[bug#47364] [PATCH 0/2] Add pam-gnupg and PAM rules for SLiM

[bug#47364] [PATCH 0/2] Add pam-gnupg and PAM rules for SLiM

[Oleg Pykhalov]

This patch series adds pam-gnupg package and PAM rules for SLiM display
manager.

Oleg Pykhalov (2):
  gnu: Add pam-gnupg.
  services: slim: Add pam-gnupg support.

 doc/guix.texi          |  8 ++++++++
 gnu/packages/linux.scm | 37 ++++++++++++++++++++++++++++++++++++-
 gnu/services/xorg.scm  |  7 ++++++-
 gnu/system/pam.scm     | 15 +++++++++++++--
 4 files changed, 63 insertions(+), 4 deletions(-)

-- 
2.30.2

[bug#47364] [PATCH 1/2] gnu: Add pam-gnupg.

[Oleg Pykhalov]

* gnu/packages/linux.scm (pam-gnupg): New variable.
---
 gnu/packages/linux.scm | 37 ++++++++++++++++++++++++++++++++++++-
 1 file changed, 36 insertions(+), 1 deletion(-)

diff --git a/gnu/packages/linux.scm b/gnu/packages/linux.scm
index 0eaf014b5c..fff4a1789e 100644
--- a/gnu/packages/linux.scm
+++ b/gnu/packages/linux.scm
@@ -38,7 +38,7 @@
 ;;; Copyright © 2019 Pierre Langlois <pierre.langlois@gmx.com>
 ;;; Copyright © 2019, 2020 Brice Waegeneire <brice@waegenei.re>
 ;;; Copyright © 2019 Kei Kebreau <kkebreau@posteo.net>
-;;; Copyright © 2020 Oleg Pykhalov <go.wigust@gmail.com>
+;;; Copyright © 2020, 2021 Oleg Pykhalov <go.wigust@gmail.com>
 ;;; Copyright © 2020 Pierre Neidhardt <mail@ambrevar.xyz>
 ;;; Copyright © 2020 Chris Marusich <cmmarusich@gmail.com>
 ;;; Copyright © 2020 Vincent Legoll <vincent.legoll@gmail.com>
@@ -99,6 +99,7 @@
   #:use-module (gnu packages gcc)
   #:use-module (gnu packages gettext)
   #:use-module (gnu packages glib)
+  #:use-module (gnu packages gnupg)
   #:use-module (gnu packages golang)
   #:use-module (gnu packages gperf)
   #:use-module (gnu packages gstreamer)
@@ -1482,6 +1483,40 @@ at login.  Local and dynamic reconfiguration are its key features.")
     (description "This package provides a PAM interface using @code{ctypes}.")
     (license license:expat)))
 
+(define-public pam-gnupg
+  (package
+    (name "pam-gnupg")
+    (version "0.3")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                    (url "https://github.com/cruegge/pam-gnupg")
+                    (commit (string-append "v" version))))
+              (file-name (git-file-name name version))
+              (sha256
+               (base32
+                "1bf91gi6zmfzzmczxm7pajxdlgnikasvg5xsd3j0a368rcr7lf9l"))))
+    (build-system gnu-build-system)
+    (inputs
+     `(("gnupg" ,gnupg)
+       ("linux-pam" ,linux-pam)))
+    (native-inputs
+     `(("autoconf" ,autoconf)
+       ("automake" ,automake)
+       ("libtool" ,libtool)))
+    (arguments
+     `(#:tests? #f ;no tests suite
+       #:configure-flags
+       (list (string-append "--with-moduledir="
+                            (assoc-ref %outputs "out") "/lib/security"))))
+
+    (home-page "https://github.com/cruegge/pam-gnupg")
+    (synopsis "Unlock GnuPG keys on login")
+    (description "This package provides a PAM module that hands over your
+login password to @code{gpg-agent}.  This can be useful if you are using a
+GnuPG-based password manager like @code{pass}.")
+    (license license:gpl3+)))
+
 
 ;;;
 ;;; Miscellaneous.
-- 
2.30.2

[bug#47364] [PATCH 2/2] services: slim: Add pam-gnupg support.

[Oleg Pykhalov]

* gnu/system/pam.scm (unix-pam-service): Add account and session PAM entries
for pam-gnupg.
* doc/guix.texi (X Window): Document this.
* gnu/services/xorg.scm (<slim-configuration>)[gnupg?]: New record field.
(slim-pam-service): Pass "#:gnupg?" argument to "unix-pam-service".
---
 doc/guix.texi         |  8 ++++++++
 gnu/services/xorg.scm |  7 ++++++-
 gnu/system/pam.scm    | 15 +++++++++++++--
 3 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/doc/guix.texi b/doc/guix.texi
index 94ecd2c247..f549930c63 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -17765,6 +17765,14 @@ Data type representing the configuration of @code{slim-service-type}.
 @item @code{allow-empty-passwords?} (default: @code{#t})
 Whether to allow logins with empty passwords.
 
+@item @code{gnupg?} (default: @code{#f})
+If enabled, @code{pam-gnupg} will attempt to automatically unlock the
+user's GPG keys with the login password via @code{gpg-agent}.  The
+keygrips of all keys to be unlocked should be written to
+@file{~/.pam-gnupg}, and can be queried with @code{gpg -K
+--with-keygrip}.  Presetting passphrases must be enabled by adding
+@code{allow-preset-passphrase} in @file{~/.gnupg/gpg-agent.conf}.
+
 @item @code{auto-login?} (default: @code{#f})
 @itemx @code{default-user} (default: @code{""})
 When @code{auto-login?} is false, SLiM presents a log-in screen.
diff --git a/gnu/services/xorg.scm b/gnu/services/xorg.scm
index 60611dc77d..65b138b4f4 100644
--- a/gnu/services/xorg.scm
+++ b/gnu/services/xorg.scm
@@ -8,6 +8,7 @@
 ;;; Copyright © 2020 shtwzrd <shtwzrd@protonmail.com>
 ;;; Copyright © 2020 Jakub Kądziołka <kuba@kadziolka.net>
 ;;; Copyright © 2020 Alex Griffin <a@ajgrf.com>
+;;; Copyright © 2021 Oleg Pykhalov <go.wigust@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -541,6 +542,8 @@ a `service-extension', as used by `set-xorg-configuration'."
         (default slim))
   (allow-empty-passwords? slim-configuration-allow-empty-passwords?
                           (default #t))
+  (gnupg? slim-configuration-gnupg?
+          (default #f))
   (auto-login? slim-configuration-auto-login?
                (default #f))
   (default-user slim-configuration-default-user
@@ -570,7 +573,9 @@ a `service-extension', as used by `set-xorg-configuration'."
          "slim"
          #:login-uid? #t
          #:allow-empty-passwords?
-         (slim-configuration-allow-empty-passwords? config))))
+         (slim-configuration-allow-empty-passwords? config)
+         #:gnupg?
+         (slim-configuration-gnupg? config))))
 
 (define (slim-shepherd-service config)
   (let* ((xinitrc (xinitrc #:fallback-session
diff --git a/gnu/system/pam.scm b/gnu/system/pam.scm
index ad02586be8..75edd01908 100644
--- a/gnu/system/pam.scm
+++ b/gnu/system/pam.scm
@@ -27,6 +27,7 @@
   #:use-module (srfi srfi-11)
   #:use-module (srfi srfi-26)
   #:use-module ((guix utils) #:select (%current-system))
+  #:use-module (gnu packages linux)
   #:export (pam-service
             pam-service-name
             pam-service-account
@@ -208,7 +209,7 @@ dumped in /etc/pam.d/NAME, where NAME is the name of SERVICE."
                (control "required")
                (module "pam_env.so"))))
     (lambda* (name #:key allow-empty-passwords? (allow-root? #f) motd
-                   login-uid?)
+                   login-uid? (gnupg? #f))
       "Return a standard Unix-style PAM service for NAME.  When
 ALLOW-EMPTY-PASSWORDS? is true, allow empty passwords.  When ALLOW-ROOT? is
 true, allow root to run the command without authentication.  When MOTD is
@@ -229,7 +230,12 @@ When LOGIN-UID? is true, require the 'pam_loginuid' module; that module sets
                                 (control "required")
                                 (module "pam_unix.so")
                                 (arguments '("nullok")))
-                               unix))))
+                               unix))
+                     (if gnupg?
+                         (list (pam-entry
+                                (control "required")
+                                (module (file-append pam-gnupg "/lib/security/pam_gnupg.so"))))
+                         '())))
        (password (list (pam-entry
                         (control "required")
                         (module "pam_unix.so")
@@ -247,6 +253,11 @@ When LOGIN-UID? is true, require the 'pam_loginuid' module; that module sets
                                (control "required")
                                (module "pam_loginuid.so")))
                         '())
+                  ,@(if gnupg?
+                        (list (pam-entry
+                               (control "required")
+                               (module (file-append pam-gnupg "/lib/security/pam_gnupg.so"))))
+                        '())
                   ,env ,unix))))))
 
 (define (rootok-pam-service command)
-- 
2.30.2

[bug#47364] [PATCH 2/2] services: slim: Add pam-gnupg support.

[Maxime Devos]

[-- Attachment #1: Type: text/plain, Size: 1413 bytes --]

Hi,

I'm not familiar with PAM, so I can't do much reviewing about that
(seems ok, though I'm no expert).  Some nitpicks:

On Wed, 2021-03-24 at 19:52 +0300, Oleg Pykhalov wrote:
> [...]
> 
> diff --git a/gnu/system/pam.scm b/gnu/system/pam.scm
> index ad02586be8..75edd01908 100644
> --- a/gnu/system/pam.scm
> +++ b/gnu/system/pam.scm
> [...]
>     (lambda* (name #:key allow-empty-passwords? (allow-root? #f) motd
> -                   login-uid?)
> +                   login-uid? (gnupg? #f))

Nitpick: keyword variables have #f as default by default, so you could just write ...

     (lambda* (name #:key allow-empty-passwords? (allow-root? #f) motd
> -                   login-uid?)
> +                   login-uid? gnupg?)

... here.  As a minimal example, you could run the following code in a Guile REPL:

> ;; These both evaluate to (#f #f)!
> ((lambda* (#:key login-uid? gnupg?) (list login-uid? gnupg?)))
> ((lambda* (#:key login-uid? (gnupg? #f)) (list login-uid? gnupg?)))

Hmm, maybe (allow-root? #f) could be replaced with simply allow-root? here ...

>        "Return a standard Unix-style PAM service for NAME.  When
>  ALLOW-EMPTY-PASSWORDS? is true, allow empty passwords.  When ALLOW-ROOT? is
>  true, allow root to run the command without authentication.  When MOTD is

It would be nice if this docstring documents GNUPG? as well.

Greetings,
Maxime.

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 260 bytes --]

[bug#47364] [PATCH 2/2] services: slim: Add pam-gnupg support.

[Oleg Pykhalov]

[-- Attachment #1.1: Type: text/plain, Size: 275 bytes --]

Hi,

Thank you for the review!

Maxime Devos <maximedevos@telenet.be> writes:

> I'm not familiar with PAM, so I can't do much reviewing about that
> (seems ok, though I'm no expert).

I'm :-) too, but it works for me.

[…]

I applied all your suggestions.


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1.2: allow-root?, gnupg?, documentation --]
[-- Type: text/x-patch, Size: 1317 bytes --]

diff --git a/gnu/system/pam.scm b/gnu/system/pam.scm
index 75edd01908..128b2bb0fe 100644
--- a/gnu/system/pam.scm
+++ b/gnu/system/pam.scm
@@ -208,14 +208,16 @@ dumped in /etc/pam.d/NAME, where NAME is the name of SERVICE."
         (env  (pam-entry ; to honor /etc/environment.
                (control "required")
                (module "pam_env.so"))))
-    (lambda* (name #:key allow-empty-passwords? (allow-root? #f) motd
-                   login-uid? (gnupg? #f))
+    (lambda* (name #:key allow-empty-passwords? allow-root? motd
+              login-uid? gnupg?)
       "Return a standard Unix-style PAM service for NAME.  When
 ALLOW-EMPTY-PASSWORDS? is true, allow empty passwords.  When ALLOW-ROOT? is
 true, allow root to run the command without authentication.  When MOTD is
 true, it should be a file-like object used as the message-of-the-day.
 When LOGIN-UID? is true, require the 'pam_loginuid' module; that module sets
-/proc/self/loginuid, which the libc 'getlogin' function relies on."
+/proc/self/loginuid, which the libc 'getlogin' function relies on.  When
+GNUPG? is true, require the 'pam_gnupg.so' module; that module hands over
+login password to 'gpg-agent'."
       ;; See <http://www.linux-pam.org/Linux-PAM-html/sag-configuration-example.html>.
       (pam-service
        (name name)

[-- Attachment #1.3: Type: text/plain, Size: 129 bytes --]


Plus in Git commit message “Don't pass "#f" to "allow-root?" argument,
because "lambda*" already does this by default.”.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 861 bytes --]

[bug#47364] [PATCH 2/2] services: slim: Add pam-gnupg support.

[Maxime Devos]

[-- Attachment #1: Type: text/plain, Size: 592 bytes --]

On Wed, 2021-03-24 at 22:48 +0300, Oleg Pykhalov wrote:
> +/proc/self/loginuid, which the libc 'getlogin' function relies on.  When
> +GNUPG? is true, require the 'pam_gnupg.so' module; that module hands over
> +login password to 'gpg-agent'."

Linguistic nitpick:
There seems to be an article missing before "login password".
Maybe add "the".

Also, ideally speaking, there would be a system test in "gnu/tests/" for
this new functionality.

Otherwise no comments, seems good to me to go into the repo
though maybe someone else wants to comment as well. 

Greetings,
Maxime

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 260 bytes --]

bug#47364: [PATCH 0/2] Add pam-gnupg and PAM rules for SLiM

[Oleg Pykhalov]

[-- Attachment #1: Type: text/plain, Size: 590 bytes --]

Oleg Pykhalov <go.wigust@gmail.com> writes:

> This patch series adds pam-gnupg package and PAM rules for SLiM display
> manager.
>
> Oleg Pykhalov (2):
>   gnu: Add pam-gnupg.
>   services: slim: Add pam-gnupg support.
>
>  doc/guix.texi          |  8 ++++++++
>  gnu/packages/linux.scm | 37 ++++++++++++++++++++++++++++++++++++-
>  gnu/services/xorg.scm  |  7 ++++++-
>  gnu/system/pam.scm     | 15 +++++++++++++--
>  4 files changed, 63 insertions(+), 4 deletions(-)

Apologies for a big pause.

Finally tested properly with my heavy configuration.  Works great.  ;-)

Pushed to master.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 861 bytes --]