dropping pam support

[williamh]

Hi All,

I'm hearing from some Gentoo developers that we should look into possibly removing pam support from openrc (there really isn't a reason to have it).

So, I would like to know what people think. Are you using the PAM support in OpenRC? Would it break your systems if we drop it?

I don't know what pam does for us myself, so please speak up. :-)

Thanks,

William

[cromerc]

Artix Linux is compiled with and using PAM support. It is hard to say if it would break anything or not if removed since it will depend on the end users. If they are using any services that require PAM authentication it could cause issues by removing it. The biggest issue is not just the OpenRC scripts in our repos. We are Arch Linux compatible and there are various OpenRC scripts in the AUR and we have no way of knowing which services might/will break if PAM support gets removed since we don't maintain the AUR.

[cromerc]

Forgot to ask, but what is the reason the gentoo developers are saying that there isn't any reason to have it?

[robbat2]

OpenRC should continue to ship pam support, but it should be OPTIONAL, for the distros that don't use pam.

Further, here's the history on the gentoo-specific content of the pam files for openrc:
https://gitweb.gentoo.org/repo/gentoo/historical.git/commit/sys-apps/openrc/files/start-stop-daemon.pam?id=3773e933a10e4def1a31db4540afb398b8b9a3a4
https://bugs.gentoo.org/365149
https://bugs.gentoo.org/386623

session         optional        pam_loginuid.so
session		required	pam_limits.so
session		required	pam_env.so
session		required	pam_unix.so

pam_loginuid -> set the loginuid process attribute
pam_limits -> use the loginuid data to set the limits
pam_env -> update the env possibly using loginuid, /etc/security/pam_env.conf here is more important than the base environment.
pam_unix -> in this case it only does logging, so could be omitted

[williamh]

All,

A lot of this conversation came out of discussing this bug. I am not sure we are going to drop pam support yet, I do, however, want to get information on whether it is being used and how.

[williamh]

Ok, it is fine with me to continue shipping it. it is optional anyway in OpenRC.