#1033455 xscreensaver: won't unlock if libpam-cap is installed and active

Package:
xscreensaver
Source:
xscreensaver
Description:
Screensaver daemon and frontend for X11
Submitter:
Athanasius
Date:
2023-03-25 13:00:08 UTC
Severity:
normal
#1033455#5
Date:
2023-03-25 12:15:21 UTC
From:
To:
Dear Maintainer,

  TL;DR - If xscreensaver pam authentication is to work it will need to
cause adjustment to libpam-cap related configuration files.

  After upgrading my Debian desktop to bookworm I found that any attempt
to unlock xscreensaver acted as if I had failed to type the password
correctly.  It should be noted that this is an old Debian install that
has been through many different stable versions without a reinstall.
  Running xscreensaver with `-verbose` and temporarily increasing some
PAM auth logging pointed to `unix_chkpwd` being where the failure
occurred, but I couldn't easily delve any deeper there due to even root
not being able to `strace` an `xscreensaver-auth` process.

  To help diagnoise this I performed a clean bookworm install on a
separate drive and re-tested it there.  It worked!

  So, I started looking at differences between the two installs.  I used
`fvwm` on both, and aligned the `~/.xscreensaver` configurations.  Then
I checked `/etc/pam.d/`, saw I had `pam_cap.so` configured on the old
install and tried commenting that out of `/etc/pam.d/common-auth`.  But
re-testing didn't cause xscreensaver auth to work.
  It turns out at least a full restart was necessary, if not a reboot.
This was discovered when `/etc/security/capability.conf` also came to
light, with its default `none  *` line active.
  So, performed an `apt purge libpam-cap`, and rebooted before a re-test,
and then xscreensaver unlocking worked!

  The version of libpam-cap that gets installed is:

ii  libpam-cap:amd64 1:2.66-3