On Fri, Dec 16, Tomas Mraz wrote:
The username matching in the pam_unix 'remember' feature
implementation
is incorrect. It will incorrectly match entries whose user name contains
the searched user name as prefix. See also
https://bugzilla.redhat.com/show_bug.cgi?id=768087
Although the remember feature is obsolete in favor of pam_pwhistory I
think we should fix this bug.
The attached patch fixes it, please review it.
Can there really be a "," after the username?
But it's fine for me.
Thorsten
diff --git a/modules/pam_unix/pam_unix_passwd.c
b/modules/pam_unix/pam_unix_passwd.c
index 6ba2c2e..498a81c 100644
--- a/modules/pam_unix/pam_unix_passwd.c
+++ b/modules/pam_unix/pam_unix_passwd.c
@@ -280,13 +280,15 @@ static int check_old_password(const char *forwho, const char
*newpass)
char *s_luser, *s_uid, *s_npas, *s_pas;
int retval = PAM_SUCCESS;
FILE *opwfile;
+ size_t len = strlen(forwho);
opwfile = fopen(OLD_PASSWORDS_FILE, "r");
if (opwfile == NULL)
return PAM_ABORT;
while (fgets(buf, 16380, opwfile)) {
- if (!strncmp(buf, forwho, strlen(forwho))) {
+ if (!strncmp(buf, forwho, len) && (buf[len] == ':' ||
+ buf[len] == ',')) {
char *sptr;
buf[strlen(buf) - 1] = '\0';
s_luser = strtok_r(buf, ":,", &sptr);
diff --git a/modules/pam_unix/passverify.c b/modules/pam_unix/passverify.c
index 089f4b8..5289955 100644
--- a/modules/pam_unix/passverify.c
+++ b/modules/pam_unix/passverify.c
@@ -562,6 +562,7 @@ save_old_password(pam_handle_t *pamh, const char *forwho, const char
*oldpass,
int found = 0;
struct passwd *pwd = NULL;
struct stat st;
+ size_t len = strlen(forwho);
#ifdef WITH_SELINUX
security_context_t prev_context=NULL;
#endif
@@ -629,7 +630,7 @@ save_old_password(pam_handle_t *pamh, const char *forwho, const char
*oldpass,
}
while (fgets(buf, 16380, opwfile)) {
- if (!strncmp(buf, forwho, strlen(forwho))) {
+ if (!strncmp(buf, forwho, len) && strchr(":,\n", buf[len]) != NULL)
{
char *sptr = NULL;
found = 1;
if (howmany == 0)
_______________________________________________
Pam-developers mailing list
Pam-developers(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/pam-developers
--
Thorsten Kukuk, Project Manager/Release Manager SLES
SUSE LINUX Products GmbH, Maxfeldstr. 5, D-90409 Nuernberg
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg)