From mboxrd@z Thu Jan 1 00:00:00 1970 From: =?UTF-8?B?5a6L5paH5q2m?= Subject: Re: [PATCH v2 3/7] gnu: Allow OS configurations to add PAM session modules Date: Wed, 26 Aug 2015 15:36:11 +0800 Message-ID: References: <95cd06d0b1639449fffa2ded823e54d0f26afbb6.1440062095.git.wingo@pobox.com> <87d1ybmn85.fsf@gnu.org> <87io834aup.fsf@igalia.com> <87zj1fdp3v.fsf@gnu.org> <87oahu347w.fsf@igalia.com> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:47204) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZUVFl-0001eN-Kt for guix-devel@gnu.org; Wed, 26 Aug 2015 03:36:17 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZUVFk-00039K-Iv for guix-devel@gnu.org; Wed, 26 Aug 2015 03:36:13 -0400 In-Reply-To: <87oahu347w.fsf@igalia.com> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org To: Andy Wingo Cc: Guix-devel 2015-08-26 15:21 GMT+08:00 Andy Wingo : > On Tue 25 Aug 2015 23:39, ludo@gnu.org (Ludovic Court=C3=A8s) writes: > >> Andy Wingo skribis: >> >>> On Tue 25 Aug 2015 16:55, ludo@gnu.org (Ludovic Court=C3=A8s) writes: >>> >>>> (operating-system >>>> ;; ... >>>> (pam-services (map (lambda (service) >>>> (pam-service >>>> (inherit service) >>>> (session (cons ...)))) >>>> (base-pam-services)))) >>>> >>> How would that work for other services like slim, mingetty, etc? >> >> Oh, it wouldn=E2=80=99t. >> >> Just to help me understand, could you explain the typical use case you >> have in mind? > > Sure. So right now on a Guix system you have /etc/pam.d, and it > contains configurations for all services that interact with PAM. > Notably there is "login", for console login, but also slim and lsh. > Elogind wants to know about all user sessions so it should add a > "session required /path/to/pam_elogind.so" line to all files in > /etc/pam.d. This causes login and logout to signal elogind. > > That's how I ended up adding #:additional-session-modules to all the > other services: mingetty, slim, lsh. > > I don't know what the right design is. I think ideally anything that > would log in would include some central file rather than having to > repeat the rules everywhere. Yes, we can ues 'include' in pam config, this is how the ArchLinux do it: https://projects.archlinux.org/svntogit/packages.git/tree/trunk?h=3Dpacka= ges/pambase https://projects.archlinux.org/svntogit/packages.git/tree/trunk/slim.pam?= h=3Dpackages/slim