Re:Sudo and Signal Propagation
by garaetjjte on Thursday May 25, 2023 @08:19PM
(#36078195)
Requiring pam_close_session is just bad design - if it needs special cleanup, pam_open_session should grab process pidfd and spawn separate monitor process (or pass pidfd to existing daemon).
[ Parent
| on HN ]
sudo is that monitor process, it's the same with how containerd and podman work, it's much much easier to babysit a process when you're its parent.
Re:Sudo and Signal Propagation
by formerly_proven on Friday May 26, 2023 @02:47AM
(#36080847)
PAM predates pidfd by about 25 years or so, though it's really weird how steadfastly unix heritage systems avoided handles for important things, resulting in race conditions and security issues all over the place.