Bug 1559600

Summary:	session: pam_ecryptfs needs to happen before pam_systemd
Product:	[Fedora] Fedora	Reporter:	Martin Pitt <mpitt>
Component:	authselect	Assignee:	Pavel Březina <pbrezina>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	rawhide	CC:	jlieskov, pbrezina, tmraz
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	authselect-0.4-1.fc28	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-04-10 22:58:43 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Martin Pitt 2018-03-22 20:48:07 UTC

Description of problem: "pam_ecryptfs.so unwrap" currently happens in /etc/pam.d/postlogin, but this is too late. The effect of pam_systemd.so is to start the  user instance, which looks into ~/.config/systemd/user/ to start user-defined units. But this won't exist until after ecryptfs actually sets up the home directory.


Version-Release number of selected component (if applicable):

authconfig-7.0.1-4.fc27.x86_64
ecryptfs-utils-111-7.fc27.x86_64

How reproducible: Always


Steps to Reproduce:
1. Set up a user with encrypted home dir using ecryptfs-migrate-home(8)
2. Log in as that user and create a systemd --user unit, in ~/.config/systemd/user/, and enable it.
3. Log out, back in

Actual results: The unit did not start.

Expected results: The unit starts.

This can be fixed by moving

   session     optional      pam_ecryptfs.so unwrap

out of /etc/pam.d/postlogin into /etc/pam.d/system-auth-ac right before pam_systemd.so.

Comment 1 Tomas Mraz 2018-03-23 08:01:34 UTC

Authconfig is being replaced with authselect, so it is unlikely this is going to be fixed. I am reassigning to authselect for future fix if it is going to support pam_ecryptfs.

Comment 2 Fedora Update System 2018-04-09 10:51:11 UTC

authselect-0.4-1.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-d5f37ac141

Comment 3 Fedora Update System 2018-04-09 21:56:01 UTC

authselect-0.4-1.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-d5f37ac141

Comment 4 Fedora Update System 2018-04-10 22:58:43 UTC

authselect-0.4-1.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.