Pam issue

[Visone-Selektah]

Hi!
I'm trying to use lidm but I got a pam error. Try to use this specific pam file to lidm without luck.

auth       include      system-auth
account    include      system-auth
password   include      system-auth
session    include      system-auth

System-auth is my pam file

# Begin /etc/pam.d/system-auth
account   required   pam_unix.so
auth      required   pam_unix.so  nullok
auth      optional   pam_permit.so
session   required   pam_limits.so
session   required   pam_unix.so
password  required   pam_unix.so  yescrypt shadow try_first_pass

Any ideas??

[javalsai]

If the error was literally "error on pam authentication", it had to be a failure getting the pam handle, basically:

#define CHECK_PAM_RET(call) \
  ret = (call);             \
  if (ret != PAM_SUCCESS) { \
    pam_end(pamh, ret);     \
    return NULL;            \
  }

pam_handle_t* get_pamh(char* user, char* passwd) {
  pam_handle_t* pamh = NULL;
  struct pam_conv pamc = {pam_conversation, (void*)passwd};
  int ret;

  CHECK_PAM_RET(pam_start("login", user, &pamc, &pamh))
  CHECK_PAM_RET(pam_authenticate(pamh, 0))
  CHECK_PAM_RET(pam_acct_mgmt(pamh, 0))
  CHECK_PAM_RET(pam_setcred(pamh, PAM_ESTABLISH_CRED))
  CHECK_PAM_RET(pam_open_session(pamh, 0))
  CHECK_PAM_RET(pam_setcred(pamh, PAM_REINITIALIZE_CRED))

  return pamh;
}

And I'ma need to dig up a lot of dark pam docs to fully understand whats happening. Not even sure on how to ask you on how to get more information about the bug. I can only ask if after it fails there's anything relevant in your system logs.

Will investigate this as soon as I finish adding the nix module (#57).

[Visone-Selektah]

This is a screenshot of the error
Nothing on the logs.
The pam file I created is located in /etc/pam.d/libdm
Thanks!!!

[javalsai]

This is a screenshot of the error Nothing on the logs. The pam file I created is located in /etc/pam.d/libdm Thanks!!!

What distro are you on and do you have a login pam file?

I didn't really went out of the way making a PAM module and made lidm just use the login one which in my distro is under /etc/pam.d/login. This issue is probably a good moment to properly make lidm's own pam module.

[Visone-Selektah]

Hi!
I using venomlinux. I'm one of the devs.
In venom we don't have a login pam file, we use the system-auth I mentioned and another pam file named other.
Having it's own pam module it's a way to make it portable for any distro, no matter what pam config they have.
I'm gonna try to make a login pam file just like arch... let's see if it works with it..

[Visone-Selektah]

Creating a login pam file I got this error

initgroups(1): Operation not permitted

[javalsai]

initgroups(1): Operation not permitted

That should just be fixed by running as root, now that I think about it there should be a way to use PAM to do this, but it's no longer a PAM issue.

I'm gonna try to make a login pam file just like arch.

That would be a huge help 🙏, glad to have a distro dev opinion on this. Don't worry about the install of the PAM file, I can take care of integrating it into the Makefile install scripts and other packages.

[Visone-Selektah]

If a name login my own lidm.pam file and launch lidm as root, it works like a charm.

#%PAM-1.0

auth       include      system-auth
account    include      system-auth
password   include      system-auth
session    include      system-auth

I'm gonna make a sysvinit service file and make some test. Then I'll see If I can change the pam file searched from the login to a lidm one ...

[javalsai]

Then I'll see If I can change the pam file searched from the login to a lidm one ...

Thats hardcoded, but only need to change src/auth.c:54, will pobably make it a preprocessor define too, so it can be passed as a build flag.

I'm gonna make a sysvinit service file and make some test

Theres runit, s6, openrc, dinit and systemd files in assets/services/ for reference if you want.

it works like a charm

Nice! I can include this myself or you can make a PR with these improvements, whatever you prefer.

[Visone-Selektah]

Hi!
Let me do some test on the service file and I'll send you a PR with the changes.
Thanks!!!

[SpamixOfficial]

@Visone-Selektah do you think #62 could work for your usecase?

EDIT: The LIDM package for your distribution could distribute the needed services file with an additional ENV variable flag then without the need to recompile every time something changes in your PAM setup

(eg. for SystemD: https://serverfault.com/a/413408)

@javalsai EDIT: #62 ended up providing a preprocesor define for this that doesn't rely on env.

[Visone-Selektah]

@Visone-Selektah do you think #62 could work for your usecase?

Sure It does!!!!
Thanks!!!!

Sorry for the delay.... my other work keeps me very busy ....

For the little tests I did for sysv and runit, I can log in but the session doesn't load, even on shell, doesn't load the user shell config.
I don't know what could be the problem .... yet ....

[grialion]

For the little tests I did for sysv and runit, I can log in but the session doesn't load, even on shell, doesn't load the user shell config.

Works for me on Void Linux, with runit. You could look into the service assets for complete service files. But I guess, if you can log already in, it's not really relevant.

I don't know what could be the problem .... yet ....

Does it work if you manually start if from a TTY as root? Or strace the syscalls for further clues?