Dear Maintainer, pam_keyinit is missing from the /etc/pam.d/xdm configuration file. Therefore, it is not possible to access the session keyring from programs running in a session started by xdm. The patch will follow. PS. Below there is a modifide pam file from my system which makes it possible to access the session keyring.
This commit replicates commits[1][2] from the openssh package. Closes [1] https://salsa.debian.org/ssh-team/openssh/-/commit/ca7f6f719ad5f168b25165caaff658f21c784c4e [2] https://salsa.debian.org/ssh-team/openssh/-/commit/dc461e571bcc56f8d95e83c731007636d8e79da5 Closes: #1068378 --- debian/rules | 10 +++++++++- debian/xdm.pam | 19 ------------------- debian/xdm.pam.in | 20 ++++++++++++++++++++ 3 files changed, 29 insertions(+), 20 deletions(-) delete mode 100644 debian/xdm.pam create mode 100644 debian/xdm.pam.in diff --git a/debian/rules b/debian/rules index 5d2dbd3..ab9f5d4 100755 --- a/debian/rules +++ b/debian/rules @@ -38,6 +38,7 @@ ifneq (,$(filter parallel=%,$(DEB_BUILD_OPTIONS))) endif DEB_HOST_ARCH ?= $(shell dpkg-architecture -qDEB_HOST_ARCH) +DEB_HOST_ARCH_OS ?= $(shell dpkg-architecture -qDEB_HOST_ARCH_OS) DEB_HOST_GNU_TYPE ?= $(shell dpkg-architecture -qDEB_HOST_GNU_TYPE) DEB_BUILD_ARCH_OS ?= $(shell dpkg-architecture -qDEB_BUILD_ARCH_OS) DEB_BUILD_GNU_TYPE ?= $(shell dpkg-architecture -qDEB_BUILD_GNU_TYPE) @@ -58,6 +59,13 @@ endif BUILD_DIR := build +debian/xdm.pam: debian/xdm.pam.in +ifeq ($(DEB_HOST_ARCH_OS),linux) + sed 's/^@IF_KEYINIT@//' $< > $@ +else + sed '/^@IF_KEYINIT@/d' $< > $@ +endif + stampdir_targets+=config config: $(STAMP_DIR)/config $(STAMP_DIR)/config: $(STAMP_DIR)/patch @@ -121,7 +129,7 @@ clean: xsfclean dh_clean # Build architecture-dependent files here. -binary-arch: $(STAMP_DIR)/install +binary-arch: $(STAMP_DIR)/install debian/xdm.pam dh_testdir dh_testroot diff --git a/debian/xdm.pam b/debian/xdm.pam deleted file mode 100644 index 1108a71..0000000 --- a/debian/xdm.pam +++ /dev/null @@ -1,19 +0,0 @@ -auth requisite pam_nologin.so -auth required pam_env.so -auth required pam_env.so envfile=/etc/default/locale - -# SELinux needs to be the first session rule. This ensures that any -# lingering context has been cleared. Without this it is possible -# that a module could execute code in the wrong domain. -session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close -session required pam_loginuid.so -# SELinux needs to intervene at login time to ensure that the process -# starts in the proper default security context. Only sessions which are -# intended to run in the user's context should be run after this. -session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open -session required pam_limits.so - -@include common-auth -@include common-account -@include common-session -@include common-password diff --git a/debian/xdm.pam.in b/debian/xdm.pam.in new file mode 100644 index 0000000..92c46b7 --- /dev/null +++ b/debian/xdm.pam.in @@ -0,0 +1,20 @@ +auth requisite pam_nologin.so +auth required pam_env.so +auth required pam_env.so envfile=/etc/default/locale + +# SELinux needs to be the first session rule. This ensures that any +# lingering context has been cleared. Without this it is possible +# that a module could execute code in the wrong domain. +session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close +session required pam_loginuid.so +@IF_KEYINIT@session optional pam_keyinit.so force revoke +# SELinux needs to intervene at login time to ensure that the process +# starts in the proper default security context. Only sessions which are +# intended to run in the user's context should be run after this. +session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open +session required pam_limits.so + +@include common-auth +@include common-account +@include common-session +@include common-password
We believe that the bug you reported is fixed in the latest version of
xdm, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1068378@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Boyuan Yang <byang@debian.org> (supplier of updated xdm package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 02 Oct 2026 13:10:50 -0400
Source: xdm
Architecture: source
Version: 1:1.1.17-3
Distribution: unstable
Urgency: medium
Maintainer: Debian X Strike Force <debian-x@lists.debian.org>
Changed-By: Boyuan Yang <byang@debian.org>
Closes: 832351 1068378
Changes:
xdm (1:1.1.17-3) unstable; urgency=medium
.
* debian/xdm.postrm.in: On purge, remove the
/etc/systemd/system/display-manager.service symlink if it still
points at xdm.service; fixes piuparts failure in sid-strict.
(Closes: #832351)
* debian/xdm.pam: Add pam_keyinit session module (force revoke) so
that a fresh session keyring is created on login, as sshd and other
display managers do. Thanks to Łukasz Stelmach. (Closes: #1068378)
* debian/gbp.conf: Set compression = xz to match the tarballs stored
in the pristine-tar branch.
* debian/control: Bump debhelper compat to v14.
* debian/control: Drop Priority: optional.
* debian/control: Use non-obsolete build-dep package name libselinux-dev.
* debian/control: Drop unused build-dep quilt.
* debian/rules: Stop using the xsfbs patch/unpatch targets. With source
format 3.0 (quilt), dpkg-source applies the patches already, and the
xsfbs targets required quilt at build and clean time.
Checksums-Sha1:
c65f65dd17cfb486c62931a788eb80b815831e18 2629 xdm_1.1.17-3.dsc
cd79d094a2002659fb2de5e8f94592783b23f391 425804 xdm_1.1.17.orig.tar.xz
364e388e955d56dece3a405feb9486d32f99bf16 58712 xdm_1.1.17-3.debian.tar.xz
201389de30f953621f175f9e9153b16d3e4be59c 7686 xdm_1.1.17-3_amd64.buildinfo
Checksums-Sha256:
b9cc570534d1b4f4e622df06f30debf76dc852e421445a1ddd856ef501dcb76d 2629 xdm_1.1.17-3.dsc
9494aef0911a031c53670725b5c8c9bb9d3f7c5ea7318b1f72ddd9dcbbeceb6a 425804 xdm_1.1.17.orig.tar.xz
7682fd7eb2308cc0a4dd4ce0737148768de69116d28bc0e884cd9be285d37b54 58712 xdm_1.1.17-3.debian.tar.xz
32f801156bfd093c540d5fab7d5e620abcaa8e2564572ab5732415993eeaf4c7 7686 xdm_1.1.17-3_amd64.buildinfo
Files:
c907857bff6c4dd249b6196c7c5bfd45 2629 x11 optional xdm_1.1.17-3.dsc
e918d273f714098fb409457e37d328ce 425804 x11 optional xdm_1.1.17.orig.tar.xz
60b1e0820d37bc0ebe93f3bff840b6b6 58712 x11 optional xdm_1.1.17-3.debian.tar.xz
6443d492031a340bc9fafd0c5664083d 7686 x11 optional xdm_1.1.17-3_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEfncpR22H1vEdkazLwpPntGGCWs4FAmq/5fQACgkQwpPntGGC
Ws4WdQ//e47JOEY7+8GmWeOQKPD7Z3PAQMUs57ksyZoR7ciYmBu9ikdcE8R1R2Fs
xOpGebYjmd501ftukCOeaLUrAxK0hoJ/0eMxXmlqoAkMVqCFsW004SPMl3d/GOE8
yCUWHoiN08trZLeoF6uXJAxEizuq5OZMHkh6IuhXuiFz+WQo0UTz+WJ1Tk7VeI64
kLSy3+dn5PztI1ZqOlnVP3IzmP73vUp17JXkdkVtsRHluCGnAsl5Ih64MLPyIRQD
d4Shm6NPTkPTu5sTCG9vJIZWjLeE/6R3N73WuspaVtebkP5ybZEtm/fX/C9I1vXH
grmNh5WkAuY8L9j3IsbgxCR91Ld7cxZjrFPgV3w+24TIzg2NxA6p/88eCSIIMgaj
i/Wcaj6mB0WZfVvkA8fMSCrkV3YWMDJPjhSPcQyqxbsHzTmreLAu2VrK+qAMqIMW
hRXFH4LQjLMJ8zBzbP/HaQyTAYXCIQ8+ZyY4hfRda2T3Bs3d1nQS7QEBj84eUo/m
+9WW/6p/x1BfppMm2sFbjfUesYGtpJPZjHH1EpPt/1aA+7Q4dpw5zXVrQJX+TJYU
45cmKJjewbwLiJHA6JVRxIQBMzLf+U7A2B4M3nIxAXIPzF03S4jpHJPjAqgOrQzk
TcwHQyMO7OHzaHFtCBQOW3LpANPP1oFCjy4QBtoSEmcS6IKX0FI=
=o4PJ
-----END PGP SIGNATURE-----