b39569222b
Strongly inspired by the forgejo counterpart[1], for the following
reasons:
* The feature is broken with the current module and crashes on
authentication with the following stacktrace (with a PAM service
`gitea` added):
server # Stack trace of thread 1008:
server # #0 0x00007f3116917dfb __nptl_setxid (libc.so.6 + 0x8ddfb)
server # #1 0x00007f3116980ae6 setuid (libc.so.6 + 0xf6ae6)
server # #2 0x00007f30cc80f420 _unix_run_helper_binary (pam_unix.so + 0x5420)
server # #3 0x00007f30cc8108c9 _unix_verify_password (pam_unix.so + 0x68c9)
server # #4 0x00007f30cc80e1b5 pam_sm_authenticate (pam_unix.so + 0x41b5)
server # #5 0x00007f3116a84e5b _pam_dispatch (libpam.so.0 + 0x3e5b)
server # #6 0x00007f3116a846a3 pam_authenticate (libpam.so.0 + 0x36a3)
server # #7 0x00000000029b1e7a n/a (.gitea-wrapped + 0x25b1e7a)
server # #8 0x000000000047c7e4 n/a (.gitea-wrapped + 0x7c7e4)
server # ELF object binary architecture: AMD x86-64
server #
server # [ 42.420827] gitea[897]: pam_unix(gitea:auth): unix_chkpwd abnormal exit: 159
server # [ 42.423142] gitea[897]: pam_unix(gitea:auth): authentication failure; logname= uid=998 euid=998 tty= ruser= rhost= user=snenskek
It only worked after turning off multiple sandbox settings and adding
`shadow` as supplementary group to `gitea.service`.
I'm not willing to maintain additional multiple sandbox settings for
different features, especially given that it was probably not used for
quite a long time:
* There was no PR or bugreport about sandboxing issues related to
PAM.
* Ever since the module exists, it used the user `gitea`, i.e. it had
never read-access to `/etc/shadow`.
* Upstream has it disabled by default[2].
If somebody really needs it, it can still be brought back by an overlay
updating `tags` accordingly and modifying the systemd service config.
[1]
|
||
|---|---|---|
| .. | ||
| gickup | ||
| gifgen | ||
| gifsicle | ||
| girouette | ||
| gist | ||
| git-agecrypt | ||
| git-autoshare | ||
| git-backup-go | ||
| git-codeowners | ||
| git-fixup | ||
| git-gamble | ||
| git-get | ||
| git-gr | ||
| git-igitt | ||
| git-instafix | ||
| git-my | ||
| git-pw | ||
| git-releaser | ||
| git-run | ||
| git-spice | ||
| git-standup | ||
| git-together | ||
| git-toolbelt | ||
| git-upstream | ||
| gitbutler | ||
| gitcs | ||
| gitea | ||
| gitg | ||
| githooks | ||
| github-desktop | ||
| github-runner | ||
| gitlab-ci-local | ||
| gitlab-release-cli | ||
| gitlab-runner | ||
| gitmoji-cli | ||
| gitprompt-rs | ||
| gittuf | ||
| gitu | ||
| gitui | ||
| gitversion | ||