diff options
Diffstat (limited to 'modules/pam_keyinit')
| -rw-r--r-- | modules/pam_keyinit/Makefile.am | 4 | ||||
| -rw-r--r-- | modules/pam_keyinit/Makefile.in | 15 | ||||
| -rw-r--r-- | modules/pam_keyinit/README.xml | 32 | ||||
| -rw-r--r-- | modules/pam_keyinit/pam_keyinit.8 | 14 | ||||
| -rw-r--r-- | modules/pam_keyinit/pam_keyinit.8.xml | 47 | ||||
| -rw-r--r-- | modules/pam_keyinit/pam_keyinit.c | 60 |
6 files changed, 99 insertions, 73 deletions
diff --git a/modules/pam_keyinit/Makefile.am b/modules/pam_keyinit/Makefile.am index e1953312..e1806a41 100644 --- a/modules/pam_keyinit/Makefile.am +++ b/modules/pam_keyinit/Makefile.am @@ -15,7 +15,11 @@ dist_check_SCRIPTS = tst-pam_keyinit TESTS = $(dist_check_SCRIPTS) securelibdir = $(SECUREDIR) +if HAVE_VENDORDIR +secureconfdir = $(VENDOR_SCONFIGDIR) +else secureconfdir = $(SCONFIGDIR) +endif AM_CFLAGS = -I$(top_srcdir)/libpam/include -I$(top_srcdir)/libpamc/include \ $(WARN_CFLAGS) diff --git a/modules/pam_keyinit/Makefile.in b/modules/pam_keyinit/Makefile.in index 600c19cb..7da83525 100644 --- a/modules/pam_keyinit/Makefile.in +++ b/modules/pam_keyinit/Makefile.in @@ -428,6 +428,7 @@ CYGPATH_W = @CYGPATH_W@ DEFS = @DEFS@ DEPDIR = @DEPDIR@ DLLTOOL = @DLLTOOL@ +DOCBOOK_RNG = @DOCBOOK_RNG@ DSYMUTIL = @DSYMUTIL@ DUMPBIN = @DUMPBIN@ ECHO_C = @ECHO_C@ @@ -440,11 +441,13 @@ EXEEXT = @EXEEXT@ EXE_CFLAGS = @EXE_CFLAGS@ EXE_LDFLAGS = @EXE_LDFLAGS@ FGREP = @FGREP@ +FILECMD = @FILECMD@ FO2PDF = @FO2PDF@ GETTEXT_MACRO_VERSION = @GETTEXT_MACRO_VERSION@ GMSGFMT = @GMSGFMT@ GMSGFMT_015 = @GMSGFMT_015@ GREP = @GREP@ +HTML_STYLESHEET = @HTML_STYLESHEET@ INSTALL = @INSTALL@ INSTALL_DATA = @INSTALL_DATA@ INSTALL_PROGRAM = @INSTALL_PROGRAM@ @@ -476,12 +479,14 @@ LIBSELINUX = @LIBSELINUX@ LIBTOOL = @LIBTOOL@ LIPO = @LIPO@ LN_S = @LN_S@ +LOGIND_CFLAGS = @LOGIND_CFLAGS@ LTLIBICONV = @LTLIBICONV@ LTLIBINTL = @LTLIBINTL@ LTLIBOBJS = @LTLIBOBJS@ LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@ MAKEINFO = @MAKEINFO@ MANIFEST_TOOL = @MANIFEST_TOOL@ +MAN_STYLESHEET = @MAN_STYLESHEET@ MKDIR_P = @MKDIR_P@ MSGFMT = @MSGFMT@ MSGFMT_015 = @MSGFMT_015@ @@ -504,6 +509,7 @@ PACKAGE_TARNAME = @PACKAGE_TARNAME@ PACKAGE_URL = @PACKAGE_URL@ PACKAGE_VERSION = @PACKAGE_VERSION@ PATH_SEPARATOR = @PATH_SEPARATOR@ +PDF_STYLESHEET = @PDF_STYLESHEET@ PKG_CONFIG = @PKG_CONFIG@ PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@ PKG_CONFIG_PATH = @PKG_CONFIG_PATH@ @@ -514,12 +520,16 @@ SECUREDIR = @SECUREDIR@ SED = @SED@ SET_MAKE = @SET_MAKE@ SHELL = @SHELL@ -STRINGPARAM_HMAC = @STRINGPARAM_HMAC@ +STRINGPARAM_PROFILECONDITIONS = @STRINGPARAM_PROFILECONDITIONS@ STRINGPARAM_VENDORDIR = @STRINGPARAM_VENDORDIR@ STRIP = @STRIP@ +SYSTEMD_CFLAGS = @SYSTEMD_CFLAGS@ +SYSTEMD_LIBS = @SYSTEMD_LIBS@ TIRPC_CFLAGS = @TIRPC_CFLAGS@ TIRPC_LIBS = @TIRPC_LIBS@ +TXT_STYLESHEET = @TXT_STYLESHEET@ USE_NLS = @USE_NLS@ +VENDOR_SCONFIGDIR = @VENDOR_SCONFIGDIR@ VERSION = @VERSION@ WARN_CFLAGS = @WARN_CFLAGS@ XGETTEXT = @XGETTEXT@ @@ -593,7 +603,8 @@ XMLS = README.xml pam_keyinit.8.xml dist_check_SCRIPTS = tst-pam_keyinit TESTS = $(dist_check_SCRIPTS) securelibdir = $(SECUREDIR) -secureconfdir = $(SCONFIGDIR) +@HAVE_VENDORDIR_FALSE@secureconfdir = $(SCONFIGDIR) +@HAVE_VENDORDIR_TRUE@secureconfdir = $(VENDOR_SCONFIGDIR) AM_CFLAGS = -I$(top_srcdir)/libpam/include -I$(top_srcdir)/libpamc/include \ $(WARN_CFLAGS) diff --git a/modules/pam_keyinit/README.xml b/modules/pam_keyinit/README.xml index 47659e89..33059c7e 100644 --- a/modules/pam_keyinit/README.xml +++ b/modules/pam_keyinit/README.xml @@ -1,41 +1,27 @@ -<?xml version="1.0" encoding='UTF-8'?> -<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN" -"http://www.docbook.org/xml/4.3/docbookx.dtd" -[ -<!-- -<!ENTITY pamaccess SYSTEM "pam_keyinit.8.xml"> ---> -]> +<article xmlns="http://docbook.org/ns/docbook" version="5.0"> -<article> - - <articleinfo> + <info> <title> - <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" - href="pam_keyinit.8.xml" xpointer='xpointer(//refnamediv[@id = "pam_keyinit-name"]/*)'/> + <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="pam_keyinit.8.xml" xpointer='xpointer(id("pam_keyinit-name")/*)'/> </title> - </articleinfo> + </info> <section> - <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" - href="pam_keyinit.8.xml" xpointer='xpointer(//refsect1[@id = "pam_keyinit-description"]/*)'/> + <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="pam_keyinit.8.xml" xpointer='xpointer(id("pam_keyinit-description")/*)'/> </section> <section> - <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" - href="pam_keyinit.8.xml" xpointer='xpointer(//refsect1[@id = "pam_keyinit-options"]/*)'/> + <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="pam_keyinit.8.xml" xpointer='xpointer(id("pam_keyinit-options")/*)'/> </section> <section> - <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" - href="pam_keyinit.8.xml" xpointer='xpointer(//refsect1[@id = "pam_keyinit-examples"]/*)'/> + <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="pam_keyinit.8.xml" xpointer='xpointer(id("pam_keyinit-examples")/*)'/> </section> <section> - <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" - href="pam_keyinit.8.xml" xpointer='xpointer(//refsect1[@id = "pam_keyinit-author"]/*)'/> + <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="pam_keyinit.8.xml" xpointer='xpointer(id("pam_keyinit-author")/*)'/> </section> -</article> +</article>
\ No newline at end of file diff --git a/modules/pam_keyinit/pam_keyinit.8 b/modules/pam_keyinit/pam_keyinit.8 index 01bfa529..5d7b3e47 100644 --- a/modules/pam_keyinit/pam_keyinit.8 +++ b/modules/pam_keyinit/pam_keyinit.8 @@ -1,13 +1,13 @@ '\" t .\" Title: pam_keyinit .\" Author: [see the "AUTHOR" section] -.\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/> -.\" Date: 09/03/2021 +.\" Generator: DocBook XSL Stylesheets v1.79.2 <http://docbook.sf.net/> +.\" Date: 05/07/2023 .\" Manual: Linux-PAM Manual -.\" Source: Linux-PAM Manual +.\" Source: Linux-PAM .\" Language: English .\" -.TH "PAM_KEYINIT" "8" "09/03/2021" "Linux-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_KEYINIT" "8" "05/07/2023" "Linux\-PAM" "Linux\-PAM Manual" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- @@ -61,18 +61,18 @@ The keyutils package is used to manipulate keys more directly\&. This can be obt \m[blue]\fBKeyutils\fR\m[]\&\s-2\u[1]\d\s+2 .SH "OPTIONS" .PP -\fBdebug\fR +debug .RS 4 Log debug information with \fBsyslog\fR(3)\&. .RE .PP -\fBforce\fR +force .RS 4 Causes the session keyring of the invoking process to be replaced unconditionally\&. .RE .PP -\fBrevoke\fR +revoke .RS 4 Causes the session keyring of the invoking process to be revoked when the invoking process exits if the session keyring was created for this process in the first place\&. .RE diff --git a/modules/pam_keyinit/pam_keyinit.8.xml b/modules/pam_keyinit/pam_keyinit.8.xml index ff1e7d00..7b0a73be 100644 --- a/modules/pam_keyinit/pam_keyinit.8.xml +++ b/modules/pam_keyinit/pam_keyinit.8.xml @@ -1,36 +1,33 @@ -<?xml version="1.0" encoding='UTF-8'?> -<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN" - "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd"> - -<refentry id="pam_keyinit"> +<refentry xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="pam_keyinit"> <refmeta> <refentrytitle>pam_keyinit</refentrytitle> <manvolnum>8</manvolnum> - <refmiscinfo class="sectdesc">Linux-PAM Manual</refmiscinfo> + <refmiscinfo class="source">Linux-PAM</refmiscinfo> + <refmiscinfo class="manual">Linux-PAM Manual</refmiscinfo> </refmeta> - <refnamediv id="pam_keyinit-name"> + <refnamediv xml:id="pam_keyinit-name"> <refname>pam_keyinit</refname> <refpurpose>Kernel session keyring initialiser module</refpurpose> </refnamediv> <refsynopsisdiv> - <cmdsynopsis id="pam_keyinit-cmdsynopsis"> + <cmdsynopsis xml:id="pam_keyinit-cmdsynopsis" sepchar=" "> <command>pam_keyinit.so</command> - <arg choice="opt"> + <arg choice="opt" rep="norepeat"> debug </arg> - <arg choice="opt"> + <arg choice="opt" rep="norepeat"> force </arg> - <arg choice="opt"> + <arg choice="opt" rep="norepeat"> revoke </arg> </cmdsynopsis> </refsynopsisdiv> - <refsect1 id="pam_keyinit-description"> + <refsect1 xml:id="pam_keyinit-description"> <title>DESCRIPTION</title> <para> The pam_keyinit PAM module ensures that the invoking process has a @@ -71,7 +68,7 @@ </para> <para> This module should not, generally, be invoked by programs like - <emphasis remap='B'>su</emphasis>, since it is usually desirable for the + <emphasis remap="B">su</emphasis>, since it is usually desirable for the key set to percolate through to the alternate context. The keys have their own permissions system to manage this. </para> @@ -80,18 +77,18 @@ can be obtained from: </para> <para> - <ulink url="http://people.redhat.com/~dhowells/keyutils/"> + <link xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="http://people.redhat.com/~dhowells/keyutils/"> Keyutils - </ulink> + </link> </para> </refsect1> - <refsect1 id="pam_keyinit-options"> + <refsect1 xml:id="pam_keyinit-options"> <title>OPTIONS</title> <variablelist> <varlistentry> <term> - <option>debug</option> + debug </term> <listitem> <para> @@ -104,7 +101,7 @@ <varlistentry> <term> - <option>force</option> + force </term> <listitem> <para> @@ -116,7 +113,7 @@ <varlistentry> <term> - <option>revoke</option> + revoke </term> <listitem> <para> @@ -130,14 +127,14 @@ </variablelist> </refsect1> - <refsect1 id="pam_keyinit-types"> + <refsect1 xml:id="pam_keyinit-types"> <title>MODULE TYPES PROVIDED</title> <para> Only the <option>session</option> module type is provided. </para> </refsect1> - <refsect1 id='pam_keyinit-return_values'> + <refsect1 xml:id="pam_keyinit-return_values"> <title>RETURN VALUES</title> <variablelist> <varlistentry> @@ -207,7 +204,7 @@ </variablelist> </refsect1> - <refsect1 id='pam_keyinit-examples'> + <refsect1 xml:id="pam_keyinit-examples"> <title>EXAMPLES</title> <para> Add this line to your login entries to start each login session with its @@ -222,7 +219,7 @@ session required pam_keyinit.so </para> </refsect1> - <refsect1 id='pam_keyinit-see_also'> + <refsect1 xml:id="pam_keyinit-see_also"> <title>SEE ALSO</title> <para> <citerefentry> @@ -240,11 +237,11 @@ session required pam_keyinit.so </para> </refsect1> - <refsect1 id='pam_keyinit-author'> + <refsect1 xml:id="pam_keyinit-author"> <title>AUTHOR</title> <para> pam_keyinit was written by David Howells, <dhowells@redhat.com>. </para> </refsect1> -</refentry> +</refentry>
\ No newline at end of file diff --git a/modules/pam_keyinit/pam_keyinit.c b/modules/pam_keyinit/pam_keyinit.c index 92e4953b..df9804b9 100644 --- a/modules/pam_keyinit/pam_keyinit.c +++ b/modules/pam_keyinit/pam_keyinit.c @@ -21,6 +21,7 @@ #include <security/pam_modutil.h> #include <security/pam_ext.h> #include <sys/syscall.h> +#include <stdatomic.h> #define KEY_SPEC_SESSION_KEYRING -3 /* ID for session keyring */ #define KEY_SPEC_USER_KEYRING -4 /* ID for UID-specific keyring */ @@ -31,12 +32,12 @@ #define KEYCTL_REVOKE 3 /* revoke a key */ #define KEYCTL_LINK 8 /* link a key into a keyring */ -static int my_session_keyring = 0; -static int session_counter = 0; -static int do_revoke = 0; -static uid_t revoke_as_uid; -static gid_t revoke_as_gid; -static int xdebug = 0; +static _Thread_local int my_session_keyring = 0; +static _Atomic int session_counter = 0; +static _Thread_local int do_revoke = 0; +static _Thread_local uid_t revoke_as_uid; +static _Thread_local gid_t revoke_as_gid; +static _Thread_local int xdebug = 0; static void debug(pam_handle_t *pamh, const char *fmt, ...) __attribute__((format(printf, 2, 3))); @@ -64,6 +65,33 @@ static void error(pam_handle_t *pamh, const char *fmt, ...) va_end(va); } +static int pam_setreuid(uid_t ruid, uid_t euid) +{ +#if defined(SYS_setreuid32) + return syscall(SYS_setreuid32, ruid, euid); +#else + return syscall(SYS_setreuid, ruid, euid); +#endif +} + +static int pam_setregid(gid_t rgid, gid_t egid) +{ +#if defined(SYS_setregid32) + return syscall(SYS_setregid32, rgid, egid); +#else + return syscall(SYS_setregid, rgid, egid); +#endif +} + +static int pam_setresuid(uid_t ruid, uid_t euid, uid_t suid) +{ +#if defined(SYS_setresuid32) + return syscall(SYS_setresuid32, ruid, euid, suid); +#else + return syscall(SYS_setresuid, ruid, euid, suid); +#endif +} + /* * initialise the session keyring for this process */ @@ -140,14 +168,14 @@ static int kill_keyrings(pam_handle_t *pamh, int error_ret) /* switch to the real UID and GID so that we have permission to * revoke the key */ - if (revoke_as_gid != old_gid && setregid(-1, revoke_as_gid) < 0) { + if (revoke_as_gid != old_gid && pam_setregid(-1, revoke_as_gid) < 0) { error(pamh, "Unable to change GID to %d temporarily\n", revoke_as_gid); return error_ret; } - if (revoke_as_uid != old_uid && setresuid(-1, revoke_as_uid, old_uid) < 0) { + if (revoke_as_uid != old_uid && pam_setresuid(-1, revoke_as_uid, old_uid) < 0) { error(pamh, "Unable to change UID to %d temporarily\n", revoke_as_uid); - if (getegid() != old_gid && setregid(-1, old_gid) < 0) + if (getegid() != old_gid && pam_setregid(-1, old_gid) < 0) error(pamh, "Unable to change GID back to %d\n", old_gid); return error_ret; } @@ -157,12 +185,12 @@ static int kill_keyrings(pam_handle_t *pamh, int error_ret) } /* return to the original UID and GID (probably root) */ - if (revoke_as_uid != old_uid && setreuid(-1, old_uid) < 0) { + if (revoke_as_uid != old_uid && pam_setreuid(-1, old_uid) < 0) { error(pamh, "Unable to change UID back to %d\n", old_uid); ret = error_ret; } - if (revoke_as_gid != old_gid && setregid(-1, old_gid) < 0) { + if (revoke_as_gid != old_gid && pam_setregid(-1, old_gid) < 0) { error(pamh, "Unable to change GID back to %d\n", old_gid); ret = error_ret; } @@ -215,14 +243,14 @@ static int do_keyinit(pam_handle_t *pamh, int argc, const char **argv, int error /* switch to the real UID and GID so that the keyring ends up owned by * the right user */ - if (gid != old_gid && setregid(gid, -1) < 0) { + if (gid != old_gid && pam_setregid(gid, -1) < 0) { error(pamh, "Unable to change GID to %d temporarily\n", gid); return error_ret; } - if (uid != old_uid && setreuid(uid, -1) < 0) { + if (uid != old_uid && pam_setreuid(uid, -1) < 0) { error(pamh, "Unable to change UID to %d temporarily\n", uid); - if (setregid(old_gid, -1) < 0) + if (pam_setregid(old_gid, -1) < 0) error(pamh, "Unable to change GID back to %d\n", old_gid); return error_ret; } @@ -230,12 +258,12 @@ static int do_keyinit(pam_handle_t *pamh, int argc, const char **argv, int error ret = init_keyrings(pamh, force, error_ret); /* return to the original UID and GID (probably root) */ - if (uid != old_uid && setreuid(old_uid, -1) < 0) { + if (uid != old_uid && pam_setreuid(old_uid, -1) < 0) { error(pamh, "Unable to change UID back to %d\n", old_uid); ret = error_ret; } - if (gid != old_gid && setregid(old_gid, -1) < 0) { + if (gid != old_gid && pam_setregid(old_gid, -1) < 0) { error(pamh, "Unable to change GID back to %d\n", old_gid); ret = error_ret; } |