Defer setting up enhanced recording until after PAM has completed initializing#29279
Merged
rosstimothy merged 1 commit intomasterfrom Jul 25, 2023
Merged
Defer setting up enhanced recording until after PAM has completed initializing#29279rosstimothy merged 1 commit intomasterfrom
rosstimothy merged 1 commit intomasterfrom
Conversation
rosstimothy
force-pushed
the
tross/pam_wait
branch
4 times, most recently
from
e0ac35e to
ad389a8
Compare
jakule
reviewed
Jul 19, 2023
rosstimothy
force-pushed
the
tross/pam_wait
branch
from
ff6853a to
5ee0c8b
Compare
jakule
approved these changes
Jul 20, 2023
Contributor
jakule
left a comment
jakule
left a comment
There was a problem hiding this comment.
LGTM. One nit is that we implicitly assume that PAM won't take more than 10 seconds. I hope this is a reasonable assumption.
Contributor
Author
|
friendly ping @lxea @probakowski |
probakowski
approved these changes
Jul 24, 2023
The reexec process now has a two way wait mechanism to allow the child process to complete any setup operations that may be required before the parent process starts enhanced recording. The old process was: 1) Parent launches child process 2) Child process opens PAM context and blocks on the continue signal 3) Parent sets up enhanced recording 4) Parent sends the continue signal 5) Child executes command/opens shell The new process is: 1) Parent launches child process and waits for child continue signal 2) Child process opens PAM context and then signals it has completed setup 3) Parent receives child continue signal and sets up enhanced recording 4) Parent sends the continue signal 5) Child executes command/opens shell Closes #29030
rosstimothy
force-pushed
the
tross/pam_wait
branch
from
5ee0c8b to
f1bac47
Compare
|
@rosstimothy See the table below for backport results.
|
rosstimothy
added a commit
that referenced
this pull request
Jul 25, 2023
…9279) The reexec process now has a two way wait mechanism to allow the child process to complete any setup operations that may be required before the parent process starts enhanced recording. The old process was: 1) Parent launches child process 2) Child process opens PAM context and blocks on the continue signal 3) Parent sets up enhanced recording 4) Parent sends the continue signal 5) Child executes command/opens shell The new process is: 1) Parent launches child process and waits for child continue signal 2) Child process opens PAM context and then signals it has completed setup 3) Parent receives child continue signal and sets up enhanced recording 4) Parent sends the continue signal 5) Child executes command/opens shell Closes #29030
rosstimothy
added a commit
that referenced
this pull request
Jul 25, 2023
…9279) The reexec process now has a two way wait mechanism to allow the child process to complete any setup operations that may be required before the parent process starts enhanced recording. The old process was: 1) Parent launches child process 2) Child process opens PAM context and blocks on the continue signal 3) Parent sets up enhanced recording 4) Parent sends the continue signal 5) Child executes command/opens shell The new process is: 1) Parent launches child process and waits for child continue signal 2) Child process opens PAM context and then signals it has completed setup 3) Parent receives child continue signal and sets up enhanced recording 4) Parent sends the continue signal 5) Child executes command/opens shell Closes #29030
github-merge-queue Bot
pushed a commit
that referenced
this pull request
Jul 25, 2023
…9279) (#29580) The reexec process now has a two way wait mechanism to allow the child process to complete any setup operations that may be required before the parent process starts enhanced recording. The old process was: 1) Parent launches child process 2) Child process opens PAM context and blocks on the continue signal 3) Parent sets up enhanced recording 4) Parent sends the continue signal 5) Child executes command/opens shell The new process is: 1) Parent launches child process and waits for child continue signal 2) Child process opens PAM context and then signals it has completed setup 3) Parent receives child continue signal and sets up enhanced recording 4) Parent sends the continue signal 5) Child executes command/opens shell Closes #29030
github-merge-queue Bot
pushed a commit
that referenced
this pull request
Jul 26, 2023
…9279) (#29582) The reexec process now has a two way wait mechanism to allow the child process to complete any setup operations that may be required before the parent process starts enhanced recording. The old process was: 1) Parent launches child process 2) Child process opens PAM context and blocks on the continue signal 3) Parent sets up enhanced recording 4) Parent sends the continue signal 5) Child executes command/opens shell The new process is: 1) Parent launches child process and waits for child continue signal 2) Child process opens PAM context and then signals it has completed setup 3) Parent receives child continue signal and sets up enhanced recording 4) Parent sends the continue signal 5) Child executes command/opens shell Closes #29030
rosstimothy
added a commit
that referenced
this pull request
Nov 26, 2024
#29279 caused PAM to deadlock when performing interactive authentication. To restore the previous semblance of functional PAM, this reverts waiting for PAM to be complete if BPF is disabled. #29279 was specifically added to prevent systemd, which may be invoked via a PAM module, from moving the exec subprocess to a different cgroup. Since cgroups are not used outside of Enhanced Session Recording this is a stop-gap measure that can allow mose users of PAM to get an immediate restoration of behavior while a more long term and sane approach to performing PAM during the SSH handshake can be considered, evaluated, and tested. Closes #49028.
rosstimothy
added a commit
that referenced
this pull request
Nov 27, 2024
#29279 caused PAM to deadlock when performing interactive authentication. To restore the previous semblance of functional PAM, this reverts waiting for PAM to be complete if BPF is disabled. #29279 was specifically added to prevent systemd, which may be invoked via a PAM module, from moving the exec subprocess to a different cgroup. Since cgroups are not used outside of Enhanced Session Recording this is a stop-gap measure that can allow mose users of PAM to get an immediate restoration of behavior while a more long term and sane approach to performing PAM during the SSH handshake can be considered, evaluated, and tested. Closes #49028.
github-merge-queue Bot
pushed a commit
that referenced
this pull request
Nov 27, 2024
#29279 caused PAM to deadlock when performing interactive authentication. To restore the previous semblance of functional PAM, this reverts waiting for PAM to be complete if BPF is disabled. #29279 was specifically added to prevent systemd, which may be invoked via a PAM module, from moving the exec subprocess to a different cgroup. Since cgroups are not used outside of Enhanced Session Recording this is a stop-gap measure that can allow mose users of PAM to get an immediate restoration of behavior while a more long term and sane approach to performing PAM during the SSH handshake can be considered, evaluated, and tested. Closes #49028.
github-actions Bot
pushed a commit
that referenced
this pull request
Nov 27, 2024
#29279 caused PAM to deadlock when performing interactive authentication. To restore the previous semblance of functional PAM, this reverts waiting for PAM to be complete if BPF is disabled. #29279 was specifically added to prevent systemd, which may be invoked via a PAM module, from moving the exec subprocess to a different cgroup. Since cgroups are not used outside of Enhanced Session Recording this is a stop-gap measure that can allow mose users of PAM to get an immediate restoration of behavior while a more long term and sane approach to performing PAM during the SSH handshake can be considered, evaluated, and tested. Closes #49028.
rosstimothy
added a commit
that referenced
this pull request
Nov 27, 2024
#29279 caused PAM to deadlock when performing interactive authentication. To restore the previous semblance of functional PAM, this reverts waiting for PAM to be complete if BPF is disabled. #29279 was specifically added to prevent systemd, which may be invoked via a PAM module, from moving the exec subprocess to a different cgroup. Since cgroups are not used outside of Enhanced Session Recording this is a stop-gap measure that can allow mose users of PAM to get an immediate restoration of behavior while a more long term and sane approach to performing PAM during the SSH handshake can be considered, evaluated, and tested. Closes #49028.
rosstimothy
added a commit
that referenced
this pull request
Nov 27, 2024
#29279 caused PAM to deadlock when performing interactive authentication. To restore the previous semblance of functional PAM, this reverts waiting for PAM to be complete if BPF is disabled. #29279 was specifically added to prevent systemd, which may be invoked via a PAM module, from moving the exec subprocess to a different cgroup. Since cgroups are not used outside of Enhanced Session Recording this is a stop-gap measure that can allow mose users of PAM to get an immediate restoration of behavior while a more long term and sane approach to performing PAM during the SSH handshake can be considered, evaluated, and tested. Closes #49028.
github-merge-queue Bot
pushed a commit
that referenced
this pull request
Nov 27, 2024
#29279 caused PAM to deadlock when performing interactive authentication. To restore the previous semblance of functional PAM, this reverts waiting for PAM to be complete if BPF is disabled. #29279 was specifically added to prevent systemd, which may be invoked via a PAM module, from moving the exec subprocess to a different cgroup. Since cgroups are not used outside of Enhanced Session Recording this is a stop-gap measure that can allow mose users of PAM to get an immediate restoration of behavior while a more long term and sane approach to performing PAM during the SSH handshake can be considered, evaluated, and tested. Closes #49028.
github-merge-queue Bot
pushed a commit
that referenced
this pull request
Nov 27, 2024
#29279 caused PAM to deadlock when performing interactive authentication. To restore the previous semblance of functional PAM, this reverts waiting for PAM to be complete if BPF is disabled. #29279 was specifically added to prevent systemd, which may be invoked via a PAM module, from moving the exec subprocess to a different cgroup. Since cgroups are not used outside of Enhanced Session Recording this is a stop-gap measure that can allow mose users of PAM to get an immediate restoration of behavior while a more long term and sane approach to performing PAM during the SSH handshake can be considered, evaluated, and tested. Closes #49028.
github-merge-queue Bot
pushed a commit
that referenced
this pull request
Nov 27, 2024
#29279 caused PAM to deadlock when performing interactive authentication. To restore the previous semblance of functional PAM, this reverts waiting for PAM to be complete if BPF is disabled. #29279 was specifically added to prevent systemd, which may be invoked via a PAM module, from moving the exec subprocess to a different cgroup. Since cgroups are not used outside of Enhanced Session Recording this is a stop-gap measure that can allow mose users of PAM to get an immediate restoration of behavior while a more long term and sane approach to performing PAM during the SSH handshake can be considered, evaluated, and tested. Closes #49028.
carloscastrojumo
pushed a commit
to carloscastrojumo/teleport
that referenced
this pull request
Feb 19, 2025
gravitational#29279 caused PAM to deadlock when performing interactive authentication. To restore the previous semblance of functional PAM, this reverts waiting for PAM to be complete if BPF is disabled. gravitational#29279 was specifically added to prevent systemd, which may be invoked via a PAM module, from moving the exec subprocess to a different cgroup. Since cgroups are not used outside of Enhanced Session Recording this is a stop-gap measure that can allow mose users of PAM to get an immediate restoration of behavior while a more long term and sane approach to performing PAM during the SSH handshake can be considered, evaluated, and tested. Closes gravitational#49028.
This was referenced Nov 19, 2025
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The reexec process now has a two way wait mechanism to allow the child process to complete any setup operations that may be required before the parent process starts enhanced recording.
The old process was:
The new process is now:
Closes #29030