[Bug 1611816] Re: pam_cifscreds.so not supplied in package
Andreas Hasenack
andreas at canonical.com
Tue Apr 25 17:53:07 UTC 2017
Verification for yakkety amd64:
package from proposed:
Version table:
*** 2:6.5-2ubuntu2 500
500 http://br.archive.ubuntu.com/ubuntu yakkety-proposed/main amd64 Packages
PAM module is installed:
root at 15-89:~# ll /lib/x86_64-linux-gnu/security/pam_cifscreds.so
-rw-r--r-- 1 root root 14176 Feb 28 21:58 /lib/x86_64-linux-gnu/security/pam_cifscreds.so
/etc/pam.d/login file modified to include pam_keyinit and pam_cifscreds: http://pastebin.ubuntu.com/24455401/
Mounted a samba share as root and connecting user "andreas" with the multiuser option:
root at 15-89:~# mount -t cifs //ds216.lowtech/downloads /downloads -o username=andreas,multiuser
Password for andreas@//ds216.lowtech/downloads: ************************
root at 15-89:~# ll /downloads/
total 414032
drwxrwxrwx 1 root root 0 Apr 20 20:23 ./
drwxr-xr-x 25 root root 4096 Apr 25 17:33 ../
drwxr-xr-x 1 1026 users 0 Aug 14 2016 humblebundle/
drwxr-xr-x 1 1026 users 0 Aug 18 2016 isos/
-rw-r--r-- 1 1026 users 265777840 Sep 9 2014 KSP_demo_linux.zip
(...)
Verified user ubuntu cannot see that:
root at 15-89:~# sudo -u ubuntu -H ls -l /downloads/
ls: cannot access '/downloads/': Permission denied
Switch to a terminal and login as ubuntu, using the same password that the ubuntu user has on the samba share:
15-89 login: ubuntu
Password:
Last login: Tue Apr 25 17:34:30 UTC 2017 from 10.0.5.1 on pts/1
Welcome to Ubuntu 16.10 (GNU/Linux 4.8.0-49-generic x86_64)
(...)
Verify we have a cifs logon key in the kernel keyring:
ubuntu at 15-89:~$ keyctl show
Session Keyring
595619243 --alswrv 1000 1000 keyring: _ses
525246747 --alswrv 1000 65534 \_ keyring: _uid.1000
470618469 ----sw-v 0 0 \_ logon: cifs:a:10.10.222.255
And we can see the /downloads share now:
ubuntu at 15-89:~$ ls -lah /downloads/
total 405M
dr-xr-xr-x 1 root root 0 Apr 20 20:23 .
drwxr-xr-x 25 root root 4.0K Apr 25 17:33 ..
drwxr-xr-x 1 1026 users 0 Aug 14 2016 humblebundle
drwxr-xr-x 1 1026 users 0 Aug 18 2016 isos
-rw-r--r-- 1 1026 users 254M Sep 9 2014 KSP_demo_linux.zip
(...)
Meanwhile, /var/log/syslog has this to say:
Apr 25 17:34:46 15-89 login[1237]: pam_cifscreds(login:auth): password stored
Apr 25 17:34:46 15-89 login[1237]: pam_keyinit(login:session): OPEN 1
Apr 25 17:34:46 15-89 login[1237]: pam_keyinit(login:session): UID:1000 [0] GID:1000 [0]
Apr 25 17:34:46 15-89 login[1237]: pam_keyinit(login:session): GET SESSION = 993549428
Apr 25 17:34:46 15-89 login[1237]: pam_keyinit(login:session): GET SESSION = 993549428
Apr 25 17:34:46 15-89 login[1237]: pam_keyinit(login:session): JOIN = 595619243
And /var/log/auth.log:
Apr 25 17:34:46 15-89 login[1237]: pam_cifscreds(login:session): credential key for \\10.10.222.255\ubuntu added
** Tags added: verification-done-yakkety
** Tags removed: verification-needed
--
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to cifs-utils in Ubuntu.
https://bugs.launchpad.net/bugs/1611816
Title:
pam_cifscreds.so not supplied in package
Status in cifs-utils package in Ubuntu:
Fix Released
Status in cifs-utils source package in Xenial:
Fix Committed
Status in cifs-utils source package in Yakkety:
Fix Committed
Status in cifs-utils source package in Zesty:
Fix Released
Status in cifs-utils package in Debian:
Fix Released
Bug description:
The cifs-utils source package contains the pam_cifscreds.so PAM
module; however, this is not built and supplied in a resulting binary
package. This is necessary functionality for our local managed
deployment.
We have worked around this issue by building our own patched version
of the package; however, this is liable to be clobbered by any future
upstream updates. Hence, it would be valuable if our modifications, or
some variant of them, could be adopted upstream.
The changes required are minimal; simply add libpam0g-dev to Build-
Depends, and add some appropriate flags to ./configure in debian/rules
to ensure the requisite library is built and installed in the correct
location.
See attached patch.
## SRU Justification
[Impact]
As David has found, users are currently unable to use the cifscreds
PAM module to unlock credentials at login because existing package
doesn't compile the module along with the rest of the package.
Davids patch adds libpam-0g-dev to the Build depends, and amends the
debian rules file so that the PAM module is built along with the rest
of the application and installed into the correct location.
I'm requesting this to be backported to the existing releases, this change is a
feature which is highly desired in managed deployments, the changes are minimal and as this patch only adds functionality and is largely unobtrusive I see no reason for the Ubuntu community to benefit from its inclusion considering the regression potential is minimal.
This feature has been added to Zesty already as part of the merge done
in LP: #1660372.
[Test Case]
Install the package and check for the existance of the PAM module at:
/lib/x86_64-linux-gnu/security/pam_cifscreds.so
At present this file is missing as it isn't compiled along with the
rest of the package.
[Regression Potential]
I've been testing this myself on a number of systems and have
discovered no issues as yet, with this patch the supplied module is
built and placed into the correct location, as is the manpage, and
both perform as intended.
This change has an overall low chance of regression as it's only
adding functionality should already be there.
The only regression I could think of is that for some reason the patch
could result in some of the other binaries being linked against PAM
(and potentially have their behavior changed) as a result of the
addition of PAM, but I find this extremely unlikely, and I have
verified that PAM isn't linked to except for pam_cifscreds.so so I
find the possibility of this happening negligible.
Documentation for the feature is provided as a manpage and is
distributed along with the updated package.
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/cifs-utils/+bug/1611816/+subscriptions
More information about the foundations-bugs
mailing list