[linux-pam] Fix strict aliasing issue in MD5 implementations.
by Tomáš Mráz
commit 183f91a212879229d37e4dce18edd7a141eefa12
Author: Tomas Mraz <tmraz(a)fedoraproject.org>
Date: Thu Mar 28 15:30:19 2013 +0100
Fix strict aliasing issue in MD5 implementations.
modules/pam_namespace/md5.c (MD5Final): Use memcpy instead of assignment.
modules/pam_unix/md5.c (MD5Final): Use memcpy instead of assignment.
modules/pam_namespace/md5.c | 3 +--
modules/pam_unix/md5.c | 3 +--
2 files changed, 2 insertions(+), 4 deletions(-)
---
diff --git a/modules/pam_namespace/md5.c b/modules/pam_namespace/md5.c
index ce4f7d6..dc95ab1 100644
--- a/modules/pam_namespace/md5.c
+++ b/modules/pam_namespace/md5.c
@@ -142,8 +142,7 @@ void MD5Name(MD5Final)(unsigned char digest[16], struct MD5Context *ctx)
byteReverse(ctx->in, 14);
/* Append length in bits and transform */
- ((uint32 *) ctx->in)[14] = ctx->bits[0];
- ((uint32 *) ctx->in)[15] = ctx->bits[1];
+ memcpy((uint32 *)ctx->in + 14, ctx->bits, 2*sizeof(uint32));
MD5Name(MD5Transform)(ctx->buf, (uint32 *) ctx->in);
byteReverse((unsigned char *) ctx->buf, 4);
diff --git a/modules/pam_unix/md5.c b/modules/pam_unix/md5.c
index 7881db5..94f0485 100644
--- a/modules/pam_unix/md5.c
+++ b/modules/pam_unix/md5.c
@@ -142,8 +142,7 @@ void MD5Name(MD5Final)(unsigned char digest[16], struct MD5Context *ctx)
byteReverse(ctx->in, 14);
/* Append length in bits and transform */
- ((uint32 *) ctx->in)[14] = ctx->bits[0];
- ((uint32 *) ctx->in)[15] = ctx->bits[1];
+ memcpy((uint32 *)ctx->in + 14, ctx->bits, 2*sizeof(uint32));
MD5Name(MD5Transform)(ctx->buf, (uint32 *) ctx->in);
byteReverse((unsigned char *) ctx->buf, 4);
11 years, 1 month
[linux-pam] pam_lastlog: Do not fail on short read if btmp is corrupted.
by Tomáš Mráz
commit 9909a2b6ab99a32853224ae8dc0bb24c018d45e7
Author: Tomas Mraz <tmraz(a)fedoraproject.org>
Date: Fri Mar 22 13:50:54 2013 +0100
pam_lastlog: Do not fail on short read if btmp is corrupted.
modules/pam_lastlog/pam_lastlog.c (last_login_failed): Just warn, not fail
on short read or read error.
modules/pam_lastlog/pam_lastlog.c | 4 ++++
1 files changed, 4 insertions(+), 0 deletions(-)
---
diff --git a/modules/pam_lastlog/pam_lastlog.c b/modules/pam_lastlog/pam_lastlog.c
index 50e5a59..bd454ff 100644
--- a/modules/pam_lastlog/pam_lastlog.c
+++ b/modules/pam_lastlog/pam_lastlog.c
@@ -479,6 +479,10 @@ last_login_failed(pam_handle_t *pamh, int announce, const char *user, time_t llt
}
}
+ if (retval != 0)
+ pam_syslog(pamh, LOG_WARNING, "corruption detected in %s", _PATH_BTMP);
+ retval = PAM_SUCCESS;
+
if (failed) {
/* we want the date? */
if (announce & LASTLOG_DATE) {
11 years, 1 month
[linux-pam] pam_rootok: Allow proper logging of the user AVC if access disallowed by SELinux
by Tomáš Mráz
commit 74ab2ed83471c2b17c2176d7465f56ae32ae4507
Author: Tomas Mraz <tmraz(a)fedoraproject.org>
Date: Fri Mar 22 09:42:22 2013 +0100
pam_rootok: Allow proper logging of the user AVC if access disallowed by SELinux
modules/pam_rootok/pam_rootok.c (log_callback, selinux_check_root): New functions.
(check_for_root): Use the selinux_check_root() instead of checkPasswdAccess.
modules/pam_rootok/pam_rootok.c | 63 +++++++++++++++++++++++++++++++++++++-
1 files changed, 61 insertions(+), 2 deletions(-)
---
diff --git a/modules/pam_rootok/pam_rootok.c b/modules/pam_rootok/pam_rootok.c
index 8d368ce..70579e5 100644
--- a/modules/pam_rootok/pam_rootok.c
+++ b/modules/pam_rootok/pam_rootok.c
@@ -28,7 +28,11 @@
#ifdef WITH_SELINUX
#include <selinux/selinux.h>
-#include <selinux/av_permissions.h>
+#include <selinux/avc.h>
+#endif
+
+#ifdef HAVE_LIBAUDIT
+#include <libaudit.h>
#endif
/* argument parsing */
@@ -55,6 +59,61 @@ _pam_parse (const pam_handle_t *pamh, int argc, const char **argv)
return ctrl;
}
+#ifdef WITH_SELINUX
+static int
+log_callback (int type, const char *fmt, ...)
+{
+ int audit_fd;
+ va_list ap;
+
+ va_start(ap, fmt);
+#ifdef HAVE_LIBAUDIT
+ audit_fd = audit_open();
+
+ if (audit_fd >= 0) {
+ char *buf;
+
+ if (vasprintf (&buf, fmt, ap) < 0)
+ return 0;
+ audit_log_user_avc_message(audit_fd, AUDIT_USER_AVC, buf, NULL, NULL,
+ NULL, 0);
+ audit_close(audit_fd);
+ free(buf);
+ return 0;
+ }
+
+#endif
+ vsyslog (LOG_USER | LOG_INFO, fmt, ap);
+ va_end(ap);
+ return 0;
+}
+
+static int
+selinux_check_root (void)
+{
+ int status = -1;
+ security_context_t user_context;
+ union selinux_callback old_callback;
+
+ if (is_selinux_enabled() < 1)
+ return 0;
+
+ old_callback = selinux_get_callback(SELINUX_CB_LOG);
+ /* setup callbacks */
+ selinux_set_callback(SELINUX_CB_LOG, (union selinux_callback) &log_callback);
+ if ((status = getprevcon(&user_context)) < 0) {
+ selinux_set_callback(SELINUX_CB_LOG, old_callback);
+ return status;
+ }
+
+ status = selinux_check_access(user_context, user_context, "passwd", "passwd", NULL);
+
+ selinux_set_callback(SELINUX_CB_LOG, old_callback);
+ freecon(user_context);
+ return status;
+}
+#endif
+
static int
check_for_root (pam_handle_t *pamh, int ctrl)
{
@@ -62,7 +121,7 @@ check_for_root (pam_handle_t *pamh, int ctrl)
if (getuid() == 0)
#ifdef WITH_SELINUX
- if (is_selinux_enabled()<1 || checkPasswdAccess(PASSWD__ROOTOK)==0)
+ if (selinux_check_root() == 0 || security_getenforce() == 0)
#endif
retval = PAM_SUCCESS;
11 years, 1 month