From Fedora Project Wiki
No edit summary
No edit summary
Line 55: Line 55:
* Other developers: N/A
* Other developers: N/A


* Release engineering: [https://pagure.io/releng/issues #Releng issue number] <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
* Release engineering: https://pagure.io/releng/issue/11649
<!-- Does this feature require coordination with release engineering (e.g. changes to installer image generation or update package delivery)?  Is a mass rebuild required?  include a link to the releng issue.
The issue is required to be filed prior to feature submission, to ensure that someone is on board to do any process development work and testing and that all changes make it into the pipeline; a bullet point in a change is not sufficient communication -->


* Policies and guidelines: N/A (not needed for this Change) <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
* Policies and guidelines: N/A (not needed for this Change) <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
Line 70: Line 68:


<!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
<!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
=== Upgrade ===
* If the pam_userdb module is used by the system, then the user/sysadmin will have to run the conversion tool. This can't be done automatically because the database location is configurable, and the conversion tool will need manual intervention.
=== Compatibility ===
* pam_userdb module is mainly used in vsftpd environments. If this module is used by the system and the database isn't converted, then the user won't be able to authenticate in vsftpd environments. The user would still be able to authenticate using other methods and run the conversion tool.





Revision as of 09:21, 30 August 2023

Switch pam_userdb from BerkeleyDB to GDBM

This is a proposed Change for Fedora Linux.
This document represents a proposed Change. As part of the Changes process, proposals are publicly announced in order to receive community feedback. This proposal will only be implemented if approved by the Fedora Engineering Steering Committee.

Summary

pam_userdb was built with support for BerkeleyDB, but this project is no longer maintained, so it is replaced by GDBM.

Owner


Current status

  • Targeted release: Fedora Linux 40
  • Last updated: 2023-08-30
  • [<will be assigned by the Wrangler> devel thread]
  • FESCo issue: <will be assigned by the Wrangler>
  • Tracker bug: <will be assigned by the Wrangler>
  • Release notes tracker: <will be assigned by the Wrangler>

Detailed Description

Currently, the Fedora provided BerkeleyDB versions is 5.x, which has been unmaintained upstream for several years. BerkeleyDB v6.x is license incompatible, so moving to that version is not an option.

The proposal is to switch to GDBM, which has upstream support and whose license is compatible with Fedora.

Feedback

Benefit to Fedora

  • This changes uses an upstream maintained version, with new features and bug fixing. pam_userdb controls user authentication, and a bug in the database could lead to a security vulnerability.
  • This change uses a database that is Fedora license compatible.

Scope

  • Proposal owners:
    • libdb provides a program to port a BerkeleyDB database to GDBM.
    • Change PAM database build option to GDBM.
  • Other developers: N/A
  • Policies and guidelines: N/A (not needed for this Change)
  • Trademark approval: N/A
  • Alignment with Community Initiatives: N/A

Upgrade/compatibility impact

Upgrade

  • If the pam_userdb module is used by the system, then the user/sysadmin will have to run the conversion tool. This can't be done automatically because the database location is configurable, and the conversion tool will need manual intervention.

Compatibility

  • pam_userdb module is mainly used in vsftpd environments. If this module is used by the system and the database isn't converted, then the user won't be able to authenticate in vsftpd environments. The user would still be able to authenticate using other methods and run the conversion tool.


How To Test

User Experience

Dependencies

Contingency Plan

  • Contingency mechanism: (What to do? Who will do it?) N/A (not a System Wide Change)
  • Contingency deadline: N/A (not a System Wide Change)
  • Blocks release? N/A (not a System Wide Change), Yes/No


Documentation

N/A (not a System Wide Change)

Release Notes