aboutsummaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* pam_loginuid: fix unlikely negative 3rd argument of strncmp on error pathikerexxe2020-07-011-1/+1
| | | | | | | | [ldv: rewrote commit message] * modules/pam_loginuid/pam_loginuid.c (set_loginuid): Do not pass to strncmp the return value of pam_modutil_read in an unlikely case when the latter fails to read from /proc/self/uid_map.
* pam_namespace, pam_mkhomedir: fix unlikely descriptor leaks on error pathikerexxe2020-07-012-0/+3
| | | | | | | | | | | [ldv: rewrote commit message] * modules/pam_mkhomedir/mkhomedir_helper.c (create_homedir): Close just opened file descriptor "srcfd" in an unlikely case when it cannot be fstat'ed. * modules/pam_namespace/pam_namespace.c (create_instance): Close just opened file descriptor "fd" in an unlikely case when it cannot be fstat'ed.
* pam_rootok: fix use of va_listikerexxe2020-07-011-3/+6
| | | | | | | | | | | | | | | | | | CPPCHECK_WARNING (CWE-843): error[va_end_missing]: va_list 'ap' was opened but not closed by va_end(). [ldv: According to POSIX documentation, each invocation of va_start() must be matched by a corresponding invocation of va_end(). According to the GNU libc documentation, "with most C compilers, calling 'va_end' does nothing. This is always true in the GNU C compiler. But you might as well call 'va_end' just in case your program is someday compiled with a peculiar compiler." The main reason for applying this change is to pacify static analysis tools like cppcheck that insist on strict POSIX conformance in this respect.]
* misc_conv: fix potential stack buffer overflowikerexxe2020-07-011-1/+1
| | | | | | | | [ldv: rewrote commit message] * libpam_misc/misc_conv.c (read_string): Use _pam_overwrite_n instead of _pam_overwrite to clear stack buffer "line" because the latter does not have to be null-terminated.
* Translated using Weblate (Hebrew)Yaron Shahrabani2020-07-011-23/+23
| | | | | | | Currently translated at 60.6% (74 of 122 strings) Translation: linux-pam/master Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/he/
* misc_conv: remove redundant checkDmitry V. Levin2020-06-301-1/+1
| | | | | * libpam_misc/misc_conv.c (read_string): Remove redundant nc > 0 check as it has already been tested in the previous condition.
* pam_limits: clarify configuration fileikerexxe2020-06-291-0/+11
| | | | Resolves: https://github.com/linux-pam/linux-pam/pull/249
* .gitignore: move doc-specific entries to doc/.gitignoreDmitry V. Levin2020-06-262-2/+2
|
* .gitignore: move module-specific entries to modules/.gitignoreDmitry V. Levin2020-06-262-1/+1
|
* pam_namespace: add systemd service file to gitignoreikerexxe2020-06-261-0/+1
| | | | | | * modules/pam_namespace/.gitignore: Add pam_namespace.service. Complements: v1.4.0~247 ("pam_namespace: secure tmp-inst directories")
* pam_faillock: add faillock executable to gitignoreikerexxe2020-06-261-0/+1
| | | | | | * modules/pam_faillock/.gitignore: Add faillock. Complements: v1.4.0~76 ("pam_faillock: New module for locking after multiple auth failures")
* pam_env: clarify user_readenv optionikerexxe2020-06-251-1/+4
|
* Translated using Weblate (Kazakh)Baurzhan Muftakhidinov2020-06-241-53/+42
| | | | | | | Currently translated at 100.0% (122 of 122 strings) Translation: linux-pam/master Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/kk/
* Translated using Weblate (Hebrew)Yaron Shahrabani2020-06-241-52/+41
| | | | | | | Currently translated at 44.2% (54 of 122 strings) Translation: linux-pam/master Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/he/
* modules/pam_limits: add support for nonewprivsVito Caputo2020-06-222-11/+47
| | | | | | | | | | | | Expose prctl(PR_SET_NO_NEW_PRIVS) as "nonewprivs" item. The valid values are a boolean toggle 0/1 to keep semi-consistent with the other numeric limits. It's slightly awkward as this is an oddball relative to the other items in pam_limits but outside of the item value itself this does seem at home in pam_limits. Resolves: https://github.com/linux-pam/linux-pam/issues/224 Resolves: https://github.com/linux-pam/linux-pam/pull/225
* pam_usertype: avoid determining if user existsikerexxe2020-06-171-0/+3
| | | | | | | | | Taking a look at the time for the password prompt to appear it was possible to determine if a user existed in a system. Solved it by matching the runtime until the password prompt was shown by always checking the password hash for an existing and a non-existing user. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1629598
* pam_unix: avoid determining if user existsikerexxe2020-06-172-7/+32
| | | | | | | | | Taking a look at the time for the password prompt to appear it was possible to determine if a user existed in a system. Solved it by matching the runtime until the password prompt was shown by always checking the password hash for an existing and a non-existing user. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1629598
* pam_faillock: change /run/faillock/$USER permissions to 0660ikerexxe2020-06-171-1/+13
| | | | | | | | | Nowadays, /run/faillock/$USER files have user:root ownership and 0600 permissions. This forces the process that writes to these files to have CAP_DAC_OVERRIDE capabilites. Just by changing the permissions to 0660 the capability can be removed, which leads to a more secure system. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1661822
* pam_modutil_check_user_in_passwd: avoid timing attacksDmitry V. Levin2020-06-161-1/+3
| | | | | | * libpam/pam_modutil_check_user.c (pam_modutil_check_user_in_passwd): Do not exit the file reading loop when the user is found, continue reading the file to avoid timing attacks.
* pam_faillock: fix build on muslFabrice Fontaine2020-06-151-38/+1
| | | | | | | | | | Use pam_modutil_check_user_in_passwd in pam_faillock.c instead of fgetpwent_r which is not available on musl. Resolves: https://github.com/linux-pam/linux-pam/issues/236 Resolves: https://github.com/linux-pam/linux-pam/pull/237 Fixes: http://autobuild.buildroot.org/results/0432736ffee376dd84757469434a4bbcfdcdaf4b Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
* Move check_user_in_passwd from pam_localuser.c to pam_modutilFabrice Fontaine2020-06-155-84/+103
| | | | | | | | | | | | | | | | | | Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> * modules/pam_localuser/pam_localuser.c: Include <security/pam_modutil.h>. (pam_sm_authenticate): Replace check_user_in_passwd with pam_modutil_check_user_in_passwd. (check_user_in_passwd): Rename to pam_modutil_check_user_in_passwd, move to ... * libpam/pam_modutil_check_user.c: ... new file. * libpam/Makefile.am (libpam_la_SOURCES): Add pam_modutil_check_user.c. * libpam/include/security/pam_modutil.h (pam_modutil_check_user_in_passwd): New function declaration. * libpam/libpam.map (LIBPAM_MODUTIL_1.4.1): New interface. Co-authored-by: Dmitry V. Levin <ldv@altlinux.org>
* configure.ac: fix non-portable use of test builtinDmitry V. Levin2020-06-151-9/+6
| | | | | | | | | | Portable code should not assume that test builtin supports == operator. * configure.ac (opt_uidmin, opt_sysuidmin, opt_kerneloverflowuid): Fix initialization. Resolves: https://github.com/linux-pam/linux-pam/issues/241 Fixes: 926d7935e ("pam_usertype: new module to tell if uid is in login.defs ranges")
* configure.ac: fix build failure when crypt() does not require libcryptFabrice Fontaine2020-06-111-1/+5
| | | | | | | | | | | Since commit 522246d20e4cd92fadc2d760228cb7e78cbeb4c5, the build fails if "none required" is returned by AC_SEARCH_LIBS for libcrypt. Resolves: https://github.com/linux-pam/linux-pam/pull/235 Fixes: http://autobuild.buildroot.org/results/92b3dd7c984d2b843ac9aacacd69eec99f28743e Fixes: v1.4.0~228 ("Use cached 'crypt' library result correctly") Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
* build: do not generate tarballs compressed with bzip2 and gzipDmitry V. Levin2020-06-041-5/+1
| | | | | | | | There are tarballs compressed with xz, that should be enough. * Makefile.am (AUTOMAKE_OPTIONS): Remove dist-bzip2, add no-dist-gzip. (releasedocs): Do not create Linux-PAM-$(VERSION)-docs.tar.bz2 and Linux-PAM-$(VERSION)-docs.tar.gz.
* maint: document release procedureDmitry V. Levin2020-06-041-0/+6
| | | | * maint/README-release: New file.
* maint: introduce gen-tag-messageDmitry V. Levin2020-06-041-0/+33
| | | | * maint/gen-tag-message: New script for preparing tag message.
* maint: introduce make-distDmitry V. Levin2020-06-041-0/+32
| | | | * maint/make-dist: New script for preparing release tarballs.
* gitlog-to-changelog: update from gnulibDmitry V. Levin2020-06-031-53/+355
|
* pam_setquota: skip mountpoints equal to the user's $HOMEJosef Möllers2020-05-291-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Matthias Gerstner found the following issue: <quote> So this pam_setquota module iterates over all mounted file systems using `setmntent()` and `getmntent()`. It tries to find the longest match of a file system mounted on /home/$USER or above (except when the fs=/some/path parameter is passed to the pam module). The thing is that /home/$USER is owned by the unprivileged user. And there exist tools like fusermount from libfuse which is by default installed setuid-root for everybody. fusermount allows to mount a FUSE file system using an arbitrary "source device name" as the unprivileged user. Thus considering the following use case: 1) there is only the root file system (/) or a file system is mounted on /home, but not on /home/$USER. 2) the attacker mounts a fake FUSE file system over its own home directory: ``` user $ export _FUSE_COMMFD=0 user $ fusermount $HOME -ononempty,fsname=/dev/sda1 ``` This will result in a mount entry in /proc/mounts looking like this: ``` /dev/sda1 on /home/$USER type fuse (rw,nosuid,nodev,relatime,user_id=1000,group_id=100) ``` 3) when the attacker now logs in with pam_setquota configured then pam_setquota will identify /dev/sda1 and the file system where to apply the user's quota on. As a result an unprivileged user has full control over onto which block device the quota is applied. </quote> If the user's $HOME is on a separate partition, setting a quota on the user's $HOME does not really make sense, so this patch skips mountpoints equal to the user's $HOME, preventing the above mentioned bug as a side-effect (or vice-versa). Reported-by: Matthias Gerstner <mgerstner@suse.de> Co-authored-by: Tomáš Mráz <tmraz@redhat.com> Co-authored-by: Dmitry V. Levin <ldv@altlinux.org> Resolves: https://github.com/linux-pam/linux-pam/pull/230
* pam_debug: do not invoke pam_get_user and do not set PAM_USERDmitry V. Levin2020-05-251-22/+1
| | | | | | | | | | | pam_debug used to invoke pam_get_user and set PAM_USER to "nobody" when pam_get_user returns an empty string as the user name. When either of these functions returned an error value, it used to return that error value. This hasn't been documented, and I couldn't find any rationale for this behaviour. * modules/pam_debug/pam_debug.c (pam_sm_authenticate): Do not invoke pam_get_user and pam_set_item.
* Translated using Weblate (Chinese (Traditional))Yi-Jyun Pan2020-05-241-56/+45
| | | | | | | Currently translated at 100.0% (122 of 122 strings) Translation: linux-pam/master Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/zh_TW/
* modules: downgrade syslog level for errors related to pam_get_userDmitry V. Levin2020-05-2212-16/+18
| | | | | | | | | | | | | | | | | | | | | | | | * modules/pam_faillock/pam_faillock.c (get_pam_user): Downgrade the syslog level for diagnostics of errors returned by pam_modutil_getpwnam for users returned by pam_get_user from LOG_ERR to LOG_NOTICE. * modules/pam_keyinit/pam_keyinit.c (do_keyinit): Likewise. * modules/pam_lastlog/pam_lastlog.c (pam_sm_authenticate): Likewise. * modules/pam_listfile/pam_listfile.c (pam_sm_authenticate): Likewise. * modules/pam_loginuid/pam_loginuid.c (_pam_loginuid): Likewise. * modules/pam_mail/pam_mail.c (_do_mail): Likewise. * modules/pam_sepermit/pam_sepermit.c (sepermit_lock): Likewise. * modules/pam_tally/pam_tally.c (pam_get_uid): Likewise. * modules/pam_tally2/pam_tally2.c (pam_get_uid): Likewise. * modules/pam_umask/pam_umask.c (pam_sm_open_session): Likewise. * modules/pam_xauth/pam_xauth.c (pam_sm_open_session, pam_sm_close_session): Likewise. * modules/pam_tty_audit/pam_tty_audit.c (pam_sm_open_session): Downgrade the syslog level for diagnostics of errors returned by pam_modutil_getpwnam for users returned by pam_get_user from LOG_WARNING to LOG_NOTICE. Suggested-by: Tomáš Mráz <tmraz@fedoraproject.org>
* modules: downgrade syslog level for pam_get_user errorsDmitry V. Levin2020-05-2222-30/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * modules/pam_access/pam_access.c (pam_sm_authenticate): Downgrade the syslog level for pam_get_user errors from LOG_ERR to LOG_NOTICE. * modules/pam_cracklib/pam_cracklib.c (_pam_unix_approve_pass): Likewise. * modules/pam_ftp/pam_ftp.c (pam_sm_authenticate): Likewise. * modules/pam_group/pam_group.c (pam_sm_setcred): Likewise. * modules/pam_lastlog/pam_lastlog.c (pam_sm_authenticate): Likewise. * modules/pam_loginuid/pam_loginuid.c (_pam_loginuid): Likewise. * modules/pam_mail/pam_mail.c (_do_mail): Likewise. * modules/pam_nologin/pam_nologin.c (perform_check): Likewise. * modules/pam_rhosts/pam_rhosts.c (pam_sm_authenticate): Likewise. * modules/pam_sepermit/pam_sepermit.c (pam_sm_authenticate): Likewise. * modules/pam_succeed_if/pam_succeed_if.c (pam_sm_authenticate): Likewise. * modules/pam_tally/pam_tally.c (pam_get_uid): Likewise. * modules/pam_tally2/pam_tally2.c (pam_get_uid): Likewise. * modules/pam_time/pam_time.c (pam_sm_acct_mgmt): Likewise. * modules/pam_tty_audit/pam_tty_audit.c (pam_sm_open_session): Likewise. * modules/pam_umask/pam_umask.c (pam_sm_open_session): Likewise. * modules/pam_userdb/pam_userdb.c (pam_sm_authenticate, pam_sm_acct_mgmt): Likewise. * modules/pam_usertype/pam_usertype.c (pam_usertype_get_uid): Likewise. * modules/pam_xauth/pam_xauth.c (pam_sm_open_session, pam_sm_close_session): Likewise. * modules/pam_securetty/pam_securetty.c (securetty_perform_check): Downgrade the syslog level for pam_get_user errors from LOG_WARNING to LOG_NOTICE. * modules/pam_stress/pam_stress.c (pam_sm_authenticate): Likewise. Suggested-by: Tomáš Mráz <tmraz@fedoraproject.org>
* pam_localuser: add a test for return valuesDmitry V. Levin2020-05-222-1/+148
| | | | | | * modules/pam_localuser/tst-pam_localuser-retval.c: New file. * modules/pam_localuser/Makefile.am (TESTS): Add $(check_PROGRAMS). (check_PROGRAMS, tst_pam_localuser_retval_LDADD): New variables.
* pam_localuser: refactor pam_sm_authenticateDmitry V. Levin2020-05-221-56/+63
| | | | | | * modules/pam_localuser/pam_localuser.c (check_user_in_passwd): New function. (pam_sm_authenticate): Use it.
* pam_localuser: downgrade syslog level for errors related to user inputDmitry V. Levin2020-05-221-3/+3
| | | | | | | | * modules/pam_localuser/pam_localuser.c (pam_sm_authenticate): Downgrade the syslog level for errors related to pam_get_user from LOG_ERR to LOG_NOTICE. Suggested-by: Tomáš Mráz <tmraz@fedoraproject.org>
* pam_localuser: re-format pam_sm_* function declarationsDmitry V. Levin2020-05-211-10/+7
|
* pam_localuser: remove unused includesDmitry V. Levin2020-05-211-10/+1
| | | | | | | | Also, remove unused MODULE_NAME macro. * modules/pam_localuser/pam_localuser.c: Stop including unused header files. (MODULE_NAME): Remove.
* pam_localuser: forward error values returned by pam_get_userDmitry V. Levin2020-05-212-2/+21
| | | | | | | | | | | | Starting with commit c2c601f5340a59c5c62193d55b555d384380ea38, pam_get_user is guaranteed to return one of the following values: PAM_SUCCESS, PAM_BUF_ERR, PAM_CONV_AGAIN, or PAM_CONV_ERR. * modules/pam_localuser/pam_localuser.c (pam_sm_authenticate): Do not replace non-PAM_CONV_AGAIN error values returned by pam_get_user with PAM_SERVICE_ERR. * modules/pam_localuser/pam_localuser.8.xml (RETURN VALUES): Document new return values.
* pam_localuser: return PAM_INCOMPLETE when pam_get_user returns PAM_CONV_AGAINDmitry V. Levin2020-05-212-4/+15
| | | | | | | | | | Give the application a chance to handle PAM_INCOMPLETE. * modules/pam_localuser/pam_localuser.c (pam_sm_authenticate): Return PAM_INCOMPLETE instead of PAM_SERVICE_ERR when pam_get_user returns PAM_CONV_AGAIN. * modules/pam_localuser/pam_localuser.8.xml (RETURN VALUES): Document it.
* pam_localuser: open the passwd file after user name validationDmitry V. Levin2020-05-211-12/+7
| | | | | | | | Since user name is untrusted input, it should be validated earlier rather than later. * modules/pam_localuser/pam_localuser.c (pam_sm_authenticate): Open the passwd file after user name validation.
* pam_localuser: use BUFSIZ as the line buffer sizeDmitry V. Levin2020-05-211-1/+1
| | | | | | | | | | As BUFSIZ is the buffer size used in stdio, it must be an efficient size for the line buffer. Also, it's larger than LINE_MAX used as the line buffer size before this change, effectively raising the maximum user name length supported by this module. * modules/pam_localuser/pam_localuser.c (pam_sm_authenticate): Replace LINE_MAX with BUFSIZ.
* pam_localuser: handle long lines in passwd files properlyDmitry V. Levin2020-05-211-3/+32
| | | | | | | | | Before this change, a long line in the passwd file used to be treated as several lines which could potentially result to false match and, consequently, to incorrect PAM_SUCCESS return value. * modules/pam_localuser/pam_localuser.c (pam_sm_authenticate): Handle long lines in passwd files properly.
* pam_localuser: get rid of a temporary bufferDmitry V. Levin2020-05-211-6/+10
| | | | | | * modules/pam_localuser/pam_localuser.c (pam_sm_authenticate): Do not copy the user name into a temporary buffer, use the user name itself in comparisons.
* pam_localuser: log unrecognized optionsDmitry V. Levin2020-05-211-0/+8
| | | | | * modules/pam_localuser/pam_localuser.c (pam_sm_authenticate): Log unrecognized options.
* pam_localuser: return PAM_SERVICE_ERR instead of PAM_SYSTEM_ERRDmitry V. Levin2020-05-211-3/+3
| | | | | | | | | When passwd file cannot be opened or the user name either cannot be obtained or is not valid, return PAM_SERVICE_ERR instead of PAM_SYSTEM_ERR. * modules/pam_localuser/pam_localuser.c (pam_sm_authenticate): Return PAM_SERVICE_ERR instead of PAM_SYSTEM_ERR.
* pam_localuser: reject user names that are too longDmitry V. Levin2020-05-211-0/+6
| | | | | | | | Too long user names used to be truncated which could potentially result to false match and, consequently, to incorrect PAM_SUCCESS return value. * modules/pam_localuser/pam_localuser.c (pam_sm_authenticate): Return PAM_SERVICE_ERR if the user name is too long.
* pam_localuser: reject user names containing a colonDmitry V. Levin2020-05-211-0/+9
| | | | | | | | "root:x" is not a local user name even if the passwd file contains a line starting with "root:x:". * modules/pam_localuser/pam_localuser.c (pam_sm_authenticate): Return PAM_PERM_DENIED if the user name contains a colon.
* pam_mkhomedir: add a test for return valuesDmitry V. Levin2020-05-212-1/+114
| | | | | | * modules/pam_mkhomedir/tst-pam_mkhomedir-retval.c: New file. * modules/pam_mkhomedir/Makefile.am (TESTS): Add $(check_PROGRAMS). (check_PROGRAMS, tst_pam_mkhomedir_retval_LDADD): New variables.
* pam_faildelay: add a test for return valuesDmitry V. Levin2020-05-212-1/+92
| | | | | | * modules/pam_faildelay/tst-pam_faildelay-retval.c: New file. * modules/pam_faildelay/Makefile.am (TESTS): Add $(check_PROGRAMS). (check_PROGRAMS, tst_pam_faildelay_retval_LDADD): New variables.
generated by cgit v1.2.3 (git 2.39.1) at 2025-06-03 21:19:00 +0000