Merge lp:~robert-ancell/lightdm/setcred-on-unlock into lp:lightdm

[Robert Ancell]

When switching to an existing session refresh PAM credentials and end session cleanly so no resources leak.

[Robert Ancell (robert-ancell)]

Awaiting confirmation from reporters in bug 1296276

[lp:~robert-ancell/lightdm/setcred-on-unlock]

1945. By Robert Ancell on 2014-03-23

Use PAM_REINITIALIZE_CRED instead of PAM_REFRESH_CRED as that's what GDM/gnome-screensaver do

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:1944
http://jenkins.qa.ubuntu.com/job/lightdm-ci/262/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/lightdm-trusty-amd64-ci/56
    SUCCESS: http://jenkins.qa.ubuntu.com/job/lightdm-trusty-armhf-ci/56

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/lightdm-ci/262/rebuild

review: Approve (continuous-integration)

[lp:~robert-ancell/lightdm/setcred-on-unlock]

1946. By Robert Ancell on 2014-03-23

Call pam_end after reinitializing credentials

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:1945
http://jenkins.qa.ubuntu.com/job/lightdm-ci/263/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/lightdm-trusty-amd64-ci/57
    SUCCESS: http://jenkins.qa.ubuntu.com/job/lightdm-trusty-armhf-ci/57

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/lightdm-ci/263/rebuild

review: Approve (continuous-integration)

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:1946
http://jenkins.qa.ubuntu.com/job/lightdm-ci/264/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/lightdm-trusty-amd64-ci/58
    SUCCESS: http://jenkins.qa.ubuntu.com/job/lightdm-trusty-armhf-ci/58

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/lightdm-ci/264/rebuild

review: Approve (continuous-integration)

[Robert Ancell (robert-ancell)]

Committing to trunk, this should probably also go into lp:lightdm/1.10

review: Approve

[Robert Ancell (robert-ancell)]

MP for 1.10: https://code.launchpad.net/~robert-ancell/lightdm/setcred-on-unlock-1.10/+merge/214660

=== modified file 'src/session-child.c'
--- src/session-child.c	2014-03-10 23:44:49 +0000
+++ src/session-child.c	2014-03-23 23:35:47 +0000
@@ -353,7 +353,10 @@
 
         /* See what user we ended up as */
         if (pam_get_item (pam_handle, PAM_USER, (const void **) &new_username) != PAM_SUCCESS)
+        {
+            pam_end (pam_handle, 0);
             return EXIT_FAILURE;
+        }
         g_free (username);
         username = g_strdup (new_username);
 
@@ -438,12 +441,16 @@
     if (!username)
     {
         g_printerr ("No user selected during authentication\n");
+        pam_end (pam_handle, 0);
         return EXIT_FAILURE;
     }
 
     /* Stop if we didn't authenticated */
     if (authentication_result != PAM_SUCCESS)
+    {
+        pam_end (pam_handle, 0);
         return EXIT_FAILURE;
+    }
 
     /* Get the command to run (blocks) */
     log_filename = read_string ();
@@ -470,6 +477,14 @@
         command_argv[i] = read_string ();
     command_argv[i] = NULL;
 
+    /* If nothing to run just refresh credentials because we successfully authenticated */
+    if (command_argc == 0)
+    {
+        pam_setcred (pam_handle, PAM_REINITIALIZE_CRED);
+        pam_end (pam_handle, 0);
+        return EXIT_SUCCESS;
+    }
+
     /* Redirect stderr to a log file */
     if (log_filename)
     {
@@ -506,6 +521,7 @@
     if (result != PAM_SUCCESS)
     {
         g_printerr ("Failed to establish PAM credentials: %s\n", pam_strerror (pam_handle, result));
+        pam_end (pam_handle, 0);
         return EXIT_FAILURE;
     }
      
@@ -514,6 +530,7 @@
     if (result != PAM_SUCCESS)
     {
         g_printerr ("Failed to open PAM session: %s\n", pam_strerror (pam_handle, result));
+        pam_end (pam_handle, 0);
         return EXIT_FAILURE;
     }
 
@@ -522,7 +539,10 @@
     if (error)
         g_printerr ("Unable to contact system bus: %s", error->message);
     if (!bus)
+    {
+        pam_end (pam_handle, 0);
         return EXIT_FAILURE;
+    }
 
     if (login1_is_running ())
     {
@@ -580,7 +600,10 @@
             g_printerr ("Error writing X authority: %s\n", error->message);
         g_clear_error (&error);
         if (!result)
+        {
+            pam_end (pam_handle, 0);
             return EXIT_FAILURE;
+        }
 
         value = g_strdup_printf ("XAUTHORITY=%s", x_authority_filename);
         pam_putenv (pam_handle, value);

=== modified file 'src/session.c'
--- src/session.c	2014-03-17 16:02:32 +0000
+++ src/session.c	2014-03-23 23:35:47 +0000
@@ -846,6 +846,22 @@
 {
     g_return_if_fail (session != NULL);
 
+    /* If can cleanly stop then do that */
+    if (session_get_is_authenticated (session) && !session->priv->command_run)
+    {
+        gsize n = 0;
+
+        session->priv->command_run = TRUE;
+        write_string (session, NULL); // log filename
+        write_string (session, NULL); // tty
+        write_string (session, NULL); // xauth filename
+        write_string (session, NULL); // xdisplay
+        write_xauth (session, NULL); // xauth
+        write_data (session, &n, sizeof (n)); // environment
+        write_data (session, &n, sizeof (n)); // command
+        return;
+    }
+
     if (session->priv->stopping)
         return;
     session->priv->stopping = TRUE;

=== modified file 'tests/Makefile.am'
--- tests/Makefile.am	2014-03-17 03:37:55 +0000
+++ tests/Makefile.am	2014-03-23 23:35:47 +0000
@@ -19,6 +19,7 @@
 	test-additional-system-config-priority \
 	test-headless \
 	test-autologin \
+	test-autologin-pam \
 	test-autologin-in-background \
 	test-autologin-guest-in-background \
 	test-autologin-timeout-in-background \
@@ -35,7 +36,6 @@
 	test-change-authentication \
 	test-restart-authentication \
 	test-gobject-cancel-authentication \
-	test-pam \
 	test-login-pam \
 	test-denied \
 	test-expired \
@@ -134,6 +134,7 @@
 	test-switch-to-greeter \
 	test-switch-to-greeter-new-session \
 	test-switch-to-greeter-return-session \
+	test-switch-to-greeter-return-session-pam \
 	test-switch-to-greeter-return-session-logout \
 	test-switch-to-guest \
 	test-switch-to-user \
@@ -329,12 +330,13 @@
 	scripts/autologin.conf \
 	scripts/autologin-guest.conf \
 	scripts/autologin-guest-fail-setup-script.conf \
+	scripts/autologin-guest-in-background.conf \
 	scripts/autologin-guest-logout.conf \
 	scripts/autologin-guest-session-config.conf \
 	scripts/autologin-guest-timeout.conf \
 	scripts/autologin-in-background.conf \
 	scripts/autologin-invalid-greeter.conf \
-	scripts/autologin-guest-in-background.conf \
+	scripts/autologin-pam.conf \
 	scripts/autologin-timeout-in-background.conf \
 	scripts/autologin-invalid-session.conf \
 	scripts/autologin-invalid-user.conf \
@@ -426,7 +428,6 @@
 	scripts/no-console-kit-or-login1.conf \
 	scripts/no-login1.conf \
 	scripts/open-file-descriptors.conf \
-	scripts/pam.conf \
 	scripts/power.conf \
 	scripts/power-no-console-kit.conf \
 	scripts/power-no-services.conf \
@@ -455,6 +456,7 @@
 	scripts/switch-to-greeter-new-session.conf \
 	scripts/switch-to-greeter-return-session.conf \
 	scripts/switch-to-greeter-return-session-logout.conf \
+	scripts/switch-to-greeter-return-session-pam.conf \
 	scripts/switch-to-guest.conf \
 	scripts/switch-to-user.conf \
 	scripts/switch-to-users.conf \

=== renamed file 'tests/scripts/pam.conf' => 'tests/scripts/autologin-pam.conf'
--- tests/scripts/pam.conf	2014-03-17 18:33:02 +0000
+++ tests/scripts/autologin-pam.conf	2014-03-23 23:35:47 +0000
@@ -1,11 +1,14 @@
 #
-# Check we handle conversations during each PAM method
+# Check we correctly use PAM for automatic login
 #
 
 [SeatDefaults]
-autologin-user=log-pam
+autologin-user=no-password1
 user-session=default
 
+[test-pam]
+log-events=true
+
 #?*START-DAEMON
 #?RUNNER DAEMON-START
 
@@ -17,8 +20,15 @@
 #?XSERVER-0 INDICATE-READY
 #?XSERVER-0 ACCEPT-CONNECT
 
+# Session authenticates
+#?PAM-no-password1 START SERVICE=lightdm-autologin USER=no-password1
+#?PAM-no-password1 AUTHENTICATE
+#?PAM-no-password1 ACCT-MGMT
+#?PAM-no-password1 SETCRED ESTABLISH_CRED
+#?PAM-no-password1 OPEN-SESSION
+
 # Session starts
-#?SESSION-X-0 START XDG_SEAT=seat0 XDG_VTNR=7 XDG_GREETER_DATA_DIR=.*/log-pam DESKTOP_SESSION=default USER=log-pam
+#?SESSION-X-0 START XDG_SEAT=seat0 XDG_VTNR=7 XDG_GREETER_DATA_DIR=.*/no-password1 DESKTOP_SESSION=default USER=no-password1
 #?LOGIN1 ACTIVATE-SESSION SESSION=c0
 #?XSERVER-0 ACCEPT-CONNECT
 #?SESSION-X-0 CONNECT-XSERVER
@@ -26,5 +36,8 @@
 # Cleanup
 #?*STOP-DAEMON
 #?SESSION-X-0 TERMINATE SIGNAL=15
+#?PAM-no-password1 CLOSE-SESSION
+#?PAM-no-password1 SETCRED DELETE_CRED
+#?PAM-no-password1 END
 #?XSERVER-0 TERMINATE SIGNAL=15
 #?RUNNER DAEMON-EXIT STATUS=0

=== modified file 'tests/scripts/login-pam.conf'
--- tests/scripts/login-pam.conf	2014-03-17 18:33:02 +0000
+++ tests/scripts/login-pam.conf	2014-03-23 23:35:47 +0000
@@ -1,10 +1,13 @@
 #
-# Check we handle conversations during each PAM method
+# Check we correctly use PAM for login
 #
 
 [SeatDefaults]
 user-session=default
 
+[test-pam]
+log-events=true
+
 #?*START-DAEMON
 #?RUNNER DAEMON-START
 
@@ -16,6 +19,11 @@
 #?XSERVER-0 INDICATE-READY
 #?XSERVER-0 ACCEPT-CONNECT
 
+# Create PAM session for greeter
+#?PAM-lightdm START SERVICE=lightdm-greeter USER=lightdm
+#?PAM-lightdm SETCRED ESTABLISH_CRED
+#?PAM-lightdm OPEN-SESSION
+
 # Greeter starts
 #?GREETER-X-0 START XDG_SEAT=seat0 XDG_VTNR=7 XDG_SESSION_CLASS=greeter
 #?LOGIN1 ACTIVATE-SESSION SESSION=c0
@@ -24,18 +32,28 @@
 #?GREETER-X-0 CONNECT-TO-DAEMON
 #?GREETER-X-0 CONNECTED-TO-DAEMON
 
-# Log into account with a password
-#?*GREETER-X-0 AUTHENTICATE USERNAME=log-pam
-#?GREETER-X-0 SHOW-MESSAGE TEXT="pam_authenticate"
+# Greeter does authentication via PAM
+#?*GREETER-X-0 AUTHENTICATE USERNAME=have-password1
+#?PAM-have-password1 START SERVICE=lightdm USER=have-password1
+#?PAM-have-password1 AUTHENTICATE
 #?GREETER-X-0 SHOW-PROMPT TEXT="Password:"
 #?*GREETER-X-0 RESPOND TEXT="password"
-#?GREETER-X-0 SHOW-MESSAGE TEXT="pam_acct_mgmt"
-#?GREETER-X-0 AUTHENTICATION-COMPLETE USERNAME=log-pam AUTHENTICATED=TRUE
+#?PAM-have-password1 ACCT-MGMT
+#?GREETER-X-0 AUTHENTICATION-COMPLETE USERNAME=have-password1 AUTHENTICATED=TRUE
+
+# User session starts
 #?*GREETER-X-0 START-SESSION
+#?PAM-have-password1 SETCRED ESTABLISH_CRED
+#?PAM-have-password1 OPEN-SESSION
+
+# Greeter session stops
 #?GREETER-X-0 TERMINATE SIGNAL=15
+#?PAM-lightdm CLOSE-SESSION
+#?PAM-lightdm SETCRED DELETE_CRED
+#?PAM-lightdm END
 
 # Session starts
-#?SESSION-X-0 START XDG_SEAT=seat0 XDG_VTNR=7 XDG_GREETER_DATA_DIR=.*/log-pam DESKTOP_SESSION=default USER=log-pam
+#?SESSION-X-0 START XDG_SEAT=seat0 XDG_VTNR=7 XDG_GREETER_DATA_DIR=.*/have-password1 DESKTOP_SESSION=default USER=have-password1
 #?LOGIN1 ACTIVATE-SESSION SESSION=c1
 #?XSERVER-0 ACCEPT-CONNECT
 #?SESSION-X-0 CONNECT-XSERVER
@@ -43,5 +61,8 @@
 # Cleanup
 #?*STOP-DAEMON
 #?SESSION-X-0 TERMINATE SIGNAL=15
+#?PAM-have-password1 CLOSE-SESSION
+#?PAM-have-password1 SETCRED DELETE_CRED
+#?PAM-have-password1 END
 #?XSERVER-0 TERMINATE SIGNAL=15
 #?RUNNER DAEMON-EXIT STATUS=0

=== added file 'tests/scripts/switch-to-greeter-return-session-pam.conf'
--- tests/scripts/switch-to-greeter-return-session-pam.conf	1970-01-01 00:00:00 +0000
+++ tests/scripts/switch-to-greeter-return-session-pam.conf	2014-03-23 23:35:47 +0000
@@ -0,0 +1,102 @@
+#
+# Check we correctly use PAM for returning to an existing session
+#
+
+[SeatDefaults]
+autologin-user=have-password1
+user-session=default
+
+[test-pam]
+log-events=true
+
+#?*START-DAEMON
+#?RUNNER DAEMON-START
+
+# X server starts
+#?XSERVER-0 START VT=7 SEAT=seat0
+
+# Daemon connects when X server is ready
+#?*XSERVER-0 INDICATE-READY
+#?XSERVER-0 INDICATE-READY
+#?XSERVER-0 ACCEPT-CONNECT
+
+# Session authenticates
+#?PAM-have-password1 START SERVICE=lightdm-autologin USER=have-password1
+#?PAM-have-password1 AUTHENTICATE
+#?PAM-have-password1 ACCT-MGMT
+#?PAM-have-password1 SETCRED ESTABLISH_CRED
+#?PAM-have-password1 OPEN-SESSION
+
+# Session starts
+#?SESSION-X-0 START XDG_SEAT=seat0 XDG_VTNR=7 XDG_GREETER_DATA_DIR=.*/have-password1 DESKTOP_SESSION=default USER=have-password1
+#?LOGIN1 ACTIVATE-SESSION SESSION=c0
+#?XSERVER-0 ACCEPT-CONNECT
+#?SESSION-X-0 CONNECT-XSERVER
+
+# Show the greeter
+#?*SWITCH-TO-GREETER
+#?RUNNER SWITCH-TO-GREETER
+
+# New X server starts
+#?XSERVER-1 START VT=8 SEAT=seat0
+
+# Daemon connects when X server is ready
+#?*XSERVER-1 INDICATE-READY
+#?XSERVER-1 INDICATE-READY
+#?XSERVER-1 ACCEPT-CONNECT
+
+# Session is locked
+#?LOGIN1 LOCK-SESSION
+
+# Create PAM session for greeter
+#?PAM-lightdm START SERVICE=lightdm-greeter USER=lightdm
+#?PAM-lightdm SETCRED ESTABLISH_CRED
+#?PAM-lightdm OPEN-SESSION
+
+# Greeter starts
+#?GREETER-X-1 START XDG_SEAT=seat0 XDG_VTNR=8 XDG_SESSION_CLASS=greeter
+#?XSERVER-1 ACCEPT-CONNECT
+#?GREETER-X-1 CONNECT-XSERVER
+#?GREETER-X-1 CONNECT-TO-DAEMON
+#?GREETER-X-1 CONNECTED-TO-DAEMON
+
+# Switch to greeter
+#?LOGIN1 ACTIVATE-SESSION SESSION=c1
+#?VT ACTIVATE VT=8
+
+# Login as existing user
+#?*GREETER-X-1 AUTHENTICATE USERNAME=have-password1
+#?PAM-have-password1 START SERVICE=lightdm USER=have-password1
+#?PAM-have-password1 AUTHENTICATE
+#?GREETER-X-1 SHOW-PROMPT TEXT="Password:"
+#?*GREETER-X-1 RESPOND TEXT="password"
+#?PAM-have-password1 ACCT-MGMT
+#?GREETER-X-1 AUTHENTICATION-COMPLETE USERNAME=have-password1 AUTHENTICATED=TRUE
+#?*GREETER-X-1 START-SESSION
+
+# Credentials are refreshed
+#?PAM-have-password1 SETCRED REINITIALIZE_CRED
+#?PAM-have-password1 END
+
+# Session is unlocked
+#?LOGIN1 UNLOCK-SESSION
+
+# Switch to session
+#?LOGIN1 ACTIVATE-SESSION SESSION=c0
+#?VT ACTIVATE VT=7
+
+# Greeter and X server stop
+#?GREETER-X-1 TERMINATE SIGNAL=15
+#?PAM-lightdm CLOSE-SESSION
+#?PAM-lightdm SETCRED DELETE_CRED
+#?PAM-lightdm END
+#?XSERVER-1 TERMINATE SIGNAL=15
+
+# Cleanup
+#?*STOP-DAEMON
+#?SESSION-X-0 TERMINATE SIGNAL=15
+#?PAM-have-password1 CLOSE-SESSION
+#?PAM-have-password1 SETCRED DELETE_CRED
+#?PAM-have-password1 END
+#?XSERVER-0 TERMINATE SIGNAL=15
+#?RUNNER DAEMON-EXIT STATUS=0

=== modified file 'tests/src/libsystem.c'
--- tests/src/libsystem.c	2014-03-18 03:06:36 +0000
+++ tests/src/libsystem.c	2014-03-23 23:35:47 +0000
@@ -54,6 +54,7 @@
 
 struct pam_handle
 {
+    char *id;
     char *service_name;
     char *user;
     char *authtok;
@@ -794,6 +795,25 @@
     if (handle == NULL)
         return PAM_BUF_ERR;
 
+    if (user)
+        handle->id = g_strdup_printf ("PAM-%s", user);
+    else
+        handle->id = g_strdup ("PAM");
+
+    connect_status ();
+    if (g_key_file_get_boolean (config, "test-pam", "log-events", NULL))
+    {
+        GString *status;
+
+        status = g_string_new ("");
+        g_string_append_printf (status, "%s START", handle->id);
+        g_string_append_printf (status, " SERVICE=%s", service_name);
+        if (user)
+            g_string_append_printf (status, " USER=%s", user);
+        status_notify (status->str);
+        g_string_free (status, TRUE);
+    }
+
     handle->service_name = strdup (service_name);
     handle->user = user ? strdup (user) : NULL;
     handle->authtok = NULL;
@@ -807,27 +827,6 @@
     return PAM_SUCCESS;
 }
 
-static void
-send_info (pam_handle_t *pamh, const char *message)
-{
-    struct pam_message **msg;
-    struct pam_response *resp = NULL;
-
-    msg = calloc (1, sizeof (struct pam_message *));
-    msg[0] = malloc (sizeof (struct pam_message));
-    msg[0]->msg_style = PAM_TEXT_INFO;
-    msg[0]->msg = message;
-    pamh->conversation.conv (1, (const struct pam_message **) msg, &resp, pamh->conversation.appdata_ptr);
-    free (msg[0]);
-    free (msg);
-    if (resp)
-    {
-        if (resp[0].resp)
-            free (resp[0].resp);
-        free (resp);
-    }
-}
-
 int
 pam_authenticate (pam_handle_t *pamh, int flags)
 {
@@ -836,6 +835,22 @@
 
     if (pamh == NULL)
         return PAM_SYSTEM_ERR;
+
+    connect_status ();
+    if (g_key_file_get_boolean (config, "test-pam", "log-events", NULL))
+    {
+        GString *status;
+
+        status = g_string_new ("");
+        g_string_append_printf (status, "%s AUTHENTICATE", pamh->id);
+        if (flags & PAM_SILENT)
+            g_string_append (status, " SILENT");
+        if (flags & PAM_DISALLOW_NULL_AUTHTOK)
+            g_string_append (status, " DISALLOW_NULL_AUTHTOK");
+
+        status_notify (status->str);
+        g_string_free (status, TRUE);
+    }
   
     if (strcmp (pamh->service_name, "test-remote") == 0)
     {
@@ -929,9 +944,6 @@
         free (resp);
     }
 
-    if (strcmp (pamh->user, "log-pam") == 0)
-        send_info (pamh, "pam_authenticate");
-
     /* Crash on authenticate */
     if (strcmp (pamh->user, "crash-authenticate") == 0)
         kill (getpid (), SIGSEGV);
@@ -1201,12 +1213,23 @@
     if (pamh == NULL)
         return PAM_SYSTEM_ERR;
 
+    connect_status ();
+    if (g_key_file_get_boolean (config, "test-pam", "log-events", NULL))
+    {
+        GString *status;
+
+        status = g_string_new ("");
+        g_string_append_printf (status, "%s OPEN-SESSION", pamh->id);
+        if (flags & PAM_SILENT)
+            g_string_append (status, " SILENT");
+
+        status_notify (status->str);
+        g_string_free (status, TRUE);
+    }
+
     if (strcmp (pamh->user, "session-error") == 0)
         return PAM_SESSION_ERR;
 
-    if (strcmp (pamh->user, "log-pam") == 0)
-        send_info (pamh, "pam_open_session");
-
     if (strcmp (pamh->user, "make-home-dir") == 0)
     {
         struct passwd *entry;
@@ -1223,8 +1246,19 @@
     if (pamh == NULL)
         return PAM_SYSTEM_ERR;
 
-    if (strcmp (pamh->user, "log-pam") == 0)
-        send_info (pamh, "pam_close_session");
+    connect_status ();
+    if (g_key_file_get_boolean (config, "test-pam", "log-events", NULL))
+    {
+        GString *status;
+
+        status = g_string_new ("");
+        g_string_append_printf (status, "%s CLOSE-SESSION", pamh->id);
+        if (flags & PAM_SILENT)
+            g_string_append (status, " SILENT");
+
+        status_notify (status->str);
+        g_string_free (status, TRUE);
+    }
 
     return PAM_SUCCESS;
 }
@@ -1234,13 +1268,26 @@
 {
     if (pamh == NULL)
         return PAM_SYSTEM_ERR;
+
+    connect_status ();
+    if (g_key_file_get_boolean (config, "test-pam", "log-events", NULL))
+    {
+        GString *status;
+
+        status = g_string_new ("");
+        g_string_append_printf (status, "%s ACCT-MGMT", pamh->id);
+        if (flags & PAM_SILENT)
+            g_string_append (status, " SILENT");
+        if (flags & PAM_DISALLOW_NULL_AUTHTOK)
+            g_string_append (status, " DISALLOW_NULL_AUTHTOK");
+
+        status_notify (status->str);
+        g_string_free (status, TRUE);
+    }
   
     if (!pamh->user)
         return PAM_USER_UNKNOWN;
 
-    if (strcmp (pamh->user, "log-pam") == 0)
-        send_info (pamh, "pam_acct_mgmt");
-
     if (strcmp (pamh->user, "denied") == 0)
         return PAM_PERM_DENIED;
     if (strcmp (pamh->user, "expired") == 0)
@@ -1262,8 +1309,21 @@
     if (pamh == NULL)
         return PAM_SYSTEM_ERR;
 
-    if (strcmp (pamh->user, "log-pam") == 0)
-        send_info (pamh, "pam_chauthtok");
+    connect_status ();
+    if (g_key_file_get_boolean (config, "test-pam", "log-events", NULL))
+    {
+        GString *status;
+
+        status = g_string_new ("");
+        g_string_append_printf (status, "%s CHAUTHTOK", pamh->id);
+        if (flags & PAM_SILENT)
+            g_string_append (status, " SILENT");
+        if (flags & PAM_CHANGE_EXPIRED_AUTHTOK)
+            g_string_append (status, " CHANGE_EXPIRED_AUTHTOK");
+
+        status_notify (status->str);
+        g_string_free (status, TRUE);
+    }
 
     msg = malloc (sizeof (struct pam_message *) * 1);
     msg[0] = malloc (sizeof (struct pam_message));
@@ -1303,8 +1363,27 @@
     if (pamh == NULL)
         return PAM_SYSTEM_ERR;
 
-    if (strcmp (pamh->user, "log-pam") == 0)
-        send_info (pamh, "pam_setcred");
+    connect_status ();
+    if (g_key_file_get_boolean (config, "test-pam", "log-events", NULL))
+    {
+        GString *status;
+
+        status = g_string_new ("");
+        g_string_append_printf (status, "%s SETCRED", pamh->id);
+        if (flags & PAM_SILENT)
+            g_string_append (status, " SILENT");
+        if (flags & PAM_ESTABLISH_CRED)
+            g_string_append (status, " ESTABLISH_CRED");
+        if (flags & PAM_DELETE_CRED)
+            g_string_append (status, " DELETE_CRED");
+        if (flags & PAM_REINITIALIZE_CRED)
+            g_string_append (status, " REINITIALIZE_CRED");
+        if (flags & PAM_REFRESH_CRED)
+            g_string_append (status, " REFRESH_CRED");
+
+        status_notify (status->str);
+        g_string_free (status, TRUE);
+    }
 
     /* Put the test directories into the path */
     e = g_strdup_printf ("PATH=%s/tests/src/.libs:%s/tests/src:%s/tests/src:%s/src:%s", BUILDDIR, BUILDDIR, SRCDIR, BUILDDIR, pam_getenv (pamh, "PATH"));
@@ -1353,7 +1432,19 @@
 {
     if (pamh == NULL)
         return PAM_SYSTEM_ERR;
-  
+
+    connect_status ();
+    if (g_key_file_get_boolean (config, "test-pam", "log-events", NULL))
+    {
+        GString *status;
+
+        status = g_string_new ("");
+        g_string_append_printf (status, "%s END", pamh->id);
+        status_notify (status->str);
+        g_string_free (status, TRUE);
+    }
+
+    free (pamh->id);
     free (pamh->service_name);
     if (pamh->user)
         free (pamh->user);

=== renamed file 'tests/test-pam' => 'tests/test-autologin-pam'
--- tests/test-pam	2012-04-05 06:52:27 +0000
+++ tests/test-autologin-pam	2014-03-23 23:35:47 +0000
@@ -1,2 +1,2 @@
 #!/bin/sh
-./src/dbus-env ./src/test-runner pam test-gobject-greeter
+./src/dbus-env ./src/test-runner autologin-pam test-gobject-greeter

=== added file 'tests/test-switch-to-greeter-return-session-pam'
--- tests/test-switch-to-greeter-return-session-pam	1970-01-01 00:00:00 +0000
+++ tests/test-switch-to-greeter-return-session-pam	2014-03-23 23:35:47 +0000
@@ -0,0 +1,2 @@
+#!/bin/sh
+./src/dbus-env ./src/test-runner switch-to-greeter-return-session-pam test-gobject-greeter