PATCH: add --loginpause to mingetty

[Bernie Innocenti]

Hello Florian,

the attached patches add an option to pause login until the user hits
a key.

We need something like it on OLPC because:

 - we don't want to set an empty password for either user root or olpc

 - at the same time, we want to allow users to login as root at the
   console

 - finally, we do not wish to waste memory on shells the user hasn't
   yet used

The security model we are implementing is very different from UNIX: we
ultimately trust the user at the console, but we don't trust applications
and we don't want them to gain root privileges using su or sudo with no
password.

I'm committing these changes to the OLPC-2 branch of mingetty in
Fedora CVS.  Please, let me know you'd like to merge them or
something similar.

-- 
 \___/
 |___|   Bernardo Innocenti - http://www.codewiz.org/
  \___\  One Laptop Per Child - http://www.laptop.org/

[Lubomir Kundrak]

On Wed, 2008-01-09 at 19:20 -0500, Bernardo Innocenti wrote:
>  Hello Florian,
>  
>  the attached patches add an option to pause login until the user hits
>  a key.
>  
>  We need something like it on OLPC because:
>  
>   - we don't want to set an empty password for either user root or olpc
>  
>   - at the same time, we want to allow users to login as root at the
>     console
>  
>   - finally, we do not wish to waste memory on shells the user hasn't
>     yet used
>  
>  The security model we are implementing is very different from UNIX: we
>  ultimately trust the user at the console, but we don't trust applications
>  and we don't want them to gain root privileges using su or sudo with no
>  password.
>  
>  I'm committing these changes to the OLPC-2 branch of mingetty in
>  Fedora CVS.  Please, let me know you'd like to merge them or
>  something similar. 
Such things are definitely better upstreamed if possible. Have you tried
contacting upstream?

Thanks,
-- 
Lubomir Kundrak (Red Hat Security Response Team)

[Bill Nottingham]

Lubomir Kundrak (lkundrak(a)redhat.com) said: 
>  > I'm committing these changes to the OLPC-2 branch of
> mingetty in
>  > Fedora CVS.  Please, let me know you'd like to merge them or
>  > something similar.
>  
>  Such things are definitely better upstreamed if possible. Have you tried
>  contacting upstream? 
Florian is upstream, IIRC.

Bill

[Florian La Roche]

On Thu, Jan 10, 2008 at 11:14:00AM -0500, Bill Nottingham wrote:
>  Lubomir Kundrak (lkundrak(a)redhat.com) said: 
>  > > I'm committing these changes to the OLPC-2 branch of mingetty in
>  > > Fedora CVS.  Please, let me know you'd like to merge them or
>  > > something similar.
>  > 
>  > Such things are definitely better upstreamed if possible. Have you tried
>  > contacting upstream?
>  
>  Florian is upstream, IIRC. 


Hello Bernardo Innocenti,

I've refused to add many other feature requests and AFAIK we do have
quite a few forks of mingetty now available.

But I think the downscaling side of Linux is pretty important, from
small machines up to larges ones with virtualization. ;-)

I'll have a look around at other patches floating around and generate
another upstream release with these posted ones here. They look sane
to me.

Thanks a lot,

Florian La Roche