Hi ports@, On Fri, Oct 23, 2026 at 10:37:21AM +0200, Manuel Giraud wrote: > Sure. Here's what I had. This was really a work in progress as I was > discovering bsdauth along the way. Also at the time I was working on > version 6.09. Hope this help.
Below is a WIP diff that integrates Manuel's work into the port. I am able to unlock my screen, so that's good. I have looked at the diff but it can benefit from more people that have a critical look. xscreensaver now prints xscreensaver-auth: 09:07:56: pwnam: couldn't get password of "caspar" when I lock my screen, which it did not do before. I have not looked into it yet, but I guess we should remove/ifdef out some code path. Some notes on the diff: - The diff changes from patching "configure" to "configure.ac" (which also explains the Makefile bits), because then we can use autoconf. I can commit the part where we move from patching configure to configure.ac separately. - The "+@bin libexec/xscreensaver/worldpieces" piece in pkg/PLIST can be committed separately. - I think it makes more sense if the configure.ac bit that checks for BSD authentication checks if auth_userokay() exists, but this also works. - Of course the comment in the Makefile regarding implementing BSD auth should be removed too if this ends up being committed. I still want to have a good look at Antoine's diff (which is here: https://codeberg.org/OpenBSD/ports/commit/9959eb2a5fca247fb47814ea37706c9bb3cd87de ) to understand why an approach like this was tried earlier but reverted. But if someone beats me to that, that's fine with me. In Antoine's diff, it says: XXX It should be possible to specify an authentication style by appending it to the user's name with a single colon (`:') as a separator but xscreensaver does not allow to modify username (yet?). To me it's not clear if using BSD authentication with a patch like this breaks existing functionality, or whether this is describing new functionality. Caspar Index: Makefile =================================================================== RCS file: /cvs/ports/x11/xscreensaver/Makefile,v diff -u -p -r1.126 Makefile --- Makefile 27 Oct 2026 06:43:30 -0000 1.126 +++ Makefile 4 Nov 2026 17:31:44 -0000 @@ -9,7 +9,7 @@ COMMENT= screen saver and locker for the # Ideally this wants a bsdauth driver to be written, change to being # installed setgid auth, and figure out any issues resulting. DISTNAME= xscreensaver-6.15 -REVISION= 2 +REVISION= 3 CATEGORIES= x11 @@ -57,11 +57,14 @@ RUN_DEPENDS+= devel/xdg-utils USE_GMAKE= Yes NO_TEST= Yes -CONFIGURE_STYLE= gnu +CONFIGURE_STYLE= autoconf CONFIGURE_ARGS= --with-app-defaults="${PREFIX}/lib/X11/app-defaults" \ --without-pam CONFIGURE_ENV= CPPFLAGS="-I${LOCALBASE}/include" \ LDFLAGS="-L${LOCALBASE}/lib" + +AUTOCONF_VERSION= 2.72 +AUTOMAKE_VERSION= 1.16 FAKE_FLAGS= install_prefix=${WRKINST} Index: patches/patch-configure =================================================================== RCS file: patches/patch-configure diff -N patches/patch-configure --- patches/patch-configure 1 Apr 2026 09:56:19 -0000 1.30 +++ /dev/null 1 Jan 1970 00:00:00 -0000 @@ -1,65 +0,0 @@ -- Fix path to /usr/local/share - -- Don't fail if unrecognised autoconf command-line flags are present -(avoid problem with --disable-gtk-doc) - -- Permit building if security/openpam is installed. - -- Don't fail if pkg-config --list-all returns an error code. - -- gnome-open -> xdg-open - -- Don't pick up FFmpeg (just used for recanim, but linked into many binaries) - -Index: configure ---- configure.orig -+++ configure -@@ -2823,11 +2823,6 @@ ac_config_headers="$ac_config_headers config.h" - echo "current directory: `pwd`" - echo "command line was: $0 $@" - --if ! test -z "$ac_unrecognized_opts" ; then -- echo "" >&2 -- exit 2 --fi -- - ############################################################################### - # - # Autoheader stuff -@@ -14468,9 +14463,9 @@ fi - - # Check for the various Gnome help and URL loading programs. - # --WITH_BROWSER=gnome-open -+WITH_BROWSER=xdg-open - if test "$have_gtk" = yes; then -- for ac_prog in gnome-open -+ for ac_prog in xdg-open - do - # Extract the first word of "$ac_prog", so it can be a program name with args. - set dummy $ac_prog; ac_word=$2 -@@ -19990,7 +19985,7 @@ fi - fi - - have_ffmpeg=no --if test "$have_avformat" = yes -a \ -+if false && test "$have_avformat" = yes -a \ - "$have_avcodec" = yes -a \ - "$have_avutil" = yes -a \ - "$have_swscale" = yes -a \ -@@ -22124,7 +22119,6 @@ else - warn2 "The errors are:" - echo '' - echo "$pkgerr" | sed 's/^/ > /g' -- CONF_STATUS=1 - fi - fi - -@@ -22417,7 +22411,6 @@ elif test "$have_pam" = no -a "$enable_locking" = yes - if test -d /etc/pam.d -o -f /etc/pam.conf ; then - warn "Your system seems to have PAM, but PAM is not being used." - warn2 "That is probably not going to work out well." -- CONF_STATUS=1 - fi - fi - Index: patches/patch-configure_ac =================================================================== RCS file: patches/patch-configure_ac diff -N patches/patch-configure_ac --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ patches/patch-configure_ac 4 Nov 2026 17:31:44 -0000 @@ -0,0 +1,154 @@ +- Fix path to /usr/local/share + +- Don't fail if unrecognised autoconf command-line flags are present +(avoid problem with --disable-gtk-doc) + +- Permit building if security/openpam is installed. + +- Don't fail if pkg-config --list-all returns an error code. + +- gnome-open -> xdg-open + +- Don't pick up FFmpeg (just used for recanim, but linked into many binaries) + +diff -u configure.ac.orig configure.ac +Index: configure.ac +--- configure.ac.orig ++++ configure.ac +@@ -9,11 +9,6 @@ AC_CONFIG_HEADERS([config.h]) + echo "current directory: `pwd`" + echo "command line was: $0 $@" + +-if ! test -z "$ac_unrecognized_opts" ; then +- echo "" >&2 +- exit 2 +-fi +- + ############################################################################### + # + # Autoheader stuff +@@ -232,6 +227,9 @@ AH_TEMPLATE([HAVE_SHADOW_PASSWD], + AH_TEMPLATE([HAVE_PWNAM_SHADOW_PASSWD], + [Define this if your system uses getpwnam_shadow.]) + ++AH_TEMPLATE([HAVE_BSDAUTH], ++ [Define this if your system uses BSD Authentication system.]) ++ + AH_TEMPLATE([HAVE_ENHANCED_PASSWD], + [Define this for DEC/SCO "Enhanced Security" with getprpwnam.]) + +@@ -2026,9 +2024,9 @@ fi + + # Check for the various Gnome help and URL loading programs. + # +-WITH_BROWSER=gnome-open ++WITH_BROWSER=xdg-open + if test "$have_wayland" = yes; then +- AC_CHECK_PROGS(gnome_open_program, gnome-open) ++ AC_CHECK_PROGS(gnome_open_program, xdg-open) + AC_CHECK_PROGS(gnome_url_show_program, gnome-url-show) + fi + +@@ -2439,7 +2437,7 @@ if test "$with_shadow" = yes ; then + #include <unistd.h> + #include <sys/types.h> + #include <pwd.h>], +- [struct spwd *p = getspnam_shadow("nobody"); ++ [struct passwd *p = getpwnam_shadow("nobody"); + const char *pw = p->pw_passwd;], + [ac_cv_pwnam_shadow=yes], + [ac_cv_pwnam_shadow=no])]) +@@ -2520,8 +2518,44 @@ if test "$enable_locking" = yes -a "$have_pam" = no ; + esac + fi + ++############################################################################### ++# ++# Check for BSD Authentication system. ++# ++############################################################################### ++have_bsdauth=no ++with_bsdauth_req=unspecified + +-if test "$have_shadow_adjunct" = yes ; then ++AC_ARG_WITH(bsdauth, ++[ --with-bsdauth Include support for BSD Authentication system.], ++ [with_bsdauth="$withval"; with_bsdauth_req="$withval"],[with_bsdauth=yes]) ++ ++HANDLE_X_PATH_ARG(with_bsdauth, --with-bsdauth, BSD Authentication system) ++ ++if test "$enable_locking" = no ; then ++ with_bsdauth_req=no ++ with_bsdauth=no ++fi ++ ++if test "$with_bsdauth" = yes ; then ++ AC_CACHE_CHECK([for BSD Authentication system], ac_cv_bsdauth, ++ [AC_TRY_X_COMPILE([#include <stdlib.h> ++ #include <unistd.h> ++ #include <sys/types.h> ++ #include <login_cap.h> ++ #include <bsd_auth.h>], ++ [auth_session_t *as = auth_open(); ++ auth_close(as);], ++ [ac_cv_bsdauth=yes], ++ [ac_cv_bsdauth=no])]) ++ if test "$ac_cv_bsdauth" = yes; then ++ have_bsdauth=yes ++ fi ++fi ++ ++if test "$have_bsdauth" = yes ; then ++ AC_DEFINE(HAVE_BSDAUTH) ++elif test "$have_shadow_adjunct" = yes ; then + AC_DEFINE(HAVE_ADJUNCT_PASSWD) + elif test "$have_shadow_enhanced" = yes ; then + AC_DEFINE(HAVE_ENHANCED_PASSWD) +@@ -2625,9 +2659,9 @@ fi + + # Check for the various Gnome help and URL loading programs. + # +-WITH_BROWSER=gnome-open ++WITH_BROWSER=xdg-open + if test "$have_gtk" = yes; then +- AC_CHECK_PROGS(gnome_open_program, gnome-open) ++ AC_CHECK_PROGS(gnome_open_program, xdg-open) + AC_CHECK_PROGS(gnome_url_show_program, gnome-url-show) + fi + +@@ -3934,7 +3968,7 @@ fi + + + have_ffmpeg=no +-if test "$have_avformat" = yes -a \ ++if false && test "$have_avformat" = yes -a \ + "$have_avcodec" = yes -a \ + "$have_avutil" = yes -a \ + "$have_swscale" = yes -a \ +@@ -4127,6 +4161,10 @@ if test "$have_pam" = yes; then + PASSWD_OBJS="$PASSWD_OBJS \$(PAM_OBJS)" + INSTALL_PAM="install-pam" + fi ++if test "$have_bsdauth" = yes; then ++ PASSWD_SRCS="$PASSWD_SRCS \$(BSDAUTH_SRCS)" ++ PASSWD_OBJS="$PASSWD_OBJS \$(BSDAUTH_OBJS)" ++fi + PASSWD_SRCS="$PASSWD_SRCS \$(PWENT_SRCS)" + PASSWD_OBJS="$PASSWD_OBJS \$(PWENT_OBJS)" + +@@ -4489,7 +4527,6 @@ else + warn2 "The errors are:" + echo '' + echo "$pkgerr" | sed 's/^/ > /g' +- CONF_STATUS=1 + fi + fi + +@@ -4793,7 +4830,6 @@ elif test "$have_pam" = no -a "$enable_locking" = yes + if test -d /etc/pam.d -o -f /etc/pam.conf ; then + warn "Your system seems to have PAM, but PAM is not being used." + warn2 "That is probably not going to work out well." +- CONF_STATUS=1 + fi + fi + Index: patches/patch-driver_Makefile_in =================================================================== RCS file: patches/patch-driver_Makefile_in diff -N patches/patch-driver_Makefile_in --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ patches/patch-driver_Makefile_in 4 Nov 2026 17:31:44 -0000 @@ -0,0 +1,41 @@ +Index: driver/Makefile.in +--- driver/Makefile.in.orig ++++ driver/Makefile.in +@@ -195,6 +195,9 @@ GFX_LIBS = $(LIBS_PRE) $(XFT_LIBS) $(XDPMS_LIBS) $(XIN + PWENT_SRCS = passwd-pwent.c + PWENT_OBJS = passwd-pwent.o + ++BSDAUTH_SRCS = passwd-bsdauth.c ++BSDAUTH_OBJS = passwd-bsdauth.o ++ + KERBEROS_SRCS = passwd-kerberos.c + KERBEROS_OBJS = passwd-kerberos.o + +@@ -308,7 +311,7 @@ EXTRAS = README Makefile.in \ + + TARFILES = $(DAEMON_SRCS) $(GFX_SRCS) $(AUTH_SRCS) $(SYSTEMD_SRCS) \ + $(CMD_SRCS) $(GTK_SRCS) $(MOTIF_SRCS) $(PWENT_SRCS) \ +- $(KERBEROS_SRCS) $(PAM_SRCS) \ ++ $(KERBEROS_SRCS) $(BSDAUTH_SRCS) $(PAM_SRCS) \ + $(WAYLAND_GEN_SRCS) \ + $(HDRS) $(MENA) $(MENB) $(TEST_SRCS) $(EXTRAS) + +@@ -703,7 +706,7 @@ depend: XScreenSaver_ad.h XScreenSaver_Xm_ad.h + $(INCLUDES_1) $(DEFS) $(DEPEND_DEFINES) $(CFLAGS) $(X_CFLAGS) -- \ + $(DAEMON_SRCS) $(GFX_SRCS) $(AUTH_SRCS) $(SYSTEMD_SRCS) $(CMD_SRCS) \ + $(GTK_SRCS) $(MOTIF_SRCS) $(PWENT_SRCS) $(KERBEROS_SRCS) \ +- $(PAM_SRCS) $(WAYLAND_GEN_SRCS) $(TEST_SRCS) ++ $(BSDAUTH_SRCS) $(PAM_SRCS) $(WAYLAND_GEN_SRCS) $(TEST_SRCS) + + # Adds some dependencies to Makefile.in -- not totally accurate, but pretty + # close. This excludes dependencies on files in /usr/include, etc. It tries +@@ -1239,6 +1242,9 @@ fade.o: $(UTILS_SRC)/visual.h + fade.o: $(UTILS_SRC)/xmu.h + fade.o: $(UTILS_SRC)/xshm.h + fade.o: $(srcdir)/xinput.h ++passwd-bsdauth.o: $(srcdir)/auth.h ++passwd-bsdauth.o: ../config.h ++passwd-bsdauth.o: $(UTILS_SRC)/blurb.h + passwd-kerberos.o: $(srcdir)/auth.h + passwd-kerberos.o: ../config.h + passwd-kerberos.o: $(UTILS_SRC)/blurb.h Index: patches/patch-driver_auth_h =================================================================== RCS file: patches/patch-driver_auth_h diff -N patches/patch-driver_auth_h --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ patches/patch-driver_auth_h 4 Nov 2026 17:31:44 -0000 @@ -0,0 +1,14 @@ +Index: driver/auth.h +--- driver/auth.h.orig ++++ driver/auth.h +@@ -61,6 +61,10 @@ extern Bool kerberos_lock_init (void); + extern Bool kerberos_passwd_valid_p (void *closure, const char *plaintext); + #endif + ++#ifdef HAVE_BSDAUTH ++extern Bool bsdauth_passwd_valid_p (void *closure, const char *plaintext); ++#endif ++ + #ifdef HAVE_PAM + extern Bool pam_priv_init (void); + extern Bool pam_try_unlock (void *closure, Index: patches/patch-driver_passwd-bsdauth_c =================================================================== RCS file: patches/patch-driver_passwd-bsdauth_c diff -N patches/patch-driver_passwd-bsdauth_c --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ patches/patch-driver_passwd-bsdauth_c 4 Nov 2026 17:31:44 -0000 @@ -0,0 +1,73 @@ +Index: driver/passwd-bsdauth.c +--- driver/passwd-bsdauth.c.orig ++++ driver/passwd-bsdauth.c +@@ -0,0 +1,69 @@ ++/* passwd-bsdauth.c --- verifying typed passwords with the BSD ++ * Authentication system. ++ * xscreensaver, Copyright © 1993-2022 Jamie Zawinski <[email protected]> ++ * ++ * Permission to use, copy, modify, distribute, and sell this software and its ++ * documentation for any purpose is hereby granted without fee, provided that ++ * the above copyright notice appear in all copies and that both that ++ * copyright notice and this permission notice appear in supporting ++ * documentation. No representations are made about the suitability of this ++ * software for any purpose. It is provided "as is" without express or ++ * implied warranty. ++ */ ++ ++#ifdef HAVE_CONFIG_H ++# include "config.h" ++#endif ++ ++#ifndef NO_LOCKING /* whole file */ ++ ++#include <stdlib.h> ++#ifdef HAVE_UNISTD_H ++# include <unistd.h> ++#endif ++ ++#include <stdio.h> ++#include <string.h> ++#include <sys/types.h> ++#include <pwd.h> ++#include <login_cap.h> ++#include <bsd_auth.h> ++ ++#ifdef __bsdi__ ++# include <sys/param.h> ++# if _BSDI_VERSION >= 199608 ++# define BSD_AUTH ++# endif ++#endif /* __bsdi__ */ ++ ++ ++#include "blurb.h" ++#include "auth.h" ++ ++/* This can be called at any time, and says whether the typed password ++ belongs to either the logged in user (real uid, not effective); or ++ to root. ++ */ ++Bool ++bsdauth_passwd_valid_p (void *closure, const char *typed_passwd) ++{ ++ struct passwd *p = getpwuid (getuid ()); ++ char *pass = strdup (typed_passwd); ++ ++ if (p && auth_userokay (p->pw_name, NULL, NULL, pass)) ++ return True; ++ ++#ifdef ALLOW_ROOT_PASSWD ++ /* 'pass' was nuked by the previous auth_userokay call */ ++ else if ((pass = strdup (typed_passwd)) && ++ auth_userokay ("root", NULL, NULL, pass)) ++ return True; ++#endif /* ALLOW_ROOT_PASSWD */ ++ ++ else ++ return False; ++} ++ ++#else /* NO_LOCKING */ ++int _ignore_; ++#endif /* NO_LOCKING -- whole file */ Index: patches/patch-driver_passwd_c =================================================================== RCS file: patches/patch-driver_passwd_c diff -N patches/patch-driver_passwd_c --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ patches/patch-driver_passwd_c 4 Nov 2026 17:31:44 -0000 @@ -0,0 +1,13 @@ +Index: driver/passwd.c +--- driver/passwd.c.orig ++++ driver/passwd.c +@@ -92,6 +92,9 @@ struct auth_methods methods[] = { + # ifdef HAVE_KERBEROS + { "KRB", kerberos_lock_init, 0, kerberos_passwd_valid_p, 0, }, + # endif ++# ifdef HAVE_BSDAUTH ++ { "BSD", 0, 0, bsdauth_passwd_valid_p, 0, }, ++# endif + # ifdef PASSWD_HELPER_PROGRAM + { "EXT", 0, ext_priv_init, ext_passwd_valid_p, 0, }, + # endif Index: patches/patch-driver_xscreensaver-auth_c =================================================================== RCS file: /cvs/ports/x11/xscreensaver/patches/patch-driver_xscreensaver-auth_c,v diff -u -p -r1.1 patch-driver_xscreensaver-auth_c --- patches/patch-driver_xscreensaver-auth_c 27 Oct 2026 06:43:30 -0000 1.1 +++ patches/patch-driver_xscreensaver-auth_c 4 Nov 2026 17:31:44 -0000 @@ -1,3 +1,4 @@ +diff -u driver/xscreensaver-auth.c.orig driver/xscreensaver-auth.c Index: driver/xscreensaver-auth.c --- driver/xscreensaver-auth.c.orig +++ driver/xscreensaver-auth.c @@ -6,8 +7,20 @@ Index: driver/xscreensaver-auth.c #include "auth.h" +/* OpenBSD: set[ug]id binary MUST say so in this var */ -+mode_t _permit_setugid = S_ISUID; ++mode_t _permit_setugid = S_ISGID; + #ifdef __GNUC__ __extension__ /* shut up about "string length is greater than the length ISO C89 compilers are required to support" when including +@@ -340,7 +343,11 @@ main (int argc, char **argv) + if (!splash_p && !init_p) + lock_priv_init (); + ++ /* I have not found a way to drop privileges and have access to ++ bsdauth at least on OpenBSD. */ ++#if !defined(HAVE_BSDAUTH) || !defined(__OpenBSD__) + disavow_privileges (); ++#endif + + if (!splash_p && !init_p) + lock_init (); Index: pkg/PLIST =================================================================== RCS file: /cvs/ports/x11/xscreensaver/pkg/PLIST,v diff -u -p -r1.60 PLIST --- pkg/PLIST 17 Apr 2026 15:14:06 -0000 1.60 +++ pkg/PLIST 4 Nov 2026 17:31:44 -0000 @@ -293,6 +293,7 @@ libexec/xscreensaver/webcollage @bin libexec/xscreensaver/whirlwindwarp @bin libexec/xscreensaver/winduprobot @comment SEGV in xft_word_wrap during run @bin libexec/xscreensaver/worldpieces +@bin libexec/xscreensaver/worldpieces @bin libexec/xscreensaver/wormhole @bin libexec/xscreensaver/xanalogtv @bin libexec/xscreensaver/xflame @@ -300,9 +301,11 @@ libexec/xscreensaver/webcollage @bin libexec/xscreensaver/xlyap @bin libexec/xscreensaver/xmatrix @bin libexec/xscreensaver/xrayswarm -@mode 4755 +@mode g+s +@group auth @bin libexec/xscreensaver/xscreensaver-auth @mode +@group @bin libexec/xscreensaver/xscreensaver-getimage libexec/xscreensaver/xscreensaver-getimage-file libexec/xscreensaver/xscreensaver-getimage-video
