https://bugzilla.redhat.com/show_bug.cgi?id=1283296 --- Comment #1 from Seth Jennings <spartacus06(a)gmail.com&gt; --- Created attachment 1096146 --> https://bugzilla.redhat.com/attachment.cgi?id=1096146&action=edit fedora-review -- You are receiving this mail because: You are on the CC list for the bug. You are always notified about changes to this product and component

https://bugzilla.redhat.com/show_bug.cgi?id=1283296 Till Maas <opensource(a)till.name&gt; changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |opensource(a)till.name --- Comment #3 from Till Maas <opensource(a)till.name&gt; --- - There is a typo in the description for pamu2fcfg: "too" instead of "tool" -- You are receiving this mail because: You are on the CC list for the bug. You are always notified about changes to this product and component

https://bugzilla.redhat.com/show_bug.cgi?id=1283296 Zbigniew Jędrzejewski-Szmek <zbyszek(a)in.waw.pl&gt; changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |zbyszek(a)in.waw.pl --- Comment #5 from Zbigniew Jędrzejewski-Szmek <zbyszek(a)in.waw.pl&gt; --- find -exec rm -f {} ';' can be replaced with find -delete. It is nice to put BuildRequires/Requires each on a separate line. %description should end in a dot. The module should not Require pam: it is a plugin for pam. It already has an automatically generated dependency on libpam.so, and that is enough. Other pam modules do not Require pam. Where can the environment variable DEFAULT_AUTHFILE_DIR_VAR come from? I didn't look at pamu2fcfg, but the code of the pam module appears to be carefully written, looks correct. -- You are receiving this mail because: You are on the CC list for the bug. You are always notified about changes to this product and component

https://bugzilla.redhat.com/show_bug.cgi?id=1283296 --- Comment #7 from Zbigniew Jędrzejewski-Szmek <zbyszek(a)in.waw.pl&gt; --- So, this module uses a number of environment variables ($DEFAULT_AUTHFILE_DIR_VAR, $XDG_CONFIG_HOME at least). To try it out, I added "auth require pam_u2f.so debug origin=pam://$HOSTNAME appid=pam://$HOSTNAME" as the first line in /etc/pam.d/su-l, and then I run: $ su - [pam-u2f.c:parse_cfg(48)] called. [pam-u2f.c:parse_cfg(49)] flags 0 argc 3 [pam-u2f.c:parse_cfg(51)] argv[0]=debug [pam-u2f.c:parse_cfg(51)] argv[1]=origin=pam://$HOSTNAME [pam-u2f.c:parse_cfg(51)] argv[2]=appid=pam://$HOSTNAME [pam-u2f.c:parse_cfg(52)] max_devices=0 [pam-u2f.c:parse_cfg(53)] debug=1 [pam-u2f.c:parse_cfg(54)] interactive=0 [pam-u2f.c:parse_cfg(55)] cue=0 [pam-u2f.c:parse_cfg(56)] manual=0 [pam-u2f.c:parse_cfg(57)] nouserok=0 [pam-u2f.c:parse_cfg(58)] alwaysok=0 [pam-u2f.c:parse_cfg(59)] authfile=(null) [pam-u2f.c:parse_cfg(60)] origin=pam://$HOSTNAME [pam-u2f.c:parse_cfg(61)] appid=pam://$HOSTNAME [pam-u2f.c:pam_sm_authenticate(124)] Maximum devices number not set. Using default (24) [pam-u2f.c:pam_sm_authenticate(142)] Requesting authentication for user root [pam-u2f.c:pam_sm_authenticate(153)] Found user root [pam-u2f.c:pam_sm_authenticate(154)] Home directory for root is /root [pam-u2f.c:pam_sm_authenticate(161)] Variable XDG_CONFIG_HOME is not set. Using default value ($HOME/.config/) [pam-u2f.c:pam_sm_authenticate(193)] Using default authentication file /root/.config/Yubico/u2f_keys [util.c:get_devices_from_authfile(34)] Cannot open file: /root/.config/Yubico/u2f_keys (No such file or directory) [pam-u2f.c:pam_sm_authenticate(211)] Unable to get devices from file /root/.config/Yubico/u2f_keys [pam-u2f.c:pam_sm_authenticate(259)] done. [Authentication service cannot retrieve authentication info] Password: Question: I'd expect the auth process to fail, since "require" is used. In the logs I see: Dec 06 19:38:28 rawhide su[9137]: PAM pam_parse: expecting return value; [...require] Looks like an error in the module. Then I run: $ XDG_CONFIG_HOME=/home/test su - [pam-u2f.c:parse_cfg(48)] called. [pam-u2f.c:parse_cfg(49)] flags 0 argc 3 [pam-u2f.c:parse_cfg(51)] argv[0]=debug [pam-u2f.c:parse_cfg(51)] argv[1]=origin=pam://$HOSTNAME [pam-u2f.c:parse_cfg(51)] argv[2]=appid=pam://$HOSTNAME [pam-u2f.c:parse_cfg(52)] max_devices=0 [pam-u2f.c:parse_cfg(53)] debug=1 [pam-u2f.c:parse_cfg(54)] interactive=0 [pam-u2f.c:parse_cfg(55)] cue=0 [pam-u2f.c:parse_cfg(56)] manual=0 [pam-u2f.c:parse_cfg(57)] nouserok=0 [pam-u2f.c:parse_cfg(58)] alwaysok=0 [pam-u2f.c:parse_cfg(59)] authfile=(null) [pam-u2f.c:parse_cfg(60)] origin=pam://$HOSTNAME [pam-u2f.c:parse_cfg(61)] appid=pam://$HOSTNAME [pam-u2f.c:pam_sm_authenticate(124)] Maximum devices number not set. Using default (24) [pam-u2f.c:pam_sm_authenticate(142)] Requesting authentication for user root [pam-u2f.c:pam_sm_authenticate(153)] Found user root [pam-u2f.c:pam_sm_authenticate(154)] Home directory for root is /root [pam-u2f.c:pam_sm_authenticate(178)] Variable XDG_CONFIG_HOME set to /home/test [pam-u2f.c:pam_sm_authenticate(193)] Using default authentication file /home/test/Yubico/u2f_keys [util.c:get_devices_from_authfile(34)] Cannot open file: /home/test/Yubico/u2f_keys (No such file or directory) [pam-u2f.c:pam_sm_authenticate(211)] Unable to get devices from file /home/test/Yubico/u2f_keys [pam-u2f.c:pam_sm_authenticate(259)] done. [Authentication service cannot retrieve authentication info] Password: As you can see, "Requesting authentication for user root", but it's happy to read configuration from a user specified file. This doesn't seem right. -- You are receiving this mail because: You are on the CC list for the bug. You are always notified about changes to this product and component

https://bugzilla.redhat.com/show_bug.cgi?id=1283296 Zbigniew Jędrzejewski-Szmek <zbyszek(a)in.waw.pl&gt; changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED Assignee|nobody(a)fedoraproject.org |zbyszek(a)in.waw.pl Flags| |fedora-review? --- Comment #9 from Zbigniew Jędrzejewski-Szmek <zbyszek(a)in.waw.pl&gt; --- It seems that the issue has been patched upstream. Can you prepare an updated srpm with the patches? -- You are receiving this mail because: You are on the CC list for the bug. You are always notified about changes to this product and component

https://bugzilla.redhat.com/show_bug.cgi?id=1283296 --- Comment #11 from Seth Jennings <spartacus06(a)gmail.com&gt; --- Updated with upstream patches Spec URL: https://www.variantweb.net/pub/review/pam-u2f.spec SRPM URL: https://www.variantweb.net/pub/review/pam-u2f-1.0.3-4.fc23.src.rpm -- You are receiving this mail because: You are on the CC list for the bug. You are always notified about changes to this product and component

https://bugzilla.redhat.com/show_bug.cgi?id=1283296 Zbigniew Jędrzejewski-Szmek <zbyszek(a)in.waw.pl&gt; changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |POST -- You are receiving this mail because: You are on the CC list for the bug. You are always notified about changes to this product and component

https://bugzilla.redhat.com/show_bug.cgi?id=1283296 --- Comment #14 from Fedora Update System <updates(a)fedoraproject.org&gt; --- pam-u2f-1.0.3-5.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2016-f047c98286 -- You are receiving this mail because: You are on the CC list for the bug. You are always notified about changes to this product and component

https://bugzilla.redhat.com/show_bug.cgi?id=1283296 Fedora Update System <updates(a)fedoraproject.org&gt; changed: What |Removed |Added ---------------------------------------------------------------------------- Status|MODIFIED |ON_QA --- Comment #15 from Fedora Update System <updates(a)fedoraproject.org&gt; --- pam-u2f-1.0.3-5.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-f047c98286 -- You are receiving this mail because: You are on the CC list for the bug. You are always notified about changes to this product and component

https://bugzilla.redhat.com/show_bug.cgi?id=1283296 --- Comment #17 from Seth Jennings <spartacus06(a)gmail.com&gt; --- Sorry for the delayed reply. (In reply to Georg Sauthoff from comment #16) Yes, a Fedora README would be a good idea. I didn't try to use it for console logins so it seems there is an selinux policy issue there. I'll check it out. Thanks for the testing! -- You are receiving this mail because: You are on the CC list for the bug. You are always notified about changes to this product and component

https://bugzilla.redhat.com/show_bug.cgi?id=1283296 Seth Jennings <sjenning(a)redhat.com&gt; changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |sjenning(a)redhat.com --- Comment #19 from Seth Jennings <sjenning(a)redhat.com&gt; --- Fred, the package is already in the repos. The selinux issue is still outstanding. -- You are receiving this mail because: You are on the CC list for the bug. You are always notified about changes to this product and component

https://bugzilla.redhat.com/show_bug.cgi?id=1283296 Fedora Update System <updates(a)fedoraproject.org&gt; changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA Last Closed| |2016-05-04 14:54:23 -- You are receiving this mail because: You are on the CC list for the bug. You are always notified about changes to this product and component

https://bugzilla.redhat.com/show_bug.cgi?id=1283296 --- Comment #22 from Seth Jennings <sjenning(a)redhat.com&gt; --- Wow, so I've slacked off on this package like crazy! Apologies. I'm opening new bugs to track the issues raised, since this bug is closed. Was able to recreate the selinux issue. Opened this bug against selinux-policy: https://bugzilla.redhat.com/show_bug.cgi?id=1377451 FYI, full type enforcement needed is: module my-login 1.0; require { type local_login_t; type udev_var_run_t; class file { getattr open read }; } #============= local_login_t ============== allow local_login_t udev_var_run_t:file { getattr open read }; Re: env vars issue, the upstream issue is closed and seems to be address by 1.0.4. Just need to update the package to that version. Opening a bug to track for bodhi purposes: https://bugzilla.redhat.com/show_bug.cgi?id=1377455 Re: README https://bugzilla.redhat.com/show_bug.cgi?id=1377459 -- You are receiving this mail because: You are on the CC list for the bug. You are always notified about changes to this product and component