From cba8255c22d9a0a6de4bd1ec5c5a134c434488c7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20B=C5=99ezina?= Date: Mon, 10 Jun 2019 10:53:15 +0200 Subject: [PATCH 2/5] rhel9: remove ecryptfs support Patch-name: 0902-rhel9-remove-ecryptfs-support.patch Patch-id: 902 From-dist-git-commit: 8461b94b1539db7f26c288e0d5d20dd71e6609bf --- profiles/nis/README | 3 --- profiles/nis/fingerprint-auth | 1 - profiles/nis/password-auth | 1 - profiles/nis/postlogin | 4 ---- profiles/nis/system-auth | 1 - profiles/sssd/README | 3 --- profiles/sssd/fingerprint-auth | 1 - profiles/sssd/password-auth | 1 - profiles/sssd/postlogin | 4 ---- profiles/sssd/smartcard-auth | 1 - profiles/sssd/system-auth | 1 - profiles/winbind/README | 3 --- profiles/winbind/fingerprint-auth | 1 - profiles/winbind/password-auth | 1 - profiles/winbind/postlogin | 4 ---- profiles/winbind/system-auth | 1 - src/compat/authcompat.py.in.in | 1 - src/compat/authcompat_Options.py | 2 +- src/man/authselect-migration.7.adoc | 5 ++--- 19 files changed, 3 insertions(+), 36 deletions(-) diff --git a/profiles/nis/README b/profiles/nis/README index 46a4b1c2b47b15a11e760e830a68255555cc0ca2..a741e4c44e927c81861ceeb0129ad8d0c91509fb 100644 --- a/profiles/nis/README +++ b/profiles/nis/README @@ -21,9 +21,6 @@ with-mkhomedir:: Enable automatic creation of home directories for users on their first login. -with-ecryptfs:: - Enable automatic per-user ecryptfs. - with-fingerprint:: Enable authentication with fingerprint reader through *pam_fprintd*. diff --git a/profiles/nis/fingerprint-auth b/profiles/nis/fingerprint-auth index 3a2609df4ca29cdfcbff84b37576bb7b840d72b2..0b2f583a2fcf164647f7de387e9be2982bdf36cb 100644 --- a/profiles/nis/fingerprint-auth +++ b/profiles/nis/fingerprint-auth @@ -15,7 +15,6 @@ password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"} -session optional pam_systemd.so session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"} session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid diff --git a/profiles/nis/password-auth b/profiles/nis/password-auth index 927fbcbda8fa4e910e29c88a3806fb5265bbc7bc..56a51d9eebb2987da340805ddb4e4a6752ebdeb2 100644 --- a/profiles/nis/password-auth +++ b/profiles/nis/password-auth @@ -20,7 +20,6 @@ password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"} -session optional pam_systemd.so session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"} session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid diff --git a/profiles/nis/postlogin b/profiles/nis/postlogin index 137cd00dc65ee9ea83123f1d3a6f7ba04f0aea04..04a11f049bc1e220c9064fba7b46eb243ddd4996 100644 --- a/profiles/nis/postlogin +++ b/profiles/nis/postlogin @@ -1,7 +1,3 @@ -auth optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"} - -password optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"} - session optional pam_umask.so silent session [success=1 default=ignore] pam_succeed_if.so service !~ gdm* service !~ su* quiet session [default=1] pam_lastlog.so nowtmp {if "with-silent-lastlog":silent|showfailed} diff --git a/profiles/nis/system-auth b/profiles/nis/system-auth index 40a1bf74aaf3d721c4d720938e57766bfe651e47..74cf6ece9ce0b1b64b122fd2309ebf5d496c4787 100644 --- a/profiles/nis/system-auth +++ b/profiles/nis/system-auth @@ -21,7 +21,6 @@ password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"} -session optional pam_systemd.so session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"} session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid diff --git a/profiles/sssd/README b/profiles/sssd/README index 3c0bcfd365e87b86cf31d2bb3067f750d7a499c4..baa5f904b5934687751cc1626326826fb3c63399 100644 --- a/profiles/sssd/README +++ b/profiles/sssd/README @@ -35,9 +35,6 @@ with-mkhomedir:: Enable automatic creation of home directories for users on their first login. -with-ecryptfs:: - Enable automatic per-user ecryptfs. - with-smartcard:: Enable authentication with smartcards through SSSD. Please note that smartcard support must be also explicitly enabled within diff --git a/profiles/sssd/fingerprint-auth b/profiles/sssd/fingerprint-auth index 20ad3613e66ec85c7d2462d0449854e522383b3a..dc7befe7a4839a1ae5a4d21f4e5232126df55564 100644 --- a/profiles/sssd/fingerprint-auth +++ b/profiles/sssd/fingerprint-auth @@ -20,7 +20,6 @@ password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"} -session optional pam_systemd.so session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"} session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid diff --git a/profiles/sssd/password-auth b/profiles/sssd/password-auth index 7fe23f2312e5c34586aad31fbe79aa5409c49b78..5b235de810a838d3002013a68a85995a15ab1a8f 100644 --- a/profiles/sssd/password-auth +++ b/profiles/sssd/password-auth @@ -31,7 +31,6 @@ password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"} -session optional pam_systemd.so session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"} session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid diff --git a/profiles/sssd/postlogin b/profiles/sssd/postlogin index 137cd00dc65ee9ea83123f1d3a6f7ba04f0aea04..04a11f049bc1e220c9064fba7b46eb243ddd4996 100644 --- a/profiles/sssd/postlogin +++ b/profiles/sssd/postlogin @@ -1,7 +1,3 @@ -auth optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"} - -password optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"} - session optional pam_umask.so silent session [success=1 default=ignore] pam_succeed_if.so service !~ gdm* service !~ su* quiet session [default=1] pam_lastlog.so nowtmp {if "with-silent-lastlog":silent|showfailed} diff --git a/profiles/sssd/smartcard-auth b/profiles/sssd/smartcard-auth index 0d8bcab250633b09bce0232a5747f3a7e740d5d7..754847f2d8885ff35cbc57ec2364d82b963caa3b 100644 --- a/profiles/sssd/smartcard-auth +++ b/profiles/sssd/smartcard-auth @@ -18,7 +18,6 @@ account required pam_permit.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"} -session optional pam_systemd.so session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"} session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid diff --git a/profiles/sssd/system-auth b/profiles/sssd/system-auth index ce2e266146aaefbdbc6ef58a1566f36655dfb6b4..22e87d8f4ee64a4ad69d547873ae833de6ac5c41 100644 --- a/profiles/sssd/system-auth +++ b/profiles/sssd/system-auth @@ -38,7 +38,6 @@ password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"} -session optional pam_systemd.so session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"} session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid diff --git a/profiles/winbind/README b/profiles/winbind/README index 929e0cdc10b55816d14c82ca1b0f6b186e108e7b..160622af9fe9daa10291b4374a67c111efbe385a 100644 --- a/profiles/winbind/README +++ b/profiles/winbind/README @@ -33,9 +33,6 @@ with-mkhomedir:: Enable automatic creation of home directories for users on their first login. -with-ecryptfs:: - Enable automatic per-user ecryptfs. - with-fingerprint:: Enable authentication with fingerprint reader through *pam_fprintd*. diff --git a/profiles/winbind/fingerprint-auth b/profiles/winbind/fingerprint-auth index e8997c6c78ce7305fa7068fb169c05c68167880d..c5485ab848989a252e4ff4b1376a41202d21fd67 100644 --- a/profiles/winbind/fingerprint-auth +++ b/profiles/winbind/fingerprint-auth @@ -19,7 +19,6 @@ password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"} -session optional pam_systemd.so session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"} session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid diff --git a/profiles/winbind/password-auth b/profiles/winbind/password-auth index 8d1682b9301c2b9c92292a41120f69611f148108..8b260fa06f5ed8494d1f6fac74517d3a54622693 100644 --- a/profiles/winbind/password-auth +++ b/profiles/winbind/password-auth @@ -27,7 +27,6 @@ password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"} -session optional pam_systemd.so session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"} session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid diff --git a/profiles/winbind/postlogin b/profiles/winbind/postlogin index 137cd00dc65ee9ea83123f1d3a6f7ba04f0aea04..04a11f049bc1e220c9064fba7b46eb243ddd4996 100644 --- a/profiles/winbind/postlogin +++ b/profiles/winbind/postlogin @@ -1,7 +1,3 @@ -auth optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"} - -password optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"} - session optional pam_umask.so silent session [success=1 default=ignore] pam_succeed_if.so service !~ gdm* service !~ su* quiet session [default=1] pam_lastlog.so nowtmp {if "with-silent-lastlog":silent|showfailed} diff --git a/profiles/winbind/system-auth b/profiles/winbind/system-auth index 612143d10fe502d7f6ed636b4fba6cc639aa66b0..33aa13efb92405393236c3511ebb351facd916f0 100644 --- a/profiles/winbind/system-auth +++ b/profiles/winbind/system-auth @@ -28,7 +28,6 @@ password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"} -session optional pam_systemd.so session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"} session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid diff --git a/src/compat/authcompat.py.in.in b/src/compat/authcompat.py.in.in index 4beb1b8c1dee4b22c7943d029be04f5ba34d75e7..7d7a2810986fa54597258923a18c82386cdd2c37 100755 --- a/src/compat/authcompat.py.in.in +++ b/src/compat/authcompat.py.in.in @@ -524,7 +524,6 @@ class AuthCompat: 'smartcard': 'with-smartcard', 'requiresmartcard': 'with-smartcard-required', 'fingerprint': 'with-fingerprint', - 'ecryptfs': 'with-ecryptfs', 'mkhomedir': 'with-mkhomedir', 'faillock': 'with-faillock', 'pamaccess': 'with-pamaccess', diff --git a/src/compat/authcompat_Options.py b/src/compat/authcompat_Options.py index d26dedabdfb9519861076b58cddd0dd0eb04b7cb..5c8b21b55014198d6d9dfc98bd807c3c922b06f4 100644 --- a/src/compat/authcompat_Options.py +++ b/src/compat/authcompat_Options.py @@ -93,7 +93,6 @@ class Options: Option.Valued("smartcardaction", _("<0=Lock|1=Ignore>"), _("action to be taken on smart card removal")), Option.Feature("requiresmartcard", _("require smart card for authentication by default")), Option.Feature("fingerprint", _("authentication with fingerprint readers by default")), - Option.Feature("ecryptfs", _("automatic per-user ecryptfs")), Option.Feature("krb5", _("Kerberos authentication by default")), Option.Valued("krb5kdc", _(""), _("default Kerberos KDC")), Option.Valued("krb5adminserver", _(""), _("default Kerberos admin server")), @@ -141,6 +140,7 @@ class Options: # layers and will produce warning when used. They will not affect # the system. Option.UnsupportedFeature("cache"), + Option.UnsupportedFeature("ecryptfs"), Option.UnsupportedFeature("shadow"), Option.UnsupportedSwitch("useshadow"), Option.UnsupportedFeature("md5"), diff --git a/src/man/authselect-migration.7.adoc b/src/man/authselect-migration.7.adoc index 3513a7e7cd3d7cc0045167e8224248c5be90ab2c..888cd4e5a0750d4e1aa5898887f5f7fd42472741 100644 --- a/src/man/authselect-migration.7.adoc +++ b/src/man/authselect-migration.7.adoc @@ -80,7 +80,6 @@ configuration file for required services. |*Authconfig options* |*Authselect profile feature* |--enablesmartcard |with-smartcard |--enablefingerprint |with-fingerprint -|--enableecryptfs |with-ecryptfs |--enablemkhomedir |with-mkhomedir |--enablefaillock |with-faillock |--enablepamaccess |with-pamaccess @@ -103,8 +102,8 @@ authselect select sssd with-faillock authconfig --enablesssd --enablesssdauth --enablesmartcard --smartcardmodule=sssd --updateall authselect select sssd with-smartcard -authconfig --enableecryptfs --enablepamaccess --updateall -authselect select sssd with-ecryptfs with-pamaccess +authconfig --enablepamaccess --updateall +authselect select sssd with-pamaccess authconfig --enablewinbind --enablewinbindauth --winbindjoin=Administrator --updateall realm join -U Administrator --client-software=winbind WINBINDDOMAIN -- 2.54.0