[linux-pam] pam_mkhomedir: Drop superfluous stat() call.
by Tomáš Mráz
commit 8cfc3e7a9aa7f40aeafe58aa88bc1bfca5282afe
Author: Tomas Mraz <tmraz(a)fedoraproject.org>
Date: Tue Aug 26 14:08:28 2014 +0200
pam_mkhomedir: Drop superfluous stat() call.
modules/pam_mkhomedir/mkhomedir_helper.c (create_homedir): Drop superfluous
stat() call.
modules/pam_mkhomedir/mkhomedir_helper.c | 16 +---------------
1 files changed, 1 insertions(+), 15 deletions(-)
---
diff --git a/modules/pam_mkhomedir/mkhomedir_helper.c b/modules/pam_mkhomedir/mkhomedir_helper.c
index f426d72..9fafe6a 100644
--- a/modules/pam_mkhomedir/mkhomedir_helper.c
+++ b/modules/pam_mkhomedir/mkhomedir_helper.c
@@ -231,7 +231,7 @@ create_homedir(const struct passwd *pwd,
if ((srcfd = open(newsource, O_RDONLY)) < 0 || fstat(srcfd, &st) != 0)
{
pam_syslog(NULL, LOG_DEBUG,
- "unable to open src file %s: %m", newsource);
+ "unable to open or stat src file %s: %m", newsource);
closedir(d);
#ifndef PATH_MAX
@@ -241,20 +241,6 @@ create_homedir(const struct passwd *pwd,
return PAM_PERM_DENIED;
}
- if (stat(newsource, &st) != 0)
- {
- pam_syslog(NULL, LOG_DEBUG, "unable to stat src file %s: %m",
- newsource);
- close(srcfd);
- closedir(d);
-
-#ifndef PATH_MAX
- free(newsource); newsource = NULL;
- free(newdest); newdest = NULL;
-#endif
-
- return PAM_PERM_DENIED;
- }
/* Open the dest file */
if ((destfd = open(newdest, O_WRONLY | O_TRUNC | O_CREAT, 0600)) < 0)
9 years, 8 months
[linux-pam] pam_exec: Do not depend on open() returning STDOUT_FILENO.
by Tomáš Mráz
commit b03f33830c94ea39ce04a865e62a9d346dcf1a2e
Author: Tomas Mraz <tmraz(a)fedoraproject.org>
Date: Tue Aug 26 14:04:02 2014 +0200
pam_exec: Do not depend on open() returning STDOUT_FILENO.
modules/pam_exec/pam_exec.c (call_exec): Move the descriptor to
STDOUT_FILENO if needed.
modules/pam_exec/pam_exec.c | 12 +++++++++++-
1 files changed, 11 insertions(+), 1 deletions(-)
---
diff --git a/modules/pam_exec/pam_exec.c b/modules/pam_exec/pam_exec.c
index 12c4444..5ab9630 100644
--- a/modules/pam_exec/pam_exec.c
+++ b/modules/pam_exec/pam_exec.c
@@ -360,9 +360,19 @@ call_exec (const char *pam_type, pam_handle_t *pamh,
logfile);
_exit (err);
}
+ if (i != STDOUT_FILENO)
+ {
+ if (dup2 (i, STDOUT_FILENO) == -1)
+ {
+ int err = errno;
+ pam_syslog (pamh, LOG_ERR, "dup2 failed: %m");
+ _exit (err);
+ }
+ close (i);
+ }
if (asprintf (&buffer, "*** %s", ctime (&tm)) > 0)
{
- pam_modutil_write (i, buffer, strlen (buffer));
+ pam_modutil_write (STDOUT_FILENO, buffer, strlen (buffer));
free (buffer);
}
}
9 years, 8 months
[linux-pam] pam_keyinit: Check return value of setregid.
by Tomáš Mráz
commit 29b63ae08f071aee5b1b901e6fb8f8131b82032d
Author: Robin Hack <rhack(a)redhat.com>
Date: Mon Aug 25 17:33:21 2014 +0200
pam_keyinit: Check return value of setregid.
modules/pam_keyinit/pam_keyinit.c (pam_sm_open_session): Log if setregid() fails.
modules/pam_keyinit/pam_keyinit.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
---
diff --git a/modules/pam_keyinit/pam_keyinit.c b/modules/pam_keyinit/pam_keyinit.c
index 8d0501e..f82eead 100644
--- a/modules/pam_keyinit/pam_keyinit.c
+++ b/modules/pam_keyinit/pam_keyinit.c
@@ -218,7 +218,8 @@ int pam_sm_open_session(pam_handle_t *pamh, int flags UNUSED,
if (uid != old_uid && setreuid(uid, -1) < 0) {
error(pamh, "Unable to change UID to %d temporarily\n", uid);
- setregid(old_gid, -1);
+ if (setregid(old_gid, -1) < 0)
+ error(pamh, "Unable to change GID back to %d\n", old_gid);
return PAM_SESSION_ERR;
}
9 years, 8 months
[linux-pam] pam_filter: Avoid leaking descriptors when fork() fails.
by Tomáš Mráz
commit bbe948ae58314ce3395d39e0fe49cdba309c29df
Author: Robin Hack <rhack(a)redhat.com>
Date: Mon Aug 25 17:30:01 2014 +0200
pam_filter: Avoid leaking descriptors when fork() fails.
modules/pam_filter/pam_filter.c (set_filter): Close descriptors when fork() fails.
modules/pam_filter/pam_filter.c | 5 +++++
1 files changed, 5 insertions(+), 0 deletions(-)
---
diff --git a/modules/pam_filter/pam_filter.c b/modules/pam_filter/pam_filter.c
index da98148..9935d99 100644
--- a/modules/pam_filter/pam_filter.c
+++ b/modules/pam_filter/pam_filter.c
@@ -341,6 +341,11 @@ set_filter (pam_handle_t *pamh, int flags UNUSED, int ctrl,
pam_syslog(pamh, LOG_WARNING, "first fork failed: %m");
if (aterminal) {
(void) tcsetattr(STDIN_FILENO, TCSAFLUSH, &stored_mode);
+ close(fd[0]);
+ } else {
+ /* Socket pair */
+ close(fd[0]);
+ close(fd[1]);
}
return PAM_AUTH_ERR;
9 years, 8 months
[linux-pam] pam_echo: Avoid leaking file descriptor.
by Tomáš Mráz
commit 8514bfe08da3912fce8b6c17c39ef20af136a087
Author: Robin Hack <rhack(a)redhat.com>
Date: Thu Aug 14 13:33:56 2014 +0200
pam_echo: Avoid leaking file descriptor.
modules/pam_echo/pam_echo.c (pam_echo): Close fd in error cases.
modules/pam_echo/pam_echo.c | 11 +++++++++--
1 files changed, 9 insertions(+), 2 deletions(-)
---
diff --git a/modules/pam_echo/pam_echo.c b/modules/pam_echo/pam_echo.c
index 043ff70..d0879fb 100644
--- a/modules/pam_echo/pam_echo.c
+++ b/modules/pam_echo/pam_echo.c
@@ -180,16 +180,23 @@ pam_echo (pam_handle_t *pamh, int flags, int argc, const char **argv)
/* load file into message buffer. */
if ((fstat (fd, &st) < 0) || !st.st_size)
- return PAM_IGNORE;
+ {
+ close (fd);
+ return PAM_IGNORE;
+ }
mtmp = malloc (st.st_size + 1);
if (!mtmp)
- return PAM_BUF_ERR;
+ {
+ close (fd);
+ return PAM_BUF_ERR;
+ }
if (pam_modutil_read (fd, mtmp, st.st_size) == -1)
{
pam_syslog (pamh, LOG_ERR, "Error while reading %s: %m", file);
free (mtmp);
+ close (fd);
return PAM_IGNORE;
}
9 years, 8 months
[linux-pam] pam_tty_audit: Silence Coverity reporting uninitialized use.
by Tomáš Mráz
commit 05a1ccc0df92d0ca031699124ddf7ec3ce12f78f
Author: Robin Hack <rhack(a)redhat.com>
Date: Wed Aug 13 15:12:13 2014 +0200
pam_tty_audit: Silence Coverity reporting uninitialized use.
modules/pam_tty_audit/pam_tty_audit.c (nl_recv): Initialize also
msg_flags.
modules/pam_tty_audit/pam_tty_audit.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
---
diff --git a/modules/pam_tty_audit/pam_tty_audit.c b/modules/pam_tty_audit/pam_tty_audit.c
index b6f53be..6003f4e 100644
--- a/modules/pam_tty_audit/pam_tty_audit.c
+++ b/modules/pam_tty_audit/pam_tty_audit.c
@@ -120,6 +120,7 @@ nl_recv (int fd, unsigned type, void *buf, size_t size)
msg.msg_iovlen = 1;
msg.msg_control = NULL;
msg.msg_controllen = 0;
+ msg.msg_flags = 0;
if (type != NLMSG_ERROR)
{
res = recvmsg (fd, &msg, MSG_PEEK);
9 years, 8 months
[linux-pam] pam_tally2: Avoid uninitialized use of fileinfo.
by Tomáš Mráz
commit debe27335e10d06aa16a5ac2148fe8a74675ca2c
Author: Tomas Mraz <tmraz(a)fedoraproject.org>
Date: Wed Aug 13 15:01:32 2014 +0200
pam_tally2: Avoid uninitialized use of fileinfo.
Problem found by Robin Hack <rhack(a)redhat.com>.
modules/pam_tally2/pam_tally2.c (get_tally): Do not depend on file size
just try to read it.
modules/pam_tally2/pam_tally2.c | 5 +----
1 files changed, 1 insertions(+), 4 deletions(-)
---
diff --git a/modules/pam_tally2/pam_tally2.c b/modules/pam_tally2/pam_tally2.c
index 09e8585..f5eebb1 100644
--- a/modules/pam_tally2/pam_tally2.c
+++ b/modules/pam_tally2/pam_tally2.c
@@ -451,11 +451,8 @@ skip_open:
alarm(oldalarm);
}
- if (fileinfo.st_size < (off_t)(uid+1)*(off_t)sizeof(*tally)) {
+ if (pam_modutil_read(*tfile, void_tally, sizeof(*tally)) != sizeof(*tally)) {
memset(tally, 0, sizeof(*tally));
- } else if (pam_modutil_read(*tfile, void_tally, sizeof(*tally)) != sizeof(*tally)) {
- memset(tally, 0, sizeof(*tally));
- /* Shouldn't happen */
}
tally->fail_line[sizeof(tally->fail_line)-1] = '\0';
9 years, 8 months
[linux-pam] pam_access: Avoid uninitialized access of line.
by Tomáš Mráz
commit 8f7f6da06091153702f38e283d8f34778ccf9eb2
Author: Tomas Mraz <tmraz(a)fedoraproject.org>
Date: Wed Aug 13 14:45:05 2014 +0200
pam_access: Avoid uninitialized access of line.
* modules/pam_access/pam_access.c (login_access): Reorder condition
so line is not accessed when uninitialized.
modules/pam_access/pam_access.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
---
diff --git a/modules/pam_access/pam_access.c b/modules/pam_access/pam_access.c
index 87626e7..b32a966 100644
--- a/modules/pam_access/pam_access.c
+++ b/modules/pam_access/pam_access.c
@@ -412,8 +412,8 @@ login_access (pam_handle_t *pamh, struct login_info *item)
return NO;
}
#ifdef HAVE_LIBAUDIT
- if (!item->noaudit && line[0] == '-' && (match == YES || (match == ALL &&
- nonall_match == YES))) {
+ if (!item->noaudit && (match == YES || (match == ALL &&
+ nonall_match == YES)) && line[0] == '-') {
pam_modutil_audit_write(pamh, AUDIT_ANOM_LOGIN_LOCATION,
"pam_access", 0);
}
9 years, 8 months
[linux-pam] pam_lastlog: Properly clean up last_login structure before use.
by Tomáš Mráz
commit 8731716646adc8065b45dc59b5e9ca1893d5a495
Author: Tomas Mraz <tmraz(a)fedoraproject.org>
Date: Tue Aug 5 16:26:01 2014 +0200
pam_lastlog: Properly clean up last_login structure before use.
modules/pam_lastlog/pam_lastlog.c (last_login_write): Properly clean up last_login
structure before use.
modules/pam_lastlog/pam_lastlog.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
---
diff --git a/modules/pam_lastlog/pam_lastlog.c b/modules/pam_lastlog/pam_lastlog.c
index ad8c660..50d33e4 100644
--- a/modules/pam_lastlog/pam_lastlog.c
+++ b/modules/pam_lastlog/pam_lastlog.c
@@ -350,6 +350,8 @@ last_login_write(pam_handle_t *pamh, int announce, int last_fd,
return PAM_SERVICE_ERR;
}
+ memset(&last_login, 0, sizeof(last_login));
+
/* set this login date */
D(("set the most recent login time"));
(void) time(&ll_time); /* set the time */
@@ -364,14 +366,12 @@ last_login_write(pam_handle_t *pamh, int announce, int last_fd,
}
/* copy to last_login */
- last_login.ll_host[0] = '\0';
strncat(last_login.ll_host, remote_host, sizeof(last_login.ll_host)-1);
/* set the terminal line */
terminal_line = get_tty(pamh);
/* copy to last_login */
- last_login.ll_line[0] = '\0';
strncat(last_login.ll_line, terminal_line, sizeof(last_login.ll_line)-1);
terminal_line = NULL;
9 years, 8 months