[linux-pam] #4: [PATCH] po/ja.po: Fix some wrong translations and so on
by fedora-badges
#4: [PATCH] po/ja.po: Fix some wrong translations and so on
--------------------+-------------------------------------------------------
Reporter: fumiyas | Owner: pam-developers(a)lists.fedorahosted.org
Type: defect | Status: new
Priority: major | Component: library
Version: 1.1.x | Keywords: l10n
--------------------+-------------------------------------------------------
I've updated po/ja.po to fix some wrong translations and so on.
Please see and commit the attached patch to master repository if you feel
good.
Should I contact the original translator (Kiyoto Hashida
<khashida(a)redhat.com>) to check and confirm this patch?
--
Ticket URL: <https://fedorahosted.org/linux-pam/ticket/4>
linux-pam <http://fedorahosted.org/linux-pam>
The Linux-PAM (Pluggable Authentication Modules) project
8 years, 11 months
[linux-pam] #5: multiple pam_namespace unmount problems
by fedora-badges
#5: multiple pam_namespace unmount problems
-----------------------------+------------------------------
Reporter: andersblomdell | Owner: pam-developers@…
Type: defect | Status: new
Priority: major | Component: library
Version: 1.1.x | Keywords:
Blocked By: | Blocking:
-----------------------------+------------------------------
This is essentially a short version of the bug in:
http://bugzilla.redhat.com/show_bug.cgi?id=755216
Essentially pam_namespace (1.1.5) suffers the following problems:
1. The (bind) mounts done in the new namespace is visible in the
original namespace (Error "too many levels of symbolic links").
2. At pam_namespace exit, the original mounting is restored for any
remaining child processes (daemons), which is a security problem.
Patch is attached
--
Ticket URL: <https://fedorahosted.org/linux-pam/ticket/5>
linux-pam <http://fedorahosted.org/linux-pam>
The Linux-PAM (Pluggable Authentication Modules) project
10 years, 3 months
[PATCH] pam_unix: use the only one pam_module struct with static build
by Ilya Matveychikov
PAM_UNIX is not able to run correctly with '--enable-static-modules' as
there are 4 pam_module structs defined: acct, auth, passwd and session.
This leads to impossibility of using standart config files with things
like 'auth require pam_unix.so'. So, merge all of theese structs into
the generic one -- _pam_unix_modstruct.
---
libpam/pam_static_modules.h | 10 ++--------
modules/pam_unix/Makefile.am | 2 +-
modules/pam_unix/pam_unix.c | 26 ++++++++++++++++++++++++++
modules/pam_unix/pam_unix_acct.c | 19 +++++--------------
modules/pam_unix/pam_unix_auth.c | 23 ++++++++++-------------
modules/pam_unix/pam_unix_passwd.c | 20 +++++---------------
modules/pam_unix/pam_unix_sess.c | 24 ++++++++++--------------
7 files changed, 59 insertions(+), 65 deletions(-)
create mode 100644 modules/pam_unix/pam_unix.c
diff --git a/libpam/pam_static_modules.h b/libpam/pam_static_modules.h
index 67d8135..2ae0cf9 100644
--- a/libpam/pam_static_modules.h
+++ b/libpam/pam_static_modules.h
@@ -80,10 +80,7 @@ extern struct pam_module _pam_timestamp_modstruct;
extern struct pam_module _pam_tty_audit_modstruct;
#endif
extern struct pam_module _pam_umask_modstruct;
-extern struct pam_module _pam_unix_acct_modstruct;
-extern struct pam_module _pam_unix_auth_modstruct;
-extern struct pam_module _pam_unix_passwd_modstruct;
-extern struct pam_module _pam_unix_session_modstruct;
+extern struct pam_module _pam_unix_modstruct;
extern struct pam_module _pam_userdb_modstruct;
extern struct pam_module _pam_warn_modstruct;
extern struct pam_module _pam_wheel_modstruct;
@@ -140,10 +137,7 @@ static struct pam_module *static_modules[] = {
&_pam_tty_audit_modstruct,
#endif
&_pam_umask_modstruct,
- &_pam_unix_acct_modstruct,
- &_pam_unix_auth_modstruct,
- &_pam_unix_passwd_modstruct,
- &_pam_unix_session_modstruct,
+ &_pam_unix_modstruct,
&_pam_userdb_modstruct,
&_pam_warn_modstruct,
&_pam_wheel_modstruct,
diff --git a/modules/pam_unix/Makefile.am b/modules/pam_unix/Makefile.am
index ea5a731..d0bfed4 100644
--- a/modules/pam_unix/Makefile.am
+++ b/modules/pam_unix/Makefile.am
@@ -40,7 +40,7 @@ sbin_PROGRAMS = unix_chkpwd unix_update
noinst_PROGRAMS = bigcrypt
-pam_unix_la_SOURCES = bigcrypt.c pam_unix_acct.c \
+pam_unix_la_SOURCES = bigcrypt.c pam_unix.c pam_unix_acct.c \
pam_unix_auth.c pam_unix_passwd.c pam_unix_sess.c support.c \
passverify.c yppasswd_xdr.c md5_good.c md5_broken.c
diff --git a/modules/pam_unix/pam_unix.c b/modules/pam_unix/pam_unix.c
new file mode 100644
index 0000000..06b2d02
--- /dev/null
+++ b/modules/pam_unix/pam_unix.c
@@ -0,0 +1,26 @@
+#include "config.h"
+
+#include <security/pam_modules.h>
+
+/* pam_unix_auth.c */
+extern int pam_unix_sm_authenticate(pam_handle_t *, int, int, const char **);
+extern int pam_unix_sm_setcred(pam_handle_t *, int, int, const char **);
+/* pam_unix_acct.c */
+extern int pam_unix_sm_acct_mgmt(pam_handle_t *, int, int, const char **);
+/* pam_unix_sess.c */
+extern int pam_unix_sm_open_session(pam_handle_t *, int, int, const char **);
+extern int pam_unix_sm_close_session(pam_handle_t *, int, int, const char **);
+/* pam_unix_passwd.c */
+extern int pam_unix_sm_chauthtok(pam_handle_t *, int, int, const char **);
+
+#ifdef PAM_STATIC
+struct pam_module _pam_unix_modstruct = {
+ "pam_unix",
+ pam_unix_sm_authenticate,
+ pam_unix_sm_setcred,
+ pam_unix_sm_acct_mgmt,
+ pam_unix_sm_open_session,
+ pam_unix_sm_close_session,
+ pam_unix_sm_chauthtok,
+};
+#endif
diff --git a/modules/pam_unix/pam_unix_acct.c b/modules/pam_unix/pam_unix_acct.c
index 2731b8b..2168301 100644
--- a/modules/pam_unix/pam_unix_acct.c
+++ b/modules/pam_unix/pam_unix_acct.c
@@ -178,8 +178,13 @@ int _unix_run_verify_binary(pam_handle_t *pamh, unsigned int ctrl,
* account management module.
*/
+#ifdef PAM_STATIC
+int pam_unix_sm_acct_mgmt(pam_handle_t * pamh, int flags,
+ int argc, const char **argv)
+#else
PAM_EXTERN int pam_sm_acct_mgmt(pam_handle_t * pamh, int flags,
int argc, const char **argv)
+#endif
{
unsigned int ctrl;
const void *void_uname;
@@ -291,17 +296,3 @@ PAM_EXTERN int pam_sm_acct_mgmt(pam_handle_t * pamh, int flags,
return retval;
}
-
-
-/* static module data */
-#ifdef PAM_STATIC
-struct pam_module _pam_unix_acct_modstruct = {
- "pam_unix_acct",
- NULL,
- NULL,
- pam_sm_acct_mgmt,
- NULL,
- NULL,
- NULL,
-};
-#endif
diff --git a/modules/pam_unix/pam_unix_auth.c b/modules/pam_unix/pam_unix_auth.c
index d9c4ea5..0436f9b 100644
--- a/modules/pam_unix/pam_unix_auth.c
+++ b/modules/pam_unix/pam_unix_auth.c
@@ -98,9 +98,13 @@ setcred_free (pam_handle_t *pamh UNUSED, void *ptr, int err UNUSED)
free (ptr);
}
-
+#ifdef PAM_STATIC
+int pam_unix_sm_authenticate(pam_handle_t * pamh, int flags,
+ int argc, const char **argv)
+#else
PAM_EXTERN int pam_sm_authenticate(pam_handle_t * pamh, int flags
,int argc, const char **argv)
+#endif
{
unsigned int ctrl;
int retval, *ret_data = NULL;
@@ -190,9 +194,14 @@ PAM_EXTERN int pam_sm_authenticate(pam_handle_t * pamh, int flags
* warned you. -- AOY
*/
+#ifdef PAM_STATIC
+int pam_unix_sm_setcred(pam_handle_t *pamh, int flags UNUSED,
+ int argc UNUSED, const char **argv UNUSED)
+#else
PAM_EXTERN int
pam_sm_setcred (pam_handle_t *pamh, int flags UNUSED,
int argc UNUSED, const char **argv UNUSED)
+#endif
{
int retval;
const void *pretval = NULL;
@@ -213,15 +222,3 @@ pam_sm_setcred (pam_handle_t *pamh, int flags UNUSED,
return retval;
}
-
-#ifdef PAM_STATIC
-struct pam_module _pam_unix_auth_modstruct = {
- "pam_unix_auth",
- pam_sm_authenticate,
- pam_sm_setcred,
- NULL,
- NULL,
- NULL,
- NULL,
-};
-#endif
diff --git a/modules/pam_unix/pam_unix_passwd.c b/modules/pam_unix/pam_unix_passwd.c
index 631df31..703d8eb 100644
--- a/modules/pam_unix/pam_unix_passwd.c
+++ b/modules/pam_unix/pam_unix_passwd.c
@@ -521,9 +521,13 @@ static int _pam_unix_approve_pass(pam_handle_t * pamh
return retval;
}
-
+#ifdef PAM_STATIC
+int pam_unix_sm_chauthtok(pam_handle_t * pamh, int flags,
+ int argc, const char **argv)
+#else
PAM_EXTERN int pam_sm_chauthtok(pam_handle_t * pamh, int flags,
int argc, const char **argv)
+#endif
{
unsigned int ctrl, lctrl;
int retval;
@@ -821,17 +825,3 @@ PAM_EXTERN int pam_sm_chauthtok(pam_handle_t * pamh, int flags,
return retval;
}
-
-
-/* static module data */
-#ifdef PAM_STATIC
-struct pam_module _pam_unix_passwd_modstruct = {
- "pam_unix_passwd",
- NULL,
- NULL,
- NULL,
- NULL,
- NULL,
- pam_sm_chauthtok,
-};
-#endif
diff --git a/modules/pam_unix/pam_unix_sess.c b/modules/pam_unix/pam_unix_sess.c
index 778062e..230c0b6 100644
--- a/modules/pam_unix/pam_unix_sess.c
+++ b/modules/pam_unix/pam_unix_sess.c
@@ -63,8 +63,13 @@
* session module.
*/
+#ifdef PAM_STATIC
+int pam_unix_sm_open_session(pam_handle_t * pamh, int flags,
+ int argc, const char **argv)
+#else
PAM_EXTERN int pam_sm_open_session(pam_handle_t * pamh, int flags,
int argc, const char **argv)
+#endif
{
char *user_name, *service;
unsigned int ctrl;
@@ -98,8 +103,13 @@ PAM_EXTERN int pam_sm_open_session(pam_handle_t * pamh, int flags,
return PAM_SUCCESS;
}
+#ifdef PAM_STATIC
+int pam_unix_sm_close_session(pam_handle_t * pamh, int flags,
+ int argc, const char **argv)
+#else
PAM_EXTERN int pam_sm_close_session(pam_handle_t * pamh, int flags,
int argc, const char **argv)
+#endif
{
char *user_name, *service;
unsigned int ctrl;
@@ -127,17 +137,3 @@ PAM_EXTERN int pam_sm_close_session(pam_handle_t * pamh, int flags,
return PAM_SUCCESS;
}
-
-/* static module data */
-#ifdef PAM_STATIC
-struct pam_module _pam_unix_session_modstruct = {
- "pam_unix_session",
- NULL,
- NULL,
- NULL,
- pam_sm_open_session,
- pam_sm_close_session,
- NULL,
-};
-#endif
-
--
1.7.8.3
12 years, 2 months
Ask for help about how to programming with PAM
by shuaijie wang
Hi all,
Current I am in charge of incorporating PAM facility into our product (we
are using krb5 for authentication), but I've search a lot, there is no
coding sample or program paradigm available, so can anyone give me a sample
client/server program so that I can get a feeling on how to program with
PAM for krb5? To be specifically, I know that client should call
pam_authenticate to do the authentication, but we know that in kerberos, it
is the end server to verify user's id, what should server code call in
order to accomplish the whole auth job? Can anyone provide some sample code
or give me some advice? Thank you.
12 years, 2 months
[PATCH] Fix compile time errors with static modules enabled
by Ilya Matveychikov
This patch fix errors when building with ./configure --enable-static-modules
---
libpam/pam_static_modules.h | 2 --
modules/pam_pwhistory/opasswd.c | 8 ++++----
modules/pam_pwhistory/opasswd.h | 10 +++++-----
modules/pam_pwhistory/pam_pwhistory.c | 12 ++++++------
modules/pam_tally2/pam_tally2.c | 2 +-
5 files changed, 16 insertions(+), 18 deletions(-)
diff --git a/libpam/pam_static_modules.h b/libpam/pam_static_modules.h
index 999adc2..67d8135 100644
--- a/libpam/pam_static_modules.h
+++ b/libpam/pam_static_modules.h
@@ -63,7 +63,6 @@ extern struct pam_module _pam_nologin_modstruct;
extern struct pam_module _pam_permit_modstruct;
extern struct pam_module _pam_pwhistory_modstruct;
extern struct pam_module _pam_rhosts_modstruct;
-extern struct pam_module _pam_rhosts_auth_modstruct;
extern struct pam_module _pam_rootok_modstruct;
extern struct pam_module _pam_securetty_modstruct;
#ifdef WITH_SELINUX
@@ -124,7 +123,6 @@ static struct pam_module *static_modules[] = {
&_pam_permit_modstruct,
&_pam_pwhistory_modstruct,
&_pam_rhosts_modstruct,
- &_pam_rhosts_auth_modstruct,
&_pam_rootok_modstruct,
&_pam_securetty_modstruct,
#ifdef WITH_SELINUX
diff --git a/modules/pam_pwhistory/opasswd.c b/modules/pam_pwhistory/opasswd.c
index 738483a..ff1b94c 100644
--- a/modules/pam_pwhistory/opasswd.c
+++ b/modules/pam_pwhistory/opasswd.c
@@ -113,8 +113,8 @@ compare_password(const char *newpass, const char *oldpass)
/* Check, if the new password is already in the opasswd file. */
int
-check_old_password (pam_handle_t *pamh, const char *user,
- const char *newpass, int debug)
+check_old_pass (pam_handle_t *pamh, const char *user,
+ const char *newpass, int debug)
{
int retval = PAM_SUCCESS;
FILE *oldpf;
@@ -209,8 +209,8 @@ check_old_password (pam_handle_t *pamh, const char *user,
}
int
-save_old_password (pam_handle_t *pamh, const char *user, uid_t uid,
- const char *oldpass, int howmany, int debug UNUSED)
+save_old_pass (pam_handle_t *pamh, const char *user, uid_t uid,
+ const char *oldpass, int howmany, int debug UNUSED)
{
char opasswd_tmp[] = TMP_PASSWORDS_FILE;
struct stat opasswd_stat;
diff --git a/modules/pam_pwhistory/opasswd.h b/modules/pam_pwhistory/opasswd.h
index e8a2013..db3e656 100644
--- a/modules/pam_pwhistory/opasswd.h
+++ b/modules/pam_pwhistory/opasswd.h
@@ -36,10 +36,10 @@
#ifndef __OPASSWD_H__
#define __OPASSWD_H__
-extern int check_old_password (pam_handle_t *pamh, const char *user,
- const char *newpass, int debug);
-extern int save_old_password (pam_handle_t *pamh, const char *user,
- uid_t uid, const char *oldpass,
- int howmany, int debug);
+extern int check_old_pass (pam_handle_t *pamh, const char *user,
+ const char *newpass, int debug);
+extern int save_old_pass (pam_handle_t *pamh, const char *user,
+ uid_t uid, const char *oldpass,
+ int howmany, int debug);
#endif /* __OPASSWD_H__ */
diff --git a/modules/pam_pwhistory/pam_pwhistory.c b/modules/pam_pwhistory/pam_pwhistory.c
index 9b58895..4c582bc 100644
--- a/modules/pam_pwhistory/pam_pwhistory.c
+++ b/modules/pam_pwhistory/pam_pwhistory.c
@@ -168,15 +168,15 @@ pam_sm_chauthtok (pam_handle_t *pamh, int flags, int argc, const char **argv)
if (spw == NULL)
return PAM_USER_UNKNOWN;
- retval = save_old_password (pamh, user, pwd->pw_uid, spw->sp_pwdp,
- options.remember, options.debug);
+ retval = save_old_pass (pamh, user, pwd->pw_uid, spw->sp_pwdp,
+ options.remember, options.debug);
if (retval != PAM_SUCCESS)
return retval;
}
else
{
- retval = save_old_password (pamh, user, pwd->pw_uid, pwd->pw_passwd,
- options.remember, options.debug);
+ retval = save_old_pass (pamh, user, pwd->pw_uid, pwd->pw_passwd,
+ options.remember, options.debug);
if (retval != PAM_SUCCESS)
return retval;
}
@@ -208,8 +208,8 @@ pam_sm_chauthtok (pam_handle_t *pamh, int flags, int argc, const char **argv)
if (options.debug)
pam_syslog (pamh, LOG_DEBUG, "check against old password file");
- if (check_old_password (pamh, user, newpass,
- options.debug) != PAM_SUCCESS)
+ if (check_old_pass (pamh, user, newpass,
+ options.debug) != PAM_SUCCESS)
{
pam_error (pamh,
_("Password has been already used. Choose another."));
diff --git a/modules/pam_tally2/pam_tally2.c b/modules/pam_tally2/pam_tally2.c
index e1df6d7..3522c79 100644
--- a/modules/pam_tally2/pam_tally2.c
+++ b/modules/pam_tally2/pam_tally2.c
@@ -844,7 +844,7 @@ pam_sm_acct_mgmt(pam_handle_t *pamh, int flags UNUSED,
/* static module data */
-struct pam_module _pam_tally_modstruct = {
+struct pam_module _pam_tally2_modstruct = {
MODULE_NAME,
#ifdef PAM_SM_AUTH
pam_sm_authenticate,
--
1.7.8.3
12 years, 3 months
Do not unmount the polyinstantiated directories on session close by default
by Tomas Mraz
The attached patch fixes another bug found in pam_namespace by Anders
Blomdell. If there are processes that are running in the private
namespace left after the pam_session_close() is called, they will see
the original polyinstantiated directories contents as the bind mounts
will be unmounted (at least for directories that are not currently in
use by the processes). There is actually no need to do the unmounts. It
would be useful only in case there are multiple pam_open/close_session
calls called in sequence from a single process. I do not even know of
any service that would do this, because it is not fully supported by
other modules as well (the state of the process might be quite different
from the original state before the first pam_open_session call). However
I kept the unmounting code and call it only when unmount_on_close option
is used.
OK to commit?
--
Tomas Mraz
No matter how far down the wrong road you've gone, turn back.
Turkish proverb
12 years, 3 months
Fix for pam_namespace leaking mounts
by Tomas Mraz
This is a fix for the problem recently reported in trac. It is not a
perfect solution as in case the root user account is polyinstantiated as
well it will not be possible to mainpulate the mounts in the parent
namespace. However a perfect fix is not possible without changes in
kernel mount() syscall implementation and the current problem is much
worse.
OK to commit?
--
Tomas Mraz
No matter how far down the wrong road you've gone, turn back.
Turkish proverb
12 years, 3 months
[PATCH] Fix typo in configure, rename '-disable-nis' to '--disable-nis'
by Ilya Matveychikov
---
configure.in | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/configure.in b/configure.in
index 5058155..2c2f20c 100644
--- a/configure.in
+++ b/configure.in
@@ -442,7 +442,7 @@ AC_SUBST(LIBDB)
AM_CONDITIONAL([HAVE_LIBDB], [test ! -z "$LIBDB"])
AC_ARG_ENABLE([nis],
- AS_HELP_STRING([-disable-nis], [Disable building NIS/YP support in pam_unix and pam_access]))
+ AS_HELP_STRING([--disable-nis], [Disable building NIS/YP support in pam_unix and pam_access]))
AS_IF([test "x$enable_nis" != "xno"], [
CFLAGS=$old_CFLAGS
--
1.7.8.3
12 years, 3 months
Policy to subscribe to pam-developers?
by Thorsten Kukuk
Hi,
waht should be the policy to subscribe to pam-developers?
Should everybody be allowed? Or only people who posted at least once
on the linux-pam mailing list?
Thorsten
--
Thorsten Kukuk, Project Manager/Release Manager SLES
SUSE LINUX Products GmbH, Maxfeldstr. 5, D-90409 Nuernberg
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg)
12 years, 3 months
linux-pam.org is our
by Thorsten Kukuk
Hi,
I still don't know what will happen with kernel.org and
other projects beside the kernel itself. But I got quite some mails
already asking for where the web pages and documentation can be
found today.
Since I had still some free domains, I registered linux-pam.org
and put the old backup online.
If kernel.org will be fully functional one day again, we can
redirect the domain to that location.
Thorsten
--
Thorsten Kukuk, Project Manager/Release Manager SLES
SUSE LINUX Products GmbH, Maxfeldstr. 5, D-90409 Nuernberg
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg)
12 years, 3 months