Clean up root access #228
Merged
Clean up root access #228
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
See QubesOS/qubes-issues#5799. Use an option to agetty: https://wiki.archlinux.org/index.php/Getty#Automatic_login_to_virtual_console The --login-pause causes agetty to wait for Enter key. This is important, because otherwise the root session prevents systemd from shutting down, and probably causes other side effect.
See QubesOS/qubes-issues#5799. Undo the change to empty password previously performed by that package.
Codecov Report
@@ Coverage Diff @@
## master #228 +/- ##
=======================================
Coverage 72.65% 72.65%
=======================================
Files 3 3
Lines 512 512
=======================================
Hits 372 372
Misses 140 140 Continue to review full report at Codecov.
|
Instead of the old workaround that replaces the whole PAM config, use Debian's framework (pam-configs) to add a rule for su. Enable it for users in qubes group only. PAM Config framework documentation: https://wiki.ubuntu.com/PAMConfigFrameworkSpec Issue: QubesOS/qubes-issues#5799 Original PR this change is based on: QubesOS#171
In Red Hat based distributions, there is no pam-configs like mechanism (authselect seems too heavy and is not configured by default), so instead, we replace the PAM file. Enable su for users in the qubes group, same as in the Debian package.
marmarek
approved these changes
May 9, 2020
This was referenced May 25, 2020
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
See QubesOS/qubes-issues#5799.