Re: new package: pam_uaccess

[ahesford <ahesford@users.noreply.github.com>]

[-- Attachment #1: Type: text/plain, Size: 1090 bytes --]

New comment by ahesford on void-packages repository

https://github.com/void-linux/void-packages/pull/50734#issuecomment-2156459362

Comment:
I'm aware of the functionality if `-session optional`, but that isn't my point:
1. We ship a fair number of PAM modules that aren't optionally enabled in the base configuration.
2. Those that are enabled represent either extremly common workflows (*e.g.*, `elogind`) or represent actions limited to the scope of the user logging in (*e.g.*, `dumb_runtime_dir`, `turnstile`, `gnome_keyring` make directories, run programs or unlock things all owned by the user---they don't grant system-level privileges; also, I don't necessarily think that `turnstile` belongs in there by default).
3. This is still a very new program.

Enabling PAM services by default in `pam-base` inverts a knowledge dependency and should be avoided. We make exceptions in some cases because we lack a good mechanism for modifying the PAM configuration in packages that need it, but that exception should be limited to a few very common programs that are well understood.