[Bug 296383] pkgbase upgrade to 15.1 restores default /etc/pam.d/* configuration

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296383

            Bug ID: 296383
           Summary: pkgbase upgrade to 15.1 restores default /etc/pam.d/*
                    configuration
           Product: Base System
           Version: 15.1-RELEASE
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: bin
          Assignee: bugs@FreeBSD.org
          Reporter: eborisch+FreeBSD@gmail.com

When upgrading from 15.0-p10 to 15.1 with pkgbase via:

pkg -oABI=FreeBSD:15:$(uname -p) -oOSVERSION=1501000 upgrade -r FreeBSD-base

my custom /etc/pam.d/sshd configuration was overwritten with the default from
the (newly introduced in 15.1) FreeBSD-pam package.

Performing the same upgrade with a similar (custom /etc/pam.d/sshd) system via
freebsd-update preserves the configuration. (Likewise this setup has been
previously upgraded from at least 13 and possibly 12 without issue.)

Unlike some configuration file patterns with local-override modifications
(/etc/rc.conf for /etc/defaults/rc.conf), typically the /etc/pam.d/<service>
configuration files are modified in-place. There is certainly the capability
to, for example, set PAMServiceName in sshd_config and have a separate local
version, but at least in my experience that is not the norm.

Combined with the fact that the upgrade succeeds (doesn't revert
/etc/pam.d/sshd) with freebsd-update, I would suggest this is a regression for
pkgbase-manged upgrades. This can easily cause loss-of-access to a system if
/etc/pam.d/sshd provides some non-stock authorization providers.

At a minimum, a warning that the file has been modified by the upgrade process
(and with moved-aside backups) should be presented.

-- 
You are receiving this mail because:
You are the assignee for the bug.