From 379778c385091a93dc412c4876f22cd618e3789f Mon Sep 17 00:00:00 2001 From: Eelco Dolstra Date: Sun, 13 Sep 2009 14:05:21 +0000 Subject: [PATCH] * For X logins, don't use pam_ck_connector since it doesn't really work for X logins. (The documentation also says so.) Instead just call ck-launch-session from the xsession script. svn path=/nixos/trunk/; revision=17090 --- modules/security/pam.nix | 36 +++++++------------ .../services/x11/display-managers/default.nix | 6 ++++ modules/services/x11/display-managers/kdm.nix | 2 +- .../services/x11/display-managers/slim.nix | 2 +- 4 files changed, 20 insertions(+), 26 deletions(-) diff --git a/modules/security/pam.nix b/modules/security/pam.nix index 9be1bad0668..977ff0ae549 100644 --- a/modules/security/pam.nix +++ b/modules/security/pam.nix @@ -26,11 +26,9 @@ let , # If set, root doesn't need to authenticate (e.g. for the "chsh" # service). rootOK ? false - , # If set, this is a local login (e.g. virtual console or X), so - # the user gets ownership of audio devices etc. - localLogin ? false - , # Temporary hack to get SLiM to work with ConsoleKit. - ckHack ? false + , # If set, use ConsoleKit's PAM connector module to claim + # ownership of audio devices etc. + ownDevices ? false , # Whether to forward XAuth keys between users. Mostly useful # for "su". forwardXAuth ? false @@ -65,9 +63,7 @@ let ${optionalString config.users.ldap.enable "session optional ${pam_ldap}/lib/security/pam_ldap.so"} session required ${pam_unix2}/lib/security/pam_unix2.so - ${optionalString ckHack - "session required pam_env.so debug conffile=${envFile} readenv=0"} - ${optionalString localLogin + ${optionalString ownDevices "session optional ${pkgs.console_kit}/lib/security/pam_ck_connector.so"} ${optionalString forwardXAuth "session optional pam_xauth.so xauthpath=${pkgs.xorg.xauth}/bin/xauth systemuser=99"} @@ -75,14 +71,6 @@ let target = "pam.d/${name}"; }; - # This is needed to get an active session in ConsoleKit. Apparently - # a better way is to run ck-launch-session from the session starter - # (or let xdm/kdm do it). - envFile = pkgs.writeText "pam_env.conf" - '' - CKCON_X11_DISPLAY_DEVICE DEFAULT="/dev/tty7" - ''; - in { @@ -104,13 +92,13 @@ in the name of the service. The attribute rootOK specifies whether the root user is allowed to use this service without authentication. The - attribute localLogin specifies whether - this is a local login service (e.g. xdm), - which implies that the user gets ownership of devices such - as audio and CD-ROM drives. The - attribute forwardXAuth specifies whether - X authentication keys should be passed from the calling user - to the target user (e.g. for su). + attribute ownDevices specifies whether + ConsoleKit's PAM connector module should be used to give the + user ownership of devices such as audio and CD-ROM drives. + The attribute forwardXAuth specifies + whether X authentication keys should be passed from the + calling user to the target user (e.g. for + su). ''; }; @@ -151,7 +139,7 @@ in { name = "useradd"; rootOK = true; } # Used by groupadd etc. { name = "shadow"; rootOK = true; } - { name = "login"; localLogin = true; } + { name = "login"; ownDevices = true; } ]; }; diff --git a/modules/services/x11/display-managers/default.nix b/modules/services/x11/display-managers/default.nix index 0343c6ae766..1649f2922c0 100644 --- a/modules/services/x11/display-managers/default.nix +++ b/modules/services/x11/display-managers/default.nix @@ -43,6 +43,12 @@ let fi ''} + # Start a ConsoleKit session so that we get ownership of various + # devices. + if test -z "$XDG_SESSION_COOKIE"; then + exec ${pkgs.console_kit}/bin/ck-launch-session "$0" "$sessionType" + fi + # Load X defaults. if test -e ~/.Xdefaults; then ${xorg.xrdb}/bin/xrdb -merge ~/.Xdefaults diff --git a/modules/services/x11/display-managers/kdm.nix b/modules/services/x11/display-managers/kdm.nix index c58b4867967..8f7a5b5b3fe 100644 --- a/modules/services/x11/display-managers/kdm.nix +++ b/modules/services/x11/display-managers/kdm.nix @@ -80,7 +80,7 @@ in logsXsession = true; }; - security.pam.services = [ { name = "kde"; localLogin = true; ckHack = true; } ]; + security.pam.services = [ { name = "kde"; } ]; }; diff --git a/modules/services/x11/display-managers/slim.nix b/modules/services/x11/display-managers/slim.nix index f8985f36b52..2f1e8c8e21a 100644 --- a/modules/services/x11/display-managers/slim.nix +++ b/modules/services/x11/display-managers/slim.nix @@ -104,7 +104,7 @@ in execCmd = "${pkgs.slim}/bin/slim"; }; - security.pam.services = [ { name = "slim"; localLogin = true; ckHack = true; } ]; + security.pam.services = [ { name = "slim"; } ]; };