[linux-pam] configure: fix typo in --disable-nis help string
by Dmitry V. Levin
commit 3ab70f792a93c84c620c4e26bccd244bb1722234
Author: Matveychikov Ilya <i.matveychikov(a)securitycode.ru>
Date: Fri Jan 20 11:05:23 2012 +0000
configure: fix typo in --disable-nis help string
* configure.in: Change '-disable-nis' to '--disable-nis'.
configure.in | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
---
diff --git a/configure.in b/configure.in
index 727d49a..15ff6dc 100644
--- a/configure.in
+++ b/configure.in
@@ -443,7 +443,7 @@ AC_SUBST(LIBDB)
AM_CONDITIONAL([HAVE_LIBDB], [test ! -z "$LIBDB"])
AC_ARG_ENABLE([nis],
- AS_HELP_STRING([-disable-nis], [Disable building NIS/YP support in pam_unix and pam_access]))
+ AS_HELP_STRING([--disable-nis], [Disable building NIS/YP support in pam_unix and pam_access]))
AS_IF([test "x$enable_nis" != "xno"], [
CFLAGS=$old_CFLAGS
12 years, 2 months
[linux-pam] Do not unmount anything by default in pam_namespace close session call.
by Tomáš Mráz
commit 17a3f6715591b215a7fdd3127db4abe70ff26381
Author: Tomas Mraz <tmraz(a)fedoraproject.org>
Date: Thu Jan 26 14:50:51 2012 +0100
Do not unmount anything by default in pam_namespace close session call.
* modules/pam_namespace/pam_namespace.c (pam_sm_close_session): Recognize
the unmount_on_close option and make the default to be to not unmount.
* modules/pam_namespace/pam_namespace.h: Rename PAMNS_NO_UNMOUNT_ON_CLOSE to
PAMNS_UNMOUNT_ON_CLOSE.
* modules/pam_namespace/pam_namespace.8.xml: Document the change.
modules/pam_namespace/pam_namespace.8.xml | 17 +++++++++--------
modules/pam_namespace/pam_namespace.c | 24 +++++++++++++-----------
modules/pam_namespace/pam_namespace.h | 2 +-
3 files changed, 23 insertions(+), 20 deletions(-)
---
diff --git a/modules/pam_namespace/pam_namespace.8.xml b/modules/pam_namespace/pam_namespace.8.xml
index 6ec3ad2..f0f80d3 100644
--- a/modules/pam_namespace/pam_namespace.8.xml
+++ b/modules/pam_namespace/pam_namespace.8.xml
@@ -44,7 +44,7 @@
ignore_instance_parent_mode
</arg>
<arg choice="opt">
- no_unmount_on_close
+ unmount_on_close
</arg>
<arg choice="opt">
use_current_context
@@ -195,16 +195,17 @@
<varlistentry>
<term>
- <option>no_unmount_on_close</option>
+ <option>unmount_on_close</option>
</term>
<listitem>
<para>
- For certain trusted programs such as newrole, open session
- is called from a child process while the parent performs
- close session and pam end functions. For these commands
- use this option to instruct pam_close_session to not
- unmount the bind mounted polyinstantiated directory in the
- parent.
+ Explicitly unmount the polyinstantiated directories instead
+ of relying on automatic namespace destruction after the last
+ process in a namespace exits. This option should be used
+ only in case it is ensured by other means that there cannot be
+ any processes running in the private namespace left after the
+ session close. It is also useful only in case there are
+ multiple pam session calls in sequence from the same process.
</para>
</listitem>
</varlistentry>
diff --git a/modules/pam_namespace/pam_namespace.c b/modules/pam_namespace/pam_namespace.c
index 470f493..a40f05e 100644
--- a/modules/pam_namespace/pam_namespace.c
+++ b/modules/pam_namespace/pam_namespace.c
@@ -2108,24 +2108,26 @@ PAM_EXTERN int pam_sm_close_session(pam_handle_t *pamh, int flags UNUSED,
idata.flags |= PAMNS_DEBUG;
if (strcmp(argv[i], "ignore_config_error") == 0)
idata.flags |= PAMNS_IGN_CONFIG_ERR;
- if (strcmp(argv[i], "no_unmount_on_close") == 0)
- idata.flags |= PAMNS_NO_UNMOUNT_ON_CLOSE;
+ if (strcmp(argv[i], "unmount_on_close") == 0)
+ idata.flags |= PAMNS_UNMOUNT_ON_CLOSE;
}
if (idata.flags & PAMNS_DEBUG)
pam_syslog(idata.pamh, LOG_DEBUG, "close_session - start");
/*
- * For certain trusted programs such as newrole, open session
- * is called from a child process while the parent perfoms
- * close session and pam end functions. For these commands
- * pam_close_session should not perform the unmount of the
- * polyinstantiatied directory because it will result in
- * undoing of parents polyinstantiatiaion. These commands
- * will invoke pam_namespace with the "no_unmount_on_close"
- * argument.
+ * Normally the unmount is implicitly done when the last
+ * process in the private namespace exits.
+ * If it is ensured that there are no child processes left in
+ * the private namespace by other means and if there are
+ * multiple sessions opened and closed sequentially by the
+ * same process, the "unmount_on_close" option might be
+ * used to unmount the polydirs explicitly.
*/
- if (idata.flags & PAMNS_NO_UNMOUNT_ON_CLOSE) {
+ if (!(idata.flags & PAMNS_UNMOUNT_ON_CLOSE)) {
+ pam_set_data(idata.pamh, NAMESPACE_POLYDIR_DATA, NULL, NULL);
+ pam_set_data(idata.pamh, NAMESPACE_PROTECT_DATA, NULL, NULL);
+
if (idata.flags & PAMNS_DEBUG)
pam_syslog(idata.pamh, LOG_DEBUG, "close_session - sucessful");
return PAM_SUCCESS;
diff --git a/modules/pam_namespace/pam_namespace.h b/modules/pam_namespace/pam_namespace.h
index 6bca31c..1d0c11c 100644
--- a/modules/pam_namespace/pam_namespace.h
+++ b/modules/pam_namespace/pam_namespace.h
@@ -101,7 +101,7 @@
#define PAMNS_GEN_HASH 0x00002000 /* Generate md5 hash for inst names */
#define PAMNS_IGN_CONFIG_ERR 0x00004000 /* Ignore format error in conf file */
#define PAMNS_IGN_INST_PARENT_MODE 0x00008000 /* Ignore instance parent mode */
-#define PAMNS_NO_UNMOUNT_ON_CLOSE 0x00010000 /* no unmount at session close */
+#define PAMNS_UNMOUNT_ON_CLOSE 0x00010000 /* Unmount at session close */
#define PAMNS_USE_CURRENT_CONTEXT 0x00020000 /* use getcon instead of getexeccon */
#define PAMNS_USE_DEFAULT_CONTEXT 0x00040000 /* use get_default_context instead of getexeccon */
#define PAMNS_MOUNT_PRIVATE 0x00080000 /* Make the polydir mounts private */
12 years, 2 months
[linux-pam] Make / mount as rslave instead of bind mounting polydirs.
by Tomáš Mráz
commit d5a261b8be2035bbf49726eb7ac792ee6d5a22d1
Author: Tomas Mraz <tmraz(a)fedoraproject.org>
Date: Tue Jan 24 20:03:28 2012 +0100
Make / mount as rslave instead of bind mounting polydirs.
* modules/pam_namespace/pam_namespace.c (protect_dir): Drop the always argument.
(check_inst_parent): Drop the always argument from protect_dir().
(create_polydir): Likewise.
(ns_setup): Likewise and do not mark the polydir with MS_PRIVATE.
(setup_namespace): Mark the / with MS_SLAVE|MS_REC.
* modules/pam_namespace/pam_namespace.8.xml: Reflect the change in docs.
modules/pam_namespace/pam_namespace.8.xml | 10 ++++++-
modules/pam_namespace/pam_namespace.c | 40 +++++++++++++---------------
2 files changed, 27 insertions(+), 23 deletions(-)
---
diff --git a/modules/pam_namespace/pam_namespace.8.xml b/modules/pam_namespace/pam_namespace.8.xml
index 48021c8..6ec3ad2 100644
--- a/modules/pam_namespace/pam_namespace.8.xml
+++ b/modules/pam_namespace/pam_namespace.8.xml
@@ -246,12 +246,18 @@
This option can be used on systems where the / mount point or
its submounts are made shared (for example with a
<command>mount --make-rshared /</command> command).
- The module will make the polyinstantiated directory mount points
- private. Normally the pam_namespace will try to detect the
+ The module will mark the whole directory tree so any mount and
+ unmount operations in the polyinstantiation namespace are private.
+ Normally the pam_namespace will try to detect the
shared / mount point and make the polyinstantiated directories
private automatically. This option has to be used just when
only a subtree is shared and / is not.
</para>
+ <para>
+ Note that mounts and unmounts done in the private namespace will not
+ affect the parent namespace if this option is used or when the
+ shared / mount point is autodetected.
+ </para>
</listitem>
</varlistentry>
diff --git a/modules/pam_namespace/pam_namespace.c b/modules/pam_namespace/pam_namespace.c
index f0bffa1..470f493 100644
--- a/modules/pam_namespace/pam_namespace.c
+++ b/modules/pam_namespace/pam_namespace.c
@@ -1003,7 +1003,7 @@ static int protect_mount(int dfd, const char *path, struct instance_data *idata)
return 0;
}
-static int protect_dir(const char *path, mode_t mode, int do_mkdir, int always,
+static int protect_dir(const char *path, mode_t mode, int do_mkdir,
struct instance_data *idata)
{
char *p = strdup(path);
@@ -1082,7 +1082,7 @@ static int protect_dir(const char *path, mode_t mode, int do_mkdir, int always,
}
}
- if ((flags & O_NOFOLLOW) || always) {
+ if (flags & O_NOFOLLOW) {
/* we are inside user-owned dir - protect */
if (protect_mount(rv, p, idata) == -1) {
save_errno = errno;
@@ -1124,7 +1124,7 @@ static int check_inst_parent(char *ipath, struct instance_data *idata)
if (trailing_slash)
*trailing_slash = '\0';
- dfd = protect_dir(inst_parent, 0, 1, 0, idata);
+ dfd = protect_dir(inst_parent, 0, 1, idata);
if (dfd == -1 || fstat(dfd, &instpbuf) < 0) {
pam_syslog(idata->pamh, LOG_ERR,
@@ -1259,7 +1259,7 @@ static int create_polydir(struct polydir_s *polyptr,
}
#endif
- rc = protect_dir(dir, mode, 1, idata->flags & PAMNS_MOUNT_PRIVATE, idata);
+ rc = protect_dir(dir, mode, 1, idata);
if (rc == -1) {
pam_syslog(idata->pamh, LOG_ERR,
"Error creating directory %s: %m", dir);
@@ -1447,7 +1447,7 @@ static int ns_setup(struct polydir_s *polyptr,
pam_syslog(idata->pamh, LOG_DEBUG,
"Set namespace for directory %s", polyptr->dir);
- retval = protect_dir(polyptr->dir, 0, 0, idata->flags & PAMNS_MOUNT_PRIVATE, idata);
+ retval = protect_dir(polyptr->dir, 0, 0, idata);
if (retval < 0 && errno != ENOENT) {
pam_syslog(idata->pamh, LOG_ERR, "Polydir %s access error: %m",
@@ -1534,22 +1534,6 @@ static int ns_setup(struct polydir_s *polyptr,
goto error_out;
}
- if (idata->flags & PAMNS_MOUNT_PRIVATE) {
- /*
- * Make the polyinstantiated dir private mount. This depends
- * on making the dir a mount point in the protect_dir call.
- */
- if (mount(polyptr->dir, polyptr->dir, NULL, MS_PRIVATE|MS_REC, NULL) < 0) {
- pam_syslog(idata->pamh, LOG_ERR, "Error making %s a private mount, %m",
- polyptr->dir);
- goto error_out;
- }
- if (idata->flags & PAMNS_DEBUG)
- pam_syslog(idata->pamh, LOG_DEBUG,
- "Polyinstantiated directory %s made as private mount", polyptr->dir);
-
- }
-
/*
* Bind mount instance directory on top of the polyinstantiated
* directory to provide an instance of polyinstantiated directory
@@ -1720,6 +1704,20 @@ static int setup_namespace(struct instance_data *idata, enum unmnt_op unmnt)
"Unable to unshare from parent namespace, %m");
return PAM_SESSION_ERR;
}
+ if (idata->flags & PAMNS_MOUNT_PRIVATE) {
+ /*
+ * Remount / as SLAVE so that nothing mounted in the namespace
+ * shows up in the parent
+ */
+ if (mount("/", "/", NULL, MS_SLAVE | MS_REC , NULL) < 0) {
+ pam_syslog(idata->pamh, LOG_ERR,
+ "Failed to mark / as a slave mount point, %m");
+ return PAM_SESSION_ERR;
+ }
+ if (idata->flags & PAMNS_DEBUG)
+ pam_syslog(idata->pamh, LOG_DEBUG,
+ "The / mount point was marked as slave");
+ }
} else {
del_polydir_list(idata->polydirs_ptr);
return PAM_SUCCESS;
12 years, 2 months
[linux-pam] Add possibility to match ruser, rhost, and tty in pam_succeed_if.
by Tomáš Mráz
commit 91e4c3633f34a6590743ee105746308664078073
Author: Tomas Mraz <tmraz(a)fedoraproject.org>
Date: Fri Jan 13 18:33:27 2012 +0100
Add possibility to match ruser, rhost, and tty in pam_succeed_if.
* modules/pam_succeed_if/pam_succeed_if.c (evaluate): Match ruser,
rhost, and tty as left operand.
* modules/pam_succeed_if/pam_succeed_if.8.xml: Document the new
possible left operands.
modules/pam_succeed_if/pam_succeed_if.8.xml | 9 ++++---
modules/pam_succeed_if/pam_succeed_if.c | 28 ++++++++++++++++++++++++++-
2 files changed, 32 insertions(+), 5 deletions(-)
---
diff --git a/modules/pam_succeed_if/pam_succeed_if.8.xml b/modules/pam_succeed_if/pam_succeed_if.8.xml
index cc61e08..7bdcb02 100644
--- a/modules/pam_succeed_if/pam_succeed_if.8.xml
+++ b/modules/pam_succeed_if/pam_succeed_if.8.xml
@@ -33,8 +33,8 @@
<para>
pam_succeed_if.so is designed to succeed or fail authentication
based on characteristics of the account belonging to the user being
- authenticated. One use is to select whether to load other modules based
- on this test.
+ authenticated or values of other PAM items. One use is to select whether
+ to load other modules based on this test.
</para>
<para>
@@ -105,8 +105,9 @@
<para>
Available fields are <emphasis>user</emphasis>,
<emphasis>uid</emphasis>, <emphasis>gid</emphasis>,
- <emphasis>shell</emphasis>, <emphasis>home</emphasis>
- and <emphasis>service</emphasis>:
+ <emphasis>shell</emphasis>, <emphasis>home</emphasis>,
+ <emphasis>ruser</emphasis>, <emphasis>rhost</emphasis>,
+ <emphasis>tty</emphasis> and <emphasis>service</emphasis>:
</para>
<variablelist>
diff --git a/modules/pam_succeed_if/pam_succeed_if.c b/modules/pam_succeed_if/pam_succeed_if.c
index 2670c25..32a7373 100644
--- a/modules/pam_succeed_if/pam_succeed_if.c
+++ b/modules/pam_succeed_if/pam_succeed_if.c
@@ -281,11 +281,37 @@ evaluate(pam_handle_t *pamh, int debug,
}
if (strcasecmp(left, "service") == 0) {
const void *svc;
- if (pam_get_item(pamh, PAM_SERVICE, &svc) != PAM_SUCCESS)
+ if (pam_get_item(pamh, PAM_SERVICE, &svc) != PAM_SUCCESS ||
+ svc == NULL)
svc = "";
snprintf(buf, sizeof(buf), "%s", (const char *)svc);
left = buf;
}
+ if (strcasecmp(left, "ruser") == 0) {
+ const void *ruser;
+ if (pam_get_item(pamh, PAM_RUSER, &ruser) != PAM_SUCCESS ||
+ ruser == NULL)
+ ruser = "";
+ snprintf(buf, sizeof(buf), "%s", (const char *)ruser);
+ left = buf;
+ user = buf;
+ }
+ if (strcasecmp(left, "rhost") == 0) {
+ const void *rhost;
+ if (pam_get_item(pamh, PAM_SERVICE, &rhost) != PAM_SUCCESS ||
+ rhost == NULL)
+ rhost = "";
+ snprintf(buf, sizeof(buf), "%s", (const char *)rhost);
+ left = buf;
+ }
+ if (strcasecmp(left, "tty") == 0) {
+ const void *tty;
+ if (pam_get_item(pamh, PAM_SERVICE, &tty) != PAM_SUCCESS ||
+ tty == NULL)
+ tty = "";
+ snprintf(buf, sizeof(buf), "%s", (const char *)tty);
+ left = buf;
+ }
/* If we have no idea what's going on, return an error. */
if (left != buf) {
pam_syslog(pamh, LOG_CRIT, "unknown attribute \"%s\"", left);
12 years, 3 months
[linux-pam: 1/2] Fix matching of usernames in the pam_unix remember feature.
by Tomáš Mráz
commit 0baf28fa03dfa46482e13390fd9a7545c30ccd7f
Author: Tomas Mraz <tmraz(a)fedoraproject.org>
Date: Tue Jan 3 12:30:43 2012 +0100
Fix matching of usernames in the pam_unix remember feature.
* modules/pam_unix/pam_unix_passwd.c (check_old_password): Make
sure we match only the whole username in opasswd entry.
* modules/pam_unix/passverify.c (save_old_password): Likewise make
sure we match only the whole username in opasswd entry.
modules/pam_unix/pam_unix_passwd.c | 4 +++-
modules/pam_unix/passverify.c | 3 ++-
2 files changed, 5 insertions(+), 2 deletions(-)
---
diff --git a/modules/pam_unix/pam_unix_passwd.c b/modules/pam_unix/pam_unix_passwd.c
index 6ba2c2e..498a81c 100644
--- a/modules/pam_unix/pam_unix_passwd.c
+++ b/modules/pam_unix/pam_unix_passwd.c
@@ -280,13 +280,15 @@ static int check_old_password(const char *forwho, const char *newpass)
char *s_luser, *s_uid, *s_npas, *s_pas;
int retval = PAM_SUCCESS;
FILE *opwfile;
+ size_t len = strlen(forwho);
opwfile = fopen(OLD_PASSWORDS_FILE, "r");
if (opwfile == NULL)
return PAM_ABORT;
while (fgets(buf, 16380, opwfile)) {
- if (!strncmp(buf, forwho, strlen(forwho))) {
+ if (!strncmp(buf, forwho, len) && (buf[len] == ':' ||
+ buf[len] == ',')) {
char *sptr;
buf[strlen(buf) - 1] = '\0';
s_luser = strtok_r(buf, ":,", &sptr);
diff --git a/modules/pam_unix/passverify.c b/modules/pam_unix/passverify.c
index 089f4b8..5289955 100644
--- a/modules/pam_unix/passverify.c
+++ b/modules/pam_unix/passverify.c
@@ -562,6 +562,7 @@ save_old_password(pam_handle_t *pamh, const char *forwho, const char *oldpass,
int found = 0;
struct passwd *pwd = NULL;
struct stat st;
+ size_t len = strlen(forwho);
#ifdef WITH_SELINUX
security_context_t prev_context=NULL;
#endif
@@ -629,7 +630,7 @@ save_old_password(pam_handle_t *pamh, const char *forwho, const char *oldpass,
}
while (fgets(buf, 16380, opwfile)) {
- if (!strncmp(buf, forwho, strlen(forwho))) {
+ if (!strncmp(buf, forwho, len) && strchr(":,\n", buf[len]) != NULL) {
char *sptr = NULL;
found = 1;
if (howmany == 0)
12 years, 3 months
