Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 342345 - sys-auth/pambase[consolekit]: remove nox11 param from pam_ck_connector line (or create separate console and graphical logins)
Summary: sys-auth/pambase[consolekit]: remove nox11 param from pam_ck_connector line (...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: PAM Gentoo Team (OBSOLETE)
URL:
Whiteboard:
Keywords:
: 346037 346635 348668 349317 381727 386819 (view as bug list)
Depends on:
Blocks:
 
Reported: 2010-10-23 16:18 UTC by Samuli Suominen
Modified: 2011-10-22 01:12 UTC (History)
15 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Samuli Suominen gentoo-dev 2010-10-23 16:18:56 UTC
It seems "session optional pam_loginuid.so" is required before "pam_ck_connector.so" line in pam.d for ConsoleKit to work properly since >= version 0.4.2-r3

Ref.

http://bugs.gentoo.org/show_bug.cgi?id=342291#c9
http://bugs.gentoo.org/show_bug.cgi?id=342291#c10
http://bugs.gentoo.org/show_bug.cgi?id=342291#c13
http://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg828464.html
Comment 1 Diego Elio Pettenò (RETIRED) gentoo-dev 2010-10-23 22:37:34 UTC
Okay I can fix it on login(1), sshd, and the like, but not for gdm. Because for whatever reason, gdm does not use the system-login session but rather the system-auth session, most likely to skip over mail and the other console login…

I guess that will require more work, and most likely the new pambase framework I've been meaning to work on. Samuli, do you want me wait before fixing this?
Comment 2 Diego Elio Pettenò (RETIRED) gentoo-dev 2010-10-23 23:36:52 UTC
Okay, *partially* fixed: pambase is updated.

What we do need now is some more complex and powerful pambase with stuff like

session include .gentoo-console-login
session include .gentoo-graphical-login

to split the stuff that is used by gdm and login(1) if the ck_connector cannot run within gdm.
Comment 3 Alex Buell 2010-10-29 10:24:39 UTC
I had to downgrade to shadow-4.1.4.2-r5 to revert to older broken behaviour as upgrading to shadow-4.1.4.2-r5, pambase-20101024 and consolekit-0.4.2-r4 still broke a lot of things in gnome. You're right, more work is needed. 
Comment 4 Samuli Suominen gentoo-dev 2010-10-29 10:46:14 UTC
(In reply to comment #3)
> I had to downgrade to shadow-4.1.4.2-r5 to revert to older broken behaviour as
> upgrading to shadow-4.1.4.2-r5, pambase-20101024 and consolekit-0.4.2-r4 still
> broke a lot of things in gnome. You're right, more work is needed. 
> 

Open new bug if you have problems. Those 3 work fine with both startx and gdm for gnome. No need to spam this bug with basically "It doesn't work for me." -messages.
Comment 5 Samuli Suominen gentoo-dev 2010-12-18 22:33:21 UTC
*** Bug 346635 has been marked as a duplicate of this bug. ***
Comment 6 Samuli Suominen gentoo-dev 2010-12-18 22:36:24 UTC
*** Bug 348668 has been marked as a duplicate of this bug. ***
Comment 7 Samuli Suominen gentoo-dev 2010-12-18 22:41:30 UTC
*** Bug 345585 has been marked as a duplicate of this bug. ***
Comment 8 Den_M 2010-12-23 09:19:08 UTC
*** Bug 349317 has been marked as a duplicate of this bug. ***
Comment 9 Samuli Suominen gentoo-dev 2011-10-11 23:17:02 UTC
*** Bug 386819 has been marked as a duplicate of this bug. ***
Comment 10 Samuli Suominen gentoo-dev 2011-10-12 14:15:48 UTC
as per bug 386819 we can now ignore creating the separate text and graphical logins and just get rid of the nox11 param, for which this bug has been open for?
Comment 11 Ian Stakenvicius (RETIRED) gentoo-dev 2011-10-12 14:20:45 UTC
(In reply to comment #9)
> *** Bug 386819 has been marked as a duplicate of this bug. ***

Along the lines of this particular bug, here's some details:

SLiM (and XDM) use /bin/bash -login to authenticate a user; this authentication needs to act identical (in a consolekit sort of way) to a console login, that is, a ck-session needs to be started.  Then, when the Xsession script runs and ck-launch-session is called within it, a second session for X will be created for the user and this will have all the appropriate variables set (active, is_local, x11-*).

However, since the actual login prompt is launched from within X, the 'nox11' option causes pam-ck-connector.so to not launch the initial "console" login, and then the second one ends up being invalid (active=FALSE, is_local=FALSE, x11-* is not set properly).

As such, the 'nox11' option needs to be removed from /etc/pam.d/system-login.

I do realize that gdm would complain without this, IF it were using system-login, but since it isn't (and just uses system-auth and a few others) this is a non-issue.  I can confirm this as i've switched back and forth between gdm and slim without issue when /etc/pam.d/system-login doesn't have 'nox11'.
Comment 12 Samuli Suominen gentoo-dev 2011-10-13 21:36:22 UTC
*** Bug 381727 has been marked as a duplicate of this bug. ***
Comment 13 Samuli Suominen gentoo-dev 2011-10-13 21:40:58 UTC
*** Bug 346037 has been marked as a duplicate of this bug. ***
Comment 14 Samuli Suominen gentoo-dev 2011-10-22 01:12:20 UTC
+*pambase-20101024-r1 (22 Oct 2011)
+
+  22 Oct 2011; Samuli Suominen <ssuominen@gentoo.org>
+  +pambase-20101024-r1.ebuild:
+  Remove nox11 argument from pam_ck_connector.so wrt #342345