Q: deprecating modules
by Dmitry V. Levin
Hi,
I suggest to start a formal procedure of deprecating modules.
For example, we could use a simple 3-step deprecation algorithm:
- declare a module as deprecated in the upcoming release N,
- do not build it by default right after release N,
- remove it from the tree right after release N+1.
I suggest starting with pam_tally (obsoleted by in-tree pam_tally2),
pam_tally2 (obsoleted by out-of-tree pam_faillock), and pam_cracklib
(obsoleted by out-of-tree pam_passwdqc and pam_pwquality), this means
declaring them as deprecated in 1.4.0 release.
This would mean making Linux-PAM releases more regular and more often,
e.g. twice a year.
Comments?
--
ldv
3 years, 11 months
Q: remove PAM_SM_*
by Dmitry V. Levin
Hi,
Starting with commit Linux-PAM-1.3.0~14 (Remove "--enable-static-modules"
option and support from Linux-PAM) PAM_SM_* macros have no effect.
I don't see why we still describe them in docs and define them in modules.
Shouldn't PAM_SM_* just be removed altogether?
--
ldv
3 years, 11 months
[PATCH 2/2] pam_usertype: do not override the default prompt
by Dmitry V. Levin
Following the bad example in pam_succeed_if module, from the very
beginning pam_usertype used to override the default prompt used by
pam_get_user() with "login: ". Fix this now.
* modules/pam_usertype/pam_usertype.c (pam_sm_authenticate): Do not
request PAM_USER_PROMPT item, invoke pam_get_user() with the default
prompt.
---
modules/pam_usertype/pam_usertype.c | 8 +-------
1 file changed, 1 insertion(+), 7 deletions(-)
diff --git a/modules/pam_usertype/pam_usertype.c b/modules/pam_usertype/pam_usertype.c
index a15599e3..820cf693 100644
--- a/modules/pam_usertype/pam_usertype.c
+++ b/modules/pam_usertype/pam_usertype.c
@@ -112,7 +112,6 @@ pam_usertype_get_uid(struct pam_usertype_opts *opts,
uid_t *_uid)
{
struct passwd *pwd;
- const void *prompt;
const char *username;
int ret;
@@ -131,12 +130,7 @@ pam_usertype_get_uid(struct pam_usertype_opts *opts,
}
/* Get uid of user that is being authenticated. */
- ret = pam_get_item(pamh, PAM_USER_PROMPT, &prompt);
- if (ret != PAM_SUCCESS || prompt == NULL || strlen(prompt) == 0) {
- prompt = "login: ";
- }
-
- ret = pam_get_user(pamh, &username, prompt);
+ ret = pam_get_user(pamh, &username, NULL);
if (ret != PAM_SUCCESS || username == NULL) {
pam_syslog(pamh, LOG_ERR, "error retrieving user name: %s",
pam_strerror(pamh, ret));
--
ldv
3 years, 11 months
[PATCH 1/2] pam_succeed_if: do not override the default prompt
by Dmitry V. Levin
From the very beginning pam_succeed_if used to override the default
prompt used by pam_get_user() with "login: ". Fix this now.
* modules/pam_succeed_if/pam_succeed_if.c (pam_sm_authenticate): Do not
request PAM_USER_PROMPT item, invoke pam_get_user() with the default
prompt.
---
modules/pam_succeed_if/pam_succeed_if.c | 9 +--------
1 file changed, 1 insertion(+), 8 deletions(-)
diff --git a/modules/pam_succeed_if/pam_succeed_if.c b/modules/pam_succeed_if/pam_succeed_if.c
index f33e6097..82de4f33 100644
--- a/modules/pam_succeed_if/pam_succeed_if.c
+++ b/modules/pam_succeed_if/pam_succeed_if.c
@@ -463,19 +463,12 @@ int
pam_sm_authenticate (pam_handle_t *pamh, int flags UNUSED,
int argc, const char **argv)
{
- const void *prompt;
const char *user;
struct passwd *pwd = NULL;
int ret, i, count, use_uid, debug;
const char *left, *right, *qual;
int quiet_fail, quiet_succ, audit;
- /* Get the user prompt. */
- ret = pam_get_item(pamh, PAM_USER_PROMPT, &prompt);
- if ((ret != PAM_SUCCESS) || (prompt == NULL) || (strlen(prompt) == 0)) {
- prompt = "login: ";
- }
-
quiet_fail = 0;
quiet_succ = 0;
audit = 0;
@@ -513,7 +506,7 @@ pam_sm_authenticate (pam_handle_t *pamh, int flags UNUSED,
user = pwd->pw_name;
} else {
/* Get the user's name. */
- ret = pam_get_user(pamh, &user, prompt);
+ ret = pam_get_user(pamh, &user, NULL);
if ((ret != PAM_SUCCESS) || (user == NULL)) {
pam_syslog(pamh, LOG_ERR,
"error retrieving user name: %s",
--
ldv
3 years, 11 months
[PATCH 0/2] Fix problems reported by gcc-10
by Dmitry V. Levin
These two patches should fix all problems reported by gcc-10 against Linux-PAM.
The patches are less trivial than I'd like them to be, please review.
Dmitry V. Levin (2):
pam_filter: fix potential off-by-one heap buffer overflow
pam_issue: fix potential read out of bounds
modules/pam_filter/pam_filter.c | 23 ++++++++-------
modules/pam_issue/pam_issue.c | 50 +++++++++++++++++++--------------
2 files changed, 40 insertions(+), 33 deletions(-)
--
ldv
3 years, 11 months
[PATCH] Add initial Travis CI support
by Dmitry V. Levin
This runs "make distcheck" using gcc-9, gcc-8, gcc-7, and clang
on x86_64, x86, x32, aarch64, s390x, and ppc64le architectures.
* .travis.yml: New file.
* ci/install-dependencies.sh: Likewise.
* ci/run-build-and-tests.sh: Likewise.
Resolves: https://github.com/linux-pam/linux-pam/issues/28
---
I've also pushed it to ldv/travis-ci branch.
.travis.yml | 115 +++++++++++++++++++++++++++++++++++++
ci/install-dependencies.sh | 83 ++++++++++++++++++++++++++
ci/run-build-and-tests.sh | 88 ++++++++++++++++++++++++++++
3 files changed, 286 insertions(+)
create mode 100644 .travis.yml
create mode 100755 ci/install-dependencies.sh
create mode 100755 ci/run-build-and-tests.sh
diff --git a/.travis.yml b/.travis.yml
new file mode 100644
index 00000000..ae627ed4
--- /dev/null
+++ b/.travis.yml
@@ -0,0 +1,115 @@
+language: c
+
+dist: bionic
+
+before_install: ci/install-dependencies.sh
+
+script: ci/run-build-and-tests.sh
+
+sudo: required
+
+git:
+ depth: 2147483647
+
+env:
+ global:
+ - VERBOSE=1
+
+matrix:
+ include:
+ - compiler: gcc
+ arch: amd64
+ env:
+ - TARGET=x86_64
+ - compiler: gcc-9
+ arch: amd64
+ env:
+ - TARGET=x86_64
+ - compiler: gcc-8
+ arch: amd64
+ env:
+ - TARGET=x86_64
+ - compiler: clang
+ arch: amd64
+ env:
+ - TARGET=x86_64
+ - compiler: gcc
+ arch: amd64
+ env:
+ - TARGET=x86
+ - compiler: gcc-9
+ arch: amd64
+ env:
+ - TARGET=x86
+ - compiler: gcc-8
+ arch: amd64
+ env:
+ - TARGET=x86
+ - compiler: clang
+ arch: amd64
+ env:
+ - TARGET=x86
+ - compiler: gcc
+ arch: amd64
+ env:
+ - TARGET=x32
+ - compiler: gcc-9
+ arch: amd64
+ env:
+ - TARGET=x32
+ - compiler: gcc-8
+ arch: amd64
+ env:
+ - TARGET=x32
+ - compiler: clang
+ arch: amd64
+ env:
+ - TARGET=x32
+ - compiler: gcc
+ arch: arm64
+ env:
+ - TARGET=aarch64
+ - compiler: gcc-9
+ arch: arm64
+ env:
+ - TARGET=aarch64
+ - compiler: gcc-8
+ arch: arm64
+ env:
+ - TARGET=aarch64
+ - compiler: clang
+ arch: arm64
+ env:
+ - TARGET=aarch64
+ - compiler: gcc
+ arch: s390x
+ env:
+ - TARGET=s390x
+ - compiler: gcc-9
+ arch: s390x
+ env:
+ - TARGET=s390x
+ - compiler: gcc-8
+ arch: s390x
+ env:
+ - TARGET=s390x
+ - compiler: clang
+ arch: s390x
+ env:
+ - TARGET=s390x
+ - compiler: gcc
+ arch: ppc64le
+ env:
+ - TARGET=ppc64le
+ - compiler: gcc-9
+ arch: ppc64le
+ env:
+ - TARGET=ppc64le
+ - compiler: gcc-8
+ arch: ppc64le
+ env:
+ - TARGET=ppc64le
+ - compiler: clang
+ arch: ppc64le
+ env:
+ - TARGET=ppc64le
diff --git a/ci/install-dependencies.sh b/ci/install-dependencies.sh
new file mode 100755
index 00000000..aaeaf389
--- /dev/null
+++ b/ci/install-dependencies.sh
@@ -0,0 +1,83 @@
+#!/bin/sh -ex
+#
+# Copyright (c) 2018-2019 The strace developers.
+# All rights reserved.
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+j=-j`nproc` || j=
+type sudo >/dev/null 2>&1 && sudo=sudo || sudo=
+packages="
+autoconf
+automake
+autopoint
+bison
+bzip2
+docbook-xml
+docbook-xsl
+flex
+gettext
+libaudit-dev
+libcrack2-dev
+libdb-dev
+libfl-dev
+libselinux1-dev
+libtool
+libxcrypt-dev
+libxml2-utils
+make
+pkg-config
+sed
+w3m
+xsltproc
+xz-utils
+$CC"
+
+retry_if_failed()
+{
+ for i in `seq 0 99`; do
+ "$@" && i= && break || sleep 1
+ done
+ [ -z "$i" ]
+}
+
+updated=
+apt_get_install()
+{
+ [ -n "$updated" ] || {
+ retry_if_failed $sudo apt-get -qq update
+ updated=1
+ }
+ retry_if_failed $sudo \
+ apt-get -qq --no-install-suggests --no-install-recommends \
+ install -y "$@"
+}
+
+case "$CC" in
+ gcc-*)
+ retry_if_failed \
+ $sudo add-apt-repository -y ppa:ubuntu-toolchain-r/test
+ ;;
+esac
+
+case "$TARGET" in
+ x32|x86)
+ packages="$packages gcc-multilib"
+ case "$CC" in
+ gcc-*) packages="$packages $CC-multilib" ;;
+ esac
+ ;;
+esac
+
+apt_get_install $packages
+
+case "${CHECK-}" in
+ coverage)
+ apt_get_install lcov python-pip python-setuptools
+ retry_if_failed \
+ pip install --user codecov
+ ;;
+ valgrind)
+ apt_get_install valgrind
+ ;;
+esac
diff --git a/ci/run-build-and-tests.sh b/ci/run-build-and-tests.sh
new file mode 100755
index 00000000..db55bdd0
--- /dev/null
+++ b/ci/run-build-and-tests.sh
@@ -0,0 +1,88 @@
+#!/bin/sh -ex
+#
+# Copyright (c) 2018-2019 The strace developers.
+# All rights reserved.
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+DISTCHECK_CONFIGURE_FLAGS='--disable-dependency-tracking'
+export DISTCHECK_CONFIGURE_FLAGS
+
+case "${TARGET-}" in
+ x32)
+ CC="$CC -mx32"
+ ;;
+ x86)
+ CC="$CC -m32"
+ DISTCHECK_CONFIGURE_FLAGS="$DISTCHECK_CONFIGURE_FLAGS --build=i686-pc-linux-gnu --target=i686-pc-linux-gnu"
+ ;;
+esac
+
+CPPFLAGS=
+
+case "${CHECK-}" in
+ coverage)
+ DISTCHECK_CONFIGURE_FLAGS="$DISTCHECK_CONFIGURE_FLAGS --enable-code-coverage"
+ CFLAGS='-g -O0'
+ CFLAGS_FOR_BUILD="$CFLAGS"
+ export CFLAGS CFLAGS_FOR_BUILD
+ ;;
+ valgrind)
+ DISTCHECK_CONFIGURE_FLAGS="$DISTCHECK_CONFIGURE_FLAGS --enable-valgrind"
+ ;;
+esac
+
+echo 'BEGIN OF BUILD ENVIRONMENT INFORMATION'
+uname -a |head -1
+libc="$(ldd /bin/sh |sed -n 's|^[^/]*\(/[^ ]*/libc\.so[^ ]*\).*|\1|p' |head -1)"
+$libc |head -1
+$CC --version |head -1
+make --version |head -1
+autoconf --version |head -1
+automake --version |head -1
+libtoolize --version |head -1
+kver="$(printf '%s\n%s\n' '#include <linux/version.h>' 'LINUX_VERSION_CODE' | $CC $CPPFLAGS -E -P -)"
+printf 'kernel-headers %s.%s.%s\n' $(($kver/65536)) $(($kver/256%256)) $(($kver%256))
+echo 'END OF BUILD ENVIRONMENT INFORMATION'
+
+export CC_FOR_BUILD="$CC"
+
+./autogen.sh
+./configure $DISTCHECK_CONFIGURE_FLAGS \
+ || {
+ rc=$?
+ cat config.log
+ echo "$CC -dumpspecs follows"
+ $CC -dumpspecs
+ exit $rc
+}
+
+j=-j`nproc` || j=
+
+case "${CHECK-}" in
+ coverage)
+ make -k $j all VERBOSE=${VERBOSE-}
+ make -k $j check VERBOSE=${VERBOSE-}
+ codecov --gcov-args=-abcp ||:
+ echo 'BEGIN OF TEST SUITE INFORMATION'
+ tail -n 99999 -- tests*/test-suite.log
+ echo 'END OF TEST SUITE INFORMATION'
+ ;;
+ valgrind)
+ make -k $j all VERBOSE=${VERBOSE-}
+ rc=$?
+ for n in ${VALGRIND_TOOLS:-memcheck helgrind drd}; do
+ make -k $j -C "${VALGRIND_TESTDIR:-.}" \
+ check-valgrind-$n VERBOSE=${VERBOSE-} ||
+ rc=$?
+ done
+ echo 'BEGIN OF TEST SUITE INFORMATION'
+ tail -n 99999 -- tests*/test-suite*.log ||
+ rc=$?
+ echo 'END OF TEST SUITE INFORMATION'
+ [ "$rc" -eq 0 ]
+ ;;
+ *)
+ make -k $j distcheck VERBOSE=${VERBOSE-}
+ ;;
+esac
--
ldv
4 years