Bug 463863 - kcm-user modifies /etc/shadow by it's own instead of calling PAM
Summary: kcm-user modifies /etc/shadow by it's own instead of calling PAM
Status: RESOLVED UPSTREAM
Alias: None
Product: systemsettings
Classification: Applications
Component: kcm_users (show other bugs)
Version: 5.26.4
Platform: Arch Linux Linux
: NOR normal
Target Milestone: ---
Assignee: Plasma Bugs List
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-01-05 06:27 UTC by Josesk Volpe
Modified: 2023-01-05 21:32 UTC (History)
2 users (show)

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Josesk Volpe 2023-01-05 06:27:56 UTC
SUMMARY
KCM User Settings writes on /etc/shadow directly by it's own, wich makes KDE to igmore system's PAM customizations
https://github.com/KDE/kcm-userconfig/blob/master/authdb/pwd.py

A user may have to change steps the systems has to do to change passwords. They may change how much rounds the system has to do to generate a hash, or even execute a function to synchronyze the password with cryptograohic features such as fscrypt. KDE ignores pam.d customizations by modifying /etc/shadow by it's own, wich may be very risky from mimor issues to critical, such as data loss by using PAM-synchronized encryptes filesystem in the  case the user lost their backup key.


STEPS TO REPRODUCE
It will depend on your settings, so compare the behaviour changing your password by using passwd and KDE System Settings
I've noticed this by trying to synchronize my password with my fscrypt encrypted home, and trying to change it through KDE. While passwd does synchronizes it, KDE doesn't.

OBSERVED RESULT
KDE system settings rebels against pam.d customizations and set the user passwords by it's own

EXPECTED RESULT
It should call a system API to change the user pasword through PAM

SOFTWARE/OS VERSIONS
Linux/KDE Plasma: Arch Linux. Kernel 5.18.86-lts x86_64
KDE Plasma Version: 5.26.4
KDE Frameworks Version: 5.101.0
Qt Version: 5.15.7
Comment 1 Nicolas Fella 2023-01-05 10:26:43 UTC
> https://github.com/KDE/kcm-userconfig/blob/master/authdb/pwd.py

This is from KDE4 times and not used on a modern Plasma system.

The actual code is at https://invent.kde.org/plasma/plasma-workspace/-/tree/master/kcms/users. It uses https://gitlab.freedesktop.org/accountsservice/accountsservice to do any kind of actual operation, so if it doesn't do what you expect it to do you'll have to raise that there
Comment 2 Josesk Volpe 2023-01-05 21:32:33 UTC
Sorry, my mistake.
Thank you