Skip to content

pamhelper does not cancel authentication and exit immediately on SIGTERM #452

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
AsakuraMizu opened this issue Jan 18, 2024 · 0 comments
Closed

Comments

@AsakuraMizu
Copy link

Distribution

Arch Linux

Package version

6.0.2

Graphics hardware in use

No response

Frequency

Always

Bug description

cinnamon-screensaver-pam-helper should immediately cancel the authentication and exit on receiving SIGTERM. But it seems to authenticate once more with empty input which must fail (see the log below).

Actually I'm encountering with #412 that my account will be locked randomly. After digging into source code I figured out every entry in faillock's log corresponds to a call on AuthClient.cancel, which send SIGTERM to pamhelper.

Steps to reproduce

Run pamhelper:

$ cinnamon-screensaver-pam-helper --debug
cinnamon-screensaver-pam-helper (pid 25632): start
cs-auth-pam (pid 25632): pam_start ("cinnamon-screensaver", "USER", ...) ==> 0 (Success)
Handling message style 1: 'Password: '
cs-auth-pam (pid 25632): Waiting for respose to message style 1: 'Password: '
Waiting for lock
Waiting for response
cinnamon-screensaver-pam-helper: Got message style 1: 'Password: '
CS_PAM_AUTH_SET_PROMPT_Password: _
CS_PAM_AUTH_BUSY_FALSE

In another terminal, send SIGTERM to it:

$ killall -TERM cinnamon-screensaver-pam-helper

And log of pamhelper after that:

cinnamon-screensaver-pam-helper (pid 25632): SIGTERM, shutting down
cinnamon-screensaver-pam-helper: auth_message_handler processing response string
cinnamon-screensaver-pam-helper: Got no response
cinnamon-screensaver-pam-helper: stdin_monitor_task_finished (Cancelled: 1)
cinnamon-screensaver-pam-helper (pid 25632): shutting down.
should interrupt: 1
Got response
cs-auth-pam (pid 25632): Got respose to message style 1: interrupt:1
Msg handler returned 0
   pam_authenticate (...) ==> 20 (Authentication token manipulation error)
 pam_end (...) ==> 0 (Success)
cinnamon-screensaver-pam-helper: Verify user returned: FALSE
CS_PAM_AUTH_FAILURE
cinnamon-screensaver-pam-helper: Authentication failed, retrying (1)
cinnamon-screensaver-pam-helper: exit

Check faillock:

USER:
When                Type  Source                                           Valid
2024-01-18 14:57:35 TTY   :0                                                   V

To reproduce the original issue: Move your mouse or sth like that to enter UnlockDialog and then press ESC or wait 30 sec (timeout) to exit. You will find an added entry in faillock.

Expected behavior

pamhelper should exit immediately and do no extra work on SIGTERM. Actually if kill it with SIGINT etc you can bypass sigterm handler and let it work as expected (?)

Additional information

No response

@AsakuraMizu AsakuraMizu closed this as not planned Won't fix, can't repro, duplicate, stale Jan 23, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant