isa/gnome-shell
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

gdm: Count fingerprint authentication failures in fail counter

Browse Source 
Fingerprint PAM module can have multiple failures during a runtime
and we rely on the pam module configuration for the maximum allowed
retries.

However, while that setting should be always followed, we should never
ignore the login-screen's allowed-failures setting that can provide
a lower value.

So, once we have a fingerprint failure let's count it to increase our
internal fail counter, and when we've reached the limit we can emit a
verification-failed signal to our clients.

As per this we need also to ignore any further 'info' messages that we
could receive from the fingerprint service, as it may be configured to
handle more retries than us and they might arrive before we have
cancelled the verification session.

Part-of: <https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/1652>
This commit is contained in:
Marco Trevisan (Treviño) 2021-02-01 18:40:03 +01:00 committed by Ray Strode
parent 1158e98913
commit 6ccd289691
1 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
js/gdm/util.js
View File

@ -556,6 +556,12 @@ var ShellUserVerifier = class {
return; return;
this._queueMessage(problem, MessageType.ERROR); this._queueMessage(problem, MessageType.ERROR);
if (isFingerprint) {
this._failCounter++;
if (!this._canRetry())
this._verificationFailed(serviceName, false);
}
} }
_onInfoQuery(client, serviceName, question) { _onInfoQuery(client, serviceName, question) {
@ -604,15 +610,18 @@ var ShellUserVerifier = class {
this._startService(serviceName); this._startService(serviceName);
} }
_canRetry() {
return this._userName &&
(this._reauthOnly || this._failCounter < this.allowedFailures);
}
_verificationFailed(serviceName, retry) { _verificationFailed(serviceName, retry) {
// For Not Listed / enterprise logins, immediately reset // For Not Listed / enterprise logins, immediately reset
// the dialog // the dialog
// Otherwise, when in login mode we allow ALLOWED_FAILURES attempts. // Otherwise, when in login mode we allow ALLOWED_FAILURES attempts.
// After that, we go back to the welcome screen. // After that, we go back to the welcome screen.
let canRetry = retry && this._userName && const canRetry = retry && this._canRetry();
(this._reauthOnly ||
this._failCounter < this._settings.get_int(ALLOWED_FAILURES_KEY));
this._disconnectSignals(); this._disconnectSignals();