----- Original Message -----
On Thu, Jul 03, 2014 at 01:39:38AM -0400, Yassir Elley wrote:
>
>
> ----- Original Message -----
> 4. Should we add the various gdm-* service names as interactive:
> gdm-autologin, gdm-fingerprint, gdm-launch-environment, gdm-pin,
> gdm-smartcard
>
> 5. Should we add the screen savers as interactive: gnome-screensaver,
> kscreensaver
I think we should check with Ray Strode (halfline on
IRC) about the and screensaver semantics. For instance in
https://bugzilla.redhat.com/show_bug.cgi?id=1104756#c16 Ray argued that
screensaver only 're-authenticates'.
I tend to agree about the gdm-* services, but again, checking with Ray
might be a good idea. I think at least in the past, gdm would do some
funky stuff with non-password authentication, like sending the authtoks
to several different pam services and checking which ones would let the
user through..I'm not sure if it's still the case now after the Gnome
3.x rewrite.
What does gdm-launch-environment do?
I chatted with Ray Strode, who said we should provide defaults (of interactive) for
gdm-password, gdm-smartcard, and gdm-fingerprint. The pam gnome-screensaver service has
apparently been replaced with a gnome-shell lock screen (starting with RHEL 7). Even on
RHEL 6, while the pam_acct_mgmt call is made when unlocking the gnome-screensaver, the
results are apparently ignored (b/c the user already has a running session; the lock
simply hides the gnome-shell display). He didn't think default values were needed for
any of the other gdm related services, such as:
* gdm-pin (no longer supported)
* gdm-autologin (password-less login)
* gdm-launch-environment (used to launch system session for gdm user to run login
process)
Note that there is no pam service simply named "gdm".
On the other side, there seem to be four pam services related to kdm: kdm, kdm-np,
kcheckpass, and kscreensaver. We should definitely include a default for kdm, but we
probably don't care about kdm-np (no-password). Does anyone know how kscreensaver
differs from kcheckpass (both have identical pam files, which essentially include
system-auth for all calls (auth, account, session, password). Perhaps we should add
defaults for both kcheckpass and kscreensaver.
Comments?
Regards,
Yassir.