Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix Fedora Polkit #687

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Conversation

EmixamPP
Copy link
Contributor

@EmixamPP EmixamPP commented Jul 15, 2022

This is a fix for the issue #630

If think that on Fedora, polkit detect that the subprocess compare.py is created and to avoid security issue it is killed.
However, if we run this subprocess through a shell instance, this is no more a problem.
So this fix is not really clean, but it works.

In order to provide a proper solution, I think we need to investigate polkit to create a policy or something like that. But personally, I don't know anything about it, and this seems complex. It is also possible that there is no such thing and that it is simply a bug.


I made the modification from the tag of the current version of Howdy: v2.6.1.

In order to provide this fix for Fedora users we have several choices:

  • An official version of Howdy 2.6.2 is created
  • The Fedora's repo maintainer creates a "hot fix", but we keep the v2.6.1 tag as source. The version on Fedora would become 2.6.1-7 (currently 2.6.1-6)
  • I create a tag on the fedora-polkit branch of my fork, which is temporarily used as source. The version on Fedora would become 2.6.1-7
  • We do nothing for Fedora at the moment, and we wait for the next official release, the v3.0.0, which rewrites the pam module in C++

@EmixamPP
Copy link
Contributor Author

@principis What do you think of that?

@validatedev
Copy link

Works flawlessly, can confirm from Fedora 36. Thanks so much!

@mikecharles
Copy link

So, do I only need to modify /lib64/security/howdy/pam.py? Do I have to restart or do anything else for this to start working?

@EmixamPP
Copy link
Contributor Author

Yes, just change the line 44 of /lib64/security/howdy/pam.py with this one :

status = subprocess.call(["/usr/bin/python3 " + os.path.dirname(os.path.abspath(__file__)) + "/compare.py " + pamh.get_user() + " &> /dev/null"], shell=True)

@Okazakee
Copy link

Okazakee commented Feb 1, 2023

this is fantastic, thanks, +1 for merging or copr repo hotfix

@wheelerlaw
Copy link

wheelerlaw commented Feb 14, 2023

I can confirm that this also worked for my installation.

@principis
Copy link
Contributor

I'll add this in the copr repo.

@wheelerlaw
Copy link

Is polkit exclusive to Fedora, or is it a Gnome thing?

@boltgolt
Copy link
Owner

The next release of Howdy will completely remove pam.py to move over to a compiled pam_howdy.so and drop the dependency on pam-python. This file is now gone on the beta branch. Is it worth merging this into master still?

@EmixamPP
Copy link
Contributor Author

@wheelerlaw A Gnome thing

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

7 participants