[26733] in Source-Commits
Re: /svn/athena r25716 - trunk/debathena/config/reactivate/debian
daemon@ATHENA.MIT.EDU (Benjamin Kaduk)
Wed Aug 8 14:38:13 2012
Date: Wed, 8 Aug 2012 14:38:09 -0400 (EDT)
From: Benjamin Kaduk <kaduk@MIT.EDU>
To: Jonathan D Reed <jdreed@MIT.EDU>
cc: source-commits@MIT.EDU
In-Reply-To: <201208081835.q78IZsjE013001@drugstore.mit.edu>
Message-ID: <alpine.GSO.1.10.1208081437230.22690@multics.mit.edu>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
On Wed, 8 Aug 2012, Jonathan D Reed wrote:
> Author: jdreed
> Date: 2012-08-08 14:35:54 -0400 (Wed, 08 Aug 2012)
> New Revision: 25716
>
> Added:
> trunk/debathena/config/reactivate/debian/transform_schroot_pam
> Modified:
> trunk/debathena/config/reactivate/debian/changelog
> trunk/debathena/config/reactivate/debian/reactivate
> trunk/debathena/config/reactivate/debian/rules
> trunk/debathena/config/reactivate/debian/snapshot-run
> Log:
> In reactivate:
> * Yes, the pam_env hack is still needed.
>
>
> Modified: trunk/debathena/config/reactivate/debian/changelog
> ===================================================================
> --- trunk/debathena/config/reactivate/debian/changelog 2012-08-08 16:27:20 UTC (rev 25715)
> +++ trunk/debathena/config/reactivate/debian/changelog 2012-08-08 18:35:54 UTC (rev 25716)
> @@ -1,3 +1,9 @@
> +debathena-reactivate (2.0.39) unstable; urgency=low
> +
> + * Yes, the pam_env hack is still needed.
> +
> + -- Jonathan Reed <jdreed@mit.edu> Wed, 08 Aug 2012 14:33:36 -0400
> +
> debathena-reactivate (2.0.38) unstable; urgency=low
>
> * Ship a session wrapper that runs initgroups(3) and stop abusing sudo
>
> Modified: trunk/debathena/config/reactivate/debian/reactivate
> ===================================================================
> --- trunk/debathena/config/reactivate/debian/reactivate 2012-08-08 16:27:20 UTC (rev 25715)
> +++ trunk/debathena/config/reactivate/debian/reactivate 2012-08-08 18:35:54 UTC (rev 25716)
> @@ -45,6 +45,12 @@
> fi
> fi
>
> +# Cleanup our ticketenv hack
> +# Make sure nobody was evil
> +chattr -f -i /tmp/ticketenv || :
> +# If you made a directory and stored files there, too bad
> +rm -rf /tmp/ticketenv
> +
> # If either we or an updated package wanted to reboot, now is a
> # perfectly good time to do so -- auto-update is inhibited during a
> # login session.
>
> Modified: trunk/debathena/config/reactivate/debian/rules
> ===================================================================
> --- trunk/debathena/config/reactivate/debian/rules 2012-08-08 16:27:20 UTC (rev 25715)
> +++ trunk/debathena/config/reactivate/debian/rules 2012-08-08 18:35:54 UTC (rev 25716)
> @@ -7,6 +7,7 @@
> DEB_TRANSFORM_FILES_debathena-reactivate += \
> /etc/pam.d/su.debathena \
> /etc/default/schroot.debathena \
> + /etc/pam.d/schroot.debathena \
> /etc/dbus-1/system.conf.debathena
> DEB_REMOVE_FILES_debathena-reactivate += \
> /etc/xdg/autostart/jockey-gtk.desktop \
> @@ -14,11 +15,13 @@
> /etc/xdg/autostart/nm-applet.desktop
>
> DEB_UNDIVERT_FILES_debathena-reactivate += \
> - /etc/pam.d/schroot.debathena \
> /etc/pam.d/sudo.debathena
> +DEB_UNDIVERT_VERSION_/etc/pam.d/sudo.debathena = 1.25.2~
>
> DEB_TRANSFORM_SCRIPT_/etc/default/schroot.debathena = \
> debian/transform_schroot_defaults
> +DEB_TRANSFORM_SCRIPT_/etc/pam.d/schroot.debathena = \
> + debian/transform_schroot_pam
>
> # The wrapper does in fact need to be setuid
> DEB_DH_FIXPERMS_ARGS = -X/usr/lib/debathena-reactivate/session-wrapper
>
> Modified: trunk/debathena/config/reactivate/debian/snapshot-run
> ===================================================================
> --- trunk/debathena/config/reactivate/debian/snapshot-run 2012-08-08 16:27:20 UTC (rev 25715)
> +++ trunk/debathena/config/reactivate/debian/snapshot-run 2012-08-08 18:35:54 UTC (rev 25716)
> @@ -25,6 +25,10 @@
> cleanup() {
> # Teardown
>
> + # Remove file from above.
> + # (This also gets nuked in reactivate, but be paranoid)
> + rm -f /tmp/ticketenv
> +
> for daemon in $daemons; do
> schr invoke-rc.d "$daemon" stop || [ $? = 100 ]
> done
> @@ -59,10 +63,15 @@
>
> # Run the session
> #
> -# We used to wrap the target command in sudo to run initgroups, now we
> -# ship our own wrapper that does that. Regardless, this runs /after/
> -# being chrooted, which puts users back in the groups we added them to
> +# We wrap the target command in sudo because it runs initgroups(3)
> +# /after/ being chrooted, which puts users back in the groups we
> +# added them to
This comment block is not correct, but go ahead and push this out as-is.
-Ben
>
> +# Workaround for stupidity, see #928 for details
> +# Remove this once we're running pam-afs-session 2.4
> +# Run this inside the "set -e" block so it'll fail if necessary
> +echo "KRB5CCNAME=$KRB5CCNAME" >| /tmp/ticketenv
> +
> set +e
>
> cd
>
> Copied: trunk/debathena/config/reactivate/debian/transform_schroot_pam (from rev 25682, trunk/debathena/config/reactivate/debian/transform_schroot_pam)
> ===================================================================
> --- trunk/debathena/config/reactivate/debian/transform_schroot_pam (rev 0)
> +++ trunk/debathena/config/reactivate/debian/transform_schroot_pam 2012-08-08 18:35:54 UTC (rev 25716)
> @@ -0,0 +1,9 @@
> +#!/usr/bin/perl -0p
> +# -*- mode: fundamental; -*-
> +
> +print <<EOF;
> +# Added by debathena-reactivate
> +auth required pam_env.so readenv=1 envfile=/tmp/ticketenv
> +EOF
> +print;
> +exit 0;
>
>
