Hello everyone, just a quick notice if you're maintaining a port of some screen locker, you now *might* want to add security/unix-selfauth-helper as a RUN_DEPENDS.
Short background is a "special" feature of LinuxPAM that *some* screen lockers now take for granted: Their pam_unix.so uses a suid-root helper for the case that you're trying to authenticate as yourself. As a consequence, a screen locker doesn't need to be suid-root itself (or use a 3rd-party suid-root helper) in order to use PAM when pam_unix.so might be used. I tried to reimplement this feature into our pam_unix.so, which was rejected, but des@ recommended to use pam_exec.so instead. That's how unix-selfauth-helper came to be. It must be specifically configured in the PAM policy used, but it's less intrusive than modifying pam_unix. To learn how to use it, just have a look at unix-selfauth-helper(8). You can also look at a review I opened to update xscreensaver to 6.04 (which will need this functionality) as an example here: <https://reviews.freebsd.org/D35348>. Best regards, Felix -- Felix Palmen <zir...@freebsd.org> {private} fe...@palmen-it.de -- ports committer (mentee) -- {web} http://palmen-it.de {pgp public key} http://palmen-it.de/pub.txt {pgp fingerprint} 6936 13D5 5BBF 4837 B212 3ACC 54AD E006 9879 F231
signature.asc
Description: PGP signature
