Bug 1217189 - kscreenlocker6: PAM configuration files with pam_loginuid.so which should be unnecessary
Summary: kscreenlocker6: PAM configuration files with pam_loginuid.so which should be ...
Status: RESOLVED FIXED
Alias: None
Product: SUSE Security Incidents
Classification: Novell Products
Component: Audits (show other bugs)
Version: unspecified
Hardware: Other Other
: P5 - None : Normal
Target Milestone: ---
Assignee: Christophe Marin
QA Contact: Security Team bot
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-11-15 13:13 UTC by Matthias Gerstner
Modified: 2024-02-16 23:16 UTC (History)
2 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Matthias Gerstner 2023-11-15 13:13:47 UTC 
+++ This bug was initially created as a clone of Bug #1217076

Doesn't warn, but new pam files are needed for unlocking screen with fingerprint devices or smartcard:

https://build.opensuse.org/package/view_file/KDE:Unstable:Frameworks/kscreenlock er6/kde-smartcard?expand=1
https://build.opensuse.org/package/view_file/KDE:Unstable:Frameworks/kscreenlock er6/kde-fingerprint?expand=1
https://build.opensuse.org/package/view_file/KDE:Unstable:Frameworks/kscreenlock er6/kde?expand=1 (identical to current one)
Comment 1 Matthias Gerstner 2023-11-28 17:22:14 UTC 
I'm looking into this. These are just two custom PAM configuration files. On
first sight nothing problematic.
Comment 2 Matthias Gerstner 2023-11-29 09:58:40 UTC 
The PAM configuration files are pretty straight forward.

However I believe that the `pam_loginuid.so` does not belong in there. This is
only supposed to be used for "entry applications" like login, gdm etc. But
kscreenlocker isn't an entry application, or is it?

Since these files are part of the packaging I reassign this bug to you.

Whitelisting is not required for this.
Comment 3 Matthias Gerstner 2024-02-14 12:23:30 UTC 
The PAM configuration files in KDE:Frameworks/kscreenlocker6 still are the
same. Moving this bug out of the whitelisting tracker bug since there is no
whitelisting required.
Comment 4 Christophe Marin 2024-02-16 23:16:59 UTC 
session mechanisms were dropped