[linux-pam] #4: [PATCH] po/ja.po: Fix some wrong translations and so on
by fedora-badges
#4: [PATCH] po/ja.po: Fix some wrong translations and so on
--------------------+-------------------------------------------------------
Reporter: fumiyas | Owner: pam-developers(a)lists.fedorahosted.org
Type: defect | Status: new
Priority: major | Component: library
Version: 1.1.x | Keywords: l10n
--------------------+-------------------------------------------------------
I've updated po/ja.po to fix some wrong translations and so on.
Please see and commit the attached patch to master repository if you feel
good.
Should I contact the original translator (Kiyoto Hashida
<khashida(a)redhat.com>) to check and confirm this patch?
--
Ticket URL: <https://fedorahosted.org/linux-pam/ticket/4>
linux-pam <http://fedorahosted.org/linux-pam>
The Linux-PAM (Pluggable Authentication Modules) project
8 years, 10 months
[linux-pam] #9: Allow pam_lastlog to write to utmp as an option
by fedora-badges
#9: Allow pam_lastlog to write to utmp as an option
-------------------------+-------------------------------------------------
Reporter: | Owner: pam-developers@…
shadowkyogre | Status: new
Type: | Component: modules
enhancement | Keywords: pam_lastlog utmp update patch
Priority: major | prototype
Version: 1.1.x | Blocking:
Blocked By: |
-------------------------+-------------------------------------------------
The following patch for pam_lastlog allows it to write to utmp as well as
wtmp. Part of the code is from xorg-sessreg to help make a utmp entry. I
only tested this on my desktop, which is running Arch Linux, so some
modifications may need to be made in order to make it more portable.
--
Ticket URL: <https://fedorahosted.org/linux-pam/ticket/9>
linux-pam <http://fedorahosted.org/linux-pam>
The Linux-PAM (Pluggable Authentication Modules) project
9 years
[linux-pam] #5: multiple pam_namespace unmount problems
by fedora-badges
#5: multiple pam_namespace unmount problems
-----------------------------+------------------------------
Reporter: andersblomdell | Owner: pam-developers@…
Type: defect | Status: new
Priority: major | Component: library
Version: 1.1.x | Keywords:
Blocked By: | Blocking:
-----------------------------+------------------------------
This is essentially a short version of the bug in:
http://bugzilla.redhat.com/show_bug.cgi?id=755216
Essentially pam_namespace (1.1.5) suffers the following problems:
1. The (bind) mounts done in the new namespace is visible in the
original namespace (Error "too many levels of symbolic links").
2. At pam_namespace exit, the original mounting is restored for any
remaining child processes (daemons), which is a security problem.
Patch is attached
--
Ticket URL: <https://fedorahosted.org/linux-pam/ticket/5>
linux-pam <http://fedorahosted.org/linux-pam>
The Linux-PAM (Pluggable Authentication Modules) project
10 years, 2 months
[linux-pam] #8: [PATCH] pam_exec: Support showing stdout via pam_info, and only running for a specified module type
by fedora-badges
#8: [PATCH] pam_exec: Support showing stdout via pam_info, and only running for
a specified module type
---------------------------+------------------------------
Reporter: joshtriplett | Owner: pam-developers@…
Type: enhancement | Status: new
Priority: major | Component: modules
Version: | Keywords: patch
Blocked By: | Blocking:
---------------------------+------------------------------
The attached patches implement two new options for the pam_exec module.
Patch 1 adds a "stdout" option, which shows the stdout (and stderr) of
the executed command via pam_info. For instance, adding the following
line to /etc/pam.d/login right before the line for pam_motd:
{{{
session optional pam_exec.so stdout /usr/bin/seq 5
}}}
will print five lines (numbered 1-5) at the start and end of the
session. In order to implement this option without breaking the
existing support for the expose_authtok option, I had to
reorganize the file descriptor handling to move the loop that closes all
unwanted
file descriptors below all the code that sets up stdin/stdout/stderr,
and add some new code before that setup to ensure that none of the pipes
ended up on stdin/stdout/stderr where they might get closed by dup2.
Patch 2 adds a "type" option, which causes pam_exec to only execute the
command when the PAM module type matches the given type. In particular,
this makes it possible to run only at the start or end of a session,
without having to write a separate wrapper script to check the PAM_TYPE
environment variable. For example, adding the following to
/etc/pam.d/login right before the line for pam_motd:
{{{
session optional pam_exec.so type=open_session /bin/sleep 5
}}}
will sleep for 5 seconds at login time, but not at logout time,
demonstrating that the option works.
Together, these options make it possible to show dynamically generated
output at the start of a PAM session. For example, the following
pam_exec invocation produces the same output as the current dynamically
generated first line of the Debian motd:
{{{
session optional pam_exec.so type=open_session stdout /bin/uname -snrvm
}}}
(As an aside, I attempted to submit these patches to pam-
developers(a)lists.fedorahosted.org, but I couldn't seem to subscribe to
that list (no response to my subscription confirmation), and thus my mail
got moderated. Does pam-developers moderate subscriptions?)
--
Ticket URL: <https://fedorahosted.org/linux-pam/ticket/8>
linux-pam <http://fedorahosted.org/linux-pam>
The Linux-PAM (Pluggable Authentication Modules) project
10 years, 6 months
authorizing to sudo and other services.
by __mt__
Hello all,
I'm working on a PAM module that would require a second username and
password to execute a command via sudo. I have the basic pieces in
place, but when the second user authenticates, they authenticate against
the system properly, but not against sudo itself... I'm wondering if
there's something simple I'm missing to make this happen.
code snippet (this is immediately after the first user's authentication
is successful):
pam_handle_t * pamh2 = NULL;
const char* pUsername2 = NULL;
status = pam_start("2man", pUsername2, &conv, &pamh2);
if (status == PAM_BUF_ERR) printf("start: PAM_BUF_ERR\n");
else if (status == PAM_CONV_ERR) printf("start: PAM_CONV_ERR\n");
else if (status == PAM_SYSTEM_ERR) printf("start: PAM_SYSTEM_ERR\n");
status = pam_get_user(pamh2, &pUsername2, NULL);
if (status == PAM_BUF_ERR) printf("get: PAM_BUF_ERR\n");
else if (status == PAM_CONV_ERR) printf("get: PAM_CONV_ERR\n");
else if (status == PAM_SYSTEM_ERR) printf("get: PAM_SYSTEM_ERR\n");
status = pam_authenticate(pamh2, 0);
if (status != PAM_SUCCESS) {
printf("could not successfully authenticate the second user\n");
return status;
} else {
printf("successfully auth'd %s as second auth\n", pUsername2);
}
Thanks in advance for any suggestions.
mt
10 years, 8 months
Make pam_pwhistory usable with SELinux
by Tomas Mraz
pam_pwhistory needs to run a helper to save hashes from /etc/shadow
to /etc/security/opasswd as these files have shadow_t context.
Although current policy allows for passwd command to work with it it
would not be possible to change expired passwords with login and other
services.
The attached patch implements the helper which is called when SELinux is
enabled.
Please review.
--
Tomas Mraz
No matter how far down the wrong road you've gone, turn back.
Turkish proverb
10 years, 8 months
Re: [Pam-developers] Linux-PAM-1.1.6 : not respecting DESTDIR in pam_namespace
by Dmitry V. Levin
On Thu, Jul 11, 2013 at 04:42:17PM +0100, James Allwright wrote:
> Hi Tomas,
>
> Thanks for the response. In looking for this problem, I found
> something else suspicious. I have not seen this causing
> a problem, so it may be that I am mistaken.
>
> The suspect code exists in the modules Makefile.in files.
> I looked in the git repository and could not see the Makefile.in, so
> maybe this is something you have solved another way.
All Makefile.in files are generated.
> The file modules/pam_tally/Makefile.in line 355 is
>
> test -z "$(securelibdir)" || $(MKDIR_P) "$(DESTDIR)$(securelibdir)"
>
> which I would expect to be
>
> test -z "$(DESTDIR)$(securelibdir)" || $(MKDIR_P) "$(DESTDIR)$(securelibdir)"
>
> All the other Makefile.in I saw showed the same construction.
That's correct: securelibdir has to be created iff it is defined.
--
ldv
10 years, 8 months