This is an automated email from the ASF dual-hosted git repository. potiuk pushed a commit to branch hardened-python-base-images in repository https://gitbox.apache.org/repos/asf/airflow.git
commit d042da46812b061b3890ae328041009016eb7c61 Author: Jarek Potiuk <[email protected]> AuthorDate: Sat Oct 10 13:50:11 2026 +0100 Restore the PAM configs the trixie hardened images strip The Debian 13 hardened images ship libpam-runtime and passwd already installed but without their /etc/pam.d files, so installing them restored nothing and adding the CI image's airflow user failed with pam_start() errors. Generated-by: Claude Opus 5 Claude-Session: https://claude.ai/code/session_014np1fVAxHmGaBFt3qebJ8x --- Dockerfile | 8 ++++++++ Dockerfile.ci | 8 ++++++++ scripts/docker/install_os_dependencies.sh | 8 ++++++++ 3 files changed, 24 insertions(+) diff --git a/Dockerfile b/Dockerfile index 92eafdcc8ae..3360811687e 100644 --- a/Dockerfile +++ b/Dockerfile @@ -307,6 +307,14 @@ function restore_debian_base_files() { apt-get install -y --no-install-recommends dash apt-get install -y --no-install-recommends base-passwd libpam-runtime update-passwd + # The Debian 13 hardened images strip /etc/pam.d further: libpam-runtime and passwd are already + # installed there, so installing them generates nothing, and passwd, chpasswd and chfn abort with + # "pam_start() failed". Reinstalling passwd brings back its deleted PAM configs, and + # pam-auth-update - which treats the deleted common-* files as local changes - needs --force. + apt-get install -y --no-install-recommends --reinstall -o Dpkg::Options::=--force-confmiss passwd + if [[ ! -e /etc/pam.d/common-auth ]]; then + pam-auth-update --package --force + fi if [[ ! -e /etc/shells ]]; then printf '%s\n' "# /etc/shells: valid login shells" /bin/sh /bin/bash > /etc/shells fi diff --git a/Dockerfile.ci b/Dockerfile.ci index 39cd72626e0..a5acf8ffc24 100644 --- a/Dockerfile.ci +++ b/Dockerfile.ci @@ -243,6 +243,14 @@ function restore_debian_base_files() { apt-get install -y --no-install-recommends dash apt-get install -y --no-install-recommends base-passwd libpam-runtime update-passwd + # The Debian 13 hardened images strip /etc/pam.d further: libpam-runtime and passwd are already + # installed there, so installing them generates nothing, and passwd, chpasswd and chfn abort with + # "pam_start() failed". Reinstalling passwd brings back its deleted PAM configs, and + # pam-auth-update - which treats the deleted common-* files as local changes - needs --force. + apt-get install -y --no-install-recommends --reinstall -o Dpkg::Options::=--force-confmiss passwd + if [[ ! -e /etc/pam.d/common-auth ]]; then + pam-auth-update --package --force + fi if [[ ! -e /etc/shells ]]; then printf '%s\n' "# /etc/shells: valid login shells" /bin/sh /bin/bash > /etc/shells fi diff --git a/scripts/docker/install_os_dependencies.sh b/scripts/docker/install_os_dependencies.sh index ef74fa7d468..b1083387b6b 100644 --- a/scripts/docker/install_os_dependencies.sh +++ b/scripts/docker/install_os_dependencies.sh @@ -218,6 +218,14 @@ function restore_debian_base_files() { apt-get install -y --no-install-recommends dash apt-get install -y --no-install-recommends base-passwd libpam-runtime update-passwd + # The Debian 13 hardened images strip /etc/pam.d further: libpam-runtime and passwd are already + # installed there, so installing them generates nothing, and passwd, chpasswd and chfn abort with + # "pam_start() failed". Reinstalling passwd brings back its deleted PAM configs, and + # pam-auth-update - which treats the deleted common-* files as local changes - needs --force. + apt-get install -y --no-install-recommends --reinstall -o Dpkg::Options::=--force-confmiss passwd + if [[ ! -e /etc/pam.d/common-auth ]]; then + pam-auth-update --package --force + fi if [[ ! -e /etc/shells ]]; then printf '%s\n' "# /etc/shells: valid login shells" /bin/sh /bin/bash > /etc/shells fi
