On 04/13/2012 09:33 AM, Oliver Burger wrote:
And as I did say in this thread. I don't see any action by our KDE
team to this effect. Ok, I only scanned over the patches, but I read
the changelog and I saw no sign of anyone patching KDM to ignore it.
So be annoyed with KDE upstream for this change, not with our KDE
maintainers.
Of course if someone does find a patch on our side, that does it, feel
free to correct me.
OK, just to be definitive, I activated KDM, set AllowRootLogin to true,
and tried and failed to login as root. However, KDM may not be the
culprit. From /var/log/auth.log:
Here's me logging on as root from a tty to do "service dm restart" (I
was previously using GDM):
Apr 13 10:13:18 localhost login: pam_tcb(login:auth): Authentication
passed for root from LOGIN(uid=0)
Apr 13 10:13:18 localhost login: pam_tcb(login:session): Session opened
for root by root(uid=0)
Apr 13 10:13:18 localhost login: ROOT LOGIN ON tty3
Apr 13 10:13:23 localhost polkitd(authority=local): Unregistered
Authentication Agent for
unix-session:/org/freedesktop/ConsoleKit/Session3 (system bus name
:1.320, object path /org/freedesktop/PolicyKit1/AuthenticationAgent,
locale en_US.UTF-8) (disconnected from bus)
Now here's two attempts at graphical login as root, followed by a
successful one as ftg:
Apr 13 10:13:38 localhost kdm: :0[22087]: pam_succeed_if(kdm:auth):
requirement "user ingroup nopasswdlogin" not met by user "root"
Apr 13 10:13:38 localhost kdm: :0[22087]: pam_tcb(kdm:auth):
Authentication passed for root from (uid=0)
Apr 13 10:13:47 localhost kdm: :0[22087]: pam_succeed_if(kdm:auth):
requirement "user ingroup nopasswdlogin" not met by user "root"
Apr 13 10:13:47 localhost kdm: :0[22087]: pam_tcb(kdm:auth):
Authentication passed for root from (uid=0)
Apr 13 10:13:58 localhost kdm: :0[22087]: pam_succeed_if(kdm:auth):
requirement "user ingroup nopasswdlogin" not met by user "ftg"
Apr 13 10:13:58 localhost kdm: :0[22087]: pam_tcb(kdm:auth):
Authentication passed for ftg from (uid=0)
Apr 13 10:13:58 localhost kdm: :0[22087]: pam_tcb(kdm:session): Session
opened for ftg by ftg(uid=0)
Note that in the tty login for root and the graphical login for ftg,
there are pam_tcb(kdm:session) entries, while there are none for the
failed graphical root logins.
It's still possible that this is being done by KDM, but googling turns
up nothing about AllowRootLogin being dropped by upstream. On the
contrary, "true" is the default on OpenSUSE and you can find here:
http://www.novell.com/support/search.do?cmd=displayKC&docType=kc&externalId=7007124&sliceId=1&docTypeID=DT_TID_1_1
an open bug in the Novell bugtracker complaining that root login is
still possible even if you set AllowRootLogin to false, because some
SUSE-specific script sets it back to true.
So, I don't think this was an upstream KDM change. From the above, it's
probably something in pam, so let's look there:
[root@ftgme2 ftg]# cat /etc/pam.d/kdm
#%PAM-1.0
auth required pam_env.so
auth required pam_succeed_if.so user != root quiet
auth sufficient pam_succeed_if.so user ingroup nopasswdlogin
auth substack system-auth
account required pam_nologin.so
account include system-auth
password include system-auth
session optional pam_keyinit.so force revoke
session required pam_loginuid.so
session include system-auth
session optional pam_console.so
session required pam_namespace.so
[root@ftgme2 ftg]#
Well. well. Turns out this file is owned by mageia-kde4-config-common.
And it also turns out that if you comment out that third line, graphical
root login works just fine.
Looking in the changelog, one finds:
* Thu Sep 22 2011 mikala <mikala> 2-0.20110921.1.mga2
+ Revision: 146549
- Use directory.trash to create the trash.desktop & remove SOURCE4
- Fix rpmlint warnings
- use dolphin as a temporary workaround for Home2.desktop
- Switch to oxygen instead of iaora for Default & Netbook
config file
- Add pam files for kdm,kcheckpass & kscreensaver in common
config file
- Update version to 2 (we're on Mageia 2)
- Add mgabutton as symlink for start-here-kde in the vanilla
theme to have the ?\194?\171 upstream ?\194?\187 icon since we're
patching kdebase4-workspace
- Fix Provides for common package
- Update tarball to fix default kdm & ksplash for vanilla flavour
- Use correct prefix for vanilla
- Follow luc menut suggestion for kde prefix use
- More progress on vanilla flavour :
- move configurations files from common to Default/netbook flavors
- remove useless configuration files
- sync dolphinuirc with upstream
- fix alternatives for kde4-config & kdm-config vanilla flavour
Unfortunately, this doesn't say which package owned the pam files before
that, so it's unclear whether they were changed before this.
So the OP wasn't dreaming, this wasn't an upstream policy change, and it
was a deliberate decision on somebody's part here. And now you know how
to disable it if you want.
