libpam: provide a real /etc/pam.d/ftp

[ivy]

Summary

We provide both /etc/pam.d/ftp and /etc/pam.d/ftpd because FTP servers
are inconsistent about which service name they use.  Previously ftp was
a hard link to ftpd; to avoid hard linking config files, replace ftp
with a normal config file that includes the ftpd service.

Move ftpd from the -ftpd package into the -runtime package (where the
rest of the pam.d services live) since FTP servers from ports use it,
and people using a ports FTP server won't want to install the -ftpd
package as well.

[kevans]

lib/libpam/pam.d/Makefile

31–33

I suspect you want this to be spelled ${FTPTAG_ARGS} instead, in case we modify how configuration tags are done at an infrastructure level.

[des]

I would prefer fixing the mk scripts, if that's not too much work?

[ivy]

use FTPTAG_ARGS

[ivy]

In D50339#1148701, @des wrote:

I would prefer fixing the mk scripts, if that's not too much work?

i don't think this is a problem in the mk scripts, the Makefile just wasn't accounting for the fact that the file is in a non-default conf group. unless there's something else to fix here?

[kevans]

In D50339#1148754, @ivy wrote:

In D50339#1148701, @des wrote:

I would prefer fixing the mk scripts, if that's not too much work?

i don't think this is a problem in the mk scripts, the Makefile just wasn't accounting for the fact that the file is in a non-default conf group. unless there's something else to fix here?

Looking at the target from a broader view, it seems like it only exists because we don't have a notion of per-group LINKS. I think that's the only further enhancement that would be required to do this correctly- otherwise the bug was entirely on us not using the correct *TAG_ARGS

[ivy]

In D50339#1148758, @kevans wrote:

Looking at the target from a broader view, it seems like it only exists because we don't have a notion of per-group LINKS.

i really dislike the idea of hardlinked config files so i'm not sure this is something we want to encourage by adding (more) mk support... in fact my first thought on discovering this bug was that we should remove one of them, but i assume there's a reason we have both—ports FTP servers, maybe? so i'm happy with this as it is (using FTPTAG_ARGS) but if we really want mk infra for this i suppose we could do that.

[des]

The correct service name is ftpd, but (at least) two FTP daemons in ports use ftp instead (others use either ftpd or something more specific).

However, we don't need to link the file. We can instead create an ftp policy containing:

auth            include         ftpd
account         include         ftpd
session         include         ftpd

[ivy]

if we're intending for this file to be used by ports, FreeBSD-ftpd may not be the right place to put it in the first place; perhaps it should live in -runtime with (most of) the rest of the PAM configs?

% grep '@config.* /etc/pam.d/' ~/src/bsd/obj/home/ivy/src/bsd/dev/amd64.amd64/worldstage/*.plist
/home/ivy/src/bsd/obj/home/ivy/src/bsd/dev/amd64.amd64/worldstage/at.plist:@config(root,wheel,0644,) /etc/pam.d/atrun
/home/ivy/src/bsd/obj/home/ivy/src/bsd/dev/amd64.amd64/worldstage/cron.plist:@config(root,wheel,0644,) /etc/pam.d/cron
/home/ivy/src/bsd/obj/home/ivy/src/bsd/dev/amd64.amd64/worldstage/ftp.plist:@config(root,wheel,0644,) /etc/pam.d/ftp
/home/ivy/src/bsd/obj/home/ivy/src/bsd/dev/amd64.amd64/worldstage/ftp.plist:@config(root,wheel,0644,) /etc/pam.d/ftpd
/home/ivy/src/bsd/obj/home/ivy/src/bsd/dev/amd64.amd64/worldstage/runtime.plist:@config(root,wheel,0444,) /etc/pam.d/README
/home/ivy/src/bsd/obj/home/ivy/src/bsd/dev/amd64.amd64/worldstage/runtime.plist:@config(root,wheel,0644,) /etc/pam.d/imap
/home/ivy/src/bsd/obj/home/ivy/src/bsd/dev/amd64.amd64/worldstage/runtime.plist:@config(root,wheel,0644,) /etc/pam.d/login
/home/ivy/src/bsd/obj/home/ivy/src/bsd/dev/amd64.amd64/worldstage/runtime.plist:@config(root,wheel,0644,) /etc/pam.d/other
/home/ivy/src/bsd/obj/home/ivy/src/bsd/dev/amd64.amd64/worldstage/runtime.plist:@config(root,wheel,0644,) /etc/pam.d/passwd
/home/ivy/src/bsd/obj/home/ivy/src/bsd/dev/amd64.amd64/worldstage/runtime.plist:@config(root,wheel,0644,) /etc/pam.d/pop3
/home/ivy/src/bsd/obj/home/ivy/src/bsd/dev/amd64.amd64/worldstage/runtime.plist:@config(root,wheel,0644,) /etc/pam.d/sshd
/home/ivy/src/bsd/obj/home/ivy/src/bsd/dev/amd64.amd64/worldstage/runtime.plist:@config(root,wheel,0644,) /etc/pam.d/su
/home/ivy/src/bsd/obj/home/ivy/src/bsd/dev/amd64.amd64/worldstage/runtime.plist:@config(root,wheel,0644,) /etc/pam.d/system
/home/ivy/src/bsd/obj/home/ivy/src/bsd/dev/amd64.amd64/worldstage/runtime.plist:@config(root,wheel,0644,) /etc/pam.d/xdm

[des]

yeah we can put it in runtime and add a comment at the top explaining that it is provided for compatibility with ports that use the wrong service name.

[ivy]

per comments, remove the link

[ivy]

i've tested pkg upgrade with this change and it is not confused by replacing the hard link with a separate file as far as i can tell (e.g., it doesn't replace /etc/pam.d/ftpd with the contents of /etc/pam.d/ftp).

[ivy]

actually i see the file was previously installed in the ftp package (not ftpd) which seems also dubious as that's for the FTP client, which won't be using PAM at all. so i think the change is still right but i'll clarify the commit message before landing.

[des]

lib/libpam/pam.d/ftp

2

We don't need two blank lines, I think they're an artifact of when we had $FreeBSD$ here.