Bug 1222457

Whitelisting for this was removed in November since it was no longer packaged.
We will have a look at the current sources to see if anything relevant
changed.

I will have a look at this. Hopefully not too much has changed since the last
time we looked at this.

Not too much changed in the codebase since the last review that happened in
bug 1146353. The PAM module preforms `chown()` and `chmod()` calls for files
in /var/google-sudoers.d and /var/google-users.d.

How these directories come into existence is a bit special. They don't use
systemd-tmpfiles or packaging mechanisms, but this happens in a different
package, in google-guest-agent, google_guest_agent/oslogin.go:

```
// Creates necessary OS Login directories if they don't exist.
func createOSLoginDirs(ctx context.Context) error {
        restorecon, restoreconerr := exec.LookPath("restorecon")

        for _, dir := range []string{"/var/google-sudoers.d",
"/var/google-users.d"} {
                err := os.Mkdir(dir, 0750)
                if err != nil && !os.IsExist(err) {
                        return err
                }
                if restoreconerr == nil {
                        run.Quiet(ctx, restorecon, dir)
                }
        }
        return nil
}
```

google-guest-agent and the PAM module run as root, this is the only place
where the directories are created and only root can write to them. Thus no
symlink attacks & friends are possible in these locations.

Otherwise this modules interacts, as outlined in the original bug, with the
cloud instance's metadata URL, and I cannot judge the security/quality of
these APIs.

We will reinstate the whitelisting for the admin PAM module.

The whitelisting process has been started. rpmlint submissions in Factory are
currently a bit stuck it seems, so it could take some days for the
whitelisting to make it into production.

This is an autogenerated message for OBS integration:
This bug (1222457) was mentioned in
https://build.opensuse.org/request/show/1168340 Factory / rpmlint

The whitelisting already made it to Factory. Closing as fixed.