Bug#734818: enable pam_keyinit by default

[Laurent Bigonville]

Le Wed, 7 May 2014 08:18:09 -0700,
Steve Langasek <vorlon at debian.org> a écrit :

> On Wed, May 07, 2014 at 10:13:02AM +0200, Laurent Bigonville wrote:
> > Le Tue, 6 May 2014 09:36:59 -0700,
> > Steve Langasek <vorlon at debian.org> a écrit :
> 
> > > On Tue, May 06, 2014 at 09:12:59AM -0700, Russ Allbery wrote:
> > > > Laurent Bigonville <bigon at debian.org> writes:
> 
> > > > > On Fedora they are using:
> 
> > > > >   session optional pam_keyinit force revoke
> 
> > > > force revoke looks good to me.  I'm not sure that force is
> > > > necessary, but it's probably a good idea in general.
> 
> > > > > As it's only available on linux architectures, I was thinking
> > > > > of adding a '-' at the beginning of the call. Do you think
> > > > > this is OK for Debian?
> 
> > > > Yes, although this is where it would be nice if this could
> > > > somehow be handled by pam-auth-update so that the PAM module
> > > > wouldn't be configured at all on systems that don't have it.
> 
> > > As discussed on IRC, we don't want this to silently fail on Linux
> > > systems because of some unrelated bug; that will just cause
> > > difficult-to-diagnose problems.  Since the module will be present
> > > on all Linux systems, it's better to ship a different pam config
> > > on Linux vs. non-Linux architectures, which can be done fairly
> > > easily without duplication using dh-exec.
> 
> > And couldn't we use the (dirty) trick we are using for pam_selinux?
> 
> Which trick are you talking about?
> 

pam_selinux is called like this in some pam services to not fail if the
module is not existing:

session [success=ok ignore=ignore module_unknown=ignore default=bad]
pam_selinux.so open