pam: adding support to manage pam modules; pam_access and pam_faillock

[danlavu]

No description provided.

[danlavu]

I'm not sure why there is an error here.

lint: exit 1 (5.50 seconds) /home/runner/work/sssd-test-framework/sssd-test-framework> python -I -m pip install jc pytest 'pytest-mh>=1.0.5' python-ldap pid=2952
lint: FAIL ✖ in 9.73 seconds

Tested locally against
jc 1.23.2
pytest-mh 1.0.5
python-ldap 3.4.3

[pbrezina]

Hi, 3.x version currently fails due to ParallelSSH/ssh2-python#194

[pbrezina]

Hi, I'm not sure in what state of draft you are. In general, it looks good.

I think both config_set and config_delete should behave the same, that is: either build command and execute it using config_write or call augeas immediately.

[ikerexxe]

LGTM!

[pbrezina]

This #31 (review) still stands.

[danlavu]

This #31 (review) still stands.

Okay, I see the misunderstanding. The augeas tree is modified and is not written until save is issued. Knowing this, does it change anything, or do you want me to update the functions to build the commands still?

[pbrezina]

This #31 (review) still stands.

Okay, I see the misunderstanding. The augeas tree is modified and is not written until save is issued. Knowing this, does it change anything, or do you want me to update the functions to build the commands still?

It doesn't change anything. Imagine:

pam.access.config_set("a")
pam.access.config_delete("a")
pam.access.config_write()

config_delete will be ignored and a will be written. It is confusing. Let these methods be used in the same way, either require config_write() for both operations or remove it.

In this case, you are already allowing to set multiple values with single call to config_set, so we do not have to postpone the write operation for performance. Therefore I would personally remove it for simplicity. But if you want to keep it, config_delete should just add the command to self.cmd instead of writing to the file immediately.

[danlavu]

config_write() removed, note --autosave is used in config_delete but cannot be used in config_set because all nodes have to be defined before it can saved, but when deleting only a branch needs to be specified.

[pbrezina]

Thank you, it looks great!

Two more nitpicks - setup_when_used should get a return value so mypy can check this method as well (it omits it without type hints). I recently got a warning about this in pytest-mh, not sure why the warning is not visible here. But the return type should definitely be there.

Feel free to merge it once you do this change an CI (3.10) is green.