aboutsummaryrefslogtreecommitdiff
path: root/modules/pam_namespace
Commit message (Collapse)AuthorAgeFilesLines
* HALF WORK: MAX_PATHdebianYuqian Yang2025-03-011-2/+4
|
* build: drop autotools supportDmitry V. Levin2024-10-232-53/+0
| | | | There is no point in supporting two different build systems.
* meson: build Linux-PAM using mesonDmitry V. Levin2024-09-101-0/+1
| | | | | | | | | | On my non-representative hardware, the full build using autotools (./autogen.sh && CFLAGS=-O2 ./configure && make -j`nproc` && make -j`nproc` install) takes about 45 seconds. On the same hardware, the full build using meson (meson setup -Doptimization=2 dir && meson compile -C dir && meson install -C dir) takes just about 7.5 seconds.
* build: consistently include config.h firstDmitry V. Levin2024-08-301-0/+2
| | | | Make sure that config.h is included before any system header.
* build: rename VENDOR_SCONFIGDIR config.h macro to VENDOR_SCONFIG_DIRDmitry V. Levin2024-08-261-5/+5
| | | | | ... for the same reason SCONFIGDIR config.h macro was renamed to SCONFIG_DIR.
* build: rename SCONFIGDIR config.h macro to SCONFIG_DIRDmitry V. Levin2024-08-251-4/+4
| | | | | | | This way it is visibly different from the configure variable SCONFIGDIR, which is helpful, because their values are slightly different: the macro is quoted while the configure variable is not quoted, and this difference may cause problems with other build systems.
* pam_namespace: log getfscreatecon(3) failureChristian Göttsche2024-05-241-1/+3
| | | | Log in case the current fscreate context could not be retrieved.
* pam_namespace: free SELinux context on error pathIker Pedrosa2024-05-231-0/+3
| | | | | | | | | | | | | | | | | | | * modules/pam_namespace/pam_namespace.c (create_polydir) [WITH_SELINUX]: Free SELinux context in case of an error. ``` Error: RESOURCE_LEAK (CWE-772): Linux-PAM-1.6.0/modules/pam_namespace/pam_namespace.c:1433: alloc_arg: "getfscreatecon_raw" allocates memory that is stored into "oldcon_raw". Linux-PAM-1.6.0/modules/pam_namespace/pam_namespace.c:1462: leaked_storage: Variable "oldcon_raw" going out of scope leaks the storage it points to. 1460| pam_syslog(idata->pamh, LOG_ERR, 1461| "Error creating directory %s: %m", dir); 1462|-> return PAM_SESSION_ERR; 1463| } 1464| ``` Resolves: https://issues.redhat.com/browse/RHEL-36475 Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
* pam_namespace: free SELinux contextIker Pedrosa2024-05-231-0/+1
| | | | | | | | | | | | | | | | | | | * modules/pam_namespace/pam_namespace.c [WITH_SELINUX] (form_context): Free SELinux context before returning. ``` Error: RESOURCE_LEAK (CWE-772): Linux-PAM-1.6.0/modules/pam_namespace/pam_namespace.c:928: alloc_arg: "getexeccon" allocates memory that is stored into "scon". Linux-PAM-1.6.0/modules/pam_namespace/pam_namespace.c:1004: leaked_storage: Variable "scon" going out of scope leaks the storage it points to. 1002| } 1003| /* Should never get here */ 1004|-> return PAM_SUCCESS; 1005| } 1006| #endif ``` Resolves: https://issues.redhat.com/browse/RHEL-36475 Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
* conf/modules: constify read-only data arraysChristian Göttsche2024-02-221-4/+4
|
* modules: add pamc headers to the search path only when neededTobias Stoeckmann2024-01-211-2/+1
| | | | | | | | | The pam client library libpamc is only needed if libpam_misc is in use. But libpam_misc is only used by an SELinux helper binary. Remove the libpamc includes from the search path in all other cases. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_namespace: use sed instead of awk in namespace.initDmitry V. Levin2024-01-201-1/+1
| | | | | | | | | Given that sed is considered a more lightweight dependency than awk, and since sed is used by pam_namespace_helper anyway, use sed instead of awk in namespace.init as well. * modules/pam_namespace/namespace.init: Use sed instead of awk to obtain the UMASK value from /etc/login.defs.
* pam_namespace: include stdint.hJacob Heider2024-01-171-0/+2
| | | | | | | | | | | | | | | | | | | | pam_namespace.c makes use of SIZE_MAX but doesn't include stdint.h, resulting in the following build failures on 1.6.0: pam_namespace.c: In function 'process_line': pam_namespace.c:649:41: error: 'SIZE_MAX' undeclared (first use in this function) 649 | if (count > UINT_MAX || count > SIZE_MAX / sizeof(uid_t)) { | ^~~~~~~~ pam_namespace.c:41:1: note: 'SIZE_MAX' is defined in header '<stdint.h>'; did you forget to '#include <stdint.h>'? 40 | #include "argv_parse.h" +++ |+#include <stdint.h> 41 | pam_namespace.c:649:41: note: each undeclared identifier is reported only once for each function it appears in 649 | if (count > UINT_MAX || count > SIZE_MAX / sizeof(uid_t)) { | ^~~~~~~~ Fixes: v1.6.0~100 ("pam_namespace: validate amount of uids in config") Resolves: https://github.com/linux-pam/linux-pam/issues/733
* pam_namespace: protect_dir(): use O_DIRECTORY to prevent local DoS situationsMatthias Gerstner2024-01-171-17/+1
| | | | | | | | | | | | Without O_DIRECTORY the path crawling logic is subject to e.g. FIFOs being placed in user controlled directories, causing the PAM module to block indefinitely during `openat()`. Pass O_DIRECTORY to cause the `openat()` to fail if the path does not refer to a directory. With this the check whether the final path element is a directory becomes unnecessary, drop it.
* treewide: strictly separate builddir and srcdirTobias Stoeckmann2024-01-121-1/+1
| | | | | | | | | | Building outside of source directory fails if --disable-doc is not explicitly chosen. This happens because generated files are sometimes expected in the source directory, where they won't exist. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_namespace: fix typo in manual pageTobias Stoeckmann2024-01-051-1/+1
| | | | Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* treewide: fix typos in commentsTobias Stoeckmann2024-01-052-2/+2
| | | | Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_namespace: validate amount of uids in configTobias Stoeckmann2024-01-031-1/+6
| | | | | | | | | | | | | If more than INT_MAX uids are found in a configuration line, the variable `count` would trigger a signed integer overflow. If more than UINT_MAX uids are found in a configuration line, then the `num_uids` counter is invalid, which could eventually lead to out of boundary accesses. Also make sure that size multiplication for malloc does not overflow. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_namespace: document that the namespace.init script runs as rootMatthias Gerstner2024-01-032-2/+8
|
* pam_namespace: document instance_prefix field better wrt final elementMatthias Gerstner2024-01-031-6/+7
|
* pam_namespace: close unnecessary file descriptors before exec()Matthias Gerstner2024-01-031-0/+11
| | | | | | | | | | | Currently the `rm` subprocess and the namespace init script inherit a random set of open file descriptors from the process running PAM. Depending on the actual PAM stack configuration these can even be security sensitive files. In any case it is unclean to inherit unexpected open file descriptors to child processes like this. To address this close all file descriptors except stdio before executing a new program.
* pam_namespace: cleanup_tmpdirs(): use proper error messageMatthias Gerstner2024-01-031-1/+1
|
* pam_namespace: fix double-free on parse error in namespace.confMatthias Gerstner2024-01-031-1/+1
| | | | | | | | | If a line in namespace.conf only consists of one field then the error handling logic in process_line() ends up in a double-free, resulting in a process abort in libc. It looks like instead of NULLing the `dir` variable, the `instance_prefix` is NULLed, without purpose. Fix this.
* treewide: use asprintf to construct stringsTobias Stoeckmann2023-12-191-16/+10
| | | | | | | | The asprintf function is considered as given for current code already. Use it instead of calling malloc + strcpy + strcat manually. Reported-by: Benny Baumann <BenBE@geshi.org> Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* treewide: replace malloc followed by strcpy with strdupTobias Stoeckmann2023-12-191-2/+1
| | | | | Suggested-by: Benny Baumann <BenBE@geshi.org> Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* treewide: fix typosTobias Stoeckmann2023-12-181-1/+1
| | | | | | Typos found with codespell Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_namespace: handle huge namespace.conf linesTobias Stoeckmann2023-12-181-0/+6
| | | | | | | | | | | If a lot of arguments are found in a namespace.conf file, argc might overflow, which is an undefined behavior. In most cases, the realloc will instantly fail due to a wrap around. Protect properly by avoiding the calculation in the first place. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* treewide: store strlen results in size_tTobias Stoeckmann2023-12-141-4/+4
| | | | | | | Very long strings could overflow the int data type. Make sure to use the correct data type. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* treewide: assume free(NULL) is no-opDmitry V. Levin2023-12-141-3/+2
| | | | | The C standard guarantees that if the argument of free() is a null pointer, no action occurs.
* treewide: do not cast calloc/malloc/reallocTobias Stoeckmann2023-11-121-2/+2
| | | | | | | It is not required to cast the results of calloc, malloc, realloc, etc. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* modules: cast to unsigned char for character handling functionChristian Göttsche2023-08-072-3/+3
| | | | | | | | Character handling functions, like isspace(3), expect a value representable as unsigned char or equal to EOF. Otherwise the behavior is undefined. See https://wiki.sei.cmu.edu/confluence/display/c/STR37-C.+Arguments+to+character-handling+functions+must+be+representable+as+an+unsigned+char
* modules: update Linux detectionChristian Göttsche2023-05-071-1/+1
| | | | | | | | GCC and Clang only define the macro `linux` when using the GNU dialect of C (e.g. -std=gnu11 instead of -std=c11). Since `linux` is also not in a reserved namespace it might be target of collisions. Use the canonical macro `__linux__` instead (already used in pam_limits.c).
* treewide: fix unnecessary $ on arithmetic variablesDmitry V. Levin2023-03-311-1/+1
| | | | This should fix shellcheck warning SC2004.
* modules: make use of secure memory erasureChristian Göttsche2023-02-281-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | Use empty initialization of structs to minimize the memset() usage, to reduce the amount of calls which are not sensitive. Non trivial changes: - pam_env: * erase environment variables where possible - pam_exec: * erase responce on error * erase auth token - pam_pwhistory: * erase buffers containing old passwords - pam_selinux: skip overwriting data structure consisting of only pointers to insensitive data, which also gets free'd afterwards (so it currently does not protect against double-free or use-after-free on the member pointers) - pam_unix: erase cipher data in more places - pam_userdb: erase password hashes
* build: use <vendordir>/security directory for installation if it has been setStefan Schubert2023-02-071-0/+4
| | | | | | | | | Otherwise the corresponding files are still installed in /etc/security. * configure.ac (AC_SUBST): Add VENDOR_SCONFIGDIR. (AM_CONDITIONAL): Add HAVE_VENDORDIR. * modules/*/Makefile.am (secureconfdir): Set to VENDOR_SCONFIGDIR if HAVE_VENDORDIR has been set, otherwise to SCONFIGDIR.
* doc: Update PAM documentation from DockBook 4 to DocBook 5Stefan Schubert2022-12-164-95/+69
| | | | | | | | | | | | | | | | | | | | Changed files -------------- Make.xml.rules.in: - Using RNG file instead of DTD file for checking XML files. - Taking the correct stylesheet for README files. doc/sag/Makefile.am, doc/adg/Makefile.am, doc/mwg/Makefile.am: - Using RNG file instead of DTD file for checking XML files. configure.ac: - Adding a new option for selecting RNG check file (-enable-docbook-rng) - Switching stylesheets to docbook 5 - Checking DocBook 5 environment instead of DocBook 4 environment *.xml: Update from DockBook 4 to DocBook 5
* pam_namespace: make sure the SIGCHLD handler is not reset too earlyDmitry V. Levin2022-07-161-15/+15
| | | | | | * modules/pam_namespace/pam_namespace.c (inst_init): Make sure the SIGCHLD handler is not reset too early by moving the sigaction call right before the fork call.
* pam_namespace: use vendor specific namespace.conf and namespace.init as fallbackStefan Schubert2022-06-304-15/+167
| | | | | | | | | | Use the vendor directory as fallback for a distribution provided default config and scripts if there is no configuration in /etc. pam_namespace.c: Take care about the fallback configuration in vendor directory. pam_namespace.h: Define vendor specific files and directories. pam_namespace.8.xml: Add description for vendor directories and files. namespace.conf.5.xml: Add description for vendor directories and files.
* modules: use SCONFIGDIR macroDmitry V. Levin2022-01-232-9/+5
| | | | | | | | | | | | | | | | | Use SCONFIGDIR macro instead of open-coding "/etc/security", the latter is not correct when configured using --enable-sconfigdir with an argument different from /etc/security. * modules/pam_faillock/faillock.h (FAILLOCK_DEFAULT_CONF): Use SCONFIGDIR. * modules/pam_namespace/pam_namespace.h (SECURECONF_DIR): Remove. (PAM_NAMESPACE_CONFIG, NAMESPACE_INIT_SCRIPT, NAMESPACE_D_DIR, NAMESPACE_D_GLOB): Use SCONFIGDIR. * modules/pam_namespace/Makefile.am (AM_CFLAGS): Remove -DSECURECONF_DIR. * modules/pam_pwhistory/opasswd.c (OLD_PASSWORDS_FILE): Use SCONFIGDIR. * modules/pam_unix/passverify.h: Likewise. * modules/pam_unix/passverify.c (OPW_TMPFILE): Use SCONFIGDIR.
* configure.ac: add --with-systemdunitdir optionChangqing Li2021-01-271-1/+1
| | | | | | | | | | | | | * Add this option to support the following scenario: prefix = '/usr' servicedir = '/lib/systemd/system' * The default behavior is changed: If this option is not given, servicedir will be set to the value that is obtained from systemd pkg-config file. If the value cannot be obtained, servicedir will be set to the default value '$(prefix)/lib/systemd/system'. Signed-off-by: Changqing Li <changqing.li@windriver.com>
* pam_namespace: check for string_to_security_class failureChristian Göttsche2020-12-081-0/+6
| | | | | | | | | | Check for the unlikely case string_to_security_class() does not find the associated SELinux security class. This will only happen if the loaded SELinux policy does not define the class "dir" (which no sane policy does) or querying the selinuxfs fails. Suggested by #309
* pam_namespace: polyinstantiation refer to gdm docikerexxe2020-10-051-39/+2
| | | | | | | modules/pam_namespace/pam_namespace.8.xml: delete obsolete information about polyinstantiation and refer to gdm's documentation. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1861841
* Fix -Wcast-align compilation warnings on armDmitry V. Levin2020-08-062-22/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Apparently, gcc is also not smart enough to infer the alignment of structure fields, for details see https://gcc.gnu.org/bugzilla/show_bug.cgi?id=89133 Use unions to avoid these casts altogether, this fixes compilation warnings reported by gcc on arm, e.g.: md5.c: In function 'MD5Update': md5.c:92:35: error: cast increases required alignment of target type [-Werror=cast-align] 92 | MD5Name(MD5Transform)(ctx->buf, (uint32 *) ctx->in); | ^ md5.c:101:35: error: cast increases required alignment of target type [-Werror=cast-align] 101 | MD5Name(MD5Transform)(ctx->buf, (uint32 *) ctx->in); | ^ md5.c: In function 'MD5Final': md5.c:136:35: error: cast increases required alignment of target type [-Werror=cast-align] 136 | MD5Name(MD5Transform)(ctx->buf, (uint32 *) ctx->in); | ^ md5.c:147:9: error: cast increases required alignment of target type [-Werror=cast-align] 147 | memcpy((uint32 *)ctx->in + 14, ctx->bits, 2*sizeof(uint32)); | ^ md5.c:149:34: error: cast increases required alignment of target type [-Werror=cast-align] 149 | MD5Name(MD5Transform)(ctx->buf, (uint32 *) ctx->in); | ^ * modules/pam_namespace/md5.h (struct MD5Context): Replace "buf" and "in" fields with unions. All users updated. * modules/pam_unix/md5.h (struct MD5Context): Likewise. * modules/pam_timestamp/sha1.h (struct sha1_context.pending): Replace with a union. All users updated. Complements: v1.4.0~195 ("Fix most of clang -Wcast-align compilation warnings")
* pam_namespace: fix big-endian check in md5 implementationDmitry V. Levin2020-08-051-4/+4
| | | | | | | * modules/pam_namespace/md5.c: Do not check against the list of architectures that are known to be little-endian, instead check for WORDS_BIGENDIAN macro defined by AC_C_BIGENDIAN autoconf macro on big-endian platforms.
* pam_namespace: skip context translationChristian Göttsche2020-08-051-8/+8
| | | | | | | These retrieved contexts are just passed to libselinux functions and not printed or otherwise made available to the outside, so a context translation to human readable MCS/MLS labels is not needed. (see man:setrans.conf(5))
* pam_namespace: replace deprecated matchpathconChristian Göttsche2020-08-052-13/+22
| | | | | The matchpathcon family is deprecated. Use the selabel family.
* pam_namespace: replace deprecated security_context_tChristian Göttsche2020-08-051-8/+8
| | | | | libselinux 3.1 deprecated the typedef security_context_t. Use the underlaying type.
* pam_namespace, pam_mkhomedir: fix unlikely descriptor leaks on error pathikerexxe2020-07-011-0/+1
| | | | | | | | | | | [ldv: rewrote commit message] * modules/pam_mkhomedir/mkhomedir_helper.c (create_homedir): Close just opened file descriptor "srcfd" in an unlikely case when it cannot be fstat'ed. * modules/pam_namespace/pam_namespace.c (create_instance): Close just opened file descriptor "fd" in an unlikely case when it cannot be fstat'ed.
* pam_namespace: add systemd service file to gitignoreikerexxe2020-06-261-0/+1
| | | | | | * modules/pam_namespace/.gitignore: Add pam_namespace.service. Complements: v1.4.0~247 ("pam_namespace: secure tmp-inst directories")
* Use correct path for pam_namespace.service file (#223)Thorsten Kukuk2020-05-121-1/+1
|
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-07 23:53:07 +0000