This document describes Guile-PAM version 0.0.1, a way to write, configure, and maintain your system’s Pluggable Authentication Module’s (PAM) in GNU Guile.
Please don’t mind the occasional Guile warnings. Guile-PAM works great!
The GNU Autoconf macro GUILE_FLAGS
requires two files from Gnulib that for some reason are not provided automatically. The
missing files can be added via your distribution’s build system. Here
is how we do it in GNU Guix:
(lambda* (#:key inputs #:allow-other-keys)
(let ((build-aux (dirname (search-input-file inputs "/src/gnulib/build-aux/config.rpath"))))
(mkdir-p "build-aux")
(copy-recursively build-aux "build-aux"))
(let ((m4 (dirname (search-input-file inputs "/src/gnulib/m4/lib-link.m4"))))
(mkdir-p "m4")
(copy-recursively m4 "m4")))
This software is in alpha stage. All interfaces are subject to change.
pam_guile.so
How did you like configuring Linux-PAM? Did you find all the modules you were looking for? Do you feel confident that it works well in all situations?
That experience could be a matter of the past. Now you can write PAM modules in GNU Guile, a dialect of Scheme.
This software can call Guile scripts via a specially crafted PAM shared object. You can even replace the entire PAM stack with logic written in Guile.
Linux-PAM was revolutionary when it came out thirty years ago. By using
shared library modules in an ingenious way, security-relevant
applications like su or login automatically followed
consistent authentication policies. When a system administrator changed
those policies, the executables did not have to be recompiled.
Guile-PAM hopes to build on that legacy by making authentication even easier for system administrators.
To use this software, please install the PAM shared object ‘pam_guile.so’ from the folder ‘lib/c’ into your PAM setup. It calls GNU Guile via the mechanism described in the Tortoise Tutorial.
You can use this software in three ways:
required
calls to ‘pam_guile.so’ and handle both recipe selection and recipe
logic in GNU Guile.
To handle all services in Guile-PAM, please replace all services in ‘/etc/pam.d’ with something like this:
auth required pam_guile.so /etc/pam-environment.nul /etc/pam.scm account required pam_guile.so /etc/pam-environment.nul /etc/pam.scm session required pam_guile.so /etc/pam-environment.nul /etc/pam.scm passed required pam_guile.so /etc/pam-environment.nul /etc/pam.scm
Here is a Guile-PAM module that says hello:
(lambda (action handle flags options) ;; do for any action (format #t "Hello, this is your friendly PAM module.~%") 'PAM_IGNORE)
The action parameter will be one of the six symbols:
The handle is an opaque variable known as the PAM handle. It gives the module access to a variety of PAM-internal data, such as the username, the PAM service (which is often the name of the application), and the conversation function.
Please have a look at Linux-PAM’s Module Writers Manual for a list.
The flags are an integer bitmask.
The options are a list of the strings that followed the module in the service definition.
Guile-PAM combines those parameters in an anonymous procedure.
The same anonymous procedures appear everywhere in Guile-PAM, so it made sense to give them a name. We call them Pamdas, which is a portmanteau of PAM and Lambda.
Pamdas always look like this:
(lambda (action handle flags options) ...)
Pamdas are not byte-compiled when they are installed. There is no point because they carry no module data. The compiled versions cannot be located via the module system.
Pamdas are found via their paths in the file system.
Let’s try to do something a little bit more useful than saying hello. Linux-PAM ships a shared object called ‘pam_limits.so’ that adjusts system limits. You can use it to increase the number of open files like this:
session required pam_limits.so
The module reads ‘/etc/security/limits.conf’ which could contain those lines:
* soft nofile 100000 * hard nofile 100000
You can do the same thing in Guile-PAM. We ship a module called ‘set-resource-limits.scm’ in the ‘modules/’ folder. Here is how you use it:
(lambda (action handle flags options)
(let* ((pamda (load "modules/set-resource-limits.scm")))
(pamda action handle flags '((nofile 100000 100000)))))
If you find all that too complicated, you can also call setrlimit
yourself:
(lambda (action handle flags options)
(if (eq? 'pam_sm_open_session action)
(setrlimit 'nofile 100000 100000))
'PAM_SUCCESS)
Finally, you can continue to use the Linux-PAM shared object:
(use-modules (pam legacy module)) (lambda (action handle flags options) (call-legacy-module "pam_limits.so" action handle flags))
It can be fun to see Guile-PAM at work:
(lambda (action handle flags options)
(case action
;; authentication management
((pam_sm_authenticate)
(format #t "In a working module, we would now identify you.~%"))
((pam_sm_setcred)
(format #t "In a working module, we would now help you manage additional credentials.~%"))
;; account management
((pam_sm_acct_mgmt)
(format #t "In a working module, we would now confirm your access rights.~%"))
;; password management
((pam_sm_chauthtok)
(format #t "In a working module, we would now change your password.~%"))
;; session management
((pam_sm_open_session)
(format #t "In a working module, we would now open a session for you.~%"))
((pam_sm_close_session)
(format #t "In a working module, we would now close your session.~%"))
(else
(format #t "In a working module, we would not know what to do about action '~s'.~%"
action)))
'PAM_SUCCESS)
Ideally, we would use a PAM conversation function instead of printing to
(current-output-port) via format but the author has yet to
figure out how to use callbacks with Nyacc.
This software comes with a complete reimplementation of the Linux-PAM stack in GNU Guile.
The Guile version of PAM stacks looks like this:
(use-modules (pam stack))
(lambda (action handle flags options)
(stack action handle flags
(list
(gate optional (load "welcome.scm"))
(gate required (load "do-something.scm")))))
Each gate procedure is like a line in a Linux-PAM configuration
file. It expects a pamda. Here are the signatures:
Define a gate around pamda using the plan. Pass options to the module, if present.
Returns a specialized lambda that is only useful when used with
stack.
The lambda will return PAM_IGNORE if #:only-actions
is given but action does not match, or if #:only-services is
given but a different service is active. The selectors make it easier
to convert existing systems to Guile-PAM.
The stack procedure evaluates a list of gates in order:
Traverse the list of gates, passing each the action, the PAM handle handle, and flags. Processing may cease depending on the evaluation at each gate.
Returns a symbolic PAM status code like PAM_SUCCESS or #f
if none was acquired.
Forwards exceptions from code below.
We’ll learn how to write the plan in a little while. In many cases, it’s just the plain variable ‘required’ or ‘optional’.
You can also stack Linux-PAM’s shared objects:
(use-modules (pam stack))
(lambda (action handle flags options)
(stack action handle flags
(list
(gate required
(lambda (action handle flags options)
(call-legacy-module "pam_motd.so") action handle flags
#:options
(list (string-append "motd=" message-file))
#:implements
'(pam_sm_open_session))))))
Linux-PAM’s shared objects often do not behave well for actions they do
not implement. The keyword parameter #:implements makes sure we
return PAM_IGNORE for actions that aren’t implemented.
Otherwise the stack may terminate when it shouldn’t.
There are some convenience procedures if you are bothered by the repetitive nature of the ‘lambdas’. The code from the previous section can be simplified to:
(use-modules (pam legacy modules)
(pam stack))
(stack-pamda
(list
(gate required
(legacy-pamda "pam_motd.so"
#:options
(list (string-append "motd=" message-file))
#:implements
'(pam_sm_open_session)))))
One procedure is in (pam stack).
Returns a pamda that evaluates gates in the order given.
Returns a symbolic PAM status code, or #f if none was acquired.
stack.
And the other is in (pam legacy module).
Returns a pamda that calls the Linux-PAM shared object located at path.
Returns a symbolic PAM status code.
Additionally, returns PAM_IGNORE if action does not match
any symbol listed in #:implements. That is necessary because many
Linux-PAM shared objects return the status PAM_SERVICE_ERR unless
they were called with an action they expected. That could
otherwise cause the stack to fail when it should not.
Raises an exception if the shared object or the ELF symbol requested therein cannot be located.
Like Linux-PAM stacks, Guile-PAM offers the keywords required,
optional, sufficient, and requisite.
They are variables so you can use their plain names.
For a custom plan like ‘success=ok new_authtok_reqd=ok ignore=ignore default=bad’ we have to delve a little bit into how stacks work.
By the way, that string is Linux-PAM’s
definition of the required plan.
The stack can take one of three actions on a return status: It can
Here are the rules for the custom plan above:
(list (cons 'PAM_SUCCESS (acquire 1)) (cons 'PAM_NEW_AUTHTOK_REQD (acquire 1)) (cons 'PAM_IGNORE (discard 1)))
For this plan, the two return statuses indicating success are
PAM_SUCCESS and PAM_NEW_AUTHTOK_REQD. The rules also
honor the module’s request to be ignored when its return status is
PAM_IGNORE. The stack will discard the result and move on.
The number one means to advance to the next gate. It is also possible to skip over modules by using numbers greater than one.
The default stack action for the custom plan above is:
(lock 1)
That’s because for the required plan all other statuses are
failures. They lock the stack in a way from which it cannot recover.
Together the rules and the default form what we call a plan.
Here is the full set of predefined plans:
;; Copyright © 2022-2024 Felix Lechner
;;
;; This program is free software: you can redistribute it and/or modify
;; it under the terms of the GNU General Public License as published by
;; the Free Software Foundation, either version 3 of the License, or
;; (at your option) any later version.
(define (make-sufficient-rules step)
(list
(cons 'PAM_SUCCESS (acquire step))
(cons 'PAM_NEW_AUTHTOK_REQD (acquire step))))
(define (make-necessary-rules step)
(cons (cons 'PAM_IGNORE (discard step))
(make-sufficient-rules step)))
(define-public required
(let* ((rules (make-necessary-rules 1))
(default (lock 1)))
(make-plan rules default)))
(define-public requisite
(let* ((rules (make-necessary-rules 1))
(default (lock 0)))
(make-plan rules default)))
(define-public sufficient
(let* ((rules (make-sufficient-rules 0))
(default (discard 1)))
(make-plan rules default)))
(define-public optional
(let* ((rules (make-sufficient-rules 1))
(default (discard 1)))
(make-plan rules default)))
In the Guile module (pam legacy stack) is a procedure
legacy-plan->modern-plan that translates Linux-PAM strings like
‘success=ok new_authtok_reqd=ok ignore=ignore default=bad’ to a
plan you can use with Guile-PAM.
Returns a plan for use with Guile-PAM that is equivalent to the Linux-PAM string plan.
Raises an error if plan does not conform to Linux-PAM’s specifications.
Guile-PAM is different from Linux-PAM in several ways:
This software is still being tested. Linux-PAM is mature and trusted.
PAM_IGNORE.Linux-PAM skips actions that belong together when the other returned
PAM_IGNORE. It groups the six actions into four categories
called auth, account, session, and passwd.
You already know them from the Linux-PAM configuration files. For the
two categories that each bundle two actions, Linux-PAM will not call the
second action if the first one returned PAM_IGNORE. The behavior
is documented in the
‘pam_sm_setcred(3)’ manual page that comes with Linux-PAM.
The implementation in (pam stack) is different. It evaluates
each module for each action.
When legacy instruction sets like ‘success=1 new_authtok_reqd=1 ignore=ignore default=bad’ use explicit skip counts, an unlocked Guile-PAM stack will always acquire the result. In Linux-PAM, the side effect depends on the action as described here.
You’ll notice quickly that in Guile-PAM everything is a pamda. Any user of Guile-PAM is a module writer. This section addresses a more in-depth interaction with the PAM subsystem.
As a small caution, please remember that your code probably runs inside
a program that is setuid to the ‘root’ user. The Bash
developers like to say that you have super cow powers.
GNU Guile’s superb foreign function interface allows programs to call code written in the ‘C’ language seamlessly. It works great!
Guile-PAM uses the FFI Helper from Nyacc (Not Yet Another Compiler Compiler) to provide a Scheme interface to Linux-PAM’s ‘libpam’ library.
The FFI helper automatically creates Guile bindings from C header files. No manual maintenance is needed, but they can be a bit cumbersome to use.
In addition, Guile-PAM provides some higher-level procedures in
(pam) that avoid the complex distractions of FFI.
For example, you can call get-username to get the name of the
user seeking authentication, or call get-service to get the name
of the PAM service, which is usually the name of the calling
application.
Get the name of the user seeking authentication from handle.
Returns #f if the name is not available.
Get the name of the PAM service from handle.
Returns #f if the service is not available.
There is also value->symbol, which translates numerical PAM
return values to their symbolic names.
Get the symbolic PAM status for the numerical PAM return code
number. For example, the number ‘0’ stands for the status
PAM_SUCCESS.
The full list is available in the (pam) module.
Returns #f if the number has no symbol associated wit it..
In the module (pam legacy module) you can find a procedure that
will call a Linux-PAM shared object. It has the following signature:
Call Linux-PAM shared object located at path. Pass the symbol action, the PAM handle handle, an integer bitmask flags, and options, which is a list of strings.
Returns a symbolic PAM status code.
Additionally, returns PAM_IGNORE if action is not listed in
#:implements. That is necessary because many Linux-PAM shared
objects return the status PAM_SERVICE_ERR unless they were called
with an action they expected. That could otherwise cause the
stack to fail when it should not.
Raises an exception if the shared object or the ELF symbol requested therein cannot be located.
Please have a look at Linux-PAM’s System Administrator’s Guide for a list of available shared objects.
The term service is used in many contexts. In Linux-PAM, it refers to a recipe how to authenticate a user. Such recipes are often named after the programs that call them.
The author would love to find a new word for PAM services. Perhaps the word recipe will find some acceptance.
There are some interesting effects when writing PAM modules in an interpreted language. An update of Linux-PAM shared objects can lead to library ABI conflicts and stability issues. There seem to be fewer such issues when a live system is updated with new pamdas.
The author has not yet figured out how to use ‘C’ callbacks with Nyacc. That needs to be resolved in order for PAM conversation functions to work. They are needed for interactive authentication modules in Guile, such as ‘pam_unix.so’.
Primary concerns are unauthorized access and the loss of secrets. For both, the use of an interpreted language should be an improvement.
It’s probably fair to say that Modules written in Guile-PAM are easier to read than the ‘C’ code in Linux-PAM. If you share a module, recipients are therefore more likely to look at it. Over time the code will receive more views, however cursory they may be. By comparison, it’s not clear how many folks look at the Linux-PAM or the OpenPAM source codes.
Attacks via injection are an additional concern. GNU Guile
separates well between strings and code but code and data are often
mixed when quoting. Quoted S-Expressions are probably harmless. Please
do not use Guile’s read procedure, however, especially not when
dealing with unknown inputs.
Tainted environments are another concern. It is imperative that we use the modules we expect. There should be no risk of substitution.
The search path for GNU Guile modules can be modified via the
environment variables GUILE_LOAD_PATH and
GUILE_LOAD_COMPILED_PATH. The ‘pam_guile.so’ shared object
tries to isolate those environment variables from the application.
The shared object also restores that part of the environment before
returning to the application. Therefore some environment variables like
LANG may not end up persisting after being set by
‘pam_env.so’.
As an additional precaution, pamdas should be loaded via absolute paths.
Guile-PAM modules performed at adequate speeds in practical tests.
Speed, it should be noted, is not always an advantage in authentication. It is common to slow down processing for the repeated entry of secrets so that an attacker will find it harder to exhaust the possible search space.
Please build delays into your modules.
Here are examples of complex things that are easier in Guile-PAM:
Here is a module that does something truly useful and unique. Called
‘user-session-with-piped-secret.scm’, it stores the token received
in the pam_sm_authenticate stage. The module then retrieves the
token in the pam_sm_open_session stage and pipes it to a user
pamda.
The user pamda, which is shown below, reads the password and mounts a Gocryptfs folder as ‘/home/lechner’ during the login process. The mount operation happens when the user logs in.
In the Linux-PAM universe there is something called ‘pam_mount.so’ but it mounts volumes as the ‘root’ user. which does not work with FUSE folders using standard settings or with kerberized NFSv4.
This use case was the author’s motivation for writing Guile-PAM.
;; Copyright © 2022-2024 Felix Lechner
;;
;; This program is free software: you can redistribute it and/or modify
;; it under the terms of the GNU General Public License as published by
;; the Free Software Foundation, either version 3 of the License, or
;; (at your option) any later version.
;;
;; This program is distributed in the hope that it will be useful,
;; but WITHOUT ANY WARRANTY; without even the implied warranty of
;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
;; GNU General Public License for more details.
;;
;; You should have received a copy of the GNU General Public License
;; along with this program. If not, see <https://www.gnu.org/licenses/>.
(use-modules (ice-9 format)
(ice-9 popen)
(pam stack)
(srfi srfi-1)
(rnrs io ports))
(define (feed-string str executable . args)
(let* ((port (apply open-pipe* OPEN_WRITE executable args)))
(format port "~a~%" str)
(status:exit-val (close-pipe port))))
(define (already-mounted? folder)
(let* ((all-mounts (call-with-input-file "/proc/mounts"
(lambda (port)
(get-string-all port))))
(lines (string-split all-mounts #\newline)))
(any (lambda (line)
(if (string-null? line)
#f
(let* ((pieces (string-split line #\space))
(mount-point (cadr pieces)))
(string=? folder mount-point))))
lines)))
(define (mount-home-gocryptfs action handle flags options)
(let* ((cleartext-folder "/home/lechner"))
(case action
((pam_sm_open_session)
;; ideally, we would count sessions instead
(if (already-mounted? cleartext-folder)
'PAM_SUCCESS
(let* ((token (car options)))
(if token
(let* ((exit-val (feed-string token
"/run/current-system/profile/bin/gocryptfs"
"../home.gocryptfs"
cleartext-folder)))
(if (eqv? 0 exit-val)
'PAM_SUCCESS
'PAM_SESSION_ERR))
'PAM_AUTHINFO_UNAVAIL))))
(else
'PAM_SUCCESS))))
(lambda (action handle flags options)
(stack action handle flags
(list
(gate required mount-home-gocryptfs
#:options options))))
You can experiment with your code on a live system by installing a new
recipe that is not used by any application. Or you can hijack an
existing recipe that is rarely used. Just add ‘pam_guile.so’ with
the optional rule set like this:
auth optional pam_guile.so /etc/pam-environment.nul /etc/pam.scm
You may find the tiny pamtester program helpful.
For anyone using GNU Guix that ad-hoc method is not available. In Guix configuration files are read-only. They reside in something called the store, which is read-only.
Another solution was therefore needed:
Guile-PAM comes with a small program called load that allows you
to test your modules before installing them on your system. You can
find it in a folder called ‘exec’.
The load program has several command-line options.
The only required option is --module-path or -m. It
designates the shared object to load. The path should point to your
location for ‘pam_guile.so’.
That’s usually all you need. On the command line you would list the path to your Guile-PAM module as well as any options to that module.
The other options are:
--action or -a picks one of the six PAM entry points. The
default is pam_sm_authenticate.
--user or -u sets the PAM user. That is the user seeking
authentication. The default is pamtester.
--service or -s sets the PAM service. That is the
particular recipe, or PAM stack, being run. The default is
‘login’.
--flags or -f sets the integer bitmask that passed to each
PAM module. That parameter is rarely used. The default value is the
integer zero.
--auto-compile or -a sets the environment variable
GUILE_AUTO_COMPILE. You can find out more about in the
GNU Guile manual. The default is the string ‘0’.
--locale or -l selects the locale for the pamdas. The
locale helps to make sure that literal strings are processed correctly.
The default is ‘en_US.utf8’.
In order to use the load program, you also have to amend or set a
couple of environment variables:
GUILE_LOAD_PATH helps Guile to find modules like (ffi pam)
or (pam stack)
GUILE_EXTENSIONS_PATH helps Guile locate ‘libpam.so’ and any
other shared ELF libraries your Guile modules load dynamically. On most
systems, the library path for ld.so is available in
LIBRARY_PATH or in LD_LIBRARY_PATH.
Putting everything together, your invocation of the ‘load’ program inside the code repo might look something like that:
$ GUILE_EXTENSIONS_PATH="$LIBRARY_PATH" GUILE_LOAD_PATH="./scm:$GUILE_LOAD_PATH" exec/load -m ../libpam-guile-c/.libs/pam_guile.so /absolute/path/to/your/pamda.scm
Happy hacking!
By experimenting with this software, you could get locked out of your computer. Please make sure you know how to recover before you proceed.
It may be helpful to keep a ‘root’ window open on the host being modified.
Other tools might include a good live boot system on a USB stick from your operating system vendor. Please make sure your equipment can boot from USB.
The author has not needed any boot media for Guile-PAM because GNU Guix offers roll-backs.
For desperate cases, please remember the kernel option ‘init=/bin/bash’. I have not needed it for Guile-PAM and hope you don’t, either.
pam_guile.soPlease install the shared object ‘pam_guile.so’ in your Linux-PAM recipes like any other Linux-PAM shared object.
The first command-line argument in the Linux-PAM configuration file is the absolute path to the runtime environment for the shared object. The second argument is the absolute path to the Scheme pamda you wish to run.
The runtime environment for pamdas is partially isolated from the calling application. The shared object adds several environment variables before calling pamdas. Here are the most important:
LANG, for the locale reading files from disk;
GUILE_AUTO_COMPILE, which prevents Guile’s automatic compilation
and is always set to ‘"0"’;
GUILE_LOAD_PATH, which points to the Guile modules that are
available to the pamda;
GUILE_LOAD_COMPILED_PATH, which points to compiled versions of
those modules; and
GUILE_EXTENSIONS_PATH, which FFI needs to locate ‘libpam’ and
potentially other shared libraries.
The full list is available in (pam environment).
To load the values when the shared object is called, ‘pam_guile.so’ receives as its first parameter the path to a file that contains the desired environment.
The path to the environment file must be absolute.
The file contains strings with variable assigments that look the way you
would enter them into a shell, except the strings are terminated by
‘\0’ characters. That is also the format expected by the
putenv(3) library call in Glibc.
Usually, the environment file will look something like this, except each line is terminated by a ‘\0’ character:
LANG=C.utf8 GUILE_AUTO_COMPILE=0 GUILE_LOAD_PATH=/usr/share/guile/site/3.0 GUILE_LOAD_COMPILED_PATH=/usr/lib/guile/3.0/site-ccache GUILE_EXTENSIONS_PATH=/usr/lib
Before the shared object returns to the application, it restores those variables to what they were before.
Pamdas can and do change enviroment variables that persist in the calling process. (They may not be mentioned in the environment file.) Without that, modules like ‘pam_env.so’ would not work.
In the module (pam environment) is a procedure that could help
you write the null-terminated environment file:
Writes to port an environment file that is suitable for Guile-PAM.
Guile-PAM provokes some Guile warnings the author has been unable to turn off:
That said, Guile-PAM’s functionality does not seem to be affected.
This section will help you migrate your system to using Guile-PAM on top of Linux-PAM.
In (pam legacy configuration) you can find the procedure
configuration-file->gates, which will read a Linux-PAM service
file and convert in on the fly for use with Guile-PAM’s stack
implementation.
Returns a list of Guile-PAM gates equivalent to the Linux-PAM configuration file file found in folder folder..
Raises an error if the configuration file does not conform to Linux-PAM’s specifications.
GNU Guix is an entire operating system configured in GNU Guile. If you use it, you can try the patch series that converts your system to Guile-PAM.
Below are the relevant parts of the author’s system configuration in hope of getting you started:
(define welcome-pamda-file
(scheme-file
"welcome-pamda-file"
#~(begin
(lambda (action handle flags options)
(case action
;; authentication management
((pam_sm_authenticate)
(format #t "In a working module, we would now identify you.~%"))
((pam_sm_setcred)
(format #t "In a working module, we would now help you manage additional credentials.~%"))
;; account management
((pam_sm_acct_mgmt)
(format #t "In a working module, we would now confirm your access rights.~%"))
;; password management
((pam_sm_chauthtok)
(format #t "In a working module, we would now change your password.~%"))
;; session management
((pam_sm_open_session)
(format #t "In a working module, we would now open a session for you.~%"))
((pam_sm_close_session)
(format #t "In a working module, we would now close your session.~%"))
(else
(format #t "In a working module, we would not know what to do about action '~s'.~%"
action)))
'PAM_SUCCESS))))
(define motd
(plain-file
"motd"
"This is your message of the day."))
(define my-pamda-file
(scheme-file
"my-pamda-file"
#~(begin
(use-modules ((pam) #:prefix guile-pam:)
(pam legacy module)
(pam stack))
(lambda (action handle flags options)
;; for gocryptfs
(if (eq? 'pam_sm_open_session action)
(setrlimit 'nofile 100000 100000))
(stack action handle flags
(list
(gate optional (load #$welcome-pamda-file))
(let* ((username (guile-pam:get-username handle))
(hostname (gethostname))
(file (string-append "/acct/"
username
"/"
hostname
"/away/pam.scm")))
(gate required (load #$(file-append guile-pam
"/share/modules/user-session-with-piped-secret.scm"))
#:options (list file)
#:only-services '("login"
"greetd"
"su"
"slim"
"gdm-password"
"sddm")))
(gate optional
(lambda (action handle flags options)
(call-legacy-module #$(file-append linux-pam "/lib/security/pam_motd.so")
action handle flags
#:options
(list (string-append "motd=" #$motd))
#:implements
'(pam_sm_open_session))))))))))
This is the ‘service’ stanza for the ‘operating-system’ definition:
(service guile-pam-module-service-type
(guile-pam-module-configuration
(rules "optional")
(module my-pamda-file)
(services '("login"
"greetd"
"su"
"slim"
"gdm-password"
"sddm"))))
Guile-PAM aims to be fully compatible with applications that rely on Linux-PAM.
Please see Linux-PAM’s Application Developer’s Guide on how to rely on Guile-PAM in your application.
The purpose of this project is to simplify authentication schemes. The PAM stack is one such method. Are there others?
One day, Guile-PAM hopes to offer Scheme implementations for all of Linux-PAM’s legacy shared objects.
The purpose would be to bring more transparency to the authentication tasks all of us depend upon.
This section is a placeholder for your creative ways to drop PAM stacks altogether.
This software should work with OpenPAM if you configure it with the
option --with-openpam.
You will also need to provide a pkg-config file, unless upstream accepted the author’s merge request to ship one. You can find the proposed patch here.
While Linux lacks the BSD system calls ‘pledge(2)’ and ‘unveil(2)’, OpenBSD scripts may eventually become usable on Linux systems when using this software. That would lead to greater convergence and consistency among free-software systems.
Please report any defects as soon as you see them. Please do not worry if you don’t have all the information. Better safe than sorry!
If you have a heart for nature and for your fellow creatures, please think twice before you associate the problems in your software with those mostly harmless creatures. (Okay, maybe not mosquitoes.)
The idea of squashing bugs at a party never appealed to the author. Following some nudging by a friend, this manual calls software defects what they are, namely defects.
Please remind the author when his posture here is inconsistent with his conduct in case he, too, continues to use the word ‘bugs’.
Development for Guile-PAM is generously hosted on Codeberg.org. Please feel free to use all enabled features, including the filing of issues.
The hope of this project is to help you write your own PAM modules. Please share your work to avoid the duplication of efforts.
Please offer to include your pamdas in this distribution. The sole requirement, aside from having general interest, is that you release your code under the same license.
For help with Guile, please ask in ‘#scheme’ or ‘#guile’ on Libera.chat.
There is also ‘#guile-pam’ but it’s very lonely there.
Guile-PAM is based on GNU Guile, which was designed to be a flexible and versatile configuration language for programs written in other languages.
The author was assisted generously by folks in the ‘#scheme’ IRC channel on Libera.chat, especially by the users ‘Zipheir’ and ‘wasamasa’.
Many people in the ‘#guile’ IRC channel on Libera.chat also helped.
The foreign-function interface for Guile-PAM was generated automatically
by the amazing ‘FFI helper’ tool that comes bundled with
nyacc. Matt Wette, the
upstream author, graciously helped the author in moments of great
despair.
Finally, homage must be paid to the pioneering developers of Linux-PAM. They revolutionized the way privileged applications ensure that they are being used in an authorized fashion. Without those developers, this project would not exist.
Thanks also to anybody not mentioned who helped with this collaborative effort by reporting defects, by providing artwork, or by making suggestions!
Copyright © 2000, 2001, 2002, 2007, 2008 Free Software Foundation, Inc. https://fsf.org/ Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.
The purpose of this License is to make a manual, textbook, or other functional and useful document free in the sense of freedom: to assure everyone the effective freedom to copy and redistribute it, with or without modifying it, either commercially or noncommercially. Secondarily, this License preserves for the author and publisher a way to get credit for their work, while not being considered responsible for modifications made by others.
This License is a kind of “copyleft”, which means that derivative works of the document must themselves be free in the same sense. It complements the GNU General Public License, which is a copyleft license designed for free software.
We have designed this License in order to use it for manuals for free software, because free software needs free documentation: a free program should come with manuals providing the same freedoms that the software does. But this License is not limited to software manuals; it can be used for any textual work, regardless of subject matter or whether it is published as a printed book. We recommend this License principally for works whose purpose is instruction or reference.
This License applies to any manual or other work, in any medium, that contains a notice placed by the copyright holder saying it can be distributed under the terms of this License. Such a notice grants a world-wide, royalty-free license, unlimited in duration, to use that work under the conditions stated herein. The “Document”, below, refers to any such manual or work. Any member of the public is a licensee, and is addressed as “you”. You accept the license if you copy, modify or distribute the work in a way requiring permission under copyright law.
A “Modified Version” of the Document means any work containing the Document or a portion of it, either copied verbatim, or with modifications and/or translated into another language.
A “Secondary Section” is a named appendix or a front-matter section of the Document that deals exclusively with the relationship of the publishers or authors of the Document to the Document’s overall subject (or to related matters) and contains nothing that could fall directly within that overall subject. (Thus, if the Document is in part a textbook of mathematics, a Secondary Section may not explain any mathematics.) The relationship could be a matter of historical connection with the subject or with related matters, or of legal, commercial, philosophical, ethical or political position regarding them.
The “Invariant Sections” are certain Secondary Sections whose titles are designated, as being those of Invariant Sections, in the notice that says that the Document is released under this License. If a section does not fit the above definition of Secondary then it is not allowed to be designated as Invariant. The Document may contain zero Invariant Sections. If the Document does not identify any Invariant Sections then there are none.
The “Cover Texts” are certain short passages of text that are listed, as Front-Cover Texts or Back-Cover Texts, in the notice that says that the Document is released under this License. A Front-Cover Text may be at most 5 words, and a Back-Cover Text may be at most 25 words.
A “Transparent” copy of the Document means a machine-readable copy, represented in a format whose specification is available to the general public, that is suitable for revising the document straightforwardly with generic text editors or (for images composed of pixels) generic paint programs or (for drawings) some widely available drawing editor, and that is suitable for input to text formatters or for automatic translation to a variety of formats suitable for input to text formatters. A copy made in an otherwise Transparent file format whose markup, or absence of markup, has been arranged to thwart or discourage subsequent modification by readers is not Transparent. An image format is not Transparent if used for any substantial amount of text. A copy that is not “Transparent” is called “Opaque”.
Examples of suitable formats for Transparent copies include plain ASCII without markup, Texinfo input format, LaTeX input format, SGML or XML using a publicly available DTD, and standard-conforming simple HTML, PostScript or PDF designed for human modification. Examples of transparent image formats include PNG, XCF and JPG. Opaque formats include proprietary formats that can be read and edited only by proprietary word processors, SGML or XML for which the DTD and/or processing tools are not generally available, and the machine-generated HTML, PostScript or PDF produced by some word processors for output purposes only.
The “Title Page” means, for a printed book, the title page itself, plus such following pages as are needed to hold, legibly, the material this License requires to appear in the title page. For works in formats which do not have any title page as such, “Title Page” means the text near the most prominent appearance of the work’s title, preceding the beginning of the body of the text.
The “publisher” means any person or entity that distributes copies of the Document to the public.
A section “Entitled XYZ” means a named subunit of the Document whose title either is precisely XYZ or contains XYZ in parentheses following text that translates XYZ in another language. (Here XYZ stands for a specific section name mentioned below, such as “Acknowledgements”, “Dedications”, “Endorsements”, or “History”.) To “Preserve the Title” of such a section when you modify the Document means that it remains a section “Entitled XYZ” according to this definition.
The Document may include Warranty Disclaimers next to the notice which states that this License applies to the Document. These Warranty Disclaimers are considered to be included by reference in this License, but only as regards disclaiming warranties: any other implication that these Warranty Disclaimers may have is void and has no effect on the meaning of this License.
You may copy and distribute the Document in any medium, either commercially or noncommercially, provided that this License, the copyright notices, and the license notice saying this License applies to the Document are reproduced in all copies, and that you add no other conditions whatsoever to those of this License. You may not use technical measures to obstruct or control the reading or further copying of the copies you make or distribute. However, you may accept compensation in exchange for copies. If you distribute a large enough number of copies you must also follow the conditions in section 3.
You may also lend copies, under the same conditions stated above, and you may publicly display copies.
If you publish printed copies (or copies in media that commonly have printed covers) of the Document, numbering more than 100, and the Document’s license notice requires Cover Texts, you must enclose the copies in covers that carry, clearly and legibly, all these Cover Texts: Front-Cover Texts on the front cover, and Back-Cover Texts on the back cover. Both covers must also clearly and legibly identify you as the publisher of these copies. The front cover must present the full title with all words of the title equally prominent and visible. You may add other material on the covers in addition. Copying with changes limited to the covers, as long as they preserve the title of the Document and satisfy these conditions, can be treated as verbatim copying in other respects.
If the required texts for either cover are too voluminous to fit legibly, you should put the first ones listed (as many as fit reasonably) on the actual cover, and continue the rest onto adjacent pages.
If you publish or distribute Opaque copies of the Document numbering more than 100, you must either include a machine-readable Transparent copy along with each Opaque copy, or state in or with each Opaque copy a computer-network location from which the general network-using public has access to download using public-standard network protocols a complete Transparent copy of the Document, free of added material. If you use the latter option, you must take reasonably prudent steps, when you begin distribution of Opaque copies in quantity, to ensure that this Transparent copy will remain thus accessible at the stated location until at least one year after the last time you distribute an Opaque copy (directly or through your agents or retailers) of that edition to the public.
It is requested, but not required, that you contact the authors of the Document well before redistributing any large number of copies, to give them a chance to provide you with an updated version of the Document.
You may copy and distribute a Modified Version of the Document under the conditions of sections 2 and 3 above, provided that you release the Modified Version under precisely this License, with the Modified Version filling the role of the Document, thus licensing distribution and modification of the Modified Version to whoever possesses a copy of it. In addition, you must do these things in the Modified Version:
If the Modified Version includes new front-matter sections or appendices that qualify as Secondary Sections and contain no material copied from the Document, you may at your option designate some or all of these sections as invariant. To do this, add their titles to the list of Invariant Sections in the Modified Version’s license notice. These titles must be distinct from any other section titles.
You may add a section Entitled “Endorsements”, provided it contains nothing but endorsements of your Modified Version by various parties—for example, statements of peer review or that the text has been approved by an organization as the authoritative definition of a standard.
You may add a passage of up to five words as a Front-Cover Text, and a passage of up to 25 words as a Back-Cover Text, to the end of the list of Cover Texts in the Modified Version. Only one passage of Front-Cover Text and one of Back-Cover Text may be added by (or through arrangements made by) any one entity. If the Document already includes a cover text for the same cover, previously added by you or by arrangement made by the same entity you are acting on behalf of, you may not add another; but you may replace the old one, on explicit permission from the previous publisher that added the old one.
The author(s) and publisher(s) of the Document do not by this License give permission to use their names for publicity for or to assert or imply endorsement of any Modified Version.
You may combine the Document with other documents released under this License, under the terms defined in section 4 above for modified versions, provided that you include in the combination all of the Invariant Sections of all of the original documents, unmodified, and list them all as Invariant Sections of your combined work in its license notice, and that you preserve all their Warranty Disclaimers.
The combined work need only contain one copy of this License, and multiple identical Invariant Sections may be replaced with a single copy. If there are multiple Invariant Sections with the same name but different contents, make the title of each such section unique by adding at the end of it, in parentheses, the name of the original author or publisher of that section if known, or else a unique number. Make the same adjustment to the section titles in the list of Invariant Sections in the license notice of the combined work.
In the combination, you must combine any sections Entitled “History” in the various original documents, forming one section Entitled “History”; likewise combine any sections Entitled “Acknowledgements”, and any sections Entitled “Dedications”. You must delete all sections Entitled “Endorsements.”
You may make a collection consisting of the Document and other documents released under this License, and replace the individual copies of this License in the various documents with a single copy that is included in the collection, provided that you follow the rules of this License for verbatim copying of each of the documents in all other respects.
You may extract a single document from such a collection, and distribute it individually under this License, provided you insert a copy of this License into the extracted document, and follow this License in all other respects regarding verbatim copying of that document.
A compilation of the Document or its derivatives with other separate and independent documents or works, in or on a volume of a storage or distribution medium, is called an “aggregate” if the copyright resulting from the compilation is not used to limit the legal rights of the compilation’s users beyond what the individual works permit. When the Document is included in an aggregate, this License does not apply to the other works in the aggregate which are not themselves derivative works of the Document.
If the Cover Text requirement of section 3 is applicable to these copies of the Document, then if the Document is less than one half of the entire aggregate, the Document’s Cover Texts may be placed on covers that bracket the Document within the aggregate, or the electronic equivalent of covers if the Document is in electronic form. Otherwise they must appear on printed covers that bracket the whole aggregate.
Translation is considered a kind of modification, so you may distribute translations of the Document under the terms of section 4. Replacing Invariant Sections with translations requires special permission from their copyright holders, but you may include translations of some or all Invariant Sections in addition to the original versions of these Invariant Sections. You may include a translation of this License, and all the license notices in the Document, and any Warranty Disclaimers, provided that you also include the original English version of this License and the original versions of those notices and disclaimers. In case of a disagreement between the translation and the original version of this License or a notice or disclaimer, the original version will prevail.
If a section in the Document is Entitled “Acknowledgements”, “Dedications”, or “History”, the requirement (section 4) to Preserve its Title (section 1) will typically require changing the actual title.
You may not copy, modify, sublicense, or distribute the Document except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense, or distribute it is void, and will automatically terminate your rights under this License.
However, if you cease all violation of this License, then your license from a particular copyright holder is reinstated (a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation.
Moreover, your license from a particular copyright holder is reinstated permanently if the copyright holder notifies you of the violation by some reasonable means, this is the first time you have received notice of violation of this License (for any work) from that copyright holder, and you cure the violation prior to 30 days after your receipt of the notice.
Termination of your rights under this section does not terminate the licenses of parties who have received copies or rights from you under this License. If your rights have been terminated and not permanently reinstated, receipt of a copy of some or all of the same material does not give you any rights to use it.
The Free Software Foundation may publish new, revised versions of the GNU Free Documentation License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. See https://www.gnu.org/copyleft/.
Each version of the License is given a distinguishing version number. If the Document specifies that a particular numbered version of this License “or any later version” applies to it, you have the option of following the terms and conditions either of that specified version or of any later version that has been published (not as a draft) by the Free Software Foundation. If the Document does not specify a version number of this License, you may choose any version ever published (not as a draft) by the Free Software Foundation. If the Document specifies that a proxy can decide which future versions of this License can be used, that proxy’s public statement of acceptance of a version permanently authorizes you to choose that version for the Document.
“Massive Multiauthor Collaboration Site” (or “MMC Site”) means any World Wide Web server that publishes copyrightable works and also provides prominent facilities for anybody to edit those works. A public wiki that anybody can edit is an example of such a server. A “Massive Multiauthor Collaboration” (or “MMC”) contained in the site means any set of copyrightable works thus published on the MMC site.
“CC-BY-SA” means the Creative Commons Attribution-Share Alike 3.0 license published by Creative Commons Corporation, a not-for-profit corporation with a principal place of business in San Francisco, California, as well as future copyleft versions of that license published by that same organization.
“Incorporate” means to publish or republish a Document, in whole or in part, as part of another Document.
An MMC is “eligible for relicensing” if it is licensed under this License, and if all works that were first published under this License somewhere other than this MMC, and subsequently incorporated in whole or in part into the MMC, (1) had no cover texts or invariant sections, and (2) were thus incorporated prior to November 1, 2008.
The operator of an MMC Site may republish an MMC contained in the site under CC-BY-SA on the same site at any time before August 1, 2009, provided the MMC is eligible for relicensing.
To use this License in a document you have written, include a copy of the License in the document and put the following copyright and license notices just after the title page:
Copyright (C) year your name. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license is included in the section entitled ``GNU Free Documentation License''.
If you have Invariant Sections, Front-Cover Texts and Back-Cover Texts, replace the “with…Texts.” line with this:
with the Invariant Sections being list their titles, with
the Front-Cover Texts being list, and with the Back-Cover Texts
being list.
If you have Invariant Sections without Cover Texts, or some other combination of the three, merge those two alternatives to suit the situation.
If your document contains nontrivial examples of program code, we recommend releasing these examples in parallel under your choice of free software license, such as the GNU General Public License, to permit their use in free software.
| Jump to: | #
A C D F G H L M N O P R S U V |
|---|
| Jump to: | #
A C D F G H L M N O P R S U V |
|---|