|
 |
1e501a |
From e92b0e3c56df36e8291a2f3dbef45e8332fab8ab Mon Sep 17 00:00:00 2001
|
|
|
1e501a |
From: Ray Strode <rstrode@redhat.com>
|
|
|
1e501a |
Date: Fri, 16 Jan 2015 09:46:26 -0500
|
|
|
1e501a |
Subject: [PATCH] Revert "pam: drop postlogin from fedora pam config"
|
|
|
1e501a |
|
|
|
1e501a |
This reverts commit 76d26d8c1c37c6bd38bcac082d5cc62670fe5d39.
|
|
|
1e501a |
|
|
|
1e501a |
It breaks pam_ecryptfs.
|
|
|
1e501a |
Downstream: https://bugzilla.redhat.com/show_bug.cgi?id=1174366
|
|
|
1e501a |
|
|
|
1e501a |
https://bugzilla.gnome.org/show_bug.cgi?id=743045
|
|
|
1e501a |
---
|
|
|
1e501a |
data/pam-redhat/gdm-autologin.pam | 2 ++
|
|
|
1e501a |
data/pam-redhat/gdm-fingerprint.pam | 2 ++
|
|
|
1e501a |
data/pam-redhat/gdm-launch-environment.pam | 2 ++
|
|
|
1e501a |
data/pam-redhat/gdm-password.pam | 2 ++
|
|
|
1e501a |
data/pam-redhat/gdm-pin.pam | 2 ++
|
|
|
1e501a |
data/pam-redhat/gdm-smartcard.pam | 2 ++
|
|
|
1e501a |
data/pam-redhat/gdm.pam | 3 +++
|
|
|
1e501a |
7 files changed, 15 insertions(+)
|
|
|
1e501a |
|
|
|
1e501a |
diff --git a/data/pam-redhat/gdm-autologin.pam b/data/pam-redhat/gdm-autologin.pam
|
|
|
1e501a |
index 08d4543..0616e66 100644
|
|
|
1e501a |
--- a/data/pam-redhat/gdm-autologin.pam
|
|
|
1e501a |
+++ b/data/pam-redhat/gdm-autologin.pam
|
|
|
1e501a |
@@ -1,14 +1,16 @@
|
|
|
1e501a |
#%PAM-1.0
|
|
|
1e501a |
auth required pam_env.so
|
|
|
1e501a |
auth required pam_permit.so
|
|
|
1e501a |
+auth include postlogin
|
|
|
1e501a |
account required pam_nologin.so
|
|
|
1e501a |
account include system-auth
|
|
|
1e501a |
password include system-auth
|
|
|
1e501a |
session required pam_selinux.so close
|
|
|
1e501a |
session required pam_loginuid.so
|
|
|
1e501a |
session optional pam_console.so
|
|
|
1e501a |
-session optional pam_ck_connector.so
|
|
|
1e501a |
session required pam_selinux.so open
|
|
|
1e501a |
session optional pam_keyinit.so force revoke
|
|
|
1e501a |
session required pam_namespace.so
|
|
|
1e501a |
session include system-auth
|
|
|
1e501a |
+session include postlogin
|
|
|
1e501a |
diff --git a/data/pam-redhat/gdm-fingerprint.pam b/data/pam-redhat/gdm-fingerprint.pam
|
|
|
1e501a |
index ee0635d..c5a3598 100644
|
|
|
1e501a |
--- a/data/pam-redhat/gdm-fingerprint.pam
|
|
|
1e501a |
+++ b/data/pam-redhat/gdm-fingerprint.pam
|
|
|
1e501a |
@@ -1,15 +1,17 @@
|
|
|
1e501a |
auth substack fingerprint-auth
|
|
|
1e501a |
+auth include postlogin
|
|
|
1e501a |
|
|
|
1e501a |
account required pam_nologin.so
|
|
|
1e501a |
account include fingerprint-auth
|
|
|
1e501a |
|
|
|
1e501a |
password include fingerprint-auth
|
|
|
1e501a |
|
|
|
1e501a |
session required pam_selinux.so close
|
|
|
1e501a |
session required pam_loginuid.so
|
|
|
1e501a |
session optional pam_console.so
|
|
|
1e501a |
-session optional pam_ck_connector.so
|
|
|
1e501a |
session required pam_selinux.so open
|
|
|
1e501a |
session optional pam_keyinit.so force revoke
|
|
|
1e501a |
session required pam_namespace.so
|
|
|
1e501a |
session include fingerprint-auth
|
|
|
1e501a |
+session include postlogin
|
|
|
1e501a |
diff --git a/data/pam-redhat/gdm-launch-environment.pam b/data/pam-redhat/gdm-launch-environment.pam
|
|
|
1e501a |
index f1811f1..a5130ea 100644
|
|
|
1e501a |
--- a/data/pam-redhat/gdm-launch-environment.pam
|
|
|
1e501a |
+++ b/data/pam-redhat/gdm-launch-environment.pam
|
|
|
1e501a |
@@ -1,7 +1,9 @@
|
|
|
1e501a |
#%PAM-1.0
|
|
|
1e501a |
auth required pam_env.so
|
|
|
1e501a |
auth required pam_permit.so
|
|
|
1e501a |
+auth include postlogin
|
|
|
1e501a |
account include system-auth
|
|
|
1e501a |
password include system-auth
|
|
|
1e501a |
session optional pam_keyinit.so force revoke
|
|
|
1e501a |
session include system-auth
|
|
|
1e501a |
+session include postlogin
|
|
|
1e501a |
diff --git a/data/pam-redhat/gdm-password.pam b/data/pam-redhat/gdm-password.pam
|
|
|
1e501a |
index b95ca16..3006d0c 100644
|
|
|
1e501a |
--- a/data/pam-redhat/gdm-password.pam
|
|
|
1e501a |
+++ b/data/pam-redhat/gdm-password.pam
|
|
|
1e501a |
@@ -1,19 +1,21 @@
|
|
|
1e501a |
auth [success=done ignore=ignore default=bad] pam_selinux_permit.so
|
|
|
1e501a |
auth substack password-auth
|
|
|
1e501a |
auth optional pam_gnome_keyring.so
|
|
|
1e501a |
+auth include postlogin
|
|
|
1e501a |
|
|
|
1e501a |
account required pam_nologin.so
|
|
|
1e501a |
account include password-auth
|
|
|
1e501a |
|
|
|
1e501a |
password substack password-auth
|
|
|
1e501a |
-password optional pam_gnome_keyring.so use_authtok
|
|
|
1e501a |
|
|
|
1e501a |
session required pam_selinux.so close
|
|
|
1e501a |
session required pam_loginuid.so
|
|
|
1e501a |
session optional pam_console.so
|
|
|
1e501a |
-session optional pam_ck_connector.so
|
|
|
1e501a |
session required pam_selinux.so open
|
|
|
1e501a |
session optional pam_keyinit.so force revoke
|
|
|
1e501a |
session required pam_namespace.so
|
|
|
1e501a |
session include password-auth
|
|
|
1e501a |
session optional pam_gnome_keyring.so auto_start
|
|
|
1e501a |
+session include postlogin
|
|
|
1e501a |
diff --git a/data/pam-redhat/gdm-pin.pam b/data/pam-redhat/gdm-pin.pam
|
|
|
1e501a |
index d0a4e71..7594653 100644
|
|
|
1e501a |
--- a/data/pam-redhat/gdm-pin.pam
|
|
|
1e501a |
+++ b/data/pam-redhat/gdm-pin.pam
|
|
|
1e501a |
@@ -1,20 +1,22 @@
|
|
|
1e501a |
auth [success=done ignore=ignore default=bad] pam_selinux_permit.so
|
|
|
1e501a |
auth requisite pam_pin.so
|
|
|
1e501a |
auth substack password-auth
|
|
|
1e501a |
auth optional pam_gnome_keyring.so
|
|
|
1e501a |
+auth include postlogin
|
|
|
1e501a |
|
|
|
1e501a |
account required pam_nologin.so
|
|
|
1e501a |
account include password-auth
|
|
|
1e501a |
|
|
|
1e501a |
password include password-auth
|
|
|
1e501a |
password optional pam_pin.so
|
|
|
1e501a |
|
|
|
1e501a |
session required pam_selinux.so close
|
|
|
1e501a |
session required pam_loginuid.so
|
|
|
1e501a |
session optional pam_console.so
|
|
|
1e501a |
-session optional pam_ck_connector.so
|
|
|
1e501a |
session required pam_selinux.so open
|
|
|
1e501a |
session optional pam_keyinit.so force revoke
|
|
|
1e501a |
session required pam_namespace.so
|
|
|
1e501a |
session include password-auth
|
|
|
1e501a |
session optional pam_gnome_keyring.so auto_start
|
|
|
1e501a |
+session include postlogin
|
|
|
1e501a |
diff --git a/data/pam-redhat/gdm-smartcard.pam b/data/pam-redhat/gdm-smartcard.pam
|
|
|
1e501a |
index d49eef9..c91cf0d 100644
|
|
|
1e501a |
--- a/data/pam-redhat/gdm-smartcard.pam
|
|
|
1e501a |
+++ b/data/pam-redhat/gdm-smartcard.pam
|
|
|
1e501a |
@@ -1,15 +1,17 @@
|
|
|
1e501a |
auth substack smartcard-auth
|
|
|
1e501a |
+auth include postlogin
|
|
|
1e501a |
|
|
|
1e501a |
account required pam_nologin.so
|
|
|
1e501a |
account include smartcard-auth
|
|
|
1e501a |
|
|
|
1e501a |
password include smartcard-auth
|
|
|
1e501a |
|
|
|
1e501a |
session required pam_selinux.so close
|
|
|
1e501a |
session required pam_loginuid.so
|
|
|
1e501a |
session optional pam_console.so
|
|
|
1e501a |
-session optional pam_ck_connector.so
|
|
|
1e501a |
session required pam_selinux.so open
|
|
|
1e501a |
session optional pam_keyinit.so force revoke
|
|
|
1e501a |
session required pam_namespace.so
|
|
|
1e501a |
session include smartcard-auth
|
|
|
1e501a |
+session include postlogin
|
|
|
1e501a |
diff --git a/data/pam-redhat/gdm.pam b/data/pam-redhat/gdm.pam
|
|
|
1e501a |
index 9d95a51..baa058b 100644
|
|
|
1e501a |
--- a/data/pam-redhat/gdm.pam
|
|
|
1e501a |
+++ b/data/pam-redhat/gdm.pam
|
|
|
1e501a |
@@ -1,10 +1,13 @@
|
|
|
1e501a |
#%PAM-1.0
|
|
|
1e501a |
auth required pam_env.so
|
|
|
1e501a |
auth sufficient pam_succeed_if.so user ingroup nopasswdlogin
|
|
|
1e501a |
+auth include postlogin
|
|
|
1e501a |
auth include system-auth
|
|
|
1e501a |
+account required pam_nologin.so
|
|
|
1e501a |
account include system-auth
|
|
|
1e501a |
password include system-auth
|
|
|
1e501a |
session optional pam_keyinit.so force revoke
|
|
|
1e501a |
session include system-auth
|
|
|
1e501a |
session required pam_loginuid.so
|
|
|
1e501a |
session optional pam_console.so
|
|
|
1e501a |
+session include postlogin
|
|
|
1e501a |
--
|
|
|
1e501a |
2.3.7
|
|
|
1e501a |
|