aboutsummaryrefslogtreecommitdiff
path: root/modules
Commit message (Collapse)AuthorAgeFilesLines
* pam_unix: avoid integer truncation in debug outputBenny Baumann2023-11-141-1/+1
| | | | | | | | When printing the current day and when the password was last changed, a truncation of the value could happen due to incorrect data types used in the format string. Signed-off-by: Benny Baumann <BenBE@geshi.org>
* pam_unix: avoid printing NULL valuesBenny Baumann2023-11-141-1/+1
| | | | | | | The value of pp can potentially be NULL. This handles this case when printing debug output. Signed-off-by: Benny Baumann <BenBE@geshi.org>
* pam_unix: only output length check message on failureBenny Baumann2023-11-141-2/+3
| | | | | | | | | | The debug message was placed outside the password length check and thus if the length check succeeded no message would have been placed. Comparing this location with other occurrences indicates this was by mistake, thus the message is now suppressed if there's nothing to print anyway. Signed-off-by: Benny Baumann <BenBE@geshi.org>
* pam_time: ensure correct argument type when printing debug outputBenny Baumann2023-11-141-1/+1
| | | | | | | | While the underlying type for setting the service was correct, the additional output neglected to include the type cast necessary when actually printing the data. This is rectified here. Signed-off-by: Benny Baumann <BenBE@geshi.org>
* pam_selinux: take null contexts into accountBenny Baumann2023-11-141-1/+2
| | | | | | | As the context variables can be NULL at this point, this has to be reflected when printing them for debug purposes. Signed-off-by: Benny Baumann <BenBE@geshi.org>
* pam_mkhomedir: ensure correct argument type when printing debug outputBenny Baumann2023-11-141-1/+1
| | | | | | | | While the underlying type for setting the user was correct, the additional output neglected to include the type cast necessary when actually printing the data. This is rectified here. Signed-off-by: Benny Baumann <BenBE@geshi.org>
* pam_lastlog: ensure correct argument type when printing debug outputBenny Baumann2023-11-141-1/+1
| | | | | | | | While the underlying type for setting the user was correct, the additional output neglected to include the type cast necessary when actually printing the data. This is rectified here. Signed-off-by: Benny Baumann <BenBE@geshi.org>
* pam_group: ensure correct argument type when printing debug outputBenny Baumann2023-11-131-1/+1
| | | | | | | | While the underlying type for setting the service was correct, the additional output neglected to include the type cast necessary when actually printing the data. This is rectified here. Signed-off-by: Benny Baumann <BenBE@geshi.org>
* pam_env: use printf type annotation for size_tBenny Baumann2023-11-131-1/+1
| | | | | | | | There was a debug message still using %d (int) instead of the contextually correct %zu (size_t AKA long unsigned int), potentially causing silent truncation of the printed value. Signed-off-by: Benny Baumann <BenBE@geshi.org>
* pam_env: force format string to be constantBenny Baumann2023-11-131-1/+1
| | | | | | | | | | | As the string to output here is user-controlled this could lead to format string attacks. Possible impact is at least information leakage about the program stack. To avoid this, make the format string fixed and insert the actual string for output as an argument. Signed-off-by: Benny Baumann <BenBE@geshi.org>
* pam_shells: limit shells to absolute pathsTobias Stoeckmann2023-11-131-7/+41
| | | | | | | Only allow shells with absolute paths. Also handle line truncations which could occur with fgets by prefering getline/getdelim. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_securetty: protect against invalid input filesTobias Stoeckmann2023-11-131-4/+9
| | | | | | | | If fgets encounters a file with a \0 at the beginning of a line, then strlen()-1 would turn negative. Check if line has at least one character in it. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_exec: fix stack overflow on \0 outputTobias Stoeckmann2023-11-131-1/+1
| | | | | | | | If an executed program prints \0 at the beginning of a line, then pam_exec triggers an out of boundary read (and possible) write on the stack. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_echo: avoid heap overflow on huge filesTobias Stoeckmann2023-11-131-0/+7
| | | | | | | The module might overflow heap on 32 bit systems if a 4 GB file is supplied as argument. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* treewide: do not cast calloc/malloc/reallocTobias Stoeckmann2023-11-127-13/+12
| | | | | | | It is not required to cast the results of calloc, malloc, realloc, etc. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_time: fix typo in debug messageTobias Stoeckmann2023-11-121-1/+1
| | | | Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_env: remove function prefix in debug messagesTobias Stoeckmann2023-11-121-3/+3
| | | | | | The D macro itself already adds the function names. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_rootok: call va_end only onceTobias Stoeckmann2023-11-121-1/+0
| | | | | | | The amount of va_start and va_end calls should be identical. Since va_end is called right after vasprintf, don't call it later again. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_pwhistory: fix passing NULL filename argument to pwhistory helperMd Zain Hasib2023-10-042-3/+3
| | | | | | | | | | | | | | | | | | This change fixes a bug when pwhistory_helper is invoked from pam_pwhistory with an NULL filename, pwhistory_helper receives a short circuited argc count of 3, ignoring the rest of the arguments passed due to filename being NULL. To resolve the issue, an empty string is passed in case the filename is empty, which is later changed back to NULL in pwhistory_helper so that it can be passed to opasswd to read the default opasswd file. * modules/pam_pwhistory/pam_pwhistory.c (run_save_helper, run_check_helper): Replace NULL filename argument with an empty string. * modules/pam_pwhistory/pwhistory_helper.c (main): Replace empty string filename argument with NULL. Fixes: 11c35109a67f ("pam_pwhistory: Enable alternate location for password history file (#396)") Signed-off-by: Dmitry V. Levin <ldv@strace.io>
* pam_succeed_if: avoid returning garbage for empty configurationChristian Göttsche2023-08-071-0/+1
| | | | | | | | | | | | | If pam_succeed_if is used without any options the return value ret will never be assigned a value. Since the case where the counted number of options is zero will print 'no condition detected; module succeeded' set the return value to PAM_SUCCESS. Reported by Clang analyzer: pam_succeed_if.c:578:2: warning: Undefined or garbage value returned to caller [core.uninitialized.UndefReturn] 578 | return ret; | ^~~~~~~~~~
* pam_env: remove allocator sizeof operator mismatchChristian Göttsche2023-08-071-2/+2
| | | | | | | | | | | | | | | | An array of strings is allocated (into a pointer) so the single array element to be allocated is char*. Since sizeof(char**) should be always equal to sizeof(char*) this caused no issues so far. Reported by Clang analyzer: pam_env.c:391:14: warning: Result of 'malloc' is converted to a pointer of type 'char *', which is incompatible with sizeof operand type 'char **' [unix.MallocSizeof] 391 | *lines = malloc((i + 1)* sizeof(char**)); | ^~~~~~ ~~~~~~~~~~~~~~ pam_env.c:401:13: warning: Result of 'realloc' is converted to a pointer of type 'char *', which is incompatible with sizeof operand type 'char **' [unix.MallocSizeof] 401 | tmp = realloc(*lines, (++i + 1) * sizeof(char**)); | ^~~~~~~ ~~~~~~~~~~~~~~
* pam_timestamp: use secure memory erasureChristian Göttsche2023-08-071-2/+3
| | | | Closes: #575
* pam_timestamp: constify sha1 padding blockChristian Göttsche2023-08-071-1/+1
| | | | The padding block is only read from via memcpy(3).
* modules: cast to unsigned char for character handling functionChristian Göttsche2023-08-0715-39/+39
| | | | | | | | Character handling functions, like isspace(3), expect a value representable as unsigned char or equal to EOF. Otherwise the behavior is undefined. See https://wiki.sei.cmu.edu/confluence/display/c/STR37-C.+Arguments+to+character-handling+functions+must+be+representable+as+an+unsigned+char
* pam_faillock: free handle in testChristian Göttsche2023-08-071-0/+1
|
* pam_selinux: fix formatting of audit messagesSteve Grubb2023-08-041-1/+1
| | | | | | | pam_selinux uses audit_log_user_message to write to the audit system. It does not take an op argument, so you have to add one yourself. Otherwise the pam_selinux part of the message is lost because it's not in key=value format.
* pam_faillock: fix formatting of audit messagesSteve Grubb2023-08-041-2/+2
| | | | | | | | | | | pam_faillock uses audit_log_user_message to write to the audit system. It does not take an op argument, so you have to add one yourself. Otherwise the pam_faillock part of the message is lost because it's not in key=value format. Also, we can't use uid in that event because the kernel already adds that field. What we normally do is use 'suid' (meaning sender uid) as the field name.
* pam_access: make non-resolveable hostname a debug output (#590)Thorsten Kukuk2023-08-041-1/+2
| | | | | | * modules/pam_access/pam_access.c (network_netmask_match): Don't print an error if a string is not resolveable, only a debug message in debug mode. We even don't know if that entry is for remote logins or not.
* pam_access: document IPv6 link-local addresses (#582)Thorsten Kukuk2023-08-032-1/+14
| | | | | | | * modules/pam_access/access.conf.5.xml: Add example and note for IPv6 link-local addresses * modules/pam_access/access.conf: Add example for IPv6 link-local addresses
* pam_unix: improve fallback values for "rounds" for yescrypt and blowfishJulian Kranz2023-07-171-4/+8
| | | | | | | | This change improves the fallback values for the "rounds" parameter for yescrypt and blowfish by using the smallest reasonable value if the user sets a too low value and by using the highest reasonable value if the user sets a too high value. This better realizes user intent and is consistent with the approach taken for SHA256.
* pam_userdb: enable GDBM supportIker Pedrosa2023-07-171-12/+78
| | | | | | | | * configure.ac: add `gdbm` option to `enable-db` * modules/pam_userdb/pam_userdb.c: conditionally provide database access depending on the database technology Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
* Fix build if crypt_r isn't availableBernhard Rosenkränzer2023-06-071-1/+1
| | | | | | | | retval was being defined only in #ifdef HAVE_CRYPT_R, but used unconditionally. Signed-off-by: Bernhard Rosenkränzer <bero@lindev.ch> Fixes: bcba17939e1b ("modules: make use of secure memory erasure")
* pam_shells: Plug econf memory leakTobias Stoeckmann2023-05-181-0/+1
| | | | Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* pam_shells: return PAM_USER_UNKNOWN if getpwnam failsJonathan Krebs2023-05-172-2/+18
| | | | | | Until before, in this case PAM_AUTH_ERR was returned. This leads to unknown users being logged with the unknown username. Now it resembles the behaviour of other modules like pam_unix in this case.
* pam_xauth: switch away from PATH_MAXPino Toscano2023-05-171-10/+18
| | | | | | | | Allocate the path buffer in check_acl() dynamically using asprintf(), so there is no need to use a PATH_MAX-fixed size buffer. The fallback PATH_MAX definition is no more needed, thus is dropped. Make sure that paths too long still result in PAM_SESSION_ERR.
* pam_mkhomedir: simplify handling of newsource/newdestPino Toscano2023-05-121-85/+32
| | | | | | | | | | | | | | | | | To support OSes without PATH_MAX (which is optional in POSIX), there are two code paths for the 'newsource' and 'newdest' variables: one using a PATH_MAX-sized stack buffer, and one using heap allocation. The second is even more complicated than needed, doing manual calculations and allocations. To simplify the code a bit more, easing its maintenance, unify the two using asprintf() to allocate 'newsource' and 'newdest': the extra allocation needed should not be an issue, since this code runs in a separate helper executable. As additional change for this simplification, remove the reset to the two variables to NULL right after their free(), which is not needed since their scopes end.
* pam_limits: build again on non-Linux OSesPino Toscano2023-05-121-0/+8
| | | | | | | | | | Even if this module is supported officially on Linux, make sure it can still build fine on non-Linux OSes, to ease its testing/fixing a bit: - build parse_kernel_limits() and stuff needed for it only on Linux, as it is called already only on Linux - limit the code needed to apply the 'nonewprivs' options to Linux only, as it uses a Linux-specific way to set it; add a syslog message for other OSes
* pam_nologin: explicitly fail when nologin path is a directoryPino Toscano2023-05-111-0/+10
| | | | | | | On some systems (e.g. GNU/Hurd), read() succeeds on the fd of a directory; since the module assumes that read() fails (and thus pam_modutil_read() as well), manually fail in case the open fd refers to a directory.
* pam_timestamp: do not assume PATH_MAX is definedPino Toscano2023-05-111-1/+3
| | | | | PATH_MAX is optional in POSIX, and not defined on GNU/Hurd; hence, in case it is not defined, define BUFLEN directly to LINE_MAX.
* pam_pwhistory: switch away from PATH_MAXPino Toscano2023-05-111-11/+29
| | | | | Allocate the buffers dynamically using asprintf(), so there is no need to use PATH_MAX-fixed size buffers.
* modules: update Linux detectionChristian Göttsche2023-05-072-2/+2
| | | | | | | | GCC and Clang only define the macro `linux` when using the GNU dialect of C (e.g. -std=gnu11 instead of -std=c11). Since `linux` is also not in a reserved namespace it might be target of collisions. Use the canonical macro `__linux__` instead (already used in pam_limits.c).
* pam_succeed_if: do not use the result of keyword substitution for keyword matchDmitry V. Levin2023-04-201-22/+14
| | | | | | | * modules/pam_succeed_if/pam_succeed_if.c (evaluate): Do not use the result of keyword substitution for keyword match. Resolves: https://github.com/linux-pam/linux-pam/issues/560
* pam_timestamp: Only build hmacfile when no opensslIker Pedrosa2023-04-201-5/+2
| | | | | | | * modules/pam_timestamp/Makefile.am: Only build hmacfile target when openssl isn't enabled. Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
* fix a grammar mistakeMark Huang2023-04-201-1/+1
|
* configure: Disable NIS if header files are missingThorsten Kukuk2023-04-062-9/+3
| | | | | | configure.ac: Disable NIS if RPC or YP header files are missing modules/pam_unix/support.c: Use HAVE_NIS to check for header file presence modules/pam_unix/pam_unix_passwd.c: Use HAVE_NIS, too
* treewide: fix unnecessary $ on arithmetic variablesDmitry V. Levin2023-03-311-1/+1
| | | | This should fix shellcheck warning SC2004.
* pam_timestamp: fix build failureIker Pedrosa2023-03-301-0/+1
| | | | | | | | | | bcba17939e1b1a568cd4a764534cde74d37078cc started using pam_overwrite_n() without providing the definition to this function, which causes a build failure. modules/pam_timestamp/hmac_openssl_wrapper.c: include pam_inline.h Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
* modules: make use of secure memory erasureChristian Göttsche2023-02-2828-96/+140
| | | | | | | | | | | | | | | | | | | | | | | | | | Use empty initialization of structs to minimize the memset() usage, to reduce the amount of calls which are not sensitive. Non trivial changes: - pam_env: * erase environment variables where possible - pam_exec: * erase responce on error * erase auth token - pam_pwhistory: * erase buffers containing old passwords - pam_selinux: skip overwriting data structure consisting of only pointers to insensitive data, which also gets free'd afterwards (so it currently does not protect against double-free or use-after-free on the member pointers) - pam_unix: erase cipher data in more places - pam_userdb: erase password hashes
* pam_env: use helper to free string listChristian Göttsche2023-02-281-2/+1
| | | | | | Free the environment variables list via the designated helper free_string_array() rather than free its elements in a loop, which might skip some.
* pam_env: override undefined pointer after asprintf failureChristian Göttsche2023-02-281-0/+1
| | | | | On failure the content of the string pointer passed to asprintf(3) is undefined. Set to NULL before free'ing the parent array.
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-26 15:26:01 +0000