Bug 16143 - pam_kwallet breaks PAM stack when used in auth section
Summary: pam_kwallet breaks PAM stack when used in auth section
Status: RESOLVED DUPLICATE of bug 18986
Alias: None
Product: Mageia
Classification: Unclassified
Component: RPM Packages (show other bugs)
Version: Cauldron
Hardware: i586 Linux
Priority: Normal normal
Target Milestone: ---
Assignee: KDE maintainers
QA Contact:
URL:
Whiteboard: MGA6TOO
Keywords:
: 17513 (view as bug list)
Depends on:
Blocks: 17523
  Show dependency treegraph
 
Reported: 2015-06-18 19:14 CEST by David Walser
Modified: 2018-04-29 21:57 CEST (History)
5 users (show)

See Also:
Source RPM: pam-kwallet
CVE:
Status comment:


Attachments

Description David Walser 2015-06-18 19:14:08 CEST
I'm not sure if this is a bug in pam_kwallet (since it has no documentation!) or mageia-kde4-config, but our default /etc/pam.d/kdm file includes two lines with pam_kwallet, one in the auth section and one in the session section.  The one in the auth section breaks the PAM stack, making the session section in particular not work.  I am using SSSD to authenticate with AD, so pam_mkhomedir needs to be employed to create the home directories.  With the auth pam_kwallet line in /etc/pam.d/kdm, it doesn't run pam_mkhomedir (which is the first session line in /etc/pam.d/system-auth) so homedirs don't get created with the correct permissions or with the files from /etc/skel.  Removing the auth pam_kwallet line from /etc/pam.d/kdm fixes this.

Reproducible: 

Steps to Reproduce:
David Walser 2015-06-18 19:14:27 CEST

CC: (none) => mageia
Whiteboard: (none) => MGA5TOO

Comment 1 Luc Menut 2015-06-18 21:01:49 CEST
IIRC, I used the same pam configuration as Fedora.

There are some informations about pam configuration for pam_kwallet in this blog post
https://www.dennogumi.org/2014/04/unlocking-kwallet-with-pam
Comment 2 Luc Menut 2015-06-18 21:08:19 CEST
(In reply to Luc Menut from comment #1)
> IIRC, I used the same pam configuration as Fedora.

confirmed
https://fedorahosted.org/kde-settings/browser/trunk/etc/pam.d/kdm

and Fedora use exactly the same configuration to open gnome_keyring with pam_gnome_keyring.so .
Comment 3 David Walser 2015-06-18 21:33:44 CEST
So our version of pam_kwallet must be broken.
Comment 4 David Walser 2015-06-21 04:40:36 CEST
Probably obvious, but uninstalling pam-kwallet also fixes the problem.
Comment 5 Samuel Verschelde 2016-01-19 10:10:17 CET
*** Bug 17513 has been marked as a duplicate of this bug. ***

CC: (none) => andresalaun

Comment 6 David Walser 2016-01-21 00:39:25 CET
kwallet-pam has replaced pam-kwallet in Cauldron.

It builds on Mageia 5, but exhibits the same problem.  It's possible that kwallet-pam is also broken, but I'm guessing our /etc/pam.d/kdm config is incorrect.

As for Cauldron, kwallet is not included in /etc/pam.d/sddm, so this won't be an issue unless someone tries to enable it modeling the config after Mageia 5's kdm one.

Version: Cauldron => 5
Whiteboard: MGA5TOO => (none)

Comment 7 Morgan Leijström 2016-05-29 04:00:26 CEST
(In reply to David Walser from comment #6)
> As for Cauldron, kwallet is not included in /etc/pam.d/sddm, so this won't
> be an issue unless someone tries to enable it modeling the config after
> Mageia 5's kdm one.

How is this handled in an update mga5 -> mga6 ?

CC: (none) => fri

David Walser 2016-07-22 15:54:19 CEST

See Also: (none) => https://bugs.mageia.org/show_bug.cgi?id=18986

David Walser 2016-07-30 03:21:29 CEST

Blocks: (none) => 17523

Luc Menut 2016-08-25 16:47:33 CEST

Assignee: lmenut => kde

Comment 8 Marja Van Waes 2018-04-28 19:02:48 CEST
@ KDE team
@ David Walser
@ Morgan

Are still any issues expected or possible in Mageia 6 that are related to this (Mga5) bug report?

CC: (none) => marja11
Keywords: (none) => NEEDINFO

Comment 9 David Walser 2018-04-29 17:59:27 CEST
See Comment 6.

Keywords: NEEDINFO => (none)
Version: 5 => Cauldron
Whiteboard: (none) => MGA6TOO

Comment 10 Ulrich Beckmann 2018-04-29 21:57:48 CEST
It works with sddm as documented in https://bugs.mageia.org/show_bug.cgi?id=18986#c60

Retested now with current Mga6 Plasma.

Ulrich Beckmann

*** This bug has been marked as a duplicate of bug 18986 ***

Status: NEW => RESOLVED
CC: (none) => bequimao.de
Resolution: (none) => DUPLICATE


Note You need to log in before you can comment on or make changes to this bug.