solaris /dev/console patch

[Robert McQueen]

On a related note, I would appreciate a better mechanism for making a
cleaner system-dependent implementation of this policy. RedHat uses
pam_console, but Ubuntu has a pretty heavy patch to instead use their
pam_foreground module & lock files to enforce that the at_console policy
must also be the currently active tty, which seems to be closer to what
this Solaris patch does. I discussed with them a more extensible means
of adding policies rather than overloading/retasking the at_console like
this, but they deemed the configuration parser too fragile to add a new
option without quite a lot of work.

It seems to me like we should think about a better way to achieve this
so that we could support more of these policies in a clean way, rather
than ending up with either heavy distro or system-specific patching or a
load of ifdef'd code.

Answers on a postcard. :)

Regards,
Rob

Artem Kachitchkine wrote:
> Havoc,
> 
> Thanks for the quick response. I've attached a new patch that I believe
> addresses all issues that you raised. (Not sure if documentation is
> clearer, though).
> 
> Apologies for the memory leak, this is embarrassing - I had a
> non-leaking patch for a while, but then made last-minute changes which
> introduced the bug.
> 
> -Artem.