Backport upstream commit fixing syslog for disabled or invalid hashes
This commit is contained in:
Björn Esser
parent
f3b728d2c9
commit
94c0a4fee4
104
pam-1.3.1-unix-fix_checksalt_syslog.patch
Normal file
104
pam-1.3.1-unix-fix_checksalt_syslog.patch
Normal file
@ -0,0 +1,104 @@
|
||||
From d8d11db2cef65da5d2afa7acf21aa9c8cd88abed Mon Sep 17 00:00:00 2001
|
||||
From: Tomas Mraz <tmraz@fedoraproject.org>
|
||||
Date: Tue, 27 Nov 2018 16:11:03 +0100
|
||||
Subject: [PATCH] pam_unix: Use pam_syslog instead of helper_log_err.
|
||||
|
||||
* modules/pam_unix/passverify.c (verify_pwd_hash): Add pamh argument via
|
||||
PAMH_ARG_DECL. Call pam_syslog() instead of helper_log_err().
|
||||
* modules/pam_unix/passverify.h: Adjust the declaration of verify_pwd_hash().
|
||||
* modules/pam_unix/support.c (_unix_verify_password): Add the pamh argument
|
||||
to verify_pwd_hash() call.
|
||||
---
|
||||
modules/pam_unix/passverify.c | 24 +++++++++++++-----------
|
||||
modules/pam_unix/passverify.h | 6 +++---
|
||||
modules/pam_unix/support.c | 2 +-
|
||||
3 files changed, 17 insertions(+), 15 deletions(-)
|
||||
|
||||
diff --git a/modules/pam_unix/passverify.c b/modules/pam_unix/passverify.c
|
||||
index 2c808eb5..80e32767 100644
|
||||
--- a/modules/pam_unix/passverify.c
|
||||
+++ b/modules/pam_unix/passverify.c
|
||||
@@ -65,8 +65,8 @@ strip_hpux_aging(char *hash)
|
||||
}
|
||||
}
|
||||
|
||||
-int
|
||||
-verify_pwd_hash(const char *p, char *hash, unsigned int nullok)
|
||||
+PAMH_ARG_DECL(int verify_pwd_hash,
|
||||
+ const char *p, char *hash, unsigned int nullok)
|
||||
{
|
||||
size_t hash_len;
|
||||
char *pp = NULL;
|
||||
@@ -116,11 +116,10 @@ verify_pwd_hash(const char *p, char *hash, unsigned int nullok)
|
||||
* pam_syslog() needs a pam handle,
|
||||
* but that's not available here.
|
||||
*/
|
||||
- helper_log_err(LOG_ERR,
|
||||
- "pam_unix(verify_pwd_hash): The method "
|
||||
- "for computing the hash \"%.6s\" has been "
|
||||
- "disabled in libcrypt by the preset from "
|
||||
- "the system's vendor and/or administrator.",
|
||||
+ pam_syslog(pamh, LOG_ERR,
|
||||
+ "The support for password hash \"%.6s\" "
|
||||
+ "has been disabled in libcrypt "
|
||||
+ "configuration.",
|
||||
hash);
|
||||
}
|
||||
/*
|
||||
@@ -132,12 +131,15 @@ verify_pwd_hash(const char *p, char *hash, unsigned int nullok)
|
||||
* recent implementations of libcrypt.
|
||||
*/
|
||||
if (retval_checksalt == CRYPT_SALT_INVALID) {
|
||||
- helper_log_err(LOG_ERR,
|
||||
- "pam_unix(verify_pwd_hash): The hash \"%.6s\""
|
||||
- "does not use a method known by the version "
|
||||
- "of libcrypt this system is supplied with.",
|
||||
+ pam_syslog(pamh, LOG_ERR,
|
||||
+ "The password hash \"%.6s\" is unknown to "
|
||||
+ "libcrypt.",
|
||||
hash);
|
||||
}
|
||||
+#else
|
||||
+#ifndef HELPER_COMPILE
|
||||
+ (void)pamh;
|
||||
+#endif
|
||||
#endif
|
||||
#ifdef HAVE_CRYPT_R
|
||||
struct crypt_data *cdata;
|
||||
diff --git a/modules/pam_unix/passverify.h b/modules/pam_unix/passverify.h
|
||||
index 086c28ac..e9a88fbf 100644
|
||||
--- a/modules/pam_unix/passverify.h
|
||||
+++ b/modules/pam_unix/passverify.h
|
||||
@@ -12,9 +12,6 @@
|
||||
|
||||
#define OLD_PASSWORDS_FILE "/etc/security/opasswd"
|
||||
|
||||
-int
|
||||
-verify_pwd_hash(const char *p, char *hash, unsigned int nullok);
|
||||
-
|
||||
int
|
||||
is_pwd_shadowed(const struct passwd *pwd);
|
||||
|
||||
@@ -65,6 +62,9 @@ read_passwords(int fd, int npass, char **passwords);
|
||||
#define PAMH_ARG(...) pamh, __VA_ARGS__
|
||||
#endif
|
||||
|
||||
+PAMH_ARG_DECL(int verify_pwd_hash,
|
||||
+ const char *p, char *hash, unsigned int nullok);
|
||||
+
|
||||
PAMH_ARG_DECL(char * create_password_hash,
|
||||
const char *password, unsigned long long ctrl, int rounds);
|
||||
|
||||
diff --git a/modules/pam_unix/support.c b/modules/pam_unix/support.c
|
||||
index 6894288d..ea5594d2 100644
|
||||
--- a/modules/pam_unix/support.c
|
||||
+++ b/modules/pam_unix/support.c
|
||||
@@ -770,7 +770,7 @@ int _unix_verify_password(pam_handle_t * pamh, const char *name
|
||||
}
|
||||
}
|
||||
} else {
|
||||
- retval = verify_pwd_hash(p, salt, off(UNIX__NONULL, ctrl));
|
||||
+ retval = verify_pwd_hash(pamh, p, salt, off(UNIX__NONULL, ctrl));
|
||||
}
|
||||
|
||||
if (retval == PAM_SUCCESS) {
|
||||
4
pam.spec
4
pam.spec
@ -59,6 +59,8 @@ Patch41: pam-1.3.1-unix-no-fallback.patch
|
||||
Patch42: pam-1.3.1-motd-multiple-paths.patch
|
||||
# https://github.com/linux-pam/linux-pam/commit/86eed7ca01864b9fd17099e57f10f2b9b6b568a1
|
||||
Patch43: pam-1.3.1-unix-checksalt_syslog.patch
|
||||
# https://github.com/linux-pam/linux-pam/commit/d8d11db2cef65da5d2afa7acf21aa9c8cd88abed
|
||||
Patch44: pam-1.3.1-unix-fix_checksalt_syslog.patch
|
||||
|
||||
%global _pamlibdir %{_libdir}
|
||||
%global _moduledir %{_libdir}/security
|
||||
@ -149,6 +151,7 @@ cp %{SOURCE18} .
|
||||
%patch41 -p1 -b .no-fallback
|
||||
%patch42 -p1 -b .multiple-paths
|
||||
%patch43 -p1 -b .checksalt_syslog
|
||||
%patch44 -p1 -b .fix_checksalt_syslog
|
||||
|
||||
autoreconf -i
|
||||
|
||||
@ -393,6 +396,7 @@ done
|
||||
%changelog
|
||||
* Sun Dec 02 2018 Björn Esser <besser82@fedoraproject.org> - 1.3.1-13
|
||||
- Backport upstream commit reporting disabled or invalid hashes to syslog
|
||||
- Backport upstream commit fixing syslog for disabled or invalid hashes
|
||||
|
||||
* Wed Nov 28 2018 Robert Fairley <rfairley@redhat.com> 1.3.1-12
|
||||
- Backport upstream commit pam_motd: Support multiple motd paths specified, with filename overrides (#69)
|
||||
|
||||
Loading…
Reference in New Issue
Block a user