Bug 16143

Summary:	pam_kwallet breaks PAM stack when used in auth section
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	RPM Packages	Assignee:	KDE maintainers <kde>
Status:	RESOLVED DUPLICATE	QA Contact:
Severity:	normal
Priority:	Normal	CC:	andresalaun, bequimao.de, fri, mageia, marja11
Version:	Cauldron
Target Milestone:	---
Hardware:	i586
OS:	Linux
See Also:	https://bugs.mageia.org/show_bug.cgi?id=18986
Whiteboard:	MGA6TOO
Source RPM:	pam-kwallet	CVE:
Status comment:
Bug Depends on:
Bug Blocks:	17523

Description David Walser 2015-06-18 19:14:08 CEST

I'm not sure if this is a bug in pam_kwallet (since it has no documentation!) or mageia-kde4-config, but our default /etc/pam.d/kdm file includes two lines with pam_kwallet, one in the auth section and one in the session section.  The one in the auth section breaks the PAM stack, making the session section in particular not work.  I am using SSSD to authenticate with AD, so pam_mkhomedir needs to be employed to create the home directories.  With the auth pam_kwallet line in /etc/pam.d/kdm, it doesn't run pam_mkhomedir (which is the first session line in /etc/pam.d/system-auth) so homedirs don't get created with the correct permissions or with the files from /etc/skel.  Removing the auth pam_kwallet line from /etc/pam.d/kdm fixes this.

Reproducible: 

Steps to Reproduce:

David Walser 2015-06-18 19:14:27 CEST

CC: (none) => mageia
Whiteboard: (none) => MGA5TOO

Comment 1 Luc Menut 2015-06-18 21:01:49 CEST

IIRC, I used the same pam configuration as Fedora.

There are some informations about pam configuration for pam_kwallet in this blog post
https://www.dennogumi.org/2014/04/unlocking-kwallet-with-pam

Comment 2 Luc Menut 2015-06-18 21:08:19 CEST

(In reply to Luc Menut from comment #1)
> IIRC, I used the same pam configuration as Fedora.

confirmed
https://fedorahosted.org/kde-settings/browser/trunk/etc/pam.d/kdm

and Fedora use exactly the same configuration to open gnome_keyring with pam_gnome_keyring.so .

Comment 3 David Walser 2015-06-18 21:33:44 CEST

So our version of pam_kwallet must be broken.

Comment 4 David Walser 2015-06-21 04:40:36 CEST

Probably obvious, but uninstalling pam-kwallet also fixes the problem.

Comment 5 Samuel Verschelde 2016-01-19 10:10:17 CET

*** Bug 17513 has been marked as a duplicate of this bug. ***

CC: (none) => andresalaun

Comment 6 David Walser 2016-01-21 00:39:25 CET

kwallet-pam has replaced pam-kwallet in Cauldron.

It builds on Mageia 5, but exhibits the same problem.  It's possible that kwallet-pam is also broken, but I'm guessing our /etc/pam.d/kdm config is incorrect.

As for Cauldron, kwallet is not included in /etc/pam.d/sddm, so this won't be an issue unless someone tries to enable it modeling the config after Mageia 5's kdm one.

Version: Cauldron => 5
Whiteboard: MGA5TOO => (none)

Comment 7 Morgan Leijström 2016-05-29 04:00:26 CEST

(In reply to David Walser from comment #6)
> As for Cauldron, kwallet is not included in /etc/pam.d/sddm, so this won't
> be an issue unless someone tries to enable it modeling the config after
> Mageia 5's kdm one.

How is this handled in an update mga5 -> mga6 ?

CC: (none) => fri

David Walser 2016-07-22 15:54:19 CEST

See Also: (none) => https://bugs.mageia.org/show_bug.cgi?id=18986

David Walser 2016-07-30 03:21:29 CEST

Blocks: (none) => 17523

Luc Menut 2016-08-25 16:47:33 CEST

Assignee: lmenut => kde

Comment 8 Marja Van Waes 2018-04-28 19:02:48 CEST

@ KDE team
@ David Walser
@ Morgan

Are still any issues expected or possible in Mageia 6 that are related to this (Mga5) bug report?

CC: (none) => marja11
Keywords: (none) => NEEDINFO

Comment 9 David Walser 2018-04-29 17:59:27 CEST

See Comment 6.

Keywords: NEEDINFO => (none)
Version: 5 => Cauldron
Whiteboard: (none) => MGA6TOO

Comment 10 Ulrich Beckmann 2018-04-29 21:57:48 CEST

It works with sddm as documented in https://bugs.mageia.org/show_bug.cgi?id=18986#c60

Retested now with current Mga6 Plasma.

Ulrich Beckmann

*** This bug has been marked as a duplicate of bug 18986 ***

Status: NEW => RESOLVED
CC: (none) => bequimao.de
Resolution: (none) => DUPLICATE