]> granicus.if.org Git - linux-pam/commitdiff
Relevant BUGIDs:
authorThorsten Kukuk <kukuk@thkukuk.de>
Mon, 1 Oct 2007 09:41:32 +0000 (09:41 +0000)
committerThorsten Kukuk <kukuk@thkukuk.de>
Mon, 1 Oct 2007 09:41:32 +0000 (09:41 +0000)
Purpose of commit: bugfix

Commit summary:
---------------

2007-10-01  Thorsten Kukuk  <kukuk@thkukuk.de>

        * xtests/tst-pam_group1.c: New test case for user compare in pam_group.
        * xtests/tst-pam_group1.sh: Script to run test case.
        * xtests/tst-pam_group1.pamd: Config for test case.
        * xtests/Makefile.am: Add tst-pam_group1 test case.
        * xtests/run-xtests.sh: Save/restore group.conf.
        * xtests/group.conf: New.

        * modules/pam_xauth/pam_xauth.c (pam_sm_open_session): Don't
        free arguments used for putenv().

        * doc/man/pam_putenv.3.xml: Document that application has to free
        the memory.

ChangeLog
doc/man/pam_putenv.3
doc/man/pam_putenv.3.xml
modules/pam_xauth/pam_xauth.c
xtests/.cvsignore
xtests/Makefile.am
xtests/run-xtests.sh
xtests/tst-pam_group1.c [new file with mode: 0644]
xtests/tst-pam_group1.pamd [new file with mode: 0644]
xtests/tst-pam_group1.sh [new file with mode: 0755]

index 2b3f2364879daba000957990d5fe0c3349f60e24..3961807066ad9e2ee2b94026ce5edd5593d25dab 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,18 @@
+2007-10-01  Thorsten Kukuk  <kukuk@thkukuk.de>
+
+       * xtests/tst-pam_group1.c: New test case for user compare in pam_group.
+       * xtests/tst-pam_group1.sh: Script to run test case.
+       * xtests/tst-pam_group1.pamd: Config for test case.
+       * xtests/Makefile.am: Add tst-pam_group1 test case.
+       * xtests/run-xtests.sh: Save/restore group.conf.
+       * xtests/group.conf: New.
+
+       * modules/pam_xauth/pam_xauth.c (pam_sm_open_session): Don't
+       free arguments used for putenv().
+
+       * doc/man/pam_putenv.3.xml: Document that application has to free
+       the memory.
+
 2007-09-27  Tomas Mraz  <t8m@centrum.cz>
 
        * modules/pam_succeed_if/pam_succeed_if.c (evaluate_inlist): Fix in
index 60b49651d2fb150981edd01b75b4088cf119bbe6..b0edc103ff292138ea302b4ca29c5b25367d5be0 100644 (file)
@@ -1,22 +1,22 @@
 .\"     Title: pam_putenv
 .\"    Author: 
-.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/>
-.\"      Date: 06/27/2006
-.\"    Manual: Linux\-PAM Manual
-.\"    Source: Linux\-PAM Manual
+.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/>
+.\"      Date: 09/28/2007
+.\"    Manual: Linux-PAM Manual
+.\"    Source: Linux-PAM Manual
 .\"
-.TH "PAM_PUTENV" "3" "06/27/2006" "Linux\-PAM Manual" "Linux\-PAM Manual"
+.TH "PAM_PUTENV" "3" "09/28/2007" "Linux-PAM Manual" "Linux-PAM Manual"
 .\" disable hyphenation
 .nh
 .\" disable justification (adjust text to left margin only)
 .ad l
 .SH "NAME"
-pam_putenv \- set or change PAM environment variable
+pam_putenv - set or change PAM environment variable
 .SH "SYNOPSIS"
 .sp
 .ft B
 .nf
-#include <security/pam_appl.h>
+#include <security/pam_appl\.h>
 .fi
 .ft
 .HP 15
@@ -27,43 +27,65 @@ The
 \fBpam_putenv\fR
 function is used to add or change the value of PAM environment variables as associated with the
 \fIpamh\fR
-handle.
+handle\.
 .PP
 The
 \fIpamh\fR
-argument is an authentication handle obtained by a prior call to pam_start(). The
+argument is an authentication handle obtained by a prior call to pam_start()\. The
 \fIname_value\fR
 argument is a single NUL terminated string of one of the following forms:
-.TP 3n
+.PP
 NAME=value of variable
+.RS 4
 In this case the environment variable of the given NAME is set to the indicated value:
-\fIvalue of variable\fR. If this variable is already known, it is overwritten. Otherwise it is added to the PAM environment.
-.TP 3n
+\fIvalue of variable\fR\. If this variable is already known, it is overwritten\. Otherwise it is added to the PAM environment\.
+.RE
+.PP
 NAME=
-This function sets the variable to an empty value. It is listed separately to indicate that this is the correct way to achieve such a setting.
-.TP 3n
+.RS 4
+This function sets the variable to an empty value\. It is listed separately to indicate that this is the correct way to achieve such a setting\.
+.RE
+.PP
 NAME
-Without an '=' the pam_putenv() function will delete the corresponding variable from the PAM environment.
+.RS 4
+Without an \'=\' the
+\fBpam_putenv\fR() function will delete the corresponding variable from the PAM environment\.
+.RE
+.PP
+
+\fBpam_putenv\fR() operates on a copy of
+\fIname_value\fR, which means in contrast to
+\fBputenv\fR(3), the application is responsible to free the data\.
 .SH "RETURN VALUES"
-.TP 3n
+.PP
 PAM_PERM_DENIED
+.RS 4
 Argument
 \fIname_value\fR
-given is a NULL pointer.
-.TP 3n
+given is a NULL pointer\.
+.RE
+.PP
 PAM_BAD_ITEM
-Variable requested (for deletion) is not currently set.
-.TP 3n
+.RS 4
+Variable requested (for deletion) is not currently set\.
+.RE
+.PP
 PAM_ABORT
+.RS 4
 The
 \fIpamh\fR
-handle is corrupt.
-.TP 3n
+handle is corrupt\.
+.RE
+.PP
 PAM_BUF_ERR
-Memory buffer error.
-.TP 3n
+.RS 4
+Memory buffer error\.
+.RE
+.PP
 PAM_SUCCESS
-The environment variable was successfully updated.
+.RS 4
+The environment variable was successfully updated\.
+.RE
 .SH "SEE ALSO"
 .PP
 
index 5efef381227e543350e2c25924fb39f531b0c3f5..619b218a749bd442641f4927516781332618005f 100644 (file)
         <term>NAME</term>
         <listitem>
           <para>
-            Without an '=' the pam_putenv() function will delete the
+            Without an '=' the <function>pam_putenv</function>() function
+            will delete the
             corresponding variable from the PAM environment.
           </para>
         </listitem>
       </varlistentry>
     </variablelist>
+    <para>
+      <function>pam_putenv</function>() operates on a copy of
+      <emphasis>name_value</emphasis>, which means in contrast to
+      <citerefentry>
+        <refentrytitle>putenv</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>, the application is responsible to free the data.
+    </para>
   </refsect1>
 
   <refsect1 id="pam_putenv-return_values">
index 153210f101a94232bb267685dd5a5115d8db1b47..1135d4b7244facc61c6e9e7da7094a14992addd8 100644 (file)
@@ -578,6 +578,7 @@ pam_sm_open_session (pam_handle_t *pamh, int flags UNUSED,
                                   "can't set environment variable '%s'",
                                   xauthority);
                putenv (xauthority); /* The environment owns this string now. */
+               xauthority = NULL; /* Don't free environment variables. */
 
                /* set $DISPLAY in pam handle to make su - work */
                {
index b840493bc0f6ec8d34bd838ddf5a4908e674cfad..ee175609ec71654a1b95392e8ca06feba72e6f9f 100644 (file)
@@ -16,3 +16,5 @@ tst-pam_limits1
 tst-pam_unix1
 tst-pam_unix2
 tst-pam_unix3
+tst-pam_succeed_if1
+tst-pam_group1
index 7b030d6d2442488387d01106e4cfd28964404dbf..9c28c9751a9657982610ffadd1d7d5f9ba183f53 100644 (file)
@@ -19,13 +19,15 @@ EXTRA_DIST = run-xtests.sh tst-pam_dispatch1.pamd tst-pam_dispatch2.pamd \
        tst-pam_access3.pamd tst-pam_access3.sh \
        tst-pam_access4.pamd tst-pam_access4.sh \
        limits.conf tst-pam_limits1.pamd tst-pam_limits1.sh \
-       tst-pam_succeed_if1.pamd tst-pam_succeed_if.sh
+       tst-pam_succeed_if1.pamd tst-pam_succeed_if.sh \
+       group.conf tst-pam_group1.pamd tst-pam_group1.sh
 
 XTESTS = tst-pam_dispatch1 tst-pam_dispatch2 tst-pam_dispatch3 \
        tst-pam_dispatch4 tst-pam_cracklib1 tst-pam_cracklib2 \
        tst-pam_unix1 tst-pam_unix2 tst-pam_unix3 \
        tst-pam_access1 tst-pam_access2 tst-pam_access3 \
-       tst-pam_access4 tst-pam_limits1 tst-pam_succeed_if1
+       tst-pam_access4 tst-pam_limits1 tst-pam_succeed_if1 \
+       tst-pam_group1
 
 noinst_PROGRAMS = $(XTESTS)
 
index 24adf12190398e440a6323a5632d237c245273d7..53dbdf060f555b0b21982cd05a788ed3497d07f4 100755 (executable)
@@ -19,6 +19,8 @@ all=0
 mkdir -p /etc/security
 cp /etc/security/access.conf /etc/security/access.conf-pam-xtests
 install -m 644 "${SRCDIR}"/access.conf /etc/security/access.conf
+cp /etc/security/group.conf /etc/security/group.conf-pam-xtests
+install -m 644 "${SRCDIR}"/group.conf /etc/security/group.conf
 cp /etc/security/limits.conf /etc/security/limits.conf-pam-xtests
 install -m 644 "${SRCDIR}"/limits.conf /etc/security/limits.conf
 for testname in $XTESTS ; do
@@ -43,6 +45,7 @@ for testname in $XTESTS ; do
          rm -f /etc/pam.d/$testname
 done
 mv /etc/security/access.conf-pam-xtests /etc/security/access.conf
+mv /etc/security/group.conf-pam-xtests /etc/security/group.conf
 mv /etc/security/limits.conf-pam-xtests /etc/security/limits.conf
 if test "$failed" -ne 0; then
          echo "==================="
diff --git a/xtests/tst-pam_group1.c b/xtests/tst-pam_group1.c
new file mode 100644 (file)
index 0000000..e4e3ca4
--- /dev/null
@@ -0,0 +1,207 @@
+/*
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, and the entire permission notice in its entirety,
+ *    including the disclaimer of warranties.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote
+ *    products derived from this software without specific prior
+ *    written permission.
+ *
+ * ALTERNATIVELY, this product may be distributed under the terms of
+ * the GNU Public License, in which case the provisions of the GPL are
+ * required INSTEAD OF the above restrictions.  (This clause is
+ * necessary due to a potential bad interaction between the GPL and
+ * the restrictions contained in a BSD-style copyright.)
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/*
+  test case:
+
+  Check the following line in group.conf:
+
+  tst-pam_group1;*;tstpamgrp;Al0000-2400;tstpamgrp
+
+
+  pam_group should add group tstpamgrp to user tstpamgrp, but not
+  to tstpamgrp2.
+*/
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <grp.h>
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/types.h>
+#include <security/pam_appl.h>
+
+#define GROUP_BLK 10
+#define blk_size(len) (((len-1 + GROUP_BLK)/GROUP_BLK)*GROUP_BLK)
+
+/* A conversation function which uses an internally-stored value for
+   the responses. */
+static int
+fake_conv (int num_msg, const struct pam_message **msgm UNUSED,
+          struct pam_response **response, void *appdata_ptr UNUSED)
+{
+  struct pam_response *reply;
+  int count;
+
+  /* Sanity test. */
+  if (num_msg <= 0)
+    return PAM_CONV_ERR;
+
+  /* Allocate memory for the responses. */
+  reply = calloc (num_msg, sizeof (struct pam_response));
+  if (reply == NULL)
+    return PAM_CONV_ERR;
+
+  /* Each prompt elicits the same response. */
+  for (count = 0; count < num_msg; ++count)
+    {
+      reply[count].resp_retcode = 0;
+      reply[count].resp = strdup ("!!");
+    }
+
+  /* Set the pointers in the response structure and return. */
+  *response = reply;
+  return PAM_SUCCESS;
+}
+
+static struct pam_conv conv = {
+    fake_conv,
+    NULL
+};
+
+static int debug = 0;
+
+static int
+run_test (const char *user, gid_t groupid, int needit)
+{
+  pam_handle_t *pamh = NULL;
+  int retval;
+
+  retval = pam_start("tst-pam_group1", user, &conv, &pamh);
+  if (retval != PAM_SUCCESS)
+    {
+      if (debug)
+       fprintf (stderr, "pam_group1: pam_start returned %d\n", retval);
+      return 1;
+    }
+
+  retval = pam_set_item (pamh, PAM_TTY, "/dev/tty1");
+  if (retval != PAM_SUCCESS)
+    {
+      if (debug)
+       fprintf (stderr,
+                "pam_group1: pam_set_item(PAM_TTY) returned %d\n",
+                retval);
+      return 1;
+    }
+
+  retval = pam_authenticate (pamh, 0);
+  if (retval != PAM_SUCCESS)
+    {
+      if (debug)
+       fprintf (stderr, "pam_group1: pam_authenticate returned %d\n", retval);
+      return 1;
+    }
+
+  retval = pam_setcred (pamh, PAM_ESTABLISH_CRED);
+  if (retval != PAM_SUCCESS)
+    {
+      if (debug)
+       fprintf (stderr, "pam_group1: pam_setcred returned %d\n", retval);
+      return 1;
+    }
+
+
+  int no_grps = getgroups(0, NULL); /* find the current number of groups */
+  if (no_grps > 0)
+    {
+      int i, found;
+      gid_t *grps = calloc (blk_size (no_grps), sizeof(gid_t));
+
+      if (getgroups(no_grps, grps) < 0)
+       {
+         if (debug)
+           fprintf (stderr, "pam_group1: getroups returned error: %m\n");
+         pam_end (pamh, PAM_SYSTEM_ERR);
+         return 1;
+        }
+
+      found = 0;
+      for (i = 0; i < no_grps; ++i)
+       {
+#if 0
+         if (debug)
+           fprintf (stderr, "gid[%d]=%d\n", i, grps[i]);
+#endif
+         if (grps[i] == groupid)
+           found = 1;
+       }
+      if ((needit && found) || (!needit && !found))
+       {
+         /* everything is ok */
+       }
+      else
+       {
+         pam_end (pamh, PAM_SYSTEM_ERR);
+         if (debug)
+           fprintf (stderr,
+                    "pam_group1: unexpected result for %s: needit=%d, found=%d\n",
+                    user, needit, found);
+         return 1;
+       }
+    }
+
+  retval = pam_end (pamh,retval);
+  if (retval != PAM_SUCCESS)
+    {
+      if (debug)
+       fprintf (stderr, "pam_group1: pam_end returned %d\n", retval);
+      return 1;
+    }
+  return 0;
+}
+
+int
+main(int argc, char *argv[])
+{
+  struct group *grp;
+  gid_t grpid;
+
+  if (argc > 1 && strcmp (argv[1], "-d") == 0)
+    debug = 1;
+
+  grp = getgrnam ("tstpamgrp");
+  if (grp == NULL)
+    return 1;
+  grpid = grp->gr_gid;
+
+  if (run_test ("root", grpid, 0) != 0 ||
+      run_test ("tstpamgrp2", grpid, 0) != 0 ||
+      run_test ("tstpamgrp", grpid, 1) != 0)
+    return 1;
+
+  return 0;
+}
diff --git a/xtests/tst-pam_group1.pamd b/xtests/tst-pam_group1.pamd
new file mode 100644 (file)
index 0000000..d78f3a6
--- /dev/null
@@ -0,0 +1,7 @@
+#%PAM-1.0
+auth     required       pam_group.so
+auth    required       pam_permit.so
+account  required       pam_permit.so
+password required       pam_permit.so
+session  required       pam_permit.so
+
diff --git a/xtests/tst-pam_group1.sh b/xtests/tst-pam_group1.sh
new file mode 100755 (executable)
index 0000000..2d38a6a
--- /dev/null
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+/usr/sbin/groupadd -p '!!' tstpamgrp
+/usr/sbin/useradd -p '!!' tstpamgrp
+/usr/sbin/useradd -p '!!' tstpamgrp2
+./tst-pam_group1
+RET=$?
+/usr/sbin/userdel -r tstpamgrp 2> /dev/null
+/usr/sbin/userdel -r tstpamgrp2 2> /dev/null
+/usr/sbin/groupdel tstpamgrp 2> /dev/null
+exit $RET