summaryrefslogtreecommitdiff
path: root/modules/pam_xauth/pam_xauth.8
diff options
context:
space:
mode:
authorSteve Langasek <steve.langasek@ubuntu.com>2019-01-03 21:22:21 -0800
committerSteve Langasek <steve.langasek@ubuntu.com>2019-01-03 21:22:45 -0800
commit795badba7f95e737f979917859cd32c9bd47bcad (patch)
tree212a6a00baa11e9d0ca7bc27b12420d1dce6f07c /modules/pam_xauth/pam_xauth.8
parentc55c14c5c6762139ec6695d84ea0e2e917da5264 (diff)
parentba315ae8effdcad591608c99452dad05c4cf20ab (diff)
New upstream version 1.1.8
Diffstat (limited to 'modules/pam_xauth/pam_xauth.8')
-rw-r--r--modules/pam_xauth/pam_xauth.8210
1 files changed, 27 insertions, 183 deletions
diff --git a/modules/pam_xauth/pam_xauth.8 b/modules/pam_xauth/pam_xauth.8
index 8f20d15a..ae56dbe7 100644
--- a/modules/pam_xauth/pam_xauth.8
+++ b/modules/pam_xauth/pam_xauth.8
@@ -1,161 +1,22 @@
+'\" t
.\" Title: pam_xauth
.\" Author: [see the "AUTHOR" section]
-.\" Generator: DocBook XSL Stylesheets v1.74.0 <http://docbook.sf.net/>
-.\" Date: 10/27/2010
+.\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
+.\" Date: 09/19/2013
.\" Manual: Linux-PAM Manual
.\" Source: Linux-PAM Manual
.\" Language: English
.\"
-.TH "PAM_XAUTH" "8" "10/27/2010" "Linux-PAM Manual" "Linux\-PAM Manual"
+.TH "PAM_XAUTH" "8" "09/19/2013" "Linux-PAM Manual" "Linux\-PAM Manual"
.\" -----------------------------------------------------------------
-.\" * (re)Define some macros
+.\" * Define some portability stuff
.\" -----------------------------------------------------------------
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.\" toupper - uppercase a string (locale-aware)
+.\" http://bugs.debian.org/507673
+.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.de toupper
-.tr aAbBcCdDeEfFgGhHiIjJkKlLmMnNoOpPqQrRsStTuUvVwWxXyYzZ
-\\$*
-.tr aabbccddeeffgghhiijjkkllmmnnooppqqrrssttuuvvwwxxyyzz
-..
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.\" SH-xref - format a cross-reference to an SH section
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.de SH-xref
-.ie n \{\
-.\}
-.toupper \\$*
-.el \{\
-\\$*
-.\}
-..
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.\" SH - level-one heading that works better for non-TTY output
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.de1 SH
-.\" put an extra blank line of space above the head in non-TTY output
-.if t \{\
-.sp 1
-.\}
-.sp \\n[PD]u
-.nr an-level 1
-.set-an-margin
-.nr an-prevailing-indent \\n[IN]
-.fi
-.in \\n[an-margin]u
-.ti 0
-.HTML-TAG ".NH \\n[an-level]"
-.it 1 an-trap
-.nr an-no-space-flag 1
-.nr an-break-flag 1
-\." make the size of the head bigger
-.ps +3
-.ft B
-.ne (2v + 1u)
-.ie n \{\
-.\" if n (TTY output), use uppercase
-.toupper \\$*
-.\}
-.el \{\
-.nr an-break-flag 0
-.\" if not n (not TTY), use normal case (not uppercase)
-\\$1
-.in \\n[an-margin]u
-.ti 0
-.\" if not n (not TTY), put a border/line under subheading
-.sp -.6
-\l'\n(.lu'
-.\}
-..
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.\" SS - level-two heading that works better for non-TTY output
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.de1 SS
-.sp \\n[PD]u
-.nr an-level 1
-.set-an-margin
-.nr an-prevailing-indent \\n[IN]
-.fi
-.in \\n[IN]u
-.ti \\n[SN]u
-.it 1 an-trap
-.nr an-no-space-flag 1
-.nr an-break-flag 1
-.ps \\n[PS-SS]u
-\." make the size of the head bigger
-.ps +2
-.ft B
-.ne (2v + 1u)
-.if \\n[.$] \&\\$*
-..
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.\" BB/BE - put background/screen (filled box) around block of text
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.de BB
-.if t \{\
-.sp -.5
-.br
-.in +2n
-.ll -2n
-.gcolor red
-.di BX
-.\}
-..
-.de EB
-.if t \{\
-.if "\\$2"adjust-for-leading-newline" \{\
-.sp -1
-.\}
-.br
-.di
-.in
-.ll
-.gcolor
-.nr BW \\n(.lu-\\n(.i
-.nr BH \\n(dn+.5v
-.ne \\n(BHu+.5v
-.ie "\\$2"adjust-for-leading-newline" \{\
-\M[\\$1]\h'1n'\v'+.5v'\D'P \\n(BWu 0 0 \\n(BHu -\\n(BWu 0 0 -\\n(BHu'\M[]
-.\}
-.el \{\
-\M[\\$1]\h'1n'\v'-.5v'\D'P \\n(BWu 0 0 \\n(BHu -\\n(BWu 0 0 -\\n(BHu'\M[]
-.\}
-.in 0
-.sp -.5v
-.nf
-.BX
-.in
-.sp .5v
-.fi
-.\}
-..
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.\" BM/EM - put colored marker in margin next to block of text
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.de BM
-.if t \{\
-.br
-.ll -2n
-.gcolor red
-.di BX
-.\}
-..
-.de EM
-.if t \{\
-.br
-.di
-.ll
-.gcolor
-.nr BH \\n(dn
-.ne \\n(BHu
-\M[\\$1]\D'P -.75n 0 0 \\n(BHu -(\\n[.i]u - \\n(INu - .75n) 0 0 -\\n(BHu'\M[]
-.in 0
-.nf
-.BX
-.in
-.fi
-.\}
-..
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
.\" -----------------------------------------------------------------
.\" * set default formatting
.\" -----------------------------------------------------------------
@@ -166,20 +27,18 @@
.\" -----------------------------------------------------------------
.\" * MAIN CONTENT STARTS HERE *
.\" -----------------------------------------------------------------
-.SH "Name"
+.SH "NAME"
pam_xauth \- PAM module to forward xauth keys between users
-.SH "Synopsis"
-.fam C
+.SH "SYNOPSIS"
.HP \w'\fBpam_xauth\&.so\fR\ 'u
\fBpam_xauth\&.so\fR [debug] [xauthpath=\fI/path/to/xauth\fR] [systemuser=\fIUID\fR] [targetuser=\fIUID\fR]
-.fam
.SH "DESCRIPTION"
.PP
The pam_xauth PAM module is designed to forward xauth keys (sometimes referred to as "cookies") between users\&.
.PP
Without pam_xauth, when xauth is enabled and a user uses the
\fBsu\fR(1)
-command to assume another user\'s privileges, that user is no longer able to access the original user\'s X display because the new user does not have the key needed to access the display\&. pam_xauth solves the problem by forwarding the key from the user running su (the source user) to the user whose identity the source user is assuming (the target user) when the session is created, and destroying the key when the session is torn down\&.
+command to assume another user\*(Aqs privileges, that user is no longer able to access the original user\*(Aqs X display because the new user does not have the key needed to access the display\&. pam_xauth solves the problem by forwarding the key from the user running su (the source user) to the user whose identity the source user is assuming (the target user) when the session is created, and destroying the key when the session is torn down\&.
.PP
This means, for example, that when you run
\fBsu\fR(1)
@@ -190,24 +49,24 @@ xauth command or ~/\&.Xauthority files\&.
pam_xauth will only forward keys if xauth can list a key connected to the $DISPLAY environment variable\&.
.PP
Primitive access control is provided by
-\FC~/\&.xauth/export\F[]
-in the invoking user\'s home directory and
-\FC~/\&.xauth/import\F[]
-in the target user\'s home directory\&.
+~/\&.xauth/export
+in the invoking user\*(Aqs home directory and
+~/\&.xauth/import
+in the target user\*(Aqs home directory\&.
.PP
If a user has a
-\FC~/\&.xauth/import\F[]
+~/\&.xauth/import
file, the user will only receive cookies from users listed in the file\&. If there is no
-\FC~/\&.xauth/import\F[]
+~/\&.xauth/import
file, the user will accept cookies from any other user\&.
.PP
If a user has a
-\FC\&.xauth/export\F[]
+\&.xauth/export
file, the user will only forward cookies to users listed in the file\&. If there is no
-\FC~/\&.xauth/export\F[]
+~/\&.xauth/export
file, and the invoking user is not
\fBroot\fR, the user will forward cookies to any other user\&. If there is no
-\FC~/\&.xauth/export\F[]
+~/\&.xauth/export
file, and the invoking user is
\fBroot\fR, the user will
\fInot\fR
@@ -225,9 +84,9 @@ Print debug information\&.
\fBxauthpath=\fR\fB\fI/path/to/xauth\fR\fR
.RS 4
Specify the path the xauth program (it is expected in
-\FC/usr/X11R6/bin/xauth\F[],
-\FC/usr/bin/xauth\F[], or
-\FC/usr/bin/X11/xauth\F[]
+/usr/X11R6/bin/xauth,
+/usr/bin/xauth, or
+/usr/bin/X11/xauth
by default)\&.
.RE
.PP
@@ -274,30 +133,16 @@ User not known\&.
.SH "EXAMPLES"
.PP
Add the following line to
-\FC/etc/pam\&.d/su\F[]
+/etc/pam\&.d/su
to forward xauth keys between users when calling su:
.sp
.if n \{\
.RS 4
.\}
-.fam C
-.ps -1
.nf
-.if t \{\
-.sp -1
-.\}
-.BB lightgray adjust-for-leading-newline
-.sp -1
-
session optional pam_xauth\&.so
-.EB lightgray adjust-for-leading-newline
-.if t \{\
-.sp 1
-.\}
.fi
-.fam
-.ps +1
.if n \{\
.RE
.\}
@@ -319,18 +164,17 @@ as the source user to extract the key for $DISPLAY, then calls xauth as the targ
pam_xauth cannot be told to not remove the keys when the session is closed\&.
.SH "FILES"
.PP
-\FC~/\&.xauth/import\F[]
+~/\&.xauth/import
.RS 4
XXX
.RE
.PP
-\FC~/\&.xauth/export\F[]
+~/\&.xauth/export
.RS 4
XXX
.RE
.SH "SEE ALSO"
.PP
-
\fBpam.conf\fR(5),
\fBpam.d\fR(5),
\fBpam\fR(8)