[linux-pam] #4: [PATCH] po/ja.po: Fix some wrong translations and so on
by fedora-badges
#4: [PATCH] po/ja.po: Fix some wrong translations and so on
--------------------+-------------------------------------------------------
Reporter: fumiyas | Owner: pam-developers(a)lists.fedorahosted.org
Type: defect | Status: new
Priority: major | Component: library
Version: 1.1.x | Keywords: l10n
--------------------+-------------------------------------------------------
I've updated po/ja.po to fix some wrong translations and so on.
Please see and commit the attached patch to master repository if you feel
good.
Should I contact the original translator (Kiyoto Hashida
<khashida(a)redhat.com>) to check and confirm this patch?
--
Ticket URL: <https://fedorahosted.org/linux-pam/ticket/4>
linux-pam <http://fedorahosted.org/linux-pam>
The Linux-PAM (Pluggable Authentication Modules) project
8 years, 11 months
[linux-pam] #24: [PATCH] pam_env: Expand @{HOME} and @{SHELL}
by fedora-badges
#24: [PATCH] pam_env: Expand @{HOME} and @{SHELL}
--------------------------+------------------------------
Reporter: chrisse | Owner: pam-developers@…
Type: enhancement | Status: new
Priority: major | Component: modules
Version: | Keywords:
Blocked By: | Blocking:
--------------------------+------------------------------
I came across the problem of trying to modify XDG_DATA_HOME etc. to some
other value. pam_env seems to be the ideal point to set those variables,
and pam_env.conf supports expansions.
However, as already explained in the configuration examples, the ${HOME}
environment variable is only set later from the process calling PAM, so
there is currently no possibility to actually use this feature.
The following patch adds support to expand @{SHELL} and @{HOME}. It does
so by looking up the password database entry corresponding to the user and
returning the pw_dir and pw_shell fields.
The patch works, but it is not complete, since it does not update the
documentation. I consider it to be a proof of concept, since I didn't know
where exactly to fit in this functionality in the existing code.
--
Ticket URL: <https://fedorahosted.org/linux-pam/ticket/24>
linux-pam <http://fedorahosted.org/linux-pam>
The Linux-PAM (Pluggable Authentication Modules) project
9 years, 1 month
[linux-pam] #20: compilation warnings
by fedora-badges
#20: compilation warnings
---------------------+------------------------------
Reporter: mirraz | Owner: pam-developers@…
Type: defect | Status: new
Priority: minor | Component: library
Version: | Keywords:
Blocked By: | Blocking:
---------------------+------------------------------
Building pam-1.1.6 I'v got this compilation warnings:
{{{
md5.c:145:2: warning: dereferencing type-punned pointer will break strict-
aliasing rules [-Wstrict-aliasing]
md5.c:146:2: warning: dereferencing type-punned pointer will break strict-
aliasing rules [-Wstrict-aliasing]
misc_conv.c:213:22: warning: the address of ‘line’ will always evaluate as
‘true’ [-Waddress]
misc_conv.c:325:15: warning: the address of ‘binary_prompt’ will always
evaluate as ‘true’ [-Waddress]
}}}
--
Ticket URL: <https://fedorahosted.org/linux-pam/ticket/20>
linux-pam <http://fedorahosted.org/linux-pam>
The Linux-PAM (Pluggable Authentication Modules) project
9 years, 1 month
[linux-pam] #9: Allow pam_lastlog to write to utmp as an option
by fedora-badges
#9: Allow pam_lastlog to write to utmp as an option
-------------------------+-------------------------------------------------
Reporter: | Owner: pam-developers@…
shadowkyogre | Status: new
Type: | Component: modules
enhancement | Keywords: pam_lastlog utmp update patch
Priority: major | prototype
Version: 1.1.x | Blocking:
Blocked By: |
-------------------------+-------------------------------------------------
The following patch for pam_lastlog allows it to write to utmp as well as
wtmp. Part of the code is from xorg-sessreg to help make a utmp entry. I
only tested this on my desktop, which is running Arch Linux, so some
modifications may need to be made in order to make it more portable.
--
Ticket URL: <https://fedorahosted.org/linux-pam/ticket/9>
linux-pam <http://fedorahosted.org/linux-pam>
The Linux-PAM (Pluggable Authentication Modules) project
9 years, 1 month
[linux-pam] #27: pam_timestamp path traversal issue
by fedora-badges
#27: pam_timestamp path traversal issue
-----------------------+------------------------------
Reporter: tmraz | Owner: pam-developers@…
Type: security | Status: new
Priority: major | Component: modules
Version: | Keywords:
Blocked By: | Blocking:
-----------------------+------------------------------
pam_timestamp uses PAM_RUSER and PAM_TTY directly without any checks. If
the user can mainpulate PAM_RUSER and PAM_TTY contents (which is mostly
not possible, but there might be scenarios where it is) he would be able
to get access to a service without proper checking.
See http://seclists.org/oss-sec/2014/q1/645 for the original report by
Sebastian Krahmer.
I suppose sufficient mitigation would be to look for ".." in both
PAM_RUSER and PAM_TTY and reject authentication attempt if they contain
this string.
I would also document that the module should never be used with services
where the authenticating user can manipulate the PAM_RUSER variable
contents.
--
Ticket URL: <https://fedorahosted.org/linux-pam/ticket/27>
linux-pam <http://fedorahosted.org/linux-pam>
The Linux-PAM (Pluggable Authentication Modules) project
9 years, 4 months
[linux-pam] #28: Allow module to put the tty to echo off mode via conversation function
by fedora-badges
#28: Allow module to put the tty to echo off mode via conversation function
--------------------------+------------------------------
Reporter: tmraz | Owner: pam-developers@…
Type: enhancement | Status: new
Priority: major | Component: library
Version: | Keywords:
Blocked By: | Blocking:
--------------------------+------------------------------
There is no general mechanism to put tty to echo off mode if a module
waits for other input (such as insertion of a smartcard or finger sweep).
For an example see:
https://bugzilla.redhat.com/show_bug.cgi?id=1038910
Users can start to type password but it will be echoed on terminal because
the pam_fprintd module for example waits for other input.
We could add PAM_SET_ECHO_OFF and PAM_RESET_ECHO_OFF types to pam_conv
with empty message which would set echo off and restore original state
respectively.
These conversation types would be implemented in misc_conv appropriately
and pam_fprintd and other similar modules could use them before waiting
for other input.
The PAM_RESET_ECHO_OFF could also flush the tty input buffer.
--
Ticket URL: <https://fedorahosted.org/linux-pam/ticket/28>
linux-pam <http://fedorahosted.org/linux-pam>
The Linux-PAM (Pluggable Authentication Modules) project
10 years, 1 month
[linux-pam] #26: Use more fail safe method of indicating success from unix_chkpwd
by fedora-badges
#26: Use more fail safe method of indicating success from unix_chkpwd
--------------------------+------------------------------
Reporter: tmraz | Owner: pam-developers@…
Type: enhancement | Status: new
Priority: major | Component: modules
Version: | Keywords: pam_unix
Blocked By: | Blocking:
--------------------------+------------------------------
Solar Designer reported that unix_chkpwd uses potentially fail unsafe
method of indicating success. Although there is no current known case
where failure in executing unix_chkpwd returned zero exit status it would
be much more safe to indicate the success by some arbitrary exit code
value.
I'd even rather suggest to use arbitrary string outputted to the stdout
which would be even safer.
I'll prepare a patch for this.
See also:
http://seclists.org/oss-sec/2014/q1/497
--
Ticket URL: <https://fedorahosted.org/linux-pam/ticket/26>
linux-pam <http://fedorahosted.org/linux-pam>
The Linux-PAM (Pluggable Authentication Modules) project
10 years, 1 month
Canonicalize username in pam_selinux
by Tomas Mraz
Due to domain mapping with SSSD and Winbind the username that is typed
by the user at the login prompt might not match what libselinux expects
when looking for the matching SELinux user. The attached patch
canonicalizes the user name through the pam_modutil_getpwnam. Please see
also the discussion here:
https://bugzilla.redhat.com/show_bug.cgi?id=1071010
OK to commit?
--
Tomas Mraz
No matter how far down the wrong road you've gone, turn back.
Turkish proverb
(You'll never know whether the road is wrong though.)
10 years, 1 month