`e5bd2c0`

Refactor PAM authentication to use pam crate

Switch from pam-client to pam crate for simpler API. Use
PasswordConv for non-interactive authentication and add
debug logging throughout the auth flow.

Simplify PAM config to use pam_unix.so directly instead of
Fedora-specific includes and SELinux modules.

Authored by mfwolffe <wolffemf@dukes.jmu.edu> 3 months ago

SHA: e5bd2c0b6f09b28d677c391e566d8668295cc72d
Parents: 1144a95
Tree: 0e9322b

3 changed files

Status	File	+	-
M	`etc/pam.d/gardm`	12	18
M	`gardmd/Cargo.toml`	1	1
M	`gardmd/src/auth.rs`	22	13

etc/pam.d/gardmmodified

  #%PAM-1.0
 -# PAM configuration for gardm display manager
 -# Based on SDDM's Fedora configuration
 +# gardm display manager PAM configuration
 -# SELinux permit (Fedora-specific)
 -auth     [success=done ignore=ignore default=bad] pam_selinux_permit.so
 -auth        substack      password-auth
 --auth       optional      pam_gnome_keyring.so
 -auth        include       postlogin
 +# Authentication
 +auth        required      pam_unix.so
 -account     required      pam_nologin.so
 -account     include       password-auth
 +# Account management
 +account     required      pam_unix.so
 -password    include       password-auth
 +# Password management
 +password    required      pam_unix.so
 -session     required      pam_selinux.so close
 -session     required      pam_loginuid.so
 -session     required      pam_selinux.so open
 -session     optional      pam_keyinit.so force revoke
 -session     required      pam_namespace.so
 -session     include       password-auth
 --session    optional      pam_gnome_keyring.so auto_start
 -session     include       postlogin
 +# Session management - pam_systemd creates /run/user/<uid>/ and registers session
 +# Note: pam_loginuid is intentionally omitted - it can only be set once per process
 +# and gardmd runs as a persistent daemon
 +-session    optional      pam_systemd.so
 +session     required      pam_unix.so

gardmd/Cargo.tomlmodified

  serde_json = { workspace = true }
  toml = { workspace = true }
  nix = { workspace = true }
 -pam-client = { workspace = true }
 +pam = "0.8"
  x11rb = { workspace = true }
  clap = { workspace = true }
  libc = "0.2"

gardmd/src/auth.rsmodified

  //! Implements a state machine for PAM-based authentication with
  //! proper conversation handling for the greeter.
 -use anyhow::{Context, Result};
 -use pam_client::{Context as PamContext, Flag};
 +use anyhow::{anyhow, Result};
 +use pam::Client;
  /// Service name for PAM configuration
  const PAM_SERVICE: &str = "gardm";
  /// Perform PAM authentication (blocking)
  fn pam_authenticate(username: &str, password: &str) -> Result<()> {
 -    use pam_client::conv_mock::Conversation;
 +    tracing::debug!(%username, password_len = password.len(), "Starting PAM authentication");
 -    // Create conversation handler that provides the password
 -    let conv = Conversation::with_credentials(username, password);
 +    // Create client with PasswordConv (non-interactive, uses provided password)
 +    let mut client = Client::with_password(PAM_SERVICE)
 +        .map_err(|e| anyhow!("Failed to create PAM client: {:?}", e))?;
 -    // Create PAM context
 -    let mut ctx = PamContext::new(PAM_SERVICE, Some(username), conv)
 -        .context("Failed to create PAM context")?;
 +    // Set the credentials
 +    client
 +        .conversation_mut()
 +        .set_credentials(username, password);
++
 +    tracing::debug!("PAM client created, calling authenticate");
      // Authenticate
 -    ctx.authenticate(Flag::NONE)
 -        .context("PAM authentication failed")?;
 +    client
 +        .authenticate()
 +        .map_err(|e| anyhow!("PAM authentication failed: {:?}", e))?;
++
 +    tracing::debug!("PAM authenticate succeeded, opening session");
 -    // Validate account (check expiry, etc.)
 -    ctx.acct_mgmt(Flag::NONE)
 -        .context("Account validation failed")?;
 +    // Open session (also does account validation)
 +    client
 +        .open_session()
 +        .map_err(|e| anyhow!("Failed to open PAM session: {:?}", e))?;
 +    tracing::debug!("PAM session opened successfully");
      Ok(())
+ }