Dmitry V. Levin [Thu, 26 Jan 2012 22:24:21 +0000 (22:24 +0000)]
Fix SUBDIRS for --enable-static-modules mode
There is no way to build "modules" subdirectory before "libpam" anyway.
In STATIC_MODULES mode, "libpam" subdirectory must be built twice to
produce a usable libpam.a without undefined references to multiple
_pam_*_modstruct symbols.
* Makefile.am: Use default SUBDIRS in STATIC_MODULES mode.
Tomas Mraz [Thu, 26 Jan 2012 13:50:51 +0000 (14:50 +0100)]
Do not unmount anything by default in pam_namespace close session call.
* modules/pam_namespace/pam_namespace.c (pam_sm_close_session): Recognize
the unmount_on_close option and make the default to be to not unmount.
* modules/pam_namespace/pam_namespace.h: Rename PAMNS_NO_UNMOUNT_ON_CLOSE to
PAMNS_UNMOUNT_ON_CLOSE.
* modules/pam_namespace/pam_namespace.8.xml: Document the change.
Tomas Mraz [Tue, 24 Jan 2012 19:03:28 +0000 (20:03 +0100)]
Make / mount as rslave instead of bind mounting polydirs.
* modules/pam_namespace/pam_namespace.c (protect_dir): Drop the always argument.
(check_inst_parent): Drop the always argument from protect_dir().
(create_polydir): Likewise.
(ns_setup): Likewise and do not mark the polydir with MS_PRIVATE.
(setup_namespace): Mark the / with MS_SLAVE|MS_REC.
* modules/pam_namespace/pam_namespace.8.xml: Reflect the change in docs.
Tomas Mraz [Fri, 13 Jan 2012 17:33:27 +0000 (18:33 +0100)]
Add possibility to match ruser, rhost, and tty in pam_succeed_if.
* modules/pam_succeed_if/pam_succeed_if.c (evaluate): Match ruser,
rhost, and tty as left operand.
* modules/pam_succeed_if/pam_succeed_if.8.xml: Document the new
possible left operands.
Tomas Mraz [Tue, 3 Jan 2012 11:30:43 +0000 (12:30 +0100)]
Fix matching of usernames in the pam_unix remember feature.
* modules/pam_unix/pam_unix_passwd.c (check_old_password): Make
sure we match only the whole username in opasswd entry.
* modules/pam_unix/passverify.c (save_old_password): Likewise make
sure we match only the whole username in opasswd entry.
Dmitry V. Levin [Fri, 28 Oct 2011 02:20:17 +0000 (02:20 +0000)]
Fix usage of LIBADD, LDADD and LDFLAGS
* modules/pam_selinux/Makefile.am: Rename pam_selinux_check_LDFLAGS to
pam_selinux_check_LDADD.
* modules/pam_userdb/Makefile.am: Split out pam_userdb_la_LIBADD from
AM_LDFLAGS.
* modules/pam_warn/Makefile.am: Split out pam_warn_la_LIBADD from
AM_LDFLAGS.
* modules/pam_wheel/Makefile.am: Split out pam_wheel_la_LIBADD from
AM_LDFLAGS.
* modules/pam_xauth/Makefile.am: split out pam_xauth_la_LIBADD from
AM_LDFLAGS.
* xtests/Makefile.am: Rename AM_LDFLAGS to LDADD.
Dmitry V. Levin [Thu, 27 Oct 2011 14:55:55 +0000 (14:55 +0000)]
Generate ChangeLog from git log
* .gitignore: Add ChangeLog
* ChangeLog: Rename to ChangeLog-CVS.
* Makefile.am (gen-changelog): New rule.
(dist-hook, .PHONY): Depend on it.
(EXTRA_DIST): Add ChangeLog-CVS.
* README-hacking: New file.
* gitlog-to-changelog: Import from gnulib.
* autogen.sh: Create empty ChangeLog file to make automake strictness
check happy. Use automated "autoreconf -fiv" instead of manual
invocations of various autotools.
Dmitry V. Levin [Thu, 27 Oct 2011 14:55:55 +0000 (14:55 +0000)]
Fix "make distcheck"
There is no use to distribute m4 files manually, because automake does
the right thing, while manual distribution is not only redundant but
also very fragile.
* Makefile.am (M4_FILES): Remove.
(EXTRA_DIST): Remove M4_FILES.
Dmitry V. Levin [Wed, 26 Oct 2011 23:56:54 +0000 (23:56 +0000)]
Fix whitespace issues
Cleanup trailing whitespaces, indentation that uses spaces before tabs,
and blank lines at EOF. Make the project free of warnings reported by
git diff --check 4b825dc642cb6eb9a060e54bf8d69288fbee4904 HEAD
Thorsten Kukuk [Tue, 21 Jun 2011 12:02:33 +0000 (14:02 +0200)]
2011-06-22 Thorsten Kukuk <kukuk@thkukuk.de>
* release version 1.1.4
* configure.in: Bump version number.
* NEWS: Document changes since 1.1.3
* libpam/Makefile.am: Bump release number of shared library
* po/de.po: Translate new string.
Thorsten Kukuk [Tue, 21 Jun 2011 09:05:31 +0000 (11:05 +0200)]
2011-06-21 Thorsten Kukuk <kukuk@thkukuk.de>
* modules/pam_limits/pam_limits.c: Add set_all option,
read limits from PID one if no limit is specified and set_all
is set.
* modules/pam_limits/pam_limits.8.xml: Document set_all option.
Based on Patch by Kees Cook.
Tomas Mraz [Wed, 15 Jun 2011 18:48:59 +0000 (20:48 +0200)]
Cleanups of pam_pwhistory code. Make opasswd entry parsing more robust.
* modules/pam_pwhistory/opasswd.c (check_old_password): Do not
needlessly call strdupa().
(save_old_password): Avoid memleaks in error paths. Avoid memleak of
buf. Make the opasswd entry parsing more robust.
* modules/pam_pwhistory/pam_pwhistory.8.xml: Document the
special meaning of remember=0.
Thorsten Kukuk [Tue, 14 Jun 2011 13:28:05 +0000 (15:28 +0200)]
2011-06-14 Thorsten Kukuk <kukuk@thkukuk.de>
* configure.in: Check for libtirpc bye default.
* libpam/Makefile.am: Add support for libtirpc.
* modules/pam_access/Makefile.am: Likewise.
* modules/pam_unix/Makefile.am: Likewise.
* modules/pam_unix/pam_unix_passwd.c: Change ifdefs for
new libtirpc support.
* modules/pam_unix/yppasswd_xdr.c: Only compile if we have rpc/rpc.h.
Tomas Mraz [Fri, 18 Mar 2011 23:15:54 +0000 (23:15 +0000)]
Relevant BUGIDs:
Purpose of commit: bugfix
Commit summary:
---------------
2011-03-18 Tomas Mraz <tm@t8m.info>
* modules/pam_namespace/md5.c (MD5Final): Clear the whole ctx.
* modules/pam_namespace/pam_namespace.c (del_polydir): Guard for NULL poly.
(protect_dir): Guard for -1 passing to close().
(ns_setup): Likewise.
(pam_sm_open_session): Correctly test for SELinux enabled flag.
Tomas Mraz [Tue, 14 Dec 2010 08:40:40 +0000 (08:40 +0000)]
Relevant BUGIDs:
Purpose of commit: new feature
Commit summary:
---------------
2010-12-14 Tomas Mraz <tm@t8m.info>
* modules/pam_limits/pam_limits.c (parse_uid_range): New function
to parse the range of uids or gids.
(parse_config_file): Call parse_uid_range() and if uid/gid range
is identified, setup the limits if the range matches. New parameters
containing user's uid and primary gid.
(pam_sm_open_session): Pass the user's uid and primary gid to
parse_config_file().
* modules/pam_limits/limits.conf.5.xml: Document the uid/gid ranges.
Thorsten Kukuk [Wed, 24 Nov 2010 12:28:01 +0000 (12:28 +0000)]
Relevant BUGIDs:
Purpose of commit: new feature
Commit summary:
---------------
2010-11-24 Thorsten Kukuk <kukuk@thkukuk.de>
* modules/pam_securetty/pam_securetty.c: Parse console= kernel
option, add noconsole option.
* modules/pam_securetty/pam_securetty.8.xml: Document new behavior
for serial console.
Patch from Lennart Poettering.
Tomas Mraz [Fri, 22 Oct 2010 07:18:07 +0000 (07:18 +0000)]
Relevant BUGIDs:
Purpose of commit: bugfix
Commit summary:
---------------
2010-10-22 Tomas Mraz <tm@t8m.info>
* modules/pam_namespace/pam_namespace.c (inst_init): Use execle()
to execute the init script with clean environment. (CVE-2010-3853)
(cleanup_tmpdirs): Likewise for executing rm.
Dmitry V. Levin [Thu, 21 Oct 2010 15:00:12 +0000 (15:00 +0000)]
Relevant BUGIDs:
Purpose of commit: cleanup
Commit summary:
---------------
2010-10-21 Dmitry V. Levin <ldv@altlinux.org>
* modules/pam_mkhomedir/mkhomedir_helper.c (rec_mkdir): Remove.
(create_homedir): Use mkdir() instead of rec_mkdir().
(make_parent_dirs): New function.
(main): Use make_parent_dirs() to create parent directories only
for the home directory itself.
Thorsten Kukuk [Wed, 20 Oct 2010 11:58:17 +0000 (11:58 +0000)]
Relevant BUGIDs:
Purpose of commit: bugfix
Commit summary:
---------------
2010-10-20 Thorsten Kukuk <kukuk@thkukuk.de>
* modules/pam_mkhomedir/mkhomedir_helper.c (rec_mkdir): Create
parent directories always with mode 0755.
(create_homedir): Create main directory with mode 0700 at first.
Thorsten Kukuk [Tue, 19 Oct 2010 15:24:34 +0000 (15:24 +0000)]
Relevant BUGIDs:
Purpose of commit: documentation
Commit summary:
---------------
2010-10-19 Thorsten Kukuk <kukuk@thkukuk.de>
* modules/pam_env/pam_env.8.xml: Document side effects of
environment variables in the stack.
* modules/pam_exec/pam_exec.8.xml: Document that user can
have controll over the environment.
Commit summary:
---------------
2010-09-27 Dmitry V. Levin <ldv@altlinux.org>
* modules/pam_xauth/pam_xauth.c (pam_sm_close_session): Return
PAM_SUCCESS immediately if no cookie file is defined. Return
PAM_SESSION_ERR if cookie file is defined but target uid cannot be
determined. Do not modify cookiefile string returned by pam_get_data.
Tomas Mraz [Thu, 26 Aug 2010 19:16:18 +0000 (19:16 +0000)]
Relevant BUGIDs:
Purpose of commit: new feature
Commit summary:
---------------
2010-08-26 Tomas Mraz <t8m@centrum.cz>
* modules/pam_nologin/pam_nologin.c (perform_check): Try first
/var/run/nologin if the nologin file is not explicitly specified.
* modules/pam_nologin/pam_nologin.8.xml: Document that /var/run/nologin
is tried first.
projects / linux-pam / log