aboutsummaryrefslogtreecommitdiff
path: root/libpam/libpam.map
Commit message (Collapse)AuthorAgeFilesLines
* Move check_user_in_passwd from pam_localuser.c to pam_modutilFabrice Fontaine2020-06-151-0/+5
| | | | | | | | | | | | | | | | | | Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> * modules/pam_localuser/pam_localuser.c: Include <security/pam_modutil.h>. (pam_sm_authenticate): Replace check_user_in_passwd with pam_modutil_check_user_in_passwd. (check_user_in_passwd): Rename to pam_modutil_check_user_in_passwd, move to ... * libpam/pam_modutil_check_user.c: ... new file. * libpam/Makefile.am (libpam_la_SOURCES): Add pam_modutil_check_user.c. * libpam/include/security/pam_modutil.h (pam_modutil_check_user_in_passwd): New function declaration. * libpam/libpam.map (LIBPAM_MODUTIL_1.4.1): New interface. Co-authored-by: Dmitry V. Levin <ldv@altlinux.org>
* New API call pam_start_confdir()Tomas Mraz2020-03-061-0/+5
| | | | To load PAM stack configurations from specified directory
* Move the duplicated search_key function to pam_modutil.Tomas Mraz2018-12-111-0/+5
| | | | | | | | | | | * libpam/pam_modutil_searchkey.c: New source file with pam_modutil_search_key(). * libpam/Makefile.am: Add the pam_modutil_searchkey.c. * libpam/include/security/pam_modutil.h: Add the pam_modutil_search_key() prototype. * libpam/libpam.map: Add the pam_modutil_search_key() into a new version. * modules/pam_faildelay/pam_faildelay.c: Drop search_key() and use pam_modutil_search_key(). * modules/pam_umask/pam_umask.c: Likewise. * modules/pam_unix/support.c: Likewise.
* Introduce pam_modutil_sanitize_helper_fdsDmitry V. Levin2014-01-271-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change introduces pam_modutil_sanitize_helper_fds - a new function that redirects standard descriptors and closes all other descriptors. pam_modutil_sanitize_helper_fds supports three types of input and output redirection: - PAM_MODUTIL_IGNORE_FD: do not redirect at all. - PAM_MODUTIL_PIPE_FD: redirect to a pipe. For stdin, it is implemented by creating a pipe, closing its write end, and redirecting stdin to its read end. Likewise, for stdout/stderr it is implemented by creating a pipe, closing its read end, and redirecting to its write end. Unlike stdin redirection, stdout/stderr redirection to a pipe has a side effect that a process writing to such descriptor should be prepared to handle SIGPIPE appropriately. - PAM_MODUTIL_NULL_FD: redirect to /dev/null. For stdin, it is implemented via PAM_MODUTIL_PIPE_FD because there is no functional difference. For stdout/stderr, it is classic redirection to /dev/null. PAM_MODUTIL_PIPE_FD is usually more suitable due to linux kernel security restrictions, but when the helper process might be writing to the corresponding descriptor and termination of the helper process by SIGPIPE is not desirable, one should choose PAM_MODUTIL_NULL_FD. * libpam/pam_modutil_sanitize.c: New file. * libpam/Makefile.am (libpam_la_SOURCES): Add it. * libpam/include/security/pam_modutil.h (pam_modutil_redirect_fd, pam_modutil_sanitize_helper_fds): New declarations. * libpam/libpam.map (LIBPAM_MODUTIL_1.1.9): New interface. * modules/pam_exec/pam_exec.c (call_exec): Use pam_modutil_sanitize_helper_fds. * modules/pam_mkhomedir/pam_mkhomedir.c (create_homedir): Likewise. * modules/pam_unix/pam_unix_acct.c (_unix_run_verify_binary): Likewise. * modules/pam_unix/pam_unix_passwd.c (_unix_run_update_binary): Likewise. * modules/pam_unix/support.c (_unix_run_helper_binary): Likewise. * modules/pam_xauth/pam_xauth.c (run_coprocess): Likewise. * modules/pam_unix/support.h (MAX_FD_NO): Remove.
* Relevant BUGIDs:Dmitry V. Levin2010-10-031-0/+6
| | | | | | | | | | | | | | | | | | | | | Purpose of commit: bugfix Commit summary: --------------- 2010-10-04 Dmitry V. Levin <ldv@altlinux.org> * libpam/pam_modutil_priv.c: New file. * libpam/Makefile.am (libpam_la_SOURCES): Add it. * libpam/include/security/pam_modutil.h (struct pam_modutil_privs, PAM_MODUTIL_DEF_PRIVS, pam_modutil_drop_priv, pam_modutil_regain_priv): New declarations. * libpam/libpam.map (LIBPAM_MODUTIL_1.1.3): New interface. * modules/pam_env/pam_env.c (handle_env): Use new pam_modutil interface. * modules/pam_mail/pam_mail.c (_do_mail): Likewise. * modules/pam_xauth/pam_xauth.c (check_acl, pam_sm_open_session, pam_sm_close_session): Likewise. (pam_sm_open_session): Remove redundant fchown call. Fixes CVE-2010-3430, CVE-2010-3431.
* Relevant BUGIDs:Thorsten Kukuk2009-11-101-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | Purpose of commit: regression fix Commit summary: --------------- 2009-11-10 Thorsten Kukuk <kukuk@suse.de> * doc/man/pam_get_authtok.3.xml: Document pam_get_authtok_noverify and pam_get_authtok_verify. * libpam/Makefile.am (libpam_la_LDFLAGS): Bump revesion of libpam. * libpam/pam_get_authtok.c (pam_get_authtok_internal): Renamed from pam_get_authtok, add flags argument, always check return values. * modules/pam_cracklib/pam_cracklib.c (pam_sm_chauthtok): Use pam_get_authtok_noverify and pam_get_authtok_verify. * libpam/include/security/pam_ext.h: Add prototypes for pam_get_authtok_noverify and pam_get_authtok_verify. * libpam/libpam.map: Add new pam_get_authtok_* functions.
* Relevant BUGIDs:Thorsten Kukuk2008-12-031-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | Purpose of commit: new feature Commit summary: --------------- 2008-12-03 Thorsten Kukuk <kukuk@suse.de> * doc/man/Makefile.am: Add pam_get_authtok.3.xml. * doc/man/pam_get_authtok.3.xml: New. * libpam/Makefile.am: Add pam_get_authtok.c. * libpam/libpam.map: Export pam_get_authtok. * libpam/pam_get_authtok.c: New. * libpam/pam_private.h: Add mod_argc and mod_argv to pam_handle. * libpam_include/security/pam_ext.h: Add pam_get_authtok prototype. * modules/pam_cracklib/pam_cracklib.c: Use pam_get_authtok. * modules/pam_pwhistory/pam_pwhistory.c: Likewise. * po/POTFILES.in: Add libpam/pam_get_authtok.c. * xtests/tst-pam_cracklib1.c: Adjust error codes. * modules/pam_timestamp/Makefile.am: Remove hmactest.c from EXTRA_DIST. * po/*.po: Regenerated.
* Relevant BUGIDs:Tomas Mraz2007-12-071-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Purpose of commit: new feature and cleanup Commit summary: --------------- 2007-12-07 Tomas Mraz <t8m@centrum.cz> * libpam/libpam.map: Add LIBPAM_MODUTIL_1.1 version. * libpam/pam_audit.c: Add _pam_audit_open() and pam_modutil_audit_write(). (_pam_auditlog): Call _pam_audit_open(). * libpam/include/security/pam_modutil.h: Add pam_modutil_audit_write(). * modules/pam_access/pam_access.8.xml: Add noaudit option. Document auditing. * modules/pam_access/pam_access.c: Move fs, sep, pam_access_debug, and only_new_group_syntax variables to struct login_info. Add noaudit member. (_parse_args): Adjust for the move of variables and add support for noaudit option. (group_match): Add debug parameter. (string_match): Likewise. (network_netmask_match): Likewise. (login_access): Adjust for the move of variables. Add nonall_match. Add call to pam_modutil_audit_write(). (list_match): Adjust for the move of variables. (user_match): Likewise. (from_match): Likewise. (pam_sm_authenticate): Call _parse_args() earlier. * modules/pam_limits/pam_limits.8.xml: Add noaudit option. Document auditing. * modules/pam_limits/pam_limits.c (_pam_parse): Add noaudit option. (setup_limits): Call pam_modutil_audit_write(). * modules/pam_time/pam_time.8.xml: Add debug and noaudit options. Document auditing. * modules/pam_time/pam_time.c: Add option parsing (_pam_parse()). (check_account): Call _pam_parse(). Call pam_modutil_audit_write() and pam_syslog() on login denials.
* Relevant BUGIDs:Thorsten Kukuk2006-06-141-9/+0
| | | | | | | | | | | | | | | | | | | | Purpose of commit: cleanup Commit summary: --------------- 2006-06-14 Thorsten Kukuk <kukuk@thkukuk.de> * configure.in: Remove --enable-memory-debug, add option to disable prelude if installed. * modules/pam_tally/pam_tally.c: Remove MEMORY_DEBUG * modules/pam_filter/upperLOWER/upperLOWER.c: Likewise. * modules/pam_unix/unix_chkpwd.c: Likewise. * libpam/include/security/_pam_types.h: Likewise. * libpam/libpam.map: Remove LIBPAM_MALLOC_DEBUG export. * libpam/pam_malloc.c: Remove file. * libpam/Makefile.am: Remove pam_malloc.c and pam_malloc.h.
* Relevant BUGIDs:Tomas Mraz2005-09-211-0/+15
| | | | | | | | Purpose of commit: new feature Commit summary: --------------- Moved functions from pammodutil to libpam.
* Relevant BUGIDs: noneThorsten Kukuk2005-09-031-0/+2
| | | | | | | | | Purpose of commit: new feature Commit summary: --------------- Add pam_syslog to unify log messages from PAM modules.
* Relevant BUGIDs: noneThorsten Kukuk2005-09-011-0/+6
| | | | | | | | | | Purpose of commit: new feature Commit summary: --------------- Add PAM extensions pam_*prompt, pam_*error and pam_*info for usage by modules to libpam, add new pam_ext.h header file with prototypes.
* Relevant BUGIDs: noneThorsten Kukuk2005-08-181-5/+0
| | | | | | | | | Purpose of commit: cleanup Commit summary: --------------- Remove unused files.
* Relevant BUGIDs: noneThorsten Kukuk2005-08-161-0/+38
Purpose of commit: new feature Commit summary: --------------- Big "automake/autoconf/libtool" commit
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-08 20:13:33 +0000