From 4f0d635eacb6400451ac447a3ae104f2fed1932f Mon Sep 17 00:00:00 2001 From: rewine Date: Wed, 14 Oct 2026 18:37:16 +0800 Subject: [PATCH] feat: add pam_deepin_keyring support to PAM services MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 1. Add pam_deepin_keyring to auth and session stacks in ddm.pam 2. Add pam_deepin_keyring to auth and session stacks in debian.ddm.pam 3. Add pam_deepin_keyring to ddm-autologin.pam for passwordless login 4. Recommend deepin-keyring-whitebox package in debian/control Log: No user-facing changes Influence: 1. Verify normal password login unlocks the keyring without error 2. Verify autologin and nopasswdlogin unlock the keyring seamlessly 3. Verify login still works when deepin-keyring-whitebox is not installed feat: 为 PAM 服务增加 pam_deepin_keyring 支持 1. 在 ddm.pam 的 auth 和 session 栈中加入 pam_deepin_keyring 2. 在 debian.ddm.pam 的 auth 和 session 栈中加入 pam_deepin_keyring 3. 在 ddm-autologin.pam 中加入 pam_deepin_keyring 以支持免密登录 4. 在 debian/control 中推荐安装 deepin-keyring-whitebox 包 Log: 无用户可见变化 Influence: 1. 验证正常密码登录后密钥环能被解锁且无报错 2. 验证自动登录和免密登录时密钥环能正常解锁 3. 验证未安装 deepin-keyring-whitebox 时登录仍能正常进行 PMS: TASK-390751 --- debian/control | 1 + services/ddm-autologin.pam | 4 ++++ services/ddm.pam | 2 ++ services/debian.ddm.pam | 2 ++ 4 files changed, 9 insertions(+) diff --git a/debian/control b/debian/control index 118d855..4f60c2d 100644 --- a/debian/control +++ b/debian/control @@ -26,6 +26,7 @@ Depends: ${shlibs:Depends}, dde-seatd, treeland, libpam-systemd, +Recommends: deepin-keyring-whitebox, Description: a modern display manager for Wayland sessions aiming to be fast, simple and beautiful. Package: libddm diff --git a/services/ddm-autologin.pam b/services/ddm-autologin.pam index 8bc87e9..c9fb564 100644 --- a/services/ddm-autologin.pam +++ b/services/ddm-autologin.pam @@ -9,6 +9,9 @@ auth requisite pam_nologin.so # Load environment from /etc/environment auth required pam_env.so +# Unlock keyring when user auto login +-auth optional pam_deepin_keyring.so + # Allow access without authentication auth required pam_permit.so @@ -24,6 +27,7 @@ session required pam_limits.so session required pam_loginuid.so session required pam_systemd.so @include common-session +-session optional pam_deepin_keyring.so -session optional pam_gnome_keyring.so auto_start -session optional pam_kwallet5.so auto_start diff --git a/services/ddm.pam b/services/ddm.pam index c89c5a3..84f6dc6 100644 --- a/services/ddm.pam +++ b/services/ddm.pam @@ -4,6 +4,7 @@ auth sufficient pam_succeed_if.so user ingroup nopasswdlogin auth include system-login +-auth optional pam_deepin_keyring.so -auth optional pam_gnome_keyring.so -auth optional pam_kwallet5.so @@ -15,5 +16,6 @@ password include system-login session optional pam_keyinit.so force revoke session include system-login session required pam_systemd.so +-session optional pam_deepin_keyring.so -session optional pam_gnome_keyring.so auto_start -session optional pam_kwallet5.so auto_start diff --git a/services/debian.ddm.pam b/services/debian.ddm.pam index ddc5136..6b560ae 100644 --- a/services/debian.ddm.pam +++ b/services/debian.ddm.pam @@ -9,6 +9,7 @@ auth sufficient pam_succeed_if.so user ingroup nopasswdlogin @include common-auth # gnome_keyring breaks QProcess +-auth optional pam_deepin_keyring.so -auth optional pam_gnome_keyring.so -auth optional pam_kwallet5.so @@ -28,6 +29,7 @@ session required pam_systemd.so # in the proper default security context. Only sessions which are intended # to run in the user's context should be run after this. session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open +-session optional pam_deepin_keyring.so -session optional pam_gnome_keyring.so auto_start -session optional pam_kwallet5.so auto_start