Several PAM fixes
- pam_lastlog: check localtime_r() return value - pam_faillock: clarify missing user faillock files after reboot - pam_faillock: avoid logging an erroneous consecutive login failure message Resolves: #2130124 Resolves: #2126632 Resolves: #2126648 Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
This commit is contained in:
Iker Pedrosa
parent
158ed61997
commit
9c94f52d3d
37
pam-1.5.1-pam-faillock-avoid-logging-erroneous.patch
Normal file
37
pam-1.5.1-pam-faillock-avoid-logging-erroneous.patch
Normal file
@ -0,0 +1,37 @@
|
||||
From 10086bc69663fa819277af244eeb5b629a2403b8 Mon Sep 17 00:00:00 2001
|
||||
From: Deepak Das <ddas@redhat.com>
|
||||
Date: Mon, 10 Oct 2022 21:21:35 +0530
|
||||
Subject: [PATCH] pam_faillock: avoid logging an erroneous consecutive login
|
||||
failure message
|
||||
|
||||
* modules/pam_faillock/pam_faillock.c (write_tally): Avoid logging
|
||||
a consecutive login failure message for the root user in case when
|
||||
even_deny_root is not set.
|
||||
|
||||
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2082442
|
||||
---
|
||||
modules/pam_faillock/pam_faillock.c | 8 +++++---
|
||||
1 file changed, 5 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/modules/pam_faillock/pam_faillock.c b/modules/pam_faillock/pam_faillock.c
|
||||
index ddbb90e7..ca1c7035 100644
|
||||
--- a/modules/pam_faillock/pam_faillock.c
|
||||
+++ b/modules/pam_faillock/pam_faillock.c
|
||||
@@ -374,9 +374,11 @@ write_tally(pam_handle_t *pamh, struct options *opts, struct tally_data *tallies
|
||||
}
|
||||
close(audit_fd);
|
||||
#endif
|
||||
- if (!(opts->flags & FAILLOCK_FLAG_NO_LOG_INFO)) {
|
||||
- pam_syslog(pamh, LOG_INFO, "Consecutive login failures for user %s account temporarily locked",
|
||||
- opts->user);
|
||||
+ if (!(opts->flags & FAILLOCK_FLAG_NO_LOG_INFO) &&
|
||||
+ ((opts->flags & FAILLOCK_FLAG_DENY_ROOT) || (opts->uid != 0))) {
|
||||
+ pam_syslog(pamh, LOG_INFO,
|
||||
+ "Consecutive login failures for user %s account temporarily locked",
|
||||
+ opts->user);
|
||||
}
|
||||
}
|
||||
|
||||
--
|
||||
2.38.1
|
||||
|
||||
53
pam-1.5.1-pam-faillock-clarify-missing-user.patch
Normal file
53
pam-1.5.1-pam-faillock-clarify-missing-user.patch
Normal file
@ -0,0 +1,53 @@
|
||||
From bcbf145ce925934214e48200c27c9ff736452549 Mon Sep 17 00:00:00 2001
|
||||
From: Deepak Das <ddas@redhat.com>
|
||||
Date: Mon, 10 Oct 2022 17:55:53 +0530
|
||||
Subject: [PATCH] pam_faillock: Clarify missing user faillock files after
|
||||
reboot
|
||||
|
||||
* modules/pam_faillock/faillock.conf.5.xml: Adding note related to missing
|
||||
user specific faillock files after reboot.
|
||||
|
||||
* modules/pam_faillock/pam_faillock.8.xml: Adding note related to missing
|
||||
user specific faillock files after reboot.
|
||||
|
||||
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2062512
|
||||
---
|
||||
modules/pam_faillock/faillock.conf.5.xml | 4 ++++
|
||||
modules/pam_faillock/pam_faillock.8.xml | 6 ++++++
|
||||
2 files changed, 10 insertions(+)
|
||||
|
||||
diff --git a/modules/pam_faillock/faillock.conf.5.xml b/modules/pam_faillock/faillock.conf.5.xml
|
||||
index 04a84107..8faa5915 100644
|
||||
--- a/modules/pam_faillock/faillock.conf.5.xml
|
||||
+++ b/modules/pam_faillock/faillock.conf.5.xml
|
||||
@@ -44,6 +44,10 @@
|
||||
The directory where the user files with the failure records are kept. The
|
||||
default is <filename>/var/run/faillock</filename>.
|
||||
</para>
|
||||
+ <para>
|
||||
+ Note: These files will disappear after reboot on systems configured with
|
||||
+ directory <filename>/var/run/faillock</filename> mounted on virtual memory.
|
||||
+ </para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
<varlistentry>
|
||||
diff --git a/modules/pam_faillock/pam_faillock.8.xml b/modules/pam_faillock/pam_faillock.8.xml
|
||||
index 79bcbbd0..b7b7b0db 100644
|
||||
--- a/modules/pam_faillock/pam_faillock.8.xml
|
||||
+++ b/modules/pam_faillock/pam_faillock.8.xml
|
||||
@@ -327,6 +327,12 @@ session required pam_selinux.so open
|
||||
<term><filename>/var/run/faillock/*</filename></term>
|
||||
<listitem>
|
||||
<para>the files logging the authentication failures for users</para>
|
||||
+ <para>
|
||||
+ Note: These files will disappear after reboot on systems configured with
|
||||
+ directory <filename>/var/run/faillock</filename> mounted on virtual memory.
|
||||
+ For persistent storage use the option <emphasis>dir=</emphasis> in
|
||||
+ file <filename>/etc/security/faillock.conf</filename>.
|
||||
+ </para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
<varlistentry>
|
||||
--
|
||||
2.38.1
|
||||
|
||||
41
pam-1.5.1-pam-lastlog-check-localtime_r-return-value.patch
Normal file
41
pam-1.5.1-pam-lastlog-check-localtime_r-return-value.patch
Normal file
@ -0,0 +1,41 @@
|
||||
From 40c271164dbcebfc5304d0537a42fb42e6b6803c Mon Sep 17 00:00:00 2001
|
||||
From: Iker Pedrosa <ipedrosa@redhat.com>
|
||||
Date: Mon, 26 Sep 2022 12:16:53 +0200
|
||||
Subject: [PATCH] pam_lastlog: check localtime_r() return value
|
||||
|
||||
Check the return value of localtime_r() before calling strftime(). This
|
||||
function crashes if the argument is NULL.
|
||||
|
||||
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2012871
|
||||
|
||||
Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
|
||||
---
|
||||
modules/pam_lastlog/pam_lastlog.c | 12 ++++++------
|
||||
1 file changed, 6 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/modules/pam_lastlog/pam_lastlog.c b/modules/pam_lastlog/pam_lastlog.c
|
||||
index abd048df..121e7560 100644
|
||||
--- a/modules/pam_lastlog/pam_lastlog.c
|
||||
+++ b/modules/pam_lastlog/pam_lastlog.c
|
||||
@@ -573,12 +573,12 @@ last_login_failed(pam_handle_t *pamh, int announce, const char *user, time_t llt
|
||||
time_t lf_time;
|
||||
|
||||
lf_time = utuser.ut_tv.tv_sec;
|
||||
- tm = localtime_r (&lf_time, &tm_buf);
|
||||
- strftime (the_time, sizeof (the_time),
|
||||
- /* TRANSLATORS: "strftime options for date of last login" */
|
||||
- _(" %a %b %e %H:%M:%S %Z %Y"), tm);
|
||||
-
|
||||
- date = the_time;
|
||||
+ if ((tm = localtime_r (&lf_time, &tm_buf)) != NULL) {
|
||||
+ strftime (the_time, sizeof (the_time),
|
||||
+ /* TRANSLATORS: "strftime options for date of last login" */
|
||||
+ _(" %a %b %e %H:%M:%S %Z %Y"), tm);
|
||||
+ date = the_time;
|
||||
+ }
|
||||
}
|
||||
|
||||
/* we want & have the host? */
|
||||
--
|
||||
2.38.1
|
||||
|
||||
16
pam.spec
16
pam.spec
@ -3,7 +3,7 @@
|
||||
Summary: An extensible library which provides authentication for applications
|
||||
Name: pam
|
||||
Version: 1.5.1
|
||||
Release: 13%{?dist}
|
||||
Release: 14%{?dist}
|
||||
# The library is BSD licensed with option to relicense as GPLv2+
|
||||
# - this option is redundant as the BSD license allows that anyway.
|
||||
# pam_timestamp, pam_loginuid, and pam_console modules are GPLv2+.
|
||||
@ -42,6 +42,12 @@ Patch9: pam-1.5.1-pam-usertype-SYS_UID_MAX.patch
|
||||
# https://github.com/linux-pam/linux-pam/commit/ba2f6dd8b81ea2a58262c1709bec906b6852591d
|
||||
# https://github.com/linux-pam/linux-pam/commit/1180bde923a22605fe8075cd1fe7992ed7513411
|
||||
Patch10: pam-1.5.1-pam-pwhistory-load-conf-from-file.patch
|
||||
# https://github.com/linux-pam/linux-pam/commit/40c271164dbcebfc5304d0537a42fb42e6b6803c
|
||||
Patch11: pam-1.5.1-pam-lastlog-check-localtime_r-return-value.patch
|
||||
# https://github.com/linux-pam/linux-pam/commit/bcbf145ce925934214e48200c27c9ff736452549
|
||||
Patch12: pam-1.5.1-pam-faillock-clarify-missing-user.patch
|
||||
# https://github.com/linux-pam/linux-pam/commit/10086bc69663fa819277af244eeb5b629a2403b8
|
||||
Patch13: pam-1.5.1-pam-faillock-avoid-logging-erroneous.patch
|
||||
|
||||
%global _pamlibdir %{_libdir}
|
||||
%global _moduledir %{_libdir}/security
|
||||
@ -134,6 +140,9 @@ cp %{SOURCE18} .
|
||||
%patch8 -p1 -b .faillock-load-conf-from-file
|
||||
%patch9 -p1 -b .pam-usertype-SYS_UID_MAX
|
||||
%patch10 -p1 -b .pam-pwhistory-load-conf-from-file
|
||||
%patch11 -p1 -b .pam-lastlog-check-localtime_r-return-value
|
||||
%patch12 -p1 -b .pam-faillock-clarify-missing-user
|
||||
%patch13 -p1 -b .pam-faillock-avoid-logging-erroneous
|
||||
|
||||
autoreconf -i
|
||||
|
||||
@ -389,6 +398,11 @@ done
|
||||
%doc doc/sag/*.txt doc/sag/html
|
||||
|
||||
%changelog
|
||||
* Tue Nov 29 2022 Iker Pedrosa <ipedrosa@redhat.com> - 1.5.1-14
|
||||
- pam_lastlog: check localtime_r() return value. Resolves: #2130124
|
||||
- pam_faillock: clarify missing user faillock files after reboot. Resolves: #2126632
|
||||
- pam_faillock: avoid logging an erroneous consecutive login failure message. Resolves: #2126648
|
||||
|
||||
* Wed Sep 28 2022 Iker Pedrosa <ipedrosa@redhat.com> - 1.5.1-13
|
||||
- pam_pwhistory: load configuration from file. Resolves: #2126640
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user