On Thursday 2019-09-05 16:05, Thorsten Kukuk wrote:
attached patch is identical to pull request #136.
diff --git a/configure.ac b/configure.ac
index e4995fc..c557d2c 100644
--- a/configure.ac
+++ b/configure.ac
@@ -504,6 +504,23 @@ if test ! -z "$LIBSELINUX" ; then
LIBS=$BACKUP_LIBS
fi
+AC_ARG_ENABLE([econf],
+ AS_HELP_STRING([--disable-econf], [do not use libeconf]),
+ [WITH_ECONF=$enableval], WITH_ECONF=yes)
+if test "$WITH_ECONF" = "yes" ; then
+ PKG_CHECK_MODULES([ECONF], [libeconf], [],
+
[AC_CHECK_LIB([econf],[econf_readDirs],[ECONF_LIBS="-leconf"],[ECONF_LIBS=""])])
+ if test -n "$ECONF_LIBS" ; then
+ ECONF_CFLAGS="-DUSE_ECONF=1 $ECONF_CFLAGS"
+ fi
I do not think you need AC_CHECK_LIB as a fallback. It is not like there any
variants of libeconf that do not have a .pc file.
+ AS_HELP_STRING([--enable-vendordir=DIR], [Direcotry for istribution
provided configuration files]),,[])
"Direcotry" "idstribution"
--- a/doc/man/pam.8.xml
+++ b/doc/man/pam.8.xml
@@ -53,11 +53,12 @@
<para>
Vendor-supplied PAM configuration files might be installed in
- the system directory <filename>/usr/lib/pam.d/</filename> instead
+ the system directory <filename>/usr/lib/pam.d/</filename> or
+ an configurable vendor specific directory instead
a configurable vendor ...
diff --git a/libpam/Makefile.am b/libpam/Makefile.am
index 875031e..1c59140 100644
--- a/libpam/Makefile.am
+++ b/libpam/Makefile.am
@@ -3,10 +3,14 @@
#
AM_CFLAGS = -DDEFAULT_MODULE_PATH=\"$(SECUREDIR)/\" -DLIBPAM_COMPILE \
- -I$(srcdir)/include $(LIBPRELUDE_CFLAGS) -DPAM_VERSION=\"$(VERSION)\"
+ -I$(srcdir)/include $(LIBPRELUDE_CFLAGS) \
+ -DPAM_VERSION=\"$(VERSION)\" @ECONF_CFLAGS@
This ought to be $(ECONF_CFLAGS). There is absolutely no reason to hardcode
the ECONF_CFLAGS into Makefile at configure time when all the other _CFLAGS
stay make-time overridable.
Speaking of which, all the -D and -I flags should be in AM_CPPFLAGS
not AM_CFLAGS.
@@ -21,7 +25,7 @@ noinst_HEADERS = pam_prelude.h pam_private.h
pam_tokens.h \
pam_modutil_private.h
libpam_la_LDFLAGS = -no-undefined -version-info 84:2:84
-libpam_la_LIBADD = @LIBAUDIT@ $(LIBPRELUDE_LIBS) @LIBDL@
+libpam_la_LIBADD = @LIBAUDIT@ $(LIBPRELUDE_LIBS) @LIBDL@ @ECONF_LIBS@
$(ECONF_LIBS)
--- a/libpam/pam_modutil_searchkey.c
+++ b/libpam/pam_modutil_searchkey.c
@@ -13,9 +13,34 @@
#include <string.h>
#include <stdlib.h>
#include <ctype.h>
+#ifdef USE_ECONF
+#include <libeconf.h>
+#endif
#define BUF_SIZE 8192
+#ifdef USE_ECONF
+#define LOGIN_DEFS "/etc/login.defs"
hardcoded path: this fails to respect the value passed to
./configure --sysconfdir=XYZ
+static char *
+econf_search_key (const char *name, const char *suffix, const char *key)
+{
+ econf_file *key_file = NULL;
+ char *val;
+
+ if (econf_readDirs (&key_file, "/usr/etc", "/etc", name,
suffix, " \t", "#"))
+ return NULL;
Fails to respect the value passed to --enable-vendordir=XYZ
diff --git a/modules/pam_securetty/Makefile.am
b/modules/pam_securetty/Makefile.am
index 30cc879..94ba04d 100644
--- a/modules/pam_securetty/Makefile.am
+++ b/modules/pam_securetty/Makefile.am
@@ -20,6 +20,9 @@ AM_LDFLAGS = -no-undefined -avoid-version -module
if HAVE_VERSIONING
AM_LDFLAGS += -Wl,--version-script=$(srcdir)/../modules.map
endif
+if HAVE_VENDORDIR
+ AM_CFLAGS += -DVENDORDIR=\"@VENDORDIR@\"
+endif
AM_CPPFLAGS
--- a/modules/pam_securetty/pam_securetty.8.xml
+++ b/modules/pam_securetty/pam_securetty.8.xml
@@ -31,9 +31,12 @@
<para>
pam_securetty is a PAM module that allows root logins only if the
user is logging in on a "secure" tty, as defined by the listing
- in <filename>/etc/securetty</filename>. pam_securetty also checks
- to make sure that <filename>/etc/securetty</filename> is a plain
- file and not world writable. It will also allow root logins on
+ in the <filename>securetty</filename> file. pam_securetty checks at
+ first, if <filename>/etc/securetty</filename> exists. If not and
+ it was build with vendordir support, it will use
it was built with vendordir support...
@@ -111,10 +116,27 @@ securetty_perform_check (pam_handle_t *pamh, int
ctrl,
}
if (stat(SECURETTY_FILE, &ttyfileinfo)) {
+#ifdef VENDORDIR
+ if (errno == ENOENT) {
+ if (stat(SECURETTY2_FILE, &ttyfileinfo)) {
+ pam_syslog(pamh, LOG_NOTICE,
+ "Couldn't open %s: %m", SECURETTY2_FILE);
+ return PAM_SUCCESS; /* for compatibility with old securetty handling,
+ this needs to succeed. But we still log the
+ error. */
+ }
+ securettyfile = SECURETTY2_FILE;
+ } else {
+#endif
So econf is not used? How then do you drop one tty without overriding all
of the vendor config, how do you add one tty without overriding all the
vendor config?