diff options
| author | Iker Pedrosa <ipedrosa@redhat.com> | 2024-05-22 11:16:28 +0200 |
|---|---|---|
| committer | Dmitry V. Levin <ldv@strace.io> | 2024-05-23 10:24:02 +0000 |
| commit | 5eccaf9b3488d3f6da800281363697e4e4834e77 (patch) | |
| tree | d007809e5d950871a366b2eff098d4b6b4e18743 /modules | |
| parent | 75292685a625153c6e28bdd820e97421c258c04a (diff) | |
| download | pam-5eccaf9b3488d3f6da800281363697e4e4834e77.tar.gz pam-5eccaf9b3488d3f6da800281363697e4e4834e77.tar.bz2 pam-5eccaf9b3488d3f6da800281363697e4e4834e77.zip | |
pam_faillock: close the audit socket after use
* modules/pam_faillock/pam_faillock.c (check_tally): Close the audit
socket when it will no longer be used.
```
Error: RESOURCE_LEAK (CWE-772):
Linux-PAM-1.6.0/modules/pam_faillock/pam_faillock.c:247: open_fn: Returning handle opened by "audit_open".
Linux-PAM-1.6.0/modules/pam_faillock/pam_faillock.c:247: var_assign: Assigning: "audit_fd" = handle returned from "audit_open()".
Linux-PAM-1.6.0/modules/pam_faillock/pam_faillock.c:256: noescape: Resource "audit_fd" is not freed or pointed-to in "audit_log_user_message".
Linux-PAM-1.6.0/modules/pam_faillock/pam_faillock.c:258: leaked_handle: Handle variable "audit_fd" going out of scope leaks the handle.
256| audit_log_user_message(audit_fd, AUDIT_RESP_ACCT_UNLOCK_TIMED, buf,
257| rhost, NULL, tty, 1);
258|-> }
259| #endif
260| opts->flags |= FAILLOCK_FLAG_UNLOCKED;
```
Resolves: https://issues.redhat.com/browse/RHEL-36475
Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
Diffstat (limited to 'modules')
| -rw-r--r-- | modules/pam_faillock/pam_faillock.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/modules/pam_faillock/pam_faillock.c b/modules/pam_faillock/pam_faillock.c index e636a24e..f39a9d95 100644 --- a/modules/pam_faillock/pam_faillock.c +++ b/modules/pam_faillock/pam_faillock.c @@ -255,6 +255,7 @@ check_tally(pam_handle_t *pamh, struct options *opts, struct tally_data *tallies snprintf(buf, sizeof(buf), "op=pam_faillock suid=%u ", opts->uid); audit_log_user_message(audit_fd, AUDIT_RESP_ACCT_UNLOCK_TIMED, buf, rhost, NULL, tty, 1); + audit_close(audit_fd); } #endif opts->flags |= FAILLOCK_FLAG_UNLOCKED; |