Make PAM optional at runtime #420
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Hm, I'm not sure I understand the benefits… Dynamic loading is pretty cumbersome to deal with, and this still needs PAM at compile-time. |
|
It needs PAM at compile-time, but works without PAM at runtime. The main benefit is that a single binary can be use both with and without PAM. |
swaylock links to PAM directly, so the same binary cannot be used in scenarios where PAM is not installed. Load PAM at runtime, to enable using the same binary when PAM is not available.
WhyNotHugo
force-pushed
the
optional-pam
branch
2 times, most recently
from
fc3e75b to
7f7d84d
Compare
WhyNotHugo
changed the title
WhyNotHugo
force-pushed
the
optional-pam
branch
4 times, most recently
from
3e1cfad to
8a50d18
Compare
Allow building with PAM and/or shadow, instead of them build mutually exclusive. This allows producing a single binary which can be used on hosts with or without PAM installed.
WhyNotHugo
force-pushed
the
optional-pam
branch
from
8a50d18 to
caa2ab3
Compare
|
I've updated the PR description with the details of the final version. I've both build permutations to CI, and this is ready for review. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
swaylock links to PAM directly, so the same binary cannot be used in scenarios where PAM is not installed.
Load PAM at runtime, to enable using the same binary when PAM is not available. Use shadow as a fallback if PAM is not available.
This allows enabling both the
shadowandpambackend at compile-time, but if PAM is not available at runtime, shadow is used as a fallback. This is particularly useful for distribution packages where some users rely on PAM and others do not use PAM.I've successfully tested this on Alpine. The same binary works with or without PAM.