Package: libpam0g Version: 1.1.3-7.1 Followup-For: Bug #693995 Hi,
I'm having the same problem. After some investigations, I noticed the patch pam-1.1.3/debian/patches-applied/cve-2011-4708.patch changes the default value of DEFAULT_USER_READ_ENVFILE to 0. It makes the option user_readenv to be disabled by default and stops reading ~/.pam_environment. It is inconsistent with the documentations and the manpage of pam_env as they described ~/.pam_environment will be read by default. It seems that cve-2011-4708.patch was made to fix CVE-2010-4708[1]. Note: The filename of the patch is incorrect. It should be s/2011/2010/. Upstream applied the same patch on 2010-10-11[2] so that set DEFAULT_USER_READ_ENVFILE to 0, but the change has immediately been reverted[3]. And DEFAULT_USER_READ_ENVFILE is still 1 in the latest version[4]. [1] https://security-tracker.debian.org/tracker/CVE-2010-4708 [2] http://git.fedorahosted.org/cgit/linux-pam.git/commit/modules/pam_env/pam_env.c?id=4c430f6f8391555bb1b7b78991afb20d35228efc [3] http://git.fedorahosted.org/cgit/linux-pam.git/commit/modules/pam_env/pam_env.c?id=f4aba7f47b87984fda3c5533b03b08a85e4ce81b [4] http://git.fedorahosted.org/cgit/linux-pam.git/tree/modules/pam_env/pam_env.c Ubuntu seems to decided to keep DEFAULT_USER_READ_ENVFILE unchanged, i.e. enabled by default[5]. [5] http://people.canonical.com/~ubuntu-security/cve/2010/CVE-2010-4708.html I know the current behaviour can be changed so that pam_env will read ~/.pam_environment by modifying the files in /etc/pam.d/*. The modification to let pam_env to read ~/.pam_environment can be made with the following command: # sed -i 's/pam_env.so.*/& user_readenv=1/' /etc/pam.d/* But it would be useful and convenient if ~/.pam_environment is read by default. FYI, Ubuntu recommended to use ~/.pam_environment to set per-user environment variables[6]. [6] https://help.ubuntu.com/community/EnvironmentVariables#Session-wide_environment_variables Please consider to drop the patch cve-2011-4708.patch. Thanks, Morita Sho -- System Information: Debian Release: 7.0 APT prefers unstable APT policy: (500, 'unstable') Architecture: amd64 (x86_64) Kernel: Linux 3.2.0-4-amd64 (SMP w/2 CPU cores) Locale: LANG=ja_JP.UTF-8, LC_CTYPE=ja_JP.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Versions of packages libpam0g depends on: ii debconf [debconf-2.0] 1.5.49 ii libc6 2.13-38 ii multiarch-support 2.13-38 libpam0g recommends no packages. Versions of packages libpam0g suggests: pn libpam-doc <none> -- no debconf information -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
