Bug 2547472 - PAM file lacks pam_oo7 session and postlogin lines because the hunk header in include-greetd.patch is wrong
Summary: PAM file lacks pam_oo7 session and postlogin lines because the hunk header in...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: cosmic-greeter
Version: 45
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Ryan Brue
QA Contact:
URL:
Whiteboard: AcceptedFreezeException
Depends On:
Blocks: F45FinalFreezeException, FinalFreezeException
TreeView+ depends on / blocked
 
Reported: 2026-10-07 14:40 UTC by mattias.eriksson
Modified: 2026-10-16 23:56 UTC (History)
5 users (show)

Fixed In Version: cosmic-greeter-1.10.0-3.fc45
Clone Of:
Environment:
Last Closed: 2026-10-16 23:56:11 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description mattias.eriksson 2026-10-07 14:40:23 UTC
The installed /usr/lib/pam.d/cosmic-greeter ends after the pam_kwallet.so session line. These last two lines from include-greetd.patch are missing:

-session    optional    pam_oo7.so auto_start
session    include     postlogin

Commit 5bcc89e ("Add support for unlocking oo7 keyrings with login") added two pam_oo7 lines to include-greetd.patch but did not update the hunk header. The hunk has 25 lines and the header still says:

@@ -0,0 +1,23 @@

GNU patch applies only the 23 lines the header announces and drops the rest without any warning. Every build since 2026-09-02 is affected, including 1.9.1 on f45 and rawhide.

As a result, oo7-daemon is never started at login and the stashed password is never handed to it, so the oo7 keyring is not unlocked automatically. On systems upgraded from F44 that still have gnome-keyring-pam installed, the pam_gnome_keyring.so auto_start session line starts gnome-keyring first. It then takes org.freedesktop.secrets, and oo7-daemon.service fails with Zbus(NameTaken). The postlogin session stack is also skipped for every greeter login.

Reproducible: Always

Steps to Reproduce:
$ git clone -b f45 https://src.fedoraproject.org/rpms/cosmic-greeter.git
$ mkdir t && cd t && patch -p1 < ../cosmic-greeter/include-greetd.patch
patching file debian/greetd.pam
$ wc -l debian/greetd.pam
23 debian/greetd.pam
$ grep -c '^+' ../cosmic-greeter/include-greetd.patch   # 25 content lines + the "+++" line 26
$ diff debian/greetd.pam /usr/lib/pam.d/cosmic-greeter && echo identical
identical
Actual Results:
That will show that the file debian/greetd.pam only gets 23 lines, and that it still is identical with what is installed on the system. 
The last two lines in the patch is missing.

Expected Results:
that the file would include all lines in the patch, including the two last lines 
-session    optional    pam_oo7.so auto_start
session    include     postlogin

Additional Information:
The fix is to change the hunk header to @@ -0,0 +1,25 @@. Shipping the PAM file as a separate Source: instead of creating it with a patch would prevent this kind of bug from happening again.

Workaround: copy the file to /etc/pam.d/cosmic-greeter and add the two missing lines.

Comment 1 Fedora Blocker Bugs Application 2026-10-07 15:13:23 UTC
Proposed as a Freeze Exception for 45-final by Fedora user ngompa using the blocker tracking app because:

 This is needed to fix oo7 PAM integration for COSMIC desktop.

Comment 2 Adam Williamson (Fedora) 2026-10-08 18:02:21 UTC
+4 in https://forge.fedoraproject.org/quality/blocker-review/issues/2208 , marking accepted FE. Thanks for the sleuthing, Matthias.

Comment 3 Fedora Update System 2026-10-15 01:28:55 UTC
FEDORA-2026-10f73a77ef (cosmic-applets-1.10.0-2.fc45, cosmic-app-library-1.10.0-2.fc45, and 26 more) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-10f73a77ef

Comment 4 Fedora Update System 2026-10-16 21:29:43 UTC
FEDORA-2026-10f73a77ef has been pushed to the Fedora 45 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-10f73a77ef`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-10f73a77ef

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 5 Fedora Update System 2026-10-16 23:56:11 UTC
FEDORA-2026-10f73a77ef (cosmic-applets-1.10.0-2.fc45, cosmic-app-library-1.10.0-2.fc45, and 26 more) has been pushed to the Fedora 45 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.