Created attachment 148656 [details] (Apply with -p1; diff against r273647.) Linux-PAM provides this functionality via a setuid helper program, and programs have come to depend on it. In particular, enlightenment desktop's lock screen uses this feature to allow unlocking. You could argue this is a bug in enlightenment, but I'm not sure we'd prefer more ports shipping setuid helpers instead of providing one standard one. I don't see the harm in presenting the additional functionality, and it means more Linux programs work on FreeBSD. I have attempted to keep the setuid helper quite simple and keep the attack surface small. This helper only facilitates authentication, and like pam_unix, does not validate account expiration time.
CC'ing security team for sign-off as this adds a setuid program to base.
Sorry, but no. Use something like kpasswd instead.
Sorry, I meant kcheckpass.
(In reply to Dag-Erling Smørgrav from comment #2) > Sorry, but no. Use something like kpasswd instead. So, this option then? > we'd prefer more ports shipping > setuid helpers instead of providing one standard one. (In reply to Dag-Erling Smørgrav from comment #3) > Sorry, I meant kcheckpass. $ pkg install kcheckpass pkg: No packages available to install matching 'kcheckpass' have been found in the repositories Any idea which of the myriad KDE ports actually provides kcheckpass?
(In reply to Conrad Meyer from comment #4) > Any idea which of the myriad KDE ports actually provides kcheckpass? Ah, it's kde-workspace. $ pkg install kde-workspace ... The process will require 641 MB more space. 223 MB to be downloaded. You think that's a usable solution?
I'm ok with kcheckpass as a solution, but it must be installable without pulling in all of KDE. I think that's doable. I should make a kcheckpass port; change kde4-workspace plist to exclude kcheckpass and have the port require it as a run-time dep; and finally fix enlightenment to use kcheckpass on FreeBSD.
If you feel like writing your own version and are comfortable releasing it under the three-clause BSD license, I may include it in OpenPAM. It won't be available in FreeBSD until 10.2 at the earliest, more likely 11, but we can easily make a port to install it on systems that don't have it in base. BTW, this is vastly more flexible than the Linux-PAM solution, as the latter will only work for users with traditional password hashes available through NSS, not for users who authenticate through Kerberos, RADIUS or some other remote method.
(In reply to Dag-Erling Smørgrav from comment #7) > If you feel like writing your own version and are comfortable releasing it > under the three-clause BSD license, I may include it in OpenPAM. Sure. The helper source file in the attached patch is 2-clause BSD; 3-clause is fine. (The attached patch also has one manual page derived from Linux-PAM, which is 3-clause BSD.) > It won't > be available in FreeBSD until 10.2 at the earliest, more likely 11, but we > can easily make a port to install it on systems that don't have it in base. CURRENT is what I care about, that is fine. > BTW, this My initial patch, kcheckpass, or something else you're proposing? > is vastly more flexible than the Linux-PAM solution, as the latter > will only work for users with traditional password hashes available through > NSS, not for users who authenticate through Kerberos, RADIUS or some other > remote method. If we're talking about the attached patch, it only modifies pam_unix and only checks for passwords available through getpwnam(3). My read of that man page was that it was only for local hashes. And of course, if a pam_unix is disabled in a PAM configuration, it won't be run at all which may be surprising if it is expected to check remote passwords. I'm happy to rework this in another way! Just let me know how you would like it to look and function, or anything I can do to help. Thanks.
I meant "your own version of something similar to kcheckpass". Sorry for the late response. For some reason, I didn't get a copy of your comment by email.
Upstream E desktop has agreed to ship their own suid helper: https://phab.enlightenment.org/D2355 So this may be closed.