Thorsten Kukuk [Thu, 29 Aug 2013 12:09:39 +0000 (14:09 +0200)]
Restart waitpid if it returns with EINTR (ticket #17)
* modules/pam_unix/pam_unix_acct.c: run waitpid in a while loop.
* modules/pam_unix/pam_unix_passwd.c: Likewise.
* modules/pam_unix/support.c: Likewise.
pam_tty_audit: fix a typo that crept in during patch review
* modules/pam_tty_audit/pam_tty_audit.c (pam_sm_open_session): Replace
all occurrences of HAVE_AUDIT_TTY_STATUS_LOG_PASSWD with
HAVE_STRUCT_AUDIT_TTY_STATUS_LOG_PASSWD.
* configure.in (HAVE_AUDIT_TTY_STATUS_LOG_PASSWD): Remove.
Signed-off-by: Richard Guy Briggs <rgb@redhat.com> Signed-off-by: Dmitry V. Levin <ldv@altlinux.org>
pam_tty_audit: add an option to control logging of passwords: log_passwd
Most commands are entered one line at a time and processed as complete lines
in non-canonical mode. Commands that interactively require a password, enter
canonical mode with echo set to off to do this. This feature (icanon and
!echo) can be used to avoid logging passwords by audit while still logging the
rest of the command. Adding a member to the struct audit_tty_status passed in
by pam_tty_audit allows control of logging passwords per task.
* configure.in: autoconf bits to conditionally add support at compile time
depending on struct audit_tty_status kernel header version.
* modules/pam_tty_audit/pam_tty_audit.8.xml: Document new pam_tty_audit module
log_passwd option.
* modules/pam_tty_audit/pam_tty_audit.c: (pam_sm_open_session): Added
"log_passwd" option parsing.
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Tomas Mraz [Fri, 12 Apr 2013 10:49:55 +0000 (12:49 +0200)]
pam_access: better not change the default function used to get domain name.
modules/pam_access/pam_access.c (netgroup_match): As we did not use
yp_get_default_domain() in the 1.1 branch due to typo in ifdef
we should use it only as fallback.
Tomas Mraz [Fri, 22 Mar 2013 08:42:22 +0000 (09:42 +0100)]
pam_rootok: Allow proper logging of the user AVC if access disallowed by SELinux
modules/pam_rootok/pam_rootok.c (log_callback, selinux_check_root): New functions.
(check_for_root): Use the selinux_check_root() instead of checkPasswdAccess.
Dmitry V. Levin [Wed, 10 Oct 2012 18:13:07 +0000 (18:13 +0000)]
pam_unix: fix build in --enable-selinux mode
glibc's <sys/wait.h> starting with commit
http://sourceware.org/git/?p=glibc.git;a=commitdiff;h=glibc-2.15-231-gd94a467
does not include <sys/resource.h> for POSIX 2008 conformance reasons, so
when pam is being built with SELinux support enabled, pam_unix_passwd.c
uses getrlimit(2) and therefore should include <sys/resource.h> without
relying on other headers.
* modules/pam_unix/pam_unix_passwd.c: Include <sys/resource.h>.
Reported-by: Guido Trentalancia <guido@trentalancia.com> Reported-by: "Jory A. Pratt" <anarchy@gentoo.org> Reported-by: Diego Elio Pettenò <flameeyes@flameeyes.eu>
Tomas Mraz [Wed, 10 Oct 2012 17:46:02 +0000 (19:46 +0200)]
pam_namespace: add mntopts flag for tmpfs mount options
modules/pam_namespace/pam_namespace.h: Add mount_opts member to polydir
structure.
modules/pam_namespace/pam_namespace.c (del_polydir): Free the mount_opts.
(parse_method): Parse the mntopts flag.
(ns_setup): Pass the mount_opts to mount().
modules/pam_namespace/namespace.conf.5.xml: Document the mntopts flag.
Tomas Mraz [Thu, 6 Sep 2012 12:58:57 +0000 (14:58 +0200)]
pam_selinux, pam_tally2: Add tty and rhost to audit data.
modules/pam_selinux/pam_selinux.c (send_audit_message): Obtain tty and
rhost from PAM items and pass them to audit.
modules/pam_tally2/pam_tally2.c (tally_check): Obtain tty and
rhost from PAM items and pass them to audit.
(main): Obtain tty name of stdin and pass it to audit.
Tomas Mraz [Fri, 17 Aug 2012 12:46:40 +0000 (14:46 +0200)]
Add missing $(DESTDIR) when making directories on install.
modules/pam_namespace/Makefile.am: Add missing $(DESTDIR) when making
$(namespaceddir) on install.
modules/pam_sepermit/Makefile.am: Add missing $(DESTDIR) when making
$(sepermitlockdir) on install.
Thorsten Kukuk [Thu, 16 Aug 2012 13:46:56 +0000 (15:46 +0200)]
Small documentation and define fixes
modules/pam_limits/limits.conf.5.xml: Document race of maxlogins [#10]
modules/pam_namespace/pam_namespace.h: Define MS_SLAVE if necessary
modules/pam_pwhistory/pam_pwhistory.c: Document how the module works
modules/pam_unix/pam_unix.8.xml: Document remember option obsoleted by pam_pwhistory [#6]
Tomas Mraz [Mon, 13 Aug 2012 18:06:44 +0000 (20:06 +0200)]
Respect PAM_AUTHTOK_TYPE in pam_get_authtok_verify().
libpam/pam_get_authtok.c (pam_get_authtok_internal): Set the PAM_AUTHTOK_TYPE
item when obtained from module options.
(pam_get_authtok_verify): Use the PAM_AUTHTOK_TYPE item when prompting.
Tomas Mraz [Fri, 22 Jun 2012 11:36:45 +0000 (13:36 +0200)]
pam_cracklib: Add monotonic character sequence checking.
modules/pam_cracklib/pam_cracklib.c (_pam_parse): Parse the maxsequence option.
(sequence): New function to check for too long monotonic sequence of characters.
(password_check): Call the sequence().
modules/pam_cracklib/pam_cracklib.8.xml: Document the maxsequence check.
Tomas Mraz [Mon, 28 May 2012 18:24:17 +0000 (20:24 +0200)]
pam_pwhistory: Always record the old password even when root changes it.
modules/pam_pwhistory/pam_pwhistory.c (pam_sm_chauthtok): Use the UID of
the process instead of the target user UID (same as in pam_cracklib) to
check for root. Always record old password.
Tomas Mraz [Thu, 24 May 2012 11:40:24 +0000 (13:40 +0200)]
pam_cracklib: Add enforce_for_root option.
modules/pam_cracklib/pam_cracklib.c (_pam_parse): Recognize the enforce_for_root option.
(pam_sm_chauthtok): Enforce errors for root with the option.
modules/pam_cracklib/pam_cracklib.8.xml: Document the enforce_for_root option.
Tomas Mraz [Mon, 30 Apr 2012 13:03:32 +0000 (15:03 +0200)]
pam_cracklib: Add maxclassrepeat, gecoscheck checks and remove unused difignore.
modules/pam_cracklib/pam_cracklib.c (_pam_parse): Recognize the maxclassrepeat, gecoscheck options. Ignore difignore option.
(simple): Add the check for the same class repetition.
(usercheck): Refactor into wordcheck().
(gecoscheck): New test for words from the GECOS field.
(password_check): Call the gecoscheck().
(pam_sm_chauthtok): Drop the diff_ignore from options struct.
modules/pam_cracklib/pam_cracklib.8.xml: Document the maxclassrepeat and gecoscheck checks, update the documentation of the difok test.
Tomas Mraz [Tue, 17 Apr 2012 12:05:24 +0000 (14:05 +0200)]
pam_lastlog: add possibility to lock out inactive users in auth or account
* modules/pam_lastlog/pam_lastlog.8.xml: Document the new functionality and
option.
* modules/pam_lastlog/pam_lastlog.c: Add the inactive user lock out.
(_pam_session_parse): Renamed from _pam_parse.
(_pam_auth_parse): New function to parse auth arguments.
(_last_login_open): Factor out opening of the lastlog file.
(_last_login_read): Factor out opening of the lastlog file.
(pam_sm_authenticate): Implement the lockout functionality.
(pam_sm_setcred): Just return PAM_SUCCESS.
(pam_sm_acct_mgmt): Call pam_sm_authenticate().
Dmitry V. Levin [Fri, 3 Feb 2012 00:13:44 +0000 (00:13 +0000)]
pam_unix: make configuration consistent in --enable-static-modules mode
In --enable-static-modules mode, it was not possible to use "pam_unix"
in PAM config files. Instead, different names had to be used for each
management group: pam_unix_auth, pam_unix_acct, pam_unix_passwd and
pam_unix_session. This change makes pam_unix configuration consistent
with other PAM modules.
* README: Remove the paragraph describing pam_unix distinctions in
--enable-static-modules mode.
* libpam/pam_static_modules.h (_pam_unix_acct_modstruct,
_pam_unix_auth_modstruct, _pam_unix_passwd_modstruct,
_pam_unix_session_modstruct): Remove.
(_pam_unix_modstruct): New pam_module declaration.
* modules/pam_unix/pam_unix_static.h: New file.
* modules/pam_unix/pam_unix_static.c: Likewise.
* modules/pam_unix/Makefile.am (noinst_HEADERS): Add pam_unix_static.h
(pam_unix_la_SOURCES) [STATIC_MODULES]: Add pam_unix_static.c
* modules/pam_unix/pam_unix_acct.c [PAM_STATIC]: Include
pam_unix_static.h
[PAM_STATIC] (_pam_unix_acct_modstruct): Remove.
* modules/pam_unix/pam_unix_auth.c [PAM_STATIC]: Include
pam_unix_static.h
[PAM_STATIC] (_pam_unix_auth_modstruct): Remove.
* modules/pam_unix/pam_unix_passwd.c [PAM_STATIC]: Include
pam_unix_static.h
[PAM_STATIC] (_pam_unix_passwd_modstruct): Remove.
* modules/pam_unix/pam_unix_sess.c [PAM_STATIC]: Include
pam_unix_static.h
[PAM_STATIC] (_pam_unix_session_modstruct): Remove.
Dmitry V. Levin [Thu, 26 Jan 2012 22:22:59 +0000 (22:22 +0000)]
Make --disable-cracklib compatible with --enable-static-modules mode
* configure.in: Define HAVE_LIBCRACK when cracklib is enabled.
* libpam/pam_static_modules.h (static_modules): Guard the use of
_pam_cracklib_modstruct by HAVE_LIBCRACK macro.
Dmitry V. Levin [Thu, 26 Jan 2012 22:24:21 +0000 (22:24 +0000)]
Fix SUBDIRS for --enable-static-modules mode
There is no way to build "modules" subdirectory before "libpam" anyway.
In STATIC_MODULES mode, "libpam" subdirectory must be built twice to
produce a usable libpam.a without undefined references to multiple
_pam_*_modstruct symbols.
* Makefile.am: Use default SUBDIRS in STATIC_MODULES mode.
Tomas Mraz [Thu, 26 Jan 2012 13:50:51 +0000 (14:50 +0100)]
Do not unmount anything by default in pam_namespace close session call.
* modules/pam_namespace/pam_namespace.c (pam_sm_close_session): Recognize
the unmount_on_close option and make the default to be to not unmount.
* modules/pam_namespace/pam_namespace.h: Rename PAMNS_NO_UNMOUNT_ON_CLOSE to
PAMNS_UNMOUNT_ON_CLOSE.
* modules/pam_namespace/pam_namespace.8.xml: Document the change.
Tomas Mraz [Tue, 24 Jan 2012 19:03:28 +0000 (20:03 +0100)]
Make / mount as rslave instead of bind mounting polydirs.
* modules/pam_namespace/pam_namespace.c (protect_dir): Drop the always argument.
(check_inst_parent): Drop the always argument from protect_dir().
(create_polydir): Likewise.
(ns_setup): Likewise and do not mark the polydir with MS_PRIVATE.
(setup_namespace): Mark the / with MS_SLAVE|MS_REC.
* modules/pam_namespace/pam_namespace.8.xml: Reflect the change in docs.
Tomas Mraz [Fri, 13 Jan 2012 17:33:27 +0000 (18:33 +0100)]
Add possibility to match ruser, rhost, and tty in pam_succeed_if.
* modules/pam_succeed_if/pam_succeed_if.c (evaluate): Match ruser,
rhost, and tty as left operand.
* modules/pam_succeed_if/pam_succeed_if.8.xml: Document the new
possible left operands.
Tomas Mraz [Tue, 3 Jan 2012 11:30:43 +0000 (12:30 +0100)]
Fix matching of usernames in the pam_unix remember feature.
* modules/pam_unix/pam_unix_passwd.c (check_old_password): Make
sure we match only the whole username in opasswd entry.
* modules/pam_unix/passverify.c (save_old_password): Likewise make
sure we match only the whole username in opasswd entry.
Dmitry V. Levin [Fri, 28 Oct 2011 02:20:17 +0000 (02:20 +0000)]
Fix usage of LIBADD, LDADD and LDFLAGS
* modules/pam_selinux/Makefile.am: Rename pam_selinux_check_LDFLAGS to
pam_selinux_check_LDADD.
* modules/pam_userdb/Makefile.am: Split out pam_userdb_la_LIBADD from
AM_LDFLAGS.
* modules/pam_warn/Makefile.am: Split out pam_warn_la_LIBADD from
AM_LDFLAGS.
* modules/pam_wheel/Makefile.am: Split out pam_wheel_la_LIBADD from
AM_LDFLAGS.
* modules/pam_xauth/Makefile.am: split out pam_xauth_la_LIBADD from
AM_LDFLAGS.
* xtests/Makefile.am: Rename AM_LDFLAGS to LDADD.
Dmitry V. Levin [Thu, 27 Oct 2011 14:55:55 +0000 (14:55 +0000)]
Generate ChangeLog from git log
* .gitignore: Add ChangeLog
* ChangeLog: Rename to ChangeLog-CVS.
* Makefile.am (gen-changelog): New rule.
(dist-hook, .PHONY): Depend on it.
(EXTRA_DIST): Add ChangeLog-CVS.
* README-hacking: New file.
* gitlog-to-changelog: Import from gnulib.
* autogen.sh: Create empty ChangeLog file to make automake strictness
check happy. Use automated "autoreconf -fiv" instead of manual
invocations of various autotools.
Dmitry V. Levin [Thu, 27 Oct 2011 14:55:55 +0000 (14:55 +0000)]
Fix "make distcheck"
There is no use to distribute m4 files manually, because automake does
the right thing, while manual distribution is not only redundant but
also very fragile.
* Makefile.am (M4_FILES): Remove.
(EXTRA_DIST): Remove M4_FILES.
Dmitry V. Levin [Wed, 26 Oct 2011 23:56:54 +0000 (23:56 +0000)]
Fix whitespace issues
Cleanup trailing whitespaces, indentation that uses spaces before tabs,
and blank lines at EOF. Make the project free of warnings reported by
git diff --check 4b825dc642cb6eb9a060e54bf8d69288fbee4904 HEAD
Thorsten Kukuk [Tue, 21 Jun 2011 12:02:33 +0000 (14:02 +0200)]
2011-06-22 Thorsten Kukuk <kukuk@thkukuk.de>
* release version 1.1.4
* configure.in: Bump version number.
* NEWS: Document changes since 1.1.3
* libpam/Makefile.am: Bump release number of shared library
* po/de.po: Translate new string.
Thorsten Kukuk [Tue, 21 Jun 2011 09:05:31 +0000 (11:05 +0200)]
2011-06-21 Thorsten Kukuk <kukuk@thkukuk.de>
* modules/pam_limits/pam_limits.c: Add set_all option,
read limits from PID one if no limit is specified and set_all
is set.
* modules/pam_limits/pam_limits.8.xml: Document set_all option.
Based on Patch by Kees Cook.
Tomas Mraz [Wed, 15 Jun 2011 18:48:59 +0000 (20:48 +0200)]
Cleanups of pam_pwhistory code. Make opasswd entry parsing more robust.
* modules/pam_pwhistory/opasswd.c (check_old_password): Do not
needlessly call strdupa().
(save_old_password): Avoid memleaks in error paths. Avoid memleak of
buf. Make the opasswd entry parsing more robust.
* modules/pam_pwhistory/pam_pwhistory.8.xml: Document the
special meaning of remember=0.