Rolf Eike Beer authored May 06, 2018 and Rolf Eike Beer committed May 23, 2018

Differential Revision: https://phabricator.kde.org/D13015

to the master version, change back to the correct one

Summary:
Don't return on error conditions, exit instead. It's a child process we
need to finish it
Don't use pam_syslog, there's a comment at the beginning saying it
doesn't work, it seems to kind of work for me but some investigation by
Matthias Gerstner seems to show it's doing funny things with the fds
so don't use it.

Reviewers: fvogt

Reviewed By: fvogt

Subscribers: anthonyfieroni, mgerstner, fvogt, plasma-devel

Tags: #plasma

Differential Revision: https://phabricator.kde.org/D13013

Summary:
If it's not a regular file we try to re-create it
if we can't for some reason, we bail out

Reviewers: fvogt, mgerstner

Reviewed By: fvogt

Subscribers: plasma-devel

Tags: #plasma

Differential Revision: https://phabricator.kde.org/D12991

GIT_SILENT

GIT_SILENT

GIT_SILENT

GIT_SILENT

Reviewers: mart, fvogt

Reviewed By: mart, fvogt

Subscribers: fvogt, mgerstner, plasma-devel

Tags: #plasma

Differential Revision: https://phabricator.kde.org/D12909

Summary:
PAM_SUCCESS signals to the PAM stack that the
authentication succeeded. That is actually not the case, because
pam_kwallet doesn't authenticate anything. If a user would badly configure
his PAM stack by classifying pam_kwallet as sufficient then login would
always be possible.

Reviewers: davidedmundson

Reviewed By: davidedmundson

Subscribers: mgerstner, plasma-devel

Tags: #plasma

Differential Revision: https://phabricator.kde.org/D12910

Summary:
The fixes for CVE-2018-10380 introduced a regression for most users not
using kde, and some for kde sessions. In particular the reorder of the
close calls and creating a new socket caused that the socket is always
assigned the file descriptor 2, aka stderr.

BUG: 393856

Test Plan: It works

Reviewers: #plasma, aacid

Reviewed By: aacid

Subscribers: asturmlechner, rdieter, davidedmundson, plasma-devel

Tags: #plasma

Differential Revision: https://phabricator.kde.org/D12702

We don't need to be creating the socket as root, and doing so,
specially having a chown is problematic security wise.

Opening files for writing as root is very tricky since through the power
of symlinks we can get tricked to write in places we don't want to and
we don't really need to be root to create the salt file

GIT_SILENT

GIT_SILENT

GIT_SILENT

GIT_SILENT

GIT_SILENT

GIT_SILENT

GIT_SILENT

GIT_SILENT

GIT_SILENT

GIT_SILENT

In case of conflict in i18n, keep the version of the branch "ours"
To resolve a particular conflict, "git checkout --ours path/to/file.desktop"

Summary:
It's a documented side effect that initialization of secure memory in gcrypt
drops privileges if getuid() != geteuid(). This results in breaking setuid
callers, like sudo or su.

Test Plan: Can use sudo again when pam_kwallet is involved.

Reviewers: #plasma

Subscribers: plasma-devel

Tags: #plasma

Differential Revision: https://phabricator.kde.org/D7124

Summary:
Avoid running if it detects a text session. This can be overridden by adding
"force_run" as argument.

Test Plan:
Put pam_kwallet5.so as optional in a global common-session pam file
that is included by all other services. It is not invoked when logging in from
a tty with getty, sudo or su and still works when using SDDM. When adding
force_run it runs in all cases.

Reviewers: #plasma

Subscribers: plasma-devel

Tags: #plasma

Differential Revision: https://phabricator.kde.org/D7125

Summary:
- No cppcheck warnings anymore
- Use snprintf everywhere
- Avoid pointless multiplication with sizeof(char)
- Avoid memory leaks

Test Plan: Still builds, works the same as before.

Reviewers: #plasma

Subscribers: plasma-devel

Tags: #plasma

Differential Revision: https://phabricator.kde.org/D7123

Summary:
FreeBSD has neither pam_ext.h nor pam_syslog(), so check for headers
and add defines as appropriate.

Test Plan: Builds on FreeBSD, now. Needs a test-build on Linux.

Reviewers: jriddell, #plasma

Reviewed By: jriddell, #plasma

Subscribers: plasma-devel

Tags: #plasma

Differential Revision: https://phabricator.kde.org/D6000

GIT_SILENT

GIT_SILENT

In case of conflict in i18n, keep the version of the branch "ours"
To resolve a particular conflict, "git checkout --ours path/to/file.desktop"

In case of conflict in i18n, keep the version of the branch "ours"
To resolve a particular conflict, "git checkout --ours path/to/file.desktop"