Bug 1159056
| Summary: | pam_pkcs11 with card_only breaks session selection | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | adam winberg <adam.winberg> | ||||||||
| Component: | gdm | Assignee: | Ray Strode [halfline] <rstrode> | ||||||||
| Status: | CLOSED ERRATA | QA Contact: | Desktop QE <desktop-qa-list> | ||||||||
| Severity: | medium | Docs Contact: | |||||||||
| Priority: | unspecified | ||||||||||
| Version: | 7.0 | CC: | adam.winberg, kbell, martinsson.patrik, vbenes | ||||||||
| Target Milestone: | rc | ||||||||||
| Target Release: | --- | ||||||||||
| Hardware: | All | ||||||||||
| OS: | Linux | ||||||||||
| Whiteboard: | |||||||||||
| Fixed In Version: | gdm-3.8.4-32.el7 | Doc Type: | Bug Fix | ||||||||
| Doc Text: | Story Points: | --- | |||||||||
| Clone Of: | |||||||||||
| : | 1163474 (view as bug list) | Environment: | |||||||||
| Last Closed: | 2015-03-05 13:28:35 UTC | Type: | Bug | ||||||||
| Regression: | --- | Mount Type: | --- | ||||||||
| Documentation: | --- | CRM: | |||||||||
| Verified Versions: | Category: | --- | |||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||
| Embargoed: | |||||||||||
| Bug Depends On: | 1163474 | ||||||||||
| Bug Blocks: | |||||||||||
| Attachments: |
|
||||||||||
|
Description
adam winberg
2014-10-30 19:12:09 UTC
First thing, do mind trying this? 1) enable card_only again 2) press ctrl-alt-f6 3) when prompted for a username just hit spacebar and then enter (so use " " as a username) 4) type your smartcard pin Does it correctly identify the username then? Second thing, after the misbehavior you've described in this bug report has happened, and you've applied your "no card_only" workaround to then successfully log into the desired selected session, can you then undo the workaround and from that point forward will it: a) remember the selection from when the workaround was in place regardless of what the user picks from session menu b) honor whatever the user picks from the sesison menu c) revert back to gnome-classic ? Do you know which pam_pkcs11 mapper module you're using? Of course! 1. Yes, my username is correctly identified if i logon a VT with " " as username with card_only enabled (neat trick btw, did not know i didnt have to put username there, although it makes sense). 2. If I revert back to card_only I am back to the same behaviour, i get gnome classic always. In the session list 'gnome classic' is pre-selected regardless of what session I choosed before. We use the cn mapper in pam_pkcs11. hey thanks for the fast response, it's very helpful! Do you mind, 1) running mkdir -p /var/log/journal 2) adding Enable=true to the [debug] section of /etc/gdm/custom.conf 3) rebooting and then reproducing 4) running journalctl -b -l > full-journal.log and attaching full-journal.log? That will enable debug information that should give us a clearer picture of what's going on. Also, do you mind running tail /var/lib/AccountsService/users/* > saved-user-config.txt and attaching saved-user-config.txt? That will show what sessions were saved in the accountsservice for each user. Created attachment 952614 [details]
full-journal.log
journal output from boot with gdm debug enabled
Created attachment 952615 [details]
saved-user-config
AccountsService user information
Created attachment 956853 [details]
propagate user's session in accounts service to shell in the case we don't know the username up front
So I debugged this a little bit a few days ago with your colleague, Patrik Martinsson.
There are two fixes needed. One on the gdm side is a change to handle when is to make sure we report the users session as soon as we find it in the case we don't know the username up front (such as is the case with smartcards)
The second fix is a change to gnome-shell to make sure we don't inform GDM about session-changes in the gear menu that were made at the request of GDM (which is creating an oscillation between the two processes after the above patch is applied) I'll clone this bug against gnome-shell. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-0551.html I encountered this behavior using a current CentOS 7 workstation: cat /etc/redhat-release CentOS Linux release 7.5.1804 (Core) # uname -r 3.10.0-862.9.1.el7.x86_64 # rpm -q gdm gdm-3.26.2.1-5.el7.x86_64 Has the fix described in this bug report been reverted perhaps? |