[phucvinh57]

Summary

When users changed their login password, the password saved for keyring unlock went stale until they saved it again in the app. Now pam_sm_chauthtok passes the new password to biopass-keyring update. If the user has a saved password, that command seals the new one with the same PCR 7 binding.

Closes # N/A / Discussion: none yet. This changes a PAM flow, so CLAUDE.md requires a linked discussion before merge.

Changes

• auth/pam: pam_sm_chauthtok acts only on PAM_UPDATE_AUTHTOK when running as euid 0. It writes PAM_AUTHTOK to a pipe before fork(). The child becomes full root, sends stdout/stderr to /dev/null, gets a fixed env, and execs /usr/libexec/biopass/biopass-keyring update <PAM_USER>. The wait uses waitForHelper with a 30 s timeout. The function always returns PAM_IGNORE. On failure it sends a PAM_ERROR_MSG unless quiet or PAM_SILENT is set.
• auth/keyring: new update USER subcommand. It requires uid and euid 0 and refuses to run when PKEXEC_UID is set, so polkit can't reach it. With no saved password it exits 0 and does nothing. Otherwise it reads the PCR 7 flag from the existing sealed file, checks the new password against /etc/shadow, then seals and stores it. seal and the new path share sealPassword(). The 2 s wrong-password delay stays on seal only.
• scripts: the pam-auth-update profile adds Password-Type: Additional / optional libbiopass_pam.so. That puts it after pam_unix → requisite pam_deny → required pam_permit in common-password, the same place as pam_gnome_keyring. Reviewers should check this first.
• docs: Keyring.md covers password changes and lists the paths that skip PAM: KDE System Settings, an admin in GNOME Settings, usermod -p, chpasswd -e. PAM.md covers the manual password line (Arch system-auth) and Fedora's sufficient pam_unix.

Verification

$ make build-auth
[ 73%] Built target biopass_pam
[ 74%] Built target biopass-keyring
[100%] Built target biopass-helper
(no warnings or errors)

$ clang-format --dry-run --Werror auth/pam/pam.cc auth/keyring/keyring_tool.cc
FORMAT_OK

$ make test-auth
100% tests passed, 0 tests failed out of 39
The following tests did not run:
	  9 - fs_user (Skipped)

$ auth/build/keyring/biopass-keyring update "$USER" </dev/null   # as non-root
biopass-keyring: run by the PAM module only
exit=3

$ make package
exit=0
$ dpkg-deb --fsys-tarfile biopass_1.5.0-1-gc2b8358_amd64.deb | tar -xO usr/share/pam-configs/biopass
...
Password-Type: Additional
Password:
	optional	libbiopass_pam.so

Manual testing:

Distro / version	Package (.deb/.rpm/AUR/source)	DE / display manager	Hardware (camera, IR, fingerprint)	Flow tested (login, sudo, polkit, lock screen, app)	Result

Not tested: the full flow (save a password in the app → passwd → face login unlocks the keyring), GNOME Settings password change, and pam-auth-update --package on upgrade. These need a VM with a TPM (swtpm). Per CLAUDE.md, PAM changes aren't tested on the host.

Review report

• First AI review: 2 important, 1 nit, 0 pre-existing. All three fixed:
  • Important: PAM.md named /etc/pam.d/system-passwd, which Arch doesn't have. Changed to system-auth, with a note that a required pam_unix lets the line run after a failed change, where the shadow check rejects it.
  • Important: Keyring.md said a password change in "desktop settings" updates the saved password. KDE, and GNOME when an admin changes another user's password, go through AccountsService and skip PAM. Both are now listed as needing a re-save.
  • Nit: the keyring_tool.cc header comment didn't mention update.
• Round 2 (fixes only): 0 important, 2 nits. Both fixed: GNOME Settings doesn't show passwd's message, and an ambiguous "It".
• Security review: ran (/security-review). No findings.

Risk

• Low: docs, UI copy, styling, tests
• Medium: app logic, Rust/Tauri commands, face/fingerprint pipeline
• High: PAM module or helper, install/remove scripts, PAM config, packaging, CI/release workflows

What could break, and for whom: Debian/Ubuntu users with the Biopass profile enabled get a new optional password rule. It always returns PAM_IGNORE, so it can't block a password change. For users with a saved password, passwd can take up to 30 s longer if the TPM hangs. If biopass-keyring update fails, passwd prints one extra error line.

How to revert

git revert and a new release. On Debian/Ubuntu the upgrade's pam-auth-update --package drops the password line from common-password. Manual setups remove the line by hand.

Checklist

• I read the whole diff and can explain every change.
• Verification above shows real output, not a claim.
• All Important review findings are fixed or answered.
• Docs are updated if behavior, install, packaging, or distro support changed.

🤖 Generated with Claude Code