<table><tr><td style="">sitter added inline comments.
</td><a style="text-decoration: none; padding: 4px 8px; margin: 0 8px 8px; float: right; color: #464C5C; font-weight: bold; border-radius: 3px; background-color: #F7F7F9; background-image: linear-gradient(to bottom,#fff,#f1f0f1); display: inline-block; border: 1px solid rgba(71,87,120,.2);" href="https://phabricator.kde.org/D27935">View Revision</a></tr></table><br /><div><strong>INLINE COMMENTS</strong><div><div style="margin: 6px 0 12px 0;"><div style="border: 1px solid #C7CCD9; border-radius: 3px;"><div style="padding: 0; background: #F7F7F7; border-color: #e3e4e8; border-style: solid; border-width: 0 0 1px 0; margin: 0;"><div style="color: #74777d; background: #eff2f4; padding: 6px 8px; overflow: hidden;"><a style="float: right; text-decoration: none;" href="https://phabricator.kde.org/D27935#inline-158695">View Inline</a><span style="color: #4b4d51; font-weight: bold;">aacid</span> wrote in <span style="color: #4b4d51; font-weight: bold;">pam_kwallet.c:329</span></div>
<div style="margin: 8px 0; padding: 0 12px; color: #74777D;"><p style="padding: 0; margin: 8px;">That is a good question, the old code was kind of prepared for it.</p>
<p style="padding: 0; margin: 8px;">I am going to say "no" open can not be called before authenticate, if you read <a href="https://pubs.opengroup.org/onlinepubs/008329799/pam_open_session.htm" class="remarkup-link" target="_blank" rel="noreferrer">https://pubs.opengroup.org/onlinepubs/008329799/pam_open_session.htm</a> it says</p>
<p style="padding: 0; margin: 8px;">"The pam_open_session() function opens a new session for a user previously authenticated with a call to pam_authenticate()."</p>
<p style="padding: 0; margin: 8px;">But my pam knowledge is between none and i googled a little, so I would be happy if someone can google a bit more and agree/disagree with me</p></div></div>
<div style="margin: 8px 0; padding: 0 12px;"><p style="padding: 0; margin: 8px;">Alex did add this check in a dedicated commit <a href="https://phabricator.kde.org/R107:634464255a82de55e0288f7e425e50f6c409f51d" style="background-color: #e7e7e7;
border-color: #e7e7e7;
border-radius: 3px;
padding: 0 4px;
font-weight: bold;
color: black;text-decoration: none;">634464255a82de55e0288f7e425e50f6c409f51d</a> and even though I couldn't find a subsequent commit that made use of that preparation I'm sure he must have had a reason to add it. Perhaps it was this:</p>
<p style="padding: 0; margin: 8px;"><a href="http://www.linux-pam.org/Linux-PAM-html/mwg-expected-of-module-overview.html#mwg-expected-of-module-overview-1" class="remarkup-link" target="_blank" rel="noreferrer">http://www.linux-pam.org/Linux-PAM-html/mwg-expected-of-module-overview.html#mwg-expected-of-module-overview-1</a></p>
<blockquote style="border-left: 3px solid #a7b5bf; color: #464c5c; font-style: italic; margin: 4px 0 12px 0; padding: 4px 12px; background-color: #f8f9fc;"><p style="padding: 0; margin: 8px;">The independence of the four groups of service a module can offer means that the module should allow for the possibility that any one of these four services may legitimately be called in <strong>any order</strong>. Thus, the module writer should consider the appropriateness of performing a service without the prior success of some other part of the module.</p></blockquote>
<p style="padding: 0; margin: 8px;">gnome-keyring, as the most topically relevant example, doesn't explicitly have 'open called before' but its written in a very particular way. Both auth and session can unlock the keyring (and attempt a daemon start) it seems. Not really the same, but there's certainly some nuance to how modules may get called.</p>
<p style="padding: 0; margin: 8px;">So, the original check for sm_open_session in our code may have been not entirely pointless, it does kinda meet that any-order expectation. It probably also wasn't entirely correct though as it didn't meet the independence expectation ^^</p>
<p style="padding: 0; margin: 8px;">Removing it leaves me a bit uneasy without input from someone who knows more about pam and the two of us. At the same time it's clearly not quite right either.</p>
<p style="padding: 0; margin: 8px;">How about leaving it in for 5.18 and drop it for master?<br />
Should there be an unexpected problem we'll at least have months of theoretical testing and a shorter window from 5.19.0 to .1 to hotfix a potential regression.</p></div></div></div></div></div><br /><div><strong>REPOSITORY</strong><div><div>R107 KWallet PAM Integration</div></div></div><br /><div><strong>REVISION DETAIL</strong><div><a href="https://phabricator.kde.org/D27935">https://phabricator.kde.org/D27935</a></div></div><br /><div><strong>To: </strong>aacid<br /><strong>Cc: </strong>sitter, security-team, davidedmundson, plasma-devel, Orage, LeGast00n, The-Feren-OS-Dev, cblack, jraleigh, zachus, fbampaloukas, GB_2, ragreen, ZrenBot, ngraham, himcesjf, lesliezhai, ali-mohamed, jensreuterberg, abetts, sebas, apol, ahiemstra, mart<br /></div>