aboutsummaryrefslogtreecommitdiff
path: root/modules/pam_unix/pam_unix_acct.c
Commit message (Collapse)AuthorAgeFilesLines
* pam_unix: try to set uid to 0 for unix_chkpwdTobias Stoeckmann2024-01-241-8/+9
| | | | | | | | | | | | | The geteuid check does not cover all cases. If a program runs with elevated capabilities like CAP_SETUID then we can still check credentials of other users. Keep logging for future analysis though. Resolves: https://github.com/linux-pam/linux-pam/issues/747 Fixes: b3020da7da38 ("pam_unix/passverify: always run the helper to obtain shadow password file entries") Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_unix: Add comment for the ignored PAM_AUTHTOK_ERR caseTomas Mraz2020-07-221-0/+4
| | | | | * modules/pam_unix/pam_unix_acct.c (pam_sm_acct_mgmt): Add comment about the reason for ignoring PAM_AUTHTOK_ERR.
* Fix missing initialization of daysleftTomas Mraz2020-07-221-1/+1
| | | | | | | | | | The daysleft otherwise stays uninitialized if there is no shadow entry. Regression from commit f5adefa. Fixes #255 * modules/pam_unix/pam_unix_acct.c (pam_sm_acct_mgmt): Initialize daysleft.
* modules: remove PAM_SM_* macrosDmitry V. Levin2020-05-031-4/+2
| | | | | | Starting with commit a684595c0bbd88df71285f43fb27630e3829121e aka Linux-PAM-1.3.0~14 (Remove "--enable-static-modules" option and support from Linux-PAM), PAM_SM_* macros have no effect.
* pam_unix: add nullresetok option to allow reset blank passwordsPavel Březina2020-02-181-25/+1
| | | | | | | | | | Adding nullresetok to auth phase of pam_unix module will allow users with blank password to authenticate in order to immediatelly change their password even if nullok is not set. This allows to have blank password authentication disabled but still allows administrator to create new user accounts with expired blank password that must be change on the first login.
* Fix remaining -Wcast-qual compilation warningsDmitry V. Levin2020-01-201-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduce a new internal header file with definitions of DIAG_PUSH_IGNORE_CAST_QUAL and DIAG_POP_IGNORE_CAST_QUAL macros, use them to temporary silence -Wcast-qual compilation warnings in various modules. * libpam/include/pam_cc_compat.h: New file. * libpam/Makefile.am (noinst_HEADERS): Add include/pam_cc_compat.h. * modules/pam_mkhomedir/pam_mkhomedir.c: Include "pam_cc_compat.h". (create_homedir): Wrap execve invocation in DIAG_PUSH_IGNORE_CAST_QUAL and DIAG_POP_IGNORE_CAST_QUAL. * modules/pam_namespace/pam_namespace.c: Include "pam_cc_compat.h". (pam_sm_close_session): Wrap the cast that discards ‘const’ qualifier in DIAG_PUSH_IGNORE_CAST_QUAL and DIAG_POP_IGNORE_CAST_QUAL. * modules/pam_tty_audit/pam_tty_audit.c: Include "pam_cc_compat.h". (nl_send): Wrap the cast that discards ‘const’ qualifier in DIAG_PUSH_IGNORE_CAST_QUAL and DIAG_POP_IGNORE_CAST_QUAL. * modules/pam_unix/pam_unix_acct.c: Include "pam_cc_compat.h". (_unix_run_verify_binary): Wrap execve invocation in DIAG_PUSH_IGNORE_CAST_QUAL and DIAG_POP_IGNORE_CAST_QUAL. * modules/pam_unix/pam_unix_passwd.c: Include "pam_cc_compat.h". (_unix_run_update_binary): Wrap execve invocation in DIAG_PUSH_IGNORE_CAST_QUAL and DIAG_POP_IGNORE_CAST_QUAL. * modules/pam_unix/passverify.c: Include "pam_cc_compat.h". (unix_update_shadow): Wrap the cast that discards ‘const’ qualifier in DIAG_PUSH_IGNORE_CAST_QUAL and DIAG_POP_IGNORE_CAST_QUAL. * modules/pam_unix/support.c: Include "pam_cc_compat.h". (_unix_run_helper_binary): Wrap execve invocation in DIAG_PUSH_IGNORE_CAST_QUAL and DIAG_POP_IGNORE_CAST_QUAL. * modules/pam_xauth/pam_xauth.c: Include "pam_cc_compat.h". (run_coprocess): Wrap execv invocation in DIAG_PUSH_IGNORE_CAST_QUAL and DIAG_POP_IGNORE_CAST_QUAL.
* pam_unix: Fix the spelling of Jan Rękorajski's name.Tomas Mraz2019-10-101-1/+1
|
* pam_unix: Add support for (gost-)yescrypt hashing methods.Björn Esser2018-11-231-2/+2
| | | | | | | | | | | | | | | libxcrypt (v4.2 and later) has added support for the yescrypt hashing method; gost-yescrypt has been added in v4.3. * modules/pam_unix/pam_unix.8.xml: Documentation for (gost-)yescrypt. * modules/pam_unix/pam_unix_acct.c: Use 64 bit type for control flags. * modules/pam_unix/pam_unix_auth.c: Likewise. * modules/pam_unix/pam_unix_passwd.c: Likewise. * modules/pam_unix/pam_unix_sess.c: Likewise. * modules/pam_unix/passverify.c: Add support for (gost-)yescrypt. * modules/pam_unix/passverify.h: Use 64 bit type for control flags. * modules/pam_unix/support.c: Set sane rounds for (gost-)yescrypt. * modules/pam_unix/support.h: Add support for (gost-)yescrypt.
* Fix grammar of messages printed via pam_promptDmitry V. Levin2018-06-191-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | | Turn into proper sentences those messages that are printed without further modifications using pam_prompt in contexts where proper sentences are expected. * libpam/pam_get_authtok.c (pam_get_authtok_internal): Fix grammar of the message passed to pam_error. * modules/pam_limits/pam_limits.c (pam_sm_open_session): Likewise. * modules/pam_cracklib/pam_cracklib.c (_pam_unix_approve_pass): Fix grammar of error messages passed to pam_error. * modules/pam_mail/pam_mail.c (report_mail): Fix grammar of a message passed to pam_info. * modules/pam_timestamp/pam_timestamp.c (verbose_success): Likewise. * modules/pam_selinux/pam_selinux.c (config_context, send_text): Fix grammar of messages passed to pam_prompt. * modules/pam_tally/pam_tally.c (tally_check): Fix grammar of messages passed to pam_info. * modules/pam_tally2/pam_tally2.c (tally_check): Likewise. * modules/pam_unix/pam_unix_acct.c (pam_sm_acct_mgmt): Fix grammar of messages passed to _make_remark. * modules/pam_unix/pam_unix_passwd.c (_pam_unix_approve_pass, pam_sm_chauthtok): Likewise. * po/Linux-PAM.pot: Regenerate.
* Unification and cleanup of syslog log levels.Tomas Mraz2016-06-301-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * libpam/pam_handlers.c: Make memory allocation failures LOG_CRIT. * libpam/pam_modutil_priv.c: Make memory allocation failures LOG_CRIT. * modules/pam_echo/pam_echo.c: Make memory allocation failures LOG_CRIT. * modules/pam_env/pam_env.c: Make memory allocation failures LOG_CRIT. * modules/pam_exec/pam_exec.c: Make memory allocation failures LOG_CRIT. * modules/pam_filter/pam_filter.c: Make all non-memory call errors LOG_ERR. * modules/pam_group/pam_group.c: Make memory allocation failures LOG_CRIT. * modules/pam_issue/pam_issue.c: Make memory allocation failures LOG_CRIT. * modules/pam_lastlog/pam_lastlog.c: The lastlog file creation is syslogged with LOG_NOTICE, memory allocation errors with LOG_CRIT, other errors with LOG_ERR. * modules/pam_limits/pam_limits.c: User login limit messages are syslogged with LOG_NOTICE, stale utmp entry with LOG_INFO, non-memory errors with LOG_ERR. * modules/pam_listfile/pam_listfile.c: Rejection of user is syslogged with LOG_NOTICE. * modules/pam_namespace/pam_namespace.c: Make memory allocation failures LOG_CRIT. * modules/pam_nologin/pam_nologin.c: Make memory allocation failures LOG_CRIT, other errors LOG_ERR. * modules/pam_securetty/pam_securetty.c: Rejection of access is syslogged with LOG_NOTICE, non-memory errors with LOG_ERR. * modules/pam_selinux/pam_selinux.c: Make memory allocation failures LOG_CRIT. * modules/pam_succeed_if/pam_succeed_if.c: Make all non-memory call errors LOG_ERR. * modules/pam_time/pam_time.c: Make memory allocation failures LOG_CRIT. * modules/pam_timestamp/pam_timestamp.c: Make memory allocation failures LOG_CRIT. * modules/pam_unix/pam_unix_acct.c: Make all non-memory call errors LOG_ERR. * modules/pam_unix/pam_unix_passwd.c: Make memory allocation failures LOG_CRIT, other errors LOG_ERR. * modules/pam_unix/pam_unix_sess.c: Make all non-memory call errors LOG_ERR. * modules/pam_unix/passverify.c: Unknown user is syslogged with LOG_NOTICE. * modules/pam_unix/support.c: Unknown user is syslogged with LOG_NOTICE and max retries ignorance by application likewise. * modules/pam_unix/unix_chkpwd.c: Make all non-memory call errors LOG_ERR. * modules/pam_userdb/pam_userdb.c: Password authentication error is syslogged with LOG_NOTICE. * modules/pam_xauth/pam_xauth.c: Make memory allocation failures LOG_CRIT.
* pam_unix: Make password expiration messages more user-friendly.Tomas Mraz2016-04-041-2/+2
| | | | | * modules/pam_unix/pam_unix_acct.c (pam_sm_acct_mgmt): Make password expiration messages more user-friendly.
* Remove "--enable-static-modules" option and support fromThorsten Kukuk2016-03-291-5/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Linux-PAM. It was never official supported and was broken since years. * configure.ac: Remove --enable-static-modules option. * doc/man/pam_sm_acct_mgmt.3.xml: Remove PAM_EXTERN. * doc/man/pam_sm_authenticate.3.xml: Likewise. * doc/man/pam_sm_chauthtok.3.xml: Likewise. * doc/man/pam_sm_close_session.3.xml: Likewise. * doc/man/pam_sm_open_session.3.xml: Likewise. * doc/man/pam_sm_setcred.3.xml: Likewise. * libpam/Makefile.am: Remove STATIC_MODULES cases. * libpam/include/security/pam_modules.h: Remove PAM_STATIC parts. * libpam/pam_dynamic.c: Likewise. * libpam/pam_handlers.c: Likewise. * libpam/pam_private.h: Likewise. * libpam/pam_static.c: Remove file. * libpam/pam_static_modules.h: Remove header file. * modules/pam_access/pam_access.c: Remove PAM_EXTERN and PAM_STATIC parts. * modules/pam_cracklib/pam_cracklib.c: Likewise. * modules/pam_debug/pam_debug.c: Likewise. * modules/pam_deny/pam_deny.c: Likewise. * modules/pam_echo/pam_echo.c: Likewise. * modules/pam_env/pam_env.c: Likewise. * modules/pam_exec/pam_exec.c: Likewise. * modules/pam_faildelay/pam_faildelay.c: Likewise. * modules/pam_filter/pam_filter.c: Likewise. * modules/pam_ftp/pam_ftp.c: Likewise. * modules/pam_group/pam_group.c: Likewise. * modules/pam_issue/pam_issue.c: Likewise. * modules/pam_keyinit/pam_keyinit.c: Likewise. * modules/pam_lastlog/pam_lastlog.c: Likewise. * modules/pam_limits/pam_limits.c: Likewise. * modules/pam_listfile/pam_listfile.c: Likewise. * modules/pam_localuser/pam_localuser.c: Likewise. * modules/pam_loginuid/pam_loginuid.c: Likewise. * modules/pam_mail/pam_mail.c: Likewise. * modules/pam_mkhomedir/pam_mkhomedir.c: Likewise. * modules/pam_motd/pam_motd.c: Likewise. * modules/pam_namespace/pam_namespace.c: Likewise. * modules/pam_nologin/pam_nologin.c: Likewise. * modules/pam_permit/pam_permit.c: Likewise. * modules/pam_pwhistory/pam_pwhistory.c: Likewise. * modules/pam_rhosts/pam_rhosts.c: Likewise. * modules/pam_rootok/pam_rootok.c: Likewise. * modules/pam_securetty/pam_securetty.c: Likewise. * modules/pam_selinux/pam_selinux.c: Likewise. * modules/pam_sepermit/pam_sepermit.c: Likewise. * modules/pam_shells/pam_shells.c: Likewise. * modules/pam_stress/pam_stress.c: Likewise. * modules/pam_succeed_if/pam_succeed_if.c: Likewise. * modules/pam_tally/pam_tally.c: Likewise. * modules/pam_tally2/pam_tally2.c: Likewise. * modules/pam_time/pam_time.c: Likewise. * modules/pam_timestamp/pam_timestamp.c: Likewise. * modules/pam_tty_audit/pam_tty_audit.c: Likewise. * modules/pam_umask/pam_umask.c: Likewise. * modules/pam_userdb/pam_userdb.c: Likewise. * modules/pam_warn/pam_warn.c: Likewise. * modules/pam_wheel/pam_wheel.c: Likewise. * modules/pam_xauth/pam_xauth.c: Likewise. * modules/pam_unix/Makefile.am: Remove STATIC_MODULES part. * modules/pam_unix/pam_unix_acct.c: Remove PAM_STATIC part. * modules/pam_unix/pam_unix_auth.c: Likewise. * modules/pam_unix/pam_unix_passwd.c: Likewise. * modules/pam_unix/pam_unix_sess.c: Likewise. * modules/pam_unix/pam_unix_static.c: Removed. * modules/pam_unix/pam_unix_static.h: Removed. * po/POTFILES.in: Remove removed files. * tests/tst-dlopen.c: Remove PAM_STATIC part.
* pam_unix: Add no_pass_expiry option to ignore password expiration.Tomas Mraz2016-02-171-0/+13
| | | | | | | | | | | | * modules/pam_unix/pam_unix.8.xml: Document the no_pass_expiry option. * modules/pam_unix/pam_unix_acct.c (pam_sm_acct_mgmt): If no_pass_expiry is on and return value data is not set to PAM_SUCCESS then ignore PAM_NEW_AUTHTOK_REQD and PAM_AUTHTOK_EXPIRED returns. * modules/pam_unix/pam_unix_auth.c (pam_sm_authenticate): Always set the return value data. (pam_sm_setcred): Test for likeauth option and use the return value data only if set. * modules/pam_unix/support.h: Add the no_pass_expiry option.
* Introduce pam_modutil_sanitize_helper_fdsDmitry V. Levin2014-01-271-13/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change introduces pam_modutil_sanitize_helper_fds - a new function that redirects standard descriptors and closes all other descriptors. pam_modutil_sanitize_helper_fds supports three types of input and output redirection: - PAM_MODUTIL_IGNORE_FD: do not redirect at all. - PAM_MODUTIL_PIPE_FD: redirect to a pipe. For stdin, it is implemented by creating a pipe, closing its write end, and redirecting stdin to its read end. Likewise, for stdout/stderr it is implemented by creating a pipe, closing its read end, and redirecting to its write end. Unlike stdin redirection, stdout/stderr redirection to a pipe has a side effect that a process writing to such descriptor should be prepared to handle SIGPIPE appropriately. - PAM_MODUTIL_NULL_FD: redirect to /dev/null. For stdin, it is implemented via PAM_MODUTIL_PIPE_FD because there is no functional difference. For stdout/stderr, it is classic redirection to /dev/null. PAM_MODUTIL_PIPE_FD is usually more suitable due to linux kernel security restrictions, but when the helper process might be writing to the corresponding descriptor and termination of the helper process by SIGPIPE is not desirable, one should choose PAM_MODUTIL_NULL_FD. * libpam/pam_modutil_sanitize.c: New file. * libpam/Makefile.am (libpam_la_SOURCES): Add it. * libpam/include/security/pam_modutil.h (pam_modutil_redirect_fd, pam_modutil_sanitize_helper_fds): New declarations. * libpam/libpam.map (LIBPAM_MODUTIL_1.1.9): New interface. * modules/pam_exec/pam_exec.c (call_exec): Use pam_modutil_sanitize_helper_fds. * modules/pam_mkhomedir/pam_mkhomedir.c (create_homedir): Likewise. * modules/pam_unix/pam_unix_acct.c (_unix_run_verify_binary): Likewise. * modules/pam_unix/pam_unix_passwd.c (_unix_run_update_binary): Likewise. * modules/pam_unix/support.c (_unix_run_helper_binary): Likewise. * modules/pam_xauth/pam_xauth.c (run_coprocess): Likewise. * modules/pam_unix/support.h (MAX_FD_NO): Remove.
* Fix gratuitous use of strdup and x_strdupDmitry V. Levin2014-01-271-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | There is no need to copy strings passed as arguments to execve, the only potentially noticeable effect of using strdup/x_strdup would be a malformed argument list in case of memory allocation error. Also, x_strdup, being a thin wrapper around strdup, is of no benefit when its argument is known to be non-NULL, and should not be used in such cases. * modules/pam_cracklib/pam_cracklib.c (password_check): Use strdup instead of x_strdup, the latter is of no benefit in this case. * modules/pam_ftp/pam_ftp.c (lookup): Likewise. * modules/pam_userdb/pam_userdb.c (user_lookup): Likewise. * modules/pam_userdb/pam_userdb.h (x_strdup): Remove. * modules/pam_mkhomedir/pam_mkhomedir.c (create_homedir): Do not use x_strdup for strings passed as arguments to execve. * modules/pam_unix/pam_unix_acct.c (_unix_run_verify_binary): Likewise. * modules/pam_unix/pam_unix_passwd.c (_unix_run_update_binary): Likewise. * modules/pam_unix/support.c (_unix_run_helper_binary): Likewise. (_unix_verify_password): Use strdup instead of x_strdup, the latter is of no benefit in this case. * modules/pam_xauth/pam_xauth.c (run_coprocess): Do not use strdup for strings passed as arguments to execv.
* Check return value of setuid to remove glibc warnings.Thorsten Kukuk2013-09-161-1/+6
| | | | | * modules/pam_unix/pam_unix_acct.c: Check setuid return value. * modules/pam_unix/support.c: Likewise.
* Fix compile errorThorsten Kukuk2013-08-301-1/+1
| | | | * modules/pam_unix/pam_unix_acct.c: fix last change
* Restart waitpid if it returns with EINTR (ticket #17)Thorsten Kukuk2013-08-291-1/+2
| | | | | | * modules/pam_unix/pam_unix_acct.c: run waitpid in a while loop. * modules/pam_unix/pam_unix_passwd.c: Likewise. * modules/pam_unix/support.c: Likewise.
* RLIMIT_* variables are no longer defined unless you explicitly includeStevan Bajić2012-07-091-0/+1
| | | | | | | | sys/resource.h. Signed-off-by: Diego Elio Pettenò <flameeyes@flameeyes.eu> modules/pam_unix/pam_unix_acct.c: Include sys/resource.h.
* pam_unix: make configuration consistent in --enable-static-modules modeDmitry V. Levin2012-02-031-17/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In --enable-static-modules mode, it was not possible to use "pam_unix" in PAM config files. Instead, different names had to be used for each management group: pam_unix_auth, pam_unix_acct, pam_unix_passwd and pam_unix_session. This change makes pam_unix configuration consistent with other PAM modules. * README: Remove the paragraph describing pam_unix distinctions in --enable-static-modules mode. * libpam/pam_static_modules.h (_pam_unix_acct_modstruct, _pam_unix_auth_modstruct, _pam_unix_passwd_modstruct, _pam_unix_session_modstruct): Remove. (_pam_unix_modstruct): New pam_module declaration. * modules/pam_unix/pam_unix_static.h: New file. * modules/pam_unix/pam_unix_static.c: Likewise. * modules/pam_unix/Makefile.am (noinst_HEADERS): Add pam_unix_static.h (pam_unix_la_SOURCES) [STATIC_MODULES]: Add pam_unix_static.c * modules/pam_unix/pam_unix_acct.c [PAM_STATIC]: Include pam_unix_static.h [PAM_STATIC] (_pam_unix_acct_modstruct): Remove. * modules/pam_unix/pam_unix_auth.c [PAM_STATIC]: Include pam_unix_static.h [PAM_STATIC] (_pam_unix_auth_modstruct): Remove. * modules/pam_unix/pam_unix_passwd.c [PAM_STATIC]: Include pam_unix_static.h [PAM_STATIC] (_pam_unix_passwd_modstruct): Remove. * modules/pam_unix/pam_unix_sess.c [PAM_STATIC]: Include pam_unix_static.h [PAM_STATIC] (_pam_unix_session_modstruct): Remove. Suggested-by: Matveychikov Ilya <i.matveychikov@securitycode.ru>
* Relevant BUGIDs:Thorsten Kukuk2010-08-171-1/+1
| | | | | | | | | | | | | | | | | | | | | Purpose of commit: new feature Commit summary: --------------- 2010-08-17 Thorsten Kukuk <kukuk@thkukuk.de> * modules/pam_unix/pam_unix_passwd.c: Implement minlen option. * modules/pam_unix/support.c: Likewise. * modules/pam_unix/support.h: Likewise. * modules/pam_unix/pam_unix_acct.c (pam_sm_acct_mgmt): Adjust arguments for _set_ctrl call. * modules/pam_unix/pam_unix_auth.c (pam_sm_authenticate): Likewise. * modules/pam_unix/pam_unix_session.c: Likewise. * modules/pam_unix/pam_unix.8.xml: Document minlen option. Based on patch by Steve Langasek.
* Relevant BUGIDs:Dmitry V. Levin2009-04-031-1/+2
| | | | | | | | | | | | | | | | | | | | | | | Purpose of commit: bugfix Commit summary: --------------- 2009-04-03 Dmitry V. Levin <ldv@altlinux.org> * libpamc/pamc_load.c (__pamc_exec_agent): Replace call to exit(3) in child process with call to _exit(2). * modules/pam_mkhomedir/pam_mkhomedir.c (create_homedir): Likewise. * modules/pam_unix/pam_unix_acct.c (_unix_run_verify_binary): Likewise. * modules/pam_unix/pam_unix_passwd.c (_unix_run_update_binary): Likewise. * modules/pam_unix/support.c (_unix_run_helper_binary): Likewise. * modules/pam_xauth/pam_xauth.c (run_coprocess): Likewise. * modules/pam_exec/pam_exec.c (call_exec): Replace all calls to exit(3) in child process with calls to _exit(2). * modules/pam_filter/pam_filter.c (set_filter): Likewise. * modules/pam_namespace/pam_namespace.c (inst_init, cleanup_tmpdirs): Likewise.
* Relevant BUGIDs:Tomas Mraz2009-03-031-0/+3
| | | | | | | | | | | | | | Purpose of commit: bugfix Commit summary: --------------- 2009-03-03 Tomas Mraz <t8m@centrum.cz> * modules/pam_unix/pam_unix_acct.c(_unix_run_verify_binary): Test for abnormal exit of the helper binary. * modules/pam_unix/pam_unix_passwd.c(_unix_run_update_binary): Likewise. * modules/pam_unix/support.c(_unix_run_helper_binary): Likewise. * modules/pam_mkhomedir/pam_mkhomedir.c(create_homedir): Likewise.
* Relevant BUGIDs:Tomas Mraz2009-02-271-4/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Purpose of commit: new feature Commit summary: --------------- 2009-02-27 Tomas Mraz <t8m@centrum.cz> * modules/pam_mkhomedir/pam_mkhomedir.c(create_homedir): Replace signal() with sigaction(). * modules/pam_namespace/pam_namespace.c(inst_init, cleanup_tmpdirs): Likewise. * modules/pam_unix/pam_unix_acct.c(_unix_run_verify_binary): Likewise. * modules/pam_unix/pam_unix_passwd.c(_unix_run_update_binary): Likewise. * modules/pam_unix/passverify.c(su_sighandler): Likewise. * modules/pam_unix/support.c(_unix_run_helper_binary): Likewise. * modules/pam_tally2/Makefile.am: Link the pam_tally2 app to libpam for auxiliary functions. * modules/pam_tally2/pam_tally2.8.xml: Drop non-existing no_reset option. Document new serialize option. * modules/pam_tally2/pam_tally2.c: Add support for the new serialize option. (_cleanup, tally_set_data, tally_get_data): Add tally file handle to tally PAM data. Needed for fcntl() locking. (get_tally): Use low level file access instead of stdio buffered FILE. If serialize option is used lock the tally file access. (set_tally, tally_bump, tally_reset): Use low level file access instead of stdio buffered FILE. Close the file handle only when it is not owned by PAM data. (pam_sm_authenticate, pam_sm_setcred, pam_sm_acct_mgmt): Pass the tally file handle to tally_set_data(). Get it from tally_get_data(). (main): Use low level file access instead of stdio buffered FILE.
* Relevant BUGIDs: debian#514437 rhbz#487216Tomas Mraz2009-02-261-0/+3
| | | | | | | | | | | | | | | | | | | Purpose of commit: bugfix Commit summary: --------------- 2009-02-26 Tomas Mraz <t8m@centrum.cz> * xtests/Makefile.am: Add tst-pam_unix4. * xtests/tst-pam_unix4.c: New test for password change and shadow min days limit. * xtests/tst-pam_unix4.pamd: Likewise. * xtests/tst-pam_unix4.sh: Likewise. * modules/pam_unix/pam_unix_acct.c (pam_sm_acct_mgmt): Ignore PAM_AUTHTOK_ERR on shadow verification. * modules/pam_unix/passverify.c (check_shadow_expiry): Return PAM_AUTHTOK_ERR if sp_min limit for password change is defied.
* Relevant BUGIDs: #2009766Tomas Mraz2008-07-111-7/+6
| | | | | | | | | | | | | | | | Purpose of commit: bugfix Commit summary: --------------- 2008-07-11 Tomas Mraz <t8m@centrum.cz> * modules/pam_unix/pam_unix_acct.c (_unix_run_verify_binary): Do not close the pipe descriptor in borderline case (#2009766) * modules/pam_unix/pam_unix_passwd.c (_unix_run_update_binary): Likewise. * modules/pam_unix/support.c (_unix_run_helper_binary): Likewise. * modules/pam_unix/support.h: Define upper limit of fds we will attempt to close.
* Relevant BUGIDs:Tomas Mraz2008-01-231-142/+79
| | | | | | | | | | Purpose of commit: cleanup, new feature Commit summary: --------------- Merging the the refactorization pam_unix_ref branch into the trunk. Added support for sha256 and sha512 password hashes to pam_unix when the libcrypt supports them.
* Relevant BUGIDs:Tomas Mraz2007-12-051-0/+1
| | | | | | | | | | | | | | | | | | | | | | Purpose of commit: cleanup Commit summary: --------------- 2007-12-05 Tomas Mraz <t8m@centrum.cz> * modules/pam_unix/Makefile.am: Add passverify.h and passverify.c as first part of pam_unix refactorization. * modules/pam_unix/pam_unix/pam_unix_acct.c: Include passverify.h. * modules/pam_unix/pam_unix_passwd.c: Likewise. * modules/pam_unix/passverify.c: New file with common functions. * modules/pam_unix/passverify.h: Prototypes for the common functions. * modules/pam_unix/support.c: Include passverify.h, move _unix_shadowed() to passverify.c. (_unix_verify_password): Refactor out verify_pwd_hash() function. * modules/pam_unix/support.h: Move _unix_shadowed() prototype to passverify.h * modules/pam_unix/unix_chkpwd.c: Use _unix_shadowed() and verify_pwd_hash() from passverify.c.
* Relevant BUGIDs: 1822761Thorsten Kukuk2007-11-061-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Purpose of commit: bugfix Commit summary: --------------- 2007-11-06 Thorsten Kukuk <kukuk@thkukuk.de> * xtests/tst-pam_group1.c: Include stdlib.h * xtests/tst-pam_succeed_if1.c: Likewise. * xtests/tst-pam_limits1.c: Likewise. * xtests/tst-pam_access1.c: Likewise. * xtests/tst-pam_access2.c: Likewise. * xtests/tst-pam_access3.c: Likewise. * xtests/tst-pam_access4.c: Likewise. * xtests/tst-pam_unix1.c: Likewise. * xtests/tst-pam_unix2.c: Likewise. * xtests/tst-pam_unix3.c: Likewise. * xtests/tst-pam_cracklib1.c: Likewise. * xtests/tst-pam_cracklib2.c: Likewise. 2007-10-30 Peter Breitenlohner <peb@mppmu.mpg.de> * modules/pam_rhosts/pam_rhosts_auth.c (__icheckhost): Correct misplaced parenthesis. * modules/pam_unix/pam_unix_acct.c (pam_sm_acct_mgmt): Prevent use of dngettext() when NLS is disabled. * modules/pam_exec/pam_exec.c (call_exec): Avoid gcc warning. * doc/specs/parse_y.y (set_label, new_counter): Break trigraphs to avoid gcc warning. * modules/pam_wheel/pam_wheel.c: Remove excessive initializer elements.
* Relevant BUGIDs:Tomas Mraz2006-06-271-1/+1
| | | | | | | | | | | | | Purpose of commit: bugfix Commit summary: --------------- * modules/pam_unix/pam_unix_acct.c (_unix_run_verify_binary): signal() fails with SIG_ERR return * modules/pam_unix/pam_unix_passwd.c(_unix_run_shadow_binary): Likewise. * modules/pam_unix/support.c(_unix_run_helper_binary): Likewise.
* Relevant BUGIDs:Thorsten Kukuk2006-06-171-2/+2
| | | | | | | | | | | | | | | | | | Purpose of commit: bugfix Commit summary: --------------- 2006-06-17 Thorsten Kukuk <kukuk@thkukuk.de> * examples/vpass.c: UID is unsigned on Linux. * modules/pam_exec/pam_exec.c: Likewise. * modules/pam_unix/pam_unix_acct.c: Likewise. * modules/pam_unix/pam_unix_sess.c: Likewise. * modules/pam_succeed_if/pam_succeed_if.8.xml: Fix syntax error. * modules/pam_succeed_if/pam_succeed_if.8: Regenerated. * modules/pam_succeed_if/README: Regenerated.
* Relevant BUGIDs: 1427738Thorsten Kukuk2006-06-021-1/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Purpose of commit: new feature/bugfix Commit summary: --------------- 2006-06-02 Thorsten Kukuk <kukuk@thkukuk.de> * doc/man/PAM.8: Regenerate with DocBook XSL Stylesheets v1.70.1. * doc/man/pam.3: Likewise. * doc/man/pam.conf.5: Likewise. * doc/man/pam_acct_mgmt.3: Likewise. * doc/man/pam_authenticate.3: Likewise. * doc/man/pam_chauthtok.3: Likewise. * doc/man/pam_close_session.3: Likewise. * doc/man/pam_conv.3: Likewise. * doc/man/pam_end.3: Likewise. * doc/man/pam_error.3: Likewise. * doc/man/pam_fail_delay.3: Likewise. * doc/man/pam_get_data.3: Likewise. * doc/man/pam_get_item.3: Likewise. * doc/man/pam_get_user.3: Likewise. * doc/man/pam_getenv.3: Likewise. * doc/man/pam_getenvlist.3: Likewise. * doc/man/pam_info.3: Likewise. * doc/man/pam_open_session.3: Likewise. * doc/man/pam_prompt.3: Likewise. * doc/man/pam_putenv.3: Likewise. * doc/man/pam_set_data.3: Likewise. * doc/man/pam_set_item.3: Likewise. * doc/man/pam_setcred.3: Likewise. * doc/man/pam_sm_acct_mgmt.3: Likewise. * doc/man/pam_start.3: Likewise. * doc/man/pam_strerror.3: Likewise. * doc/man/pam_syslog.3: Likewise. * modules/pam_access/access.conf.5: Likewise. * modules/pam_access/pam_access.8: Likewise. * modules/pam_cracklib/pam_cracklib.8: Likewise. * modules/pam_deny/pam_deny.8: Likewise. * modules/pam_echo/pam_echo.8: Likewise. * modules/pam_env/pam_env.8: Likewise. * modules/pam_env/pam_env.conf.5: Likewise. * modules/pam_exec/pam_exec.8: Likewise. * modules/pam_filter/pam_filter.8: Likewise. * modules/pam_ftp/pam_ftp.8: Likewise. * modules/pam_group/group.conf.5: Likewise. * modules/pam_group/pam_group.8: Likewise. * modules/pam_issue/pam_issue.8: Likewise. * modules/pam_lastlog/pam_lastlog.8: Likewise. * modules/pam_mkhomedir/pam_mkhomedir.8: Likewise. * modules/pam_succeed_if/pam_succeed_if.8: Likewise. * modules/pam_umask/pam_umask.8: Likewise. * modules/pam_unix/pam_unix_acct.c (pam_sm_acct_mgmt): Use dngettext if available [#1427738]. * configure.in: Check for dngettext [#1427738]. * po/*.po: Update to dngettext usage. * modules/pam_listfile/Makefile.am: Include Make.xml.rules. * modules/pam_listfile/pam_listfile.8.xml: New. * modules/pam_listfile/pam_listfile.8: New, generated from xml file. * modules/pam_listfile/README.xml: New. * modules/pam_listfile/README: Regenerated from xml file.
* Relevant BUGIDs: 1427738Thorsten Kukuk2006-05-021-2/+7
| | | | | | | | | | | | | | Purpose of commit: bugfix Commit summary: --------------- 2006-05-02 Thorsten Kukuk <kukuk@suse.de> * modules/pam_unix/pam_unix_acct.c (pam_sm_acct_mgmt): Use different strings for plural or not [#1427738] * po/*.po: Adjust for pam_unix.so translation fix.
* Relevant BUGIDs: Red Hat bz 168180Tomas Mraz2005-10-261-0/+7
| | | | | | | | | | | | | | | Purpose of commit: bugfix Commit summary: --------------- 2005-10-26 Tomas Mraz <t8m@centrum.cz> * modules/pam_unix/pam_unix_acct.c (_unix_run_verify_binary), modules/pam_unix/pam_unix_passwd.c (_unix_run_shadow_binary), modules/pam_unix/support.c (_unix_run_shadow_binary_): Set real uid to 0 before executing the helper if SELinux is enabled. * modules/pam_unix/unix_chkpwd.c (main): Disable user check only if real uid is 0 (CVE-2005-2977). Log failed password check attempt.
* Relevant BUGIDs:Tomas Mraz2005-09-261-35/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Purpose of commit: cleanup Commit summary: --------------- 2005-09-26 Tomas Mraz <t8m@centrum.cz> * modules/pam_unix/pam_unix_acct.c (_unix_run_verify_binary): _log_err() -> pam_syslog() (pam_sm_acct_mgmt): _log_err() -> pam_syslog(), fix warning. * modules/pam_unix/pam_unix_auth.c (pam_sm_authenticate): _log_err() -> pam_syslog() * modules/pam_unix/pam_unix_passwd.c: removed obsolete ifdef (getNISserver, _unix_run_shadow_binary, _update_passwd, _update_shadow, _do_setpass, _pam_unix_approve_pass, pam_sm_chauthtok): _log_err() -> pam_syslog() * modules/pam_unix/pam_unix_sess.c: removed obsolete ifdef (pam_sm_open_session, pam_sm_close_session): _log_err() -> pam_syslog() * modules/pam_unix/support.c (_log_err, converse): removed (_make_remark): use pam_prompt() instead of converse() (_set_ctrl, _cleanup_failures, _unix_run_helper_binary, _unix_verify_password, _unix_read_password): _log_err() -> pam_syslog() _cleanup(), _unix_cleanup(): Silence unused param warnings. (_cleanup_failures, _unix_verify_password, _unix_getpwnam, _unix_run_helper_binary): Silence incorrect type warnings. (_unix_read_password): Use multiple pam_prompt() and pam_info() calls instead of converse(). * modules/pam_unix/support.h (_log_err): removed * modules/pam_unix/unix_chkpwd.c (_log_err): LOG_AUTH -> LOG_AUTHPRIV
* Relevant BUGIDs:Tomas Mraz2005-09-211-5/+5
| | | | | | | | Purpose of commit: new feature Commit summary: --------------- Moved functions from pammodutil to libpam.
* Relevant BUGIDs: noneThorsten Kukuk2005-08-161-2/+2
| | | | | | | | | Purpose of commit: new feature Commit summary: --------------- Big "automake/autoconf/libtool" commit
* Relevant BUGIDs: noneThorsten Kukuk2005-07-201-6/+6
| | | | | | | | | Purpose of commit: new feature Commit summary: --------------- Mark message strings for translation
* Relevant BUGIDs: noneThorsten Kukuk2005-07-201-1/+1
| | | | | | | | | Purpose of commit: cleanup Commit summary: --------------- Rename _pam_aconf.h to config.h.
* Relevant BUGIDs: noneThorsten Kukuk2005-06-091-2/+2
| | | | | | | | | | Purpose of commit: cleanup Commit summary: --------------- Fix all occurrence of dereferencing type-punned pointer will break strict-aliasing rules warnings
* Relevant BUGIDs: noneThorsten Kukuk2005-05-161-3/+126
| | | | | | | | | Purpose of commit: new feature Commit summary: --------------- Add SELinux support, based on Patch from Red Hat
* Relevant BUGIDs: Red Hat bz 139539Tomas Mraz2004-12-031-14/+20
| | | | | | | | | Purpose of commit: bugfix Commit summary: --------------- Rearrange conditions in pam_unix_acct to make it more reliable with large values of expiration times.
* Relevant BUGIDs: Redhat bz 69279Tomas Mraz2004-11-171-2/+1
| | | | | | | | Purpose of commit: bugfix Commit summary: --------------- pam_unix: Forced password change shouldn't trump account expiration
* Relevant BUGIDs:Thorsten Kukuk2004-10-061-3/+2
| | | | | | | | | Purpose of commit: Commit summary: --------------- bugfix: Last part of fixes from Red Hat
* Relevant BUGIDs:Thorsten Kukuk2004-09-241-3/+4
| | | | | | | | | | Purpose of commit: Commit summary: --------------- bugfix: 440107: Add various patches from Linux Distibutors to make PAM modules reentrant.
* Relevant BUGIDs:Thorsten Kukuk2004-09-241-0/+4
| | | | | | | | | | | Purpose of commit: Commit summary: --------------- bugfix: Fix lot of compiler warnings new feature: add broken_shadow option to pam_unix (patch from Linux distributions)
* Relevant BUGIDs: 126431, 126423Steve Langasek2000-12-201-8/+8
| | | | | | | | | | | | Purpose of commit: new feature / bugfix Commit summary: --------------- This changes the format of pam_unix log messages, per bug 126423. The change is extensive (every call to _log_err() now has an additional argument) but straightforward. These changes to the logging code incidentally fix the problem reported in bug 126431.
* Relevant BUGIDs: task 15788, bugs 108297, 117476, 117474Andrew G. Morgan2000-11-191-7/+1
| | | | | | | | | | | | | | Purpose of commit: autoconf support for Linux-PAM Commit summary: --------------- This is a merge of the autoconf support that was developed against a 0-72 branch. [Note, because CVS has some issues, this is actually only 95% of the actual commit. The other files were actually committed when the preparation branch Linux-PAM-0-73pre-autoconf was updated. Hopefully, this will complete the merge.]
* Initial revisionAndrew G. Morgan2000-06-201-0/+210
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-14 18:19:00 +0000