Thorsten Kukuk [Thu, 16 Aug 2012 13:46:56 +0000 (15:46 +0200)]
Small documentation and define fixes
modules/pam_limits/limits.conf.5.xml: Document race of maxlogins [#10]
modules/pam_namespace/pam_namespace.h: Define MS_SLAVE if necessary
modules/pam_pwhistory/pam_pwhistory.c: Document how the module works
modules/pam_unix/pam_unix.8.xml: Document remember option obsoleted by pam_pwhistory [#6]
Tomas Mraz [Mon, 13 Aug 2012 18:06:44 +0000 (20:06 +0200)]
Respect PAM_AUTHTOK_TYPE in pam_get_authtok_verify().
libpam/pam_get_authtok.c (pam_get_authtok_internal): Set the PAM_AUTHTOK_TYPE
item when obtained from module options.
(pam_get_authtok_verify): Use the PAM_AUTHTOK_TYPE item when prompting.
Tomas Mraz [Fri, 22 Jun 2012 11:36:45 +0000 (13:36 +0200)]
pam_cracklib: Add monotonic character sequence checking.
modules/pam_cracklib/pam_cracklib.c (_pam_parse): Parse the maxsequence option.
(sequence): New function to check for too long monotonic sequence of characters.
(password_check): Call the sequence().
modules/pam_cracklib/pam_cracklib.8.xml: Document the maxsequence check.
Tomas Mraz [Mon, 28 May 2012 18:24:17 +0000 (20:24 +0200)]
pam_pwhistory: Always record the old password even when root changes it.
modules/pam_pwhistory/pam_pwhistory.c (pam_sm_chauthtok): Use the UID of
the process instead of the target user UID (same as in pam_cracklib) to
check for root. Always record old password.
Tomas Mraz [Thu, 24 May 2012 11:40:24 +0000 (13:40 +0200)]
pam_cracklib: Add enforce_for_root option.
modules/pam_cracklib/pam_cracklib.c (_pam_parse): Recognize the enforce_for_root option.
(pam_sm_chauthtok): Enforce errors for root with the option.
modules/pam_cracklib/pam_cracklib.8.xml: Document the enforce_for_root option.
Tomas Mraz [Mon, 30 Apr 2012 13:03:32 +0000 (15:03 +0200)]
pam_cracklib: Add maxclassrepeat, gecoscheck checks and remove unused difignore.
modules/pam_cracklib/pam_cracklib.c (_pam_parse): Recognize the maxclassrepeat, gecoscheck options. Ignore difignore option.
(simple): Add the check for the same class repetition.
(usercheck): Refactor into wordcheck().
(gecoscheck): New test for words from the GECOS field.
(password_check): Call the gecoscheck().
(pam_sm_chauthtok): Drop the diff_ignore from options struct.
modules/pam_cracklib/pam_cracklib.8.xml: Document the maxclassrepeat and gecoscheck checks, update the documentation of the difok test.
Tomas Mraz [Tue, 17 Apr 2012 12:05:24 +0000 (14:05 +0200)]
pam_lastlog: add possibility to lock out inactive users in auth or account
* modules/pam_lastlog/pam_lastlog.8.xml: Document the new functionality and
option.
* modules/pam_lastlog/pam_lastlog.c: Add the inactive user lock out.
(_pam_session_parse): Renamed from _pam_parse.
(_pam_auth_parse): New function to parse auth arguments.
(_last_login_open): Factor out opening of the lastlog file.
(_last_login_read): Factor out opening of the lastlog file.
(pam_sm_authenticate): Implement the lockout functionality.
(pam_sm_setcred): Just return PAM_SUCCESS.
(pam_sm_acct_mgmt): Call pam_sm_authenticate().
Dmitry V. Levin [Fri, 3 Feb 2012 00:13:44 +0000 (00:13 +0000)]
pam_unix: make configuration consistent in --enable-static-modules mode
In --enable-static-modules mode, it was not possible to use "pam_unix"
in PAM config files. Instead, different names had to be used for each
management group: pam_unix_auth, pam_unix_acct, pam_unix_passwd and
pam_unix_session. This change makes pam_unix configuration consistent
with other PAM modules.
* README: Remove the paragraph describing pam_unix distinctions in
--enable-static-modules mode.
* libpam/pam_static_modules.h (_pam_unix_acct_modstruct,
_pam_unix_auth_modstruct, _pam_unix_passwd_modstruct,
_pam_unix_session_modstruct): Remove.
(_pam_unix_modstruct): New pam_module declaration.
* modules/pam_unix/pam_unix_static.h: New file.
* modules/pam_unix/pam_unix_static.c: Likewise.
* modules/pam_unix/Makefile.am (noinst_HEADERS): Add pam_unix_static.h
(pam_unix_la_SOURCES) [STATIC_MODULES]: Add pam_unix_static.c
* modules/pam_unix/pam_unix_acct.c [PAM_STATIC]: Include
pam_unix_static.h
[PAM_STATIC] (_pam_unix_acct_modstruct): Remove.
* modules/pam_unix/pam_unix_auth.c [PAM_STATIC]: Include
pam_unix_static.h
[PAM_STATIC] (_pam_unix_auth_modstruct): Remove.
* modules/pam_unix/pam_unix_passwd.c [PAM_STATIC]: Include
pam_unix_static.h
[PAM_STATIC] (_pam_unix_passwd_modstruct): Remove.
* modules/pam_unix/pam_unix_sess.c [PAM_STATIC]: Include
pam_unix_static.h
[PAM_STATIC] (_pam_unix_session_modstruct): Remove.
Dmitry V. Levin [Thu, 26 Jan 2012 22:22:59 +0000 (22:22 +0000)]
Make --disable-cracklib compatible with --enable-static-modules mode
* configure.in: Define HAVE_LIBCRACK when cracklib is enabled.
* libpam/pam_static_modules.h (static_modules): Guard the use of
_pam_cracklib_modstruct by HAVE_LIBCRACK macro.
Dmitry V. Levin [Thu, 26 Jan 2012 22:24:21 +0000 (22:24 +0000)]
Fix SUBDIRS for --enable-static-modules mode
There is no way to build "modules" subdirectory before "libpam" anyway.
In STATIC_MODULES mode, "libpam" subdirectory must be built twice to
produce a usable libpam.a without undefined references to multiple
_pam_*_modstruct symbols.
* Makefile.am: Use default SUBDIRS in STATIC_MODULES mode.
Tomas Mraz [Thu, 26 Jan 2012 13:50:51 +0000 (14:50 +0100)]
Do not unmount anything by default in pam_namespace close session call.
* modules/pam_namespace/pam_namespace.c (pam_sm_close_session): Recognize
the unmount_on_close option and make the default to be to not unmount.
* modules/pam_namespace/pam_namespace.h: Rename PAMNS_NO_UNMOUNT_ON_CLOSE to
PAMNS_UNMOUNT_ON_CLOSE.
* modules/pam_namespace/pam_namespace.8.xml: Document the change.
Tomas Mraz [Tue, 24 Jan 2012 19:03:28 +0000 (20:03 +0100)]
Make / mount as rslave instead of bind mounting polydirs.
* modules/pam_namespace/pam_namespace.c (protect_dir): Drop the always argument.
(check_inst_parent): Drop the always argument from protect_dir().
(create_polydir): Likewise.
(ns_setup): Likewise and do not mark the polydir with MS_PRIVATE.
(setup_namespace): Mark the / with MS_SLAVE|MS_REC.
* modules/pam_namespace/pam_namespace.8.xml: Reflect the change in docs.
Tomas Mraz [Fri, 13 Jan 2012 17:33:27 +0000 (18:33 +0100)]
Add possibility to match ruser, rhost, and tty in pam_succeed_if.
* modules/pam_succeed_if/pam_succeed_if.c (evaluate): Match ruser,
rhost, and tty as left operand.
* modules/pam_succeed_if/pam_succeed_if.8.xml: Document the new
possible left operands.
Tomas Mraz [Tue, 3 Jan 2012 11:30:43 +0000 (12:30 +0100)]
Fix matching of usernames in the pam_unix remember feature.
* modules/pam_unix/pam_unix_passwd.c (check_old_password): Make
sure we match only the whole username in opasswd entry.
* modules/pam_unix/passverify.c (save_old_password): Likewise make
sure we match only the whole username in opasswd entry.
Dmitry V. Levin [Fri, 28 Oct 2011 02:20:17 +0000 (02:20 +0000)]
Fix usage of LIBADD, LDADD and LDFLAGS
* modules/pam_selinux/Makefile.am: Rename pam_selinux_check_LDFLAGS to
pam_selinux_check_LDADD.
* modules/pam_userdb/Makefile.am: Split out pam_userdb_la_LIBADD from
AM_LDFLAGS.
* modules/pam_warn/Makefile.am: Split out pam_warn_la_LIBADD from
AM_LDFLAGS.
* modules/pam_wheel/Makefile.am: Split out pam_wheel_la_LIBADD from
AM_LDFLAGS.
* modules/pam_xauth/Makefile.am: split out pam_xauth_la_LIBADD from
AM_LDFLAGS.
* xtests/Makefile.am: Rename AM_LDFLAGS to LDADD.
Dmitry V. Levin [Thu, 27 Oct 2011 14:55:55 +0000 (14:55 +0000)]
Generate ChangeLog from git log
* .gitignore: Add ChangeLog
* ChangeLog: Rename to ChangeLog-CVS.
* Makefile.am (gen-changelog): New rule.
(dist-hook, .PHONY): Depend on it.
(EXTRA_DIST): Add ChangeLog-CVS.
* README-hacking: New file.
* gitlog-to-changelog: Import from gnulib.
* autogen.sh: Create empty ChangeLog file to make automake strictness
check happy. Use automated "autoreconf -fiv" instead of manual
invocations of various autotools.
Dmitry V. Levin [Thu, 27 Oct 2011 14:55:55 +0000 (14:55 +0000)]
Fix "make distcheck"
There is no use to distribute m4 files manually, because automake does
the right thing, while manual distribution is not only redundant but
also very fragile.
* Makefile.am (M4_FILES): Remove.
(EXTRA_DIST): Remove M4_FILES.
Dmitry V. Levin [Wed, 26 Oct 2011 23:56:54 +0000 (23:56 +0000)]
Fix whitespace issues
Cleanup trailing whitespaces, indentation that uses spaces before tabs,
and blank lines at EOF. Make the project free of warnings reported by
git diff --check 4b825dc642cb6eb9a060e54bf8d69288fbee4904 HEAD
Thorsten Kukuk [Tue, 21 Jun 2011 12:02:33 +0000 (14:02 +0200)]
2011-06-22 Thorsten Kukuk <kukuk@thkukuk.de>
* release version 1.1.4
* configure.in: Bump version number.
* NEWS: Document changes since 1.1.3
* libpam/Makefile.am: Bump release number of shared library
* po/de.po: Translate new string.
Thorsten Kukuk [Tue, 21 Jun 2011 09:05:31 +0000 (11:05 +0200)]
2011-06-21 Thorsten Kukuk <kukuk@thkukuk.de>
* modules/pam_limits/pam_limits.c: Add set_all option,
read limits from PID one if no limit is specified and set_all
is set.
* modules/pam_limits/pam_limits.8.xml: Document set_all option.
Based on Patch by Kees Cook.
Tomas Mraz [Wed, 15 Jun 2011 18:48:59 +0000 (20:48 +0200)]
Cleanups of pam_pwhistory code. Make opasswd entry parsing more robust.
* modules/pam_pwhistory/opasswd.c (check_old_password): Do not
needlessly call strdupa().
(save_old_password): Avoid memleaks in error paths. Avoid memleak of
buf. Make the opasswd entry parsing more robust.
* modules/pam_pwhistory/pam_pwhistory.8.xml: Document the
special meaning of remember=0.
Thorsten Kukuk [Tue, 14 Jun 2011 13:28:05 +0000 (15:28 +0200)]
2011-06-14 Thorsten Kukuk <kukuk@thkukuk.de>
* configure.in: Check for libtirpc bye default.
* libpam/Makefile.am: Add support for libtirpc.
* modules/pam_access/Makefile.am: Likewise.
* modules/pam_unix/Makefile.am: Likewise.
* modules/pam_unix/pam_unix_passwd.c: Change ifdefs for
new libtirpc support.
* modules/pam_unix/yppasswd_xdr.c: Only compile if we have rpc/rpc.h.
Tomas Mraz [Fri, 18 Mar 2011 23:15:54 +0000 (23:15 +0000)]
Relevant BUGIDs:
Purpose of commit: bugfix
Commit summary:
---------------
2011-03-18 Tomas Mraz <tm@t8m.info>
* modules/pam_namespace/md5.c (MD5Final): Clear the whole ctx.
* modules/pam_namespace/pam_namespace.c (del_polydir): Guard for NULL poly.
(protect_dir): Guard for -1 passing to close().
(ns_setup): Likewise.
(pam_sm_open_session): Correctly test for SELinux enabled flag.
Tomas Mraz [Tue, 14 Dec 2010 08:40:40 +0000 (08:40 +0000)]
Relevant BUGIDs:
Purpose of commit: new feature
Commit summary:
---------------
2010-12-14 Tomas Mraz <tm@t8m.info>
* modules/pam_limits/pam_limits.c (parse_uid_range): New function
to parse the range of uids or gids.
(parse_config_file): Call parse_uid_range() and if uid/gid range
is identified, setup the limits if the range matches. New parameters
containing user's uid and primary gid.
(pam_sm_open_session): Pass the user's uid and primary gid to
parse_config_file().
* modules/pam_limits/limits.conf.5.xml: Document the uid/gid ranges.
Thorsten Kukuk [Wed, 24 Nov 2010 12:28:01 +0000 (12:28 +0000)]
Relevant BUGIDs:
Purpose of commit: new feature
Commit summary:
---------------
2010-11-24 Thorsten Kukuk <kukuk@thkukuk.de>
* modules/pam_securetty/pam_securetty.c: Parse console= kernel
option, add noconsole option.
* modules/pam_securetty/pam_securetty.8.xml: Document new behavior
for serial console.
Patch from Lennart Poettering.
Tomas Mraz [Fri, 22 Oct 2010 07:18:07 +0000 (07:18 +0000)]
Relevant BUGIDs:
Purpose of commit: bugfix
Commit summary:
---------------
2010-10-22 Tomas Mraz <tm@t8m.info>
* modules/pam_namespace/pam_namespace.c (inst_init): Use execle()
to execute the init script with clean environment. (CVE-2010-3853)
(cleanup_tmpdirs): Likewise for executing rm.
Dmitry V. Levin [Thu, 21 Oct 2010 15:00:12 +0000 (15:00 +0000)]
Relevant BUGIDs:
Purpose of commit: cleanup
Commit summary:
---------------
2010-10-21 Dmitry V. Levin <ldv@altlinux.org>
* modules/pam_mkhomedir/mkhomedir_helper.c (rec_mkdir): Remove.
(create_homedir): Use mkdir() instead of rec_mkdir().
(make_parent_dirs): New function.
(main): Use make_parent_dirs() to create parent directories only
for the home directory itself.
Thorsten Kukuk [Wed, 20 Oct 2010 11:58:17 +0000 (11:58 +0000)]
Relevant BUGIDs:
Purpose of commit: bugfix
Commit summary:
---------------
2010-10-20 Thorsten Kukuk <kukuk@thkukuk.de>
* modules/pam_mkhomedir/mkhomedir_helper.c (rec_mkdir): Create
parent directories always with mode 0755.
(create_homedir): Create main directory with mode 0700 at first.
projects / linux-pam / log