aboutsummaryrefslogtreecommitdiff
path: root/modules
Commit message (Collapse)AuthorAgeFilesLines
* pam_access: support UID and GID in access.confMatthew Luckam2024-08-132-6/+65
| | | | | | | | | | | Extend access.conf(5) syntax to support UID and GID in addition to user and group names. Co-authored-by: blueskycs2c <lili.ding@cs2c.com> Signed-off-by: Dmitry V. Levin <ldv@strace.io> Resolves: https://github.com/linux-pam/linux-pam/issues/114 Resolves: https://github.com/linux-pam/linux-pam/pull/186 Resolves: https://github.com/linux-pam/linux-pam/pull/601
* pam_faillock: silence compilation warningDmitry V. Levin2024-07-281-1/+2
| | | | | | | | | | | | | | | | Since audit_log_acct_message() was decorated with warn_unused_result attribute, compilation of faillock helper produces the following diagnostics: main.c: In function 'do_user': main.c:250:25: warning: ignoring return value of 'audit_log_acct_message' declared with attribute 'warn_unused_result' [-Wunused-result] Given that this helper has never been picky about audit, e.g. audit_open() errors do not affect its exit status, just silence this new warning. * modules/pam_faillock/main.c [HAVE_LIBAUDIT] (do_user): Silence compilation warning.
* libpam_internal: introduce pam_econf_readconfigStefan Schubert2024-07-024-20/+24
| | | | | | | Use this new function instead of econf_readDirs() and econf_readDirsWithCallback(). Co-authored-by: Dmitry V. Levin <ldv@strace.io>
* pam_xauth: improve error logging on selabel lookupChristian Göttsche2024-05-241-2/+5
| | | | | | Log in case the database could not be initialized. Include the errno on lookup failure.
* pam_namespace: log getfscreatecon(3) failureChristian Göttsche2024-05-241-1/+3
| | | | Log in case the current fscreate context could not be retrieved.
* pam_namespace: free SELinux context on error pathIker Pedrosa2024-05-231-0/+3
| | | | | | | | | | | | | | | | | | | * modules/pam_namespace/pam_namespace.c (create_polydir) [WITH_SELINUX]: Free SELinux context in case of an error. ``` Error: RESOURCE_LEAK (CWE-772): Linux-PAM-1.6.0/modules/pam_namespace/pam_namespace.c:1433: alloc_arg: "getfscreatecon_raw" allocates memory that is stored into "oldcon_raw". Linux-PAM-1.6.0/modules/pam_namespace/pam_namespace.c:1462: leaked_storage: Variable "oldcon_raw" going out of scope leaks the storage it points to. 1460| pam_syslog(idata->pamh, LOG_ERR, 1461| "Error creating directory %s: %m", dir); 1462|-> return PAM_SESSION_ERR; 1463| } 1464| ``` Resolves: https://issues.redhat.com/browse/RHEL-36475 Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
* pam_namespace: free SELinux contextIker Pedrosa2024-05-231-0/+1
| | | | | | | | | | | | | | | | | | | * modules/pam_namespace/pam_namespace.c [WITH_SELINUX] (form_context): Free SELinux context before returning. ``` Error: RESOURCE_LEAK (CWE-772): Linux-PAM-1.6.0/modules/pam_namespace/pam_namespace.c:928: alloc_arg: "getexeccon" allocates memory that is stored into "scon". Linux-PAM-1.6.0/modules/pam_namespace/pam_namespace.c:1004: leaked_storage: Variable "scon" going out of scope leaks the storage it points to. 1002| } 1003| /* Should never get here */ 1004|-> return PAM_SUCCESS; 1005| } 1006| #endif ``` Resolves: https://issues.redhat.com/browse/RHEL-36475 Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
* pam_timestamp: close the timestamp file on error pathIker Pedrosa2024-05-231-0/+1
| | | | | | | | | | | | | | | | | | | | | | * modules/pam_timestamp/pam_timestamp.c (pam_sm_authenticate) [WITH_OPENSSL]: Close the timestamp file if hmac_size returned an error. ``` Error: RESOURCE_LEAK (CWE-772): Linux-PAM-1.6.0/modules/pam_timestamp/pam_timestamp.c:450: open_fn: Returning handle opened by "open". [Note: The source code implementation of the function has been overridden by a user model.] Linux-PAM-1.6.0/modules/pam_timestamp/pam_timestamp.c:450: var_assign: Assigning: "fd" = handle returned from "open(path, 131072)". Linux-PAM-1.6.0/modules/pam_timestamp/pam_timestamp.c:460: noescape: Resource "fd" is not freed or pointed-to in "fstat". Linux-PAM-1.6.0/modules/pam_timestamp/pam_timestamp.c:484: leaked_handle: Handle variable "fd" going out of scope leaks the handle. 482| #ifdef WITH_OPENSSL 483| if (hmac_size(pamh, debug, &maclen)) { 484|-> return PAM_AUTH_ERR; 485| } 486| #else ``` Resolves: https://issues.redhat.com/browse/RHEL-36475 Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
* pam_rootok: close the audit socket on error pathIker Pedrosa2024-05-231-0/+1
| | | | | | | | | | | | | | | | | | | | * modules/pam_rootok/pam_rootok.c (log_callback): Close the audit socket if vasprintf returned an error. ``` Error: RESOURCE_LEAK (CWE-772): Linux-PAM-1.6.0/modules/pam_rootok/pam_rootok.c:59: open_fn: Returning handle opened by "audit_open". Linux-PAM-1.6.0/modules/pam_rootok/pam_rootok.c:59: var_assign: Assigning: "audit_fd" = handle returned from "audit_open()". Linux-PAM-1.6.0/modules/pam_rootok/pam_rootok.c:69: leaked_handle: Handle variable "audit_fd" going out of scope leaks the handle. 67| va_end(ap); 68| if (ret < 0) { 69|-> return 0; 70| } 71| audit_log_user_avc_message(audit_fd, AUDIT_USER_AVC, buf, NULL, NULL, ``` Resolves: https://issues.redhat.com/browse/RHEL-36475 Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
* pam_faillock: close the audit socket after useIker Pedrosa2024-05-231-0/+1
| | | | | | | | | | | | | | | | | | | | | * modules/pam_faillock/pam_faillock.c (check_tally): Close the audit socket when it will no longer be used. ``` Error: RESOURCE_LEAK (CWE-772): Linux-PAM-1.6.0/modules/pam_faillock/pam_faillock.c:247: open_fn: Returning handle opened by "audit_open". Linux-PAM-1.6.0/modules/pam_faillock/pam_faillock.c:247: var_assign: Assigning: "audit_fd" = handle returned from "audit_open()". Linux-PAM-1.6.0/modules/pam_faillock/pam_faillock.c:256: noescape: Resource "audit_fd" is not freed or pointed-to in "audit_log_user_message". Linux-PAM-1.6.0/modules/pam_faillock/pam_faillock.c:258: leaked_handle: Handle variable "audit_fd" going out of scope leaks the handle. 256| audit_log_user_message(audit_fd, AUDIT_RESP_ACCT_UNLOCK_TIMED, buf, 257| rhost, NULL, tty, 1); 258|-> } 259| #endif 260| opts->flags |= FAILLOCK_FLAG_UNLOCKED; ``` Resolves: https://issues.redhat.com/browse/RHEL-36475 Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
* pam_env: fix error handling in econf_read_fileDmitry V. Levin2024-05-191-4/+4
| | | | | | * modules/pam_env/pam_env.c [USE_ECONF] (econf_read_file): Make sure the returned array of strings is properly initialized when econf_getStringValue() fails to return a value.
* pam_env: fix NULL dereference on error path in econf_read_fileDmitry V. Levin2024-05-191-1/+1
| | | | | | | * modules/pam_env/pam_env.c [USE_ECONF] (econf_read_file): Handle NULL value returned by econf_getStringValue(). Resolves: https://github.com/linux-pam/linux-pam/issues/796
* Move all historic changelog files to a top-level ChangeLog.old directoryDmitry V. Levin2024-05-151-54/+0
| | | | Move all historic changelog files away to avoid confusion.
* build: do not distribute historic changelog filesDmitry V. Levin2024-05-151-1/+1
| | | | | | | | | | | | | Since 2011, ChangeLog file is generated from git log history. ChangeLog-CVS is a historic changelog file that was maintained before the project was migrated from cvs to git. CHANGELOG is another historic changelog file that was replaced by ChangeLog in 2005. modules/pam_unix/CHANGELOG is the oldest of historic changelog files, it is not maintained since 1999. All these historic changelog files are no longer relevant, so they are no longer included into release tarballs.
* pam_umask: document details about the GECOS fieldChristoph Anton Mitterer2024-04-151-2/+4
| | | | Signed-off-by: Christoph Anton Mitterer <mail@christoph.anton.mitterer.name>
* pam_umask: minor improvements to wordingChristoph Anton Mitterer2024-04-151-6/+6
| | | | | | The previous sentence was strange to read. Signed-off-by: Christoph Anton Mitterer <mail@christoph.anton.mitterer.name>
* pam_unix: compare password hashes in constant timeChristian Göttsche2024-04-131-2/+2
| | | | | Compare the hashes in constant time as a defense-in-depth mechanism, since performance is not a priority.
* doc: fix uses of non-neutral gender pronounsAura Herrero Ruiz2024-04-026-12/+12
|
* pam_env: document when the module is executedThorsten Kukuk2024-03-311-2/+19
| | | | | | | | Document that pam_env.so is only called by pam_setcred() and not by pam_authenticate() when added to the auth stack. Resolves: https://github.com/linux-pam/linux-pam/issues/680 Signed-off-by: Thorsten Kukuk <kukuk@suse.com>
* pam_unix: allow empty passwords with non-empty hashesSergei Trofimovich2024-03-291-8/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Before the change pam_unix has different behaviours for a user with empty password for these two `/etc/shadow` entries: nulloktest:$6$Yy4ty2jJ$bsVQWo8qlXC6UHq1/qTC3UR60ZJKmKApJ3Wj7DreAy8FxlVKtlDnplFQ7jMLVlDqordE7e4t49GvTb.aI59TP0:1:::::: nulloktest::1:::::: The entry with a hash was rejected and the entry without was accepted. The rejection happened because 9e74e90147c "pam_unix: avoid determining if user exists" introduced the following rejection check (slightly simplified): ... } else if (p[0] == '\0' && nullok) { if (hash[0] != '\0') { retval = PAM_AUTH_ERR; } We should not reject the user with a hash assuming it's non-empty. The change does that by pushing empty password check into `verify_pwd_hash()`. `NixOS` generates such hashed entries for empty passwords as if they were non-empty using the following perl code: sub hashPassword { my ($password) = @_; my $salt = ""; my @chars = ('.', '/', 0..9, 'A'..'Z', 'a'..'z'); $salt .= $chars[rand 64] for (1..8); return crypt($password, '$6$' . $salt . '$'); } Resolves: https://github.com/linux-pam/linux-pam/issues/758 Fixes: 9e74e90147c "pam_unix: avoid determining if user exists" Signed-off-by: Sergei Trofimovich <slyich@gmail.com>
* pam_limits: fix potential use-after-free of pl->conf_fileShaleen Bathla2024-03-041-2/+10
| | | | | | | | | | When limits.d is processed, pl->conf_file consequently points to elements of filename_list array which are freed later even though it can still be used in the logging. Signed-off-by: Shaleen Bathla <shaleen.bathla@oracle.com> Co-authored-by: Dmitry V. Levin <ldv@strace.io> Fixes: f6b973b92281 ("Add support for limits.d directory to pam_limits")
* pam_unix: use yp functions only if nis requestedTobias Stoeckmann2024-03-031-1/+1
| | | | | | | It can happen that yp functions are found in system but their header files are not available. In this case, do not call them. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* conf/modules: constify read-only data arraysChristian Göttsche2024-02-223-7/+7
|
* pam_unix: drop cast to same typeChristian Göttsche2024-02-221-1/+1
|
* modules: drop redundant return at end of void functionsChristian Göttsche2024-02-223-3/+0
|
* pam_faillock: drop duplicate includeChristian Göttsche2024-02-221-1/+0
|
* modules: enclose macro parameterChristian Göttsche2024-02-226-14/+14
|
* pam_unix: avoid string formatting of NULLChristian Göttsche2024-02-221-2/+3
| | | | | | | Since the struct member user might be NULL use the same condition for the value as for the preceding key. Reported-by: Yugend
* pam_xauth: untangle stringsChristian Göttsche2024-02-221-10/+13
| | | | | | | | Untangle two distinct strings to simplify their usage. Check for allocation failure of the second one. Fix double-free of the second one in the error branch in line 692. Reported-by: Yugend
* pam_xauth: sanitize variable after asprintf(3) failureChristian Göttsche2024-02-221-0/+1
| | | | | On asprintf(3) failure the value of the first argument is undefined. Set to NULL to avoid UB on cleanup.
* pam_limits: print line number in warningTobias Stoeckmann2024-02-071-1/+5
| | | | | | | The line itself is modified while parsing its content. Print the line number and file name instead so an administrator can investigate it. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_limits: remove whitespaces around valueTobias Stoeckmann2024-02-061-1/+21
| | | | | | | | | Trim all whitespaces before and after value. Resolves: https://github.com/linux-pam/linux-pam/pull/760 Fixes: eec4358a49dc ("pam_limits: avoid sscanf in parse_config_file") Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* libpam_internal: introduce pam_lineTobias Stoeckmann2024-02-062-8/+9
| | | | | | | | | | | The pam_assemble_line function is renamed to pam_line_assemble and moved into libpam_internal so it can be shared across libpam and the pam_env module. Applied renaming to all other relevant functions and data structures so it is easier to locate them in files. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_unix: try to set uid to 0 for unix_chkpwdTobias Stoeckmann2024-01-242-15/+16
| | | | | | | | | | | | | The geteuid check does not cover all cases. If a program runs with elevated capabilities like CAP_SETUID then we can still check credentials of other users. Keep logging for future analysis though. Resolves: https://github.com/linux-pam/linux-pam/issues/747 Fixes: b3020da7da38 ("pam_unix/passverify: always run the helper to obtain shadow password file entries") Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* libpam_internal: supply debug functionalityTobias Stoeckmann2024-01-2414-17/+33
| | | | | | | | | | Move function bodies from headers into dedicated object files stored in libpam_internal. This library won't be installed. Keep the debug function body in header, even though disabled when building Linux-PAM, to stay API compatible with previous versions. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_faildelay: add more tests to delay parserTobias Stoeckmann2024-01-211-1/+1
| | | | Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_faildelay: support UINT_MAX delay on 32 bitTobias Stoeckmann2024-01-211-8/+8
| | | | | | | | Use strtoll to support up to 64 bit on 32 bit systems, although only up to 32 unsigned bits are used. The strtoul function exists but converts negative numbers to positive ones without any form of warning. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* modules: add pamc headers to the search path only when neededTobias Stoeckmann2024-01-2146-88/+50
| | | | | | | | | The pam client library libpamc is only needed if libpam_misc is in use. But libpam_misc is only used by an SELinux helper binary. Remove the libpamc includes from the search path in all other cases. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_pwhistory: allocate crypt data on the heapChristian Göttsche2024-01-211-9/+26
| | | | | The struct crypt_data has the size of 32768 bytes, thus allocate it on the heap for portability.
* pam_userdb: cleanse crypt dataChristian Göttsche2024-01-211-0/+1
| | | | Clease the crypt data to avoid any potential information leakage.
* pam_unix: cleanse crypt dataChristian Göttsche2024-01-211-0/+1
| | | | | Cleanse the crypt data also in the failure branch to sanitize in case of partial data being written.
* modules: zero out crypt_r(3) data before usageChristian Göttsche2024-01-214-11/+5
| | | | The manual page of crypt_r(3) recommends to zero the entire data object.
* pam_faildelay: fix compilation warnings on 32bit platformsDmitry V. Levin2024-01-201-2/+2
| | | | | | | | | | | | | | | | | Fix the following warning reported by gcc on 32bit platforms: pam_faildelay.c: In function 'pam_sm_authenticate': pam_faildelay.c:104:34: error: comparison of integer expressions of different signedness: 'long int' and 'unsigned int' [-Werror=sign-compare] 104 | if (delay < 0 || delay > UINT_MAX) | ^ pam_faildelay.c:123:32: error: comparison of integer expressions of different signedness: 'long int' and 'unsigned int' [-Werror=sign-compare] 123 | if (delay < 0 || delay > UINT_MAX / S_TO_MICROS) | ^ * modules/pam_faildelay/pam_faildelay.c (pam_sm_authenticate): Cast "delay" to "unsigned long" in comparisons with unsigned int. Fixes: dd87776d3683 ("pam_faildelay: validate parameter ranges")
* pam_namespace: use sed instead of awk in namespace.initDmitry V. Levin2024-01-201-1/+1
| | | | | | | | | Given that sed is considered a more lightweight dependency than awk, and since sed is used by pam_namespace_helper anyway, use sed instead of awk in namespace.init as well. * modules/pam_namespace/namespace.init: Use sed instead of awk to obtain the UMASK value from /etc/login.defs.
* pam_unix: do not warn if password aging is disabledTobias Stoeckmann2024-01-191-1/+0
| | | | | | | | | Later checks will print a warning if daysleft is 0. If password aging is disabled, leave daysleft at -1. Resolves: https://github.com/linux-pam/linux-pam/issues/743 Fixes: 9ebc14085a3b ("pam_unix: allow disabled password aging") Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_env: remove escaped newlines from econf linesTobias Stoeckmann2024-01-181-0/+23
| | | | | | | | | The libeconf routines do not remove escaped newlines the way we want to process them later on. Manually remove them from values. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org> Resolves: https://github.com/linux-pam/linux-pam/issues/738 Fixes: 6135c45347b6 ("pam_env: Use vendor specific pam_env.conf and environment as fallback")
* pam_env: fix --enable-vendordir fallback logicDmitry V. Levin2024-01-181-11/+11
| | | | | | | | | * modules/pam_env/pam_env.c (_parse_config_file) [!USE_ECONF && VENDOR_DEFAULT_CONF_FILE]: Do not fallback to vendor pam_env.conf file if the config file is specified via module arguments. Link: https://github.com/linux-pam/linux-pam/issues/738 Fixes: v1.5.3~69 ("pam_env: Use vendor specific pam_env.conf and environment as fallback")
* pam_env: check VENDORDIR after config.h inclusionTobias Stoeckmann2024-01-181-9/+9
| | | | | | | | | The VENDORDIR define has to be checked after config.h inclusion, otherwise the ifdef test always yields false. Fixes: 6135c45347b6 ("pam_env: Use vendor specific pam_env.conf and environment as fallback") Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_namespace: include stdint.hJacob Heider2024-01-171-0/+2
| | | | | | | | | | | | | | | | | | | | pam_namespace.c makes use of SIZE_MAX but doesn't include stdint.h, resulting in the following build failures on 1.6.0: pam_namespace.c: In function 'process_line': pam_namespace.c:649:41: error: 'SIZE_MAX' undeclared (first use in this function) 649 | if (count > UINT_MAX || count > SIZE_MAX / sizeof(uid_t)) { | ^~~~~~~~ pam_namespace.c:41:1: note: 'SIZE_MAX' is defined in header '<stdint.h>'; did you forget to '#include <stdint.h>'? 40 | #include "argv_parse.h" +++ |+#include <stdint.h> 41 | pam_namespace.c:649:41: note: each undeclared identifier is reported only once for each function it appears in 649 | if (count > UINT_MAX || count > SIZE_MAX / sizeof(uid_t)) { | ^~~~~~~~ Fixes: v1.6.0~100 ("pam_namespace: validate amount of uids in config") Resolves: https://github.com/linux-pam/linux-pam/issues/733
* pam_namespace: protect_dir(): use O_DIRECTORY to prevent local DoS situationsMatthias Gerstner2024-01-171-17/+1
| | | | | | | | | | | | Without O_DIRECTORY the path crawling logic is subject to e.g. FIFOs being placed in user controlled directories, causing the PAM module to block indefinitely during `openat()`. Pass O_DIRECTORY to cause the `openat()` to fail if the path does not refer to a directory. With this the check whether the final path element is a directory becomes unnecessary, drop it.
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-16 07:15:05 +0000