aboutsummaryrefslogtreecommitdiff
path: root/modules
Commit message (Collapse)AuthorAgeFilesLines
...
* modules: enclose macro parameterChristian Göttsche2024-02-226-14/+14
|
* pam_unix: avoid string formatting of NULLChristian Göttsche2024-02-221-2/+3
| | | | | | | Since the struct member user might be NULL use the same condition for the value as for the preceding key. Reported-by: Yugend
* pam_xauth: untangle stringsChristian Göttsche2024-02-221-10/+13
| | | | | | | | Untangle two distinct strings to simplify their usage. Check for allocation failure of the second one. Fix double-free of the second one in the error branch in line 692. Reported-by: Yugend
* pam_xauth: sanitize variable after asprintf(3) failureChristian Göttsche2024-02-221-0/+1
| | | | | On asprintf(3) failure the value of the first argument is undefined. Set to NULL to avoid UB on cleanup.
* pam_limits: print line number in warningTobias Stoeckmann2024-02-071-1/+5
| | | | | | | The line itself is modified while parsing its content. Print the line number and file name instead so an administrator can investigate it. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_limits: remove whitespaces around valueTobias Stoeckmann2024-02-061-1/+21
| | | | | | | | | Trim all whitespaces before and after value. Resolves: https://github.com/linux-pam/linux-pam/pull/760 Fixes: eec4358a49dc ("pam_limits: avoid sscanf in parse_config_file") Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* libpam_internal: introduce pam_lineTobias Stoeckmann2024-02-062-8/+9
| | | | | | | | | | | The pam_assemble_line function is renamed to pam_line_assemble and moved into libpam_internal so it can be shared across libpam and the pam_env module. Applied renaming to all other relevant functions and data structures so it is easier to locate them in files. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_unix: try to set uid to 0 for unix_chkpwdTobias Stoeckmann2024-01-242-15/+16
| | | | | | | | | | | | | The geteuid check does not cover all cases. If a program runs with elevated capabilities like CAP_SETUID then we can still check credentials of other users. Keep logging for future analysis though. Resolves: https://github.com/linux-pam/linux-pam/issues/747 Fixes: b3020da7da38 ("pam_unix/passverify: always run the helper to obtain shadow password file entries") Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* libpam_internal: supply debug functionalityTobias Stoeckmann2024-01-2414-17/+33
| | | | | | | | | | Move function bodies from headers into dedicated object files stored in libpam_internal. This library won't be installed. Keep the debug function body in header, even though disabled when building Linux-PAM, to stay API compatible with previous versions. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_faildelay: add more tests to delay parserTobias Stoeckmann2024-01-211-1/+1
| | | | Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_faildelay: support UINT_MAX delay on 32 bitTobias Stoeckmann2024-01-211-8/+8
| | | | | | | | Use strtoll to support up to 64 bit on 32 bit systems, although only up to 32 unsigned bits are used. The strtoul function exists but converts negative numbers to positive ones without any form of warning. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* modules: add pamc headers to the search path only when neededTobias Stoeckmann2024-01-2146-88/+50
| | | | | | | | | The pam client library libpamc is only needed if libpam_misc is in use. But libpam_misc is only used by an SELinux helper binary. Remove the libpamc includes from the search path in all other cases. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_pwhistory: allocate crypt data on the heapChristian Göttsche2024-01-211-9/+26
| | | | | The struct crypt_data has the size of 32768 bytes, thus allocate it on the heap for portability.
* pam_userdb: cleanse crypt dataChristian Göttsche2024-01-211-0/+1
| | | | Clease the crypt data to avoid any potential information leakage.
* pam_unix: cleanse crypt dataChristian Göttsche2024-01-211-0/+1
| | | | | Cleanse the crypt data also in the failure branch to sanitize in case of partial data being written.
* modules: zero out crypt_r(3) data before usageChristian Göttsche2024-01-214-11/+5
| | | | The manual page of crypt_r(3) recommends to zero the entire data object.
* pam_faildelay: fix compilation warnings on 32bit platformsDmitry V. Levin2024-01-201-2/+2
| | | | | | | | | | | | | | | | | Fix the following warning reported by gcc on 32bit platforms: pam_faildelay.c: In function 'pam_sm_authenticate': pam_faildelay.c:104:34: error: comparison of integer expressions of different signedness: 'long int' and 'unsigned int' [-Werror=sign-compare] 104 | if (delay < 0 || delay > UINT_MAX) | ^ pam_faildelay.c:123:32: error: comparison of integer expressions of different signedness: 'long int' and 'unsigned int' [-Werror=sign-compare] 123 | if (delay < 0 || delay > UINT_MAX / S_TO_MICROS) | ^ * modules/pam_faildelay/pam_faildelay.c (pam_sm_authenticate): Cast "delay" to "unsigned long" in comparisons with unsigned int. Fixes: dd87776d3683 ("pam_faildelay: validate parameter ranges")
* pam_namespace: use sed instead of awk in namespace.initDmitry V. Levin2024-01-201-1/+1
| | | | | | | | | Given that sed is considered a more lightweight dependency than awk, and since sed is used by pam_namespace_helper anyway, use sed instead of awk in namespace.init as well. * modules/pam_namespace/namespace.init: Use sed instead of awk to obtain the UMASK value from /etc/login.defs.
* pam_unix: do not warn if password aging is disabledTobias Stoeckmann2024-01-191-1/+0
| | | | | | | | | Later checks will print a warning if daysleft is 0. If password aging is disabled, leave daysleft at -1. Resolves: https://github.com/linux-pam/linux-pam/issues/743 Fixes: 9ebc14085a3b ("pam_unix: allow disabled password aging") Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_env: remove escaped newlines from econf linesTobias Stoeckmann2024-01-181-0/+23
| | | | | | | | | The libeconf routines do not remove escaped newlines the way we want to process them later on. Manually remove them from values. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org> Resolves: https://github.com/linux-pam/linux-pam/issues/738 Fixes: 6135c45347b6 ("pam_env: Use vendor specific pam_env.conf and environment as fallback")
* pam_env: fix --enable-vendordir fallback logicDmitry V. Levin2024-01-181-11/+11
| | | | | | | | | * modules/pam_env/pam_env.c (_parse_config_file) [!USE_ECONF && VENDOR_DEFAULT_CONF_FILE]: Do not fallback to vendor pam_env.conf file if the config file is specified via module arguments. Link: https://github.com/linux-pam/linux-pam/issues/738 Fixes: v1.5.3~69 ("pam_env: Use vendor specific pam_env.conf and environment as fallback")
* pam_env: check VENDORDIR after config.h inclusionTobias Stoeckmann2024-01-181-9/+9
| | | | | | | | | The VENDORDIR define has to be checked after config.h inclusion, otherwise the ifdef test always yields false. Fixes: 6135c45347b6 ("pam_env: Use vendor specific pam_env.conf and environment as fallback") Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_namespace: include stdint.hJacob Heider2024-01-171-0/+2
| | | | | | | | | | | | | | | | | | | | pam_namespace.c makes use of SIZE_MAX but doesn't include stdint.h, resulting in the following build failures on 1.6.0: pam_namespace.c: In function 'process_line': pam_namespace.c:649:41: error: 'SIZE_MAX' undeclared (first use in this function) 649 | if (count > UINT_MAX || count > SIZE_MAX / sizeof(uid_t)) { | ^~~~~~~~ pam_namespace.c:41:1: note: 'SIZE_MAX' is defined in header '<stdint.h>'; did you forget to '#include <stdint.h>'? 40 | #include "argv_parse.h" +++ |+#include <stdint.h> 41 | pam_namespace.c:649:41: note: each undeclared identifier is reported only once for each function it appears in 649 | if (count > UINT_MAX || count > SIZE_MAX / sizeof(uid_t)) { | ^~~~~~~~ Fixes: v1.6.0~100 ("pam_namespace: validate amount of uids in config") Resolves: https://github.com/linux-pam/linux-pam/issues/733
* pam_namespace: protect_dir(): use O_DIRECTORY to prevent local DoS situationsMatthias Gerstner2024-01-171-17/+1
| | | | | | | | | | | | Without O_DIRECTORY the path crawling logic is subject to e.g. FIFOs being placed in user controlled directories, causing the PAM module to block indefinitely during `openat()`. Pass O_DIRECTORY to cause the `openat()` to fail if the path does not refer to a directory. With this the check whether the final path element is a directory becomes unnecessary, drop it.
* pam_pwhistory: fix typo in example configurationTobias Stoeckmann2024-01-161-1/+1
| | | | | | The option file points to a file, not a directory. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_unix: fix typos in commentsChristian Göttsche2024-01-162-2/+2
|
* pam_pwhistory: use cp variable only when neededTobias Stoeckmann2024-01-161-17/+13
| | | | | | | Removes its usage from check_old_pass and reduces its visibility in save_old_pass. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_pwhistory: parse opasswd lines verbatimTobias Stoeckmann2024-01-161-16/+4
| | | | | | | | Users may have a hash character in their name, which would be removed. This in turn effectively defeats the purpose of pam_pwhistory for the user. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_unix: do not allow comma as a field separatorTobias Stoeckmann2024-01-162-9/+8
| | | | | | | | | | | The opasswd file shall not use comma as a separator. Enforce colon just like pam_pwhistory does as well. A comma can be part of a user name, although its usage is discouraged. If such a user exists, it could happen that stored passwords of another user are checked. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* modules: do not invoke getline(3) unnecessarilyDmitry V. Levin2024-01-162-3/+2
| | | | | | | | | | | | Replace while (getline(...) != -1 && retval) with while (retval && getline(...) != -1) * modules/pam_listfile/pam_listfile.c (pam_listfile): Do not invoke getline(3) when its result is going to be ignored. * modules/pam_securetty/pam_securetty.c (securetty_perform_check): Likewise.
* pam_unix: declare read-only data array constChristian Göttsche2024-01-151-1/+1
|
* pam_unix: log about failure to execute unix_chkpwd(8)Christian Göttsche2024-01-151-1/+1
|
* pam_unix: clean additional possible sensitive buffersChristian Göttsche2024-01-153-2/+7
|
* pam_unix: use more appropriate typesChristian Göttsche2024-01-152-5/+5
|
* pam_unix: retain const qualifierChristian Göttsche2024-01-151-6/+6
|
* pam_unix: enclose macro argumentsChristian Göttsche2024-01-151-3/+3
|
* pam_unix: set close-on-execChristian Göttsche2024-01-154-24/+13
| | | | | | | | | Since the module operates on sensitive files set the close-on-exec flag, to avoid file descriptor leaks if there is ever any sibling thread. The fopen(3) mode "e" is supported in glibc since version 2.7 (released in 2007), and ignored prior, see: https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=65d834b0add966dbbdb5ed1e916c60b2b2d87f10
* pam_unix: support setgid version of unix_chkpwd(8)Christian Göttsche2024-01-151-2/+7
| | | | | | | | | | | In case unix_chkpwd(8) is not a setuid but a setgid binary, reset to the real group as well. Also check the privileges are permanently lost, see: https://wiki.sei.cmu.edu/confluence/display/c/POS37-C.+Ensure+that+privilege+relinquishment+is+successful See also the current Debian patch: https://sources.debian.org/src/pam/1.5.2-9.1/debian/patches-applied/pam_unix_dont_trust_chkpwd_caller.patch/
* pam_unix: reject unix_update(8) running on different unprivileged userChristian Göttsche2024-01-151-3/+13
| | | | | | In case unix_update(8) is installed as a setuid binary, which Fedora and Debian does not do, prevent unprivileged users to probe (and eventually change) passwords of other users (including root).
* pam_unix: add audit support to unix_update(8)Christian Göttsche2024-01-152-1/+18
| | | | | | | Emit audit reports in the helper unix_update(8) about abnormal executions, unprivileged authentications, and password updates. Also log unprivileged authentication failures to syslog.
* pam_unix: refactor audit loggingChristian Göttsche2024-01-155-36/+61
| | | | | Split the audit logging code into a separate file, to be reused by unix_update(8).
* pam_unix: fix regressionsTobias Stoeckmann2024-01-152-2/+1
| | | | | | | | | | | | The returned value stored in pwd from _unix_getpwnam is inserted into pam handler through pam_set_data. Do not manually free the value. Also check getline return value for != -1 instead of == -1. Fixes 8f2ca5919b26843ef774ef0aeb9bf261dec943a0 and 73d009e9ea8edafc18c7fe3650b25dd6bdce88c1. No release affected. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_pwhistory: disable SELinux code if not usedTobias Stoeckmann2024-01-151-0/+6
| | | | | | Disable code to run helper binary if SELinux is not enabled. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_pwhistory: build pwhistory_helper only with SELinux enabledTobias Stoeckmann2024-01-151-3/+12
| | | | | | | | | | | Apply the same logic of pam_unix Makefile adjustment for pw_history as well. Reference commit is cb9f88ba944d56c0b6c65be18500f7d56c9f514c. The helper pwhistory_helper(8) is only called from code enabled when SELinux support is enabled. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_pwhistory: annotate declaration with format attributeChristian Göttsche2024-01-152-1/+1
| | | | | Instead of annotating the function definition with the format attribute annotate the declaration, so the annotation is visible at call sites.
* pam_unix: annotate declaration with format attributeChristian Göttsche2024-01-152-1/+1
| | | | | Instead of annotating the function definition with the format attribute annotate the declaration, so the annotation is visible at call sites.
* pam_succeed_if: add unit testTobias Stoeckmann2024-01-142-1/+91
| | | | | | Cover previous changes with unit test. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_succeed_if: empty strings are no numberTobias Stoeckmann2024-01-141-2/+2
| | | | | | | If an empty string is encountered, do not treat it as 0. Instead, return PAM_SERVICE_ERR as specified in comment. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_succeed_if: allow very long field valuesTobias Stoeckmann2024-01-141-23/+16
| | | | | | | | | | | | | Fields are currently written to stack buffer, even if they already exist in heap. Just reference them in this case. If numbers have to be stored as a string, use a stack buffer sufficiently large for the long long conversion (64 bit). Also adjust the "left != buf" check to allow this change. It is simply the else-statement to previous if-else-if-block, because in every other case left is set to buf. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* treewide: remove unused definesTobias Stoeckmann2024-01-133-6/+0
| | | | | | These are leftovers from fgets usages. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-08 05:37:05 +0000