also needed for Tru64 SIA to work in privsep. WAS: Password expirypatch plans

[Darren Tucker]

"Toni L. Harbaugh-Blackford" wrote:
> On Sun, 10 Nov 2002, Michael Steffens wrote:
>   > But in any way it requieres tunnneling PAM conversation between
>   > monitor and unprivileged child
>
> This is exactly the problem with getting Tru64 SIA to work in privsep
> mode.  SIA wants to 'talk' to the user directly over the tty that is passed
> to the auth routines.

How about allocating a pty and passing the fd's back to the slave, then
calling chauthtok or whatever in the monitor? ie:

1) Slave calls wrapped chauthtok, request passed to monitor
2) Monitor allocs pty, opens, makes controlling tty
3) Monitor passes descriptors back to slave
4) Monitor calls chauthtok / SIA / whatever
5) Slave spins copying to and from stdio and the passed fd's
6) In monitor, chauthtok returns and returns status to slave
7) Slave reads return status from monitor

No, I haven't tried this so I don't know if it will work. I don't know
if you want the monitor to have a controlling tty either.

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.