Various fixes
- pam_unix: sync expiry checks with shadow - pam.conf: remove tallylog Resolves: RHEL-70519 Resolves: RHEL-15324 Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
This commit is contained in:
Iker Pedrosa
parent
63c249a731
commit
682c67a65d
105
pam-1.5.1-pam-unix-blank-expiration.patch
Normal file
105
pam-1.5.1-pam-unix-blank-expiration.patch
Normal file
@ -0,0 +1,105 @@
|
||||
diff -up Linux-PAM-1.5.1/modules/pam_unix/passverify.c.pam-unix-blank-expiration Linux-PAM-1.5.1/modules/pam_unix/passverify.c
|
||||
--- Linux-PAM-1.5.1/modules/pam_unix/passverify.c.pam-unix-blank-expiration 2025-04-14 14:40:34.181165272 +0200
|
||||
+++ Linux-PAM-1.5.1/modules/pam_unix/passverify.c 2025-04-14 14:42:11.740385381 +0200
|
||||
@@ -5,6 +5,7 @@
|
||||
#include <security/_pam_macros.h>
|
||||
#include <security/pam_modules.h>
|
||||
#include "support.h"
|
||||
+#include <limits.h>
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include <sys/types.h>
|
||||
@@ -286,14 +286,29 @@ PAMH_ARG_DECL(int get_pwd_hash,
|
||||
return PAM_SUCCESS;
|
||||
}
|
||||
|
||||
+/*
|
||||
+ * invariant: 0 <= num1
|
||||
+ * invariant: 0 <= num2
|
||||
+ */
|
||||
+static int
|
||||
+subtract(long num1, long num2)
|
||||
+{
|
||||
+ long value = num1 - num2;
|
||||
+ if (value < INT_MIN)
|
||||
+ return INT_MIN;
|
||||
+ if (value > INT_MAX)
|
||||
+ return INT_MAX;
|
||||
+ return (int)value;
|
||||
+}
|
||||
+
|
||||
PAMH_ARG_DECL(int check_shadow_expiry,
|
||||
struct spwd *spent, int *daysleft)
|
||||
{
|
||||
- long int curdays;
|
||||
+ long int curdays, passed;
|
||||
*daysleft = -1;
|
||||
curdays = (long int)(time(NULL) / (60 * 60 * 24));
|
||||
- D(("today is %d, last change %d", curdays, spent->sp_lstchg));
|
||||
- if ((curdays >= spent->sp_expire) && (spent->sp_expire != -1)) {
|
||||
+ D(("today is %ld, last change %ld", curdays, spent->sp_lstchg));
|
||||
+ if (spent->sp_expire >= 0 && curdays >= spent->sp_expire) {
|
||||
D(("account expired"));
|
||||
return PAM_ACCT_EXPIRED;
|
||||
}
|
||||
@@ -308,31 +323,42 @@ PAMH_ARG_DECL(int check_shadow_expiry,
|
||||
*daysleft = 0;
|
||||
return PAM_NEW_AUTHTOK_REQD;
|
||||
}
|
||||
+ if (spent->sp_lstchg < 0) {
|
||||
+ D(("password aging disabled"));
|
||||
+ *daysleft = 0;
|
||||
+ return PAM_SUCCESS;
|
||||
+ }
|
||||
if (curdays < spent->sp_lstchg) {
|
||||
pam_syslog(pamh, LOG_DEBUG,
|
||||
"account %s has password changed in future",
|
||||
spent->sp_namp);
|
||||
return PAM_SUCCESS;
|
||||
}
|
||||
- if ((curdays - spent->sp_lstchg > spent->sp_max)
|
||||
- && (curdays - spent->sp_lstchg > spent->sp_inact)
|
||||
- && (curdays - spent->sp_lstchg > spent->sp_max + spent->sp_inact)
|
||||
- && (spent->sp_max != -1) && (spent->sp_inact != -1)) {
|
||||
- *daysleft = (int)((spent->sp_lstchg + spent->sp_max) - curdays);
|
||||
- D(("authtok expired"));
|
||||
- return PAM_AUTHTOK_EXPIRED;
|
||||
- }
|
||||
- if ((curdays - spent->sp_lstchg > spent->sp_max) && (spent->sp_max != -1)) {
|
||||
- D(("need a new password 2"));
|
||||
- return PAM_NEW_AUTHTOK_REQD;
|
||||
- }
|
||||
- if ((curdays - spent->sp_lstchg > spent->sp_max - spent->sp_warn)
|
||||
- && (spent->sp_max != -1) && (spent->sp_warn != -1)) {
|
||||
- *daysleft = (int)((spent->sp_lstchg + spent->sp_max) - curdays);
|
||||
- D(("warn before expiry"));
|
||||
+ passed = curdays - spent->sp_lstchg;
|
||||
+ if (spent->sp_max >= 0) {
|
||||
+ if (spent->sp_inact >= 0) {
|
||||
+ long inact = spent->sp_max < LONG_MAX - spent->sp_inact ?
|
||||
+ spent->sp_max + spent->sp_inact : LONG_MAX;
|
||||
+ if (passed >= inact) {
|
||||
+ *daysleft = subtract(inact, passed);
|
||||
+ D(("authtok expired"));
|
||||
+ return PAM_AUTHTOK_EXPIRED;
|
||||
+ }
|
||||
+ }
|
||||
+ if (passed >= spent->sp_max) {
|
||||
+ D(("need a new password 2"));
|
||||
+ return PAM_NEW_AUTHTOK_REQD;
|
||||
+ }
|
||||
+ if (spent->sp_warn > 0) {
|
||||
+ long warn = spent->sp_warn > spent->sp_max ? -1 :
|
||||
+ spent->sp_max - spent->sp_warn;
|
||||
+ if (passed >= warn) {
|
||||
+ *daysleft = subtract(spent->sp_max, passed);
|
||||
+ D(("warn before expiry"));
|
||||
+ }
|
||||
+ }
|
||||
}
|
||||
- if ((curdays - spent->sp_lstchg < spent->sp_min)
|
||||
- && (spent->sp_min != -1)) {
|
||||
+ if (spent->sp_min > 0 && passed < spent->sp_min) {
|
||||
/*
|
||||
* The last password change was too recent. This error will be ignored
|
||||
* if no password change is attempted.
|
||||
10
pam.spec
10
pam.spec
@ -3,7 +3,7 @@
|
||||
Summary: An extensible library which provides authentication for applications
|
||||
Name: pam
|
||||
Version: 1.5.1
|
||||
Release: 23%{?dist}
|
||||
Release: 24%{?dist}
|
||||
# The library is BSD licensed with option to relicense as GPLv2+
|
||||
# - this option is redundant as the BSD license allows that anyway.
|
||||
# pam_timestamp, pam_loginuid, and pam_console modules are GPLv2+.
|
||||
@ -75,6 +75,9 @@ Patch22: pam-1.5.1-pam-unix-shadow-password.patch
|
||||
Patch23: pam-1.5.1-pam-access-local.patch
|
||||
# https://github.com/linux-pam/linux-pam/commit/940747f88c16e029b69a74e80a2e94f65cb3e628
|
||||
Patch24: pam-1.5.1-pam-access-resolve-ip.patch
|
||||
# https://github.com/linux-pam/linux-pam/commit/2c711ce57ced9f97c2cf4c8d59c1730447a7bd7f
|
||||
# https://github.com/linux-pam/linux-pam/commit/51a06bc8cc2278c6e81c9c08a9381c9eb0d2de96
|
||||
Patch25: pam-1.5.1-pam-unix-blank-expiration.patch
|
||||
|
||||
%global _pamlibdir %{_libdir}
|
||||
%global _moduledir %{_libdir}/security
|
||||
@ -181,6 +184,7 @@ cp %{SOURCE18} .
|
||||
%patch22 -p1 -b .pam-unix-shadow-password
|
||||
%patch23 -p1 -b .pam-access-local
|
||||
%patch24 -p1 -b .pam-access-resolve-ip
|
||||
%patch25 -p1 -b .pam-unix-blank-expiration
|
||||
|
||||
autoreconf -i
|
||||
|
||||
@ -436,6 +440,10 @@ done
|
||||
%doc doc/sag/*.txt doc/sag/html
|
||||
|
||||
%changelog
|
||||
* Mon May 26 2025 Iker Pedrosa <ipedrosa@redhat.com> - 1.5.1-24
|
||||
- pam_unix: sync expiry checks with shadow. Resolves: RHEL-70519
|
||||
- pam.conf: remove tallylog. Resolves: RHEL-15324
|
||||
|
||||
* Thu Nov 21 2024 Iker Pedrosa <ipedrosa@redhat.com> - 1.5.1-23
|
||||
- pam_access: rework resolving of tokens as hostname.
|
||||
Resolves: CVE-2024-10963 and RHEL-66244
|
||||
|
||||
@ -2,4 +2,3 @@ d /run/console 0755 root root -
|
||||
d /run/faillock 0755 root root -
|
||||
d /run/sepermit 0755 root root -
|
||||
d /run/motd.d 0755 root root -
|
||||
f /var/log/tallylog 0600 root root -
|
||||
|
||||
Loading…
Reference in New Issue
Block a user