aboutsummaryrefslogtreecommitdiff
path: root/libpam/pam_dispatch.c
Commit message (Collapse)AuthorAgeFilesLines
* libpam: enclose macro parametersChristian Göttsche2024-02-221-2/+2
|
* treewide: fix typos in commentsTobias Stoeckmann2024-01-051-1/+1
| | | | Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* libpam: fix indentationChristian Göttsche2024-01-041-1/+1
| | | | Reported by clang-tidy.
* treewide: fix typos in comments and documentationTobias Stoeckmann2023-12-181-1/+1
| | | | Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* libpam: print module name in debug error messageBenny Baumann2023-11-131-1/+2
| | | | | | | | | Previously, there was a missing argument to the debug output within _pam_dispatch whe _pam_dispatch_aux returned an error. This updates the debug message in that situation to include the module name that was involved with the failure. Signed-off-by: Benny Baumann <BenBE@geshi.org>
* libpam: simplify IF_NO_PAMHTobias Stoeckmann2023-11-121-2/+2
| | | | | | | | | | | | | The first argument of IF_NO_PAMH is supposed to be the name of the function which was called with pamh being NULL. With __FUNCTION__ the name can be inserted automatically by the compiler which is also already done with D macro. Fixes a bug in which _pam_drop_env erroneously logs with the function name _pam_make_env. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_dispatch: fix unread store statementikerexxe2020-11-031-1/+0
| | | | | libpam/pam_dispatch: remove store statement since the value is never read.
* Add grantor field to audit records of libpam.Tomas Mraz2014-09-051-7/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | The grantor field gives audit trail of PAM modules which granted access for successful return from libpam calls. In case of failed return the grantor field is set to '?'. libpam/pam_account.c (pam_acct_mgmt): Remove _pam_auditlog() call. libpam/pam_auth.c (pam_authenticate, pam_setcred): Likewise. libpam/pam_password.c (pam_chauthtok): Likewise. libpam/pam_session.c (pam_open_session, pam_close_session): Likewise. libpam/pam_audit.c (_pam_audit_writelog): Add grantors parameter, add grantor= field to the message if grantors is set. (_pam_list_grantors): New function creating the string with grantors list. (_pam_auditlog): Add struct handler pointer parameter, call _pam_list_grantors() to list the grantors from the handler list. (_pam_audit_end): Add NULL handler parameter to _pam_auditlog() call. (pam_modutil_audit_write): Add NULL grantors parameter to _pam_audit_writelog(). libpam/pam_dispatch.c (_pam_dispatch_aux): Set h->grantor where appropriate. (_pam_clear_grantors): New function to clear grantor field of handler. (_pam_dispatch): Call _pam_clear_grantors() before executing the stack. Call _pam_auditlog() when appropriate. libpam/pam_handlers.c (extract_modulename): Do not allow empty module name or just "?" to avoid confusing audit trail. (_pam_add_handler): Test for NULL return from extract_modulename(). Clear grantor field of handler. libpam/pam_private.h: Add grantor field to struct handler, add handler pointer parameter to _pam_auditlog().
* Fix whitespace issuesDmitry V. Levin2011-10-261-4/+4
| | | | | | Cleanup trailing whitespaces, indentation that uses spaces before tabs, and blank lines at EOF. Make the project free of warnings reported by git diff --check 4b825dc642cb6eb9a060e54bf8d69288fbee4904 HEAD
* Relevant BUGIDs: bugzilla.novell.com#470337Thorsten Kukuk2009-02-171-8/+4
| | | | | | | | | | | | | | | Purpose of commit: bugfix Commit summary: --------------- 2009-02-17 Thorsten Kukuk <kukuk@thkukuk.de> * doc/man/pam_sm_chauthtok.3.xml: Document that sufficient can break the PRELIM_CHECK chain. * libpam/pam_dispatch.c: Don't freeze chain for chauthtok [bugzilla.novell.com#470337]
* Relevant BUGIDs:Thorsten Kukuk2008-12-031-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | Purpose of commit: new feature Commit summary: --------------- 2008-12-03 Thorsten Kukuk <kukuk@suse.de> * doc/man/Makefile.am: Add pam_get_authtok.3.xml. * doc/man/pam_get_authtok.3.xml: New. * libpam/Makefile.am: Add pam_get_authtok.c. * libpam/libpam.map: Export pam_get_authtok. * libpam/pam_get_authtok.c: New. * libpam/pam_private.h: Add mod_argc and mod_argv to pam_handle. * libpam_include/security/pam_ext.h: Add pam_get_authtok prototype. * modules/pam_cracklib/pam_cracklib.c: Use pam_get_authtok. * modules/pam_pwhistory/pam_pwhistory.c: Likewise. * po/POTFILES.in: Add libpam/pam_get_authtok.c. * xtests/tst-pam_cracklib1.c: Adjust error codes. * modules/pam_timestamp/Makefile.am: Remove hmactest.c from EXTRA_DIST. * po/*.po: Regenerated.
* Relevant BUGIDs:Tomas Mraz2007-10-191-17/+49
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Purpose of commit: new feature Commit summary: --------------- 2007-10-19 Tomas Mraz <t8m@centrum.cz> * xtests/tst-pam_access1.c: Use different name for user and group. * xtests/tst-pam_access1.sh: Likewise. * xtests/tst-pam_access2.c: Likewise. * xtests/tst-pam_access2.sh: Likewise. * xtests/tst-pam_access4.c: Likewise. * xtests/tst-pam_access4.sh: Likewise. * xtests/group.conf: Likewise. * xtests/tst-pam_group1.c: Likewise. * xtests/tst-pam_group1.sh: Likewise. * libpam/pam_dispatch.c (_pam_dispatch_aux): Save states for substacks, record substack level, skip over virtual substack modules, implement evaluation of done, die, reset and jumps in substacks. Also fixes too far jumps in substacks. * libpam/pam_end.c (pam_end): Drop substack evaluation states. * libpam/pam_handlers.c (_pam_parse_conf_file): Add substack level parameter, instead of must_fail use handler_type needed for virtual substack modules. (_pam_load_conf_file): Add substack level parameter. (_pam_init_handlers): Substack level parameter added to _pam_parse_conf_file() calls. (_pam_load_module): New function. (_pam_add_handler): Refactor code into the _pam_load_module(). Add support for virtual substack modules. * libpam/pam_private.h: Rename must_fail to handler_type, add stack_level to struct handler. Define handler type constants. Add struct for substack evaluation states. Define constant for maximum substack level. Add substack states pointer to former state struct. * libpam/pam_start.c (pam_start): Initialize pointer to substack states. * doc/man/pam.conf-syntax.xml: Document substack control. * xtests/Makefile.am: Add new tests for substack evaluation. * xtests/run_xtests.sh: Support multiple .pamd files in a test. * xtests/tst-pam_authfail.pamd: New tests for substack evaluation. * xtests/tst-pam_authsucceed.pamd: Likewise. * xtests/tst-pam_substack1.pamd: Likewise. * xtests/tst-pam_substack1a.pamd: Likewise. * xtests/tst-pam_substack1.sh: Likewise. * xtests/tst-pam_substack2.pamd: Likewise. * xtests/tst-pam_substack2a.pamd: Likewise. * xtests/tst-pam_substack2.sh: Likewise. * xtests/tst-pam_substack3.pamd: Likewise. * xtests/tst-pam_substack3a.pamd: Likewise. * xtests/tst-pam_substack3.sh: Likewise. * xtests/tst-pam_substack4.pamd: Likewise. * xtests/tst-pam_substack4a.pamd: Likewise. * xtests/tst-pam_substack4.sh: Likewise. * xtests/tst-pam_substack5.pamd: Likewise. * xtests/tst-pam_substack5a.pamd: Likewise. * xtests/tst-pam_substack5.sh: Likewise.
* Relevant BUGIDs: BRC#196859Thorsten Kukuk2006-08-011-2/+5
| | | | | | | | | | | | | | Purpose of commit: bugfix Commit summary: --------------- 2006-08-01 Thorsten Kukuk <kukuk@thkukuk.de> * libpam/Makefile.am: Bump patchlevel of libpam. * libpam/pam_dispatch.c (_pam_dispatch_aux): If [return=die] or [return=bad] is used, don't return PAM_IGNORE. Based on patch by Tomas Mraz <t8m@centrum.cz>, [BRC#196859].
* Relevant BUGIDs: noneThorsten Kukuk2005-09-041-5/+5
| | | | | | | | | Purpose of commit: cleanup Commit summary: --------------- Replace _pam_system_log with pam_syslog.
* Relevant BUGIDs: noneThorsten Kukuk2005-09-031-0/+3
| | | | | | | | | Purpose of commit: new feature Commit summary: --------------- Add pam_syslog to unify log messages from PAM modules.
* Relevant BUGIDs: noneThorsten Kukuk2005-06-091-6/+5
| | | | | | | | | | Purpose of commit: cleanup Commit summary: --------------- Fix all occurrence of dereferencing type-punned pointer will break strict-aliasing rules warnings
* Relevant BUGIDs: 629251, Red Hat bz 143750Tomas Mraz2005-01-071-4/+10
| | | | | | | | | | Purpose of commit: bugfix Commit summary: --------------- libpam: don't return PAM_IGNORE if the impression is positive and using cached chain pam_nologin: don't overwrite return value with return from pam_get_item
* Relevant BUGIDs: 770645Steve Langasek2003-07-131-2/+2
| | | | | | | | | | | | | Purpose of commit: cleanup Commit summary: --------------- Fix the many compile-time warnings caused by features.h being included before our _pam_aconf.h. This should make it much easier to find other bugs. Also, call config.status instead of configure, to allow rebuilding generated files with the same options.
* Relevant BUGIDs: 468724Andrew G. Morgan2001-10-111-20/+48
| | | | | | | | | | | | | | | | | | | Purpose of commit: bugfix Commit summary: --------------- Legacy behavior for pam_close_session and pam_setcred was not sufficient. Basically, it appears to be common practice for some applications to call these functions without first calling pam_authenticate and pam_open_session which would have frozen the auth and session module stacks. The new behavior is to treat the returns of these secondary functions as authoritative when navigating the stack in the absence of a chain-freezing first set of calls. pam_chauthtok should not benefit from this behavior, and there does not appear to be a justification for using an event like this to freeze the stack outright - legacy behavior did not do that.
* Relevant BUGIDs: 424315Andrew G. Morgan2001-10-101-2/+1
| | | | | | | | | | | | | | Purpose of commit: cleanup, new feature Commit summary: --------------- I'm adding a new module (pam_debug) that helped me to verify that the new setcred handling did not suffer from a bug in the handling of 'auth optional'. I'm also fixing a D(()) line from libpam/pam_dispatch.c which was simply broken. [There is still an outstanding backward compatibility issue with pam_dispatch that I'll address with respect to Bug 468724.]
* Relevant BUGIDs: 129775Andrew G. Morgan2001-02-051-9/+69
| | | | | | | | | | | | | | | | | | | Purpose of commit: bugfix Commit summary: --------------- This bugfix leads to backwardly incompatable behavior with earlier releases of Linux-PAM. Note, this cleans up the setcred/session and chauthtok stacks in such a way that it is no longer preferred that the setcred module always return the same error code as the auth components of said modules did. This means behavior should be a great deal more sane. It also gives meaning to the unique return codes that are available to pam_sm_setcred. [I'm sure that when we add support for credential relevant events, this change will be critical.]
* Relevant BUGIDs: 129027, 128576Andrew G. Morgan2001-01-221-1/+10
| | | | | | | | | | Purpose of commit: new feature + documentation Commit summary: --------------- Cleaned up the handling of AUTHTOK items and pam_[gs]et_data() functions. Added more clear documentation about the pam_[gs]et_item() functions to the pam_appl and pam_modules programmer guides.
* Initial revisionAndrew G. Morgan2000-06-201-0/+282
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-08 15:28:36 +0000