On Fri, 12 Sep 2003, Greg A. Woods wrote:

: What do I mean by "_full_ proxy"?  Well, assuming we know (by spec. or
: by examination of the PAM code) what exactly the authenticator does to
: the current process context

That rather defeats the purpose of PAM.  Some authenticators (two-way smart
cards are a common example) are *stateful* and cannot run outside the
authenticated process without significant authenticator-specific context
copy operations.  At that point, the whole point of running a pluggable
*off-the-shelf* module in the same process context is defeated and you might
as well not use PAM at all.

All this babble is all FUD.  If you don't trust PAM modules, don't use them.
But that doesn't mean others should be barred from using them.

-- 
-- Todd Vierling <tv@duh.org> <tv@pobox.com>