Date: Sat, 20 Aug 2022 11:57:24 +0200 From: Felix Palmen <zirias@FreeBSD.org> To: freebsd-ports@FreeBSD.org Subject: security/unix-selfauth-helper ready for use (screenlockers etc) Message-ID: <20220820095724.soj2hdefvk3waniv@nexus.home.palmen-it.de>
next in thread | raw e-mail | index | archive | help
--sfh7hsvkypyxmt66 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hello everyone, just a quick notice if you're maintaining a port of some screen locker, you now *might* want to add security/unix-selfauth-helper as a RUN_DEPENDS. Short background is a "special" feature of LinuxPAM that *some* screen lockers now take for granted: Their pam_unix.so uses a suid-root helper for the case that you're trying to authenticate as yourself. As a consequence, a screen locker doesn't need to be suid-root itself (or use a 3rd-party suid-root helper) in order to use PAM when pam_unix.so might be used. I tried to reimplement this feature into our pam_unix.so, which was rejected, but des@ recommended to use pam_exec.so instead. That's how unix-selfauth-helper came to be. It must be specifically configured in the PAM policy used, but it's less intrusive than modifying pam_unix. To learn how to use it, just have a look at unix-selfauth-helper(8). You can also look at a review I opened to update xscreensaver to 6.04 (which will need this functionality) as an example here: <https://reviews.freebsd.org/D35348>. Best regards, Felix --=20 Felix Palmen <zirias@FreeBSD.org> {private} felix@palmen-it.de -- ports committer (mentee) -- {web} http://palmen-it.de {pgp public key} http://palmen-it.de/pub.txt {pgp fingerprint} 6936 13D5 5BBF 4837 B212 3ACC 54AD E006 9879 F231 --sfh7hsvkypyxmt66 Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iNUEABYKAH0WIQRpNhPVW79IN7ISOsxUreAGmHnyMQUCYwCwBF8UgAAAAAAuAChp c3N1ZXItZnByQG5vdGF0aW9ucy5vcGVucGdwLmZpZnRoaG9yc2VtYW4ubmV0Njkz NjEzRDU1QkJGNDgzN0IyMTIzQUNDNTRBREUwMDY5ODc5RjIzMQAKCRBUreAGmHny McQSAP4ji+xlfP9m6SxIZ+TyoIyAp6r4YbExecTbD/U1iRW9wwD+N+rJDstwK61z sCxFmVPQG2REZOfNKA5b/dDLikq4+As= =n5pO -----END PGP SIGNATURE----- --sfh7hsvkypyxmt66--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20220820095724.soj2hdefvk3waniv>