Skip to content

Commit

Permalink
pam_fscrypt/config: prioritise over other session modules
Browse files Browse the repository at this point in the history
Services launched by systemd user sessions on Debian / Ubuntu systems
are often not able to access the home directory, because there is no
guarantee / requirement that pam_fscrypt is sequenced before
pam_systemd.

Although this pam-config mechanism is Debian-specific, the config file
is provided here upstream and unmodified in Debian. Raising the
priority here so that it's always ordered ahead of pam_systemd will
solve issues such as google#270,
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=964951 and
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1889416.

After a survey of pam-config files available in Debian bullseye, the
value of 100 was chosen as it appears after most other plugins that
could be involved in more explicit homedir configuration (eg pam_mount
at 128) but before those which seem unlikely to work without a home
directory (eg pam_ssh at 64).
  • Loading branch information
ramcq committed Mar 3, 2021
1 parent 7fa623a commit 315dab2
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion pam_fscrypt/config
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
Name: fscrypt PAM passphrase support
Default: yes
Priority: 0
Priority: 100
Auth-Type: Additional
Auth-Final:
optional PAM_INSTALL_PATH
Expand Down

0 comments on commit 315dab2

Please sign in to comment.