Lennart Poettering
9a4f9e84c4
Let's move pam_systemd_home before pam_unix in the authentication hook. Since a while we are exposing shadow entries for homed log entries via NSS. This means that pam_unix now potentially has enough data for authenticating a user on its own, without letting pam_systemd_home do that. This is superficially OK, but also means that authentication will always go via password, even if pkcs11/fido2 is registered. Let's move this around, but be careful about it: let's list the precise errors which we think are enough to terminating further PAM processing, so that pam_unix comes into control in all cases where it's not clear that pam_systemd_home owns the user record. This previously wasn't visible to me, because on Fedora until authselect 1.5.1 (released earleir this year) the NSS shadow stuff was not enabled. This does the same also for the "account" stack, except that the order there already was as we want it. Finally, shorten the account stack, by just requiring pam_unix.so and dropping pam_permit.so, because it doesn't really serve much purpose (and Fedora doesn't use it by default either.)
24 lines
718 B
Plaintext
24 lines
718 B
Plaintext
# SPDX-License-Identifier: LGPL-2.1-or-later
|
|
# This file is part of systemd.
|
|
#
|
|
# Used by run0 sessions
|
|
|
|
{% if ENABLE_HOMED %}
|
|
-account [success=done authtok_expired=bad new_authtok_reqd=bad maxtries=bad acct_expired=bad default=ignore] pam_systemd_home.so
|
|
{% endif %}
|
|
account required pam_unix.so
|
|
|
|
{% if HAVE_SELINUX %}
|
|
session required pam_selinux.so close
|
|
session required pam_selinux.so open
|
|
{% endif %}
|
|
session required pam_loginuid.so
|
|
session optional pam_keyinit.so force revoke
|
|
session required pam_namespace.so
|
|
{% if ENABLE_HOMED %}
|
|
-session optional pam_systemd_home.so
|
|
{% endif %}
|
|
session optional pam_umask.so silent
|
|
session optional pam_systemd.so
|
|
session required pam_unix.so
|