pam_setcred() without pam_authenticate()?

Darren J Moffat
Thu, 05 Jun 2003 00:22:49 -0000

On Wed, 4 Jun 2003, Frank Cusack wrote:

> Should pam_setcred() be called if pam_authenticate() wasn't called?
> I would say not; both of these functions are in the authenticate
> part of pam.

yes it should. pam_setcred may be doing stuff that it doesn't need the
PAM_AUTHTOK for.   For example cron(1m) on Solaris calls pam_setcred.

> It seems the the 'auth' part of pam config controls which modules
get
> called, so if you didn't to _authenticate() you shouldn't do
_setcred().

That is a bug in the specification of PAM there really should have been
a separate auth and cred stack.

--
Darren J Moffat