Allow a distinct pam config file for greeter and for lock-screen
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Unity |
Fix Released
|
Medium
|
Andrea Azzarone | ||
7.2 |
Fix Released
|
Medium
|
Andrea Azzarone | ||
unity (Ubuntu) |
Fix Released
|
Undecided
|
Andrea Azzarone | ||
Trusty |
Fix Released
|
Undecided
|
Unassigned | ||
unity-greeter (Ubuntu) |
Invalid
|
Undecided
|
Unassigned | ||
Trusty |
Invalid
|
Undecided
|
Unassigned |
Bug Description
[Impact]
It might be desirable to have a distinct pam config file when logging in and when unlocking the screen. Specifically, using a fingerprint reader is fine for sudo or for unlocking, but you want to use your password when logging in, to provide a secret and be able to unlock the gnome-keyring for example.
[Test Case]
See http://
So this feature request is about allowing for a (optional) pam config file for the lock-screen, distinct from the /etc/pam.d/lightdm currently used and shared with the greeter.
[Regression Potential]
An additional configuration point could allow a system to be misconfigured for reduced security. The default configuration is to use the same PAM stack as the LightDM login process so no new regression is introduced without user modification.
[Other Info]
The Ubuntu 14.04 LTS SRU patch was cherry-picked from Ubuntu 14.10 where it has been in production use for a few months and appears stable.
Related branches
- Stephen M. Webb (community): Approve
- Marco Trevisan (Treviño): Approve
- PS Jenkins bot (community): Approve (continuous-integration)
-
Diff: 69 lines (+8/-3)7 files modifiedCMakeLists.txt (+1/-0)
data/CMakeLists.txt (+1/-0)
data/pam/CMakeLists.txt (+1/-0)
data/pam/unity (+2/-0)
debian/rules (+1/-1)
debian/unity.install (+1/-0)
lockscreen/UserAuthenticatorPam.cpp (+1/-2)
- Marco Trevisan (Treviño): Approve
-
Diff: 6023 lines (+2168/-709)105 files modifiedCMakeLists.txt (+1/-0)
UnityCore/DBusIndicators.cpp (+11/-0)
UnityCore/DBusIndicators.h (+1/-0)
UnityCore/DesktopUtilities.cpp (+12/-0)
UnityCore/DesktopUtilities.h (+1/-0)
UnityCore/GLibDBusProxy.cpp (+100/-3)
UnityCore/GLibDBusProxy.h (+6/-0)
UnityCore/GLibWrapper-inl.h (+12/-0)
UnityCore/GLibWrapper.h (+1/-0)
UnityCore/GnomeSessionManager.cpp (+0/-1)
UnityCore/Indicators.h (+1/-0)
dash/FilterBasicButton.cpp (+6/-3)
dash/previews/ActionButton.cpp (+5/-2)
dash/previews/ErrorPreview.cpp (+1/-0)
dash/previews/PaymentPreview.cpp (+3/-1)
data/CMakeLists.txt (+1/-0)
data/pam/CMakeLists.txt (+1/-0)
data/pam/unity (+2/-0)
debian/changelog (+59/-0)
debian/rules (+1/-1)
debian/unity.install (+1/-0)
debian/unity.migrations (+1/-0)
decorations/DecoratedWindow.cpp (+155/-64)
decorations/DecorationsEdgeBorders.cpp (+32/-19)
decorations/DecorationsForceQuitDialog.cpp (+17/-3)
decorations/DecorationsManager.cpp (+17/-26)
decorations/DecorationsPriv.h (+12/-3)
decorations/DecorationsTitle.cpp (+1/-0)
decorations/DecorationsWidgets.cpp (+13/-1)
decorations/DecorationsWidgets.h (+5/-0)
doc/unity.1 (+35/-10)
hud/HudIconTextureSource.cpp (+0/-5)
hud/HudIconTextureSource.h (+0/-1)
launcher/ApplicationLauncherIcon.cpp (+2/-0)
launcher/DesktopLauncherIcon.cpp (+13/-1)
launcher/DesktopLauncherIcon.h (+2/-0)
launcher/Launcher.cpp (+1/-3)
launcher/LauncherIcon.cpp (+117/-104)
launcher/LauncherIcon.h (+12/-8)
launcher/MockLauncherIcon.h (+0/-5)
launcher/SwitcherView.cpp (+9/-1)
launcher/Tooltip.cpp (+5/-4)
lockscreen/BackgroundSettings.cpp (+13/-11)
lockscreen/BackgroundSettings.h (+0/-1)
lockscreen/CMakeLists.txt (+2/-0)
lockscreen/CofView.cpp (+15/-2)
lockscreen/CofView.h (+3/-1)
lockscreen/LockScreenAbstractShield.h (+14/-1)
lockscreen/LockScreenController.cpp (+54/-14)
lockscreen/LockScreenController.h (+12/-3)
lockscreen/LockScreenPanel.cpp (+31/-2)
lockscreen/LockScreenSettings.cpp (+2/-0)
lockscreen/LockScreenSettings.h (+2/-1)
lockscreen/LockScreenShield.cpp (+60/-29)
lockscreen/LockScreenShield.h (+10/-3)
lockscreen/LockScreenShieldFactory.cpp (+7/-2)
lockscreen/LockScreenShieldFactory.h (+12/-2)
lockscreen/ShutdownNotifier.cpp (+152/-0)
lockscreen/ShutdownNotifier.h (+51/-0)
lockscreen/SuspendNotifier.cpp (+153/-0)
lockscreen/SuspendNotifier.h (+51/-0)
lockscreen/UserAuthenticatorPam.cpp (+1/-2)
lockscreen/UserPromptView.cpp (+96/-17)
lockscreen/UserPromptView.h (+5/-4)
panel/PanelIndicatorEntryView.cpp (+1/-1)
panel/PanelMenuView.cpp (+83/-38)
panel/PanelMenuView.h (+1/-1)
plugins/unityshell/src/unityshell.cpp (+29/-35)
plugins/unityshell/src/unityshell.h (+2/-2)
services/panel-main.c (+8/-0)
services/panel-service.c (+15/-0)
services/panel-service.h (+2/-0)
tests/CMakeLists.txt (+1/-1)
tests/mock_indicators.h (+1/-0)
tests/test_lockscreen_controller.cpp (+10/-2)
tests/test_main_xless.cpp (+4/-5)
tests/test_previews_music_payment.cpp (+1/-0)
tests/test_text_input.cpp (+1/-0)
tools/migration-scripts/03_unity_first_run_stamp_move (+35/-0)
unity-shared/CompizUtils.cpp (+77/-58)
unity-shared/CompizUtils.h (+36/-5)
unity-shared/DashStyle.cpp (+8/-11)
unity-shared/DecorationStyle.cpp (+2/-2)
unity-shared/GnomeKeyGrabber.cpp (+9/-0)
unity-shared/IconRenderer.cpp (+73/-43)
unity-shared/IconRenderer.h (+0/-2)
unity-shared/IconTexture.cpp (+1/-1)
unity-shared/IconTextureSource.cpp (+37/-1)
unity-shared/IconTextureSource.h (+10/-4)
unity-shared/LayoutSystem.cpp (+28/-4)
unity-shared/LayoutSystem.h (+2/-1)
unity-shared/PluginAdapter.cpp (+39/-2)
unity-shared/PluginAdapter.h (+3/-0)
unity-shared/SearchBar.cpp (+18/-12)
unity-shared/SearchBar.h (+9/-9)
unity-shared/SearchBarSpinner.h (+0/-2)
unity-shared/SpreadFilter.cpp (+3/-1)
unity-shared/StandaloneWindowManager.h (+2/-0)
unity-shared/TextInput.cpp (+138/-76)
unity-shared/TextInput.h (+17/-19)
unity-shared/UScreen.cpp (+26/-4)
unity-shared/UScreen.h (+0/-1)
unity-shared/UnitySettings.cpp (+9/-1)
unity-shared/WindowManager.h (+5/-0)
unity-shared/XWindowManager.cpp (+1/-1)
Changed in unity: | |
importance: | Undecided → Medium |
status: | New → Triaged |
affects: | unity-greeter → unity-greeter (Ubuntu) |
Changed in unity-greeter (Ubuntu): | |
status: | New → Confirmed |
Changed in unity: | |
assignee: | nobody → Andrea Azzarone (andyrock) |
Changed in unity-greeter (Ubuntu): | |
assignee: | nobody → Andrea Azzarone (andyrock) |
status: | New → Invalid |
Changed in unity (Ubuntu): | |
status: | New → Confirmed |
Changed in unity: | |
status: | Triaged → In Progress |
Changed in unity (Ubuntu): | |
status: | Confirmed → In Progress |
tags: | added: lockscreen |
Changed in unity: | |
milestone: | none → 7.2.1 |
no longer affects: | unity/7.3 |
Changed in unity: | |
milestone: | 7.2.1 → 7.3.0 |
Changed in unity-greeter (Ubuntu): | |
assignee: | Andrea Azzarone (andyrock) → nobody |
Changed in unity (Ubuntu): | |
assignee: | nobody → Andrea Azzarone (andyrock) |
Changed in unity: | |
milestone: | 7.3.0 → 7.3.1 |
Changed in unity: | |
status: | In Progress → Fix Committed |
tags: | added: verification-done |
tags: | removed: verification-needed |
Changed in unity-greeter (Ubuntu Trusty): | |
status: | New → Invalid |
Changed in unity: | |
status: | Fix Committed → Fix Released |
As stated in the comment of the above mentioned Askubuntu question, the code already states that Unity should use its own pam files:
// FIXME (andy) We should install our own unityshell pam file. "lightdm" , username_.c_str(),
&conversat ion, &pam_handle_) == PAM_SUCCESS;
return pam_start(
A trivial patch is to use a specific file name in this code: I used "lightdm- lockscreen" , and it works just fine (tested with apt-get source unity + dpkg-buildpackage)
But this raises the question of the specs of this feature request:
- should the specific pam file for the lockscreen be mandatory, or should it fallback to the greeter pam config file ?
- if it is mandatory, what should be the defaults ?
- how to ensure a safe transition for existing installations ?