[prev in list] [next in list] [prev in thread] [next in thread] 

List:       kde-frameworks-devel
Subject:    Re: Review Request 125641: Allow PAM unlocking of a running wallet
From:       Martin Klapetek <martin.klapetek () gmail ! com>
Date:       2017-02-26 5:37:04
Message-ID: 20170226053704.3284.56699 () mimi ! kde ! org
[Download RAW message or body]

--===============5018532194242668119==
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit



> On Feb. 25, 2017, 11:55 p.m., Albert Astals Cid wrote:
> > Martin, Valentin, should I commit this?

I honestly don't know what the state of this and/or the component(s) that \
needed it is. It was mainly meant for Plasma Mobile, no idea about that \
project either.

I guess it should still work, so perhaps it's ok to commit.


- Martin


-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://git.reviewboard.kde.org/r/125641/#review102608
-----------------------------------------------------------


On Oct. 16, 2015, 6:52 p.m., Martin Klapetek wrote:
> 
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://git.reviewboard.kde.org/r/125641/
> -----------------------------------------------------------
> 
> (Updated Oct. 16, 2015, 6:52 p.m.)
> 
> 
> Review request for KDE Frameworks and Valentin Rusu.
> 
> 
> Repository: kwallet
> 
> 
> Description
> -------
> 
> A use-case: kwallet gets locked with lockscreen, eg. on Plasma Mobile, \
> unlocking the screen would also unlock kwallet through PAM. 
> Another use-case: automatic login that shows lockscreen after booting, \
> unlocking that session would also unlock kwallet through PAM. 
> This requires a small change in kwallet-pam.
> 
> Now to the patch itself. When a user authenticates via lockscreen, PAM \
> can start the kwalletd process and pass the auth hash token to it. In \
> case the kwalletd process is already running, this patch would check if \
> the wallet is opened and if not, it would pass the PAM hash token over \
> dbus to the running kwallet instance which would unlock the running \
> wallet. If it is unlocked, nothing would happen. 
> I originally didn't want to pass it over dbus, but in the end it doesn't \
> matter because as soon as the session is unlocked (at this point the hash \
> is sent), the wallet would be unlocked and a possible attacker would have \
> access to its data anyway. But I'm open to suggestions on improvements. 
> 
> Diffs
> -----
> 
> src/runtime/kwalletd/main.cpp fbab58d 
> 
> Diff: https://git.reviewboard.kde.org/r/125641/diff/
> 
> 
> Testing
> -------
> 
> I've created a special PAM profile which has
> 
> auth   optional        pam_kwallet5.so lockscreen \
> kwalletd=/opt/kde5/bin/kwalletd5 
> ran kcheckpass -c myprofile and kwallet5 got started and unlocked. Then I \
> locked the wallet using kwalletmanager5, ran kcheckpass -c myprofile \
> again and the running kwallet5 instance got unlocked. 
> 
> Thanks,
> 
> Martin Klapetek
> 
> 


--===============5018532194242668119==
MIME-Version: 1.0
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: 7bit




<html>
 <body>
  <div style="font-family: Verdana, Arial, Helvetica, Sans-Serif;">
   <table bgcolor="#f9f3c9" width="100%" cellpadding="12" style="border: \
1px #c9c399 solid; border-radius: 6px; -moz-border-radius: 6px; \
-webkit-border-radius: 6px;">  <tr>
     <td>
      This is an automatically generated e-mail. To reply, visit:
      <a href="https://git.reviewboard.kde.org/r/125641/">https://git.reviewboard.kde.org/r/125641/</a>
  </td>
    </tr>
   </table>
   <br />





<blockquote style="margin-left: 1em; border-left: 2px solid #d0d0d0; \
padding-left: 10px;">  <p style="margin-top: 0;">On February 25th, 2017, \
11:55 p.m. CET, <b>Albert Astals Cid</b> wrote:</p>  <blockquote \
style="margin-left: 1em; border-left: 2px solid #d0d0d0; padding-left: \
10px;">  <pre style="white-space: pre-wrap; white-space: -moz-pre-wrap; \
white-space: -pre-wrap; white-space: -o-pre-wrap; word-wrap: \
break-word;"><p style="padding: 0;text-rendering: inherit;margin: \
0;line-height: inherit;white-space: inherit;">Martin, Valentin, should I \
commit this?</p></pre>  </blockquote>







</blockquote>

<pre style="white-space: pre-wrap; white-space: -moz-pre-wrap; white-space: \
-pre-wrap; white-space: -o-pre-wrap; word-wrap: break-word;"><p \
style="padding: 0;text-rendering: inherit;margin: 0;line-height: \
inherit;white-space: inherit;">I honestly don't know what the state of this \
and/or the component(s) that needed it is. It was mainly meant for Plasma \
Mobile, no idea about that project either.</p> <p style="padding: \
0;text-rendering: inherit;margin: 0;line-height: inherit;white-space: \
inherit;">I guess it should still work, so perhaps it's ok to \
commit.</p></pre> <br />










<p>- Martin</p>


<br />
<p>On October 16th, 2015, 6:52 p.m. CEST, Martin Klapetek wrote:</p>








<table bgcolor="#fefadf" width="100%" cellspacing="0" cellpadding="12" \
style="border: 1px #888a85 solid; border-radius: 6px; -moz-border-radius: \
6px; -webkit-border-radius: 6px;">  <tr>
  <td>

<div>Review request for KDE Frameworks and Valentin Rusu.</div>
<div>By Martin Klapetek.</div>


<p style="color: grey;"><i>Updated Oct. 16, 2015, 6:52 p.m.</i></p>









<div style="margin-top: 1.5em;">
 <b style="color: #575012; font-size: 10pt;">Repository: </b>
kwallet
</div>


<h1 style="color: #575012; font-size: 10pt; margin-top: 1.5em;">Description \
</h1>  <table width="100%" bgcolor="#ffffff" cellspacing="0" \
cellpadding="10" style="border: 1px solid #b8b5a0">  <tr>
  <td>
   <pre style="margin: 0; padding: 0; white-space: pre-wrap; white-space: \
-moz-pre-wrap; white-space: -pre-wrap; white-space: -o-pre-wrap; word-wrap: \
break-word;"><p style="padding: 0;text-rendering: inherit;margin: \
0;line-height: inherit;white-space: inherit;">A use-case: kwallet gets \
locked with lockscreen, eg. on Plasma Mobile, unlocking the screen would \
also unlock kwallet through PAM.</p> <p style="padding: 0;text-rendering: \
inherit;margin: 0;line-height: inherit;white-space: inherit;">Another \
use-case: automatic login that shows lockscreen after booting, unlocking \
that session would also unlock kwallet through PAM.</p> <p style="padding: \
0;text-rendering: inherit;margin: 0;line-height: inherit;white-space: \
inherit;">This requires a small change in kwallet-pam.</p> <p \
style="padding: 0;text-rendering: inherit;margin: 0;line-height: \
inherit;white-space: inherit;">Now to the patch itself. When a user \
authenticates via lockscreen, PAM can start the kwalletd process and pass \
the auth hash token to it. In case the kwalletd process is already running, \
this patch would check if the wallet is opened and if not, it would pass \
the PAM hash token over dbus to the running kwallet instance which would \
unlock the running wallet. If it is unlocked, nothing would happen.</p> <p \
style="padding: 0;text-rendering: inherit;margin: 0;line-height: \
inherit;white-space: inherit;">I originally didn't want to pass it over \
dbus, but in the end it doesn't matter because as soon as the session is \
unlocked (at this point the hash is sent), the wallet would be unlocked and \
a possible attacker would have access to its data anyway. But I'm open to \
suggestions on improvements.</p></pre>  </td>
 </tr>
</table>


<h1 style="color: #575012; font-size: 10pt; margin-top: 1.5em;">Testing \
</h1> <table width="100%" bgcolor="#ffffff" cellspacing="0" \
cellpadding="10" style="border: 1px solid #b8b5a0">  <tr>
  <td>
   <pre style="margin: 0; padding: 0; white-space: pre-wrap; white-space: \
-moz-pre-wrap; white-space: -pre-wrap; white-space: -o-pre-wrap; word-wrap: \
break-word;"><p style="padding: 0;text-rendering: inherit;margin: \
0;line-height: inherit;white-space: inherit;">I've created a special PAM \
profile which has</p> <p style="padding: 0;text-rendering: inherit;margin: \
0;line-height: inherit;white-space: inherit;">auth   optional        \
pam_kwallet5.so lockscreen kwalletd=/opt/kde5/bin/kwalletd5</p> <p \
style="padding: 0;text-rendering: inherit;margin: 0;line-height: \
inherit;white-space: inherit;">ran kcheckpass -c myprofile and kwallet5 got \
started and unlocked. Then I locked the wallet using kwalletmanager5, ran \
kcheckpass -c myprofile again and the running kwallet5 instance got \
unlocked.</p></pre>  </td>
 </tr>
</table>


<h1 style="color: #575012; font-size: 10pt; margin-top: 1.5em;">Diffs</b> \
</h1> <ul style="margin-left: 3em; padding-left: 0;">

 <li>src/runtime/kwalletd/main.cpp <span style="color: \
grey">(fbab58d)</span></li>

</ul>

<p><a href="https://git.reviewboard.kde.org/r/125641/diff/" \
style="margin-left: 3em;">View Diff</a></p>






  </td>
 </tr>
</table>







  </div>
 </body>
</html>


--===============5018532194242668119==--


[prev in list] [next in list] [prev in thread] [next in thread] 

Configure | About | News | Add a list | Sponsored by KoreLogic