Bug#784158: Missing pam_env.so user_readenv=1 in the pam file

2022-04-09 Thread Christoph Anton Mitterer
Hey. I should add, that there was: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=611136 which is about a security hole that involved reading the user specific environment file. I couldn't find any in-depth analysis of that or some definite information on whether this was fixed or not. Cause

Bug#784158: Missing pam_env.so user_readenv=1 in the pam file

2022-04-07 Thread Christoph Anton Mitterer
(sorry for re-sending, but seems the Debian BTS doesn't like my other mail address o.O) CCing pam maintainers for their opinion on whether this could be don in PAM's common-session config, for the benefit of all. On Thu, 2022-04-07 at 09:14 +0200, Yves-Alexis Perez wrote: > > May I split these

Bug#784158: Missing pam_env.so user_readenv=1 in the pam file

2022-04-07 Thread Yves-Alexis Perez
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On Thu, 2022-04-07 at 05:59 +0200, Christoph Anton Mitterer wrote: > You've set wontfix on #672793 some longer time ago, but AFAIU, this was > because of some user's request to have lightdm source .profile (which > is IMO indeed plain wrong).

Bug#784158: Missing pam_env.so user_readenv=1 in the pam file

2021-06-17 Thread Christoph Anton Mitterer
Hey. Anything new about this? It's clear that .profile and friends is *not* the right place to set the path. I would say however, that .xsessionrc isn't either, simply be because this would again be just for X, so users would need to set their PATH/etc. again at different locations. Doing