Messages in this thread | | | From | ross@lug ... | Date | Sat, 8 Jan 2005 11:56:57 -0500 | Subject | Re: [PATCH] [request for inclusion] Realtime LSM |
| |
On Sat, Jan 08, 2005 at 12:12:59AM -0600, Jack O'Quin wrote: > I find it hard to understand why some of you think PAM is an adequate > solution. As currently deployed, it is poorly documented and nearly > impossible for non-experts to administer securely. On my Debian woody > system, when I login from the console I get one fairly sensible set of > ulimit values, but from gdm I get a much more permissive set (with > ulimited mlocking, BTW). Apparently, this is because the `gdm' PAM > config includes `session required pam_limits.so' but the system comes > with an empty /etc/security/limits.conf. I'm just guessing about that > because I can't find any decent documentation for any of this crap. > > Remember, if something is difficult to administer, it's *not* secure.
Not to mention that not everyone chooses to use PAM for precisely this reason. Slackware has never included PAM and probably never will. My audio workstation has worked swell with the 2.4+caps solution and the 2.6+LSM solution. PAM would break me ::-(
-- Ross Vandegrift ross@lug.udel.edu
"The good Christian should beware of mathematicians, and all those who make empty prophecies. The danger already exists that the mathematicians have made a covenant with the devil to darken the spirit and to confine man in the bonds of Hell." --St. Augustine, De Genesi ad Litteram, Book II, xviii, 37 - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |