'Review Request 125641: Allow PAM unlocking of a running wallet'

[prev in list] [next in list] [prev in thread] [next in thread] 

List:       kde-frameworks-devel
Subject:    Review Request 125641: Allow PAM unlocking of a running wallet
From:       "Martin Klapetek" <martin.klapetek () gmail ! com>
Date:       2015-10-14 20:17:31
Message-ID: 20151014201731.1403.18656 () mimi ! kde ! org
[Download RAW message or body]

--===============2224399013391837514==
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit

-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://git.reviewboard.kde.org/r/125641/
-----------------------------------------------------------

Review request for KDE Frameworks.

Repository: kwallet

Description
-------

A use-case: kwallet gets locked with lockscreen, eg. on Plasma Mobile, unlocking the \
screen would also unlock kwallet through PAM.

Another use-case: automatic login that shows lockscreen after booting, unlocking that \
session would also unlock kwallet through PAM.

This requires a small change in kwallet-pam.

Now to the patch itself. When a user authenticates via lockscreen, PAM can start the \
kwalletd process and pass the auth hash token to it. In case the kwalletd process is \
already running, this patch would check if the wallet is opened and if not, it would \
pass the PAM hash token over dbus to the running kwallet instance which would unlock \
the running wallet. If it is unlocked, nothing would happen.

I originally didn't want to pass it over dbus, but in the end it doesn't matter \
because as soon as the session is unlocked (at this point the hash is sent), the \
wallet would be unlocked and a possible attacker would have access to its data \
anyway. But I'm open to suggestions on improvements.

Diffs
-----

  src/runtime/kwalletd/main.cpp fbab58d 

Diff: https://git.reviewboard.kde.org/r/125641/diff/

Testing
-------

I've created a special PAM profile which has

auth   optional        pam_kwallet5.so lockscreen kwalletd=/opt/kde5/bin/kwalletd5

ran kcheckpass -c myprofile and kwallet5 got started and unlocked. Then I locked the \
wallet using kwalletmanager5, ran kcheckpass -c myprofile again and the running \
kwallet5 instance got unlocked.

Thanks,

Martin Klapetek

--===============2224399013391837514==
MIME-Version: 1.0
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: 7bit

<html>
 <body>
  <div style="font-family: Verdana, Arial, Helvetica, Sans-Serif;">
   <table bgcolor="#f9f3c9" width="100%" cellpadding="12" style="border: 1px #c9c399 \
solid; border-radius: 6px; -moz-border-radius: 6px; -webkit-border-radius: 6px;">  \
<tr>  <td>
      This is an automatically generated e-mail. To reply, visit:
      <a href="https://git.reviewboard.kde.org/r/125641/">https://git.reviewboard.kde.org/r/125641/</a>
  </td>
    </tr>
   </table>
   <br />

<table bgcolor="#fefadf" width="100%" cellspacing="0" cellpadding="12" style="border: \
1px #888a85 solid; border-radius: 6px; -moz-border-radius: 6px; \
-webkit-border-radius: 6px;">  <tr>
  <td>

<div>Review request for KDE Frameworks.</div>
<div>By Martin Klapetek.</div>

<div style="margin-top: 1.5em;">
 <b style="color: #575012; font-size: 10pt;">Repository: </b>
kwallet
</div>

<h1 style="color: #575012; font-size: 10pt; margin-top: 1.5em;">Description </h1>
 <table width="100%" bgcolor="#ffffff" cellspacing="0" cellpadding="10" \
style="border: 1px solid #b8b5a0">  <tr>
  <td>
   <pre style="margin: 0; padding: 0; white-space: pre-wrap; white-space: \
-moz-pre-wrap; white-space: -pre-wrap; white-space: -o-pre-wrap; word-wrap: \
break-word;"><p style="padding: 0;text-rendering: inherit;margin: 0;line-height: \
inherit;white-space: inherit;">A use-case: kwallet gets locked with lockscreen, eg. \
on Plasma Mobile, unlocking the screen would also unlock kwallet through PAM.</p> <p \
style="padding: 0;text-rendering: inherit;margin: 0;line-height: inherit;white-space: \
inherit;">Another use-case: automatic login that shows lockscreen after booting, \
unlocking that session would also unlock kwallet through PAM.</p> <p style="padding: \
0;text-rendering: inherit;margin: 0;line-height: inherit;white-space: inherit;">This \
requires a small change in kwallet-pam.</p> <p style="padding: 0;text-rendering: \
inherit;margin: 0;line-height: inherit;white-space: inherit;">Now to the patch \
itself. When a user authenticates via lockscreen, PAM can start the kwalletd process \
and pass the auth hash token to it. In case the kwalletd process is already running, \
this patch would check if the wallet is opened and if not, it would pass the PAM hash \
token over dbus to the running kwallet instance which would unlock the running \
wallet. If it is unlocked, nothing would happen.</p> <p style="padding: \
0;text-rendering: inherit;margin: 0;line-height: inherit;white-space: inherit;">I \
originally didn't want to pass it over dbus, but in the end it doesn't matter because \
as soon as the session is unlocked (at this point the hash is sent), the wallet would \
be unlocked and a possible attacker would have access to its data anyway. But I'm \
open to suggestions on improvements.</p></pre>  </td>
 </tr>
</table>

<h1 style="color: #575012; font-size: 10pt; margin-top: 1.5em;">Testing </h1>
<table width="100%" bgcolor="#ffffff" cellspacing="0" cellpadding="10" style="border: \
1px solid #b8b5a0">  <tr>
  <td>
   <pre style="margin: 0; padding: 0; white-space: pre-wrap; white-space: \
-moz-pre-wrap; white-space: -pre-wrap; white-space: -o-pre-wrap; word-wrap: \
break-word;"><p style="padding: 0;text-rendering: inherit;margin: 0;line-height: \
inherit;white-space: inherit;">I've created a special PAM profile which has</p> <p \
style="padding: 0;text-rendering: inherit;margin: 0;line-height: inherit;white-space: \
inherit;">auth   optional        pam_kwallet5.so lockscreen \
kwalletd=/opt/kde5/bin/kwalletd5</p> <p style="padding: 0;text-rendering: \
inherit;margin: 0;line-height: inherit;white-space: inherit;">ran kcheckpass -c \
myprofile and kwallet5 got started and unlocked. Then I locked the wallet using \
kwalletmanager5, ran kcheckpass -c myprofile again and the running kwallet5 instance \
got unlocked.</p></pre>  </td>
 </tr>
</table>

<h1 style="color: #575012; font-size: 10pt; margin-top: 1.5em;">Diffs</b> </h1>
<ul style="margin-left: 3em; padding-left: 0;">

 <li>src/runtime/kwalletd/main.cpp <span style="color: grey">(fbab58d)</span></li>

</ul>

<p><a href="https://git.reviewboard.kde.org/r/125641/diff/" style="margin-left: \
3em;">View Diff</a></p>

  </td>
 </tr>
</table>

  </div>
 </body>
</html>

--===============2224399013391837514==--

[Attachment #3 (text/plain)]

_______________________________________________
Kde-frameworks-devel mailing list
Kde-frameworks-devel@kde.org
https://mail.kde.org/mailman/listinfo/kde-frameworks-devel

[prev in list] [next in list] [prev in thread] [next in thread] 