Why pam and pambase?

Message

pa4wdh · Post by **pa4wdh** » Thu Oct 22, 2020 5:33 pm

Hi All,

Yesterday i updated my RPi2B and one of the updates was pam. I was aware of the changes and was warned by the news item. The warning in the news item did not apply to me (i did not make manual changes and config-protect-if-modified is in use).
My Pi is used as a headless ntp server, during normal use my only access is ssh. Because of the (lack of) speed of the Pi, there was quite some time between updating pam and later pambase. During that time the Pi was inaccessible, no ssh, no local console.

That made me think: Why are pam and pambase separate packages? pambase only seems to provide some (gentoo specific?) configuration, and I see no reason why it can't be combined with the pam package.

Does anyone know why it's done this way?

netfab · Post by **netfab** » Fri Oct 23, 2020 5:05 pm

https://flameeyes.blog/2010/04/29/pamba ... that-free/

pa4wdh · Post by **pa4wdh** » Sat Oct 24, 2020 7:57 am

Thanks for sharing the link netfab, it was an interesting read.

For what I understand now pambase generates the config files in /etc/pam.d based on it's USE flags. For me that still doesn't answer the question what that can't be done in the pam package itself and get rid of pambase, so that the binaries (currently provided by pam) and configuration (currently provided by pambase) are always in sync.

netfab · Post by **netfab** » Sat Oct 24, 2020 8:23 am

For me that still doesn't answer the question what that can't be done in the pam package itself and get rid of pambase, so that the binaries (currently provided by pam) and configuration (currently provided by pambase) are always in sync.

Maybe to break circular deps : https://bugs.gentoo.org/239437#c2

Flameeyes · Post by **Flameeyes** » Sat Oct 24, 2020 1:36 pm

Much more simply: it's easier to maintain Gentoo-specific configuration in Gentoo-specific packages, rather than bundling it with another upstream package.

Particularly during development, the updates to pambase were completely out of sync with Linux-PAM, so having two separate packages meant fixes for pambase wouldn't be causing rebuilds of the whole PAM implementation and libraries when the code didn't change at all.

And yes I think I would do it exactly the same way if I was developing it right now. Except definitely not with the C preprocessor.

pa4wdh · Post by **pa4wdh** » Sat Oct 24, 2020 8:58 pm

Thanks for your answer Flameeyes.
What do you mean with your comment on the C preprocessor? As far as i can see the pambase package uses a python script to parse templates and generate the config files.

Flameeyes · Post by **Flameeyes** » Sun Oct 25, 2020 4:41 pm

The original version used the C pre-processor rather than something more maintainable.

I was trying to rewrite it in M4 at some point, but now I can see I was just full of it

https://flameeyes.blog/tag/pambase has some of the history behind all of the development while I was involved. I'm no longer active at all, so I have no updates on it. But if you're interested in history, that's where it would be.

pa4wdh · Post by **pa4wdh** » Mon Oct 26, 2020 8:06 am

Thanks for the link, it's interesting to see how things came to be way they are now.

Using a C-preprocessor to generate configuration doesn't seem like the right tool for the job