diff options
Diffstat (limited to 'modules/pam_umask')
| -rw-r--r-- | modules/pam_umask/.cvsignore | 8 | ||||
| -rw-r--r-- | modules/pam_umask/Makefile.am | 32 | ||||
| -rw-r--r-- | modules/pam_umask/README | 58 | ||||
| -rw-r--r-- | modules/pam_umask/README.xml | 41 | ||||
| -rw-r--r-- | modules/pam_umask/pam_umask.8 | 96 | ||||
| -rw-r--r-- | modules/pam_umask/pam_umask.8.xml | 220 | ||||
| -rw-r--r-- | modules/pam_umask/pam_umask.c | 319 | ||||
| -rwxr-xr-x | modules/pam_umask/tst-pam_umask | 2 |
8 files changed, 0 insertions, 776 deletions
diff --git a/modules/pam_umask/.cvsignore b/modules/pam_umask/.cvsignore deleted file mode 100644 index 621104aa..00000000 --- a/modules/pam_umask/.cvsignore +++ /dev/null @@ -1,8 +0,0 @@ -*.la -*.lo -*.so -*~ -.deps -.libs -Makefile -Makefile.in diff --git a/modules/pam_umask/Makefile.am b/modules/pam_umask/Makefile.am deleted file mode 100644 index 56fa63b4..00000000 --- a/modules/pam_umask/Makefile.am +++ /dev/null @@ -1,32 +0,0 @@ -# -# Copyright (c) 2005, 2006 Thorsten Kukuk <kukuk@suse.de> -# - -CLEANFILES = *~ - -EXTRA_DIST = README $(MANS) $(XMLS) tst-pam_umask - -man_MANS = pam_umask.8 - -XMLS = README.xml pam_umask.8.xml - -TESTS = tst-pam_umask - -securelibdir = $(SECUREDIR) -secureconfdir = $(SCONFIGDIR) - -AM_CFLAGS = -I$(top_srcdir)/libpam/include -I$(top_srcdir)/libpamc/include -AM_LDFLAGS = -no-undefined -avoid-version -module \ - -L$(top_builddir)/libpam -lpam -if HAVE_VERSIONING - AM_LDFLAGS += -Wl,--version-script=$(srcdir)/../modules.map -endif - -securelib_LTLIBRARIES = pam_umask.la - -if ENABLE_REGENERATE_MAN -noinst_DATA = README -README: pam_umask.8.xml --include $(top_srcdir)/Make.xml.rules -endif - diff --git a/modules/pam_umask/README b/modules/pam_umask/README deleted file mode 100644 index 69003ec3..00000000 --- a/modules/pam_umask/README +++ /dev/null @@ -1,58 +0,0 @@ -pam_umask — PAM module to set the file mode creation mask - -━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ - -DESCRIPTION - -pam_umask is a PAM module to set the file mode creation mask of the current -environment. The umask affects the default permissions assigned to newly -created files. - -The PAM module tries to get the umask value from the following places in the -following order: - - ● umask= argument - - ● umask= entry of the users GECOS field - - ● pri= entry of the users GECOS field - - ● ulimit= entry of the users GECOS field - - ● UMASK= entry from /etc/default/login - - ● UMASK entry from /etc/login.defs - -OPTIONS - -debug - - Print debug information. - -silent - - Don't print informative messages. - -usergroups - - If the user is not root, and the user ID is equal to the group ID, and the - username is the same as primary group name, the umask group bits are set to - be the same as owner bits (examples: 022 -> 002, 077 -> 007). - -umask=mask - - Sets the calling process's file mode creation mask (umask) to mask & 0777. - The value is interpreted as Octal. - -EXAMPLES - -Add the following line to /etc/pam.d/login to set the user specific umask at -login: - - session optional pam_umask.so umask=0022 - - -AUTHOR - -pam_umask was written by Thorsten Kukuk <kukuk@thkukuk.de>. - diff --git a/modules/pam_umask/README.xml b/modules/pam_umask/README.xml deleted file mode 100644 index 9afbe543..00000000 --- a/modules/pam_umask/README.xml +++ /dev/null @@ -1,41 +0,0 @@ -<?xml version="1.0" encoding='UTF-8'?> -<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN" -"http://www.docbook.org/xml/4.3/docbookx.dtd" -[ -<!-- -<!ENTITY pamaccess SYSTEM "pam_umask.8.xml"> ---> -]> - -<article> - - <articleinfo> - - <title> - <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" - href="pam_umask.8.xml" xpointer='xpointer(//refnamediv[@id = "pam_umask-name"]/*)'/> - </title> - - </articleinfo> - - <section> - <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" - href="pam_umask.8.xml" xpointer='xpointer(//refsect1[@id = "pam_umask-description"]/*)'/> - </section> - - <section> - <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" - href="pam_umask.8.xml" xpointer='xpointer(//refsect1[@id = "pam_umask-options"]/*)'/> - </section> - - <section> - <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" - href="pam_umask.8.xml" xpointer='xpointer(//refsect1[@id = "pam_umask-examples"]/*)'/> - </section> - - <section> - <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" - href="pam_umask.8.xml" xpointer='xpointer(//refsect1[@id = "pam_umask-author"]/*)'/> - </section> - -</article> diff --git a/modules/pam_umask/pam_umask.8 b/modules/pam_umask/pam_umask.8 deleted file mode 100644 index 43160d63..00000000 --- a/modules/pam_umask/pam_umask.8 +++ /dev/null @@ -1,96 +0,0 @@ -.\" Title: pam_umask -.\" Author: -.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/> -.\" Date: 08/06/2006 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual -.\" -.TH "PAM_UMASK" "8" "08/06/2006" "Linux\-PAM Manual" "Linux\-PAM Manual" -.\" disable hyphenation -.nh -.\" disable justification (adjust text to left margin only) -.ad l -.SH "NAME" -pam_umask \- PAM module to set the file mode creation mask -.SH "SYNOPSIS" -.HP 13 -\fBpam_umask.so\fR [debug] [silent] [usergroups] [umask=\fImask\fR] -.SH "DESCRIPTION" -.PP -pam_umask is a PAM module to set the file mode creation mask of the current environment. The umask affects the default permissions assigned to newly created files. -.PP -The PAM module tries to get the umask value from the following places in the following order: -.TP 3n -\(bu -umask= argument -.TP 3n -\(bu -umask= entry of the users GECOS field -.TP 3n -\(bu -pri= entry of the users GECOS field -.TP 3n -\(bu -ulimit= entry of the users GECOS field -.TP 3n -\(bu -UMASK= entry from /etc/default/login -.TP 3n -\(bu -UMASK entry from /etc/login.defs -.sp -.RE -.SH "OPTIONS" -.PP -.TP 3n -\fBdebug\fR -Print debug information. -.TP 3n -\fBsilent\fR -Don't print informative messages. -.TP 3n -\fBusergroups\fR -If the user is not root, and the user ID is equal to the group ID, and the username is the same as primary group name, the umask group bits are set to be the same as owner bits (examples: 022 \-> 002, 077 \-> 007). -.TP 3n -\fBumask=\fR\fB\fImask\fR\fR -Sets the calling process's file mode creation mask (umask) to -\fBmask\fR -& 0777. The value is interpreted as Octal. -.SH "MODULE SERVICES PROVIDED" -.PP -Only the -\fBsession\fR -service is supported. -.SH "RETURN VALUES" -.PP -.TP 3n -PAM_SUCCESS -The new umask was set successfull. -.TP 3n -PAM_SERVICE_ERR -No username was given. -.TP 3n -PAM_USER_UNKNOWN -User not known. -.SH "EXAMPLES" -.PP -Add the following line to -\fI/etc/pam.d/login\fR -to set the user specific umask at login: -.sp -.RS 3n -.nf - session optional pam_umask.so umask=0022 - -.fi -.RE -.sp -.SH "SEE ALSO" -.PP - -\fBpam.conf\fR(5), -\fBpam.d\fR(8), -\fBpam\fR(8) -.SH "AUTHOR" -.PP -pam_umask was written by Thorsten Kukuk <kukuk@thkukuk.de>. diff --git a/modules/pam_umask/pam_umask.8.xml b/modules/pam_umask/pam_umask.8.xml deleted file mode 100644 index d65e6660..00000000 --- a/modules/pam_umask/pam_umask.8.xml +++ /dev/null @@ -1,220 +0,0 @@ -<?xml version="1.0" encoding='UTF-8'?> -<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN" - "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd"> - -<refentry id="pam_umask"> - - <refmeta> - <refentrytitle>pam_umask</refentrytitle> - <manvolnum>8</manvolnum> - <refmiscinfo class="sectdesc">Linux-PAM Manual</refmiscinfo> - </refmeta> - - <refnamediv id="pam_umask-name"> - <refname>pam_umask</refname> - <refpurpose>PAM module to set the file mode creation mask</refpurpose> - </refnamediv> - - <refsynopsisdiv> - <cmdsynopsis id="pam_umask-cmdsynopsis"> - <command>pam_umask.so</command> - <arg choice="opt"> - debug - </arg> - <arg choice="opt"> - silent - </arg> - <arg choice="opt"> - usergroups - </arg> - <arg choice="opt"> - umask=<replaceable>mask</replaceable> - </arg> - </cmdsynopsis> - </refsynopsisdiv> - - <refsect1 id="pam_umask-description"> - - <title>DESCRIPTION</title> - - <para> - pam_umask is a PAM module to set the file mode creation mask - of the current environment. The umask affects the default - permissions assigned to newly created files. - </para> - <para> - The PAM module tries to get the umask value from the - following places in the following order: - <itemizedlist> - <listitem> - <para> - umask= argument - </para> - </listitem> - <listitem> - <para> - umask= entry of the users GECOS field - </para> - </listitem> - <listitem> - <para> - pri= entry of the users GECOS field - </para> - </listitem> - <listitem> - <para> - ulimit= entry of the users GECOS field - </para> - </listitem> - <listitem> - <para> - UMASK= entry from /etc/default/login - </para> - </listitem> - <listitem> - <para> - UMASK entry from /etc/login.defs - </para> - </listitem> - </itemizedlist> - </para> - - </refsect1> - - <refsect1 id="pam_umask-options"> - - <title>OPTIONS</title> - <para> - <variablelist> - - <varlistentry> - <term> - <option>debug</option> - </term> - <listitem> - <para> - Print debug information. - </para> - </listitem> - </varlistentry> - - <varlistentry> - <term> - <option>silent</option> - </term> - <listitem> - <para> - Don't print informative messages. - </para> - </listitem> - </varlistentry> - - <varlistentry> - <term> - <option>usergroups</option> - </term> - <listitem> - <para> - If the user is not root, and the user ID is equal to the - group ID, and the username is the same as primary group name, - the umask group bits are set to be the same as - owner bits (examples: 022 -> 002, 077 -> 007). - </para> - </listitem> - </varlistentry> - - <varlistentry> - <term> - <option>umask=<replaceable>mask</replaceable></option> - </term> - <listitem> - <para> - Sets the calling process's file mode creation mask (umask) - to <option>mask</option> & 0777. The value is interpreted - as Octal. - </para> - </listitem> - </varlistentry> - - </variablelist> - - </para> - </refsect1> - - <refsect1 id="pam_umask-services"> - <title>MODULE SERVICES PROVIDED</title> - <para> - Only the <option>session</option> service is supported. - </para> - </refsect1> - - <refsect1 id='pam_umask-return_values'> - <title>RETURN VALUES</title> - <para> - <variablelist> - - <varlistentry> - <term>PAM_SUCCESS</term> - <listitem> - <para> - The new umask was set successfull. - </para> - </listitem> - </varlistentry> - - <varlistentry> - <term>PAM_SERVICE_ERR</term> - <listitem> - <para> - No username was given. - </para> - </listitem> - </varlistentry> - - <varlistentry> - <term>PAM_USER_UNKNOWN</term> - <listitem> - <para> - User not known. - </para> - </listitem> - </varlistentry> - - </variablelist> - </para> - </refsect1> - - <refsect1 id='pam_umask-examples'> - <title>EXAMPLES</title> - <para> - Add the following line to <filename>/etc/pam.d/login</filename> to - set the user specific umask at login: - <programlisting> - session optional pam_umask.so umask=0022 - </programlisting> - </para> - </refsect1> - - <refsect1 id='pam_umask-see_also'> - <title>SEE ALSO</title> - <para> - <citerefentry> - <refentrytitle>pam.conf</refentrytitle><manvolnum>5</manvolnum> - </citerefentry>, - <citerefentry> - <refentrytitle>pam.d</refentrytitle><manvolnum>8</manvolnum> - </citerefentry>, - <citerefentry> - <refentrytitle>pam</refentrytitle><manvolnum>8</manvolnum> - </citerefentry> - </para> - </refsect1> - - <refsect1 id='pam_umask-author'> - <title>AUTHOR</title> - <para> - pam_umask was written by Thorsten Kukuk <kukuk@thkukuk.de>. - </para> - </refsect1> - -</refentry> diff --git a/modules/pam_umask/pam_umask.c b/modules/pam_umask/pam_umask.c deleted file mode 100644 index fdeb3c51..00000000 --- a/modules/pam_umask/pam_umask.c +++ /dev/null @@ -1,319 +0,0 @@ -/* - * Copyright (c) 2005, 2006 Thorsten Kukuk <kukuk@thkukuk.de> - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * 1. Redistributions of source code must retain the above copyright - * notice, and the entire permission notice in its entirety, - * including the disclaimer of warranties. - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * 3. The name of the author may not be used to endorse or promote - * products derived from this software without specific prior - * written permission. - * - * ALTERNATIVELY, this product may be distributed under the terms of - * the GNU Public License V2, in which case the provisions of the GPL - * are required INSTEAD OF the above restrictions. (This clause is - * necessary due to a potential bad interaction between the GPL and - * the restrictions contained in a BSD-style copyright.) - * - * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED - * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES - * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE - * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, - * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES - * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR - * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, - * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED - * OF THE POSSIBILITY OF SUCH DAMAGE. - */ - -#include "config.h" - -#include <pwd.h> -#include <grp.h> -#include <stdio.h> -#include <ctype.h> -#include <errno.h> -#include <limits.h> -#include <string.h> -#include <stdarg.h> -#include <unistd.h> -#include <stdlib.h> -#include <sys/stat.h> -#include <sys/types.h> -#include <sys/resource.h> -#include <syslog.h> - -#define PAM_SM_SESSION - -#include <security/pam_modules.h> -#include <security/pam_modutil.h> -#include <security/pam_ext.h> - -#define BUF_SIZE 4096 -#define LOGIN_DEFS "/etc/login.defs" -#define LOGIN_CONF "/etc/default/login" - -struct options_t { - int debug; - int usergroups; - int silent; - char *umask; -}; -typedef struct options_t options_t; - -static void -parse_option (const pam_handle_t *pamh, const char *argv, options_t *options) -{ - if (argv == NULL || argv[0] == '\0') - return; - - if (strcasecmp (argv, "debug") == 0) - options->debug = 1; - else if (strncasecmp (argv, "umask=", 6) == 0) - options->umask = strdup (&argv[6]); - else if (strcasecmp (argv, "usergroups") == 0) - options->usergroups = 1; - else if (strcasecmp (argv, "silent") == 0) - options->silent = 1; - else - pam_syslog (pamh, LOG_ERR, "Unknown option: `%s'", argv); -} - -static char * -search_key (const char *filename) -{ - FILE *fp; - char *buf = NULL; - size_t buflen = 0; - char *retval = NULL; - - fp = fopen (filename, "r"); - if (NULL == fp) - return NULL; - - while (!feof (fp)) - { - char *tmp, *cp; -#if defined(HAVE_GETLINE) - ssize_t n = getline (&buf, &buflen, fp); -#elif defined (HAVE_GETDELIM) - ssize_t n = getdelim (&buf, &buflen, '\n', fp); -#else - ssize_t n; - - if (buf == NULL) - { - buflen = BUF_SIZE; - buf = malloc (buflen); - } - buf[0] = '\0'; - if (fgets (buf, buflen - 1, fp) == NULL) - break; - else if (buf != NULL) - n = strlen (buf); - else - n = 0; -#endif /* HAVE_GETLINE / HAVE_GETDELIM */ - cp = buf; - - if (n < 1) - break; - - tmp = strchr (cp, '#'); /* remove comments */ - if (tmp) - *tmp = '\0'; - while (isspace ((int)*cp)) /* remove spaces and tabs */ - ++cp; - if (*cp == '\0') /* ignore empty lines */ - continue; - - if (cp[strlen (cp) - 1] == '\n') - cp[strlen (cp) - 1] = '\0'; - - tmp = strsep (&cp, " \t="); - if (cp != NULL) - while (isspace ((int)*cp) || *cp == '=') - ++cp; - - if (strcasecmp (tmp, "UMASK") == 0) - { - retval = strdup (cp); - break; - } - } - fclose (fp); - - free (buf); - - return retval; -} - -static int -get_options (const pam_handle_t *pamh, options_t *options, - int argc, const char **argv) -{ - memset (options, 0, sizeof (options_t)); - /* Parse parameters for module */ - for ( ; argc-- > 0; argv++) - parse_option (pamh, *argv, options); - - if (options->umask == NULL) - options->umask = search_key (LOGIN_DEFS); - if (options->umask == NULL) - options->umask = search_key (LOGIN_CONF); - - return 0; -} - -static void -set_umask (const char *value) -{ - const char *value_orig = value; - mode_t mask; - char *endptr; - - mask = strtoul (value, &endptr, 8) & 0777; - if (((mask == 0) && (value_orig == endptr)) || - ((mask == ULONG_MAX) && (errno == ERANGE))) - return; - umask (mask); - return; -} - -/* Set the process nice, ulimit, and umask from the - password file entry. */ -static void -setup_limits_from_gecos (pam_handle_t *pamh, options_t *options, - struct passwd *pw) -{ - char *cp; - - if (options->usergroups) - { - /* if not root, and UID == GID, and username is the same as - primary group name, set umask group bits to be the same as - owner bits (examples: 022 -> 002, 077 -> 007). */ - if (pw->pw_uid != 0 && pw->pw_uid == pw->pw_gid) - { - struct group *grp = pam_modutil_getgrgid (pamh, pw->pw_gid); - if (grp && (strcmp (pw->pw_name, grp->gr_name) == 0)) - { - mode_t oldmask = umask (0777); - umask ((oldmask & ~070) | ((oldmask >> 3) & 070)); - } - } - } - - /* See if the GECOS field contains values for NICE, UMASK or ULIMIT. */ - for (cp = pw->pw_gecos; cp != NULL; cp = strchr (cp, ',')) - { - if (*cp == ',') - cp++; - - if (strncasecmp (cp, "umask=", 6) == 0) - umask (strtol (cp + 6, NULL, 8) & 0777); - else if (strncasecmp (cp, "pri=", 4) == 0) - { - errno = 0; - if (nice (strtol (cp + 4, NULL, 10)) == -1 && errno != 0) - { - if (!options->silent || options->debug) - pam_error (pamh, "nice failed: %m\n"); - pam_syslog (pamh, LOG_ERR, "nice failed: %m"); - } - } - else if (strncasecmp (cp, "ulimit=", 7) == 0) - { - struct rlimit rlimit_fsize; - rlimit_fsize.rlim_cur = 512L * strtol (cp + 7, NULL, 10); - rlimit_fsize.rlim_max = rlimit_fsize.rlim_cur; - if (setrlimit (RLIMIT_FSIZE, &rlimit_fsize) == -1) - { - if (!options->silent || options->debug) - pam_error (pamh, "setrlimit failed: %m\n"); - pam_syslog (pamh, LOG_ERR, "setrlimit failed: %m"); - } - } - } -} - - -PAM_EXTERN int -pam_sm_open_session (pam_handle_t *pamh, int flags UNUSED, - int argc, const char **argv) -{ - struct passwd *pw; - options_t options; - const char *name; - int retval = PAM_SUCCESS; - - get_options (pamh, &options, argc, argv); - if (flags & PAM_SILENT) - options.silent = 1; - - /* get the user name. */ - if ((retval = pam_get_user (pamh, &name, NULL)) != PAM_SUCCESS) - { - pam_syslog (pamh, LOG_ERR, "pam_get_user failed: return %d", retval); - return (retval == PAM_CONV_AGAIN ? PAM_INCOMPLETE:retval); - } - - if (name == NULL || name[0] == '\0') - { - if (name) - { - pam_syslog (pamh, LOG_ERR, "bad username [%s]", name); - return PAM_USER_UNKNOWN; - } - return PAM_SERVICE_ERR; - } - - pw = pam_modutil_getpwnam (pamh, name); - if (pw == NULL) - { - pam_syslog (pamh, LOG_ERR, "account for %s not found", name); - return PAM_USER_UNKNOWN; - } - - if (options.umask != NULL) - { - set_umask (options.umask); - free (options.umask); - } - - setup_limits_from_gecos (pamh, &options, pw); - - return retval; -} - -PAM_EXTERN int -pam_sm_close_session (pam_handle_t *pamh UNUSED, int flags UNUSED, - int argc UNUSED, const char **argv UNUSED) -{ - return PAM_SUCCESS; -} - -#ifdef PAM_STATIC - -/* static module data */ - -struct pam_module _pam_umask_modstruct = { - "pam_umask", - NULL, - NULL, - NULL, - pam_sm_open_session, - pam_sm_close_session, - NULL -}; - -#endif - -/* end of module definition */ diff --git a/modules/pam_umask/tst-pam_umask b/modules/pam_umask/tst-pam_umask deleted file mode 100755 index 3608a9de..00000000 --- a/modules/pam_umask/tst-pam_umask +++ /dev/null @@ -1,2 +0,0 @@ -#!/bin/sh -../../tests/tst-dlopen .libs/pam_umask.so |