Steve Langasek [Mon, 3 Sep 2007 21:45:04 +0000 (21:45 +0000)]
Relevant BUGIDs: Debian bug #1708
Purpose of commit: cleanup (behavior change)
Commit summary:
---------------
2007-09-03 Steve Langasek <vorlon@debian.org>
* libpam_misc/misc_conv.c: don't block SIGINT in misc_conv; it's
perfectly valid to allow the user to interrupt at a prompt. If
an application wants prompts to not be interruptable, the
application should take responsibility for blocking SIGINT.
Steve Langasek [Sat, 1 Sep 2007 02:10:32 +0000 (02:10 +0000)]
Relevant BUGIDs: Debian bug #197080
Purpose of commit: cleanup
Commit summary:
---------------
2007-08-31 Steve Langasek <vorlon@debian.org>
* modules/pam_group/group.conf: don't use "games" as an example
group, on some distros this is a pre-existing group that it would
be a security hole to give users access to.
Steve Langasek [Thu, 30 Aug 2007 15:15:41 +0000 (15:15 +0000)]
Relevant BUGIDs: Debian bugs #95220, #175900
Purpose of commit: bugfix
Commit summary:
---------------
2007-08-30 Steve Langasek <vorlon@debian.org>
* modules/pam_unix/support.c, modules/pam_unix/unix_chkpwd.c:
A wrong username doesn't need to be logged at LOG_ALERT;
LOG_WARNING should be sufficient.
Patch from Sam Hartman <hartmans@debian.org>.
Steve Langasek [Thu, 30 Aug 2007 04:00:39 +0000 (04:00 +0000)]
Relevant BUGIDs:
Purpose of commit: portability, cleanup
Commit summary:
---------------
2007-08-29 Steve Langasek <vorlon@debian.org>
* libpam/pam_modutil_getgrgid.c, libpam/pam_modutil_getgrnam.c,
libpam/pam_modutil_getpwnam.c, libpam/pam_modutil_getpwuid.c,
libpam/pam_modutil_getspnam.c: don't use pthread mutexes in libpam
unnecessarily; this avoids linking problems on non-Linux
platforms.
Steve Langasek [Thu, 30 Aug 2007 00:11:15 +0000 (00:11 +0000)]
Relevant BUGIDs: Debian bug #84428
Purpose of commit: new feature
Commit summary:
---------------
2007-08-29 Steve Langasek <vorlon@debian.org>
* modules/pam_listfile/pam_listfile.c, modules/pam_listfile/README,
modules/pam_listfile/pam_listfile.8,
modules/pam_listfile/pam_listfile.8.xml: add a 'quiet' option to
avoid logging errors any time a user is refused service by this
module.
Steve Langasek [Wed, 29 Aug 2007 10:30:11 +0000 (10:30 +0000)]
Relevant BUGIDs: Debian bug #440019
Purpose of commit: bugfix
Commit summary:
---------------
2007-08-29 Steve Langasek <vorlon@debian.org>
* modules/pam_rhosts/pam_rhosts_auth.c: getline returns -1 at
EOF, not 0. Check accordingly to fix an infinite loop. Thanks
to Stephan Springl <springl-rhosts@bfw-online.de> for catching
this.
Steve Langasek [Wed, 29 Aug 2007 00:14:57 +0000 (00:14 +0000)]
Relevant BUGIDs:
Purpose of commit: cleanup
Commit summary:
---------------
2007-08-28 Steve Langasek <vorlon@debian.org>
* configure.in: call AC_CHECK_HEADERS instead of AC_CHECK_HEADER
for crack.h, so we get a HAVE_CRACK_H define.
* modules/pam_cracklib/pam_cracklib.c: don't copy around the
cracklib dictpath into a fixed-width buffer, when we can just
point at the existing strings; and allow users to override the
default cracklib path with -DCRACKLIB_DICT, required for
compatibility with cracklib 2.7.
Steve Langasek [Tue, 28 Aug 2007 02:27:17 +0000 (02:27 +0000)]
Relevant BUGIDs: Debian bugs #76119, #165066
Purpose of commit: portability
Commit summary:
---------------
2007-08-27 Steve Langasek <vorlon@debian.org>
* modules/pam_limits/pam_limits.c: when building on non-Linux
systems, give a warning only, not an error; no one seems to
remember why this error was here in the first place, but leave
something in that might still grab the attention of non-Linux
users.
Patch from Michal Suchanek <hramrach_l@centrum.cz>.
* configure.in, modules/pam_rhosts/pam_rhosts_auth.c: check for
the presence of net/if.h before using, required for Hurd
compatibility.
Patch from Igor Khavkine <i_khavki@alcor.concordia.ca>.
* modules/pam_limits/pam_limits.c: conditionalize the use of
RLIMIT_AS, which is not present on the Hurd.
Patch from Igor Khavkine <i_khavki@alcor.concordia.ca>.
* modules/pam_rhosts/pam_rhosts_auth.c: use getline() instead of
a static buffer when available; fixes the build on systems
without MAXHOSTNAMELEN (i.e., the Hurd).
* modules/pam_xauth/pam_xauth.c: make sure PATH_MAX is defined
before using it.
Steve Langasek [Sat, 25 Aug 2007 12:11:30 +0000 (12:11 +0000)]
Relevant BUGIDs:
Purpose of commit: bugfix
Commit summary:
---------------
2007-08-25 Steve Langasek <vorlon@debian.org>
* doc/man/pam.conf-syntax.xml, doc/man/pam.conf.5:
Document "new" control options conv_again and incomplete, supported
in pam.d's extended syntax.
Patch from Ben Collins <bcollins@debian.org>.
* configure.in: Add --with-db-uniquename option to support
db libraries and functions with unique name extension.
Patch from Diego 'Flameeyes' Pettenò <flameeyes@gmail.com>.
* modules/pam_limits/pam_limits.c: Include locale.h.
* configure.in: Check for audit_log_acct_message instead of
audit_log_user_message.
* libpam/pam_audit.c: Use audit_log_acct_message.
Based on patch from Mark J Cox <mjc@redhat.com>.
* libpam/Makefile.am: Bump version number of libpam.
* modules/pam_umask/pam_umask.c (set_umask): mode_t is 32bit,
not 64bit.
* xtests/tst-pam_limits1.c: Fix printf arguments.
* po/*.po: Merge po files with latest code changes.
Thorsten Kukuk [Tue, 26 Jun 2007 10:44:28 +0000 (10:44 +0000)]
Relevant BUGIDs:
Purpose of commit: bugfix
Commit summary:
---------------
2007-06-26 Thorsten Kukuk <kukuk@thkukuk.de>
* modules/pam_limits/pam_limits.c (process_limit): Check upper and
lower limit of nice value, fix off-by-one in conversation to rlim_t.
* xtests/Makefile.am: Add new pam_limits test case.
* xtests/limits.conf: New, config file for test case.
* xtests/pam_limits1.c: New, test case for RLIMIT_NICE.
* xtests/pam_limits1.sh: Likewise.
* xtests/pam_limits1.pamd: Likewise.
Thorsten Kukuk [Fri, 22 Jun 2007 09:49:03 +0000 (09:49 +0000)]
Relevant BUGIDs: 411390
Purpose of commit: new feature
Commit summary:
---------------
2007-06-22 Thorsten Kukuk <kukuk@thkukuk.de>
* modules/pam_access/pam_access.c: Add new syntax for groups
in access.conf to differentiate group names from account names.
Based on patch from Julien Lecomte <julien@famille-lecomte.net>,
solves feature request [#411390].
* modules/pam_access/access.conf: Add example for new group
syntax.
* modules/pam_access/access.conf.5.xml: Document new syntax.
* modules/pam_cracklib/pam_cracklib.8.xml: Document new minclass
option.
* modules/pam_cracklib/pam_cracklib.c: Add support for minimum
character classes [#1688777]. Based on patch from Keith Schincke.
* xtests/tst-pam_cracklib2.c: New, test case for minclass option.
* xtests/tst-pam_cracklib2.pamd: New, PAM config file for test case.
* xtests/Makefile.am: Add new testcase.
* xtests/pam_cracklib.c: Fix comment what this application tests.
* configure.in: Use /lib64 on x86-64, ppc64, s390x, sparc64
Tomas Mraz [Fri, 15 Jun 2007 10:17:22 +0000 (10:17 +0000)]
Relevant BUGIDs:
Purpose of commit: new feature
Commit summary:
---------------
2007-06-15 Tomas Mraz <t8m@centrum.cz>
* modules/pam_selinux/pam_selinux.8.xml: Remove multiple option,
add select_context and use_current_range options.
* modules/pam_selinux/pam_selinux.c (send_audit_message): Added
function for auditing role/level changes.
(query_response): Add default response.
(select_context): Removed.
(manual_context): Query only role and level.
(mls_range_allowed): Added function for range check.
(config_context): Added function for role and level override.
(pam_sm_open_session): Remove multiple option, add select_context
and use_current_range_options. Use getseuserbyname to obtain
SELinux user and level. Audit role/level changes. Call setkeycreatecon
to assign key creation context. Don't fail on errors when SELinux
is not in enforcing mode.
Tomas Mraz [Fri, 15 Jun 2007 09:38:11 +0000 (09:38 +0000)]
Relevant BUGIDs:
Purpose of commit: bugfix, new feature
Commit summary:
---------------
2007-06-15 Tomas Mraz <t8m@centrum.cz>
* modules/pam_namespace/README.xml: Avoid duplication of
documentation.
* modules/pam_namespace/namespace.conf: More real life example
from MLS support.
* modules/pam_namespace/namespace.conf.5.xml: Likewise plus
properly describe how instance directory names are formed.
* modules/pam_namespace/namespace.init: Preserve euid when
called from setuid apps (su, newrole).
* modules/pam_namespace/pam_namespace.8.xml: Added option
no_unmount_on_close.
* modules/pam_namespace/pam_namespace.c (process_line): Polyinst
methods are now user, level and context. Fix crash on unknown
override user in config file.
(ns_override): Add explicit uid parameter.
(form_context): Skip for user method. Implement level based
polyinstantiation.
(poly_name): Initialize contexts. Add level based polyinst,
remove 'both' metod. Use raw contexts for instance names,
truncate long instance names and add hash.
(ns_setup): Hashing moved to poly_name().
(setup_namespace): Handle correctly override users for
su (when unmnt_remnt is used).
(pam_sm_close_session): Added no_unmount_on_close option.
* modules/pam_namespace/pam_namespace.h: Added
no_unmount_on_close_option, level method, limit on instance
directory name length.
Thorsten Kukuk [Fri, 4 May 2007 11:36:08 +0000 (11:36 +0000)]
Relevant BUGIDs:
Purpose of commit: bugfix
Commit summary:
---------------
2007-05-04 Thorsten Kukuk <kukuk@suse.de>
* xtests/run-xtests.sh: Use SRCDIR to find PAM config files.
* xtests/Makefile.am:Call run-xtests.sh with srcdir as first
argument.
Based on patch by Bernard Leak <thisisnotapipe@hotmail.com>.
* modules/pam_limits/limits.conf: Address space limit is KB.
* modules/pam_limits/limits.conf.5.xml: Likewise.
Reported by Thomas Vander Stichele <thomas@apestaart.org>.
Tomas Mraz [Thu, 29 Mar 2007 20:33:07 +0000 (20:33 +0000)]
Relevant BUGIDs:
Purpose of commit: new feature
Commit summary:
---------------
* modules/pam_limits/Makefile.am: Define limits.d dir and install it.
* modules/pam_limits/pam_limits.8.xml: Describe limits.d parsing.
* modules/pam_limits/pam_limits.c (pam_limit_s): Make conf_file ptr.
(pam_parse): conf_file is now ptr.
(pam_sm_open_session): Add parsing files from limits.d subdir using
glob, change pl to pointer.
Tomas Mraz [Thu, 1 Feb 2007 21:54:58 +0000 (21:54 +0000)]
Relevant BUGIDs:
Purpose of commit: bugfix
Commit summary:
---------------
2007-02-01 Tomas Mraz <t8m@centrum.cz>
* xtests/tst-pam_unix3.c: Fix typos in comments.
* modules/pam_unix/support.c (_unix_verify_password): Explicitly
disallow '!' in the beginning of password hash. Treat only
13 bytes password hash specifically. (Suggested by Solar Designer.)
Fix a warning and test for allocation failure.
* modules/pam_unix/unix_chkpwd.c (_unix_verify_password): Likewise.
Thorsten Kukuk [Wed, 20 Dec 2006 14:56:08 +0000 (14:56 +0000)]
Relevant BUGIDs:
Purpose of commit: bugfix
Commit summary:
---------------
Don't be more restrictive than useradd for account names:
2006-12-20 Thorsten Kukuk <kukuk@thkukuk.de>
* modules/pam_unix/pam_unix_passwd.c (pam_sm_chauthtok): Forbid
only '+' and '-' as first characters for account names.
* modules/pam_unix/pam_unix_auth.c (pam_sm_authenticate): Likewise.
Tomas Mraz [Mon, 18 Dec 2006 21:07:42 +0000 (21:07 +0000)]
Relevant BUGIDs:
Purpose of commit: bugfix
Commit summary:
---------------
2006-12-18 Tomas Mraz <t8m@centrum.cz>
* modules/pam_keyinit/pam_keyinit.c (kill_keyrings): Switch to new
egid first, euid next. Revert euid/egid to old euid/egid and not
ruid/rgid.
(pam_sm_open_session): Switch to new rgid first, ruid next.
* modules/pam_localuser/pam_localuser.c: Add support for session
and chauthtok [SF#1606180].
* modules/pam_localuser/pam_localuser.8.xml: Document last change.
* libpam/pam_audit.c (_pam_audit_writelog): Print error message
only once.
Thorsten Kukuk [Thu, 7 Dec 2006 12:34:00 +0000 (12:34 +0000)]
Relevant BUGIDs:
Purpose of commit: new feature
Commit summary:
---------------
2006-12-06 Thorsten Kukuk <kukuk@thkukuk.de>
* modules/pam_faildelay/pam_faildelay.c: If no argument is
given, try to read FAIL_DELAY from /etc/login.defs.
* modules/pam_faildelay/pam_faildelay.8.xml: Document usage
of /etc/login.defs.
* modules/pam_mkhomedir/pam_mkhomedir.c (rec_mkdir): Fix
handling of left-most path component [SF#1591598].
(create_homedir): Mark user visible messages for translation.
* po/de.po: Adjust german translation for pam_mkhomedir.
Thorsten Kukuk [Tue, 24 Oct 2006 13:07:51 +0000 (13:07 +0000)]
Relevant BUGIDs:
Purpose of commit: bugfix
Commit summary:
---------------
2006-10-24 Thorsten Kukuk <kukuk@thkukuk.de>
* modules/pam_unix/support.c (_unix_verify_password): Try system
crypt() if we don't know the hash alogorithm.
* modules/pam_unix/unix_chkpwd.c (_unix_verify_password): Likewise.
Thorsten Kukuk [Wed, 30 Aug 2006 08:45:30 +0000 (08:45 +0000)]
Relevant BUGIDs:
Purpose of commit: cleanup/bugfix
Commit summary:
---------------
2006-08-30 Thorsten Kukuk <kukuk@thkukuk.de>
* xtests/Makefile.am: Move shell code to execute tests from here ...
* xtests/run-xtests.sh: ... to here.
* xtests/*.c: Include config.h.
* tests/*.c: Likewise.
projects / linux-pam / log