`e5bd2c0`

Refactor PAM authentication to use pam crate

Switch from pam-client to pam crate for simpler API. Use
PasswordConv for non-interactive authentication and add
debug logging throughout the auth flow.

Simplify PAM config to use pam_unix.so directly instead of
Fedora-specific includes and SELinux modules.

Authored by mfwolffe <wolffemf@dukes.jmu.edu> 3 months ago

SHA: e5bd2c0b6f09b28d677c391e566d8668295cc72d
Parents: 1144a95
Tree: 0e9322b

3 changed files

Status	File	+	-
M	`etc/pam.d/gardm`	12	18
M	`gardmd/Cargo.toml`	1	1
M	`gardmd/src/auth.rs`	22	13

etc/pam.d/gardmmodified

  #%PAM-1.0
--# PAM configuration for gardm display manager
++# gardm display manager PAM configuration
--# Based on SDDM's Fedora configuration
--# SELinux permit (Fedora-specific)
++# Authentication
--auth     [success=done ignore=ignore default=bad] pam_selinux_permit.so
++auth        required      pam_unix.so
--auth        substack      password-auth
---auth       optional      pam_gnome_keyring.so
--auth        include       postlogin
--account     required      pam_nologin.so
++# Account management
--account     include       password-auth
++account     required      pam_unix.so
--password    include       password-auth
++# Password management
++password    required      pam_unix.so
--session     required      pam_selinux.so close
++# Session management - pam_systemd creates /run/user/<uid>/ and registers session
--session     required      pam_loginuid.so
++# Note: pam_loginuid is intentionally omitted - it can only be set once per process
--session     required      pam_selinux.so open
++# and gardmd runs as a persistent daemon
--session     optional      pam_keyinit.so force revoke
++-session    optional      pam_systemd.so
--session     required      pam_namespace.so
++session     required      pam_unix.so
--session     include       password-auth
---session    optional      pam_gnome_keyring.so auto_start
--session     include       postlogin

gardmd/Cargo.tomlmodified


 serde_json = { workspace = true }
 toml = { workspace = true }
 nix = { workspace = true }
+pam = "0.8"
 x11rb = { workspace = true }
 clap = { workspace = true }
 libc = "0.2"

gardmd/src/auth.rsmodified

  //! Implements a state machine for PAM-based authentication with
  //! proper conversation handling for the greeter.
--use anyhow::{Context, Result};
++use anyhow::{anyhow, Result};
--use pam_client::{Context as PamContext, Flag};
++use pam::Client;
  /// Service name for PAM configuration
  const PAM_SERVICE: &str = "gardm";
  /// Perform PAM authentication (blocking)
  fn pam_authenticate(username: &str, password: &str) -> Result<()> {
--    use pam_client::conv_mock::Conversation;
++    tracing::debug!(%username, password_len = password.len(), "Starting PAM authentication");
--    // Create conversation handler that provides the password
++    // Create client with PasswordConv (non-interactive, uses provided password)
--    let conv = Conversation::with_credentials(username, password);
++    let mut client = Client::with_password(PAM_SERVICE)
++        .map_err(|e| anyhow!("Failed to create PAM client: {:?}", e))?;
--    // Create PAM context
++    // Set the credentials
--    let mut ctx = PamContext::new(PAM_SERVICE, Some(username), conv)
++    client
--        .context("Failed to create PAM context")?;
++        .conversation_mut()
++        .set_credentials(username, password);
++
++    tracing::debug!("PAM client created, calling authenticate");
      // Authenticate
--    ctx.authenticate(Flag::NONE)
++    client
--        .context("PAM authentication failed")?;
++        .authenticate()
++        .map_err(|e| anyhow!("PAM authentication failed: {:?}", e))?;
++
++    tracing::debug!("PAM authenticate succeeded, opening session");
--    // Validate account (check expiry, etc.)
++    // Open session (also does account validation)
--    ctx.acct_mgmt(Flag::NONE)
++    client
--        .context("Account validation failed")?;
++        .open_session()
++        .map_err(|e| anyhow!("Failed to open PAM session: {:?}", e))?;
++    tracing::debug!("PAM session opened successfully");
      Ok(())
+ }

`@@ -20,7 +20,7 @@` serde = { workspace = true }
20	serde_json = { workspace = true }	20	serde_json = { workspace = true }
21	toml = { workspace = true }	21	toml = { workspace = true }
22	nix = { workspace = true }	22	nix = { workspace = true }
23	-pam-client = { workspace = true }	23	+pam = "0.8"
24	x11rb = { workspace = true }	24	x11rb = { workspace = true }
25	clap = { workspace = true }	25	clap = { workspace = true }
26	libc = "0.2"	26	libc = "0.2"