cookiez/pam-fprint-grosshack
1
0
Fork 0
mirror of https://gitlab.com/mishakmak/pam-fprint-grosshack.git synced 2026-04-08 20:03:34 +02:00
Code Issues Packages Projects Releases Wiki Activity

Revert "pam_fprintd: Just return a PAM_AUTH_ERROR on unknown errors"

Browse Source 
This reverts commit ecf6b7c323.

The idea of the commit was to make device failures less fatal to the
system. Unfortunately, we can fail quickly in this case, and returning
PAM_AUTH_ERR means that the user might run into a retry limit due to
this.

Go back to reporting PAM_AUTHINFO_UNAVAIL, it appears as the lesser evil
right now. Ideally we want to a way to tell the upper stack to retry
authentication whenever there is a good opportunity, but to not consider
it as an authentication failure.
This commit is contained in:
Benjamin Berg
2021-06-29 20:27:35 +02:00
parent 6482e2dbd4
commit 9ec1747b84
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
pam/pam_fprintd.c
View File

@ -565,7 +565,7 @@ do_verify (sd_bus *bus,
}
else if (str_equal (data->result, "verify-unknown-error"))
{
return PAM_AUTH_ERR;
return PAM_AUTHINFO_UNAVAIL;
}
else if (str_equal (data->result, "verify-disconnected"))
{

2
tests/pam/test_pam_fprintd.py
View File

@ -97,7 +97,7 @@ class TestPamFprintd(dbusmock.DBusTestCase):
]
self.device_mock.SetVerifyScript(script)
tc = pypamtest.TestCase(pypamtest.PAMTEST_AUTHENTICATE, expected_rv=PAM_AUTH_ERR)
tc = pypamtest.TestCase(pypamtest.PAMTEST_AUTHENTICATE, expected_rv=PAM_AUTHINFO_UNAVAIL)
res = pypamtest.run_pamtest("toto", "fprintd-pam-test", [tc], [ 'unused' ])
self.assertRegex(res.info[0], r'Swipe your left little finger across the fingerprint reader')