On 2026/11/04 18:35, Caspar Schutijser wrote: > Hi ports@, > > On Fri, Oct 23, 2026 at 10:37:21AM +0200, Manuel Giraud wrote: > > Sure. Here's what I had. This was really a work in progress as I was > > discovering bsdauth along the way. Also at the time I was working on > > version 6.09. Hope this help. > > Below is a WIP diff that integrates Manuel's work into the port. > > I am able to unlock my screen, so that's good. I have looked at the > diff but it can benefit from more people that have a critical look. > > xscreensaver now prints > xscreensaver-auth: 09:07:56: pwnam: couldn't get password of "caspar" > when I lock my screen, which it did not do before. I have not looked > into it yet, but I guess we should remove/ifdef out some code path.
expected, but yes that seems like it should be disabled > Some notes on the diff: > - The diff changes from patching "configure" to "configure.ac" (which > also explains the Makefile bits), because then we can use autoconf. > I can commit the part where we move from patching configure to > configure.ac separately. yes please, that will make the diff clearer, ok with me > - The "+@bin libexec/xscreensaver/worldpieces" piece in pkg/PLIST can > be committed separately. that can go alongside the above (with bump) > - I think it makes more sense if the configure.ac bit that checks for > BSD authentication checks if auth_userokay() exists, but this also > works. > - Of course the comment in the Makefile regarding implementing BSD auth > should be removed too if this ends up being committed. > > I still want to have a good look at Antoine's diff (which is here: > https://codeberg.org/OpenBSD/ports/commit/9959eb2a5fca247fb47814ea37706c9bb3cd87de > ) > to understand why an approach like this was tried earlier but reverted. > But if someone beats me to that, that's fine with me. In Antoine's > diff, it says: > XXX It should be possible to specify an authentication style by > appending it to the user's name with a single colon (`:') as a separator > but xscreensaver does not allow to modify username (yet?). > To me it's not clear if using BSD authentication with a patch like > this breaks existing functionality, or whether this is describing new > functionality. that describes a bsdauth feature (an example would be to choose an auth style which uses OTP if they default is to use a local password, or vice versa; you can do this by trying to login at the console or via ssh with user:style). but I don't really see how this would integrate with xscreensaver. so "possible new functionality if there's a way to integrate it". > Index: Makefile > =================================================================== > RCS file: /cvs/ports/x11/xscreensaver/Makefile,v > diff -u -p -r1.126 Makefile > --- Makefile 27 Oct 2026 06:43:30 -0000 1.126 > +++ Makefile 4 Nov 2026 17:31:44 -0000 > @@ -9,7 +9,7 @@ COMMENT= screen saver and locker for the > # Ideally this wants a bsdauth driver to be written, change to being > # installed setgid auth, and figure out any issues resulting. > DISTNAME= xscreensaver-6.15 > -REVISION= 2 > +REVISION= 3 > > CATEGORIES= x11 > > @@ -57,11 +57,14 @@ RUN_DEPENDS+= devel/xdg-utils > USE_GMAKE= Yes > NO_TEST= Yes > > -CONFIGURE_STYLE= gnu > +CONFIGURE_STYLE= autoconf > CONFIGURE_ARGS= --with-app-defaults="${PREFIX}/lib/X11/app-defaults" \ > --without-pam > CONFIGURE_ENV= CPPFLAGS="-I${LOCALBASE}/include" \ > LDFLAGS="-L${LOCALBASE}/lib" > + > +AUTOCONF_VERSION= 2.72 > +AUTOMAKE_VERSION= 1.16 > > FAKE_FLAGS= install_prefix=${WRKINST} > > Index: patches/patch-configure > =================================================================== > RCS file: patches/patch-configure > diff -N patches/patch-configure > --- patches/patch-configure 1 Apr 2026 09:56:19 -0000 1.30 > +++ /dev/null 1 Jan 1970 00:00:00 -0000 > @@ -1,65 +0,0 @@ > -- Fix path to /usr/local/share > - > -- Don't fail if unrecognised autoconf command-line flags are present > -(avoid problem with --disable-gtk-doc) > - > -- Permit building if security/openpam is installed. > - > -- Don't fail if pkg-config --list-all returns an error code. > - > -- gnome-open -> xdg-open > - > -- Don't pick up FFmpeg (just used for recanim, but linked into many binaries) > - > -Index: configure > ---- configure.orig > -+++ configure > -@@ -2823,11 +2823,6 @@ ac_config_headers="$ac_config_headers config.h" > - echo "current directory: `pwd`" > - echo "command line was: $0 $@" > - > --if ! test -z "$ac_unrecognized_opts" ; then > -- echo "" >&2 > -- exit 2 > --fi > -- > - > ############################################################################### > - # > - # Autoheader stuff > -@@ -14468,9 +14463,9 @@ fi > - > - # Check for the various Gnome help and URL loading programs. > - # > --WITH_BROWSER=gnome-open > -+WITH_BROWSER=xdg-open > - if test "$have_gtk" = yes; then > -- for ac_prog in gnome-open > -+ for ac_prog in xdg-open > - do > - # Extract the first word of "$ac_prog", so it can be a program name with > args. > - set dummy $ac_prog; ac_word=$2 > -@@ -19990,7 +19985,7 @@ fi > - fi > - > - have_ffmpeg=no > --if test "$have_avformat" = yes -a \ > -+if false && test "$have_avformat" = yes -a \ > - "$have_avcodec" = yes -a \ > - "$have_avutil" = yes -a \ > - "$have_swscale" = yes -a \ > -@@ -22124,7 +22119,6 @@ else > - warn2 "The errors are:" > - echo '' > - echo "$pkgerr" | sed 's/^/ > /g' > -- CONF_STATUS=1 > - fi > - fi > - > -@@ -22417,7 +22411,6 @@ elif test "$have_pam" = no -a "$enable_locking" = > yes > - if test -d /etc/pam.d -o -f /etc/pam.conf ; then > - warn "Your system seems to have PAM, but PAM is not being used." > - warn2 "That is probably not going to work out well." > -- CONF_STATUS=1 > - fi > - fi > - > Index: patches/patch-configure_ac > =================================================================== > RCS file: patches/patch-configure_ac > diff -N patches/patch-configure_ac > --- /dev/null 1 Jan 1970 00:00:00 -0000 > +++ patches/patch-configure_ac 4 Nov 2026 17:31:44 -0000 > @@ -0,0 +1,154 @@ > +- Fix path to /usr/local/share > + > +- Don't fail if unrecognised autoconf command-line flags are present > +(avoid problem with --disable-gtk-doc) > + > +- Permit building if security/openpam is installed. > + > +- Don't fail if pkg-config --list-all returns an error code. > + > +- gnome-open -> xdg-open > + > +- Don't pick up FFmpeg (just used for recanim, but linked into many binaries) > + > +diff -u configure.ac.orig configure.ac > +Index: configure.ac > +--- configure.ac.orig > ++++ configure.ac > +@@ -9,11 +9,6 @@ AC_CONFIG_HEADERS([config.h]) > + echo "current directory: `pwd`" > + echo "command line was: $0 $@" > + > +-if ! test -z "$ac_unrecognized_opts" ; then > +- echo "" >&2 > +- exit 2 > +-fi > +- > + > ############################################################################### > + # > + # Autoheader stuff > +@@ -232,6 +227,9 @@ AH_TEMPLATE([HAVE_SHADOW_PASSWD], > + AH_TEMPLATE([HAVE_PWNAM_SHADOW_PASSWD], > + [Define this if your system uses getpwnam_shadow.]) > + > ++AH_TEMPLATE([HAVE_BSDAUTH], > ++ [Define this if your system uses BSD Authentication system.]) > ++ > + AH_TEMPLATE([HAVE_ENHANCED_PASSWD], > + [Define this for DEC/SCO "Enhanced Security" with getprpwnam.]) > + > +@@ -2026,9 +2024,9 @@ fi > + > + # Check for the various Gnome help and URL loading programs. > + # > +-WITH_BROWSER=gnome-open > ++WITH_BROWSER=xdg-open > + if test "$have_wayland" = yes; then > +- AC_CHECK_PROGS(gnome_open_program, gnome-open) > ++ AC_CHECK_PROGS(gnome_open_program, xdg-open) > + AC_CHECK_PROGS(gnome_url_show_program, gnome-url-show) > + fi > + > +@@ -2439,7 +2437,7 @@ if test "$with_shadow" = yes ; then > + #include <unistd.h> > + #include <sys/types.h> > + #include <pwd.h>], > +- [struct spwd *p = getspnam_shadow("nobody"); > ++ [struct passwd *p = getpwnam_shadow("nobody"); > + const char *pw = p->pw_passwd;], > + [ac_cv_pwnam_shadow=yes], > + [ac_cv_pwnam_shadow=no])]) > +@@ -2520,8 +2518,44 @@ if test "$enable_locking" = yes -a "$have_pam" = no ; > + esac > + fi > + > ++############################################################################### > ++# > ++# Check for BSD Authentication system. > ++# > ++############################################################################### > ++have_bsdauth=no > ++with_bsdauth_req=unspecified > + > +-if test "$have_shadow_adjunct" = yes ; then > ++AC_ARG_WITH(bsdauth, > ++[ --with-bsdauth Include support for BSD Authentication system.], > ++ [with_bsdauth="$withval"; with_bsdauth_req="$withval"],[with_bsdauth=yes]) > ++ > ++HANDLE_X_PATH_ARG(with_bsdauth, --with-bsdauth, BSD Authentication system) > ++ > ++if test "$enable_locking" = no ; then > ++ with_bsdauth_req=no > ++ with_bsdauth=no > ++fi > ++ > ++if test "$with_bsdauth" = yes ; then > ++ AC_CACHE_CHECK([for BSD Authentication system], ac_cv_bsdauth, > ++ [AC_TRY_X_COMPILE([#include <stdlib.h> > ++ #include <unistd.h> > ++ #include <sys/types.h> > ++ #include <login_cap.h> > ++ #include <bsd_auth.h>], > ++ [auth_session_t *as = auth_open(); > ++ auth_close(as);], > ++ [ac_cv_bsdauth=yes], > ++ [ac_cv_bsdauth=no])]) > ++ if test "$ac_cv_bsdauth" = yes; then > ++ have_bsdauth=yes > ++ fi > ++fi > ++ > ++if test "$have_bsdauth" = yes ; then > ++ AC_DEFINE(HAVE_BSDAUTH) > ++elif test "$have_shadow_adjunct" = yes ; then > + AC_DEFINE(HAVE_ADJUNCT_PASSWD) > + elif test "$have_shadow_enhanced" = yes ; then > + AC_DEFINE(HAVE_ENHANCED_PASSWD) > +@@ -2625,9 +2659,9 @@ fi > + > + # Check for the various Gnome help and URL loading programs. > + # > +-WITH_BROWSER=gnome-open > ++WITH_BROWSER=xdg-open > + if test "$have_gtk" = yes; then > +- AC_CHECK_PROGS(gnome_open_program, gnome-open) > ++ AC_CHECK_PROGS(gnome_open_program, xdg-open) > + AC_CHECK_PROGS(gnome_url_show_program, gnome-url-show) > + fi > + > +@@ -3934,7 +3968,7 @@ fi > + > + > + have_ffmpeg=no > +-if test "$have_avformat" = yes -a \ > ++if false && test "$have_avformat" = yes -a \ > + "$have_avcodec" = yes -a \ > + "$have_avutil" = yes -a \ > + "$have_swscale" = yes -a \ > +@@ -4127,6 +4161,10 @@ if test "$have_pam" = yes; then > + PASSWD_OBJS="$PASSWD_OBJS \$(PAM_OBJS)" > + INSTALL_PAM="install-pam" > + fi > ++if test "$have_bsdauth" = yes; then > ++ PASSWD_SRCS="$PASSWD_SRCS \$(BSDAUTH_SRCS)" > ++ PASSWD_OBJS="$PASSWD_OBJS \$(BSDAUTH_OBJS)" > ++fi > + PASSWD_SRCS="$PASSWD_SRCS \$(PWENT_SRCS)" > + PASSWD_OBJS="$PASSWD_OBJS \$(PWENT_OBJS)" > + > +@@ -4489,7 +4527,6 @@ else > + warn2 "The errors are:" > + echo '' > + echo "$pkgerr" | sed 's/^/ > /g' > +- CONF_STATUS=1 > + fi > + fi > + > +@@ -4793,7 +4830,6 @@ elif test "$have_pam" = no -a "$enable_locking" = yes > + if test -d /etc/pam.d -o -f /etc/pam.conf ; then > + warn "Your system seems to have PAM, but PAM is not being used." > + warn2 "That is probably not going to work out well." > +- CONF_STATUS=1 > + fi > + fi > + > Index: patches/patch-driver_Makefile_in > =================================================================== > RCS file: patches/patch-driver_Makefile_in > diff -N patches/patch-driver_Makefile_in > --- /dev/null 1 Jan 1970 00:00:00 -0000 > +++ patches/patch-driver_Makefile_in 4 Nov 2026 17:31:44 -0000 > @@ -0,0 +1,41 @@ > +Index: driver/Makefile.in > +--- driver/Makefile.in.orig > ++++ driver/Makefile.in > +@@ -195,6 +195,9 @@ GFX_LIBS = $(LIBS_PRE) $(XFT_LIBS) $(XDPMS_LIBS) $(XIN > + PWENT_SRCS = passwd-pwent.c > + PWENT_OBJS = passwd-pwent.o > + > ++BSDAUTH_SRCS = passwd-bsdauth.c > ++BSDAUTH_OBJS = passwd-bsdauth.o > ++ > + KERBEROS_SRCS = passwd-kerberos.c > + KERBEROS_OBJS = passwd-kerberos.o > + > +@@ -308,7 +311,7 @@ EXTRAS = README Makefile.in \ > + > + TARFILES = $(DAEMON_SRCS) $(GFX_SRCS) $(AUTH_SRCS) $(SYSTEMD_SRCS) \ > + $(CMD_SRCS) $(GTK_SRCS) $(MOTIF_SRCS) $(PWENT_SRCS) \ > +- $(KERBEROS_SRCS) $(PAM_SRCS) \ > ++ $(KERBEROS_SRCS) $(BSDAUTH_SRCS) $(PAM_SRCS) \ > + $(WAYLAND_GEN_SRCS) \ > + $(HDRS) $(MENA) $(MENB) $(TEST_SRCS) $(EXTRAS) > + > +@@ -703,7 +706,7 @@ depend: XScreenSaver_ad.h XScreenSaver_Xm_ad.h > + $(INCLUDES_1) $(DEFS) $(DEPEND_DEFINES) $(CFLAGS) $(X_CFLAGS) -- \ > + $(DAEMON_SRCS) $(GFX_SRCS) $(AUTH_SRCS) $(SYSTEMD_SRCS) $(CMD_SRCS) \ > + $(GTK_SRCS) $(MOTIF_SRCS) $(PWENT_SRCS) $(KERBEROS_SRCS) \ > +- $(PAM_SRCS) $(WAYLAND_GEN_SRCS) $(TEST_SRCS) > ++ $(BSDAUTH_SRCS) $(PAM_SRCS) $(WAYLAND_GEN_SRCS) $(TEST_SRCS) > + > + # Adds some dependencies to Makefile.in -- not totally accurate, but pretty > + # close. This excludes dependencies on files in /usr/include, etc. It > tries > +@@ -1239,6 +1242,9 @@ fade.o: $(UTILS_SRC)/visual.h > + fade.o: $(UTILS_SRC)/xmu.h > + fade.o: $(UTILS_SRC)/xshm.h > + fade.o: $(srcdir)/xinput.h > ++passwd-bsdauth.o: $(srcdir)/auth.h > ++passwd-bsdauth.o: ../config.h > ++passwd-bsdauth.o: $(UTILS_SRC)/blurb.h > + passwd-kerberos.o: $(srcdir)/auth.h > + passwd-kerberos.o: ../config.h > + passwd-kerberos.o: $(UTILS_SRC)/blurb.h > Index: patches/patch-driver_auth_h > =================================================================== > RCS file: patches/patch-driver_auth_h > diff -N patches/patch-driver_auth_h > --- /dev/null 1 Jan 1970 00:00:00 -0000 > +++ patches/patch-driver_auth_h 4 Nov 2026 17:31:44 -0000 > @@ -0,0 +1,14 @@ > +Index: driver/auth.h > +--- driver/auth.h.orig > ++++ driver/auth.h > +@@ -61,6 +61,10 @@ extern Bool kerberos_lock_init (void); > + extern Bool kerberos_passwd_valid_p (void *closure, const char *plaintext); > + #endif > + > ++#ifdef HAVE_BSDAUTH > ++extern Bool bsdauth_passwd_valid_p (void *closure, const char *plaintext); > ++#endif > ++ > + #ifdef HAVE_PAM > + extern Bool pam_priv_init (void); > + extern Bool pam_try_unlock (void *closure, > Index: patches/patch-driver_passwd-bsdauth_c > =================================================================== > RCS file: patches/patch-driver_passwd-bsdauth_c > diff -N patches/patch-driver_passwd-bsdauth_c > --- /dev/null 1 Jan 1970 00:00:00 -0000 > +++ patches/patch-driver_passwd-bsdauth_c 4 Nov 2026 17:31:44 -0000 > @@ -0,0 +1,73 @@ > +Index: driver/passwd-bsdauth.c > +--- driver/passwd-bsdauth.c.orig > ++++ driver/passwd-bsdauth.c > +@@ -0,0 +1,69 @@ > ++/* passwd-bsdauth.c --- verifying typed passwords with the BSD > ++ * Authentication system. > ++ * xscreensaver, Copyright © 1993-2022 Jamie Zawinski <[email protected]> > ++ * > ++ * Permission to use, copy, modify, distribute, and sell this software and > its > ++ * documentation for any purpose is hereby granted without fee, provided > that > ++ * the above copyright notice appear in all copies and that both that > ++ * copyright notice and this permission notice appear in supporting > ++ * documentation. No representations are made about the suitability of this > ++ * software for any purpose. It is provided "as is" without express or > ++ * implied warranty. > ++ */ > ++ > ++#ifdef HAVE_CONFIG_H > ++# include "config.h" > ++#endif > ++ > ++#ifndef NO_LOCKING /* whole file */ > ++ > ++#include <stdlib.h> > ++#ifdef HAVE_UNISTD_H > ++# include <unistd.h> > ++#endif > ++ > ++#include <stdio.h> > ++#include <string.h> > ++#include <sys/types.h> > ++#include <pwd.h> > ++#include <login_cap.h> > ++#include <bsd_auth.h> > ++ > ++#ifdef __bsdi__ > ++# include <sys/param.h> > ++# if _BSDI_VERSION >= 199608 > ++# define BSD_AUTH > ++# endif > ++#endif /* __bsdi__ */ > ++ > ++ > ++#include "blurb.h" > ++#include "auth.h" > ++ > ++/* This can be called at any time, and says whether the typed password > ++ belongs to either the logged in user (real uid, not effective); or > ++ to root. > ++ */ > ++Bool > ++bsdauth_passwd_valid_p (void *closure, const char *typed_passwd) > ++{ > ++ struct passwd *p = getpwuid (getuid ()); > ++ char *pass = strdup (typed_passwd); > ++ > ++ if (p && auth_userokay (p->pw_name, NULL, NULL, pass)) > ++ return True; > ++ > ++#ifdef ALLOW_ROOT_PASSWD > ++ /* 'pass' was nuked by the previous auth_userokay call */ > ++ else if ((pass = strdup (typed_passwd)) && > ++ auth_userokay ("root", NULL, NULL, pass)) > ++ return True; > ++#endif /* ALLOW_ROOT_PASSWD */ > ++ > ++ else > ++ return False; > ++} > ++ > ++#else /* NO_LOCKING */ > ++int _ignore_; > ++#endif /* NO_LOCKING -- whole file */ > Index: patches/patch-driver_passwd_c > =================================================================== > RCS file: patches/patch-driver_passwd_c > diff -N patches/patch-driver_passwd_c > --- /dev/null 1 Jan 1970 00:00:00 -0000 > +++ patches/patch-driver_passwd_c 4 Nov 2026 17:31:44 -0000 > @@ -0,0 +1,13 @@ > +Index: driver/passwd.c > +--- driver/passwd.c.orig > ++++ driver/passwd.c > +@@ -92,6 +92,9 @@ struct auth_methods methods[] = { > + # ifdef HAVE_KERBEROS > + { "KRB", kerberos_lock_init, 0, kerberos_passwd_valid_p, 0, }, > + # endif > ++# ifdef HAVE_BSDAUTH > ++ { "BSD", 0, 0, bsdauth_passwd_valid_p, 0, }, > ++# endif > + # ifdef PASSWD_HELPER_PROGRAM > + { "EXT", 0, ext_priv_init, ext_passwd_valid_p, 0, }, > + # endif > Index: patches/patch-driver_xscreensaver-auth_c > =================================================================== > RCS file: > /cvs/ports/x11/xscreensaver/patches/patch-driver_xscreensaver-auth_c,v > diff -u -p -r1.1 patch-driver_xscreensaver-auth_c > --- patches/patch-driver_xscreensaver-auth_c 27 Oct 2026 06:43:30 -0000 > 1.1 > +++ patches/patch-driver_xscreensaver-auth_c 4 Nov 2026 17:31:44 -0000 > @@ -1,3 +1,4 @@ > +diff -u driver/xscreensaver-auth.c.orig driver/xscreensaver-auth.c > Index: driver/xscreensaver-auth.c > --- driver/xscreensaver-auth.c.orig > +++ driver/xscreensaver-auth.c > @@ -6,8 +7,20 @@ Index: driver/xscreensaver-auth.c > #include "auth.h" > > +/* OpenBSD: set[ug]id binary MUST say so in this var */ > -+mode_t _permit_setugid = S_ISUID; > ++mode_t _permit_setugid = S_ISGID; > + > #ifdef __GNUC__ > __extension__ /* shut up about "string length is greater than the > length > ISO C89 compilers are required to support" when > including > +@@ -340,7 +343,11 @@ main (int argc, char **argv) > + if (!splash_p && !init_p) > + lock_priv_init (); > + > ++ /* I have not found a way to drop privileges and have access to > ++ bsdauth at least on OpenBSD. */ > ++#if !defined(HAVE_BSDAUTH) || !defined(__OpenBSD__) > + disavow_privileges (); > ++#endif > + > + if (!splash_p && !init_p) > + lock_init (); > Index: pkg/PLIST > =================================================================== > RCS file: /cvs/ports/x11/xscreensaver/pkg/PLIST,v > diff -u -p -r1.60 PLIST > --- pkg/PLIST 17 Apr 2026 15:14:06 -0000 1.60 > +++ pkg/PLIST 4 Nov 2026 17:31:44 -0000 > @@ -293,6 +293,7 @@ libexec/xscreensaver/webcollage > @bin libexec/xscreensaver/whirlwindwarp > @bin libexec/xscreensaver/winduprobot > @comment SEGV in xft_word_wrap during run @bin > libexec/xscreensaver/worldpieces > +@bin libexec/xscreensaver/worldpieces > @bin libexec/xscreensaver/wormhole > @bin libexec/xscreensaver/xanalogtv > @bin libexec/xscreensaver/xflame > @@ -300,9 +301,11 @@ libexec/xscreensaver/webcollage > @bin libexec/xscreensaver/xlyap > @bin libexec/xscreensaver/xmatrix > @bin libexec/xscreensaver/xrayswarm > -@mode 4755 > +@mode g+s > +@group auth > @bin libexec/xscreensaver/xscreensaver-auth > @mode > +@group > @bin libexec/xscreensaver/xscreensaver-getimage > libexec/xscreensaver/xscreensaver-getimage-file > libexec/xscreensaver/xscreensaver-getimage-video >
