Changes/PamBerkeleyDBtoGdbm

Switch pam_userdb from BerkeleyDB to GDBM

This is a proposed Change for Fedora Linux.
This document represents a proposed Change. As part of the Changes process, proposals are publicly announced in order to receive community feedback. This proposal will only be implemented if approved by the Fedora Engineering Steering Committee.

Summary

pam_userdb was built with support for BerkeleyDB, but this project is no longer maintained as open source, so it is replaced by GDBM.

Owner

• Name: Iker Pedrosa Filip Janus
• Email: ipedrosa@redhat.com fjanus@redhat.com

Current status

• Targeted release: Fedora Linux 40
• Last updated: 2023-09-04
• [<will be assigned by the Wrangler> devel thread]
• FESCo issue: <will be assigned by the Wrangler>
• Tracker bug: <will be assigned by the Wrangler>
• Release notes tracker: <will be assigned by the Wrangler>

Detailed Description

Currently, the Fedora provided BerkeleyDB versions is 5.x, which has been unmaintained upstream for several years. BerkeleyDB v6.x is license incompatible, so moving to that version is not an option.

The proposal is to switch to GDBM, which has upstream support and whose license is compatible with Fedora.

Feedback

This proposal contains manual steps to be executed by system administrators in the upgrade path. It is a risky point, as it relies on sysadmins reading the documentation, but it's the best solution so far. The database location is defined in the PAM stack, and the system administrator can set it to any value. Therefore, the only way to automate this would be to embed the database port in the PAM module code. But the port should be handled by libdb as this will allow to concentrate all the effort on a single binary, which will do this job for other packages as well.

An email thread was opened in Fedora devel to discuss this topic. Steve Grubb mentioned that this approach was used in the past to update other PAM modules. So even if the solution is not ideal, the best approach is to document the database porting process and let the system administrator run it manually.

Benefit to Fedora

• This change uses a database that is Fedora license compatible.
• This changes uses an upstream maintained database version, with new features and bug fixing. pam_userdb controls user authentication, and a bug in the database could lead to a security vulnerability.

Scope

• Proposal owners:
  • libdb provides a program to port a BerkeleyDB database to GDBM.
  • Change PAM database build option to GDBM.

• Other developers: N/A

• Release engineering: https://pagure.io/releng/issue/11649

• Policies and guidelines: N/A (not needed for this Change)

• Trademark approval: N/A

• Alignment with Community Initiatives: N/A

Upgrade/compatibility impact

Upgrade

• If the pam_userdb module is used by the system, then the user/sysadmin will have to run the conversion tool. This can't be done automatically because the database location is configurable, and the conversion tool will need manual intervention.

Compatibility

• pam_userdb module is mainly used in vsftpd environments. If this module is used by the system and the database isn't converted, then the user won't be able to authenticate in vsftpd environments. The user would still be able to authenticate using other methods (i.e. su, ssh) and run the conversion tool.

How To Test

• Run db_converter to convert the database. Example

db_converter --src /etc/vsftpd/login.db --dest /etc/vsftpd/login.gdbm

• vsftpd login

• Check that the user is authenticated

User Experience

Users won't experience any change.

Dependencies

vsftpd depends on this change, but nothing needs to be done in this package.

Contingency Plan

• Contingency mechanism: Postpone to the next release.
• Contingency deadline: Beta freeze.
• Blocks release? No.

Documentation

N/A (not a System Wide Change)

Release Notes

pam_userdb switches database provider to GDM.