* Add support for integrating GDM with GnomeKeyring and PAM

* Remove some ancient PAM checks

PR:		125983
Submitted by:	Marcin Wisnicki <mwisnicki+freebsd@gmail.com>

4 files changed, 38 insertions, 5 deletions

diff --git a/x11/gdm/Makefile b/x11/gdm/Makefile
index 70edda19b69..f8c84304fe0 100644
--- a/x11/gdm/Makefile
+++ b/x11/gdm/Makefile
@@ -8,7 +8,7 @@
 
 PORTNAME=	gdm
 PORTVERSION=	2.20.7
-PORTREVISION=	1
+PORTREVISION=	2
 CATEGORIES=	x11 gnome
 MASTER_SITES=	GNOME
 DIST_SUBDIR=	gnome2
@@ -39,6 +39,8 @@ CONFIGURE_ENV=	CPPFLAGS="-I${LOCALBASE}/include" \
 		GTKDOC="false"
 CONFIGURE_ARGS=--with-console-kit=yes
 
+SUB_FILES+=	gdm.pam
+
 GDMDIR?=	${PREFIX}/etc/gdm
 PKGMESSAGE=	${WRKDIR}/pkg-message
 
@@ -47,14 +49,16 @@ GNOME_LOCALSTATEDIR=	/var
 MAN1=		gdm.1
 
 OPTIONS=	IPV6 "Enable IPv6 support" off \
+		KEYRING "Enable GnomeKeyring/PAM integration" on \
 		LOG_LIMIT "Limit ~/.xsession-errors size" on
 
 .include <bsd.port.pre.mk>
 
-.if exists(/usr/include/security/pam_misc.h)
-PLIST_SUB+=	PAM_MISC=""
+.if defined(WITHOUT_KEYRING)
+SUB_LIST+=	PAM_KEYRING=\#
 .else
-PLIST_SUB+=	PAM_MISC="@comment "
+RUN_DEPENDS+=	${LOCALBASE}/lib/pam_gnome_keyring.so:${PORTSDIR}/security/gnome-keyring
+SUB_LIST+=	PAM_KEYRING=
 .endif
 
 .if !defined(WITHOUT_IPV6)
@@ -88,6 +92,7 @@ post-install:
 .endif
 	${INSTALL_DATA} ${WRKSRC}/config/gdm.conf-custom \
 		${PREFIX}/etc/gdm/custom.conf.default
+	${INSTALL_DATA} ${WRKDIR}/gdm.pam ${PREFIX}/etc/pam.d/gdm
 	@${MKDIR} ${PREFIX}/etc/gdm/Sessions
 	@${SED} -e 's|%%PREFIX%%|${PREFIX}|g' < ${PKGDIR}/pkg-message \
 		| /usr/bin/fmt 75 79 > ${PKGMESSAGE}
diff --git a/x11/gdm/files/gdm.in b/x11/gdm/files/gdm.in
index 8705c474283..ee6cd21fd5b 100644
--- a/x11/gdm/files/gdm.in
+++ b/x11/gdm/files/gdm.in
@@ -14,6 +14,7 @@
 . %%GNOME_SUBR%%
 
 gdm_enable=${gdm_enable-${gnome_enable}}
+gdm_preserve_base_pam_conf=${gdm_preserve_base_pam_conf-NO}
 
 export PATH=/bin:/sbin:/usr/bin:/usr/sbin:%%LOCALBASE%%/bin:%%LOCALBASE%%/sbin
 
@@ -31,6 +32,12 @@ gdm_start()
     fi
     echo "Starting ${name}."
 
+    # make sure there is no pam configuration for gdm service in base system
+    if ! checkyesno gdm_preserve_base_pam_conf && [ -f /etc/pam.d/gdm ]; then
+	cp -p /etc/pam.d/gdm /etc/pam.d/gdm_disabled
+    	rm -f /etc/pam.d/gdm
+    fi
+
     ( iter=0
     while ! ps -axoargs | grep "^/usr/libexec/getty " | grep -qv grep >/dev/null 2>&1; do
 	if [ ${iter} -eq 60 ]; then
diff --git a/x11/gdm/files/gdm.pam.in b/x11/gdm/files/gdm.pam.in
new file mode 100644
index 00000000000..ea630b7b135
--- /dev/null
+++ b/x11/gdm/files/gdm.pam.in
@@ -0,0 +1,21 @@
+#
+# $FreeBSD$
+#
+# PAM configuration for the "gdm" service
+#
+
+# auth
+#auth		sufficient	pam_krb5.so		no_warn try_first_pass
+#auth		sufficient	pam_ssh.so		no_warn try_first_pass
+auth		required	pam_unix.so		no_warn try_first_pass
+%%PAM_KEYRING%%auth		optional	%%LOCALBASE%%/lib/pam_gnome_keyring.so
+
+# account
+account		required	pam_nologin.so
+#account 	required	pam_krb5.so
+account		required	pam_unix.so
+
+# session
+#session 	optional	pam_ssh.so
+session		required	pam_permit.so
+%%PAM_KEYRING%%session		optional	%%LOCALBASE%%/lib/pam_gnome_keyring.so	auto_start
diff --git a/x11/gdm/pkg-plist b/x11/gdm/pkg-plist
index 7492a149072..ea47c5c3a2e 100644
--- a/x11/gdm/pkg-plist
+++ b/x11/gdm/pkg-plist
@@ -21,13 +21,13 @@ etc/gdm/modules/factory-AccessDwellMouseEvents
 @unexec if cmp -s %D/etc/gdm/modules/AccessKeyMouseEvents %D/etc/gdm/modules/factory-AccessKeyMouseEvents; then rm -f %D/etc/gdm/modules/AccessKeyMouseEvents; fi
 etc/gdm/modules/factory-AccessKeyMouseEvents
 @exec [ -f %B/AccessKeyMouseEvents ] || cp %B/%f %B/AccessKeyMouseEvents
+etc/pam.d/gdm
 lib/gtk-2.0/modules/libdwellmouselistener.a
 lib/gtk-2.0/modules/libdwellmouselistener.la
 lib/gtk-2.0/modules/libdwellmouselistener.so
 lib/gtk-2.0/modules/libkeymouselistener.a
 lib/gtk-2.0/modules/libkeymouselistener.la
 lib/gtk-2.0/modules/libkeymouselistener.so
-%%PAM_MISC%%libexec/gdmaskpass
 libexec/gdmchooser
 libexec/gdmgreeter
 libexec/gdmlogin