From 0a7779b47319eb47b4d5d51f6eb653434c204c29 Mon Sep 17 00:00:00 2001
From: Ray Strode <rstrode@redhat.com>
Date: Tue, 30 Aug 2016 16:10:19 -0400
Subject: [PATCH 1/2] pam_gdm: return AUTHINFO_UNAVAIL if kernel keyring
unavailable
right now we return PAM_SUCCESS if keyutils are unavailable.
This is the wrong default, we should fail if we aren't able to
get the password.
https://bugzilla.gnome.org/show_bug.cgi?id=770612
---
pam_gdm/pam_gdm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pam_gdm/pam_gdm.c b/pam_gdm/pam_gdm.c
index 7beb04e..f491b8d 100644
--- a/pam_gdm/pam_gdm.c
+++ b/pam_gdm/pam_gdm.c
@@ -31,61 +31,61 @@
#include <keyutils.h>
#endif
int
pam_sm_authenticate (pam_handle_t *pamh,
int flags,
int argc,
const char **argv)
{
#ifdef HAVE_KEYUTILS
int r;
void *cached_password = NULL;
key_serial_t serial;
serial = find_key_by_type_and_desc ("user", "cryptsetup", 0);
if (serial == 0)
return PAM_AUTHINFO_UNAVAIL;
r = keyctl_read_alloc (serial, &cached_password);
if (r < 0)
return PAM_AUTHINFO_UNAVAIL;
r = pam_set_item (pamh, PAM_AUTHTOK, cached_password);
free (cached_password);
if (r < 0)
return PAM_AUTH_ERR;
#endif
- return PAM_SUCCESS;
+ return PAM_AUTHINFO_UNAVAIL;
}
int
pam_sm_setcred (pam_handle_t *pamh,
int flags,
int argc,
const char **argv)
{
return PAM_SUCCESS;
}
int
pam_sm_acct_mgmt (pam_handle_t *pamh,
int flags,
int argc,
const char **argv)
{
return PAM_SUCCESS;
}
int
pam_sm_chauthtok (pam_handle_t *pamh,
int flags,
int argc,
const char **argv)
{
return PAM_SUCCESS;
}
int
--
2.7.4
From 5716de2c0ec11a77c279c6952ea76d173d46b0e3 Mon Sep 17 00:00:00 2001
From: Ray Strode <rstrode@redhat.com>
Date: Tue, 30 Aug 2016 15:58:15 -0400
Subject: [PATCH 2/2] pam: don't call into pam_unix if pam_gdm fails for
autolgoin
If pam_gdm fails we shouldn't call into pam_unix since it can lead
to the system asking for a password, and autologin isn't equipped for
that.
This commit changes the pam configuration to jump to pam_permit if
pam_gdm fails.
https://bugzilla.gnome.org/show_bug.cgi?id=770612
---
data/pam-exherbo/gdm-autologin.pam | 4 ++--
data/pam-redhat/gdm-autologin.pam | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/data/pam-exherbo/gdm-autologin.pam b/data/pam-exherbo/gdm-autologin.pam
index afde048..61f8e54 100644
--- a/data/pam-exherbo/gdm-autologin.pam
+++ b/data/pam-exherbo/gdm-autologin.pam
@@ -1,15 +1,15 @@
# mirrors system-auth / system(-local)-login
# except for the authentication method, which is:
# always permit login
-auth optional pam_gdm.so
+auth [success=ok default=2] pam_gdm.so
auth substack system-local-login
-auth sufficient pam_permit.so
-auth optional pam_gnome_keyring.so
+auth sufficient pam_permit.so
account include system-local-login
password include system-local-login
session include system-local-login
-session optional pam_gnome_keyring.so auto_start
diff --git a/data/pam-redhat/gdm-autologin.pam b/data/pam-redhat/gdm-autologin.pam
index c2efea8..fbc9d9c 100644
--- a/data/pam-redhat/gdm-autologin.pam
+++ b/data/pam-redhat/gdm-autologin.pam
@@ -1,18 +1,18 @@
#%PAM-1.0
-auth optional pam_gdm.so
+auth [success=ok default=2] pam_gdm.so
auth substack password-auth
auth optional pam_gnome_keyring.so
auth sufficient pam_permit.so
auth include postlogin
account required pam_nologin.so
account include system-auth
password include system-auth
session required pam_selinux.so close
session required pam_loginuid.so
session optional pam_console.so
session required pam_selinux.so open
session optional pam_keyinit.so force revoke
session required pam_namespace.so
session include system-auth
session optional pam_gnome_keyring.so auto_start
session include postlogin
--
2.7.4