[SSSD] [PATCHES] CONFIGURE: Enhance detection of pam

Lukas Slebodnik lslebodn at redhat.com
Tue Jun 3 07:19:09 UTC 2014


On (03/06/14 09:06), Sumit Bose wrote:
>On Tue, Jun 03, 2014 at 08:15:36AM +0200, Lukas Slebodnik wrote:
>> On (02/06/14 23:19), Sumit Bose wrote:
>> >On Sat, May 31, 2014 at 04:59:44PM +0200, Lukas Slebodnik wrote:
>> >> ehlo,
>> >> 
>> >> I think that the attached patches are self descriptive.
>> >> 
>> >> LS
>> >
>> >Patches apply and build fine. I've run build on a few platforms without
>> >any issue, but I had none with openpam at hand.
>> >
>> >I only have one comment on the last patch. getlogin() is not thread safe
>> It is
>> https://github.com/freebsd/freebsd/blob/master/lib/libc/gen/getlogin.c
>>     lines 72:82
>
>There are locks, but the result is still in a static variable (line 59),
>i.e. in the admittedly rare case when two threads do authentication in
>parallel for different users one thread might override the result of the
>other.
>

Attaching version withou getlogin. It will require more time to find proper
solution and I do not want to block other patches in this patchset.

LS
-------------- next part --------------
>From dddc33ff8b3dfccb1b4d8dae341d83261c4673c7 Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn at redhat.com>
Date: Tue, 27 May 2014 21:42:52 +0200
Subject: [PATCH 1/6] PAM: Include header file security/pam_appl.h

We need this file for declaration of pam functions
    pam_get_item, pam_putenv, pam_set_data, pam_strerror, pam_set_item

There is already test in configure script for this header file,
but it was not included in pam_sss.c

sh-4.2$ git grep pam_appl.h
src/external/pam.m4:AC_CHECK_HEADERS([security/pam_appl.h ...
src/providers/data_provider_be.c:#include <security/pam_appl.h>
src/providers/proxy/proxy.h:#include <security/pam_appl.h>
src/providers/proxy/proxy_child.c:#include <security/pam_appl.h>
src/responder/pam/pamsrv.h:#include <security/pam_appl.h>
src/sss_client/pam_test_client.c:#include <security/pam_appl.h>
src/util/auth_utils.h:#include <security/pam_appl.h>
---
 src/sss_client/pam_sss.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/sss_client/pam_sss.c b/src/sss_client/pam_sss.c
index 4dae7e1cab5a50e919177b9da1901be594609794..a242929744a345967ea14ff17e31fafa0f4b74e7 100644
--- a/src/sss_client/pam_sss.c
+++ b/src/sss_client/pam_sss.c
@@ -34,6 +34,7 @@
 #include <stdbool.h>
 
 #include <security/pam_modules.h>
+#include <security/pam_appl.h>
 #include <security/pam_ext.h>
 #include <security/pam_modutil.h>
 #include "sss_pam_macros.h"
-- 
1.9.3

-------------- next part --------------
>From 35304e6de91e06a6b4ddb0a3f60fcdb58ec8bd0e Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn at redhat.com>
Date: Tue, 27 May 2014 22:52:56 +0200
Subject: [PATCH 2/6] MAKE: Remove PAM libraries from libsss_simple

libsss_simple does not call any pam function.

sh-4.2$ nm --dynamic --undefined-only .libs/libsss_simple.so | grep pam
sh-4.2$ echo $?
1
---
 Makefile.am | 2 --
 1 file changed, 2 deletions(-)

diff --git a/Makefile.am b/Makefile.am
index 3475ee09d33fc63138aeefbb196506c65986dc05..0d24729200df6d7e189c7b307bf3f7ffdf4a8543 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -2120,8 +2120,6 @@ libsss_simple_la_SOURCES = \
     src/providers/simple/simple_access.c
 libsss_simple_la_CFLAGS = \
     $(AM_CFLAGS)
-libsss_simple_la_LIBADD = \
-    $(PAM_LIBS)
 libsss_simple_la_LDFLAGS = \
     -avoid-version \
     -module
-- 
1.9.3

-------------- next part --------------
>From 8f20eec00804c93ba55f2a0b88579821780e59ce Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn at redhat.com>
Date: Tue, 27 May 2014 22:44:17 +0200
Subject: [PATCH 3/6] CONFIGURE: Enhance detection of pam

---
 Makefile.am         |  4 ++--
 src/external/pam.m4 | 18 ++++++++++++++++--
 2 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/Makefile.am b/Makefile.am
index 0d24729200df6d7e189c7b307bf3f7ffdf4a8543..0fa613505881a5080040a97351cd5f9b07e77b3c 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -1879,7 +1879,7 @@ noinst_PROGRAMS += autofs_test_client
 endif
 
 pam_test_client_SOURCES = src/sss_client/pam_test_client.c
-pam_test_client_LDADD = -lpam -lpam_misc
+pam_test_client_LDADD = $(PAM_LIBS) $(PAM_MISC_LIBS)
 
 if BUILD_AUTOFS
 autofs_test_client_SOURCES = \
@@ -1926,7 +1926,7 @@ pam_sss_la_SOURCES = \
 
 pam_sss_la_LIBADD = \
     $(CLIENT_LIBS) \
-    -lpam
+    $(PAM_LIBS)
 pam_sss_la_LDFLAGS = \
     -module \
     -avoid-version \
diff --git a/src/external/pam.m4 b/src/external/pam.m4
index 40c8fd0dc748dcf9015a5f771fcb45ebce39c67c..90f89bee3f3a6cdfc967498b5aea603609f92c3b 100644
--- a/src/external/pam.m4
+++ b/src/external/pam.m4
@@ -1,6 +1,20 @@
 AC_SUBST(PAM_LIBS)
+AC_SUBST(PAM_MISC_LIBS)
 
-AC_CHECK_HEADERS([security/pam_appl.h security/pam_misc.h security/pam_modules.h],
-    [AC_CHECK_LIB(pam, pam_get_item, [ PAM_LIBS="-lpam" ], [AC_MSG_ERROR([PAM must support pam_get_item])])],
+AC_CHECK_HEADERS([security/pam_appl.h security/pam_modules.h],
+    [AC_CHECK_LIB([pam], [pam_get_item],
+        [PAM_LIBS="-lpam"],
+        [AC_MSG_ERROR([PAM must support pam_get_item])])],
     [AC_MSG_ERROR([PAM development libraries not installed])]
 )
+
+AC_CHECK_HEADERS([security/pam_ext.h security/pam_modutil.h])
+AC_CHECK_HEADERS([security/pam_misc.h security/_pam_macros.h])
+AC_CHECK_HEADERS([security/openpam.h],,,[
+      #ifdef HAVE_SECURITY_PAM_APPL_H
+      #include <security/pam_appl.h>
+      #endif
+    ])
+
+AC_CHECK_LIB([pam_misc], [misc_conv],
+    [PAM_MISC_LIBS="-lpam_misc"])
-- 
1.9.3

-------------- next part --------------
>From f5a76b2f935b29fec1e45916999740ddf28edff5 Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn at redhat.com>
Date: Tue, 27 May 2014 23:05:08 +0200
Subject: [PATCH 4/6] PAM: Fix compilation of pam_test_client with openpam

linuxpam and openpam use different functions for text based conversation.
---
 src/sss_client/pam_test_client.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/src/sss_client/pam_test_client.c b/src/sss_client/pam_test_client.c
index c9cbffaf4a74b5c9f831cb3feec5de305a8dc182..29d1fcbf01682668d51bf154736aec673bd46501 100644
--- a/src/sss_client/pam_test_client.c
+++ b/src/sss_client/pam_test_client.c
@@ -27,12 +27,26 @@
 #include <string.h>
 
 #include <security/pam_appl.h>
-#include <security/pam_misc.h>
 
+#ifdef HAVE_SECURITY_PAM_MISC_H
+# include <security/pam_misc.h>
+#elif defined(HAVE_SECURITY_OPENPAM_H)
+# include <security/openpam.h>
+#endif
+
+#ifdef HAVE_SECURITY_PAM_MISC_H
 static struct pam_conv conv = {
     misc_conv,
     NULL
 };
+#elif defined(HAVE_SECURITY_OPENPAM_H)
+static struct pam_conv conv = {
+    openpam_ttyconv,
+    NULL
+};
+#else
+# error "Missing text based pam conversation function"
+#endif
 
 int main(int argc, char *argv[]) {
 
-- 
1.9.3

-------------- next part --------------
>From a35b3ee20f8d679704eef005b760ec0a68d17c75 Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn at redhat.com>
Date: Tue, 27 May 2014 23:15:10 +0200
Subject: [PATCH 5/6] PAM: Use fallback version of some pam macros

The header file security/_pam_macros.h is not available in openapam.
This patch copies necessary macros from linux-pam 1.1.8.
---
 src/sss_client/sss_pam_macros.h | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/src/sss_client/sss_pam_macros.h b/src/sss_client/sss_pam_macros.h
index 198633c5adc1ca04ced02bd37b52ca7c32aa00b1..0a7e266010a3a4a00d2e76126a1c58a0fa3c8295 100644
--- a/src/sss_client/sss_pam_macros.h
+++ b/src/sss_client/sss_pam_macros.h
@@ -29,7 +29,20 @@
  * _pam_overwrite_n(n,x) macro. This implementation is copied from
  * the Fedora 11 _pam_macros.h.
  */
-#include <security/_pam_macros.h>
+#ifdef HAVE_SECURITY__PAM_MACROS_H
+# include <security/_pam_macros.h>
+#endif /* HAVE_SECURITY__PAM_MACROS_H */
+
+#ifndef _pam_overwrite
+#define _pam_overwrite(x)        \
+do {                             \
+     register char *__xx__;      \
+     if ((__xx__=(x)))           \
+          while (*__xx__)        \
+               *__xx__++ = '\0'; \
+} while (0)
+#endif /* _pam_overwrite */
+
 #ifndef _pam_overwrite_n
 #define _pam_overwrite_n(x,n)   \
 do {                             \
@@ -41,4 +54,8 @@ do {                             \
 } while (0)
 #endif /* _pam_overwrite_n */
 
+#ifndef D
+#define D(x)   do { } while (0)
+#endif /* D */
+
 #endif /* _SSS_PAM_MACROS_H */
-- 
1.9.3

-------------- next part --------------
>From 34c381e6604212fa3a1a32a5371c7b61c6445c74 Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn at redhat.com>
Date: Tue, 27 May 2014 23:55:17 +0200
Subject: [PATCH 6/6] PAM: Define compatible macros for some functions.

Functions pam_vsyslog and pam_modutil_getlogin are not available in openpam.
This patch conditionally define macros for these function if they are not
available. Compatible macros use standard functions vsyslog, getlogin
---
 Makefile.am                     |  3 ++-
 src/external/pam.m4             |  9 +++++++++
 src/sss_client/pam_sss.c        |  4 ++--
 src/sss_client/sss_pam_compat.h | 45 +++++++++++++++++++++++++++++++++++++++++
 4 files changed, 58 insertions(+), 3 deletions(-)
 create mode 100644 src/sss_client/sss_pam_compat.h

diff --git a/Makefile.am b/Makefile.am
index 0fa613505881a5080040a97351cd5f9b07e77b3c..f64c77a5bdd7f53b41bd37572b2d91434a9893a6 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -1922,7 +1922,8 @@ pam_sss_la_SOURCES = \
     src/sss_client/common.c \
     src/sss_client/sss_cli.h \
     src/util/atomic_io.c \
-    src/sss_client/sss_pam_macros.h
+    src/sss_client/sss_pam_macros.h \
+    src/sss_client/sss_pam_compat.h
 
 pam_sss_la_LIBADD = \
     $(CLIENT_LIBS) \
diff --git a/src/external/pam.m4 b/src/external/pam.m4
index 90f89bee3f3a6cdfc967498b5aea603609f92c3b..4776b6ae338409f0a2729dfc4cf5962463a40dfd 100644
--- a/src/external/pam.m4
+++ b/src/external/pam.m4
@@ -18,3 +18,12 @@ AC_CHECK_HEADERS([security/openpam.h],,,[
 
 AC_CHECK_LIB([pam_misc], [misc_conv],
     [PAM_MISC_LIBS="-lpam_misc"])
+
+dnl save LIBS to restore later
+save_LIBS="$LIBS"
+LIBS="$PAM_LIBS"
+
+AC_CHECK_FUNCS(pam_modutil_getlogin pam_vsyslog)
+
+dnl restore LIBS
+LIBS="$save_LIBS"
diff --git a/src/sss_client/pam_sss.c b/src/sss_client/pam_sss.c
index a242929744a345967ea14ff17e31fafa0f4b74e7..d4baa19b60c99d7b6ddccdf9534fc765da06a7df 100644
--- a/src/sss_client/pam_sss.c
+++ b/src/sss_client/pam_sss.c
@@ -35,8 +35,8 @@
 
 #include <security/pam_modules.h>
 #include <security/pam_appl.h>
-#include <security/pam_ext.h>
-#include <security/pam_modutil.h>
+
+#include "sss_pam_compat.h"
 #include "sss_pam_macros.h"
 
 #include "sss_cli.h"
diff --git a/src/sss_client/sss_pam_compat.h b/src/sss_client/sss_pam_compat.h
new file mode 100644
index 0000000000000000000000000000000000000000..d131ceacb233499a3f9c10166af20f64e7020c7b
--- /dev/null
+++ b/src/sss_client/sss_pam_compat.h
@@ -0,0 +1,45 @@
+/*
+   SSSD
+
+   Compat declarations for PAM.
+
+   Authors:
+        Lukas Slebodnik <lslebodn at redhat.com>
+
+   Copyright (C) Red Hat, Inc 2014
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU Lesser General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#ifndef _SSS_PAM_COMPAT_H
+#define _SSS_PAM_COMPAT_H
+
+#ifdef HAVE_SECURITY_PAM_MODUTIL_H
+# include <security/pam_modutil.h>
+#endif /* HAVE_SECURITY_PAM_MODUTIL_H */
+
+#ifdef HAVE_SECURITY_PAM_EXT_H
+# include <security/pam_ext.h>
+#endif /* HAVE_SECURITY_PAM_EXT_H */
+
+#ifndef HAVE_PAM_VSYSLOG
+#define pam_vsyslog(pamh, priority, fmt, vargs) \
+    vsyslog((priority), (fmt), (vargs))
+#endif /* HAVE_PAM_VSYSLOG */
+
+#ifndef PAM_BAD_ITEM
+# define PAM_BAD_ITEM PAM_USER_UNKNOWN
+#endif /* PAM_BAD_ITEM */
+
+#endif /* _SSS_PAM_COMPAT_H */
-- 
1.9.3



More information about the sssd-devel mailing list