da2fa46551
Instead of the old workaround that replaces the whole PAM config, use Debian's framework (pam-configs) to add a rule for su. Enable it for users in qubes group only. PAM Config framework documentation: https://wiki.ubuntu.com/PAMConfigFrameworkSpec Issue: QubesOS/qubes-issues#5799 Original PR this change is based on: QubesOS/qubes-core-agent-linux#171
44 lines
1.4 KiB
Bash
44 lines
1.4 KiB
Bash
#!/bin/sh
|
|
# prerm script for qubes-core-agent-passwordless-root
|
|
#
|
|
# see: dh_installdeb(1)
|
|
|
|
set -e
|
|
|
|
# The prerm script may be called in the following ways:
|
|
# * <prerm> 'remove'
|
|
# * <old-prerm> 'upgrade' <new-version>
|
|
# * <conflictor's-prerm> 'remove' 'in-favour' <package> <new-version>
|
|
# * <deconfigured's-prerm> 'deconfigure' 'in-favour' <package-being-installed>
|
|
# <version> [removing conflicting-package version]
|
|
#
|
|
# The package whose prerm is being called will be at least "Half-Installed".
|
|
# All package dependencies will at least be "Half-Installed" and will have
|
|
# previously been configured and not removed. If there was no error, all
|
|
# dependencies will at least be "Unpacked", but these actions may be called in
|
|
# various error states where dependencies are only "Half-Installed" due to a
|
|
# partial upgrade.
|
|
#
|
|
# * <new-prerm> 'failed-upgrade' <old-version>
|
|
#
|
|
# Called during error handling when prerm upgrade fails. The new package
|
|
# will not yet be unpacked, and all the same constraints as for preinst
|
|
# upgrade apply.
|
|
#
|
|
# For details, see http://www.debian.org/doc/debian-policy/ or
|
|
# https://www.debian.org/doc/debian-policy/ch-maintainerscripts.html or
|
|
# the debian-policy package
|
|
|
|
if [ "$1" = remove ]; then
|
|
pam-auth-update --package --remove su.qubes
|
|
fi
|
|
|
|
# dh_installdeb will replace this with shell code automatically
|
|
# generated by other debhelper scripts.
|
|
|
|
#DEBHELPER#
|
|
|
|
exit 0
|
|
|
|
# vim: set ts=4 sw=4 sts=4 et :
|