blob: e362a2a56fab0b8cdf0fa79bb6899be51bcf5ca9 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
|
<!--
$Id$
This file was written by Andrew G. Morgan <morgan@parc.power.net>
-->
<sect1>The root access module
<sect2>Synopsis
<p>
<descrip>
<tag><bf>Module Name:</bf></tag>
pam_rootok
<tag><bf>Author:</bf></tag>
Andrew G. Morgan <morgan@parc.power.net>
<tag><bf>Maintainer:</bf></tag>
<bf>Linux-PAM</bf> maintainer
<tag><bf>Management groups provided:</bf></tag>
authentication
<tag><bf>Cryptographically sensitive:</bf></tag>
<tag><bf>Security rating:</bf></tag>
<tag><bf>Clean code base:</bf></tag>
Clean.
<tag><bf>System dependencies:</bf></tag>
<tag><bf>Network aware:</bf></tag>
</descrip>
<sect2>Overview of module
<p>
This module is for use in situations where the superuser wishes
to gain access to a service without having to enter a password.
<sect2>Authentication component
<p>
<descrip>
<tag><bf>Recognized arguments:</bf></tag>
<tt/debug/
<tag><bf>Description:</bf></tag>
This module authenticates the user if their <tt/uid/ is <tt/0/.
Applications that are created <em/setuid/-root generally retain the
<tt/uid/ of the user but run with the authority of an enhanced
<em/effective-/<tt/uid/. It is the real <tt/uid/ that is checked.
<tag><bf>Examples/suggested usage:</bf></tag>
In the case of the <tt/su/ application the historical usage is to
permit the superuser to adopt the identity of a lesser user without
the use of a password. To obtain this behavior under <tt/Linux-PAM/
the following pair of lines are needed for the corresponding entry in
the configuration file:
<tscreen>
<verb>
#
# su authentication. Root is granted access by default.
#
su auth sufficient pam_rootok.so
su auth required pam_unix_auth.so
</verb>
</tscreen>
<p>
Note. For programs that are run by the superuser (or started when the
system boots) this module should not be used to authenticate users.
</descrip>
<!--
End of sgml insert for this module.
-->
|
