things to be done after cvs->git migration
by Dmitry V. Levin
Based on my experience of earlier cvs->git migrations, there are few
things that could be done naturally now:
- migrate from .cvsignore to .gitignore;
- cleanup trailing whitespaces and indentation that uses spaces before
tabs as reported by
git diff --check 4b825dc642cb6eb9a060e54bf8d69288fbee4904 HEAD
- adjust hooks/update to reject new commits introducing new trailing
whitespaces;
- accept a guideline about git commit messages style and maintaining
ChangeLog file in git; I propose to deprecate the ChangeLog file in
the repository, follow to commit log requirements (e.g. based on
"Commit log requirements" described in
http://git.savannah.gnu.org/cgit/coreutils.git/tree/HACKING), and
use the gitlog-to-changelog tool to generate the ChangeLog file from
git log at "make dist" time.
I made these changes in strace project after cvs->git migration in
July of 2009, and everybody seems to be happy so far.
--
ldv
12 years, 4 months
[PATCH] pam_limits: initialize rlimits from kernel values
by Kees Cook
Since the kernel sets a number of dynamic rlimits based on the system
properties (e.g. physical memory for nproc), these rlimits should be
respected by PAM. Parse /proc/1/limits for the kernel-defined rlimits.
Signed-off-by: Kees Cook <kees.cook(a)canonical.com>
---
modules/pam_limits/pam_limits.c | 157 +++++++++++++++++++++++++++++++++++++-
1 files changed, 152 insertions(+), 5 deletions(-)
diff --git a/modules/pam_limits/pam_limits.c b/modules/pam_limits/pam_limits.c
index 8814652..fa1d35f 100644
--- a/modules/pam_limits/pam_limits.c
+++ b/modules/pam_limits/pam_limits.c
@@ -51,9 +51,10 @@
#define LIMITS_DEF_USER 0 /* limit was set by an user entry */
#define LIMITS_DEF_GROUP 1 /* limit was set by a group entry */
#define LIMITS_DEF_ALLGROUP 2 /* limit was set by a group entry */
-#define LIMITS_DEF_ALL 3 /* limit was set by an default entry */
-#define LIMITS_DEF_DEFAULT 4 /* limit was set by an default entry */
-#define LIMITS_DEF_NONE 5 /* this limit was not set yet */
+#define LIMITS_DEF_ALL 3 /* limit was set by an all entry */
+#define LIMITS_DEF_DEFAULT 4 /* limit was set by a default entry */
+#define LIMITS_DEF_KERNEL 5 /* limit was set from /proc/1/limits */
+#define LIMITS_DEF_NONE 6 /* this limit was not set yet */
#define LIMIT_RANGE_ERR -1 /* error in specified uid/gid range */
#define LIMIT_RANGE_NONE 0 /* no range specified */
@@ -67,6 +68,7 @@ static const char *limits_def_names[] = {
"ALLGROUP",
"ALL",
"DEFAULT",
+ "KERNEL",
"NONE",
NULL
};
@@ -292,7 +294,139 @@ check_logins (pam_handle_t *pamh, const char *name, int limit, int ctrl,
return 0;
}
-static int init_limits(struct pam_limit_s *pl)
+static const char * lnames[RLIM_NLIMITS] = {
+ [RLIMIT_CPU] = "Max cpu time",
+ [RLIMIT_FSIZE] = "Max file size",
+ [RLIMIT_DATA] = "Max data size",
+ [RLIMIT_STACK] = "Max stack size",
+ [RLIMIT_CORE] = "Max core file size",
+ [RLIMIT_RSS] = "Max resident set",
+ [RLIMIT_NPROC] = "Max processes",
+ [RLIMIT_NOFILE] = "Max open files",
+ [RLIMIT_MEMLOCK] = "Max locked memory",
+#ifdef RLIMIT_AS
+ [RLIMIT_AS] = "Max address space",
+#endif
+#ifdef RLIMIT_LOCKS
+ [RLIMIT_LOCKS] = "Max file locks",
+#endif
+#ifdef RLIMIT_SIGPENDING
+ [RLIMIT_SIGPENDING] = "Max pending signals",
+#endif
+#ifdef RLIMIT_MSGQUEUE
+ [RLIMIT_MSGQUEUE] = "Max msgqueue size",
+#endif
+#ifdef RLIMIT_NICE
+ [RLIMIT_NICE] = "Max nice priority",
+#endif
+#ifdef RLIMIT_RTPRIO
+ [RLIMIT_RTPRIO] = "Max realtime priority",
+#endif
+#ifdef RLIMIT_RTTIME
+ [RLIMIT_RTTIME] = "Max realtime timeout",
+#endif
+};
+
+static int str2rlimit(char *name) {
+ int i;
+ if (!name || *name == '\0')
+ return -1;
+ for(i = 0; i < RLIM_NLIMITS; i++) {
+ if (strcmp(name, lnames[i]) == 0) return i;
+ }
+ return -1;
+}
+
+static rlim_t str2rlim_t(char *value) {
+ unsigned long long rlimit = 0;
+
+ if (!value) return (rlim_t)rlimit;
+ if (strcmp(value, "unlimited") == 0) {
+ return RLIM_INFINITY;
+ }
+ rlimit = strtoull(value, NULL, 10);
+ return (rlim_t)rlimit;
+}
+
+#define LIMITS_SKIP_WHITESPACE { \
+ /* step backwards over spaces */ \
+ pos--; \
+ while (pos && line[pos] == ' ') pos--; \
+ if (!pos) continue; \
+ line[pos+1] = '\0'; \
+}
+#define LIMITS_MARK_ITEM(item) { \
+ /* step backwards over non-spaces */ \
+ pos--; \
+ while (pos && line[pos] != ' ') pos--; \
+ if (!pos) continue; \
+ item = line + pos + 1; \
+}
+
+static void parse_kernel_limits(pam_handle_t *pamh, struct pam_limit_s *pl)
+{
+ int i, maxlen = 0;
+ FILE *limitsfile;
+ const char *proclimits = "/proc/1/limits";
+ char line[256];
+ char *units, *hard, *soft, *name;
+
+ if (!(limitsfile = fopen(proclimits, "r"))) {
+ pam_syslog(pamh, LOG_WARNING, "Could not read %s (%s), using PAM defaults", proclimits, strerror(errno));
+ return;
+ }
+
+ while (fgets(line, 256, limitsfile)) {
+ int pos = strlen(line);
+ if (pos < 2) continue;
+
+ /* drop trailing newline */
+ if (line[pos-1] == '\n') {
+ pos--;
+ line[pos] = '\0';
+ }
+
+ /* determine formatting boundry of limits report */
+ if (!maxlen && strncmp(line, "Limit", 5) == 0) {
+ maxlen = pos;
+ continue;
+ }
+
+ if (pos == maxlen) {
+ /* step backwards over "Units" name */
+ LIMITS_SKIP_WHITESPACE;
+ LIMITS_MARK_ITEM(units);
+ }
+ else {
+ units = "";
+ }
+
+ /* step backwards over "Hard Limit" value */
+ LIMITS_SKIP_WHITESPACE;
+ LIMITS_MARK_ITEM(hard);
+
+ /* step backwards over "Soft Limit" value */
+ LIMITS_SKIP_WHITESPACE;
+ LIMITS_MARK_ITEM(soft);
+
+ /* step backwards over name of limit */
+ LIMITS_SKIP_WHITESPACE;
+ name = line;
+
+ i = str2rlimit(name);
+ if (i < 0 || i >= RLIM_NLIMITS) {
+ pam_syslog(pamh, LOG_DEBUG, "Unknown kernel rlimit '%s' ignored", name);
+ continue;
+ }
+ pl->limits[i].limit.rlim_cur = str2rlim_t(soft);
+ pl->limits[i].limit.rlim_max = str2rlim_t(hard);
+ pl->limits[i].src_soft = LIMITS_DEF_KERNEL;
+ pl->limits[i].src_hard = LIMITS_DEF_KERNEL;
+ }
+ fclose(limitsfile);
+}
+
+static int init_limits(pam_handle_t *pamh, struct pam_limit_s *pl)
{
int i;
int retval = PAM_SUCCESS;
@@ -313,6 +447,19 @@ static int init_limits(struct pam_limit_s *pl)
}
}
+#ifdef __linux__
+ parse_kernel_limits(pamh, pl);
+#endif
+
+ for(i = 0; i < RLIM_NLIMITS; i++) {
+ if (pl->limits[i].supported &&
+ (pl->limits[i].src_soft == LIMITS_DEF_NONE ||
+ pl->limits[i].src_hard == LIMITS_DEF_NONE)) {
+#ifdef __linux__
+ pam_syslog(pamh, LOG_WARNING, "Did not find kernel RLIMIT for %s, using PAM default", rlimit2str(i));
+#endif
+ }
+
errno = 0;
pl->priority = getpriority (PRIO_PROCESS, 0);
if (pl->priority == -1 && errno != 0)
@@ -873,7 +1020,7 @@ pam_sm_open_session (pam_handle_t *pamh, int flags UNUSED,
return PAM_USER_UNKNOWN;
}
- retval = init_limits(pl);
+ retval = init_limits(pamh, pl);
if (retval != PAM_SUCCESS) {
pam_syslog(pamh, LOG_WARNING, "cannot initialize");
return PAM_ABORT;
--
1.7.4.1
--
Kees Cook
Ubuntu Security Team
12 years, 9 months
[linux-pam] #3: Just testing notification
by fedora-badges
#3: Just testing notification
-------------------+--------------------------------------------------------
Reporter: tmraz | Owner: pam-developers(a)lists.fedorahosted.org
Type: defect | Status: new
Priority: major | Component: library
Version: | Keywords:
-------------------+--------------------------------------------------------
Just testing notification of the ticketing system.
--
Ticket URL: <https://fedorahosted.org/linux-pam/ticket/3>
linux-pam <http://fedorahosted.org/linux-pam>
The Linux-PAM (Pluggable Authentication Modules) project
12 years, 9 months
Fixes for compiler warnings
by Thorsten Kukuk
Hi,
beside the unused variable warning for pam_timestamp, gcc 4.6 complains
about quite some wrong usages of "const" and "const"-castings.
And strictly spoken, most of the time the compiler had right.
Ok to apply the attached patch? It fixes some of the warnings,
the others are hard to fix or not fixable.
Thorsten
--
Thorsten Kukuk, Project Manager/Release Manager SLES
SUSE LINUX Products GmbH, Maxfeldstr. 5, D-90409 Nuernberg
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg)
12 years, 10 months
Linux-PAM 1.1.4?
by Thorsten Kukuk
Hi,
I think it is time to think about a new 1.1.4 release.
Things I would like to check or get fixed before:
- gcc 4.6 shows some new warnings, I wanted to check at least for
their relevance
- The pam_env.so debug patch
- pam_limits? I haven't seen anything about this anymore. Will we
apply it (default disabled) or is this idea dead?
- Trac: allow root login on devices from /sys/class/tty/console/active
Any opinions about that patch?
- Trac: pam_access, allow uid/gid like in pam_limits.
Thorsten
--
Thorsten Kukuk, Project Manager/Release Manager SLES
SUSE LINUX Products GmbH, Maxfeldstr. 5, D-90409 Nuernberg
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg)
12 years, 10 months
pam_timestamp and pam_env
by Thorsten Kukuk
Hi,
I found out that pam_env.so has a "debug" option, which
is described in the manual page, but the variable is never
used. So it's a NOP.
Should we remove it? I would suggest to remove it at least
from the documentation.
Else pam_timestamp as an used variable, Ok to remove it?
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2011-05-25 Thorsten Kukuk <kukuk(a)thkukuk.de>
+
+ * modules/pam_timestamp/pam_timestamp.c (main): Remove unused
+ variable pretval.
+
2011-05-24 Thorsten Kukuk <kukuk(a)thkukuk.de>
* modules/pam_listfile/pam_listfile.c (pam_sm_authenticate): quiet
--- a/modules/pam_timestamp/pam_timestamp.c
+++ b/modules/pam_timestamp/pam_timestamp.c
@@ -684,7 +684,7 @@ struct pam_module _pam_timestamp_modstruct = {
int
main(int argc, char **argv)
{
- int i, pretval = -1, retval = 0, dflag = 0, kflag = 0;
+ int i, retval = 0, dflag = 0, kflag = 0;
const char *target_user = NULL, *user = NULL, *tty = NULL;
struct passwd *pwd;
struct timeval tv;
@@ -826,7 +826,6 @@ main(int argc, char **argv)
select(STDOUT_FILENO + 1,
NULL, NULL, &write_fds,
&tv);
- pretval = retval;
retval = 0;
}
} while (dflag > 0);
--
Thorsten Kukuk, Project Manager/Release Manager SLES
SUSE LINUX Products GmbH, Maxfeldstr. 5, D-90409 Nuernberg
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg)
12 years, 10 months
Fwd: Linux PAM Authentication failed: Non-Local users
by DEEPAK SHARMA
---------- Forwarded message ----------
From: Deepak Sharma <Deepak.Sharma(a)aricent.com>
Date: Fri, 27 May 2011 13:28:50 +0530
Subject: Linux PAM Authentication failed: Non-Local users
To: "deepaksharma06(a)gmail.com" <deepaksharma06(a)gmail.com>
Hello Everyone,
We are trying to perform Radius based authentication of any guest user
using Linux PAM module 1.0
As radius client, pam_radius-1.3.17 plugin is used and freeradius
server is used as Radius Server.
I have performed the Radius client and server configurations according
to the guidelines.
I added the radius entry in /etc/pam.d/sshd:
#%PAM-1.0
auth sufficient /lib/security/pam_radius_auth.so debug
client_id=linux
While i am trying of perform authentication of users, following are
the outcomes depending upon user (trying to login) is locally
configured or not.
Users are trying to log-in via ssh. Both Users A and B are configured
in Radius Server
1. If user A (locally configured in Linux M/C) tries to login, then
Linux PAM gets the user/password information and send it to radius
server. Radius Server authenticates the user/password in its database
and sends successful acknowledgement to linux m/c. User is allowed to
login.
2. If user B (not configured in Linux M/C) login, then
Authentication is being rejected by Radius Server. Radius Server logs
are showing that password in either malformed/incorrect
*********************************************************************************************************************************************************************************************************************
Radius Server Logs:
rad_recv: Access-Request packet from host 127.0.0.1:27138, id=117, length=91
User-Name = "abcd"
User-Password = "\010\n\INCORRECT"
NAS-IP-Address = 172.21.142.4
NAS-Identifier = "linux"
NAS-Port = 26113
NAS-Port-Type = Virtual
Service-Type = Authenticate-Only
Calling-Station-Id = "172.21.142.140"
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 0
modcall[authorize]: module "preprocess" returns ok for request 0
modcall[authorize]: module "chap" returns noop for request 0
modcall[authorize]: module "mschap" returns noop for request 0
rlm_realm: No '@' in User-Name = "abcd", looking up realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 0
rlm_eap: No EAP-Message, not doing EAP
modcall[authorize]: module "eap" returns noop for request 0
modcall[authorize]: module "files" returns notfound for request 0
modcall: group authorize returns ok for request 0
auth: No authenticate method (Auth-Type) configuration found for the
request: Rejecting the user
auth: Failed to validate the user.
Login incorrect: [abcd/\010\n\INCORRECT] (from client localhost port
26113 cli 172.21.142.140)
WARNING: Unprintable characters in the password. ? Double-check the
shared secret on the server and the NAS!
*********************************************************************************************************************************************************************************************************************
SSHD Logs:
May 27 13:14:07 localho sshd[26113]: debug1: PAM: initializing for "abcd"
May 27 13:14:07 localho sshd[26113]: debug1: PAM: setting PAM_RHOST to
"172.21.142.140"
May 27 13:14:07 localho sshd[26113]: debug1: PAM: setting PAM_TTY to "ssh"
May 27 13:14:09 localho sshd[26113]: pam_radius_auth: Got user name abcd
May 27 13:14:09 localho sshd[26113]: pam_radius_auth: Sending RADIUS
request code 1
May 27 13:14:09 localho sshd[26113]: pam_radius_auth: DEBUG:
getservbyname(radius, udp) returned -1768845152.
May 27 13:14:10 localho sshd[26113]: pam_radius_auth: RADIUS server
127.0.0.1 failed to respond
May 27 13:14:10 localho sshd[26113]: pam_radius_auth: All RADIUS
servers failed to respond.
May 27 13:14:10 localho sshd[26113]: pam_radius_auth: authentication failed
May 27 13:14:10 localho sshd(pam_unix)[26113]: check pass; user unknown
May 27 13:14:10 localho sshd(pam_unix)[26113]: authentication failure;
logname= uid=0 euid=0 tty=ssh ruser= rhost=172.21.142.140
May 27 13:14:13 localho sshd[26113]: debug1: PAM: password
authentication failed for an illegal user: Authentication failure
May 27 13:14:13 localho sshd[26113]: Failed password for invalid user
abcd from ::ffff:172.21.142.140 port 36124 ssh2
*********************************************************************************************************************************************************************************************************************
After reading through couple of forums, i got the hint this is the way
PAM works.
Linux PAM has restriction to have user-id configured locally on Linux
M/C for successful Radius Authentication
But if we have the case of thousands of guest users, then it is not
possible to add every user in machine itself.
I am willing to know:
1. Is this is the way how PAM works. Is this limitation is present in PAM
2. I am using Linux PAM 1.0. Is there any patch/fix available in
higher version of PAM?
3. Is there any way to overcome this issue by using some other
libpam-radius-auth plugin. Though i do not think it is Radius client
plugin issue.
It will be really helpful if someone can help/suggest me in this regards.
Regards,
Deepak Sharma
Technical Leader
Aricent
Plot 5, Elec. Cirty,Sector 18, GURGAON
Mobile +91 99111 62935
Office +91 124 4095888 Ext 2939
________________________________
"DISCLAIMER: This message is proprietary to the Aricent Group and is
intended solely for the use of the individual to whom it is addressed.
It may contain privileged or confidential information and should not
be circulated or used for any purpose other than for what it is
intended. If you have received this message in error, please notify
the originator immediately. If you are not the intended recipient, you
are notified that you are strictly prohibited from using, copying,
altering, or disclosing the contents of this message. The Aricent
Group accepts no responsibility for loss or damage arising from the
use of the information transmitted by this email including damage from
virus."
--
Sent from my mobile device
Thanks
Deepak Sharma
12 years, 10 months
sf.net/projects/pam closed
by Thorsten Kukuk
Hi,
after all relevant bugs are closed, I "closed" sf.net/projects/pam
and there is now the following message:
"As of 2011-05-24, this project may now be found at https://fedorahosted.org/linux-pam/."
Thorsten
--
Thorsten Kukuk, Project Manager/Release Manager SLES
SUSE LINUX Products GmbH, Maxfeldstr. 5, D-90409 Nuernberg
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg)
12 years, 10 months
pam_listfile: fix quiet option
by Thorsten Kukuk
Hi,
the quiet option of pam_listfile.so currently doesn't work at all.
This patch fixes it, ok to commit?
diff --git a/ChangeLog b/ChangeLog
index 763c44e..b90a2e6 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2011-05-24 Thorsten Kukuk <kukuk(a)thkukuk.de>
+
+ * modules/pam_listfile/pam_listfile.c (pam_sm_authenticate): quiet
+ option has no argument, print no missing file if quiet is set
+ [sf#3194930].
+
2011-05-04 Thorsten Kukuk <kukuk(a)thkukuk.de>
* modules/pam_lastlog/pam_lastlog.c (last_login_failed): Don't
diff --git a/modules/pam_listfile/pam_listfile.c b/modules/pam_listfile/pam_listfile.c
index 616d220..2af2afd 100644
--- a/modules/pam_listfile/pam_listfile.c
+++ b/modules/pam_listfile/pam_listfile.c
@@ -78,8 +78,14 @@ pam_sm_authenticate (pam_handle_t *pamh, int flags UNUSED,
{
const char *junk;
+ /* option quiet has no value */
+ if(!strcmp(argv[i],"quiet")) {
+ quiet = 1;
+ continue;
+ }
+
memset(mybuf,'\0',sizeof(mybuf));
- memset(myval,'\0',sizeof(mybuf));
+ memset(myval,'\0',sizeof(myval));
junk = strchr(argv[i], '=');
if((junk == NULL) || (junk - argv[i]) >= (int) sizeof(mybuf)) {
pam_syslog(pamh,LOG_ERR, "Bad option: \"%s\"",
@@ -142,8 +148,6 @@ pam_sm_authenticate (pam_handle_t *pamh, int flags UNUSED,
apply_type=APPLY_TYPE_USER;
strncpy(apply_val,myval,sizeof(apply_val)-1);
}
- } else if (!strcmp(mybuf,"quiet")) {
- quiet = 1;
} else {
free(ifname);
pam_syslog(pamh,LOG_ERR, "Unknown option: %s",mybuf);
@@ -283,7 +287,8 @@ pam_sm_authenticate (pam_handle_t *pamh, int flags UNUSED,
ifname, citem, citemp, sense);
#endif
if(lstat(ifname,&fileinfo)) {
- pam_syslog(pamh,LOG_ERR, "Couldn't open %s",ifname);
+ if(!quiet)
+ pam_syslog(pamh,LOG_ERR, "Couldn't open %s",ifname);
free(ifname);
return onerr;
}
--
Thorsten Kukuk, Project Manager/Release Manager SLES
SUSE LINUX Products GmbH, Maxfeldstr. 5, D-90409 Nuernberg
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg)
12 years, 10 months
[Patch] pam_limits.so Support whitespace in user/group names
by Janek Walkenhorst
Hello!
This patch adds support for whitespace in the <domain> field of limits.conf.
It does so by enabling the use of " to escape data. The " itself is escaped by duplication.
Example:
@"long ""group"" name" hard nproc 1000
This specifies the group name >>>long "group" name<<<.
- Janek
--
Janek Walkenhorst
Software Engineering Apprentice
Univention GmbH
Linux for your business
Mary-Somerville-Str.1
28359 Bremen
Tel. : +49 421 22232-0
Fax : +49 421 22232-99
walkenhorst(a)univention.de
http://www.univention.de
Geschäftsführer: Peter H. Ganten
HRB 20755 Amtsgericht Bremen
Steuer-Nr.: 71-597-02876
12 years, 10 months