diff options
| -rw-r--r-- | configure.ac | 5 | ||||
| -rw-r--r-- | modules/pam_timestamp/hmac_openssl_wrapper.c | 13 |
2 files changed, 18 insertions, 0 deletions
diff --git a/configure.ac b/configure.ac index cbffa113..70faf33f 100644 --- a/configure.ac +++ b/configure.ac @@ -640,6 +640,11 @@ AC_CHECK_FUNCS(explicit_bzero memset_explicit) AC_CHECK_FUNCS([ruserok_af ruserok], [break]) AC_CHECK_FUNCS(close_range) +dnl For module/pam_timestamp +AC_CHECK_HEADERS([sys/random.h]) +dnl May require libbsd/libSystem on non-Linux platforms +AC_CHECK_FUNCS(getrandom) + AC_ARG_ENABLE([regenerate-docu], AS_HELP_STRING([--disable-regenerate-docu],[Don't re-build documentation from XML sources]), [enable_docu=$enableval], [enable_docu=yes]) diff --git a/modules/pam_timestamp/hmac_openssl_wrapper.c b/modules/pam_timestamp/hmac_openssl_wrapper.c index a633a2bf..bf0f6e9c 100644 --- a/modules/pam_timestamp/hmac_openssl_wrapper.c +++ b/modules/pam_timestamp/hmac_openssl_wrapper.c @@ -56,6 +56,10 @@ #include "hmac_openssl_wrapper.h" #include "pam_inline.h" +#ifdef HAVE_SYS_RANDOM_H +#include <sys/random.h> +#endif + #define LOGIN_DEFS "/etc/login.defs" #define CRYPTO_KEY "HMAC_CRYPTO_ALGO" #define DEFAULT_ALGORITHM "SHA512" @@ -94,6 +98,15 @@ generate_key(pam_handle_t *pamh, char **key, size_t key_size) return PAM_AUTH_ERR; } +#ifdef HAVE_GETRANDOM + /* Fallback to getrandom(2) if available */ + if (getrandom(tmp, key_size, 0) == (ssize_t)key_size) { + *key = tmp; + return PAM_SUCCESS; + } +#endif + + /* Fallback to /dev/urandom */ fd = open("/dev/urandom", O_RDONLY); if (fd == -1) { pam_syslog(pamh, LOG_ERR, "Cannot open /dev/urandom: %m"); |