Bug 1706029

Summary: "/etc/pam.d/sddm" does not auto start "pam_kwallet"
Product: [Fedora] Fedora Reporter: J. Goutin <redhat.depress835>
Component: sddmAssignee: Martin Bříza <m>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 30CC: jgrulich, kde-sig, me, m, pierluigi.fiorini, rdieter
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: sddm-0.18.1-2.fc30 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-05-13 01:07:50 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Fixed "/etc/pam.d/sddm" none

Description J. Goutin 2019-05-03 12:12:43 UTC
Description of problem:

Kwallet is locked on user login because "pam_kwallet" is not correctly loaded by "/etc/pam.d/sddm".


Version-Release number of selected component (if applicable):

sddm-0.18.0-6.fc30.x86_64


How reproducible:

Each user login.


Steps to Reproduce:

Login into Fedora with KDE plasma


Actual results:

The Kwallet is locked.


Expected results:

The Kwallet should be unlocked.


Additional info:

On my machine, I fixed the problem by editing "/etc/pam.d/sddm" and changing:

-session     optional      pam_kwallet5.so
-session     optional      pam_kwallet.so

To:

-session     optional      pam_kwallet5.so auto_start
-session     optional      pam_kwallet.so auto_start

Comment 1 J. Goutin 2019-05-03 12:17:21 UTC
Created attachment 1562364 [details]
Fixed "/etc/pam.d/sddm"

Comment 2 Rex Dieter 2019-05-03 12:50:06 UTC
Odd, it's worked for me the old way ... forever.  I'll look into it.

Comment 3 Rex Dieter 2019-05-03 12:50:56 UTC
Can you give any indication or evidence why auto_start is needed?

Comment 4 Rex Dieter 2019-05-03 12:57:59 UTC
(Sorry for spam), but this link at least,
https://wiki.gnome.org/Projects/GnomeKeyring/Pam

says auto_start instructs pam to start it "as a daemon", which I presume is a "good thing(tm)", doesn't explain how/why it doesn't work for you without it, however.

Comment 5 J. Goutin 2019-05-03 13:12:01 UTC
In my case, it never worked without "auto_start", and since I added the "auto_start", it work as intended.

I found some references of pam_kwallet on some other Linux distributions documentations or examples:

- https://wiki.archlinux.org/index.php/KDE_Wallet#Unlock_KDE_Wallet_automatically_on_login
- https://wiki.gentoo.org/wiki/KDE#KWallet_auto-unlocking
- https://gist.github.com/benediktg/195f774073e3d85fc22597c094d21bae
- https://www.dennogumi.org/2014/04/unlocking-kwallet-with-pam/

In all case, there is "auto_start".

Comment 6 J. Goutin 2019-05-03 14:30:03 UTC
I searched a little more and find nothing to explain it more, pam_kwallet is not very documented (Only found this that explain how it work internally: https://github.com/KDE/kwallet-pam).

I personally not have more experience with PAM to explain it.

I see you said that it should work without the "auto_start", so I maybe have another issue with my PAM/Kwallet configuration. I'll report if this change fix the problem on the long time or not in my case.

Comment 7 Fedora Update System 2019-05-06 15:17:24 UTC
sddm-0.18.1-2.fc30 has been submitted as an update to Fedora 30. https://bodhi.fedoraproject.org/updates/FEDORA-2019-8e9c61850d

Comment 8 Fedora Update System 2019-05-06 21:04:10 UTC
sddm-0.18.1-2.fc30 has been pushed to the Fedora 30 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-8e9c61850d

Comment 9 Fedora Update System 2019-05-13 01:07:50 UTC
sddm-0.18.1-2.fc30 has been pushed to the Fedora 30 stable repository. If problems still persist, please make note of it in this bug report.