pam_faillock: change /run/faillock/$USER permissions to 0660

pam-1.3.1-faillock-change-file-permissions.patch

@@ -0,0 +1,50 @@
+From 395915dae1571e10e2766c999974de864655ea3a Mon Sep 17 00:00:00 2001
+From: ikerexxe <ipedrosa@redhat.com>
+Date: Mon, 15 Jun 2020 09:52:11 +0200
+Subject: [PATCH] pam_faillock: change /run/faillock/$USER permissions to 0660
+
+Nowadays, /run/faillock/$USER files have user:root ownership and 0600
+permissions. This forces the process that writes to these files to have
+CAP_DAC_OVERRIDE capabilites. Just by changing the permissions to 0660
+the capability can be removed, which leads to a more secure system.
+
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1661822
+---
+ modules/pam_faillock/faillock.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/modules/pam_faillock/faillock.c b/modules/pam_faillock/faillock.c
+index e492f5f9..4ea94cbe 100644
+--- a/modules/pam_faillock/faillock.c
++++ b/modules/pam_faillock/faillock.c
+@@ -76,7 +76,7 @@ open_tally (const char *dir, const char *user, uid_t uid, int create)
+ 		flags |= O_CREAT;
+ 	}
+ 
+-	fd = open(path, flags, 0600);
++	fd = open(path, flags, 0660);
+ 
+ 	free(path);
+ 
+@@ -88,6 +88,18 @@ open_tally (const char *dir, const char *user, uid_t uid, int create)
+ 			if (st.st_uid != uid) {
+ 				ignore_return(fchown(fd, uid, -1));
+ 			}
++
++			/*
++			 * If umask is set to 022, as will probably in most systems, then the
++			 * group will not be able to write to the file. So, change the file
++			 * permissions just in case.
++			 * Note: owners of this file are user:root, so if the permissions are
++			 * not changed the root process writing to this file will require
++			 * CAP_DAC_OVERRIDE.
++			 */
++			if (!(st.st_mode & S_IWGRP)) {
++				ignore_return(fchmod(fd, 0660));
++			}
+ 		}
+ 	}
+ 
+-- 
+2.26.2
+

pam.spec

@@ -3,7 +3,7 @@
 Summary: An extensible library which provides authentication for applications
 Name: pam
 Version: 1.3.1
-Release: 27%{?dist}
+Release: 28%{?dist}
 # The library is BSD licensed with option to relicense as GPLv2+
 # - this option is redundant as the BSD license allows that anyway.
 # pam_timestamp, pam_loginuid, and pam_console modules are GPLv2+.
@@ -69,6 +69,8 @@ Patch55: pam-1.3.1-audit-error.patch
 Patch56: pam-1.3.1-pam-modutil-close-write.patch
 # Upstreamed
 Patch57: pam-1.3.1-determinine-user-exists.patch
+# Upstreamed
+Patch58: pam-1.3.1-faillock-change-file-permissions.patch
 
 %global _pamlibdir %{_libdir}
 %global _moduledir %{_libdir}/security
@@ -176,6 +178,7 @@ cp %{SOURCE18} .
 %patch55 -p1 -b .audit-error
 %patch56 -p1 -b .pam-modutil-close-write
 %patch57 -p1 -b .determinine-user-exists
+%patch58 -p1 -b .faillock-change-file-permissions
 
 autoreconf -i
 
@@ -428,6 +431,9 @@ done
 %doc doc/sag/*.txt doc/sag/html
 
 %changelog
+* Mon Jun 22 2020 Iker Pedrosa <ipedrosa@redhat.com> - 1.3.1-28
+- pam_faillock: change /run/faillock/$USER permissions to 0660 (#1661822)
+
 * Wed Jun 17 2020 Iker Pedrosa <ipedrosa@redhat.com> - 1.3.1-27
 - pam_unix and pam_usertype: avoid determining if user exists (#1629598)