Tomas Mraz [Wed, 5 Dec 2007 10:03:29 +0000 (10:03 +0000)]
Relevant BUGIDs:
Purpose of commit: cleanup
Commit summary:
---------------
2007-12-05 Tomas Mraz <t8m@centrum.cz>
* modules/pam_unix/Makefile.am: Add passverify.h and passverify.c
as first part of pam_unix refactorization.
* modules/pam_unix/pam_unix/pam_unix_acct.c: Include passverify.h.
* modules/pam_unix/pam_unix_passwd.c: Likewise.
* modules/pam_unix/passverify.c: New file with common functions.
* modules/pam_unix/passverify.h: Prototypes for the common functions.
* modules/pam_unix/support.c: Include passverify.h, move
_unix_shadowed() to passverify.c.
(_unix_verify_password): Refactor out verify_pwd_hash() function.
* modules/pam_unix/support.h: Move _unix_shadowed() prototype to
passverify.h
* modules/pam_unix/unix_chkpwd.c: Use _unix_shadowed() and
verify_pwd_hash() from passverify.c.
Don't link pam_tally application against libpam, if linked static,
libpam is not yet available.
2007-11-20 Thorsten Kukuk <kukuk@thkukuk.de>
* modules/pam_tally/pam_tally.c (tally_log): Map
pam_modutil_getpwnam to getpwnam if we don't compile
as module.
* modules/pam_tally/Makefile.am: Don't link pam_tally_app
against libpam (#1822779).
* libpam/pam_static_modules.h: Fix name of pam_namespace variable.
2007-10-30 Peter Breitenlohner <peb@mppmu.mpg.de>
* tests/tst-dlopen.c: Return 77 in case of static modules, such that
all modules/pam_*/tst-pam_* tests yield SKIP instead of FAIL.
* libpam/Makefile.am (libpam_la_LIBADD): Use "$(shell ls ...)" instead
of "`ls ...`", to allow for static modules.
* libpam/pam_static_modules.h: Make pam_keyinit module depend on
HAVE_KEY_MANAGEMENT; correct name of pam_faildelay pam_module struct.
* modules/pam_faildelay/pam_faildelay.c: Correct name of pam_module
struct.
Steve Langasek [Thu, 25 Oct 2007 21:32:48 +0000 (21:32 +0000)]
Relevant BUGIDs: Debian bug #446327
Purpose of commit: bugfix
Commit summary:
---------------
2007-10-25 Steve Langasek <vorlon@debian.org>
* modules/pam_tally/pam_tally.c: fix the definition of OPT_AUDIT
to be octal instead of decimal, so that it works properly in a
bit field instead of forcing the "even_deny_root_account" and
"no_reset" options to on.
Patch from Corey Wright <undefined@pobox.com>.
Tomas Mraz [Fri, 19 Oct 2007 17:06:29 +0000 (17:06 +0000)]
Relevant BUGIDs:
Purpose of commit: new feature
Commit summary:
---------------
2007-10-19 Tomas Mraz <t8m@centrum.cz>
* xtests/tst-pam_access1.c: Use different name for user and group.
* xtests/tst-pam_access1.sh: Likewise.
* xtests/tst-pam_access2.c: Likewise.
* xtests/tst-pam_access2.sh: Likewise.
* xtests/tst-pam_access4.c: Likewise.
* xtests/tst-pam_access4.sh: Likewise.
* xtests/group.conf: Likewise.
* xtests/tst-pam_group1.c: Likewise.
* xtests/tst-pam_group1.sh: Likewise.
* libpam/pam_dispatch.c (_pam_dispatch_aux): Save states for substacks,
record substack level, skip over virtual substack modules, implement
evaluation of done, die, reset and jumps in substacks. Also fixes
too far jumps in substacks.
* libpam/pam_end.c (pam_end): Drop substack evaluation states.
* libpam/pam_handlers.c (_pam_parse_conf_file): Add substack level
parameter, instead of must_fail use handler_type needed for virtual
substack modules.
(_pam_load_conf_file): Add substack level parameter.
(_pam_init_handlers): Substack level parameter added to
_pam_parse_conf_file() calls.
(_pam_load_module): New function.
(_pam_add_handler): Refactor code into the _pam_load_module(). Add
support for virtual substack modules.
* libpam/pam_private.h: Rename must_fail to handler_type, add stack_level
to struct handler. Define handler type constants. Add struct
for substack evaluation states. Define constant for maximum
substack level. Add substack states pointer to former state struct.
* libpam/pam_start.c (pam_start): Initialize pointer to substack states.
* doc/man/pam.conf-syntax.xml: Document substack control.
* xtests/Makefile.am: Add new tests for substack evaluation.
* xtests/run_xtests.sh: Support multiple .pamd files in a test.
* xtests/tst-pam_authfail.pamd: New tests for substack evaluation.
* xtests/tst-pam_authsucceed.pamd: Likewise.
* xtests/tst-pam_substack1.pamd: Likewise.
* xtests/tst-pam_substack1a.pamd: Likewise.
* xtests/tst-pam_substack1.sh: Likewise.
* xtests/tst-pam_substack2.pamd: Likewise.
* xtests/tst-pam_substack2a.pamd: Likewise.
* xtests/tst-pam_substack2.sh: Likewise.
* xtests/tst-pam_substack3.pamd: Likewise.
* xtests/tst-pam_substack3a.pamd: Likewise.
* xtests/tst-pam_substack3.sh: Likewise.
* xtests/tst-pam_substack4.pamd: Likewise.
* xtests/tst-pam_substack4a.pamd: Likewise.
* xtests/tst-pam_substack4.sh: Likewise.
* xtests/tst-pam_substack5.pamd: Likewise.
* xtests/tst-pam_substack5a.pamd: Likewise.
* xtests/tst-pam_substack5.sh: Likewise.
Tomas Mraz [Thu, 18 Oct 2007 11:02:57 +0000 (11:02 +0000)]
Relevant BUGIDs:
Purpose of commit: testcase
Commit summary:
---------------
2007-10-18 Tomas Mraz <t8m@centrum.cz>
* xtests/tst-pam_dispatch4.c: Fix comment about the test.
* xtests/tst-pam_dispatch4.pamd: Improve the testcase.
Thorsten Kukuk [Fri, 12 Oct 2007 10:46:25 +0000 (10:46 +0000)]
Relevant BUGIDs:
Purpose of commit: new testcase
Commit summary:
---------------
2007-10-12 Thorsten Kukuk <kukuk@thkukuk.de>
* xtests/Makefile.am: Add tst-pam_dispatch5 sources
* xtests/tst-pam_dispatch5.c: New test for jump too far.
* xtests/tst-pam_dispatch5.pamd: New test configuration.
Thorsten Kukuk [Mon, 1 Oct 2007 09:41:32 +0000 (09:41 +0000)]
Relevant BUGIDs:
Purpose of commit: bugfix
Commit summary:
---------------
2007-10-01 Thorsten Kukuk <kukuk@thkukuk.de>
* xtests/tst-pam_group1.c: New test case for user compare in pam_group.
* xtests/tst-pam_group1.sh: Script to run test case.
* xtests/tst-pam_group1.pamd: Config for test case.
* xtests/Makefile.am: Add tst-pam_group1 test case.
* xtests/run-xtests.sh: Save/restore group.conf.
* xtests/group.conf: New.
* modules/pam_xauth/pam_xauth.c (pam_sm_open_session): Don't
free arguments used for putenv().
* doc/man/pam_putenv.3.xml: Document that application has to free
the memory.
Tomas Mraz [Thu, 27 Sep 2007 11:54:43 +0000 (11:54 +0000)]
Relevant BUGIDs: rhbz #306901, rhbz #295151
Purpose of commit: bugfix
Commit summary:
---------------
2007-09-27 Tomas Mraz <t8m@centrum.cz>
* modules/pam_succeed_if/pam_succeed_if.c (evaluate_inlist): Fix in
operator rhbz #295151.
* modules/pam_namespace/pam_namespace.c (poly_name): Do not try to
get context when SELinux is disabled rhbz #306901.
* xtests/tst-pam_succeed_if1.c: New test case for
https://bugzilla.redhat.com/show_bug.cgi?id=295151
* xtests/tst-pam_succeed_if1.sh: Script to run test case.
* xtests/tst-pam_succeed_if1.pamd: Config for test case.
* xtests/Makefile.am: Add tst-pam_succeed_if1 test case.
Steve Langasek [Mon, 3 Sep 2007 21:45:04 +0000 (21:45 +0000)]
Relevant BUGIDs: Debian bug #1708
Purpose of commit: cleanup (behavior change)
Commit summary:
---------------
2007-09-03 Steve Langasek <vorlon@debian.org>
* libpam_misc/misc_conv.c: don't block SIGINT in misc_conv; it's
perfectly valid to allow the user to interrupt at a prompt. If
an application wants prompts to not be interruptable, the
application should take responsibility for blocking SIGINT.
Steve Langasek [Sat, 1 Sep 2007 02:10:32 +0000 (02:10 +0000)]
Relevant BUGIDs: Debian bug #197080
Purpose of commit: cleanup
Commit summary:
---------------
2007-08-31 Steve Langasek <vorlon@debian.org>
* modules/pam_group/group.conf: don't use "games" as an example
group, on some distros this is a pre-existing group that it would
be a security hole to give users access to.
Steve Langasek [Thu, 30 Aug 2007 15:15:41 +0000 (15:15 +0000)]
Relevant BUGIDs: Debian bugs #95220, #175900
Purpose of commit: bugfix
Commit summary:
---------------
2007-08-30 Steve Langasek <vorlon@debian.org>
* modules/pam_unix/support.c, modules/pam_unix/unix_chkpwd.c:
A wrong username doesn't need to be logged at LOG_ALERT;
LOG_WARNING should be sufficient.
Patch from Sam Hartman <hartmans@debian.org>.
Steve Langasek [Thu, 30 Aug 2007 04:00:39 +0000 (04:00 +0000)]
Relevant BUGIDs:
Purpose of commit: portability, cleanup
Commit summary:
---------------
2007-08-29 Steve Langasek <vorlon@debian.org>
* libpam/pam_modutil_getgrgid.c, libpam/pam_modutil_getgrnam.c,
libpam/pam_modutil_getpwnam.c, libpam/pam_modutil_getpwuid.c,
libpam/pam_modutil_getspnam.c: don't use pthread mutexes in libpam
unnecessarily; this avoids linking problems on non-Linux
platforms.
Steve Langasek [Thu, 30 Aug 2007 00:11:15 +0000 (00:11 +0000)]
Relevant BUGIDs: Debian bug #84428
Purpose of commit: new feature
Commit summary:
---------------
2007-08-29 Steve Langasek <vorlon@debian.org>
* modules/pam_listfile/pam_listfile.c, modules/pam_listfile/README,
modules/pam_listfile/pam_listfile.8,
modules/pam_listfile/pam_listfile.8.xml: add a 'quiet' option to
avoid logging errors any time a user is refused service by this
module.
Steve Langasek [Wed, 29 Aug 2007 10:30:11 +0000 (10:30 +0000)]
Relevant BUGIDs: Debian bug #440019
Purpose of commit: bugfix
Commit summary:
---------------
2007-08-29 Steve Langasek <vorlon@debian.org>
* modules/pam_rhosts/pam_rhosts_auth.c: getline returns -1 at
EOF, not 0. Check accordingly to fix an infinite loop. Thanks
to Stephan Springl <springl-rhosts@bfw-online.de> for catching
this.
Steve Langasek [Wed, 29 Aug 2007 00:14:57 +0000 (00:14 +0000)]
Relevant BUGIDs:
Purpose of commit: cleanup
Commit summary:
---------------
2007-08-28 Steve Langasek <vorlon@debian.org>
* configure.in: call AC_CHECK_HEADERS instead of AC_CHECK_HEADER
for crack.h, so we get a HAVE_CRACK_H define.
* modules/pam_cracklib/pam_cracklib.c: don't copy around the
cracklib dictpath into a fixed-width buffer, when we can just
point at the existing strings; and allow users to override the
default cracklib path with -DCRACKLIB_DICT, required for
compatibility with cracklib 2.7.
Steve Langasek [Tue, 28 Aug 2007 02:27:17 +0000 (02:27 +0000)]
Relevant BUGIDs: Debian bugs #76119, #165066
Purpose of commit: portability
Commit summary:
---------------
2007-08-27 Steve Langasek <vorlon@debian.org>
* modules/pam_limits/pam_limits.c: when building on non-Linux
systems, give a warning only, not an error; no one seems to
remember why this error was here in the first place, but leave
something in that might still grab the attention of non-Linux
users.
Patch from Michal Suchanek <hramrach_l@centrum.cz>.
* configure.in, modules/pam_rhosts/pam_rhosts_auth.c: check for
the presence of net/if.h before using, required for Hurd
compatibility.
Patch from Igor Khavkine <i_khavki@alcor.concordia.ca>.
* modules/pam_limits/pam_limits.c: conditionalize the use of
RLIMIT_AS, which is not present on the Hurd.
Patch from Igor Khavkine <i_khavki@alcor.concordia.ca>.
* modules/pam_rhosts/pam_rhosts_auth.c: use getline() instead of
a static buffer when available; fixes the build on systems
without MAXHOSTNAMELEN (i.e., the Hurd).
* modules/pam_xauth/pam_xauth.c: make sure PATH_MAX is defined
before using it.
Steve Langasek [Sat, 25 Aug 2007 12:11:30 +0000 (12:11 +0000)]
Relevant BUGIDs:
Purpose of commit: bugfix
Commit summary:
---------------
2007-08-25 Steve Langasek <vorlon@debian.org>
* doc/man/pam.conf-syntax.xml, doc/man/pam.conf.5:
Document "new" control options conv_again and incomplete, supported
in pam.d's extended syntax.
Patch from Ben Collins <bcollins@debian.org>.
* configure.in: Add --with-db-uniquename option to support
db libraries and functions with unique name extension.
Patch from Diego 'Flameeyes' Pettenò <flameeyes@gmail.com>.
* modules/pam_limits/pam_limits.c: Include locale.h.
* configure.in: Check for audit_log_acct_message instead of
audit_log_user_message.
* libpam/pam_audit.c: Use audit_log_acct_message.
Based on patch from Mark J Cox <mjc@redhat.com>.
* libpam/Makefile.am: Bump version number of libpam.
* modules/pam_umask/pam_umask.c (set_umask): mode_t is 32bit,
not 64bit.
* xtests/tst-pam_limits1.c: Fix printf arguments.
* po/*.po: Merge po files with latest code changes.
Thorsten Kukuk [Tue, 26 Jun 2007 10:44:28 +0000 (10:44 +0000)]
Relevant BUGIDs:
Purpose of commit: bugfix
Commit summary:
---------------
2007-06-26 Thorsten Kukuk <kukuk@thkukuk.de>
* modules/pam_limits/pam_limits.c (process_limit): Check upper and
lower limit of nice value, fix off-by-one in conversation to rlim_t.
* xtests/Makefile.am: Add new pam_limits test case.
* xtests/limits.conf: New, config file for test case.
* xtests/pam_limits1.c: New, test case for RLIMIT_NICE.
* xtests/pam_limits1.sh: Likewise.
* xtests/pam_limits1.pamd: Likewise.
Thorsten Kukuk [Fri, 22 Jun 2007 09:49:03 +0000 (09:49 +0000)]
Relevant BUGIDs: 411390
Purpose of commit: new feature
Commit summary:
---------------
2007-06-22 Thorsten Kukuk <kukuk@thkukuk.de>
* modules/pam_access/pam_access.c: Add new syntax for groups
in access.conf to differentiate group names from account names.
Based on patch from Julien Lecomte <julien@famille-lecomte.net>,
solves feature request [#411390].
* modules/pam_access/access.conf: Add example for new group
syntax.
* modules/pam_access/access.conf.5.xml: Document new syntax.
* modules/pam_cracklib/pam_cracklib.8.xml: Document new minclass
option.
* modules/pam_cracklib/pam_cracklib.c: Add support for minimum
character classes [#1688777]. Based on patch from Keith Schincke.
* xtests/tst-pam_cracklib2.c: New, test case for minclass option.
* xtests/tst-pam_cracklib2.pamd: New, PAM config file for test case.
* xtests/Makefile.am: Add new testcase.
* xtests/pam_cracklib.c: Fix comment what this application tests.
* configure.in: Use /lib64 on x86-64, ppc64, s390x, sparc64
Tomas Mraz [Fri, 15 Jun 2007 10:17:22 +0000 (10:17 +0000)]
Relevant BUGIDs:
Purpose of commit: new feature
Commit summary:
---------------
2007-06-15 Tomas Mraz <t8m@centrum.cz>
* modules/pam_selinux/pam_selinux.8.xml: Remove multiple option,
add select_context and use_current_range options.
* modules/pam_selinux/pam_selinux.c (send_audit_message): Added
function for auditing role/level changes.
(query_response): Add default response.
(select_context): Removed.
(manual_context): Query only role and level.
(mls_range_allowed): Added function for range check.
(config_context): Added function for role and level override.
(pam_sm_open_session): Remove multiple option, add select_context
and use_current_range_options. Use getseuserbyname to obtain
SELinux user and level. Audit role/level changes. Call setkeycreatecon
to assign key creation context. Don't fail on errors when SELinux
is not in enforcing mode.
Tomas Mraz [Fri, 15 Jun 2007 09:38:11 +0000 (09:38 +0000)]
Relevant BUGIDs:
Purpose of commit: bugfix, new feature
Commit summary:
---------------
2007-06-15 Tomas Mraz <t8m@centrum.cz>
* modules/pam_namespace/README.xml: Avoid duplication of
documentation.
* modules/pam_namespace/namespace.conf: More real life example
from MLS support.
* modules/pam_namespace/namespace.conf.5.xml: Likewise plus
properly describe how instance directory names are formed.
* modules/pam_namespace/namespace.init: Preserve euid when
called from setuid apps (su, newrole).
* modules/pam_namespace/pam_namespace.8.xml: Added option
no_unmount_on_close.
* modules/pam_namespace/pam_namespace.c (process_line): Polyinst
methods are now user, level and context. Fix crash on unknown
override user in config file.
(ns_override): Add explicit uid parameter.
(form_context): Skip for user method. Implement level based
polyinstantiation.
(poly_name): Initialize contexts. Add level based polyinst,
remove 'both' metod. Use raw contexts for instance names,
truncate long instance names and add hash.
(ns_setup): Hashing moved to poly_name().
(setup_namespace): Handle correctly override users for
su (when unmnt_remnt is used).
(pam_sm_close_session): Added no_unmount_on_close option.
* modules/pam_namespace/pam_namespace.h: Added
no_unmount_on_close_option, level method, limit on instance
directory name length.
Thorsten Kukuk [Fri, 4 May 2007 11:36:08 +0000 (11:36 +0000)]
Relevant BUGIDs:
Purpose of commit: bugfix
Commit summary:
---------------
2007-05-04 Thorsten Kukuk <kukuk@suse.de>
* xtests/run-xtests.sh: Use SRCDIR to find PAM config files.
* xtests/Makefile.am:Call run-xtests.sh with srcdir as first
argument.
Based on patch by Bernard Leak <thisisnotapipe@hotmail.com>.
* modules/pam_limits/limits.conf: Address space limit is KB.
* modules/pam_limits/limits.conf.5.xml: Likewise.
Reported by Thomas Vander Stichele <thomas@apestaart.org>.
Tomas Mraz [Thu, 29 Mar 2007 20:33:07 +0000 (20:33 +0000)]
Relevant BUGIDs:
Purpose of commit: new feature
Commit summary:
---------------
* modules/pam_limits/Makefile.am: Define limits.d dir and install it.
* modules/pam_limits/pam_limits.8.xml: Describe limits.d parsing.
* modules/pam_limits/pam_limits.c (pam_limit_s): Make conf_file ptr.
(pam_parse): conf_file is now ptr.
(pam_sm_open_session): Add parsing files from limits.d subdir using
glob, change pl to pointer.
Tomas Mraz [Thu, 1 Feb 2007 21:54:58 +0000 (21:54 +0000)]
Relevant BUGIDs:
Purpose of commit: bugfix
Commit summary:
---------------
2007-02-01 Tomas Mraz <t8m@centrum.cz>
* xtests/tst-pam_unix3.c: Fix typos in comments.
* modules/pam_unix/support.c (_unix_verify_password): Explicitly
disallow '!' in the beginning of password hash. Treat only
13 bytes password hash specifically. (Suggested by Solar Designer.)
Fix a warning and test for allocation failure.
* modules/pam_unix/unix_chkpwd.c (_unix_verify_password): Likewise.
Thorsten Kukuk [Wed, 20 Dec 2006 14:56:08 +0000 (14:56 +0000)]
Relevant BUGIDs:
Purpose of commit: bugfix
Commit summary:
---------------
Don't be more restrictive than useradd for account names:
2006-12-20 Thorsten Kukuk <kukuk@thkukuk.de>
* modules/pam_unix/pam_unix_passwd.c (pam_sm_chauthtok): Forbid
only '+' and '-' as first characters for account names.
* modules/pam_unix/pam_unix_auth.c (pam_sm_authenticate): Likewise.
Tomas Mraz [Mon, 18 Dec 2006 21:07:42 +0000 (21:07 +0000)]
Relevant BUGIDs:
Purpose of commit: bugfix
Commit summary:
---------------
2006-12-18 Tomas Mraz <t8m@centrum.cz>
* modules/pam_keyinit/pam_keyinit.c (kill_keyrings): Switch to new
egid first, euid next. Revert euid/egid to old euid/egid and not
ruid/rgid.
(pam_sm_open_session): Switch to new rgid first, ruid next.
* modules/pam_localuser/pam_localuser.c: Add support for session
and chauthtok [SF#1606180].
* modules/pam_localuser/pam_localuser.8.xml: Document last change.
* libpam/pam_audit.c (_pam_audit_writelog): Print error message
only once.
Thorsten Kukuk [Thu, 7 Dec 2006 12:34:00 +0000 (12:34 +0000)]
Relevant BUGIDs:
Purpose of commit: new feature
Commit summary:
---------------
2006-12-06 Thorsten Kukuk <kukuk@thkukuk.de>
* modules/pam_faildelay/pam_faildelay.c: If no argument is
given, try to read FAIL_DELAY from /etc/login.defs.
* modules/pam_faildelay/pam_faildelay.8.xml: Document usage
of /etc/login.defs.
* modules/pam_mkhomedir/pam_mkhomedir.c (rec_mkdir): Fix
handling of left-most path component [SF#1591598].
(create_homedir): Mark user visible messages for translation.
* po/de.po: Adjust german translation for pam_mkhomedir.
projects / linux-pam / log