modules: make use of secure memory erasure

Use empty initialization of structs to minimize the memset() usage, to
reduce the amount of calls which are not sensitive.

Non trivial changes:

- pam_env:
  * erase environment variables where possible

- pam_exec:
  * erase responce on error
  * erase auth token

- pam_pwhistory:
  * erase buffers containing old passwords

- pam_selinux: skip overwriting data structure consisting of only
  pointers to insensitive data, which also gets free'd afterwards (so
  it currently does not protect against double-free or use-after-free on
  the member pointers)

- pam_unix: erase cipher data in more places

- pam_userdb: erase password hashes

1 files changed, 1 insertions, 2 deletions

diff --git a/modules/pam_mkhomedir/mkhomedir_helper.c b/modules/pam_mkhomedir/mkhomedir_helper.c
index 582fecce..3213f028 100644
--- a/modules/pam_mkhomedir/mkhomedir_helper.c
+++ b/modules/pam_mkhomedir/mkhomedir_helper.c
@@ -184,8 +184,7 @@ create_homedir(const struct passwd *pwd,
 	   else
 		   pointed[pointedlen] = 0;
 #else
-         char pointed[PATH_MAX];
-         memset(pointed, 0, sizeof(pointed));
+         char pointed[PATH_MAX] = {};
 
          pointedlen = readlink(newsource, pointed, sizeof(pointed) - 1);
 #endif