Bug 1217189

Summary: kscreenlocker6: PAM configuration files with pam_loginuid.so which should be unnecessary
Product: [Novell Products] SUSE Security Incidents Reporter: Matthias Gerstner <matthias.gerstner>
Component: AuditsAssignee: Christophe Marin <christophe>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P5 - None CC: opensuse-kde-bugs, security-team
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
Whiteboard:
Found By: --- Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Matthias Gerstner 2023-11-15 13:13:47 UTC 
+++ This bug was initially created as a clone of Bug #1217076

Doesn't warn, but new pam files are needed for unlocking screen with fingerprint devices or smartcard:

https://build.opensuse.org/package/view_file/KDE:Unstable:Frameworks/kscreenlock er6/kde-smartcard?expand=1
https://build.opensuse.org/package/view_file/KDE:Unstable:Frameworks/kscreenlock er6/kde-fingerprint?expand=1
https://build.opensuse.org/package/view_file/KDE:Unstable:Frameworks/kscreenlock er6/kde?expand=1 (identical to current one)
Comment 1 Matthias Gerstner 2023-11-28 17:22:14 UTC 
I'm looking into this. These are just two custom PAM configuration files. On
first sight nothing problematic.
Comment 2 Matthias Gerstner 2023-11-29 09:58:40 UTC 
The PAM configuration files are pretty straight forward.

However I believe that the `pam_loginuid.so` does not belong in there. This is
only supposed to be used for "entry applications" like login, gdm etc. But
kscreenlocker isn't an entry application, or is it?

Since these files are part of the packaging I reassign this bug to you.

Whitelisting is not required for this.
Comment 3 Matthias Gerstner 2024-02-14 12:23:30 UTC 
The PAM configuration files in KDE:Frameworks/kscreenlocker6 still are the
same. Moving this bug out of the whitelisting tracker bug since there is no
whitelisting required.
Comment 4 Christophe Marin 2024-02-16 23:16:59 UTC 
session mechanisms were dropped