Pam 1.5.0 has a auth bypass under some conditions

I would love to see no_new_privs more widely used, so thanks!

Unfortunately it should be noted on most distributions this will cause counterintuitive breakages -- most notably ping won't work for unprivileged users (but luckily you can fix this by changing net.ipv4.ping_group_range to include the unprivileged user groups -- I hope distributions fix this eventually...).

Does that actually fix it? The linked email listing says the issue is that logging in as a non-existent user with an empty password will work, and the fix that you linked seems to just make it harder to figure out if a user doesn't exist. That doesn't seem like it fixes anything; there's no need to determine beforehand if a user doesn't exist to use this exploit, since you could just try to use the exploit with an arbitrary username, and if it works, then obviously the user doesn't exist.

I hate to be that guy, but _damn_ does PAM seem ripe for being rewritten in Rust. Maybe it's the PTSD speaking, but seeing vanilla C string operations in a security-critical library makes my hair stand on end.

Searching around, the best I can find is one 0.1 crate that hasn't seen activity since 2017:

https://crates.io/crates/librustpam

I wonder if I should create a "pam_unix_non_existent:" account.

Doesn't pretty much every mainstream Linux distro use it?

What is an alternative? PAM seems pretty ubiquitous.

Do you mean via mod_pam style PAM module creations? Help Me understand what you mean.

PAM is an authn core in any modern mainstream Linux distro. If you build and/or tweak Linux boxes, PAM was almost always here right with you. The only question is do you know what exacly PAM do?