rpms/pam
5
0
Fork 0
Code Issues Pull Requests Releases Activity

More pam_faillock updates.

Browse Source
This commit is contained in:
Tomas Mraz 2014-08-13 16:03:00 +02:00
parent b582f50a36
commit 140efce0ea
3 changed files with 8 additions and 172 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
pam-1.1.1-faillock.patch
View File

@ -433,7 +433,7 @@ diff -up Linux-PAM-1.1.1/modules/pam_faillock/faillock.8.xml.faillock Linux-PAM-
diff -up Linux-PAM-1.1.1/modules/pam_faillock/main.c.faillock Linux-PAM-1.1.1/modules/pam_faillock/main.c diff -up Linux-PAM-1.1.1/modules/pam_faillock/main.c.faillock Linux-PAM-1.1.1/modules/pam_faillock/main.c
--- Linux-PAM-1.1.1/modules/pam_faillock/main.c.faillock 2011-01-25 18:24:43.000000000 +0100 --- Linux-PAM-1.1.1/modules/pam_faillock/main.c.faillock 2011-01-25 18:24:43.000000000 +0100
+++ Linux-PAM-1.1.1/modules/pam_faillock/main.c 2011-01-25 18:24:56.000000000 +0100 +++ Linux-PAM-1.1.1/modules/pam_faillock/main.c 2011-01-25 18:24:56.000000000 +0100
@@ -0,0 +1,233 @@ @@ -0,0 +1,235 @@
+/* +/*
+ * Copyright (c) 2010 Tomas Mraz <tmraz@redhat.com> + * Copyright (c) 2010 Tomas Mraz <tmraz@redhat.com>
+ * + *
@ -478,6 +478,8 @@ diff -up Linux-PAM-1.1.1/modules/pam_faillock/main.c.faillock Linux-PAM-1.1.1/mo
+#include <errno.h> +#include <errno.h>
+#include <pwd.h> +#include <pwd.h>
+#include <time.h> +#include <time.h>
+#include <sys/types.h>
+#include <unistd.h>
+#ifdef HAVE_LIBAUDIT +#ifdef HAVE_LIBAUDIT
+#include <libaudit.h> +#include <libaudit.h>
+#endif +#endif
@ -717,7 +719,7 @@ diff -up Linux-PAM-1.1.1/modules/pam_faillock/Makefile.am.faillock Linux-PAM-1.1
diff -up Linux-PAM-1.1.1/modules/pam_faillock/pam_faillock.c.faillock Linux-PAM-1.1.1/modules/pam_faillock/pam_faillock.c diff -up Linux-PAM-1.1.1/modules/pam_faillock/pam_faillock.c.faillock Linux-PAM-1.1.1/modules/pam_faillock/pam_faillock.c
--- Linux-PAM-1.1.1/modules/pam_faillock/pam_faillock.c.faillock 2011-01-25 18:24:43.000000000 +0100 --- Linux-PAM-1.1.1/modules/pam_faillock/pam_faillock.c.faillock 2011-01-25 18:24:43.000000000 +0100
+++ Linux-PAM-1.1.1/modules/pam_faillock/pam_faillock.c 2011-01-25 18:24:56.000000000 +0100 +++ Linux-PAM-1.1.1/modules/pam_faillock/pam_faillock.c 2011-01-25 18:24:56.000000000 +0100
@@ -0,0 +1,553 @@ @@ -0,0 +1,556 @@
+/* +/*
+ * Copyright (c) 2010 Tomas Mraz <tmraz@redhat.com> + * Copyright (c) 2010 Tomas Mraz <tmraz@redhat.com>
+ * + *
@ -984,6 +986,7 @@ diff -up Linux-PAM-1.1.1/modules/pam_faillock/pam_faillock.c.faillock Linux-PAM-
+ if (opts->action != FAILLOCK_ACTION_PREAUTH) { /* do not audit in preauth */ + if (opts->action != FAILLOCK_ACTION_PREAUTH) { /* do not audit in preauth */
+ char buf[64]; + char buf[64];
+ int audit_fd; + int audit_fd;
+ const void *rhost = NULL, *tty = NULL;
+ +
+ audit_fd = audit_open(); + audit_fd = audit_open();
+ /* If there is an error & audit support is in the kernel report error */ + /* If there is an error & audit support is in the kernel report error */
@ -991,9 +994,11 @@ diff -up Linux-PAM-1.1.1/modules/pam_faillock/pam_faillock.c.faillock Linux-PAM-
+ errno == EAFNOSUPPORT)) + errno == EAFNOSUPPORT))
+ return PAM_SYSTEM_ERR; + return PAM_SYSTEM_ERR;
+ +
+ (void)pam_get_item(pamh, PAM_TTY, &tty);
+ (void)pam_get_item(pamh, PAM_RHOST, &rhost);
+ snprintf(buf, sizeof(buf), "pam_faillock uid=%u ", opts->uid); + snprintf(buf, sizeof(buf), "pam_faillock uid=%u ", opts->uid);
+ audit_log_user_message(audit_fd, AUDIT_RESP_ACCT_UNLOCK_TIMED, buf, + audit_log_user_message(audit_fd, AUDIT_RESP_ACCT_UNLOCK_TIMED, buf,
+ NULL, NULL, NULL, 1); + rhost, NULL, tty, 1);
+ } + }
+#endif +#endif
+ opts->flags |= FAILLOCK_FLAG_UNLOCKED; + opts->flags |= FAILLOCK_FLAG_UNLOCKED;

167
pam-1.1.3-faillock-screensaver.patch
View File

@ -1,167 +0,0 @@
diff -up Linux-PAM-1.1.3/modules/pam_faillock/faillock.c.screensaver Linux-PAM-1.1.3/modules/pam_faillock/faillock.c
--- Linux-PAM-1.1.3/modules/pam_faillock/faillock.c.screensaver 2010-11-10 11:46:07.000000000 +0100
+++ Linux-PAM-1.1.3/modules/pam_faillock/faillock.c 2010-11-10 11:46:07.000000000 +0100
@@ -41,13 +41,14 @@
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/file.h>
+#include <sys/stat.h>
#include <fcntl.h>
#include <security/pam_modutil.h>
#include "faillock.h"
int
-open_tally (const char *dir, const char *user, int create)
+open_tally (const char *dir, const char *user, uid_t uid, int create)
{
char *path;
int flags = O_RDWR;
@@ -69,8 +70,18 @@ open_tally (const char *dir, const char
fd = open(path, flags, 0600);
- if (fd != -1)
+ free(path);
+
+ if (fd != -1) {
+ struct stat st;
+
while (flock(fd, LOCK_EX) == -1 && errno == EINTR);
+ if (fstat(fd, &st) == 0) {
+ if (st.st_uid != uid) {
+ fchown(fd, uid, -1);
+ }
+ }
+ }
return fd;
}
diff -up Linux-PAM-1.1.3/modules/pam_faillock/faillock.h.screensaver Linux-PAM-1.1.3/modules/pam_faillock/faillock.h
--- Linux-PAM-1.1.3/modules/pam_faillock/faillock.h.screensaver 2010-11-10 11:46:07.000000000 +0100
+++ Linux-PAM-1.1.3/modules/pam_faillock/faillock.h 2010-11-10 11:46:07.000000000 +0100
@@ -45,6 +45,7 @@
#define _FAILLOCK_H
#include <stdint.h>
+#include <sys/types.h>
#define TALLY_STATUS_VALID 0x1 /* the tally file entry is valid */
#define TALLY_STATUS_RHOST 0x2 /* the source is rhost */
@@ -65,7 +66,7 @@ struct tally_data {
#define FAILLOCK_DEFAULT_TALLYDIR "/var/run/faillock"
-int open_tally(const char *dir, const char *user, int create);
+int open_tally(const char *dir, const char *user, uid_t uid, int create);
int read_tally(int fd, struct tally_data *tallies);
int update_tally(int fd, struct tally_data *tallies);
#endif
diff -up Linux-PAM-1.1.3/modules/pam_faillock/main.c.screensaver Linux-PAM-1.1.3/modules/pam_faillock/main.c
--- Linux-PAM-1.1.3/modules/pam_faillock/main.c.screensaver 2010-11-10 11:46:07.000000000 +0100
+++ Linux-PAM-1.1.3/modules/pam_faillock/main.c 2010-11-10 11:46:07.000000000 +0100
@@ -106,8 +106,11 @@ do_user(struct options *opts, const char
int fd;
int rv;
struct tally_data tallies;
+ struct passwd *pwd;
- fd = open_tally(opts->dir, user, 0);
+ pwd = getpwnam(user);
+
+ fd = open_tally(opts->dir, user, pwd != NULL ? pwd->pw_uid : 0, 0);
if (fd == -1) {
if (errno == ENOENT) {
@@ -134,9 +137,8 @@ do_user(struct options *opts, const char
#ifdef HAVE_LIBAUDIT
}
if ((audit_fd=audit_open()) >= 0) {
- struct passwd *pwd;
- if ((pwd=getpwnam(user)) != NULL) {
+ if (pwd != NULL) {
snprintf(buf, sizeof(buf), "faillock reset uid=%u",
pwd->pw_uid);
audit_log_user_message(audit_fd, AUDIT_USER_ACCT,
diff -up Linux-PAM-1.1.3/modules/pam_faillock/pam_faillock.c.screensaver Linux-PAM-1.1.3/modules/pam_faillock/pam_faillock.c
--- Linux-PAM-1.1.3/modules/pam_faillock/pam_faillock.c.screensaver 2010-11-10 11:46:07.000000000 +0100
+++ Linux-PAM-1.1.3/modules/pam_faillock/pam_faillock.c 2010-11-10 11:46:07.000000000 +0100
@@ -213,7 +213,7 @@ check_tally(pam_handle_t *pamh, struct o
opts->now = time(NULL);
- tfd = open_tally(opts->dir, opts->user, 0);
+ tfd = open_tally(opts->dir, opts->user, opts->uid, 0);
*fd = tfd;
@@ -289,9 +289,14 @@ reset_tally(pam_handle_t *pamh, struct o
{
int rv;
- while ((rv=ftruncate(*fd, 0)) == -1 && errno == EINTR);
- if (rv == -1) {
- pam_syslog(pamh, LOG_ERR, "Error clearing the tally file for %s: %m", opts->user);
+ if (*fd == -1) {
+ *fd = open_tally(opts->dir, opts->user, opts->uid, 1);
+ }
+ else {
+ while ((rv=ftruncate(*fd, 0)) == -1 && errno == EINTR);
+ if (rv == -1) {
+ pam_syslog(pamh, LOG_ERR, "Error clearing the tally file for %s: %m", opts->user);
+ }
}
}
@@ -306,7 +311,7 @@ write_tally(pam_handle_t *pamh, struct o
const void *source = NULL;
if (*fd == -1) {
- *fd = open_tally(opts->dir, opts->user, 1);
+ *fd = open_tally(opts->dir, opts->user, opts->uid, 1);
}
if (*fd == -1) {
if (errno == EACCES) {
@@ -463,7 +468,7 @@ pam_sm_authenticate(pam_handle_t *pamh,
case FAILLOCK_ACTION_AUTHSUCC:
rv = check_tally(pamh, &opts, &tallies, &fd);
- if (rv == PAM_SUCCESS && fd != -1) {
+ if (rv == PAM_SUCCESS) {
reset_tally(pamh, &opts, &fd);
}
break;
@@ -511,10 +516,8 @@ pam_sm_acct_mgmt(pam_handle_t *pamh, int
return rv;
}
- check_tally(pamh, &opts, &tallies, &fd);
- if (fd != -1) {
- reset_tally(pamh, &opts, &fd);
- }
+ check_tally(pamh, &opts, &tallies, &fd); /* for auditing */
+ reset_tally(pamh, &opts, &fd);
tally_cleanup(&tallies, fd);
diff -up Linux-PAM-1.1.3/modules/pam_faillock/pam_faillock.8.xml.screensaver Linux-PAM-1.1.3/modules/pam_faillock/pam_faillock.8.xml
--- Linux-PAM-1.1.3/modules/pam_faillock/pam_faillock.8.xml.screensaver 2010-11-10 11:46:07.000000000 +0100
+++ Linux-PAM-1.1.3/modules/pam_faillock/pam_faillock.8.xml 2010-11-10 11:47:14.000000000 +0100
@@ -277,13 +277,9 @@
from the <emphasis>pam_tally2</emphasis> module setup.
</para>
<para>
- There is no setuid wrapper for access to the data file such as when the
- <emphasis remap='B'>pam_faillock.so</emphasis> module is called from
- a screensaver. As this would make it impossible to share PAM configuration
- with such services the following workaround is used: If the data file
- cannot be opened because of insufficient permissions
- (<errorcode>EACCES</errorcode>) the module returns
- <errorcode>PAM_SUCCESS</errorcode>.
+ The individual files with the failure records are created as owned by
+ the user. This allows <emphasis remap='B'>pam_faillock.so</emphasis> module
+ to work correctly when it is called from a screensaver.
</para>
<para>
Note that using the module in <option>preauth</option> without the

2
pam.spec
View File

@ -35,7 +35,6 @@ Patch5: pam-1.1.0-notally.patch
Patch8: pam-1.1.1-faillock.patch Patch8: pam-1.1.1-faillock.patch
Patch9: pam-1.1.6-noflex.patch Patch9: pam-1.1.6-noflex.patch
Patch10: pam-1.1.3-nouserenv.patch Patch10: pam-1.1.3-nouserenv.patch
Patch12: pam-1.1.3-faillock-screensaver.patch
Patch13: pam-1.1.6-limits-user.patch Patch13: pam-1.1.6-limits-user.patch
Patch15: pam-1.1.6-full-relro.patch Patch15: pam-1.1.6-full-relro.patch
# FIPS related - non upstreamable # FIPS related - non upstreamable
@ -122,7 +121,6 @@ cp %{SOURCE18} .
%patch8 -p1 -b .faillock %patch8 -p1 -b .faillock
%patch9 -p1 -b .noflex %patch9 -p1 -b .noflex
%patch10 -p1 -b .nouserenv %patch10 -p1 -b .nouserenv
%patch12 -p1 -b .screensaver
%patch13 -p1 -b .limits %patch13 -p1 -b .limits
%patch15 -p1 -b .relro %patch15 -p1 -b .relro
%patch20 -p1 -b .no-fallback %patch20 -p1 -b .no-fallback