#986358 hardening-runtime: Restrictions on /etc/pam.d/ break X screensavers

Package:
hardening-runtime
Source:
hardening-runtime
Submitter:
Andrew Savchenko
Date:
2021-04-04 21:51:03 UTC
Severity:
important
#986358#5
Date:
2021-04-04 09:52:23 UTC
From:
To:
Dear Maintainer,

Restricting permissions on /etc/pam.d to 0700 while the folder is owned
by `root:root` leads to xscreensaver, mate-screensaver and others being
unable to authenticate a user.

Perhaps worth adding a warning or making this optional?


Thank you.
#986358#10
Date:
2021-04-04 10:05:46 UTC
From:
To:
Hi Andrew,

statoverride in hardening-runtime were added by Topi Miettinen so I'm adding
him in the loop for comments.

Regards,
#986358#15
Date:
2021-04-04 13:23:04 UTC
From:
To:
Hello Yves-Alexis,

Sunday, April 4, 2021, 7:35:46 PM, you wrote:
chmod'ing it to the default 0755 fixes the issue.

There might be more dragons though as this is somewhat similar to openSUSE:
https://github.com/openSUSE/permissions/blob/master/profiles/permissions.paranoid
#986358#20
Date:
2021-04-04 21:46:32 UTC
From:
To:
Very strange, I actually also have 0755. I think this line should be
removed.

I didn't see any reference to pam.d here though.