gdm-51.0

[Bruce Dubbs]

New major version.

[Bruce Dubbs]

51.0

• Fixed some memory leaks
• Correctness improvements to GDM's PAM extensions
• Fixes to remote login with Kerberos
• Translation updates

Also of note: in GNOME 51, we've changed the behavior of the fingerprint sensor to only function during re-authentication. The user can no longer log into their system with a fingerprint sensor alone. This is done both for security reasons, and because various parts of the system (like the keyring) are broken when logging in via fingerprint.

51.rc

• Follow-up bugfix for $GDM_AUTH_SESSION_ID
• Follow-up bugfix for redone PAM service loading logic
• Follow-up bugfix for pam_gdm keyring buffer bounds check
• Fixed a couple crashes and memory leaks
• Introduced pre-authenticated remote displays, for Kerberos authentication in gnome-remote-desktop
• Updated Fedora's PAM rules to include support for oo7 instead of gnome-keyring
• Translation updates

51.beta

• Fixed autologin bypass where a compromised greeter could request autologin for any local account by sending arbitrary usernames via BeginAutoLogin
• Dropped unused enable-web-authentication and enable-passkey-authentication gsettings keys from the org.gnome.login-screen schema
• Introduced PAM substack safety net, such that authentication cannot by bypassed on systems where authselect hasn't configured a PAM service file for a specific authentication method (i.e. gdm-switchable-auth)
• Fixed double-free in session worker
• Reworked build script for installing PAM service files into modern search path
• Redid PAM service loading logic in GDM, to introduce meaningful error messages whenever PAM services aren't found
• Fixed memory leaks in PAM extensions
• Fixed denial of service where an invalid session name from the greeter would cause the entire daemon to exit, terminating all active sessions
• Adjusted D-Bus object path generation for /org/gnome/DisplayManager/Displays/* to fix ASLR leak
• Fixed input sanitation when forwarding unknown usernames to audit subsystem
• Fixed passphrase handling in pam_gdm to wipe cached plaintext passwords before freeing and to bound the keyring buffer walk preventing out-of-bounds reads
• Fixed path traversal vulnerability where a compromised greeter could load arbitrary .desktop files via SelectSession, potentially executing attacker-controlled commands as the authenticated user
• Introduced $GDM_AUTH_SESSION_ID environment variable, which communicates the logind session ID of the caller that requested authentication. This will be used for smartcard redirection for remote sessions

51.alpha

• Compatibility with kmsconvt
• Add checks to make sure PAM plugins don't drop fsuid privilges and break GDM
• CI improvements
• Reworked the way GDM constructs XDG_DATA_DIRS for its launch environment, so that it will no longer hard-code /usr/share at a higher priority than /usr/local/share. This behavior would prevent people from locally hacking on gnome-shell with --prefix=/usr/local without also having to rebuild GDM with the same prefix
• Reworked conflicting session logic to use logind for enumeration. Previously, GDM would only look for sessions it started itself, but that would cause it to miss conflicting sessions started externally, such as those from ThinLinc or TigerVNC
• Fixed bug where plymouth never quit on headless or no-monitor systems, which would prevent the system from ever reaching graphical.target
• Added setting to change the fallback session. This is the session that gets used whenever a user doesn't have a preferred session selected, or their preferred session is unusable. Sysadmins can use this setting to change the selected session for users that have never logged into the system before
• Fixed bug where GDM would start X11 sessions with XDG_SESSION_TYPE=wayland
• Fixed PAM handling code to notify PAM modules when we've switched user and are about to exec the session leader. This fixes PAM modules like pam_cap.so in its defer mode
• Removed unnecessary SetRemoteId method from the remote display DBus API
• Added setting to turn off local greeter sessions, for headless-only systems
• Removed unused settings
• Documented remote display DBus API
• Documented GDM's settings
• Dropped dconf override of org.gnome.desktop.session.session-name, and instead gnome-session is now explicitly told to launch the GDM login screen UI even if dconf overrides fail to get applied
• Addressed warnings from Fedora's static analyzer
• Fixed bug where the kernel's VT cursor may flicker during the transition between graphical sessions (i.e. at log out)
• Dropped ancient GDM docs, which have been out of date for a very long time and are entirely inaccurate now.
• Fixed some more misc. bugs: memory leaks, crashes, etc
• Translation updates

NOTE: In the previous 50.X release series, we removed GDM's ability to execute the various PreSession/PostSession/etc scripts as part of the X11 removal. However, it turned out that some people were using these hook points on Wayland, despite their limited functionality there. Still, the feature is gone for good, and I wanted to make sure it's listed in the changelog. See the issue for more details and context: ​https://gitlab.gnome.org/GNOME/gdm/-/work_items/1059

[Bruce Dubbs]

Fixed at commits:

508bcfc2b0 Update to gnome-shell-51.0.
b595c6b60c Update to gdm-51.0.
f3e18ee30b Update to gnome-shell-extensions-51.0.
e18c2d55fc Update to gnome-session-51.0.
60dff2975e Update to gnome-user-docs-51.0