On Tue, Jan 24, 2012 at 09:56:21PM +0100, Tomas Mraz wrote:
The attached patch fixes another bug found in pam_namespace by
Anders
Blomdell. If there are processes that are running in the private
namespace left after the pam_session_close() is called, they will see
the original polyinstantiated directories contents as the bind mounts
will be unmounted (at least for directories that are not currently in
use by the processes). There is actually no need to do the unmounts. It
would be useful only in case there are multiple pam_open/close_session
calls called in sequence from a single process. I do not even know of
any service that would do this, because it is not fully supported by
other modules as well (the state of the process might be quite different
from the original state before the first pam_open_session call). However
I kept the unmounting code and call it only when unmount_on_close option
is used.
OK to commit?
OK for me.
P.S. NAMESPACE_PROTECT_DATA seems to be unused:
pam_namespace$ git grep NAMESPACE_PROTECT_DATA
pam_namespace.c: } else if (pam_set_data(idata->pamh, NAMESPACE_PROTECT_DATA,
idata->protect_dirs,
pam_namespace.c: pam_set_data(idata->pamh, NAMESPACE_PROTECT_DATA, NULL, NULL);
pam_namespace.c: pam_set_data(idata.pamh, NAMESPACE_PROTECT_DATA, NULL, NULL);
pam_namespace.h:#define NAMESPACE_PROTECT_DATA "pam_namespace:protect_data"
I see no pam_get_data() calls with NAMESPACE_PROTECT_DATA argument.
--
ldv