diff --git a/.gitignore b/.gitignore index 28c7b90..0244ad4 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,2 @@ -SOURCES/Linux-PAM-1.3.1.tar.xz -SOURCES/pam-redhat-0.99.11.tar.bz2 +Linux-PAM-1.6.1.tar.xz +pam-redhat-1.2.0.tar.xz diff --git a/.pam.metadata b/.pam.metadata deleted file mode 100644 index ff5cf70..0000000 --- a/.pam.metadata +++ /dev/null @@ -1,2 +0,0 @@ -e89b6d279c9bf8cb495dfc0b3f3931eb50f818e9 SOURCES/Linux-PAM-1.3.1.tar.xz -42206fe8319723ef23ab646b2eab496c86de3f5b SOURCES/pam-redhat-0.99.11.tar.bz2 diff --git a/Linux-PAM-1.6.1.tar.xz.asc b/Linux-PAM-1.6.1.tar.xz.asc new file mode 100644 index 0000000..3e67bc4 --- /dev/null +++ b/Linux-PAM-1.6.1.tar.xz.asc @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIcBAABCgAGBQJmFWt/AAoJEKgEH6g54W42NCwP/iWl8igdScTreVF6zV79Dqu1 +sl+ZjBr/dL+DOTcotsRnoAZUOy4ug3iktMZr1t0BMpWUorNmUofH4SZuhsX0CgRq +47t5mVqCakwn4JLq8J9cLOciMno6ips5ZT4RbMgzRYd1WcBurCAxQSNLP3aQGgub +RFObkqw5814ksz9Ge6QVhJ4l9P0wUoKfcpkzHj2Vq+cy0EzlBtnBGCHrMDgrz5aT +mXqGVvWTPO+lR2S+7wOLUtPoRv0uvN6h97ZszaoGoJ6wa6yYwOYz12/AiIsVQhet +cnr29ymuwPDqlrYGD1Hb0+ZUQExjVDQY90hdJ/ZntUlK7CY/2SotpDGB9kR8dTYJ +fpIVmR6GEZ+xSjBqa7RaiL8ieZCgT3TIvsMqteiFkqI+2lhlSGHX3g3oNSd3sbqd +PLok6W4L+xWDp89aMyYDDs/ISjBt5sSNK4NOOTZIMK4oeScGJJvrDL3S5DOSk1ku +o3l9N62WStD7fk0LYnyUGZORg/ccK6Yy2fV22zBMm/76PoyA1yHfFxCW+HwwmcqR +0riaFjA8cesZ3Dj79q24U3FRVdW5fTF9gS/5mK/Yj51KMMzTkUmbjksEC/AEBKzB +9laXxPdIeKUwNlGs7Heo/NE87u4OZfyihwpzLaTcOzbpN3zDyH6aH5poDs1FSaQ2 +UoUkHsbCWJU/ksn/9BIQ +=Dbz2 +-----END PGP SIGNATURE----- diff --git a/SOURCES/Linux-PAM-1.3.1.tar.xz.asc b/SOURCES/Linux-PAM-1.3.1.tar.xz.asc deleted file mode 100644 index 7057c18..0000000 --- a/SOURCES/Linux-PAM-1.3.1.tar.xz.asc +++ /dev/null @@ -1,7 +0,0 @@ ------BEGIN PGP SIGNATURE----- -Version: GnuPG v2 - -iD8DBQBa/r62bRp/BS5ZJLsRArnKAJ9pGaJHpsEsbOVa5dBQLHYC4DhPuACeJNrg -+DaNc8W13E4Z2ZEUSsgUGe4= -=aSTW ------END PGP SIGNATURE----- diff --git a/SOURCES/fingerprint-auth.pamd b/SOURCES/fingerprint-auth.pamd deleted file mode 100644 index aae6ecc..0000000 --- a/SOURCES/fingerprint-auth.pamd +++ /dev/null @@ -1,19 +0,0 @@ -#%PAM-1.0 -# This file is auto-generated. -# User changes will be destroyed the next time authselect is run. -auth required pam_env.so -auth sufficient pam_fprintd.so -auth required pam_deny.so - -account required pam_unix.so -account sufficient pam_localuser.so -account sufficient pam_succeed_if.so uid < 500 quiet -account required pam_permit.so - -password required pam_deny.so - -session optional pam_keyinit.so revoke -session required pam_limits.so --session optional pam_systemd.so -session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid -session required pam_unix.so diff --git a/SOURCES/pam-1.1.0-console-nochmod.patch b/SOURCES/pam-1.1.0-console-nochmod.patch deleted file mode 100644 index e41adad..0000000 --- a/SOURCES/pam-1.1.0-console-nochmod.patch +++ /dev/null @@ -1,26 +0,0 @@ -diff -up Linux-PAM-1.1.0/modules/pam_console/console.handlers.nochmod Linux-PAM-1.1.0/modules/pam_console/console.handlers ---- Linux-PAM-1.1.0/modules/pam_console/console.handlers.nochmod 2008-12-16 13:37:52.000000000 +0100 -+++ Linux-PAM-1.1.0/modules/pam_console/console.handlers 2009-09-01 17:20:08.000000000 +0200 -@@ -15,5 +15,3 @@ - # touch unlock wait /var/run/console-unlocked - - console consoledevs tty[0-9][0-9]* vc/[0-9][0-9]* :[0-9]+\.[0-9]+ :[0-9]+ --/sbin/pam_console_apply lock logfail wait -t tty -s --/sbin/pam_console_apply unlock logfail wait -r -t tty -s -diff -up Linux-PAM-1.1.0/modules/pam_console/Makefile.am.nochmod Linux-PAM-1.1.0/modules/pam_console/Makefile.am ---- Linux-PAM-1.1.0/modules/pam_console/Makefile.am.nochmod 2008-12-16 13:37:52.000000000 +0100 -+++ Linux-PAM-1.1.0/modules/pam_console/Makefile.am 2009-09-01 17:42:47.000000000 +0200 -@@ -38,7 +38,6 @@ sbin_PROGRAMS = pam_console_apply - - - secureconf_DATA = console.perms console.handlers --permsd_DATA = 50-default.perms - - FLEX_OPTS = -Cr - BISON_OPTS = -d -@@ -62,4 +61,5 @@ configfile.c: configfile.tab.c configfil - - install-data-local: - mkdir -p $(DESTDIR)$(secureconfdir)/console.apps -+ mkdir -p $(DESTDIR)$(permsddir) - mkdir -m $(LOCKMODE) -p -p $(DESTDIR)$(LOCKDIR) diff --git a/SOURCES/pam-1.1.0-notally.patch b/SOURCES/pam-1.1.0-notally.patch deleted file mode 100644 index 0a98952..0000000 --- a/SOURCES/pam-1.1.0-notally.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -up Linux-PAM-1.1.0/modules/Makefile.am.notally Linux-PAM-1.1.0/modules/Makefile.am ---- Linux-PAM-1.1.0/modules/Makefile.am.notally 2009-07-27 17:39:25.000000000 +0200 -+++ Linux-PAM-1.1.0/modules/Makefile.am 2009-09-01 17:40:16.000000000 +0200 -@@ -10,7 +10,7 @@ SUBDIRS = pam_access pam_cracklib pam_de - pam_mkhomedir pam_motd pam_namespace pam_nologin \ - pam_permit pam_pwhistory pam_rhosts pam_rootok pam_securetty \ - pam_selinux pam_sepermit pam_shells pam_stress \ -- pam_succeed_if pam_tally pam_tally2 pam_time pam_timestamp \ -+ pam_succeed_if pam_time pam_timestamp \ - pam_tty_audit pam_umask \ - pam_unix pam_userdb pam_warn pam_wheel pam_xauth - diff --git a/SOURCES/pam-1.1.1-console-errmsg.patch b/SOURCES/pam-1.1.1-console-errmsg.patch deleted file mode 100644 index f2fe846..0000000 --- a/SOURCES/pam-1.1.1-console-errmsg.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -up Linux-PAM-1.1.1/modules/pam_console/pam_console_apply.c.errmsg Linux-PAM-1.1.1/modules/pam_console/pam_console_apply.c ---- Linux-PAM-1.1.1/modules/pam_console/pam_console_apply.c.errmsg 2008-12-16 13:37:52.000000000 +0100 -+++ Linux-PAM-1.1.1/modules/pam_console/pam_console_apply.c 2014-06-19 13:23:28.948343737 +0200 -@@ -65,7 +65,7 @@ parse_files(void) - on system locale */ - oldlocale = setlocale(LC_COLLATE, "C"); - -- rc = glob(PERMS_GLOB, GLOB_NOCHECK, NULL, &globbuf); -+ rc = glob(PERMS_GLOB, 0, NULL, &globbuf); - setlocale(LC_COLLATE, oldlocale); - if (rc) - return; diff --git a/SOURCES/pam-1.1.3-nouserenv.patch b/SOURCES/pam-1.1.3-nouserenv.patch deleted file mode 100644 index f3a742c..0000000 --- a/SOURCES/pam-1.1.3-nouserenv.patch +++ /dev/null @@ -1,27 +0,0 @@ -diff -up pam/modules/pam_env/pam_env.c.nouserenv pam/modules/pam_env/pam_env.c ---- pam/modules/pam_env/pam_env.c.nouserenv 2010-10-20 09:59:30.000000000 +0200 -+++ pam/modules/pam_env/pam_env.c 2010-11-01 14:42:01.000000000 +0100 -@@ -10,7 +10,7 @@ - #define DEFAULT_READ_ENVFILE 1 - - #define DEFAULT_USER_ENVFILE ".pam_environment" --#define DEFAULT_USER_READ_ENVFILE 1 -+#define DEFAULT_USER_READ_ENVFILE 0 - - #include "config.h" - -diff -up pam/modules/pam_env/pam_env.8.xml.nouserenv pam/modules/pam_env/pam_env.8.xml ---- pam/modules/pam_env/pam_env.8.xml.nouserenv 2010-10-20 09:59:30.000000000 +0200 -+++ pam/modules/pam_env/pam_env.8.xml 2010-11-01 14:42:01.000000000 +0100 -@@ -147,7 +147,10 @@ - - - Turns on or off the reading of the user specific environment -- file. 0 is off, 1 is on. By default this option is on. -+ file. 0 is off, 1 is on. By default this option is off as user -+ supplied environment variables in the PAM environment could affect -+ behavior of subsequent modules in the stack without the consent -+ of the system administrator. - - - diff --git a/SOURCES/pam-1.1.6-limits-user.patch b/SOURCES/pam-1.1.6-limits-user.patch deleted file mode 100644 index 3c17b78..0000000 --- a/SOURCES/pam-1.1.6-limits-user.patch +++ /dev/null @@ -1,20 +0,0 @@ -diff -up Linux-PAM-1.1.6/modules/pam_limits/limits.conf.limits Linux-PAM-1.1.6/modules/pam_limits/limits.conf ---- Linux-PAM-1.1.6/modules/pam_limits/limits.conf.limits 2012-08-15 13:08:43.000000000 +0200 -+++ Linux-PAM-1.1.6/modules/pam_limits/limits.conf 2013-03-14 16:43:37.615087671 +0100 -@@ -1,5 +1,16 @@ - # /etc/security/limits.conf - # -+#This file sets the resource limits for the users logged in via PAM. -+#It does not affect resource limits of the system services. -+# -+#Also note that configuration files in /etc/security/limits.d directory, -+#which are read in alphabetical order, override the settings in this -+#file in case the domain is the same or more specific. -+#That means for example that setting a limit for wildcard domain here -+#can be overriden with a wildcard setting in a config file in the -+#subdirectory, but a user specific setting here can be overriden only -+#with a user specific setting in the subdirectory. -+# - #Each line describes a limit for a user in the form: - # - # diff --git a/SOURCES/pam-1.1.8-audit-user-mgmt.patch b/SOURCES/pam-1.1.8-audit-user-mgmt.patch deleted file mode 100644 index 277a569..0000000 --- a/SOURCES/pam-1.1.8-audit-user-mgmt.patch +++ /dev/null @@ -1,31 +0,0 @@ -diff -up Linux-PAM-1.1.8/modules/pam_tally2/pam_tally2.c.audit-user-mgmt Linux-PAM-1.1.8/modules/pam_tally2/pam_tally2.c ---- Linux-PAM-1.1.8/modules/pam_tally2/pam_tally2.c.audit-user-mgmt 2013-06-18 16:11:21.000000000 +0200 -+++ Linux-PAM-1.1.8/modules/pam_tally2/pam_tally2.c 2014-10-17 12:09:12.965490940 +0200 -@@ -997,9 +997,9 @@ main( int argc UNUSED, char **argv ) - #ifdef HAVE_LIBAUDIT - char buf[64]; - int audit_fd = audit_open(); -- snprintf(buf, sizeof(buf), "pam_tally2 uid=%u reset=%hu", uid, cline_reset); -- audit_log_user_message(audit_fd, AUDIT_USER_ACCT, -- buf, NULL, NULL, ttyname(STDIN_FILENO), 1); -+ snprintf(buf, sizeof(buf), "pam_tally2 reset=%hu", cline_reset); -+ audit_log_acct_message(audit_fd, AUDIT_USER_MGMT, NULL, -+ buf, NULL, uid, NULL, NULL, ttyname(STDIN_FILENO), 1); - if (audit_fd >=0) - close(audit_fd); - #endif -@@ -1040,11 +1040,10 @@ main( int argc UNUSED, char **argv ) - } - else if ( !cline_reset ) { - #ifdef HAVE_LIBAUDIT -- char buf[64]; - int audit_fd = audit_open(); -- snprintf(buf, sizeof(buf), "pam_tally2 uid=all reset=0"); -- audit_log_user_message(audit_fd, AUDIT_USER_ACCT, -- buf, NULL, NULL, ttyname(STDIN_FILENO), 1); -+ audit_log_acct_message(audit_fd, AUDIT_USER_MGMT, NULL, -+ "pam_tally2-reset-all-accts reset=0", "*", -1, -+ NULL, NULL, ttyname(STDIN_FILENO), 1); - if (audit_fd >=0) - close(audit_fd); - #endif diff --git a/SOURCES/pam-1.1.8-full-relro.patch b/SOURCES/pam-1.1.8-full-relro.patch deleted file mode 100644 index 07c69e3..0000000 --- a/SOURCES/pam-1.1.8-full-relro.patch +++ /dev/null @@ -1,88 +0,0 @@ -diff -up Linux-PAM-1.1.8/modules/pam_console/Makefile.am.relro Linux-PAM-1.1.8/modules/pam_console/Makefile.am ---- Linux-PAM-1.1.8/modules/pam_console/Makefile.am.relro 2014-08-13 16:02:49.000000000 +0200 -+++ Linux-PAM-1.1.8/modules/pam_console/Makefile.am 2014-09-10 17:14:33.245554314 +0200 -@@ -33,6 +33,8 @@ pam_console_la_LIBADD = -L$(top_builddir - - pam_console_apply_LDADD = -L$(top_builddir)/libpam -lpam - -+pam_console_apply_LDFLAGS = -Wl,-z,now @PIE_LDFLAGS@ -+ - securelib_LTLIBRARIES = pam_console.la - sbin_PROGRAMS = pam_console_apply - -@@ -47,7 +49,7 @@ pam_console_apply_SOURCES = pam_console_ - configfile.c configfile.h hashtable.c hashtable.h hashtable_private.h - - pam_console_la_CFLAGS = $(AM_CFLAGS) --pam_console_apply_CFLAGS = $(AM_CFLAGS) -+pam_console_apply_CFLAGS = $(AM_CFLAGS) @PIE_CFLAGS@ - - configfile.tab.c: configfile.y - $(YACC) $(BISON_OPTS) -o $@ -p _pc_yy $< -diff -up Linux-PAM-1.1.8/modules/pam_filter/upperLOWER/Makefile.am.relro Linux-PAM-1.1.8/modules/pam_filter/upperLOWER/Makefile.am ---- Linux-PAM-1.1.8/modules/pam_filter/upperLOWER/Makefile.am.relro 2014-09-10 17:17:20.273401344 +0200 -+++ Linux-PAM-1.1.8/modules/pam_filter/upperLOWER/Makefile.am 2014-09-10 17:17:07.857115369 +0200 -@@ -9,7 +9,7 @@ securelibfilterdir = $(SECUREDIR)/pam_fi - - AM_CFLAGS = -I$(top_srcdir)/libpam/include -I$(top_srcdir)/libpamc/include \ - -I$(srcdir)/.. @PIE_CFLAGS@ --AM_LDFLAGS = @PIE_LDFLAGS@ -+AM_LDFLAGS = -Wl,-z,now @PIE_LDFLAGS@ - LDADD = $(top_builddir)/libpam/libpam.la - - securelibfilter_PROGRAMS = upperLOWER -diff -up Linux-PAM-1.1.8/modules/pam_mkhomedir/Makefile.am.relro Linux-PAM-1.1.8/modules/pam_mkhomedir/Makefile.am ---- Linux-PAM-1.1.8/modules/pam_mkhomedir/Makefile.am.relro 2013-06-18 16:11:21.000000000 +0200 -+++ Linux-PAM-1.1.8/modules/pam_mkhomedir/Makefile.am 2014-09-10 17:18:42.922304935 +0200 -@@ -30,6 +30,8 @@ endif - - sbin_PROGRAMS = mkhomedir_helper - mkhomedir_helper_SOURCES = mkhomedir_helper.c -+mkhomedir_helper_CFLAGS = $(AM_CFLAGS) @PIE_CFLAGS@ -+mkhomedir_helper_LDFLAGS = -Wl,-z,now @PIE_LDFLAGS@ - mkhomedir_helper_LDADD = $(top_builddir)/libpam/libpam.la - - if ENABLE_REGENERATE_MAN -diff -up Linux-PAM-1.1.8/modules/pam_tally2/Makefile.am.relro Linux-PAM-1.1.8/modules/pam_tally2/Makefile.am ---- Linux-PAM-1.1.8/modules/pam_tally2/Makefile.am.relro 2013-06-18 16:11:21.000000000 +0200 -+++ Linux-PAM-1.1.8/modules/pam_tally2/Makefile.am 2014-09-10 17:22:04.339944040 +0200 -@@ -26,6 +26,8 @@ if HAVE_VERSIONING - pam_tally2_la_LDFLAGS += -Wl,--version-script=$(srcdir)/../modules.map - endif - -+pam_tally2_CFLAGS = $(AM_CFLAGS) @PIE_CFLAGS@ -+pam_tally2_LDFLAGS = -Wl,-z,now @PIE_LDFLAGS@ - pam_tally2_LDADD = $(top_builddir)/libpam/libpam.la $(LIBAUDIT) - - securelib_LTLIBRARIES = pam_tally2.la -diff -up Linux-PAM-1.1.8/modules/pam_timestamp/Makefile.am.relro Linux-PAM-1.1.8/modules/pam_timestamp/Makefile.am ---- Linux-PAM-1.1.8/modules/pam_timestamp/Makefile.am.relro 2013-06-18 16:11:21.000000000 +0200 -+++ Linux-PAM-1.1.8/modules/pam_timestamp/Makefile.am 2014-08-13 16:02:49.906688139 +0200 -@@ -36,7 +36,7 @@ pam_timestamp_la_CFLAGS = $(AM_CFLAGS) - pam_timestamp_check_SOURCES = pam_timestamp_check.c - pam_timestamp_check_CFLAGS = $(AM_CFLAGS) @PIE_CFLAGS@ - pam_timestamp_check_LDADD = $(top_builddir)/libpam/libpam.la --pam_timestamp_check_LDFLAGS = @PIE_LDFLAGS@ -+pam_timestamp_check_LDFLAGS = -Wl,-z,now @PIE_LDFLAGS@ - - hmacfile_SOURCES = hmacfile.c hmacsha1.c sha1.c - hmacfile_LDADD = $(top_builddir)/libpam/libpam.la -diff -up Linux-PAM-1.1.8/modules/pam_unix/Makefile.am.relro Linux-PAM-1.1.8/modules/pam_unix/Makefile.am ---- Linux-PAM-1.1.8/modules/pam_unix/Makefile.am.relro 2013-06-18 16:11:21.000000000 +0200 -+++ Linux-PAM-1.1.8/modules/pam_unix/Makefile.am 2014-08-13 16:02:49.906688139 +0200 -@@ -55,13 +55,13 @@ bigcrypt_LDADD = @LIBCRYPT@ - unix_chkpwd_SOURCES = unix_chkpwd.c md5_good.c md5_broken.c bigcrypt.c \ - passverify.c - unix_chkpwd_CFLAGS = $(AM_CFLAGS) @PIE_CFLAGS@ -DHELPER_COMPILE=\"unix_chkpwd\" --unix_chkpwd_LDFLAGS = @PIE_LDFLAGS@ -+unix_chkpwd_LDFLAGS = -Wl,-z,now @PIE_LDFLAGS@ - unix_chkpwd_LDADD = @LIBCRYPT@ @LIBSELINUX@ @LIBAUDIT@ - - unix_update_SOURCES = unix_update.c md5_good.c md5_broken.c bigcrypt.c \ - passverify.c - unix_update_CFLAGS = $(AM_CFLAGS) @PIE_CFLAGS@ -DHELPER_COMPILE=\"unix_update\" --unix_update_LDFLAGS = @PIE_LDFLAGS@ -+unix_update_LDFLAGS = -Wl,-z,now @PIE_LDFLAGS@ - unix_update_LDADD = @LIBCRYPT@ @LIBSELINUX@ - - if ENABLE_REGENERATE_MAN diff --git a/SOURCES/pam-1.2.0-redhat-modules.patch b/SOURCES/pam-1.2.0-redhat-modules.patch deleted file mode 100644 index 8a66134..0000000 --- a/SOURCES/pam-1.2.0-redhat-modules.patch +++ /dev/null @@ -1,23 +0,0 @@ -diff -up Linux-PAM-1.2.0/configure.ac.redhat-modules Linux-PAM-1.2.0/configure.ac ---- Linux-PAM-1.2.0/configure.ac.redhat-modules 2015-03-25 16:50:10.000000000 +0100 -+++ Linux-PAM-1.2.0/configure.ac 2015-05-15 15:46:50.996074677 +0200 -@@ -616,6 +616,8 @@ AC_CONFIG_FILES([Makefile libpam/Makefil - libpam_misc/Makefile conf/Makefile conf/pam_conv1/Makefile \ - po/Makefile.in \ - modules/Makefile \ -+ modules/pam_chroot/Makefile modules/pam_console/Makefile \ -+ modules/pam_postgresok/Makefile \ - modules/pam_access/Makefile modules/pam_cracklib/Makefile \ - modules/pam_debug/Makefile modules/pam_deny/Makefile \ - modules/pam_echo/Makefile modules/pam_env/Makefile \ -diff -up Linux-PAM-1.2.0/modules/Makefile.am.redhat-modules Linux-PAM-1.2.0/modules/Makefile.am ---- Linux-PAM-1.2.0/modules/Makefile.am.redhat-modules 2015-03-24 13:02:32.000000000 +0100 -+++ Linux-PAM-1.2.0/modules/Makefile.am 2015-05-15 15:46:50.995074654 +0200 -@@ -3,6 +3,7 @@ - # - - SUBDIRS = pam_access pam_cracklib pam_debug pam_deny pam_echo \ -+ pam_chroot pam_console pam_postgresok \ - pam_env pam_exec pam_faildelay pam_filter pam_ftp \ - pam_group pam_issue pam_keyinit pam_lastlog pam_limits \ - pam_listfile pam_localuser pam_loginuid pam_mail \ diff --git a/SOURCES/pam-1.2.0-unix-no-fallback.patch b/SOURCES/pam-1.2.0-unix-no-fallback.patch deleted file mode 100644 index 6295da7..0000000 --- a/SOURCES/pam-1.2.0-unix-no-fallback.patch +++ /dev/null @@ -1,73 +0,0 @@ -diff -up Linux-PAM-1.2.0/modules/pam_unix/pam_unix.8.xml.no-fallback Linux-PAM-1.2.0/modules/pam_unix/pam_unix.8.xml ---- Linux-PAM-1.2.0/modules/pam_unix/pam_unix.8.xml.no-fallback 2015-04-27 16:38:03.000000000 +0200 -+++ Linux-PAM-1.2.0/modules/pam_unix/pam_unix.8.xml 2015-05-15 15:54:21.524440864 +0200 -@@ -284,11 +284,10 @@ - - - When a user changes their password next, -- encrypt it with the SHA256 algorithm. If the -- SHA256 algorithm is not known to the -+ encrypt it with the SHA256 algorithm. The -+ SHA256 algorithm must be supported by the - crypt3 -- function, -- fall back to MD5. -+ function. - - - -@@ -299,11 +298,10 @@ - - - When a user changes their password next, -- encrypt it with the SHA512 algorithm. If the -- SHA512 algorithm is not known to the -+ encrypt it with the SHA512 algorithm. The -+ SHA512 algorithm must be supported by the - crypt3 -- function, -- fall back to MD5. -+ function. - - - -@@ -314,11 +312,10 @@ - - - When a user changes their password next, -- encrypt it with the blowfish algorithm. If the -- blowfish algorithm is not known to the -+ encrypt it with the blowfish algorithm. The -+ blowfish algorithm must be supported by the - crypt3 -- function, -- fall back to MD5. -+ function. - - - -diff -up Linux-PAM-1.2.0/modules/pam_unix/passverify.c.no-fallback Linux-PAM-1.2.0/modules/pam_unix/passverify.c ---- Linux-PAM-1.2.0/modules/pam_unix/passverify.c.no-fallback 2015-05-15 15:54:21.525440887 +0200 -+++ Linux-PAM-1.2.0/modules/pam_unix/passverify.c 2015-05-15 15:57:23.138613273 +0200 -@@ -437,10 +437,9 @@ PAMH_ARG_DECL(char * create_password_has - sp = crypt(password, salt); - #endif - if (!sp || strncmp(algoid, sp, strlen(algoid)) != 0) { -- /* libxcrypt/libc doesn't know the algorithm, use MD5 */ -+ /* libxcrypt/libc doesn't know the algorithm, error out */ - pam_syslog(pamh, LOG_ERR, -- "Algo %s not supported by the crypto backend, " -- "falling back to MD5\n", -+ "Algo %s not supported by the crypto backend.\n", - on(UNIX_BLOWFISH_PASS, ctrl) ? "blowfish" : - on(UNIX_SHA256_PASS, ctrl) ? "sha256" : - on(UNIX_SHA512_PASS, ctrl) ? "sha512" : algoid); -@@ -450,7 +449,7 @@ PAMH_ARG_DECL(char * create_password_has - #ifdef HAVE_CRYPT_R - free(cdata); - #endif -- return crypt_md5_wrapper(password); -+ return NULL; - } - sp = x_strdup(sp); - #ifdef HAVE_CRYPT_R diff --git a/SOURCES/pam-1.2.1-console-devname.patch b/SOURCES/pam-1.2.1-console-devname.patch deleted file mode 100644 index 5e03b40..0000000 --- a/SOURCES/pam-1.2.1-console-devname.patch +++ /dev/null @@ -1,9 +0,0 @@ -diff -up Linux-PAM-1.2.1/modules/pam_console/console.handlers.devname Linux-PAM-1.2.1/modules/pam_console/console.handlers ---- Linux-PAM-1.2.1/modules/pam_console/console.handlers.devname 2015-10-16 14:15:48.000000000 +0200 -+++ Linux-PAM-1.2.1/modules/pam_console/console.handlers 2016-02-05 17:47:26.056787517 +0100 -@@ -14,4 +14,4 @@ - # echo lock wait Locking console for user on tty - # touch unlock wait /var/run/console-unlocked - --console consoledevs tty[0-9][0-9]* vc/[0-9][0-9]* :[0-9]+\.[0-9]+ :[0-9]+ -+console consoledevs /dev/tty[0-9][0-9]* tty[0-9][0-9]* vc/[0-9][0-9]* :[0-9]+\.[0-9]+ :[0-9]+ diff --git a/SOURCES/pam-1.2.1-faillock-admin-group.patch b/SOURCES/pam-1.2.1-faillock-admin-group.patch deleted file mode 100644 index 8bd1384..0000000 --- a/SOURCES/pam-1.2.1-faillock-admin-group.patch +++ /dev/null @@ -1,133 +0,0 @@ -diff -up Linux-PAM-1.3.0/modules/pam_faillock/pam_faillock.c.admin-group Linux-PAM-1.3.0/modules/pam_faillock/pam_faillock.c ---- Linux-PAM-1.3.0/modules/pam_faillock/pam_faillock.c.admin-group 2016-04-04 16:37:38.696260359 +0200 -+++ Linux-PAM-1.3.0/modules/pam_faillock/pam_faillock.c 2017-08-21 16:40:01.624706864 +0200 -@@ -1,5 +1,5 @@ - /* -- * Copyright (c) 2010 Tomas Mraz -+ * Copyright (c) 2010, 2017 Tomas Mraz - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions -@@ -78,9 +78,11 @@ struct options { - unsigned int root_unlock_time; - const char *dir; - const char *user; -+ const char *admin_group; - int failures; - uint64_t latest_time; - uid_t uid; -+ int is_admin; - uint64_t now; - }; - -@@ -152,6 +154,9 @@ args_parse(pam_handle_t *pamh, int argc, - opts->root_unlock_time = temp; - } - } -+ else if (strncmp(argv[i], "admin_group=", 12) == 0) { -+ opts->admin_group = argv[i] + 12; -+ } - else if (strcmp(argv[i], "preauth") == 0) { - opts->action = FAILLOCK_ACTION_PREAUTH; - } -@@ -209,6 +214,17 @@ static int get_pam_user(pam_handle_t *pa - } - opts->user = user; - opts->uid = pwd->pw_uid; -+ -+ if (pwd->pw_uid == 0) { -+ opts->is_admin = 1; -+ return PAM_SUCCESS; -+ } -+ -+ if (opts->admin_group && *opts->admin_group) { -+ opts->is_admin = pam_modutil_user_in_group_uid_nam(pamh, -+ pwd->pw_uid, opts->admin_group); -+ } -+ - return PAM_SUCCESS; - } - -@@ -239,7 +255,7 @@ check_tally(pam_handle_t *pamh, struct o - return PAM_SYSTEM_ERR; - } - -- if (opts->uid == 0 && !(opts->flags & FAILLOCK_FLAG_DENY_ROOT)) { -+ if (opts->is_admin && !(opts->flags & FAILLOCK_FLAG_DENY_ROOT)) { - return PAM_SUCCESS; - } - -@@ -262,13 +278,9 @@ check_tally(pam_handle_t *pamh, struct o - - opts->failures = failures; - -- if (opts->uid == 0 && !(opts->flags & FAILLOCK_FLAG_DENY_ROOT)) { -- return PAM_SUCCESS; -- } -- - if (opts->deny && failures >= opts->deny) { -- if ((opts->uid && opts->unlock_time && latest_time + opts->unlock_time < opts->now) || -- (!opts->uid && opts->root_unlock_time && latest_time + opts->root_unlock_time < opts->now)) { -+ if ((!opts->is_admin && opts->unlock_time && latest_time + opts->unlock_time < opts->now) || -+ (opts->is_admin && opts->root_unlock_time && latest_time + opts->root_unlock_time < opts->now)) { - #ifdef HAVE_LIBAUDIT - if (opts->action != FAILLOCK_ACTION_PREAUTH) { /* do not audit in preauth */ - char buf[64]; -@@ -401,7 +413,7 @@ write_tally(pam_handle_t *pamh, struct o - audit_log_user_message(audit_fd, AUDIT_ANOM_LOGIN_FAILURES, buf, - NULL, NULL, NULL, 1); - -- if (opts->uid != 0 || (opts->flags & FAILLOCK_FLAG_DENY_ROOT)) { -+ if (!opts->is_admin || (opts->flags & FAILLOCK_FLAG_DENY_ROOT)) { - audit_log_user_message(audit_fd, AUDIT_RESP_ACCT_LOCK, buf, - NULL, NULL, NULL, 1); - } -@@ -425,11 +437,11 @@ faillock_message(pam_handle_t *pamh, str - int64_t left; - - if (!(opts->flags & FAILLOCK_FLAG_SILENT)) { -- if (opts->uid) { -- left = opts->latest_time + opts->unlock_time - opts->now; -+ if (opts->is_admin) { -+ left = opts->latest_time + opts->root_unlock_time - opts->now; - } - else { -- left = opts->latest_time + opts->root_unlock_time - opts->now; -+ left = opts->latest_time + opts->unlock_time - opts->now; - } - - if (left > 0) { -diff -up Linux-PAM-1.3.0/modules/pam_faillock/pam_faillock.8.xml.admin-group Linux-PAM-1.3.0/modules/pam_faillock/pam_faillock.8.xml ---- Linux-PAM-1.3.0/modules/pam_faillock/pam_faillock.8.xml.admin-group 2016-05-06 15:24:10.328281818 +0200 -+++ Linux-PAM-1.3.0/modules/pam_faillock/pam_faillock.8.xml 2017-08-21 16:16:09.448033843 +0200 -@@ -40,6 +40,9 @@ - root_unlock_time=n - - -+ admin_group=name -+ -+ - audit - - -@@ -243,6 +246,20 @@ - - - -+ -+ -+ -+ -+ -+ -+ If a group name is specified with this option, members -+ of the group will be handled by this module the same as -+ the root account (the options -+ and will apply to them. -+ By default the option is not set. -+ -+ -+ - - - diff --git a/SOURCES/pam-1.2.1-faillock.patch b/SOURCES/pam-1.2.1-faillock.patch deleted file mode 100644 index 7a4209c..0000000 --- a/SOURCES/pam-1.2.1-faillock.patch +++ /dev/null @@ -1,1759 +0,0 @@ -diff -up Linux-PAM-1.2.1/configure.ac.faillock Linux-PAM-1.2.1/configure.ac ---- Linux-PAM-1.2.1/configure.ac.faillock 2015-06-25 10:42:21.477374752 +0200 -+++ Linux-PAM-1.2.1/configure.ac 2015-06-25 10:42:21.501375246 +0200 -@@ -621,7 +621,7 @@ AC_CONFIG_FILES([Makefile libpam/Makefil - modules/pam_access/Makefile modules/pam_cracklib/Makefile \ - modules/pam_debug/Makefile modules/pam_deny/Makefile \ - modules/pam_echo/Makefile modules/pam_env/Makefile \ -- modules/pam_faildelay/Makefile \ -+ modules/pam_faildelay/Makefile modules/pam_faillock/Makefile \ - modules/pam_filter/Makefile modules/pam_filter/upperLOWER/Makefile \ - modules/pam_ftp/Makefile modules/pam_group/Makefile \ - modules/pam_issue/Makefile modules/pam_keyinit/Makefile \ -diff -up Linux-PAM-1.2.1/doc/sag/pam_faillock.xml.faillock Linux-PAM-1.2.1/doc/sag/pam_faillock.xml ---- Linux-PAM-1.2.1/doc/sag/pam_faillock.xml.faillock 2015-06-25 10:42:21.482374855 +0200 -+++ Linux-PAM-1.2.1/doc/sag/pam_faillock.xml 2015-06-25 10:42:21.482374855 +0200 -@@ -0,0 +1,38 @@ -+ -+ -+
-+ pam_faillock - temporarily locking access based on failed authentication attempts during an interval -+ -+ -+ -+ -+ -+ -+
-+ -+
-+
-+ -+
-+
-+ -+
-+
-+ -+
-+
-+ -+
-+
-+ -+
-+
-diff -up Linux-PAM-1.2.1/modules/Makefile.am.faillock Linux-PAM-1.2.1/modules/Makefile.am ---- Linux-PAM-1.2.1/modules/Makefile.am.faillock 2015-06-25 10:42:21.480374814 +0200 -+++ Linux-PAM-1.2.1/modules/Makefile.am 2015-06-25 10:42:21.482374855 +0200 -@@ -3,7 +3,7 @@ - # - - SUBDIRS = pam_access pam_cracklib pam_debug pam_deny pam_echo \ -- pam_chroot pam_console pam_postgresok \ -+ pam_chroot pam_console pam_postgresok pam_faillock \ - pam_env pam_exec pam_faildelay pam_filter pam_ftp \ - pam_group pam_issue pam_keyinit pam_lastlog pam_limits \ - pam_listfile pam_localuser pam_loginuid pam_mail \ -diff -up Linux-PAM-1.2.1/modules/pam_faillock/faillock.c.faillock Linux-PAM-1.2.1/modules/pam_faillock/faillock.c ---- Linux-PAM-1.2.1/modules/pam_faillock/faillock.c.faillock 2015-06-25 10:42:21.482374855 +0200 -+++ Linux-PAM-1.2.1/modules/pam_faillock/faillock.c 2015-06-25 10:42:21.482374855 +0200 -@@ -0,0 +1,158 @@ -+/* -+ * Copyright (c) 2010 Tomas Mraz -+ * -+ * Redistribution and use in source and binary forms, with or without -+ * modification, are permitted provided that the following conditions -+ * are met: -+ * 1. Redistributions of source code must retain the above copyright -+ * notice, and the entire permission notice in its entirety, -+ * including the disclaimer of warranties. -+ * 2. Redistributions in binary form must reproduce the above copyright -+ * notice, this list of conditions and the following disclaimer in the -+ * documentation and/or other materials provided with the distribution. -+ * 3. The name of the author may not be used to endorse or promote -+ * products derived from this software without specific prior -+ * written permission. -+ * -+ * ALTERNATIVELY, this product may be distributed under the terms of -+ * the GNU Public License, in which case the provisions of the GPL are -+ * required INSTEAD OF the above restrictions. (This clause is -+ * necessary due to a potential bad interaction between the GPL and -+ * the restrictions contained in a BSD-style copyright.) -+ * -+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED -+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES -+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -+ * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, -+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR -+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) -+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, -+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) -+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED -+ * OF THE POSSIBILITY OF SUCH DAMAGE. -+ */ -+ -+#include "config.h" -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+ -+#include "faillock.h" -+ -+int -+open_tally (const char *dir, const char *user, uid_t uid, int create) -+{ -+ char *path; -+ int flags = O_RDWR; -+ int fd; -+ -+ if (strstr(user, "../") != NULL) -+ /* just a defensive programming as the user must be a -+ * valid user on the system anyway -+ */ -+ return -1; -+ path = malloc(strlen(dir) + strlen(user) + 2); -+ if (path == NULL) -+ return -1; -+ -+ strcpy(path, dir); -+ if (*dir && dir[strlen(dir) - 1] != '/') { -+ strcat(path, "/"); -+ } -+ strcat(path, user); -+ -+ if (create) { -+ flags |= O_CREAT; -+ } -+ -+ fd = open(path, flags, 0600); -+ -+ free(path); -+ -+ if (fd != -1) { -+ struct stat st; -+ -+ while (flock(fd, LOCK_EX) == -1 && errno == EINTR); -+ if (fstat(fd, &st) == 0) { -+ if (st.st_uid != uid) { -+ fchown(fd, uid, -1); -+ } -+ } -+ } -+ -+ return fd; -+} -+ -+#define CHUNK_SIZE (64 * sizeof(struct tally)) -+#define MAX_RECORDS 1024 -+ -+int -+read_tally(int fd, struct tally_data *tallies) -+{ -+ void *data = NULL, *newdata; -+ unsigned int count = 0; -+ ssize_t chunk = 0; -+ -+ do { -+ newdata = realloc(data, count * sizeof(struct tally) + CHUNK_SIZE); -+ if (newdata == NULL) { -+ free(data); -+ return -1; -+ } -+ -+ data = newdata; -+ -+ chunk = pam_modutil_read(fd, (char *)data + count * sizeof(struct tally), CHUNK_SIZE); -+ if (chunk < 0) { -+ free(data); -+ return -1; -+ } -+ -+ count += chunk/sizeof(struct tally); -+ -+ if (count >= MAX_RECORDS) -+ break; -+ } -+ while (chunk == CHUNK_SIZE); -+ -+ tallies->records = data; -+ tallies->count = count; -+ -+ return 0; -+} -+ -+int -+update_tally(int fd, struct tally_data *tallies) -+{ -+ void *data = tallies->records; -+ unsigned int count = tallies->count; -+ ssize_t chunk; -+ -+ if (tallies->count > MAX_RECORDS) { -+ data = tallies->records + (count - MAX_RECORDS); -+ count = MAX_RECORDS; -+ } -+ -+ if (lseek(fd, 0, SEEK_SET) == (off_t)-1) { -+ return -1; -+ } -+ -+ chunk = pam_modutil_write(fd, data, count * sizeof(struct tally)); -+ -+ if (chunk != (ssize_t)(count * sizeof(struct tally))) { -+ return -1; -+ } -+ -+ if (ftruncate(fd, count * sizeof(struct tally)) == -1) -+ return -1; -+ -+ return 0; -+} -diff -up Linux-PAM-1.2.1/modules/pam_faillock/faillock.h.faillock Linux-PAM-1.2.1/modules/pam_faillock/faillock.h ---- Linux-PAM-1.2.1/modules/pam_faillock/faillock.h.faillock 2015-06-25 10:42:21.482374855 +0200 -+++ Linux-PAM-1.2.1/modules/pam_faillock/faillock.h 2015-06-25 10:42:21.482374855 +0200 -@@ -0,0 +1,73 @@ -+/* -+ * Copyright (c) 2010 Tomas Mraz -+ * -+ * Redistribution and use in source and binary forms, with or without -+ * modification, are permitted provided that the following conditions -+ * are met: -+ * 1. Redistributions of source code must retain the above copyright -+ * notice, and the entire permission notice in its entirety, -+ * including the disclaimer of warranties. -+ * 2. Redistributions in binary form must reproduce the above copyright -+ * notice, this list of conditions and the following disclaimer in the -+ * documentation and/or other materials provided with the distribution. -+ * 3. The name of the author may not be used to endorse or promote -+ * products derived from this software without specific prior -+ * written permission. -+ * -+ * ALTERNATIVELY, this product may be distributed under the terms of -+ * the GNU Public License, in which case the provisions of the GPL are -+ * required INSTEAD OF the above restrictions. (This clause is -+ * necessary due to a potential bad interaction between the GPL and -+ * the restrictions contained in a BSD-style copyright.) -+ * -+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED -+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES -+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -+ * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, -+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR -+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) -+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, -+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) -+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED -+ * OF THE POSSIBILITY OF SUCH DAMAGE. -+ */ -+ -+/* -+ * faillock.h - authentication failure data file record structure -+ * -+ * Each record in the file represents an instance of login failure of -+ * the user at the recorded time -+ */ -+ -+ -+#ifndef _FAILLOCK_H -+#define _FAILLOCK_H -+ -+#include -+#include -+ -+#define TALLY_STATUS_VALID 0x1 /* the tally file entry is valid */ -+#define TALLY_STATUS_RHOST 0x2 /* the source is rhost */ -+#define TALLY_STATUS_TTY 0x4 /* the source is tty - if both TALLY_FLAG_RHOST and TALLY_FLAG_TTY are not set the source is service */ -+ -+struct tally { -+ char source[52]; /* rhost or tty of the login failure (not necessarily NULL terminated) */ -+ uint16_t reserved; /* reserved for future use */ -+ uint16_t status; /* record status */ -+ uint64_t time; /* time of the login failure */ -+}; -+/* 64 bytes per entry */ -+ -+struct tally_data { -+ struct tally *records; /* array of tallies */ -+ unsigned int count; /* number of records */ -+}; -+ -+#define FAILLOCK_DEFAULT_TALLYDIR "/var/run/faillock" -+ -+int open_tally(const char *dir, const char *user, uid_t uid, int create); -+int read_tally(int fd, struct tally_data *tallies); -+int update_tally(int fd, struct tally_data *tallies); -+#endif -+ -diff -up Linux-PAM-1.2.1/modules/pam_faillock/faillock.8.xml.faillock Linux-PAM-1.2.1/modules/pam_faillock/faillock.8.xml ---- Linux-PAM-1.2.1/modules/pam_faillock/faillock.8.xml.faillock 2015-06-25 10:42:21.482374855 +0200 -+++ Linux-PAM-1.2.1/modules/pam_faillock/faillock.8.xml 2015-06-25 10:42:21.482374855 +0200 -@@ -0,0 +1,123 @@ -+ -+ -+ -+ -+ -+ -+ faillock -+ 8 -+ Linux-PAM Manual -+ -+ -+ -+ faillock -+ Tool for displaying and modifying the authentication failure record files -+ -+ -+ -+ -+ faillock -+ -+ --dir /path/to/tally-directory -+ -+ -+ --user username -+ -+ -+ --reset -+ -+ -+ -+ -+ -+ -+ DESCRIPTION -+ -+ -+ The pam_faillock.so module maintains a list of -+ failed authentication attempts per user during a specified interval -+ and locks the account in case there were more than -+ deny consecutive failed authentications. -+ It stores the failure records into per-user files in the tally -+ directory. -+ -+ -+ The faillock command is an application which -+ can be used to examine and modify the contents of the -+ the tally files. It can display the recent failed authentication -+ attempts of the username or clear the tally -+ files of all or individual usernames. -+ -+ -+ -+ -+ -+ OPTIONS -+ -+ -+ -+ -+ -+ -+ -+ The directory where the user files with the failure records are kept. The -+ default is /var/run/faillock. -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ The user whose failure records should be displayed or cleared. -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ Instead of displaying the user's failure records, clear them. -+ -+ -+ -+ -+ -+ -+ -+ FILES -+ -+ -+ /var/run/faillock/* -+ -+ the files logging the authentication failures for users -+ -+ -+ -+ -+ -+ -+ SEE ALSO -+ -+ -+ pam_faillock8 -+ , -+ -+ pam8 -+ -+ -+ -+ -+ -+ AUTHOR -+ -+ faillock was written by Tomas Mraz. -+ -+ -+ -+ -diff -up Linux-PAM-1.2.1/modules/pam_faillock/main.c.faillock Linux-PAM-1.2.1/modules/pam_faillock/main.c ---- Linux-PAM-1.2.1/modules/pam_faillock/main.c.faillock 2015-06-25 10:42:21.482374855 +0200 -+++ Linux-PAM-1.2.1/modules/pam_faillock/main.c 2015-06-25 10:42:21.503375287 +0200 -@@ -0,0 +1,232 @@ -+/* -+ * Copyright (c) 2010 Tomas Mraz -+ * -+ * Redistribution and use in source and binary forms, with or without -+ * modification, are permitted provided that the following conditions -+ * are met: -+ * 1. Redistributions of source code must retain the above copyright -+ * notice, and the entire permission notice in its entirety, -+ * including the disclaimer of warranties. -+ * 2. Redistributions in binary form must reproduce the above copyright -+ * notice, this list of conditions and the following disclaimer in the -+ * documentation and/or other materials provided with the distribution. -+ * 3. The name of the author may not be used to endorse or promote -+ * products derived from this software without specific prior -+ * written permission. -+ * -+ * ALTERNATIVELY, this product may be distributed under the terms of -+ * the GNU Public License, in which case the provisions of the GPL are -+ * required INSTEAD OF the above restrictions. (This clause is -+ * necessary due to a potential bad interaction between the GPL and -+ * the restrictions contained in a BSD-style copyright.) -+ * -+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED -+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES -+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -+ * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, -+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR -+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) -+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, -+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) -+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED -+ * OF THE POSSIBILITY OF SUCH DAMAGE. -+ */ -+ -+#include "config.h" -+ -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#ifdef HAVE_LIBAUDIT -+#include -+#endif -+ -+#include "faillock.h" -+ -+struct options { -+ unsigned int reset; -+ const char *dir; -+ const char *user; -+ const char *progname; -+}; -+ -+static int -+args_parse(int argc, char **argv, struct options *opts) -+{ -+ int i; -+ memset(opts, 0, sizeof(*opts)); -+ -+ opts->dir = FAILLOCK_DEFAULT_TALLYDIR; -+ opts->progname = argv[0]; -+ -+ for (i = 1; i < argc; ++i) { -+ -+ if (strcmp(argv[i], "--dir") == 0) { -+ ++i; -+ if (i >= argc || strlen(argv[i]) == 0) { -+ fprintf(stderr, "%s: No directory supplied.\n", argv[0]); -+ return -1; -+ } -+ opts->dir = argv[i]; -+ } -+ else if (strcmp(argv[i], "--user") == 0) { -+ ++i; -+ if (i >= argc || strlen(argv[i]) == 0) { -+ fprintf(stderr, "%s: No user name supplied.\n", argv[0]); -+ return -1; -+ } -+ opts->user = argv[i]; -+ } -+ else if (strcmp(argv[i], "--reset") == 0) { -+ opts->reset = 1; -+ } -+ else { -+ fprintf(stderr, "%s: Unknown option: %s\n", argv[0], argv[i]); -+ return -1; -+ } -+ } -+ return 0; -+} -+ -+static void -+usage(const char *progname) -+{ -+ fprintf(stderr, _("Usage: %s [--dir /path/to/tally-directory] [--user username] [--reset]\n"), -+ progname); -+} -+ -+static int -+do_user(struct options *opts, const char *user) -+{ -+ int fd; -+ int rv; -+ struct tally_data tallies; -+ struct passwd *pwd; -+ -+ pwd = getpwnam(user); -+ -+ fd = open_tally(opts->dir, user, pwd != NULL ? pwd->pw_uid : 0, 0); -+ -+ if (fd == -1) { -+ if (errno == ENOENT) { -+ return 0; -+ } -+ else { -+ fprintf(stderr, "%s: Error opening the tally file for %s:", -+ opts->progname, user); -+ perror(NULL); -+ return 3; -+ } -+ } -+ if (opts->reset) { -+#ifdef HAVE_LIBAUDIT -+ int audit_fd; -+#endif -+ -+ while ((rv=ftruncate(fd, 0)) == -1 && errno == EINTR); -+ if (rv == -1) { -+ fprintf(stderr, "%s: Error clearing the tally file for %s:", -+ opts->progname, user); -+ perror(NULL); -+#ifdef HAVE_LIBAUDIT -+ } -+ if ((audit_fd=audit_open()) >= 0) { -+ -+ if (pwd != NULL) { -+ audit_log_acct_message(audit_fd, AUDIT_USER_MGMT, NULL, -+ "faillock-reset", NULL, pwd->pw_uid, NULL, NULL, NULL, rv == 0); -+ } -+ close(audit_fd); -+ } -+ if (rv == -1) { -+#endif -+ close(fd); -+ return 4; -+ } -+ } -+ else { -+ unsigned int i; -+ -+ memset(&tallies, 0, sizeof(tallies)); -+ if ((rv=read_tally(fd, &tallies)) == -1) { -+ fprintf(stderr, "%s: Error reading the tally file for %s:", -+ opts->progname, user); -+ perror(NULL); -+ close(fd); -+ return 5; -+ } -+ -+ printf("%s:\n", user); -+ printf("%-19s %-5s %-48s %-5s\n", "When", "Type", "Source", "Valid"); -+ -+ for (i = 0; i < tallies.count; i++) { -+ struct tm *tm; -+ char timebuf[80]; -+ uint16_t status = tallies.records[i].status; -+ time_t when = tallies.records[i].time; -+ -+ tm = localtime(&when); -+ strftime(timebuf, sizeof(timebuf), "%Y-%m-%d %H:%M:%S", tm); -+ printf("%-19s %-5s %-52.52s %s\n", timebuf, -+ status & TALLY_STATUS_RHOST ? "RHOST" : (status & TALLY_STATUS_TTY ? "TTY" : "SVC"), -+ tallies.records[i].source, status & TALLY_STATUS_VALID ? "V":"I"); -+ } -+ free(tallies.records); -+ } -+ close(fd); -+ return 0; -+} -+ -+static int -+do_allusers(struct options *opts) -+{ -+ struct dirent **userlist; -+ int rv, i; -+ -+ rv = scandir(opts->dir, &userlist, NULL, alphasort); -+ if (rv < 0) { -+ fprintf(stderr, "%s: Error reading tally directory: ", opts->progname); -+ perror(NULL); -+ return 2; -+ } -+ -+ for (i = 0; i < rv; i++) { -+ if (userlist[i]->d_name[0] == '.') { -+ if ((userlist[i]->d_name[1] == '.' && userlist[i]->d_name[2] == '\0') || -+ userlist[i]->d_name[1] == '\0') -+ continue; -+ } -+ do_user(opts, userlist[i]->d_name); -+ free(userlist[i]); -+ } -+ free(userlist); -+ -+ return 0; -+} -+ -+ -+/*-----------------------------------------------------------------------*/ -+int -+main (int argc, char *argv[]) -+{ -+ struct options opts; -+ -+ if (args_parse(argc, argv, &opts)) { -+ usage(argv[0]); -+ return 1; -+ } -+ -+ if (opts.user == NULL) { -+ return do_allusers(&opts); -+ } -+ -+ return do_user(&opts, opts.user); -+} -+ -diff -up Linux-PAM-1.2.1/modules/pam_faillock/Makefile.am.faillock Linux-PAM-1.2.1/modules/pam_faillock/Makefile.am ---- Linux-PAM-1.2.1/modules/pam_faillock/Makefile.am.faillock 2015-06-25 10:42:21.482374855 +0200 -+++ Linux-PAM-1.2.1/modules/pam_faillock/Makefile.am 2015-06-25 10:42:21.494375102 +0200 -@@ -0,0 +1,44 @@ -+# -+# Copyright (c) 2005, 2006, 2007, 2009 Thorsten Kukuk -+# Copyright (c) 2008 Red Hat, Inc. -+# Copyright (c) 2010 Tomas Mraz -+# -+ -+CLEANFILES = *~ -+MAINTAINERCLEANFILES = $(MANS) README -+ -+EXTRA_DIST = README $(MANS) $(XMLS) tst-pam_faillock -+ -+man_MANS = pam_faillock.8 faillock.8 -+XMLS = README.xml pam_faillock.8.xml faillock.8.xml -+ -+TESTS = tst-pam_faillock -+ -+securelibdir = $(SECUREDIR) -+secureconfdir = $(SCONFIGDIR) -+ -+noinst_HEADERS = faillock.h -+ -+faillock_CFLAGS = -I$(top_srcdir)/libpam/include -I$(top_srcdir)/libpamc/include @PIE_CFLAGS@ -+pam_faillock_la_CFLAGS = -I$(top_srcdir)/libpam/include -I$(top_srcdir)/libpamc/include -+ -+pam_faillock_la_LDFLAGS = -no-undefined -avoid-version -module -+pam_faillock_la_LIBADD = -L$(top_builddir)/libpam -lpam $(LIBAUDIT) -+if HAVE_VERSIONING -+ pam_faillock_la_LDFLAGS += -Wl,--version-script=$(srcdir)/../modules.map -+endif -+ -+faillock_LDFLAGS = -Wl,-z,now @PIE_LDFLAGS@ -+faillock_LDADD = -L$(top_builddir)/libpam -lpam $(LIBAUDIT) -+ -+securelib_LTLIBRARIES = pam_faillock.la -+sbin_PROGRAMS = faillock -+ -+pam_faillock_la_SOURCES = pam_faillock.c faillock.c -+faillock_SOURCES = main.c faillock.c -+ -+if ENABLE_REGENERATE_MAN -+noinst_DATA = README -+README: pam_faillock.8.xml -+-include $(top_srcdir)/Make.xml.rules -+endif -diff -up Linux-PAM-1.2.1/modules/pam_faillock/pam_faillock.c.faillock Linux-PAM-1.2.1/modules/pam_faillock/pam_faillock.c ---- Linux-PAM-1.2.1/modules/pam_faillock/pam_faillock.c.faillock 2015-06-25 10:42:21.483374875 +0200 -+++ Linux-PAM-1.2.1/modules/pam_faillock/pam_faillock.c 2015-10-16 14:07:38.451616869 +0200 -@@ -0,0 +1,571 @@ -+/* -+ * Copyright (c) 2010 Tomas Mraz -+ * -+ * Redistribution and use in source and binary forms, with or without -+ * modification, are permitted provided that the following conditions -+ * are met: -+ * 1. Redistributions of source code must retain the above copyright -+ * notice, and the entire permission notice in its entirety, -+ * including the disclaimer of warranties. -+ * 2. Redistributions in binary form must reproduce the above copyright -+ * notice, this list of conditions and the following disclaimer in the -+ * documentation and/or other materials provided with the distribution. -+ * 3. The name of the author may not be used to endorse or promote -+ * products derived from this software without specific prior -+ * written permission. -+ * -+ * ALTERNATIVELY, this product may be distributed under the terms of -+ * the GNU Public License, in which case the provisions of the GPL are -+ * required INSTEAD OF the above restrictions. (This clause is -+ * necessary due to a potential bad interaction between the GPL and -+ * the restrictions contained in a BSD-style copyright.) -+ * -+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED -+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES -+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -+ * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, -+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR -+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) -+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, -+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) -+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED -+ * OF THE POSSIBILITY OF SUCH DAMAGE. -+ */ -+ -+#include "config.h" -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+ -+#ifdef HAVE_LIBAUDIT -+#include -+#endif -+ -+#include -+#include -+#include -+ -+#include "faillock.h" -+ -+#define PAM_SM_AUTH -+#define PAM_SM_ACCOUNT -+ -+#define FAILLOCK_ACTION_PREAUTH 0 -+#define FAILLOCK_ACTION_AUTHSUCC 1 -+#define FAILLOCK_ACTION_AUTHFAIL 2 -+ -+#define FAILLOCK_FLAG_DENY_ROOT 0x1 -+#define FAILLOCK_FLAG_AUDIT 0x2 -+#define FAILLOCK_FLAG_SILENT 0x4 -+#define FAILLOCK_FLAG_NO_LOG_INFO 0x8 -+#define FAILLOCK_FLAG_UNLOCKED 0x10 -+ -+#define MAX_TIME_INTERVAL 604800 /* 7 days */ -+ -+struct options { -+ unsigned int action; -+ unsigned int flags; -+ unsigned short deny; -+ unsigned int fail_interval; -+ unsigned int unlock_time; -+ unsigned int root_unlock_time; -+ const char *dir; -+ const char *user; -+ int failures; -+ uint64_t latest_time; -+ uid_t uid; -+ uint64_t now; -+}; -+ -+static void -+args_parse(pam_handle_t *pamh, int argc, const char **argv, -+ int flags, struct options *opts) -+{ -+ int i; -+ memset(opts, 0, sizeof(*opts)); -+ -+ opts->dir = FAILLOCK_DEFAULT_TALLYDIR; -+ opts->deny = 3; -+ opts->fail_interval = 900; -+ opts->unlock_time = 600; -+ opts->root_unlock_time = MAX_TIME_INTERVAL+1; -+ -+ for (i = 0; i < argc; ++i) { -+ -+ if (strncmp(argv[i], "dir=", 4) == 0) { -+ if (argv[i][4] != '/') { -+ pam_syslog(pamh, LOG_ERR, -+ "Tally directory is not absolute path (%s); keeping default", argv[i]); -+ } else { -+ opts->dir = argv[i]+4; -+ } -+ } -+ else if (strncmp(argv[i], "deny=", 5) == 0) { -+ if (sscanf(argv[i]+5, "%hu", &opts->deny) != 1) { -+ pam_syslog(pamh, LOG_ERR, -+ "Bad number supplied for deny argument"); -+ } -+ } -+ else if (strncmp(argv[i], "fail_interval=", 14) == 0) { -+ unsigned int temp; -+ if (sscanf(argv[i]+14, "%u", &temp) != 1 || -+ temp > MAX_TIME_INTERVAL) { -+ pam_syslog(pamh, LOG_ERR, -+ "Bad number supplied for fail_interval argument"); -+ } else { -+ opts->fail_interval = temp; -+ } -+ } -+ else if (strncmp(argv[i], "unlock_time=", 12) == 0) { -+ unsigned int temp; -+ -+ if (strcmp(argv[i]+12, "never") == 0) { -+ opts->unlock_time = 0; -+ } -+ else if (sscanf(argv[i]+12, "%u", &temp) != 1 || -+ temp > MAX_TIME_INTERVAL) { -+ pam_syslog(pamh, LOG_ERR, -+ "Bad number supplied for unlock_time argument"); -+ } -+ else { -+ opts->unlock_time = temp; -+ } -+ } -+ else if (strncmp(argv[i], "root_unlock_time=", 17) == 0) { -+ unsigned int temp; -+ -+ if (strcmp(argv[i]+17, "never") == 0) { -+ opts->root_unlock_time = 0; -+ } -+ else if (sscanf(argv[i]+17, "%u", &temp) != 1 || -+ temp > MAX_TIME_INTERVAL) { -+ pam_syslog(pamh, LOG_ERR, -+ "Bad number supplied for root_unlock_time argument"); -+ } else { -+ opts->root_unlock_time = temp; -+ } -+ } -+ else if (strcmp(argv[i], "preauth") == 0) { -+ opts->action = FAILLOCK_ACTION_PREAUTH; -+ } -+ else if (strcmp(argv[i], "authfail") == 0) { -+ opts->action = FAILLOCK_ACTION_AUTHFAIL; -+ } -+ else if (strcmp(argv[i], "authsucc") == 0) { -+ opts->action = FAILLOCK_ACTION_AUTHSUCC; -+ } -+ else if (strcmp(argv[i], "even_deny_root") == 0) { -+ opts->flags |= FAILLOCK_FLAG_DENY_ROOT; -+ } -+ else if (strcmp(argv[i], "audit") == 0) { -+ opts->flags |= FAILLOCK_FLAG_AUDIT; -+ } -+ else if (strcmp(argv[i], "silent") == 0) { -+ opts->flags |= FAILLOCK_FLAG_SILENT; -+ } -+ else if (strcmp(argv[i], "no_log_info") == 0) { -+ opts->flags |= FAILLOCK_FLAG_NO_LOG_INFO; -+ } -+ else { -+ pam_syslog(pamh, LOG_ERR, "Unknown option: %s", argv[i]); -+ } -+ } -+ -+ if (opts->root_unlock_time == MAX_TIME_INTERVAL+1) -+ opts->root_unlock_time = opts->unlock_time; -+ if (flags & PAM_SILENT) -+ opts->flags |= FAILLOCK_FLAG_SILENT; -+} -+ -+static int get_pam_user(pam_handle_t *pamh, struct options *opts) -+{ -+ const char *user; -+ int rv; -+ struct passwd *pwd; -+ -+ if ((rv=pam_get_user(pamh, &user, NULL)) != PAM_SUCCESS) { -+ return rv; -+ } -+ -+ if (*user == '\0') { -+ return PAM_IGNORE; -+ } -+ -+ if ((pwd=pam_modutil_getpwnam(pamh, user)) == NULL) { -+ if (opts->flags & FAILLOCK_FLAG_AUDIT) { -+ pam_syslog(pamh, LOG_ERR, "User unknown: %s", user); -+ } -+ else { -+ pam_syslog(pamh, LOG_ERR, "User unknown"); -+ } -+ return PAM_IGNORE; -+ } -+ opts->user = user; -+ opts->uid = pwd->pw_uid; -+ return PAM_SUCCESS; -+} -+ -+static int -+check_tally(pam_handle_t *pamh, struct options *opts, struct tally_data *tallies, int *fd) -+{ -+ int tfd; -+ unsigned int i; -+ uint64_t latest_time; -+ int failures; -+ -+ opts->now = time(NULL); -+ -+ tfd = open_tally(opts->dir, opts->user, opts->uid, 0); -+ -+ *fd = tfd; -+ -+ if (tfd == -1) { -+ if (errno == EACCES || errno == ENOENT) { -+ return PAM_SUCCESS; -+ } -+ pam_syslog(pamh, LOG_ERR, "Error opening the tally file for %s: %m", opts->user); -+ return PAM_SYSTEM_ERR; -+ } -+ -+ if (read_tally(tfd, tallies) != 0) { -+ pam_syslog(pamh, LOG_ERR, "Error reading the tally file for %s: %m", opts->user); -+ return PAM_SYSTEM_ERR; -+ } -+ -+ if (opts->uid == 0 && !(opts->flags & FAILLOCK_FLAG_DENY_ROOT)) { -+ return PAM_SUCCESS; -+ } -+ -+ latest_time = 0; -+ for(i = 0; i < tallies->count; i++) { -+ if ((tallies->records[i].status & TALLY_STATUS_VALID) && -+ tallies->records[i].time > latest_time) -+ latest_time = tallies->records[i].time; -+ } -+ -+ opts->latest_time = latest_time; -+ -+ failures = 0; -+ for(i = 0; i < tallies->count; i++) { -+ if ((tallies->records[i].status & TALLY_STATUS_VALID) && -+ latest_time - tallies->records[i].time < opts->fail_interval) { -+ ++failures; -+ } -+ } -+ -+ opts->failures = failures; -+ -+ if (opts->uid == 0 && !(opts->flags & FAILLOCK_FLAG_DENY_ROOT)) { -+ return PAM_SUCCESS; -+ } -+ -+ if (opts->deny && failures >= opts->deny) { -+ if ((opts->uid && opts->unlock_time && latest_time + opts->unlock_time < opts->now) || -+ (!opts->uid && opts->root_unlock_time && latest_time + opts->root_unlock_time < opts->now)) { -+#ifdef HAVE_LIBAUDIT -+ if (opts->action != FAILLOCK_ACTION_PREAUTH) { /* do not audit in preauth */ -+ char buf[64]; -+ int audit_fd; -+ const void *rhost = NULL, *tty = NULL; -+ -+ audit_fd = audit_open(); -+ /* If there is an error & audit support is in the kernel report error */ -+ if ((audit_fd < 0) && !(errno == EINVAL || errno == EPROTONOSUPPORT || -+ errno == EAFNOSUPPORT)) -+ return PAM_SYSTEM_ERR; -+ -+ (void)pam_get_item(pamh, PAM_TTY, &tty); -+ (void)pam_get_item(pamh, PAM_RHOST, &rhost); -+ snprintf(buf, sizeof(buf), "pam_faillock uid=%u ", opts->uid); -+ audit_log_user_message(audit_fd, AUDIT_RESP_ACCT_UNLOCK_TIMED, buf, -+ rhost, NULL, tty, 1); -+ } -+#endif -+ opts->flags |= FAILLOCK_FLAG_UNLOCKED; -+ return PAM_SUCCESS; -+ } -+ return PAM_AUTH_ERR; -+ } -+ return PAM_SUCCESS; -+} -+ -+static void -+reset_tally(pam_handle_t *pamh, struct options *opts, int *fd) -+{ -+ int rv; -+ -+ if (*fd == -1) { -+ *fd = open_tally(opts->dir, opts->user, opts->uid, 1); -+ } -+ else { -+ while ((rv=ftruncate(*fd, 0)) == -1 && errno == EINTR); -+ if (rv == -1) { -+ pam_syslog(pamh, LOG_ERR, "Error clearing the tally file for %s: %m", opts->user); -+ } -+ } -+} -+ -+static int -+write_tally(pam_handle_t *pamh, struct options *opts, struct tally_data *tallies, int *fd) -+{ -+ struct tally *records; -+ unsigned int i; -+ int failures; -+ unsigned int oldest; -+ uint64_t oldtime; -+ const void *source = NULL; -+ -+ if (*fd == -1) { -+ *fd = open_tally(opts->dir, opts->user, opts->uid, 1); -+ } -+ if (*fd == -1) { -+ if (errno == EACCES) { -+ return PAM_SUCCESS; -+ } -+ pam_syslog(pamh, LOG_ERR, "Error opening the tally file for %s: %m", opts->user); -+ return PAM_SYSTEM_ERR; -+ } -+ -+ oldtime = 0; -+ oldest = 0; -+ failures = 0; -+ -+ for (i = 0; i < tallies->count; ++i) { -+ if (tallies->records[i].time < oldtime) { -+ oldtime = tallies->records[i].time; -+ oldest = i; -+ } -+ if (opts->flags & FAILLOCK_FLAG_UNLOCKED || -+ opts->now - tallies->records[i].time >= opts->fail_interval ) { -+ tallies->records[i].status &= ~TALLY_STATUS_VALID; -+ } else { -+ ++failures; -+ } -+ } -+ -+ if (oldest >= tallies->count || (tallies->records[oldest].status & TALLY_STATUS_VALID)) { -+ oldest = tallies->count; -+ -+ if ((records=realloc(tallies->records, (oldest+1) * sizeof (*tallies->records))) == NULL) { -+ pam_syslog(pamh, LOG_CRIT, "Error allocating memory for tally records: %m"); -+ return PAM_BUF_ERR; -+ } -+ -+ ++tallies->count; -+ tallies->records = records; -+ } -+ -+ memset(&tallies->records[oldest], 0, sizeof (*tallies->records)); -+ -+ tallies->records[oldest].status = TALLY_STATUS_VALID; -+ if (pam_get_item(pamh, PAM_RHOST, &source) != PAM_SUCCESS || source == NULL) { -+ if (pam_get_item(pamh, PAM_TTY, &source) != PAM_SUCCESS || source == NULL) { -+ if (pam_get_item(pamh, PAM_SERVICE, &source) != PAM_SUCCESS || source == NULL) { -+ source = ""; -+ } -+ } -+ else { -+ tallies->records[oldest].status |= TALLY_STATUS_TTY; -+ } -+ } -+ else { -+ tallies->records[oldest].status |= TALLY_STATUS_RHOST; -+ } -+ -+ strncpy(tallies->records[oldest].source, source, sizeof(tallies->records[oldest].source)); -+ /* source does not have to be null terminated */ -+ -+ tallies->records[oldest].time = opts->now; -+ -+ ++failures; -+ -+ if (opts->deny && failures == opts->deny) { -+#ifdef HAVE_LIBAUDIT -+ char buf[64]; -+ int audit_fd; -+ -+ audit_fd = audit_open(); -+ /* If there is an error & audit support is in the kernel report error */ -+ if ((audit_fd < 0) && !(errno == EINVAL || errno == EPROTONOSUPPORT || -+ errno == EAFNOSUPPORT)) -+ return PAM_SYSTEM_ERR; -+ -+ snprintf(buf, sizeof(buf), "pam_faillock uid=%u ", opts->uid); -+ audit_log_user_message(audit_fd, AUDIT_ANOM_LOGIN_FAILURES, buf, -+ NULL, NULL, NULL, 1); -+ -+ if (opts->uid != 0 || (opts->flags & FAILLOCK_FLAG_DENY_ROOT)) { -+ audit_log_user_message(audit_fd, AUDIT_RESP_ACCT_LOCK, buf, -+ NULL, NULL, NULL, 1); -+ } -+ close(audit_fd); -+#endif -+ if (!(opts->flags & FAILLOCK_FLAG_NO_LOG_INFO)) { -+ pam_syslog(pamh, LOG_INFO, "Consecutive login failures for user %s account temporarily locked", -+ opts->user); -+ } -+ } -+ -+ if (update_tally(*fd, tallies) == 0) -+ return PAM_SUCCESS; -+ -+ return PAM_SYSTEM_ERR; -+} -+ -+static void -+faillock_message(pam_handle_t *pamh, struct options *opts) -+{ -+ int64_t left; -+ -+ if (!(opts->flags & FAILLOCK_FLAG_SILENT)) { -+ if (opts->uid) { -+ left = opts->latest_time + opts->unlock_time - opts->now; -+ } -+ else { -+ left = opts->latest_time + opts->root_unlock_time - opts->now; -+ } -+ -+ if (left > 0) { -+ left = (left + 59)/60; /* minutes */ -+ -+ pam_info(pamh, _("Account temporarily locked due to %d failed logins"), -+ opts->failures); -+ pam_info(pamh, _("(%d minutes left to unlock)"), (int)left); -+ } -+ else { -+ pam_info(pamh, _("Account locked due to %d failed logins"), -+ opts->failures); -+ } -+ } -+} -+ -+static void -+tally_cleanup(struct tally_data *tallies, int fd) -+{ -+ if (fd != -1) { -+ close(fd); -+ } -+ -+ free(tallies->records); -+} -+ -+/*---------------------------------------------------------------------*/ -+ -+PAM_EXTERN int -+pam_sm_authenticate(pam_handle_t *pamh, int flags, -+ int argc, const char **argv) -+{ -+ struct options opts; -+ int rv, fd = -1; -+ struct tally_data tallies; -+ -+ memset(&tallies, 0, sizeof(tallies)); -+ -+ args_parse(pamh, argc, argv, flags, &opts); -+ -+ pam_fail_delay(pamh, 2000000); /* 2 sec delay for on failure */ -+ -+ if ((rv=get_pam_user(pamh, &opts)) != PAM_SUCCESS) { -+ return rv; -+ } -+ -+ switch (opts.action) { -+ case FAILLOCK_ACTION_PREAUTH: -+ rv = check_tally(pamh, &opts, &tallies, &fd); -+ if (rv == PAM_AUTH_ERR && !(opts.flags & FAILLOCK_FLAG_SILENT)) { -+ faillock_message(pamh, &opts); -+ } -+ break; -+ -+ case FAILLOCK_ACTION_AUTHSUCC: -+ rv = check_tally(pamh, &opts, &tallies, &fd); -+ if (rv == PAM_SUCCESS) { -+ reset_tally(pamh, &opts, &fd); -+ } -+ break; -+ -+ case FAILLOCK_ACTION_AUTHFAIL: -+ rv = check_tally(pamh, &opts, &tallies, &fd); -+ if (rv == PAM_SUCCESS) { -+ rv = PAM_IGNORE; /* this return value should be ignored */ -+ write_tally(pamh, &opts, &tallies, &fd); -+ } -+ break; -+ } -+ -+ tally_cleanup(&tallies, fd); -+ -+ return rv; -+} -+ -+/*---------------------------------------------------------------------*/ -+ -+PAM_EXTERN int -+pam_sm_setcred(pam_handle_t *pamh UNUSED, int flags UNUSED, -+ int argc UNUSED, const char **argv UNUSED) -+{ -+ return PAM_SUCCESS; -+} -+ -+/*---------------------------------------------------------------------*/ -+ -+PAM_EXTERN int -+pam_sm_acct_mgmt(pam_handle_t *pamh, int flags, -+ int argc, const char **argv) -+{ -+ struct options opts; -+ int rv, fd = -1; -+ struct tally_data tallies; -+ -+ memset(&tallies, 0, sizeof(tallies)); -+ -+ args_parse(pamh, argc, argv, flags, &opts); -+ -+ opts.action = FAILLOCK_ACTION_AUTHSUCC; -+ -+ if ((rv=get_pam_user(pamh, &opts)) != PAM_SUCCESS) { -+ return rv; -+ } -+ -+ check_tally(pamh, &opts, &tallies, &fd); /* for auditing */ -+ reset_tally(pamh, &opts, &fd); -+ -+ tally_cleanup(&tallies, fd); -+ -+ return PAM_SUCCESS; -+} -+ -+/*-----------------------------------------------------------------------*/ -+ -+#ifdef PAM_STATIC -+ -+/* static module data */ -+ -+struct pam_module _pam_faillock_modstruct = { -+ MODULE_NAME, -+#ifdef PAM_SM_AUTH -+ pam_sm_authenticate, -+ pam_sm_setcred, -+#else -+ NULL, -+ NULL, -+#endif -+#ifdef PAM_SM_ACCOUNT -+ pam_sm_acct_mgmt, -+#else -+ NULL, -+#endif -+ NULL, -+ NULL, -+ NULL, -+}; -+ -+#endif /* #ifdef PAM_STATIC */ -+ -diff -up Linux-PAM-1.2.1/modules/pam_faillock/pam_faillock.8.xml.faillock Linux-PAM-1.2.1/modules/pam_faillock/pam_faillock.8.xml ---- Linux-PAM-1.2.1/modules/pam_faillock/pam_faillock.8.xml.faillock 2016-04-04 16:37:38.696260359 +0200 -+++ Linux-PAM-1.2.1/modules/pam_faillock/pam_faillock.8.xml 2016-04-28 17:09:04.679596165 +0200 -@@ -0,0 +1,408 @@ -+ -+ -+ -+ -+ -+ -+ pam_faillock -+ 8 -+ Linux-PAM Manual -+ -+ -+ -+ pam_faillock -+ Module counting authentication failures during a specified interval -+ -+ -+ -+ -+ auth ... pam_faillock.so -+ -+ preauth|authfail|authsucc -+ -+ -+ dir=/path/to/tally-directory -+ -+ -+ even_deny_root -+ -+ -+ deny=n -+ -+ -+ fail_interval=n -+ -+ -+ unlock_time=n -+ -+ -+ root_unlock_time=n -+ -+ -+ audit -+ -+ -+ silent -+ -+ -+ no_log_info -+ -+ -+ -+ account ... pam_faillock.so -+ -+ dir=/path/to/tally-directory -+ -+ -+ no_log_info -+ -+ -+ -+ -+ -+ -+ DESCRIPTION -+ -+ -+ This module maintains a list of failed authentication attempts per -+ user during a specified interval and locks the account in case -+ there were more than deny consecutive -+ failed authentications. -+ -+ -+ Normally, failed attempts to authenticate root will -+ not cause the root account to become -+ blocked, to prevent denial-of-service: if your users aren't given -+ shell accounts and root may only login via su or -+ at the machine console (not telnet/rsh, etc), this is safe. -+ -+ -+ -+ -+ -+ OPTIONS -+ -+ -+ -+ -+ -+ -+ -+ This argument must be set accordingly to the position of this module -+ instance in the PAM stack. -+ -+ -+ The preauth argument must be used when the module -+ is called before the modules which ask for the user credentials such -+ as the password. The module just examines whether the user should -+ be blocked from accessing the service in case there were anomalous -+ number of failed consecutive authentication attempts recently. This -+ call is optional if authsucc is used. -+ -+ -+ The authfail argument must be used when the module -+ is called after the modules which determine the authentication outcome, -+ failed. Unless the user is already blocked due to previous authentication -+ failures, the module will record the failure into the appropriate user -+ tally file. -+ -+ -+ The authsucc argument must be used when the module -+ is called after the modules which determine the authentication outcome, -+ succeded. Unless the user is already blocked due to previous authentication -+ failures, the module will then clear the record of the failures in the -+ respective user tally file. Otherwise it will return authentication error. -+ If this call is not done, the pam_faillock will not distinguish between -+ consecutive and non-consecutive failed authentication attempts. The -+ preauth call must be used in such case. Due to -+ complications in the way the PAM stack can be configured it is also -+ possible to call pam_faillock as an account module. -+ In such configuration the module must be also called in the -+ preauth stage. -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ The directory where the user files with the failure records are kept. The -+ default is /var/run/faillock. -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ Will log the user name into the system log if the user is not found. -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ Don't print informative messages. This option is implicite -+ in the authfail and authsucc -+ functions. -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ Don't log informative messages via syslog3. -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ Deny access if the number of consecutive authentication failures -+ for this user during the recent interval exceeds -+ n. The default is 3. -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ The length of the interval during which the consecutive -+ authentication failures must happen for the user account -+ lock out is n seconds. -+ The default is 900 (15 minutes). -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ The access will be reenabled after -+ n seconds after the lock out. -+ The value 0 has the same meaning as value -+ never - the access -+ will not be reenabled without resetting the faillock -+ entries by the faillock8 command. -+ The default is 600 (10 minutes). -+ -+ -+ Note that the default directory that pam_faillock -+ uses is usually cleared on system boot so the access will be also reenabled -+ after system reboot. If that is undesirable a different tally directory -+ must be set with the option. -+ -+ -+ Also note that it is usually undesirable to permanently lock -+ out the users as they can become easily a target of denial of service -+ attack unless the usernames are random and kept secret to potential -+ attackers. -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ Root account can become locked as well as regular accounts. -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ This option implies option. -+ Allow access after n seconds -+ to root account after the account is locked. In case the -+ option is not specified the value is the same as of the -+ option. -+ -+ -+ -+ -+ -+ -+ -+ MODULE TYPES PROVIDED -+ -+ The and module types are -+ provided. -+ -+ -+ -+ -+ RETURN VALUES -+ -+ -+ PAM_AUTH_ERR -+ -+ -+ A invalid option was given, the module was not able -+ to retrieve the user name, no valid counter file -+ was found, or too many failed logins. -+ -+ -+ -+ -+ PAM_SUCCESS -+ -+ -+ Everything was successful. -+ -+ -+ -+ -+ PAM_IGNORE -+ -+ -+ User not present in passwd database. -+ -+ -+ -+ -+ -+ -+ -+ NOTES -+ -+ pam_faillock setup in the PAM stack is different -+ from the pam_tally2 module setup. -+ -+ -+ The individual files with the failure records are created as owned by -+ the user. This allows pam_faillock.so module -+ to work correctly when it is called from a screensaver. -+ -+ -+ Note that using the module in without the -+ option or with requisite -+ control field leaks an information about existence or -+ non-existence of an user account in the system because -+ the failures are not recorded for the unknown users. The message -+ about the user account being locked is never displayed for nonexisting -+ user accounts allowing the adversary to infer that a particular account -+ is not existing on a system. -+ -+ -+ -+ -+ EXAMPLES -+ -+ Here are two possible configuration examples for /etc/pam.d/login. -+ They make pam_faillock to lock the account after 4 consecutive -+ failed logins during the default interval of 15 minutes. Root account will be locked -+ as well. The accounts will be automatically unlocked after 20 minutes. -+ -+ -+ In the first example the module is called only in the auth -+ phase and the module does not print any information about the account blocking -+ by pam_faillock. The preauth call can -+ be added to tell the user that his login is blocked by the module and also to abort -+ the authentication without even asking for password in such case. -+ -+ -+auth required pam_securetty.so -+auth required pam_env.so -+auth required pam_nologin.so -+# optionally call: auth requisite pam_faillock.so preauth deny=4 even_deny_root unlock_time=1200 -+# to display the message about account being locked -+auth [success=1 default=bad] pam_unix.so -+auth [default=die] pam_faillock.so authfail deny=4 even_deny_root unlock_time=1200 -+auth sufficient pam_faillock.so authsucc deny=4 even_deny_root unlock_time=1200 -+auth required pam_deny.so -+account required pam_unix.so -+password required pam_unix.so shadow -+session required pam_selinux.so close -+session required pam_loginuid.so -+session required pam_unix.so -+session required pam_selinux.so open -+ -+ -+ In the second example the module is called both in the auth -+ and account phases and the module gives the authenticating -+ user message when the account is locked -+ -+ -+auth required pam_securetty.so -+auth required pam_env.so -+auth required pam_nologin.so -+auth required pam_faillock.so preauth silent deny=4 even_deny_root unlock_time=1200 -+# optionally use requisite above if you do not want to prompt for the password -+# on locked accounts, possibly with removing the silent option as well -+auth sufficient pam_unix.so -+auth [default=die] pam_faillock.so authfail deny=4 even_deny_root unlock_time=1200 -+auth required pam_deny.so -+account required pam_faillock.so -+# if you drop the above call to pam_faillock.so the lock will be done also -+# on non-consecutive authentication failures -+account required pam_unix.so -+password required pam_unix.so shadow -+session required pam_selinux.so close -+session required pam_loginuid.so -+session required pam_unix.so -+session required pam_selinux.so open -+ -+ -+ -+ -+ FILES -+ -+ -+ /var/run/faillock/* -+ -+ the files logging the authentication failures for users -+ -+ -+ -+ -+ -+ -+ SEE ALSO -+ -+ -+ faillock8 -+ , -+ -+ pam.conf5 -+ , -+ -+ pam.d5 -+ , -+ -+ pam8 -+ -+ -+ -+ -+ -+ AUTHOR -+ -+ pam_faillock was written by Tomas Mraz. -+ -+ -+ -+ -diff -up Linux-PAM-1.2.1/modules/pam_faillock/README.xml.faillock Linux-PAM-1.2.1/modules/pam_faillock/README.xml ---- Linux-PAM-1.2.1/modules/pam_faillock/README.xml.faillock 2015-06-25 10:42:21.483374875 +0200 -+++ Linux-PAM-1.2.1/modules/pam_faillock/README.xml 2015-06-25 10:42:21.483374875 +0200 -@@ -0,0 +1,46 @@ -+ -+ -+--> -+]> -+ -+
-+ -+ -+ -+ -+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" -+ href="pam_faillock.8.xml" xpointer='xpointer(//refnamediv[@id = "pam_faillock-name"]/*)'/> -+ -+ -+ -+ -+
-+ -+
-+ -+
-+ -+
-+ -+
-+ -+
-+ -+
-+ -+
-+ -+
-+ -+
-+ -+
-diff -up Linux-PAM-1.2.1/modules/pam_faillock/tst-pam_faillock.faillock Linux-PAM-1.2.1/modules/pam_faillock/tst-pam_faillock ---- Linux-PAM-1.2.1/modules/pam_faillock/tst-pam_faillock.faillock 2015-06-25 10:42:21.483374875 +0200 -+++ Linux-PAM-1.2.1/modules/pam_faillock/tst-pam_faillock 2015-06-25 10:42:21.483374875 +0200 -@@ -0,0 +1,2 @@ -+#!/bin/sh -+../../tests/tst-dlopen .libs/pam_faillock.so diff --git a/SOURCES/pam-1.3.0-pwhistory-helper.patch b/SOURCES/pam-1.3.0-pwhistory-helper.patch deleted file mode 100644 index 554e5c8..0000000 --- a/SOURCES/pam-1.3.0-pwhistory-helper.patch +++ /dev/null @@ -1,806 +0,0 @@ -diff -up Linux-PAM-1.3.0/modules/pam_pwhistory/Makefile.am.pwhhelper Linux-PAM-1.3.0/modules/pam_pwhistory/Makefile.am ---- Linux-PAM-1.3.0/modules/pam_pwhistory/Makefile.am.pwhhelper 2016-03-24 12:45:42.000000000 +0100 -+++ Linux-PAM-1.3.0/modules/pam_pwhistory/Makefile.am 2016-05-06 15:18:42.307637933 +0200 -@@ -1,5 +1,6 @@ - # - # Copyright (c) 2008, 2009 Thorsten Kukuk -+# Copyright (c) 2013 Red Hat, Inc. - # - - CLEANFILES = *~ -@@ -9,25 +10,34 @@ EXTRA_DIST = README $(MANS) $(XMLS) tst- - - TESTS = tst-pam_pwhistory - --man_MANS = pam_pwhistory.8 -+man_MANS = pam_pwhistory.8 pwhistory_helper.8 - --XMLS = README.xml pam_pwhistory.8.xml -+XMLS = README.xml pam_pwhistory.8.xml pwhistory_helper.8.xml - - securelibdir = $(SECUREDIR) - secureconfdir = $(SCONFIGDIR) - --AM_CFLAGS = -I$(top_srcdir)/libpam/include -I$(top_srcdir)/libpamc/include --AM_LDFLAGS = -no-undefined -avoid-version -module -+AM_CFLAGS = -I$(top_srcdir)/libpam/include -I$(top_srcdir)/libpamc/include \ -+ -DPWHISTORY_HELPER=\"$(sbindir)/pwhistory_helper\" -+ -+pam_pwhistory_la_LDFLAGS = -no-undefined -avoid-version -module - if HAVE_VERSIONING -- AM_LDFLAGS += -Wl,--version-script=$(srcdir)/../modules.map -+ pam_pwhistory_la_LDFLAGS += -Wl,--version-script=$(srcdir)/../modules.map - endif - - noinst_HEADERS = opasswd.h - - securelib_LTLIBRARIES = pam_pwhistory.la --pam_pwhistory_la_LIBADD = $(top_builddir)/libpam/libpam.la @LIBCRYPT@ -+pam_pwhistory_la_CFLAGS = $(AM_CFLAGS) -+pam_pwhistory_la_LIBADD = $(top_builddir)/libpam/libpam.la @LIBCRYPT@ @LIBSELINUX@ - pam_pwhistory_la_SOURCES = pam_pwhistory.c opasswd.c - -+sbin_PROGRAMS = pwhistory_helper -+pwhistory_helper_CFLAGS = $(AM_CFLAGS) -DHELPER_COMPILE=\"pwhistory_helper\" @PIE_CFLAGS@ -+pwhistory_helper_SOURCES = pwhistory_helper.c opasswd.c -+pwhistory_helper_LDFLAGS = -Wl,-z,now @PIE_LDFLAGS@ -+pwhistory_helper_LDADD = $(top_builddir)/libpam/libpam.la @LIBCRYPT@ -+ - if ENABLE_REGENERATE_MAN - noinst_DATA = README - README: pam_pwhistory.8.xml -diff -up Linux-PAM-1.3.0/modules/pam_pwhistory/opasswd.c.pwhhelper Linux-PAM-1.3.0/modules/pam_pwhistory/opasswd.c ---- Linux-PAM-1.3.0/modules/pam_pwhistory/opasswd.c.pwhhelper 2016-03-24 12:45:42.000000000 +0100 -+++ Linux-PAM-1.3.0/modules/pam_pwhistory/opasswd.c 2016-05-06 15:18:42.307637933 +0200 -@@ -1,5 +1,6 @@ - /* - * Copyright (c) 2008 Thorsten Kukuk -+ * Copyright (c) 2013 Red Hat, Inc. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions -@@ -38,6 +39,7 @@ - #endif - - #include -+#include - #include - #include - #include -@@ -47,6 +49,7 @@ - #include - #include - #include -+#include - #include - - #if defined (HAVE_XCRYPT_H) -@@ -55,7 +58,14 @@ - #include - #endif - -+#ifdef HELPER_COMPILE -+#define pam_modutil_getpwnam(h,n) getpwnam(n) -+#define pam_modutil_getspnam(h,n) getspnam(n) -+#define pam_syslog(h,a,...) helper_log_err(a,__VA_ARGS__) -+#else -+#include - #include -+#endif - #include - - #include "opasswd.h" -@@ -76,6 +86,19 @@ typedef struct { - char *old_passwords; - } opwd; - -+#ifdef HELPER_COMPILE -+void -+helper_log_err(int err, const char *format, ...) -+{ -+ va_list args; -+ -+ va_start(args, format); -+ openlog(HELPER_COMPILE, LOG_CONS | LOG_PID, LOG_AUTHPRIV); -+ vsyslog(err, format, args); -+ va_end(args); -+ closelog(); -+} -+#endif - - static int - parse_entry (char *line, opwd *data) -@@ -117,8 +140,8 @@ compare_password(const char *newpass, co - } - - /* Check, if the new password is already in the opasswd file. */ --int --check_old_pass (pam_handle_t *pamh, const char *user, -+PAMH_ARG_DECL(int -+check_old_pass, const char *user, - const char *newpass, int debug) - { - int retval = PAM_SUCCESS; -@@ -128,6 +151,11 @@ check_old_pass (pam_handle_t *pamh, cons - opwd entry; - int found = 0; - -+#ifndef HELPER_COMPILE -+ if (SELINUX_ENABLED) -+ return PAM_PWHISTORY_RUN_HELPER; -+#endif -+ - if ((oldpf = fopen (OLD_PASSWORDS_FILE, "r")) == NULL) - { - if (errno != ENOENT) -@@ -213,9 +241,9 @@ check_old_pass (pam_handle_t *pamh, cons - return retval; - } - --int --save_old_pass (pam_handle_t *pamh, const char *user, uid_t uid, -- const char *oldpass, int howmany, int debug UNUSED) -+PAMH_ARG_DECL(int -+save_old_pass, const char *user, -+ int howmany, int debug UNUSED) - { - char opasswd_tmp[] = TMP_PASSWORDS_FILE; - struct stat opasswd_stat; -@@ -226,10 +254,35 @@ save_old_pass (pam_handle_t *pamh, const - char *buf = NULL; - size_t buflen = 0; - int found = 0; -+ struct passwd *pwd; -+ const char *oldpass; -+ -+ pwd = pam_modutil_getpwnam (pamh, user); -+ if (pwd == NULL) -+ return PAM_USER_UNKNOWN; - - if (howmany <= 0) - return PAM_SUCCESS; - -+#ifndef HELPER_COMPILE -+ if (SELINUX_ENABLED) -+ return PAM_PWHISTORY_RUN_HELPER; -+#endif -+ -+ if ((strcmp(pwd->pw_passwd, "x") == 0) || -+ ((pwd->pw_passwd[0] == '#') && -+ (pwd->pw_passwd[1] == '#') && -+ (strcmp(pwd->pw_name, pwd->pw_passwd + 2) == 0))) -+ { -+ struct spwd *spw = pam_modutil_getspnam (pamh, user); -+ -+ if (spw == NULL) -+ return PAM_USER_UNKNOWN; -+ oldpass = spw->sp_pwdp; -+ } -+ else -+ oldpass = pwd->pw_passwd; -+ - if (oldpass == NULL || *oldpass == '\0') - return PAM_SUCCESS; - -@@ -452,7 +505,7 @@ save_old_pass (pam_handle_t *pamh, const - { - char *out; - -- if (asprintf (&out, "%s:%d:1:%s\n", user, uid, oldpass) < 0) -+ if (asprintf (&out, "%s:%d:1:%s\n", user, pwd->pw_uid, oldpass) < 0) - { - retval = PAM_AUTHTOK_ERR; - if (oldpf) -diff -up Linux-PAM-1.3.0/modules/pam_pwhistory/opasswd.h.pwhhelper Linux-PAM-1.3.0/modules/pam_pwhistory/opasswd.h ---- Linux-PAM-1.3.0/modules/pam_pwhistory/opasswd.h.pwhhelper 2016-03-24 12:45:42.000000000 +0100 -+++ Linux-PAM-1.3.0/modules/pam_pwhistory/opasswd.h 2016-05-06 15:18:42.307637933 +0200 -@@ -1,5 +1,6 @@ - /* - * Copyright (c) 2008 Thorsten Kukuk -+ * Copyright (c) 2013 Red Hat, Inc. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions -@@ -36,10 +37,32 @@ - #ifndef __OPASSWD_H__ - #define __OPASSWD_H__ - --extern int check_old_pass (pam_handle_t *pamh, const char *user, -- const char *newpass, int debug); --extern int save_old_pass (pam_handle_t *pamh, const char *user, -- uid_t uid, const char *oldpass, -- int howmany, int debug); -+#define PAM_PWHISTORY_RUN_HELPER PAM_CRED_INSUFFICIENT -+ -+#ifdef WITH_SELINUX -+#include -+#define SELINUX_ENABLED is_selinux_enabled()>0 -+#else -+#define SELINUX_ENABLED 0 -+#endif -+ -+#ifdef HELPER_COMPILE -+#define PAMH_ARG_DECL(fname, ...) fname(__VA_ARGS__) -+#define PAMH_ARG(...) __VA_ARGS__ -+#else -+#define PAMH_ARG_DECL(fname, ...) fname(pam_handle_t *pamh, __VA_ARGS__) -+#define PAMH_ARG(...) pamh, __VA_ARGS__ -+#endif -+ -+#ifdef HELPER_COMPILE -+void -+helper_log_err(int err, const char *format, ...); -+#endif -+ -+PAMH_ARG_DECL(int -+check_old_pass, const char *user, const char *newpass, int debug); -+ -+PAMH_ARG_DECL(int -+save_old_pass, const char *user, int howmany, int debug); - - #endif /* __OPASSWD_H__ */ -diff -up Linux-PAM-1.3.0/modules/pam_pwhistory/pam_pwhistory.c.pwhhelper Linux-PAM-1.3.0/modules/pam_pwhistory/pam_pwhistory.c ---- Linux-PAM-1.3.0/modules/pam_pwhistory/pam_pwhistory.c.pwhhelper 2016-04-04 11:22:28.000000000 +0200 -+++ Linux-PAM-1.3.0/modules/pam_pwhistory/pam_pwhistory.c 2016-05-06 15:19:31.610785512 +0200 -@@ -1,6 +1,7 @@ - /* - * Copyright (c) 2008, 2012 Thorsten Kukuk - * Author: Thorsten Kukuk -+ * Copyright (c) 2013 Red Hat, Inc. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions -@@ -46,10 +47,14 @@ - #include - #include - #include --#include - #include - #include - #include -+#include -+#include -+#include -+#include -+#include - - #include - #include -@@ -59,6 +64,7 @@ - #include "opasswd.h" - - #define DEFAULT_BUFLEN 2048 -+#define MAX_FD_NO 20000 - - struct options_t { - int debug; -@@ -102,6 +108,184 @@ parse_option (pam_handle_t *pamh, const - pam_syslog (pamh, LOG_ERR, "pam_pwhistory: unknown option: %s", argv); - } - -+static int -+run_save_helper(pam_handle_t *pamh, const char *user, -+ int howmany, int debug) -+{ -+ int retval, child; -+ struct sigaction newsa, oldsa; -+ -+ memset(&newsa, '\0', sizeof(newsa)); -+ newsa.sa_handler = SIG_DFL; -+ sigaction(SIGCHLD, &newsa, &oldsa); -+ -+ child = fork(); -+ if (child == 0) -+ { -+ int i = 0; -+ struct rlimit rlim; -+ int dummyfds[2]; -+ static char *envp[] = { NULL }; -+ char *args[] = { NULL, NULL, NULL, NULL, NULL, NULL }; -+ -+ /* replace std file descriptors with a dummy pipe */ -+ if (pipe2(dummyfds, O_NONBLOCK) == 0) -+ { -+ dup2(dummyfds[0], STDIN_FILENO); -+ dup2(dummyfds[1], STDOUT_FILENO); -+ dup2(dummyfds[1], STDERR_FILENO); -+ } -+ -+ if (getrlimit(RLIMIT_NOFILE,&rlim) == 0) -+ { -+ if (rlim.rlim_max >= MAX_FD_NO) -+ rlim.rlim_max = MAX_FD_NO; -+ for (i = STDERR_FILENO + 1; i < (int)rlim.rlim_max; i++) -+ { -+ if (i != dummyfds[0]) -+ close(i); -+ } -+ } -+ -+ /* exec binary helper */ -+ args[0] = strdup(PWHISTORY_HELPER); -+ args[1] = strdup("save"); -+ args[2] = x_strdup(user); -+ asprintf(&args[3], "%d", howmany); -+ asprintf(&args[4], "%d", debug); -+ -+ execve(args[0], args, envp); -+ -+ _exit(PAM_SYSTEM_ERR); -+ } -+ else if (child > 0) -+ { -+ /* wait for child */ -+ int rc = 0; -+ rc = waitpid(child, &retval, 0); /* wait for helper to complete */ -+ if (rc < 0) -+ { -+ pam_syslog(pamh, LOG_ERR, "pwhistory_helper save waitpid returned %d: %m", rc); -+ retval = PAM_SYSTEM_ERR; -+ } -+ else if (!WIFEXITED(retval)) -+ { -+ pam_syslog(pamh, LOG_ERR, "pwhistory_helper save abnormal exit: %d", retval); -+ retval = PAM_SYSTEM_ERR; -+ } -+ else -+ { -+ retval = WEXITSTATUS(retval); -+ } -+ } -+ else -+ { -+ retval = PAM_SYSTEM_ERR; -+ } -+ -+ sigaction(SIGCHLD, &oldsa, NULL); /* restore old signal handler */ -+ -+ return retval; -+} -+ -+static int -+run_check_helper(pam_handle_t *pamh, const char *user, -+ const char *newpass, int debug) -+{ -+ int retval, child, fds[2]; -+ struct sigaction newsa, oldsa; -+ -+ /* create a pipe for the password */ -+ if (pipe(fds) != 0) -+ return PAM_SYSTEM_ERR; -+ -+ memset(&newsa, '\0', sizeof(newsa)); -+ newsa.sa_handler = SIG_DFL; -+ sigaction(SIGCHLD, &newsa, &oldsa); -+ -+ child = fork(); -+ if (child == 0) -+ { -+ int i = 0; -+ struct rlimit rlim; -+ int dummyfds[2]; -+ static char *envp[] = { NULL }; -+ char *args[] = { NULL, NULL, NULL, NULL, NULL }; -+ -+ /* reopen stdin as pipe */ -+ dup2(fds[0], STDIN_FILENO); -+ -+ /* replace std file descriptors with a dummy pipe */ -+ if (pipe2(dummyfds, O_NONBLOCK) == 0) -+ { -+ dup2(dummyfds[1], STDOUT_FILENO); -+ dup2(dummyfds[1], STDERR_FILENO); -+ } -+ -+ if (getrlimit(RLIMIT_NOFILE,&rlim) == 0) -+ { -+ if (rlim.rlim_max >= MAX_FD_NO) -+ rlim.rlim_max = MAX_FD_NO; -+ for (i = STDERR_FILENO + 1; i < (int)rlim.rlim_max; i++) -+ { -+ if (i != dummyfds[0]) -+ close(i); -+ } -+ } -+ -+ /* exec binary helper */ -+ args[0] = strdup(PWHISTORY_HELPER); -+ args[1] = strdup("check"); -+ args[2] = x_strdup(user); -+ asprintf(&args[3], "%d", debug); -+ -+ execve(args[0], args, envp); -+ -+ _exit(PAM_SYSTEM_ERR); -+ } -+ else if (child > 0) -+ { -+ /* wait for child */ -+ int rc = 0; -+ if (newpass == NULL) -+ newpass = ""; -+ -+ /* send the password to the child */ -+ if (write(fds[1], newpass, strlen(newpass)+1) == -1) -+ { -+ pam_syslog(pamh, LOG_ERR, "Cannot send password to helper: %m"); -+ retval = PAM_SYSTEM_ERR; -+ } -+ newpass = NULL; -+ close(fds[0]); /* close here to avoid possible SIGPIPE above */ -+ close(fds[1]); -+ rc = waitpid(child, &retval, 0); /* wait for helper to complete */ -+ if (rc < 0) -+ { -+ pam_syslog(pamh, LOG_ERR, "pwhistory_helper check waitpid returned %d: %m", rc); -+ retval = PAM_SYSTEM_ERR; -+ } -+ else if (!WIFEXITED(retval)) -+ { -+ pam_syslog(pamh, LOG_ERR, "pwhistory_helper check abnormal exit: %d", retval); -+ retval = PAM_SYSTEM_ERR; -+ } -+ else -+ { -+ retval = WEXITSTATUS(retval); -+ } -+ } -+ else -+ { -+ close(fds[0]); -+ close(fds[1]); -+ retval = PAM_SYSTEM_ERR; -+ } -+ -+ sigaction(SIGCHLD, &oldsa, NULL); /* restore old signal handler */ -+ -+ return retval; -+} - - /* This module saves the current crypted password in /etc/security/opasswd - and then compares the new password with all entries in this file. */ -@@ -109,7 +293,6 @@ parse_option (pam_handle_t *pamh, const - int - pam_sm_chauthtok (pam_handle_t *pamh, int flags, int argc, const char **argv) - { -- struct passwd *pwd; - const char *newpass; - const char *user; - int retval, tries; -@@ -154,31 +337,13 @@ pam_sm_chauthtok (pam_handle_t *pamh, in - return PAM_SUCCESS; - } - -- pwd = pam_modutil_getpwnam (pamh, user); -- if (pwd == NULL) -- return PAM_USER_UNKNOWN; -- -- if ((strcmp(pwd->pw_passwd, "x") == 0) || -- ((pwd->pw_passwd[0] == '#') && -- (pwd->pw_passwd[1] == '#') && -- (strcmp(pwd->pw_name, pwd->pw_passwd + 2) == 0))) -- { -- struct spwd *spw = pam_modutil_getspnam (pamh, user); -- if (spw == NULL) -- return PAM_USER_UNKNOWN; -+ retval = save_old_pass (pamh, user, options.remember, options.debug); - -- retval = save_old_pass (pamh, user, pwd->pw_uid, spw->sp_pwdp, -- options.remember, options.debug); -- if (retval != PAM_SUCCESS) -- return retval; -- } -- else -- { -- retval = save_old_pass (pamh, user, pwd->pw_uid, pwd->pw_passwd, -- options.remember, options.debug); -- if (retval != PAM_SUCCESS) -- return retval; -- } -+ if (retval == PAM_PWHISTORY_RUN_HELPER) -+ retval = run_save_helper(pamh, user, options.remember, options.debug); -+ -+ if (retval != PAM_SUCCESS) -+ return retval; - - newpass = NULL; - tries = 0; -@@ -207,8 +372,11 @@ pam_sm_chauthtok (pam_handle_t *pamh, in - if (options.debug) - pam_syslog (pamh, LOG_DEBUG, "check against old password file"); - -- if (check_old_pass (pamh, user, newpass, -- options.debug) != PAM_SUCCESS) -+ retval = check_old_pass (pamh, user, newpass, options.debug); -+ if (retval == PAM_PWHISTORY_RUN_HELPER) -+ retval = run_check_helper(pamh, user, newpass, options.debug); -+ -+ if (retval != PAM_SUCCESS) - { - if (getuid() || options.enforce_for_root || - (flags & PAM_CHANGE_EXPIRED_AUTHTOK)) -diff -up Linux-PAM-1.3.0/modules/pam_pwhistory/pwhistory_helper.c.pwhhelper Linux-PAM-1.3.0/modules/pam_pwhistory/pwhistory_helper.c ---- Linux-PAM-1.3.0/modules/pam_pwhistory/pwhistory_helper.c.pwhhelper 2016-05-06 15:18:42.308637957 +0200 -+++ Linux-PAM-1.3.0/modules/pam_pwhistory/pwhistory_helper.c 2016-05-06 15:18:42.308637957 +0200 -@@ -0,0 +1,209 @@ -+/* -+ * Copyright (c) 2013 Red Hat, Inc. -+ * Author: Tomas Mraz -+ * -+ * Redistribution and use in source and binary forms, with or without -+ * modification, are permitted provided that the following conditions -+ * are met: -+ * 1. Redistributions of source code must retain the above copyright -+ * notice, and the entire permission notice in its entirety, -+ * including the disclaimer of warranties. -+ * 2. Redistributions in binary form must reproduce the above copyright -+ * notice, this list of conditions and the following disclaimer in the -+ * documentation and/or other materials provided with the distribution. -+ * 3. The name of the author may not be used to endorse or promote -+ * products derived from this software without specific prior -+ * written permission. -+ * -+ * ALTERNATIVELY, this product may be distributed under the terms of -+ * the GNU Public License, in which case the provisions of the GPL are -+ * required INSTEAD OF the above restrictions. (This clause is -+ * necessary due to a potential bad interaction between the GPL and -+ * the restrictions contained in a BSD-style copyright.) -+ * -+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED -+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES -+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -+ * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, -+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR -+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) -+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, -+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) -+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED -+ * OF THE POSSIBILITY OF SUCH DAMAGE. -+ */ -+ -+#include "config.h" -+ -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include "opasswd.h" -+ -+#define MAXPASS 200 -+ -+static void -+su_sighandler(int sig) -+{ -+#ifndef SA_RESETHAND -+ /* emulate the behaviour of the SA_RESETHAND flag */ -+ if ( sig == SIGILL || sig == SIGTRAP || sig == SIGBUS || sig = SIGSERV ) { -+ struct sigaction sa; -+ memset(&sa, '\0', sizeof(sa)); -+ sa.sa_handler = SIG_DFL; -+ sigaction(sig, &sa, NULL); -+ } -+#endif -+ if (sig > 0) { -+ _exit(sig); -+ } -+} -+ -+static void -+setup_signals(void) -+{ -+ struct sigaction action; /* posix signal structure */ -+ -+ /* -+ * Setup signal handlers -+ */ -+ (void) memset((void *) &action, 0, sizeof(action)); -+ action.sa_handler = su_sighandler; -+#ifdef SA_RESETHAND -+ action.sa_flags = SA_RESETHAND; -+#endif -+ (void) sigaction(SIGILL, &action, NULL); -+ (void) sigaction(SIGTRAP, &action, NULL); -+ (void) sigaction(SIGBUS, &action, NULL); -+ (void) sigaction(SIGSEGV, &action, NULL); -+ action.sa_handler = SIG_IGN; -+ action.sa_flags = 0; -+ (void) sigaction(SIGTERM, &action, NULL); -+ (void) sigaction(SIGHUP, &action, NULL); -+ (void) sigaction(SIGINT, &action, NULL); -+ (void) sigaction(SIGQUIT, &action, NULL); -+} -+ -+static int -+read_passwords(int fd, int npass, char **passwords) -+{ -+ int rbytes = 0; -+ int offset = 0; -+ int i = 0; -+ char *pptr; -+ while (npass > 0) -+ { -+ rbytes = read(fd, passwords[i]+offset, MAXPASS-offset); -+ -+ if (rbytes < 0) -+ { -+ if (errno == EINTR) continue; -+ break; -+ } -+ if (rbytes == 0) -+ break; -+ -+ while (npass > 0 && (pptr=memchr(passwords[i]+offset, '\0', rbytes)) -+ != NULL) -+ { -+ rbytes -= pptr - (passwords[i]+offset) + 1; -+ i++; -+ offset = 0; -+ npass--; -+ if (rbytes > 0) -+ { -+ if (npass > 0) -+ memcpy(passwords[i], pptr+1, rbytes); -+ memset(pptr+1, '\0', rbytes); -+ } -+ } -+ offset += rbytes; -+ } -+ -+ /* clear up */ -+ if (offset > 0 && npass > 0) -+ memset(passwords[i], '\0', offset); -+ -+ return i; -+} -+ -+ -+static int -+check_history(const char *user, const char *debug) -+{ -+ char pass[MAXPASS + 1]; -+ char *passwords[] = { pass }; -+ int npass; -+ int dbg = atoi(debug); /* no need to be too fancy here */ -+ int retval; -+ -+ /* read the password from stdin (a pipe from the pam_pwhistory module) */ -+ npass = read_passwords(STDIN_FILENO, 1, passwords); -+ -+ if (npass != 1) -+ { /* is it a valid password? */ -+ helper_log_err(LOG_DEBUG, "no password supplied"); -+ return PAM_AUTHTOK_ERR; -+ } -+ -+ retval = check_old_pass(user, pass, dbg); -+ -+ memset(pass, '\0', MAXPASS); /* clear memory of the password */ -+ -+ return retval; -+} -+ -+static int -+save_history(const char *user, const char *howmany, const char *debug) -+{ -+ int num = atoi(howmany); -+ int dbg = atoi(debug); /* no need to be too fancy here */ -+ int retval; -+ -+ retval = save_old_pass(user, num, dbg); -+ -+ return retval; -+} -+ -+int -+main(int argc, char *argv[]) -+{ -+ const char *option; -+ const char *user; -+ -+ /* -+ * Catch or ignore as many signal as possible. -+ */ -+ setup_signals(); -+ -+ /* -+ * we establish that this program is running with non-tty stdin. -+ * this is to discourage casual use. -+ */ -+ -+ if (isatty(STDIN_FILENO) || argc < 4) -+ { -+ fprintf(stderr, -+ "This binary is not designed for running in this way.\n"); -+ sleep(10); /* this should discourage/annoy the user */ -+ return PAM_SYSTEM_ERR; -+ } -+ -+ option = argv[1]; -+ user = argv[2]; -+ -+ if (strcmp(option, "check") == 0 && argc == 4) -+ return check_history(user, argv[3]); -+ else if (strcmp(option, "save") == 0 && argc == 5) -+ return save_history(user, argv[3], argv[4]); -+ -+ return PAM_SYSTEM_ERR; -+} -+ -diff -up Linux-PAM-1.3.0/modules/pam_pwhistory/pwhistory_helper.8.xml.pwhhelper Linux-PAM-1.3.0/modules/pam_pwhistory/pwhistory_helper.8.xml ---- Linux-PAM-1.3.0/modules/pam_pwhistory/pwhistory_helper.8.xml.pwhhelper 2016-05-06 15:18:42.308637957 +0200 -+++ Linux-PAM-1.3.0/modules/pam_pwhistory/pwhistory_helper.8.xml 2016-05-06 15:18:42.308637957 +0200 -@@ -0,0 +1,68 @@ -+ -+ -+ -+ -+ -+ -+ pwhistory_helper -+ 8 -+ Linux-PAM Manual -+ -+ -+ -+ pwhistory_helper -+ Helper binary that transfers password hashes from passwd or shadow to opasswd -+ -+ -+ -+ -+ pwhistory_helper -+ -+ ... -+ -+ -+ -+ -+ -+ -+ DESCRIPTION -+ -+ -+ pwhistory_helper is a helper program for the -+ pam_pwhistory module that transfers password hashes -+ from passwd or shadow file to the opasswd file and checks a password -+ supplied by user against the existing hashes in the opasswd file. -+ -+ -+ -+ The purpose of the helper is to enable tighter confinement of -+ login and password changing services. The helper is thus called only -+ when SELinux is enabled on the system. -+ -+ -+ -+ The interface of the helper - command line options, and input/output -+ data format are internal to the pam_pwhistory -+ module and it should not be called directly from applications. -+ -+ -+ -+ -+ SEE ALSO -+ -+ -+ pam_pwhistory8 -+ -+ -+ -+ -+ -+ AUTHOR -+ -+ Written by Tomas Mraz based on the code originally in -+ pam_pwhistory and pam_unix modules. -+ -+ -+ -+ diff --git a/SOURCES/pam-1.3.1-access-handle-hostnames.patch b/SOURCES/pam-1.3.1-access-handle-hostnames.patch deleted file mode 100644 index b73ba8a..0000000 --- a/SOURCES/pam-1.3.1-access-handle-hostnames.patch +++ /dev/null @@ -1,158 +0,0 @@ -diff -up Linux-PAM-1.3.1/modules/pam_access/pam_access.c.access-handle-hostnames Linux-PAM-1.3.1/modules/pam_access/pam_access.c ---- Linux-PAM-1.3.1/modules/pam_access/pam_access.c.access-handle-hostnames 2024-01-19 16:45:18.319862531 +0100 -+++ Linux-PAM-1.3.1/modules/pam_access/pam_access.c 2024-01-19 16:50:34.239545948 +0100 -@@ -683,7 +683,7 @@ string_match (pam_handle_t *pamh, const - /* - * If the token has the magic value "ALL" the match always succeeds. - * Otherwise, return YES if the token fully matches the string. -- * "NONE" token matches NULL string. -+ * "NONE" token matches NULL string. - */ - - if (strcasecmp(tok, "ALL") == 0) { /* all: always matches */ -@@ -701,7 +701,8 @@ string_match (pam_handle_t *pamh, const - - /* network_netmask_match - match a string against one token - * where string is a hostname or ip (v4,v6) address and tok -- * represents either a single ip (v4,v6) address or a network/netmask -+ * represents either a hostname, a single ip (v4,v6) address -+ * or a network/netmask - */ - static int - network_netmask_match (pam_handle_t *pamh, -@@ -710,10 +711,12 @@ network_netmask_match (pam_handle_t *pam - char *netmask_ptr; - char netmask_string[MAXHOSTNAMELEN + 1]; - int addr_type; -+ struct addrinfo *ai = NULL; - - if (item->debug) -- pam_syslog (pamh, LOG_DEBUG, -+ pam_syslog (pamh, LOG_DEBUG, - "network_netmask_match: tok=%s, item=%s", tok, string); -+ - /* OK, check if tok is of type addr/mask */ - if ((netmask_ptr = strchr(tok, '/')) != NULL) - { -@@ -745,52 +748,109 @@ network_netmask_match (pam_handle_t *pam - netmask_ptr = number_to_netmask(netmask, addr_type, - netmask_string, MAXHOSTNAMELEN); - } -- } -+ -+ /* -+ * Construct an addrinfo list from the IP address. -+ * This should not fail as the input is a correct IP address... -+ */ -+ if (getaddrinfo (tok, NULL, NULL, &ai) != 0) -+ { -+ return NO; -+ } -+ } - else -- /* NO, then check if it is only an addr */ -- if (isipaddr(tok, NULL, NULL) != YES) -+ { -+ /* -+ * It is either an IP address or a hostname. -+ * Let getaddrinfo sort everything out -+ */ -+ if (getaddrinfo (tok, NULL, NULL, &ai) != 0) - { -+ if (item->debug) -+ pam_syslog(pamh, LOG_DEBUG, "cannot resolve hostname \"%s\"", tok); -+ - return NO; - } -+ netmask_ptr = NULL; -+ } - - if (isipaddr(string, NULL, NULL) != YES) - { -- /* Assume network/netmask with a name of a host. */ - struct addrinfo hint; - -+ /* Assume network/netmask with a name of a host. */ - memset (&hint, '\0', sizeof (hint)); - hint.ai_flags = AI_CANONNAME; - hint.ai_family = AF_UNSPEC; - - if (item->gai_rv != 0) -+ { -+ freeaddrinfo(ai); - return NO; -+ } - else if (!item->res && - (item->gai_rv = getaddrinfo (string, NULL, &hint, &item->res)) != 0) -+ { -+ freeaddrinfo(ai); - return NO; -+ } - else - { - struct addrinfo *runp = item->res; -+ struct addrinfo *runp1; - - while (runp != NULL) - { - char buf[INET6_ADDRSTRLEN]; - -- inet_ntop (runp->ai_family, -- runp->ai_family == AF_INET -- ? (void *) &((struct sockaddr_in *) runp->ai_addr)->sin_addr -- : (void *) &((struct sockaddr_in6 *) runp->ai_addr)->sin6_addr, -- buf, sizeof (buf)); -+ if (getnameinfo (runp->ai_addr, runp->ai_addrlen, buf, sizeof (buf), NULL, 0, NI_NUMERICHOST) != 0) -+ { -+ freeaddrinfo(ai); -+ return NO; -+ } - -- if (are_addresses_equal(buf, tok, netmask_ptr)) -+ for (runp1 = ai; runp1 != NULL; runp1 = runp1->ai_next) - { -- return YES; -+ char buf1[INET6_ADDRSTRLEN]; -+ -+ if (runp->ai_family != runp1->ai_family) -+ continue; -+ -+ if (getnameinfo (runp1->ai_addr, runp1->ai_addrlen, buf1, sizeof (buf1), NULL, 0, NI_NUMERICHOST) != 0) -+ { -+ freeaddrinfo(ai); -+ return NO; -+ } -+ -+ if (are_addresses_equal (buf, buf1, netmask_ptr)) -+ { -+ freeaddrinfo(ai); -+ return YES; -+ } - } - runp = runp->ai_next; - } - } - } - else -- return (are_addresses_equal(string, tok, netmask_ptr)); -+ { -+ struct addrinfo *runp1; -+ -+ for (runp1 = ai; runp1 != NULL; runp1 = runp1->ai_next) -+ { -+ char buf1[INET6_ADDRSTRLEN]; -+ -+ (void) getnameinfo (runp1->ai_addr, runp1->ai_addrlen, buf1, sizeof (buf1), NULL, 0, NI_NUMERICHOST); -+ -+ if (are_addresses_equal(string, buf1, netmask_ptr)) -+ { -+ freeaddrinfo(ai); -+ return YES; -+ } -+ } -+ } -+ -+ freeaddrinfo(ai); - - return NO; - } diff --git a/SOURCES/pam-1.3.1-audit-error.patch b/SOURCES/pam-1.3.1-audit-error.patch deleted file mode 100644 index f01172b..0000000 --- a/SOURCES/pam-1.3.1-audit-error.patch +++ /dev/null @@ -1,35 +0,0 @@ -From b429ea18b1c9c8953df5169c6a453b4255a6f23d Mon Sep 17 00:00:00 2001 -From: Iker Pedrosa -Date: Thu, 27 Feb 2020 11:48:47 +0100 -Subject: [PATCH] pam_tty_audit: if kernel audit is disabled return PAM_IGNORE - -If kernel audit is disabled the socket open will return -EPROTONOSUPPORT. -Return PAM_IGNORE from pam_tty_audit and log a warning -in this situation so login is not blocked by the module. ---- - modules/pam_tty_audit/pam_tty_audit.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/modules/pam_tty_audit/pam_tty_audit.c b/modules/pam_tty_audit/pam_tty_audit.c -index 7dbcada2..589c60a2 100644 ---- a/modules/pam_tty_audit/pam_tty_audit.c -+++ b/modules/pam_tty_audit/pam_tty_audit.c -@@ -351,6 +351,14 @@ pam_sm_open_session (pam_handle_t *pamh, int flags, int argc, const char **argv) - - fd = nl_open (); - if (fd == -1 -+ && errno == EPROTONOSUPPORT) -+ { -+ pam_syslog (pamh, LOG_WARNING, "unable to open audit socket, audit not " -+ "supported; tty_audit skipped"); -+ free (old_status); -+ return PAM_IGNORE; -+ } -+ else if (fd == -1 - || nl_send (fd, AUDIT_TTY_GET, 0, NULL, 0) != 0 - || nl_recv (fd, AUDIT_TTY_GET, old_status, sizeof (*old_status)) != 0) - { --- -2.25.2 - diff --git a/SOURCES/pam-1.3.1-audit-messages-formatting.patch b/SOURCES/pam-1.3.1-audit-messages-formatting.patch deleted file mode 100644 index e152aa5..0000000 --- a/SOURCES/pam-1.3.1-audit-messages-formatting.patch +++ /dev/null @@ -1,33 +0,0 @@ -diff -up Linux-PAM-1.3.1/modules/pam_faillock/pam_faillock.c.audit-messages-formatting Linux-PAM-1.3.1/modules/pam_faillock/pam_faillock.c ---- Linux-PAM-1.3.1/modules/pam_faillock/pam_faillock.c.audit-messages-formatting 2024-03-11 16:21:51.928946604 +0100 -+++ Linux-PAM-1.3.1/modules/pam_faillock/pam_faillock.c 2024-03-11 16:21:51.934946609 +0100 -@@ -334,7 +334,7 @@ check_tally(pam_handle_t *pamh, struct o - - (void)pam_get_item(pamh, PAM_TTY, &tty); - (void)pam_get_item(pamh, PAM_RHOST, &rhost); -- snprintf(buf, sizeof(buf), "pam_faillock uid=%u ", opts->uid); -+ snprintf(buf, sizeof(buf), "op=pam_faillock suid=%u ", opts->uid); - audit_log_user_message(audit_fd, AUDIT_RESP_ACCT_UNLOCK_TIMED, buf, - rhost, NULL, tty, 1); - } -@@ -450,7 +450,7 @@ write_tally(pam_handle_t *pamh, struct o - errno == EAFNOSUPPORT)) - return PAM_SYSTEM_ERR; - -- snprintf(buf, sizeof(buf), "pam_faillock uid=%u ", opts->uid); -+ snprintf(buf, sizeof(buf), "op=pam_faillock suid=%u ", opts->uid); - audit_log_user_message(audit_fd, AUDIT_ANOM_LOGIN_FAILURES, buf, - NULL, NULL, NULL, 1); - -diff -up Linux-PAM-1.3.1/modules/pam_selinux/pam_selinux.c.audit-messages-formatting Linux-PAM-1.3.1/modules/pam_selinux/pam_selinux.c ---- Linux-PAM-1.3.1/modules/pam_selinux/pam_selinux.c.audit-messages-formatting 2024-03-11 16:21:51.934946609 +0100 -+++ Linux-PAM-1.3.1/modules/pam_selinux/pam_selinux.c 2024-03-11 16:23:24.521025061 +0100 -@@ -106,7 +106,7 @@ int send_audit_message(pam_handle_t *pam - pam_syslog(pamh, LOG_ERR, "Error translating selected context."); - selected_raw = NULL; - } -- if (asprintf(&msg, "pam: default-context=%s selected-context=%s", -+ if (asprintf(&msg, "op=pam_selinux default-context=%s selected-context=%s", - default_raw ? default_raw : (default_context ? default_context : "?"), - selected_raw ? selected_raw : (selected_context ? selected_context : "?")) < 0) { - pam_syslog(pamh, LOG_ERR, "Error allocating memory."); diff --git a/SOURCES/pam-1.3.1-authtok-verify-fix.patch b/SOURCES/pam-1.3.1-authtok-verify-fix.patch deleted file mode 100644 index 6c40cdc..0000000 --- a/SOURCES/pam-1.3.1-authtok-verify-fix.patch +++ /dev/null @@ -1,88 +0,0 @@ -From 27d04a849fd9f9cfd4b35eb80d687817830183df Mon Sep 17 00:00:00 2001 -From: Tomas Mraz -Date: Wed, 7 Aug 2019 12:22:55 +0200 -Subject: [PATCH] pam_get_authtok_verify: Avoid duplicate password verification - -If password was already verified by previous modules in the stack -it does not need to be verified by pam_get_authtok_verify either. - -* libpam/pam_get_authtok.c (pam_get_authtok_internal): Set the authtok_verified - appropriately. - (pam_get_authtok_verify): Do not prompt if authtok_verified is set and - set it when the password is verified. -* libpam/pam_private.h: Add authtok_verified to the pam handle struct. -* libpam/pam_start.c (pam_start): Initialize authtok_verified. ---- - libpam/pam_get_authtok.c | 10 ++++++++++ - libpam/pam_private.h | 1 + - libpam/pam_start.c | 1 + - 3 files changed, 12 insertions(+) - -diff --git a/libpam/pam_get_authtok.c b/libpam/pam_get_authtok.c -index 800c6e5..99eb25f 100644 ---- a/libpam/pam_get_authtok.c -+++ b/libpam/pam_get_authtok.c -@@ -140,6 +140,8 @@ pam_get_authtok_internal (pam_handle_t *pamh, int item, - } - else if (chpass) - { -+ pamh->authtok_verified = 0; -+ - retval = pam_prompt (pamh, PAM_PROMPT_ECHO_OFF, &resp[0], - PROMPT1, authtok_type, - strlen (authtok_type) > 0?" ":""); -@@ -184,6 +186,9 @@ pam_get_authtok_internal (pam_handle_t *pamh, int item, - if (retval != PAM_SUCCESS) - return retval; - -+ if (chpass > 1) -+ pamh->authtok_verified = 1; -+ - return pam_get_item(pamh, item, (const void **)authtok); - } - -@@ -214,6 +219,9 @@ pam_get_authtok_verify (pam_handle_t *pamh, const char **authtok, - if (authtok == NULL || pamh->choice != PAM_CHAUTHTOK) - return PAM_SYSTEM_ERR; - -+ if (pamh->authtok_verified) -+ return pam_get_item (pamh, PAM_AUTHTOK, (const void **)authtok); -+ - if (prompt != NULL) - { - retval = pam_prompt (pamh, PAM_PROMPT_ECHO_OFF, &resp, -@@ -252,5 +260,7 @@ pam_get_authtok_verify (pam_handle_t *pamh, const char **authtok, - if (retval != PAM_SUCCESS) - return retval; - -+ pamh->authtok_verified = 1; -+ - return pam_get_item(pamh, PAM_AUTHTOK, (const void **)authtok); - } -diff --git a/libpam/pam_private.h b/libpam/pam_private.h -index 7ff9f75..58a26f5 100644 ---- a/libpam/pam_private.h -+++ b/libpam/pam_private.h -@@ -172,6 +172,7 @@ struct pam_handle { - #ifdef HAVE_LIBAUDIT - int audit_state; /* keep track of reported audit messages */ - #endif -+ int authtok_verified; - }; - - /* Values for select arg to _pam_dispatch() */ -diff --git a/libpam/pam_start.c b/libpam/pam_start.c -index 328416d..e27c64b 100644 ---- a/libpam/pam_start.c -+++ b/libpam/pam_start.c -@@ -94,6 +94,7 @@ int pam_start ( - #endif - (*pamh)->xdisplay = NULL; - (*pamh)->authtok_type = NULL; -+ (*pamh)->authtok_verified = 0; - memset (&((*pamh)->xauth), 0, sizeof ((*pamh)->xauth)); - - if (((*pamh)->pam_conversation = (struct pam_conv *) --- -2.20.1 - diff --git a/SOURCES/pam-1.3.1-console-build.patch b/SOURCES/pam-1.3.1-console-build.patch deleted file mode 100644 index b9338cd..0000000 --- a/SOURCES/pam-1.3.1-console-build.patch +++ /dev/null @@ -1,11 +0,0 @@ -diff -up Linux-PAM-1.3.1/modules/pam_console/sed-static.console-build Linux-PAM-1.3.1/modules/pam_console/sed-static ---- Linux-PAM-1.3.1/modules/pam_console/sed-static.console-build 2014-01-31 14:17:53.000000000 +0100 -+++ Linux-PAM-1.3.1/modules/pam_console/sed-static 2018-09-10 15:06:04.115302315 +0200 -@@ -13,6 +13,7 @@ sed ' - /^YY_BUFFER_STATE yy_scan_buffer/s/^/STATIC / - /^YY_BUFFER_STATE yy_scan_string/s/^/STATIC / - /^void yy_switch_to_buffer/s/^/STATIC / -+/^extern int yylex/s/^extern /STATIC / - /define YY_DECL int yylex/s/YY_DECL /YY_DECL STATIC / - /^int yyparse/s/^/STATIC / - /^void yyrestart/s/^/STATIC / diff --git a/SOURCES/pam-1.3.1-coverity.patch b/SOURCES/pam-1.3.1-coverity.patch deleted file mode 100644 index cecf768..0000000 --- a/SOURCES/pam-1.3.1-coverity.patch +++ /dev/null @@ -1,185 +0,0 @@ -diff --git a/libpam/pam_handlers.c b/libpam/pam_handlers.c -index 106ef7c..b2e94c7 100644 ---- a/libpam/pam_handlers.c -+++ b/libpam/pam_handlers.c -@@ -282,7 +282,6 @@ _pam_open_config_file(pam_handle_t *pamh - { - char *p; - FILE *f; -- int err = 0; - - /* Absolute path */ - if (service[0] == '/') { -diff --git a/libpam_misc/misc_conv.c b/libpam_misc/misc_conv.c -index be53f34..07dce36 100644 ---- a/libpam_misc/misc_conv.c -+++ b/libpam_misc/misc_conv.c -@@ -211,7 +211,7 @@ static int read_string(int echo, const char *prompt, char **retstr) - line[nc] = '\0'; - } - *retstr = strdup(line); -- _pam_overwrite(line); -+ _pam_overwrite_n(line, sizeof(line)); - if (!*retstr) { - D(("no memory for response string")); - nc = -1; -@@ -244,7 +244,7 @@ static int read_string(int echo, const char *prompt, char **retstr) - D(("the timer appears to have expired")); - - *retstr = NULL; -- _pam_overwrite(line); -+ _pam_overwrite_n(line, sizeof(line)); - - cleanexit: - -diff --git a/modules/pam_access/pam_access.c b/modules/pam_access/pam_access.c -index 80d885d..3801862 100644 ---- a/modules/pam_access/pam_access.c -+++ b/modules/pam_access/pam_access.c -@@ -806,7 +806,7 @@ pam_sm_authenticate (pam_handle_t *pamh, int flags UNUSED, - const char *user=NULL; - const void *void_from=NULL; - const char *from; -- const char const *default_config = PAM_ACCESS_CONFIG; -+ const char * const default_config = PAM_ACCESS_CONFIG; - struct passwd *user_pw; - char hostname[MAXHOSTNAMELEN + 1]; - int rv; -diff --git a/modules/pam_limits/pam_limits.c b/modules/pam_limits/pam_limits.c -index 4bc4ae7..f8476b4 100644 ---- a/modules/pam_limits/pam_limits.c -+++ b/modules/pam_limits/pam_limits.c -@@ -342,7 +342,7 @@ static const char *lnames[RLIM_NLIMITS] = { - #endif - }; - --static int str2rlimit(char *name) { -+static int str2rlimit(const char *name) { - int i; - if (!name || *name == '\0') - return -1; -@@ -352,7 +352,7 @@ static int str2rlimit(char *name) { - return -1; - } - --static rlim_t str2rlim_t(char *value) { -+static rlim_t str2rlim_t(const char *value) { - unsigned long long rlimit = 0; - - if (!value) return (rlim_t)rlimit; -@@ -384,7 +384,7 @@ static void parse_kernel_limits(pam_handle_t *pamh, struct pam_limit_s *pl, int - FILE *limitsfile; - const char *proclimits = "/proc/1/limits"; - char line[256]; -- char *units, *hard, *soft, *name; -+ const char *units, *hard, *soft, *name; - - if (!(limitsfile = fopen(proclimits, "r"))) { - pam_syslog(pamh, LOG_WARNING, "Could not read %s (%s), using PAM defaults", proclimits, strerror(errno)); -diff --git a/modules/pam_loginuid/pam_loginuid.c b/modules/pam_loginuid/pam_loginuid.c -index 96bfd98..66d202c 100644 ---- a/modules/pam_loginuid/pam_loginuid.c -+++ b/modules/pam_loginuid/pam_loginuid.c -@@ -64,7 +64,7 @@ static int set_loginuid(pam_handle_t *pamh, uid_t uid) - fd = open("/proc/self/uid_map", O_RDONLY); - if (fd >= 0) { - count = pam_modutil_read(fd, uid_map, sizeof(uid_map)); -- if (strncmp(uid_map, host_uid_map, count) != 0) -+ if (count <= 0 || strncmp(uid_map, host_uid_map, count) != 0) - rc = PAM_IGNORE; - close(fd); - } -diff --git a/modules/pam_mkhomedir/mkhomedir_helper.c b/modules/pam_mkhomedir/mkhomedir_helper.c -index 9e204c1..4b8d6b7 100644 ---- a/modules/pam_mkhomedir/mkhomedir_helper.c -+++ b/modules/pam_mkhomedir/mkhomedir_helper.c -@@ -232,6 +232,8 @@ create_homedir(const struct passwd *pwd, - { - pam_syslog(NULL, LOG_DEBUG, - "unable to open or stat src file %s: %m", newsource); -+ if (srcfd >= 0) -+ close(srcfd); - closedir(d); - - #ifndef PATH_MAX -diff --git a/modules/pam_namespace/pam_namespace.c b/modules/pam_namespace/pam_namespace.c -index f541f89..85f5efa 100644 ---- a/modules/pam_namespace/pam_namespace.c -+++ b/modules/pam_namespace/pam_namespace.c -@@ -1418,6 +1418,7 @@ static int create_instance(struct polydir_s *polyptr, char *ipath, struct stat * - if (fstat(fd, &newstatbuf) < 0) { - pam_syslog(idata->pamh, LOG_ERR, "Error stating %s, %m", - ipath); -+ close(fd); - rmdir(ipath); - return PAM_SESSION_ERR; - } -diff --git a/modules/pam_pwhistory/opasswd.c b/modules/pam_pwhistory/opasswd.c -index e6cf346..813f579 100644 ---- a/modules/pam_pwhistory/opasswd.c -+++ b/modules/pam_pwhistory/opasswd.c -@@ -326,6 +326,9 @@ save_old_pass (pam_handle_t *pamh, const char *user, uid_t uid, - n = strlen (buf); - #endif /* HAVE_GETLINE / HAVE_GETDELIM */ - -+ if (n < 1) -+ break; -+ - cp = buf; - save = strdup (buf); /* Copy to write the original data back. */ - if (save == NULL) -@@ -336,9 +339,6 @@ save_old_pass (pam_handle_t *pamh, const char *user, uid_t uid, - goto error_opasswd; - } - -- if (n < 1) -- break; -- - tmp = strchr (cp, '#'); /* remove comments */ - if (tmp) - *tmp = '\0'; -diff --git a/modules/pam_rootok/pam_rootok.c b/modules/pam_rootok/pam_rootok.c -index 17baabe..a9d9140 100644 ---- a/modules/pam_rootok/pam_rootok.c -+++ b/modules/pam_rootok/pam_rootok.c -@@ -66,14 +66,17 @@ log_callback (int type, const char *fmt, ...) - int audit_fd; - va_list ap; - -- va_start(ap, fmt); - #ifdef HAVE_LIBAUDIT - audit_fd = audit_open(); - - if (audit_fd >= 0) { - char *buf; -+ int ret; - -- if (vasprintf (&buf, fmt, ap) < 0) -+ va_start(ap, fmt); -+ ret = vasprintf (&buf, fmt, ap); -+ va_end(ap); -+ if (ret < 0) - return 0; - audit_log_user_avc_message(audit_fd, AUDIT_USER_AVC, buf, NULL, NULL, - NULL, 0); -@@ -83,6 +86,7 @@ log_callback (int type, const char *fmt, ...) - } - - #endif -+ va_start(ap, fmt); - vsyslog (LOG_USER | LOG_INFO, fmt, ap); - va_end(ap); - return 0; -diff --git a/modules/pam_sepermit/pam_sepermit.c b/modules/pam_sepermit/pam_sepermit.c -index c653290..f37af0f 100644 ---- a/modules/pam_sepermit/pam_sepermit.c -+++ b/modules/pam_sepermit/pam_sepermit.c -@@ -353,7 +353,7 @@ sepermit_match(pam_handle_t *pamh, const char *cfgfile, const char *user, - if (*sense == PAM_SUCCESS) { - if (ignore) - *sense = PAM_IGNORE; -- if (geteuid() == 0 && exclusive && get_loginuid(pamh) == -1) -+ if (geteuid() == 0 && exclusive && get_loginuid(pamh) == (uid_t)-1) - if (sepermit_lock(pamh, user, debug) < 0) - *sense = PAM_AUTH_ERR; - } diff --git a/SOURCES/pam-1.3.1-faillock-create-tallydir.patch b/SOURCES/pam-1.3.1-faillock-create-tallydir.patch deleted file mode 100644 index e2d2caf..0000000 --- a/SOURCES/pam-1.3.1-faillock-create-tallydir.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff -up Linux-PAM-1.3.1/modules/pam_faillock/faillock.c.faillock-create-tallydir Linux-PAM-1.3.1/modules/pam_faillock/faillock.c ---- Linux-PAM-1.3.1/modules/pam_faillock/faillock.c.faillock-create-tallydir 2024-01-08 11:32:02.122392119 +0100 -+++ Linux-PAM-1.3.1/modules/pam_faillock/faillock.c 2024-01-08 11:33:10.916515943 +0100 -@@ -74,6 +74,9 @@ open_tally (const char *dir, const char - - if (create) { - flags |= O_CREAT; -+ if (access(dir, F_OK) != 0) { -+ mkdir(dir, 0755); -+ } - } - - fd = open(path, flags, 0600); diff --git a/SOURCES/pam-1.3.1-faillock-load-conf-from-file.patch b/SOURCES/pam-1.3.1-faillock-load-conf-from-file.patch deleted file mode 100644 index 81ea7cc..0000000 --- a/SOURCES/pam-1.3.1-faillock-load-conf-from-file.patch +++ /dev/null @@ -1,1212 +0,0 @@ -diff -up Linux-PAM-1.3.1/modules/pam_faillock/faillock.8.xml.faillock-load-conf-from-file Linux-PAM-1.3.1/modules/pam_faillock/faillock.8.xml ---- Linux-PAM-1.3.1/modules/pam_faillock/faillock.8.xml.faillock-load-conf-from-file 2022-05-26 10:57:11.713067506 +0200 -+++ Linux-PAM-1.3.1/modules/pam_faillock/faillock.8.xml 2022-05-26 10:57:11.747067749 +0200 -@@ -57,12 +57,29 @@ - - - -+ -+ -+ -+ -+ The file where the configuration is located. The default is -+ /etc/security/faillock.conf. -+ -+ -+ -+ -+ - - - - -- The directory where the user files with the failure records are kept. The -- default is /var/run/faillock. -+ The directory where the user files with the failure records are kept. -+ -+ -+ The priority to set this option is to use the value provided -+ from the command line. If this isn't provided, then the value -+ from the configuration file is used. Finally, if neither of -+ them has been provided, then -+ /var/run/faillock is used. - - - -diff -up Linux-PAM-1.3.1/modules/pam_faillock/faillock_config.c.faillock-load-conf-from-file Linux-PAM-1.3.1/modules/pam_faillock/faillock_config.c ---- Linux-PAM-1.3.1/modules/pam_faillock/faillock_config.c.faillock-load-conf-from-file 2022-05-26 10:57:11.747067749 +0200 -+++ Linux-PAM-1.3.1/modules/pam_faillock/faillock_config.c 2022-05-26 10:57:11.747067749 +0200 -@@ -0,0 +1,266 @@ -+/* -+ * Copyright (c) 2022 Tomas Mraz -+ * Copyright (c) 2022 Iker Pedrosa -+ * -+ * Redistribution and use in source and binary forms, with or without -+ * modification, are permitted provided that the following conditions -+ * are met: -+ * 1. Redistributions of source code must retain the above copyright -+ * notice, and the entire permission notice in its entirety, -+ * including the disclaimer of warranties. -+ * 2. Redistributions in binary form must reproduce the above copyright -+ * notice, this list of conditions and the following disclaimer in the -+ * documentation and/or other materials provided with the distribution. -+ * 3. The name of the author may not be used to endorse or promote -+ * products derived from this software without specific prior -+ * written permission. -+ * -+ * ALTERNATIVELY, this product may be distributed under the terms of -+ * the GNU Public License, in which case the provisions of the GPL are -+ * required INSTEAD OF the above restrictions. (This clause is -+ * necessary due to a potential bad interaction between the GPL and -+ * the restrictions contained in a BSD-style copyright.) -+ * -+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED -+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES -+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -+ * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, -+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR -+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) -+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, -+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) -+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED -+ * OF THE POSSIBILITY OF SUCH DAMAGE. -+ */ -+ -+#include "config.h" -+ -+#include -+#include -+#include -+#include -+#include -+#include -+ -+#include -+ -+#include "faillock_config.h" -+#include "faillock.h" -+ -+#define FAILLOCK_DEFAULT_CONF "/etc/security/faillock.conf" -+#ifdef VENDOR_SCONFIGDIR -+#define VENDOR_FAILLOCK_DEFAULT_CONF VENDOR_SCONFIGDIR "/faillock.conf" -+#endif -+ -+static void PAM_FORMAT((printf, 3, 4)) PAM_NONNULL((3)) -+config_log(const pam_handle_t *pamh, int priority, const char *fmt, ...) -+{ -+ va_list args; -+ -+ va_start(args, fmt); -+ if (pamh) { -+ pam_vsyslog(pamh, priority, fmt, args); -+ } else { -+ char *buf = NULL; -+ -+ if (vasprintf(&buf, fmt, args) < 0) { -+ fprintf(stderr, "vasprintf: %m"); -+ va_end(args); -+ return; -+ } -+ fprintf(stderr, "%s\n", buf); -+ free(buf); -+ } -+ va_end(args); -+} -+ -+/* parse a single configuration file */ -+int -+read_config_file(pam_handle_t *pamh, struct options *opts, const char *cfgfile) -+{ -+ char linebuf[FAILLOCK_CONF_MAX_LINELEN+1]; -+ const char *fname = (cfgfile != NULL) ? cfgfile : FAILLOCK_DEFAULT_CONF; -+ FILE *f = fopen(fname, "r"); -+ -+#ifdef VENDOR_FAILLOCK_DEFAULT_CONF -+ if (f == NULL && errno == ENOENT && cfgfile == NULL) { -+ /* -+ * If the default configuration file in /etc does not exist, -+ * try the vendor configuration file as fallback. -+ */ -+ f = fopen(VENDOR_FAILLOCK_DEFAULT_CONF, "r"); -+ } -+#endif /* VENDOR_FAILLOCK_DEFAULT_CONF */ -+ -+ if (f == NULL) { -+ /* ignore non-existent default config file */ -+ if (errno == ENOENT && cfgfile == NULL) -+ return PAM_SUCCESS; -+ return PAM_SERVICE_ERR; -+ } -+ -+ while (fgets(linebuf, sizeof(linebuf), f) != NULL) { -+ size_t len; -+ char *ptr; -+ char *name; -+ int eq; -+ -+ len = strlen(linebuf); -+ /* len cannot be 0 unless there is a bug in fgets */ -+ if (len && linebuf[len - 1] != '\n' && !feof(f)) { -+ (void) fclose(f); -+ return PAM_SERVICE_ERR; -+ } -+ -+ if ((ptr=strchr(linebuf, '#')) != NULL) { -+ *ptr = '\0'; -+ } else { -+ ptr = linebuf + len; -+ } -+ -+ /* drop terminating whitespace including the \n */ -+ while (ptr > linebuf) { -+ if (!isspace(*(ptr-1))) { -+ *ptr = '\0'; -+ break; -+ } -+ --ptr; -+ } -+ -+ /* skip initial whitespace */ -+ for (ptr = linebuf; isspace(*ptr); ptr++); -+ if (*ptr == '\0') -+ continue; -+ -+ /* grab the key name */ -+ eq = 0; -+ name = ptr; -+ while (*ptr != '\0') { -+ if (isspace(*ptr) || *ptr == '=') { -+ eq = *ptr == '='; -+ *ptr = '\0'; -+ ++ptr; -+ break; -+ } -+ ++ptr; -+ } -+ -+ /* grab the key value */ -+ while (*ptr != '\0') { -+ if (*ptr != '=' || eq) { -+ if (!isspace(*ptr)) { -+ break; -+ } -+ } else { -+ eq = 1; -+ } -+ ++ptr; -+ } -+ -+ /* set the key:value pair on opts */ -+ set_conf_opt(pamh, opts, name, ptr); -+ } -+ -+ (void)fclose(f); -+ return PAM_SUCCESS; -+} -+ -+void -+set_conf_opt(pam_handle_t *pamh, struct options *opts, const char *name, -+ const char *value) -+{ -+ if (strcmp(name, "dir") == 0) { -+ if (value[0] != '/') { -+ config_log(pamh, LOG_ERR, -+ "Tally directory is not absolute path (%s); keeping value", -+ value); -+ } else { -+ free(opts->dir); -+ opts->dir = strdup(value); -+ if (opts->dir == NULL) { -+ opts->fatal_error = 1; -+ config_log(pamh, LOG_CRIT, "Error allocating memory: %m"); -+ } -+ } -+ } -+ else if (strcmp(name, "deny") == 0) { -+ if (sscanf(value, "%hu", &opts->deny) != 1) { -+ config_log(pamh, LOG_ERR, -+ "Bad number supplied for deny argument"); -+ } -+ } -+ else if (strcmp(name, "fail_interval") == 0) { -+ unsigned int temp; -+ if (sscanf(value, "%u", &temp) != 1 || -+ temp > MAX_TIME_INTERVAL) { -+ config_log(pamh, LOG_ERR, -+ "Bad number supplied for fail_interval argument"); -+ } else { -+ opts->fail_interval = temp; -+ } -+ } -+ else if (strcmp(name, "unlock_time") == 0) { -+ unsigned int temp; -+ -+ if (strcmp(value, "never") == 0) { -+ opts->unlock_time = 0; -+ } -+ else if (sscanf(value, "%u", &temp) != 1 || -+ temp > MAX_TIME_INTERVAL) { -+ config_log(pamh, LOG_ERR, -+ "Bad number supplied for unlock_time argument"); -+ } -+ else { -+ opts->unlock_time = temp; -+ } -+ } -+ else if (strcmp(name, "root_unlock_time") == 0) { -+ unsigned int temp; -+ -+ if (strcmp(value, "never") == 0) { -+ opts->root_unlock_time = 0; -+ } -+ else if (sscanf(value, "%u", &temp) != 1 || -+ temp > MAX_TIME_INTERVAL) { -+ config_log(pamh, LOG_ERR, -+ "Bad number supplied for root_unlock_time argument"); -+ } else { -+ opts->root_unlock_time = temp; -+ } -+ } -+ else if (strcmp(name, "admin_group") == 0) { -+ free(opts->admin_group); -+ opts->admin_group = strdup(value); -+ if (opts->admin_group == NULL) { -+ opts->fatal_error = 1; -+ config_log(pamh, LOG_CRIT, "Error allocating memory: %m"); -+ } -+ } -+ else if (strcmp(name, "even_deny_root") == 0) { -+ opts->flags |= FAILLOCK_FLAG_DENY_ROOT; -+ } -+ else if (strcmp(name, "audit") == 0) { -+ opts->flags |= FAILLOCK_FLAG_AUDIT; -+ } -+ else if (strcmp(name, "silent") == 0) { -+ opts->flags |= FAILLOCK_FLAG_SILENT; -+ } -+ else if (strcmp(name, "no_log_info") == 0) { -+ opts->flags |= FAILLOCK_FLAG_NO_LOG_INFO; -+ } -+ else if (strcmp(name, "local_users_only") == 0) { -+ opts->flags |= FAILLOCK_FLAG_LOCAL_ONLY; -+ } -+ else if (strcmp(name, "nodelay") == 0) { -+ opts->flags |= FAILLOCK_FLAG_NO_DELAY; -+ } -+ else { -+ config_log(pamh, LOG_ERR, "Unknown option: %s", name); -+ } -+} -+ -+const char *get_tally_dir(const struct options *opts) -+{ -+ return (opts->dir != NULL) ? opts->dir : FAILLOCK_DEFAULT_TALLYDIR; -+} -diff -up Linux-PAM-1.3.1/modules/pam_faillock/faillock_config.h.faillock-load-conf-from-file Linux-PAM-1.3.1/modules/pam_faillock/faillock_config.h ---- Linux-PAM-1.3.1/modules/pam_faillock/faillock_config.h.faillock-load-conf-from-file 2022-05-26 10:57:11.747067749 +0200 -+++ Linux-PAM-1.3.1/modules/pam_faillock/faillock_config.h 2022-05-26 10:57:11.747067749 +0200 -@@ -0,0 +1,89 @@ -+/* -+ * Copyright (c) 2022 Tomas Mraz -+ * Copyright (c) 2022 Iker Pedrosa -+ * -+ * Redistribution and use in source and binary forms, with or without -+ * modification, are permitted provided that the following conditions -+ * are met: -+ * 1. Redistributions of source code must retain the above copyright -+ * notice, and the entire permission notice in its entirety, -+ * including the disclaimer of warranties. -+ * 2. Redistributions in binary form must reproduce the above copyright -+ * notice, this list of conditions and the following disclaimer in the -+ * documentation and/or other materials provided with the distribution. -+ * 3. The name of the author may not be used to endorse or promote -+ * products derived from this software without specific prior -+ * written permission. -+ * -+ * ALTERNATIVELY, this product may be distributed under the terms of -+ * the GNU Public License, in which case the provisions of the GPL are -+ * required INSTEAD OF the above restrictions. (This clause is -+ * necessary due to a potential bad interaction between the GPL and -+ * the restrictions contained in a BSD-style copyright.) -+ * -+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED -+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES -+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -+ * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, -+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR -+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) -+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, -+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) -+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED -+ * OF THE POSSIBILITY OF SUCH DAMAGE. -+ */ -+ -+/* -+ * faillock_config.h - load configuration options from file -+ * -+ */ -+ -+#ifndef _FAILLOCK_CONFIG_H -+#define _FAILLOCK_CONFIG_H -+ -+#include -+#include -+#include -+ -+#include -+ -+#define FAILLOCK_FLAG_DENY_ROOT 0x1 -+#define FAILLOCK_FLAG_AUDIT 0x2 -+#define FAILLOCK_FLAG_SILENT 0x4 -+#define FAILLOCK_FLAG_NO_LOG_INFO 0x8 -+#define FAILLOCK_FLAG_UNLOCKED 0x10 -+#define FAILLOCK_FLAG_LOCAL_ONLY 0x20 -+#define FAILLOCK_FLAG_NO_DELAY 0x40 -+ -+#define FAILLOCK_CONF_MAX_LINELEN 1023 -+#define MAX_TIME_INTERVAL 604800 /* 7 days */ -+ -+struct options { -+ unsigned int action; -+ unsigned int flags; -+ unsigned short deny; -+ unsigned int fail_interval; -+ unsigned int unlock_time; -+ unsigned int root_unlock_time; -+ char *dir; -+ const char *user; -+ char *admin_group; -+ int failures; -+ uint64_t latest_time; -+ uid_t uid; -+ int is_admin; -+ uint64_t now; -+ int fatal_error; -+ -+ unsigned int reset; -+ const char *progname; -+}; -+ -+int read_config_file(pam_handle_t *pamh, struct options *opts, -+ const char *cfgfile); -+void set_conf_opt(pam_handle_t *pamh, struct options *opts, const char *name, -+ const char *value); -+const char *get_tally_dir(const struct options *opts); -+ -+#endif /* _FAILLOCK_CONFIG_H */ -diff -up Linux-PAM-1.3.1/modules/pam_faillock/main.c.faillock-load-conf-from-file Linux-PAM-1.3.1/modules/pam_faillock/main.c ---- Linux-PAM-1.3.1/modules/pam_faillock/main.c.faillock-load-conf-from-file 2022-05-26 10:57:11.713067506 +0200 -+++ Linux-PAM-1.3.1/modules/pam_faillock/main.c 2022-05-26 10:57:11.747067749 +0200 -@@ -48,43 +48,50 @@ - #include - #endif - -+#include "pam_inline.h" - #include "faillock.h" -- --struct options { -- unsigned int reset; -- const char *dir; -- const char *user; -- const char *progname; --}; -+#include "faillock_config.h" - - static int - args_parse(int argc, char **argv, struct options *opts) - { - int i; -+ int rv; -+ const char *dir = NULL; -+ const char *conf = NULL; -+ - memset(opts, 0, sizeof(*opts)); - -- opts->dir = FAILLOCK_DEFAULT_TALLYDIR; - opts->progname = argv[0]; - - for (i = 1; i < argc; ++i) { -- -- if (strcmp(argv[i], "--dir") == 0) { -+ if (strcmp(argv[i], "--conf") == 0) { -+ ++i; -+ if (i >= argc || strlen(argv[i]) == 0) { -+ fprintf(stderr, "%s: No configuration file supplied.\n", -+ argv[0]); -+ return -1; -+ } -+ conf = argv[i]; -+ } -+ else if (strcmp(argv[i], "--dir") == 0) { - ++i; - if (i >= argc || strlen(argv[i]) == 0) { -- fprintf(stderr, "%s: No directory supplied.\n", argv[0]); -+ fprintf(stderr, "%s: No records directory supplied.\n", -+ argv[0]); - return -1; - } -- opts->dir = argv[i]; -- } -+ dir = argv[i]; -+ } - else if (strcmp(argv[i], "--user") == 0) { - ++i; - if (i >= argc || strlen(argv[i]) == 0) { -- fprintf(stderr, "%s: No user name supplied.\n", argv[0]); -+ fprintf(stderr, "%s: No user name supplied.\n", argv[0]); - return -1; - } -- opts->user = argv[i]; -+ opts->user = argv[i]; - } -- else if (strcmp(argv[i], "--reset") == 0) { -+ else if (strcmp(argv[i], "--reset") == 0) { - opts->reset = 1; - } - else { -@@ -92,6 +99,21 @@ args_parse(int argc, char **argv, struct - return -1; - } - } -+ -+ if ((rv = read_config_file(NULL, opts, conf)) != PAM_SUCCESS) { -+ fprintf(stderr, "Configuration file missing or broken"); -+ return rv; -+ } -+ -+ if (dir != NULL) { -+ free(opts->dir); -+ opts->dir = strdup(dir); -+ if (opts->dir == NULL) { -+ fprintf(stderr, "Error allocating memory: %m"); -+ return -1; -+ } -+ } -+ - return 0; - } - -@@ -109,10 +131,11 @@ do_user(struct options *opts, const char - int rv; - struct tally_data tallies; - struct passwd *pwd; -+ const char *dir = get_tally_dir(opts); - - pwd = getpwnam(user); - -- fd = open_tally(opts->dir, user, pwd != NULL ? pwd->pw_uid : 0, 0); -+ fd = open_tally(dir, user, pwd != NULL ? pwd->pw_uid : 0, 0); - - if (fd == -1) { - if (errno == ENOENT) { -@@ -189,11 +212,11 @@ do_allusers(struct options *opts) - { - struct dirent **userlist; - int rv, i; -+ const char *dir = get_tally_dir(opts); - -- rv = scandir(opts->dir, &userlist, NULL, alphasort); -+ rv = scandir(dir, &userlist, NULL, alphasort); - if (rv < 0) { -- fprintf(stderr, "%s: Error reading tally directory: ", opts->progname); -- perror(NULL); -+ fprintf(stderr, "%s: Error reading tally directory: %m\n", opts->progname); - return 2; - } - -diff -up Linux-PAM-1.3.1/modules/pam_faillock/Makefile.am.faillock-load-conf-from-file Linux-PAM-1.3.1/modules/pam_faillock/Makefile.am ---- Linux-PAM-1.3.1/modules/pam_faillock/Makefile.am.faillock-load-conf-from-file 2022-05-26 10:57:11.727067606 +0200 -+++ Linux-PAM-1.3.1/modules/pam_faillock/Makefile.am 2022-05-26 10:57:59.032406450 +0200 -@@ -17,7 +17,7 @@ TESTS = tst-pam_faillock - securelibdir = $(SECUREDIR) - secureconfdir = $(SCONFIGDIR) - --noinst_HEADERS = faillock.h -+noinst_HEADERS = faillock.h faillock_config.h - - faillock_CFLAGS = -I$(top_srcdir)/libpam/include -I$(top_srcdir)/libpamc/include @PIE_CFLAGS@ - pam_faillock_la_CFLAGS = -I$(top_srcdir)/libpam/include -I$(top_srcdir)/libpamc/include -@@ -36,8 +36,8 @@ secureconf_DATA = faillock.conf - securelib_LTLIBRARIES = pam_faillock.la - sbin_PROGRAMS = faillock - --pam_faillock_la_SOURCES = pam_faillock.c faillock.c --faillock_SOURCES = main.c faillock.c -+pam_faillock_la_SOURCES = pam_faillock.c faillock.c faillock_config.c -+faillock_SOURCES = main.c faillock.c faillock_config.c - - if ENABLE_REGENERATE_MAN - noinst_DATA = README -diff -up Linux-PAM-1.3.1/modules/pam_faillock/pam_faillock.c.faillock-load-conf-from-file Linux-PAM-1.3.1/modules/pam_faillock/pam_faillock.c ---- Linux-PAM-1.3.1/modules/pam_faillock/pam_faillock.c.faillock-load-conf-from-file 2022-05-26 10:57:11.727067606 +0200 -+++ Linux-PAM-1.3.1/modules/pam_faillock/pam_faillock.c 2022-05-26 10:57:11.748067756 +0200 -@@ -38,7 +38,6 @@ - #include - #include - #include --#include - #include - #include - #include -@@ -54,83 +53,50 @@ - #include - #include - -+#include "pam_inline.h" - #include "faillock.h" -- --#define PAM_SM_AUTH --#define PAM_SM_ACCOUNT -+#include "faillock_config.h" - - #define FAILLOCK_ACTION_PREAUTH 0 - #define FAILLOCK_ACTION_AUTHSUCC 1 - #define FAILLOCK_ACTION_AUTHFAIL 2 - --#define FAILLOCK_FLAG_DENY_ROOT 0x1 --#define FAILLOCK_FLAG_AUDIT 0x2 --#define FAILLOCK_FLAG_SILENT 0x4 --#define FAILLOCK_FLAG_NO_LOG_INFO 0x8 --#define FAILLOCK_FLAG_UNLOCKED 0x10 --#define FAILLOCK_FLAG_LOCAL_ONLY 0x20 -- --#define MAX_TIME_INTERVAL 604800 /* 7 days */ --#define FAILLOCK_CONF_MAX_LINELEN 1023 --#define FAILLOCK_ERROR_CONF_OPEN -3 --#define FAILLOCK_ERROR_CONF_MALFORMED -4 -- --#define PATH_PASSWD "/etc/passwd" -- --struct options { -- unsigned int action; -- unsigned int flags; -- unsigned short deny; -- unsigned int fail_interval; -- unsigned int unlock_time; -- unsigned int root_unlock_time; -- char *dir; -- const char *conf; -- const char *user; -- char *admin_group; -- int failures; -- uint64_t latest_time; -- uid_t uid; -- int is_admin; -- uint64_t now; -- int fatal_error; --}; -- --int read_config_file( -- pam_handle_t *pamh, -- struct options *opts, -- const char *cfgfile --); -- --void set_conf_opt( -- pam_handle_t *pamh, -- struct options *opts, -- const char *name, -- const char *value --); -- --static void -+static int - args_parse(pam_handle_t *pamh, int argc, const char **argv, - int flags, struct options *opts) - { - int i; -+ int config_arg_index = -1; - int rv; -+ const char *conf = NULL; -+ - memset(opts, 0, sizeof(*opts)); - -- opts->dir = strdup(FAILLOCK_DEFAULT_TALLYDIR); -- opts->conf = FAILLOCK_DEFAULT_CONF; - opts->deny = 3; - opts->fail_interval = 900; - opts->unlock_time = 600; - opts->root_unlock_time = MAX_TIME_INTERVAL+1; - -- if ((rv=read_config_file(pamh, opts, opts->conf)) != PAM_SUCCESS) { -- pam_syslog(pamh, LOG_DEBUG, -- "Configuration file missing"); -+ for (i = 0; i < argc; ++i) { -+ const char *str = pam_str_skip_prefix(argv[i], "conf="); -+ -+ if (str != NULL) { -+ conf = str; -+ config_arg_index = i; -+ } -+ } -+ -+ if ((rv = read_config_file(pamh, opts, conf)) != PAM_SUCCESS) { -+ pam_syslog(pamh, LOG_ERR, -+ "Configuration file missing or broken"); -+ return rv; - } - - for (i = 0; i < argc; ++i) { -- if (strcmp(argv[i], "preauth") == 0) { -+ if (i == config_arg_index) { -+ continue; -+ } -+ else if (strcmp(argv[i], "preauth") == 0) { - opts->action = FAILLOCK_ACTION_PREAUTH; - } - else if (strcmp(argv[i], "authfail") == 0) { -@@ -163,226 +129,26 @@ args_parse(pam_handle_t *pamh, int argc, - if (flags & PAM_SILENT) - opts->flags |= FAILLOCK_FLAG_SILENT; - -- if (opts->dir == NULL) { -- pam_syslog(pamh, LOG_CRIT, "Error allocating memory: %m"); -- opts->fatal_error = 1; -- } --} -- --/* parse a single configuration file */ --int --read_config_file(pam_handle_t *pamh, struct options *opts, const char *cfgfile) --{ -- FILE *f; -- char linebuf[FAILLOCK_CONF_MAX_LINELEN+1]; -- -- f = fopen(cfgfile, "r"); -- if (f == NULL) { -- /* ignore non-existent default config file */ -- if (errno == ENOENT && strcmp(cfgfile, FAILLOCK_DEFAULT_CONF) == 0) -- return 0; -- return FAILLOCK_ERROR_CONF_OPEN; -- } -- -- while (fgets(linebuf, sizeof(linebuf), f) != NULL) { -- size_t len; -- char *ptr; -- char *name; -- int eq; -- -- len = strlen(linebuf); -- /* len cannot be 0 unless there is a bug in fgets */ -- if (len && linebuf[len - 1] != '\n' && !feof(f)) { -- (void) fclose(f); -- return FAILLOCK_ERROR_CONF_MALFORMED; -- } -- -- if ((ptr=strchr(linebuf, '#')) != NULL) { -- *ptr = '\0'; -- } else { -- ptr = linebuf + len; -- } -- -- /* drop terminating whitespace including the \n */ -- while (ptr > linebuf) { -- if (!isspace(*(ptr-1))) { -- *ptr = '\0'; -- break; -- } -- --ptr; -- } -- -- /* skip initial whitespace */ -- for (ptr = linebuf; isspace(*ptr); ptr++); -- if (*ptr == '\0') -- continue; -- -- /* grab the key name */ -- eq = 0; -- name = ptr; -- while (*ptr != '\0') { -- if (isspace(*ptr) || *ptr == '=') { -- eq = *ptr == '='; -- *ptr = '\0'; -- ++ptr; -- break; -- } -- ++ptr; -- } -- -- /* grab the key value */ -- while (*ptr != '\0') { -- if (*ptr != '=' || eq) { -- if (!isspace(*ptr)) { -- break; -- } -- } else { -- eq = 1; -- } -- ++ptr; -- } -- -- /* set the key:value pair on opts */ -- set_conf_opt(pamh, opts, name, ptr); -- } -- -- (void)fclose(f); -+ if (opts->fatal_error) -+ return PAM_BUF_ERR; - return PAM_SUCCESS; - } - --void set_conf_opt(pam_handle_t *pamh, struct options *opts, const char *name, const char *value) --{ -- if (strcmp(name, "dir") == 0) { -- if (value[0] != '/') { -- pam_syslog(pamh, LOG_ERR, -- "Tally directory is not absolute path (%s); keeping default", value); -- } else { -- free(opts->dir); -- opts->dir = strdup(value); -- } -- } -- else if (strcmp(name, "deny") == 0) { -- if (sscanf(value, "%hu", &opts->deny) != 1) { -- pam_syslog(pamh, LOG_ERR, -- "Bad number supplied for deny argument"); -- } -- } -- else if (strcmp(name, "fail_interval") == 0) { -- unsigned int temp; -- if (sscanf(value, "%u", &temp) != 1 || -- temp > MAX_TIME_INTERVAL) { -- pam_syslog(pamh, LOG_ERR, -- "Bad number supplied for fail_interval argument"); -- } else { -- opts->fail_interval = temp; -- } -- } -- else if (strcmp(name, "unlock_time") == 0) { -- unsigned int temp; -- -- if (strcmp(value, "never") == 0) { -- opts->unlock_time = 0; -- } -- else if (sscanf(value, "%u", &temp) != 1 || -- temp > MAX_TIME_INTERVAL) { -- pam_syslog(pamh, LOG_ERR, -- "Bad number supplied for unlock_time argument"); -- } -- else { -- opts->unlock_time = temp; -- } -- } -- else if (strcmp(name, "root_unlock_time") == 0) { -- unsigned int temp; -- -- if (strcmp(value, "never") == 0) { -- opts->root_unlock_time = 0; -- } -- else if (sscanf(value, "%u", &temp) != 1 || -- temp > MAX_TIME_INTERVAL) { -- pam_syslog(pamh, LOG_ERR, -- "Bad number supplied for root_unlock_time argument"); -- } else { -- opts->root_unlock_time = temp; -- } -- } -- else if (strcmp(name, "admin_group") == 0) { -- free(opts->admin_group); -- opts->admin_group = strdup(value); -- if (opts->admin_group == NULL) { -- opts->fatal_error = 1; -- pam_syslog(pamh, LOG_CRIT, "Error allocating memory: %m"); -- } -- } -- else if (strcmp(name, "even_deny_root") == 0) { -- opts->flags |= FAILLOCK_FLAG_DENY_ROOT; -- } -- else if (strcmp(name, "audit") == 0) { -- opts->flags |= FAILLOCK_FLAG_AUDIT; -- } -- else if (strcmp(name, "silent") == 0) { -- opts->flags |= FAILLOCK_FLAG_SILENT; -- } -- else if (strcmp(name, "no_log_info") == 0) { -- opts->flags |= FAILLOCK_FLAG_NO_LOG_INFO; -- } -- else if (strcmp(name, "local_users_only") == 0) { -- opts->flags |= FAILLOCK_FLAG_LOCAL_ONLY; -- } -- else { -- pam_syslog(pamh, LOG_ERR, "Unknown option: %s", name); -- } --} -- --static int check_local_user (pam_handle_t *pamh, const char *user) -+static int -+check_local_user (pam_handle_t *pamh, const char *user) - { -- struct passwd pw, *pwp; -- char buf[4096]; -- int found = 0; -- FILE *fp; -- int errn; -- -- fp = fopen(PATH_PASSWD, "r"); -- if (fp == NULL) { -- pam_syslog(pamh, LOG_ERR, "unable to open %s: %m", -- PATH_PASSWD); -- return -1; -- } -- -- for (;;) { -- errn = fgetpwent_r(fp, &pw, buf, sizeof (buf), &pwp); -- if (errn == ERANGE) { -- pam_syslog(pamh, LOG_WARNING, "%s contains very long lines; corrupted?", -- PATH_PASSWD); -- /* we can continue here as next call will read further */ -- continue; -- } -- if (errn != 0) -- break; -- if (strcmp(pwp->pw_name, user) == 0) { -- found = 1; -- break; -- } -- } -- -- fclose (fp); -- -- if (errn != 0 && errn != ENOENT) { -- pam_syslog(pamh, LOG_ERR, "unable to enumerate local accounts: %m"); -- return -1; -- } else { -- return found; -- } -+ return pam_modutil_check_user_in_passwd(pamh, user, NULL) == PAM_SUCCESS; - } - --static int get_pam_user(pam_handle_t *pamh, struct options *opts) -+static int -+get_pam_user(pam_handle_t *pamh, struct options *opts) - { - const char *user; - int rv; - struct passwd *pwd; - - if ((rv=pam_get_user(pamh, &user, NULL)) != PAM_SUCCESS) { -- return rv; -+ return rv == PAM_CONV_AGAIN ? PAM_INCOMPLETE : rv; - } - - if (*user == '\0') { -@@ -391,10 +157,10 @@ static int get_pam_user(pam_handle_t *pa - - if ((pwd=pam_modutil_getpwnam(pamh, user)) == NULL) { - if (opts->flags & FAILLOCK_FLAG_AUDIT) { -- pam_syslog(pamh, LOG_ERR, "User unknown: %s", user); -+ pam_syslog(pamh, LOG_NOTICE, "User unknown: %s", user); - } - else { -- pam_syslog(pamh, LOG_ERR, "User unknown"); -+ pam_syslog(pamh, LOG_NOTICE, "User unknown"); - } - return PAM_IGNORE; - } -@@ -421,10 +187,11 @@ check_tally(pam_handle_t *pamh, struct o - unsigned int i; - uint64_t latest_time; - int failures; -+ const char *dir = get_tally_dir(opts); - - opts->now = time(NULL); - -- tfd = open_tally(opts->dir, opts->user, opts->uid, 0); -+ tfd = open_tally(dir, opts->user, opts->uid, 0); - - *fd = tfd; - -@@ -446,7 +213,7 @@ check_tally(pam_handle_t *pamh, struct o - } - - latest_time = 0; -- for(i = 0; i < tallies->count; i++) { -+ for (i = 0; i < tallies->count; i++) { - if ((tallies->records[i].status & TALLY_STATUS_VALID) && - tallies->records[i].time > latest_time) - latest_time = tallies->records[i].time; -@@ -455,7 +222,7 @@ check_tally(pam_handle_t *pamh, struct o - opts->latest_time = latest_time; - - failures = 0; -- for(i = 0; i < tallies->count; i++) { -+ for (i = 0; i < tallies->count; i++) { - if ((tallies->records[i].status & TALLY_STATUS_VALID) && - latest_time - tallies->records[i].time < opts->fail_interval) { - ++failures; -@@ -498,9 +265,10 @@ static void - reset_tally(pam_handle_t *pamh, struct options *opts, int *fd) - { - int rv; -+ const char *dir = get_tally_dir(opts); - - if (*fd == -1) { -- *fd = open_tally(opts->dir, opts->user, opts->uid, 1); -+ *fd = open_tally(dir, opts->user, opts->uid, 1); - } - else { - while ((rv=ftruncate(*fd, 0)) == -1 && errno == EINTR); -@@ -519,9 +287,10 @@ write_tally(pam_handle_t *pamh, struct o - unsigned int oldest; - uint64_t oldtime; - const void *source = NULL; -+ const char *dir = get_tally_dir(opts); - - if (*fd == -1) { -- *fd = open_tally(opts->dir, opts->user, opts->uid, 1); -+ *fd = open_tally(dir, opts->user, opts->uid, 1); - } - if (*fd == -1) { - if (errno == EACCES) { -@@ -536,7 +305,7 @@ write_tally(pam_handle_t *pamh, struct o - failures = 0; - - for (i = 0; i < tallies->count; ++i) { -- if (tallies->records[i].time < oldtime) { -+ if (oldtime == 0 || tallies->records[i].time < oldtime) { - oldtime = tallies->records[i].time; - oldest = i; - } -@@ -630,16 +399,26 @@ faillock_message(pam_handle_t *pamh, str - left = opts->latest_time + opts->unlock_time - opts->now; - } - -+ pam_info(pamh, _("The account is locked due to %u failed logins."), -+ (unsigned int)opts->failures); - if (left > 0) { - left = (left + 59)/60; /* minutes */ - -- pam_info(pamh, _("Account temporarily locked due to %d failed logins"), -- opts->failures); -- pam_info(pamh, _("(%d minutes left to unlock)"), (int)left); -- } -- else { -- pam_info(pamh, _("Account locked due to %d failed logins"), -- opts->failures); -+#if defined HAVE_DNGETTEXT && defined ENABLE_NLS -+ pam_info( -+ pamh, -+ dngettext(PACKAGE, -+ "(%d minute left to unlock)", -+ "(%d minutes left to unlock)", -+ (int)left), -+ (int)left); -+#else -+ if (left == 1) -+ pam_info(pamh, _("(%d minute left to unlock)"), (int)left); -+ else -+ /* TRANSLATORS: only used if dngettext is not supported. */ -+ pam_info(pamh, _("(%d minutes left to unlock)"), (int)left); -+#endif - } - } - } -@@ -663,7 +442,7 @@ opts_cleanup(struct options *opts) - - /*---------------------------------------------------------------------*/ - --PAM_EXTERN int -+int - pam_sm_authenticate(pam_handle_t *pamh, int flags, - int argc, const char **argv) - { -@@ -673,13 +452,13 @@ pam_sm_authenticate(pam_handle_t *pamh, - - memset(&tallies, 0, sizeof(tallies)); - -- args_parse(pamh, argc, argv, flags, &opts); -- if (opts.fatal_error) { -- rv = PAM_BUF_ERR; -+ rv = args_parse(pamh, argc, argv, flags, &opts); -+ if (rv != PAM_SUCCESS) - goto err; -- } - -- pam_fail_delay(pamh, 2000000); /* 2 sec delay for on failure */ -+ if (!(opts.flags & FAILLOCK_FLAG_NO_DELAY)) { -+ pam_fail_delay(pamh, 2000000); /* 2 sec delay on failure */ -+ } - - if ((rv=get_pam_user(pamh, &opts)) != PAM_SUCCESS) { - goto err; -@@ -722,7 +501,7 @@ err: - - /*---------------------------------------------------------------------*/ - --PAM_EXTERN int -+int - pam_sm_setcred(pam_handle_t *pamh UNUSED, int flags UNUSED, - int argc UNUSED, const char **argv UNUSED) - { -@@ -731,7 +510,7 @@ pam_sm_setcred(pam_handle_t *pamh UNUSED - - /*---------------------------------------------------------------------*/ - --PAM_EXTERN int -+int - pam_sm_acct_mgmt(pam_handle_t *pamh, int flags, - int argc, const char **argv) - { -@@ -741,12 +520,10 @@ pam_sm_acct_mgmt(pam_handle_t *pamh, int - - memset(&tallies, 0, sizeof(tallies)); - -- args_parse(pamh, argc, argv, flags, &opts); -+ rv = args_parse(pamh, argc, argv, flags, &opts); - -- if (opts.fatal_error) { -- rv = PAM_BUF_ERR; -+ if (rv != PAM_SUCCESS) - goto err; -- } - - opts.action = FAILLOCK_ACTION_AUTHSUCC; - -@@ -770,28 +547,3 @@ err: - - /*-----------------------------------------------------------------------*/ - --#ifdef PAM_STATIC -- --/* static module data */ -- --struct pam_module _pam_faillock_modstruct = { -- MODULE_NAME, --#ifdef PAM_SM_AUTH -- pam_sm_authenticate, -- pam_sm_setcred, --#else -- NULL, -- NULL, --#endif --#ifdef PAM_SM_ACCOUNT -- pam_sm_acct_mgmt, --#else -- NULL, --#endif -- NULL, -- NULL, -- NULL, --}; -- --#endif /* #ifdef PAM_STATIC */ -- -diff --git a/modules/pam_faillock/faillock.h b/modules/pam_faillock/faillock.h -index b22a9dfb..0ea0ffba 100644 ---- a/modules/pam_faillock/faillock.h -+++ b/modules/pam_faillock/faillock.h -diff -up Linux-PAM-1.5.1/modules/pam_faillock/faillock.h.faillock-load-conf-from-file Linux-PAM-1.5.1/modules/pam_faillock/faillock.h ---- Linux-PAM-1.5.1/modules/pam_faillock/faillock.h.faillock-load-conf-from-file 2020-11-25 17:57:02.000000000 +0100 -+++ Linux-PAM-1.5.1/modules/pam_faillock/faillock.h 2022-05-25 15:33:03.885551825 +0200 -@@ -67,7 +67,6 @@ struct tally_data { - }; - - #define FAILLOCK_DEFAULT_TALLYDIR "/var/run/faillock" --#define FAILLOCK_DEFAULT_CONF "/etc/security/faillock.conf" - - int open_tally(const char *dir, const char *user, uid_t uid, int create); - int read_tally(int fd, struct tally_data *tallies); -diff --git a/modules/pam_faillock/pam_faillock.c b/modules/pam_faillock/pam_faillock.c -index ddbb90e7..f46fca99 100644 ---- a/modules/pam_faillock/pam_faillock.c -+++ b/modules/pam_faillock/pam_faillock.c -@@ -134,10 +134,96 @@ args_parse(pam_handle_t *pamh, int argc, const char **argv, - return PAM_SUCCESS; - } - -+static int -+check_user_in_passwd(pam_handle_t *pamh, -+ const char *user_name, -+ const char *file_name) -+{ -+ int rc; -+ size_t user_len; -+ FILE *fp; -+ char line[BUFSIZ]; -+ -+ /* Validate the user name. */ -+ if ((user_len = strlen(user_name)) == 0) { -+ pam_syslog(pamh, LOG_NOTICE, "user name is not valid"); -+ return PAM_SERVICE_ERR; -+ } -+ -+ if (user_len > sizeof(line) - sizeof(":")) { -+ pam_syslog(pamh, LOG_NOTICE, "user name is too long"); -+ return PAM_SERVICE_ERR; -+ } -+ -+ if (strchr(user_name, ':') != NULL) { -+ /* -+ * "root:x" is not a local user name even if the passwd file -+ * contains a line starting with "root:x:". -+ */ -+ return PAM_PERM_DENIED; -+ } -+ -+ /* Open the passwd file. */ -+ if (file_name == NULL) { -+ file_name = "/etc/passwd"; -+ } -+ if ((fp = fopen(file_name, "r")) == NULL) { -+ pam_syslog(pamh, LOG_ERR, "error opening %s: %m", file_name); -+ return PAM_SERVICE_ERR; -+ } -+ -+ /* -+ * Scan the file using fgets() instead of fgetpwent_r() because -+ * the latter is not flexible enough in handling long lines -+ * in passwd files. -+ */ -+ rc = PAM_PERM_DENIED; -+ while (fgets(line, sizeof(line), fp) != NULL) { -+ size_t line_len; -+ const char *str; -+ -+ /* -+ * Does this line start with the user name -+ * followed by a colon? -+ */ -+ if (strncmp(user_name, line, user_len) == 0 && -+ line[user_len] == ':') { -+ rc = PAM_SUCCESS; -+ /* -+ * Continue reading the file to avoid timing attacks. -+ */ -+ } -+ /* Has a newline been read? */ -+ line_len = strlen(line); -+ if (line_len < sizeof(line) - 1 || -+ line[line_len - 1] == '\n') { -+ /* Yes, continue with the next line. */ -+ continue; -+ } -+ -+ /* No, read till the end of this line first. */ -+ while ((str = fgets(line, sizeof(line), fp)) != NULL) { -+ line_len = strlen(line); -+ if (line_len == 0 || -+ line[line_len - 1] == '\n') { -+ break; -+ } -+ } -+ if (str == NULL) { -+ /* fgets returned NULL, we are done. */ -+ break; -+ } -+ /* Continue with the next line. */ -+ } -+ -+ fclose(fp); -+ return rc; -+} -+ - static int - check_local_user (pam_handle_t *pamh, const char *user) - { -- return pam_modutil_check_user_in_passwd(pamh, user, NULL) == PAM_SUCCESS; -+ return check_user_in_passwd(pamh, user, NULL) == PAM_SUCCESS; - } - - static int diff --git a/SOURCES/pam-1.3.1-faillock-update.patch b/SOURCES/pam-1.3.1-faillock-update.patch deleted file mode 100644 index c001f48..0000000 --- a/SOURCES/pam-1.3.1-faillock-update.patch +++ /dev/null @@ -1,1186 +0,0 @@ -diff -up Linux-PAM-1.3.1/modules/pam_faillock/faillock.c.faillock-update Linux-PAM-1.3.1/modules/pam_faillock/faillock.c ---- Linux-PAM-1.3.1/modules/pam_faillock/faillock.c.faillock-update 2019-10-16 16:49:27.026893768 +0200 -+++ Linux-PAM-1.3.1/modules/pam_faillock/faillock.c 2019-12-16 17:55:27.042001068 +0100 -@@ -1,5 +1,6 @@ - /* - * Copyright (c) 2010 Tomas Mraz -+ * Copyright (c) 2010, 2016, 2017 Red Hat, Inc. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions -@@ -47,6 +48,8 @@ - - #include "faillock.h" - -+#define ignore_return(x) if (1==((int)x)) {;} -+ - int - open_tally (const char *dir, const char *user, uid_t uid, int create) - { -@@ -54,7 +57,7 @@ open_tally (const char *dir, const char - int flags = O_RDWR; - int fd; - -- if (strstr(user, "../") != NULL) -+ if (dir == NULL || strstr(user, "../") != NULL) - /* just a defensive programming as the user must be a - * valid user on the system anyway - */ -@@ -83,7 +86,7 @@ open_tally (const char *dir, const char - while (flock(fd, LOCK_EX) == -1 && errno == EINTR); - if (fstat(fd, &st) == 0) { - if (st.st_uid != uid) { -- fchown(fd, uid, -1); -+ ignore_return(fchown(fd, uid, -1)); - } - } - } -@@ -121,7 +124,7 @@ read_tally(int fd, struct tally_data *ta - if (count >= MAX_RECORDS) - break; - } -- while (chunk == CHUNK_SIZE); -+ while (chunk == CHUNK_SIZE); - - tallies->records = data; - tallies->count = count; -diff -up Linux-PAM-1.3.1/modules/pam_faillock/faillock.conf.5.xml.faillock-update Linux-PAM-1.3.1/modules/pam_faillock/faillock.conf.5.xml ---- Linux-PAM-1.3.1/modules/pam_faillock/faillock.conf.5.xml.faillock-update 2019-10-16 17:34:58.073276020 +0200 -+++ Linux-PAM-1.3.1/modules/pam_faillock/faillock.conf.5.xml 2019-10-16 16:26:05.000000000 +0200 -@@ -0,0 +1,243 @@ -+ -+ -+ -+ -+ -+ -+ faillock.conf -+ 5 -+ Linux-PAM Manual -+ -+ -+ -+ faillock.conf -+ pam_faillock configuration file -+ -+ -+ -+ -+ DESCRIPTION -+ -+ faillock.conf provides a way to configure the -+ default settings for locking the user after multiple failed authentication attempts. -+ This file is read by the pam_faillock module and is the -+ preferred method over configuring pam_faillock directly. -+ -+ -+ The file has a very simple name = value format with possible comments -+ starting with # character. The whitespace at the beginning of line, end -+ of line, and around the = sign is ignored. -+ -+ -+ -+ -+ -+ OPTIONS -+ -+ -+ -+ -+ -+ -+ -+ The directory where the user files with the failure records are kept. The -+ default is /var/run/faillock. -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ Will log the user name into the system log if the user is not found. -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ Don't print informative messages to the user. Please note that when -+ this option is not used there will be difference in the authentication -+ behavior for users which exist on the system and non-existing users. -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ Don't log informative messages via syslog3. -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ Only track failed user authentications attempts for local users -+ in /etc/passwd and ignore centralized (AD, IdM, LDAP, etc.) users. -+ The faillock8 -+ command will also no longer track user failed -+ authentication attempts. Enabling this option will prevent a -+ double-lockout scenario where a user is locked out locally and -+ in the centralized mechanism. -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ Deny access if the number of consecutive authentication failures -+ for this user during the recent interval exceeds -+ n. The default is 3. -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ The length of the interval during which the consecutive -+ authentication failures must happen for the user account -+ lock out is n seconds. -+ The default is 900 (15 minutes). -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ The access will be reenabled after -+ n seconds after the lock out. -+ The value 0 has the same meaning as value -+ never - the access -+ will not be reenabled without resetting the faillock -+ entries by the faillock8 command. -+ The default is 600 (10 minutes). -+ -+ -+ Note that the default directory that pam_faillock -+ uses is usually cleared on system boot so the access will be also reenabled -+ after system reboot. If that is undesirable a different tally directory -+ must be set with the option. -+ -+ -+ Also note that it is usually undesirable to permanently lock -+ out the users as they can become easily a target of denial of service -+ attack unless the usernames are random and kept secret to potential -+ attackers. -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ Root account can become locked as well as regular accounts. -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ This option implies option. -+ Allow access after n seconds -+ to root account after the account is locked. In case the -+ option is not specified the value is the same as of the -+ option. -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ If a group name is specified with this option, members -+ of the group will be handled by this module the same as -+ the root account (the options -+ and will apply to them. -+ By default the option is not set. -+ -+ -+ -+ -+ -+ -+ -+ EXAMPLES -+ -+ /etc/security/faillock.conf file example: -+ -+ -+deny=4 -+unlock_time=1200 -+silent -+ -+ -+ -+ -+ FILES -+ -+ -+ /etc/security/faillock.conf -+ -+ the config file for custom options -+ -+ -+ -+ -+ -+ -+ SEE ALSO -+ -+ -+ faillock8 -+ , -+ -+ pam_faillock8 -+ , -+ -+ pam.conf5 -+ , -+ -+ pam.d5 -+ , -+ -+ pam8 -+ -+ -+ -+ -+ -+ AUTHOR -+ -+ pam_faillock was written by Tomas Mraz. The support for faillock.conf was written by Brian Ward. -+ -+ -+ -+ -diff -up Linux-PAM-1.3.1/modules/pam_faillock/faillock.conf.faillock-update Linux-PAM-1.3.1/modules/pam_faillock/faillock.conf ---- Linux-PAM-1.3.1/modules/pam_faillock/faillock.conf.faillock-update 2019-10-16 17:34:50.607405060 +0200 -+++ Linux-PAM-1.3.1/modules/pam_faillock/faillock.conf 2019-10-16 16:26:05.000000000 +0200 -@@ -0,0 +1,62 @@ -+# Configuration for locking the user after multiple failed -+# authentication attempts. -+# -+# The directory where the user files with the failure records are kept. -+# The default is /var/run/faillock. -+# dir = /var/run/faillock -+# -+# Will log the user name into the system log if the user is not found. -+# Enabled if option is present. -+# audit -+# -+# Don't print informative messages. -+# Enabled if option is present. -+# silent -+# -+# Don't log informative messages via syslog. -+# Enabled if option is present. -+# no_log_info -+# -+# Only track failed user authentications attempts for local users -+# in /etc/passwd and ignore centralized (AD, IdM, LDAP, etc.) users. -+# The `faillock` command will also no longer track user failed -+# authentication attempts. Enabling this option will prevent a -+# double-lockout scenario where a user is locked out locally and -+# in the centralized mechanism. -+# Enabled if option is present. -+# local_users_only -+# -+# Deny access if the number of consecutive authentication failures -+# for this user during the recent interval exceeds n tries. -+# The default is 3. -+# deny = 3 -+# -+# The length of the interval during which the consecutive -+# authentication failures must happen for the user account -+# lock out is n seconds. -+# The default is 900 (15 minutes). -+# fail_interval = 900 -+# -+# The access will be reenabled after n seconds after the lock out. -+# The value 0 has the same meaning as value `never` - the access -+# will not be reenabled without resetting the faillock -+# entries by the `faillock` command. -+# The default is 600 (10 minutes). -+# unlock_time = 600 -+# -+# Root account can become locked as well as regular accounts. -+# Enabled if option is present. -+# even_deny_root -+# -+# This option implies the `even_deny_root` option. -+# Allow access after n seconds to root account after the -+# account is locked. In case the option is not specified -+# the value is the same as of the `unlock_time` option. -+# root_unlock_time = 900 -+# -+# If a group name is specified with this option, members -+# of the group will be handled by this module the same as -+# the root account (the options `even_deny_root>` and -+# `root_unlock_time` will apply to them. -+# By default, the option is not set. -+# admin_group = -diff -up Linux-PAM-1.3.1/modules/pam_faillock/faillock.h.faillock-update Linux-PAM-1.3.1/modules/pam_faillock/faillock.h ---- Linux-PAM-1.3.1/modules/pam_faillock/faillock.h.faillock-update 2019-10-16 16:49:27.026893768 +0200 -+++ Linux-PAM-1.3.1/modules/pam_faillock/faillock.h 2019-10-16 16:51:40.431628566 +0200 -@@ -65,6 +65,7 @@ struct tally_data { - }; - - #define FAILLOCK_DEFAULT_TALLYDIR "/var/run/faillock" -+#define FAILLOCK_DEFAULT_CONF "/etc/security/faillock.conf" - - int open_tally(const char *dir, const char *user, uid_t uid, int create); - int read_tally(int fd, struct tally_data *tallies); -diff -up Linux-PAM-1.3.1/modules/pam_faillock/Makefile.am.faillock-update Linux-PAM-1.3.1/modules/pam_faillock/Makefile.am ---- Linux-PAM-1.3.1/modules/pam_faillock/Makefile.am.faillock-update 2019-10-16 16:49:27.026893768 +0200 -+++ Linux-PAM-1.3.1/modules/pam_faillock/Makefile.am 2019-10-16 16:50:15.065078080 +0200 -@@ -1,6 +1,6 @@ - # - # Copyright (c) 2005, 2006, 2007, 2009 Thorsten Kukuk --# Copyright (c) 2008 Red Hat, Inc. -+# Copyright (c) 2008, 2018 Red Hat, Inc. - # Copyright (c) 2010 Tomas Mraz - # - -@@ -9,8 +9,8 @@ MAINTAINERCLEANFILES = $(MANS) README - - EXTRA_DIST = README $(MANS) $(XMLS) tst-pam_faillock - --man_MANS = pam_faillock.8 faillock.8 --XMLS = README.xml pam_faillock.8.xml faillock.8.xml -+man_MANS = pam_faillock.8 faillock.8 faillock.conf.5 -+XMLS = README.xml pam_faillock.8.xml faillock.8.xml faillock.conf.5.xml - - TESTS = tst-pam_faillock - -@@ -31,6 +31,8 @@ endif - faillock_LDFLAGS = -Wl,-z,now @PIE_LDFLAGS@ - faillock_LDADD = -L$(top_builddir)/libpam -lpam $(LIBAUDIT) - -+secureconf_DATA = faillock.conf -+ - securelib_LTLIBRARIES = pam_faillock.la - sbin_PROGRAMS = faillock - -diff -up Linux-PAM-1.3.1/modules/pam_faillock/pam_faillock.8.xml.faillock-update Linux-PAM-1.3.1/modules/pam_faillock/pam_faillock.8.xml ---- Linux-PAM-1.3.1/modules/pam_faillock/pam_faillock.8.xml.faillock-update 2019-10-16 16:49:27.030893701 +0200 -+++ Linux-PAM-1.3.1/modules/pam_faillock/pam_faillock.8.xml 2019-10-16 16:53:39.544606052 +0200 -@@ -126,141 +126,13 @@ - - - -- -- -- -- -- -- -- The directory where the user files with the failure records are kept. The -- default is /var/run/faillock. -- -- -- -- -- -- -- -- -- -- Will log the user name into the system log if the user is not found. -- -- -- -- -- -- -- -- -- -- Don't print informative messages. This option is implicite -- in the authfail and authsucc -- functions. -- -- -- -- -- -- -- -- -- -- Don't log informative messages via syslog3. -- -- -- -- -- -- -- -- -- -- Deny access if the number of consecutive authentication failures -- for this user during the recent interval exceeds -- n. The default is 3. -- -- -- -- -- -- -- -- -- -- The length of the interval during which the consecutive -- authentication failures must happen for the user account -- lock out is n seconds. -- The default is 900 (15 minutes). -- -- -- -- -- -- -- -- -- -- The access will be reenabled after -- n seconds after the lock out. -- The value 0 has the same meaning as value -- never - the access -- will not be reenabled without resetting the faillock -- entries by the faillock8 command. -- The default is 600 (10 minutes). -- -- -- Note that the default directory that pam_faillock -- uses is usually cleared on system boot so the access will be also reenabled -- after system reboot. If that is undesirable a different tally directory -- must be set with the option. -- -- -- Also note that it is usually undesirable to permanently lock -- out the users as they can become easily a target of denial of service -- attack unless the usernames are random and kept secret to potential -- attackers. -- -- -- -- -- -- -- -- -- -- Root account can become locked as well as regular accounts. -- -- -- -- -- -- -- -- -- -- This option implies option. -- Allow access after n seconds -- to root account after the account is locked. In case the -- option is not specified the value is the same as of the -- option. -- -- -- -- -- -- -- -- -- -- If a group name is specified with this option, members -- of the group will be handled by this module the same as -- the root account (the options -- and will apply to them. -- By default the option is not set. -- -- -- - -+ -+ The options for configuring the module behavior are described in the -+ faillock.conf5 -+ manual page. The options specified on the module command -+ line override the values from the configuration file. -+ - - - -@@ -306,19 +178,23 @@ - - NOTES - -- pam_faillock setup in the PAM stack is different -+ Configuring options on the module command line is not recommend. The -+ /etc/security/faillock.conf should be used instead. -+ -+ -+ The setup of pam_faillock in the PAM stack is different - from the pam_tally2 module setup. - - -- The individual files with the failure records are created as owned by -+ Individual files with the failure records are created as owned by - the user. This allows pam_faillock.so module - to work correctly when it is called from a screensaver. - - - Note that using the module in without the -- option or with requisite -- control field leaks an information about existence or -- non-existence of an user account in the system because -+ option specified in /etc/security/faillock.conf -+ or with requisite control field leaks an information about -+ existence or non-existence of an user account in the system because - the failures are not recorded for the unknown users. The message - about the user account being locked is never displayed for nonexisting - user accounts allowing the adversary to infer that a particular account -@@ -341,15 +217,26 @@ - be added to tell the user that his login is blocked by the module and also to abort - the authentication without even asking for password in such case. - -+ -+ /etc/security/faillock.conf file example: -+ -+ -+deny=4 -+unlock_time=1200 -+silent -+ -+ -+ /etc/pam.d/config file example: -+ - - auth required pam_securetty.so - auth required pam_env.so - auth required pam_nologin.so --# optionally call: auth requisite pam_faillock.so preauth deny=4 even_deny_root unlock_time=1200 -+# optionally call: auth requisite pam_faillock.so preauth - # to display the message about account being locked - auth [success=1 default=bad] pam_unix.so --auth [default=die] pam_faillock.so authfail deny=4 even_deny_root unlock_time=1200 --auth sufficient pam_faillock.so authsucc deny=4 even_deny_root unlock_time=1200 -+auth [default=die] pam_faillock.so authfail -+auth sufficient pam_faillock.so authsucc - auth required pam_deny.so - account required pam_unix.so - password required pam_unix.so shadow -@@ -361,17 +248,18 @@ session required pam_selinux.so o - - In the second example the module is called both in the auth - and account phases and the module gives the authenticating -- user message when the account is locked -+ user message when the account is locked if option is not -+ specified in the faillock.conf. - - - auth required pam_securetty.so - auth required pam_env.so - auth required pam_nologin.so --auth required pam_faillock.so preauth silent deny=4 even_deny_root unlock_time=1200 -+auth required pam_faillock.so preauth - # optionally use requisite above if you do not want to prompt for the password --# on locked accounts, possibly with removing the silent option as well -+# on locked accounts - auth sufficient pam_unix.so --auth [default=die] pam_faillock.so authfail deny=4 even_deny_root unlock_time=1200 -+auth [default=die] pam_faillock.so authfail - auth required pam_deny.so - account required pam_faillock.so - # if you drop the above call to pam_faillock.so the lock will be done also -@@ -394,6 +282,12 @@ session required pam_selinux.so o - the files logging the authentication failures for users - - -+ -+ /etc/security/faillock.conf -+ -+ the config file for pam_faillock options -+ -+ - - - -@@ -404,6 +298,9 @@ session required pam_selinux.so o - faillock8 - , - -+ faillock.conf5 -+ , -+ - pam.conf5 - , - -diff -up Linux-PAM-1.3.1/modules/pam_faillock/pam_faillock.c.faillock-update Linux-PAM-1.3.1/modules/pam_faillock/pam_faillock.c ---- Linux-PAM-1.3.1/modules/pam_faillock/pam_faillock.c.faillock-update 2019-10-16 16:49:27.030893701 +0200 -+++ Linux-PAM-1.3.1/modules/pam_faillock/pam_faillock.c 2019-12-16 17:55:11.403270018 +0100 -@@ -1,5 +1,6 @@ - /* -- * Copyright (c) 2010, 2017 Tomas Mraz -+ * Copyright (c) 2010, 2017, 2019 Tomas Mraz -+ * Copyright (c) 2010, 2017, 2019 Red Hat, Inc. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions -@@ -43,6 +44,7 @@ - #include - #include - #include -+#include - - #ifdef HAVE_LIBAUDIT - #include -@@ -66,8 +68,14 @@ - #define FAILLOCK_FLAG_SILENT 0x4 - #define FAILLOCK_FLAG_NO_LOG_INFO 0x8 - #define FAILLOCK_FLAG_UNLOCKED 0x10 -+#define FAILLOCK_FLAG_LOCAL_ONLY 0x20 - - #define MAX_TIME_INTERVAL 604800 /* 7 days */ -+#define FAILLOCK_CONF_MAX_LINELEN 1023 -+#define FAILLOCK_ERROR_CONF_OPEN -3 -+#define FAILLOCK_ERROR_CONF_MALFORMED -4 -+ -+#define PATH_PASSWD "/etc/passwd" - - struct options { - unsigned int action; -@@ -76,117 +84,295 @@ struct options { - unsigned int fail_interval; - unsigned int unlock_time; - unsigned int root_unlock_time; -- const char *dir; -+ char *dir; -+ const char *conf; - const char *user; -- const char *admin_group; -+ char *admin_group; - int failures; - uint64_t latest_time; - uid_t uid; - int is_admin; - uint64_t now; -+ int fatal_error; - }; - -+int read_config_file( -+ pam_handle_t *pamh, -+ struct options *opts, -+ const char *cfgfile -+); -+ -+void set_conf_opt( -+ pam_handle_t *pamh, -+ struct options *opts, -+ const char *name, -+ const char *value -+); -+ - static void - args_parse(pam_handle_t *pamh, int argc, const char **argv, - int flags, struct options *opts) - { - int i; -+ int rv; - memset(opts, 0, sizeof(*opts)); - -- opts->dir = FAILLOCK_DEFAULT_TALLYDIR; -+ opts->dir = strdup(FAILLOCK_DEFAULT_TALLYDIR); -+ opts->conf = FAILLOCK_DEFAULT_CONF; - opts->deny = 3; - opts->fail_interval = 900; - opts->unlock_time = 600; - opts->root_unlock_time = MAX_TIME_INTERVAL+1; - -- for (i = 0; i < argc; ++i) { -+ if ((rv=read_config_file(pamh, opts, opts->conf)) != PAM_SUCCESS) { -+ pam_syslog(pamh, LOG_DEBUG, -+ "Configuration file missing"); -+ } - -- if (strncmp(argv[i], "dir=", 4) == 0) { -- if (argv[i][4] != '/') { -- pam_syslog(pamh, LOG_ERR, -- "Tally directory is not absolute path (%s); keeping default", argv[i]); -- } else { -- opts->dir = argv[i]+4; -- } -- } -- else if (strncmp(argv[i], "deny=", 5) == 0) { -- if (sscanf(argv[i]+5, "%hu", &opts->deny) != 1) { -- pam_syslog(pamh, LOG_ERR, -- "Bad number supplied for deny argument"); -- } -- } -- else if (strncmp(argv[i], "fail_interval=", 14) == 0) { -- unsigned int temp; -- if (sscanf(argv[i]+14, "%u", &temp) != 1 || -- temp > MAX_TIME_INTERVAL) { -- pam_syslog(pamh, LOG_ERR, -- "Bad number supplied for fail_interval argument"); -- } else { -- opts->fail_interval = temp; -- } -+ for (i = 0; i < argc; ++i) { -+ if (strcmp(argv[i], "preauth") == 0) { -+ opts->action = FAILLOCK_ACTION_PREAUTH; -+ } -+ else if (strcmp(argv[i], "authfail") == 0) { -+ opts->action = FAILLOCK_ACTION_AUTHFAIL; -+ } -+ else if (strcmp(argv[i], "authsucc") == 0) { -+ opts->action = FAILLOCK_ACTION_AUTHSUCC; - } -- else if (strncmp(argv[i], "unlock_time=", 12) == 0) { -- unsigned int temp; -+ else { -+ char buf[FAILLOCK_CONF_MAX_LINELEN + 1]; -+ char *val; - -- if (strcmp(argv[i]+12, "never") == 0) { -- opts->unlock_time = 0; -- } -- else if (sscanf(argv[i]+12, "%u", &temp) != 1 || -- temp > MAX_TIME_INTERVAL) { -- pam_syslog(pamh, LOG_ERR, -- "Bad number supplied for unlock_time argument"); -+ strncpy(buf, argv[i], sizeof(buf) - 1); -+ buf[sizeof(buf) - 1] = '\0'; -+ -+ val = strchr(buf, '='); -+ if (val != NULL) { -+ *val = '\0'; -+ ++val; - } - else { -- opts->unlock_time = temp; -+ val = buf + sizeof(buf) - 1; - } -+ set_conf_opt(pamh, opts, buf, val); - } -- else if (strncmp(argv[i], "root_unlock_time=", 17) == 0) { -- unsigned int temp; -+ } - -- if (strcmp(argv[i]+17, "never") == 0) { -- opts->root_unlock_time = 0; -- } -- else if (sscanf(argv[i]+17, "%u", &temp) != 1 || -- temp > MAX_TIME_INTERVAL) { -- pam_syslog(pamh, LOG_ERR, -- "Bad number supplied for root_unlock_time argument"); -+ if (opts->root_unlock_time == MAX_TIME_INTERVAL+1) -+ opts->root_unlock_time = opts->unlock_time; -+ if (flags & PAM_SILENT) -+ opts->flags |= FAILLOCK_FLAG_SILENT; -+ -+ if (opts->dir == NULL) { -+ pam_syslog(pamh, LOG_CRIT, "Error allocating memory: %m"); -+ opts->fatal_error = 1; -+ } -+} -+ -+/* parse a single configuration file */ -+int -+read_config_file(pam_handle_t *pamh, struct options *opts, const char *cfgfile) -+{ -+ FILE *f; -+ char linebuf[FAILLOCK_CONF_MAX_LINELEN+1]; -+ -+ f = fopen(cfgfile, "r"); -+ if (f == NULL) { -+ /* ignore non-existent default config file */ -+ if (errno == ENOENT && strcmp(cfgfile, FAILLOCK_DEFAULT_CONF) == 0) -+ return 0; -+ return FAILLOCK_ERROR_CONF_OPEN; -+ } -+ -+ while (fgets(linebuf, sizeof(linebuf), f) != NULL) { -+ size_t len; -+ char *ptr; -+ char *name; -+ int eq; -+ -+ len = strlen(linebuf); -+ /* len cannot be 0 unless there is a bug in fgets */ -+ if (len && linebuf[len - 1] != '\n' && !feof(f)) { -+ (void) fclose(f); -+ return FAILLOCK_ERROR_CONF_MALFORMED; -+ } -+ -+ if ((ptr=strchr(linebuf, '#')) != NULL) { -+ *ptr = '\0'; -+ } else { -+ ptr = linebuf + len; -+ } -+ -+ /* drop terminating whitespace including the \n */ -+ while (ptr > linebuf) { -+ if (!isspace(*(ptr-1))) { -+ *ptr = '\0'; -+ break; -+ } -+ --ptr; -+ } -+ -+ /* skip initial whitespace */ -+ for (ptr = linebuf; isspace(*ptr); ptr++); -+ if (*ptr == '\0') -+ continue; -+ -+ /* grab the key name */ -+ eq = 0; -+ name = ptr; -+ while (*ptr != '\0') { -+ if (isspace(*ptr) || *ptr == '=') { -+ eq = *ptr == '='; -+ *ptr = '\0'; -+ ++ptr; -+ break; -+ } -+ ++ptr; -+ } -+ -+ /* grab the key value */ -+ while (*ptr != '\0') { -+ if (*ptr != '=' || eq) { -+ if (!isspace(*ptr)) { -+ break; -+ } - } else { -- opts->root_unlock_time = temp; -+ eq = 1; - } -+ ++ptr; - } -- else if (strncmp(argv[i], "admin_group=", 12) == 0) { -- opts->admin_group = argv[i] + 12; -+ -+ /* set the key:value pair on opts */ -+ set_conf_opt(pamh, opts, name, ptr); -+ } -+ -+ (void)fclose(f); -+ return PAM_SUCCESS; -+} -+ -+void set_conf_opt(pam_handle_t *pamh, struct options *opts, const char *name, const char *value) -+{ -+ if (strcmp(name, "dir") == 0) { -+ if (value[0] != '/') { -+ pam_syslog(pamh, LOG_ERR, -+ "Tally directory is not absolute path (%s); keeping default", value); -+ } else { -+ free(opts->dir); -+ opts->dir = strdup(value); - } -- else if (strcmp(argv[i], "preauth") == 0) { -- opts->action = FAILLOCK_ACTION_PREAUTH; -+ } -+ else if (strcmp(name, "deny") == 0) { -+ if (sscanf(value, "%hu", &opts->deny) != 1) { -+ pam_syslog(pamh, LOG_ERR, -+ "Bad number supplied for deny argument"); -+ } -+ } -+ else if (strcmp(name, "fail_interval") == 0) { -+ unsigned int temp; -+ if (sscanf(value, "%u", &temp) != 1 || -+ temp > MAX_TIME_INTERVAL) { -+ pam_syslog(pamh, LOG_ERR, -+ "Bad number supplied for fail_interval argument"); -+ } else { -+ opts->fail_interval = temp; - } -- else if (strcmp(argv[i], "authfail") == 0) { -- opts->action = FAILLOCK_ACTION_AUTHFAIL; -+ } -+ else if (strcmp(name, "unlock_time") == 0) { -+ unsigned int temp; -+ -+ if (strcmp(value, "never") == 0) { -+ opts->unlock_time = 0; - } -- else if (strcmp(argv[i], "authsucc") == 0) { -- opts->action = FAILLOCK_ACTION_AUTHSUCC; -+ else if (sscanf(value, "%u", &temp) != 1 || -+ temp > MAX_TIME_INTERVAL) { -+ pam_syslog(pamh, LOG_ERR, -+ "Bad number supplied for unlock_time argument"); - } -- else if (strcmp(argv[i], "even_deny_root") == 0) { -- opts->flags |= FAILLOCK_FLAG_DENY_ROOT; -+ else { -+ opts->unlock_time = temp; - } -- else if (strcmp(argv[i], "audit") == 0) { -- opts->flags |= FAILLOCK_FLAG_AUDIT; -+ } -+ else if (strcmp(name, "root_unlock_time") == 0) { -+ unsigned int temp; -+ -+ if (strcmp(value, "never") == 0) { -+ opts->root_unlock_time = 0; - } -- else if (strcmp(argv[i], "silent") == 0) { -- opts->flags |= FAILLOCK_FLAG_SILENT; -+ else if (sscanf(value, "%u", &temp) != 1 || -+ temp > MAX_TIME_INTERVAL) { -+ pam_syslog(pamh, LOG_ERR, -+ "Bad number supplied for root_unlock_time argument"); -+ } else { -+ opts->root_unlock_time = temp; - } -- else if (strcmp(argv[i], "no_log_info") == 0) { -- opts->flags |= FAILLOCK_FLAG_NO_LOG_INFO; -+ } -+ else if (strcmp(name, "admin_group") == 0) { -+ free(opts->admin_group); -+ opts->admin_group = strdup(value); -+ if (opts->admin_group == NULL) { -+ opts->fatal_error = 1; -+ pam_syslog(pamh, LOG_CRIT, "Error allocating memory: %m"); - } -- else { -- pam_syslog(pamh, LOG_ERR, "Unknown option: %s", argv[i]); -+ } -+ else if (strcmp(name, "even_deny_root") == 0) { -+ opts->flags |= FAILLOCK_FLAG_DENY_ROOT; -+ } -+ else if (strcmp(name, "audit") == 0) { -+ opts->flags |= FAILLOCK_FLAG_AUDIT; -+ } -+ else if (strcmp(name, "silent") == 0) { -+ opts->flags |= FAILLOCK_FLAG_SILENT; -+ } -+ else if (strcmp(name, "no_log_info") == 0) { -+ opts->flags |= FAILLOCK_FLAG_NO_LOG_INFO; -+ } -+ else if (strcmp(name, "local_users_only") == 0) { -+ opts->flags |= FAILLOCK_FLAG_LOCAL_ONLY; -+ } -+ else { -+ pam_syslog(pamh, LOG_ERR, "Unknown option: %s", name); -+ } -+} -+ -+static int check_local_user (pam_handle_t *pamh, const char *user) -+{ -+ struct passwd pw, *pwp; -+ char buf[4096]; -+ int found = 0; -+ FILE *fp; -+ int errn; -+ -+ fp = fopen(PATH_PASSWD, "r"); -+ if (fp == NULL) { -+ pam_syslog(pamh, LOG_ERR, "unable to open %s: %m", -+ PATH_PASSWD); -+ return -1; -+ } -+ -+ for (;;) { -+ errn = fgetpwent_r(fp, &pw, buf, sizeof (buf), &pwp); -+ if (errn == ERANGE) { -+ pam_syslog(pamh, LOG_WARNING, "%s contains very long lines; corrupted?", -+ PATH_PASSWD); -+ /* we can continue here as next call will read further */ -+ continue; -+ } -+ if (errn != 0) -+ break; -+ if (strcmp(pwp->pw_name, user) == 0) { -+ found = 1; -+ break; - } - } - -- if (opts->root_unlock_time == MAX_TIME_INTERVAL+1) -- opts->root_unlock_time = opts->unlock_time; -- if (flags & PAM_SILENT) -- opts->flags |= FAILLOCK_FLAG_SILENT; -+ fclose (fp); -+ -+ if (errn != 0 && errn != ENOENT) { -+ pam_syslog(pamh, LOG_ERR, "unable to enumerate local accounts: %m"); -+ return -1; -+ } else { -+ return found; -+ } - } - - static int get_pam_user(pam_handle_t *pamh, struct options *opts) -@@ -393,7 +579,7 @@ write_tally(pam_handle_t *pamh, struct o - - strncpy(tallies->records[oldest].source, source, sizeof(tallies->records[oldest].source)); - /* source does not have to be null terminated */ -- -+ - tallies->records[oldest].time = opts->now; - - ++failures; -@@ -468,6 +654,13 @@ tally_cleanup(struct tally_data *tallies - free(tallies->records); - } - -+static void -+opts_cleanup(struct options *opts) -+{ -+ free(opts->dir); -+ free(opts->admin_group); -+} -+ - /*---------------------------------------------------------------------*/ - - PAM_EXTERN int -@@ -481,39 +674,49 @@ pam_sm_authenticate(pam_handle_t *pamh, - memset(&tallies, 0, sizeof(tallies)); - - args_parse(pamh, argc, argv, flags, &opts); -+ if (opts.fatal_error) { -+ rv = PAM_BUF_ERR; -+ goto err; -+ } - - pam_fail_delay(pamh, 2000000); /* 2 sec delay for on failure */ - - if ((rv=get_pam_user(pamh, &opts)) != PAM_SUCCESS) { -- return rv; -+ goto err; - } - -- switch (opts.action) { -- case FAILLOCK_ACTION_PREAUTH: -- rv = check_tally(pamh, &opts, &tallies, &fd); -- if (rv == PAM_AUTH_ERR && !(opts.flags & FAILLOCK_FLAG_SILENT)) { -- faillock_message(pamh, &opts); -- } -- break; -- -- case FAILLOCK_ACTION_AUTHSUCC: -- rv = check_tally(pamh, &opts, &tallies, &fd); -- if (rv == PAM_SUCCESS) { -- reset_tally(pamh, &opts, &fd); -- } -- break; -- -- case FAILLOCK_ACTION_AUTHFAIL: -- rv = check_tally(pamh, &opts, &tallies, &fd); -- if (rv == PAM_SUCCESS) { -- rv = PAM_IGNORE; /* this return value should be ignored */ -- write_tally(pamh, &opts, &tallies, &fd); -- } -- break; -+ if (!(opts.flags & FAILLOCK_FLAG_LOCAL_ONLY) || -+ check_local_user (pamh, opts.user) != 0) { -+ switch (opts.action) { -+ case FAILLOCK_ACTION_PREAUTH: -+ rv = check_tally(pamh, &opts, &tallies, &fd); -+ if (rv == PAM_AUTH_ERR && !(opts.flags & FAILLOCK_FLAG_SILENT)) { -+ faillock_message(pamh, &opts); -+ } -+ break; -+ -+ case FAILLOCK_ACTION_AUTHSUCC: -+ rv = check_tally(pamh, &opts, &tallies, &fd); -+ if (rv == PAM_SUCCESS) { -+ reset_tally(pamh, &opts, &fd); -+ } -+ break; -+ -+ case FAILLOCK_ACTION_AUTHFAIL: -+ rv = check_tally(pamh, &opts, &tallies, &fd); -+ if (rv == PAM_SUCCESS) { -+ rv = PAM_IGNORE; /* this return value should be ignored */ -+ write_tally(pamh, &opts, &tallies, &fd); -+ } -+ break; -+ } - } - - tally_cleanup(&tallies, fd); - -+err: -+ opts_cleanup(&opts); -+ - return rv; - } - -@@ -540,18 +743,29 @@ pam_sm_acct_mgmt(pam_handle_t *pamh, int - - args_parse(pamh, argc, argv, flags, &opts); - -+ if (opts.fatal_error) { -+ rv = PAM_BUF_ERR; -+ goto err; -+ } -+ - opts.action = FAILLOCK_ACTION_AUTHSUCC; - - if ((rv=get_pam_user(pamh, &opts)) != PAM_SUCCESS) { -- return rv; -+ goto err; - } - -- check_tally(pamh, &opts, &tallies, &fd); /* for auditing */ -- reset_tally(pamh, &opts, &fd); -+ if (!(opts.flags & FAILLOCK_FLAG_LOCAL_ONLY) || -+ check_local_user (pamh, opts.user) != 0) { -+ check_tally(pamh, &opts, &tallies, &fd); /* for auditing */ -+ reset_tally(pamh, &opts, &fd); -+ } - - tally_cleanup(&tallies, fd); - -- return PAM_SUCCESS; -+err: -+ opts_cleanup(&opts); -+ -+ return rv; - } - - /*-----------------------------------------------------------------------*/ diff --git a/SOURCES/pam-1.3.1-fds-closing.patch b/SOURCES/pam-1.3.1-fds-closing.patch deleted file mode 100644 index 7f5f772..0000000 --- a/SOURCES/pam-1.3.1-fds-closing.patch +++ /dev/null @@ -1,70 +0,0 @@ -diff -up Linux-PAM-1.3.1/libpam/pam_modutil_sanitize.c.fds-closing Linux-PAM-1.3.1/libpam/pam_modutil_sanitize.c ---- Linux-PAM-1.3.1/libpam/pam_modutil_sanitize.c.fds-closing 2017-02-10 11:10:15.000000000 +0100 -+++ Linux-PAM-1.3.1/libpam/pam_modutil_sanitize.c 2019-10-16 16:07:31.259021159 +0200 -@@ -10,6 +10,7 @@ - #include - #include - #include -+#include - - /* - * Creates a pipe, closes its write end, redirects fd to its read end. -@@ -116,27 +117,45 @@ redirect_out(pam_handle_t *pamh, enum pa - static void - close_fds(void) - { -+ DIR *dir = NULL; -+ struct dirent *dent; -+ int dfd = -1; -+ int fd; -+ struct rlimit rlim; -+ - /* - * An arbitrary upper limit for the maximum file descriptor number - * returned by RLIMIT_NOFILE. - */ -- const int MAX_FD_NO = 65535; -+ const unsigned int MAX_FD_NO = 65535; - - /* The lower limit is the same as for _POSIX_OPEN_MAX. */ -- const int MIN_FD_NO = 20; -+ const unsigned int MIN_FD_NO = 20; - -- int fd; -- struct rlimit rlim; -- -- if (getrlimit(RLIMIT_NOFILE, &rlim) || rlim.rlim_max > MAX_FD_NO) -- fd = MAX_FD_NO; -- else if (rlim.rlim_max < MIN_FD_NO) -- fd = MIN_FD_NO; -- else -- fd = rlim.rlim_max - 1; -+ /* If /proc is mounted, we can optimize which fd can be closed. */ -+ if ((dir = opendir("/proc/self/fd")) != NULL) { -+ if ((dfd = dirfd(dir)) >= 0) { -+ while ((dent = readdir(dir)) != NULL) { -+ fd = atoi(dent->d_name); -+ if (fd > STDERR_FILENO && fd != dfd) -+ close(fd); -+ } -+ } -+ closedir(dir); -+ } -+ -+ /* If /proc isn't available, fallback to the previous behavior. */ -+ if (dfd < 0) { -+ if (getrlimit(RLIMIT_NOFILE, &rlim) || rlim.rlim_max > MAX_FD_NO) -+ fd = MAX_FD_NO; -+ else if (rlim.rlim_max < MIN_FD_NO) -+ fd = MIN_FD_NO; -+ else -+ fd = rlim.rlim_max - 1; - -- for (; fd > STDERR_FILENO; --fd) -- close(fd); -+ for (; fd > STDERR_FILENO; --fd) -+ close(fd); -+ } - } - - int diff --git a/SOURCES/pam-1.3.1-inline.patch b/SOURCES/pam-1.3.1-inline.patch deleted file mode 100644 index 65dfa26..0000000 --- a/SOURCES/pam-1.3.1-inline.patch +++ /dev/null @@ -1,105 +0,0 @@ -diff -up Linux-PAM-1.3.1/libpam/include/pam_cc_compat.h.inline Linux-PAM-1.3.1/libpam/include/pam_cc_compat.h ---- Linux-PAM-1.3.1/libpam/include/pam_cc_compat.h.inline 2022-05-26 10:44:31.702623614 +0200 -+++ Linux-PAM-1.3.1/libpam/include/pam_cc_compat.h 2022-05-26 10:44:31.703623621 +0200 -@@ -44,4 +44,17 @@ - # define DIAG_POP_IGNORE_CAST_ALIGN /* empty */ - #endif - -+/* -+ * Evaluates to -+ * 1, if the given two types are known to be the same -+ * 0, otherwise. -+ */ -+#if PAM_GNUC_PREREQ(3, 0) -+# define PAM_IS_SAME_TYPE(x_, y_) \ -+ __builtin_types_compatible_p(__typeof__(x_), __typeof__(y_)) -+#else -+/* Cannot tell whether these types are the same. */ -+# define PAM_IS_SAME_TYPE(x_, y_) 0 -+#endif -+ - #endif /* PAM_CC_COMPAT_H */ -diff -up Linux-PAM-1.3.1/libpam/include/pam_inline.h.inline Linux-PAM-1.3.1/libpam/include/pam_inline.h ---- Linux-PAM-1.3.1/libpam/include/pam_inline.h.inline 2022-05-26 10:44:31.703623621 +0200 -+++ Linux-PAM-1.3.1/libpam/include/pam_inline.h 2022-05-26 10:44:31.703623621 +0200 -@@ -0,0 +1,67 @@ -+/* -+ * Copyright (c) 2020 Dmitry V. Levin -+ * -+ * Handy inline functions and macros providing some convenient functionality -+ * to libpam and its modules. -+ */ -+ -+#ifndef PAM_INLINE_H -+#define PAM_INLINE_H -+ -+#include "pam_cc_compat.h" -+#include -+ -+/* -+ * Evaluates to -+ * - a syntax error if the argument is 0, -+ * 0, otherwise. -+ */ -+#define PAM_FAIL_BUILD_ON_ZERO(e_) (sizeof(int[-1 + 2 * !!(e_)]) * 0) -+ -+/* -+ * Evaluates to -+ * 1, if the given type is known to be a non-array type -+ * 0, otherwise. -+ */ -+#define PAM_IS_NOT_ARRAY(a_) PAM_IS_SAME_TYPE((a_), &(a_)[0]) -+ -+/* -+ * Evaluates to -+ * - a syntax error if the argument is not an array, -+ * 0, otherwise. -+ */ -+#define PAM_MUST_BE_ARRAY(a_) PAM_FAIL_BUILD_ON_ZERO(!PAM_IS_NOT_ARRAY(a_)) -+ -+/* Evaluates to the number of elements in the specified array. */ -+#define PAM_ARRAY_SIZE(a_) (sizeof(a_) / sizeof((a_)[0]) + PAM_MUST_BE_ARRAY(a_)) -+ -+/* -+ * Returns NULL if STR does not start with PREFIX, -+ * or a pointer to the first char in STR after PREFIX. -+ * The length of PREFIX is specified by PREFIX_LEN. -+ */ -+static inline const char * -+pam_str_skip_prefix_len(const char *str, const char *prefix, size_t prefix_len) -+{ -+ return strncmp(str, prefix, prefix_len) ? NULL : str + prefix_len; -+} -+ -+#define pam_str_skip_prefix(str_, prefix_) \ -+ pam_str_skip_prefix_len((str_), (prefix_), sizeof(prefix_) - 1 + PAM_MUST_BE_ARRAY(prefix_)) -+ -+/* -+ * Returns NULL if STR does not start with PREFIX -+ * (ignoring the case of the characters), -+ * or a pointer to the first char in STR after PREFIX. -+ * The length of PREFIX is specified by PREFIX_LEN. -+ */ -+static inline const char * -+pam_str_skip_icase_prefix_len(const char *str, const char *prefix, size_t prefix_len) -+{ -+ return strncasecmp(str, prefix, prefix_len) ? NULL : str + prefix_len; -+} -+ -+#define pam_str_skip_icase_prefix(str_, prefix_) \ -+ pam_str_skip_icase_prefix_len((str_), (prefix_), sizeof(prefix_) - 1 + PAM_MUST_BE_ARRAY(prefix_)) -+ -+#endif /* PAM_INLINE_H */ -diff -up Linux-PAM-1.3.1/libpam/Makefile.am.inline Linux-PAM-1.3.1/libpam/Makefile.am ---- Linux-PAM-1.3.1/libpam/Makefile.am.inline 2022-05-26 10:44:31.702623614 +0200 -+++ Linux-PAM-1.3.1/libpam/Makefile.am 2022-05-26 10:45:21.146977780 +0200 -@@ -18,7 +18,8 @@ include_HEADERS = include/security/_pam_ - include/security/pam_ext.h include/security/pam_modutil.h - - noinst_HEADERS = pam_prelude.h pam_private.h pam_tokens.h \ -- pam_modutil_private.h include/pam_cc_compat.h -+ pam_modutil_private.h include/pam_cc_compat.h \ -+ include/pam_inline.h - - libpam_la_LDFLAGS = -no-undefined -version-info 84:2:84 - libpam_la_LIBADD = @LIBAUDIT@ $(LIBPRELUDE_LIBS) @LIBDL@ diff --git a/SOURCES/pam-1.3.1-lastlog-no-showfailed.patch b/SOURCES/pam-1.3.1-lastlog-no-showfailed.patch deleted file mode 100644 index 6b68d9d..0000000 --- a/SOURCES/pam-1.3.1-lastlog-no-showfailed.patch +++ /dev/null @@ -1,82 +0,0 @@ -From c426914fa166ffb0482b6f6ad659ddf17d5dfaa1 Mon Sep 17 00:00:00 2001 -From: Nir Soffer -Date: Wed, 9 Jan 2019 23:41:16 +0200 -Subject: [PATCH] pam_lastlog: Improve silent option documentation - -The silent option explicitly silents only the last login message and not -bad logins. Add a note to the manual to make this clear. - -* modules/pam_lastlog/pam_lastlog.8.xml: Clearify "silent showfailed" ---- - modules/pam_lastlog/pam_lastlog.8.xml | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/modules/pam_lastlog/pam_lastlog.8.xml b/modules/pam_lastlog/pam_lastlog.8.xml -index c8f247e..bc2e1be 100644 ---- a/modules/pam_lastlog/pam_lastlog.8.xml -+++ b/modules/pam_lastlog/pam_lastlog.8.xml -@@ -102,6 +102,7 @@ - - Don't inform the user about any previous login, - just update the /var/log/lastlog file. -+ This option does not affect display of bad login attempts. - - - --- -2.20.1 - -From 7d036249a9772c546ede1f38ad68b3f1575216d6 Mon Sep 17 00:00:00 2001 -From: Nir Soffer -Date: Sun, 6 Jan 2019 00:36:27 +0200 -Subject: [PATCH] pam_lastlog: Respect PAM_SILENT flag - -pam_lastlog module will not log info about failed login if the session -was opened with PAM_SILENT flag. - -Example use case enabled by this change: - - sudo --non-interactive program - -If this command is run by another program expecting specific output from -the command run by sudo, the unexpected info about failed logins will -break this program. - -* modules/pam_lastlog/pam_lastlog.c: Respect silent option. - (_pam_session_parse): Unset LASTLOG_BTMP if PAM_SILENT is set. ---- - modules/pam_lastlog/pam_lastlog.c | 11 ++++++----- - 1 file changed, 6 insertions(+), 5 deletions(-) - -diff --git a/modules/pam_lastlog/pam_lastlog.c b/modules/pam_lastlog/pam_lastlog.c -index 18bf7be..e980c04 100644 ---- a/modules/pam_lastlog/pam_lastlog.c -+++ b/modules/pam_lastlog/pam_lastlog.c -@@ -135,11 +135,6 @@ _pam_session_parse(pam_handle_t *pamh, int flags, int argc, const char **argv) - { - int ctrl=(LASTLOG_DATE|LASTLOG_HOST|LASTLOG_LINE|LASTLOG_WTMP|LASTLOG_UPDATE); - -- /* does the appliction require quiet? */ -- if (flags & PAM_SILENT) { -- ctrl |= LASTLOG_QUIET; -- } -- - /* step through arguments */ - for (; argc-- > 0; ++argv) { - -@@ -168,6 +163,12 @@ _pam_session_parse(pam_handle_t *pamh, int flags, int argc, const char **argv) - } - } - -+ /* does the appliction require quiet? */ -+ if (flags & PAM_SILENT) { -+ ctrl |= LASTLOG_QUIET; -+ ctrl &= ~LASTLOG_BTMP; -+ } -+ - D(("ctrl = %o", ctrl)); - return ctrl; - } --- -2.20.1 - diff --git a/SOURCES/pam-1.3.1-lastlog-unlimited-fsize.patch b/SOURCES/pam-1.3.1-lastlog-unlimited-fsize.patch deleted file mode 100644 index 1067d6f..0000000 --- a/SOURCES/pam-1.3.1-lastlog-unlimited-fsize.patch +++ /dev/null @@ -1,227 +0,0 @@ -From 3a3e70739834cd5cbd17469907ef718c81ae40c0 Mon Sep 17 00:00:00 2001 -From: Carlos Santos -Date: Wed, 11 Sep 2019 11:50:28 -0300 -Subject: [PATCH] pam_lastlog: document the 'unlimited' option - -Signed-off-by: Carlos Santos ---- - modules/pam_lastlog/pam_lastlog.8.xml | 18 ++++++++++++++++++ - 1 file changed, 18 insertions(+) - -diff --git a/modules/pam_lastlog/pam_lastlog.8.xml b/modules/pam_lastlog/pam_lastlog.8.xml -index bc2e1be..f10e94a 100644 ---- a/modules/pam_lastlog/pam_lastlog.8.xml -+++ b/modules/pam_lastlog/pam_lastlog.8.xml -@@ -48,6 +48,9 @@ - - inactive=<days> - -+ -+ unlimited -+ - - - -@@ -196,6 +199,18 @@ - - - -+ -+ -+ -+ -+ -+ -+ If the fsize limit is set, this option can be -+ used to override it, preventing failures on systems with large UID -+ values that lead lastlog to become a huge sparse file. -+ -+ -+ - - - -@@ -300,6 +315,9 @@ - - SEE ALSO - -+ -+ limits.conf5 -+ , - - pam.conf5 - , --- -2.20.1 - -From 9349333a9ae958205294cd25e97fd6b4805bd82b Mon Sep 17 00:00:00 2001 -From: Carlos Santos -Date: Tue, 10 Sep 2019 23:08:30 -0300 -Subject: [PATCH] pam_lastlog: prevent crash due to reduced 'fsize' limit - -It a reduced fsize limit is set in /etc/security/limits.conf and -pam_limits is in use pam_lastlog may cause a crash, e.g. - - ----- begin /etc/pam.d/su ---- - auth sufficient pam_rootok.so - auth required pam_wheel.so use_uid - auth required pam_env.so - auth required pam_unix.so nullok - account required pam_unix.so - password required pam_unix.so nullok - session required pam_limits.so - session required pam_env.so - session required pam_unix.so - session optional pam_lastlog.so - ----- end /etc/pam.d/su ----- - - ----- begin /etc/security/limits.d/fsize.conf ----- - * soft fsize 1710 - * hard fsize 1710 - ----- end /etc/security/limits.d/fsize.conf ----- - - # id user1 - uid=1000(user1) gid=1000(user1) groups=1000(user1) - # su - user1 - Last login: Wed Sep 11 01:52:44 UTC 2019 on console - $ exit - # id user2 - uid=60000(user2) gid=60000(user2) groups=60000(user2) - # su - user2 - File size limit exceeded - -This happens because pam_limits sets RLIMIT_FSIZE before pam_lastlog -attempts to write /var/log/lastlog, leading to a SIGXFSZ signal. - -In order to fix this, and an 'unlimited' option, which leads to saving -the 'fsize' limit and set it to unlimited before writing lastlog. After -that, restore the saved value. If 'fsize' is already unlimited nothing -is done. - -Failing to set the 'fsize' limit is not a fatal error. With luck the -configured limit will suffice, so we try to write lastlog anyway, even -under the risk of dying due to a SIGXFSZ. - -Failing to restore the 'fsize' limit is a fatal error, since we don't -want to keep it unlimited. - -Signed-off-by: Carlos Santos ---- - modules/pam_lastlog/pam_lastlog.c | 66 ++++++++++++++++++++++++++----- - 1 file changed, 57 insertions(+), 9 deletions(-) - -diff --git a/modules/pam_lastlog/pam_lastlog.c b/modules/pam_lastlog/pam_lastlog.c -index e980c04..a135c9f 100644 ---- a/modules/pam_lastlog/pam_lastlog.c -+++ b/modules/pam_lastlog/pam_lastlog.c -@@ -25,6 +25,8 @@ - #include - #include - #include -+#include -+#include - #include - #include - -@@ -82,15 +84,16 @@ struct lastlog { - - /* argument parsing */ - --#define LASTLOG_DATE 01 /* display the date of the last login */ --#define LASTLOG_HOST 02 /* display the last host used (if set) */ --#define LASTLOG_LINE 04 /* display the last terminal used */ --#define LASTLOG_NEVER 010 /* display a welcome message for first login */ --#define LASTLOG_DEBUG 020 /* send info to syslog(3) */ --#define LASTLOG_QUIET 040 /* keep quiet about things */ --#define LASTLOG_WTMP 0100 /* log to wtmp as well as lastlog */ --#define LASTLOG_BTMP 0200 /* display failed login info from btmp */ --#define LASTLOG_UPDATE 0400 /* update the lastlog and wtmp files (default) */ -+#define LASTLOG_DATE 01 /* display the date of the last login */ -+#define LASTLOG_HOST 02 /* display the last host used (if set) */ -+#define LASTLOG_LINE 04 /* display the last terminal used */ -+#define LASTLOG_NEVER 010 /* display a welcome message for first login */ -+#define LASTLOG_DEBUG 020 /* send info to syslog(3) */ -+#define LASTLOG_QUIET 040 /* keep quiet about things */ -+#define LASTLOG_WTMP 0100 /* log to wtmp as well as lastlog */ -+#define LASTLOG_BTMP 0200 /* display failed login info from btmp */ -+#define LASTLOG_UPDATE 0400 /* update the lastlog and wtmp files (default) */ -+#define LASTLOG_UNLIMITED 01000 /* unlimited file size (ignore 'fsize' limit) */ - - static int - _pam_auth_parse(pam_handle_t *pamh, int flags, int argc, const char **argv, -@@ -158,6 +161,8 @@ _pam_session_parse(pam_handle_t *pamh, int flags, int argc, const char **argv) - ctrl &= ~(LASTLOG_WTMP|LASTLOG_UPDATE); - } else if (!strcmp(*argv,"showfailed")) { - ctrl |= LASTLOG_BTMP; -+ } else if (!strcmp(*argv,"unlimited")) { -+ ctrl |= LASTLOG_UNLIMITED; - } else { - pam_syslog(pamh, LOG_ERR, "unknown option: %s", *argv); - } -@@ -373,6 +378,12 @@ static int - last_login_write(pam_handle_t *pamh, int announce, int last_fd, - uid_t uid, const char *user) - { -+ static struct rlimit no_limit = { -+ RLIM_INFINITY, -+ RLIM_INFINITY -+ }; -+ struct rlimit old_limit; -+ int setrlimit_res; - struct flock last_lock; - struct lastlog last_login; - time_t ll_time; -@@ -427,6 +438,31 @@ last_login_write(pam_handle_t *pamh, int announce, int last_fd, - sleep(LASTLOG_IGNORE_LOCK_TIME); - } - -+ /* -+ * Failing to set the 'fsize' limit is not a fatal error. We try to write -+ * lastlog anyway, under the risk of dying due to a SIGXFSZ. -+ */ -+ D(("setting limit for 'fsize'")); -+ -+ if ((announce & LASTLOG_UNLIMITED) == 0) { /* don't set to unlimted */ -+ setrlimit_res = -1; -+ } else if (getrlimit(RLIMIT_FSIZE, &old_limit) == 0) { -+ if (old_limit.rlim_cur == RLIM_INFINITY) { /* already unlimited */ -+ setrlimit_res = -1; -+ } else { -+ setrlimit_res = setrlimit(RLIMIT_FSIZE, &no_limit); -+ if (setrlimit_res != 0) -+ pam_syslog(pamh, LOG_WARNING, "Could not set limit for 'fsize': %m"); -+ } -+ } else { -+ setrlimit_res = -1; -+ if (errno == EINVAL) { -+ pam_syslog(pamh, LOG_INFO, "Limit for 'fsize' not supported: %m"); -+ } else { -+ pam_syslog(pamh, LOG_WARNING, "Could not get limit for 'fsize': %m"); -+ } -+ } -+ - D(("writing to the lastlog file")); - if (pam_modutil_write (last_fd, (char *) &last_login, - sizeof (last_login)) != sizeof(last_login)) { -@@ -434,6 +470,18 @@ last_login_write(pam_handle_t *pamh, int announce, int last_fd, - retval = PAM_SERVICE_ERR; - } - -+ /* -+ * Failing to restore the 'fsize' limit is a fatal error. -+ */ -+ D(("restoring limit for 'fsize'")); -+ if (setrlimit_res == 0) { -+ setrlimit_res = setrlimit(RLIMIT_FSIZE, &old_limit); -+ if (setrlimit_res != 0) { -+ pam_syslog(pamh, LOG_ERR, "Could not restore limit for 'fsize': %m"); -+ retval = PAM_SERVICE_ERR; -+ } -+ } -+ - last_lock.l_type = F_UNLCK; - (void) fcntl(last_fd, F_SETLK, &last_lock); /* unlock */ - D(("unlocked")); --- -2.20.1 - diff --git a/SOURCES/pam-1.3.1-libpam-support-long-lines.patch b/SOURCES/pam-1.3.1-libpam-support-long-lines.patch deleted file mode 100644 index 6483b62..0000000 --- a/SOURCES/pam-1.3.1-libpam-support-long-lines.patch +++ /dev/null @@ -1,595 +0,0 @@ -diff -up Linux-PAM-1.3.1/libpam/pam_handlers.c.libpam-support-long-lines Linux-PAM-1.3.1/libpam/pam_handlers.c ---- Linux-PAM-1.3.1/libpam/pam_handlers.c.libpam-support-long-lines 2024-11-04 13:17:27.395991844 +0100 -+++ Linux-PAM-1.3.1/libpam/pam_handlers.c 2024-11-04 14:45:22.583441849 +0100 -@@ -16,21 +16,30 @@ - #include - #include - --#define BUF_SIZE 1024 - #define MODULE_CHUNK 4 - #define UNKNOWN_MODULE "<*unknown module*>" - #ifndef _PAM_ISA - #define _PAM_ISA "." - #endif - --static int _pam_assemble_line(FILE *f, char *buf, int buf_len); -+struct line_buffer { -+ char *assembled; -+ char *chunk; -+ size_t chunk_size; -+ size_t len; -+ size_t size; -+}; -+ -+static void _pam_buffer_init(struct line_buffer *buffer); -+ -+static int _pam_assemble_line(FILE *f, struct line_buffer *buf); - - static void _pam_free_handlers_aux(struct handler **hp); - - static int _pam_add_handler(pam_handle_t *pamh - , int must_fail, int other, int stack_level, int type - , int *actions, const char *mod_path -- , int argc, char **argv, int argvlen); -+ , int argc, char **argv, size_t argvlen); - - /* Values for module type */ - -@@ -58,12 +67,15 @@ static int _pam_parse_conf_file(pam_hand - #endif /* PAM_READ_BOTH_CONFS */ - ) - { -- char buf[BUF_SIZE]; -+ struct line_buffer buffer; - int x; /* read a line from the FILE *f ? */ -+ -+ _pam_buffer_init(&buffer); - /* - * read a line from the configuration (FILE *) f - */ -- while ((x = _pam_assemble_line(f, buf, BUF_SIZE)) > 0) { -+ while ((x = _pam_assemble_line(f, &buffer)) > 0) { -+ char *buf = buffer.assembled; - char *tok, *nexttok=NULL; - const char *this_service; - const char *mod_path; -@@ -73,7 +85,7 @@ static int _pam_parse_conf_file(pam_hand - int handler_type = PAM_HT_MODULE; /* regular handler from a module */ - int argc; - char **argv; -- int argvlen; -+ size_t argvlen; - - D(("_pam_init_handler: LINE: %s", buf)); - if (known_service != NULL) { -@@ -232,10 +244,11 @@ static int _pam_parse_conf_file(pam_hand - if (nexttok != NULL) { - D(("list: %s",nexttok)); - argvlen = _pam_mkargv(nexttok, &argv, &argc); -- D(("argvlen = %d",argvlen)); -+ D(("argvlen = %zu",argvlen)); - } else { /* there are no arguments so fix by hand */ - D(("_pam_init_handlers: empty argument list")); -- argvlen = argc = 0; -+ argvlen = 0; -+ argc = 0; - argv = NULL; - } - -@@ -548,88 +561,243 @@ int _pam_init_handlers(pam_handle_t *pam - return PAM_SUCCESS; - } - -+static int _pam_buffer_add(struct line_buffer *buffer, char *start, char *end) -+{ -+ size_t len = end - start; -+ -+ D(("assembled: [%zu/%zu] '%s', adding [%zu] '%s'", -+ buffer->len, buffer->size, -+ buffer->assembled == NULL ? "" : buffer->assembled, len, start)); -+ -+ if (start == end) -+ return 0; -+ -+ if (buffer->assembled == NULL && buffer->chunk == start) { -+ /* no extra allocation needed, just move chunk to assembled */ -+ buffer->assembled = buffer->chunk; -+ buffer->len = len; -+ buffer->size = buffer->chunk_size; -+ -+ buffer->chunk = NULL; -+ buffer->chunk_size = 0; -+ -+ D(("exiting with quick exchange")); -+ return 0; -+ } -+ -+ if (buffer->len + len + 1 > buffer->size) { -+ size_t size; -+ char *p; -+ -+ size = buffer->len + len + 1; -+ if ((p = realloc(buffer->assembled, size)) == NULL) -+ return -1; -+ -+ buffer->assembled = p; -+ buffer->size = size; -+ } -+ -+ memcpy(buffer->assembled + buffer->len, start, len); -+ buffer->len += len; -+ buffer->assembled[buffer->len] = '\0'; -+ -+ D(("exiting")); -+ return 0; -+} -+ -+static inline int _pam_buffer_add_eol(struct line_buffer *buffer, -+ char *start, char *end) -+{ -+ if (buffer->assembled != NULL || (*start != '\0' && *start != '\n')) -+ return _pam_buffer_add(buffer, start, end); -+ return 0; -+} -+ -+static void _pam_buffer_clear(struct line_buffer *buffer) -+{ -+ _pam_drop(buffer->assembled); -+ _pam_drop(buffer->chunk); -+ buffer->chunk_size = 0; -+ buffer->len = 0; -+ buffer->size = 0; -+} -+ -+static void _pam_buffer_init(struct line_buffer *buffer) -+{ -+ buffer->assembled = NULL; -+ buffer->chunk = NULL; -+ _pam_buffer_clear(buffer); -+} -+ -+static void _pam_buffer_purge(struct line_buffer *buffer) -+{ -+ _pam_drop(buffer->chunk); -+ buffer->chunk_size = 0; -+} -+ -+static void _pam_buffer_shift(struct line_buffer *buffer) -+{ -+ if (buffer->assembled == NULL) -+ return; -+ -+ _pam_buffer_purge(buffer); -+ buffer->chunk = buffer->assembled; -+ buffer->chunk_size = buffer->size; -+ -+ buffer->assembled = NULL; -+ buffer->size = 0; -+ buffer->len = 0; -+} -+ -+static inline int _pam_buffer_valid(struct line_buffer *buffer) -+{ -+ return buffer->assembled != NULL && *buffer->assembled != '\0'; -+} -+ - /* -- * This is where we read a line of the PAM config file. The line may be -- * preceeded by lines of comments and also extended with "\\\n" -+ * Trim string to relevant parts of a configuration line. -+ * -+ * Preceding whitespaces are skipped and comment (#) marks the end of -+ * configuration line. -+ * -+ * Returns start of configuration line. - */ -+static inline char *_pam_str_trim(char *str) -+{ -+ /* skip leading spaces */ -+ str += strspn(str, " \t"); -+ /* -+ * we are only interested in characters before the first '#' -+ * character -+ */ -+ str[strcspn(str, "#")] = '\0'; - --static int _pam_assemble_line(FILE *f, char *buffer, int buf_len) -+ return str; -+} -+ -+/* -+ * Remove escaped newline from end of string. -+ * -+ * Configuration lines may span across multiple lines in a file -+ * by ending a line with a backslash (\). -+ * -+ * If an escaped newline is encountered, the backslash will be -+ * replaced with a blank ' ' and the newline itself removed. -+ * Then the variable "end" will point to the new end of line. -+ * -+ * Returns 0 if escaped newline was found and replaced, 1 otherwise. -+ */ -+static inline int _pam_str_unescnl(char *start, char **end) - { -- char *p = buffer; -- char *endp = buffer + buf_len; -- char *s, *os; -- int used = 0; -+ int ret = 1; -+ char *p = *end; - -- /* loop broken with a 'break' when a non-'\\n' ended line is read */ -+ /* -+ * Check for backslash by scanning back from the end of -+ * the entered line, the '\n' should be included since -+ * normally a line is terminated with this character. -+ */ -+ while (p > start && ((*--p == ' ') || (*p == '\t') || (*p == '\n'))) -+ ; -+ if (*p == '\\') { -+ *p++ = ' '; /* replace backslash with ' ' */ -+ *p = '\0'; /* truncate the line here */ -+ *end = p; -+ ret = 0; -+ } - -- D(("called.")); -- for (;;) { -- if (p >= endp) { -- /* Overflow */ -- D(("_pam_assemble_line: overflow")); -- return -1; -- } -- if (fgets(p, endp - p, f) == NULL) { -- if (used) { -- /* Incomplete read */ -- return -1; -- } else { -- /* EOF */ -- return 0; -- } -- } -+ return ret; -+} - -- /* skip leading spaces --- line may be blank */ -+/* -+ * Prepare line from file for configuration line parsing. -+ * -+ * A configuration line may span across multiple lines in a file. -+ * Remove comments and skip preceding whitespaces. -+ * -+ * Returns 0 if line spans across multiple lines, 1 if -+ * end of line is encountered. -+ */ -+static inline int _pam_str_prepare(char *line, ssize_t len, -+ char **start, char **end) -+{ -+ int ret; - -- s = p + strspn(p, " \n\t"); -- if (*s && (*s != '#')) { -- os = s; -+ *start = line; -+ *end = line + len; - -- /* -- * we are only interested in characters before the first '#' -- * character -- */ -+ ret = _pam_str_unescnl(*start, end) || strchr(*start, '#') != NULL; - -- while (*s && *s != '#') -- ++s; -- if (*s == '#') { -- *s = '\0'; -- used += strlen(os); -- break; /* the line has been read */ -- } -+ *start = _pam_str_trim(*start); -+ -+ return ret; -+} -+ -+/* -+ * This is where we read a line of the PAM config file. The line may be -+ * preceded by lines of comments and also extended with "\\\n" -+ * -+ * Returns 0 on EOF, 1 on successful line parsing, or -1 on error. -+ */ -+ -+static int _pam_assemble_line(FILE *f, struct line_buffer *buffer) -+{ -+ int ret = 0; -+ -+ /* loop broken with a 'break' when a non-'\\n' ended line is read */ - -- s = os; -+ D(("called.")); - -- /* -- * Check for backslash by scanning back from the end of -- * the entered line, the '\n' has been included since -- * normally a line is terminated with this -- * character. fgets() should only return one though! -- */ -+ _pam_buffer_shift(buffer); - -- s += strlen(s); -- while (s > os && ((*--s == ' ') || (*s == '\t') -- || (*s == '\n'))); -+ for (;;) { -+ char *start, *end; -+ ssize_t n; -+ int eol; - -- /* check if it ends with a backslash */ -- if (*s == '\\') { -- *s++ = ' '; /* replace backslash with ' ' */ -- *s = '\0'; /* truncate the line here */ -- used += strlen(os); -- p = s; /* there is more ... */ -+ if ((n = getline(&buffer->chunk, &buffer->chunk_size, f)) == -1) { -+ if (ret) { -+ /* Incomplete read */ -+ ret = -1; - } else { -- /* End of the line! */ -- used += strlen(os); -- break; /* this is the complete line */ -+ /* EOF */ -+ ret = 0; - } -+ break; -+ } -+ -+ eol = _pam_str_prepare(buffer->chunk, n, &start, &end); - -+ if (eol) { -+ if (_pam_buffer_add_eol(buffer, start, end)) { -+ ret = -1; -+ break; -+ } -+ if (_pam_buffer_valid(buffer)) { -+ /* Successfully parsed a line */ -+ ret = 1; -+ break; -+ } -+ /* Start parsing next line */ -+ _pam_buffer_shift(buffer); -+ ret = 0; - } else { -- /* Nothing in this line */ -- /* Don't move p */ -+ /* Configuration line spans across multiple lines in file */ -+ if (_pam_buffer_add(buffer, start, end)) { -+ ret = -1; -+ break; -+ } -+ /* Keep parsing line */ -+ ret = 1; - } - } - -- return used; -+ if (ret == 1) -+ _pam_buffer_purge(buffer); -+ else -+ _pam_buffer_clear(buffer); -+ -+ return ret; - } - - static char * -@@ -761,7 +929,7 @@ _pam_load_module(pam_handle_t *pamh, con - int _pam_add_handler(pam_handle_t *pamh - , int handler_type, int other, int stack_level, int type - , int *actions, const char *mod_path -- , int argc, char **argv, int argvlen) -+ , int argc, char **argv, size_t argvlen) - { - struct loaded_module *mod = NULL; - struct handler **handler_p; -diff -up Linux-PAM-1.3.1/libpam/pam_misc.c.libpam-support-long-lines Linux-PAM-1.3.1/libpam/pam_misc.c ---- Linux-PAM-1.3.1/libpam/pam_misc.c.libpam-support-long-lines 2017-02-10 11:10:15.000000000 +0100 -+++ Linux-PAM-1.3.1/libpam/pam_misc.c 2024-11-04 14:47:31.147672755 +0100 -@@ -39,6 +39,8 @@ - - #include - #include -+#include -+#include - #include - #include - #include -@@ -163,60 +165,55 @@ char *_pam_memdup(const char *x, int len - /* Generate argv, argc from s */ - /* caller must free(argv) */ - --int _pam_mkargv(char *s, char ***argv, int *argc) -+size_t _pam_mkargv(const char *s, char ***argv, int *argc) - { -- int l; -- int argvlen = 0; -- char *sbuf, *sbuf_start; -+ size_t l; -+ size_t argvlen = 0; - char **our_argv = NULL; -- char **argvbuf; -- char *argvbufp; --#ifdef PAM_DEBUG -- int count=0; --#endif - -- D(("_pam_mkargv called: %s",s)); -+ D(("called: %s",s)); - - *argc = 0; - - l = strlen(s); -- if (l) { -- if ((sbuf = sbuf_start = _pam_strdup(s)) == NULL) { -- pam_syslog(NULL, LOG_CRIT, -- "pam_mkargv: null returned by _pam_strdup"); -- D(("arg NULL")); -+ if (l && l < SIZE_MAX / (sizeof(char) + sizeof(char *))) { -+ char **argvbuf; -+ /* Overkill on the malloc, but not large */ -+ argvlen = (l + 1) * (sizeof(char) + sizeof(char *)); -+ if ((our_argv = argvbuf = malloc(argvlen)) == NULL) { -+ pam_syslog(NULL, LOG_CRIT, "pam_mkargv: null returned by malloc"); -+ argvlen = 0; - } else { -- /* Overkill on the malloc, but not large */ -- argvlen = (l + 1) * ((sizeof(char)) + sizeof(char *)); -- if ((our_argv = argvbuf = malloc(argvlen)) == NULL) { -- pam_syslog(NULL, LOG_CRIT, -- "pam_mkargv: null returned by malloc"); -- } else { -- char *tmp=NULL; -- -- argvbufp = (char *) argvbuf + (l * sizeof(char *)); -- D(("[%s]",sbuf)); -- while ((sbuf = _pam_StrTok(sbuf, " \n\t", &tmp))) { -- D(("arg #%d",++count)); -- D(("->[%s]",sbuf)); -- strcpy(argvbufp, sbuf); -- D(("copied token")); -- *argvbuf = argvbufp; -- argvbufp += strlen(argvbufp) + 1; -- D(("stepped in argvbufp")); -- (*argc)++; -- argvbuf++; -- sbuf = NULL; -- D(("loop again?")); -+ char *argvbufp; -+ char *tmp=NULL; -+ char *tok; -+#ifdef PAM_DEBUG -+ unsigned count=0; -+#endif -+ argvbufp = (char *) argvbuf + (l * sizeof(char *)); -+ strcpy(argvbufp, s); -+ D(("[%s]",argvbufp)); -+ while ((tok = _pam_StrTok(argvbufp, " \n\t", &tmp))) { -+ D(("arg #%u",++count)); -+ D(("->[%s]",tok)); -+ *argvbuf++ = tok; -+ if (*argc == INT_MAX) { -+ pam_syslog(NULL, LOG_CRIT, -+ "pam_mkargv: too many arguments"); -+ argvlen = 0; -+ _pam_drop(our_argv); -+ break; - } -+ (*argc)++; -+ argvbufp = NULL; -+ D(("loop again?")); - } -- _pam_drop(sbuf_start); - } - } - - *argv = our_argv; - -- D(("_pam_mkargv returned")); -+ D(("exiting")); - - return(argvlen); - } -diff -up Linux-PAM-1.3.1/libpam/pam_private.h.libpam-support-long-lines Linux-PAM-1.3.1/libpam/pam_private.h ---- Linux-PAM-1.3.1/libpam/pam_private.h.libpam-support-long-lines 2024-11-04 13:17:27.404991868 +0100 -+++ Linux-PAM-1.3.1/libpam/pam_private.h 2024-11-04 14:51:31.654635328 +0100 -@@ -16,6 +16,7 @@ - - #include "config.h" - -+#include - #include - - #include -@@ -266,7 +267,7 @@ char *_pam_strdup(const char *s); - - char *_pam_memdup(const char *s, int len); - --int _pam_mkargv(char *s, char ***argv, int *argc); -+size_t _pam_mkargv(const char *s, char ***argv, int *argc); - - void _pam_sanitize(pam_handle_t *pamh); - -diff -up Linux-PAM-1.3.1/modules/pam_exec/pam_exec.c.libpam-support-long-lines Linux-PAM-1.3.1/modules/pam_exec/pam_exec.c ---- Linux-PAM-1.3.1/modules/pam_exec/pam_exec.c.libpam-support-long-lines 2017-02-10 11:10:15.000000000 +0100 -+++ Linux-PAM-1.3.1/modules/pam_exec/pam_exec.c 2024-11-04 13:17:27.434991946 +0100 -@@ -408,7 +408,7 @@ call_exec (const char *pam_type, pam_han - _exit (err); - } - -- arggv = calloc (argc + 4, sizeof (char *)); -+ arggv = calloc ((size_t) argc + 1, sizeof (char *)); - if (arggv == NULL) - _exit (ENOMEM); - -diff -up Linux-PAM-1.3.1/modules/pam_filter/pam_filter.c.libpam-support-long-lines Linux-PAM-1.3.1/modules/pam_filter/pam_filter.c ---- Linux-PAM-1.3.1/modules/pam_filter/pam_filter.c.libpam-support-long-lines 2017-02-10 11:10:15.000000000 +0100 -+++ Linux-PAM-1.3.1/modules/pam_filter/pam_filter.c 2024-11-04 13:17:27.434991946 +0100 -@@ -101,7 +101,8 @@ static int process_args(pam_handle_t *pa - char **levp; - const char *user = NULL; - const void *tmp; -- int i,size, retval; -+ int i, retval; -+ size_t size; - - *filtername = *++argv; - if (ctrl & FILTER_DEBUG) { -diff -up Linux-PAM-1.3.1/modules/pam_motd/pam_motd.c.libpam-support-long-lines Linux-PAM-1.3.1/modules/pam_motd/pam_motd.c ---- Linux-PAM-1.3.1/modules/pam_motd/pam_motd.c.libpam-support-long-lines 2024-11-04 13:17:27.423991918 +0100 -+++ Linux-PAM-1.3.1/modules/pam_motd/pam_motd.c 2024-11-04 13:17:27.434991946 +0100 -@@ -83,14 +83,14 @@ static void try_to_display_fd(pam_handle - * Returns 0 in case of error, 1 in case of success. - */ - static int pam_split_string(const pam_handle_t *pamh, char *arg, char delim, -- char ***out_arg_split, unsigned int *out_num_strs) -+ char ***out_arg_split, size_t *out_num_strs) - { - char *arg_extracted = NULL; - const char *arg_ptr = arg; - char **arg_split = NULL; - char delim_str[2]; -- unsigned int i = 0; -- unsigned int num_strs = 0; -+ size_t i = 0; -+ size_t num_strs = 0; - int retval = 0; - - delim_str[0] = delim; -@@ -184,13 +184,13 @@ static int filter_dirents(const struct d - } - - static void try_to_display_directories_with_overrides(pam_handle_t *pamh, -- char **motd_dir_path_split, unsigned int num_motd_dirs, int report_missing) -+ char **motd_dir_path_split, size_t num_motd_dirs, int report_missing) - { - struct dirent ***dirscans = NULL; - unsigned int *dirscans_sizes = NULL; - unsigned int dirscans_size_total = 0; - char **dirnames_all = NULL; -- unsigned int i; -+ size_t i; - int i_dirnames = 0; - - if (pamh == NULL || motd_dir_path_split == NULL) { -@@ -302,11 +302,11 @@ int pam_sm_open_session(pam_handle_t *pa - int retval = PAM_IGNORE; - const char *motd_path = NULL; - char *motd_path_copy = NULL; -- unsigned int num_motd_paths = 0; -+ size_t num_motd_paths = 0; - char **motd_path_split = NULL; - const char *motd_dir_path = NULL; - char *motd_dir_path_copy = NULL; -- unsigned int num_motd_dir_paths = 0; -+ size_t num_motd_dir_paths = 0; - char **motd_dir_path_split = NULL; - int report_missing; - diff --git a/SOURCES/pam-1.3.1-motd-manpage.patch b/SOURCES/pam-1.3.1-motd-manpage.patch deleted file mode 100644 index b8e2a1e..0000000 --- a/SOURCES/pam-1.3.1-motd-manpage.patch +++ /dev/null @@ -1,25 +0,0 @@ -diff -up Linux-PAM-1.3.1/modules/pam_motd/pam_motd.8.xml.motd-manpage Linux-PAM-1.3.1/modules/pam_motd/pam_motd.8.xml ---- Linux-PAM-1.3.1/modules/pam_motd/pam_motd.8.xml.motd-manpage 2018-05-18 11:50:46.000000000 +0200 -+++ Linux-PAM-1.3.1/modules/pam_motd/pam_motd.8.xml 2019-12-19 10:29:36.243558251 +0100 -@@ -31,10 +31,19 @@ - - pam_motd is a PAM module that can be used to display - arbitrary motd (message of the day) files after a successful -- login. By default the /etc/motd file is -+ login. By default the /etc/motd file and -+ all files from /etc/motd.d are - shown. The message size is limited to 64KB. - -- -+ -+ To silence a message, -+ a symbolic link with target /dev/null -+ may be placed in /etc/motd.d with -+ the same filename as the message to be silenced. Example: -+ -+ -+ ln -sfn /dev/null /etc/motd.d/my_motd -+ - - - diff --git a/SOURCES/pam-1.3.1-namespace-gdm-doc.patch b/SOURCES/pam-1.3.1-namespace-gdm-doc.patch deleted file mode 100644 index 48c4961..0000000 --- a/SOURCES/pam-1.3.1-namespace-gdm-doc.patch +++ /dev/null @@ -1,68 +0,0 @@ -From 491e5500b6b3913f531574208274358a2df88659 Mon Sep 17 00:00:00 2001 -From: ikerexxe -Date: Mon, 5 Oct 2020 10:41:29 +0200 -Subject: [PATCH] pam_namespace: polyinstantiation refer to gdm doc - -modules/pam_namespace/pam_namespace.8.xml: delete obsolete information -about polyinstantiation and refer to gdm's documentation. - -Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1861841 ---- - modules/pam_namespace/pam_namespace.8.xml | 41 ++--------------------- - 1 file changed, 2 insertions(+), 39 deletions(-) - -diff --git a/modules/pam_namespace/pam_namespace.8.xml b/modules/pam_namespace/pam_namespace.8.xml -index f0f80d33..57c44c4b 100644 ---- a/modules/pam_namespace/pam_namespace.8.xml -+++ b/modules/pam_namespace/pam_namespace.8.xml -@@ -343,45 +343,8 @@ - - - -- To use polyinstantiation with graphical display manager gdm, insert the -- following line, before exit 0, in /etc/gdm/PostSession/Default: -- -- -- -- /usr/sbin/gdm-safe-restart -- -- -- -- This allows gdm to restart after each session and appropriately adjust -- namespaces of display manager and the X server. If polyinstantiation -- of /tmp is desired along with the graphical environment, then additional -- configuration changes are needed to address the interaction of X server -- and font server namespaces with their use of /tmp to create -- communication sockets. Please use the initialization script -- /etc/security/namespace.init to ensure that -- the X server and its clients can appropriately access the -- communication socket X0. Please refer to the sample instructions -- provided in the comment section of the instance initialization script -- /etc/security/namespace.init. In addition, -- perform the following changes to use graphical environment with -- polyinstantiation of /tmp: -- -- -- -- -- 1. Disable the use of font server by commenting out "FontPath" -- line in /etc/X11/xorg.conf. If you do want to use the font server -- then you will have to augment the instance initialization -- script to appropriately provide /tmp/.font-unix from the -- polyinstantiated /tmp. -- 2. Ensure that the gdm service is setup to use pam_namespace, -- as described above, by modifying /etc/pam.d/gdm. -- 3. Ensure that the display manager is configured to restart X server -- with each new session. This default setup can be verified by -- making sure that /usr/share/gdm/defaults.conf contains -- "AlwaysRestartServer=true", and it is not overridden by -- /etc/gdm/custom.conf. -- -+ To use polyinstantiation with graphical display manager gdm, please refer -+ to gdm's documentation. - - - --- -2.26.2 - diff --git a/SOURCES/pam-1.3.1-namespace-mntopts.patch b/SOURCES/pam-1.3.1-namespace-mntopts.patch deleted file mode 100644 index 3249157..0000000 --- a/SOURCES/pam-1.3.1-namespace-mntopts.patch +++ /dev/null @@ -1,131 +0,0 @@ -diff --git a/modules/pam_namespace/namespace.conf.5.xml b/modules/pam_namespace/namespace.conf.5.xml -index c7698cb..a94b49e 100644 ---- a/modules/pam_namespace/namespace.conf.5.xml -+++ b/modules/pam_namespace/namespace.conf.5.xml -@@ -122,9 +122,14 @@ - mntopts=value - - value of this flag is passed to the mount call when the tmpfs mount is - done. It allows for example the specification of the maximum size of the -- tmpfs instance that is created by the mount call. See -- mount8 -- for details. -+ tmpfs instance that is created by the mount call. In addition to -+ options specified in the -+ tmpfs5 -+ manual the nosuid, -+ noexec, and nodev flags -+ can be used to respectively disable setuid bit effect, disable running -+ executables, and disable devices to be interpreted on the mounted -+ tmpfs filesystem. - - - -diff --git a/modules/pam_namespace/pam_namespace.c b/modules/pam_namespace/pam_namespace.c -index f541f89..660c7a1 100644 ---- a/modules/pam_namespace/pam_namespace.c -+++ b/modules/pam_namespace/pam_namespace.c -@@ -230,6 +230,73 @@ static int parse_iscript_params(char *params, struct polydir_s *poly) - return 0; - } - -+struct mntflag { -+ const char *name; -+ size_t len; -+ unsigned long flag; -+}; -+ -+#define LITERAL_AND_LEN(x) x, sizeof(x) - 1 -+ -+static const struct mntflag mntflags[] = { -+ { LITERAL_AND_LEN("noexec"), MS_NOEXEC }, -+ { LITERAL_AND_LEN("nosuid"), MS_NOSUID }, -+ { LITERAL_AND_LEN("nodev"), MS_NODEV } -+ }; -+ -+static int filter_mntopts(const char *opts, char **filtered, -+ unsigned long *mountflags) -+{ -+ size_t origlen = strlen(opts); -+ const char *end; -+ char *dest; -+ -+ dest = *filtered = NULL; -+ *mountflags = 0; -+ -+ if (origlen == 0) -+ return 0; -+ -+ do { -+ size_t len; -+ int i; -+ -+ end = strchr(opts, ','); -+ if (end == NULL) { -+ len = strlen(opts); -+ } else { -+ len = end - opts; -+ } -+ -+ for (i = 0; i < (int)(sizeof(mntflags)/sizeof(mntflags[0])); i++) { -+ if (mntflags[i].len != len) -+ continue; -+ if (memcmp(mntflags[i].name, opts, len) == 0) { -+ *mountflags |= mntflags[i].flag; -+ opts = end; -+ break; -+ } -+ } -+ -+ if (opts != end) { -+ if (dest != NULL) { -+ *dest = ','; -+ ++dest; -+ } else { -+ dest = *filtered = calloc(1, origlen + 1); -+ if (dest == NULL) -+ return -1; -+ } -+ memcpy(dest, opts, len); -+ dest += len; -+ } -+ -+ opts = end + 1; -+ } while (end != NULL); -+ -+ return 0; -+} -+ - static int parse_method(char *method, struct polydir_s *poly, - struct instance_data *idata) - { -@@ -289,7 +356,8 @@ static int parse_method(char *method, struct polydir_s *poly, - break; - } - free(poly->mount_opts); /* if duplicate mntopts specified */ -- if ((poly->mount_opts = strdup(flag+namelen+1)) == NULL) { -+ poly->mount_opts = NULL; -+ if (filter_mntopts(flag+namelen+1, &poly->mount_opts, &poly->mount_flags) != 0) { - pam_syslog(idata->pamh, LOG_CRIT, "Memory allocation error"); - return -1; - } -@@ -1484,7 +1552,7 @@ static int ns_setup(struct polydir_s *polyptr, - } - - if (polyptr->method == TMPFS) { -- if (mount("tmpfs", polyptr->dir, "tmpfs", 0, polyptr->mount_opts) < 0) { -+ if (mount("tmpfs", polyptr->dir, "tmpfs", polyptr->mount_flags, polyptr->mount_opts) < 0) { - pam_syslog(idata->pamh, LOG_ERR, "Error mounting tmpfs on %s, %m", - polyptr->dir); - return PAM_SESSION_ERR; -diff --git a/modules/pam_namespace/pam_namespace.h b/modules/pam_namespace/pam_namespace.h -index 47ebcc3..1522386 100644 ---- a/modules/pam_namespace/pam_namespace.h -+++ b/modules/pam_namespace/pam_namespace.h -@@ -166,6 +166,7 @@ struct polydir_s { - unsigned int flags; /* polydir flags */ - char *init_script; /* path to init script */ - char *mount_opts; /* mount options for tmpfs mount */ -+ unsigned long mount_flags; /* mount flags for tmpfs mount */ - uid_t owner; /* user which should own the polydir */ - gid_t group; /* group which should own the polydir */ - mode_t mode; /* mode of the polydir */ diff --git a/SOURCES/pam-1.3.1-namespace-protect-dir.patch b/SOURCES/pam-1.3.1-namespace-protect-dir.patch deleted file mode 100644 index 39e2b5e..0000000 --- a/SOURCES/pam-1.3.1-namespace-protect-dir.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 031bb5a5d0d950253b68138b498dc93be69a64cb Mon Sep 17 00:00:00 2001 -From: Matthias Gerstner -Date: Wed, 27 Dec 2023 14:01:59 +0100 -Subject: [PATCH] pam_namespace: protect_dir(): use O_DIRECTORY to prevent - local DoS situations - -Without O_DIRECTORY the path crawling logic is subject to e.g. FIFOs -being placed in user controlled directories, causing the PAM module to -block indefinitely during `openat()`. - -Pass O_DIRECTORY to cause the `openat()` to fail if the path does not -refer to a directory. - -With this the check whether the final path element is a directory -becomes unnecessary, drop it. ---- - modules/pam_namespace/pam_namespace.c | 18 +----------------- - 1 file changed, 1 insertion(+), 17 deletions(-) - -diff --git a/modules/pam_namespace/pam_namespace.c b/modules/pam_namespace/pam_namespace.c -index 2528cff8..f72d6718 100644 ---- a/modules/pam_namespace/pam_namespace.c -+++ b/modules/pam_namespace/pam_namespace.c -@@ -1201,7 +1201,7 @@ static int protect_dir(const char *path, mode_t mode, int do_mkdir, - int dfd = AT_FDCWD; - int dfd_next; - int save_errno; -- int flags = O_RDONLY; -+ int flags = O_RDONLY | O_DIRECTORY; - int rv = -1; - struct stat st; - -@@ -1255,22 +1255,6 @@ static int protect_dir(const char *path, mode_t mode, int do_mkdir, - rv = openat(dfd, dir, flags); - } - -- if (rv != -1) { -- if (fstat(rv, &st) != 0) { -- save_errno = errno; -- close(rv); -- rv = -1; -- errno = save_errno; -- goto error; -- } -- if (!S_ISDIR(st.st_mode)) { -- close(rv); -- errno = ENOTDIR; -- rv = -1; -- goto error; -- } -- } -- - if (flags & O_NOFOLLOW) { - /* we are inside user-owned dir - protect */ - if (protect_mount(rv, p, idata) == -1) { --- -2.43.0 - diff --git a/SOURCES/pam-1.3.1-noflex.patch b/SOURCES/pam-1.3.1-noflex.patch deleted file mode 100644 index c65d225..0000000 --- a/SOURCES/pam-1.3.1-noflex.patch +++ /dev/null @@ -1,24 +0,0 @@ -diff -up Linux-PAM-1.3.1/doc/Makefile.am.noflex Linux-PAM-1.3.1/doc/Makefile.am ---- Linux-PAM-1.3.1/doc/Makefile.am.noflex 2017-02-10 11:10:15.000000000 +0100 -+++ Linux-PAM-1.3.1/doc/Makefile.am 2018-05-18 14:53:50.300997606 +0200 -@@ -2,7 +2,7 @@ - # Copyright (c) 2005, 2006 Thorsten Kukuk - # - --SUBDIRS = man specs sag adg mwg -+SUBDIRS = man sag adg mwg - - CLEANFILES = *~ - -diff -up Linux-PAM-1.3.1/Makefile.am.noflex Linux-PAM-1.3.1/Makefile.am ---- Linux-PAM-1.3.1/Makefile.am.noflex 2018-05-18 14:53:50.301997629 +0200 -+++ Linux-PAM-1.3.1/Makefile.am 2018-05-18 14:55:31.576353800 +0200 -@@ -4,7 +4,7 @@ - - AUTOMAKE_OPTIONS = 1.9 gnu dist-bzip2 dist-xz check-news - --SUBDIRS = libpam tests libpamc libpam_misc modules po conf doc examples xtests -+SUBDIRS = libpam tests libpamc libpam_misc modules po doc examples xtests - - CLEANFILES = *~ - diff --git a/SOURCES/pam-1.3.1-pam-cc-compat.patch b/SOURCES/pam-1.3.1-pam-cc-compat.patch deleted file mode 100644 index fe9a95a..0000000 --- a/SOURCES/pam-1.3.1-pam-cc-compat.patch +++ /dev/null @@ -1,63 +0,0 @@ -diff -up Linux-PAM-1.3.1/libpam/include/pam_cc_compat.h.pam-cc-compat Linux-PAM-1.3.1/libpam/include/pam_cc_compat.h ---- Linux-PAM-1.3.1/libpam/include/pam_cc_compat.h.pam-cc-compat 2022-05-26 10:43:50.436328027 +0200 -+++ Linux-PAM-1.3.1/libpam/include/pam_cc_compat.h 2022-05-26 10:43:50.436328027 +0200 -@@ -0,0 +1,47 @@ -+/* -+ * Copyright (c) 2020 Dmitry V. Levin -+ */ -+ -+#ifndef PAM_CC_COMPAT_H -+#define PAM_CC_COMPAT_H -+ -+#include "config.h" -+#include -+ -+#if defined __clang__ && defined __clang_major__ && defined __clang_minor__ -+# define PAM_CLANG_PREREQ(maj, min) \ -+ ((__clang_major__ << 16) + __clang_minor__ >= ((maj) << 16) + (min)) -+#else -+# define PAM_CLANG_PREREQ(maj, min) 0 -+#endif -+ -+#if PAM_GNUC_PREREQ(4, 6) -+# define DIAG_PUSH_IGNORE_CAST_QUAL \ -+ _Pragma("GCC diagnostic push"); \ -+ _Pragma("GCC diagnostic ignored \"-Wcast-qual\"") -+# define DIAG_POP_IGNORE_CAST_QUAL \ -+ _Pragma("GCC diagnostic pop") -+# define DIAG_PUSH_IGNORE_CAST_ALIGN \ -+ _Pragma("GCC diagnostic push"); \ -+ _Pragma("GCC diagnostic ignored \"-Wcast-align\"") -+# define DIAG_POP_IGNORE_CAST_ALIGN \ -+ _Pragma("GCC diagnostic pop") -+#elif PAM_CLANG_PREREQ(2, 6) -+# define DIAG_PUSH_IGNORE_CAST_QUAL \ -+ _Pragma("clang diagnostic push"); \ -+ _Pragma("clang diagnostic ignored \"-Wcast-qual\"") -+# define DIAG_POP_IGNORE_CAST_QUAL \ -+ _Pragma("clang diagnostic pop") -+# define DIAG_PUSH_IGNORE_CAST_ALIGN \ -+ _Pragma("clang diagnostic push"); \ -+ _Pragma("clang diagnostic ignored \"-Wcast-align\"") -+# define DIAG_POP_IGNORE_CAST_ALIGN \ -+ _Pragma("clang diagnostic pop") -+#else -+# define DIAG_PUSH_IGNORE_CAST_QUAL /* empty */ -+# define DIAG_POP_IGNORE_CAST_QUAL /* empty */ -+# define DIAG_PUSH_IGNORE_CAST_ALIGN /* empty */ -+# define DIAG_POP_IGNORE_CAST_ALIGN /* empty */ -+#endif -+ -+#endif /* PAM_CC_COMPAT_H */ -diff -up Linux-PAM-1.3.1/libpam/Makefile.am.pam-cc-compat Linux-PAM-1.3.1/libpam/Makefile.am ---- Linux-PAM-1.3.1/libpam/Makefile.am.pam-cc-compat 2022-05-26 10:43:50.436328027 +0200 -+++ Linux-PAM-1.3.1/libpam/Makefile.am 2022-05-26 10:44:00.865402730 +0200 -@@ -18,7 +18,7 @@ include_HEADERS = include/security/_pam_ - include/security/pam_ext.h include/security/pam_modutil.h - - noinst_HEADERS = pam_prelude.h pam_private.h pam_tokens.h \ -- pam_modutil_private.h -+ pam_modutil_private.h include/pam_cc_compat.h - - libpam_la_LDFLAGS = -no-undefined -version-info 84:2:84 - libpam_la_LIBADD = @LIBAUDIT@ $(LIBPRELUDE_LIBS) @LIBDL@ diff --git a/SOURCES/pam-1.3.1-pam-keyinit-thread-safe.patch b/SOURCES/pam-1.3.1-pam-keyinit-thread-safe.patch deleted file mode 100644 index 1f322a1..0000000 --- a/SOURCES/pam-1.3.1-pam-keyinit-thread-safe.patch +++ /dev/null @@ -1,125 +0,0 @@ -diff -up Linux-PAM-1.3.1/modules/pam_keyinit/pam_keyinit.c.pam_keyinit-thread-safe Linux-PAM-1.3.1/modules/pam_keyinit/pam_keyinit.c ---- Linux-PAM-1.3.1/modules/pam_keyinit/pam_keyinit.c.pam_keyinit-thread-safe 2017-02-10 11:10:15.000000000 +0100 -+++ Linux-PAM-1.3.1/modules/pam_keyinit/pam_keyinit.c 2022-04-25 12:10:28.071240439 +0200 -@@ -20,6 +20,7 @@ - #include - #include - #include -+#include - - #define KEY_SPEC_SESSION_KEYRING -3 /* ID for session keyring */ - #define KEY_SPEC_USER_KEYRING -4 /* ID for UID-specific keyring */ -@@ -30,12 +31,12 @@ - #define KEYCTL_REVOKE 3 /* revoke a key */ - #define KEYCTL_LINK 8 /* link a key into a keyring */ - --static int my_session_keyring; --static int session_counter; --static int do_revoke; --static int revoke_as_uid; --static int revoke_as_gid; --static int xdebug = 0; -+static _Thread_local int my_session_keyring = 0; -+static _Atomic int session_counter = 0; -+static _Thread_local int do_revoke = 0; -+static _Thread_local uid_t revoke_as_uid; -+static _Thread_local gid_t revoke_as_gid; -+static _Thread_local int xdebug = 0; - - static void debug(pam_handle_t *pamh, const char *fmt, ...) - __attribute__((format(printf, 2, 3))); -@@ -65,6 +66,33 @@ static int error(pam_handle_t *pamh, con - return PAM_SESSION_ERR; - } - -+static int pam_setreuid(uid_t ruid, uid_t euid) -+{ -+#if defined(SYS_setreuid32) -+ return syscall(SYS_setreuid32, ruid, euid); -+#else -+ return syscall(SYS_setreuid, ruid, euid); -+#endif -+} -+ -+static int pam_setregid(gid_t rgid, gid_t egid) -+{ -+#if defined(SYS_setregid32) -+ return syscall(SYS_setregid32, rgid, egid); -+#else -+ return syscall(SYS_setregid, rgid, egid); -+#endif -+} -+ -+static int pam_setresuid(uid_t ruid, uid_t euid, uid_t suid) -+{ -+#if defined(SYS_setresuid32) -+ return syscall(SYS_setresuid32, ruid, euid, suid); -+#else -+ return syscall(SYS_setresuid, ruid, euid, suid); -+#endif -+} -+ - /* - * initialise the session keyring for this process - */ -@@ -139,23 +167,25 @@ static void kill_keyrings(pam_handle_t * - - /* switch to the real UID and GID so that we have permission to - * revoke the key */ -- if (revoke_as_gid != old_gid && setregid(-1, revoke_as_gid) < 0) -+ if (revoke_as_gid != old_gid && pam_setregid(-1, revoke_as_gid) < 0) - error(pamh, "Unable to change GID to %d temporarily\n", - revoke_as_gid); - -- if (revoke_as_uid != old_uid && setresuid(-1, revoke_as_uid, old_uid) < 0) -+ if (revoke_as_uid != old_uid && pam_setresuid(-1, revoke_as_uid, old_uid) < 0) - error(pamh, "Unable to change UID to %d temporarily\n", - revoke_as_uid); -+ if (getegid() != old_gid && pam_setregid(-1, old_gid) < 0) -+ error(pamh, "Unable to change GID back to %d\n", old_gid); - - syscall(__NR_keyctl, - KEYCTL_REVOKE, - my_session_keyring); - - /* return to the orignal UID and GID (probably root) */ -- if (revoke_as_uid != old_uid && setreuid(-1, old_uid) < 0) -+ if (revoke_as_uid != old_uid && pam_setreuid(-1, old_uid) < 0) - error(pamh, "Unable to change UID back to %d\n", old_uid); - -- if (revoke_as_gid != old_gid && setregid(-1, old_gid) < 0) -+ if (revoke_as_gid != old_gid && pam_setregid(-1, old_gid) < 0) - error(pamh, "Unable to change GID back to %d\n", old_gid); - - my_session_keyring = 0; -@@ -210,14 +240,14 @@ int pam_sm_open_session(pam_handle_t *pa - - /* switch to the real UID and GID so that the keyring ends up owned by - * the right user */ -- if (gid != old_gid && setregid(gid, -1) < 0) { -+ if (gid != old_gid && pam_setregid(gid, -1) < 0) { - error(pamh, "Unable to change GID to %d temporarily\n", gid); - return PAM_SESSION_ERR; - } - -- if (uid != old_uid && setreuid(uid, -1) < 0) { -+ if (uid != old_uid && pam_setreuid(uid, -1) < 0) { - error(pamh, "Unable to change UID to %d temporarily\n", uid); -- if (setregid(old_gid, -1) < 0) -+ if (pam_setregid(old_gid, -1) < 0) - error(pamh, "Unable to change GID back to %d\n", old_gid); - return PAM_SESSION_ERR; - } -@@ -225,10 +255,10 @@ int pam_sm_open_session(pam_handle_t *pa - ret = init_keyrings(pamh, force); - - /* return to the orignal UID and GID (probably root) */ -- if (uid != old_uid && setreuid(old_uid, -1) < 0) -+ if (uid != old_uid && pam_setreuid(old_uid, -1) < 0) - ret = error(pamh, "Unable to change UID back to %d\n", old_uid); - -- if (gid != old_gid && setregid(old_gid, -1) < 0) -+ if (gid != old_gid && pam_setregid(old_gid, -1) < 0) - ret = error(pamh, "Unable to change GID back to %d\n", old_gid); - - return ret; diff --git a/SOURCES/pam-1.3.1-pam-limits-unlimited-value.patch b/SOURCES/pam-1.3.1-pam-limits-unlimited-value.patch deleted file mode 100644 index 1cf063c..0000000 --- a/SOURCES/pam-1.3.1-pam-limits-unlimited-value.patch +++ /dev/null @@ -1,78 +0,0 @@ -diff -up Linux-PAM-1.3.1/modules/pam_limits/limits.conf.5.xml.pam-limits-unlimited-value Linux-PAM-1.3.1/modules/pam_limits/limits.conf.5.xml ---- Linux-PAM-1.3.1/modules/pam_limits/limits.conf.5.xml.pam-limits-unlimited-value 2022-01-28 09:45:41.431606850 +0100 -+++ Linux-PAM-1.3.1/modules/pam_limits/limits.conf.5.xml 2022-01-28 09:47:31.732430391 +0100 -@@ -275,6 +275,8 @@ - All items support the values -1, - unlimited or infinity indicating no limit, - except for priority and nice. -+ If nofile is to be set to one of these values, -+ it will be set to the contents of /proc/sys/fs/nr_open instead (see setrlimit(3)). - - - If a hard limit or soft limit of a resource is set to a valid value, -diff -up Linux-PAM-1.3.1/modules/pam_limits/pam_limits.c.pam-limits-unlimited-value Linux-PAM-1.3.1/modules/pam_limits/pam_limits.c ---- Linux-PAM-1.3.1/modules/pam_limits/pam_limits.c.pam-limits-unlimited-value 2022-01-28 09:45:41.415606731 +0100 -+++ Linux-PAM-1.3.1/modules/pam_limits/pam_limits.c 2022-01-28 09:45:41.431606850 +0100 -@@ -487,6 +487,41 @@ static int init_limits(pam_handle_t *pam - return retval; - } - -+/* -+ * Read the contents of and return it in *valuep -+ * return 1 if conversion succeeds, result is in *valuep -+ * return 0 if conversion fails, *valuep is untouched. -+ */ -+static int -+value_from_file(const char *pathname, rlim_t *valuep) -+{ -+ char buf[128]; -+ FILE *fp; -+ int retval; -+ -+ retval = 0; -+ -+ if ((fp = fopen(pathname, "r")) != NULL) { -+ if (fgets(buf, sizeof(buf), fp) != NULL) { -+ char *endptr; -+ unsigned long long value; -+ -+ errno = 0; -+ value = strtoull(buf, &endptr, 10); -+ if (endptr != buf && -+ (value != ULLONG_MAX || errno == 0) && -+ (unsigned long long) (rlim_t) value == value) { -+ *valuep = (rlim_t) value; -+ retval = 1; -+ } -+ } -+ -+ fclose(fp); -+ } -+ -+ return retval; -+} -+ - static void - process_limit (const pam_handle_t *pamh, int source, const char *lim_type, - const char *lim_item, const char *lim_value, -@@ -652,6 +687,20 @@ process_limit (const pam_handle_t *pamh, - rlimit_value = 20 - int_value; - break; - #endif -+ case RLIMIT_NOFILE: -+ /* -+ * If nofile is to be set to "unlimited", try to set it to -+ * the value in /proc/sys/fs/nr_open instead. -+ */ -+ if (rlimit_value == RLIM_INFINITY) { -+ if (!value_from_file("/proc/sys/fs/nr_open", &rlimit_value)) -+ pam_syslog(pamh, LOG_WARNING, -+ "Cannot set \"nofile\" to a sensible value"); -+ else if (ctrl & PAM_DEBUG_ARG) -+ pam_syslog(pamh, LOG_DEBUG, "Setting \"nofile\" limit to %llu", -+ (unsigned long long) rlimit_value); -+ } -+ break; - } - - if ( (limit_item != LIMIT_LOGIN) diff --git a/SOURCES/pam-1.3.1-pam-misc-configurable.patch b/SOURCES/pam-1.3.1-pam-misc-configurable.patch deleted file mode 100644 index 045e70e..0000000 --- a/SOURCES/pam-1.3.1-pam-misc-configurable.patch +++ /dev/null @@ -1,29 +0,0 @@ -diff -up Linux-PAM-1.3.1/configure.ac.pam-misc-configurable Linux-PAM-1.3.1/configure.ac ---- Linux-PAM-1.3.1/configure.ac.pam-misc-configurable 2023-06-26 09:57:00.243146563 +0200 -+++ Linux-PAM-1.3.1/configure.ac 2023-06-26 09:59:45.353636685 +0200 -@@ -621,6 +621,13 @@ if test x"$opt_kerneloverflowuid" == x; - fi - AC_DEFINE_UNQUOTED(PAM_USERTYPE_OVERFLOW_UID, $opt_kerneloverflowuid, [Kernel overflow uid.]) - -+AC_ARG_WITH([misc-conv-bufsize], -+AS_HELP_STRING([--with-misc-conv-bufsize=], -+ [Size of input buffer for libpam_misc's misc_conv() conversation function, default=4096]), -+ [], -+ [with_misc_conv_bufsize=4096]) -+AC_DEFINE_UNQUOTED(PAM_MISC_CONV_BUFSIZE, $with_misc_conv_bufsize, [libpam_misc misc_conv() buffer size.]) -+ - dnl Files to be created from when we run configure - AC_CONFIG_FILES([Makefile libpam/Makefile libpamc/Makefile libpamc/test/Makefile \ - libpam_misc/Makefile conf/Makefile conf/pam_conv1/Makefile \ -diff -up Linux-PAM-1.3.1/libpam_misc/misc_conv.c.pam-misc-configurable Linux-PAM-1.3.1/libpam_misc/misc_conv.c ---- Linux-PAM-1.3.1/libpam_misc/misc_conv.c.pam-misc-configurable 2023-06-26 09:57:00.242146560 +0200 -+++ Linux-PAM-1.3.1/libpam_misc/misc_conv.c 2023-06-26 10:00:38.023787972 +0200 -@@ -18,7 +18,7 @@ - #include - #include - --#define INPUTSIZE PAM_MAX_MSG_SIZE /* maximum length of input+1 */ -+#define INPUTSIZE PAM_MISC_CONV_BUFSIZE /* maximum length of input+1 */ - #define CONV_ECHO_ON 1 /* types of echo state */ - #define CONV_ECHO_OFF 0 - diff --git a/SOURCES/pam-1.3.1-pam-modutil-close-write.patch b/SOURCES/pam-1.3.1-pam-modutil-close-write.patch deleted file mode 100644 index 611e855..0000000 --- a/SOURCES/pam-1.3.1-pam-modutil-close-write.patch +++ /dev/null @@ -1,74 +0,0 @@ -From b6f73810a2e7afd02a231e2dfa14b05752c83db7 Mon Sep 17 00:00:00 2001 -From: "Dmitry V. Levin" -Date: Wed, 26 Feb 2020 19:20:58 +0000 -Subject: [PATCH] pam_modutil_sanitize_helper_fds: fix SIGPIPE effect of - PAM_MODUTIL_PIPE_FD - -When pam_modutil_sanitize_helper_fds() is invoked with -PAM_MODUTIL_PIPE_FD to provide a dummy pipe descriptor for stdout -or stderr, it closes the read end of the newly created dummy pipe. -The negative side effect of this approach is that any write to such -descriptor triggers a SIGPIPE. Avoid this by closing the write end of -the dummy pipe and using its read end as a dummy pipe descriptor for -output. Any read from such descriptor returns 0, and any write just -fails with EBADF, which should work better with unprepared writers. - -* libpam/pam_modutil_sanitize.c (redirect_out_pipe): Remove. -(redirect_out): Call redirect_in_pipe instead of redirect_out_pipe. - -Fixes: b0ec5d1e ("Introduce pam_modutil_sanitize_helper_fds") ---- - libpam/pam_modutil_sanitize.c | 30 +----------------------------- - 1 file changed, 1 insertion(+), 29 deletions(-) - -diff --git a/libpam/pam_modutil_sanitize.c b/libpam/pam_modutil_sanitize.c -index 605c859d..58b9537c 100644 ---- a/libpam/pam_modutil_sanitize.c -+++ b/libpam/pam_modutil_sanitize.c -@@ -46,34 +46,6 @@ redirect_in_pipe(pam_handle_t *pamh, int fd, const char *name) - return fd; - } - --/* -- * Creates a pipe, closes its read end, redirects fd to its write end. -- * Returns fd on success, -1 otherwise. -- */ --static int --redirect_out_pipe(pam_handle_t *pamh, int fd, const char *name) --{ -- int out[2]; -- -- if (pipe(out) < 0) { -- pam_syslog(pamh, LOG_ERR, "Could not create pipe: %m"); -- return -1; -- } -- -- close(out[0]); -- -- if (out[1] == fd) -- return fd; -- -- if (dup2(out[1], fd) != fd) { -- pam_syslog(pamh, LOG_ERR, "dup2 of %s failed: %m", name); -- fd = -1; -- } -- -- close(out[1]); -- return fd; --} -- - /* - * Opens /dev/null for writing, redirects fd there. - * Returns fd on success, -1 otherwise. -@@ -106,7 +78,7 @@ redirect_out(pam_handle_t *pamh, enum pam_modutil_redirect_fd mode, - { - switch (mode) { - case PAM_MODUTIL_PIPE_FD: -- if (redirect_out_pipe(pamh, fd, name) < 0) -+ if (redirect_in_pipe(pamh, fd, name) < 0) - return -1; - break; - case PAM_MODUTIL_NULL_FD: --- -2.25.3 - diff --git a/SOURCES/pam-1.3.1-pam-motd-avoid-unnecessary-logging.patch b/SOURCES/pam-1.3.1-pam-motd-avoid-unnecessary-logging.patch deleted file mode 100644 index 52f7292..0000000 --- a/SOURCES/pam-1.3.1-pam-motd-avoid-unnecessary-logging.patch +++ /dev/null @@ -1,283 +0,0 @@ -From d57ab22133654033ee1da89f128a81572d320985 Mon Sep 17 00:00:00 2001 -From: Tomas Mraz -Date: Thu, 20 Dec 2018 13:59:25 +0100 -Subject: [PATCH] pam_motd: Cleanup the code and avoid unnecessary logging - -The pam_motd module will not log if the default motd.d directories -are missing. - -Also cleanup some code cleanliness issues and fix compilation -warnings. - -* modules/pam_motd/pam_motd.c: Constification of constant strings. - (try_to_display_directory): Removed unused function. - (pam_split_string): Replace uint with unsigned int. Fix warnings. - (compare_strings): Fix warnings by proper constification. - (try_to_display_directories_with_overrides): Cleanups. Switch - off the logging if the motd.d directories are missing and they - are default ones. - (pam_sm_open_session): Cleanup warnings. Pass the information - to try_to_display_directories_with_overrides() that non-default - motd options are used. ---- - modules/pam_motd/pam_motd.c | 88 ++++++++++++++++--------------------- - 1 file changed, 37 insertions(+), 51 deletions(-) - -diff --git a/modules/pam_motd/pam_motd.c b/modules/pam_motd/pam_motd.c -index ec3ebd58..dbd718b6 100644 ---- a/modules/pam_motd/pam_motd.c -+++ b/modules/pam_motd/pam_motd.c -@@ -22,6 +22,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -48,8 +49,8 @@ pam_sm_close_session (pam_handle_t *pamh UNUSED, int flags UNUSED, - return PAM_IGNORE; - } - --static char default_motd[] = DEFAULT_MOTD; --static char default_motd_dir[] = DEFAULT_MOTD_D; -+static const char default_motd[] = DEFAULT_MOTD; -+static const char default_motd_dir[] = DEFAULT_MOTD_D; - - static void try_to_display_fd(pam_handle_t *pamh, int fd) - { -@@ -75,28 +76,6 @@ static void try_to_display_fd(pam_handle_t *pamh, int fd) - _pam_drop(mtmp); - } - --static void try_to_display_directory(pam_handle_t *pamh, const char *dirname) --{ -- DIR *dirp; -- -- dirp = opendir(dirname); -- -- if (dirp != NULL) { -- struct dirent *entry; -- -- while ((entry = readdir(dirp))) { -- int fd = openat(dirfd(dirp), entry->d_name, O_RDONLY); -- -- if (fd >= 0) { -- try_to_display_fd(pamh, fd); -- close(fd); -- } -- } -- -- closedir(dirp); -- } --} -- - /* - * Split a DELIM-separated string ARG into an array. - * Outputs a newly allocated array of strings OUT_ARG_SPLIT -@@ -104,14 +83,14 @@ static void try_to_display_directory(pam_handle_t *pamh, const char *dirname) - * Returns 0 in case of error, 1 in case of success. - */ - static int pam_split_string(const pam_handle_t *pamh, char *arg, char delim, -- char ***out_arg_split, uint *out_num_strs) -+ char ***out_arg_split, unsigned int *out_num_strs) - { - char *arg_extracted = NULL; - const char *arg_ptr = arg; - char **arg_split = NULL; - char delim_str[2]; -- int i = 0; -- uint num_strs = 0; -+ unsigned int i = 0; -+ unsigned int num_strs = 0; - int retval = 0; - - delim_str[0] = delim; -@@ -126,7 +105,7 @@ static int pam_split_string(const pam_handle_t *pamh, char *arg, char delim, - arg_ptr = strchr(arg_ptr + sizeof(const char), delim); - } - -- arg_split = (char **)calloc(num_strs, sizeof(char *)); -+ arg_split = calloc(num_strs, sizeof(char *)); - if (arg_split == NULL) { - pam_syslog(pamh, LOG_CRIT, "pam_motd: failed to allocate string array"); - goto out; -@@ -180,10 +159,10 @@ static int join_dir_strings(char **strp_out, const char *a_str, const char *b_st - return retval; - } - --static int compare_strings(const void * a, const void * b) -+static int compare_strings(const void *a, const void *b) - { -- const char *a_str = *(char **)a; -- const char *b_str = *(char **)b; -+ const char *a_str = *(const char * const *)a; -+ const char *b_str = *(const char * const *)b; - - if (a_str == NULL && b_str == NULL) { - return 0; -@@ -205,13 +184,13 @@ static int filter_dirents(const struct dirent *d) - } - - static void try_to_display_directories_with_overrides(pam_handle_t *pamh, -- char **motd_dir_path_split, int num_motd_dirs) -+ char **motd_dir_path_split, unsigned int num_motd_dirs, int report_missing) - { - struct dirent ***dirscans = NULL; -- int *dirscans_sizes = NULL; -- int dirscans_size_total = 0; -+ unsigned int *dirscans_sizes = NULL; -+ unsigned int dirscans_size_total = 0; - char **dirnames_all = NULL; -- int i; -+ unsigned int i; - int i_dirnames = 0; - - if (pamh == NULL || motd_dir_path_split == NULL) { -@@ -221,29 +200,31 @@ static void try_to_display_directories_with_overrides(pam_handle_t *pamh, - goto out; - } - -- if ((dirscans = (struct dirent ***)calloc(num_motd_dirs, -- sizeof(struct dirent **))) == NULL) { -+ if ((dirscans = calloc(num_motd_dirs, sizeof(struct dirent **))) == NULL) { - pam_syslog(pamh, LOG_CRIT, "pam_motd: failed to allocate dirent arrays"); - goto out; - } -- if ((dirscans_sizes = (int *)calloc(num_motd_dirs, sizeof(int))) == NULL) { -+ if ((dirscans_sizes = calloc(num_motd_dirs, sizeof(int))) == NULL) { - pam_syslog(pamh, LOG_CRIT, "pam_motd: failed to allocate dirent array sizes"); - goto out; - } - - for (i = 0; i < num_motd_dirs; i++) { -- dirscans_sizes[i] = scandir(motd_dir_path_split[i], &(dirscans[i]), -+ int rv; -+ rv = scandir(motd_dir_path_split[i], &(dirscans[i]), - filter_dirents, alphasort); -- if (dirscans_sizes[i] < 0) { -- pam_syslog(pamh, LOG_ERR, "pam_motd: error scanning directory %s", motd_dir_path_split[i]); -- dirscans_sizes[i] = 0; -+ if (rv < 0) { -+ if (errno != ENOENT || report_missing) { -+ pam_syslog(pamh, LOG_ERR, "pam_motd: error scanning directory %s: %m", -+ motd_dir_path_split[i]); -+ } -+ dirscans_sizes[i] = rv; - } - dirscans_size_total += dirscans_sizes[i]; - } - - /* Allocate space for all file names found in the directories, including duplicates. */ -- if ((dirnames_all = (char **)calloc(dirscans_size_total, -- sizeof(char *))) == NULL) { -+ if ((dirnames_all = calloc(dirscans_size_total, sizeof(char *))) == NULL) { - pam_syslog(pamh, LOG_CRIT, "pam_motd: failed to allocate dirname array"); - goto out; - } -@@ -253,7 +234,7 @@ static void try_to_display_directories_with_overrides(pam_handle_t *pamh, - } - - for (i = 0; i < num_motd_dirs; i++) { -- int j; -+ unsigned int j; - - for (j = 0; j < dirscans_sizes[i]; j++) { - dirnames_all[i_dirnames] = dirscans[i][j]->d_name; -@@ -265,7 +246,7 @@ static void try_to_display_directories_with_overrides(pam_handle_t *pamh, - sizeof(const char *), compare_strings); - - for (i = 0; i < dirscans_size_total; i++) { -- int j; -+ unsigned int j; - - if (dirnames_all[i] == NULL) { - continue; -@@ -301,7 +282,8 @@ static void try_to_display_directories_with_overrides(pam_handle_t *pamh, - out: - _pam_drop(dirnames_all); - for (i = 0; i < num_motd_dirs; i++) { -- int j; -+ unsigned int j; -+ - for (j = 0; j < dirscans_sizes[i]; j++) { - _pam_drop(dirscans[i][j]); - } -@@ -319,12 +301,13 @@ int pam_sm_open_session(pam_handle_t *pamh, int flags, - int retval = PAM_IGNORE; - const char *motd_path = NULL; - char *motd_path_copy = NULL; -- int num_motd_paths = 0; -+ unsigned int num_motd_paths = 0; - char **motd_path_split = NULL; - const char *motd_dir_path = NULL; - char *motd_dir_path_copy = NULL; -- int num_motd_dir_paths = 0; -+ unsigned int num_motd_dir_paths = 0; - char **motd_dir_path_split = NULL; -+ int report_missing; - - if (flags & PAM_SILENT) { - return retval; -@@ -360,6 +343,9 @@ int pam_sm_open_session(pam_handle_t *pamh, int flags, - if (motd_path == NULL && motd_dir_path == NULL) { - motd_path = default_motd; - motd_dir_path = default_motd_dir; -+ report_missing = 0; -+ } else { -+ report_missing = 1; - } - - if (motd_path != NULL) { -@@ -385,7 +371,7 @@ int pam_sm_open_session(pam_handle_t *pamh, int flags, - } - - if (motd_path_split != NULL) { -- int i; -+ unsigned int i; - - for (i = 0; i < num_motd_paths; i++) { - int fd = open(motd_path_split[i], O_RDONLY, 0); -@@ -402,7 +388,7 @@ int pam_sm_open_session(pam_handle_t *pamh, int flags, - - if (motd_dir_path_split != NULL) - try_to_display_directories_with_overrides(pamh, motd_dir_path_split, -- num_motd_dir_paths); -+ num_motd_dir_paths, report_missing); - - out: - _pam_drop(motd_path_copy); --- -2.37.3 - -From c2c0434bd634a817f2b16ce7f58fc96c04e88b03 Mon Sep 17 00:00:00 2001 -From: "Dmitry V. Levin" -Date: Sun, 26 Apr 2020 11:12:59 +0000 -Subject: [PATCH] pam_motd: fix NULL dereference when at least one of motd - directories is not available - -* modules/pam_motd/pam_motd.c -(try_to_display_directories_with_overrides): Do not assign -1U to -dirscans_sizes[i] when scandir(motd_dir_path_split[i]) returns an error. - -Resolves: https://bugzilla.altlinux.org/38389 -Fixes: d57ab221 ("pam_motd: Cleanup the code and avoid unnecessary logging") ---- - modules/pam_motd/pam_motd.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/modules/pam_motd/pam_motd.c b/modules/pam_motd/pam_motd.c -index df09b7d0..8147c6fd 100644 ---- a/modules/pam_motd/pam_motd.c -+++ b/modules/pam_motd/pam_motd.c -@@ -219,6 +219,7 @@ static void try_to_display_directories_with_overrides(pam_handle_t *pamh, - pam_syslog(pamh, LOG_ERR, "pam_motd: error scanning directory %s: %m", - motd_dir_path_split[i]); - } -+ } else { - dirscans_sizes[i] = rv; - } - dirscans_size_total += dirscans_sizes[i]; --- -2.37.3 - diff --git a/SOURCES/pam-1.3.1-pam-motd-fix-memory-leak.patch b/SOURCES/pam-1.3.1-pam-motd-fix-memory-leak.patch deleted file mode 100644 index 932633b..0000000 --- a/SOURCES/pam-1.3.1-pam-motd-fix-memory-leak.patch +++ /dev/null @@ -1,57 +0,0 @@ -From 62cd745d730e5ba13d5d7092ac566fc0b2148e61 Mon Sep 17 00:00:00 2001 -From: "Dmitry V. Levin" -Date: Sun, 26 Apr 2020 11:12:59 +0000 -Subject: [PATCH] pam_motd: fix memory leak - -pam_motd used to leak memory allocated for each motd file -successfully opened in try_to_display_directories_with_overrides. - -* modules/pam_motd/pam_motd.c -(try_to_display_directories_with_overrides): Free abs_path. - -Fixes: f9c9c721 ("pam_motd: Support multiple motd paths specified, with filename overrides (#69)") ---- - modules/pam_motd/pam_motd.c | 20 ++++++++++---------- - 1 file changed, 10 insertions(+), 10 deletions(-) - -diff --git a/modules/pam_motd/pam_motd.c b/modules/pam_motd/pam_motd.c -index f0cd317d..3be129a5 100644 ---- a/modules/pam_motd/pam_motd.c -+++ b/modules/pam_motd/pam_motd.c -@@ -259,23 +259,23 @@ static void try_to_display_directories_with_overrides(pam_handle_t *pamh, - - for (j = 0; j < num_motd_dirs; j++) { - char *abs_path = NULL; -+ int fd; - - if (join_dir_strings(&abs_path, motd_dir_path_split[j], -- dirnames_all[i]) < 0) { -+ dirnames_all[i]) < 0 || abs_path == NULL) { - continue; - } - -- if (abs_path != NULL) { -- int fd = open(abs_path, O_RDONLY, 0); -- if (fd >= 0) { -- try_to_display_fd(pamh, fd); -- close(fd); -+ fd = open(abs_path, O_RDONLY, 0); -+ _pam_drop(abs_path); - -- /* We displayed a file, skip to the next file name. */ -- break; -- } -+ if (fd >= 0) { -+ try_to_display_fd(pamh, fd); -+ close(fd); -+ -+ /* We displayed a file, skip to the next file name. */ -+ break; - } -- _pam_drop(abs_path); - } - } - --- -2.35.3 - diff --git a/SOURCES/pam-1.3.1-pam-motd-fix-segmentation-fault.patch b/SOURCES/pam-1.3.1-pam-motd-fix-segmentation-fault.patch deleted file mode 100644 index af72866..0000000 --- a/SOURCES/pam-1.3.1-pam-motd-fix-segmentation-fault.patch +++ /dev/null @@ -1,133 +0,0 @@ -From 8eaf5570cf011148a0b55c53570df5edaafebdb0 Mon Sep 17 00:00:00 2001 -From: Robert Fairley -Date: Wed, 21 Nov 2018 02:46:02 -0500 -Subject: [PATCH] pam_motd: Fix segmentation fault when no motd_dir specified - (#76) - -This fixes a regression introduced by #69, where motd_path was set -to NULL and passed into strdup() if the motd_dir argument was -not specified in the configuration file. This caused a segmentation -fault. - -* modules/pam_motd/pam_motd.c: fix checks for NULL in arguments -* xtests/Makefile.am: add test scripts and config file -* xtests/tst-pam_motd.sh: add running tst-pam_motd4.sh -* xtests/tst-pam_motd4.pamd: create -* xtests/tst-pam_motd4.sh: create ---- - modules/pam_motd/pam_motd.c | 15 ++++++++++----- - xtests/Makefile.am | 4 ++-- - xtests/tst-pam_motd.sh | 1 + - xtests/tst-pam_motd4.pamd | 3 +++ - xtests/tst-pam_motd4.sh | 27 +++++++++++++++++++++++++++ - 5 files changed, 43 insertions(+), 7 deletions(-) - create mode 100644 xtests/tst-pam_motd4.pamd - create mode 100755 xtests/tst-pam_motd4.sh - -diff --git a/modules/pam_motd/pam_motd.c b/modules/pam_motd/pam_motd.c -index 1c1cfcfa..ec3ebd58 100644 ---- a/modules/pam_motd/pam_motd.c -+++ b/modules/pam_motd/pam_motd.c -@@ -132,7 +132,6 @@ static int pam_split_string(const pam_handle_t *pamh, char *arg, char delim, - goto out; - } - -- - arg_extracted = strtok_r(arg, delim_str, &arg); - while (arg_extracted != NULL && i < num_strs) { - arg_split[i++] = arg_extracted; -@@ -363,15 +362,21 @@ int pam_sm_open_session(pam_handle_t *pamh, int flags, - motd_dir_path = default_motd_dir; - } - -- motd_path_copy = strdup(motd_path); -+ if (motd_path != NULL) { -+ motd_path_copy = strdup(motd_path); -+ } -+ - if (motd_path_copy != NULL) { -- if (pam_split_string(pamh, motd_path_copy, ':', &motd_path_split, -- &num_motd_paths) == 0) { -+ if (pam_split_string(pamh, motd_path_copy, ':', -+ &motd_path_split, &num_motd_paths) == 0) { - goto out; - } - } - -- motd_dir_path_copy = strdup(motd_dir_path); -+ if (motd_dir_path != NULL) { -+ motd_dir_path_copy = strdup(motd_dir_path); -+ } -+ - if (motd_dir_path_copy != NULL) { - if (pam_split_string(pamh, motd_dir_path_copy, ':', - &motd_dir_path_split, &num_motd_dir_paths) == 0) { -diff --git a/xtests/Makefile.am b/xtests/Makefile.am -index 555d5e33..4d5aba3d 100644 ---- a/xtests/Makefile.am -+++ b/xtests/Makefile.am -@@ -34,8 +34,8 @@ EXTRA_DIST = run-xtests.sh tst-pam_dispatch1.pamd tst-pam_dispatch2.pamd \ - tst-pam_pwhistory1.pamd tst-pam_pwhistory1.sh \ - tst-pam_time1.pamd time.conf \ - tst-pam_motd.sh tst-pam_motd1.sh tst-pam_motd2.sh \ -- tst-pam_motd3.sh tst-pam_motd1.pamd \ -- tst-pam_motd2.pamd tst-pam_motd3.pamd -+ tst-pam_motd3.sh tst-pam_motd4.sh tst-pam_motd1.pamd \ -+ tst-pam_motd2.pamd tst-pam_motd3.pamd tst-pam_motd4.pamd - - XTESTS = tst-pam_dispatch1 tst-pam_dispatch2 tst-pam_dispatch3 \ - tst-pam_dispatch4 tst-pam_dispatch5 \ -diff --git a/xtests/tst-pam_motd.sh b/xtests/tst-pam_motd.sh -index 9b0c38f6..90801280 100755 ---- a/xtests/tst-pam_motd.sh -+++ b/xtests/tst-pam_motd.sh -@@ -5,3 +5,4 @@ set -e - ./tst-pam_motd1.sh - ./tst-pam_motd2.sh - ./tst-pam_motd3.sh -+./tst-pam_motd4.sh -diff --git a/xtests/tst-pam_motd4.pamd b/xtests/tst-pam_motd4.pamd -new file mode 100644 -index 00000000..9dc311ad ---- /dev/null -+++ b/xtests/tst-pam_motd4.pamd -@@ -0,0 +1,3 @@ -+#%PAM-1.0 -+session required pam_permit.so -+session optional pam_motd.so motd=tst-pam_motd4.d/etc/motd -diff --git a/xtests/tst-pam_motd4.sh b/xtests/tst-pam_motd4.sh -new file mode 100755 -index 00000000..6022177f ---- /dev/null -+++ b/xtests/tst-pam_motd4.sh -@@ -0,0 +1,27 @@ -+#!/bin/bash -+ -+TST_DIR="tst-pam_motd4.d" -+ -+function tst_cleanup() { -+ rm -rf "${TST_DIR}" -+ rm -f tst-pam_motd4.out -+} -+ -+mkdir -p ${TST_DIR}/etc -+ -+# Verify the case of single motd with no motd_dir given in tst-pam_motd4.pamd -+echo "motd: /etc/motd" > ${TST_DIR}/etc/motd -+ -+./tst-pam_motd tst-pam_motd4 > tst-pam_motd4.out -+ -+RET=$? -+ -+motd_to_show_output=$(cat tst-pam_motd4.out | grep "motd: /etc/motd") -+if [ -z "${motd_to_show_output}" ]; -+then -+ tst_cleanup -+ exit 1 -+fi -+ -+tst_cleanup -+exit $RET --- -2.35.1 - diff --git a/SOURCES/pam-1.3.1-pam-motd-support-multiple-motd-paths.patch b/SOURCES/pam-1.3.1-pam-motd-support-multiple-motd-paths.patch deleted file mode 100644 index f81ecbe..0000000 --- a/SOURCES/pam-1.3.1-pam-motd-support-multiple-motd-paths.patch +++ /dev/null @@ -1,691 +0,0 @@ -diff -up Linux-PAM-1.3.1/modules/pam_motd/pam_motd.8.xml.pam_motd-support-multiple-motd-paths1 Linux-PAM-1.3.1/modules/pam_motd/pam_motd.8.xml ---- Linux-PAM-1.3.1/modules/pam_motd/pam_motd.8.xml.pam_motd-support-multiple-motd-paths1 2022-04-25 12:32:36.939663167 +0200 -+++ Linux-PAM-1.3.1/modules/pam_motd/pam_motd.8.xml 2022-04-25 12:34:43.506582206 +0200 -@@ -21,6 +21,9 @@ - - motd=/path/filename - -+ -+ motd_dir=/path/dirname.d -+ - - - -@@ -31,18 +34,49 @@ - - pam_motd is a PAM module that can be used to display - arbitrary motd (message of the day) files after a successful -- login. By default the /etc/motd file and -- all files from /etc/motd.d are -- shown. The message size is limited to 64KB. -+ login. By default, pam_motd shows files in the -+ following locations: -+ -+ -+ -+ /etc/motd -+ /run/motd -+ /usr/lib/motd -+ /etc/motd.d/ -+ /run/motd.d/ -+ /usr/lib/motd.d/ -+ -+ -+ -+ Each message size is limited to 64KB. -+ -+ -+ If /etc/motd does not exist, -+ then /run/motd is shown. If -+ /run/motd does not exist, then -+ /usr/lib/motd is shown. -+ -+ -+ Similar overriding behavior applies to the directories. -+ Files in /etc/motd.d/ override files -+ with the same name in /run/motd.d/ and -+ /usr/lib/motd.d/. Files in /run/motd.d/ -+ override files with the same name in /usr/lib/motd.d/. -+ -+ -+ Files in the directories listed above are displayed in lexicographic -+ order by name. Moreover, the files are filtered by reading them with the -+ credentials of the target user authenticating on the system. - - - To silence a message, - a symbolic link with target /dev/null - may be placed in /etc/motd.d with - the same filename as the message to be silenced. Example: -+ Creating a symbolic link as follows silences /usr/lib/motd.d/my_motd. - - -- ln -sfn /dev/null /etc/motd.d/my_motd -+ ln -s /dev/null /etc/motd.d/my_motd - - - -@@ -56,8 +90,10 @@ - - - -- The /path/filename file is displayed -- as message of the day. -+ The /path/filename file is displayed -+ as message of the day. Multiple paths to try can be -+ specified as a colon-separated list. By default this option -+ is set to /etc/motd:/run/motd:/usr/lib/motd. - - - -@@ -68,16 +104,17 @@ - - - The /path/dirname.d directory is scanned -- and each file contained inside of it is displayed. -+ and each file contained inside of it is displayed. Multiple -+ directories to scan can be specified as a colon-separated list. -+ By default this option is set to /etc/motd.d:/run/motd.d:/usr/lib/motd.d. - - - - - -- When no options are given, the default is to display both -- /etc/motd and the contents of -- /etc/motd.d. Specifying either option (or both) -- will disable this default behavior. -+ When no options are given, the default behavior applies for both -+ options. Specifying either option (or both) will disable the -+ default behavior for both options. - - - -diff -up Linux-PAM-1.3.1/modules/pam_motd/pam_motd.c.pam_motd-support-multiple-motd-paths1 Linux-PAM-1.3.1/modules/pam_motd/pam_motd.c ---- Linux-PAM-1.3.1/modules/pam_motd/pam_motd.c.pam_motd-support-multiple-motd-paths1 2018-05-18 11:50:46.000000000 +0200 -+++ Linux-PAM-1.3.1/modules/pam_motd/pam_motd.c 2022-04-25 12:32:36.947663225 +0200 -@@ -33,8 +33,8 @@ - */ - - #define PAM_SM_SESSION --#define DEFAULT_MOTD "/etc/motd" --#define DEFAULT_MOTD_D "/etc/motd.d" -+#define DEFAULT_MOTD "/etc/motd:/run/motd:/usr/lib/motd" -+#define DEFAULT_MOTD_D "/etc/motd.d:/run/motd.d:/usr/lib/motd.d" - - #include - #include -@@ -97,12 +97,235 @@ static void try_to_display_directory(pam - } - } - -+/* -+ * Split a DELIM-separated string ARG into an array. -+ * Outputs a newly allocated array of strings OUT_ARG_SPLIT -+ * and the number of strings OUT_NUM_STRS. -+ * Returns 0 in case of error, 1 in case of success. -+ */ -+static int pam_split_string(const pam_handle_t *pamh, char *arg, char delim, -+ char ***out_arg_split, uint *out_num_strs) -+{ -+ char *arg_extracted = NULL; -+ const char *arg_ptr = arg; -+ char **arg_split = NULL; -+ char delim_str[2]; -+ int i = 0; -+ uint num_strs = 0; -+ int retval = 0; -+ -+ delim_str[0] = delim; -+ delim_str[1] = '\0'; -+ -+ if (arg == NULL) { -+ goto out; -+ } -+ -+ while (arg_ptr != NULL) { -+ num_strs++; -+ arg_ptr = strchr(arg_ptr + sizeof(const char), delim); -+ } -+ -+ arg_split = (char **)calloc(num_strs, sizeof(char *)); -+ if (arg_split == NULL) { -+ pam_syslog(pamh, LOG_CRIT, "pam_motd: failed to allocate string array"); -+ goto out; -+ } -+ -+ -+ arg_extracted = strtok_r(arg, delim_str, &arg); -+ while (arg_extracted != NULL && i < num_strs) { -+ arg_split[i++] = arg_extracted; -+ arg_extracted = strtok_r(NULL, delim_str, &arg); -+ } -+ -+ retval = 1; -+ -+ out: -+ *out_num_strs = num_strs; -+ *out_arg_split = arg_split; -+ -+ return retval; -+} -+ -+/* Join A_STR and B_STR, inserting a "/" between them if one is not already trailing -+ * in A_STR or beginning B_STR. A pointer to a newly allocated string holding the -+ * joined string is returned in STRP_OUT. -+ * Returns -1 in case of error, or the number of bytes in the joined string in -+ * case of success. */ -+static int join_dir_strings(char **strp_out, const char *a_str, const char *b_str) -+{ -+ int has_sep = 0; -+ int retval = -1; -+ char *join_strp = NULL; -+ -+ if (strp_out == NULL || a_str == NULL || b_str == NULL) { -+ goto out; -+ } -+ if (strlen(a_str) == 0) { -+ goto out; -+ } -+ -+ has_sep = (a_str[strlen(a_str) - 1] == '/') || (b_str[0] == '/'); -+ -+ retval = asprintf(&join_strp, "%s%s%s", a_str, -+ (has_sep == 1) ? "" : "/", b_str); -+ -+ if (retval < 0) { -+ goto out; -+ } -+ -+ *strp_out = join_strp; -+ -+ out: -+ return retval; -+} -+ -+static int compare_strings(const void * a, const void * b) -+{ -+ const char *a_str = *(char **)a; -+ const char *b_str = *(char **)b; -+ -+ if (a_str == NULL && b_str == NULL) { -+ return 0; -+ } -+ else if (a_str == NULL) { -+ return -1; -+ } -+ else if (b_str == NULL) { -+ return 1; -+ } -+ else { -+ return strcmp(a_str, b_str); -+ } -+} -+ -+static int filter_dirents(const struct dirent *d) -+{ -+ return (d->d_type == DT_REG || d->d_type == DT_LNK); -+} -+ -+static void try_to_display_directories_with_overrides(pam_handle_t *pamh, -+ char **motd_dir_path_split, int num_motd_dirs) -+{ -+ struct dirent ***dirscans = NULL; -+ int *dirscans_sizes = NULL; -+ int dirscans_size_total = 0; -+ char **dirnames_all = NULL; -+ int i; -+ int i_dirnames = 0; -+ -+ if (pamh == NULL || motd_dir_path_split == NULL) { -+ goto out; -+ } -+ if (num_motd_dirs < 1) { -+ goto out; -+ } -+ -+ if ((dirscans = (struct dirent ***)calloc(num_motd_dirs, -+ sizeof(struct dirent **))) == NULL) { -+ pam_syslog(pamh, LOG_CRIT, "pam_motd: failed to allocate dirent arrays"); -+ goto out; -+ } -+ if ((dirscans_sizes = (int *)calloc(num_motd_dirs, sizeof(int))) == NULL) { -+ pam_syslog(pamh, LOG_CRIT, "pam_motd: failed to allocate dirent array sizes"); -+ goto out; -+ } -+ -+ for (i = 0; i < num_motd_dirs; i++) { -+ dirscans_sizes[i] = scandir(motd_dir_path_split[i], &(dirscans[i]), -+ filter_dirents, alphasort); -+ if (dirscans_sizes[i] < 0) { -+ pam_syslog(pamh, LOG_ERR, "pam_motd: error scanning directory %s", motd_dir_path_split[i]); -+ dirscans_sizes[i] = 0; -+ } -+ dirscans_size_total += dirscans_sizes[i]; -+ } -+ -+ /* Allocate space for all file names found in the directories, including duplicates. */ -+ if ((dirnames_all = (char **)calloc(dirscans_size_total, -+ sizeof(char *))) == NULL) { -+ pam_syslog(pamh, LOG_CRIT, "pam_motd: failed to allocate dirname array"); -+ goto out; -+ } -+ -+ for (i = 0; i < dirscans_size_total; i++) { -+ dirnames_all[i] = NULL; -+ } -+ -+ for (i = 0; i < num_motd_dirs; i++) { -+ int j; -+ -+ for (j = 0; j < dirscans_sizes[i]; j++) { -+ dirnames_all[i_dirnames] = dirscans[i][j]->d_name; -+ i_dirnames++; -+ } -+ } -+ -+ qsort(dirnames_all, dirscans_size_total, -+ sizeof(const char *), compare_strings); -+ -+ for (i = 0; i < dirscans_size_total; i++) { -+ int j; -+ -+ if (dirnames_all[i] == NULL) { -+ continue; -+ } -+ -+ /* Skip duplicate file names. */ -+ if (i > 0 && strcmp(dirnames_all[i], dirnames_all[i - 1]) == 0) { -+ continue; -+ } -+ -+ for (j = 0; j < num_motd_dirs; j++) { -+ char *abs_path = NULL; -+ -+ if (join_dir_strings(&abs_path, motd_dir_path_split[j], -+ dirnames_all[i]) < 0) { -+ continue; -+ } -+ -+ if (abs_path != NULL) { -+ int fd = open(abs_path, O_RDONLY, 0); -+ if (fd >= 0) { -+ try_to_display_fd(pamh, fd); -+ close(fd); -+ -+ /* We displayed a file, skip to the next file name. */ -+ break; -+ } -+ } -+ _pam_drop(abs_path); -+ } -+ } -+ -+ out: -+ _pam_drop(dirnames_all); -+ for (i = 0; i < num_motd_dirs; i++) { -+ int j; -+ for (j = 0; j < dirscans_sizes[i]; j++) { -+ _pam_drop(dirscans[i][j]); -+ } -+ _pam_drop(dirscans[i]); -+ } -+ _pam_drop(dirscans_sizes); -+ _pam_drop(dirscans); -+ -+ return; -+} -+ - int pam_sm_open_session(pam_handle_t *pamh, int flags, - int argc, const char **argv) - { - int retval = PAM_IGNORE; - const char *motd_path = NULL; -+ char *motd_path_copy = NULL; -+ int num_motd_paths = 0; -+ char **motd_path_split = NULL; - const char *motd_dir_path = NULL; -+ char *motd_dir_path_copy = NULL; -+ int num_motd_dir_paths = 0; -+ char **motd_dir_path_split = NULL; - - if (flags & PAM_SILENT) { - return retval; -@@ -140,17 +363,47 @@ int pam_sm_open_session(pam_handle_t *pa - motd_dir_path = default_motd_dir; - } - -- if (motd_path != NULL) { -- int fd = open(motd_path, O_RDONLY, 0); -+ motd_path_copy = strdup(motd_path); -+ if (motd_path_copy != NULL) { -+ if (pam_split_string(pamh, motd_path_copy, ':', &motd_path_split, -+ &num_motd_paths) == 0) { -+ goto out; -+ } -+ } -+ -+ motd_dir_path_copy = strdup(motd_dir_path); -+ if (motd_dir_path_copy != NULL) { -+ if (pam_split_string(pamh, motd_dir_path_copy, ':', -+ &motd_dir_path_split, &num_motd_dir_paths) == 0) { -+ goto out; -+ } -+ } -+ -+ if (motd_path_split != NULL) { -+ int i; -+ -+ for (i = 0; i < num_motd_paths; i++) { -+ int fd = open(motd_path_split[i], O_RDONLY, 0); - -- if (fd >= 0) { -- try_to_display_fd(pamh, fd); -- close(fd); -+ if (fd >= 0) { -+ try_to_display_fd(pamh, fd); -+ close(fd); -+ -+ /* We found and displayed a file, move onto next filename. */ -+ break; -+ } - } - } - -- if (motd_dir_path != NULL) -- try_to_display_directory(pamh, motd_dir_path); -+ if (motd_dir_path_split != NULL) -+ try_to_display_directories_with_overrides(pamh, motd_dir_path_split, -+ num_motd_dir_paths); -+ -+ out: -+ _pam_drop(motd_path_copy); -+ _pam_drop(motd_path_split); -+ _pam_drop(motd_dir_path_copy); -+ _pam_drop(motd_dir_path_split); - - return retval; - } -diff -up Linux-PAM-1.3.1/xtests/Makefile.am.pam_motd-support-multiple-motd-paths1 Linux-PAM-1.3.1/xtests/Makefile.am ---- Linux-PAM-1.3.1/xtests/Makefile.am.pam_motd-support-multiple-motd-paths1 2017-02-10 11:10:15.000000000 +0100 -+++ Linux-PAM-1.3.1/xtests/Makefile.am 2022-04-25 12:32:36.947663225 +0200 -@@ -32,7 +32,10 @@ EXTRA_DIST = run-xtests.sh tst-pam_dispa - tst-pam_substack5.pamd tst-pam_substack5a.pamd tst-pam_substack5.sh \ - tst-pam_assemble_line1.pamd tst-pam_assemble_line1.sh \ - tst-pam_pwhistory1.pamd tst-pam_pwhistory1.sh \ -- tst-pam_time1.pamd time.conf -+ tst-pam_time1.pamd time.conf \ -+ tst-pam_motd.sh tst-pam_motd1.sh tst-pam_motd2.sh \ -+ tst-pam_motd3.sh tst-pam_motd1.pamd \ -+ tst-pam_motd2.pamd tst-pam_motd3.pamd - - XTESTS = tst-pam_dispatch1 tst-pam_dispatch2 tst-pam_dispatch3 \ - tst-pam_dispatch4 tst-pam_dispatch5 \ -@@ -41,7 +44,7 @@ XTESTS = tst-pam_dispatch1 tst-pam_dispa - tst-pam_access1 tst-pam_access2 tst-pam_access3 \ - tst-pam_access4 tst-pam_limits1 tst-pam_succeed_if1 \ - tst-pam_group1 tst-pam_authfail tst-pam_authsucceed \ -- tst-pam_pwhistory1 tst-pam_time1 -+ tst-pam_pwhistory1 tst-pam_time1 tst-pam_motd - - NOSRCTESTS = tst-pam_substack1 tst-pam_substack2 tst-pam_substack3 \ - tst-pam_substack4 tst-pam_substack5 tst-pam_assemble_line1 -diff -up Linux-PAM-1.3.1/xtests/tst-pam_motd1.pamd.pam_motd-support-multiple-motd-paths1 Linux-PAM-1.3.1/xtests/tst-pam_motd1.pamd ---- Linux-PAM-1.3.1/xtests/tst-pam_motd1.pamd.pam_motd-support-multiple-motd-paths1 2022-04-25 12:32:36.947663225 +0200 -+++ Linux-PAM-1.3.1/xtests/tst-pam_motd1.pamd 2022-04-25 12:32:36.947663225 +0200 -@@ -0,0 +1,3 @@ -+#%PAM-1.0 -+session required pam_permit.so -+session optional pam_motd.so motd=tst-pam_motd1.d/etc/motd motd_dir=tst-pam_motd1.d/etc/motd.d -diff -up Linux-PAM-1.3.1/xtests/tst-pam_motd1.sh.pam_motd-support-multiple-motd-paths1 Linux-PAM-1.3.1/xtests/tst-pam_motd1.sh ---- Linux-PAM-1.3.1/xtests/tst-pam_motd1.sh.pam_motd-support-multiple-motd-paths1 2022-04-25 12:32:36.947663225 +0200 -+++ Linux-PAM-1.3.1/xtests/tst-pam_motd1.sh 2022-04-25 12:32:36.947663225 +0200 -@@ -0,0 +1,36 @@ -+#!/bin/bash -+ -+TST_DIR="tst-pam_motd1.d" -+ -+function tst_cleanup() { -+ rm -rf "${TST_DIR}" -+ rm -f tst-pam_motd1.out -+} -+ -+mkdir -p ${TST_DIR} -+mkdir -p ${TST_DIR}/etc/motd.d -+ -+# Verify the case of single motd and motd.d directory works -+echo "motd: /etc/motd" > ${TST_DIR}/etc/motd -+echo "motd: /etc/motd.d/test" > ${TST_DIR}/etc/motd.d/test -+ -+./tst-pam_motd tst-pam_motd1 > tst-pam_motd1.out -+ -+RET=$? -+ -+motd_to_show_output=$(cat tst-pam_motd1.out | grep "motd: /etc/motd") -+if [ -z "${motd_to_show_output}" ]; -+then -+ tst_cleanup -+ exit 1 -+fi -+ -+motd_dir_to_show_output=$(cat tst-pam_motd1.out | grep "motd: /etc/motd.d/test") -+if [ -z "${motd_dir_to_show_output}" ]; -+then -+ tst_cleanup -+ exit 1 -+fi -+ -+tst_cleanup -+exit $RET -diff -up Linux-PAM-1.3.1/xtests/tst-pam_motd2.pamd.pam_motd-support-multiple-motd-paths1 Linux-PAM-1.3.1/xtests/tst-pam_motd2.pamd ---- Linux-PAM-1.3.1/xtests/tst-pam_motd2.pamd.pam_motd-support-multiple-motd-paths1 2022-04-25 12:32:36.947663225 +0200 -+++ Linux-PAM-1.3.1/xtests/tst-pam_motd2.pamd 2022-04-25 12:32:36.947663225 +0200 -@@ -0,0 +1,3 @@ -+#%PAM-1.0 -+session required pam_permit.so -+session optional pam_motd.so motd=tst-pam_motd2.d/etc/motd:tst-pam_motd2.d/run/motd:tst-pam_motd2.d/usr/lib/motd motd_dir=tst-pam_motd2.d/etc/motd.d:tst-pam_motd2.d/run/motd.d:tst-pam_motd2.d/usr/lib/motd.d -diff -up Linux-PAM-1.3.1/xtests/tst-pam_motd2.sh.pam_motd-support-multiple-motd-paths1 Linux-PAM-1.3.1/xtests/tst-pam_motd2.sh ---- Linux-PAM-1.3.1/xtests/tst-pam_motd2.sh.pam_motd-support-multiple-motd-paths1 2022-04-25 12:32:36.947663225 +0200 -+++ Linux-PAM-1.3.1/xtests/tst-pam_motd2.sh 2022-04-25 12:32:36.947663225 +0200 -@@ -0,0 +1,53 @@ -+#!/bin/bash -+ -+TST_DIR="tst-pam_motd2.d" -+ -+function tst_cleanup() { -+ rm -rf "${TST_DIR}" -+ rm -f tst-pam_motd2.out -+} -+ -+mkdir -p ${TST_DIR} -+mkdir -p ${TST_DIR}/etc/motd.d -+mkdir -p ${TST_DIR}/run/motd.d -+mkdir -p ${TST_DIR}/usr/lib/motd.d -+ -+echo "motd: /etc/motd" > ${TST_DIR}/etc/motd -+echo "motd: /run/motd" > ${TST_DIR}/run/motd -+echo "motd: /usr/lib/motd" > ${TST_DIR}/usr/lib/motd -+ -+# Drop a motd file in test directories such that every overriding -+# condition (for 3 directories in this case) will be seen. -+echo "motd: e0r0u1 in usr/lib - will show" > ${TST_DIR}/usr/lib/motd.d/e0r0u1.motd -+echo "motd: e0r1u0 in run - will show" > ${TST_DIR}/run/motd.d/e0r1u0.motd -+echo "motd: e0r1u1 in usr/lib - not show" > ${TST_DIR}/usr/lib/motd.d/e0r1u1.motd -+echo "motd: e0r1u1 in run - will show" > ${TST_DIR}/run/motd.d/e0r1u1.motd -+echo "motd: e1r0u0 in etc - will show" > ${TST_DIR}/etc/motd.d/e1r0u0.motd -+echo "motd: e1r0u1 in usr/lib - not show" > ${TST_DIR}/usr/lib/motd.d/e1r0u1.motd -+echo "motd: e1r0u1 in etc - will show" > ${TST_DIR}/etc/motd.d/e1r0u1.motd -+echo "motd: e1r1u0 in run - not show" > ${TST_DIR}/run/motd.d/e1r1u0.motd -+echo "motd: e1r1u0 in etc - will show" > ${TST_DIR}/etc/motd.d/e1r1u0.motd -+echo "motd: e1r1u1 in usr/lib - not show" > ${TST_DIR}/usr/lib/motd.d/e1r1u1.motd -+echo "motd: e1r1u1 in run - not show" > ${TST_DIR}/run/motd.d/e1r1u1.motd -+echo "motd: e1r1u1 in etc - will show" > ${TST_DIR}/etc/motd.d/e1r1u1.motd -+ -+./tst-pam_motd tst-pam_motd2 > tst-pam_motd2.out -+ -+RET=$? -+ -+motd_to_show_output=$(cat tst-pam_motd2.out | grep "motd: /etc/motd") -+if [ -z "${motd_to_show_output}" ]; -+then -+ tst_cleanup -+ exit 1 -+fi -+ -+motd_dir_not_show_output=$(cat tst-pam_motd2.out | grep "not show") -+if [ -n "${motd_dir_not_show_output}" ]; -+then -+ tst_cleanup -+ exit 1 -+fi -+ -+tst_cleanup -+exit $RET -diff -up Linux-PAM-1.3.1/xtests/tst-pam_motd3.pamd.pam_motd-support-multiple-motd-paths1 Linux-PAM-1.3.1/xtests/tst-pam_motd3.pamd ---- Linux-PAM-1.3.1/xtests/tst-pam_motd3.pamd.pam_motd-support-multiple-motd-paths1 2022-04-25 12:32:36.947663225 +0200 -+++ Linux-PAM-1.3.1/xtests/tst-pam_motd3.pamd 2022-04-25 12:32:36.947663225 +0200 -@@ -0,0 +1,3 @@ -+#%PAM-1.0 -+session required pam_permit.so -+session optional pam_motd.so motd=tst-pam_motd3.d/etc/motd:tst-pam_motd3.d/run/motd:tst-pam_motd3.d/usr/lib/motd motd_dir=tst-pam_motd3.d/etc/motd.d:tst-pam_motd3.d/run/motd.d:tst-pam_motd3.d/usr/lib/motd.d -diff -up Linux-PAM-1.3.1/xtests/tst-pam_motd3.sh.pam_motd-support-multiple-motd-paths1 Linux-PAM-1.3.1/xtests/tst-pam_motd3.sh ---- Linux-PAM-1.3.1/xtests/tst-pam_motd3.sh.pam_motd-support-multiple-motd-paths1 2022-04-25 12:32:36.947663225 +0200 -+++ Linux-PAM-1.3.1/xtests/tst-pam_motd3.sh 2022-04-25 12:32:36.947663225 +0200 -@@ -0,0 +1,53 @@ -+#!/bin/bash -+ -+TST_DIR="tst-pam_motd3.d" -+ -+function tst_cleanup() { -+ rm -rf "${TST_DIR}" -+ rm -f tst-pam_motd3.out -+} -+ -+mkdir -p ${TST_DIR} -+mkdir -p ${TST_DIR}/etc/motd.d -+mkdir -p ${TST_DIR}/run/motd.d -+mkdir -p ${TST_DIR}/usr/lib/motd.d -+ -+# Verify motd is still displayed when not overridden -+echo "motd: test-show in run - show" > ${TST_DIR}/run/motd.d/test-show.motd -+ -+# Test overridden by a symlink to a file that isn't /dev/null; symlink target should show -+echo "motd: hidden-by-symlink in usr/lib - not show" > ${TST_DIR}/usr/lib/motd.d/hidden-by-symlink.motd -+echo "motd: test-from-symlink - show" > ${TST_DIR}/test-from-symlink.motd -+ln -sr ${TST_DIR}/test-from-symlink.motd ${TST_DIR}/run/motd.d/hidden-by-symlink.motd -+ -+# Test hidden by a null symlink -+echo "motd: hidden-by-null-symlink in run - not show" > ${TST_DIR}/run/motd.d/hidden-by-null-symlink.motd -+ln -s /dev/null ${TST_DIR}/etc/motd.d/hidden-by-null-symlink.motd -+ -+./tst-pam_motd tst-pam_motd3 > tst-pam_motd3.out -+ -+RET=$? -+ -+motd_dir_not_show_output=$(cat tst-pam_motd3.out | grep "not show") -+if [ -n "${motd_dir_not_show_output}" ]; -+then -+ tst_cleanup -+ exit 1 -+fi -+ -+motd_test_show_output=$(cat tst-pam_motd3.out | grep "test-show.*- show") -+if [ -z "${motd_test_show_output}" ]; -+then -+ tst_cleanup -+ exit 1 -+fi -+ -+motd_general_symlink_show_output=$(cat tst-pam_motd3.out | grep "test-from-symlink.*- show") -+if [ -z "${motd_general_symlink_show_output}" ]; -+then -+ tst_cleanup -+ exit 1 -+fi -+ -+tst_cleanup -+exit $RET -diff -up Linux-PAM-1.3.1/xtests/tst-pam_motd.c.pam_motd-support-multiple-motd-paths1 Linux-PAM-1.3.1/xtests/tst-pam_motd.c ---- Linux-PAM-1.3.1/xtests/tst-pam_motd.c.pam_motd-support-multiple-motd-paths1 2022-04-25 12:32:36.947663225 +0200 -+++ Linux-PAM-1.3.1/xtests/tst-pam_motd.c 2022-04-25 12:32:36.947663225 +0200 -@@ -0,0 +1,69 @@ -+/* -+ * Redistribution and use in source and binary forms, with or without -+ * modification, are permitted provided that the following conditions -+ * are met: -+ * 1. Redistributions of source code must retain the above copyright -+ * notice, and the entire permission notice in its entirety, -+ * including the disclaimer of warranties. -+ * 2. Redistributions in binary form must reproduce the above copyright -+ * notice, this list of conditions and the following disclaimer in the -+ * documentation and/or other materials provided with the distribution. -+ * 3. The name of the author may not be used to endorse or promote -+ * products derived from this software without specific prior -+ * written permission. -+ * -+ * ALTERNATIVELY, this product may be distributed under the terms of -+ * the GNU Public License, in which case the provisions of the GPL are -+ * required INSTEAD OF the above restrictions. (This clause is -+ * necessary due to a potential bad interaction between the GPL and -+ * the restrictions contained in a BSD-style copyright.) -+ * -+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED -+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES -+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -+ * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, -+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR -+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) -+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, -+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) -+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED -+ * OF THE POSSIBILITY OF SUCH DAMAGE. -+ */ -+ -+#ifdef HAVE_CONFIG_H -+#include -+#endif -+ -+#include -+#include -+#include -+#include -+ -+static struct pam_conv conv = { -+ misc_conv, -+ NULL -+}; -+ -+int main(int argc, char *argv[]) -+{ -+ pam_handle_t *pamh=NULL; -+ char *tst_arg = NULL; -+ int retval; -+ -+ if (argc > 1) -+ tst_arg = argv[1]; -+ -+ retval = pam_start(tst_arg, NULL, &conv, &pamh); -+ -+ retval = pam_open_session(pamh, 0); -+ -+ retval = pam_close_session(pamh, 0); -+ -+ if (pam_end(pamh,retval) != PAM_SUCCESS) { /* close Linux-PAM */ -+ pamh = NULL; -+ exit(1); -+ } -+ -+ return ( retval == PAM_SUCCESS ? 0:1 ); /* indicate success */ -+} -diff -up Linux-PAM-1.3.1/xtests/tst-pam_motd.sh.pam_motd-support-multiple-motd-paths1 Linux-PAM-1.3.1/xtests/tst-pam_motd.sh ---- Linux-PAM-1.3.1/xtests/tst-pam_motd.sh.pam_motd-support-multiple-motd-paths1 2022-04-25 12:32:36.947663225 +0200 -+++ Linux-PAM-1.3.1/xtests/tst-pam_motd.sh 2022-04-25 12:32:36.947663225 +0200 -@@ -0,0 +1,7 @@ -+#!/bin/bash -+ -+set -e -+ -+./tst-pam_motd1.sh -+./tst-pam_motd2.sh -+./tst-pam_motd3.sh diff --git a/SOURCES/pam-1.3.1-pam-pwhistory-load-conf-from-file.patch b/SOURCES/pam-1.3.1-pam-pwhistory-load-conf-from-file.patch deleted file mode 100644 index 35e3d94..0000000 --- a/SOURCES/pam-1.3.1-pam-pwhistory-load-conf-from-file.patch +++ /dev/null @@ -1,573 +0,0 @@ -diff -up Linux-PAM-1.3.1/modules/pam_pwhistory/Makefile.am.pam-pwhistory-load-conf-from-file Linux-PAM-1.3.1/modules/pam_pwhistory/Makefile.am ---- Linux-PAM-1.3.1/modules/pam_pwhistory/Makefile.am.pam-pwhistory-load-conf-from-file 2022-09-29 10:13:35.709355179 +0200 -+++ Linux-PAM-1.3.1/modules/pam_pwhistory/Makefile.am 2022-09-29 10:13:35.780355766 +0200 -@@ -10,9 +10,10 @@ EXTRA_DIST = README $(MANS) $(XMLS) tst- - - TESTS = tst-pam_pwhistory - --man_MANS = pam_pwhistory.8 pwhistory_helper.8 -+man_MANS = pam_pwhistory.8 pwhistory_helper.8 pwhistory.conf.5 - --XMLS = README.xml pam_pwhistory.8.xml pwhistory_helper.8.xml -+XMLS = README.xml pam_pwhistory.8.xml pwhistory_helper.8.xml \ -+ pwhistory.conf.5.xml - - securelibdir = $(SECUREDIR) - secureconfdir = $(SCONFIGDIR) -@@ -25,12 +26,14 @@ if HAVE_VERSIONING - pam_pwhistory_la_LDFLAGS += -Wl,--version-script=$(srcdir)/../modules.map - endif - --noinst_HEADERS = opasswd.h -+noinst_HEADERS = opasswd.h pwhistory_config.h -+ -+dist_secureconf_DATA = pwhistory.conf - - securelib_LTLIBRARIES = pam_pwhistory.la - pam_pwhistory_la_CFLAGS = $(AM_CFLAGS) - pam_pwhistory_la_LIBADD = $(top_builddir)/libpam/libpam.la @LIBCRYPT@ @LIBSELINUX@ --pam_pwhistory_la_SOURCES = pam_pwhistory.c opasswd.c -+pam_pwhistory_la_SOURCES = pam_pwhistory.c opasswd.c pwhistory_config.c - - sbin_PROGRAMS = pwhistory_helper - pwhistory_helper_CFLAGS = $(AM_CFLAGS) -DHELPER_COMPILE=\"pwhistory_helper\" @PIE_CFLAGS@ -diff -up Linux-PAM-1.3.1/modules/pam_pwhistory/pam_pwhistory.8.xml.pam-pwhistory-load-conf-from-file Linux-PAM-1.3.1/modules/pam_pwhistory/pam_pwhistory.8.xml ---- Linux-PAM-1.3.1/modules/pam_pwhistory/pam_pwhistory.8.xml.pam-pwhistory-load-conf-from-file 2017-02-10 11:10:15.000000000 +0100 -+++ Linux-PAM-1.3.1/modules/pam_pwhistory/pam_pwhistory.8.xml 2022-09-29 10:13:35.780355766 +0200 -@@ -36,6 +36,9 @@ - - authtok_type=STRING - -+ -+ conf=/path/to/config-file -+ - - - -@@ -104,7 +107,7 @@ - - - The last N passwords for each -- user are saved in /etc/security/opasswd. -+ user are saved. - The default is 10. Value of - 0 makes the module to keep the existing - contents of the opasswd file unchanged. -@@ -137,7 +140,26 @@ - - - -+ -+ -+ -+ -+ -+ -+ Use another configuration file instead of the default -+ /etc/security/pwhistory.conf. -+ -+ -+ -+ - -+ -+ The options for configuring the module behavior are described in the -+ pwhistory.conf -+ 5 manual page. The options -+ specified on the module command line override the values from the -+ configuration file. -+ - - - -@@ -223,6 +245,9 @@ password required pam_unix.so - SEE ALSO - - -+ pwhistory.conf5 -+ , -+ - pam.conf5 - , - -diff -up Linux-PAM-1.3.1/modules/pam_pwhistory/pam_pwhistory.c.pam-pwhistory-load-conf-from-file Linux-PAM-1.3.1/modules/pam_pwhistory/pam_pwhistory.c ---- Linux-PAM-1.3.1/modules/pam_pwhistory/pam_pwhistory.c.pam-pwhistory-load-conf-from-file 2022-09-29 10:13:35.711355195 +0200 -+++ Linux-PAM-1.3.1/modules/pam_pwhistory/pam_pwhistory.c 2022-09-29 10:13:35.780355766 +0200 -@@ -62,18 +62,11 @@ - #include - - #include "opasswd.h" -+#include "pwhistory_config.h" - - #define DEFAULT_BUFLEN 2048 - #define MAX_FD_NO 20000 - --struct options_t { -- int debug; -- int enforce_for_root; -- int remember; -- int tries; --}; --typedef struct options_t options_t; -- - - static void - parse_option (pam_handle_t *pamh, const char *argv, options_t *options) -@@ -304,6 +297,8 @@ pam_sm_chauthtok (pam_handle_t *pamh, in - options.remember = 10; - options.tries = 1; - -+ parse_config_file(pamh, argc, argv, &options); -+ - /* Parse parameters for module */ - for ( ; argc-- > 0; argv++) - parse_option (pamh, *argv, &options); -@@ -311,7 +306,6 @@ pam_sm_chauthtok (pam_handle_t *pamh, in - if (options.debug) - pam_syslog (pamh, LOG_DEBUG, "pam_sm_chauthtok entered"); - -- - if (options.remember == 0) - return PAM_IGNORE; - -diff -up Linux-PAM-1.3.1/modules/pam_pwhistory/pwhistory.conf.5.xml.pam-pwhistory-load-conf-from-file Linux-PAM-1.3.1/modules/pam_pwhistory/pwhistory.conf.5.xml ---- Linux-PAM-1.3.1/modules/pam_pwhistory/pwhistory.conf.5.xml.pam-pwhistory-load-conf-from-file 2022-09-29 10:13:35.780355766 +0200 -+++ Linux-PAM-1.3.1/modules/pam_pwhistory/pwhistory.conf.5.xml 2022-09-29 10:13:35.780355766 +0200 -@@ -0,0 +1,155 @@ -+ -+ -+ -+ -+ -+ -+ pwhistory.conf -+ 5 -+ Linux-PAM Manual -+ -+ -+ -+ pwhistory.conf -+ pam_pwhistory configuration file -+ -+ -+ -+ -+ DESCRIPTION -+ -+ pwhistory.conf provides a way to configure the -+ default settings for saving the last passwords for each user. -+ This file is read by the pam_pwhistory module and is the -+ preferred method over configuring pam_pwhistory directly. -+ -+ -+ The file has a very simple name = value format with possible comments -+ starting with # character. The whitespace at the beginning of line, end -+ of line, and around the = sign is ignored. -+ -+ -+ -+ -+ -+ OPTIONS -+ -+ -+ -+ -+ -+ -+ -+ Turns on debugging via -+ -+ syslog3 -+ . -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ If this option is set, the check is enforced for root, too. -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ The last N passwords for each -+ user are saved. -+ The default is 10. Value of -+ 0 makes the module to keep the existing -+ contents of the opasswd file unchanged. -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ Prompt user at most N times -+ before returning with error. The default is 1. -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ Store password history in file -+ /path/filename rather than the default -+ location. The default location is -+ /etc/security/opasswd. -+ -+ -+ -+ -+ -+ -+ -+ EXAMPLES -+ -+ /etc/security/pwhistory.conf file example: -+ -+ -+debug -+remember=5 -+file=/tmp/opasswd -+ -+ -+ -+ -+ FILES -+ -+ -+ /etc/security/pwhistory.conf -+ -+ the config file for custom options -+ -+ -+ -+ -+ -+ -+ SEE ALSO -+ -+ -+ pwhistory8 -+ , -+ -+ pam_pwhistory8 -+ , -+ -+ pam.conf5 -+ , -+ -+ pam.d5 -+ , -+ -+ pam8 -+ -+ -+ -+ -+ -+ AUTHOR -+ -+ pam_pwhistory was written by Thorsten Kukuk. The support for -+ pwhistory.conf was written by Iker Pedrosa. -+ -+ -+ -+ -diff -up Linux-PAM-1.3.1/modules/pam_pwhistory/pwhistory_config.c.pam-pwhistory-load-conf-from-file Linux-PAM-1.3.1/modules/pam_pwhistory/pwhistory_config.c ---- Linux-PAM-1.3.1/modules/pam_pwhistory/pwhistory_config.c.pam-pwhistory-load-conf-from-file 2022-09-29 10:13:35.781355775 +0200 -+++ Linux-PAM-1.3.1/modules/pam_pwhistory/pwhistory_config.c 2022-09-29 10:14:33.377832622 +0200 -@@ -0,0 +1,195 @@ -+/* -+ * Copyright (c) 2022 Iker Pedrosa -+ * -+ * Redistribution and use in source and binary forms, with or without -+ * modification, are permitted provided that the following conditions -+ * are met: -+ * 1. Redistributions of source code must retain the above copyright -+ * notice, and the entire permission notice in its entirety, -+ * including the disclaimer of warranties. -+ * 2. Redistributions in binary form must reproduce the above copyright -+ * notice, this list of conditions and the following disclaimer in the -+ * documentation and/or other materials provided with the distribution. -+ * 3. The name of the author may not be used to endorse or promote -+ * products derived from this software without specific prior -+ * written permission. -+ * -+ * ALTERNATIVELY, this product may be distributed under the terms of -+ * the GNU Public License, in which case the provisions of the GPL are -+ * required INSTEAD OF the above restrictions. (This clause is -+ * necessary due to a potential bad interaction between the GPL and -+ * the restrictions contained in a BSD-style copyright.) -+ * -+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED -+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES -+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -+ * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, -+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR -+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) -+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, -+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) -+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED -+ * OF THE POSSIBILITY OF SUCH DAMAGE. -+ */ -+ -+#include "config.h" -+ -+#include -+#include -+#include -+#include -+#include -+ -+#include -+ -+#include "pam_inline.h" -+#include "pwhistory_config.h" -+ -+#define PWHISTORY_DEFAULT_CONF "/etc/security/pwhistory.conf" -+ -+/* lookup a value for key in login.defs file or similar key value format */ -+static char * -+pwhistory_search_key(pam_handle_t *pamh UNUSED, -+ const char *file_name, -+ const char *key) -+{ -+ FILE *fp; -+ char *buf = NULL; -+ size_t buflen = 0; -+ char *retval = NULL; -+ -+#ifdef USE_ECONF -+ if (strcmp (file_name, LOGIN_DEFS) == 0) -+ return econf_search_key ("login", ".defs", key); -+#endif -+ -+ fp = fopen(file_name, "r"); -+ if (NULL == fp) -+ return NULL; -+ -+ while (!feof(fp)) { -+ char *tmp, *cp; -+#if defined(HAVE_GETLINE) -+ ssize_t n = getline(&buf, &buflen, fp); -+#elif defined (HAVE_GETDELIM) -+ ssize_t n = getdelim(&buf, &buflen, '\n', fp); -+#else -+ ssize_t n; -+ -+ if (buf == NULL) { -+ buflen = BUF_SIZE; -+ buf = malloc(buflen); -+ if (buf == NULL) { -+ fclose(fp); -+ return NULL; -+ } -+ } -+ buf[0] = '\0'; -+ if (fgets(buf, buflen - 1, fp) == NULL) -+ break; -+ else if (buf != NULL) -+ n = strlen(buf); -+ else -+ n = 0; -+#endif /* HAVE_GETLINE / HAVE_GETDELIM */ -+ cp = buf; -+ -+ if (n < 1) -+ break; -+ if (cp[n - 1] == '\n') -+ cp[n - 1] = '\0'; -+ -+ tmp = strchr(cp, '#'); /* remove comments */ -+ if (tmp) -+ *tmp = '\0'; -+ while (isspace((int)*cp)) /* remove spaces and tabs */ -+ ++cp; -+ if (*cp == '\0') /* ignore empty lines */ -+ continue; -+ -+ tmp = strsep (&cp, " \t="); -+ if (cp != NULL) -+ while (isspace((int)*cp) || *cp == '=') -+ ++cp; -+ else -+ cp = buf + n; /* empty string */ -+ -+ if (strcasecmp(tmp, key) == 0) { -+ retval = strdup(cp); -+ break; -+ } -+ } -+ fclose(fp); -+ -+ free(buf); -+ -+ return retval; -+} -+ -+void -+parse_config_file(pam_handle_t *pamh, int argc, const char **argv, -+ struct options_t *options) -+{ -+ const char *fname = NULL; -+ int i; -+ char *val; -+ -+ for (i = 0; i < argc; ++i) { -+ const char *str = pam_str_skip_prefix(argv[i], "conf="); -+ -+ if (str != NULL) { -+ fname = str; -+ } -+ } -+ -+ if (fname == NULL) { -+ fname = PWHISTORY_DEFAULT_CONF; -+ } -+ -+ val = pwhistory_search_key (pamh, fname, "debug"); -+ if (val != NULL) { -+ options->debug = 1; -+ free(val); -+ } -+ -+ val = pwhistory_search_key (pamh, fname, "enforce_for_root"); -+ if (val != NULL) { -+ options->enforce_for_root = 1; -+ free(val); -+ } -+ -+ val = pwhistory_search_key (pamh, fname, "remember"); -+ if (val != NULL) { -+ unsigned int temp; -+ if (sscanf(val, "%u", &temp) != 1) { -+ pam_syslog(pamh, LOG_ERR, -+ "Bad number supplied for remember argument"); -+ } else { -+ options->remember = temp; -+ } -+ free(val); -+ } -+ -+ val = pwhistory_search_key (pamh, fname, "retry"); -+ if (val != NULL) { -+ unsigned int temp; -+ if (sscanf(val, "%u", &temp) != 1) { -+ pam_syslog(pamh, LOG_ERR, -+ "Bad number supplied for retry argument"); -+ } else { -+ options->tries = temp; -+ } -+ free(val); -+ } -+ -+ val = pwhistory_search_key (pamh, fname, "file"); -+ if (val != NULL) { -+ if (*val != '/') { -+ pam_syslog (pamh, LOG_ERR, -+ "File path should be absolute: %s", val); -+ } else { -+ options->filename = val; -+ } -+ } -+} -diff -up Linux-PAM-1.3.1/modules/pam_pwhistory/pwhistory_config.h.pam-pwhistory-load-conf-from-file Linux-PAM-1.3.1/modules/pam_pwhistory/pwhistory_config.h ---- Linux-PAM-1.3.1/modules/pam_pwhistory/pwhistory_config.h.pam-pwhistory-load-conf-from-file 2022-09-29 10:13:35.781355775 +0200 -+++ Linux-PAM-1.3.1/modules/pam_pwhistory/pwhistory_config.h 2022-09-29 10:13:35.781355775 +0200 -@@ -0,0 +1,54 @@ -+/* -+ * Copyright (c) 2022 Iker Pedrosa -+ * -+ * Redistribution and use in source and binary forms, with or without -+ * modification, are permitted provided that the following conditions -+ * are met: -+ * 1. Redistributions of source code must retain the above copyright -+ * notice, and the entire permission notice in its entirety, -+ * including the disclaimer of warranties. -+ * 2. Redistributions in binary form must reproduce the above copyright -+ * notice, this list of conditions and the following disclaimer in the -+ * documentation and/or other materials provided with the distribution. -+ * 3. The name of the author may not be used to endorse or promote -+ * products derived from this software without specific prior -+ * written permission. -+ * -+ * ALTERNATIVELY, this product may be distributed under the terms of -+ * the GNU Public License, in which case the provisions of the GPL are -+ * required INSTEAD OF the above restrictions. (This clause is -+ * necessary due to a potential bad interaction between the GPL and -+ * the restrictions contained in a BSD-style copyright.) -+ * -+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED -+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES -+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -+ * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, -+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR -+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) -+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, -+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) -+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED -+ * OF THE POSSIBILITY OF SUCH DAMAGE. -+ */ -+ -+#ifndef _PWHISTORY_CONFIG_H -+#define _PWHISTORY_CONFIG_H -+ -+#include -+ -+struct options_t { -+ int debug; -+ int enforce_for_root; -+ int remember; -+ int tries; -+ const char *filename; -+}; -+typedef struct options_t options_t; -+ -+void -+parse_config_file(pam_handle_t *pamh, int argc, const char **argv, -+ struct options_t *options); -+ -+#endif /* _PWHISTORY_CONFIG_H */ -diff -up Linux-PAM-1.3.1/modules/pam_pwhistory/pwhistory.conf.pam-pwhistory-load-conf-from-file Linux-PAM-1.3.1/modules/pam_pwhistory/pwhistory.conf ---- Linux-PAM-1.3.1/modules/pam_pwhistory/pwhistory.conf.pam-pwhistory-load-conf-from-file 2022-09-29 10:13:35.781355775 +0200 -+++ Linux-PAM-1.3.1/modules/pam_pwhistory/pwhistory.conf 2022-09-29 10:13:35.781355775 +0200 -@@ -0,0 +1,21 @@ -+# Configuration for remembering the last passwords used by a user. -+# -+# Enable the debugging logs. -+# Enabled if option is present. -+# debug -+# -+# root account's passwords are also remembered. -+# Enabled if option is present. -+# enforce_for_root -+# -+# Number of passwords to remember. -+# The default is 10. -+# remember = 10 -+# -+# Number of times to prompt for the password. -+# The default is 1. -+# retry = 1 -+# -+# The directory where the last passwords are kept. -+# The default is /etc/security/opasswd. -+# file = /etc/security/opasswd diff --git a/SOURCES/pam-1.3.1-pam-unix-shadow-password.patch b/SOURCES/pam-1.3.1-pam-unix-shadow-password.patch deleted file mode 100644 index bf183e5..0000000 --- a/SOURCES/pam-1.3.1-pam-unix-shadow-password.patch +++ /dev/null @@ -1,47 +0,0 @@ -diff -up Linux-PAM-1.3.1/modules/pam_unix/passverify.c.pam-unix-shadow-password Linux-PAM-1.3.1/modules/pam_unix/passverify.c ---- Linux-PAM-1.3.1/modules/pam_unix/passverify.c.pam-unix-shadow-password 2024-11-05 13:02:14.637785962 +0100 -+++ Linux-PAM-1.3.1/modules/pam_unix/passverify.c 2024-11-05 13:02:14.643785975 +0100 -@@ -73,9 +73,13 @@ verify_pwd_hash(const char *p, char *has - - strip_hpux_aging(hash); - hash_len = strlen(hash); -- if (!hash_len) { -+ -+ if (p && p[0] == '\0' && !nullok) { -+ /* The passed password is empty */ -+ retval = PAM_AUTH_ERR; -+ } else if (!hash_len) { - /* the stored password is NULL */ -- if (nullok) { /* this means we've succeeded */ -+ if (p && p[0] == '\0' && nullok) { /* this means we've succeeded */ - D(("user has empty password - access granted")); - retval = PAM_SUCCESS; - } else { -@@ -192,17 +196,21 @@ PAMH_ARG_DECL(int get_account_info, - return PAM_UNIX_RUN_HELPER; - #endif - } else if (is_pwd_shadowed(*pwd)) { -+#ifdef HELPER_COMPILE - /* -- * ...and shadow password file entry for this user, -+ * shadow password file entry for this user, - * if shadowing is enabled - */ --#ifndef HELPER_COMPILE -- if (geteuid() || SELINUX_ENABLED) -- return PAM_UNIX_RUN_HELPER; --#endif -- *spwdent = pam_modutil_getspnam(pamh, name); -+ *spwdent = getspnam(name); - if (*spwdent == NULL || (*spwdent)->sp_pwdp == NULL) - return PAM_AUTHINFO_UNAVAIL; -+#else -+ /* -+ * The helper has to be invoked to deal with -+ * the shadow password file entry. -+ */ -+ return PAM_UNIX_RUN_HELPER; -+#endif - } - } else { - return PAM_USER_UNKNOWN; diff --git a/SOURCES/pam-1.3.1-pam-userdb-prevent-garbage-characters-from-db.patch b/SOURCES/pam-1.3.1-pam-userdb-prevent-garbage-characters-from-db.patch deleted file mode 100644 index 37b3e72..0000000 --- a/SOURCES/pam-1.3.1-pam-userdb-prevent-garbage-characters-from-db.patch +++ /dev/null @@ -1,111 +0,0 @@ -From a7453aeeb398d6cbb7a709c4e2a1d75905220fff Mon Sep 17 00:00:00 2001 -From: Stanislav Zidek -Date: Fri, 16 Apr 2021 19:14:18 +0200 -Subject: [PATCH] pam_userdb: Prevent garbage characters from db - -Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1791965 ---- - modules/pam_userdb/pam_userdb.8.xml | 3 +- - modules/pam_userdb/pam_userdb.c | 56 +++++++++++++++++------------ - 2 files changed, 36 insertions(+), 23 deletions(-) - -diff --git a/modules/pam_userdb/pam_userdb.8.xml b/modules/pam_userdb/pam_userdb.8.xml -index fa628ada..bce92850 100644 ---- a/modules/pam_userdb/pam_userdb.8.xml -+++ b/modules/pam_userdb/pam_userdb.8.xml -@@ -100,7 +100,8 @@ - - - -- Print debug information. -+ Print debug information. Note that password hashes, both from db -+ and computed, will be printed to syslog. - - - -diff --git a/modules/pam_userdb/pam_userdb.c b/modules/pam_userdb/pam_userdb.c -index dc2ca232..d59801bf 100644 ---- a/modules/pam_userdb/pam_userdb.c -+++ b/modules/pam_userdb/pam_userdb.c -@@ -194,7 +194,7 @@ user_lookup (pam_handle_t *pamh, const char *database, const char *cryptmode, - } - - if (data.dptr != NULL) { -- int compare = 0; -+ int compare = -2; - - if (ctrl & PAM_KEY_ONLY_ARG) - { -@@ -209,36 +209,48 @@ user_lookup (pam_handle_t *pamh, const char *database, const char *cryptmode, - char *cryptpw = NULL; - - if (data.dsize < 13) { -- compare = -2; -+ /* hash is too short */ -+ pam_syslog(pamh, LOG_INFO, "password hash in database is too short"); - } else if (ctrl & PAM_ICASE_ARG) { -- compare = -2; -+ pam_syslog(pamh, LOG_INFO, -+ "case-insensitive comparison only works with plaintext passwords"); - } else { -+ /* libdb is not guaranteed to produce null terminated strings */ -+ char *pwhash = strndup(data.dptr, data.dsize); -+ -+ if (pwhash == NULL) { -+ pam_syslog(pamh, LOG_CRIT, "strndup failed: data.dptr"); -+ } else { - #ifdef HAVE_CRYPT_R -- struct crypt_data *cdata = NULL; -- cdata = malloc(sizeof(*cdata)); -- if (cdata != NULL) { -- cdata->initialized = 0; -- cryptpw = crypt_r(pass, data.dptr, cdata); -- } -+ struct crypt_data *cdata = NULL; -+ cdata = malloc(sizeof(*cdata)); -+ if (cdata == NULL) { -+ pam_syslog(pamh, LOG_CRIT, "malloc failed: struct crypt_data"); -+ } else { -+ cdata->initialized = 0; -+ cryptpw = crypt_r(pass, pwhash, cdata); -+ } - #else -- cryptpw = crypt (pass, data.dptr); -+ cryptpw = crypt (pass, pwhash); - #endif -- if (cryptpw && strlen(cryptpw) == (size_t)data.dsize) { -- compare = memcmp(data.dptr, cryptpw, data.dsize); -- } else { -- compare = -2; -- if (ctrl & PAM_DEBUG_ARG) { -- if (cryptpw) -- pam_syslog(pamh, LOG_INFO, "lengths of computed and stored hashes differ"); -- else -- pam_syslog(pamh, LOG_INFO, "crypt() returned NULL"); -+ if (cryptpw && strlen(cryptpw) == (size_t)data.dsize) { -+ compare = memcmp(data.dptr, cryptpw, data.dsize); -+ } else { -+ if (ctrl & PAM_DEBUG_ARG) { -+ if (cryptpw) { -+ pam_syslog(pamh, LOG_INFO, "lengths of computed and stored hashes differ"); -+ pam_syslog(pamh, LOG_INFO, "computed hash: %s", cryptpw); -+ } else { -+ pam_syslog(pamh, LOG_ERR, "crypt() returned NULL"); -+ } -+ } - } -- } - #ifdef HAVE_CRYPT_R -- free(cdata); -+ free(cdata); - #endif -+ } -+ free(pwhash); - } -- - } else { - - /* Unknown password encryption method - --- -2.30.2 - diff --git a/SOURCES/pam-1.3.1-pam-usertype-SYS_UID_MAX.patch b/SOURCES/pam-1.3.1-pam-usertype-SYS_UID_MAX.patch deleted file mode 100644 index 4881a5e..0000000 --- a/SOURCES/pam-1.3.1-pam-usertype-SYS_UID_MAX.patch +++ /dev/null @@ -1,75 +0,0 @@ -diff -up Linux-PAM-1.3.1/configure.ac.pam-usertype-SYS_UID_MAX Linux-PAM-1.3.1/configure.ac ---- Linux-PAM-1.3.1/configure.ac.pam-usertype-SYS_UID_MAX 2022-06-22 16:41:09.169146826 +0200 -+++ Linux-PAM-1.3.1/configure.ac 2022-06-22 16:43:54.343373619 +0200 -@@ -615,12 +615,6 @@ if test x"$opt_uidmin" == x; then - fi - AC_DEFINE_UNQUOTED(PAM_USERTYPE_UIDMIN, $opt_uidmin, [Minimum regular user uid.]) - --AC_ARG_WITH([sysuidmin], AS_HELP_STRING([--with-sysuidmin=],[default value for system user min uid (101)]), opt_sysuidmin=$withval) --if test x"$opt_sysuidmin" == x; then -- opt_sysuidmin=101 --fi --AC_DEFINE_UNQUOTED(PAM_USERTYPE_SYSUIDMIN, $opt_sysuidmin, [Minimum system user uid.]) -- - AC_ARG_WITH([kerneloverflowuid], AS_HELP_STRING([--with-kernel-overflow-uid=],[kernel overflow uid, default (uint16_t)-2=65534]), opt_kerneloverflowuid=$withval) - if test x"$opt_kerneloverflowuid" == x; then - opt_kerneloverflowuid=65534 -diff -up Linux-PAM-1.3.1/modules/pam_usertype/pam_usertype.8.xml.pam-usertype-SYS_UID_MAX Linux-PAM-1.3.1/modules/pam_usertype/pam_usertype.8.xml ---- Linux-PAM-1.3.1/modules/pam_usertype/pam_usertype.8.xml.pam-usertype-SYS_UID_MAX 2022-06-22 16:41:09.155146722 +0200 -+++ Linux-PAM-1.3.1/modules/pam_usertype/pam_usertype.8.xml 2022-06-22 16:41:09.169146826 +0200 -@@ -31,7 +31,7 @@ - pam_usertype.so is designed to succeed or fail authentication - based on type of the account of the authenticated user. - The type of the account is decided with help of -- SYS_UID_MIN and SYS_UID_MAX -+ SYS_UID_MAX - settings in /etc/login.defs. One use is to select - whether to load other modules based on this test. - -diff -up Linux-PAM-1.3.1/modules/pam_usertype/pam_usertype.c.pam-usertype-SYS_UID_MAX Linux-PAM-1.3.1/modules/pam_usertype/pam_usertype.c ---- Linux-PAM-1.3.1/modules/pam_usertype/pam_usertype.c.pam-usertype-SYS_UID_MAX 2022-06-22 16:41:09.155146722 +0200 -+++ Linux-PAM-1.3.1/modules/pam_usertype/pam_usertype.c 2022-06-22 16:41:09.169146826 +0200 -@@ -277,7 +277,6 @@ static int - pam_usertype_is_system(pam_handle_t *pamh, uid_t uid) - { - uid_t uid_min; -- uid_t sys_min; - uid_t sys_max; - - if (uid == (uid_t)-1) { -@@ -285,21 +284,19 @@ pam_usertype_is_system(pam_handle_t *pam - return PAM_USER_UNKNOWN; - } - -- if (uid <= 99) { -- /* Reserved. */ -- return PAM_SUCCESS; -- } -- - if (uid == PAM_USERTYPE_OVERFLOW_UID) { - /* nobody */ - return PAM_SUCCESS; - } - - uid_min = pam_usertype_get_id(pamh, "UID_MIN", PAM_USERTYPE_UIDMIN); -- sys_min = pam_usertype_get_id(pamh, "SYS_UID_MIN", PAM_USERTYPE_SYSUIDMIN); - sys_max = pam_usertype_get_id(pamh, "SYS_UID_MAX", uid_min - 1); - -- return uid >= sys_min && uid <= sys_max ? PAM_SUCCESS : PAM_AUTH_ERR; -+ if (uid <= sys_max && uid < uid_min) { -+ return PAM_SUCCESS; -+ } -+ -+ return PAM_AUTH_ERR; - } - - static int -@@ -336,7 +333,7 @@ pam_usertype_evaluate(struct pam_usertyp - - /** - * Arguments: -- * - issystem: uid in -+ * - issystem: uid less than SYS_UID_MAX - * - isregular: not issystem - * - use_uid: use user that runs application not that is being authenticate (same as in pam_succeed_if) - * - audit: log unknown users to syslog diff --git a/SOURCES/pam-1.3.1-pam-usertype.patch b/SOURCES/pam-1.3.1-pam-usertype.patch deleted file mode 100644 index bada491..0000000 --- a/SOURCES/pam-1.3.1-pam-usertype.patch +++ /dev/null @@ -1,712 +0,0 @@ -diff -up Linux-PAM-1.3.1/configure.ac.pam-usertype Linux-PAM-1.3.1/configure.ac ---- Linux-PAM-1.3.1/configure.ac.pam-usertype 2020-05-15 10:03:27.247468160 +0200 -+++ Linux-PAM-1.3.1/configure.ac 2020-05-15 10:03:27.270468089 +0200 -@@ -606,6 +606,27 @@ AC_SUBST([HAVE_KEY_MANAGEMENT], $HAVE_KE - - AM_CONDITIONAL([HAVE_KEY_MANAGEMENT], [test "$have_key_syscalls" = 1]) - -+dnl -+dnl Get values for default uid ranges in login.defs used in pam_usertype -+dnl -+AC_ARG_WITH([uidmin], AS_HELP_STRING([--with-uidmin=],[default value for regular user min uid (1000)]), opt_uidmin=$withval) -+if test x"$opt_uidmin" == x; then -+ opt_uidmin=1000 -+fi -+AC_DEFINE_UNQUOTED(PAM_USERTYPE_UIDMIN, $opt_uidmin, [Minimum regular user uid.]) -+ -+AC_ARG_WITH([sysuidmin], AS_HELP_STRING([--with-sysuidmin=],[default value for system user min uid (101)]), opt_sysuidmin=$withval) -+if test x"$opt_sysuidmin" == x; then -+ opt_sysuidmin=101 -+fi -+AC_DEFINE_UNQUOTED(PAM_USERTYPE_SYSUIDMIN, $opt_sysuidmin, [Minimum system user uid.]) -+ -+AC_ARG_WITH([kerneloverflowuid], AS_HELP_STRING([--with-kernel-overflow-uid=],[kernel overflow uid, default (uint16_t)-2=65534]), opt_kerneloverflowuid=$withval) -+if test x"$opt_kerneloverflowuid" == x; then -+ opt_kerneloverflowuid=65534 -+fi -+AC_DEFINE_UNQUOTED(PAM_USERTYPE_OVERFLOW_UID, $opt_kerneloverflowuid, [Kernel overflow uid.]) -+ - dnl Files to be created from when we run configure - AC_CONFIG_FILES([Makefile libpam/Makefile libpamc/Makefile libpamc/test/Makefile \ - libpam_misc/Makefile conf/Makefile conf/pam_conv1/Makefile \ -@@ -636,6 +657,7 @@ AC_CONFIG_FILES([Makefile libpam/Makefil - modules/pam_timestamp/Makefile modules/pam_tty_audit/Makefile \ - modules/pam_umask/Makefile \ - modules/pam_unix/Makefile modules/pam_userdb/Makefile \ -+ modules/pam_usertype/Makefile \ - modules/pam_warn/Makefile modules/pam_wheel/Makefile \ - modules/pam_xauth/Makefile doc/Makefile doc/specs/Makefile \ - doc/man/Makefile doc/sag/Makefile doc/adg/Makefile \ -diff -up Linux-PAM-1.3.1/modules/Makefile.am.pam-usertype Linux-PAM-1.3.1/modules/Makefile.am ---- Linux-PAM-1.3.1/modules/Makefile.am.pam-usertype 2020-05-15 10:03:27.247468160 +0200 -+++ Linux-PAM-1.3.1/modules/Makefile.am 2020-05-15 10:03:27.270468089 +0200 -@@ -12,7 +12,7 @@ SUBDIRS = pam_access pam_cracklib pam_de - pam_selinux pam_sepermit pam_shells pam_stress \ - pam_succeed_if pam_time pam_timestamp \ - pam_tty_audit pam_umask \ -- pam_unix pam_userdb pam_warn pam_wheel pam_xauth -+ pam_unix pam_userdb pam_usertype pam_warn pam_wheel pam_xauth - - CLEANFILES = *~ - -diff -up Linux-PAM-1.3.1/modules/pam_usertype/Makefile.am.pam-usertype Linux-PAM-1.3.1/modules/pam_usertype/Makefile.am ---- Linux-PAM-1.3.1/modules/pam_usertype/Makefile.am.pam-usertype 2020-05-15 10:03:27.270468089 +0200 -+++ Linux-PAM-1.3.1/modules/pam_usertype/Makefile.am 2020-05-15 10:03:27.270468089 +0200 -@@ -0,0 +1,34 @@ -+# -+# Copyright (c) 2005, 2006, 2009 Thorsten Kukuk -+# Copyright (c) 2020 Red Hat, Inc. -+# -+ -+CLEANFILES = *~ -+MAINTAINERCLEANFILES = $(MANS) README -+ -+EXTRA_DIST = README ${MANS} ${XMLS} tst-pam_usertype -+ -+TESTS = tst-pam_usertype -+ -+man_MANS = pam_usertype.8 -+ -+XMLS = README.xml pam_usertype.8.xml -+ -+securelibdir = $(SECUREDIR) -+secureconfdir = $(SCONFIGDIR) -+ -+AM_CFLAGS = -I$(top_srcdir)/libpam/include -I$(top_srcdir)/libpamc/include \ -+ $(WARN_CFLAGS) -+AM_LDFLAGS = -no-undefined -avoid-version -module -+if HAVE_VERSIONING -+ AM_LDFLAGS += -Wl,--version-script=$(srcdir)/../modules.map -+endif -+ -+securelib_LTLIBRARIES = pam_usertype.la -+pam_usertype_la_LIBADD = $(top_builddir)/libpam/libpam.la -+ -+if ENABLE_REGENERATE_MAN -+noinst_DATA = README -+README: pam_usertype.8.xml -+-include $(top_srcdir)/Make.xml.rules -+endif -diff -up Linux-PAM-1.3.1/modules/pam_usertype/pam_usertype.8.xml.pam-usertype Linux-PAM-1.3.1/modules/pam_usertype/pam_usertype.8.xml ---- Linux-PAM-1.3.1/modules/pam_usertype/pam_usertype.8.xml.pam-usertype 2020-05-15 10:03:27.270468089 +0200 -+++ Linux-PAM-1.3.1/modules/pam_usertype/pam_usertype.8.xml 2020-05-15 10:03:27.270468089 +0200 -@@ -0,0 +1,170 @@ -+ -+ -+ -+ -+ -+ -+ pam_usertype -+ 8 -+ Linux-PAM -+ -+ -+ -+ pam_usertype -+ check if the authenticated user is a system or regular account -+ -+ -+ -+ -+ -+ pam_usertype.so -+ flag -+ condition -+ -+ -+ -+ -+ -+ DESCRIPTION -+ -+ pam_usertype.so is designed to succeed or fail authentication -+ based on type of the account of the authenticated user. -+ The type of the account is decided with help of -+ SYS_UID_MIN and SYS_UID_MAX -+ settings in /etc/login.defs. One use is to select -+ whether to load other modules based on this test. -+ -+ -+ -+ The module should be given only one condition as module argument. -+ Authentication will succeed only if the condition is met. -+ -+ -+ -+ -+ OPTIONS -+ -+ The following flags are supported: -+ -+ -+ -+ -+ -+ -+ -+ Evaluate conditions using the account of the user whose UID -+ the application is running under instead of the user being -+ authenticated. -+ -+ -+ -+ -+ -+ -+ -+ Log unknown users to the system log. -+ -+ -+ -+ -+ -+ -+ Available conditions are: -+ -+ -+ -+ -+ -+ -+ Succeed if the user is a system user. -+ -+ -+ -+ -+ -+ Succeed if the user is a regular user. -+ -+ -+ -+ -+ -+ -+ MODULE TYPES PROVIDED -+ -+ All module types (, , -+ and ) are provided. -+ -+ -+ -+ -+ RETURN VALUES -+ -+ -+ -+ PAM_SUCCESS -+ -+ -+ The condition was true. -+ -+ -+ -+ -+ -+ PAM_AUTH_ERR -+ -+ -+ The condition was false. -+ -+ -+ -+ -+ -+ PAM_SERVICE_ERR -+ -+ -+ A service error occurred or the arguments can't be -+ parsed correctly. -+ -+ -+ -+ -+ -+ PAM_USER_UNKNOWN -+ -+ -+ User was not found. -+ -+ -+ -+ -+ -+ -+ -+ -+ EXAMPLES -+ -+ Skip remaining modules if the user is a system user: -+ -+ -+account sufficient pam_usertype.so issystem -+ -+ -+ -+ -+ SEE ALSO -+ -+ -+ login.defs5 -+ , -+ -+ pam8 -+ -+ -+ -+ -+ -+ AUTHOR -+ Pavel Březina <pbrezina@redhat.com> -+ -+ -diff -up Linux-PAM-1.3.1/modules/pam_usertype/pam_usertype.c.pam-usertype Linux-PAM-1.3.1/modules/pam_usertype/pam_usertype.c ---- Linux-PAM-1.3.1/modules/pam_usertype/pam_usertype.c.pam-usertype 2020-05-15 10:03:27.270468089 +0200 -+++ Linux-PAM-1.3.1/modules/pam_usertype/pam_usertype.c 2020-05-15 10:16:08.053198025 +0200 -@@ -0,0 +1,394 @@ -+/****************************************************************************** -+ * Check user type based on login.defs. -+ * -+ * Copyright (c) 2020 Red Hat, Inc. -+ * Written by Pavel Březina -+ * -+ * Redistribution and use in source and binary forms, with or without -+ * modification, are permitted provided that the following conditions -+ * are met: -+ * 1. Redistributions of source code must retain the above copyright -+ * notice, and the entire permission notice in its entirety, -+ * including the disclaimer of warranties. -+ * 2. Redistributions in binary form must reproduce the above copyright -+ * notice, this list of conditions and the following disclaimer in the -+ * documentation and/or other materials provided with the distribution. -+ * 3. The name of the author may not be used to endorse or promote -+ * products derived from this software without specific prior -+ * written permission. -+ * -+ * ALTERNATIVELY, this product may be distributed under the terms of -+ * the GNU Public License, in which case the provisions of the GPL are -+ * required INSTEAD OF the above restrictions. (This clause is -+ * necessary due to a potential bad interaction between the GPL and -+ * the restrictions contained in a BSD-style copyright.) -+ * -+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED -+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES -+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -+ * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, -+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR -+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) -+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, -+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) -+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED -+ * OF THE POSSIBILITY OF SUCH DAMAGE. -+ * -+ */ -+ -+#include "config.h" -+ -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+ -+#define PAM_SM_AUTH -+#define PAM_SM_ACCOUNT -+#define PAM_SM_SESSION -+#define PAM_SM_PASSWORD -+ -+#include -+#include -+#include -+ -+#define LOGIN_DEFS "/etc/login.defs" -+ -+enum pam_usertype_op { -+ OP_IS_SYSTEM, -+ OP_IS_REGULAR, -+ -+ OP_SENTINEL -+}; -+ -+struct pam_usertype_opts { -+ enum pam_usertype_op op; -+ int use_uid; -+ int audit; -+}; -+ -+static int -+pam_usertype_parse_args(struct pam_usertype_opts *opts, -+ pam_handle_t *pamh, -+ int argc, -+ const char **argv) -+{ -+ int i; -+ -+ memset(opts, 0, sizeof(struct pam_usertype_opts)); -+ opts->op = OP_SENTINEL; -+ -+ for (i = 0; i < argc; i++) { -+ if (strcmp(argv[i], "use_uid") == 0) { -+ opts->use_uid = 1; -+ } else if (strcmp(argv[i], "audit") == 0) { -+ opts->audit = 1; -+ } else if (strcmp(argv[i], "issystem") == 0) { -+ opts->op = OP_IS_SYSTEM; -+ } else if (strcmp(argv[i], "isregular") == 0) { -+ opts->op = OP_IS_REGULAR; -+ } else { -+ pam_syslog(pamh, LOG_WARNING, "Unknown argument: %s", argv[i]); -+ /* Just continue. */ -+ } -+ } -+ -+ if (opts->op == OP_SENTINEL) { -+ pam_syslog(pamh, LOG_ERR, "Operation not specified"); -+ return PAM_SERVICE_ERR; -+ } -+ -+ return PAM_SUCCESS; -+} -+ -+static int -+pam_usertype_get_uid(struct pam_usertype_opts *opts, -+ pam_handle_t *pamh, -+ uid_t *_uid) -+{ -+ struct passwd *pwd; -+ const void *prompt; -+ const char *username; -+ int ret; -+ -+ /* Get uid of user that runs the application. */ -+ if (opts->use_uid) { -+ pwd = pam_modutil_getpwuid(pamh, getuid()); -+ if (pwd == NULL) { -+ pam_syslog(pamh, LOG_ERR, -+ "error retrieving information about user %lu", -+ (unsigned long)getuid()); -+ return PAM_USER_UNKNOWN; -+ } -+ -+ *_uid = pwd->pw_uid; -+ return PAM_SUCCESS; -+ } -+ -+ /* Get uid of user that is being authenticated. */ -+ ret = pam_get_item(pamh, PAM_USER_PROMPT, &prompt); -+ if (ret != PAM_SUCCESS || prompt == NULL || strlen(prompt) == 0) { -+ prompt = "login: "; -+ } -+ -+ ret = pam_get_user(pamh, &username, prompt); -+ if (ret != PAM_SUCCESS || username == NULL) { -+ pam_syslog(pamh, LOG_ERR, "error retrieving user name: %s", -+ pam_strerror(pamh, ret)); -+ return ret; -+ } -+ -+ pwd = pam_modutil_getpwnam(pamh, username); -+ if (pwd == NULL) { -+ if (opts->audit) { -+ pam_syslog(pamh, LOG_NOTICE, -+ "error retrieving information about user %s", username); -+ } -+ -+ return PAM_USER_UNKNOWN; -+ } -+ -+ *_uid = pwd->pw_uid; -+ -+ return PAM_SUCCESS; -+} -+ -+#define MAX_UID_VALUE 0xFFFFFFFFUL -+ -+/* lookup a value for key in login.defs file or similar key value format */ -+char * -+pam_usertype_search_key(pam_handle_t *pamh UNUSED, -+ const char *file_name, -+ const char *key) -+{ -+ FILE *fp; -+ char *buf = NULL; -+ size_t buflen = 0; -+ char *retval = NULL; -+ -+ fp = fopen(file_name, "r"); -+ if (NULL == fp) -+ return NULL; -+ -+ while (!feof(fp)) { -+ char *tmp, *cp; -+#if defined(HAVE_GETLINE) -+ ssize_t n = getline(&buf, &buflen, fp); -+#elif defined (HAVE_GETDELIM) -+ ssize_t n = getdelim(&buf, &buflen, '\n', fp); -+#else -+ ssize_t n; -+ -+ if (buf == NULL) { -+ buflen = BUF_SIZE; -+ buf = malloc(buflen); -+ if (buf == NULL) { -+ fclose(fp); -+ return NULL; -+ } -+ } -+ buf[0] = '\0'; -+ if (fgets(buf, buflen - 1, fp) == NULL) -+ break; -+ else if (buf != NULL) -+ n = strlen(buf); -+ else -+ n = 0; -+#endif /* HAVE_GETLINE / HAVE_GETDELIM */ -+ cp = buf; -+ -+ if (n < 1) -+ break; -+ if (cp[n - 1] == '\n') -+ cp[n - 1] = '\0'; -+ -+ tmp = strchr(cp, '#'); /* remove comments */ -+ if (tmp) -+ *tmp = '\0'; -+ while (isspace((int)*cp)) /* remove spaces and tabs */ -+ ++cp; -+ if (*cp == '\0') /* ignore empty lines */ -+ continue; -+ -+ tmp = strsep (&cp, " \t="); -+ if (cp != NULL) -+ while (isspace((int)*cp) || *cp == '=') -+ ++cp; -+ else -+ cp = ""; -+ -+ if (strcasecmp(tmp, key) == 0) { -+ retval = strdup(cp); -+ break; -+ } -+ } -+ fclose(fp); -+ -+ free(buf); -+ -+ return retval; -+} -+ -+static uid_t -+pam_usertype_get_id(pam_handle_t *pamh, -+ const char *key, -+ uid_t default_value) -+{ -+ unsigned long ul; -+ char *value; -+ char *ep; -+ uid_t uid; -+ -+ value = pam_usertype_search_key(pamh, LOGIN_DEFS, key); -+ if (value == NULL) { -+ return default_value; -+ } -+ -+ /* taken from get_lastlog_uid_max() */ -+ ep = value + strlen(value); -+ while (ep > value && isspace(*(--ep))) { -+ *ep = '\0'; -+ } -+ -+ errno = 0; -+ ul = strtoul(value, &ep, 10); -+ if (!(ul >= MAX_UID_VALUE -+ || (uid_t)ul >= MAX_UID_VALUE -+ || (errno != 0 && ul == 0) -+ || value == ep -+ || *ep != '\0')) { -+ uid = (uid_t)ul; -+ } else { -+ uid = default_value; -+ } -+ -+ free(value); -+ -+ return uid; -+} -+ -+static int -+pam_usertype_is_system(pam_handle_t *pamh, uid_t uid) -+{ -+ uid_t uid_min; -+ uid_t sys_min; -+ uid_t sys_max; -+ -+ if (uid == (uid_t)-1) { -+ pam_syslog(pamh, LOG_WARNING, "invalid uid"); -+ return PAM_USER_UNKNOWN; -+ } -+ -+ if (uid <= 99) { -+ /* Reserved. */ -+ return PAM_SUCCESS; -+ } -+ -+ if (uid == PAM_USERTYPE_OVERFLOW_UID) { -+ /* nobody */ -+ return PAM_SUCCESS; -+ } -+ -+ uid_min = pam_usertype_get_id(pamh, "UID_MIN", PAM_USERTYPE_UIDMIN); -+ sys_min = pam_usertype_get_id(pamh, "SYS_UID_MIN", PAM_USERTYPE_SYSUIDMIN); -+ sys_max = pam_usertype_get_id(pamh, "SYS_UID_MAX", uid_min - 1); -+ -+ return uid >= sys_min && uid <= sys_max ? PAM_SUCCESS : PAM_AUTH_ERR; -+} -+ -+static int -+pam_usertype_is_regular(pam_handle_t *pamh, uid_t uid) -+{ -+ int ret; -+ -+ ret = pam_usertype_is_system(pamh, uid); -+ switch (ret) { -+ case PAM_SUCCESS: -+ return PAM_AUTH_ERR; -+ case PAM_USER_UNKNOWN: -+ return PAM_USER_UNKNOWN; -+ default: -+ return PAM_SUCCESS; -+ } -+} -+ -+static int -+pam_usertype_evaluate(struct pam_usertype_opts *opts, -+ pam_handle_t *pamh, -+ uid_t uid) -+{ -+ switch (opts->op) { -+ case OP_IS_SYSTEM: -+ return pam_usertype_is_system(pamh, uid); -+ case OP_IS_REGULAR: -+ return pam_usertype_is_regular(pamh, uid); -+ default: -+ pam_syslog(pamh, LOG_ERR, "Unknown operation: %d", opts->op); -+ return PAM_SERVICE_ERR; -+ } -+} -+ -+/** -+ * Arguments: -+ * - issystem: uid in -+ * - isregular: not issystem -+ * - use_uid: use user that runs application not that is being authenticate (same as in pam_succeed_if) -+ * - audit: log unknown users to syslog -+ */ -+int -+pam_sm_authenticate(pam_handle_t *pamh, int flags UNUSED, -+ int argc, const char **argv) -+{ -+ struct pam_usertype_opts opts; -+ uid_t uid; -+ int ret; -+ -+ ret = pam_usertype_parse_args(&opts, pamh, argc, argv); -+ if (ret != PAM_SUCCESS) { -+ return ret; -+ } -+ -+ ret = pam_usertype_get_uid(&opts, pamh, &uid); -+ if (ret != PAM_SUCCESS) { -+ return ret; -+ } -+ -+ return pam_usertype_evaluate(&opts, pamh, uid); -+} -+ -+int -+pam_sm_setcred(pam_handle_t *pamh UNUSED, int flags UNUSED, -+ int argc UNUSED, const char **argv UNUSED) -+{ -+ return PAM_IGNORE; -+} -+ -+int -+pam_sm_acct_mgmt(pam_handle_t *pamh, int flags, int argc, const char **argv) -+{ -+ return pam_sm_authenticate(pamh, flags, argc, argv); -+} -+ -+int -+pam_sm_open_session(pam_handle_t *pamh, int flags, int argc, const char **argv) -+{ -+ return pam_sm_authenticate(pamh, flags, argc, argv); -+} -+ -+int -+pam_sm_close_session(pam_handle_t *pamh, int flags, int argc, const char **argv) -+{ -+ return pam_sm_authenticate(pamh, flags, argc, argv); -+} -+ -+int -+pam_sm_chauthtok(pam_handle_t *pamh, int flags, int argc, const char **argv) -+{ -+ return pam_sm_authenticate(pamh, flags, argc, argv); -+} -diff -up Linux-PAM-1.3.1/modules/pam_usertype/README.xml.pam-usertype Linux-PAM-1.3.1/modules/pam_usertype/README.xml ---- Linux-PAM-1.3.1/modules/pam_usertype/README.xml.pam-usertype 2020-05-15 10:03:27.270468089 +0200 -+++ Linux-PAM-1.3.1/modules/pam_usertype/README.xml 2020-05-15 10:03:27.270468089 +0200 -@@ -0,0 +1,41 @@ -+ -+ -+--> -+]> -+ -+
-+ -+ -+ -+ -+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" -+ href="pam_usertype.8.xml" xpointer='xpointer(//refnamediv[@id = "pam_usertype-name"]/*)'/> -+ -+ -+ -+ -+
-+ -+
-+ -+
-+ -+
-+ -+
-+ -+
-+ -+
-+ -+
-+ -+
-diff -up Linux-PAM-1.3.1/modules/pam_usertype/tst-pam_usertype.pam-usertype Linux-PAM-1.3.1/modules/pam_usertype/tst-pam_usertype ---- Linux-PAM-1.3.1/modules/pam_usertype/tst-pam_usertype.pam-usertype 2020-05-15 10:03:27.270468089 +0200 -+++ Linux-PAM-1.3.1/modules/pam_usertype/tst-pam_usertype 2020-05-15 10:03:27.270468089 +0200 -@@ -0,0 +1,2 @@ -+#!/bin/sh -+../../tests/tst-dlopen .libs/pam_usertype.so diff --git a/SOURCES/pam-1.3.1-tty-audit-manfix.patch b/SOURCES/pam-1.3.1-tty-audit-manfix.patch deleted file mode 100644 index 3d17963..0000000 --- a/SOURCES/pam-1.3.1-tty-audit-manfix.patch +++ /dev/null @@ -1,33 +0,0 @@ -From e31dd6c7d0faa7a06d3ebd50a0b6957b9f822d15 Mon Sep 17 00:00:00 2001 -From: Tomas Mraz -Date: Wed, 7 Aug 2019 18:13:57 +0200 -Subject: [PATCH] pam_tty_audit: Manual page clarification about password - logging - -* modules/pam_tty_audit/pam_tty_audit.8.xml: Explanation why passwords -can be sometimes logged even when the option is not set. ---- - modules/pam_tty_audit/pam_tty_audit.8.xml | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/modules/pam_tty_audit/pam_tty_audit.8.xml b/modules/pam_tty_audit/pam_tty_audit.8.xml -index 59a3406..e346c68 100644 ---- a/modules/pam_tty_audit/pam_tty_audit.8.xml -+++ b/modules/pam_tty_audit/pam_tty_audit.8.xml -@@ -149,6 +149,13 @@ - greater than or equal to min_uid will be - matched. - -+ -+ Please note that passwords in some circumstances may be logged by TTY auditing -+ even if the is not used. For example, all input to -+ an ssh session will be logged - even if there is a password being typed into -+ some software running at the remote host because only the local TTY state -+ affects the local TTY auditing. -+ - - - --- -2.20.1 - diff --git a/SOURCES/pam-1.3.1-unix-default-rounds.patch b/SOURCES/pam-1.3.1-unix-default-rounds.patch deleted file mode 100644 index bb4a156..0000000 --- a/SOURCES/pam-1.3.1-unix-default-rounds.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -up Linux-PAM-1.3.1/modules/pam_unix/pam_unix_passwd.c.unix-default-rounds Linux-PAM-1.3.1/modules/pam_unix/pam_unix_passwd.c ---- Linux-PAM-1.3.1/modules/pam_unix/pam_unix_passwd.c.unix-default-rounds 2023-11-02 09:59:54.533238124 +0100 -+++ Linux-PAM-1.3.1/modules/pam_unix/pam_unix_passwd.c 2023-11-02 10:40:58.017404936 +0100 -@@ -607,7 +607,7 @@ pam_sm_chauthtok(pam_handle_t *pamh, int - unsigned int ctrl, lctrl; - int retval; - int remember = -1; -- int rounds = -1; -+ int rounds = 0; - int pass_min_len = 0; - - /* */ diff --git a/SOURCES/pam-1.3.1-unix-enable-bcrypt.patch b/SOURCES/pam-1.3.1-unix-enable-bcrypt.patch deleted file mode 100644 index 9264765..0000000 --- a/SOURCES/pam-1.3.1-unix-enable-bcrypt.patch +++ /dev/null @@ -1,174 +0,0 @@ -From f7abb8c1ef3aa31e6c2564a8aaf69683a77c2016 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= -Date: Thu, 15 Nov 2018 15:01:57 +0100 -Subject: [PATCH] pam_unix: Use bcrypt b-variant for computing new hashes. - -Bcrypt hashes used the "$2a$" prefix since 1997. -However, in 2011 an implementation bug was discovered in bcrypt -affecting the handling of characters in passphrases with the 8th -bit set. - -Besides fixing the bug, OpenBSD 5.5 introduced the "$2b$" prefix -for a behavior that exactly matches crypt_blowfish's "$2y$", and -the crypt_blowfish implementation supports it as well since v1.1. - -That said new computed bcrypt hashes should use the "$2b$" prefix. - -* modules/pam_unix/passverify.c: Use bcrypt b-variant. ---- - modules/pam_unix/passverify.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/modules/pam_unix/passverify.c b/modules/pam_unix/passverify.c -index 9c1771e2..1f433b3a 100644 ---- a/modules/pam_unix/passverify.c -+++ b/modules/pam_unix/passverify.c -@@ -385,7 +385,7 @@ PAMH_ARG_DECL(char * create_password_hash, - /* algoid = "$1" */ - return crypt_md5_wrapper(password); - } else if (on(UNIX_BLOWFISH_PASS, ctrl)) { -- algoid = "$2a$"; -+ algoid = "$2b$"; - } else if (on(UNIX_SHA256_PASS, ctrl)) { - algoid = "$5$"; - } else if (on(UNIX_SHA512_PASS, ctrl)) { --- -2.41.0 - -diff -up Linux-PAM-1.3.1/configure.ac.legacy-xcrypt Linux-PAM-1.3.1/configure.ac ---- Linux-PAM-1.3.1/configure.ac.legacy-xcrypt 2023-10-26 12:08:46.896437225 +0200 -+++ Linux-PAM-1.3.1/configure.ac 2023-10-26 12:10:38.289654696 +0200 -@@ -395,19 +395,32 @@ AC_SUBST(LIBAUDIT) - AM_CONDITIONAL([HAVE_AUDIT_TTY_STATUS], - [test "x$HAVE_AUDIT_TTY_STATUS" = xyes]) - --AC_CHECK_HEADERS(xcrypt.h crypt.h) --AS_IF([test "x$ac_cv_header_xcrypt_h" = "xyes"], -- [crypt_libs="xcrypt crypt"], -- [crypt_libs="crypt"]) -+AC_CHECK_HEADERS(crypt.h) - - BACKUP_LIBS=$LIBS --AC_SEARCH_LIBS([crypt],[$crypt_libs], LIBCRYPT="${ac_lib:+-l$ac_lib}", LIBCRYPT="") --AC_CHECK_FUNCS(crypt_r crypt_gensalt_r) -+LIBCRYPT="" -+PKG_CHECK_MODULES([CRYPT], [libcrypt], [ -+ CFLAGS="$CFLAGS $CRYPT_CFLAGS" -+ CPPFLAGS="$CPPFLAGS $CRYPT_CFLAGS" -+ LIBS="$LIBS $CRYPT_LIBS" -+ LIBCRYPT="$CRYPT_LIBS" -+], [ -+ AC_SEARCH_LIBS([crypt_gensalt_rn],[crypt]) -+ case "$ac_cv_search_crypt_gensalt_rn" in -+ -l*) LIBCRYPT="$ac_cv_search_crypt_gensalt_rn" ;; -+ no) AC_SEARCH_LIBS([crypt_r],[crypt]) -+ case "$ac_cv_search_crypt_r" in -+ -l*) LIBCRYPT="$ac_cv_search_crypt_r" ;; -+ no ) AC_SEARCH_LIBS([crypt],[crypt]) -+ case "$ac_cv_search_crypt" in -+ -l*) LIBCRYPT="$ac_cv_search_crypt" ;; -+ esac ;; -+ esac ;; -+ esac -+]) -+AC_CHECK_FUNCS([crypt_r]) - LIBS=$BACKUP_LIBS - AC_SUBST(LIBCRYPT) --if test "$LIBCRYPT" = "-lxcrypt" -a "$ac_cv_header_xcrypt_h" = "yes" ; then -- AC_DEFINE([HAVE_LIBXCRYPT], 1, [Define to 1 if xcrypt support should be compiled in.]) --fi - - AC_ARG_WITH([randomdev], AS_HELP_STRING([--with-randomdev=(|yes|no)],[use specified random device instead of /dev/urandom or 'no' to disable]), opt_randomdev=$withval) - if test "$opt_randomdev" = yes -o -z "$opt_randomdev"; then -diff -up Linux-PAM-1.3.1/modules/pam_pwhistory/opasswd.c.legacy-xcrypt Linux-PAM-1.3.1/modules/pam_pwhistory/opasswd.c ---- Linux-PAM-1.3.1/modules/pam_pwhistory/opasswd.c.legacy-xcrypt 2023-10-26 12:08:46.896437225 +0200 -+++ Linux-PAM-1.3.1/modules/pam_pwhistory/opasswd.c 2023-10-26 12:11:14.437725259 +0200 -@@ -52,9 +52,7 @@ - #include - #include - --#if defined (HAVE_XCRYPT_H) --#include --#elif defined (HAVE_CRYPT_H) -+#ifdef HAVE_CRYPT_H - #include - #endif - -diff -up Linux-PAM-1.3.1/modules/pam_unix/bigcrypt.c.legacy-xcrypt Linux-PAM-1.3.1/modules/pam_unix/bigcrypt.c ---- Linux-PAM-1.3.1/modules/pam_unix/bigcrypt.c.legacy-xcrypt 2017-02-10 11:10:15.000000000 +0100 -+++ Linux-PAM-1.3.1/modules/pam_unix/bigcrypt.c 2023-10-26 12:08:46.896437225 +0200 -@@ -29,9 +29,7 @@ - #include - #include - #include --#ifdef HAVE_LIBXCRYPT --#include --#elif defined(HAVE_CRYPT_H) -+#ifdef HAVE_CRYPT_H - #include - #endif - -diff -up Linux-PAM-1.3.1/modules/pam_unix/passverify.c.legacy-xcrypt Linux-PAM-1.3.1/modules/pam_unix/passverify.c ---- Linux-PAM-1.3.1/modules/pam_unix/passverify.c.legacy-xcrypt 2023-10-26 12:08:46.895437223 +0200 -+++ Linux-PAM-1.3.1/modules/pam_unix/passverify.c 2023-10-26 12:16:25.470320408 +0200 -@@ -19,9 +19,7 @@ - #include - #include - #include --#ifdef HAVE_LIBXCRYPT --#include --#elif defined(HAVE_CRYPT_H) -+#ifdef HAVE_CRYPT_H - #include - #endif - -@@ -406,23 +404,19 @@ PAMH_ARG_DECL(char * create_password_has - return crypted; - } - --#ifdef HAVE_CRYPT_GENSALT_R -- if (on(UNIX_BLOWFISH_PASS, ctrl)) { -- char entropy[17]; -- crypt_make_salt(entropy, sizeof(entropy) - 1); -- sp = crypt_gensalt_r (algoid, rounds, -- entropy, sizeof(entropy), -- salt, sizeof(salt)); -- } else { --#endif -- sp = stpcpy(salt, algoid); -- if (on(UNIX_ALGO_ROUNDS, ctrl)) { -- sp += snprintf(sp, sizeof(salt) - (16 + 1 + (sp - salt)), "rounds=%u$", rounds); -- } -- crypt_make_salt(sp, 16); --#ifdef HAVE_CRYPT_GENSALT_R -+#if defined(CRYPT_GENSALT_IMPLEMENTS_AUTO_ENTROPY) && CRYPT_GENSALT_IMPLEMENTS_AUTO_ENTROPY -+ /* -+ * Any version of libcrypt supporting auto entropy is -+ * guaranteed to have crypt_gensalt_rn(). -+ */ -+ sp = crypt_gensalt_rn(algoid, rounds, NULL, 0, salt, sizeof(salt)); -+#else -+ sp = stpcpy(salt, algoid); -+ if (on(UNIX_ALGO_ROUNDS, ctrl)) { -+ sp += snprintf(sp, sizeof(salt) - (16 + 1 + (sp - salt)), "rounds=%u$", rounds); - } --#endif -+ crypt_make_salt(sp, 16); -+#endif /* CRYPT_GENSALT_IMPLEMENTS_AUTO_ENTROPY */ - #ifdef HAVE_CRYPT_R - sp = NULL; - cdata = malloc(sizeof(*cdata)); -diff -up Linux-PAM-1.3.1/modules/pam_userdb/pam_userdb.c.legacy-xcrypt Linux-PAM-1.3.1/modules/pam_userdb/pam_userdb.c ---- Linux-PAM-1.3.1/modules/pam_userdb/pam_userdb.c.legacy-xcrypt 2023-10-26 12:08:46.880437194 +0200 -+++ Linux-PAM-1.3.1/modules/pam_userdb/pam_userdb.c 2023-10-26 12:08:46.896437225 +0200 -@@ -17,9 +17,7 @@ - #include - #include - #include --#ifdef HAVE_LIBXCRYPT --#include --#elif defined(HAVE_CRYPT_H) -+#ifdef HAVE_CRYPT_H - #include - #endif - diff --git a/SOURCES/pam-1.3.1-unix-improve-logging.patch b/SOURCES/pam-1.3.1-unix-improve-logging.patch deleted file mode 100644 index 682b4d5..0000000 --- a/SOURCES/pam-1.3.1-unix-improve-logging.patch +++ /dev/null @@ -1,57 +0,0 @@ -From a6845905869ccabb5eb802be37241eabec085dc7 Mon Sep 17 00:00:00 2001 -From: Tomas Mraz -Date: Mon, 14 Oct 2019 16:52:46 +0200 -Subject: [PATCH] pam_unix: Add logging useful for debugging problems - -Two messages added about obtaining the username are guarded -by the debug option as these should not be normally -logged - they can be useful for debugging but they do not -indicate any special condition. - -The message about authenticating user with blank password is -still just LOG_DEBUG priority but it is logged unconditionally -because it is somewhat extraordinary condition to have an user -with blank password. - -* modules/pam_unix/pam_unix_auth.c (pam_sm_authenticate): Replace - D() macro calls which are not enabled on production builds with - regular pam_syslog() calls. ---- - modules/pam_unix/pam_unix_auth.c | 7 ++++--- - 1 file changed, 4 insertions(+), 3 deletions(-) - -diff --git a/modules/pam_unix/pam_unix_auth.c b/modules/pam_unix/pam_unix_auth.c -index 681e49d..3fca945 100644 ---- a/modules/pam_unix/pam_unix_auth.c -+++ b/modules/pam_unix/pam_unix_auth.c -@@ -130,15 +130,16 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, const char **argv) - AUTH_RETURN; - } - if (on(UNIX_DEBUG, ctrl)) -- D(("username [%s] obtained", name)); -+ pam_syslog(pamh, LOG_DEBUG, "username [%s] obtained", name); - } else { -- D(("trouble reading username")); - if (retval == PAM_CONV_AGAIN) { - D(("pam_get_user/conv() function is not ready yet")); - /* it is safe to resume this function so we translate this - * retval to the value that indicates we're happy to resume. - */ - retval = PAM_INCOMPLETE; -+ } else if (on(UNIX_DEBUG, ctrl)) { -+ pam_syslog(pamh, LOG_DEBUG, "could not obtain username"); - } - AUTH_RETURN; - } -@@ -146,7 +147,7 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, const char **argv) - /* if this user does not have a password... */ - - if (_unix_blankpasswd(pamh, ctrl, name)) { -- D(("user '%s' has blank passwd", name)); -+ pam_syslog(pamh, LOG_DEBUG, "user [%s] has blank password; authenticated without it", name); - name = NULL; - retval = PAM_SUCCESS; - AUTH_RETURN; --- -2.20.1 - diff --git a/SOURCES/pam-1.3.1-wheel-pam_ruser-fallback.patch b/SOURCES/pam-1.3.1-wheel-pam_ruser-fallback.patch deleted file mode 100644 index a92f884..0000000 --- a/SOURCES/pam-1.3.1-wheel-pam_ruser-fallback.patch +++ /dev/null @@ -1,134 +0,0 @@ -From 6bf9b454eb971083f0cce49faa2aa1cde329ff5d Mon Sep 17 00:00:00 2001 -From: ikerexxe -Date: Wed, 26 Aug 2020 14:44:23 +0200 -Subject: [PATCH 1/3] pam_wheel: improve coding style - -modules/pam_wheel/pam_wheel.c: improve indentation and explicitly state -condition statements ---- - modules/pam_wheel/pam_wheel.c | 36 ++++++++++++++++++----------------- - 1 file changed, 19 insertions(+), 17 deletions(-) - -diff --git a/modules/pam_wheel/pam_wheel.c b/modules/pam_wheel/pam_wheel.c -index a025ebaf..94cb7d89 100644 ---- a/modules/pam_wheel/pam_wheel.c -+++ b/modules/pam_wheel/pam_wheel.c -@@ -130,25 +130,27 @@ perform_check (pam_handle_t *pamh, int ctrl, const char *use_group) - } - - if (ctrl & PAM_USE_UID_ARG) { -- tpwd = pam_modutil_getpwuid (pamh, getuid()); -- if (!tpwd) { -- if (ctrl & PAM_DEBUG_ARG) { -+ tpwd = pam_modutil_getpwuid (pamh, getuid()); -+ if (tpwd == NULL) { -+ if (ctrl & PAM_DEBUG_ARG) { - pam_syslog(pamh, LOG_NOTICE, "who is running me ?!"); -- } -- return PAM_SERVICE_ERR; -- } -- fromsu = tpwd->pw_name; -+ } -+ return PAM_SERVICE_ERR; -+ } -+ fromsu = tpwd->pw_name; - } else { -- fromsu = pam_modutil_getlogin(pamh); -- if (fromsu) { -- tpwd = pam_modutil_getpwnam (pamh, fromsu); -- } -- if (!fromsu || !tpwd) { -- if (ctrl & PAM_DEBUG_ARG) { -- pam_syslog(pamh, LOG_NOTICE, "who is running me ?!"); -- } -- return PAM_SERVICE_ERR; -- } -+ fromsu = pam_modutil_getlogin(pamh); -+ -+ if (fromsu != NULL) { -+ tpwd = pam_modutil_getpwnam (pamh, fromsu); -+ } -+ -+ if (fromsu == NULL || tpwd == NULL) { -+ if (ctrl & PAM_DEBUG_ARG) { -+ pam_syslog(pamh, LOG_NOTICE, "who is running me ?!"); -+ } -+ return PAM_SERVICE_ERR; -+ } - } - - /* --- -2.26.2 - - -From 9091ea1d81e85f49a221b0325d27b22ce69e444a Mon Sep 17 00:00:00 2001 -From: ikerexxe -Date: Thu, 27 Aug 2020 09:16:15 +0200 -Subject: [PATCH 2/3] pam_wheel: if getlogin fails fallback to PAM_RUSER - -modules/pam_wheel/pam_wheel.c: if getlogin fails to obtain the real user -ID, then try with PAM_RUSER. - -Resolves: -https://bugzilla.redhat.com/show_bug.cgi?id=1866866 ---- - modules/pam_wheel/pam_wheel.c | 10 ++++++++++ - 1 file changed, 10 insertions(+) - -diff --git a/modules/pam_wheel/pam_wheel.c b/modules/pam_wheel/pam_wheel.c -index 94cb7d89..7fa3cfa9 100644 ---- a/modules/pam_wheel/pam_wheel.c -+++ b/modules/pam_wheel/pam_wheel.c -@@ -141,6 +141,16 @@ perform_check (pam_handle_t *pamh, int ctrl, const char *use_group) - } else { - fromsu = pam_modutil_getlogin(pamh); - -+ /* if getlogin fails try a fallback to PAM_RUSER */ -+ if (fromsu == NULL) { -+ const char *rhostname; -+ -+ retval = pam_get_item(pamh, PAM_RHOST, (const void **)&rhostname); -+ if (retval != PAM_SUCCESS || rhostname == NULL) { -+ retval = pam_get_item(pamh, PAM_RUSER, (const void **)&fromsu); -+ } -+ } -+ - if (fromsu != NULL) { - tpwd = pam_modutil_getpwnam (pamh, fromsu); - } --- -2.26.2 - - -From a3a5cbf86083c43026b558e2023f597530626267 Mon Sep 17 00:00:00 2001 -From: ikerexxe -Date: Wed, 9 Sep 2020 10:32:03 +0200 -Subject: [PATCH 3/3] pam_wheel: clarify use_uid option in man page - -modules/pam_wheel/pam_wheel.8.xml: indicate that use_uid option uses the -real uid of the calling process. ---- - modules/pam_wheel/pam_wheel.8.xml | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/modules/pam_wheel/pam_wheel.8.xml b/modules/pam_wheel/pam_wheel.8.xml -index b32f5e2b..ee8c7d26 100644 ---- a/modules/pam_wheel/pam_wheel.8.xml -+++ b/modules/pam_wheel/pam_wheel.8.xml -@@ -122,9 +122,9 @@ - - - -- The check for wheel membership will be done against -- the current uid instead of the original one (useful when -- jumping with su from one account to another for example). -+ The check will be done against the real uid of the calling process, -+ instead of trying to obtain the user from the login session -+ associated with the terminal in use. - - - --- -2.26.2 - diff --git a/SOURCES/pam-1.5.1-pam-faillock-avoid-logging-erroneous.patch b/SOURCES/pam-1.5.1-pam-faillock-avoid-logging-erroneous.patch deleted file mode 100644 index 016bb15..0000000 --- a/SOURCES/pam-1.5.1-pam-faillock-avoid-logging-erroneous.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 10086bc69663fa819277af244eeb5b629a2403b8 Mon Sep 17 00:00:00 2001 -From: Deepak Das -Date: Mon, 10 Oct 2022 21:21:35 +0530 -Subject: [PATCH] pam_faillock: avoid logging an erroneous consecutive login - failure message - -* modules/pam_faillock/pam_faillock.c (write_tally): Avoid logging -a consecutive login failure message for the root user in case when -even_deny_root is not set. - -Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2082442 ---- - modules/pam_faillock/pam_faillock.c | 8 +++++--- - 1 file changed, 5 insertions(+), 3 deletions(-) - -diff --git a/modules/pam_faillock/pam_faillock.c b/modules/pam_faillock/pam_faillock.c -index ddbb90e7..ca1c7035 100644 ---- a/modules/pam_faillock/pam_faillock.c -+++ b/modules/pam_faillock/pam_faillock.c -@@ -374,9 +374,11 @@ write_tally(pam_handle_t *pamh, struct options *opts, struct tally_data *tallies - } - close(audit_fd); - #endif -- if (!(opts->flags & FAILLOCK_FLAG_NO_LOG_INFO)) { -- pam_syslog(pamh, LOG_INFO, "Consecutive login failures for user %s account temporarily locked", -- opts->user); -+ if (!(opts->flags & FAILLOCK_FLAG_NO_LOG_INFO) && -+ ((opts->flags & FAILLOCK_FLAG_DENY_ROOT) || (opts->uid != 0))) { -+ pam_syslog(pamh, LOG_INFO, -+ "Consecutive login failures for user %s account temporarily locked", -+ opts->user); - } - } - --- -2.38.1 - diff --git a/SOURCES/pam-1.5.1-pam-faillock-clarify-missing-user.patch b/SOURCES/pam-1.5.1-pam-faillock-clarify-missing-user.patch deleted file mode 100644 index 3f15eb8..0000000 --- a/SOURCES/pam-1.5.1-pam-faillock-clarify-missing-user.patch +++ /dev/null @@ -1,53 +0,0 @@ -From bcbf145ce925934214e48200c27c9ff736452549 Mon Sep 17 00:00:00 2001 -From: Deepak Das -Date: Mon, 10 Oct 2022 17:55:53 +0530 -Subject: [PATCH] pam_faillock: Clarify missing user faillock files after - reboot - -* modules/pam_faillock/faillock.conf.5.xml: Adding note related to missing -user specific faillock files after reboot. - -* modules/pam_faillock/pam_faillock.8.xml: Adding note related to missing -user specific faillock files after reboot. - -Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2062512 ---- - modules/pam_faillock/faillock.conf.5.xml | 4 ++++ - modules/pam_faillock/pam_faillock.8.xml | 6 ++++++ - 2 files changed, 10 insertions(+) - -diff --git a/modules/pam_faillock/faillock.conf.5.xml b/modules/pam_faillock/faillock.conf.5.xml -index 04a84107..8faa5915 100644 ---- a/modules/pam_faillock/faillock.conf.5.xml -+++ b/modules/pam_faillock/faillock.conf.5.xml -@@ -44,6 +44,10 @@ - The directory where the user files with the failure records are kept. The - default is /var/run/faillock. - -+ -+ Note: These files will disappear after reboot on systems configured with -+ directory /var/run/faillock mounted on virtual memory. -+ - - - -diff --git a/modules/pam_faillock/pam_faillock.8.xml b/modules/pam_faillock/pam_faillock.8.xml -index 79bcbbd0..b7b7b0db 100644 ---- a/modules/pam_faillock/pam_faillock.8.xml -+++ b/modules/pam_faillock/pam_faillock.8.xml -@@ -327,6 +327,12 @@ session required pam_selinux.so open - /var/run/faillock/* - - the files logging the authentication failures for users -+ -+ Note: These files will disappear after reboot on systems configured with -+ directory /var/run/faillock mounted on virtual memory. -+ For persistent storage use the option dir= in -+ file /etc/security/faillock.conf. -+ - - - --- -2.38.1 - diff --git a/SOURCES/pam-1.5.1-pam-lastlog-check-localtime_r-return-value.patch b/SOURCES/pam-1.5.1-pam-lastlog-check-localtime_r-return-value.patch deleted file mode 100644 index 80ad508..0000000 --- a/SOURCES/pam-1.5.1-pam-lastlog-check-localtime_r-return-value.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 40c271164dbcebfc5304d0537a42fb42e6b6803c Mon Sep 17 00:00:00 2001 -From: Iker Pedrosa -Date: Mon, 26 Sep 2022 12:16:53 +0200 -Subject: [PATCH] pam_lastlog: check localtime_r() return value - -Check the return value of localtime_r() before calling strftime(). This -function crashes if the argument is NULL. - -Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2012871 - -Signed-off-by: Iker Pedrosa ---- - modules/pam_lastlog/pam_lastlog.c | 12 ++++++------ - 1 file changed, 6 insertions(+), 6 deletions(-) - -diff --git a/modules/pam_lastlog/pam_lastlog.c b/modules/pam_lastlog/pam_lastlog.c -index abd048df..121e7560 100644 ---- a/modules/pam_lastlog/pam_lastlog.c -+++ b/modules/pam_lastlog/pam_lastlog.c -@@ -573,12 +573,12 @@ last_login_failed(pam_handle_t *pamh, int announce, const char *user, time_t llt - time_t lf_time; - - lf_time = utuser.ut_tv.tv_sec; -- tm = localtime_r (&lf_time, &tm_buf); -- strftime (the_time, sizeof (the_time), -- /* TRANSLATORS: "strftime options for date of last login" */ -- _(" %a %b %e %H:%M:%S %Z %Y"), tm); -- -- date = the_time; -+ if ((tm = localtime_r (&lf_time, &tm_buf)) != NULL) { -+ strftime (the_time, sizeof (the_time), -+ /* TRANSLATORS: "strftime options for date of last login" */ -+ _(" %a %b %e %H:%M:%S %Z %Y"), tm); -+ date = the_time; -+ } - } - - /* we want & have the host? */ --- -2.38.1 - diff --git a/SOURCES/password-auth.pamd b/SOURCES/password-auth.pamd deleted file mode 100644 index 5de6f4d..0000000 --- a/SOURCES/password-auth.pamd +++ /dev/null @@ -1,18 +0,0 @@ -#%PAM-1.0 -# This file is auto-generated. -# User changes will be destroyed the next time authselect is run. -auth required pam_env.so -auth sufficient pam_unix.so try_first_pass nullok -auth required pam_deny.so - -account required pam_unix.so - -password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= -password sufficient pam_unix.so try_first_pass use_authtok nullok sha512 shadow -password required pam_deny.so - -session optional pam_keyinit.so revoke -session required pam_limits.so --session optional pam_systemd.so -session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid -session required pam_unix.so diff --git a/SOURCES/postlogin.pamd b/SOURCES/postlogin.pamd deleted file mode 100644 index 2ce9af4..0000000 --- a/SOURCES/postlogin.pamd +++ /dev/null @@ -1,8 +0,0 @@ -#%PAM-1.0 -# This file is auto-generated. -# User changes will be destroyed the next time authselect is run. - -session optional pam_umask.so silent -session [success=1 default=ignore] pam_succeed_if.so service !~ gdm* service !~ su* quiet -session [default=1] pam_lastlog.so nowtmp showfailed -session optional pam_lastlog.so silent noupdate showfailed diff --git a/SOURCES/smartcard-auth.pamd b/SOURCES/smartcard-auth.pamd deleted file mode 100644 index e8a6745..0000000 --- a/SOURCES/smartcard-auth.pamd +++ /dev/null @@ -1,4 +0,0 @@ -#%PAM-1.0 -# This file is auto-generated. -# User changes will be destroyed the next time authselect is run. -auth sufficient pam_sss.so allow_missing_name diff --git a/SOURCES/system-auth.pamd b/SOURCES/system-auth.pamd deleted file mode 100644 index 5de6f4d..0000000 --- a/SOURCES/system-auth.pamd +++ /dev/null @@ -1,18 +0,0 @@ -#%PAM-1.0 -# This file is auto-generated. -# User changes will be destroyed the next time authselect is run. -auth required pam_env.so -auth sufficient pam_unix.so try_first_pass nullok -auth required pam_deny.so - -account required pam_unix.so - -password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= -password sufficient pam_unix.so try_first_pass use_authtok nullok sha512 shadow -password required pam_deny.so - -session optional pam_keyinit.so revoke -session required pam_limits.so --session optional pam_systemd.so -session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid -session required pam_unix.so diff --git a/SOURCES/config-util.5 b/config-util.5 similarity index 92% rename from SOURCES/config-util.5 rename to config-util.5 index 17d7f8a..625f17b 100644 --- a/SOURCES/config-util.5 +++ b/config-util.5 @@ -8,7 +8,7 @@ config-util \- Common PAM configuration file for configuration utilities .sp 2 .SH DESCRIPTION -The purpose of this configuration file is to provide common +The purpose of this configuration file is to provide common configuration file for all configuration utilities which must be run from the supervisor account and use the userhelper wrapper application. @@ -23,7 +23,7 @@ There are not usually any other modules in the individual configuration files of these utilities. .sp -It is possible for example to modify duration of the validity of the +It is possible for example to modify duration of the validity of the authentication timestamp there. See .BR pam_timestamp(8) for details. diff --git a/SOURCES/config-util.pamd b/config-util.pamd similarity index 100% rename from SOURCES/config-util.pamd rename to config-util.pamd diff --git a/SOURCES/dlopen.sh b/dlopen.sh similarity index 100% rename from SOURCES/dlopen.sh rename to dlopen.sh diff --git a/SOURCES/gpl-2.0.txt b/gpl-2.0.txt similarity index 100% rename from SOURCES/gpl-2.0.txt rename to gpl-2.0.txt diff --git a/macros.pam b/macros.pam new file mode 100644 index 0000000..774327a --- /dev/null +++ b/macros.pam @@ -0,0 +1,5 @@ +%_pam_libdir %{_libdir} +%_pam_moduledir %{_libdir}/security +%_pam_secconfdir %{_sysconfdir}/security +%_pam_confdir %{_sysconfdir}/pam.d +%_pam_vendordir %{_datadir}/pam.d diff --git a/SOURCES/other.pamd b/other.pamd similarity index 100% rename from SOURCES/other.pamd rename to other.pamd diff --git a/SOURCES/pam-1.3.0-unix-nomsg.patch b/pam-1.5.3-unix-nomsg.patch similarity index 54% rename from SOURCES/pam-1.3.0-unix-nomsg.patch rename to pam-1.5.3-unix-nomsg.patch index 33c2267..3a8abbb 100644 --- a/SOURCES/pam-1.3.0-unix-nomsg.patch +++ b/pam-1.5.3-unix-nomsg.patch @@ -1,7 +1,8 @@ -diff -up Linux-PAM-1.3.0/modules/pam_unix/pam_unix_passwd.c.nomsg Linux-PAM-1.3.0/modules/pam_unix/pam_unix_passwd.c ---- Linux-PAM-1.3.0/modules/pam_unix/pam_unix_passwd.c.nomsg 2016-04-11 13:08:47.000000000 +0200 -+++ Linux-PAM-1.3.0/modules/pam_unix/pam_unix_passwd.c 2017-04-20 16:51:24.853106709 +0200 -@@ -687,12 +687,6 @@ pam_sm_chauthtok(pam_handle_t *pamh, int +Index: Linux-PAM-1.5.3/modules/pam_unix/pam_unix_passwd.c +=================================================================== +--- Linux-PAM-1.5.3.orig/modules/pam_unix/pam_unix_passwd.c ++++ Linux-PAM-1.5.3/modules/pam_unix/pam_unix_passwd.c +@@ -678,12 +678,6 @@ pam_sm_chauthtok(pam_handle_t *pamh, int return PAM_SUCCESS; } else if (off(UNIX__IAMROOT, ctrl) || (on(UNIX_NIS, ctrl) && _unix_comesfromsource(pamh, user, 0, 1))) { diff --git a/pam-1.6.0-redhat-modules.patch b/pam-1.6.0-redhat-modules.patch new file mode 100644 index 0000000..66aa8ff --- /dev/null +++ b/pam-1.6.0-redhat-modules.patch @@ -0,0 +1,24 @@ +diff -up Linux-PAM-1.6.0/configure.ac.redhat-modules Linux-PAM-1.6.0/configure.ac +--- Linux-PAM-1.6.0/configure.ac.redhat-modules 2024-01-23 13:16:34.854753145 +0100 ++++ Linux-PAM-1.6.0/configure.ac 2024-01-23 13:17:52.855859922 +0100 +@@ -774,6 +774,8 @@ AC_CONFIG_FILES([Makefile libpam/Makefil + po/Makefile.in \ + Make.xml.rules \ + modules/Makefile \ ++ modules/pam_chroot/Makefile \ ++ modules/pam_postgresok/Makefile \ + modules/pam_access/Makefile \ + modules/pam_canonicalize_user/Makefile \ + modules/pam_debug/Makefile modules/pam_deny/Makefile \ +diff -up Linux-PAM-1.6.0/modules/Makefile.am.redhat-modules Linux-PAM-1.6.0/modules/Makefile.am +--- Linux-PAM-1.6.0/modules/Makefile.am.redhat-modules 2024-01-17 11:29:36.000000000 +0100 ++++ Linux-PAM-1.6.0/modules/Makefile.am 2024-01-23 13:16:34.855753147 +0100 +@@ -48,6 +48,8 @@ SUBDIRS := \ + pam_debug \ + pam_deny \ + pam_echo \ ++ pam_chroot \ ++ pam_postgresok \ + pam_env \ + pam_exec \ + pam_faildelay \ diff --git a/pam-1.6.1-noflex.patch b/pam-1.6.1-noflex.patch new file mode 100644 index 0000000..fa35dc7 --- /dev/null +++ b/pam-1.6.1-noflex.patch @@ -0,0 +1,24 @@ +diff -up Linux-PAM-1.6.1/doc/Makefile.am.noflex Linux-PAM-1.6.1/doc/Makefile.am +--- Linux-PAM-1.6.1/doc/Makefile.am.noflex 2024-04-09 18:22:59.000000000 +0200 ++++ Linux-PAM-1.6.1/doc/Makefile.am 2024-04-10 11:09:39.304086982 +0200 +@@ -2,7 +2,7 @@ + # Copyright (c) 2005, 2006 Thorsten Kukuk + # + +-SUBDIRS = man specs sag adg mwg ++SUBDIRS = man sag adg mwg + + CLEANFILES = *~ + DISTCLEANFILES = custom-html.xsl custom-man.xsl +diff -up Linux-PAM-1.6.1/Makefile.am.noflex Linux-PAM-1.6.1/Makefile.am +--- Linux-PAM-1.6.1/Makefile.am.noflex 2024-04-10 11:09:39.304086982 +0200 ++++ Linux-PAM-1.6.1/Makefile.am 2024-04-10 11:13:15.057352362 +0200 +@@ -4,7 +4,7 @@ + + AUTOMAKE_OPTIONS = 1.9 gnu dist-xz no-dist-gzip check-news + +-SUBDIRS = libpam_internal libpam tests libpamc libpam_misc modules po conf \ ++SUBDIRS = libpam_internal libpam tests libpamc libpam_misc modules po doc \ + xtests + + if HAVE_DOC diff --git a/SOURCES/pam-1.3.1-pam-access-local.patch b/pam-1.6.1-pam-access-local.patch similarity index 54% rename from SOURCES/pam-1.3.1-pam-access-local.patch rename to pam-1.6.1-pam-access-local.patch index 2b82d49..89a0d39 100644 --- a/SOURCES/pam-1.3.1-pam-access-local.patch +++ b/pam-1.6.1-pam-access-local.patch @@ -1,99 +1,3 @@ -From 08992030c56c940c0707ccbc442b1c325aa01e6d Mon Sep 17 00:00:00 2001 -From: Tomas Mraz -Date: Tue, 6 Apr 2021 12:27:38 +0200 -Subject: [PATCH] pam_access: clean up the remote host matching code - -* modules/pam_access/pam_access.c (from_match): Split out remote_match() - function and avoid calling it when matching against LOCAL keyword. - There is also no point in doing domain match against TTY or SERVICE. ---- - modules/pam_access/pam_access.c | 44 +++++++++++++++++++++------------ - 1 file changed, 28 insertions(+), 16 deletions(-) - -diff --git a/modules/pam_access/pam_access.c b/modules/pam_access/pam_access.c -index 98848c54..277192b9 100644 ---- a/modules/pam_access/pam_access.c -+++ b/modules/pam_access/pam_access.c -@@ -160,6 +160,7 @@ static int list_match (pam_handle_t *, char *, char *, struct login_info *, - static int user_match (pam_handle_t *, char *, struct login_info *); - static int group_match (pam_handle_t *, const char *, const char *, int); - static int from_match (pam_handle_t *, char *, struct login_info *); -+static int remote_match (pam_handle_t *, char *, struct login_info *); - static int string_match (pam_handle_t *, const char *, const char *, int); - static int network_netmask_match (pam_handle_t *, const char *, const char *, struct login_info *); - -@@ -589,11 +590,9 @@ group_match (pam_handle_t *pamh, const char *tok, const char* usr, - /* from_match - match a host or tty against a list of tokens */ - - static int --from_match (pam_handle_t *pamh UNUSED, char *tok, struct login_info *item) -+from_match (pam_handle_t *pamh, char *tok, struct login_info *item) - { - const char *string = item->from; -- int tok_len; -- int str_len; - int rv; - - if (item->debug) -@@ -616,14 +615,29 @@ from_match (pam_handle_t *pamh UNUSED, char *tok, struct login_info *item) - } else if ((rv = string_match(pamh, tok, string, item->debug)) != NO) { - /* ALL or exact match */ - return rv; -- } else if (tok[0] == '.') { /* domain: match last fields */ -- if ((str_len = strlen(string)) > (tok_len = strlen(tok)) -- && strcasecmp(tok, string + str_len - tok_len) == 0) -- return (YES); -- } else if (item->from_remote_host == 0) { /* local: no PAM_RHOSTS */ -- if (strcasecmp(tok, "LOCAL") == 0) -- return (YES); -- } else if (tok[(tok_len = strlen(tok)) - 1] == '.') { -+ } else if (strcasecmp(tok, "LOCAL") == 0) { -+ /* LOCAL matches only local accesses */ -+ if (!item->from_remote_host) -+ return YES; -+ return NO; -+ } else if (item->from_remote_host) { -+ return remote_match(pamh, tok, item); -+ } -+ return NO; -+} -+ -+static int -+remote_match (pam_handle_t *pamh, char *tok, struct login_info *item) -+{ -+ const char *string = item->from; -+ size_t tok_len = strlen(tok); -+ size_t str_len; -+ -+ if (tok[0] == '.') { /* domain: match last fields */ -+ if ((str_len = strlen(string)) > tok_len -+ && strcasecmp(tok, string + str_len - tok_len) == 0) -+ return YES; -+ } else if (tok[tok_len - 1] == '.') { - struct addrinfo hint; - - memset (&hint, '\0', sizeof (hint)); -@@ -661,13 +675,11 @@ from_match (pam_handle_t *pamh UNUSED, char *tok, struct login_info *item) - runp = runp->ai_next; - } - } -- } else { -- /* Assume network/netmask with a IP of a host. */ -- if (network_netmask_match(pamh, tok, string, item)) -- return YES; -+ return NO; - } - -- return NO; -+ /* Assume network/netmask with an IP of a host. */ -+ return network_netmask_match(pamh, tok, string, item); - } - - /* string_match - match a string against one token */ --- -2.47.0 - - From ecaaf4456e5aeacae1acdb1775bb5aadd3b19e13 Mon Sep 17 00:00:00 2001 From: Iker Pedrosa Date: Wed, 16 Oct 2024 12:41:09 +0200 diff --git a/SOURCES/pam-1.3.1-pam-access-resolve-ip.patch b/pam-1.6.1-pam-access-resolve-ip.patch similarity index 59% rename from SOURCES/pam-1.3.1-pam-access-resolve-ip.patch rename to pam-1.6.1-pam-access-resolve-ip.patch index 27cbdf5..2d4e06c 100644 --- a/SOURCES/pam-1.3.1-pam-access-resolve-ip.patch +++ b/pam-1.6.1-pam-access-resolve-ip.patch @@ -1,46 +1,62 @@ -diff -up Linux-PAM-1.5.1/modules/pam_access/access.conf.5.xml.pam-access-resolve-ip Linux-PAM-1.5.1/modules/pam_access/access.conf.5.xml ---- Linux-PAM-1.5.1/modules/pam_access/access.conf.5.xml.pam-access-resolve-ip 2020-11-25 17:57:02.000000000 +0100 -+++ Linux-PAM-1.5.1/modules/pam_access/access.conf.5.xml 2024-11-21 10:04:58.553127026 +0100 -@@ -226,6 +226,14 @@ - item and the line will be most probably ignored. For this reason, it is not - recommended to put spaces around the ':' characters. +From 940747f88c16e029b69a74e80a2e94f65cb3e628 Mon Sep 17 00:00:00 2001 +From: Thorsten Kukuk +Date: Thu, 14 Nov 2024 10:27:28 +0100 +Subject: [PATCH] pam_access: rework resolving of tokens as hostname + +* modules/pam_access/pam_access.c: separate resolving of IP addresses + from hostnames. Don't resolve TTYs or display variables as hostname + (#834). + Add "nodns" option to disallow resolving of tokens as hostname. +* modules/pam_access/pam_access.8.xml: document nodns option +* modules/pam_access/access.conf.5.xml: document that hostnames should + be written as FQHN. +--- + modules/pam_access/access.conf.5.xml | 4 ++ + modules/pam_access/pam_access.8.xml | 46 ++++++++++++------ + modules/pam_access/pam_access.c | 72 +++++++++++++++++++++++++++- + 3 files changed, 105 insertions(+), 17 deletions(-) + +diff --git a/modules/pam_access/access.conf.5.xml b/modules/pam_access/access.conf.5.xml +index 0b93db00..10b8ba92 100644 +--- a/modules/pam_access/access.conf.5.xml ++++ b/modules/pam_access/access.conf.5.xml +@@ -233,6 +233,10 @@ + An IPv6 link local host address must contain the interface + identifier. IPv6 link local network/netmask is not supported. + -+ An IPv6 link local host address must contain the interface -+ identifier. IPv6 link local network/netmask is not supported. -+ -+ + Hostnames should be written as Fully-Qualified Host Name (FQHN) to avoid + confusion with device names or PAM service names. + - -diff -up Linux-PAM-1.5.1/modules/pam_access/pam_access.8.xml.pam-access-resolve-ip Linux-PAM-1.5.1/modules/pam_access/pam_access.8.xml ---- Linux-PAM-1.5.1/modules/pam_access/pam_access.8.xml.pam-access-resolve-ip 2020-11-25 17:57:02.000000000 +0100 -+++ Linux-PAM-1.5.1/modules/pam_access/pam_access.8.xml 2024-11-21 10:04:58.553127026 +0100 -@@ -25,11 +25,14 @@ - + +diff --git a/modules/pam_access/pam_access.8.xml b/modules/pam_access/pam_access.8.xml +index c991d7a0..71a4f7ee 100644 +--- a/modules/pam_access/pam_access.8.xml ++++ b/modules/pam_access/pam_access.8.xml +@@ -22,11 +22,14 @@ + debug + + noaudit + - + nodefgroup -- + - noaudit -+ + nodns - - accessfile=file -@@ -114,7 +117,46 @@ + + quiet_log +@@ -132,6 +135,33 @@ + + - - -- ++ ++ + nodefgroup + + @@ -66,32 +82,16 @@ diff -up Linux-PAM-1.5.1/modules/pam_access/pam_access.8.xml.pam-access-resolve- + + + -+ -+ -+ quiet_log -+ -+ -+ -+ Do not log denials with -+ syslog3. -+ -+ -+ -+ -+ -+ -+ fieldsep=separators - - - -@@ -152,20 +194,6 @@ - + + + quiet_log +@@ -185,20 +215,6 @@ -- + - - -- +- nodefgroup - - - @@ -102,30 +102,41 @@ diff -up Linux-PAM-1.5.1/modules/pam_access/pam_access.8.xml.pam-access-resolve- - - - - +- -diff -up Linux-PAM-1.5.1/modules/pam_access/pam_access.c.pam-access-resolve-ip Linux-PAM-1.5.1/modules/pam_access/pam_access.c ---- Linux-PAM-1.5.1/modules/pam_access/pam_access.c.pam-access-resolve-ip 2024-11-21 10:04:58.547127010 +0100 -+++ Linux-PAM-1.5.1/modules/pam_access/pam_access.c 2024-11-21 10:04:58.553127026 +0100 -@@ -92,6 +92,7 @@ struct login_info { - int debug; /* Print debugging messages. */ + +diff --git a/modules/pam_access/pam_access.c b/modules/pam_access/pam_access.c +index 48e7c7e9..109115e9 100644 +--- a/modules/pam_access/pam_access.c ++++ b/modules/pam_access/pam_access.c +@@ -100,6 +100,7 @@ struct login_info { int only_new_group_syntax; /* Only allow group entries of the form "(xyz)" */ int noaudit; /* Do not audit denials */ + int quiet_log; /* Do not log denials */ + int nodns; /* Do not try to resolve tokens as hostnames */ const char *fs; /* field separator */ const char *sep; /* list-element separator */ int from_remote_host; /* If PAM_RHOST was used for from */ -@@ -143,6 +144,8 @@ parse_args(pam_handle_t *pamh, struct lo - loginfo->only_new_group_syntax = YES; - } else if (strcmp (argv[i], "noaudit") == 0) { +@@ -154,6 +155,8 @@ parse_args(pam_handle_t *pamh, struct login_info *loginfo, loginfo->noaudit = YES; + } else if (strcmp (argv[i], "quiet_log") == 0) { + loginfo->quiet_log = YES; + } else if (strcmp (argv[i], "nodns") == 0) { + loginfo->nodns = YES; } else { pam_syslog(pamh, LOG_ERR, "unrecognized option [%s]", argv[i]); } -@@ -700,6 +703,39 @@ string_match (pam_handle_t *pamh, const +@@ -820,7 +823,7 @@ remote_match (pam_handle_t *pamh, char *tok, struct login_info *item) + if ((str_len = strlen(string)) > tok_len + && strcasecmp(tok, string + str_len - tok_len) == 0) + return YES; +- } else if (tok[tok_len - 1] == '.') { /* internet network numbers (end with ".") */ ++ } else if (tok[tok_len - 1] == '.') { /* internet network numbers/subnet (end with ".") */ + struct addrinfo hint; + + memset (&hint, '\0', sizeof (hint)); +@@ -895,6 +898,39 @@ string_match (pam_handle_t *pamh, const char *tok, const char *string, } @@ -165,7 +176,7 @@ diff -up Linux-PAM-1.5.1/modules/pam_access/pam_access.c.pam-access-resolve-ip L /* network_netmask_match - match a string against one token * where string is a hostname or ip (v4,v6) address and tok * represents either a hostname, a single ip (v4,v6) address -@@ -761,10 +797,42 @@ network_netmask_match (pam_handle_t *pam +@@ -956,10 +992,42 @@ network_netmask_match (pam_handle_t *pamh, return NO; } } @@ -209,3 +220,6 @@ diff -up Linux-PAM-1.5.1/modules/pam_access/pam_access.c.pam-access-resolve-ip L * Let getaddrinfo sort everything out */ if (getaddrinfo (tok, NULL, NULL, &ai) != 0) +-- +2.47.0 + diff --git a/pam-1.6.1-pam-env-econf-read-file-fixes.patch b/pam-1.6.1-pam-env-econf-read-file-fixes.patch new file mode 100644 index 0000000..0663588 --- /dev/null +++ b/pam-1.6.1-pam-env-econf-read-file-fixes.patch @@ -0,0 +1,86 @@ +From aabd5314a6d76968c377969b49118a2df3f97003 Mon Sep 17 00:00:00 2001 +From: "Dmitry V. Levin" +Date: Sun, 19 May 2024 15:00:00 +0000 +Subject: [PATCH 1/2] pam_env: fix NULL dereference on error path in + econf_read_file + +* modules/pam_env/pam_env.c [USE_ECONF] (econf_read_file): Handle NULL +value returned by econf_getStringValue(). + +Resolves: https://github.com/linux-pam/linux-pam/issues/796 +--- + modules/pam_env/pam_env.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/modules/pam_env/pam_env.c b/modules/pam_env/pam_env.c +index 2cc58228..6d39bb24 100644 +--- a/modules/pam_env/pam_env.c ++++ b/modules/pam_env/pam_env.c +@@ -287,7 +287,7 @@ econf_read_file(const pam_handle_t *pamh, const char *filename, const char *deli + char *val; + + error = econf_getStringValue (key_file, NULL, keys[i], &val); +- if (error != ECONF_SUCCESS) { ++ if (error != ECONF_SUCCESS || val == NULL) { + pam_syslog(pamh, LOG_ERR, "Unable to get string from key %s: %s", + keys[i], + econf_errString(error)); +-- +2.45.1 + + +From 75292685a625153c6e28bdd820e97421c258c04a Mon Sep 17 00:00:00 2001 +From: "Dmitry V. Levin" +Date: Sun, 19 May 2024 15:00:00 +0000 +Subject: [PATCH 2/2] pam_env: fix error handling in econf_read_file + +* modules/pam_env/pam_env.c [USE_ECONF] (econf_read_file): Make sure +the returned array of strings is properly initialized +when econf_getStringValue() fails to return a value. +--- + modules/pam_env/pam_env.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/modules/pam_env/pam_env.c b/modules/pam_env/pam_env.c +index 6d39bb24..7c146439 100644 +--- a/modules/pam_env/pam_env.c ++++ b/modules/pam_env/pam_env.c +@@ -273,7 +273,7 @@ econf_read_file(const pam_handle_t *pamh, const char *filename, const char *deli + return PAM_ABORT; + } + +- *lines = malloc((key_number +1)* sizeof(char**)); ++ *lines = calloc((key_number + 1), sizeof(char**)); + if (*lines == NULL) { + pam_syslog(pamh, LOG_ERR, "Cannot allocate memory."); + econf_free(keys); +@@ -281,8 +281,7 @@ econf_read_file(const pam_handle_t *pamh, const char *filename, const char *deli + return PAM_BUF_ERR; + } + +- (*lines)[key_number] = 0; +- ++ size_t n = 0; + for (size_t i = 0; i < key_number; i++) { + char *val; + +@@ -293,7 +292,7 @@ econf_read_file(const pam_handle_t *pamh, const char *filename, const char *deli + econf_errString(error)); + } else { + econf_unescnl(val); +- if (asprintf(&(*lines)[i],"%s%c%s", keys[i], delim[0], val) < 0) { ++ if (asprintf(&(*lines)[n],"%s%c%s", keys[i], delim[0], val) < 0) { + pam_syslog(pamh, LOG_ERR, "Cannot allocate memory."); + econf_free(keys); + econf_freeFile(key_file); +@@ -303,6 +302,7 @@ econf_read_file(const pam_handle_t *pamh, const char *filename, const char *deli + return PAM_BUF_ERR; + } + free (val); ++ n++; + } + } + +-- +2.45.1 + diff --git a/pam-1.6.1-sast-fixes.patch b/pam-1.6.1-sast-fixes.patch new file mode 100644 index 0000000..d2557c4 --- /dev/null +++ b/pam-1.6.1-sast-fixes.patch @@ -0,0 +1,212 @@ +From 5eccaf9b3488d3f6da800281363697e4e4834e77 Mon Sep 17 00:00:00 2001 +From: Iker Pedrosa +Date: Wed, 22 May 2024 11:16:28 +0200 +Subject: [PATCH 1/5] pam_faillock: close the audit socket after use + +* modules/pam_faillock/pam_faillock.c (check_tally): Close the audit +socket when it will no longer be used. + +``` +Error: RESOURCE_LEAK (CWE-772): +Linux-PAM-1.6.0/modules/pam_faillock/pam_faillock.c:247: open_fn: Returning handle opened by "audit_open". +Linux-PAM-1.6.0/modules/pam_faillock/pam_faillock.c:247: var_assign: Assigning: "audit_fd" = handle returned from "audit_open()". +Linux-PAM-1.6.0/modules/pam_faillock/pam_faillock.c:256: noescape: Resource "audit_fd" is not freed or pointed-to in "audit_log_user_message". +Linux-PAM-1.6.0/modules/pam_faillock/pam_faillock.c:258: leaked_handle: Handle variable "audit_fd" going out of scope leaks the handle. +256| audit_log_user_message(audit_fd, AUDIT_RESP_ACCT_UNLOCK_TIMED, buf, +257| rhost, NULL, tty, 1); +258|-> } +259| #endif +260| opts->flags |= FAILLOCK_FLAG_UNLOCKED; +``` + +Resolves: https://issues.redhat.com/browse/RHEL-36475 +Signed-off-by: Iker Pedrosa +--- + modules/pam_faillock/pam_faillock.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/modules/pam_faillock/pam_faillock.c b/modules/pam_faillock/pam_faillock.c +index e636a24e..f39a9d95 100644 +--- a/modules/pam_faillock/pam_faillock.c ++++ b/modules/pam_faillock/pam_faillock.c +@@ -255,6 +255,7 @@ check_tally(pam_handle_t *pamh, struct options *opts, struct tally_data *tallies + snprintf(buf, sizeof(buf), "op=pam_faillock suid=%u ", opts->uid); + audit_log_user_message(audit_fd, AUDIT_RESP_ACCT_UNLOCK_TIMED, buf, + rhost, NULL, tty, 1); ++ audit_close(audit_fd); + } + #endif + opts->flags |= FAILLOCK_FLAG_UNLOCKED; +-- +2.45.2 + + +From d00f6cb366b492de455f9b72fcbd2e49abf323e0 Mon Sep 17 00:00:00 2001 +From: Iker Pedrosa +Date: Wed, 22 May 2024 11:20:02 +0200 +Subject: [PATCH 2/5] pam_rootok: close the audit socket on error path + +* modules/pam_rootok/pam_rootok.c (log_callback): Close the audit socket +if vasprintf returned an error. + +``` +Error: RESOURCE_LEAK (CWE-772): +Linux-PAM-1.6.0/modules/pam_rootok/pam_rootok.c:59: open_fn: Returning handle opened by "audit_open". +Linux-PAM-1.6.0/modules/pam_rootok/pam_rootok.c:59: var_assign: Assigning: "audit_fd" = handle returned from "audit_open()". +Linux-PAM-1.6.0/modules/pam_rootok/pam_rootok.c:69: leaked_handle: Handle variable "audit_fd" going out of scope leaks the handle. +67| va_end(ap); +68| if (ret < 0) { +69|-> return 0; +70| } +71| audit_log_user_avc_message(audit_fd, AUDIT_USER_AVC, buf, NULL, NULL, +``` + +Resolves: https://issues.redhat.com/browse/RHEL-36475 +Signed-off-by: Iker Pedrosa +--- + modules/pam_rootok/pam_rootok.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/modules/pam_rootok/pam_rootok.c b/modules/pam_rootok/pam_rootok.c +index 6d2dfa07..1b88fb19 100644 +--- a/modules/pam_rootok/pam_rootok.c ++++ b/modules/pam_rootok/pam_rootok.c +@@ -66,6 +66,7 @@ log_callback (int type UNUSED, const char *fmt, ...) + ret = vasprintf (&buf, fmt, ap); + va_end(ap); + if (ret < 0) { ++ audit_close(audit_fd); + return 0; + } + audit_log_user_avc_message(audit_fd, AUDIT_USER_AVC, buf, NULL, NULL, +-- +2.45.2 + + +From 1ca5bfed50bd9f6c2f1e3e36c2df3253923dadf6 Mon Sep 17 00:00:00 2001 +From: Iker Pedrosa +Date: Wed, 22 May 2024 12:27:00 +0200 +Subject: [PATCH 3/5] pam_timestamp: close the timestamp file on error path + +* modules/pam_timestamp/pam_timestamp.c (pam_sm_authenticate) +[WITH_OPENSSL]: Close the timestamp file if hmac_size returned +an error. + +``` +Error: RESOURCE_LEAK (CWE-772): +Linux-PAM-1.6.0/modules/pam_timestamp/pam_timestamp.c:450: open_fn: Returning handle opened by "open". [Note: The source code implementation of the function has been overridden by a user model.] +Linux-PAM-1.6.0/modules/pam_timestamp/pam_timestamp.c:450: var_assign: Assigning: "fd" = handle returned from "open(path, 131072)". +Linux-PAM-1.6.0/modules/pam_timestamp/pam_timestamp.c:460: noescape: Resource "fd" is not freed or pointed-to in "fstat". +Linux-PAM-1.6.0/modules/pam_timestamp/pam_timestamp.c:484: leaked_handle: Handle variable "fd" going out of scope leaks the handle. +482| #ifdef WITH_OPENSSL +483| if (hmac_size(pamh, debug, &maclen)) { +484|-> return PAM_AUTH_ERR; +485| } +486| #else +``` + +Resolves: https://issues.redhat.com/browse/RHEL-36475 +Signed-off-by: Iker Pedrosa +--- + modules/pam_timestamp/pam_timestamp.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/modules/pam_timestamp/pam_timestamp.c b/modules/pam_timestamp/pam_timestamp.c +index 7c5457c4..edecc052 100644 +--- a/modules/pam_timestamp/pam_timestamp.c ++++ b/modules/pam_timestamp/pam_timestamp.c +@@ -481,6 +481,7 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, const char **argv) + + #ifdef WITH_OPENSSL + if (hmac_size(pamh, debug, &maclen)) { ++ close(fd); + return PAM_AUTH_ERR; + } + #else +-- +2.45.2 + + +From 667204d7e3e4a0341c529f7566d62dd64dd80866 Mon Sep 17 00:00:00 2001 +From: Iker Pedrosa +Date: Wed, 22 May 2024 12:25:34 +0200 +Subject: [PATCH 4/5] pam_namespace: free SELinux context + +* modules/pam_namespace/pam_namespace.c [WITH_SELINUX] (form_context): +Free SELinux context before returning. + +``` +Error: RESOURCE_LEAK (CWE-772): +Linux-PAM-1.6.0/modules/pam_namespace/pam_namespace.c:928: alloc_arg: "getexeccon" allocates memory that is stored into "scon". +Linux-PAM-1.6.0/modules/pam_namespace/pam_namespace.c:1004: leaked_storage: Variable "scon" going out of scope leaks the storage it points to. +1002| } +1003| /* Should never get here */ +1004|-> return PAM_SUCCESS; +1005| } +1006| #endif +``` + +Resolves: https://issues.redhat.com/browse/RHEL-36475 +Signed-off-by: Iker Pedrosa +--- + modules/pam_namespace/pam_namespace.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/modules/pam_namespace/pam_namespace.c b/modules/pam_namespace/pam_namespace.c +index e499d95a..781dac20 100644 +--- a/modules/pam_namespace/pam_namespace.c ++++ b/modules/pam_namespace/pam_namespace.c +@@ -1003,6 +1003,7 @@ static int form_context(const struct polydir_s *polyptr, + return rc; + } + /* Should never get here */ ++ freecon(scon); + return PAM_SUCCESS; + } + #endif +-- +2.45.2 + + +From bd2f695b3d89efe0c52bba975f9540634125178a Mon Sep 17 00:00:00 2001 +From: Iker Pedrosa +Date: Wed, 22 May 2024 12:29:07 +0200 +Subject: [PATCH 5/5] pam_namespace: free SELinux context on error path + +* modules/pam_namespace/pam_namespace.c (create_polydir) [WITH_SELINUX]: +Free SELinux context in case of an error. + +``` +Error: RESOURCE_LEAK (CWE-772): +Linux-PAM-1.6.0/modules/pam_namespace/pam_namespace.c:1433: alloc_arg: "getfscreatecon_raw" allocates memory that is stored into "oldcon_raw". +Linux-PAM-1.6.0/modules/pam_namespace/pam_namespace.c:1462: leaked_storage: Variable "oldcon_raw" going out of scope leaks the storage it points to. +1460| pam_syslog(idata->pamh, LOG_ERR, +1461| "Error creating directory %s: %m", dir); +1462|-> return PAM_SESSION_ERR; +1463| } +1464| +``` + +Resolves: https://issues.redhat.com/browse/RHEL-36475 +Signed-off-by: Iker Pedrosa +--- + modules/pam_namespace/pam_namespace.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/modules/pam_namespace/pam_namespace.c b/modules/pam_namespace/pam_namespace.c +index 781dac20..2dab49ef 100644 +--- a/modules/pam_namespace/pam_namespace.c ++++ b/modules/pam_namespace/pam_namespace.c +@@ -1462,6 +1462,9 @@ static int create_polydir(struct polydir_s *polyptr, + if (rc == -1) { + pam_syslog(idata->pamh, LOG_ERR, + "Error creating directory %s: %m", dir); ++#ifdef WITH_SELINUX ++ freecon(oldcon_raw); ++#endif + return PAM_SESSION_ERR; + } + +-- +2.45.2 + diff --git a/SPECS/pam.spec b/pam.spec similarity index 77% rename from SPECS/pam.spec rename to pam.spec index ee87fa4..794593a 100644 --- a/SPECS/pam.spec +++ b/pam.spec @@ -1,166 +1,70 @@ -%define pam_redhat_version 0.99.11 +%global so_ver 0 +%global pam_redhat_version 1.2.0 Summary: An extensible library which provides authentication for applications Name: pam -Version: 1.3.1 -Release: 36%{?dist} +Version: 1.6.1 +Release: 7%{?dist} # The library is BSD licensed with option to relicense as GPLv2+ # - this option is redundant as the BSD license allows that anyway. -# pam_timestamp, pam_loginuid, and pam_console modules are GPLv2+. -License: BSD and GPLv2+ -Group: System Environment/Base +# pam_timestamp and pam_loginuid modules are GPLv2+. +License: BSD-3-Clause AND GPL-2.0-or-later +URL: http://www.linux-pam.org/ Source0: https://github.com/linux-pam/linux-pam/releases/download/v%{version}/Linux-PAM-%{version}.tar.xz Source1: https://github.com/linux-pam/linux-pam/releases/download/v%{version}/Linux-PAM-%{version}.tar.xz.asc -Source2: https://releases.pagure.org/pam-redhat/pam-redhat-%{pam_redhat_version}.tar.bz2 +Source2: https://releases.pagure.org/pam-redhat/pam-redhat-%{pam_redhat_version}.tar.xz +Source3: macros.%{name} Source5: other.pamd -Source6: system-auth.pamd -Source7: password-auth.pamd -Source8: fingerprint-auth.pamd -Source9: smartcard-auth.pamd Source10: config-util.pamd Source11: dlopen.sh Source12: system-auth.5 Source13: config-util.5 Source15: pamtmp.conf -Source16: postlogin.pamd Source17: postlogin.5 Source18: https://www.gnu.org/licenses/old-licenses/gpl-2.0.txt -Patch1: pam-1.2.0-redhat-modules.patch -Patch4: pam-1.1.0-console-nochmod.patch -Patch5: pam-1.1.0-notally.patch -Patch7: pam-1.2.1-faillock.patch -Patch8: pam-1.2.1-faillock-admin-group.patch -Patch9: pam-1.3.1-noflex.patch -Patch10: pam-1.1.3-nouserenv.patch -Patch13: pam-1.1.6-limits-user.patch -Patch15: pam-1.1.8-full-relro.patch -# FIPS related - non upstreamable -Patch20: pam-1.2.0-unix-no-fallback.patch -Patch28: pam-1.1.1-console-errmsg.patch -# Upstreamed partially -Patch29: pam-1.3.0-pwhistory-helper.patch -Patch31: pam-1.1.8-audit-user-mgmt.patch -Patch32: pam-1.2.1-console-devname.patch -Patch33: pam-1.3.0-unix-nomsg.patch -Patch34: pam-1.3.1-coverity.patch -Patch35: pam-1.3.1-console-build.patch -Patch36: pam-1.3.1-faillock-update.patch -Patch37: pam-1.3.1-namespace-mntopts.patch -Patch38: pam-1.3.1-lastlog-no-showfailed.patch -Patch39: pam-1.3.1-lastlog-unlimited-fsize.patch -Patch40: pam-1.3.1-unix-improve-logging.patch -Patch41: pam-1.3.1-tty-audit-manfix.patch -Patch42: pam-1.3.1-fds-closing.patch -Patch43: pam-1.3.1-authtok-verify-fix.patch -Patch44: pam-1.3.1-motd-manpage.patch -# Upstreamed -Patch45: pam-1.3.1-pam-usertype.patch -# Upstreamed -Patch46: pam-1.3.1-audit-error.patch -# Upstreamed -Patch47: pam-1.3.1-pam-modutil-close-write.patch -# https://github.com/linux-pam/linux-pam/commit/6bf9b454eb971083f0cce49faa2aa1cde329ff5d -# https://github.com/linux-pam/linux-pam/commit/9091ea1d81e85f49a221b0325d27b22ce69e444a -# https://github.com/linux-pam/linux-pam/commit/a3a5cbf86083c43026b558e2023f597530626267 -Patch48: pam-1.3.1-wheel-pam_ruser-fallback.patch -# https://github.com/linux-pam/linux-pam/commit/491e5500b6b3913f531574208274358a2df88659 -Patch49: pam-1.3.1-namespace-gdm-doc.patch -# https://github.com/linux-pam/linux-pam/commit/a7453aeeb398d6cbb7a709c4e2a1d75905220fff -Patch50: pam-1.3.1-pam-userdb-prevent-garbage-characters-from-db.patch -# https://github.com/linux-pam/linux-pam/commit/3234488f2c52a021eec87df1990d256314c21bff -Patch51: pam-1.3.1-pam-limits-unlimited-value.patch -# https://github.com/linux-pam/linux-pam/commit/a35e092e24ee7632346a0e1b4a203c04d4cd2c62 -Patch52: pam-1.3.1-pam-keyinit-thread-safe.patch -# https://github.com/linux-pam/linux-pam/commit/f9c9c72121eada731e010ab3620762bcf63db08f -Patch53: pam-1.3.1-pam-motd-support-multiple-motd-paths.patch -# https://github.com/linux-pam/linux-pam/commit/8eaf5570cf011148a0b55c53570df5edaafebdb0 -Patch54: pam-1.3.1-pam-motd-fix-segmentation-fault.patch -# https://github.com/linux-pam/linux-pam/commit/62cd745d730e5ba13d5d7092ac566fc0b2148e61 -Patch55: pam-1.3.1-pam-motd-fix-memory-leak.patch -# Needed by the next patch. Already upstreamed -Patch56: pam-1.3.1-pam-cc-compat.patch -Patch57: pam-1.3.1-inline.patch -# https://github.com/linux-pam/linux-pam/commit/9bcbe96d9e82a23d983c0618178a8dc25596ac2d -# https://github.com/linux-pam/linux-pam/commit/fc867a9e22eac2c9a0ed0577776bba4df21c9aad -Patch58: pam-1.3.1-faillock-load-conf-from-file.patch -# https://github.com/linux-pam/linux-pam/commit/370064ef6f99581b08d473a42bb3417d5dda3e4e -Patch59: pam-1.3.1-pam-usertype-SYS_UID_MAX.patch -# https://github.com/linux-pam/linux-pam/commit/ba2f6dd8b81ea2a58262c1709bec906b6852591d -# https://github.com/linux-pam/linux-pam/commit/1180bde923a22605fe8075cd1fe7992ed7513411 -Patch60: pam-1.3.1-pam-pwhistory-load-conf-from-file.patch -# https://github.com/linux-pam/linux-pam/commit/d57ab22133654033ee1da89f128a81572d320985 -# https://github.com/linux-pam/linux-pam/commit/c2c0434bd634a817f2b16ce7f58fc96c04e88b03 -Patch61: pam-1.3.1-pam-motd-avoid-unnecessary-logging.patch -# https://github.com/linux-pam/linux-pam/commit/40c271164dbcebfc5304d0537a42fb42e6b6803c -Patch62: pam-1.5.1-pam-lastlog-check-localtime_r-return-value.patch -# https://github.com/linux-pam/linux-pam/commit/bcbf145ce925934214e48200c27c9ff736452549 -Patch63: pam-1.5.1-pam-faillock-clarify-missing-user.patch -# https://github.com/linux-pam/linux-pam/commit/10086bc69663fa819277af244eeb5b629a2403b8 -Patch64: pam-1.5.1-pam-faillock-avoid-logging-erroneous.patch -# https://github.com/linux-pam/linux-pam/commit/55f206447a1e4ee26e307e7a9c069236e823b1a5 -# https://github.com/linux-pam/linux-pam/commit/80bfda5962e5be3daa70e0fc8c75fc97d1c55121 -Patch65: pam-1.3.1-pam-misc-configurable.patch -# https://github.com/linux-pam/linux-pam/commit/530c9f9e2d746e1d168c6b17863debda7664ac7c -# https://github.com/linux-pam/linux-pam/commit/f7abb8c1ef3aa31e6c2564a8aaf69683a77c2016 -Patch66: pam-1.3.1-unix-enable-bcrypt.patch -Patch67: pam-1.3.1-unix-default-rounds.patch -# https://github.com/linux-pam/linux-pam/commit/d54870f993e97fe75e2cd0470a3701d5af22877c -Patch68: pam-1.3.1-faillock-create-tallydir.patch -# https://github.com/linux-pam/linux-pam/commit/23393bef92c1e768eda329813d7af55481c6ca9f -Patch69: pam-1.3.1-access-handle-hostnames.patch -# https://github.com/linux-pam/linux-pam/commit/031bb5a5d0d950253b68138b498dc93be69a64cb -Patch70: pam-1.3.1-namespace-protect-dir.patch -# https://github.com/linux-pam/linux-pam/commit/c85513220c1bd3150e39c6277422d29cfa44acc7 -# https://github.com/linux-pam/linux-pam/commit/1648734a69c31e9ce834da70144ac9a453296807 -Patch71: pam-1.3.1-audit-messages-formatting.patch -# https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be -# https://github.com/linux-pam/linux-pam/commit/8d0c575336ad301cd14e16ad2fdec6fe621764b8 -Patch72: pam-1.3.1-pam-unix-shadow-password.patch -# https://github.com/linux-pam/linux-pam/commit/08992030c56c940c0707ccbc442b1c325aa01e6d +Patch1: pam-1.6.0-redhat-modules.patch +Patch2: pam-1.6.1-noflex.patch +Patch3: pam-1.5.3-unix-nomsg.patch +# https://github.com/linux-pam/linux-pam/commit/bd2f695b3d89efe0c52bba975f9540634125178a +Patch4: pam-1.6.1-sast-fixes.patch +# https://github.com/linux-pam/linux-pam/commit/aabd5314a6d76968c377969b49118a2df3f97003 +Patch5: pam-1.6.1-pam-env-econf-read-file-fixes.patch # https://github.com/linux-pam/linux-pam/commit/641dfd1084508c63f3590e93a35b80ffc50774e5 -Patch73: pam-1.3.1-pam-access-local.patch -# https://github.com/linux-pam/linux-pam/commit/ec1fb9ddc6c252d8c61379e9385ca19c036fcb96 -Patch74: pam-1.3.1-libpam-support-long-lines.patch +Patch6: pam-1.6.1-pam-access-local.patch # https://github.com/linux-pam/linux-pam/commit/940747f88c16e029b69a74e80a2e94f65cb3e628 -Patch75: pam-1.3.1-pam-access-resolve-ip.patch +Patch7: pam-1.6.1-pam-access-resolve-ip.patch -%define _pamlibdir %{_libdir} -%define _moduledir %{_libdir}/security -%define _secconfdir %{_sysconfdir}/security -%define _pamconfdir %{_sysconfdir}/pam.d +%{load:%{SOURCE3}} -%if %{?WITH_SELINUX:0}%{!?WITH_SELINUX:1} -%define WITH_SELINUX 1 -%endif -%if %{?WITH_AUDIT:0}%{!?WITH_AUDIT:1} -%define WITH_AUDIT 1 -%endif -%global _performance_build 1 +### Dependencies ### +Requires(meta): authselect >= 1.3 +Requires: gdbm +Requires: libpwquality%{?_isa} +Requires: pam-libs%{?_isa} = %{version}-%{release} +Requires: setup -Recommends: cracklib-dicts >= 2.8 -Requires: libpwquality >= 0.9.9 -Requires(post): coreutils, /sbin/ldconfig -BuildRequires: autoconf >= 2.60 -BuildRequires: automake, libtool -BuildRequires: bison, flex, sed -BuildRequires: cracklib-devel -BuildRequires: perl-interpreter, pkgconfig, gettext-devel -BuildRequires: libtirpc-devel, libnsl2-devel -%if %{WITH_AUDIT} -BuildRequires: audit-libs-devel >= 1.0.8 -Requires: audit-libs >= 1.0.8 -%endif -%if %{WITH_SELINUX} -BuildRequires: libselinux-devel >= 1.33.2 -Requires: libselinux >= 1.33.2 -%endif -Requires: glibc >= 2.3.90-37 -BuildRequires: libdb-devel -# Following deps are necessary only to build the pam library documentation. -BuildRequires: linuxdoc-tools, elinks, libxslt -BuildRequires: docbook-style-xsl, docbook-dtds +Suggests: libdb-convert-util -URL: http://www.linux-pam.org/ +### Build Dependencies ### +BuildRequires: audit-libs-devel +BuildRequires: autoconf +BuildRequires: automake +BuildRequires: bison +BuildRequires: flex +BuildRequires: gcc +BuildRequires: gdbm-devel +BuildRequires: gettext-devel +BuildRequires: libeconf-devel +BuildRequires: libselinux-devel +BuildRequires: libtirpc-devel +BuildRequires: libtool +BuildRequires: libxcrypt-devel +BuildRequires: make +BuildRequires: openssl-devel +BuildRequires: perl-interpreter +BuildRequires: pkgconfig +BuildRequires: sed +BuildRequires: systemd %description PAM (Pluggable Authentication Modules) is a system security tool that @@ -168,9 +72,8 @@ allows system administrators to set authentication policy without having to recompile programs that handle authentication. %package devel -Group: Development/Libraries Summary: Files needed for developing PAM-aware applications and modules for PAM -Requires: pam%{?_isa} = %{version}-%{release} +Requires: pam-libs%{?_isa} = %{version}-%{release} %description devel PAM (Pluggable Authentication Modules) is a system security tool that @@ -179,6 +82,37 @@ having to recompile programs that handle authentication. This package contains header files used for building both PAM-aware applications and modules for use with the PAM system. +%package doc +Summary: Extra documentation for PAM. +Requires: pam = %{version}-%{release} +Obsoletes: pam-docs < 1.5.2-6 +Provides: pam-docs = %{version}-%{release} +BuildArch: noarch +BuildRequires: docbook5-schemas +BuildRequires: docbook5-style-xsl +BuildRequires: elinks +BuildRequires: libxslt +BuildRequires: linuxdoc-tools + +%description doc +PAM (Pluggable Authentication Modules) is a system security tool that +allows system administrators to set authentication policy without +having to recompile programs that handle authentication. The pam-doc +contains extra documentation for PAM. Currently, this includes additional +documentation in txt and html format. + +%package libs +Summary: Shared libraries of the PAM package +# Make sure that if we don't try to upgrade -libs but not the +# main pam package and get file conflicts: +Conflicts: pam < 1.5.2-11 + +%description libs +PAM (Pluggable Authentication Modules) is a system security tool that +allows system administrators to set authentication policy without +having to recompile programs that handle authentication. The pam-libs +contains the shared libraries for PAM. + %prep %setup -q -n Linux-PAM-%{version} -a 2 perl -pi -e "s/ppc64-\*/ppc64-\* \| ppc64p7-\*/" build-aux/config.sub @@ -189,154 +123,109 @@ mv pam-redhat-%{pam_redhat_version}/* modules cp %{SOURCE18} . -%patch1 -p1 -b .redhat-modules -%patch4 -p1 -b .nochmod -%patch5 -p1 -b .notally -%patch7 -p1 -b .faillock -%patch8 -p1 -b .admin-group -%patch9 -p1 -b .noflex -%patch10 -p1 -b .nouserenv -%patch13 -p1 -b .limits -%patch15 -p1 -b .relro -%patch20 -p1 -b .no-fallback -%patch28 -p1 -b .errmsg -%patch29 -p1 -b .pwhhelper -%patch31 -p1 -b .audit-user-mgmt -%patch32 -p1 -b .devname -%patch33 -p1 -b .nomsg -%patch34 -p1 -b .coverity -%patch35 -p1 -b .console-build -%patch36 -p1 -b .faillock-update -%patch37 -p1 -b .mntopts -%patch38 -p1 -b .no-showfailed -%patch39 -p1 -b .unlimited-fsize -%patch40 -p1 -b .improve-logging -%patch41 -p1 -b .tty-audit-manfix -%patch42 -p1 -b .fds-closing -%patch43 -p1 -b .authtok-verify-fix -%patch44 -p1 -b .motd-manpage -%patch45 -p1 -b .pam-usertype -%patch46 -p1 -b .audit-error -%patch47 -p1 -b .pam-modutil-close-write -%patch48 -p1 -b .wheel-pam_ruser-fallback -%patch49 -p1 -b .namespace-gdm-doc -%patch50 -p1 -b .pam-userdb-prevent-garbage-characters-from-db -%patch51 -p1 -b .pam-limits-unlimited-value -%patch52 -p1 -b .pam-keyinit-thread-safe -%patch53 -p1 -b .pam-motd-support-multiple-motd-paths -%patch54 -p1 -b .pam-motd-fix-segmentation-fault -%patch55 -p1 -b .pam-motd-fix-memory-leak -%patch56 -p1 -b .pam-cc-compat -%patch57 -p1 -b .inline -%patch58 -p1 -b .faillock-load-conf-from-file -%patch59 -p1 -b .pam-usertype-SYS_UID_MAX -%patch60 -p1 -b .pam-pwhistory-load-conf-from-file -%patch61 -p1 -b .pam-motd-avoid-unnecessary-logging -%patch62 -p1 -b .pam-lastlog-check-localtime_r-return-value -%patch63 -p1 -b .pam-faillock-clarify-missing-user -%patch64 -p1 -b .pam-faillock-avoid-logging-erroneous -%patch65 -p1 -b .pam-misc-configurable -%patch66 -p1 -b .unix-enable-bcrypt -%patch67 -p1 -b .unix-default-rounds -%patch68 -p1 -b .faillock-create-tallydir -%patch69 -p1 -b .access-handle-hostnames -%patch70 -p1 -b .namespace-protect-dir -%patch71 -p1 -b .audit-messages-formatting -%patch72 -p1 -b .pam-unix-shadow-password -%patch73 -p1 -b .pam-access-local -%patch74 -p1 -b .libpam-support-long-lines -%patch75 -p1 -b .pam-access-resolve-ip +%patch -P 1 -p1 -b .redhat-modules +%patch -P 2 -p1 -b .noflex +%patch -P 3 -p1 -b .nomsg +%patch -P 4 -p1 -b .sast-fixes +%patch -P 5 -p1 -b .pam-env-econf-read-file-fixes +%patch -P 6 -p1 -b .pam-access-local +%patch -P 7 -p1 -b .pam-access-resolve-ip autoreconf -i %build %configure \ - --disable-rpath \ - --libdir=%{_pamlibdir} \ - --includedir=%{_includedir}/security \ -%if ! %{WITH_SELINUX} - --disable-selinux \ -%endif -%if ! %{WITH_AUDIT} - --disable-audit \ -%endif - --disable-static \ - --disable-prelude -make -C po update-gmo -make -# we do not use _smp_mflags because the build of sources in yacc/flex fails + --libdir=%{_pam_libdir} \ + --includedir=%{_includedir}/security \ + --disable-rpath \ + --disable-static \ + --disable-prelude \ + --disable-nis \ + --enable-audit \ + --enable-openssl \ + --enable-selinux \ + --enable-lastlog \ + --enable-db=gdbm +%make_build -C po update-gmo +%make_build %install mkdir -p doc/txts for readme in modules/pam_*/README ; do - cp -f ${readme} doc/txts/README.`dirname ${readme} | sed -e 's|^modules/||'` + cp -f ${readme} doc/txts/README.`dirname ${readme} | sed -e 's|^modules/||'` done -rm -rf doc/txts/README.pam_tally* -rm -rf doc/sag/html/*pam_tally* +# Install the macros file +install -D -m 644 %{SOURCE3} %{buildroot}%{_rpmconfigdir}/macros.d/macros.%{name} # Install the binaries, libraries, and modules. -make install DESTDIR=$RPM_BUILD_ROOT LDCONFIG=: +%make_install LDCONFIG=: -%if %{WITH_SELINUX} # Temporary compat link -ln -sf pam_sepermit.so $RPM_BUILD_ROOT%{_moduledir}/pam_selinux_permit.so -%endif +ln -sf pam_sepermit.so %{buildroot}%{_pam_moduledir}/pam_selinux_permit.so # RPM uses docs from source tree -rm -rf $RPM_BUILD_ROOT%{_datadir}/doc/Linux-PAM +rm -rf %{buildroot}%{_datadir}/doc/Linux-PAM # Included in setup package -rm -f $RPM_BUILD_ROOT%{_sysconfdir}/environment +rm -f %{buildroot}%{_sysconfdir}/environment # Install default configuration files. -install -d -m 755 $RPM_BUILD_ROOT%{_pamconfdir} -install -m 644 %{SOURCE5} $RPM_BUILD_ROOT%{_pamconfdir}/other -install -m 644 %{SOURCE6} $RPM_BUILD_ROOT%{_pamconfdir}/system-auth -install -m 644 %{SOURCE7} $RPM_BUILD_ROOT%{_pamconfdir}/password-auth -install -m 644 %{SOURCE8} $RPM_BUILD_ROOT%{_pamconfdir}/fingerprint-auth -install -m 644 %{SOURCE9} $RPM_BUILD_ROOT%{_pamconfdir}/smartcard-auth -install -m 644 %{SOURCE10} $RPM_BUILD_ROOT%{_pamconfdir}/config-util -install -m 644 %{SOURCE16} $RPM_BUILD_ROOT%{_pamconfdir}/postlogin -install -m 600 /dev/null $RPM_BUILD_ROOT%{_secconfdir}/opasswd -install -d -m 755 $RPM_BUILD_ROOT/var/log -install -d -m 755 $RPM_BUILD_ROOT/var/run/faillock -install -d -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/motd.d -install -d -m 755 $RPM_BUILD_ROOT/usr/lib/motd.d -install -d -m 755 $RPM_BUILD_ROOT/run/motd.d +install -d -m 755 %{buildroot}%{_pam_confdir} +install -d -m 755 %{buildroot}%{_pam_vendordir} +install -m 644 %{SOURCE5} %{buildroot}%{_pam_confdir}/other +install -m 644 %{SOURCE10} %{buildroot}%{_pam_confdir}/config-util +install -m 600 /dev/null %{buildroot}%{_pam_secconfdir}/opasswd +install -d -m 755 %{buildroot}/var/log +install -d -m 755 %{buildroot}/var/run/faillock # Install man pages. -install -m 644 %{SOURCE12} %{SOURCE13} %{SOURCE17} $RPM_BUILD_ROOT%{_mandir}/man5/ -ln -sf system-auth.5 $RPM_BUILD_ROOT%{_mandir}/man5/password-auth.5 -ln -sf system-auth.5 $RPM_BUILD_ROOT%{_mandir}/man5/fingerprint-auth.5 -ln -sf system-auth.5 $RPM_BUILD_ROOT%{_mandir}/man5/smartcard-auth.5 +install -m 644 %{SOURCE12} %{SOURCE13} %{SOURCE17} %{buildroot}%{_mandir}/man5/ +ln -sf system-auth.5 %{buildroot}%{_mandir}/man5/password-auth.5 +ln -sf system-auth.5 %{buildroot}%{_mandir}/man5/fingerprint-auth.5 +ln -sf system-auth.5 %{buildroot}%{_mandir}/man5/smartcard-auth.5 for phase in auth acct passwd session ; do - ln -sf pam_unix.so $RPM_BUILD_ROOT%{_moduledir}/pam_unix_${phase}.so + ln -sf pam_unix.so %{buildroot}%{_pam_moduledir}/pam_unix_${phase}.so done # Remove .la files and make new .so links -- this depends on the value # of _libdir not changing, and *not* being /usr/lib. for lib in libpam libpamc libpam_misc ; do -rm -f $RPM_BUILD_ROOT%{_pamlibdir}/${lib}.la + rm -f %{buildroot}%{_pam_libdir}/${lib}.la done -rm -f $RPM_BUILD_ROOT%{_moduledir}/*.la +rm -f %{buildroot}%{_pam_moduledir}/*.la -%if "%{_pamlibdir}" != "%{_libdir}" -install -d -m 755 $RPM_BUILD_ROOT%{_libdir} +%if "%{_pam_libdir}" != "%{_libdir}" +install -d -m 755 %{buildroot}%{_libdir} for lib in libpam libpamc libpam_misc ; do -pushd $RPM_BUILD_ROOT%{_libdir} -ln -sf %{_pamlibdir}/${lib}.so.*.* ${lib}.so -popd -rm -f $RPM_BUILD_ROOT%{_pamlibdir}/${lib}.so + pushd %{buildroot}%{_libdir} + ln -sf %{_pam_libdir}/${lib}.so.*.* ${lib}.so + popd + rm -f %{buildroot}%{_pam_libdir}/${lib}.so done %endif # Duplicate doc file sets. -rm -fr $RPM_BUILD_ROOT/usr/share/doc/pam +rm -fr %{buildroot}/usr/share/doc/pam # Install the file for autocreation of /var/run subdirectories on boot -install -m644 -D %{SOURCE15} $RPM_BUILD_ROOT%{_prefix}/lib/tmpfiles.d/pam.conf +install -m644 -D %{SOURCE15} %{buildroot}%{_prefix}/lib/tmpfiles.d/pam.conf + +# Install systemd unit file. +install -m644 -D modules/pam_namespace/pam_namespace.service \ + %{buildroot}%{_unitdir}/pam_namespace.service + +# Install doc files to unified location. +install -d -m 755 %{buildroot}%{_pkgdocdir}/{adg/html,mwg/html,sag/html,txts} +install -p -m 644 doc/specs/rfc86.0.txt %{buildroot}%{_pkgdocdir} +install -p -m 644 doc/txts/* %{buildroot}%{_pkgdocdir}/txts +for i in adg mwg sag; do + install -p -m 644 doc/$i/*.txt %{buildroot}%{_pkgdocdir}/$i + cp -pr doc/$i/html/* %{buildroot}%{_pkgdocdir}/$i/html +done +find %{buildroot}%{_pkgdocdir} -type d | xargs chmod 755 +find %{buildroot}%{_pkgdocdir} -type f | xargs chmod 644 %find_lang Linux-PAM @@ -344,261 +233,375 @@ install -m644 -D %{SOURCE15} $RPM_BUILD_ROOT%{_prefix}/lib/tmpfiles.d/pam.conf # Make sure every module subdirectory gave us a module. Yes, this is hackish. for dir in modules/pam_* ; do if [ -d ${dir} ] ; then -%if ! %{WITH_SELINUX} - [ ${dir} = "modules/pam_selinux" ] && continue - [ ${dir} = "modules/pam_sepermit" ] && continue -%endif -%if ! %{WITH_AUDIT} - [ ${dir} = "modules/pam_tty_audit" ] && continue -%endif - [ ${dir} = "modules/pam_tally" ] && continue - [ ${dir} = "modules/pam_tally2" ] && continue - if ! ls -1 $RPM_BUILD_ROOT%{_moduledir}/`basename ${dir}`*.so ; then - echo ERROR `basename ${dir}` did not build a module. - exit 1 - fi + [ ${dir} = "modules/pam_selinux" ] && continue + [ ${dir} = "modules/pam_sepermit" ] && continue + [ ${dir} = "modules/pam_tty_audit" ] && continue + if ! ls -1 %{buildroot}%{_pam_moduledir}/`basename ${dir}`*.so ; then + echo ERROR `basename ${dir}` did not build a module. + exit 1 + fi fi done # Check for module problems. Specifically, check that every module we just # installed can actually be loaded by a minimal PAM-aware application. -/sbin/ldconfig -n $RPM_BUILD_ROOT%{_pamlibdir} -for module in $RPM_BUILD_ROOT%{_moduledir}/pam*.so ; do - if ! env LD_LIBRARY_PATH=$RPM_BUILD_ROOT%{_pamlibdir} \ - %{SOURCE11} -ldl -lpam -L$RPM_BUILD_ROOT%{_libdir} ${module} ; then - echo ERROR module: ${module} cannot be loaded. - exit 1 - fi +/sbin/ldconfig -n %{buildroot}%{_pam_libdir} +for module in %{buildroot}%{_pam_moduledir}/pam*.so ; do + if ! env LD_LIBRARY_PATH=%{buildroot}%{_pam_libdir} \ + %{SOURCE11} -ldl -lpam -L%{buildroot}%{_libdir} ${module} ; then + echo ERROR module: ${module} cannot be loaded. + exit 1 + fi done -%post -p /sbin/ldconfig - -%postun -p /sbin/ldconfig - %files -f Linux-PAM.lang -%dir %{_pamconfdir} -%config(noreplace) %{_pamconfdir}/other -%config(noreplace) %{_pamconfdir}/system-auth -%config(noreplace) %{_pamconfdir}/password-auth -%config(noreplace) %{_pamconfdir}/fingerprint-auth -%config(noreplace) %{_pamconfdir}/smartcard-auth -%config(noreplace) %{_pamconfdir}/config-util -%config(noreplace) %{_pamconfdir}/postlogin -%{!?_licensedir:%global license %%doc} %license Copyright %license gpl-2.0.txt -%doc doc/txts -%doc doc/sag/*.txt doc/sag/html -%{_pamlibdir}/libpam.so.* -%{_pamlibdir}/libpamc.so.* -%{_pamlibdir}/libpam_misc.so.* -%{_sbindir}/pam_console_apply +%dir %{_pam_confdir} +%dir %{_pam_vendordir} +%config(noreplace) %{_pam_confdir}/other +%config(noreplace) %{_pam_confdir}/config-util +%{_rpmconfigdir}/macros.d/macros.%{name} +%{_sbindir}/pam_namespace_helper %{_sbindir}/faillock %attr(4755,root,root) %{_sbindir}/pam_timestamp_check %attr(4755,root,root) %{_sbindir}/unix_chkpwd %attr(0700,root,root) %{_sbindir}/unix_update %attr(0755,root,root) %{_sbindir}/mkhomedir_helper %attr(0755,root,root) %{_sbindir}/pwhistory_helper -%dir %{_moduledir} -%{_moduledir}/pam_access.so -%{_moduledir}/pam_chroot.so -%{_moduledir}/pam_console.so -%{_moduledir}/pam_cracklib.so -%{_moduledir}/pam_debug.so -%{_moduledir}/pam_deny.so -%{_moduledir}/pam_echo.so -%{_moduledir}/pam_env.so -%{_moduledir}/pam_exec.so -%{_moduledir}/pam_faildelay.so -%{_moduledir}/pam_faillock.so -%{_moduledir}/pam_filter.so -%{_moduledir}/pam_ftp.so -%{_moduledir}/pam_group.so -%{_moduledir}/pam_issue.so -%{_moduledir}/pam_keyinit.so -%{_moduledir}/pam_lastlog.so -%{_moduledir}/pam_limits.so -%{_moduledir}/pam_listfile.so -%{_moduledir}/pam_localuser.so -%{_moduledir}/pam_loginuid.so -%{_moduledir}/pam_mail.so -%{_moduledir}/pam_mkhomedir.so -%{_moduledir}/pam_motd.so -%{_moduledir}/pam_namespace.so -%{_moduledir}/pam_nologin.so -%{_moduledir}/pam_permit.so -%{_moduledir}/pam_postgresok.so -%{_moduledir}/pam_pwhistory.so -%{_moduledir}/pam_rhosts.so -%{_moduledir}/pam_rootok.so -%if %{WITH_SELINUX} -%{_moduledir}/pam_selinux.so -%{_moduledir}/pam_selinux_permit.so -%{_moduledir}/pam_sepermit.so -%endif -%{_moduledir}/pam_securetty.so -%{_moduledir}/pam_shells.so -%{_moduledir}/pam_stress.so -%{_moduledir}/pam_succeed_if.so -%{_moduledir}/pam_time.so -%{_moduledir}/pam_timestamp.so -%if %{WITH_AUDIT} -%{_moduledir}/pam_tty_audit.so -%endif -%{_moduledir}/pam_umask.so -%{_moduledir}/pam_unix.so -%{_moduledir}/pam_unix_acct.so -%{_moduledir}/pam_unix_auth.so -%{_moduledir}/pam_unix_passwd.so -%{_moduledir}/pam_unix_session.so -%{_moduledir}/pam_userdb.so -%{_moduledir}/pam_usertype.so -%{_moduledir}/pam_warn.so -%{_moduledir}/pam_wheel.so -%{_moduledir}/pam_xauth.so -%{_moduledir}/pam_filter -%dir %{_secconfdir} -%config(noreplace) %{_secconfdir}/access.conf -%config(noreplace) %{_secconfdir}/chroot.conf -%config %{_secconfdir}/console.perms -%config(noreplace) %{_secconfdir}/console.handlers -%config(noreplace) %{_secconfdir}/faillock.conf -%config(noreplace) %{_secconfdir}/group.conf -%config(noreplace) %{_secconfdir}/limits.conf -%dir %{_secconfdir}/limits.d -%config(noreplace) %{_secconfdir}/namespace.conf -%dir %{_secconfdir}/namespace.d -%attr(755,root,root) %config(noreplace) %{_secconfdir}/namespace.init -%config(noreplace) %{_secconfdir}/pam_env.conf -%config(noreplace) %{_secconfdir}/pwhistory.conf -%config(noreplace) %{_secconfdir}/time.conf -%config(noreplace) %{_secconfdir}/opasswd -%dir %{_secconfdir}/console.apps -%dir %{_secconfdir}/console.perms.d -%dir /var/run/console -%if %{WITH_SELINUX} -%config(noreplace) %{_secconfdir}/sepermit.conf +%dir %{_pam_moduledir} +%{_pam_moduledir}/pam_access.so +%{_pam_moduledir}/pam_canonicalize_user.so +%{_pam_moduledir}/pam_chroot.so +%{_pam_moduledir}/pam_debug.so +%{_pam_moduledir}/pam_deny.so +%{_pam_moduledir}/pam_echo.so +%{_pam_moduledir}/pam_env.so +%{_pam_moduledir}/pam_exec.so +%{_pam_moduledir}/pam_faildelay.so +%{_pam_moduledir}/pam_faillock.so +%{_pam_moduledir}/pam_filter.so +%{_pam_moduledir}/pam_ftp.so +%{_pam_moduledir}/pam_group.so +%{_pam_moduledir}/pam_issue.so +%{_pam_moduledir}/pam_keyinit.so +%{_pam_moduledir}/pam_lastlog.so +%{_pam_moduledir}/pam_limits.so +%{_pam_moduledir}/pam_listfile.so +%{_pam_moduledir}/pam_localuser.so +%{_pam_moduledir}/pam_loginuid.so +%{_pam_moduledir}/pam_mail.so +%{_pam_moduledir}/pam_mkhomedir.so +%{_pam_moduledir}/pam_motd.so +%{_pam_moduledir}/pam_namespace.so +%{_pam_moduledir}/pam_nologin.so +%{_pam_moduledir}/pam_permit.so +%{_pam_moduledir}/pam_postgresok.so +%{_pam_moduledir}/pam_pwhistory.so +%{_pam_moduledir}/pam_rhosts.so +%{_pam_moduledir}/pam_rootok.so +%{_pam_moduledir}/pam_selinux.so +%{_pam_moduledir}/pam_selinux_permit.so +%{_pam_moduledir}/pam_sepermit.so +%{_pam_moduledir}/pam_securetty.so +%{_pam_moduledir}/pam_setquota.so +%{_pam_moduledir}/pam_shells.so +%{_pam_moduledir}/pam_stress.so +%{_pam_moduledir}/pam_succeed_if.so +%{_pam_moduledir}/pam_time.so +%{_pam_moduledir}/pam_timestamp.so +%{_pam_moduledir}/pam_tty_audit.so +%{_pam_moduledir}/pam_umask.so +%{_pam_moduledir}/pam_unix.so +%{_pam_moduledir}/pam_unix_acct.so +%{_pam_moduledir}/pam_unix_auth.so +%{_pam_moduledir}/pam_unix_passwd.so +%{_pam_moduledir}/pam_unix_session.so +%{_pam_moduledir}/pam_userdb.so +%{_pam_moduledir}/pam_usertype.so +%{_pam_moduledir}/pam_warn.so +%{_pam_moduledir}/pam_wheel.so +%{_pam_moduledir}/pam_xauth.so +%{_pam_moduledir}/pam_filter +%{_unitdir}/pam_namespace.service +%dir %{_pam_secconfdir} +%config(noreplace) %{_pam_secconfdir}/access.conf +%config(noreplace) %{_pam_secconfdir}/chroot.conf +%config(noreplace) %{_pam_secconfdir}/faillock.conf +%config(noreplace) %{_pam_secconfdir}/group.conf +%config(noreplace) %{_pam_secconfdir}/limits.conf +%dir %{_pam_secconfdir}/limits.d +%config(noreplace) %{_pam_secconfdir}/namespace.conf +%dir %{_pam_secconfdir}/namespace.d +%attr(755,root,root) %config(noreplace) %{_pam_secconfdir}/namespace.init +%config(noreplace) %{_pam_secconfdir}/pam_env.conf +%config(noreplace) %{_pam_secconfdir}/pwhistory.conf +%config(noreplace) %{_pam_secconfdir}/time.conf +%config(noreplace) %{_pam_secconfdir}/opasswd +%config(noreplace) %{_pam_secconfdir}/sepermit.conf %dir /var/run/sepermit -%endif %dir /var/run/faillock -%dir %{_sysconfdir}/motd.d -%dir /run/motd.d -%dir /usr/lib/motd.d %{_prefix}/lib/tmpfiles.d/pam.conf %{_mandir}/man5/* %{_mandir}/man8/* %files devel +%dir %{_pkgdocdir} +%doc %{_pkgdocdir}/rfc86.0.txt %{_includedir}/security %{_mandir}/man3/* %{_libdir}/libpam.so %{_libdir}/libpamc.so %{_libdir}/libpam_misc.so -%doc doc/mwg/*.txt doc/mwg/html -%doc doc/adg/*.txt doc/adg/html -%doc doc/specs/rfc86.0.txt +%{_libdir}/pkgconfig/pam.pc +%{_libdir}/pkgconfig/pam_misc.pc +%{_libdir}/pkgconfig/pamc.pc + +%files doc +%doc %{_pkgdocdir} + +%files libs +%license Copyright +%license gpl-2.0.txt +%{_pam_libdir}/libpam.so.%{so_ver}* +%{_pam_libdir}/libpamc.so.%{so_ver}* +%{_pam_libdir}/libpam_misc.so.%{so_ver}* %changelog -* Mon Nov 25 2024 Iker Pedrosa - 1.3.1-36 +* Thu Nov 21 2024 Iker Pedrosa - 1.6.1-7 - pam_access: rework resolving of tokens as hostname. - Resolves: CVE-2024-10963 and RHEL-66242 + Resolves: CVE-2024-10963 and RHEL-66241 -* Mon Nov 4 2024 Iker Pedrosa - 1.3.1-35 -- pam_unix: always run the helper to obtain shadow password file entries. - CVE-2024-10041. Resolves: RHEL-62877 +* Mon Nov 4 2024 Iker Pedrosa - 1.6.1-6 - pam_access: always match local address and clarify LOCAL keyword behaviour. - Resolves: RHEL-23018 -- libpam: support long lines in service files. Resolves: RHEL-5051 + Resolves: RHEL-65223 -* Thu Apr 4 2024 Iker Pedrosa - 1.3.1-34 -- fix formatting of audit messages. Resolves: RHEL-28620 +* Tue Oct 29 2024 Troy Dawson +- Bump release for October 2024 mass rebuild: + Resolves: RHEL-64018 -* Mon Feb 12 2024 Iker Pedrosa - 1.3.1-33 -- pam_namespace: protect_dir(): use O_DIRECTORY to prevent local DoS - situations. CVE-2024-22365. Resolves: RHEL-21242 +* Fri Aug 30 2024 Iker Pedrosa - 1.6.1-4 +- spec: Use Requires(meta): authselect. Resolves: RHEL-56703 -* Fri Jan 26 2024 Iker Pedrosa - 1.3.1-32 -- pam_access: handle hostnames in access.conf. Resolves: RHEL-3374 +* Mon Jun 24 2024 Troy Dawson +- Bump release for June 2024 mass rebuild -* Mon Jan 8 2024 Iker Pedrosa - 1.3.1-31 -- pam_faillock: create tallydir before creating tallyfile. Resolves: RHEL-19810 +* Tue Jun 18 2024 Iker Pedrosa - 1.6.1-2 +- Fix static analyzer detected issues. Resolves: RHEL-36475 +- pam_env: fixes for NULL environment variables -* Thu Nov 2 2023 Iker Pedrosa - 1.3.1-30 -- pam_unix: enable bcrypt. Resolves: RHEL-5057 +* Wed Apr 10 2024 Iker Pedrosa - 1.6.1-1 +- Rebase to release 1.6.1 +- Disable nis support -* Mon Jun 26 2023 Iker Pedrosa - 1.3.1-27 -- pam_misc: make length of misc_conv() configurable and set to 4096. Resolves: #2209785 +* Thu Feb 15 2024 Iker Pedrosa - 1.6.0-2 +- pam_unix: do not warn if password aging is disabled (#2263689) -* Tue May 16 2023 Iker Pedrosa - 1.3.1-26 -- smartcard-auth: modify the content to remove unnecessary modules. Resolves: #1983683 +* Tue Jan 23 2024 Iker Pedrosa - 1.6.0-1 +- Rebase to release 1.6.0 + Resolves: #2258964 -* Tue Nov 29 2022 Iker Pedrosa - 1.3.1-25 -- pam_motd: avoid unnecessary logging. Resolves: #2091062 -- pam_lastlog: check localtime_r() return value. Resolves: #2012871 -- pam_faillock: clarify missing user faillock files after reboot. Resolves: #2062512 -- pam_faillock: avoid logging an erroneous consecutive login failure message. Resolves: #2082442 +* Sun Jan 21 2024 Fedora Release Engineering +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild -* Thu Sep 29 2022 Iker Pedrosa - 1.3.1-24 -- pam_pwhistory: load configuration from file. Resolves: #2068461 +* Mon Dec 18 2023 Ding-Yi Chen - 1.5.3-9 +- pam.conf: Remove tallylog (#2253817) -* Wed Jul 13 2022 Iker Pedrosa - 1.3.1-22 -- Regenerate the /run/motd.d at each boot. Resolves: #2104878 +* Tue Nov 21 2023 Iker Pedrosa - 1.5.3-8 +- Suggest libdb-convert-util (#2245149 and #1788543) -* Thu Jun 23 2022 Iker Pedrosa - 1.3.1-21 -- pam_usertype: only use SYS_UID_MAX for system users. Resolves: #1949137 +* Tue Nov 7 2023 Iker Pedrosa - 1.5.3-7 +- Include openssl-devel build dependency -* Thu May 26 2022 Iker Pedrosa - 1.3.1-20 -- faillock: load configuration from file. Resolves: #1978029 +* Fri Nov 3 2023 Iker Pedrosa - 1.5.3-6 +- Drop explicit dependencies (#2247250) -* Mon May 23 2022 Iker Pedrosa - 1.3.1-19 -- Add the motd.d directories (empty) to silence warnings and to - provide proper ownership for them. Resolves: #2014458 +* Mon Oct 30 2023 Iker Pedrosa - 1.5.3-5 +- Explicitly state package dependencies and reorganize them -* Thu May 19 2022 Iker Pedrosa - 1.3.1-18 -- pam_motd: fix memory leak. Resolves: #2014458 +* Mon Oct 23 2023 Iker Pedrosa - 1.5.2-4 +- Switch pam_userdb from BerkeleyDB to GDBM (#2245149 and #1788543) -* Tue May 17 2022 Iker Pedrosa - 1.3.1-17 -- pam_keyinit: thread-safe implementation. Resolves: #1997969 -- pam_motd: support multiple motd paths specified, with filename overrides. Resolves: #2014458 +* Thu Oct 19 2023 Iker Pedrosa - 1.5.3-3 +- pam_pwhistory: fix passing NULL filename argument to pwhistory helper -* Fri Jan 28 2022 Iker Pedrosa - 1.3.1-16 -- pam_limits: "Unlimited" is not a valid value for RLIMIT_NOFILE. Resolves: #2047655 +* Thu Jul 20 2023 Fedora Release Engineering +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild -* Mon May 3 2021 Iker Pedrosa 1.3.1-15 -- pam_userdb: Prevent garbage characters from db (#1791965) +* Fri May 19 2023 Björn Esser - 1.5.3-1 +- Rebase to release 1.5.3 + Resolves: #2196709 +- Drop pam-1.5.2-pwhistory-config.patch and pam-1.5.2-configure-c99.patch, + as those patches are implemented upstream +- Realign left-over patches +- Update build requirements for documentation (docbook5) +- Remove --enable-vendordir from configuration +- Enable (deprecated) pam_lastlog module -* Thu Nov 5 2020 Iker Pedrosa 1.3.1-14 -- Revert 1.3.1-12 +* Tue Apr 25 2023 Björn Esser - 1.5.2-19 +- Replace deprecated '%%patchN' with '%%patch -P N' -* Fri Oct 30 2020 Iker Pedrosa 1.3.1-13 -- pam_wheel: if getlogin fails fallback to PAM_RUSER: fixed malformed patch (#1866866) -- pam_namespace: polyinstantiation refer to gdm doc (#1861841) +* Tue Apr 25 2023 Arjun Shankar - 1.5.2-18 +- Port configure script to C99 -* Thu Jul 16 2020 Peter Robinson - 1.3.1-12 -- Add the motd.d directories (empty) to silence warnings and to - provide proper ownership for them (#1847501) +* Thu Feb 9 2023 Iker Pedrosa - 1.5.2-17 +- Remove pam_console (#2166692) +- Rebase to pam-redhat-1.2.0 -* Fri May 15 2020 Iker Pedrosa 1.3.1-11 -- pam_usertype: fixed malformed patch +* Thu Jan 19 2023 Fedora Release Engineering +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild -* Tue Apr 21 2020 Iker Pedrosa 1.3.1-10 +* Mon Dec 19 2022 Iker Pedrosa - 1.5.2-15 +- SPDX license migration + +* Fri Jul 22 2022 Fedora Release Engineering +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Mon Jul 18 2022 Iker Pedrosa - 1.5.2-13 +- pam_pwhistory: load config from file + +* Sun Feb 27 2022 Zbigniew Jędrzejewski-Szmek - 1.5.2-12 +- Add Conflicts for pam version before the split + +* Thu Feb 17 2022 Björn Esser - 1.5.2-11 +- Split shared libraries into pam-libs package (#2055572) + +* Thu Jan 20 2022 Fedora Release Engineering +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Mon Jan 10 2022 Ondrej Mosnacek - 1.5.2-9 +- Remove conflicting ownership of motd.d directories + +* Tue Nov 16 2021 Pavel Březina - 1.5.2-8 +- systemd-auth, smartcard-auth, fingerprint-auth, password-auth and postlogin are now owned by authselect (#2023738) + +* Fri Nov 12 2021 Björn Esser - 1.5.2-7 +- Rebuild(libnsl2) + +* Wed Oct 06 2021 Björn Esser - 1.5.2-6 +- Remove old cruft from spec file +- Rename docs sub-package to doc +- Replace $RPM_BUILD_ROOT with %%{buildroot} +- Move documentation to %%{_pkgdocdir} +- Constantly use spaces for indentation + +* Thu Sep 23 2021 Björn Esser - 1.5.2-5 +- Rebase to pam-redhat-1.1.5 +- Drop explicit dependency on openssl, as auto-deps will pull it in +- Conditionalize BR: openssl >= 3.0.0 to supported distributions + +* Thu Sep 23 2021 Iker Pedrosa - 1.5.2-4 +- Remove the /etc/motd.d directory to exclude its ownership from pam (#1968131) +- pam_timestamp: enable openssl hmac authentication on supported + distributions (Fedora >= 36 and RHEL >= 9) (#1947294) +- Clean spec file: organize dependencies and move URL location + +* Thu Sep 23 2021 Björn Esser - 1.5.2-3 +- Update patch for parallel build + +* Wed Sep 22 2021 Björn Esser - 1.5.2-2 +- Add a patch to fix parallel builds with autgenerated sources + +* Sat Sep 04 2021 Björn Esser - 1.5.2-1 +- Rebase to release 1.5.2 + Resolves: #2001208 +- Add so_ver macro to avoid accidental soname bumps +- Add a patch to fix a missing header include in pam_console + +* Thu Jul 22 2021 Iker Pedrosa - 1.5.1-9 +- Add macros file to allow other packages to stop hardcoding directory names + +* Fri Jul 9 2021 Iker Pedrosa - 1.5.1-8 +- Fix issues detected by covscan tool + +* Thu Jun 10 2021 Björn Esser - 1.5.1-7 +- Change the default password hash method to yescrypt + +* Thu Jun 10 2021 Björn Esser - 1.5.1-6 +- Add a patch to not use crypt_checksalt for password expiration + Resolves: #1965345, #1967150 + +* Fri Apr 16 2021 Benjamin Berg - 1.5.1-5 +- Add script to avoid fingerprint-auth issues for long term Fedora users + Resolves: #1942443 + +* Mon Apr 12 2021 Iker Pedrosa - 1.5.1-4 +- Change fingerprint-auth.pamd to return PAM_AUTHINFO_UNAVAIL from pam_fprintd.so +- Clean auto-generated message from pam stack files + +* Tue Jan 26 2021 Fedora Release Engineering - 1.5.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Mon Nov 30 2020 Iker Pedrosa - 1.5.1-2 +- Add BuildRequires: make (#1902520) + +* Thu Nov 26 2020 Iker Pedrosa - 1.5.1-1 +- Rebase to release 1.5.1 +- fix CVE-2020-27780: authentication bypass when the user doesn't exist + and root password is blank (#1901173) + +* Wed Nov 11 2020 Iker Pedrosa - 1.5.0-1 +- Rebase to release 1.5.0 +- Rebase to pam-redhat-1.1.4 +- Remove pam_cracklib, pam_tally and pam_tally2 +- spec file cleanup + +* Fri Nov 6 2020 Iker Pedrosa - 1.4.0-7 +- libpam: fix memory leak in pam_start (#1894630) + +* Mon Oct 19 2020 Iker Pedrosa - 1.4.0-6 +- pam_unix: fix missing initialization of daysleft (#1887077) +- pam_motd: change privilege message prompt to default (#1861640) + +* Wed Oct 14 2020 Iker Pedrosa - 1.4.0-5 +- pam_motd: read motd files with target user credentials skipping unreadable ones (#1861640) +- Clarify upstreamed patches + +* Tue Aug 04 2020 Tom Stellard - 1.4.0-4 +- Add BuildRequires: gcc +- https://docs.fedoraproject.org/en-US/packaging-guidelines/C_and_C++/#_packaging + +* Tue Jul 28 2020 Fedora Release Engineering - 1.4.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Thu Jul 2 2020 Iker Pedrosa - 1.4.0-2 +- Enable layered configuration with distribution configs in /usr/share/pam.d +- Added new pam-redhat tarball to lookaside cache + +* Wed Jun 24 2020 Iker Pedrosa - 1.4.0-1 +- Rebased to release 1.4.0 +- Rebased to pam-redhat-1.1.3 +- Removed pam_cracklib as it has been deprecated + +* Mon Jun 22 2020 Iker Pedrosa - 1.3.1-28 +- pam_faillock: change /run/faillock/$USER permissions to 0660 (#1661822) + +* Wed Jun 17 2020 Iker Pedrosa - 1.3.1-27 +- pam_unix and pam_usertype: avoid determining if user exists (#1629598) + +* Thu May 14 2020 Iker Pedrosa 1.3.1-26 +- pam_tty_audit: if kernel audit is disabled return PAM_IGNORE (#1775357) - pam_modutil_sanitize_helper_fds: fix SIGPIPE effect of PAM_MODUTIL_PIPE_FD (#1791970) -* Fri Apr 17 2020 Iker Pedrosa 1.3.1-9 -- pam_usertype: new module to tell if uid is in login.defs ranges (#1810474) -- pam_tty_audit: if kernel audit is disabled return PAM_IGNORE (#1775357) +* Thu Apr 23 2020 Iker Pedrosa - 1.3.1-25 +- docs: splitted documentation in subpackage -docs -* Thu Dec 19 2019 Tomáš Mráz 1.3.1-8 -- pam_motd: Document how to properly silence unwanted motd messages +* Mon Mar 9 2020 Iker Pedrosa - 1.3.1-24 +- pam_selinux: check unknown object classes or permissions in current policy -* Mon Dec 16 2019 Tomáš Mráz 1.3.1-6 +* Tue Feb 4 2020 Pavel Březina - 1.3.1-23 +- Add pam_usertype.so + +* Wed Jan 29 2020 Fedora Release Engineering - 1.3.1-22 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Wed Dec 18 2019 Tomáš Mráz 1.3.1-21 - pam_faillock: Fix regression in admin_group support -* Wed Oct 16 2019 Tomáš Mráz 1.3.1-5 -- pam_faillock: Support configuration file /etc/security/faillock.conf -- pam_faillock: Support local_users_only option +* Wed Oct 16 2019 Tomáš Mráz 1.3.1-20 - pam_namespace: Support noexec, nosuid and nodev flags for tmpfs mounts -- Drop tallylog and pam_tally[2] documentation +- Drop tallylog and pam_tally documentation +- pam_faillock: Support local_users_only option - pam_lastlog: Do not display failed attempts with PAM_SILENT flag - pam_lastlog: Support unlimited option to override fsize limit - pam_unix: Log if user authenticated without password @@ -606,13 +609,70 @@ done - Optimize closing fds when spawning helpers - Fix duplicate password verification in pam_authtok_verify() -* Fri Dec 7 2018 Tomáš Mráz 1.3.1-4 -- Drop pam_tally2 which was obsoleted and deprecated long time ago +* Mon Sep 9 2019 Tomáš Mráz 1.3.1-19 +- pam_faillock: Support configuration file /etc/security/faillock.conf -* Mon Sep 10 2018 Tomáš Mráz 1.3.1-3 +* Thu Jul 25 2019 Fedora Release Engineering - 1.3.1-18 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Fri Feb 01 2019 Fedora Release Engineering - 1.3.1-17 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Mon Jan 14 2019 Björn Esser - 1.3.1-16 +- Rebuilt for libcrypt.so.2 (#1666033) + +* Thu Dec 20 2018 Tomáš Mráz 1.3.1-15 +- Add the motd.d directories (empty) to silence warnings and to + provide proper ownership for them (#1660935) + +* Tue Dec 4 2018 Tomáš Mráz 1.3.1-14 +- Update Red Hat PAM modules to version 1.0.0 which includes pam_faillock +- Drop also pam_tally2 which was obsoleted and deprecated long time ago + +* Sun Dec 02 2018 Björn Esser - 1.3.1-13 +- Backport upstream commit reporting disabled or invalid hashes to syslog +- Backport upstream commit fixing syslog for disabled or invalid hashes + +* Wed Nov 28 2018 Robert Fairley 1.3.1-12 +- Backport upstream commit pam_motd: Support multiple motd paths specified, with filename overrides (#69) +- Backport upstream commit pam_motd: Fix segmentation fault when no motd_dir specified (#76) + +* Mon Nov 26 2018 Tomáš Mráz 1.3.1-11 +- Completely drop the check of invalid or disabled salt via crypt_checksalt + +* Sun Nov 25 2018 Björn Esser - 1.3.1-10 +- Fix passphraseless sudo with crypt_checksalt (#1653023) + +* Fri Nov 23 2018 Björn Esser - 1.3.1-9 +- Backport upstream commit removing an obsolete prototype +- Backport upstream commit preferring bcrypt_b ($2b$) for blowfish +- Backport upstream commit preferring gensalt with autoentropy +- Backport upstream commit using crypt_checksalt for password aging +- Backport upstream commit adding support for (gost-)yescrypt +- Update the no-MD5-fallback patch for alignment + +* Fri Nov 16 2018 Björn Esser - 1.3.1-8 +- Use %%ldconfig_scriptlets +- Drop Requires(post), not needed anymore +- Prefer %%global over %%define + +* Tue Nov 13 2018 Björn Esser - 1.3.1-7 +- when building against libxcrypt >= 4.3.3-2, we can avoid the explicit + dependency on libxcrypt >= 4.3.3-1 + +* Mon Nov 12 2018 Björn Esser - 1.3.1-6 +- add explicit (Build)Requires for libxcrypt >= 4.3.3-1 + +* Mon Nov 12 2018 Björn Esser - 1.3.1-5 +- rebuilt against libxcrypt-4.3.3 to enable the use of crypt_gensalt_r + +* Mon Sep 10 2018 Tomáš Mráz 1.3.1-4 - add pam_umask to postlogin PAM configuration file - fix some issues found by Coverity scan +* Fri Jul 13 2018 Fedora Release Engineering - 1.3.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + * Fri Jun 8 2018 Tomáš Mráz 1.3.1-1 - use /run instead of /var/run in pamtmp.conf (#1588612) @@ -1323,12 +1383,12 @@ support) - pam_unix: always honor nis flag on password change (by Aaron Hope) * Wed Aug 24 2005 Tomas Mraz 0.80-7 -- don't fail in audit code when audit is not compiled in +- don't fail in audit code when audit is not compiled in on the newest kernels (#166422) * Mon Aug 01 2005 Tomas Mraz 0.80-6 - add option to pam_loginuid to require auditd - + * Fri Jul 29 2005 Tomas Mraz 0.80-5 - fix NULL dereference in pam_userdb (#164418) @@ -1463,17 +1523,17 @@ support) * Tue Oct 19 2004 Tomas Mraz 0.77-63 - Fix checking of group %%group syntax in pam_limits -- Drop fencepost patch as it was already fixed +- Drop fencepost patch as it was already fixed by upstream change from 0.75 to 0.77 - Fix brokenshadow patch * Mon Oct 11 2004 Tomas Mraz 0.77-62 - Added bluetooth, raw1394 and flash to console.perms -- pam_console manpage fix +- pam_console manpage fix * Mon Oct 11 2004 Tomas Mraz 0.77-61 - #129328 pam_env shouldn't abort on missing /etc/environment -- #126985 pam_stack should always copy the conversation function +- #126985 pam_stack should always copy the conversation function - #127524 add /etc/security/opasswd to files * Tue Sep 28 2004 Phil Knirsch 0.77-60 @@ -1490,7 +1550,7 @@ support) * Mon Sep 13 2004 Tomas Mraz 0.77-56 - #75454 fixed locking when changing password -- #127054 +- #127054 - #125653 removed unnecessary getgrouplist call - #124979 added quiet option to pam_succeed_if @@ -1501,7 +1561,7 @@ support) - Move pam_console.lock to /var/run/console/ * Thu Jul 29 2004 Dan Walsh 0.77-53 -- Close fd[1] before pam_modutilread so that unix_verify will complete +- Close fd[1] before pam_modutilread so that unix_verify will complete * Tue Jul 27 2004 Alan Cox 0.77-52 - First chunk of Steve Grubb's resource leak and other fixes @@ -1613,7 +1673,7 @@ support) - Cleanup unix_chkpwd * Mon Nov 03 2003 Dan Walsh 0.77-17.sel -- Fix tty handling +- Fix tty handling - Add back multiple handling * Mon Oct 27 2003 Dan Walsh 0.77-16.sel @@ -1635,7 +1695,7 @@ support) - Add Russell Coker patch to handle /dev/pty * Fri Oct 17 2003 Dan Walsh 0.77-13.sel -- Turn on Selinux +- Turn on Selinux * Fri Oct 17 2003 Dan Walsh 0.77-12 - Fix pam_timestamp to work when 0 seconds have elapsed @@ -1644,7 +1704,7 @@ support) - Turn off selinux * Thu Sep 25 2003 Dan Walsh 0.77-10.sel -- Turn on Selinux and remove multiple choice of context. +- Turn on Selinux and remove multiple choice of context. * Wed Sep 24 2003 Dan Walsh 0.77-10 - Turn off selinux @@ -1731,9 +1791,9 @@ support) - use $ISA in default configs * Fri Oct 04 2002 Elliot Lee 0.75-42 -- Since cracklib-dicts location will not be correctly detected without +- Since cracklib-dicts location will not be correctly detected without that package being installed, add buildreq for cracklib-dicts. -- Add patch57: makes configure use $LIBNAME when searching for cracklib +- Add patch57: makes configure use $LIBNAME when searching for cracklib dicts, and error out if not found. * Thu Sep 12 2002 Than Ngo 0.75-41.1 diff --git a/SOURCES/pamtmp.conf b/pamtmp.conf similarity index 75% rename from SOURCES/pamtmp.conf rename to pamtmp.conf index e4cfe2a..e94a860 100644 --- a/SOURCES/pamtmp.conf +++ b/pamtmp.conf @@ -1,4 +1,3 @@ d /run/console 0755 root root - d /run/faillock 0755 root root - d /run/sepermit 0755 root root - -d /run/motd.d 0755 root root - diff --git a/SOURCES/postlogin.5 b/postlogin.5 similarity index 100% rename from SOURCES/postlogin.5 rename to postlogin.5 diff --git a/sources b/sources new file mode 100644 index 0000000..b676524 --- /dev/null +++ b/sources @@ -0,0 +1,2 @@ +SHA512 (Linux-PAM-1.6.1.tar.xz) = ddb5a5f296f564b76925324550d29f15d342841a97815336789c7bb922a8663e831edeb54f3dcd1eaf297e3325c9e2e6c14b8740def5c43cf3f160a8a14fa2ea +SHA512 (pam-redhat-1.2.0.tar.xz) = f676a6c8df0cf3836018b1a67ded1d40937b88ff046e5c6b22bac46cb05e27970ef6a7ce224269e4c0d1ca9375c72e77880cf9114e936a7de9c423bf443d27ee diff --git a/SOURCES/system-auth.5 b/system-auth.5 similarity index 100% rename from SOURCES/system-auth.5 rename to system-auth.5