#906752 sudo: /etc/pam.d/sudo doesn't create a new keyring session

Package:
sudo
Source:
sudo
Description:
Provide limited super user privileges to specific users
Submitter:
Simon Ruggier
Date:
2022-07-05 16:09:05 UTC
Severity:
normal
Tags:
#906752#5
Date:
2018-08-20 16:45:29 UTC
From:
To:
Dear Maintainer,

sudo's pam config doesn't create a new keyring session for the processes
it spawns. This leads to problems with programs that try to add things
to the keyring, because they try to modify the user's keyring, which
even root doesn't have permission to do. An example of this was
mentioned in this previous bug:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758788#45

It turns out that this works when logged in as root via SSH because this
line in `/etc/pam.d/sshd` sets up a new session keyring for the root
user:


The same line is also present in `/etc/pam.d/runuser-l`, so I've been
working around this problem by running cryptdisks_start via `sudo
runuser -l`, as in:
so on'


Given that it's not useful for a process running on the root user to try to
manipulate the user's session keyring, I think it would make sense for
/etc/pam.d/sudo to force the creation of a new one, or at least for `sudo
-i` to force the creation of a new one via a `/etc/pam.d/sudo-i` config
file, similar to `runuser -l`.

Thanks,
Simon

#906752#16
Date:
2021-02-27 17:38:00 UTC
From:
To:
The pam_keyring(8) manpage advises against adding pam_keyinit

,----
| This module should not, generally, be invoked by programs like su,
| since it is usually desirable for the key set to percolate through to
| the alternate context. The keys have their own permissions system to
| manage this.
`----

However, there's no mentioning of the issue described here.

For what it's worth, RHEL/CentOS 7 ships an /etc/pam.d/sudo which
contains a line.

,----
| session    optional     pam_keyinit.so revoke
`----

and they also seem to have different intended behavior for interactive
usage – there's a separate /etc/pam.d/sudo-i which contains

,----
| session    optional     pam_keyinit.so force revoke
`----

Cheers,
-Hilko

#906752#21
Date:
2022-02-02 11:44:44 UTC
From:
To:
X-Debbugs-CC: vorlon@debian.org
thanks

So we need to make up our minds whether to follow up the pam_keyinit
maintainers or Red Hat. Maybe the PAM maintainer can comment here?

Greetings
Marc

#906752#24
Date:
2022-02-02 11:44:44 UTC
From:
To:
X-Debbugs-CC: vorlon@debian.org
thanks

So we need to make up our minds whether to follow up the pam_keyinit
maintainers or Red Hat. Maybe the PAM maintainer can comment here?

Greetings
Marc

#906752#29
Date:
2022-02-05 20:28:35 UTC
From:
To:
I guess this is supposed to be pam_keyinit(8) since I do find the text
there.

I would suggest consulting the maintainers of other packages that currently
ship references to pam_keyinit and try to get a consensus with them.  For
example, /etc/pam.d/su-l does reference pam_keyinit in Debian, which seems
like it directly contradicts the above manpage but addresses this exact
issue.  I believe debian-devel is the appropriate for venue for such a
discussion.

#906752#32
Date:
2022-02-05 20:28:35 UTC
From:
To:
I guess this is supposed to be pam_keyinit(8) since I do find the text
there.

I would suggest consulting the maintainers of other packages that currently
ship references to pam_keyinit and try to get a consensus with them.  For
example, /etc/pam.d/su-l does reference pam_keyinit in Debian, which seems
like it directly contradicts the above manpage but addresses this exact
issue.  I believe debian-devel is the appropriate for venue for such a
discussion.

#906752#37
Date:
2022-02-06 11:34:17 UTC
From:
To:
Dear Util-Linux Maintainers,

in sudo, we have currently the situation whether to add calls to
pam_keyinit in our pam configuration files. There is quite a number of
packages doing this, but the pam_keyinit documentation advises "programs
like su" against doing so. However, in Debian, /etc/pam.d/su-l
references pam_keyinit, while /etc/pam.d/su doesn't. On the other hand,
doas doesnt seem to reference pam_keyinit at all.

If sudo goes the way to mimic what su does, we would reference
pam_keyinit in /etc/pam.d/sudo-i which is our form of giving the caller
an interactive session, but not in /etc/pam.d/sudo.

May I ask for you rationale to do things the way you did them for su and
pam_keyinit? Your insights might help us to take a wise decision for
sudo.

Thanks for your help, which is greatly appreciated.

Greetings
Marc

#906752#42
Date:
2022-02-06 16:09:10 UTC
From:
To:
Hello Marc,
Hello Andreas (added to CC:),

* Marc Haber <mh+debian-packages@zugschlus.de> [220206 12:36]:

I do not know why this was done for su-l and not su. My speculation
would be that we have inherited the su-l PAM config from Fedora, and
the su PAM config from src:shadow before 2018. Maybe the distinction
is an accident.

Andreas, you worked on the su takeover from src:shadow. Do you have
insights to share?

I will note that our runuser(-l) PAM config also mirrors this:

runuser:
session              optional        pam_keyinit.so revoke

runuser-l:
session            optional        pam_keyinit.so force revoke


It would appear to me that keyutils and pam_keyinit, and most of the
util-linux PAM config originate in Fedora(/RH). The Fedora folks
are probably the ones to ask how all of this is supposed to work.

Sorry that I cannot add much useful info here.

Chris

#906752#47
Date:
2022-03-14 14:23:53 UTC
From:
To:
Control: tags -1 help
Control: tags 939357 help
thanks

For the record, the Red Hat maintainer of pam_keyinit didn't bother
replying. So the next thing is to follow Steve's advice to reach out to
-devel to get consensus. I have currently other things on my plate and
would not like to open just another issue here, I am therefore
postponing this on my personal schedule.

Other team members or people who want to help, please reach out to
-devel at will. Thanks in advance.

Greetings
Marc

#906752#52
Date:
2022-03-14 14:23:53 UTC
From:
To:
Control: tags -1 help
Control: tags 939357 help
thanks

For the record, the Red Hat maintainer of pam_keyinit didn't bother
replying. So the next thing is to follow Steve's advice to reach out to
-devel to get consensus. I have currently other things on my plate and
would not like to open just another issue here, I am therefore
postponing this on my personal schedule.

Other team members or people who want to help, please reach out to
-devel at will. Thanks in advance.

Greetings
Marc

#906752#57
Date:
2022-07-05 13:17:19 UTC
From:
To:
Hi Chris,

thanks for trying to help back in February.

I'm coming back to this after being busy with other things.

Andreas, did you read this?

Chris,
Can you give me a pointer to whom in Fedora I'm supposed to reach out?

Greetings
Marc

#906752#60
Date:
2022-07-05 13:17:19 UTC
From:
To:
Hi Chris,

thanks for trying to help back in February.

I'm coming back to this after being busy with other things.

Andreas, did you read this?

Chris,
Can you give me a pointer to whom in Fedora I'm supposed to reach out?

Greetings
Marc

#906752#65
Date:
2022-07-05 16:00:32 UTC
From:
To:
Hello Marc, Chris,

Sorry for my late (and possibly pretty lame) reply.
[...]
[...]

I have a very bad memory which is why I try to write down as much as
possible in bug reports, commit messages, etc to leave hints for my
future self. I need to dig to figure things out myself, but I think the
above description is basically correct.

(If there's any message from me that you have a problem with
interpretting what it means, please point me to it and I can try to
interpret my own bad grammar to figure out what I tried to write.)

Regards,
Andreas Henriksson

#906752#68
Date:
2022-07-05 16:00:32 UTC
From:
To:
Hello Marc, Chris,

Sorry for my late (and possibly pretty lame) reply.
[...]
[...]

I have a very bad memory which is why I try to write down as much as
possible in bug reports, commit messages, etc to leave hints for my
future self. I need to dig to figure things out myself, but I think the
above description is basically correct.

(If there's any message from me that you have a problem with
interpretting what it means, please point me to it and I can try to
interpret my own bad grammar to figure out what I tried to write.)

Regards,
Andreas Henriksson