google / google/fscrypt

[bug] pam_fscrypt hangs on login via xrdp

Open
#350 10 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Go
Stars
1k
Forks
111
Avg merge
2d 19h
Merged PRs (30d)
3

Description

This issue may or may not relate to #323. I am investigating the use of xrdp + fscrypt.

I am observing that the pam_fscrypt module hangs after the user has authenticated, leaving the xrdp login process dead in the water. This is on Ubuntu, using a daily build of 22.04/jammy. The fscrypt packages are version 0.3.3-1, so they appear current.

I enabled the `debug` keyword on the module in `/etc/pam.d/common-session`, and this is what `/var/log/syslog` looks like:
```
Apr 8 06:07:09 xubuntu xrdp[5563]: [INFO ] started connecting
Apr 8 06:07:09 xubuntu xrdp[5563]: [INFO ] lib_mod_connect: connecting via UNIX socket
Apr 8 06:07:09 xubuntu xrdp-sesman[5461]: [ERROR] sesman_data_in: scp_process_msg failed
Apr 8 06:07:09 xubuntu xrdp-sesman[5461]: [ERROR] sesman_main_loop: trans_check_wait_objs failed, removing trans
Apr 8 06:07:09 xubuntu xrdp-sesman[5571]: [INFO ] [session start] (display 10): calling auth_start_session from pid 5571
Apr 8 06:07:09 xubuntu pam_fscrypt[5571]: OpenSession(map[debug:true]) starting
Apr 8 06:07:09 xubuntu pam_fscrypt[5571]: Session count for UID=1000 updated to 1
Apr 8 06:07:09 xubuntu pam_fscrypt[5571]: Current privs (real, effective): uid=(0,0) gid=(0,0) groups=[]
Apr 8 06:07:09 xubuntu pam_fscrypt[5571]: Setting euid=1000 egid=1000 groups=[1000]
Apr 8 06:07:09 xubuntu pam_fscrypt[5571]: Current privs (real, effective): uid=(0,1000) gid=(0,1000) groups=[1000]
Apr 8 06:07:09 xubuntu pam_fscrypt[5571]: Reading config from "/etc/fscrypt.conf"
Apr 8 06:07:09 xubuntu pam_fscrypt[5571]: creating context for user "testuser"
Apr 8 06:07:09 xubuntu pam_fscrypt[5571]: found overlay filesystem "/" ()
Apr 8 06:07:09 xubuntu pam_fscrypt[5571]: listing protectors in "/.fscrypt/protectors"
Apr 8 06:07:09 xubuntu pam_fscrypt[5571]: found 1 protectors
Apr 8 06:07:09 xubuntu pam_fscrypt[5571]: successfully read metadata from "/.fscrypt/protectors/f16e151ff1887a1d"
Apr 8 06:07:09 xubuntu pam_fscrypt[5571]: Getting protector f16e151ff1887a1d from option
Apr 8 06:07:09 xubuntu pam_fscrypt[5571]: successfully read metadata from "/.fscrypt/protectors/f16e151ff1887a1d"
Apr 8 06:07:09 xubuntu pam_fscrypt[5571]: listing policies in "/.fscrypt/policies"
Apr 8 06:07:09 xubuntu pam_fscrypt[5571]: found 0 policies
Apr 8 06:07:09 xubuntu pam_fscrypt[5571]: following protector link /mnt/.fscrypt/protectors/f16e151ff1887a1d.link
Apr 8 06:07:09 xubuntu pam_fscrypt[5571]: resolved filesystem link using mountpoint path "/"
Apr 8 06:07:09 xubuntu pam_fscrypt[5571]: successfully read metadata from "/.fscrypt/protectors/f16e151ff1887a1d"
Apr 8 06:07:09 xubuntu pam_fscrypt[5571]: listing policies in "/mnt/.fscrypt/policies"
Apr 8 06:07:09 xubuntu pam_fscrypt[5571]: found 1 policies
Apr 8 06:07:09 xubuntu pam_fscrypt[5571]: successfully read metadata from "/mnt/.fscrypt/policies/47ae2fc75b32c2d7cb51530f70f187db"
Apr 8 06:07:09 xubuntu pam_fscrypt[5571]: got data for 47ae2fc75b32c2d7cb51530f70f187db from "/mnt"
Apr 8 06:07:09 xubuntu pam_fscrypt[5571]: unlocking 1 policies protected with AUTHTOK
Apr 8 06:07:09 xubuntu pam_fscrypt[5571]: running passphrase hash for protector f16e151ff1887a1d
```

There, it stops. The process (xrdp-sesman) is not using CPU; it's not doing anything. Eventually, the login process times out with an error.

As this requires somewhat of a non-trivial setup to reproduce, I have put together an [initialization script](https://github.com/google/fscrypt/files/8449162/fscrypt-bug-repro.sh.txt) that will do all the work. Get a daily build of Ubuntu Live 22.04/jammy (I used a Xubuntu .iso for my testing), boot up the GUI environment, run this script as root, and then invoke xfreerdp as directed to trigger the bug.

(I can't say if the login will work once this bug is fixed; there may be other issues on the xrdp side. pam_fscrypt should at least be returning within a reasonable amount of time, however.)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.