Fix Fedora Polkit

[EmixamPP]

This is a fix for the issue #630

If think that on Fedora, polkit detect that the subprocess compare.py is created and to avoid security issue it is killed.
However, if we run this subprocess through a shell instance, this is no more a problem.
So this fix is not really clean, but it works.

In order to provide a proper solution, I think we need to investigate polkit to create a policy or something like that. But personally, I don't know anything about it, and this seems complex. It is also possible that there is no such thing and that it is simply a bug.

---

I made the modification from the tag of the current version of Howdy: v2.6.1.

In order to provide this fix for Fedora users we have several choices:

• An official version of Howdy 2.6.2 is created
• The Fedora's repo maintainer creates a "hot fix", but we keep the v2.6.1 tag as source. The version on Fedora would become 2.6.1-7 (currently 2.6.1-6)
• I create a tag on the fedora-polkit branch of my fork, which is temporarily used as source. The version on Fedora would become 2.6.1-7
• We do nothing for Fedora at the moment, and we wait for the next official release, the v3.0.0, which rewrites the pam module in C++

[EmixamPP]

@principis What do you think of that?

[validatedev]

Works flawlessly, can confirm from Fedora 36. Thanks so much!

[mikecharles]

So, do I only need to modify /lib64/security/howdy/pam.py? Do I have to restart or do anything else for this to start working?

[EmixamPP]

Yes, just change the line 44 of /lib64/security/howdy/pam.py with this one :

status = subprocess.call(["/usr/bin/python3 " + os.path.dirname(os.path.abspath(__file__)) + "/compare.py " + pamh.get_user() + " &> /dev/null"], shell=True)

[Okazakee]

this is fantastic, thanks, +1 for merging or copr repo hotfix

[wheelerlaw]

I can confirm that this also worked for my installation.

[principis]

I'll add this in the copr repo.

[wheelerlaw]

Is polkit exclusive to Fedora, or is it a Gnome thing?

[boltgolt]

The next release of Howdy will completely remove pam.py to move over to a compiled pam_howdy.so and drop the dependency on pam-python. This file is now gone on the beta branch. Is it worth merging this into master still?

[EmixamPP]

@wheelerlaw A Gnome thing