On Wed, Nov 04, 2026 at 05:52:57PM +0000, Stuart Henderson wrote: > On 2026/11/04 18:35, Caspar Schutijser wrote: > > Hi ports@, > > > > On Fri, Oct 23, 2026 at 10:37:21AM +0200, Manuel Giraud wrote: > > > Sure. Here's what I had. This was really a work in progress as I was > > > discovering bsdauth along the way. Also at the time I was working on > > > version 6.09. Hope this help. > > > > Below is a WIP diff that integrates Manuel's work into the port. > > > > I am able to unlock my screen, so that's good. I have looked at the > > diff but it can benefit from more people that have a critical look. > > > > xscreensaver now prints > > xscreensaver-auth: 09:07:56: pwnam: couldn't get password of "caspar" > > when I lock my screen, which it did not do before. I have not looked > > into it yet, but I guess we should remove/ifdef out some code path. > > expected, but yes that seems like it should be disabled > > > Some notes on the diff: > > - The diff changes from patching "configure" to "configure.ac" (which > > also explains the Makefile bits), because then we can use autoconf. > > I can commit the part where we move from patching configure to > > configure.ac separately. > > yes please, that will make the diff clearer, ok with me > > > - The "+@bin libexec/xscreensaver/worldpieces" piece in pkg/PLIST can > > be committed separately. > > that can go alongside the above (with bump)
Thanks, I have committed those two changes. New, shorter diff at the bottom. > > - I think it makes more sense if the configure.ac bit that checks for > > BSD authentication checks if auth_userokay() exists, but this also > > works. > > - Of course the comment in the Makefile regarding implementing BSD auth > > should be removed too if this ends up being committed. > > > > I still want to have a good look at Antoine's diff (which is here: > > https://codeberg.org/OpenBSD/ports/commit/9959eb2a5fca247fb47814ea37706c9bb3cd87de > > ) > > to understand why an approach like this was tried earlier but reverted. > > But if someone beats me to that, that's fine with me. In Antoine's > > diff, it says: > > XXX It should be possible to specify an authentication style by > > appending it to the user's name with a single colon (`:') as a separator > > but xscreensaver does not allow to modify username (yet?). > > To me it's not clear if using BSD authentication with a patch like > > this breaks existing functionality, or whether this is describing new > > functionality. > > that describes a bsdauth feature (an example would be to choose an auth > style which uses OTP if they default is to use a local password, or vice > versa; you can do this by trying to login at the console or via ssh with > user:style). but I don't really see how this would integrate with > xscreensaver. so "possible new functionality if there's a way to > integrate it". Okay, thanks for the explanation. I'd say that this in particular is not a blocker for a BSD Authentication diff then. Caspar Index: Makefile =================================================================== RCS file: /cvs/ports/x11/xscreensaver/Makefile,v diff -u -p -r1.127 Makefile --- Makefile 4 Nov 2026 19:56:11 -0000 1.127 +++ Makefile 4 Nov 2026 20:04:57 -0000 @@ -9,7 +9,7 @@ COMMENT= screen saver and locker for the # Ideally this wants a bsdauth driver to be written, change to being # installed setgid auth, and figure out any issues resulting. DISTNAME= xscreensaver-6.15 -REVISION= 3 +REVISION= 4 CATEGORIES= x11 Index: patches/patch-configure_ac =================================================================== RCS file: /cvs/ports/x11/xscreensaver/patches/patch-configure_ac,v diff -u -p -r1.1 patch-configure_ac --- patches/patch-configure_ac 4 Nov 2026 19:56:11 -0000 1.1 +++ patches/patch-configure_ac 4 Nov 2026 20:04:57 -0000 @@ -1,5 +1,9 @@ - Fix path to /usr/local/share +- Add BSD Authentication support bits + +- Fix OpenBSD shadow test + - Don't fail if unrecognised autoconf command-line flags are present (avoid problem with --disable-gtk-doc) @@ -26,6 +30,16 @@ Index: configure.ac ############################################################################### # # Autoheader stuff +@@ -232,6 +227,9 @@ AH_TEMPLATE([HAVE_SHADOW_PASSWD], + AH_TEMPLATE([HAVE_PWNAM_SHADOW_PASSWD], + [Define this if your system uses getpwnam_shadow.]) + ++AH_TEMPLATE([HAVE_BSDAUTH], ++ [Define this if your system uses BSD Authentication system.]) ++ + AH_TEMPLATE([HAVE_ENHANCED_PASSWD], + [Define this for DEC/SCO "Enhanced Security" with getprpwnam.]) + @@ -2026,9 +2024,9 @@ fi # Check for the various Gnome help and URL loading programs. @@ -38,7 +52,62 @@ Index: configure.ac AC_CHECK_PROGS(gnome_url_show_program, gnome-url-show) fi -@@ -2625,9 +2661,9 @@ fi +@@ -2439,7 +2437,7 @@ if test "$with_shadow" = yes ; then + #include <unistd.h> + #include <sys/types.h> + #include <pwd.h>], +- [struct spwd *p = getspnam_shadow("nobody"); ++ [struct passwd *p = getpwnam_shadow("nobody"); + const char *pw = p->pw_passwd;], + [ac_cv_pwnam_shadow=yes], + [ac_cv_pwnam_shadow=no])]) +@@ -2520,8 +2518,44 @@ if test "$enable_locking" = yes -a "$have_pam" = no ; + esac + fi + ++############################################################################### ++# ++# Check for BSD Authentication system. ++# ++############################################################################### ++have_bsdauth=no ++with_bsdauth_req=unspecified + +-if test "$have_shadow_adjunct" = yes ; then ++AC_ARG_WITH(bsdauth, ++[ --with-bsdauth Include support for BSD Authentication system.], ++ [with_bsdauth="$withval"; with_bsdauth_req="$withval"],[with_bsdauth=yes]) ++ ++HANDLE_X_PATH_ARG(with_bsdauth, --with-bsdauth, BSD Authentication system) ++ ++if test "$enable_locking" = no ; then ++ with_bsdauth_req=no ++ with_bsdauth=no ++fi ++ ++if test "$with_bsdauth" = yes ; then ++ AC_CACHE_CHECK([for BSD Authentication system], ac_cv_bsdauth, ++ [AC_TRY_X_COMPILE([#include <stdlib.h> ++ #include <unistd.h> ++ #include <sys/types.h> ++ #include <login_cap.h> ++ #include <bsd_auth.h>], ++ [auth_session_t *as = auth_open(); ++ auth_close(as);], ++ [ac_cv_bsdauth=yes], ++ [ac_cv_bsdauth=no])]) ++ if test "$ac_cv_bsdauth" = yes; then ++ have_bsdauth=yes ++ fi ++fi ++ ++if test "$have_bsdauth" = yes ; then ++ AC_DEFINE(HAVE_BSDAUTH) ++elif test "$have_shadow_adjunct" = yes ; then + AC_DEFINE(HAVE_ADJUNCT_PASSWD) + elif test "$have_shadow_enhanced" = yes ; then + AC_DEFINE(HAVE_ENHANCED_PASSWD) +@@ -2625,9 +2659,9 @@ fi # Check for the various Gnome help and URL loading programs. # @@ -50,7 +119,7 @@ Index: configure.ac AC_CHECK_PROGS(gnome_url_show_program, gnome-url-show) fi -@@ -3934,7 +3970,7 @@ fi +@@ -3934,7 +3968,7 @@ fi have_ffmpeg=no @@ -59,7 +128,18 @@ Index: configure.ac "$have_avcodec" = yes -a \ "$have_avutil" = yes -a \ "$have_swscale" = yes -a \ -@@ -4489,7 +4529,6 @@ else +@@ -4127,6 +4161,10 @@ if test "$have_pam" = yes; then + PASSWD_OBJS="$PASSWD_OBJS \$(PAM_OBJS)" + INSTALL_PAM="install-pam" + fi ++if test "$have_bsdauth" = yes; then ++ PASSWD_SRCS="$PASSWD_SRCS \$(BSDAUTH_SRCS)" ++ PASSWD_OBJS="$PASSWD_OBJS \$(BSDAUTH_OBJS)" ++fi + PASSWD_SRCS="$PASSWD_SRCS \$(PWENT_SRCS)" + PASSWD_OBJS="$PASSWD_OBJS \$(PWENT_OBJS)" + +@@ -4489,7 +4527,6 @@ else warn2 "The errors are:" echo '' echo "$pkgerr" | sed 's/^/ > /g' @@ -67,7 +147,7 @@ Index: configure.ac fi fi -@@ -4793,7 +4832,6 @@ elif test "$have_pam" = no -a "$enable_locking" = yes +@@ -4793,7 +4830,6 @@ elif test "$have_pam" = no -a "$enable_locking" = yes if test -d /etc/pam.d -o -f /etc/pam.conf ; then warn "Your system seems to have PAM, but PAM is not being used." warn2 "That is probably not going to work out well." Index: patches/patch-driver_Makefile_in =================================================================== RCS file: patches/patch-driver_Makefile_in diff -N patches/patch-driver_Makefile_in --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ patches/patch-driver_Makefile_in 4 Nov 2026 20:04:57 -0000 @@ -0,0 +1,41 @@ +Index: driver/Makefile.in +--- driver/Makefile.in.orig ++++ driver/Makefile.in +@@ -195,6 +195,9 @@ GFX_LIBS = $(LIBS_PRE) $(XFT_LIBS) $(XDPMS_LIBS) $(XIN + PWENT_SRCS = passwd-pwent.c + PWENT_OBJS = passwd-pwent.o + ++BSDAUTH_SRCS = passwd-bsdauth.c ++BSDAUTH_OBJS = passwd-bsdauth.o ++ + KERBEROS_SRCS = passwd-kerberos.c + KERBEROS_OBJS = passwd-kerberos.o + +@@ -308,7 +311,7 @@ EXTRAS = README Makefile.in \ + + TARFILES = $(DAEMON_SRCS) $(GFX_SRCS) $(AUTH_SRCS) $(SYSTEMD_SRCS) \ + $(CMD_SRCS) $(GTK_SRCS) $(MOTIF_SRCS) $(PWENT_SRCS) \ +- $(KERBEROS_SRCS) $(PAM_SRCS) \ ++ $(KERBEROS_SRCS) $(BSDAUTH_SRCS) $(PAM_SRCS) \ + $(WAYLAND_GEN_SRCS) \ + $(HDRS) $(MENA) $(MENB) $(TEST_SRCS) $(EXTRAS) + +@@ -703,7 +706,7 @@ depend: XScreenSaver_ad.h XScreenSaver_Xm_ad.h + $(INCLUDES_1) $(DEFS) $(DEPEND_DEFINES) $(CFLAGS) $(X_CFLAGS) -- \ + $(DAEMON_SRCS) $(GFX_SRCS) $(AUTH_SRCS) $(SYSTEMD_SRCS) $(CMD_SRCS) \ + $(GTK_SRCS) $(MOTIF_SRCS) $(PWENT_SRCS) $(KERBEROS_SRCS) \ +- $(PAM_SRCS) $(WAYLAND_GEN_SRCS) $(TEST_SRCS) ++ $(BSDAUTH_SRCS) $(PAM_SRCS) $(WAYLAND_GEN_SRCS) $(TEST_SRCS) + + # Adds some dependencies to Makefile.in -- not totally accurate, but pretty + # close. This excludes dependencies on files in /usr/include, etc. It tries +@@ -1239,6 +1242,9 @@ fade.o: $(UTILS_SRC)/visual.h + fade.o: $(UTILS_SRC)/xmu.h + fade.o: $(UTILS_SRC)/xshm.h + fade.o: $(srcdir)/xinput.h ++passwd-bsdauth.o: $(srcdir)/auth.h ++passwd-bsdauth.o: ../config.h ++passwd-bsdauth.o: $(UTILS_SRC)/blurb.h + passwd-kerberos.o: $(srcdir)/auth.h + passwd-kerberos.o: ../config.h + passwd-kerberos.o: $(UTILS_SRC)/blurb.h Index: patches/patch-driver_auth_h =================================================================== RCS file: patches/patch-driver_auth_h diff -N patches/patch-driver_auth_h --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ patches/patch-driver_auth_h 4 Nov 2026 20:04:57 -0000 @@ -0,0 +1,14 @@ +Index: driver/auth.h +--- driver/auth.h.orig ++++ driver/auth.h +@@ -61,6 +61,10 @@ extern Bool kerberos_lock_init (void); + extern Bool kerberos_passwd_valid_p (void *closure, const char *plaintext); + #endif + ++#ifdef HAVE_BSDAUTH ++extern Bool bsdauth_passwd_valid_p (void *closure, const char *plaintext); ++#endif ++ + #ifdef HAVE_PAM + extern Bool pam_priv_init (void); + extern Bool pam_try_unlock (void *closure, Index: patches/patch-driver_passwd-bsdauth_c =================================================================== RCS file: patches/patch-driver_passwd-bsdauth_c diff -N patches/patch-driver_passwd-bsdauth_c --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ patches/patch-driver_passwd-bsdauth_c 4 Nov 2026 20:04:57 -0000 @@ -0,0 +1,73 @@ +Index: driver/passwd-bsdauth.c +--- driver/passwd-bsdauth.c.orig ++++ driver/passwd-bsdauth.c +@@ -0,0 +1,69 @@ ++/* passwd-bsdauth.c --- verifying typed passwords with the BSD ++ * Authentication system. ++ * xscreensaver, Copyright © 1993-2022 Jamie Zawinski <[email protected]> ++ * ++ * Permission to use, copy, modify, distribute, and sell this software and its ++ * documentation for any purpose is hereby granted without fee, provided that ++ * the above copyright notice appear in all copies and that both that ++ * copyright notice and this permission notice appear in supporting ++ * documentation. No representations are made about the suitability of this ++ * software for any purpose. It is provided "as is" without express or ++ * implied warranty. ++ */ ++ ++#ifdef HAVE_CONFIG_H ++# include "config.h" ++#endif ++ ++#ifndef NO_LOCKING /* whole file */ ++ ++#include <stdlib.h> ++#ifdef HAVE_UNISTD_H ++# include <unistd.h> ++#endif ++ ++#include <stdio.h> ++#include <string.h> ++#include <sys/types.h> ++#include <pwd.h> ++#include <login_cap.h> ++#include <bsd_auth.h> ++ ++#ifdef __bsdi__ ++# include <sys/param.h> ++# if _BSDI_VERSION >= 199608 ++# define BSD_AUTH ++# endif ++#endif /* __bsdi__ */ ++ ++ ++#include "blurb.h" ++#include "auth.h" ++ ++/* This can be called at any time, and says whether the typed password ++ belongs to either the logged in user (real uid, not effective); or ++ to root. ++ */ ++Bool ++bsdauth_passwd_valid_p (void *closure, const char *typed_passwd) ++{ ++ struct passwd *p = getpwuid (getuid ()); ++ char *pass = strdup (typed_passwd); ++ ++ if (p && auth_userokay (p->pw_name, NULL, NULL, pass)) ++ return True; ++ ++#ifdef ALLOW_ROOT_PASSWD ++ /* 'pass' was nuked by the previous auth_userokay call */ ++ else if ((pass = strdup (typed_passwd)) && ++ auth_userokay ("root", NULL, NULL, pass)) ++ return True; ++#endif /* ALLOW_ROOT_PASSWD */ ++ ++ else ++ return False; ++} ++ ++#else /* NO_LOCKING */ ++int _ignore_; ++#endif /* NO_LOCKING -- whole file */ Index: patches/patch-driver_passwd_c =================================================================== RCS file: patches/patch-driver_passwd_c diff -N patches/patch-driver_passwd_c --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ patches/patch-driver_passwd_c 4 Nov 2026 20:04:57 -0000 @@ -0,0 +1,13 @@ +Index: driver/passwd.c +--- driver/passwd.c.orig ++++ driver/passwd.c +@@ -92,6 +92,9 @@ struct auth_methods methods[] = { + # ifdef HAVE_KERBEROS + { "KRB", kerberos_lock_init, 0, kerberos_passwd_valid_p, 0, }, + # endif ++# ifdef HAVE_BSDAUTH ++ { "BSD", 0, 0, bsdauth_passwd_valid_p, 0, }, ++# endif + # ifdef PASSWD_HELPER_PROGRAM + { "EXT", 0, ext_priv_init, ext_passwd_valid_p, 0, }, + # endif Index: patches/patch-driver_xscreensaver-auth_c =================================================================== RCS file: /cvs/ports/x11/xscreensaver/patches/patch-driver_xscreensaver-auth_c,v diff -u -p -r1.1 patch-driver_xscreensaver-auth_c --- patches/patch-driver_xscreensaver-auth_c 27 Oct 2026 06:43:30 -0000 1.1 +++ patches/patch-driver_xscreensaver-auth_c 4 Nov 2026 20:04:57 -0000 @@ -1,3 +1,4 @@ +diff -u driver/xscreensaver-auth.c.orig driver/xscreensaver-auth.c Index: driver/xscreensaver-auth.c --- driver/xscreensaver-auth.c.orig +++ driver/xscreensaver-auth.c @@ -6,8 +7,20 @@ Index: driver/xscreensaver-auth.c #include "auth.h" +/* OpenBSD: set[ug]id binary MUST say so in this var */ -+mode_t _permit_setugid = S_ISUID; ++mode_t _permit_setugid = S_ISGID; + #ifdef __GNUC__ __extension__ /* shut up about "string length is greater than the length ISO C89 compilers are required to support" when including +@@ -340,7 +343,11 @@ main (int argc, char **argv) + if (!splash_p && !init_p) + lock_priv_init (); + ++ /* I have not found a way to drop privileges and have access to ++ bsdauth at least on OpenBSD. */ ++#if !defined(HAVE_BSDAUTH) || !defined(__OpenBSD__) + disavow_privileges (); ++#endif + + if (!splash_p && !init_p) + lock_init (); Index: pkg/PLIST =================================================================== RCS file: /cvs/ports/x11/xscreensaver/pkg/PLIST,v diff -u -p -r1.61 PLIST --- pkg/PLIST 4 Nov 2026 19:56:11 -0000 1.61 +++ pkg/PLIST 4 Nov 2026 20:04:57 -0000 @@ -301,9 +301,11 @@ libexec/xscreensaver/webcollage @bin libexec/xscreensaver/xlyap @bin libexec/xscreensaver/xmatrix @bin libexec/xscreensaver/xrayswarm -@mode 4755 +@mode g+s +@group auth @bin libexec/xscreensaver/xscreensaver-auth @mode +@group @bin libexec/xscreensaver/xscreensaver-getimage libexec/xscreensaver/xscreensaver-getimage-file libexec/xscreensaver/xscreensaver-getimage-video
