public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #21860 from e-user/bugfix/upstream/gnome-pam

Browse Source 
nixos/gdm: use provided PAM login configuration wherever possible
This commit is contained in:
worldofpeace 2019-04-14 09:52:17 -04:00 committed by GitHub
commit 4616b4ec85
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 15 additions and 62 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
nixos/modules/security/pam.nix
View File

@ -410,6 +410,8 @@ let
"password sufficient ${pam_krb5}/lib/security/pam_krb5.so use_first_pass"} "password sufficient ${pam_krb5}/lib/security/pam_krb5.so use_first_pass"}
${optionalString config.services.samba.syncPasswordsByPam ${optionalString config.services.samba.syncPasswordsByPam
"password optional ${pkgs.samba}/lib/security/pam_smbpass.so nullok use_authtok try_first_pass"} "password optional ${pkgs.samba}/lib/security/pam_smbpass.so nullok use_authtok try_first_pass"}
${optionalString cfg.enableGnomeKeyring
"password optional ${pkgs.gnome3.gnome-keyring}/lib/security/pam_gnome_keyring.so use_authtok"}
# Session management. # Session management.
${optionalString cfg.setEnvironment '' ${optionalString cfg.setEnvironment ''

2
nixos/modules/services/desktops/gnome3/gnome-keyring.nix
View File

@ -35,6 +35,8 @@ with lib;
services.dbus.packages = [ pkgs.gnome3.gnome-keyring pkgs.gcr ]; services.dbus.packages = [ pkgs.gnome3.gnome-keyring pkgs.gcr ];
security.pam.services.login.enableGnomeKeyring = true;
}; };
} }

61
nixos/modules/services/x11/display-managers/gdm.nix
View File

@ -208,59 +208,11 @@ in
session optional pam_permit.so session optional pam_permit.so
''; '';
gdm.text = ''
auth requisite pam_nologin.so
auth required pam_env.so envfile=${config.system.build.pamEnvironment}
auth required pam_succeed_if.so uid >= 1000 quiet
auth optional ${pkgs.gnome3.gnome-keyring}/lib/security/pam_gnome_keyring.so
auth ${if config.security.pam.enableEcryptfs then "required" else "sufficient"} pam_unix.so nullok likeauth
${optionalString config.security.pam.enableEcryptfs
"auth required ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so unwrap"}
${optionalString (! config.security.pam.enableEcryptfs)
"auth required pam_deny.so"}
account sufficient pam_unix.so
password requisite pam_unix.so nullok sha512
${optionalString config.security.pam.enableEcryptfs
"password optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"}
session required pam_env.so envfile=${config.system.build.pamEnvironment}
session required pam_unix.so
${optionalString config.security.pam.enableEcryptfs
"session optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"}
session required pam_loginuid.so
session optional ${pkgs.systemd}/lib/security/pam_systemd.so
session optional ${pkgs.gnome3.gnome-keyring}/lib/security/pam_gnome_keyring.so auto_start
'';
gdm-password.text = '' gdm-password.text = ''
auth requisite pam_nologin.so auth substack login
auth required pam_env.so envfile=${config.system.build.pamEnvironment} account include login
password substack login
auth required pam_succeed_if.so uid >= 1000 quiet session include login
auth optional ${pkgs.gnome3.gnome-keyring}/lib/security/pam_gnome_keyring.so
auth ${if config.security.pam.enableEcryptfs then "required" else "sufficient"} pam_unix.so nullok likeauth
${optionalString config.security.pam.enableEcryptfs
"auth required ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so unwrap"}
${optionalString (! config.security.pam.enableEcryptfs)
"auth required pam_deny.so"}
account sufficient pam_unix.so
password requisite pam_unix.so nullok sha512
${optionalString config.security.pam.enableEcryptfs
"password optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"}
session required pam_env.so envfile=${config.system.build.pamEnvironment}
session required pam_unix.so
${optionalString config.security.pam.enableEcryptfs
"session optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"}
session required pam_loginuid.so
session optional ${pkgs.systemd}/lib/security/pam_systemd.so
session optional ${pkgs.gnome3.gnome-keyring}/lib/security/pam_gnome_keyring.so auto_start
''; '';
gdm-autologin.text = '' gdm-autologin.text = ''
@ -274,10 +226,7 @@ in
password requisite pam_unix.so nullok sha512 password requisite pam_unix.so nullok sha512
session optional pam_keyinit.so revoke session optional pam_keyinit.so revoke
session required pam_env.so envfile=${config.system.build.pamEnvironment} session include login
session required pam_unix.so
session required pam_loginuid.so
session optional ${pkgs.systemd}/lib/security/pam_systemd.so
''; '';
}; };