[linux-pam] pam_warn: log flags passed to the module (ticket #25)
by Dmitry V. Levin
commit 988199b01aefffc266804b40ef24ad00ef4610e5
Author: Dmitry V. Levin <ldv(a)altlinux.org>
Date: Tue Nov 19 21:55:40 2013 +0000
pam_warn: log flags passed to the module (ticket #25)
* modules/pam_warn/pam_warn.c (log_items): Take "flags" argument and
log it using pam_syslog.
(pam_sm_authenticate, pam_sm_setcred, pam_sm_chauthtok,
pam_sm_acct_mgmt, pam_sm_open_session, pam_sm_close_session): Pass
"flags" argument to log_items.
modules/pam_warn/pam_warn.c | 30 +++++++++++++++---------------
1 files changed, 15 insertions(+), 15 deletions(-)
---
diff --git a/modules/pam_warn/pam_warn.c b/modules/pam_warn/pam_warn.c
index 268e228..a26c48d 100644
--- a/modules/pam_warn/pam_warn.c
+++ b/modules/pam_warn/pam_warn.c
@@ -33,7 +33,7 @@
value = value ? value : default_value ; \
} while (0)
-static void log_items(pam_handle_t *pamh, const char *function)
+static void log_items(pam_handle_t *pamh, const char *function, int flags)
{
const void *service=NULL, *user=NULL, *terminal=NULL,
*rhost=NULL, *ruser=NULL;
@@ -45,8 +45,8 @@ static void log_items(pam_handle_t *pamh, const char *function)
OBTAIN(PAM_RHOST, rhost, "<unknown>");
pam_syslog(pamh, LOG_NOTICE,
- "function=[%s] service=[%s] terminal=[%s] user=[%s]"
- " ruser=[%s] rhost=[%s]\n", function,
+ "function=[%s] flags=%#x service=[%s] terminal=[%s] user=[%s]"
+ " ruser=[%s] rhost=[%s]\n", function, flags,
(const char *) service, (const char *) terminal,
(const char *) user, (const char *) ruser,
(const char *) rhost);
@@ -55,52 +55,52 @@ static void log_items(pam_handle_t *pamh, const char *function)
/* --- authentication management functions (only) --- */
PAM_EXTERN
-int pam_sm_authenticate(pam_handle_t *pamh, int flags UNUSED,
+int pam_sm_authenticate(pam_handle_t *pamh, int flags,
int argc UNUSED, const char **argv UNUSED)
{
- log_items(pamh, __FUNCTION__);
+ log_items(pamh, __FUNCTION__, flags);
return PAM_IGNORE;
}
PAM_EXTERN
-int pam_sm_setcred(pam_handle_t *pamh, int flags UNUSED,
+int pam_sm_setcred(pam_handle_t *pamh, int flags,
int argc UNUSED, const char **argv UNUSED)
{
- log_items(pamh, __FUNCTION__);
+ log_items(pamh, __FUNCTION__, flags);
return PAM_IGNORE;
}
/* password updating functions */
PAM_EXTERN
-int pam_sm_chauthtok(pam_handle_t *pamh, int flags UNUSED,
+int pam_sm_chauthtok(pam_handle_t *pamh, int flags,
int argc UNUSED, const char **argv UNUSED)
{
- log_items(pamh, __FUNCTION__);
+ log_items(pamh, __FUNCTION__, flags);
return PAM_IGNORE;
}
PAM_EXTERN int
-pam_sm_acct_mgmt(pam_handle_t *pamh, int flags UNUSED,
+pam_sm_acct_mgmt(pam_handle_t *pamh, int flags,
int argc UNUSED, const char **argv UNUSED)
{
- log_items(pamh, __FUNCTION__);
+ log_items(pamh, __FUNCTION__, flags);
return PAM_IGNORE;
}
PAM_EXTERN int
-pam_sm_open_session(pam_handle_t *pamh, int flags UNUSED,
+pam_sm_open_session(pam_handle_t *pamh, int flags,
int argc UNUSED, const char **argv UNUSED)
{
- log_items(pamh, __FUNCTION__);
+ log_items(pamh, __FUNCTION__, flags);
return PAM_IGNORE;
}
PAM_EXTERN int
-pam_sm_close_session(pam_handle_t *pamh, int flags UNUSED,
+pam_sm_close_session(pam_handle_t *pamh, int flags,
int argc UNUSED, const char **argv UNUSED)
{
- log_items(pamh, __FUNCTION__);
+ log_items(pamh, __FUNCTION__, flags);
return PAM_IGNORE;
}
10 years, 5 months
[linux-pam] Modernize AM_INIT_AUTOMAKE invocation
by Dmitry V. Levin
commit 3fa23ce1fe422a0ef24a298f0d8778a4b22f89b2
Author: Dmitry V. Levin <ldv(a)altlinux.org>
Date: Tue Nov 19 21:08:00 2013 +0000
Modernize AM_INIT_AUTOMAKE invocation
Before this change, automake complained that two- and three-arguments
forms of AM_INIT_AUTOMAKE are deprecated.
* configure.in: Pass PACKAGE and VERSION arguments to AC_INIT instead
of AM_INIT_AUTOMAKE.
configure.in | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
---
diff --git a/configure.in b/configure.in
index f16020b..a161e20 100644
--- a/configure.in
+++ b/configure.in
@@ -1,8 +1,8 @@
dnl Process this file with autoconf to produce a configure script.
-AC_INIT
+AC_INIT([Linux-PAM], [1.1.8])
AC_CONFIG_SRCDIR([conf/pam_conv1/pam_conv_y.y])
AC_CONFIG_AUX_DIR([build-aux])
-AM_INIT_AUTOMAKE("Linux-PAM", 1.1.8)
+AM_INIT_AUTOMAKE
AC_PREREQ([2.61])
AC_CONFIG_HEADERS([config.h])
AC_CONFIG_MACRO_DIR([m4])
10 years, 5 months
[linux-pam] Fix autoconf warnings
by Dmitry V. Levin
commit 27e0ada82168e51a43683ca718c63601e5a2077f
Author: Dmitry V. Levin <ldv(a)altlinux.org>
Date: Tue Nov 19 20:49:47 2013 +0000
Fix autoconf warnings
Before this change, autoconf complained that AC_COMPILE_IFELSE
and AC_RUN_IFELSE was called before AC_USE_SYSTEM_EXTENSIONS.
* configure.in: Call AC_USE_SYSTEM_EXTENSIONS before LT_INIT.
configure.in | 7 +++++--
1 files changed, 5 insertions(+), 2 deletions(-)
---
diff --git a/configure.in b/configure.in
index 424a634..f16020b 100644
--- a/configure.in
+++ b/configure.in
@@ -3,7 +3,6 @@ AC_INIT
AC_CONFIG_SRCDIR([conf/pam_conv1/pam_conv_y.y])
AC_CONFIG_AUX_DIR([build-aux])
AM_INIT_AUTOMAKE("Linux-PAM", 1.1.8)
-LT_INIT([disable-static])
AC_PREREQ([2.61])
AC_CONFIG_HEADERS([config.h])
AC_CONFIG_MACRO_DIR([m4])
@@ -58,6 +57,11 @@ dnl Add /var directory
fi
+dnl This should be called before any macros that run the C compiler.
+AC_USE_SYSTEM_EXTENSIONS
+
+LT_INIT([disable-static])
+
dnl
dnl check if we should link everything static into libpam
dnl
@@ -76,7 +80,6 @@ fi
AM_CONDITIONAL([STATIC_MODULES], [test "$STATIC_MODULES" != "no"])
dnl Checks for programs.
-AC_USE_SYSTEM_EXTENSIONS
AC_PROG_CC
AC_PROG_YACC
AM_PROG_LEX
10 years, 5 months
[linux-pam] pam_securetty: check return value of fgets
by Dmitry V. Levin
commit 0f65b1fe153b343e28b617a8553b6e978cbd37d4
Author: Dmitry V. Levin <ldv(a)altlinux.org>
Date: Tue Nov 19 14:18:44 2013 +0000
pam_securetty: check return value of fgets
Checking return value of fgets not only silences the warning from glibc
but also leads to a cleaner code.
* modules/pam_securetty/pam_securetty.c (securetty_perform_check):
Check return value of fgets.
modules/pam_securetty/pam_securetty.c | 5 ++---
1 files changed, 2 insertions(+), 3 deletions(-)
---
diff --git a/modules/pam_securetty/pam_securetty.c b/modules/pam_securetty/pam_securetty.c
index 5f2d1be..0474130 100644
--- a/modules/pam_securetty/pam_securetty.c
+++ b/modules/pam_securetty/pam_securetty.c
@@ -159,11 +159,10 @@ securetty_perform_check (pam_handle_t *pamh, int ctrl,
if (cmdlinefile != NULL) {
char line[LINE_MAX], *p;
- line[0] = 0;
- fgets(line, sizeof(line), cmdlinefile);
+ p = fgets(line, sizeof(line), cmdlinefile);
fclose(cmdlinefile);
- for (p = line; p; p = strstr(p+1, "console=")) {
+ for (; p; p = strstr(p+1, "console=")) {
char *e;
/* Test whether this is a beginning of a word? */
10 years, 5 months
[linux-pam] pam_lastlog: fix format string
by Dmitry V. Levin
commit a5f0998028283c5933f147dabae1dc7e65170bcd
Author: Dmitry V. Levin <ldv(a)altlinux.org>
Date: Tue Nov 19 14:05:09 2013 +0000
pam_lastlog: fix format string
gcc -Wformat justly complains:
format '%d' expects argument of type 'int', but argument 5 has type 'time_t'
* modules/pam_lastlog/pam_lastlog.c (pam_sm_authenticate): Fix format
string.
modules/pam_lastlog/pam_lastlog.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
---
diff --git a/modules/pam_lastlog/pam_lastlog.c b/modules/pam_lastlog/pam_lastlog.c
index bd454ff..ad8c660 100644
--- a/modules/pam_lastlog/pam_lastlog.c
+++ b/modules/pam_lastlog/pam_lastlog.c
@@ -628,7 +628,8 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags,
lltime = (time(NULL) - lltime) / (24*60*60);
if (lltime > inactive_days) {
- pam_syslog(pamh, LOG_INFO, "user %s inactive for %d days - denied", user, lltime);
+ pam_syslog(pamh, LOG_INFO, "user %s inactive for %ld days - denied",
+ user, (long) lltime);
return PAM_AUTH_ERR;
}
10 years, 5 months
[linux-pam] If the correct loginuid is set already, skip writing it.
by Tomáš Mráz
commit 45cdd2489e68465c2d2202370c350069d2a391b8
Author: Darren Tucker <dtucker(a)zip.com.au>
Date: Wed Nov 20 09:43:50 2013 +0100
If the correct loginuid is set already, skip writing it.
modules/pam_loginuid/pam_loginuid.c (set_loginuid): Read the current loginuid
and skip writing if already correctly set.
modules/pam_loginuid/pam_loginuid.c | 11 ++++++++---
1 files changed, 8 insertions(+), 3 deletions(-)
---
diff --git a/modules/pam_loginuid/pam_loginuid.c b/modules/pam_loginuid/pam_loginuid.c
index 0647997..a903845 100644
--- a/modules/pam_loginuid/pam_loginuid.c
+++ b/modules/pam_loginuid/pam_loginuid.c
@@ -52,10 +52,10 @@
static int set_loginuid(pam_handle_t *pamh, uid_t uid)
{
int fd, count, rc = 0;
- char loginuid[24];
+ char loginuid[24], buf[24];
count = snprintf(loginuid, sizeof(loginuid), "%lu", (unsigned long)uid);
- fd = open("/proc/self/loginuid", O_NOFOLLOW|O_WRONLY|O_TRUNC);
+ fd = open("/proc/self/loginuid", O_NOFOLLOW|O_RDWR);
if (fd < 0) {
if (errno != ENOENT) {
rc = 1;
@@ -64,8 +64,13 @@ static int set_loginuid(pam_handle_t *pamh, uid_t uid)
}
return rc;
}
- if (pam_modutil_write(fd, loginuid, count) != count)
+ if (pam_modutil_read(fd, buf, sizeof(buf)) == count &&
+ memcmp(buf, loginuid, count) == 0)
+ goto done; /* already correct */
+ if (lseek(fd, 0, SEEK_SET) == -1 || (ftruncate(fd, 0) == -1 ||
+ pam_modutil_write(fd, loginuid, count) != count))
rc = 1;
+ done:
close(fd);
return rc;
}
10 years, 5 months
[linux-pam] Always ask for old password if changing NIS account
by kukuk
commit 5865f521f37846634f981582eaedad81abb08104
Author: Thorsten Kukuk <kukuk(a)thkukuk.de>
Date: Mon Nov 11 14:14:31 2013 +0100
Always ask for old password if changing NIS account
* modules/pam_unix/pam_unix_passwd.c (pam_sm_chauthtok): ask
for old password if NIS account.
modules/pam_unix/pam_unix_passwd.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
---
diff --git a/modules/pam_unix/pam_unix_passwd.c b/modules/pam_unix/pam_unix_passwd.c
index 9aae3b0..0cfc0f4 100644
--- a/modules/pam_unix/pam_unix_passwd.c
+++ b/modules/pam_unix/pam_unix_passwd.c
@@ -614,7 +614,8 @@ pam_sm_chauthtok(pam_handle_t *pamh, int flags, int argc, const char **argv)
if (_unix_blankpasswd(pamh, ctrl, user)) {
return PAM_SUCCESS;
- } else if (off(UNIX__IAMROOT, ctrl)) {
+ } else if (off(UNIX__IAMROOT, ctrl) ||
+ (on(UNIX_NIS, ctrl) && _unix_comesfromsource(pamh, user, 0, 1))) {
/* instruct user what is happening */
if (asprintf(&Announce, _("Changing password for %s."),
user) < 0) {
10 years, 5 months
[linux-pam] Allow DES as compatibility option for /etc/login.defs
by kukuk
commit 9cfee1810d7756fdae56b5757b6bf8e8bec92495
Author: Thorsten Kukuk <kukuk(a)thkukuk.de>
Date: Fri Nov 8 15:35:41 2013 +0100
Allow DES as compatibility option for /etc/login.defs
* modules/pam_unix/support.h: Add UNIX_DES
modules/pam_unix/support.h | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)
---
diff --git a/modules/pam_unix/support.h b/modules/pam_unix/support.h
index 6575938..6f5b2eb 100644
--- a/modules/pam_unix/support.h
+++ b/modules/pam_unix/support.h
@@ -97,8 +97,9 @@ typedef struct {
password hash algorithms */
#define UNIX_BLOWFISH_PASS 26 /* new password hashes will use blowfish */
#define UNIX_MIN_PASS_LEN 27 /* min length for password */
+#define UNIX_DES 28 /* DES, default */
/* -------------- */
-#define UNIX_CTRLS_ 28 /* number of ctrl arguments defined */
+#define UNIX_CTRLS_ 29 /* number of ctrl arguments defined */
#define UNIX_DES_CRYPT(ctrl) (off(UNIX_MD5_PASS,ctrl)&&off(UNIX_BIGCRYPT,ctrl)&&off(UNIX_SHA256_PASS,ctrl)&&off(UNIX_SHA512_PASS,ctrl)&&off(UNIX_BLOWFISH_PASS,ctrl))
@@ -135,6 +136,7 @@ static const UNIX_Ctrls unix_args[UNIX_CTRLS_] =
/* UNIX_ALGO_ROUNDS */ {"rounds=", _ALL_ON_, 0100000000, 0},
/* UNIX_BLOWFISH_PASS */ {"blowfish", _ALL_ON_^(0260420000), 0200000000, 1},
/* UNIX_MIN_PASS_LEN */ {"minlen=", _ALL_ON_, 0400000000, 0},
+/* UNIX_DES */ {"des", _ALL_ON_^(0260420000), 0, 1},
};
#define UNIX_DEFAULTS (unix_args[UNIX__NONULL].flag)
10 years, 5 months