Subject: Re: PAM proposal
To: Roland Dowdeswell <elric@imrryr.org>
From: Daniel Carosone <dan@geek.com.au>
List: tech-security
Date: 05/08/2005 08:59:00
--bnUi9GzdSM4S/DMA
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
On Sun, May 08, 2005 at 08:25:19AM +1000, Daniel Carosone wrote:
> One such change which would make it less confusing is to have two
> columns for keywords, one to describe the four possible continuation
> behaviours, another to describe the four possible flag-setting
> behaviours.=20
On second thought, I think a more useful grouping is "action on
success/action on failure".
This would give us keyword-parts like:
PermitCont
PermitStop
IgnoreCont
IgnoreStop
DenyCont
DenyStop
Or even make the 'Cont' implied:
Permit
PermitStop
Ignore
IgnoreStop
Deny
DenyStop
which you would combine to make up equivalents to the current
keywords:
keyword c:F c:S can succeed force deny
------- --- --- ----------- ----------
required =3D Permit/Deny yes yes yes yes
requisite =3D Permit/DenyStop no yes yes yes
sufficient =3D Permit/Ignore yes yes yes no
optional =3D Ignore/Ignore yes yes no no
binding =3D PermitStop/Deny yes no yes yes
and
necessary =3D Ignore/Deny yes yes no yes
This seems *SO* much clearer to me, and can be done as simple string
aliases in the current syntax.
--
Dan.
--bnUi9GzdSM4S/DMA
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (NetBSD)
iD8DBQFCfUg0EAVxvV4N66cRAvrJAJ9iObUxtJDBIRhw3M4FWHdZhb4bHgCfS7ZK
FZi5Gacgkdse077r9QsvZsw=
=1lzT
-----END PGP SIGNATURE-----
--bnUi9GzdSM4S/DMA--