aboutsummaryrefslogtreecommitdiff
path: root/libpam/include
Commit message (Collapse)AuthorAgeFilesLines
* HALF WORK: MAX_PATHdevYuqian Yang2025-03-012-4/+52
|
* Prepare for 1.7.0 releaseDmitry V. Levin2024-10-231-1/+1
| | | | | | | | | | * meson.build: Raise project version to 1.7.0. * po/meson.build: Likewise. * po/Linux-PAM.pot (Project-Id-Version): Likewise. * libpam/include/security/_pam_types.h (__LINUX_PAM_MINOR__): Update. * NEWS: Update. Resolves: https://github.com/linux-pam/linux-pam/issues/844
* meson: build Linux-PAM using mesonDmitry V. Levin2024-09-102-0/+13
| | | | | | | | | | On my non-representative hardware, the full build using autotools (./autogen.sh && CFLAGS=-O2 ./configure && make -j`nproc` && make -j`nproc` install) takes about 45 seconds. On the same hardware, the full build using meson (meson setup -Doptimization=2 dir && meson compile -C dir && meson install -C dir) takes just about 7.5 seconds.
* build: consistently include config.h unconditionallyDmitry V. Levin2024-08-281-3/+1
| | | | | | | | Given that in most places config.h is included unconditionally, there is no point in keeping remaining HAVE_CONFIG_H checks. Public header files do not use config.h and therefore are not affected by this change anyway.
* Introduce pam_i18n.hDmitry V. Levin2024-08-201-0/+17
| | | | | | | | | | Introduce a new internal header file that is going to be used for i18n definitions instead of providing those definitions via config.h. providing convenient assertion testing functionality. * libpam/include/pam_i18n.h: New file. * libpam/Makefile.am (noinst_HEADERS): Add include/pam_i18n.h.
* pam_inline.h: introduce zero_extend_signed_to_ull() and ↵Dmitry V. Levin2024-08-131-0/+20
| | | | | | sign_extend_unsigned_to_ll() Import these handy macros from strace project.
* libpam: add helper to compare strings in constant timeChristian Göttsche2024-04-131-0/+14
| | | | | | | | | Add a helper function to compare two strings for equality, that performs the same amount of operations based on the first argument, regardless of the length of the second argument, or the position of the first difference. This can be used as defense-in-depth mitigation against timing attacks of password comparisons.
* libpam: enclose macro parametersChristian Göttsche2024-02-221-12/+12
|
* libpam_internal: introduce pam_lineTobias Stoeckmann2024-02-061-267/+0
| | | | | | | | | | | The pam_assemble_line function is renamed to pam_line_assemble and moved into libpam_internal so it can be shared across libpam and the pam_env module. Applied renaming to all other relevant functions and data structures so it is easier to locate them in files. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_inline.h: Fix use of memset_explicit(3)Arseny Maslennikov2024-02-041-1/+1
| | | | | | | | | | | That function is being added to C23 with the same prototype as memset(3): void* memset_explicit(void*, int, size_t); Unlike bzero, it accepts the fill byte as an argument. Fixes: 19a292681789 ("libpam: introduce secure memory erasure helpers")
* libpam_internal: supply debug functionalityTobias Stoeckmann2024-01-241-3/+19
| | | | | | | | | | Move function bodies from headers into dedicated object files stored in libpam_internal. This library won't be installed. Keep the debug function body in header, even though disabled when building Linux-PAM, to stay API compatible with previous versions. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* libpam: clear config line memory before freeTobias Stoeckmann2024-01-051-0/+3
| | | | Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* libpam: allow custom escaped newline replacementTobias Stoeckmann2024-01-051-8/+13
| | | | | | | | To use _pam_assemble_line in pam_env, we must be able to modify the replacement of an escaped newline. The PAM configuration replaces it with a blank, while pam_env fully removes it. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* libpam: move line assembling functions to headerTobias Stoeckmann2024-01-051-0/+259
| | | | | | | | | | This follows the idiom of debug functions which reside in headers to allow their usage within libpam itself and its modules without adding modutil functions, i.e. extending the API. No functional change. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* treewide: fix typos in commentsTobias Stoeckmann2024-01-051-1/+1
| | | | Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* treewide: assume free(NULL) is no-opDmitry V. Levin2023-12-141-6/+3
| | | | | The C standard guarantees that if the argument of free() is a null pointer, no action occurs.
* libpam: mark debug output functions as potentially unusedBenny Baumann2023-11-141-0/+6
| | | | | | | | | | | | | | | Marking the functions _pam_output_debug and _pam_output_debug_info as potentially unused reduces the noise when compiling in debug mode. The warning is produced whenever _pam_macros.h is included, but no debug output is produced by the module. Just marking the function as static inline, which would have a similar effect, does not work for various reasons and instead produces new issues instead. Thus silencing this warning by telling the compiler about our intentions with these functions is the better approach. Signed-off-by: Benny Baumann <BenBE@geshi.org>
* libpam: mark _pam_output_debug as printf-style functionBenny Baumann2023-11-141-0/+1
| | | | | | | | Marking _pam_output_debug as printf-style function allows the compiler to check for potential errors at places where this function is called, like mismatches in the argument types or insufficient number of arguments. Signed-off-by: Benny Baumann <BenBE@geshi.org>
* libpam: avoid reserved variable names in macrosChristian Göttsche2023-08-071-13/+13
| | | | | | Identifiers staring with an underscores are reserved by the C standard. Also avoid double underscore, which are reserved by C++, in header file.
* tests: define PATH_MAX if not availablePino Toscano2023-05-111-0/+5
| | | | | | PATH_MAX is optional in POSIX, and not defined on GNU/Hurd; since these sources are tests, it is fine to hardcoded a fallback value that allows the tests to build and run.
* libpam: make use of secure memory erasureChristian Göttsche2023-02-281-2/+2
| | | | | | Non trivial changes: - erase responses in pam_get_authtok_internal() on error branch
* libpam: introduce secure memory erasure helpersChristian Göttsche2023-02-283-10/+84
| | | | | | | | | | Avoid compiler optimizations to elide the memory erasure by using a secure method: either memset_explicit() [C23], bzero_explicit() [glibc 2.25] or a manual memory barrier. Since the current helpers _pam_overwrite*() and _pam_drop_reply() are publicly exported, create new ones in "pam_inline.h" and deprecate the old ones.
* Enable format compiler warningsChristian Göttsche2023-01-301-4/+16
| | | | | | | | * libpam/include/pam_cc_compat.h (DIAG_PUSH_IGNORE_FORMAT_NONLITERAL, DIAG_POP_IGNORE_FORMAT_NONLITERAL): New macros. * libpam/pam_handlers.c (_pam_open_config_file): Use them to exempt usage of format string literals from a constant array. * m4/warn_lang_flags.m4 (gl_WARN_ADD): Add -Wformat=2.
* libpam: improve pam_modutil_search_key() docIker Pedrosa2022-07-151-1/+10
| | | | | | | * libpam/include/security/pam_modutil.h: Improve the pam_modutil_search_key() interface documentation. Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
* pam_inline.h: cleanup pam_read_passwords a bitDmitry V. Levin2020-07-151-5/+6
| | | | | | | * libpam/include/pam_inline.h (pam_read_passwords): Increment pptr once instead of using pptr+1 several times. This change is not expected to affect the code generated by the compiler as the latter is likely to perform the optimization itself.
* Move read_passwords function from pam_unix to pam_inline.hikerexxe2020-07-151-0/+50
| | | | | | | | | | | | | | [ldv: rewrote commit message] * modules/pam_unix/passverify.h (read_passwords): Remove prototype. * modules/pam_unix/passverify.c (read_passwords): Move ... * libpam/include/pam_inline.h: ... here, rename to pam_read_passwords, add static inline qualifiers. Include <unistd.h> and <errno.h>. * modules/pam_unix/unix_chkpwd.c: Include "pam_inline.h". (main): Replace read_passwords with pam_read_passwords. * modules/pam_unix/unix_update.c: Include "pam_inline.h". (set_password): Replace read_passwords with pam_read_passwords.
* Move check_user_in_passwd from pam_localuser.c to pam_modutilFabrice Fontaine2020-06-151-0/+5
| | | | | | | | | | | | | | | | | | Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> * modules/pam_localuser/pam_localuser.c: Include <security/pam_modutil.h>. (pam_sm_authenticate): Replace check_user_in_passwd with pam_modutil_check_user_in_passwd. (check_user_in_passwd): Rename to pam_modutil_check_user_in_passwd, move to ... * libpam/pam_modutil_check_user.c: ... new file. * libpam/Makefile.am (libpam_la_SOURCES): Add pam_modutil_check_user.c. * libpam/include/security/pam_modutil.h (pam_modutil_check_user_in_passwd): New function declaration. * libpam/libpam.map (LIBPAM_MODUTIL_1.4.1): New interface. Co-authored-by: Dmitry V. Levin <ldv@altlinux.org>
* Introduce test_assert.hDmitry V. Levin2020-05-211-0/+55
| | | | | | | | Introduce a new internal header file for definitions of handy macros providing convenient assertion testing functionality. * libpam/include/test_assert.h: New file. * libpam/Makefile.am (noinst_HEADERS): Add include/test_assert.h.
* Fix various typos found using codespell toolDmitry V. Levin2020-03-281-2/+2
|
* Introduce pam_str_skip_icase_prefix_len and pam_str_skip_icase_prefixDmitry V. Levin2020-03-191-0/+15
| | | | | | | | | | | | | | | | Every time I see a code like if (strncasecmp(argv, "remember=", 9) == 0) options->remember = strtol(&argv[9], NULL, 10); my eyes are bleeding. Similar to pam_str_skip_prefix_len() and pam_str_skip_prefix(), introduce a new helper inline function pam_str_skip_icase_prefix_len() and a new macro pam_str_skip_icase_prefix() on top of it, to be used in subsequent commits to cleanup the ugliness. * libpam/include/pam_inline.h (pam_str_skip_icase_prefix_len): New function. (pam_str_skip_icase_prefix): New macro.
* Introduce pam_str_skip_prefix_len and pam_str_skip_prefixDmitry V. Levin2020-03-191-0/+15
| | | | | | | | | | | | | | | Every time I see a code like if (!strncmp(*argv,"user_readenv=",13)) *user_readenv = atoi(13+*argv); my eyes are bleeding. Introduce a new helper inline function pam_str_skip_prefix_len() and a new macro pam_str_skip_prefix() on top of it, to be used in subsequent commits to cleanup the ugliness. * libpam/include/pam_inline.h: Include <string.h>. (pam_str_skip_prefix_len): New function. (pam_str_skip_prefix): New macro.
* Introduce pam_inline.hDmitry V. Levin2020-03-192-0/+50
| | | | | | | | | | Introduce a new internal header file for definitions of handly inline functions and macros providing some convenient functionality to libpam and its modules. * libpam/include/pam_cc_compat.h (PAM_SAME_TYPE): New macro. * libpam/include/pam_inline.h: New file. * libpam/Makefile.am (noinst_HEADERS): Add include/pam_inline.h.
* Fix remaining clang -Wcast-align compilation warningsDmitry V. Levin2020-03-191-0/+12
| | | | | | | | | | | | Introduce DIAG_PUSH_IGNORE_CAST_ALIGN and DIAG_POP_IGNORE_CAST_ALIGN macros, use them to silence remaining clang -Wcast-align compilation warnings. * libpam/include/pam_cc_compat.h (DIAG_PUSH_IGNORE_CAST_ALIGN, DIAG_POP_IGNORE_CAST_ALIGN): New macros. * modules/pam_access/pam_access.c: Include "pam_cc_compat.h". (from_match, network_netmask_match): Wrap inet_ntop invocations in DIAG_PUSH_IGNORE_CAST_ALIGN and DIAG_POP_IGNORE_CAST_ALIGN.
* Fix most of clang -Wcast-align compilation warningsDmitry V. Levin2020-03-191-0/+6
| | | | | | | | | | | | | | | | | | | Unlike gcc, clang is not smart enough to infer the alignment of structure fields, so add some alignment hints to the code. * libpam/include/pam_cc_compat.h (PAM_ATTRIBUTE_ALIGNED): New macro. * modules/pam_namespace/md5.h: Include "pam_cc_compat.h". (struct MD5Context): Add PAM_ATTRIBUTE_ALIGNED to "in" field. * modules/pam_namespace/md5.c [!(__i386__ || __x86_64__)] (uint8_aligned): New type. [!(__i386__ || __x86_64__)] (byteReverse): Use it instead of unsigned char. * modules/pam_timestamp/sha1.h: Include "pam_cc_compat.h". (struct sha1_context): Add PAM_ATTRIBUTE_ALIGNED to pending field. * modules/pam_unix/md5.h: Include "pam_cc_compat.h". (struct MD5Context): Add PAM_ATTRIBUTE_ALIGNED to "in" field. * modules/pam_unix/md5.c [!HIGHFIRST] (uint8_aligned): New type. [!HIGHFIRST] (byteReverse): Use it instead of unsigned char.
* New API call pam_start_confdir()Tomas Mraz2020-03-061-0/+5
| | | | To load PAM stack configurations from specified directory
* Fix remaining -Wcast-qual compilation warningsDmitry V. Levin2020-01-201-0/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduce a new internal header file with definitions of DIAG_PUSH_IGNORE_CAST_QUAL and DIAG_POP_IGNORE_CAST_QUAL macros, use them to temporary silence -Wcast-qual compilation warnings in various modules. * libpam/include/pam_cc_compat.h: New file. * libpam/Makefile.am (noinst_HEADERS): Add include/pam_cc_compat.h. * modules/pam_mkhomedir/pam_mkhomedir.c: Include "pam_cc_compat.h". (create_homedir): Wrap execve invocation in DIAG_PUSH_IGNORE_CAST_QUAL and DIAG_POP_IGNORE_CAST_QUAL. * modules/pam_namespace/pam_namespace.c: Include "pam_cc_compat.h". (pam_sm_close_session): Wrap the cast that discards ‘const’ qualifier in DIAG_PUSH_IGNORE_CAST_QUAL and DIAG_POP_IGNORE_CAST_QUAL. * modules/pam_tty_audit/pam_tty_audit.c: Include "pam_cc_compat.h". (nl_send): Wrap the cast that discards ‘const’ qualifier in DIAG_PUSH_IGNORE_CAST_QUAL and DIAG_POP_IGNORE_CAST_QUAL. * modules/pam_unix/pam_unix_acct.c: Include "pam_cc_compat.h". (_unix_run_verify_binary): Wrap execve invocation in DIAG_PUSH_IGNORE_CAST_QUAL and DIAG_POP_IGNORE_CAST_QUAL. * modules/pam_unix/pam_unix_passwd.c: Include "pam_cc_compat.h". (_unix_run_update_binary): Wrap execve invocation in DIAG_PUSH_IGNORE_CAST_QUAL and DIAG_POP_IGNORE_CAST_QUAL. * modules/pam_unix/passverify.c: Include "pam_cc_compat.h". (unix_update_shadow): Wrap the cast that discards ‘const’ qualifier in DIAG_PUSH_IGNORE_CAST_QUAL and DIAG_POP_IGNORE_CAST_QUAL. * modules/pam_unix/support.c: Include "pam_cc_compat.h". (_unix_run_helper_binary): Wrap execve invocation in DIAG_PUSH_IGNORE_CAST_QUAL and DIAG_POP_IGNORE_CAST_QUAL. * modules/pam_xauth/pam_xauth.c: Include "pam_cc_compat.h". (run_coprocess): Wrap execv invocation in DIAG_PUSH_IGNORE_CAST_QUAL and DIAG_POP_IGNORE_CAST_QUAL.
* Move the duplicated search_key function to pam_modutil.Tomas Mraz2018-12-111-0/+6
| | | | | | | | | | | * libpam/pam_modutil_searchkey.c: New source file with pam_modutil_search_key(). * libpam/Makefile.am: Add the pam_modutil_searchkey.c. * libpam/include/security/pam_modutil.h: Add the pam_modutil_search_key() prototype. * libpam/libpam.map: Add the pam_modutil_search_key() into a new version. * modules/pam_faildelay/pam_faildelay.c: Drop search_key() and use pam_modutil_search_key(). * modules/pam_umask/pam_umask.c: Likewise. * modules/pam_unix/support.c: Likewise.
* PAM_EXTERN isn't needed anymore, but don't remove it to not break lot ofThorsten Kukuk2016-03-291-0/+3
| | | | | | external code using it. * libpam/include/security/pam_modules.h: Readd PAM_EXTERN for compatibility
* Remove "--enable-static-modules" option and support fromThorsten Kukuk2016-03-291-66/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Linux-PAM. It was never official supported and was broken since years. * configure.ac: Remove --enable-static-modules option. * doc/man/pam_sm_acct_mgmt.3.xml: Remove PAM_EXTERN. * doc/man/pam_sm_authenticate.3.xml: Likewise. * doc/man/pam_sm_chauthtok.3.xml: Likewise. * doc/man/pam_sm_close_session.3.xml: Likewise. * doc/man/pam_sm_open_session.3.xml: Likewise. * doc/man/pam_sm_setcred.3.xml: Likewise. * libpam/Makefile.am: Remove STATIC_MODULES cases. * libpam/include/security/pam_modules.h: Remove PAM_STATIC parts. * libpam/pam_dynamic.c: Likewise. * libpam/pam_handlers.c: Likewise. * libpam/pam_private.h: Likewise. * libpam/pam_static.c: Remove file. * libpam/pam_static_modules.h: Remove header file. * modules/pam_access/pam_access.c: Remove PAM_EXTERN and PAM_STATIC parts. * modules/pam_cracklib/pam_cracklib.c: Likewise. * modules/pam_debug/pam_debug.c: Likewise. * modules/pam_deny/pam_deny.c: Likewise. * modules/pam_echo/pam_echo.c: Likewise. * modules/pam_env/pam_env.c: Likewise. * modules/pam_exec/pam_exec.c: Likewise. * modules/pam_faildelay/pam_faildelay.c: Likewise. * modules/pam_filter/pam_filter.c: Likewise. * modules/pam_ftp/pam_ftp.c: Likewise. * modules/pam_group/pam_group.c: Likewise. * modules/pam_issue/pam_issue.c: Likewise. * modules/pam_keyinit/pam_keyinit.c: Likewise. * modules/pam_lastlog/pam_lastlog.c: Likewise. * modules/pam_limits/pam_limits.c: Likewise. * modules/pam_listfile/pam_listfile.c: Likewise. * modules/pam_localuser/pam_localuser.c: Likewise. * modules/pam_loginuid/pam_loginuid.c: Likewise. * modules/pam_mail/pam_mail.c: Likewise. * modules/pam_mkhomedir/pam_mkhomedir.c: Likewise. * modules/pam_motd/pam_motd.c: Likewise. * modules/pam_namespace/pam_namespace.c: Likewise. * modules/pam_nologin/pam_nologin.c: Likewise. * modules/pam_permit/pam_permit.c: Likewise. * modules/pam_pwhistory/pam_pwhistory.c: Likewise. * modules/pam_rhosts/pam_rhosts.c: Likewise. * modules/pam_rootok/pam_rootok.c: Likewise. * modules/pam_securetty/pam_securetty.c: Likewise. * modules/pam_selinux/pam_selinux.c: Likewise. * modules/pam_sepermit/pam_sepermit.c: Likewise. * modules/pam_shells/pam_shells.c: Likewise. * modules/pam_stress/pam_stress.c: Likewise. * modules/pam_succeed_if/pam_succeed_if.c: Likewise. * modules/pam_tally/pam_tally.c: Likewise. * modules/pam_tally2/pam_tally2.c: Likewise. * modules/pam_time/pam_time.c: Likewise. * modules/pam_timestamp/pam_timestamp.c: Likewise. * modules/pam_tty_audit/pam_tty_audit.c: Likewise. * modules/pam_umask/pam_umask.c: Likewise. * modules/pam_userdb/pam_userdb.c: Likewise. * modules/pam_warn/pam_warn.c: Likewise. * modules/pam_wheel/pam_wheel.c: Likewise. * modules/pam_xauth/pam_xauth.c: Likewise. * modules/pam_unix/Makefile.am: Remove STATIC_MODULES part. * modules/pam_unix/pam_unix_acct.c: Remove PAM_STATIC part. * modules/pam_unix/pam_unix_auth.c: Likewise. * modules/pam_unix/pam_unix_passwd.c: Likewise. * modules/pam_unix/pam_unix_sess.c: Likewise. * modules/pam_unix/pam_unix_static.c: Removed. * modules/pam_unix/pam_unix_static.h: Removed. * po/POTFILES.in: Remove removed files. * tests/tst-dlopen.c: Remove PAM_STATIC part.
* Introduce pam_modutil_sanitize_helper_fdsDmitry V. Levin2014-01-271-0/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change introduces pam_modutil_sanitize_helper_fds - a new function that redirects standard descriptors and closes all other descriptors. pam_modutil_sanitize_helper_fds supports three types of input and output redirection: - PAM_MODUTIL_IGNORE_FD: do not redirect at all. - PAM_MODUTIL_PIPE_FD: redirect to a pipe. For stdin, it is implemented by creating a pipe, closing its write end, and redirecting stdin to its read end. Likewise, for stdout/stderr it is implemented by creating a pipe, closing its read end, and redirecting to its write end. Unlike stdin redirection, stdout/stderr redirection to a pipe has a side effect that a process writing to such descriptor should be prepared to handle SIGPIPE appropriately. - PAM_MODUTIL_NULL_FD: redirect to /dev/null. For stdin, it is implemented via PAM_MODUTIL_PIPE_FD because there is no functional difference. For stdout/stderr, it is classic redirection to /dev/null. PAM_MODUTIL_PIPE_FD is usually more suitable due to linux kernel security restrictions, but when the helper process might be writing to the corresponding descriptor and termination of the helper process by SIGPIPE is not desirable, one should choose PAM_MODUTIL_NULL_FD. * libpam/pam_modutil_sanitize.c: New file. * libpam/Makefile.am (libpam_la_SOURCES): Add it. * libpam/include/security/pam_modutil.h (pam_modutil_redirect_fd, pam_modutil_sanitize_helper_fds): New declarations. * libpam/libpam.map (LIBPAM_MODUTIL_1.1.9): New interface. * modules/pam_exec/pam_exec.c (call_exec): Use pam_modutil_sanitize_helper_fds. * modules/pam_mkhomedir/pam_mkhomedir.c (create_homedir): Likewise. * modules/pam_unix/pam_unix_acct.c (_unix_run_verify_binary): Likewise. * modules/pam_unix/pam_unix_passwd.c (_unix_run_update_binary): Likewise. * modules/pam_unix/support.c (_unix_run_helper_binary): Likewise. * modules/pam_xauth/pam_xauth.c (run_coprocess): Likewise. * modules/pam_unix/support.h (MAX_FD_NO): Remove.
* Add missing includes for types used in the pam_modutil.h.Tomas Mraz2012-02-101-0/+5
| | | | * libpam/include/security/pam_modutil.h: Add missing includes for used types.
* Relevant BUGIDs:Dmitry V. Levin2010-10-031-0/+24
| | | | | | | | | | | | | | | | | | | | | Purpose of commit: bugfix Commit summary: --------------- 2010-10-04 Dmitry V. Levin <ldv@altlinux.org> * libpam/pam_modutil_priv.c: New file. * libpam/Makefile.am (libpam_la_SOURCES): Add it. * libpam/include/security/pam_modutil.h (struct pam_modutil_privs, PAM_MODUTIL_DEF_PRIVS, pam_modutil_drop_priv, pam_modutil_regain_priv): New declarations. * libpam/libpam.map (LIBPAM_MODUTIL_1.1.3): New interface. * modules/pam_env/pam_env.c (handle_env): Use new pam_modutil interface. * modules/pam_mail/pam_mail.c (_do_mail): Likewise. * modules/pam_xauth/pam_xauth.c (check_acl, pam_sm_open_session, pam_sm_close_session): Likewise. (pam_sm_open_session): Remove redundant fchown call. Fixes CVE-2010-3430, CVE-2010-3431.
* Relevant BUGIDs: 2892529Thorsten Kukuk2009-12-081-2/+2
| | | | | | | | | | | | | | | | | | | | | Purpose of commit: bugfix Commit summary: --------------- 2009-12-08 Thorsten Kukuk <kukuk@thkukuk.de> * configure.in: Rename DEBUG to PAM_DEBUG. * libpam/pam_env.c: Likewise * libpam/pam_handlers.c: Likewise * libpam/pam_miscc.c: Likewise * libpam/pam_password.c: Likewise * libpam/include/security/_pam_macros.h: Likewise * libpamc/test/modules/pam_secret.c: Likewise * modules/pam_group/pam_group.c: Likewise * modules/pam_listfile/pam_listfile.c: Likewise * modules/pam_unix/pam_unix_auth.c: Likewise * modules/pam_unix/pam_unix_passwd.c: Likewise
* Relevant BUGIDs:Thorsten Kukuk2009-11-101-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | Purpose of commit: regression fix Commit summary: --------------- 2009-11-10 Thorsten Kukuk <kukuk@suse.de> * doc/man/pam_get_authtok.3.xml: Document pam_get_authtok_noverify and pam_get_authtok_verify. * libpam/Makefile.am (libpam_la_LDFLAGS): Bump revesion of libpam. * libpam/pam_get_authtok.c (pam_get_authtok_internal): Renamed from pam_get_authtok, add flags argument, always check return values. * modules/pam_cracklib/pam_cracklib.c (pam_sm_chauthtok): Use pam_get_authtok_noverify and pam_get_authtok_verify. * libpam/include/security/pam_ext.h: Add prototypes for pam_get_authtok_noverify and pam_get_authtok_verify. * libpam/libpam.map: Add new pam_get_authtok_* functions.
* Relevant BUGIDs:Thorsten Kukuk2008-12-111-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Purpose of commit: new feature Commit summary: --------------- 2008-12-10 Thorsten Kukuk <kukuk@thkukuk.de> * doc/man/pam_item_types_ext.inc.xml: Document PAM_AUTHTOK_TYPE. * libpam/pam_end.c (pam_end): Free authtok_type. * tests/tst-pam_get_item.c: Add PAM_AUTHTOK_TYPE as test case. * tests/tst-pam_set_item.c: Likewise. * libpam/pam_start.c (pam_start): Initialize xdisplay, xauth and authtok_type. * libpam/pam_get_authtok.c (pam_get_authtok): Rename "type" to "authtok_type". * modules/pam_cracklib/pam_cracklib.8.xml: Replace "type=" with "authtok_type=". * doc/man/pam_get_authtok.3.xml: Document authtok_type argument. * modules/pam_cracklib/pam_cracklib.c (pam_sm_chauthtok): Set type= argument as PAM_AUTHTOK_TYPE item. * libpam/pam_get_authtok.c (pam_get_authtok): If no type argument given, use PAM_AUTHTOK_TYPE item. * libpam/pam_item.c (pam_get_item): Fetch PAM_AUTHTOK_TYPE item. (pam_set_item): Store PAM_AUTHTOK_TYPE item. * libpam/pam_private.h: Add authtok_type to pam_handle. * libpam/include/security/_pam_types.h (PAM_AUTHTOK_TYPE): New.
* Relevant BUGIDs:Thorsten Kukuk2008-12-031-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | Purpose of commit: new feature Commit summary: --------------- 2008-12-03 Thorsten Kukuk <kukuk@suse.de> * doc/man/Makefile.am: Add pam_get_authtok.3.xml. * doc/man/pam_get_authtok.3.xml: New. * libpam/Makefile.am: Add pam_get_authtok.c. * libpam/libpam.map: Export pam_get_authtok. * libpam/pam_get_authtok.c: New. * libpam/pam_private.h: Add mod_argc and mod_argv to pam_handle. * libpam_include/security/pam_ext.h: Add pam_get_authtok prototype. * modules/pam_cracklib/pam_cracklib.c: Use pam_get_authtok. * modules/pam_pwhistory/pam_pwhistory.c: Likewise. * po/POTFILES.in: Add libpam/pam_get_authtok.c. * xtests/tst-pam_cracklib1.c: Adjust error codes. * modules/pam_timestamp/Makefile.am: Remove hmactest.c from EXTRA_DIST. * po/*.po: Regenerated.
* Relevant BUGIDs:Thorsten Kukuk2008-01-281-3/+3
| | | | | | | | | | | | | | | | | Purpose of commit: cleanup Commit summary: --------------- 2008-01-28 Thorsten Kukuk <kukuk@thkukuk.de> * libpam/pam_audit.c: Include pam_modutil_private.h. * libpam/pam_item.c (pam_set_item): Fix compiler warning. * libpam/pam_end.c (pam_end): Cast to correct pointer type. * libpam/include/security/_pam_macros.h (_pam_overwrite_n): Use unsigned int.
* Relevant BUGIDs:Tomas Mraz2007-12-071-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Purpose of commit: new feature and cleanup Commit summary: --------------- 2007-12-07 Tomas Mraz <t8m@centrum.cz> * libpam/libpam.map: Add LIBPAM_MODUTIL_1.1 version. * libpam/pam_audit.c: Add _pam_audit_open() and pam_modutil_audit_write(). (_pam_auditlog): Call _pam_audit_open(). * libpam/include/security/pam_modutil.h: Add pam_modutil_audit_write(). * modules/pam_access/pam_access.8.xml: Add noaudit option. Document auditing. * modules/pam_access/pam_access.c: Move fs, sep, pam_access_debug, and only_new_group_syntax variables to struct login_info. Add noaudit member. (_parse_args): Adjust for the move of variables and add support for noaudit option. (group_match): Add debug parameter. (string_match): Likewise. (network_netmask_match): Likewise. (login_access): Adjust for the move of variables. Add nonall_match. Add call to pam_modutil_audit_write(). (list_match): Adjust for the move of variables. (user_match): Likewise. (from_match): Likewise. (pam_sm_authenticate): Call _parse_args() earlier. * modules/pam_limits/pam_limits.8.xml: Add noaudit option. Document auditing. * modules/pam_limits/pam_limits.c (_pam_parse): Add noaudit option. (setup_limits): Call pam_modutil_audit_write(). * modules/pam_time/pam_time.8.xml: Add debug and noaudit options. Document auditing. * modules/pam_time/pam_time.c: Add option parsing (_pam_parse()). (check_account): Call _pam_parse(). Call pam_modutil_audit_write() and pam_syslog() on login denials.
* Relevant BUGIDs:Tomas Mraz2007-12-062-0/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Purpose of commit: new feature Commit summary: --------------- 2007-12-06 Eamon Walsh <ewalsh@tycho.nsa.gov> * libpam/include/security/_pam_macros.h: Add _pam_overwrite_n() macro. * libpam/include/security/_pam_types.h: Add PAM_XDISPLAY, PAM_XAUTHDATA items, pam_xauth_data struct. * libpam/pam_item.c (pam_set_item, pam_get_item): Handle PAM_XDISPLAY and PAM_XAUTHDATA items. * libpam/pam_end.c (pam_end): Destroy the new items. * libpam/pam_private.h (pam_handle): Add data members for new items. Add prototype for _pam_memdup. * libpam/pam_misc.c: Add _pam_memdup. * doc/man/Makefile.am: Add pam_xauth_data.3. Replace pam_item_types.inc.xml with pam_item_types_std.inc.xml and pam_item_types_ext.inc.xml. * doc/man/pam_get_item.3.xml: Replace pam_item_types.inc.xml with pam_item_types_std.inc.xml and pam_item_types_ext.inc.xml. * doc/man/pam_set_item.3.xml: Likewise. * doc/man/pam_item_types.inc.xml: Removed file. * doc/man/pam_item_types_ext.inc.xml: New file. * doc/man/pam_item_types_std.inc.xml: New file.
* Relevant BUGIDs:Thorsten Kukuk2006-06-141-106/+0
| | | | | | | | | Purpose of commit: cleanup Commit summary: --------------- Really remove pam_malloc.* files.
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-08 05:23:46 +0000