Subject: Re: PAM proposal
To: Roland Dowdeswell <elric@imrryr.org>
From: Daniel Carosone <dan@geek.com.au>
List: tech-security
Date: 05/08/2005 08:59:00
--bnUi9GzdSM4S/DMA
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sun, May 08, 2005 at 08:25:19AM +1000, Daniel Carosone wrote:
> One such change which would make it less confusing is to have two
> columns for keywords, one to describe the four possible continuation
> behaviours, another to describe the four possible flag-setting
> behaviours.=20

On second thought, I think a more useful grouping is "action on
success/action on failure".

This would give us keyword-parts like:
  PermitCont
  PermitStop
  IgnoreCont
  IgnoreStop
  DenyCont
  DenyStop

Or even make the 'Cont' implied:
  Permit
  PermitStop
  Ignore
  IgnoreStop
  Deny
  DenyStop

which you would combine to make up equivalents to the current
keywords:

keyword                       c:F  c:S  can succeed  force deny
-------                       ---  ---  -----------  ----------
required   =3D Permit/Deny      yes  yes  yes          yes
requisite  =3D Permit/DenyStop  no   yes  yes          yes
sufficient =3D Permit/Ignore    yes  yes  yes          no
optional   =3D Ignore/Ignore    yes  yes  no           no
binding    =3D PermitStop/Deny  yes  no   yes          yes

and

necessary  =3D Ignore/Deny      yes  yes  no           yes


This seems *SO* much clearer to me, and can be done as simple string
aliases in the current syntax.

--
Dan.



--bnUi9GzdSM4S/DMA
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (NetBSD)

iD8DBQFCfUg0EAVxvV4N66cRAvrJAJ9iObUxtJDBIRhw3M4FWHdZhb4bHgCfS7ZK
FZi5Gacgkdse077r9QsvZsw=
=1lzT
-----END PGP SIGNATURE-----

--bnUi9GzdSM4S/DMA--