pam_kwallet/0003-Exit-early-if-the-target-user-is-root.patch

From 2126d9f148506d71ebc5576a91259c80e095f5ec Mon Sep 17 00:00:00 2001
From: Fabian Vogt <fabian@ritter-vogt.de>
Date: Mon, 13 Mar 2023 10:12:18 +0100
Subject: [PATCH 3/4] Exit early if the target user is root

kwallet should not be used as root user, so just refuse doing anything if
root is the target user.
---
 pam_kwallet.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pam_kwallet.c b/pam_kwallet.c
index 2cd3758..49be6c0 100644
--- a/pam_kwallet.c
+++ b/pam_kwallet.c
@@ -265,6 +265,11 @@ PAM_EXTERN int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, cons
         return PAM_IGNORE;
     }
 
+    if (userInfo->pw_uid == 0) {
+        pam_syslog(pamh, LOG_DEBUG, "%s: Refusing to do anything for the root user", logPrefix);
+        return PAM_IGNORE;
+    }
+
     const char *password;
     result = pam_get_item(pamh, PAM_AUTHTOK, (const void**)&password);
 
@@ -569,6 +574,11 @@ PAM_EXTERN int pam_sm_open_session(pam_handle_t *pamh, int flags, int argc, cons
         return PAM_IGNORE;
     }
 
+    if (userInfo->pw_uid == 0) {
+        pam_syslog(pamh, LOG_DEBUG, "%s: Refusing to do anything for the root user", logPrefix);
+        return PAM_IGNORE;
+    }
+
     char *password;
     result = pam_get_data(pamh, kwalletPamDataKey, (const void **)&password);
 
-- 
2.39.2