Bug#1146345: libpam-kwallet-common: Default-enabled pam-configs profile breaks fingerprint authentication for sudo and PolicyKit

Package: libpam-kwallet-common
Version: 6.7.4-3
Severity: important

After upgrading libpam-kwallet-common from 6.7.4-1 to 6.7.4-3,
fingerprint authentication started requesting the account password after a
successful fingerprint match in sudo and PolicyKit authentication dialogs.

The upgrade installs /usr/share/pam-configs/kde-kwallet with "Default: yes"
and runs pam-auth-update.  This adds the following Additional auth module to
/etc/pam.d/common-auth:

    auth optional pam_kwallet5.so

common-auth is used by sudo, PolicyKit and many services which are unrelated
to graphical session login.  When pam_fprintd authenticates the user, no
PAM_AUTHTOK password is available.  pam_kwallet5 then starts another PAM
conversation asking for the password.  This makes fingerprint authentication
appear to have failed and prevents passwordless completion of the operation.

The relevant journal messages after touching the enrolled finger are:

    pam_kwallet5(sudo:auth): pam_sm_authenticate
    pam_kwallet5(sudo:auth): Couldn't get password (it is empty)
    pam_kwallet5(sudo:auth): Prompt for password failed Conversation error

The fingerprint reader and enrollment remain functional: fprintd-verify
successfully matches the enrolled finger.  The problem occurs with both sudo
and a pkexec PolicyKit dialog.

Steps to reproduce:

1. Enroll a fingerprint and enable the fprintd pam-auth-update profile.
2. Install or upgrade to libpam-kwallet-common 6.7.4-3, accepting its
   default-enabled kde-kwallet profile.
3. Run "sudo -k; sudo true" and authenticate with the enrolled finger.

Expected result:

The successful fingerprint match completes sudo authentication.

Actual result:

pam_kwallet5 requests the user's password after the fingerprint match.

Disabling the newly added global profile immediately restores fingerprint
authentication:

    sudo pam-auth-update --package --disable kde-kwallet

KWallet PAM integration needs to be limited to graphical login services, or
pam_kwallet5 needs to return without prompting when a preceding authentication
module succeeded without setting PAM_AUTHTOK.  Enabling this profile globally
by default is unsafe for authentication methods which do not produce a
password token.

This is a regression introduced by the pam-configs integration added in
6.7.4-2 and enabled during the upgrade to 6.7.4-3.


-- System Information:
Debian Release: forky/sid
  APT prefers testing
  APT policy: (900, 'testing'), (900, 'stable'), (500, 'stable-updates'), (500, 'stable-security'), (90, 'unstable')
Architecture: amd64 (x86_64)

Kernel: Linux 7.1.8+deb14.1-amd64 (SMP w/20 CPU threads; PREEMPT)
Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set to C.UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages libpam-kwallet-common depends on:
ii  init-system-helpers                       1.69+nmu1
ii  plasma-version [plasma-version-base-6.7]  6.7.0
ii  socat                                     1.8.1.3-2

libpam-kwallet-common recommends no packages.

libpam-kwallet-common suggests no packages.

-- no debconf information