From owner-freebsd-stable@FreeBSD.ORG Thu Sep 25 15:18:55 2014 Return-Path: Delivered-To: freebsd-stable@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 3C4031D6; Thu, 25 Sep 2014 15:18:55 +0000 (UTC) Received: from mail-we0-x22c.google.com (mail-we0-x22c.google.com [IPv6:2a00:1450:400c:c03::22c]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 7F9D0C6F; Thu, 25 Sep 2014 15:18:54 +0000 (UTC) Received: by mail-we0-f172.google.com with SMTP id p10so7726225wes.3 for ; Thu, 25 Sep 2014 08:18:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=tzaEC8rLVtzt1FitEMCZM6v6M8j+uuohCNeBig26c+E=; b=y7UuebIHS1E9NEnFKdVjk40kt2NW2IPg3Ei2g8SmSmxR8aq/Tfp+m6HbnpFG+UGGM2 QEsIp1URp4+fMEFPEMFIkshucIQIVIOAlfEkophXtsA+PK7g7uZMHjAXDh+q9d8xBh8y RZfXm48md1EnVG3chX6DEXxH3NVxiBrO0/Gies0qsjgHLJO5KAu37GNLE9EOyvJZv7yA kTbsqjpi4OEaxTXImlOCFk7MiZEzl+s/vBczYvs3ggO17gHPMrJEwGcuXIh/w8mXV/wT pvWH2Wh8AEv1l83DlCFzwCBfeZXw/3lgVmlHEq6ZajC1i584vAe1+59ntH3Ky2jzD3h9 3u+g== MIME-Version: 1.0 X-Received: by 10.180.74.227 with SMTP id x3mr19699764wiv.80.1411658332726; Thu, 25 Sep 2014 08:18:52 -0700 (PDT) Received: by 10.217.127.70 with HTTP; Thu, 25 Sep 2014 08:18:52 -0700 (PDT) In-Reply-To: <542430EB.1040804@tundraware.com> References: <3DA4B666-AB81-4F25-ABAE-DDC163F41E20@FreeBSD.org> <542430EB.1040804@tundraware.com> Date: Thu, 25 Sep 2014 11:18:52 -0400 Message-ID: Subject: Re: 10.1 BETA2 World - Breaks saslauthd From: Brandon Allbery To: Tim Daneliuk Content-Type: text/plain; charset=UTF-8 X-Content-Filtered-By: Mailman/MimeDel 2.1.18-1 Cc: FreeBSD stable , Dimitry Andric , =?UTF-8?Q?Dag=2DErling_Sm=C3=B8rgrav?= X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Sep 2014 15:18:55 -0000 On Thu, Sep 25, 2014 at 11:12 AM, Tim Daneliuk wrote: > Yup, that worked. Thanks! Now, for those of us less than smart, could > you explain why this was necessary in context of that MFC? > To me the implication is that before the MFC, PAM had a potentially quite severe security issue involving either incorrect fallback to a default configuration or not correctly handling error returns from a PAM stack --- either of which could result in unauthorized users being permitted access. -- brandon s allbery kf8nh sine nomine associates allbery.b@gmail.com ballbery@sinenomine.net unix, openafs, kerberos, infrastructure, xmonad http://sinenomine.net