[kscreenlocker] [Bug 458540] Keyboard layout indicator is missing with certain distro setups
https://bugs.kde.org/show_bug.cgi?id=458540 Nate Graham changed: What|Removed |Added Component|greeter |general -- You are receiving this mail because: You are watching all bug changes.
[kscreenlocker] [Bug 458540] Keyboard layout indicator is missing with certain distro setups
https://bugs.kde.org/show_bug.cgi?id=458540 Oleg Solovyov changed: What|Removed |Added Ever confirmed|0 |1 Status|RESOLVED|REOPENED Resolution|WORKSFORME |--- -- You are receiving this mail because: You are watching all bug changes.
[kscreenlocker] [Bug 458540] Keyboard layout indicator is missing with certain distro setups
https://bugs.kde.org/show_bug.cgi?id=458540 Bug Janitor Service changed: What|Removed |Added Resolution|WAITINGFORINFO |WORKSFORME Status|NEEDSINFO |RESOLVED --- Comment #12 from Bug Janitor Service --- This bug has been in NEEDSINFO status with no change for at least 30 days. The bug is now closed as RESOLVED > WORKSFORME due to lack of needed information. For more information about our bug triaging procedures please read the wiki located here: https://community.kde.org/Guidelines_and_HOWTOs/Bug_triaging Thank you for helping us make KDE software even better for everyone! -- You are receiving this mail because: You are watching all bug changes.
[kscreenlocker] [Bug 458540] Keyboard layout indicator is missing with certain distro setups
https://bugs.kde.org/show_bug.cgi?id=458540 --- Comment #11 from Bug Janitor Service --- Dear Bug Submitter, This bug has been in NEEDSINFO status with no change for at least 15 days. Please provide the requested information as soon as possible and set the bug status as REPORTED. Due to regular bug tracker maintenance, if the bug is still in NEEDSINFO status with no change in 30 days the bug will be closed as RESOLVED > WORKSFORME due to lack of needed information. For more information about our bug triaging procedures please read the wiki located here: https://community.kde.org/Guidelines_and_HOWTOs/Bug_triaging If you have already provided the requested information, please mark the bug as REPORTED so that the KDE team knows that the bug is ready to be confirmed. Thank you for helping us make KDE software even better for everyone! -- You are receiving this mail because: You are watching all bug changes.
[kscreenlocker] [Bug 458540] Keyboard layout indicator is missing with certain distro setups
https://bugs.kde.org/show_bug.cgi?id=458540 Sergey V Turchin changed: What|Removed |Added CC||z...@altlinux.org -- You are receiving this mail because: You are watching all bug changes.
[kscreenlocker] [Bug 458540] Keyboard layout indicator is missing with certain distro setups
https://bugs.kde.org/show_bug.cgi?id=458540 --- Comment #10 from Oleg Solovyov --- install-non-root: install-common install -d -m 710 $(DESTDIR)$(LIBEXECDIR)/chkpwd install -m 700 $(CHKPWD) $(DESTDIR)$(LIBEXECDIR)/chkpwd/ Same: no o+x bits -- You are receiving this mail because: You are watching all bug changes.
[kscreenlocker] [Bug 458540] Keyboard layout indicator is missing with certain distro setups
https://bugs.kde.org/show_bug.cgi?id=458540 --- Comment #9 from Oleg Solovyov --- (In reply to David Edmundson from comment #8) > >I don't think it's a good idea to give sgid to the whole greeter > > Me neither. I don't want anyone doing that. > > Lets disable that bit again get some debug from the tcb pam backend and go > from there. $ /usr/lib/chkpwd/tcb_chkpwd bash: /usr/lib/chkpwd/tcb_chkpwd: Отказано в доступе we simply get EACCES when invoking helper without proper permissions # chmod o+x /usr/lib/chkpwd/ # chmod g-s /usr/libexec/kf5/kscreenlocker_greet $ /usr/lib/chkpwd/tcb_chkpwd $ /usr/lib/chkpwd/ does not have o+x bit: # l -d /usr/lib/chkpwd/ drwx--x--- 1 root chkpwd 20 фев 17 2022 /usr/lib/chkpwd/ It prevents /usr/lib/chkpwd/* to execute even if they have o+x bits. And it seems to be intentional tcb/progs/Makefile: install: install-common install -d -o root -g chkpwd -m 710 $(DESTDIR)$(LIBEXECDIR)/chkpwd install -m 2711 -o root -g shadow $(CHKPWD) \ $(DESTDIR)$(LIBEXECDIR)/chkpwd/ -- You are receiving this mail because: You are watching all bug changes.
[kscreenlocker] [Bug 458540] Keyboard layout indicator is missing with certain distro setups
https://bugs.kde.org/show_bug.cgi?id=458540 David Edmundson changed: What|Removed |Added Resolution|--- |WAITINGFORINFO Status|REPORTED|NEEDSINFO --- Comment #8 from David Edmundson --- >I don't think it's a good idea to give sgid to the whole greeter Me neither. I don't want anyone doing that. With pam_unix we definitely don't need to, the code for tcb heavily heavily implies we don't need to. Clearly something is wrong there that needs fixing. Either tcb has a bug or there's some extra setup step that's not clear. Lets disable that bit again get some debug from the tcb pam backend and go from there. -- You are receiving this mail because: You are watching all bug changes.
[kscreenlocker] [Bug 458540] Keyboard layout indicator is missing with certain distro setups
https://bugs.kde.org/show_bug.cgi?id=458540
Oleg Solovyov changed:
What|Removed |Added
Resolution|WAITINGFORINFO |---
Status|NEEDSINFO |REPORTED
--- Comment #7 from Oleg Solovyov ---
(In reply to David Edmundson from comment #6)
> >Our distro uses tcb with users have their own /etc/tcb//shadow
> >As of consequence, password checker has to be in chkpwd group with sgid bit
> >set.
>
> Are you sure?
>
> Looking at TCB code (support.c) it has an explicit path for when we're not
> running as root.
>
> ```
> if (uid == geteuid() && uid == pw->pw_uid && uid != 0) {
> /* We are not root perhaps this is the reason? */
> D(("running helper binary"));
> retval = unix_run_helper_binary(user, pass);
> ```
>
> Which from the make file seems to invoke $(LIBEXECDIR)/chkpwd/tcb_chkpwd
>
Yes. Can't prove why but I tested with sgid bit removed and I can't unlock my
session.
That's why kcheckpass had attrs:
-rwx--s--x 1 root chkpwd [...] /usr/libexec/kf5/kcheckpass
Now same attrs should be on kscreenlocker_greet:
-rwx--s--x 1 root chkpwd 149864 авг 26 17:18
/usr/libexec/kf5/kscreenlocker_greet
I don't think it's a good idea to give sgid to the whole greeter instead of
kcheckpass which is small and written w/o Qt
Also:
#l /usr/lib/chkpwd/
итого 16
drwxr-xr-x 1 root root 20362 сен 5 10:39 ../
drwx--x--- 1 root chkpwd20 фев 17 2022 ./
-rwx--s--x 2 root shadow 14528 авг 24 2021 tcb_chkpwd
--
You are receiving this mail because:
You are watching all bug changes.
[kscreenlocker] [Bug 458540] Keyboard layout indicator is missing with certain distro setups
https://bugs.kde.org/show_bug.cgi?id=458540
David Edmundson changed:
What|Removed |Added
Resolution|--- |WAITINGFORINFO
Status|REPORTED|NEEDSINFO
CC||k...@davidedmundson.co.uk
--- Comment #6 from David Edmundson ---
>Our distro uses tcb with users have their own /etc/tcb//shadow
>As of consequence, password checker has to be in chkpwd group with sgid bit
>set.
Are you sure?
Looking at TCB code (support.c) it has an explicit path for when we're not
running as root.
```
if (uid == geteuid() && uid == pw->pw_uid && uid != 0) {
/* We are not root perhaps this is the reason? */
D(("running helper binary"));
retval = unix_run_helper_binary(user, pass);
```
Which from the make file seems to invoke $(LIBEXECDIR)/chkpwd/tcb_chkpwd
That matches 1:1 how pam_unix works in this situation and why I ported away
from kcheckpass as a helper binary, as good pam modules provide their own
helper binary implementation anyway and we were just duplicating that.
If this is not working correctly that would lean towards a TCB bug or a setup
issue.
I can provide a simpler pam test case that runs as a regular user if that's
useful in diagnosing the issue.
--
You are receiving this mail because:
You are watching all bug changes.
[kscreenlocker] [Bug 458540] Keyboard layout indicator is missing with certain distro setups
https://bugs.kde.org/show_bug.cgi?id=458540 --- Comment #5 from Oleg Solovyov --- (In reply to Nate Graham from comment #4) > Thanks for the info. Vlad, could you take a look? I don't think it's an upstream problem but still I would appreciate any help on restoring kcheckpass in any way. Or moving from Plasma 5.24 to 5.25 would be blocked in our stable products. Just restoring files from 5.24.6 works but it's not fine - authentificator interface has changed since and plasma-workspace needs patching as well. -- You are receiving this mail because: You are watching all bug changes.
[kscreenlocker] [Bug 458540] Keyboard layout indicator is missing with certain distro setups
https://bugs.kde.org/show_bug.cgi?id=458540 Nate Graham changed: What|Removed |Added CC||vlad.zahorod...@kde.org Summary|Keyboard layout indicator |Keyboard layout indicator |is missing |is missing with certain ||distro setups --- Comment #4 from Nate Graham --- Thanks for the info. Vlad, could you take a look? -- You are receiving this mail because: You are watching all bug changes.
[kscreenlocker] [Bug 458540] Keyboard layout indicator is missing
https://bugs.kde.org/show_bug.cgi?id=458540 --- Comment #3 from Oleg Solovyov --- Additional info: # l /usr/libexec/kf5/kscreenlocker_greet -rwx--s--x 1 root chkpwd 158056 авг 31 18:01 /usr/libexec/kf5/kscreenlocker_greet Our distro uses tcb with users have their own /etc/tcb//shadow As of consequence, password checker has to be in chkpwd group with sgid bit set. Before throwing out kcheckpass, it worked. After, kscreenlocker_greet should have sgid to successfully unlock session but it breaks keyboard layouts shown. -- You are receiving this mail because: You are watching all bug changes.
[kscreenlocker] [Bug 458540] Keyboard layout indicator is missing
https://bugs.kde.org/show_bug.cgi?id=458540 --- Comment #2 from Oleg Solovyov --- (In reply to Nate Graham from comment #1) > Works for me with current git master, as long as I have configured more than > one keyboard layout. With only one layout, it's hidden as expected. > > What repo is that commit in? kscreenlocker -- You are receiving this mail because: You are watching all bug changes.
[kscreenlocker] [Bug 458540] Keyboard layout indicator is missing
https://bugs.kde.org/show_bug.cgi?id=458540 Nate Graham changed: What|Removed |Added CC||n...@kde.org Keywords||regression --- Comment #1 from Nate Graham --- Works for me with current git master, as long as I have configured more than one keyboard layout. With only one layout, it's hidden as expected. What repo is that commit in? -- You are receiving this mail because: You are watching all bug changes.
