pam_motd should log the error when run-parts fails
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
pam (Ubuntu) |
Triaged
|
Low
|
Unassigned |
Bug Description
Binary package hint: libpam-modules
** Problem:
pam_motd module creates the file /var/run/motd.new but doesn't rename it into /var/run/motd.
The /etc/motd symlink points to /var/run/motd and at each user login are shown old informations.
** Repeatable:
Yes, always
** How to repeat:
You need to force "run-parts /etc/update-motd.d" to exit with errors.
To complete this task just add in the update-motd.d chain a script that exits with error or a symlink to a script that doesn't exist.
** Explanation:
I discover this issue while upgrading from lucid to maverik (server edition).
For some reason, the package update-
At each ssh login I was presented with stale informations.
Looking into the pam_motd.c code I found the problem.
The module performs a system("run-parts /etc/update-motd.d > /var/run/motd.new") call, that returns a non-zero value if run-parts exits with errors.
If the system() call returns a non-zero value, the following rename() call is not executed.
The file /var/run/motd.new is *always* created and written to disk with the output of the working scripts.
We are in the situation where the /var/run/motd.new is updated but never renamed into /var/run/motd, if some scripts have bugs or exit with errors.
I have attached a patch that should solve this problem.
The rename() call is not blocked by the system() call and moreover if run-parts exits with a non-zero value, pam_syslog is used to log the error and help sysadmins to find rapidly the problem.
Within the patch, the rename() call is always executed, even if run-parts fails totally and /var/run/motd.new is not created.
In this case, the rename() call doesn't perform the renaming and returns a non-zero value (but we are not interested in it).
Thanks,
Yusef
tags: | added: patch |
tags: |
added: bitesize removed: patch |
summary: |
- pam_motd doesn't rename /var/run/motd.new if run-parts exits with errors + pam_motd should log the error when run-parts fails |
Thank you for taking the time to report this issue and help to improve Ubuntu.
This is not a bug, this behavior is by design. We don't want to copy over an incomplete or broken motd in the event that one or more scripts have failed. The correct fix is to solve whatever is causing the non-zero exit of run-parts on your system.