[26732] in Source-Commits
/svn/athena r25716 - trunk/debathena/config/reactivate/debian
daemon@ATHENA.MIT.EDU (Jonathan D Reed)
Wed Aug 8 14:35:56 2012
Date: Wed, 8 Aug 2012 14:35:54 -0400
From: Jonathan D Reed <jdreed@MIT.EDU>
Message-Id: <201208081835.q78IZsjE013001@drugstore.mit.edu>
To: source-commits@MIT.EDU
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Author: jdreed
Date: 2012-08-08 14:35:54 -0400 (Wed, 08 Aug 2012)
New Revision: 25716
Added:
trunk/debathena/config/reactivate/debian/transform_schroot_pam
Modified:
trunk/debathena/config/reactivate/debian/changelog
trunk/debathena/config/reactivate/debian/reactivate
trunk/debathena/config/reactivate/debian/rules
trunk/debathena/config/reactivate/debian/snapshot-run
Log:
In reactivate:
* Yes, the pam_env hack is still needed.
Modified: trunk/debathena/config/reactivate/debian/changelog
===================================================================
--- trunk/debathena/config/reactivate/debian/changelog 2012-08-08 16:27:20 UTC (rev 25715)
+++ trunk/debathena/config/reactivate/debian/changelog 2012-08-08 18:35:54 UTC (rev 25716)
@@ -1,3 +1,9 @@
+debathena-reactivate (2.0.39) unstable; urgency=low
+
+ * Yes, the pam_env hack is still needed.
+
+ -- Jonathan Reed <jdreed@mit.edu> Wed, 08 Aug 2012 14:33:36 -0400
+
debathena-reactivate (2.0.38) unstable; urgency=low
* Ship a session wrapper that runs initgroups(3) and stop abusing sudo
Modified: trunk/debathena/config/reactivate/debian/reactivate
===================================================================
--- trunk/debathena/config/reactivate/debian/reactivate 2012-08-08 16:27:20 UTC (rev 25715)
+++ trunk/debathena/config/reactivate/debian/reactivate 2012-08-08 18:35:54 UTC (rev 25716)
@@ -45,6 +45,12 @@
fi
fi
+# Cleanup our ticketenv hack
+# Make sure nobody was evil
+chattr -f -i /tmp/ticketenv || :
+# If you made a directory and stored files there, too bad
+rm -rf /tmp/ticketenv
+
# If either we or an updated package wanted to reboot, now is a
# perfectly good time to do so -- auto-update is inhibited during a
# login session.
Modified: trunk/debathena/config/reactivate/debian/rules
===================================================================
--- trunk/debathena/config/reactivate/debian/rules 2012-08-08 16:27:20 UTC (rev 25715)
+++ trunk/debathena/config/reactivate/debian/rules 2012-08-08 18:35:54 UTC (rev 25716)
@@ -7,6 +7,7 @@
DEB_TRANSFORM_FILES_debathena-reactivate += \
/etc/pam.d/su.debathena \
/etc/default/schroot.debathena \
+ /etc/pam.d/schroot.debathena \
/etc/dbus-1/system.conf.debathena
DEB_REMOVE_FILES_debathena-reactivate += \
/etc/xdg/autostart/jockey-gtk.desktop \
@@ -14,11 +15,13 @@
/etc/xdg/autostart/nm-applet.desktop
DEB_UNDIVERT_FILES_debathena-reactivate += \
- /etc/pam.d/schroot.debathena \
/etc/pam.d/sudo.debathena
+DEB_UNDIVERT_VERSION_/etc/pam.d/sudo.debathena = 1.25.2~
DEB_TRANSFORM_SCRIPT_/etc/default/schroot.debathena = \
debian/transform_schroot_defaults
+DEB_TRANSFORM_SCRIPT_/etc/pam.d/schroot.debathena = \
+ debian/transform_schroot_pam
# The wrapper does in fact need to be setuid
DEB_DH_FIXPERMS_ARGS = -X/usr/lib/debathena-reactivate/session-wrapper
Modified: trunk/debathena/config/reactivate/debian/snapshot-run
===================================================================
--- trunk/debathena/config/reactivate/debian/snapshot-run 2012-08-08 16:27:20 UTC (rev 25715)
+++ trunk/debathena/config/reactivate/debian/snapshot-run 2012-08-08 18:35:54 UTC (rev 25716)
@@ -25,6 +25,10 @@
cleanup() {
# Teardown
+ # Remove file from above.
+ # (This also gets nuked in reactivate, but be paranoid)
+ rm -f /tmp/ticketenv
+
for daemon in $daemons; do
schr invoke-rc.d "$daemon" stop || [ $? = 100 ]
done
@@ -59,10 +63,15 @@
# Run the session
#
-# We used to wrap the target command in sudo to run initgroups, now we
-# ship our own wrapper that does that. Regardless, this runs /after/
-# being chrooted, which puts users back in the groups we added them to
+# We wrap the target command in sudo because it runs initgroups(3)
+# /after/ being chrooted, which puts users back in the groups we
+# added them to
+# Workaround for stupidity, see #928 for details
+# Remove this once we're running pam-afs-session 2.4
+# Run this inside the "set -e" block so it'll fail if necessary
+echo "KRB5CCNAME=$KRB5CCNAME" >| /tmp/ticketenv
+
set +e
cd
Copied: trunk/debathena/config/reactivate/debian/transform_schroot_pam (from rev 25682, trunk/debathena/config/reactivate/debian/transform_schroot_pam)
===================================================================
--- trunk/debathena/config/reactivate/debian/transform_schroot_pam (rev 0)
+++ trunk/debathena/config/reactivate/debian/transform_schroot_pam 2012-08-08 18:35:54 UTC (rev 25716)
@@ -0,0 +1,9 @@
+#!/usr/bin/perl -0p
+# -*- mode: fundamental; -*-
+
+print <<EOF;
+# Added by debathena-reactivate
+auth required pam_env.so readenv=1 envfile=/tmp/ticketenv
+EOF
+print;
+exit 0;
