From 0bb584b3d7810a2b437348da817009900ff9fba4 Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Thu, 1 Dec 2022 06:11:45 +0000 Subject: [PATCH] import pam-1.3.1-25.el8 --- ...1-pam-motd-avoid-unnecessary-logging.patch | 283 ++++++++++++++++++ ...pam-faillock-avoid-logging-erroneous.patch | 37 +++ ....1-pam-faillock-clarify-missing-user.patch | 53 ++++ ...stlog-check-localtime_r-return-value.patch | 41 +++ SPECS/pam.spec | 21 +- 5 files changed, 434 insertions(+), 1 deletion(-) create mode 100644 SOURCES/pam-1.3.1-pam-motd-avoid-unnecessary-logging.patch create mode 100644 SOURCES/pam-1.5.1-pam-faillock-avoid-logging-erroneous.patch create mode 100644 SOURCES/pam-1.5.1-pam-faillock-clarify-missing-user.patch create mode 100644 SOURCES/pam-1.5.1-pam-lastlog-check-localtime_r-return-value.patch diff --git a/SOURCES/pam-1.3.1-pam-motd-avoid-unnecessary-logging.patch b/SOURCES/pam-1.3.1-pam-motd-avoid-unnecessary-logging.patch new file mode 100644 index 0000000..52f7292 --- /dev/null +++ b/SOURCES/pam-1.3.1-pam-motd-avoid-unnecessary-logging.patch @@ -0,0 +1,283 @@ +From d57ab22133654033ee1da89f128a81572d320985 Mon Sep 17 00:00:00 2001 +From: Tomas Mraz +Date: Thu, 20 Dec 2018 13:59:25 +0100 +Subject: [PATCH] pam_motd: Cleanup the code and avoid unnecessary logging + +The pam_motd module will not log if the default motd.d directories +are missing. + +Also cleanup some code cleanliness issues and fix compilation +warnings. + +* modules/pam_motd/pam_motd.c: Constification of constant strings. + (try_to_display_directory): Removed unused function. + (pam_split_string): Replace uint with unsigned int. Fix warnings. + (compare_strings): Fix warnings by proper constification. + (try_to_display_directories_with_overrides): Cleanups. Switch + off the logging if the motd.d directories are missing and they + are default ones. + (pam_sm_open_session): Cleanup warnings. Pass the information + to try_to_display_directories_with_overrides() that non-default + motd options are used. +--- + modules/pam_motd/pam_motd.c | 88 ++++++++++++++++--------------------- + 1 file changed, 37 insertions(+), 51 deletions(-) + +diff --git a/modules/pam_motd/pam_motd.c b/modules/pam_motd/pam_motd.c +index ec3ebd58..dbd718b6 100644 +--- a/modules/pam_motd/pam_motd.c ++++ b/modules/pam_motd/pam_motd.c +@@ -22,6 +22,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -48,8 +49,8 @@ pam_sm_close_session (pam_handle_t *pamh UNUSED, int flags UNUSED, + return PAM_IGNORE; + } + +-static char default_motd[] = DEFAULT_MOTD; +-static char default_motd_dir[] = DEFAULT_MOTD_D; ++static const char default_motd[] = DEFAULT_MOTD; ++static const char default_motd_dir[] = DEFAULT_MOTD_D; + + static void try_to_display_fd(pam_handle_t *pamh, int fd) + { +@@ -75,28 +76,6 @@ static void try_to_display_fd(pam_handle_t *pamh, int fd) + _pam_drop(mtmp); + } + +-static void try_to_display_directory(pam_handle_t *pamh, const char *dirname) +-{ +- DIR *dirp; +- +- dirp = opendir(dirname); +- +- if (dirp != NULL) { +- struct dirent *entry; +- +- while ((entry = readdir(dirp))) { +- int fd = openat(dirfd(dirp), entry->d_name, O_RDONLY); +- +- if (fd >= 0) { +- try_to_display_fd(pamh, fd); +- close(fd); +- } +- } +- +- closedir(dirp); +- } +-} +- + /* + * Split a DELIM-separated string ARG into an array. + * Outputs a newly allocated array of strings OUT_ARG_SPLIT +@@ -104,14 +83,14 @@ static void try_to_display_directory(pam_handle_t *pamh, const char *dirname) + * Returns 0 in case of error, 1 in case of success. + */ + static int pam_split_string(const pam_handle_t *pamh, char *arg, char delim, +- char ***out_arg_split, uint *out_num_strs) ++ char ***out_arg_split, unsigned int *out_num_strs) + { + char *arg_extracted = NULL; + const char *arg_ptr = arg; + char **arg_split = NULL; + char delim_str[2]; +- int i = 0; +- uint num_strs = 0; ++ unsigned int i = 0; ++ unsigned int num_strs = 0; + int retval = 0; + + delim_str[0] = delim; +@@ -126,7 +105,7 @@ static int pam_split_string(const pam_handle_t *pamh, char *arg, char delim, + arg_ptr = strchr(arg_ptr + sizeof(const char), delim); + } + +- arg_split = (char **)calloc(num_strs, sizeof(char *)); ++ arg_split = calloc(num_strs, sizeof(char *)); + if (arg_split == NULL) { + pam_syslog(pamh, LOG_CRIT, "pam_motd: failed to allocate string array"); + goto out; +@@ -180,10 +159,10 @@ static int join_dir_strings(char **strp_out, const char *a_str, const char *b_st + return retval; + } + +-static int compare_strings(const void * a, const void * b) ++static int compare_strings(const void *a, const void *b) + { +- const char *a_str = *(char **)a; +- const char *b_str = *(char **)b; ++ const char *a_str = *(const char * const *)a; ++ const char *b_str = *(const char * const *)b; + + if (a_str == NULL && b_str == NULL) { + return 0; +@@ -205,13 +184,13 @@ static int filter_dirents(const struct dirent *d) + } + + static void try_to_display_directories_with_overrides(pam_handle_t *pamh, +- char **motd_dir_path_split, int num_motd_dirs) ++ char **motd_dir_path_split, unsigned int num_motd_dirs, int report_missing) + { + struct dirent ***dirscans = NULL; +- int *dirscans_sizes = NULL; +- int dirscans_size_total = 0; ++ unsigned int *dirscans_sizes = NULL; ++ unsigned int dirscans_size_total = 0; + char **dirnames_all = NULL; +- int i; ++ unsigned int i; + int i_dirnames = 0; + + if (pamh == NULL || motd_dir_path_split == NULL) { +@@ -221,29 +200,31 @@ static void try_to_display_directories_with_overrides(pam_handle_t *pamh, + goto out; + } + +- if ((dirscans = (struct dirent ***)calloc(num_motd_dirs, +- sizeof(struct dirent **))) == NULL) { ++ if ((dirscans = calloc(num_motd_dirs, sizeof(struct dirent **))) == NULL) { + pam_syslog(pamh, LOG_CRIT, "pam_motd: failed to allocate dirent arrays"); + goto out; + } +- if ((dirscans_sizes = (int *)calloc(num_motd_dirs, sizeof(int))) == NULL) { ++ if ((dirscans_sizes = calloc(num_motd_dirs, sizeof(int))) == NULL) { + pam_syslog(pamh, LOG_CRIT, "pam_motd: failed to allocate dirent array sizes"); + goto out; + } + + for (i = 0; i < num_motd_dirs; i++) { +- dirscans_sizes[i] = scandir(motd_dir_path_split[i], &(dirscans[i]), ++ int rv; ++ rv = scandir(motd_dir_path_split[i], &(dirscans[i]), + filter_dirents, alphasort); +- if (dirscans_sizes[i] < 0) { +- pam_syslog(pamh, LOG_ERR, "pam_motd: error scanning directory %s", motd_dir_path_split[i]); +- dirscans_sizes[i] = 0; ++ if (rv < 0) { ++ if (errno != ENOENT || report_missing) { ++ pam_syslog(pamh, LOG_ERR, "pam_motd: error scanning directory %s: %m", ++ motd_dir_path_split[i]); ++ } ++ dirscans_sizes[i] = rv; + } + dirscans_size_total += dirscans_sizes[i]; + } + + /* Allocate space for all file names found in the directories, including duplicates. */ +- if ((dirnames_all = (char **)calloc(dirscans_size_total, +- sizeof(char *))) == NULL) { ++ if ((dirnames_all = calloc(dirscans_size_total, sizeof(char *))) == NULL) { + pam_syslog(pamh, LOG_CRIT, "pam_motd: failed to allocate dirname array"); + goto out; + } +@@ -253,7 +234,7 @@ static void try_to_display_directories_with_overrides(pam_handle_t *pamh, + } + + for (i = 0; i < num_motd_dirs; i++) { +- int j; ++ unsigned int j; + + for (j = 0; j < dirscans_sizes[i]; j++) { + dirnames_all[i_dirnames] = dirscans[i][j]->d_name; +@@ -265,7 +246,7 @@ static void try_to_display_directories_with_overrides(pam_handle_t *pamh, + sizeof(const char *), compare_strings); + + for (i = 0; i < dirscans_size_total; i++) { +- int j; ++ unsigned int j; + + if (dirnames_all[i] == NULL) { + continue; +@@ -301,7 +282,8 @@ static void try_to_display_directories_with_overrides(pam_handle_t *pamh, + out: + _pam_drop(dirnames_all); + for (i = 0; i < num_motd_dirs; i++) { +- int j; ++ unsigned int j; ++ + for (j = 0; j < dirscans_sizes[i]; j++) { + _pam_drop(dirscans[i][j]); + } +@@ -319,12 +301,13 @@ int pam_sm_open_session(pam_handle_t *pamh, int flags, + int retval = PAM_IGNORE; + const char *motd_path = NULL; + char *motd_path_copy = NULL; +- int num_motd_paths = 0; ++ unsigned int num_motd_paths = 0; + char **motd_path_split = NULL; + const char *motd_dir_path = NULL; + char *motd_dir_path_copy = NULL; +- int num_motd_dir_paths = 0; ++ unsigned int num_motd_dir_paths = 0; + char **motd_dir_path_split = NULL; ++ int report_missing; + + if (flags & PAM_SILENT) { + return retval; +@@ -360,6 +343,9 @@ int pam_sm_open_session(pam_handle_t *pamh, int flags, + if (motd_path == NULL && motd_dir_path == NULL) { + motd_path = default_motd; + motd_dir_path = default_motd_dir; ++ report_missing = 0; ++ } else { ++ report_missing = 1; + } + + if (motd_path != NULL) { +@@ -385,7 +371,7 @@ int pam_sm_open_session(pam_handle_t *pamh, int flags, + } + + if (motd_path_split != NULL) { +- int i; ++ unsigned int i; + + for (i = 0; i < num_motd_paths; i++) { + int fd = open(motd_path_split[i], O_RDONLY, 0); +@@ -402,7 +388,7 @@ int pam_sm_open_session(pam_handle_t *pamh, int flags, + + if (motd_dir_path_split != NULL) + try_to_display_directories_with_overrides(pamh, motd_dir_path_split, +- num_motd_dir_paths); ++ num_motd_dir_paths, report_missing); + + out: + _pam_drop(motd_path_copy); +-- +2.37.3 + +From c2c0434bd634a817f2b16ce7f58fc96c04e88b03 Mon Sep 17 00:00:00 2001 +From: "Dmitry V. Levin" +Date: Sun, 26 Apr 2020 11:12:59 +0000 +Subject: [PATCH] pam_motd: fix NULL dereference when at least one of motd + directories is not available + +* modules/pam_motd/pam_motd.c +(try_to_display_directories_with_overrides): Do not assign -1U to +dirscans_sizes[i] when scandir(motd_dir_path_split[i]) returns an error. + +Resolves: https://bugzilla.altlinux.org/38389 +Fixes: d57ab221 ("pam_motd: Cleanup the code and avoid unnecessary logging") +--- + modules/pam_motd/pam_motd.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/modules/pam_motd/pam_motd.c b/modules/pam_motd/pam_motd.c +index df09b7d0..8147c6fd 100644 +--- a/modules/pam_motd/pam_motd.c ++++ b/modules/pam_motd/pam_motd.c +@@ -219,6 +219,7 @@ static void try_to_display_directories_with_overrides(pam_handle_t *pamh, + pam_syslog(pamh, LOG_ERR, "pam_motd: error scanning directory %s: %m", + motd_dir_path_split[i]); + } ++ } else { + dirscans_sizes[i] = rv; + } + dirscans_size_total += dirscans_sizes[i]; +-- +2.37.3 + diff --git a/SOURCES/pam-1.5.1-pam-faillock-avoid-logging-erroneous.patch b/SOURCES/pam-1.5.1-pam-faillock-avoid-logging-erroneous.patch new file mode 100644 index 0000000..016bb15 --- /dev/null +++ b/SOURCES/pam-1.5.1-pam-faillock-avoid-logging-erroneous.patch @@ -0,0 +1,37 @@ +From 10086bc69663fa819277af244eeb5b629a2403b8 Mon Sep 17 00:00:00 2001 +From: Deepak Das +Date: Mon, 10 Oct 2022 21:21:35 +0530 +Subject: [PATCH] pam_faillock: avoid logging an erroneous consecutive login + failure message + +* modules/pam_faillock/pam_faillock.c (write_tally): Avoid logging +a consecutive login failure message for the root user in case when +even_deny_root is not set. + +Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2082442 +--- + modules/pam_faillock/pam_faillock.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/modules/pam_faillock/pam_faillock.c b/modules/pam_faillock/pam_faillock.c +index ddbb90e7..ca1c7035 100644 +--- a/modules/pam_faillock/pam_faillock.c ++++ b/modules/pam_faillock/pam_faillock.c +@@ -374,9 +374,11 @@ write_tally(pam_handle_t *pamh, struct options *opts, struct tally_data *tallies + } + close(audit_fd); + #endif +- if (!(opts->flags & FAILLOCK_FLAG_NO_LOG_INFO)) { +- pam_syslog(pamh, LOG_INFO, "Consecutive login failures for user %s account temporarily locked", +- opts->user); ++ if (!(opts->flags & FAILLOCK_FLAG_NO_LOG_INFO) && ++ ((opts->flags & FAILLOCK_FLAG_DENY_ROOT) || (opts->uid != 0))) { ++ pam_syslog(pamh, LOG_INFO, ++ "Consecutive login failures for user %s account temporarily locked", ++ opts->user); + } + } + +-- +2.38.1 + diff --git a/SOURCES/pam-1.5.1-pam-faillock-clarify-missing-user.patch b/SOURCES/pam-1.5.1-pam-faillock-clarify-missing-user.patch new file mode 100644 index 0000000..3f15eb8 --- /dev/null +++ b/SOURCES/pam-1.5.1-pam-faillock-clarify-missing-user.patch @@ -0,0 +1,53 @@ +From bcbf145ce925934214e48200c27c9ff736452549 Mon Sep 17 00:00:00 2001 +From: Deepak Das +Date: Mon, 10 Oct 2022 17:55:53 +0530 +Subject: [PATCH] pam_faillock: Clarify missing user faillock files after + reboot + +* modules/pam_faillock/faillock.conf.5.xml: Adding note related to missing +user specific faillock files after reboot. + +* modules/pam_faillock/pam_faillock.8.xml: Adding note related to missing +user specific faillock files after reboot. + +Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2062512 +--- + modules/pam_faillock/faillock.conf.5.xml | 4 ++++ + modules/pam_faillock/pam_faillock.8.xml | 6 ++++++ + 2 files changed, 10 insertions(+) + +diff --git a/modules/pam_faillock/faillock.conf.5.xml b/modules/pam_faillock/faillock.conf.5.xml +index 04a84107..8faa5915 100644 +--- a/modules/pam_faillock/faillock.conf.5.xml ++++ b/modules/pam_faillock/faillock.conf.5.xml +@@ -44,6 +44,10 @@ + The directory where the user files with the failure records are kept. The + default is /var/run/faillock. + ++ ++ Note: These files will disappear after reboot on systems configured with ++ directory /var/run/faillock mounted on virtual memory. ++ + + + +diff --git a/modules/pam_faillock/pam_faillock.8.xml b/modules/pam_faillock/pam_faillock.8.xml +index 79bcbbd0..b7b7b0db 100644 +--- a/modules/pam_faillock/pam_faillock.8.xml ++++ b/modules/pam_faillock/pam_faillock.8.xml +@@ -327,6 +327,12 @@ session required pam_selinux.so open + /var/run/faillock/* + + the files logging the authentication failures for users ++ ++ Note: These files will disappear after reboot on systems configured with ++ directory /var/run/faillock mounted on virtual memory. ++ For persistent storage use the option dir= in ++ file /etc/security/faillock.conf. ++ + + + +-- +2.38.1 + diff --git a/SOURCES/pam-1.5.1-pam-lastlog-check-localtime_r-return-value.patch b/SOURCES/pam-1.5.1-pam-lastlog-check-localtime_r-return-value.patch new file mode 100644 index 0000000..80ad508 --- /dev/null +++ b/SOURCES/pam-1.5.1-pam-lastlog-check-localtime_r-return-value.patch @@ -0,0 +1,41 @@ +From 40c271164dbcebfc5304d0537a42fb42e6b6803c Mon Sep 17 00:00:00 2001 +From: Iker Pedrosa +Date: Mon, 26 Sep 2022 12:16:53 +0200 +Subject: [PATCH] pam_lastlog: check localtime_r() return value + +Check the return value of localtime_r() before calling strftime(). This +function crashes if the argument is NULL. + +Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2012871 + +Signed-off-by: Iker Pedrosa +--- + modules/pam_lastlog/pam_lastlog.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/modules/pam_lastlog/pam_lastlog.c b/modules/pam_lastlog/pam_lastlog.c +index abd048df..121e7560 100644 +--- a/modules/pam_lastlog/pam_lastlog.c ++++ b/modules/pam_lastlog/pam_lastlog.c +@@ -573,12 +573,12 @@ last_login_failed(pam_handle_t *pamh, int announce, const char *user, time_t llt + time_t lf_time; + + lf_time = utuser.ut_tv.tv_sec; +- tm = localtime_r (&lf_time, &tm_buf); +- strftime (the_time, sizeof (the_time), +- /* TRANSLATORS: "strftime options for date of last login" */ +- _(" %a %b %e %H:%M:%S %Z %Y"), tm); +- +- date = the_time; ++ if ((tm = localtime_r (&lf_time, &tm_buf)) != NULL) { ++ strftime (the_time, sizeof (the_time), ++ /* TRANSLATORS: "strftime options for date of last login" */ ++ _(" %a %b %e %H:%M:%S %Z %Y"), tm); ++ date = the_time; ++ } + } + + /* we want & have the host? */ +-- +2.38.1 + diff --git a/SPECS/pam.spec b/SPECS/pam.spec index 77e71c1..25deb7d 100644 --- a/SPECS/pam.spec +++ b/SPECS/pam.spec @@ -3,7 +3,7 @@ Summary: An extensible library which provides authentication for applications Name: pam Version: 1.3.1 -Release: 24%{?dist} +Release: 25%{?dist} # The library is BSD licensed with option to relicense as GPLv2+ # - this option is redundant as the BSD license allows that anyway. # pam_timestamp, pam_loginuid, and pam_console modules are GPLv2+. @@ -88,6 +88,15 @@ Patch59: pam-1.3.1-pam-usertype-SYS_UID_MAX.patch # https://github.com/linux-pam/linux-pam/commit/ba2f6dd8b81ea2a58262c1709bec906b6852591d # https://github.com/linux-pam/linux-pam/commit/1180bde923a22605fe8075cd1fe7992ed7513411 Patch60: pam-1.3.1-pam-pwhistory-load-conf-from-file.patch +# https://github.com/linux-pam/linux-pam/commit/d57ab22133654033ee1da89f128a81572d320985 +# https://github.com/linux-pam/linux-pam/commit/c2c0434bd634a817f2b16ce7f58fc96c04e88b03 +Patch61: pam-1.3.1-pam-motd-avoid-unnecessary-logging.patch +# https://github.com/linux-pam/linux-pam/commit/40c271164dbcebfc5304d0537a42fb42e6b6803c +Patch62: pam-1.5.1-pam-lastlog-check-localtime_r-return-value.patch +# https://github.com/linux-pam/linux-pam/commit/bcbf145ce925934214e48200c27c9ff736452549 +Patch63: pam-1.5.1-pam-faillock-clarify-missing-user.patch +# https://github.com/linux-pam/linux-pam/commit/10086bc69663fa819277af244eeb5b629a2403b8 +Patch64: pam-1.5.1-pam-faillock-avoid-logging-erroneous.patch %define _pamlibdir %{_libdir} %define _moduledir %{_libdir}/security @@ -196,6 +205,10 @@ cp %{SOURCE18} . %patch58 -p1 -b .faillock-load-conf-from-file %patch59 -p1 -b .pam-usertype-SYS_UID_MAX %patch60 -p1 -b .pam-pwhistory-load-conf-from-file +%patch61 -p1 -b .pam-motd-avoid-unnecessary-logging +%patch62 -p1 -b .pam-lastlog-check-localtime_r-return-value +%patch63 -p1 -b .pam-faillock-clarify-missing-user +%patch64 -p1 -b .pam-faillock-avoid-logging-erroneous autoreconf -i @@ -449,6 +462,12 @@ done %doc doc/specs/rfc86.0.txt %changelog +* Tue Nov 29 2022 Iker Pedrosa - 1.3.1-25 +- pam_motd: avoid unnecessary logging. Resolves: #2091062 +- pam_lastlog: check localtime_r() return value. Resolves: #2012871 +- pam_faillock: clarify missing user faillock files after reboot. Resolves: #2062512 +- pam_faillock: avoid logging an erroneous consecutive login failure message. Resolves: #2082442 + * Thu Sep 29 2022 Iker Pedrosa - 1.3.1-24 - pam_pwhistory: load configuration from file. Resolves: #2068461