Fix auth bypass in authselect pam substacks
Resolves: https://redhat.atlassian.net/browse/RHEL-194090
This commit is contained in:
Joan Torres Lopez
parent
e0913cdea8
commit
520181a385
124
0001-data-Add-PAM-substack-wrappers-to-prevent-auth-bypas.patch
Normal file
124
0001-data-Add-PAM-substack-wrappers-to-prevent-auth-bypas.patch
Normal file
@ -0,0 +1,124 @@
|
||||
From 2892ac533be818826b4a1ab3c10a9619632e3a81 Mon Sep 17 00:00:00 2001
|
||||
From: Joan Torres Lopez <joantolo@redhat.com>
|
||||
Date: Thu, 9 Jul 2026 20:09:10 +0200
|
||||
Subject: [PATCH] data: Add PAM substack wrappers to prevent auth bypass on
|
||||
empty service files
|
||||
|
||||
When an authselect-managed service file (e.g., switchable-auth) is missing
|
||||
or empty, a direct substack to it returns PAM_SUCCESS without checking any
|
||||
credentials, allowing unauthenticated session access.
|
||||
|
||||
Introduce generated wrapper PAM services (gdm-*-substack) that use include
|
||||
instead of substack internally, followed by pam_deny.so as a safety net.
|
||||
The gdm-* services now substack these wrappers: on a properly configured
|
||||
system, sufficient modules trigger done before reaching pam_deny.so; on an
|
||||
empty or missing service file, pam_deny.so catches the fallthrough.
|
||||
---
|
||||
data/meson.build | 20 +++++++++++++++++++
|
||||
data/pam-redhat/gdm-fingerprint.pam | 2 +-
|
||||
data/pam-redhat/gdm-password.pam | 4 ++--
|
||||
.../gdm-service-auth-substack.pam.in | 5 +++++
|
||||
data/pam-redhat/gdm-smartcard.pam | 2 +-
|
||||
data/pam-redhat/gdm-switchable-auth.pam | 4 ++--
|
||||
6 files changed, 31 insertions(+), 6 deletions(-)
|
||||
create mode 100644 data/pam-redhat/gdm-service-auth-substack.pam.in
|
||||
|
||||
diff --git a/data/meson.build b/data/meson.build
|
||||
index de75c15..780878c 100644
|
||||
--- a/data/meson.build
|
||||
+++ b/data/meson.build
|
||||
@@ -149,6 +149,26 @@ foreach _pam_filename : pam_data_files
|
||||
)
|
||||
endforeach
|
||||
|
||||
+if default_pam_config == 'redhat'
|
||||
+ pam_substack_services = [
|
||||
+ 'password-auth',
|
||||
+ 'smartcard-auth',
|
||||
+ 'fingerprint-auth',
|
||||
+ 'switchable-auth',
|
||||
+ ]
|
||||
+ foreach service : pam_substack_services
|
||||
+ pam_conf = configuration_data()
|
||||
+ pam_conf.set('PAM_SERVICE', service)
|
||||
+ configure_file(
|
||||
+ input: 'pam-redhat/gdm-service-auth-substack.pam.in',
|
||||
+ output: 'gdm-@0@-substack'.format(service),
|
||||
+ configuration: pam_conf,
|
||||
+ install: true,
|
||||
+ install_dir: pam_prefix / 'pam.d',
|
||||
+ )
|
||||
+ endforeach
|
||||
+endif
|
||||
+
|
||||
gdm_rules = configure_file(
|
||||
input: '61-gdm.rules.in',
|
||||
output: '@BASENAME@',
|
||||
diff --git a/data/pam-redhat/gdm-fingerprint.pam b/data/pam-redhat/gdm-fingerprint.pam
|
||||
index 1483cdf..597448e 100644
|
||||
--- a/data/pam-redhat/gdm-fingerprint.pam
|
||||
+++ b/data/pam-redhat/gdm-fingerprint.pam
|
||||
@@ -1,4 +1,4 @@
|
||||
-auth substack fingerprint-auth
|
||||
+auth substack gdm-fingerprint-auth-substack
|
||||
auth include postlogin
|
||||
|
||||
account required pam_nologin.so
|
||||
diff --git a/data/pam-redhat/gdm-password.pam b/data/pam-redhat/gdm-password.pam
|
||||
index 21c04ec..8940f38 100644
|
||||
--- a/data/pam-redhat/gdm-password.pam
|
||||
+++ b/data/pam-redhat/gdm-password.pam
|
||||
@@ -1,12 +1,12 @@
|
||||
auth [success=done ignore=ignore default=bad] pam_selinux_permit.so
|
||||
-auth substack password-auth
|
||||
+auth substack gdm-password-auth-substack
|
||||
auth optional pam_gnome_keyring.so
|
||||
auth include postlogin
|
||||
|
||||
account required pam_nologin.so
|
||||
account include password-auth
|
||||
|
||||
-password substack password-auth
|
||||
+password substack gdm-password-auth-substack
|
||||
-password optional pam_gnome_keyring.so use_authtok
|
||||
|
||||
session required pam_selinux.so close
|
||||
diff --git a/data/pam-redhat/gdm-service-auth-substack.pam.in b/data/pam-redhat/gdm-service-auth-substack.pam.in
|
||||
new file mode 100644
|
||||
index 0000000..db43cbb
|
||||
--- /dev/null
|
||||
+++ b/data/pam-redhat/gdm-service-auth-substack.pam.in
|
||||
@@ -0,0 +1,5 @@
|
||||
+auth include @PAM_SERVICE@
|
||||
+auth required pam_deny.so
|
||||
+
|
||||
+password include @PAM_SERVICE@
|
||||
+password required pam_deny.so
|
||||
diff --git a/data/pam-redhat/gdm-smartcard.pam b/data/pam-redhat/gdm-smartcard.pam
|
||||
index 5024e52..0d3c2d3 100644
|
||||
--- a/data/pam-redhat/gdm-smartcard.pam
|
||||
+++ b/data/pam-redhat/gdm-smartcard.pam
|
||||
@@ -1,4 +1,4 @@
|
||||
-auth substack smartcard-auth
|
||||
+auth substack gdm-smartcard-auth-substack
|
||||
auth include postlogin
|
||||
|
||||
account required pam_nologin.so
|
||||
diff --git a/data/pam-redhat/gdm-switchable-auth.pam b/data/pam-redhat/gdm-switchable-auth.pam
|
||||
index 6648c3c..9b7e6de 100644
|
||||
--- a/data/pam-redhat/gdm-switchable-auth.pam
|
||||
+++ b/data/pam-redhat/gdm-switchable-auth.pam
|
||||
@@ -1,11 +1,11 @@
|
||||
-auth substack switchable-auth
|
||||
+auth substack gdm-switchable-auth-substack
|
||||
auth optional pam_gnome_keyring.so
|
||||
auth include postlogin
|
||||
|
||||
account required pam_nologin.so
|
||||
account include switchable-auth
|
||||
|
||||
-password substack switchable-auth
|
||||
+password substack gdm-switchable-auth-substack
|
||||
-password optional pam_gnome_keyring.so use_authtok
|
||||
|
||||
session required pam_selinux.so close
|
||||
16
gdm.spec
16
gdm.spec
@ -11,7 +11,7 @@
|
||||
Name: gdm
|
||||
Epoch: 1
|
||||
Version: 40.1
|
||||
Release: 47%{?dist}
|
||||
Release: 48%{?dist}
|
||||
Summary: The GNOME Display Manager
|
||||
|
||||
License: GPLv2+
|
||||
@ -81,6 +81,8 @@ Patch170001: 0001-session-record-Rework-wtmp-utmp-btmp-fields.patch
|
||||
Patch180001: 0001-pam-extensions-Add-support-for-generic-GDM-CustomJSON.patch
|
||||
Patch180002: 0001-data-Add-support-for-unified-authentication.patch
|
||||
|
||||
Patch190001: 0001-data-Add-PAM-substack-wrappers-to-prevent-auth-bypas.patch
|
||||
|
||||
# Non-upstreamable workarounds
|
||||
Patch66610001: 0001-data-reap-gdm-sessions-on-shutdown.patch
|
||||
|
||||
@ -317,7 +319,7 @@ dconf update || :
|
||||
%config %{_sysconfdir}/gdm/PreSession/*
|
||||
%config %{_sysconfdir}/gdm/PostSession/*
|
||||
%config %{_sysconfdir}/pam.d/gdm-autologin
|
||||
%config %{_sysconfdir}/pam.d/gdm-password
|
||||
%config %{_sysconfdir}/pam.d/gdm-password*
|
||||
# not config files
|
||||
%{_sysconfdir}/gdm/Xsession
|
||||
%{_datadir}/gdm/gdm.schemas
|
||||
@ -362,9 +364,9 @@ dconf update || :
|
||||
%attr(0600, gdm, gdm) %{_localstatedir}/lib/gdm/.config/pulse/default.pa
|
||||
%attr(0711, root, gdm) %dir /run/gdm
|
||||
%config %{_sysconfdir}/pam.d/gdm-pin
|
||||
%config %{_sysconfdir}/pam.d/gdm-smartcard
|
||||
%config %{_sysconfdir}/pam.d/gdm-switchable-auth
|
||||
%config %{_sysconfdir}/pam.d/gdm-fingerprint
|
||||
%config %{_sysconfdir}/pam.d/gdm-smartcard*
|
||||
%config %{_sysconfdir}/pam.d/gdm-switchable*
|
||||
%config %{_sysconfdir}/pam.d/gdm-fingerprint*
|
||||
%{_sysconfdir}/pam.d/gdm-launch-environment
|
||||
%{_udevrulesdir}/61-gdm.rules
|
||||
%{_unitdir}/gdm.service
|
||||
@ -392,6 +394,10 @@ dconf update || :
|
||||
%{_libdir}/pkgconfig/gdm-pam-extensions.pc
|
||||
|
||||
%changelog
|
||||
* Fri Jul 10 2026 Joan Torres Lopez <joantolo@redhat.com> - 40.1-48
|
||||
- Fix auth bypass in authselect pam substacks
|
||||
Resolves: https://redhat.atlassian.net/browse/RHEL-194090
|
||||
|
||||
* Mon Jun 1 2026 Joan Torres Lopez <joantolo@redhat.com> - 40.1-47
|
||||
- Create display in "legacy-xorg" mode checking displays in tty
|
||||
Resolves: https://redhat.atlassian.net/browse/RHEL-180822
|
||||
|
||||
Loading…
Reference in New Issue
Block a user