rpms/systemd
7
0
Fork 0
Code Issues Pull Requests Releases Activity
a10s
systemd/0047-fedora-use-system-auth-in-pam-systemd-user.patch

34 lines
1.0 KiB
Diff
Raw Permalink Normal View History

systemd rebase/bootstrap for c10s Resolves: RHEL-40924,RHEL-22621,RHEL-678,RHEL-40360,RHEL-36636
2024-06-26 15:26:24 +00:00
From 79519b922b59c2282223742327cc8d75c7b219d0 Mon Sep 17 00:00:00 2001
Use upstream pam systemd-auth file with a patch, add pam_keyinit This file changes rarely, but it does every one in a while. And since we have an independent copy, we forget to adjust it. We have had already two bugs because of this. I submitted a PR upstream to include pam_namespace (because that makes sense for all distros), so the diff between upstream and us now is just the inclusion of system-auth (which is not upstreamable). Effectively, the only difference right now is that 'pam_keyinit force revoke' is included. It was added upstream with the comment: We want that systemd --user gets its own keyring as usual, even if the barebones PAM snippet we ship upstream is used. If we don't do this we get the basic keyring systemd --system sets up for us.
2022-12-14 21:35:52 +00:00
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
Date: Wed, 14 Dec 2022 22:24:53 +0100
Version 254~rc1 - Way too many changes to list. See https://raw.githubusercontent.com/systemd/systemd/v254-rc1/NEWS - Fix regression in socket activation of services (rhbz#2213660).
2023-07-10 16:52:26 +00:00
Subject: [PATCH] fedora: use system-auth in pam systemd-user
Use upstream pam systemd-auth file with a patch, add pam_keyinit This file changes rarely, but it does every one in a while. And since we have an independent copy, we forget to adjust it. We have had already two bugs because of this. I submitted a PR upstream to include pam_namespace (because that makes sense for all distros), so the diff between upstream and us now is just the inclusion of system-auth (which is not upstreamable). Effectively, the only difference right now is that 'pam_keyinit force revoke' is included. It was added upstream with the comment: We want that systemd --user gets its own keyring as usual, even if the barebones PAM snippet we ship upstream is used. If we don't do this we get the basic keyring systemd --system sets up for us.
2022-12-14 21:35:52 +00:00
systemd rebase/bootstrap for c10s Resolves: RHEL-40924,RHEL-22621,RHEL-678,RHEL-40360,RHEL-36636
2024-06-26 15:26:24 +00:00
Adjust upstream config to use our shared stack
rhel-only: feature
Related: RHEL-40924
Use upstream pam systemd-auth file with a patch, add pam_keyinit This file changes rarely, but it does every one in a while. And since we have an independent copy, we forget to adjust it. We have had already two bugs because of this. I submitted a PR upstream to include pam_namespace (because that makes sense for all distros), so the diff between upstream and us now is just the inclusion of system-auth (which is not upstreamable). Effectively, the only difference right now is that 'pam_keyinit force revoke' is included. It was added upstream with the comment: We want that systemd --user gets its own keyring as usual, even if the barebones PAM snippet we ship upstream is used. If we don't do this we get the basic keyring systemd --system sets up for us.
2022-12-14 21:35:52 +00:00
---
src/login/systemd-user.in | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/login/systemd-user.in b/src/login/systemd-user.in
Version 254~rc1 - Way too many changes to list. See https://raw.githubusercontent.com/systemd/systemd/v254-rc1/NEWS - Fix regression in socket activation of services (rhbz#2213660).
2023-07-10 16:52:26 +00:00
index 8a3c9e0165..74ef5f2552 100644
Use upstream pam systemd-auth file with a patch, add pam_keyinit This file changes rarely, but it does every one in a while. And since we have an independent copy, we forget to adjust it. We have had already two bugs because of this. I submitted a PR upstream to include pam_namespace (because that makes sense for all distros), so the diff between upstream and us now is just the inclusion of system-auth (which is not upstreamable). Effectively, the only difference right now is that 'pam_keyinit force revoke' is included. It was added upstream with the comment: We want that systemd --user gets its own keyring as usual, even if the barebones PAM snippet we ship upstream is used. If we don't do this we get the basic keyring systemd --system sets up for us.
2022-12-14 21:35:52 +00:00
--- a/src/login/systemd-user.in
+++ b/src/login/systemd-user.in
@@ -7,7 +7,7 @@
-account sufficient pam_systemd_home.so
{% endif %}
account sufficient pam_unix.so no_pass_expiry
-account required pam_permit.so
+account include system-auth
{% if HAVE_SELINUX %}
session required pam_selinux.so close
Version 254~rc1 - Way too many changes to list. See https://raw.githubusercontent.com/systemd/systemd/v254-rc1/NEWS - Fix regression in socket activation of services (rhbz#2213660).
2023-07-10 16:52:26 +00:00
@@ -20,4 +20,4 @@ session required pam_namespace.so
Use upstream pam systemd-auth file with a patch, add pam_keyinit This file changes rarely, but it does every one in a while. And since we have an independent copy, we forget to adjust it. We have had already two bugs because of this. I submitted a PR upstream to include pam_namespace (because that makes sense for all distros), so the diff between upstream and us now is just the inclusion of system-auth (which is not upstreamable). Effectively, the only difference right now is that 'pam_keyinit force revoke' is included. It was added upstream with the comment: We want that systemd --user gets its own keyring as usual, even if the barebones PAM snippet we ship upstream is used. If we don't do this we get the basic keyring systemd --system sets up for us.
2022-12-14 21:35:52 +00:00
-session optional pam_systemd_home.so
{% endif %}
Version 254~rc1 - Way too many changes to list. See https://raw.githubusercontent.com/systemd/systemd/v254-rc1/NEWS - Fix regression in socket activation of services (rhbz#2213660).
2023-07-10 16:52:26 +00:00
session optional pam_umask.so silent
Use upstream pam systemd-auth file with a patch, add pam_keyinit This file changes rarely, but it does every one in a while. And since we have an independent copy, we forget to adjust it. We have had already two bugs because of this. I submitted a PR upstream to include pam_namespace (because that makes sense for all distros), so the diff between upstream and us now is just the inclusion of system-auth (which is not upstreamable). Effectively, the only difference right now is that 'pam_keyinit force revoke' is included. It was added upstream with the comment: We want that systemd --user gets its own keyring as usual, even if the barebones PAM snippet we ship upstream is used. If we don't do this we get the basic keyring systemd --system sets up for us.
2022-12-14 21:35:52 +00:00
-session optional pam_systemd.so
+session include system-auth
Reference in New Issue Copy Permalink