Relevant BUGIDs:
authorTomas Mraz <tm@t8m.info>
Thu, 6 Dec 2007 20:20:07 +0000 (20:20 +0000)
committerTomas Mraz <tm@t8m.info>
Thu, 6 Dec 2007 20:20:07 +0000 (20:20 +0000)
Purpose of commit: new feature

Commit summary:
---------------
2007-12-06  Eamon Walsh <ewalsh@tycho.nsa.gov>

        * libpam/include/security/_pam_macros.h: Add _pam_overwrite_n()
        macro.
        * libpam/include/security/_pam_types.h: Add PAM_XDISPLAY,
        PAM_XAUTHDATA items, pam_xauth_data struct.
        * libpam/pam_item.c (pam_set_item, pam_get_item): Handle
        PAM_XDISPLAY and PAM_XAUTHDATA items.
        * libpam/pam_end.c (pam_end): Destroy the new items.
        * libpam/pam_private.h (pam_handle): Add data members for new
        items. Add prototype for _pam_memdup.
        * libpam/pam_misc.c: Add _pam_memdup.
        * doc/man/Makefile.am: Add pam_xauth_data.3. Replace
        pam_item_types.inc.xml with pam_item_types_std.inc.xml and
        pam_item_types_ext.inc.xml.
        * doc/man/pam_get_item.3.xml: Replace pam_item_types.inc.xml
        with pam_item_types_std.inc.xml and pam_item_types_ext.inc.xml.
        * doc/man/pam_set_item.3.xml: Likewise.
        * doc/man/pam_item_types.inc.xml: Removed file.
        * doc/man/pam_item_types_ext.inc.xml: New file.
        * doc/man/pam_item_types_std.inc.xml: New file.

13 files changed:
ChangeLog
NEWS
doc/man/Makefile.am
doc/man/pam_get_item.3.xml
doc/man/pam_item_types_ext.inc.xml [new file with mode: 0644]
doc/man/pam_item_types_std.inc.xml [moved from doc/man/pam_item_types.inc.xml with 92% similarity]
doc/man/pam_set_item.3.xml
libpam/include/security/_pam_macros.h
libpam/include/security/_pam_types.h
libpam/pam_end.c
libpam/pam_item.c
libpam/pam_misc.c
libpam/pam_private.h

index 32135cddfebdd9b483db9eedbe59637af3539f49..452001e721441551423f3f4e468b0da2d2426984 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,25 @@
+2007-12-06  Eamon Walsh <ewalsh@tycho.nsa.gov>
+
+       * libpam/include/security/_pam_macros.h: Add _pam_overwrite_n()
+       macro.
+       * libpam/include/security/_pam_types.h: Add PAM_XDISPLAY,
+       PAM_XAUTHDATA items, pam_xauth_data struct.
+       * libpam/pam_item.c (pam_set_item, pam_get_item): Handle
+       PAM_XDISPLAY and PAM_XAUTHDATA items.
+       * libpam/pam_end.c (pam_end): Destroy the new items.
+       * libpam/pam_private.h (pam_handle): Add data members for new
+       items. Add prototype for _pam_memdup.
+       * libpam/pam_misc.c: Add _pam_memdup.
+       * doc/man/Makefile.am: Add pam_xauth_data.3. Replace
+       pam_item_types.inc.xml with pam_item_types_std.inc.xml and
+       pam_item_types_ext.inc.xml.
+       * doc/man/pam_get_item.3.xml: Replace pam_item_types.inc.xml
+       with pam_item_types_std.inc.xml and pam_item_types_ext.inc.xml.
+       * doc/man/pam_set_item.3.xml: Likewise.
+       * doc/man/pam_item_types.inc.xml: Removed file.
+       * doc/man/pam_item_types_ext.inc.xml: New file.
+       * doc/man/pam_item_types_std.inc.xml: New file.
+
 2007-12-06  Tomas Mraz  <t8m@centrum.cz>
 
        * modules/pam_tty_audit/pam_tty_audit.8.xml: Fix example.
diff --git a/NEWS b/NEWS
index 87aaa6c7e96282ab49d8360dc0df2d74941ac030..e794525efcca318bd2bf0c65a32f9cea4387424c 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,7 @@ Linux-PAM NEWS -- history of user-visible changes.
 * New substack directive in config file syntax.
 * New module pam_tty_audit.so for enabling and disabling tty
   auditing.
+* New PAM items PAM_XDISPLAY and PAM_XAUTHDATA.
 
 Release 0.99.9.0
 * misc_conv no longer blocks SIGINT; applications that don't want
index 7d17a43915b751143c36003ec9a50f7eb3c1c957..926f1ae50ff89f943855ffb7c1e00e95e9fe4ef1 100644 (file)
@@ -10,7 +10,7 @@ man_MANS = pam.3 PAM.8 pam.8 pam.conf.5 pam.d.5 \
        pam_acct_mgmt.3 pam_authenticate.3 \
        pam_chauthtok.3 pam_close_session.3 pam_conv.3 \
        pam_end.3 pam_error.3 \
-       pam_fail_delay.3 \
+       pam_fail_delay.3 pam_xauth_data.3 \
        pam_get_data.3 pam_get_item.3 pam_get_user.3 pam_getenv.3 \
        pam_getenvlist.3 \
        pam_info.3 \
@@ -27,7 +27,7 @@ XMLS = pam.3.xml pam.8.xml \
        pam_acct_mgmt.3.xml pam_authenticate.3.xml \
        pam_chauthtok.3.xml pam_close_session.3.xml pam_conv.3.xml \
        pam_end.3.xml pam_error.3.xml \
-       pam_fail_delay.3.xml \
+       pam_fail_delay.3.xml pam_xauth_data.3 \
        pam_get_data.3.xml pam_get_item.3.xml pam_get_user.3.xml \
        pam_getenv.3.xml pam_getenvlist.3.xml \
         pam_info.3.xml \
@@ -38,14 +38,14 @@ XMLS = pam.3.xml pam.8.xml \
        pam_sm_close_session.3.xml pam_sm_open_session.3.xml \
        pam_sm_setcred.3.xml pam_start.3.xml pam_strerror.3.xml \
        pam_sm_chauthtok.3.xml \
-       pam_item_types.inc.xml \
+       pam_item_types_std.inc.xml pam_item_types_ext.inc.xml \
        pam.conf-desc.xml pam.conf-dir.xml pam.conf-syntax.xml \
        misc_conv.3.xml pam_misc_paste_env.3.xml pam_misc_drop_env.3.xml \
        pam_misc_setenv.3.xml
 
 if ENABLE_REGENERATE_MAN
-pam_get_item.3: pam_item_types.inc.xml
-pam_set_data.3: pam_item_types.inc.xml
+pam_get_item.3: pam_item_types_std.inc.xml pam_item_types_ext.inc.xml
+pam_set_data.3: pam_item_types_std.inc.xml pam_item_types_ext.inc.xml
 pam.conf.5: pam.conf-desc.xml pam.conf-dir.xml pam.conf-syntax.xml
 -include $(top_srcdir)/Make.xml.rules
 endif
index e5806d11dbb37c4cbd4902a276b900f88986de55..d07862e00e218f1121f1eec3fd2764bb48d46f71 100644 (file)
@@ -3,7 +3,8 @@
                    "http://www.oasis-open.org/docbook/xml/4.1.2/docbookx.dtd"
 [
 <!--
-<!ENTITY accessconf SYSTEM "pam_item_types.inc.xml">
+<!ENTITY accessconf SYSTEM "pam_item_types_std.inc.xml">
+<!ENTITY accessconf SYSTEM "pam_item_types_ext.inc.xml">
 -->
 ]>
 
    </para>
 
    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
-      href="pam_item_types.inc.xml"/>
+      href="pam_item_types_std.inc.xml"/>
+
+   <para>
+     The following additional items are specific to Linux-PAM and should not be used in
+     portable applications:
+   </para>
+
+   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+      href="pam_item_types_ext.inc.xml"/>
 
     <para>
       If a service module wishes to obtain the name of the user,
diff --git a/doc/man/pam_item_types_ext.inc.xml b/doc/man/pam_item_types_ext.inc.xml
new file mode 100644 (file)
index 0000000..0c72f69
--- /dev/null
@@ -0,0 +1,45 @@
+<!-- this file is included by pam_set_item and pam_get_item -->
+
+    <variablelist>
+      <varlistentry>
+        <term>PAM_FAIL_DELAY</term>
+        <listitem>
+          <para>
+            A function pointer to redirect centrally managed
+            failure delays. See
+            <citerefentry>
+              <refentrytitle>pam_fail_delay</refentrytitle><manvolnum>3</manvolnum>
+            </citerefentry>.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>PAM_XDISPLAY</term>
+        <listitem>
+          <para>
+            The name of the X display.  For graphical, X-based applications the
+           value for this item should be the <emphasis>$DISPLAY</emphasis>
+           variable.  This value should be used instead of
+           <emphasis>PAM_TTY</emphasis> for passing the
+           name of the display where possible.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>PAM_XAUTHDATA</term>
+        <listitem>
+          <para>
+            A pointer to a structure containing the X authentication data
+           required to make a connection to the display specified by
+           <emphasis>PAM_XDISPLAY</emphasis>, if such information is
+           necessary.  See
+            <citerefentry>
+              <refentrytitle>pam_xauth_data</refentrytitle><manvolnum>3</manvolnum>
+            </citerefentry>.
+          </para>
+        </listitem>
+      </varlistentry>
+
+    </variablelist>
similarity index 92%
rename from doc/man/pam_item_types.inc.xml
rename to doc/man/pam_item_types_std.inc.xml
index 9d70087b3f065f9642248b85201d24144ffe3c1d..81f240b0560b15e9550088606ee6d321fbca5cd9 100644 (file)
         </listitem>
       </varlistentry>
 
-      <varlistentry>
-        <term>PAM_FAIL_DELAY</term>
-        <listitem>
-          <para>
-            A function pointer to redirect centrally managed
-            failure delays. See
-            <citerefentry>
-              <refentrytitle>pam_fail_delay</refentrytitle><manvolnum>3</manvolnum>
-            </citerefentry>.
-          </para>
-        </listitem>
-      </varlistentry>
-
     </variablelist>
index cbac8413b2dd7b0aeb1abcd7a4414766dc1e0865..39758313d669ea7a6b1996dd546c87c1de08d299 100644 (file)
@@ -3,7 +3,8 @@
                    "http://www.oasis-open.org/docbook/xml/4.1.2/docbookx.dtd"
 [
 <!--
-<!ENTITY accessconf SYSTEM "pam_item_types.inc.xml">
+<!ENTITY accessconf SYSTEM "pam_item_types_std.inc.xml">
+<!ENTITY accessconf SYSTEM "pam_item_types_ext.inc.xml">
 -->
 ]>
 
    </para>
 
    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
-      href="pam_item_types.inc.xml"/>
+      href="pam_item_types_std.inc.xml"/>
+
+   <para>
+     The following additional items are specific to Linux-PAM and should not be used in
+     portable applications:
+   </para>
+
+   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+      href="pam_item_types_ext.inc.xml"/>
 
     <para>
       For all <emphasis>item_type</emphasis>s, other than PAM_CONV and
index f7da10a75edafe21e25070e9390d1cbe94989593..72aaf4682ce0bac1a631a73ef050b138262570ad 100644 (file)
@@ -25,6 +25,15 @@ do {                             \
                *__xx__++ = '\0'; \
 } while (0)
 
+#define _pam_overwrite_n(x,n)   \
+do {                             \
+     register char *__xx__;      \
+     register int __i__ = 0;    \
+     if ((__xx__=(x)))           \
+        for (;__i__<n; __i__++) \
+            __xx__[__i__] = 0; \
+} while (0)
+
 /*
  * Don't just free it, forget it too.
  */
index 45bae97b235905599fdfb60806f5c0d8607ccc6d..2f7e807fb7501ba1b67d6d13ee83a5d582e9c7e7 100644 (file)
@@ -138,8 +138,11 @@ typedef struct pam_handle pam_handle_t;
 #define PAM_OLDAUTHTOK     7   /* The old authentication token */
 #define PAM_RUSER          8   /* The remote user name */
 #define PAM_USER_PROMPT    9    /* the prompt for getting a username */
+/* Linux-PAM extensions */
 #define PAM_FAIL_DELAY     10   /* app supplied function to override failure
                                   delays */
+#define PAM_XDISPLAY       11   /* X display name */
+#define PAM_XAUTHDATA      12   /* X server authentication data */
 
 /* -------------- Special defines used by Linux-PAM -------------- */
 
@@ -279,6 +282,17 @@ struct pam_conv {
     void *appdata_ptr;
 };
 
+/* Used by the PAM_XAUTHDATA pam item.  Contains X authentication
+   data used by modules to connect to the user's X display.  Note:
+   this structure is intentionally compatible with xcb_auth_info_t. */
+
+struct pam_xauth_data {
+    int namelen;
+    char *name;
+    int datalen;
+    char *data;
+};
+
 /* ... adapted from the pam_appl.h file created by Theodore Ts'o and
  *
  * Copyright Theodore Ts'o, 1996.  All rights reserved.
index de1c26ed10a026dec63dad01a0103d74a5291d3f..f400c325b3c3f6cdb49f005e192b43c376d42fde 100644 (file)
@@ -73,6 +73,15 @@ int pam_end(pam_handle_t *pamh, int pam_status)
 
     _pam_drop(pamh->former.substates);
 
+    _pam_overwrite(pamh->xdisplay);
+    _pam_drop(pamh->xdisplay);
+
+    _pam_overwrite(pamh->xauth.name);
+    _pam_drop(pamh->xauth.name);
+    _pam_overwrite_n(pamh->xauth.data, pamh->xauth.datalen);
+    _pam_drop(pamh->xauth.data);
+    _pam_overwrite_n(&pamh->xauth, sizeof(pamh->xauth));
+
     /* and finally liberate the memory for the pam_handle structure */
 
     _pam_drop(pamh);
index 52efe80b24af950cf8bdfa2340fccf6050237bf0..41d900874f989c97f58bdd9f62d3e1609d54a0dc 100644 (file)
@@ -138,6 +138,24 @@ int pam_set_item (pam_handle_t *pamh, int item_type, const void *item)
        pamh->fail_delay.delay_fn_ptr = item;
        break;
 
+    case PAM_XDISPLAY:
+       RESET(pamh->xdisplay, item);
+       break;
+
+    case PAM_XAUTHDATA:
+       if (pamh->xauth.namelen) {
+           _pam_overwrite(pamh->xauth.name);
+           free(pamh->xauth.name);
+       }
+       if (pamh->xauth.datalen) {
+           _pam_overwrite_n(pamh->xauth.data, pamh->xauth.datalen);
+           free(pamh->xauth.data);
+       }
+       pamh->xauth = *((const struct pam_xauth_data *) item);
+       pamh->xauth.name = _pam_strdup(pamh->xauth.name);
+       pamh->xauth.data = _pam_memdup(pamh->xauth.data, pamh->xauth.datalen);
+       break;
+
     default:
        retval = PAM_BAD_ITEM;
     }
@@ -220,6 +238,14 @@ int pam_get_item (const pam_handle_t *pamh, int item_type, const void **item)
        *item = pamh->fail_delay.delay_fn_ptr;
        break;
 
+    case PAM_XDISPLAY:
+       *item = pamh->xdisplay;
+       break;
+
+    case PAM_XAUTHDATA:
+       *item = &pamh->xauth;
+       break;
+
     default:
        retval = PAM_BAD_ITEM;
     }
index 770c9ccef1a4bb5a1d352e192bf4d58454e081b3..574a570e5da16c2bc88ead9191c7167ce929db43 100644 (file)
@@ -137,6 +137,28 @@ char *_pam_strdup(const char *x)
      return new;                 /* return the duplicate or NULL on error */
 }
 
+/*
+ * Safe duplication of memory buffers. "Paranoid"; don't leave
+ * evidence of old token around for later stack analysis.
+ */
+
+char *_pam_memdup(const char *x, int len)
+{
+     register char *new=NULL;
+
+     if (x != NULL) {
+         if ((new = malloc(len)) == NULL) {
+             len = 0;
+             pam_syslog(NULL, LOG_CRIT, "_pam_memdup: failed to get memory");
+         } else {
+             memcpy (new, x, len);
+         }
+         x = NULL;
+     }
+
+     return new;                 /* return the duplicate or NULL on error */
+}
+
 /* Generate argv, argc from s */
 /* caller must free(argv)     */
 
index bf32ad4488bd6d16c7babae8a68fcff4c6f07177..333f4d0f942e380e77070ec4ebfda1717f9fb181 100644 (file)
@@ -152,9 +152,11 @@ struct pam_handle {
     char *rhost;
     char *ruser;
     char *tty;
+    char *xdisplay;
     struct pam_data *data;
     struct pam_environ *env;      /* structure to maintain environment list */
     struct _pam_fail_delay fail_delay;   /* helper function for easy delays */
+    struct pam_xauth_data xauth;        /* auth info for X display */
     struct service handlers;
     struct _pam_former_state former;  /* library state - support for
                                         event driven applications */
@@ -267,6 +269,8 @@ char *_pam_StrTok(char *from, const char *format, char **next);
 
 char *_pam_strdup(const char *s);
 
+char *_pam_memdup(const char *s, int len);
+
 int _pam_mkargv(char *s, char ***argv, int *argc);
 
 void _pam_sanitize(pam_handle_t *pamh);