Pam-developers February 2013

pam-developers@lists.fedorahosted.org

5 participants
12 discussions

[linux-pam] #4: [PATCH] po/ja.po: Fix some wrong translations and so on
by fedora-badges 26 May '15

26 May '15

#4: [PATCH] po/ja.po: Fix some wrong translations and so on --------------------+------------------------------------------------------- Reporter: fumiyas | Owner: pam-developers(a)lists.fedorahosted.org Type: defect | Status: new Priority: major | Component: library Version: 1.1.x | Keywords: l10n --------------------+------------------------------------------------------- I've updated po/ja.po to fix some wrong translations and so on. Please see and commit the attached patch to master repository if you feel good. Should I contact the original translator (Kiyoto Hashida <khashida(a)redhat.com>) to check and confirm this patch? -- Ticket URL: <https://fedorahosted.org/linux-pam/ticket/4> linux-pam <http://fedorahosted.org/linux-pam> The Linux-PAM (Pluggable Authentication Modules) project

1 9

[linux-pam] #9: Allow pam_lastlog to write to utmp as an option
by fedora-badges 24 Mar '15

24 Mar '15

#9: Allow pam_lastlog to write to utmp as an option -------------------------+------------------------------------------------- Reporter: | Owner: pam-developers@… shadowkyogre | Status: new Type: | Component: modules enhancement | Keywords: pam_lastlog utmp update patch Priority: major | prototype Version: 1.1.x | Blocking: Blocked By: | -------------------------+------------------------------------------------- The following patch for pam_lastlog allows it to write to utmp as well as wtmp. Part of the code is from xorg-sessreg to help make a utmp entry. I only tested this on my desktop, which is running Arch Linux, so some modifications may need to be made in order to make it more portable. -- Ticket URL: <https://fedorahosted.org/linux-pam/ticket/9> linux-pam <http://fedorahosted.org/linux-pam> The Linux-PAM (Pluggable Authentication Modules) project

1 4

[linux-pam] #11: sign the released tarballs
by fedora-badges 24 Mar '15

24 Mar '15

#11: sign the released tarballs ---------------------+------------------------------ Reporter: vbatts | Owner: pam-developers@… Type: defect | Status: new Priority: major | Component: library Version: | Keywords: Blocked By: | Blocking: ---------------------+------------------------------ Previously the tarballs that landed on kernel.org were signed by the trusted key 0x517D0F0E, but now the tarballs on https://fedorahosted.org/releases/l/i/linux-pam/ have no signature at all. We not be using Linux-PAM source that does not have a trusted signature. -- Ticket URL: <https://fedorahosted.org/linux-pam/ticket/11> linux-pam <http://fedorahosted.org/linux-pam> The Linux-PAM (Pluggable Authentication Modules) project

3 4

[linux-pam] #5: multiple pam_namespace unmount problems
by fedora-badges 23 Jan '14

23 Jan '14

#5: multiple pam_namespace unmount problems -----------------------------+------------------------------ Reporter: andersblomdell | Owner: pam-developers@… Type: defect | Status: new Priority: major | Component: library Version: 1.1.x | Keywords: Blocked By: | Blocking: -----------------------------+------------------------------ This is essentially a short version of the bug in: http://bugzilla.redhat.com/show_bug.cgi?id=755216 Essentially pam_namespace (1.1.5) suffers the following problems: 1. The (bind) mounts done in the new namespace is visible in the original namespace (Error "too many levels of symbolic links"). 2. At pam_namespace exit, the original mounting is restored for any remaining child processes (daemons), which is a security problem. Patch is attached -- Ticket URL: <https://fedorahosted.org/linux-pam/ticket/5> linux-pam <http://fedorahosted.org/linux-pam> The Linux-PAM (Pluggable Authentication Modules) project

1 2

[linux-pam] #8: [PATCH] pam_exec: Support showing stdout via pam_info, and only running for a specified module type
by fedora-badges 04 Sep '13

04 Sep '13

#8: [PATCH] pam_exec: Support showing stdout via pam_info, and only running for a specified module type ---------------------------+------------------------------ Reporter: joshtriplett | Owner: pam-developers@… Type: enhancement | Status: new Priority: major | Component: modules Version: | Keywords: patch Blocked By: | Blocking: ---------------------------+------------------------------ The attached patches implement two new options for the pam_exec module. Patch 1 adds a "stdout" option, which shows the stdout (and stderr) of the executed command via pam_info. For instance, adding the following line to /etc/pam.d/login right before the line for pam_motd: {{{ session optional pam_exec.so stdout /usr/bin/seq 5 }}} will print five lines (numbered 1-5) at the start and end of the session. In order to implement this option without breaking the existing support for the expose_authtok option, I had to reorganize the file descriptor handling to move the loop that closes all unwanted file descriptors below all the code that sets up stdin/stdout/stderr, and add some new code before that setup to ensure that none of the pipes ended up on stdin/stdout/stderr where they might get closed by dup2. Patch 2 adds a "type" option, which causes pam_exec to only execute the command when the PAM module type matches the given type. In particular, this makes it possible to run only at the start or end of a session, without having to write a separate wrapper script to check the PAM_TYPE environment variable. For example, adding the following to /etc/pam.d/login right before the line for pam_motd: {{{ session optional pam_exec.so type=open_session /bin/sleep 5 }}} will sleep for 5 seconds at login time, but not at logout time, demonstrating that the option works. Together, these options make it possible to show dynamically generated output at the start of a PAM session. For example, the following pam_exec invocation produces the same output as the current dynamically generated first line of the Debian motd: {{{ session optional pam_exec.so type=open_session stdout /bin/uname -snrvm }}} (As an aside, I attempted to submit these patches to pam- developers(a)lists.fedorahosted.org, but I couldn't seem to subscribe to that list (no response to my subscription confirmation), and thus my mail got moderated. Does pam-developers moderate subscriptions?) -- Ticket URL: <https://fedorahosted.org/linux-pam/ticket/8> linux-pam <http://fedorahosted.org/linux-pam> The Linux-PAM (Pluggable Authentication Modules) project

1 3

[linux-pam] #7: [PATCH] Allow changing of passwords in containers lacking CAP_AUDIT_WRITE
by fedora-badges 29 Aug '13

29 Aug '13

#7: [PATCH] Allow changing of passwords in containers lacking CAP_AUDIT_WRITE ----------------------+------------------------------ Reporter: lennart | Owner: pam-developers@… Type: defect | Status: new Priority: major | Component: modules Version: | Keywords: Blocked By: | Blocking: ----------------------+------------------------------ Currently, changing passwords fails in containers lacking CAP_AUDIT_WRITE (i.e. most containers). The patch that is attached fixes this. See patch comment for a longer explanation of what it does and why. -- Ticket URL: <https://fedorahosted.org/linux-pam/ticket/7> linux-pam <http://fedorahosted.org/linux-pam> The Linux-PAM (Pluggable Authentication Modules) project

3 8

[linux-pam] #13: pam_env: Unterminated expandable variable raises a critical error
by fedora-badges 18 Jun '13

18 Jun '13

#13: pam_env: Unterminated expandable variable raises a critical error ------------------------+------------------------------ Reporter: moritasho | Owner: pam-developers@… Type: defect | Status: new Priority: major | Component: modules Version: | Keywords: Blocked By: | Blocking: ------------------------+------------------------------ This is originated from Bug#699805 in Debian BTS http://bugs.debian.org /cgi-bin/bugreport.cgi?bug=699805, and I'm forwarded here. Hi, When pam_env founds an unterminated expandable variable while parsing a conffile, it makes a critical error. It results any login to be rejected. To reproduce the problem, put the following line into /etc/security/pam_env.conf {{{ FOO DEFAULT="${VAR" }}} Any login will fail and the following error message will be logged to syslog: {{{ pam_env(login:session): Unterminated expandable variable: <${VAR> Critical error - immediate abort }}} The error message is came from modules/pam_env/pam_env.c: {{{ static int _expand_arg(pam_handle_t *pamh, char **value) { [...] D(("Unterminated expandable variable: <%s>", orig-2)); pam_syslog(pamh, LOG_ERR, "Unterminated expandable variable: <%s>", orig-2); return PAM_ABORT; }}} When this function found an unterminated expandable variable, it returns PAM_ABORT, and it will raises a critical error. I think unterminated expandable variable is a small error, not so critical. I suggest to change the function to return BAD_LINE instead of PAM_ABORT. Regards, -- Ticket URL: <https://fedorahosted.org/linux-pam/ticket/13> linux-pam <http://fedorahosted.org/linux-pam> The Linux-PAM (Pluggable Authentication Modules) project

1 1

pam_unix and login.defs
by Thorsten Kukuk 18 Apr '13

18 Apr '13

Hi, I find it very disturbing, that you need to manual maintain the used encryption hash in /etc/login.defs for shadow and as pam_unix.so argument. Since we have already two modules reading /etc/login.defs, I made a small change to pam_unix.so: The default encryption hash is taken from /etc/login.defs and can be overwritten with the pam_unix.so argument. If there is no entry in /etc/login.defs and no argument DES is still the default. So this change should be pretty backward compatible. Any opinions? Most of the code is from the other PAM modules, maybe we should add the /etc/login.defs parsing functions to libpam itself sometimes. 2013-02-05 Thorsten Kukuk <kukuk(a)thkukuk.de> Use hash from /etc/login.defs as default if no other one is specified as argument. * modules/pam_unix/support.c: Add search_key, call from __set_ctrl * modules/pam_unix/support.h: Add define for /etc/login.defs * modules/pam_unix/pam_unix.8.xml: Document new behavior. --- modules/pam_unix/support.c +++ modules/pam_unix/support.c @@ -37,6 +37,76 @@ #define SELINUX_ENABLED 0 #endif +static char * +search_key (const char *filename) +{ + FILE *fp; + char *buf = NULL; + size_t buflen = 0; + char *retval = NULL; + + fp = fopen (filename, "r"); + if (NULL == fp) + return NULL; + + while (!feof (fp)) + { + char *tmp, *cp; +#if defined(HAVE_GETLINE) + ssize_t n = getline (&buf, &buflen, fp); +#elif defined (HAVE_GETDELIM) + ssize_t n = getdelim (&buf, &buflen, '\n', fp); +#else + ssize_t n; + + if (buf == NULL) + { + buflen = BUF_SIZE; + buf = malloc (buflen); + } + buf[0] = '\0'; + if (fgets (buf, buflen - 1, fp) == NULL) + break; + else if (buf != NULL) + n = strlen (buf); + else + n = 0; +#endif /* HAVE_GETLINE / HAVE_GETDELIM */ + cp = buf; + + if (n < 1) + break; + + tmp = strchr (cp, '#'); /* remove comments */ + if (tmp) + *tmp = '\0'; + while (isspace ((int)*cp)) /* remove spaces and tabs */ + ++cp; + if (*cp == '\0') /* ignore empty lines */ + continue; + + if (cp[strlen (cp) - 1] == '\n') + cp[strlen (cp) - 1] = '\0'; + + tmp = strsep (&cp, " \t="); + if (cp != NULL) + while (isspace ((int)*cp) || *cp == '=') + ++cp; + + if (strcasecmp (tmp, "ENCRYPT_METHOD") == 0) + { + retval = strdup (cp); + break; + } + } + fclose (fp); + + free (buf); + + return retval; +} + + /* this is a front-end for module-application conversations */ int _make_remark(pam_handle_t * pamh, unsigned int ctrl, @@ -58,6 +128,8 @@ int _set_ctrl(pam_handle_t *pamh, int flags, int *remember, int *rounds, int *pass_min_len, int argc, const char **argv) { unsigned int ctrl; + char *val; + int j; D(("called.")); @@ -81,10 +153,27 @@ int _set_ctrl(pam_handle_t *pamh, int flags, int *remember, int *rounds, D(("SILENT")); set(UNIX__QUIET, ctrl); } + + /* preset encryption method with value from /etc/login.defs */ + val = search_key (LOGIN_DEFS); + if (val) { + for (j = 0; j < UNIX_CTRLS_; ++j) { + if (unix_args[j].token + && !strncasecmp(val, unix_args[j].token, strlen(unix_args[j].token))) { + break; + } + } + if (j >= UNIX_CTRLS_) { + pam_syslog(pamh, LOG_WARNING, "unrecognized ENCRYPTION_METHOD value [%s]", val); + } else { + ctrl &= unix_args[j].mask; /* for turning things off */ + ctrl |= unix_args[j].flag; /* for turning things on */ + } + } + /* now parse the arguments to this module */ for (; argc-- > 0; ++argv) { - int j; D(("pam_unix arg: %s", *argv)); --- modules/pam_unix/support.h +++ modules/pam_unix/support.h @@ -8,6 +8,12 @@ #include <pwd.h> /* + * File to read value of ENCRYPT_METHOD from. + */ +#define LOGIN_DEFS "/etc/login.defs" + + +/* * here is the string to inform the user that the new passwords they * typed were not the same. */ --- modules/pam_unix/pam_unix.8.xml +++ modules/pam_unix/pam_unix.8.xml @@ -81,7 +81,9 @@ <para> The password component of this module performs the task of updating - the user's password. + the user's password. The default encryption hash is taken from the + <emphasis remap='B'>ENCYPTION_METHOD</emphasis> variable from + <emphasis>/etc/login.defs</emphasis> </para> <para> @@ -393,6 +395,9 @@ session required pam_unix.so <title>SEE ALSO</title> <para> <citerefentry> + <refentrytitle>login.defs</refentrytitle><manvolnum>5</manvolnum> + </citerefentry>, + <citerefentry> <refentrytitle>pam.conf</refentrytitle><manvolnum>5</manvolnum> </citerefentry>, <citerefentry> -- Thorsten Kukuk, Project Manager/Release Manager SLES SUSE LINUX Products GmbH, Maxfeldstr. 5, D-90409 Nuernberg GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg)

3 11

Use different way to check for passwd accessibility by root in pam_rootok
by Tomas Mraz 21 Mar '13

21 Mar '13

The attached patch uses different way to check for passwd accessibility by root in pam_rootok module. This method allows for proper auditing the denial of access, so the user can find the user AVC message in the audit.log. OK to commit? -- Tomas Mraz No matter how far down the wrong road you've gone, turn back. Turkish proverb

2 7

Check for crypt() returning NULL
by Tomas Mraz 08 Feb '13

08 Feb '13

The attached trivial patch adds missing check for crypt() returning NULL in pam_pwhistory and pam_unix. OK to commit? -- Tomas Mraz No matter how far down the wrong road you've gone, turn back. Turkish proverb

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

Pam-developers February 2013