diff options
| author | Matthew Luckam <mcl209@vt.edu> | 2024-01-17 17:24:40 -0500 |
|---|---|---|
| committer | Dmitry V. Levin <ldv@strace.io> | 2024-08-13 08:00:00 +0000 |
| commit | 83c344ee5a5eb4796e435bce897b83cae3465243 (patch) | |
| tree | 24f94f2f77b1ad68e3a66d87ae01bf9c5f33fcb9 /modules/pam_access/access.conf.5.xml | |
| parent | 10071e284ea4a496ab97b56d477e23cf09d972ec (diff) | |
| download | pam-83c344ee5a5eb4796e435bce897b83cae3465243.tar.gz pam-83c344ee5a5eb4796e435bce897b83cae3465243.tar.bz2 pam-83c344ee5a5eb4796e435bce897b83cae3465243.zip | |
pam_access: support UID and GID in access.conf
Extend access.conf(5) syntax to support UID and GID in addition to
user and group names.
Co-authored-by: blueskycs2c <lili.ding@cs2c.com>
Signed-off-by: Dmitry V. Levin <ldv@strace.io>
Resolves: https://github.com/linux-pam/linux-pam/issues/114
Resolves: https://github.com/linux-pam/linux-pam/pull/186
Resolves: https://github.com/linux-pam/linux-pam/pull/601
Diffstat (limited to 'modules/pam_access/access.conf.5.xml')
| -rw-r--r-- | modules/pam_access/access.conf.5.xml | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/modules/pam_access/access.conf.5.xml b/modules/pam_access/access.conf.5.xml index 2dc5d477..35a1a8fe 100644 --- a/modules/pam_access/access.conf.5.xml +++ b/modules/pam_access/access.conf.5.xml @@ -63,10 +63,10 @@ <para> The second field, the <replaceable>users</replaceable>/<replaceable>group</replaceable> - field, should be a list of one or more login names, group names, or + field, should be a list of one or more login names, group names, uid, gid, or <emphasis>ALL</emphasis> (which always matches). To differentiate user entries from group entries, group entries should be written - with brackets, e.g. <emphasis>(group)</emphasis>. + with brackets, e.g. <emphasis>(group)</emphasis> or <emphasis>(gid)</emphasis>. </para> <para> @@ -176,6 +176,12 @@ <para>-:root:ALL</para> <para> + A user with uid <emphasis>1003</emphasis> and a group with gid + <emphasis>1000</emphasis> should be allowed to get access + from all other sources. + </para> + <para>+:(1000) 1003:ALL</para> + <para> User <emphasis>foo</emphasis> and members of netgroup <emphasis>admins</emphasis> should be allowed to get access from all sources. This will only work if netgroup service is available. |