From 03f3364ebfc4697082b7f7cb8adb2c046b341a20 Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Wed, 5 Aug 2026 06:05:29 -0400 Subject: [PATCH] import CS git gdm-47.0-22.el10_2 --- ...stack-wrappers-to-prevent-auth-bypas.patch | 124 ++++++++++++++++++ gdm.spec | 17 ++- 2 files changed, 136 insertions(+), 5 deletions(-) create mode 100644 0001-data-Add-PAM-substack-wrappers-to-prevent-auth-bypas.patch diff --git a/0001-data-Add-PAM-substack-wrappers-to-prevent-auth-bypas.patch b/0001-data-Add-PAM-substack-wrappers-to-prevent-auth-bypas.patch new file mode 100644 index 0000000..3026b68 --- /dev/null +++ b/0001-data-Add-PAM-substack-wrappers-to-prevent-auth-bypas.patch @@ -0,0 +1,124 @@ +From 2892ac533be818826b4a1ab3c10a9619632e3a81 Mon Sep 17 00:00:00 2001 +From: Joan Torres Lopez +Date: Thu, 9 Jul 2026 20:09:10 +0200 +Subject: [PATCH] data: Add PAM substack wrappers to prevent auth bypass on + empty service files + +When an authselect-managed service file (e.g., switchable-auth) is missing +or empty, a direct substack to it returns PAM_SUCCESS without checking any +credentials, allowing unauthenticated session access. + +Introduce generated wrapper PAM services (gdm-*-substack) that use include +instead of substack internally, followed by pam_deny.so as a safety net. +The gdm-* services now substack these wrappers: on a properly configured +system, sufficient modules trigger done before reaching pam_deny.so; on an +empty or missing service file, pam_deny.so catches the fallthrough. +--- + data/meson.build | 20 +++++++++++++++++++ + data/pam-redhat/gdm-fingerprint.pam | 2 +- + data/pam-redhat/gdm-password.pam | 4 ++-- + .../gdm-service-auth-substack.pam.in | 5 +++++ + data/pam-redhat/gdm-smartcard.pam | 2 +- + data/pam-redhat/gdm-switchable-auth.pam | 4 ++-- + 6 files changed, 31 insertions(+), 6 deletions(-) + create mode 100644 data/pam-redhat/gdm-service-auth-substack.pam.in + +diff --git a/data/meson.build b/data/meson.build +index 2c5cf94..795f226 100644 +--- a/data/meson.build ++++ b/data/meson.build +@@ -134,6 +134,26 @@ pam_data_files_map = { + ], + } + ++if default_pam_config == 'redhat' ++ pam_substack_services = [ ++ 'password-auth', ++ 'smartcard-auth', ++ 'fingerprint-auth', ++ 'switchable-auth', ++ ] ++ foreach service : pam_substack_services ++ pam_conf = configuration_data() ++ pam_conf.set('PAM_SERVICE', service) ++ configure_file( ++ input: 'pam-redhat/gdm-service-auth-substack.pam.in', ++ output: 'gdm-@0@-substack'.format(service), ++ configuration: pam_conf, ++ install: true, ++ install_dir: pam_profiles_dir, ++ ) ++ endforeach ++endif ++ + pam_data_files = pam_data_files_map.get(default_pam_config, []) + foreach _pam_filename : pam_data_files + install_data('pam-@0@/@1@.pam'.format(default_pam_config, _pam_filename), +diff --git a/data/pam-redhat/gdm-fingerprint.pam b/data/pam-redhat/gdm-fingerprint.pam +index 628568e..b2eddec 100644 +--- a/data/pam-redhat/gdm-fingerprint.pam ++++ b/data/pam-redhat/gdm-fingerprint.pam +@@ -1,4 +1,4 @@ +-auth substack fingerprint-auth ++auth substack gdm-fingerprint-auth-substack + auth include postlogin + + account required pam_nologin.so +diff --git a/data/pam-redhat/gdm-password.pam b/data/pam-redhat/gdm-password.pam +index c75da00..4e331b2 100644 +--- a/data/pam-redhat/gdm-password.pam ++++ b/data/pam-redhat/gdm-password.pam +@@ -1,12 +1,12 @@ + auth [success=done ignore=ignore default=bad] pam_selinux_permit.so +-auth substack password-auth ++auth substack gdm-password-auth-substack + auth optional pam_gnome_keyring.so + auth include postlogin + + account required pam_nologin.so + account include password-auth + +-password substack password-auth ++password substack gdm-password-auth-substack + -password optional pam_gnome_keyring.so use_authtok + + session required pam_selinux.so close +diff --git a/data/pam-redhat/gdm-service-auth-substack.pam.in b/data/pam-redhat/gdm-service-auth-substack.pam.in +new file mode 100644 +index 0000000..db43cbb +--- /dev/null ++++ b/data/pam-redhat/gdm-service-auth-substack.pam.in +@@ -0,0 +1,5 @@ ++auth include @PAM_SERVICE@ ++auth required pam_deny.so ++ ++password include @PAM_SERVICE@ ++password required pam_deny.so +diff --git a/data/pam-redhat/gdm-smartcard.pam b/data/pam-redhat/gdm-smartcard.pam +index 3264a71..da1c328 100644 +--- a/data/pam-redhat/gdm-smartcard.pam ++++ b/data/pam-redhat/gdm-smartcard.pam +@@ -1,4 +1,4 @@ +-auth substack smartcard-auth ++auth substack gdm-smartcard-auth-substack + auth include postlogin + + account required pam_nologin.so +diff --git a/data/pam-redhat/gdm-switchable-auth.pam b/data/pam-redhat/gdm-switchable-auth.pam +index 6648c3c..9b7e6de 100644 +--- a/data/pam-redhat/gdm-switchable-auth.pam ++++ b/data/pam-redhat/gdm-switchable-auth.pam +@@ -1,11 +1,11 @@ +-auth substack switchable-auth ++auth substack gdm-switchable-auth-substack + auth optional pam_gnome_keyring.so + auth include postlogin + + account required pam_nologin.so + account include switchable-auth + +-password substack switchable-auth ++password substack gdm-switchable-auth-substack + -password optional pam_gnome_keyring.so use_authtok + + session required pam_selinux.so close diff --git a/gdm.spec b/gdm.spec index 649d69c..3d7fc7d 100644 --- a/gdm.spec +++ b/gdm.spec @@ -2,7 +2,7 @@ ## (rpmautospec version 0.8.1) ## RPMAUTOSPEC: autorelease, autochangelog %define autorelease(e:s:pb:n) %{?-p:0.}%{lua: - release_number = 21; + release_number = 22; base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}")); print(release_number + base_release_number - 1); }%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}} @@ -82,6 +82,10 @@ Patch: 0001-session-Don-t-report-service-unavailable-error-as-fa.patch # https://gitlab.gnome.org/GNOME/gdm/-/merge_requests/343 Patch: 0001-local-display-factory-look-for-boot_display-sysfs-at.patch +# RHEL-194086 +# https://gitlab.gnome.org/GNOME/gdm/-/merge_requests/378 +Patch: 0001-data-Add-PAM-substack-wrappers-to-prevent-auth-bypas.patch + BuildRequires: dconf BuildRequires: desktop-file-utils BuildRequires: gettext-devel @@ -278,7 +282,7 @@ fi %config %{_sysconfdir}/gdm/PreSession/* %config %{_sysconfdir}/gdm/PostSession/* %config %{_sysconfdir}/pam.d/gdm-autologin -%config %{_sysconfdir}/pam.d/gdm-password +%config %{_sysconfdir}/pam.d/gdm-password* # not config files %{_datadir}/gdm/gdm.schemas %{_sysconfdir}/dbus-1/system.d/gdm.conf @@ -321,9 +325,9 @@ fi %attr(0700, gdm, gdm) %dir %{_localstatedir}/lib/gdm/.config/pulse %attr(0600, gdm, gdm) %{_localstatedir}/lib/gdm/.config/pulse/default.pa %attr(0711, root, gdm) %dir /run/gdm -%config %{_sysconfdir}/pam.d/gdm-smartcard -%config %{_sysconfdir}/pam.d/gdm-switchable-auth -%config %{_sysconfdir}/pam.d/gdm-fingerprint +%config %{_sysconfdir}/pam.d/gdm-smartcard* +%config %{_sysconfdir}/pam.d/gdm-switchable* +%config %{_sysconfdir}/pam.d/gdm-fingerprint* %{_sysconfdir}/pam.d/gdm-launch-environment %{_unitdir}/gdm.service %{_unitdir}/gnome-headless-session@.service @@ -351,6 +355,9 @@ fi %changelog ## START: Generated by rpmautospec +* Fri Jul 10 2026 Joan Torres Lopez - 1:47.0-22 +- Fix auth bypass in authselect pam substacks + * Wed May 27 2026 Joan Torres Lopez - 1:47.0-21 - Fix gdm-x-session parameter, now it uses "--handle-registration"