Even with the changes committed for 1.0.1-10, enabling only profiles
like consolekit that provide no authentication option leave the system
accepting any password.

I realize this is messy in the code, but I think we need to actually
check that the auth stack contains an entry and require more profiles
if that is not true.

Do you think this needs to be treated as serious, given that this isn't a
state users will end up in automatically (unlike the previous iteration of
the bug)?

Honestly I'd rather think about fixing it than argue about bug
severities.  I would probably have treated all of these as
grave/critical, but I don't care much.
As far as I can tell, the bug severity doesn't matter much:

1) They are all in testing  already
2) We agree they want to be fixed
3) We plan to fix all the above before the freeze in December
4) The release team would find it easier to get this fixed than remove pam.

So, while I personally think they are all RC, I'm also happy if you
want to downgrade.
If we end up uploading before this is fixed, well, incremental improvement is good.

severity 539163 normal
thanks

I think this isn't serious.  While it's possible that someone might select
a auth-less list, that could potentially be what they _want_ for their
crazy system.  On the other hand, if it was an accident, some notice should
be taken.  But I see this more as a feature request than anything else.

Further protecting a user who is already customizing their PAM stack is a
good idea and nice to have, but shouldn't cause PAM to have an RC bug for
it.