Cherry-pick to 1.4 https://github.com/vyos/vyos-1x/pull/2226

PR for 1.4 https://github.com/vyos/vyos-1x/pull/2224

I'm closing this one. No news in the last year, and the tests I've done last month were ok.

Feature included in: https://github.com/vyos/vyos-1x/pull/2222

The PR is merged

PR is created https://github.com/vyos/vyos-build/pull/394

Sagitta PR updated with fix for regression in T5556.

PR: https://github.com/vyos/vyos-1x/pull/2222

The logic error is fixed in commit above: updates work as expected, and all smoketests (but for unrelated test) pass.

PR: https://github.com/vyos/vyos-1x/pull/2221

Using VyOS 1.4-rolling-202309070021.

Not as such: this is a logic error in T5353, which will be fixed momentarily. Nonetheless, T5514 is worthwhile to consider.

Related to https://vyos.dev/T5514 ?

For 1.4 add session [default=ignore success=2] pam_succeed_if.so service = sudo to /etc/pam.d/common-session-noninteractive fixes the issue

# here are the per-package modules (the "Primary" block)
session [default=1]                     pam_permit.so
# here's the fallback if no module succeeds
session requisite                       pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
session required                        pam_permit.so
# and here are more per-package modules (the "Additional" block)
session required        pam_mkhomedir.so umask=0022 skel=/etc/skel
session [default=ignore success=2] pam_succeed_if.so service = sudo
session [default=ignore success=ignore] pam_succeed_if.so user ingroup aaa quiet
session [authinfo_unavail=ignore success=ok default=ignore] pam_radius_auth.so
session required        pam_unix.so
# end of pam-auth-update config

1.4 running FRR9 is already mitigated

Logic error in recent bug fix; correction is being checked ...

current PR: https://github.com/vyos/vyos-1x/pull/2217
1.4 PR: https://github.com/vyos/vyos-1x/pull/2218
1.3 PR: https://github.com/vyos/vyos-1x/pull/2219

I see this in 20230329 rolling, but don't see on the latest one.

Could please the vyos_debconfig files be updated aswell?

PR392 was merged in VyOS 1.4-rolling-202309070021.

PR:
https://github.com/vyos/vyos-1x/pull/2216

PR for Sagitta (draft until dependency PR 2207 is merged to Sagitta):
https://github.com/vyos/vyos-1x/pull/2215

Sounds great @jestabro I'm happy to assist in any way possible