I'm studying PAM, and I'm a bit clueless about the meaning of some combination of control flags. From the Red Hat documentation we have:
required
failure of such a PAM will ultimately lead to the PAM-API returning failure
but only after the remaining stacked modules (for this service and type)
have been invokedrequisite
like required, however, in the case that such a module returns a failure,
control is directly returned to the application.sufficient
success of such a module is enough to satisfy the authentication
requirements of the stack of modules (if a prior required module has failed
the success of this one is ignored). A failure of this module is not deemed
as fatal to satisfying the application that this type has succeeded. If the
module succeeds the PAM framework returns success to the application
immediately without trying any other modules.
So, in my understanding, if a module requisite
fails, the entire stack of modules will not be parsed, and the control will be back to the application immediately.
If a module sufficient
succeeds, the rest of modules stack will not be parsed and the control will be back to the application immediately.
If a module required
fails, the entire stack will be parsed.
Now, I cannot understand what will be the behavior when a certain module required
fails and another module sufficient
succeeds.
Best Answer
PAM proceeds through the items on the stack in sequence. It only keeps the memory of what state it's in (success or denied, with success meaning success so far), not of how it reached that state.
If an item marked
sufficient
succeeds, the PAM library stops processing that stack. This happens whether there were previousrequired
items or not. At this point, PAM returns the current state: success if no previousrequired
item failed, otherwise denied.Similarly, if an item marked
requisite
fails, the PAM library stops processing and returns a failure. At that point, it's irrelevant whether a previousrequired
item failed.In other words,
required
doesn't necessarily cause the whole stack to be processed. It only means to keep going.