Archive-Team
/
zfs
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 103 Wiki Activity

Merge cc3014ef08 into 7ca7bb7fd7

This commit is contained in:
ColMelvin 2024-07-17 07:20:43 +08:00 committed by GitHub
parent 7ca7bb7fd7 cc3014ef08
commit ad4c7914c2
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 30 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
contrib/pam_zfs_key/pam_zfs_key.c
View File

@ -665,6 +665,35 @@ zfs_key_config_modify_session_counter(pam_handle_t *pamh,
return (counter_value); return (counter_value);
} }
/*
* This module only works if every opened session is later closed. There are
* known and common service(s) which violate this norm; warn if they are
* detected.
*
* Specifically, these <services> include "systemd-user".
*
* Workaround:
* session [success=1 default=ignore] pam_succeed_if.so service in <services>
* session optional pam_zfs_key.so
*/
static int
session_roundtrip_check(pam_handle_t *pamh)
{
const char *service;
int ret = pam_get_item(pamh, PAM_SERVICE, (const void **)&service);
if (ret != PAM_SUCCESS) {
pam_syslog(pamh, LOG_NOTICE, "Unable to identify PAM service");
return (-1);
}
if (strcmp("systemd-user", service) == 0) {
pam_syslog(pamh, LOG_WARNING,
"Key may not be unloaded because of "
"https://github.com/systemd/systemd/issues/8598");
return (1);
}
return (0);
}
__attribute__((visibility("default"))) __attribute__((visibility("default")))
PAM_EXTERN int PAM_EXTERN int
pam_sm_authenticate(pam_handle_t *pamh, int flags, pam_sm_authenticate(pam_handle_t *pamh, int flags,
@ -830,6 +859,7 @@ pam_sm_open_session(pam_handle_t *pamh, int flags,
"Cannot zfs_mount when not being root."); "Cannot zfs_mount when not being root.");
return (PAM_SUCCESS); return (PAM_SUCCESS);
} }
(void) session_roundtrip_check(pamh);
zfs_key_config_t config; zfs_key_config_t config;
if (zfs_key_config_load(pamh, &config, argc, argv) != PAM_SUCCESS) { if (zfs_key_config_load(pamh, &config, argc, argv) != PAM_SUCCESS) {
return (PAM_SESSION_ERR); return (PAM_SESSION_ERR);