diff options
| author | Steve Langasek <steve.langasek@canonical.com> | 2020-08-11 14:54:29 -0700 |
|---|---|---|
| committer | Steve Langasek <steve.langasek@canonical.com> | 2020-08-11 14:54:29 -0700 |
| commit | f6d08ed47a3da3c08345bce2ca366e961c52ad7c (patch) | |
| tree | dcbd0efb229b17f696f7195671f05b354b4f70fc /ChangeLog | |
| parent | 668b13da8f830c38388cecac45539972e80cb246 (diff) | |
| parent | 9e5bea9e146dee574796259ca464ad2435be3590 (diff) | |
New upstream version 1.4.0
Diffstat (limited to 'ChangeLog')
| -rw-r--r-- | ChangeLog | 3773 |
1 files changed, 3769 insertions, 4 deletions
@@ -1,3 +1,3738 @@ +2020-06-04 Dmitry V. Levin <ldv@altlinux.org> + + maint: document release procedure. + * maint/README-release: New file. + + maint: introduce gen-tag-message. + * maint/gen-tag-message: New script for preparing tag message. + + maint: introduce make-dist. + * maint/make-dist: New script for preparing release tarballs. + +2020-06-03 Dmitry V. Levin <ldv@altlinux.org> + + gitlog-to-changelog: update from gnulib. + +2020-05-29 Josef Möllers <jmoellers@suse.de> + Tomáš Mráz <tmraz@redhat.com> + Dmitry V. Levin <ldv@altlinux.org> + + pam_setquota: skip mountpoints equal to the user's $HOME. + Matthias Gerstner found the following issue: + + <quote> + So this pam_setquota module iterates over all mounted file systems using + `setmntent()` and `getmntent()`. It tries to find the longest match of + a file system mounted on /home/$USER or above (except when the + fs=/some/path parameter is passed to the pam module). + + The thing is that /home/$USER is owned by the unprivileged user. And + there exist tools like fusermount from libfuse which is by default + installed setuid-root for everybody. fusermount allows to mount a FUSE + file system using an arbitrary "source device name" as the unprivileged + user. + + Thus considering the following use case: + + 1) there is only the root file system (/) or a file system is mounted on + /home, but not on /home/$USER. + 2) the attacker mounts a fake FUSE file system over its own home directory: + + ``` + user $ export _FUSE_COMMFD=0 + user $ fusermount $HOME -ononempty,fsname=/dev/sda1 + ``` + + This will result in a mount entry in /proc/mounts looking like this: + + ``` + /dev/sda1 on /home/$USER type fuse (rw,nosuid,nodev,relatime,user_id=1000,group_id=100) + ``` + 3) when the attacker now logs in with pam_setquota configured then + pam_setquota will identify /dev/sda1 and the file system where + to apply the user's quota on. + + As a result an unprivileged user has full control over onto which block + device the quota is applied. + </quote> + + If the user's $HOME is on a separate partition, setting a quota on the + user's $HOME does not really make sense, so this patch skips mountpoints + equal to the user's $HOME, preventing the above mentioned bug as + a side-effect (or vice-versa). + + Reported-by: Matthias Gerstner <mgerstner@suse.de> + Resolves: https://github.com/linux-pam/linux-pam/pull/230 + +2020-05-25 Dmitry V. Levin <ldv@altlinux.org> + + pam_debug: do not invoke pam_get_user and do not set PAM_USER. + pam_debug used to invoke pam_get_user and set PAM_USER to "nobody" when + pam_get_user returns an empty string as the user name. When either of + these functions returned an error value, it used to return that error + value. This hasn't been documented, and I couldn't find any rationale + for this behaviour. + + * modules/pam_debug/pam_debug.c (pam_sm_authenticate): Do not invoke + pam_get_user and pam_set_item. + +2020-05-24 Yi-Jyun Pan <pan93412@gmail.com> + + Translated using Weblate (Chinese (Traditional)) + Currently translated at 100.0% (122 of 122 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/zh_TW/ + +2020-05-22 Dmitry V. Levin <ldv@altlinux.org> + + modules: downgrade syslog level for errors related to pam_get_user. + * modules/pam_faillock/pam_faillock.c (get_pam_user): Downgrade + the syslog level for diagnostics of errors returned by + pam_modutil_getpwnam for users returned by pam_get_user + from LOG_ERR to LOG_NOTICE. + * modules/pam_keyinit/pam_keyinit.c (do_keyinit): Likewise. + * modules/pam_lastlog/pam_lastlog.c (pam_sm_authenticate): Likewise. + * modules/pam_listfile/pam_listfile.c (pam_sm_authenticate): Likewise. + * modules/pam_loginuid/pam_loginuid.c (_pam_loginuid): Likewise. + * modules/pam_mail/pam_mail.c (_do_mail): Likewise. + * modules/pam_sepermit/pam_sepermit.c (sepermit_lock): Likewise. + * modules/pam_tally/pam_tally.c (pam_get_uid): Likewise. + * modules/pam_tally2/pam_tally2.c (pam_get_uid): Likewise. + * modules/pam_umask/pam_umask.c (pam_sm_open_session): Likewise. + * modules/pam_xauth/pam_xauth.c (pam_sm_open_session, + pam_sm_close_session): Likewise. + * modules/pam_tty_audit/pam_tty_audit.c (pam_sm_open_session): Downgrade + the syslog level for diagnostics of errors returned by + pam_modutil_getpwnam for users returned by pam_get_user + from LOG_WARNING to LOG_NOTICE. + + Suggested-by: Tomáš Mráz <tmraz@fedoraproject.org> + +2020-05-22 Dmitry V. Levin <ldv@altlinux.org> + + modules: downgrade syslog level for pam_get_user errors. + * modules/pam_access/pam_access.c (pam_sm_authenticate): Downgrade + the syslog level for pam_get_user errors from LOG_ERR to LOG_NOTICE. + * modules/pam_cracklib/pam_cracklib.c (_pam_unix_approve_pass): Likewise. + * modules/pam_ftp/pam_ftp.c (pam_sm_authenticate): Likewise. + * modules/pam_group/pam_group.c (pam_sm_setcred): Likewise. + * modules/pam_lastlog/pam_lastlog.c (pam_sm_authenticate): Likewise. + * modules/pam_loginuid/pam_loginuid.c (_pam_loginuid): Likewise. + * modules/pam_mail/pam_mail.c (_do_mail): Likewise. + * modules/pam_nologin/pam_nologin.c (perform_check): Likewise. + * modules/pam_rhosts/pam_rhosts.c (pam_sm_authenticate): Likewise. + * modules/pam_sepermit/pam_sepermit.c (pam_sm_authenticate): Likewise. + * modules/pam_succeed_if/pam_succeed_if.c (pam_sm_authenticate): Likewise. + * modules/pam_tally/pam_tally.c (pam_get_uid): Likewise. + * modules/pam_tally2/pam_tally2.c (pam_get_uid): Likewise. + * modules/pam_time/pam_time.c (pam_sm_acct_mgmt): Likewise. + * modules/pam_tty_audit/pam_tty_audit.c (pam_sm_open_session): Likewise. + * modules/pam_umask/pam_umask.c (pam_sm_open_session): Likewise. + * modules/pam_userdb/pam_userdb.c (pam_sm_authenticate, + pam_sm_acct_mgmt): Likewise. + * modules/pam_usertype/pam_usertype.c (pam_usertype_get_uid): Likewise. + * modules/pam_xauth/pam_xauth.c (pam_sm_open_session, + pam_sm_close_session): Likewise. + * modules/pam_securetty/pam_securetty.c (securetty_perform_check): + Downgrade the syslog level for pam_get_user errors from LOG_WARNING + to LOG_NOTICE. + * modules/pam_stress/pam_stress.c (pam_sm_authenticate): Likewise. + + Suggested-by: Tomáš Mráz <tmraz@fedoraproject.org> + +2020-05-22 Dmitry V. Levin <ldv@altlinux.org> + + pam_localuser: add a test for return values. + * modules/pam_localuser/tst-pam_localuser-retval.c: New file. + * modules/pam_localuser/Makefile.am (TESTS): Add $(check_PROGRAMS). + (check_PROGRAMS, tst_pam_localuser_retval_LDADD): New variables. + + pam_localuser: refactor pam_sm_authenticate. + * modules/pam_localuser/pam_localuser.c (check_user_in_passwd): New + function. + (pam_sm_authenticate): Use it. + +2020-05-22 Dmitry V. Levin <ldv@altlinux.org> + + pam_localuser: downgrade syslog level for errors related to user input. + * modules/pam_localuser/pam_localuser.c (pam_sm_authenticate): Downgrade + the syslog level for errors related to pam_get_user from LOG_ERR to + LOG_NOTICE. + + Suggested-by: Tomáš Mráz <tmraz@fedoraproject.org> + +2020-05-21 Dmitry V. Levin <ldv@altlinux.org> + + pam_localuser: re-format pam_sm_* function declarations. + +2020-05-21 Dmitry V. Levin <ldv@altlinux.org> + + pam_localuser: remove unused includes. + Also, remove unused MODULE_NAME macro. + + * modules/pam_localuser/pam_localuser.c: Stop including unused header + files. + (MODULE_NAME): Remove. + +2020-05-21 Dmitry V. Levin <ldv@altlinux.org> + + pam_localuser: forward error values returned by pam_get_user. + Starting with commit c2c601f5340a59c5c62193d55b555d384380ea38, + pam_get_user is guaranteed to return one of the following values: + PAM_SUCCESS, PAM_BUF_ERR, PAM_CONV_AGAIN, or PAM_CONV_ERR. + + * modules/pam_localuser/pam_localuser.c (pam_sm_authenticate): Do not + replace non-PAM_CONV_AGAIN error values returned by pam_get_user with + PAM_SERVICE_ERR. + * modules/pam_localuser/pam_localuser.8.xml (RETURN VALUES): Document + new return values. + +2020-05-21 Dmitry V. Levin <ldv@altlinux.org> + + pam_localuser: return PAM_INCOMPLETE when pam_get_user returns PAM_CONV_AGAIN + Give the application a chance to handle PAM_INCOMPLETE. + + * modules/pam_localuser/pam_localuser.c (pam_sm_authenticate): Return + PAM_INCOMPLETE instead of PAM_SERVICE_ERR when pam_get_user returns + PAM_CONV_AGAIN. + * modules/pam_localuser/pam_localuser.8.xml (RETURN VALUES): Document + it. + +2020-05-21 Dmitry V. Levin <ldv@altlinux.org> + + pam_localuser: open the passwd file after user name validation. + Since user name is untrusted input, it should be validated earlier + rather than later. + + * modules/pam_localuser/pam_localuser.c (pam_sm_authenticate): Open + the passwd file after user name validation. + +2020-05-21 Dmitry V. Levin <ldv@altlinux.org> + + pam_localuser: use BUFSIZ as the line buffer size. + As BUFSIZ is the buffer size used in stdio, it must be an efficient size + for the line buffer. Also, it's larger than LINE_MAX used as the line + buffer size before this change, effectively raising the maximum user + name length supported by this module. + + * modules/pam_localuser/pam_localuser.c (pam_sm_authenticate): Replace + LINE_MAX with BUFSIZ. + +2020-05-21 Dmitry V. Levin <ldv@altlinux.org> + + pam_localuser: handle long lines in passwd files properly. + Before this change, a long line in the passwd file used to be treated as + several lines which could potentially result to false match and, + consequently, to incorrect PAM_SUCCESS return value. + + * modules/pam_localuser/pam_localuser.c (pam_sm_authenticate): Handle + long lines in passwd files properly. + +2020-05-21 Dmitry V. Levin <ldv@altlinux.org> + + pam_localuser: get rid of a temporary buffer. + * modules/pam_localuser/pam_localuser.c (pam_sm_authenticate): Do not + copy the user name into a temporary buffer, use the user name itself in + comparisons. + + pam_localuser: log unrecognized options. + * modules/pam_localuser/pam_localuser.c (pam_sm_authenticate): Log + unrecognized options. + +2020-05-21 Dmitry V. Levin <ldv@altlinux.org> + + pam_localuser: return PAM_SERVICE_ERR instead of PAM_SYSTEM_ERR. + When passwd file cannot be opened or the user name either cannot be + obtained or is not valid, return PAM_SERVICE_ERR instead of + PAM_SYSTEM_ERR. + + * modules/pam_localuser/pam_localuser.c (pam_sm_authenticate): Return + PAM_SERVICE_ERR instead of PAM_SYSTEM_ERR. + +2020-05-21 Dmitry V. Levin <ldv@altlinux.org> + + pam_localuser: reject user names that are too long. + Too long user names used to be truncated which could potentially result + to false match and, consequently, to incorrect PAM_SUCCESS return value. + + * modules/pam_localuser/pam_localuser.c (pam_sm_authenticate): Return + PAM_SERVICE_ERR if the user name is too long. + +2020-05-21 Dmitry V. Levin <ldv@altlinux.org> + + pam_localuser: reject user names containing a colon. + "root:x" is not a local user name even if the passwd file contains + a line starting with "root:x:". + + * modules/pam_localuser/pam_localuser.c (pam_sm_authenticate): Return + PAM_PERM_DENIED if the user name contains a colon. + +2020-05-21 Dmitry V. Levin <ldv@altlinux.org> + + pam_mkhomedir: add a test for return values. + * modules/pam_mkhomedir/tst-pam_mkhomedir-retval.c: New file. + * modules/pam_mkhomedir/Makefile.am (TESTS): Add $(check_PROGRAMS). + (check_PROGRAMS, tst_pam_mkhomedir_retval_LDADD): New variables. + + pam_faildelay: add a test for return values. + * modules/pam_faildelay/tst-pam_faildelay-retval.c: New file. + * modules/pam_faildelay/Makefile.am (TESTS): Add $(check_PROGRAMS). + (check_PROGRAMS, tst_pam_faildelay_retval_LDADD): New variables. + + pam_rootok: add a test for return values. + * modules/pam_rootok/tst-pam_rootok-retval.c: New file. + * modules/pam_rootok/Makefile.am (TESTS): Add $(check_PROGRAMS). + (check_PROGRAMS, tst_pam_rootok_retval_LDADD): New variables. + + pam_nologin: add a test for return values. + * modules/pam_nologin/tst-pam_nologin-retval.c: New file. + * modules/pam_nologin/Makefile.am (TESTS): Add $(check_PROGRAMS). + (check_PROGRAMS, tst_pam_nologin_retval_LDADD): New variables. + + pam_echo: add a test for return values. + * modules/pam_echo/tst-pam_echo-retval.c: New file. + * modules/pam_echo/Makefile.am (TESTS): Add $(check_PROGRAMS). + (check_PROGRAMS, tst_pam_echo_retval_LDADD): New variables. + + pam_warn: add a test for return values. + * modules/pam_warn/tst-pam_warn-retval.c: New file. + * modules/pam_warn/Makefile.am (TESTS): Add $(check_PROGRAMS). + (check_PROGRAMS, tst_pam_warn_retval_LDADD): New variables. + + pam_debug: add a test for return values. + * modules/pam_debug/tst-pam_debug-retval.c: New file. + * modules/pam_debug/Makefile.am (TESTS): Add $(check_PROGRAMS). + (check_PROGRAMS, tst_pam_debug_retval_LDADD): New variables. + + pam_permit: add a test for return values. + * modules/pam_permit/tst-pam_permit-retval.c: New file. + * modules/pam_permit/Makefile.am (TESTS): Add $(check_PROGRAMS). + (check_PROGRAMS, tst_pam_permit_retval_LDADD): New variables. + + pam_deny: add a test for return values. + * modules/pam_deny/tst-pam_deny-retval.c: New file. + * modules/pam_deny/Makefile.am (TESTS): Add $(check_PROGRAMS). + (check_PROGRAMS, tst_pam_deny_retval_LDADD): New variables. + +2020-05-21 Dmitry V. Levin <ldv@altlinux.org> + + Introduce test_assert.h. + Introduce a new internal header file for definitions of handy macros + providing convenient assertion testing functionality. + + * libpam/include/test_assert.h: New file. + * libpam/Makefile.am (noinst_HEADERS): Add include/test_assert.h. + +2020-05-21 Andreas Henriksson <andreas+fedora@fatal.se> + + Translated using Weblate (Swedish) + Currently translated at 100.0% (122 of 122 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/sv/ + +2020-05-17 Dmitry V. Levin <ldv@altlinux.org> + + doc: fix the description of stack jump effects. + Every stack jump, besides the jump itself, has a side effect which is + one of 'ignore', 'ok', or 'bad'. Unfortunately, the side effect is far + from obvious because it depends on the PAM function call, and the + documentation that contradicts the implementation does not help either. + + * doc/man/pam.conf-syntax.xml (actionN): Rewrite the description + of stack jump effects to match the implementation. + + Fixes: 871a6e14d65c3c446ae0af51166dabc7a47a2b56 + +2020-05-17 Weblate (bot) <noreply@weblate.org> + Allan Nordhøy <epost@anotheragency.no>
+ Dmitry V. Levin <ldv@altlinux.org> + + Translations update from Weblate (#227) + * Translated using Weblate (Norwegian Bokmål)
+
+ Currently translated at 99.1% (121 of 122 strings)
+
+ Translation: linux-pam/master
+ Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/nb_NO/
+
+ * Translated using Weblate (Catalan)
+
+ Currently translated at 98.3% (120 of 122 strings)
+
+ Translation: linux-pam/master
+ Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/ca/
+ +2020-05-16 Dmitry V. Levin <ldv@altlinux.org> + + modules: do not check user name for emptyness before passing it to pam_modutil_getpwnam + pam_modutil_getpwnam is perfectly capable of handling empty strings as + user names, no need to double check that. + + * modules/pam_access/pam_access.c (pam_sm_authenticate): Do not check + the user name for emptyness before passing it to pam_modutil_getpwnam. + * modules/pam_lastlog/pam_lastlog.c (pam_sm_authenticate): Likewise. + * modules/pam_pwhistory/pam_pwhistory.c (pam_sm_chauthtok): Likewise. + * modules/pam_shells/pam_shells.c (perform_check): Likewise. + * modules/pam_tally/pam_tally.c (pam_get_uid): Likewise. + * modules/pam_tally2/pam_tally2.c (pam_get_uid): Likewise. + * modules/pam_umask/pam_umask.c (pam_sm_open_session): Likewise. + +2020-05-15 Dmitry V. Levin <ldv@altlinux.org> + + pam_usertype: Document return values forwarded from pam_get_user. + * modules/pam_usertype/pam_usertype.8.xml (RETURN VALUES): Document + PAM_BUF_ERR and PAM_CONV_ERR return values. + +2020-05-15 Dmitry V. Levin <ldv@altlinux.org> + + pam_usertype: return PAM_INCOMPLETE when pam_get_user returns PAM_CONV_AGAIN + Give the application a chance to handle PAM_INCOMPLETE. + + * modules/pam_usertype/pam_usertype.c (pam_usertype_get_uid): Return + PAM_INCOMPLETE instead of PAM_CONV_AGAIN when pam_get_user returns + PAM_CONV_AGAIN. + * modules/pam_usertype/pam_usertype.8.xml (RETURN VALUES): Document it. + +2020-05-15 Dmitry V. Levin <ldv@altlinux.org> + + pam_faillock: Document return values forwarded from pam_get_user. + * modules/pam_faillock/pam_faillock.8.xml (RETURN VALUES): Document + PAM_BUF_ERR and PAM_CONV_ERR return values. + +2020-05-15 Dmitry V. Levin <ldv@altlinux.org> + + pam_faillock: return PAM_INCOMPLETE when pam_get_user returns PAM_CONV_AGAIN + Give the application a chance to handle PAM_INCOMPLETE. + + * modules/pam_faillock/pam_faillock.c (get_pam_user): Return + PAM_INCOMPLETE instead of PAM_CONV_AGAIN when pam_get_user returns + PAM_CONV_AGAIN. + * modules/pam_faillock/pam_faillock.8.xml (RETURN VALUES): Document it. + +2020-05-15 Dmitry V. Levin <ldv@altlinux.org> + + pam_securetty: forward error values returned by pam_get_user. + Starting with commit c2c601f5340a59c5c62193d55b555d384380ea38, + pam_get_user is guaranteed to return one of the following values: + PAM_SUCCESS, PAM_BUF_ERR, PAM_CONV_AGAIN, or PAM_CONV_ERR. + + * modules/pam_securetty/pam_securetty.c (pam_sm_authenticate): Do not + replace non-PAM_CONV_AGAIN error values returned by pam_get_user with + PAM_SERVICE_ERR. + * modules/pam_securetty/pam_securetty.8.xml (RETURN VALUES): Document + new return values. + +2020-05-15 Dmitry V. Levin <ldv@altlinux.org> + + modules: do not check user name for NULL if pam_get_user returned PAM_SUCCESS + If pam_get_user returned PAM_SUCCESS, the user name is guaranteed + to be a valid C string, no need to double check that. + + * modules/pam_access/pam_access.c (pam_sm_authenticate): Do not check + for NULL the user name returned by pam_get_user when the latter returned + PAM_SUCCESS. + * modules/pam_cracklib/pam_cracklib.c (_pam_unix_approve_pass): Likewise. + * modules/pam_debug/pam_debug.c (pam_sm_authenticate): Likewise. + * modules/pam_filter/pam_filter.c (process_args): Likewise. + * modules/pam_ftp/pam_ftp.c (pam_sm_authenticate): Likewise. + * modules/pam_group/pam_group.c (pam_sm_setcred): Likewise. + * modules/pam_lastlog/pam_lastlog.c (pam_sm_authenticate): Likewise. + * modules/pam_listfile/pam_listfile.c (pam_sm_authenticate): Likewise. + * modules/pam_localuser/pam_localuser.c (pam_sm_authenticate): Likewise. + * modules/pam_mail/pam_mail.c (_do_mail): Likewise. + * modules/pam_nologin/pam_nologin.c (perform_check): Likewise. + * modules/pam_permit/pam_permit.c (pam_sm_authenticate): Likewise. + * modules/pam_pwhistory/pam_pwhistory.c (pam_sm_chauthtok): Likewise. + * modules/pam_rhosts/pam_rhosts.c (pam_sm_authenticate): Likewise. + * modules/pam_securetty/pam_securetty.c (pam_sm_authenticate): Likewise. + * modules/pam_sepermit/pam_sepermit.c (pam_sm_authenticate): Likewise. + * modules/pam_shells/pam_shells.c (perform_check): Likewise. + * modules/pam_stress/pam_stress.c (pam_sm_authenticate): Likewise. + * modules/pam_succeed_if/pam_succeed_if.c (pam_sm_authenticate): Likewise. + * modules/pam_time/pam_time.c (pam_sm_acct_mgmt): Likewise. + * modules/pam_timestamp/pam_timestamp.c (get_timestamp_name): Likewise. + * modules/pam_umask/pam_umask.c (pam_sm_open_session): Likewise. + * modules/pam_unix/pam_unix_auth.c (pam_sm_authenticate): Likewise. + * modules/pam_unix/pam_unix_passwd.c (pam_sm_chauthtok): Likewise. + * modules/pam_usertype/pam_usertype.c (pam_usertype_get_uid): Likewise. + * modules/pam_wheel/pam_wheel.c (perform_check): Likewise. + * modules/pam_userdb/pam_userdb.c (pam_sm_authenticate, pam_sm_acct_mgmt): + Likewise. + +2020-05-14 Dmitry V. Levin <ldv@altlinux.org> + + pam_umask: Document return values forwarded from pam_get_user. + * modules/pam_umask/pam_umask.8.xml (RETURN VALUES): Document + PAM_BUF_ERR, PAM_CONV_ERR, and PAM_INCOMPLETE return values. + + pam_exec: Document return values forwarded from pam_get_user. + * modules/pam_exec/pam_exec.8.xml (RETURN VALUES): Document + PAM_BUF_ERR, PAM_CONV_ERR, and PAM_INCOMPLETE return values. + +2020-05-13 Dmitry V. Levin <ldv@altlinux.org> + + Deprecate pam_cracklib, pam_tally, and pam_tally2. + Deprecate pam_cracklib, there are two better alternatives to this + obsolete module: pam_passwdqc from passwdqc project and pam_pwquality + from libpwquality project. + + Deprecate pam_tally and pam_tally2 in favour of pam_faillock. + + * configure.ac: Implement --enable-cracklib=check that enables build + of pam_cracklib when libcrack is available. + Disable build of pam_cracklib, pam_tally, and pam_tally2 by default. + * NEWS: Mention this change. + * ci/run-build-and-tests.sh (DISTCHECK_CONFIGURE_FLAGS): Add + --enable-tally, --enable-tally2, and --enable-cracklib=check + to check build of these deprecated modules. + +2020-05-13 Dmitry V. Levin <ldv@altlinux.org> + + NEWS: update. + +2020-05-12 Thorsten Kukuk <5908016+thkukuk@users.noreply.github.com> + + Use correct path for pam_namespace.service file (#223) + +2020-05-09 Dmitry V. Levin <ldv@altlinux.org> + + pam_setquota: fix return value when the user is unknown. + Following the bad example in pam_mkhomedir module, from the very + beginning pam_setquota module used to return PAM_CRED_INSUFFICIENT + when pam_modutil_getpwnam() returned an error. Fix this now + by changing the return value to PAM_USER_UNKNOWN. + + * modules/pam_setquota/pam_setquota.c (pam_sm_open_session): Return + PAM_USER_UNKNOWN instead of PAM_CRED_INSUFFICIENT. + * modules/pam_setquota/pam_setquota.8.xml (PAM_CRED_INSUFFICIENT): + Replace with PAM_USER_UNKNOWN. + +2020-05-09 Dmitry V. Levin <ldv@altlinux.org> + + pam_mkhomedir: fix return value when the user is unknown. + From the very beginning pam_mkhomedir module used to return + PAM_CRED_INSUFFICIENT when getpwnam() or pam_modutil_getpwnam() + returned an error. Fix this now by changing the return value + to PAM_USER_UNKNOWN. + + * modules/pam_mkhomedir/mkhomedir_helper.c (main): Return + PAM_USER_UNKNOWN instead of PAM_CRED_INSUFFICIENT. + * modules/pam_mkhomedir/pam_mkhomedir.c (pam_sm_open_session): Likewise. + * modules/pam_mkhomedir/pam_mkhomedir.8.xml (PAM_CRED_INSUFFICIENT): + Remove. + +2020-05-06 Dmitry V. Levin <ldv@altlinux.org> + + pam_get_user: do not override valid values returned by the conversation function + When the conversation function returned a value different from + PAM_CONV_AGAIN and provided no response, pam_get_user used to replace + the return value with PAM_CONV_ERR. Fix this and replace the return + value only if it was PAM_SUCCESS. + + * libpam/pam_item.c (pam_get_user): Do not override valid values + returned by the conversation function. + +2020-05-06 Dmitry V. Levin <ldv@altlinux.org> + + pam_get_user: filter conversation function return values. + Do not assume that the conversation function provided by the application + strictly follows the return values guidelines, replace undocumented + return values with PAM_CONV_ERR. + + * libpam/pam_item.c (pam_get_user): If the value returned by the + conversation function is not one of PAM_SUCCESS, PAM_BUF_ERR, + PAM_CONV_AGAIN, or PAM_CONV_ERR, replace it with PAM_CONV_ERR. + +2020-05-06 Dmitry V. Levin <ldv@altlinux.org> + + man: document other valid pam_get_user return values. + * doc/man/pam_get_user.3.xml (pam_get_user-return_values): Add + PAM_BUF_ERR, PAM_ABORT, and PAM_CONV_AGAIN. + +2020-05-06 Dmitry V. Levin <ldv@altlinux.org> + + pam_get_user: consistently return PAM_SYSTEM_ERR if user specified a NULL pointer + pam_get_user returns PAM_SYSTEM_ERR in case of pamh == NULL. + In case of user == NULL, however, it used to return PAM_PERM_DENIED, + and in case of NULL conversation function it used to return + PAM_SERVICE_ERR. + + According to the documentation, PAM_SYSTEM_ERR shall be returned + if a NULL pointer was submitted. + + Fix this inconsistency and return PAM_SYSTEM_ERR in each of these + programming error cases. + + * libpam/pam_item.c (pam_get_user): Return PAM_SYSTEM_ERR instead of + PAM_PERM_DENIED if user == NULL. Return PAM_SYSTEM_ERR instead of + PAM_SERVICE_ERR if pamh->pam_conversation == NULL. + +2020-05-06 Weblate (bot) <noreply@weblate.org> + + Translations update from Weblate. + * Translated using Weblate (Spanish)
+
+ Currently translated at 81.9% (100 of 122 strings)
+
+ * Translated using Weblate (Portuguese)
+
+ Currently translated at 100.0% (122 of 122 strings)
+ +2020-05-03 Dmitry V. Levin <ldv@altlinux.org> + + doc: remove references to PAM_SM_* macros. + Starting with commit a684595c0bbd88df71285f43fb27630e3829121e aka + Linux-PAM-1.3.0~14 (Remove "--enable-static-modules" option and support + from Linux-PAM), PAM_SM_* macros have no effect. + + modules: remove PAM_SM_* macros. + Starting with commit a684595c0bbd88df71285f43fb27630e3829121e aka + Linux-PAM-1.3.0~14 (Remove "--enable-static-modules" option and support + from Linux-PAM), PAM_SM_* macros have no effect. + +2020-05-03 Dmitry V. Levin <ldv@altlinux.org> + + pam_usertype: do not override the default prompt. + Following the bad example in pam_succeed_if module, from the very + beginning pam_usertype used to override the default prompt used by + pam_get_user() with "login: ". Fix this now. + + * modules/pam_usertype/pam_usertype.c (pam_sm_authenticate): Do not + request PAM_USER_PROMPT item, invoke pam_get_user() with the default + prompt. + +2020-05-03 Dmitry V. Levin <ldv@altlinux.org> + + pam_succeed_if: do not override the default prompt. + From the very beginning pam_succeed_if used to override the default + prompt used by pam_get_user() with "login: ". Fix this now. + + * modules/pam_succeed_if/pam_succeed_if.c (pam_sm_authenticate): Do not + request PAM_USER_PROMPT item, invoke pam_get_user() with the default + prompt. + +2020-05-03 Dmitry V. Levin <ldv@altlinux.org> + + modules/*/Makefile.am: rename TESTS to dist_check_SCRIPTS. + ... and remove $(TESTS) from EXTRA_DIST. + + The change is performed automatically using the following script: + sed -i -e 's/^TESTS = \(tst.*\)/dist_check_SCRIPTS = \1\nTESTS = $(dist_check_SCRIPTS)/' \ + -e '/^EXTRA_DIST/ s/ \$(TESTS)//' modules/*/Makefile.am + +2020-05-03 Dmitry V. Levin <ldv@altlinux.org> + + modules/*/Makefile.am: rename man_MANS to dist_man_MANS. + ... and remove $(MANS) from EXTRA_DIST. + + The change is performed automatically using the following script: + sed -i 's/^man_MANS/dist_&/; /^EXTRA_DIST/ s/ \$(MANS)//' modules/*/Makefile.am + +2020-05-03 Dmitry V. Levin <ldv@altlinux.org> + + pam_namespace: cleanup pam_namespace.service installation. + * modules/pam_namespace/Makefile.am (service_DATA): New variable. + (install-data-local): Remove all commands related to servicedir. + (uninstall-local): Remove. + + Fixes: 59812d1cf ("pam_namespace: secure tmp-inst directories") + +2020-05-03 Dmitry V. Levin <ldv@altlinux.org> + + modules/*/Makefile.am: add dist_ prefix to *_DATA. + ... and remove $(DATA) from EXTRA_DIST. + + The change is performed automatically using the following script: + sed -i 's/^[a-z]*_DATA/dist_&/; /^EXTRA_DIST/ s/ \$(DATA)//' modules/*/Makefile.am + +2020-05-03 Dmitry V. Levin <ldv@altlinux.org> + + modules/pam_timestamp/Makefile.am: rename noinst_PROGRAMS to check_PROGRAMS + ... and remove nodist_TESTS. + + * modules/pam_timestamp/Makefile.am (nodist_TESTS): Remove. + (TESTS): Replace $(nodist_TESTS) with $(check_PROGRAMS). + (noinst_PROGRAMS): Rename to check_PROGRAMS. + +2020-05-03 Dmitry V. Levin <ldv@altlinux.org> + + modules/pam_timestamp/Makefile.am: rename dist_TESTS to dist_check_SCRIPTS + ... and remove it from EXTRA_DIST + + * modules/pam_timestamp/Makefile.am (EXTRA_DIST): Remove $(dist_TESTS). + (dist_TESTS): Rename to dist_check_SCRIPTS. + (TESTS): Replace $(dist_TESTS) with $(dist_check_SCRIPTS). + +2020-05-03 Dmitry V. Levin <ldv@altlinux.org> + + modules/pam_namespace/Makefile.am: add dist_ prefix to secureconf_SCRIPTS + ... and remove $(SCRIPTS) from EXTRA_DIST. + + * modules/pam_namespace/Makefile.am (EXTRA_DIST): Remove $(SCRIPTS). + (secureconf_SCRIPTS): Rename to dist_secureconf_SCRIPTS. + +2020-05-03 Dmitry V. Levin <ldv@altlinux.org> + + Translated using Weblate (Russian) + Currently translated at 100.0% (122 of 122 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/ru/ + +2020-05-03 Yuri Chornoivan <yurchor@ukr.net> + + Translated using Weblate (Ukrainian) + Currently translated at 100.0% (122 of 122 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/uk/ + +2020-05-03 Oğuz Ersen <oguzersen@protonmail.com> + + Translated using Weblate (Turkish) + Currently translated at 100.0% (122 of 122 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/tr/ + +2020-05-03 Julien Humbert <julroy67@gmail.com> + + Translated using Weblate (French) + Currently translated at 100.0% (122 of 122 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/fr/ + +2020-05-03 scootergrisen <scootergrisen@gmail.com> + + Translated using Weblate (Danish) + Currently translated at 100.0% (122 of 122 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/da/ + +2020-05-03 Piotr Drąg <piotrdrag@gmail.com> + + Translated using Weblate (Polish) + Currently translated at 100.0% (122 of 122 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/pl/ + +2020-04-30 Tomas Mraz <tmraz@fedoraproject.org> + + Update .po and .pot files after adding pam_faillock. + + pam_faillock: Correct the grammar of translated strings. + Also make the message the same as in pam_tally2. + + pam_faillock: Add conf option to use a different config file. + + pam_faillock: New module for locking after multiple auth failures. + +2020-04-29 Weblate (bot) <noreply@weblate.org> + Alesker Abdullayev - FEDORA Azerbaijan <tech@abdullaeff.com>
+ Allan Nordhøy <epost@anotheragency.no> + + Translations update from Weblate (#215) + Updated translation using Weblate
+
+ * Translated using Weblate (Azerbaijani)
+
+ Currently translated at 15.8% (19 of 120 strings)
+
+ * Translated using Weblate (Norwegian Bokmål)
+
+ Currently translated at 100.0% (120 of 120 strings)
+ +2020-04-28 Dmitry V. Levin <ldv@altlinux.org> + + build: rework vendordir substitution. + Since Make.xml.rules is the only place where XSLTPROC_CUSTOM was used, + remove stereotypic definitions from other Makefiles, this way we no + longer have to worry about vendordir being used somewhere else in + documentation files. + + Likewise, define VENDORDIR in config.h and remove stereotypic + -DVENDORDIR= additions from other Makefiles, this way we no longer + have to worry about VENDORDIR being used somewhere else in the code. + + * configure.ac (AM_CONDITIONAL): Remove HAVE_VENDORDIR. + (AC_DEFINE_UNQUOTED): Add VENDORDIR. + (AC_SUBST): Remove VENDORDIR, add STRINGPARAM_VENDORDIR. + * Make.xml.rules.in: Replace $(XSLTPROC_CUSTOM) with + @STRINGPARAM_VENDORDIR@. + * doc/man/Makefile.am (XSLTPROC_CUSTOM): Remove. + * libpam/Makefile.am [HAVE_VENDORDIR]: Remove. + * modules/pam_securetty/Makefile.am [HAVE_VENDORDIR]: Remove. + (XSLTPROC_CUSTOM): Remove. + * modules/pam_securetty/pam_securetty.c: Move definitions of local + macros after config.h to benefit from macros defined there. + +2020-04-28 Dmitry V. Levin <ldv@altlinux.org> + + Make.xml.rules: prepare for configure substitutions. + * Make.xml.rules: Rename to ... + * Make.xml.rules.in: ... new file. + * Makefile.am (EXTRA_DIST): Remove Make.xml.rules. + * configure.ac (AC_CONFIG_FILES): Add Make.xml.rules. + +2020-04-27 Dmitry V. Levin <ldv@altlinux.org> + + pam_namespace: replace namespace.init with $(SCRIPTS) in EXTRA_DIST. + As namespace.init is listed in secureconf_SCRIPTS which is part of + generated SCRIPTS variable. + + * modules/pam_namespace/Makefile.am (EXTRA_DIST): Replace namespace.init + with $(SCRIPTS). + +2020-04-27 Dmitry V. Levin <ldv@altlinux.org> + + pam_env: remove environment from EXTRA_DIST. + * modules/pam_env/Makefile.am (EXTRA_DIST): Remove environment as it is + listed in sysconf_DATA which is part of DATA which is already listed in + EXTRA_DIST. + +2020-04-27 Dmitry V. Levin <ldv@altlinux.org> + + modules/*/Makefile.am: remove $(secureconf_DATA) from EXTRA_DIST. + Since the whole $(DATA) is listed in EXTRA_DIST, $(secureconf_DATA) + can be safely de-listed. + + * modules/pam_access/Makefile.am (EXTRA_DIST): Remove + $(secureconf_DATA). + * modules/pam_env/Makefile.am: Likewise. + * modules/pam_group/Makefile.am: Likewise. + * modules/pam_limits/Makefile.am: Likewise. + * modules/pam_namespace/Makefile.am: Likewise. + * modules/pam_sepermit/Makefile.am: Likewise. + * modules/pam_time/Makefile.am: Likewise. + +2020-04-27 Dmitry V. Levin <ldv@altlinux.org> + + modules/*/Makefile.am: replace README with $(DATA) in EXTRA_DIST. + Since the GNU Automake distributes README files by default, the only + reason why README had to be listed in EXTRA_DIST was to make these + README files generated. + + Since README is also listed in noinst_DATA, we can safely replace + README in EXTRA_DIST with $(DATA), this also opens the way for + further EXTRA_DIST cleanup. + + * modules/*/Makefile.am (EXTRA_DIST): Replace README with $(DATA). + +2020-04-27 Dmitry V. Levin <ldv@altlinux.org> + + modules/*/Makefile.am: reorder lines to promote uniformity. + This is essentially a no-op change that makes modules/*/Makefile.am + files less divergent. + +2020-04-27 Dmitry V. Levin <ldv@altlinux.org> + + build: move README prerequisites rule from modules/*/Makefile.am to Make.xml.rules + As the rule is now the same in every modules/*/Makefile.am file, + move it to Make.xml.rules. + + * Make.xml.rules (README): New prerequisites rule. + * modules/pam_access/Makefile.am (README): Remove rule. + * modules/pam_cracklib/Makefile.am (README): Likewise. + * modules/pam_debug/Makefile.am (README): Likewise. + * modules/pam_deny/Makefile.am (README): Likewise. + * modules/pam_echo/Makefile.am (README): Likewise. + * modules/pam_env/Makefile.am (README): Likewise. + * modules/pam_exec/Makefile.am (README): Likewise. + * modules/pam_faildelay/Makefile.am (README): Likewise. + * modules/pam_filter/Makefile.am (README): Likewise. + * modules/pam_ftp/Makefile.am (README): Likewise. + * modules/pam_group/Makefile.am (README): Likewise. + * modules/pam_issue/Makefile.am (README): Likewise. + * modules/pam_keyinit/Makefile.am (README): Likewise. + * modules/pam_lastlog/Makefile.am (README): Likewise. + * modules/pam_limits/Makefile.am (README): Likewise. + * modules/pam_listfile/Makefile.am (README): Likewise. + * modules/pam_localuser/Makefile.am (README): Likewise. + * modules/pam_loginuid/Makefile.am (README): Likewise. + * modules/pam_mail/Makefile.am (README): Likewise. + * modules/pam_mkhomedir/Makefile.am (README): Likewise. + * modules/pam_motd/Makefile.am (README): Likewise. + * modules/pam_namespace/Makefile.am (README): Likewise. + * modules/pam_nologin/Makefile.am (README): Likewise. + * modules/pam_permit/Makefile.am (README): Likewise. + * modules/pam_pwhistory/Makefile.am (README): Likewise. + * modules/pam_rhosts/Makefile.am (README): Likewise. + * modules/pam_rootok/Makefile.am (README): Likewise. + * modules/pam_securetty/Makefile.am (README): Likewise. + * modules/pam_selinux/Makefile.am (README): Likewise. + * modules/pam_sepermit/Makefile.am (README): Likewise. + * modules/pam_setquota/Makefile.am (README): Likewise. + * modules/pam_shells/Makefile.am (README): Likewise. + * modules/pam_succeed_if/Makefile.am (README): Likewise. + * modules/pam_tally/Makefile.am (README): Likewise. + * modules/pam_tally2/Makefile.am (README): Likewise. + * modules/pam_time/Makefile.am (README): Likewise. + * modules/pam_timestamp/Makefile.am (README): Likewise. + * modules/pam_tty_audit/Makefile.am (README): Likewise. + * modules/pam_umask/Makefile.am (README): Likewise. + * modules/pam_unix/Makefile.am (README): Likewise. + * modules/pam_userdb/Makefile.am (README): Likewise. + * modules/pam_usertype/Makefile.am (README): Likewise. + * modules/pam_warn/Makefile.am (README): Likewise. + * modules/pam_wheel/Makefile.am (README): Likewise. + * modules/pam_xauth/Makefile.am (README): Likewise. + +2020-04-27 Dmitry V. Levin <ldv@altlinux.org> + + modules/*/Makefile.am: list prerequisites of README target uniformly. + There is no need to list prerequisites of README targets manually as + all README targets depend on $(XMLS). + + The change is performed automatically using the following script: + sed -i 's/^README: pam_.*/README: $(XMLS)/' modules/*/Makefile.am + + * modules/pam_access/Makefile.am (README): Replace pam_access.8.xml + and access.conf.5.xml with $(XMLS). + * modules/pam_cracklib/Makefile.am (README): Replace pam_cracklib.8.xml + with $(XMLS). + * modules/pam_debug/Makefile.am (README): Replace pam_debug.8.xml + with $(XMLS). + * modules/pam_deny/Makefile.am (README): Replace pam_deny.8.xml + with $(XMLS). + * modules/pam_echo/Makefile.am (README): Replace pam_echo.8.xml + with $(XMLS). + * modules/pam_env/Makefile.am (README): Replace pam_env.8.xml and + pam_env.conf.5.xml with $(XMLS). + * modules/pam_exec/Makefile.am (README): Replace pam_exec.8.xml + with $(XMLS). + * modules/pam_faildelay/Makefile.am (README): Replace + pam_faildelay.8.xml with $(XMLS). + * modules/pam_filter/Makefile.am (README): Replace pam_filter.8.xml + with $(XMLS). + * modules/pam_ftp/Makefile.am (README): Replace pam_ftp.8.xml with + $(XMLS). + * modules/pam_group/Makefile.am (README): Replace pam_group.8.xml + and group.conf.5.xml with $(XMLS). + * modules/pam_issue/Makefile.am (README): Replace pam_issue.8.xml + with $(XMLS). + * modules/pam_keyinit/Makefile.am (README): Replace pam_keyinit.8.xml + with $(XMLS). + * modules/pam_lastlog/Makefile.am (README): Replace pam_lastlog.8.xml + with $(XMLS). + * modules/pam_limits/Makefile.am (README): Replace pam_limits.8.xml + and limits.conf.5.xml with $(XMLS). + * modules/pam_listfile/Makefile.am (README): Replace pam_listfile.8.xml + with $(XMLS). + * modules/pam_localuser/Makefile.am (README): Replace + pam_localuser.8.xml with $(XMLS). + * modules/pam_loginuid/Makefile.am (README): Replace pam_loginuid.8.xml + with $(XMLS). + * modules/pam_mail/Makefile.am (README): Replace pam_mail.8.xml + with $(XMLS). + * modules/pam_mkhomedir/Makefile.am (README): Replace + pam_mkhomedir.8.xml with $(XMLS). + * modules/pam_motd/Makefile.am (README): Replace pam_motd.8.xml + with $(XMLS). + * modules/pam_namespace/Makefile.am (README): Replace + pam_namespace.8.xml, namespace.conf.5.xml, + and pam_namespace_helper.8.xml with $(XMLS). + * modules/pam_nologin/Makefile.am (README): Replace pam_nologin.8.xml + with $(XMLS). + * modules/pam_permit/Makefile.am (README): Replace pam_permit.8.xml + with $(XMLS). + * modules/pam_pwhistory/Makefile.am (README): Replace + pam_pwhistory.8.xml with $(XMLS). + * modules/pam_rhosts/Makefile.am (README): Replace pam_rhosts.8.xml + with $(XMLS). + * modules/pam_rootok/Makefile.am (README): Replace pam_rootok.8.xml + with $(XMLS). + * modules/pam_securetty/Makefile.am (README): Replace + pam_securetty.8.xml with $(XMLS). + * modules/pam_selinux/Makefile.am (README): Replace pam_selinux.8.xml + with $(XMLS). + * modules/pam_sepermit/Makefile.am (README): Replace pam_sepermit.8.xml + with $(XMLS). + * modules/pam_setquota/Makefile.am (README): Replace pam_setquota.8.xml + with $(XMLS). + * modules/pam_shells/Makefile.am (README): Replace pam_shells.8.xml + with $(XMLS). + * modules/pam_succeed_if/Makefile.am (README): Replace + pam_succeed_if.8.xml with $(XMLS). + * modules/pam_tally/Makefile.am (README): Replace pam_tally.8.xml + with $(XMLS). + * modules/pam_tally2/Makefile.am (README): Replace pam_tally2.8.xml + with $(XMLS). + * modules/pam_time/Makefile.am (README): Replace pam_time.8.xml and + time.conf.5.xml with $(XMLS). + * modules/pam_timestamp/Makefile.am (README): Replace + pam_timestamp.8.xml with $(XMLS). + * modules/pam_tty_audit/Makefile.am (README): Replace + pam_tty_audit.8.xml with $(XMLS). + * modules/pam_umask/Makefile.am (README): Replace pam_umask.8.xml + with $(XMLS). + * modules/pam_unix/Makefile.am (README): Replace pam_unix.8.xml + with $(XMLS). + * modules/pam_userdb/Makefile.am (README): Replace pam_userdb.8.xml + with $(XMLS). + * modules/pam_usertype/Makefile.am (README): Replace pam_usertype.8.xml + with $(XMLS). + * modules/pam_warn/Makefile.am (README): Replace pam_warn.8.xml + with $(XMLS). + * modules/pam_wheel/Makefile.am (README): Replace pam_wheel.8.xml + with $(XMLS). + * modules/pam_xauth/Makefile.am (README): Replace pam_xauth.8.xml + with $(XMLS). + +2020-04-27 Dmitry V. Levin <ldv@altlinux.org> + + modules/*/Makefile.am: list secureconf_DATA files in EXTRA_DIST uniformly + The change was prepared using the following script: + git grep -l secureconf_DATA modules/*/Makefile.am |while read m; do + t="$(sed '/^secureconf_DATA = /!d;s///;q' -- "$m")" + sed -i "/^EXTRA_DIST =/ s/\\<$t\\>/\$(secureconf_DATA)/" -- "$m" + done + + * modules/pam_access/Makefile.am (EXTRA_DIST): Replace access.conf with + $(secureconf_DATA). + * modules/pam_env/Makefile.am (EXTRA_DIST): Replace pam_env.conf with + $(secureconf_DATA). + * modules/pam_group/Makefile.am (EXTRA_DIST): Replace group.conf with + $(secureconf_DATA). + * modules/pam_limits/Makefile.am (EXTRA_DIST): Replace limits.conf with + $(secureconf_DATA). + * modules/pam_namespace/Makefile.am (EXTRA_DIST): Replace namespace.conf + with $(secureconf_DATA). + * modules/pam_sepermit/Makefile.am (EXTRA_DIST): Replace sepermit.conf + with $(secureconf_DATA). + * modules/pam_time/Makefile.am (EXTRA_DIST): Replace time.conf with + $(secureconf_DATA). + +2020-04-27 Dmitry V. Levin <ldv@altlinux.org> + + modules/*/Makefile.am: list manual pages in EXTRA_DIST uniformly. + List in EXTRA_DIST those manual pages that are listed in man_MANS + as $(MANS). + + * modules/pam_cracklib/Makefile.am (EXTRA_DIST): Replace pam_cracklib.8 + with $(MANS). + * modules/pam_keyinit/Makefile.am (EXTRA_DIST): Replace pam_keyinit.8 + with $(MANS). + * modules/pam_selinux/Makefile.am (EXTRA_DIST): Replace pam_selinux.8 + with $(MANS). + * modules/pam_sepermit/Makefile.am (EXTRA_DIST): Replace pam_sepermit.8 + and sepermit.conf.5 with $(MANS). + * modules/pam_tty_audit/Makefile.am (EXTRA_DIST): Replace + pam_tty_audit.8 with $(MANS). + * modules/pam_userdb/Makefile.am (EXTRA_DIST): Replace pam_userdb.8 with + $(MANS). + +2020-04-27 Dmitry V. Levin <ldv@altlinux.org> + + modules/*/Makefile.am: list tests in EXTRA_DIST uniformly. + The change was prepared using the following script: + git grep -l '^TESTS = tst-pam_' modules/ |while read m; do + t="$(sed '/^TESTS = tst-pam_/!d;s/^TESTS = //;q' -- "$m")" + sed -i "/^EXTRA_DIST =/ s/$t\\>/\$(TESTS)/" -- "$m" + done + + * modules/pam_access/Makefile.am (EXTRA_DIST): Replace tst-pam_access + with $(TESTS). + * modules/pam_cracklib/Makefile.am (EXTRA_DIST): Replace + tst-pam_cracklib with $(TESTS). + * modules/pam_debug/Makefile.am (EXTRA_DIST): Replace tst-pam_debug with + $(TESTS). + * modules/pam_deny/Makefile.am (EXTRA_DIST): Replace tst-pam_deny with + $(TESTS). + * modules/pam_echo/Makefile.am (EXTRA_DIST): Replace tst-pam_echo with + $(TESTS). + * modules/pam_env/Makefile.am (EXTRA_DIST): Replace tst-pam_env with + $(TESTS). + * modules/pam_exec/Makefile.am (EXTRA_DIST): Replace tst-pam_exec with + $(TESTS). + * modules/pam_faildelay/Makefile.am (EXTRA_DIST): Replace + tst-pam_faildelay with $(TESTS). + * modules/pam_filter/Makefile.am (EXTRA_DIST): Replace tst-pam_filter + with $(TESTS). + * modules/pam_ftp/Makefile.am (EXTRA_DIST): Replace tst-pam_ftp with + $(TESTS). + * modules/pam_group/Makefile.am (EXTRA_DIST): Replace tst-pam_group with + $(TESTS). + * modules/pam_issue/Makefile.am (EXTRA_DIST): Replace tst-pam_issue with + $(TESTS). + * modules/pam_keyinit/Makefile.am (EXTRA_DIST): Replace tst-pam_keyinit + with $(TESTS). + * modules/pam_lastlog/Makefile.am (EXTRA_DIST): Replace tst-pam_lastlog + with $(TESTS). + * modules/pam_limits/Makefile.am (EXTRA_DIST): Replace tst-pam_limits + with $(TESTS). + * modules/pam_listfile/Makefile.am (EXTRA_DIST): Replace + tst-pam_listfile with $(TESTS). + * modules/pam_localuser/Makefile.am (EXTRA_DIST): Replace + tst-pam_localuser with $(TESTS). + * modules/pam_loginuid/Makefile.am (EXTRA_DIST): Replace + tst-pam_loginuid with $(TESTS). + * modules/pam_mail/Makefile.am (EXTRA_DIST): Replace tst-pam_mail with + $(TESTS). + * modules/pam_mkhomedir/Makefile.am (EXTRA_DIST): Replace + tst-pam_mkhomedir with $(TESTS). + * modules/pam_motd/Makefile.am (EXTRA_DIST): Replace tst-pam_motd with + $(TESTS). + * modules/pam_namespace/Makefile.am (EXTRA_DIST): Replace + tst-pam_namespace with $(TESTS). + * modules/pam_nologin/Makefile.am (EXTRA_DIST): Replace tst-pam_nologin + with $(TESTS). + * modules/pam_permit/Makefile.am (EXTRA_DIST): Replace tst-pam_permit + with $(TESTS). + * modules/pam_pwhistory/Makefile.am (EXTRA_DIST): Replace + tst-pam_pwhistory with $(TESTS). + * modules/pam_rhosts/Makefile.am (EXTRA_DIST): Replace tst-pam_rhosts + with $(TESTS). + * modules/pam_rootok/Makefile.am (EXTRA_DIST): Replace tst-pam_rootok + with $(TESTS). + * modules/pam_securetty/Makefile.am (EXTRA_DIST): Replace + tst-pam_securetty with $(TESTS). + * modules/pam_sepermit/Makefile.am (EXTRA_DIST): Replace + tst-pam_sepermit with $(TESTS). + * modules/pam_setquota/Makefile.am (EXTRA_DIST): Replace + tst-pam_setquota with $(TESTS). + * modules/pam_shells/Makefile.am (EXTRA_DIST): Replace tst-pam_shells + with $(TESTS). + * modules/pam_stress/Makefile.am (EXTRA_DIST): Replace tst-pam_stress + with $(TESTS). + * modules/pam_succeed_if/Makefile.am (EXTRA_DIST): Replace + tst-pam_succeed_if with $(TESTS). + * modules/pam_tally/Makefile.am (EXTRA_DIST): Replace tst-pam_tally with + $(TESTS). + * modules/pam_tally2/Makefile.am (EXTRA_DIST): Replace tst-pam_tally2 + with $(TESTS). + * modules/pam_time/Makefile.am (EXTRA_DIST): Replace tst-pam_time with + $(TESTS). + * modules/pam_tty_audit/Makefile.am (EXTRA_DIST): Replace + tst-pam_tty_audit with $(TESTS). + * modules/pam_umask/Makefile.am (EXTRA_DIST): Replace tst-pam_umask with + $(TESTS). + * modules/pam_userdb/Makefile.am (EXTRA_DIST): Replace tst-pam_userdb + with $(TESTS). + * modules/pam_usertype/Makefile.am (EXTRA_DIST): Replace + tst-pam_usertype with $(TESTS). + * modules/pam_warn/Makefile.am (EXTRA_DIST): Replace tst-pam_warn with + $(TESTS). + * modules/pam_wheel/Makefile.am (EXTRA_DIST): Replace tst-pam_wheel with + $(TESTS). + * modules/pam_xauth/Makefile.am (EXTRA_DIST): Replace tst-pam_xauth with + $(TESTS). + +2020-04-27 Dmitry V. Levin <ldv@altlinux.org> + + pam_namespace: simplify distribution of manual pages. + * modules/pam_namespace/Makefile.am: Merge MAN5 and MAN8 into man_MANS. + +2020-04-27 Dmitry V. Levin <ldv@altlinux.org> + + modules/*/Makefile.am: remove manual pages from noinst_DATA. + Manual pages already belong to man_MANS, listing them also + in noinst_DATA does not help in any way. + + * modules/pam_cracklib/Makefile.am (noinst_DATA): Remove pam_cracklib.8. + * modules/pam_selinux/Makefile.am (noinst_DATA): Remove pam_selinux.8. + * modules/pam_sepermit/Makefile.am (noinst_DATA): Remove pam_sepermit.8 + and sepermit.conf.5. + * modules/pam_userdb/Makefile.am (noinst_DATA): Remove pam_userdb.8. + +2020-04-27 Dmitry V. Levin <ldv@altlinux.org> + + configure: fix dlopen check. + * configure.ac: Check for the library providing dlopen using + AC_SEARCH_LIBS instead of AC_CHECK_LIB to handle the case when + dlopen is a part of libc. + + configure: add --disable-tally and --disable-tally2 options. + * configure.ac (AC_ARG_ENABLE): Add tally and tally2. + (AM_CONDITIONAL): Add COND_BUILD_PAM_TALLY and COND_BUILD_PAM_TALLY2. + * modules/Makefile.am [COND_BUILD_PAM_TALLY] (MAYBE_PAM_TALLY): Define. + [COND_BUILD_PAM_TALLY2] (MAYBE_PAM_TALLY2): Likewise. + (SUBDIRS): Replace pam_tally with $(COND_BUILD_PAM_TALLY), pam_tally2 + with $(COND_BUILD_PAM_TALLY2). + +2020-04-26 Dmitry V. Levin <ldv@altlinux.org> + + build: move pam_selinux and pam_sepermit build conditions to modules/Makefile.am + * configure.ac (AM_CONDITIONAL): Replace HAVE_LIBSELINUX with + COND_BUILD_PAM_SELINUX and COND_BUILD_PAM_SEPERMIT. + * modules/Makefile.am [COND_BUILD_PAM_SELINUX] (MAYBE_PAM_SELINUX): + Define. + [COND_BUILD_PAM_SEPERMIT] (MAYBE_PAM_SEPERMIT): Likewise. + (SUBDIRS): Replace pam_selinux with $(MAYBE_PAM_SELINUX), + pam_sepermit with MAYBE_PAM_SEPERMIT. + * modules/pam_selinux/Makefile.am: Assume HAVE_LIBSELINUX. + * modules/pam_sepermit/Makefile.am: Likewise. + + build: simplify the check for unshare function. + * configure.ac (AC_CHECK_FUNCS): Do not set UNSHARE when checking for + unshare function. + (COND_BUILD_PAM_NAMESPACE): Check for $ac_cv_func_unshare instead of + $UNSHARE. + + build: move pam_namespace build condition to modules/Makefile.am. + * configure.ac (AM_CONDITIONAL): Replace HAVE_UNSHARE with + COND_BUILD_PAM_NAMESPACE. + * modules/Makefile.am [COND_BUILD_PAM_NAMESPACE] (MAYBE_PAM_NAMESPACE): + Define. + (SUBDIRS): Replace pam_namespace with $(MAYBE_PAM_NAMESPACE). + * modules/pam_namespace/Makefile.am: Assume HAVE_UNSHARE. + + build: move pam_userdb build condition to modules/Makefile.am. + * configure.ac (AM_CONDITIONAL): Replace HAVE_LIBDB with + COND_BUILD_PAM_USERDB. + * modules/Makefile.am [COND_BUILD_PAM_USERDB] (MAYBE_PAM_USERDB): + Define. + (SUBDIRS): Replace pam_userdb with $(MAYBE_PAM_USERDB). + * modules/pam_userdb/Makefile.am: Assume HAVE_LIBDB. + + build: remove unused HAVE_LIBCRACK. + * configure.ac (AC_DEFINE): Remove unused HAVE_LIBCRACK. + + build: move pam_cracklib build condition to modules/Makefile.am. + * configure.ac (AM_CONDITIONAL): Replace HAVE_LIBCRACK with + COND_BUILD_PAM_CRACKLIB. + * modules/Makefile.am [COND_BUILD_PAM_CRACKLIB] (MAYBE_PAM_CRACKLIB): + Define. + (SUBDIRS): Replace pam_cracklib with $(MAYBE_PAM_CRACKLIB). + * modules/pam_cracklib/Makefile.am: Assume HAVE_LIBCRACK. + + build: remove unused HAVE_KEY_MANAGEMENT. + * configure.ac (AC_DEFINE, AC_SUBST): Remove unused HAVE_KEY_MANAGEMENT. + (AC_CHECK_DECL): Remove unused ENOKEY. + + build: move pam_keyinit build condition to modules/Makefile.am. + * configure.ac (AM_CONDITIONAL): Replace HAVE_KEY_MANAGEMENT with + COND_BUILD_PAM_KEYINIT. + * modules/Makefile.am [COND_BUILD_PAM_KEYINIT] (MAYBE_PAM_KEYINIT): + Define. + (SUBDIRS): Replace pam_keyinit with $(MAYBE_PAM_KEYINIT). + * modules/pam_keyinit/Makefile.am: Assume HAVE_KEY_MANAGEMENT. + + build: remove unused AC_DEFINE([HAVE_AUDIT_TTY_STATUS]) + * configure.ac (AC_DEFINE): Remove unused HAVE_AUDIT_TTY_STATUS. + + build: move pam_tty_audit build condition to modules/Makefile.am. + * configure.ac (AM_CONDITIONAL): Replace HAVE_AUDIT_TTY_STATUS with + COND_BUILD_PAM_TTY_AUDIT. + * modules/Makefile.am [COND_BUILD_PAM_TTY_AUDIT] (MAYBE_PAM_TTY_AUDIT): + Define. + (SUBDIRS): Replace pam_tty_audit with $(MAYBE_PAM_TTY_AUDIT). + * modules/pam_tty_audit/Makefile.am: Assume HAVE_AUDIT_TTY_STATUS. + + configure.ac: sort COND_BUILD_* conditionals. + ... and move them closer to the end of configure.ac. + +2020-04-26 Dmitry V. Levin <ldv@altlinux.org> + + modules/Makefile.am: sort SUBDIRS. + Also list one element of SUBDIRS per line for the ease of maintenance. + + * modules/Makefile.am (SUBDIRS): List one per line, sort. + +2020-04-26 Dmitry V. Levin <ldv@altlinux.org> + + ci: add gcc-10 jobs. + * .github/workflows/ci.yml (gcc10-x86_64, gcc10-x86, gcc10-x32): + New jobs. + * .travis.yml (matrix): Add gcc-10 jobs on x86_64, x86, x32, + and ppc64le. + +2020-04-26 Dmitry V. Levin <ldv@altlinux.org> + + pam_issue: fix potential read out of bounds. + Reported by gcc-10 -Warray-bounds: + + In file included from /usr/include/string.h:494, + from modules/pam_issue/pam_issue.c:19: + In function 'strncat', + inlined from 'read_issue_quoted' at modules/pam_issue/pam_issue.c:197:3: + /usr/include/x86_64-linux-gnu/bits/string_fortified.h:136:10: error: '__builtin___strncat_chk' offset [260, 389] from the object at 'uts' is out of the bounds of referenced subobject 'version' with type 'char[65]' at offset 195 [-Werror=array-bounds] + 136 | return __builtin___strncat_chk (__dest, __src, __len, __bos (__dest)); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + In file included from modules/pam_issue/pam_issue.c:26: + modules/pam_issue/pam_issue.c: In function 'read_issue_quoted': + /usr/include/x86_64-linux-gnu/sys/utsname.h:59:10: note: subobject 'version' declared here + 59 | char version[_UTSNAME_VERSION_LENGTH]; + | ^~~~~~~ + In file included from /usr/include/string.h:494, + from modules/pam_issue/pam_issue.c:19: + In function 'strncat', + inlined from 'read_issue_quoted' at modules/pam_issue/pam_issue.c:188:3: + /usr/include/x86_64-linux-gnu/bits/string_fortified.h:136:10: error: '__builtin___strncat_chk' offset [65, 389] from the object at 'uts' is out of the bounds of referenced subobject 'sysname' with type 'char[65]' at offset 0 [-Werror=array-bounds] + 136 | return __builtin___strncat_chk (__dest, __src, __len, __bos (__dest)); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + In file included from modules/pam_issue/pam_issue.c:26: + modules/pam_issue/pam_issue.c: In function 'read_issue_quoted': + /usr/include/x86_64-linux-gnu/sys/utsname.h:51:10: note: subobject 'sysname' declared here + 51 | char sysname[_UTSNAME_SYSNAME_LENGTH]; + | ^~~~~~~ + In file included from /usr/include/string.h:494, + from modules/pam_issue/pam_issue.c:19: + In function 'strncat', + inlined from 'read_issue_quoted' at modules/pam_issue/pam_issue.c:194:3: + /usr/include/x86_64-linux-gnu/bits/string_fortified.h:136:10: error: '__builtin___strncat_chk' offset [195, 389] from the object at 'uts' is out of the bounds of referenced subobject 'release' with type 'char[65]' at offset 130 [-Werror=array-bounds] + 136 | return __builtin___strncat_chk (__dest, __src, __len, __bos (__dest)); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + In file included from modules/pam_issue/pam_issue.c:26: + modules/pam_issue/pam_issue.c: In function 'read_issue_quoted': + /usr/include/x86_64-linux-gnu/sys/utsname.h:57:10: note: subobject 'release' declared here + 57 | char release[_UTSNAME_RELEASE_LENGTH]; + | ^~~~~~~ + In file included from /usr/include/string.h:494, + from modules/pam_issue/pam_issue.c:19: + In function 'strncat', + inlined from 'read_issue_quoted' at modules/pam_issue/pam_issue.c:191:3: + /usr/include/x86_64-linux-gnu/bits/string_fortified.h:136:10: error: '__builtin___strncat_chk' offset [130, 389] from the object at 'uts' is out of the bounds of referenced subobject 'nodename' with type 'char[65]' at offset 65 [-Werror=array-bounds] + 136 | return __builtin___strncat_chk (__dest, __src, __len, __bos (__dest)); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + In file included from modules/pam_issue/pam_issue.c:26: + modules/pam_issue/pam_issue.c: In function 'read_issue_quoted': + /usr/include/x86_64-linux-gnu/sys/utsname.h:54:10: note: subobject 'nodename' declared here + 54 | char nodename[_UTSNAME_NODENAME_LENGTH]; + | ^~~~~~~~ + In file included from /usr/include/string.h:494, + from modules/pam_issue/pam_issue.c:19: + In function 'strncat', + inlined from 'read_issue_quoted' at modules/pam_issue/pam_issue.c:200:3: + /usr/include/x86_64-linux-gnu/bits/string_fortified.h:136:10: error: '__builtin___strncat_chk' offset [325, 389] from the object at 'uts' is out of the bounds of referenced subobject 'machine' with type 'char[65]' at offset 260 [-Werror=array-bounds] + 136 | return __builtin___strncat_chk (__dest, __src, __len, __bos (__dest)); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + In file included from modules/pam_issue/pam_issue.c:26: + modules/pam_issue/pam_issue.c: In function 'read_issue_quoted': + /usr/include/x86_64-linux-gnu/sys/utsname.h:62:10: note: subobject 'machine' declared here + 62 | char machine[_UTSNAME_MACHINE_LENGTH]; + | ^~~~~~~ + + * modules/pam_issue/pam_issue.c (read_issue_quoted): Rewrite to avoid + strncat from potentially not null-terminated string buffer fields + of struct utsname. + +2020-04-26 Dmitry V. Levin <ldv@altlinux.org> + + pam_motd: fix NULL dereference when at least one of motd directories is not available + * modules/pam_motd/pam_motd.c + (try_to_display_directories_with_overrides): Do not assign -1U to + dirscans_sizes[i] when scandir(motd_dir_path_split[i]) returns an error. + + Resolves: https://bugzilla.altlinux.org/38389 + Fixes: d57ab221 ("pam_motd: Cleanup the code and avoid unnecessary logging") + +2020-04-26 Dmitry V. Levin <ldv@altlinux.org> + + pam_motd: cleanup calloc invocations. + Apply the following calloc invocation idiom: + ptr = calloc(nmemb, sizeof(*ptr)); + + * modules/pam_motd/pam_motd.c (pam_split_string, + try_to_display_directories_with_overrides): Cleanup calloc invocations. + + Fixes: f9c9c721 ("pam_motd: Support multiple motd paths specified, with filename overrides (#69)") + +2020-04-26 Dmitry V. Levin <ldv@altlinux.org> + + pam_motd: fix NULL dereference on error path. + * modules/pam_motd/pam_motd.c + (try_to_display_directories_with_overrides): Do not access + elements of dirscans_sizes array if dirscans_sizes == NULL + due to an earlier memory allocation error. + + Fixes: f9c9c721 ("pam_motd: Support multiple motd paths specified, with filename overrides (#69)") + +2020-04-26 Dmitry V. Levin <ldv@altlinux.org> + + pam_motd: remove redundant return statement. + * modules/pam_motd/pam_motd.c + (try_to_display_directories_with_overrides): Remove return statement + at the end of the function returning void. + + Fixes: f9c9c721 ("pam_motd: Support multiple motd paths specified, with filename overrides (#69)") + +2020-04-26 Dmitry V. Levin <ldv@altlinux.org> + + pam_motd: remove redundant prefix from syslog messages. + pam_syslog already does all the prefixing we need. + + * modules/pam_motd/pam_motd.c (pam_split_string, + try_to_display_directories_with_overrides): Remove "pam_motd: " prefix + from strings passed to pam_syslog. + + Fixes: f9c9c721 ("pam_motd: Support multiple motd paths specified, with filename overrides (#69)") + +2020-04-26 Dmitry V. Levin <ldv@altlinux.org> + + pam_motd: fix memory leak. + pam_motd used to leak memory allocated for each motd file + successfully opened in try_to_display_directories_with_overrides. + + * modules/pam_motd/pam_motd.c + (try_to_display_directories_with_overrides): Free abs_path. + + Fixes: f9c9c721 ("pam_motd: Support multiple motd paths specified, with filename overrides (#69)") + +2020-04-26 Dmitry V. Levin <ldv@altlinux.org> + + pam_motd: fix misleading error diagnostics. + Do not invoke calloc with the first argument equal to zero as the return + value can be NULL which is undistinguishable from memory allocation + error. + + * modules/pam_motd/pam_motd.c + (try_to_display_directories_with_overrides): Skip if there are no + directory entries (dirscans_size_total == 0). + + Fixes: f9c9c721 ("pam_motd: Support multiple motd paths specified, with filename overrides (#69)") + +2020-04-26 Dmitry V. Levin <ldv@altlinux.org> + + pam_motd: do not zero the memory allocated by calloc. + As dirnames_all is allocated with calloc, zeroing it out is pointless. + + * modules/pam_motd/pam_motd.c + (try_to_display_directories_with_overrides): Remove redundant zeroing + of dirnames_all. + + Fixes: f9c9c721 ("pam_motd: Support multiple motd paths specified, with filename overrides (#69)") + +2020-04-26 Dmitry V. Levin <ldv@altlinux.org> + + build: cleanup: do not add -DWITH_SELINUX to CFLAGS. + As WITH_SELINUX is already AC_DEFINE'd in configure.ac, + there is no point in adding -DWITH_SELINUX to CFLAGS. + + * libpam/Makefile.am [HAVE_LIBSELINUX] (AM_CFLAGS): Do not add + -DWITH_SELINUX. + * modules/pam_rootok/Makefile.am: Likewise. + * modules/pam_unix/Makefile.am: Likewise. + +2020-04-26 Dmitry V. Levin <ldv@altlinux.org> + + build: cleanup: replace "test ! -z" with "test -n" + * configure.ac: replace "test ! -z" with "test -n". + +2020-04-24 Dmitry V. Levin <ldv@altlinux.org> + + pam_filter: fix potential off-by-one heap buffer overflow. + Reported by gcc-10 -Wstringop-overflow: + + In file included from /usr/include/string.h:494, + from modules/pam_filter/pam_filter.c:14: + In function 'strcpy', + inlined from 'process_args' at modules/pam_filter/pam_filter.c:137:2, + inlined from 'need_a_filter.isra' at modules/pam_filter/pam_filter.c:618:12: + /usr/include/x86_64-linux-gnu/bits/string_fortified.h:90:10: warning: '__builtin_memcpy' writing 6 bytes into a region of size 5 [-Wstringop-overflow=] + 90 | return __builtin___strcpy_chk (__dest, __src, __bos (__dest)); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + modules/pam_filter/pam_filter.c: In function 'need_a_filter.isra': + modules/pam_filter/pam_filter.c:128:21: note: at offset 0 to an object with size 5 allocated by 'malloc' here + 128 | levp[0] = (char *) malloc(size); + | ^~~~~~~~~~~~ + + * modules/pam_filter/pam_filter.c (process_args): Fix off-by-one heap + buffer overflow in case of a filter without arguments (argc == 0). + +2020-04-24 Dmitry V. Levin <ldv@altlinux.org> + + pam_setquota: remove PAM_EXTERN and PAM_STATIC parts. + In other modules they were removed by commit Linux-PAM-1.3.0~14. + + * modules/pam_setquota/pam_setquota.c: Remove PAM_EXTERN and PAM_STATIC + parts. + +2020-04-24 Dmitry V. Levin <ldv@altlinux.org> + + pam_setquota: fix more harmless compilation warnings. + On ppc64le the compiler complains with the following diagnostics: + + pam_setquota.c: In function 'debug': + pam_setquota.c:48:59: warning: format '%llu' expects argument of type 'long long unsigned int', but argument 6 has type '__u64' {aka 'const long unsigned int'} [-Wformat=] + 48 | pam_syslog(pamh, LOG_DEBUG, "%s device=%s bsoftlimit=%llu bhardlimit=%llu " + | ~~~^ + | | + | long long unsigned int + | %lu + ...... + 51 | p->dqb_bsoftlimit, p->dqb_bhardlimit, + | ~~~~~~~~~~~~~~~~~ + | | + | __u64 {aka const long unsigned int} + pam_setquota.c:48:75: warning: format '%llu' expects argument of type 'long long unsigned int', but argument 7 has type '__u64' {aka 'const long unsigned int'} [-Wformat=] + 48 | pam_syslog(pamh, LOG_DEBUG, "%s device=%s bsoftlimit=%llu bhardlimit=%llu " + | ~~~^ + | | + | long long unsigned int + | %lu + ...... + 51 | p->dqb_bsoftlimit, p->dqb_bhardlimit, + | ~~~~~~~~~~~~~~~~~ + | | + | __u64 {aka const long unsigned int} + pam_setquota.c:48:31: warning: format '%llu' expects argument of type 'long long unsigned int', but argument 8 has type '__u64' {aka 'const long unsigned int'} [-Wformat=] + 48 | pam_syslog(pamh, LOG_DEBUG, "%s device=%s bsoftlimit=%llu bhardlimit=%llu " + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + ...... + 52 | p->dqb_isoftlimit, p->dqb_ihardlimit, + | ~~~~~~~~~~~~~~~~~ + | | + | __u64 {aka const long unsigned int} + pam_setquota.c:49:46: note: format string is defined here + 49 | "isoftlimit=%llu ihardlimit=%llu btime=%llu itime=%llu", + | ~~~^ + | | + | long long unsigned int + | %lu + pam_setquota.c:48:31: warning: format '%llu' expects argument of type 'long long unsigned int', but argument 9 has type '__u64' {aka 'const long unsigned int'} [-Wformat=] + 48 | pam_syslog(pamh, LOG_DEBUG, "%s device=%s bsoftlimit=%llu bhardlimit=%llu " + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + ...... + 52 | p->dqb_isoftlimit, p->dqb_ihardlimit, + | ~~~~~~~~~~~~~~~~~ + | | + | __u64 {aka const long unsigned int} + pam_setquota.c:49:62: note: format string is defined here + 49 | "isoftlimit=%llu ihardlimit=%llu btime=%llu itime=%llu", + | ~~~^ + | | + | long long unsigned int + | %lu + pam_setquota.c:48:31: warning: format '%llu' expects argument of type 'long long unsigned int', but argument 10 has type '__u64' {aka 'const long unsigned int'} [-Wformat=] + 48 | pam_syslog(pamh, LOG_DEBUG, "%s device=%s bsoftlimit=%llu bhardlimit=%llu " + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + ...... + 53 | p->dqb_btime, p->dqb_itime); + | ~~~~~~~~~~~~ + | | + | __u64 {aka const long unsigned int} + pam_setquota.c:49:73: note: format string is defined here + 49 | "isoftlimit=%llu ihardlimit=%llu btime=%llu itime=%llu", + | ~~~^ + | | + | long long unsigned int + | %lu + pam_setquota.c:48:31: warning: format '%llu' expects argument of type 'long long unsigned int', but argument 11 has type '__u64' {aka 'const long unsigned int'} [-Wformat=] + 48 | pam_syslog(pamh, LOG_DEBUG, "%s device=%s bsoftlimit=%llu bhardlimit=%llu " + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + ...... + 53 | p->dqb_btime, p->dqb_itime); + | ~~~~~~~~~~~~ + | | + | __u64 {aka const long unsigned int} + pam_setquota.c:49:84: note: format string is defined here + 49 | "isoftlimit=%llu ihardlimit=%llu btime=%llu itime=%llu", + | ~~~^ + | | + | long long unsigned int + | %lu + + * modules/pam_setquota/pam_setquota.c (debug): Cast fields of type __u64 + to unsigned long long. + +2020-04-24 Dmitry V. Levin <ldv@altlinux.org> + + pam_timestamp: include "config.h" in hmacsha1.c as the first header. + This ensures "config.h" is included before any system header + which fixes the following bug reported by ALT diagnostics: + + verify-elf: ERROR: ./lib/security/pam_timestamp.so: uses non-LFS functions: __fxstat open + + * modules/pam_timestamp/hmacsha1.c: Include "config.h". + +2020-04-24 Dmitry V. Levin <ldv@altlinux.org> + + libpamc.h: include "config.h" as the first header. + This ensures "config.h" is included before any system header included by + libpamc.h, which fixes the following bug reported by ALT diagnostics: + + verify-elf: ERROR: ./lib/libpamc.so.0.82.1: uses non-LFS functions: __xstat readdir + + * libpamc/libpamc.h: Include "config.h". + +2020-04-24 Dmitry V. Levin <ldv@altlinux.org> + + pam_setquota: apply WARN_CFLAGS. + All other modules already build with WARN_CFLAGS. + + * modules/pam_setquota/Makefile.am (AM_CFLAGS): Add $(WARN_CFLAGS). + +2020-04-24 Dmitry V. Levin <ldv@altlinux.org> + + pam_setquota: fix harmless compilation warnings. + Fix -Wunused-variable compilation warnings: + + pam_setquota.c: In function 'pam_sm_open_session': + pam_setquota.c:173:9: warning: unused variable 'ep' [-Wunused-variable] + 173 | char *ep, *val, *mntdevice = NULL; + | ^~ + pam_setquota.c:172:17: warning: unused variable 'ul' [-Wunused-variable] + 172 | unsigned long ul; + | ^~ + + Fix -Wunused-parameter compilation warnings: + + pam_setquota.c: In function 'pam_sm_open_session': + pam_setquota.c:169:60: warning: unused parameter 'flags' [-Wunused-parameter] + 169 | PAM_EXTERN int pam_sm_open_session(pam_handle_t *pamh, int flags, int argc, + | ~~~~^~~~~ + pam_setquota.c: In function 'pam_sm_close_session': + pam_setquota.c:382:40: warning: unused parameter 'pamh' [-Wunused-parameter] + 382 | int pam_sm_close_session(pam_handle_t *pamh, int flags, int argc, + | ~~~~~~~~~~~~~~^~~~ + pam_setquota.c:382:50: warning: unused parameter 'flags' [-Wunused-parameter] + 382 | int pam_sm_close_session(pam_handle_t *pamh, int flags, int argc, + | ~~~~^~~~~ + pam_setquota.c:382:61: warning: unused parameter 'argc' [-Wunused-parameter] + 382 | int pam_sm_close_session(pam_handle_t *pamh, int flags, int argc, + | ~~~~^~~~ + pam_setquota.c:383:39: warning: unused parameter 'argv' [-Wunused-parameter] + 383 | const char **argv) { + | ~~~~~~~~~~~~~^~~~ + + * modules/pam_setquota/pam_setquota.c (pam_sm_open_session): Mark + 'flags' parameter as unused. Remove unused 'ep' and 'ul' variables. + (pam_sm_close_session): Mark all parameters as unused. + +2020-04-18 Oğuz Ersen <oguzersen@protonmail.com> + + Translated using Weblate (Turkish) + Currently translated at 100.0% (120 of 120 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/tr/ + Resolves: https://github.com/linux-pam/linux-pam/pull/214 + +2020-04-17 Sven Hartge <sven@svenhartge.de> + + pam_setquota: new module to set or modify disk quotas on session start. + This makes disk quotas usable with central user databases, such as MySQL or + LDAP. + + Resolves: https://github.com/linux-pam/linux-pam/issues/92 + +2020-04-15 Dmitry V. Levin <ldv@altlinux.org> + + pam_access, pam_issue: do not assume that getdomainname always exists. + * modules/pam_access/pam_access.c (netgroup_match): Place the code + that calls getdomainname under HAVE_GETDOMAINNAME guard. + * modules/pam_issue/pam_issue.c (read_issue_quoted): Likewise. + + Resolves: https://github.com/linux-pam/linux-pam/issues/43 + +2020-04-13 Oğuz Ersen <oguzersen@protonmail.com> + + Translated using Weblate (Turkish) + Currently translated at 100.0% (120 of 120 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/tr/ + +2020-04-13 Ankit Behera <proneon267@gmail.com> + + Translated using Weblate (Odia) + Currently translated at 100.0% (120 of 120 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/or/ + +2020-04-12 Topi Miettinen <toiwoton@gmail.com> + + pam_unix: modernize example in manual page. + According to crypt(5), md5 should not be used for new hashes. Let's + give a modern example with yescrypt. + +2020-04-10 Robert Antoni Buj Gelonch <robert.buj@gmail.com> + + Translated using Weblate (Catalan) + Currently translated at 100.0% (120 of 120 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/ca/ + Resolves: https://github.com/linux-pam/linux-pam/pull/207 + +2020-04-07 Dmitry V. Levin <ldv@altlinux.org> + + travis: remove faulty jobs. + * .travis.yml: Remove faulty gcc-9 jobs on aarch64 and s390x, + gcc-9 became uninstallable on these platforms several days ago + and hasn't been fixed yet. + +2020-04-07 Lucas Ramage <oxr463@gmx.us> + + pam_access: add an example of using groups in access.conf to permit access + Resolves: https://github.com/linux-pam/linux-pam/issues/65 + Resolves: https://github.com/linux-pam/linux-pam/pull/199 + +2020-04-07 Dmitry V. Levin <ldv@altlinux.org> + + github: add CI action. + Somewhat similar to Travis CI, this runs "make distcheck" on Ubuntu + 18.04 using gcc-9, gcc-8, gcc, clang-9, clang-8, and clang on x86_64, + x86, and x32 architectures. + + Compared with Travis CI, GitHub Actions service currently provides + a significantly better parallelism as well as (unsurprisingly) + better integration with github. + + However, GitHub Actions cannot replace Travis CI completely yet as + the latter can build on aarch64, s390x, and ppc64le architectures. + + * .github/workflows/whitespace-errors-check.yml: Remove + * .github/workflows/ci.yml: New file. + +2020-04-07 scootergrisen <scootergrisen@gmail.com> + + Translated using Weblate (Danish) + Currently translated at 100.0% (120 of 120 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/da/ + +2020-04-07 scootergrisen <scootergrisen@gmail.com> + + Translated using Weblate (Danish) + Currently translated at 100.0% (120 of 120 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/da/ + +2020-03-31 Petr Lautrbach <plautrba@redhat.com> + + pam_timestamp: Fix // in TIMESTAMPDIR. + _PATH_VARRUN already provides trailing slash for building paths + + Fixes: + $ strings /usr/lib64/security/pam_timestamp.so | grep /run/ + /var/run//pam_timestamp + /var/run//pam_timestamp/_pam_timestamp_key + +2020-03-30 James Ralston <ralston@pobox.com> + + pam_unix: Return PAM_AUTHINFO_UNAVAIL when appropriate. + The pam_unix.so will never return PAM_AUTHINFO_UNAVAIL on systems + that use the unix_chkpwd helper. + + The reason is that in unix_chkpwd.c, towards the end of main(), if + helper_verify_password() does not return PAM_SUCCESS, main() ignores + the actual error that helper_verify_password() returned and instead + returns PAM_AUTH_ERR. + + This commit corrects this behavior. Specifically, if + helper_verify_password() returns PAM_USER_UNKNOWN, which it does + when /etc/passwd entry indicates that shadow information is present + but the /etc/shadow entry is missing, the unix_chkpwd now exits + with PAM_AUTHINFO_UNAVAIL. For any other error from + helper_verify_password(), unix_chkpwd continues to exit with + PAM_AUTH_ERR. + + * modules/pam_unix/unix_chkpwd.c (main): Return PAM_AUTHINFO_UNAVAIL + when helper_verify_password() returns PAM_USER_UNKNOWN. + +2020-03-28 Dmitry V. Levin <ldv@altlinux.org> + + Fix various typos found using codespell tool. + + po: semi-automatically fix translations of pam_get_authtok default prompts + Complements: 4daceedd ("pam_get_authtok: fix i18n of default prompts") + +2020-03-24 Dmitry V. Levin <ldv@altlinux.org> + + _pam_load_module: reduce redundancy. + * libpam/pam_handlers.c (_pam_load_module): Reorganize $ISA handling + to reduce redundancy. + + Resolves: https://github.com/linux-pam/linux-pam/pull/198 + +2020-03-24 blueskycs2c <lili.ding@cs2c.com> + + pam_time: add conffile option to specify an alternative configuration file + Resolves: https://github.com/linux-pam/linux-pam/pull/163 + Resolves: https://github.com/linux-pam/linux-pam/pull/191 + +2020-03-23 Alexander Zubkov <green@qrator.net> + + pam_exec: require user name to be ready for the command. + pam_exec module can be called when a user name has not been prompted + yet. And thus the command is called without a user name available. + This fix asks PAM for the user name to ensure it is ready or to force + the prompt. + + Resolves: https://github.com/linux-pam/linux-pam/issues/131 + Resolves: https://github.com/linux-pam/linux-pam/pull/195 + +2020-03-23 Christian Göttsche <cgzones@googlemail.com> + + pam_selinux: fall back to log to syslog if audit logging fails. + Resolves: https://github.com/linux-pam/linux-pam/pull/194 + + pam_selinux: sanitize asprintf argument on failure. + + pam_selinux: print additional information on failures. + + pam_selinux: convert send_audit_message to void function. + The result is nowhere checked and other logging functions like + pam_syslog are also not checked. + + pam_selinux: fix indentation. + +2020-03-23 Christian Göttsche <cgzones@googlemail.com> + + pam_selinux: substitute legacy security_context_t type. + `security_context_t` is a legacy typedef to `char *`, substitute all usage. + + See + https://github.com/SELinuxProject/selinux/commit/9eb9c9327563014ad6a807814e7975424642d5b9 + https://github.com/SELinuxProject/selinux/blob/f8c110c8a615eb640510eab39640a0957a6ba19c/libselinux/include/selinux/selinux.h#L16 + +2020-03-20 Jiri Grönroos <jiri.gronroos@iki.fi> + + Translated using Weblate (Finnish) + Currently translated at 90.8% (109 of 120 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/fi/ + +2020-03-20 Dmitry V. Levin <ldv@altlinux.org> + + Translated using Weblate (Slovak) + Currently translated at 100.0% (120 of 120 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/sk/ + + Translated using Weblate (Czech) + + Currently translated at 100.0% (120 of 120 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/cs/ + + Translated using Weblate (French) + + Currently translated at 100.0% (120 of 120 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/fr/ + +2020-03-20 Yuri Chornoivan <yurchor@ukr.net> + + Translated using Weblate (Ukrainian) + Currently translated at 100.0% (120 of 120 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/uk/ + +2020-03-20 Oğuz Ersen <oguzersen@protonmail.com> + + Translated using Weblate (Turkish) + Currently translated at 100.0% (120 of 120 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/tr/ + +2020-03-20 Geert Warrink <geert.warrink@onsnet.nu> + + Translated using Weblate (Dutch) + Currently translated at 100.0% (120 of 120 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/nl/ + +2020-03-20 Julien Humbert <julroy67@gmail.com> + + Translated using Weblate (French) + Currently translated at 100.0% (120 of 120 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/fr/ + +2020-03-20 Dmitry V. Levin <ldv@altlinux.org> + + Translated using Weblate (Russian) + Currently translated at 100.0% (120 of 120 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/ru/ + + Translated using Weblate (Portuguese (Brazil)) + + Currently translated at 100.0% (120 of 120 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/pt_BR/ + + Translated using Weblate (Portuguese) + + Currently translated at 100.0% (120 of 120 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/pt/ + + Translated using Weblate (German) + + Currently translated at 100.0% (120 of 120 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/de/ + +2020-03-20 Piotr Drąg <piotrdrag@gmail.com> + + Translated using Weblate (Polish) + Currently translated at 100.0% (120 of 120 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/pl/ + +2020-03-19 Dmitry V. Levin <ldv@altlinux.org> + + modules/pam_userdb: use pam_str_skip_icase_prefix. + * modules/pam_userdb/pam_userdb.c: Include "pam_inline.h". + (_pam_parse, user_lookup): Use pam_str_skip_icase_prefix + instead of ugly strncasecmp invocations. + + modules/pam_umask: use pam_str_skip_icase_prefix. + * modules/pam_umask/pam_umask.c: Include "pam_inline.h". + (parse_option, setup_limits_from_gecos): Use pam_str_skip_icase_prefix + instead of ugly strncasecmp invocations. + + modules/pam_pwhistory: use pam_str_skip_icase_prefix. + * modules/pam_pwhistory/pam_pwhistory.c: Include "pam_inline.h". + (parse_option): Use pam_str_skip_icase_prefix instead of ugly + strncasecmp invocations. + + modules/pam_exec: use pam_str_skip_icase_prefix. + * modules/pam_exec/pam_exec.c (call_exec): Use pam_str_skip_icase_prefix + instead of ugly strncasecmp invocations. + +2020-03-19 Dmitry V. Levin <ldv@altlinux.org> + + Introduce pam_str_skip_icase_prefix_len and pam_str_skip_icase_prefix. + Every time I see a code like + if (strncasecmp(argv, "remember=", 9) == 0) + options->remember = strtol(&argv[9], NULL, 10); + my eyes are bleeding. + + Similar to pam_str_skip_prefix_len() and pam_str_skip_prefix(), + introduce a new helper inline function pam_str_skip_icase_prefix_len() + and a new macro pam_str_skip_icase_prefix() on top of it, to be used + in subsequent commits to cleanup the ugliness. + + * libpam/include/pam_inline.h (pam_str_skip_icase_prefix_len): New + function. + (pam_str_skip_icase_prefix): New macro. + +2020-03-19 Dmitry V. Levin <ldv@altlinux.org> + + modules/pam_xauth: use pam_str_skip_prefix. + * modules/pam_xauth/pam_xauth.c: Include "pam_inline.h". + (pam_sm_open_session, pam_sm_close_session): Use pam_str_skip_prefix + instead of ugly strncmp invocations. + + modules/pam_wheel: use pam_str_skip_prefix. + * modules/pam_wheel/pam_wheel.c: Include "pam_inline.h". + (_pam_parse): Use pam_str_skip_prefix instead of ugly strncmp + invocations. + +2020-03-19 Dmitry V. Levin <ldv@altlinux.org> + + modules/pam_unix: use pam_str_skip_prefix and pam_str_skip_prefix_len. + * modules/pam_unix/passverify.c: Include "pam_inline.h". + (verify_pwd_hash): Use pam_str_skip_prefix instead of ugly strncmp + invocations. + * modules/pam_unix/support.c: Include "pam_inline.h". + (_set_ctrl): Use pam_str_skip_prefix_len instead of hardcoding string + lengths. + * modules/pam_unix/md5_crypt.c: Include "pam_inline.h". + (crypt_md5): Use pam_str_skip_prefix_len. + + squash! modules/pam_unix: use pam_str_skip_prefix and pam_str_skip_prefix_len + +2020-03-19 Dmitry V. Levin <ldv@altlinux.org> + + modules/pam_tty_audit: use pam_str_skip_prefix. + * modules/pam_tty_audit/pam_tty_audit.c: Include "pam_inline.h". + (pam_sm_open_session): Use pam_str_skip_prefix instead of ugly strncmp + invocations. + + modules/pam_timestamp: use pam_str_skip_prefix. + * modules/pam_timestamp/pam_timestamp.c: Include "pam_inline.h". + (check_tty, get_timestamp_name, pam_sm_authenticate): Use + pam_str_skip_prefix instead of ugly strncmp invocations. + + modules/pam_tally: use pam_str_skip_prefix. + * modules/pam_tally/pam_tally.c: Include "pam_inline.h". + (tally_parse_args, getopts): Use pam_str_skip_prefix instead of ugly + strncmp invocations. + + modules/pam_tally2: use pam_str_skip_prefix. + * modules/pam_tally2/pam_tally2.c: Include "pam_inline.h". + (tally_parse_args, getopts): Use pam_str_skip_prefix instead of ugly + strncmp invocations. + + modules/pam_selinux: use pam_str_skip_prefix. + * modules/pam_selinux/pam_selinux.c: Include "pam_inline.h". + (compute_exec_context, compute_tty_context): Use pam_str_skip_prefix + instead of ugly strncmp invocations. + + modules/pam_securetty: use pam_str_skip_prefix and pam_str_skip_prefix_len + * modules/pam_securetty/pam_securetty.c: Include "pam_inline.h". + (securetty_perform_check): Use pam_str_skip_prefix and + pam_str_skip_prefix_len instead of ugly strncmp invocations. + + modules/pam_rhosts: use pam_str_skip_prefix. + * modules/pam_rhosts/pam_rhosts.c: Include "pam_inline.h". + (pam_sm_authenticate): Use pam_str_skip_prefix instead of ugly strncmp + invocations. + + modules/pam_nologin: use pam_str_skip_prefix. + * modules/pam_nologin/pam_nologin.c: Include "pam_inline.h". + (parse_args): Use pam_str_skip_prefix instead of ugly strncmp + invocations. + + modules/pam_namespace: use pam_str_skip_prefix. + * modules/pam_namespace/pam_namespace.c (root_shared): Use + pam_str_skip_prefix instead of ugly strncmp invocations. + + modules/pam_motd: use pam_str_skip_prefix. + * modules/pam_motd/pam_motd.c: Include "pam_inline.h". + (pam_sm_open_session): Use pam_str_skip_prefix instead of ugly strncmp + invocations. + + modules/pam_mkhomedir: use pam_str_skip_prefix. + * modules/pam_mkhomedir/pam_mkhomedir.c: Include "pam_inline.h". + (_pam_parse): Use pam_str_skip_prefix instead of ugly strncmp + invocations. + + modules/pam_mail: use pam_str_skip_prefix. + * modules/pam_mail/pam_mail.c: Include "pam_inline.h". + (_pam_parse): Use pam_str_skip_prefix instead of ugly strncmp + invocations. + + modules/pam_localuser: use pam_str_skip_prefix. + * modules/pam_localuser/pam_localuser.c: Include "pam_inline.h". + (pam_sm_authenticate): Use pam_str_skip_prefix instead of ugly strncmp + invocations. + + modules/pam_listfile: use pam_str_skip_prefix. + * modules/pam_listfile/pam_listfile.c: Include "pam_inline.h". + (pam_sm_authenticate): Use pam_str_skip_prefix instead of ugly strncmp + invocations. + + modules/pam_limits: use pam_str_skip_prefix. + * modules/pam_limits/pam_limits.c: Include "pam_inline.h". + (_pam_parse, parse_kernel_limits): Use pam_str_skip_prefix instead of + ugly strncmp invocations. + + modules/pam_lastlog: use pam_str_skip_prefix. + * modules/pam_lastlog/pam_lastlog.c: Include "pam_inline.h". + (_pam_auth_parse, get_tty): Use pam_str_skip_prefix instead of ugly + strncmp invocations. + + modules/pam_issue: use pam_str_skip_prefix. + * modules/pam_issue/pam_issue.c: Include "pam_inline.h". + (pam_sm_authenticate, read_issue_quoted): Use pam_str_skip_prefix + instead of ugly strncmp invocations. + + modules/pam_ftp: use pam_str_skip_prefix. + * modules/pam_ftp/pam_ftp.c: Include "pam_inline.h". + (_pam_parse): Use pam_str_skip_prefix instead of ugly strncmp invocations. + + modules/pam_env: use pam_str_skip_prefix. + * modules/pam_env/pam_env.c: Include "pam_inline.h". + (_pam_parse, _parse_line): Use pam_str_skip_prefix instead of ugly + strncmp invocations. + + modules/pam_echo: use pam_str_skip_prefix. + * modules/pam_echo/pam_echo.c: Include "pam_inline.h". + (pam_echo): Use pam_str_skip_prefix instead of ugly strncmp invocations. + + modules/pam_cracklib: use pam_str_skip_prefix. + * modules/pam_cracklib/pam_cracklib.c: Include "pam_inline.h". + (_pam_parse): Use pam_str_skip_prefix instead of ugly strncmp + invocations. + + modules/pam_access: use pam_str_skip_prefix. + * modules/pam_access/pam_access.c: Include "pam_inline.h". + (parse_args): Use pam_str_skip_prefix instead of ugly strncmp invocations. + +2020-03-19 Dmitry V. Levin <ldv@altlinux.org> + + Introduce pam_str_skip_prefix_len and pam_str_skip_prefix. + Every time I see a code like + if (!strncmp(*argv,"user_readenv=",13)) + *user_readenv = atoi(13+*argv); + my eyes are bleeding. + + Introduce a new helper inline function pam_str_skip_prefix_len() and + a new macro pam_str_skip_prefix() on top of it, to be used in subsequent + commits to cleanup the ugliness. + + * libpam/include/pam_inline.h: Include <string.h>. + (pam_str_skip_prefix_len): New function. + (pam_str_skip_prefix): New macro. + +2020-03-19 Dmitry V. Levin <ldv@altlinux.org> + + Use PAM_ARRAY_SIZE. + Replace all instances of sizeof(x) / sizeof(*x) with PAM_ARRAY_SIZE(x) + which is less error-prone and implements an additional type check. + + * libpam/pam_handlers.c: Include "pam_inline.h". + (_pam_open_config_file): Use PAM_ARRAY_SIZE. + * modules/pam_exec/pam_exec.c: Include "pam_inline.h". + (call_exec): Use PAM_ARRAY_SIZE. + * modules/pam_namespace/pam_namespace.c: Include "pam_inline.h". + (filter_mntopts): Use PAM_ARRAY_SIZE. + * modules/pam_timestamp/hmacfile.c: Include "pam_inline.h". + (testvectors): Use PAM_ARRAY_SIZE. + * modules/pam_xauth/pam_xauth.c: Include "pam_inline.h". + (run_coprocess, pam_sm_open_session): Use PAM_ARRAY_SIZE. + * tests/tst-pam_get_item.c: Include "pam_inline.h". + (main): Use PAM_ARRAY_SIZE. + * tests/tst-pam_set_item.c: Likewise. + * xtests/tst-pam_pwhistory1.c: Likewise. + * xtests/tst-pam_time1.c: Likewise. + +2020-03-19 Dmitry V. Levin <ldv@altlinux.org> + + Introduce pam_inline.h. + Introduce a new internal header file for definitions of handly inline + functions and macros providing some convenient functionality to libpam + and its modules. + + * libpam/include/pam_cc_compat.h (PAM_SAME_TYPE): New macro. + * libpam/include/pam_inline.h: New file. + * libpam/Makefile.am (noinst_HEADERS): Add include/pam_inline.h. + +2020-03-19 Dmitry V. Levin <ldv@altlinux.org> + + modules/pam_cracklib: fix parsing of options without arguments. + Prefix match for options without arguments such as use_first_pass + is not correct, there has to be an exact match for these options. + + * modules/pam_cracklib/pam_cracklib.c (_pam_parse): Fix parsing + of reject_username, gecoscheck, enforce_for_root, use_authtok, + use_first_pass, and try_first_pass options. + +2020-03-19 Dmitry V. Levin <ldv@altlinux.org> + + ci: enable -Werror for all builds. + The main purpose of fixing all compilation warnings in the current code + base was to enable -Werror in CI builds so that no new warnings would + creep in. + + * ci/run-build-and-tests.sh (DISTCHECK_CONFIGURE_FLAGS): Add --enable-Werror. + +2020-03-19 Dmitry V. Levin <ldv@altlinux.org> + + configure: implement --enable-Werror option. + When configure is invoked with --enable-Werror option, + -Werror compiler option is added to WARN_CFLAGS. + + This new configure option is intended primarily for CI purposes. + + * configure.ac (AC_ARG_ENABLE): Add Werror. Forward -Werror + to JAPHAR_GREP_CFLAGS. + +2020-03-19 Dmitry V. Levin <ldv@altlinux.org> + + Fix remaining clang -Wcast-align compilation warnings. + Introduce DIAG_PUSH_IGNORE_CAST_ALIGN and DIAG_POP_IGNORE_CAST_ALIGN + macros, use them to silence remaining clang -Wcast-align compilation + warnings. + + * libpam/include/pam_cc_compat.h (DIAG_PUSH_IGNORE_CAST_ALIGN, + DIAG_POP_IGNORE_CAST_ALIGN): New macros. + * modules/pam_access/pam_access.c: Include "pam_cc_compat.h". + (from_match, network_netmask_match): Wrap inet_ntop invocations + in DIAG_PUSH_IGNORE_CAST_ALIGN and DIAG_POP_IGNORE_CAST_ALIGN. + +2020-03-19 Dmitry V. Levin <ldv@altlinux.org> + + Fix most of clang -Wcast-align compilation warnings. + Unlike gcc, clang is not smart enough to infer the alignment + of structure fields, so add some alignment hints to the code. + + * libpam/include/pam_cc_compat.h (PAM_ATTRIBUTE_ALIGNED): New macro. + * modules/pam_namespace/md5.h: Include "pam_cc_compat.h". + (struct MD5Context): Add PAM_ATTRIBUTE_ALIGNED to "in" field. + * modules/pam_namespace/md5.c [!(__i386__ || __x86_64__)] + (uint8_aligned): New type. + [!(__i386__ || __x86_64__)] (byteReverse): Use it instead of + unsigned char. + * modules/pam_timestamp/sha1.h: Include "pam_cc_compat.h". + (struct sha1_context): Add PAM_ATTRIBUTE_ALIGNED to pending field. + * modules/pam_unix/md5.h: Include "pam_cc_compat.h". + (struct MD5Context): Add PAM_ATTRIBUTE_ALIGNED to "in" field. + * modules/pam_unix/md5.c [!HIGHFIRST] (uint8_aligned): New type. + [!HIGHFIRST] (byteReverse): Use it instead of unsigned char. + +2020-03-19 Dmitry V. Levin <ldv@altlinux.org> + + modules/pam_tally, modules/pam_tally2: fix compilation warnings. + Fix the following compilation warnings reported by gcc + when sizeof(time_t) > sizeof(long), e.g. on x32: + + modules/pam_tally/pam_tally.c:541:7: warning: format ‘%ld’ expects argument of type ‘long int’, but argument 5 has type ‘time_t’ {aka ‘long long int’} [-Wformat=] + 541 | _("The account is temporarily locked (%ld seconds left)."), + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + modules/pam_tally/pam_tally.c:546:40: warning: format ‘%ld’ expects argument of type ‘long int’, but argument 6 has type ‘time_t’ {aka ‘long long int’} [-Wformat=] + 546 | "user %s (%lu) has time limit [%lds left]" + | ~~^ + | | + | long int + | %lld + ...... + 549 | oldtime+lock_time-time(NULL)); + | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + | | + | time_t {aka long long int} + + modules/pam_tally2/pam_tally2.c:592:27: warning: format ‘%ld’ expects argument of type ‘long int’, but argument 5 has type ‘time_t’ {aka ‘long long int’} [-Wformat=] + 592 | pam_info(pamh, _("The account is temporarily locked (%ld seconds left)."), + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + modules/pam_tally2/pam_tally2.c:597:50: warning: format ‘%ld’ expects argument of type ‘long int’, but argument 6 has type ‘time_t’ {aka ‘long long int’} [-Wformat=] + 597 | "user %s (%lu) has time limit [%lds left]" + | ~~^ + | | + | long int + | %lld + ...... + 600 | oldtime+opts->lock_time-time(NULL)); + | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + | | + | time_t {aka long long int} + + This change doesn't attempt to fix handling of 64-bit time_t on 32-bit + systems in these modules. + + * modules/pam_tally/pam_tally.c (tally_check): Cast time_t expressions + to long int before passing them to pam_info and pam_syslog. + * modules/pam_tally2/pam_tally2.c (tally_check): Likewise. + +2020-03-19 Dmitry V. Levin <ldv@altlinux.org> + + modules/pam_timestamp: fix compilation warnings. + Fix the following compilation warnings reported by gcc on ilp32 platforms: + + modules/pam_timestamp/hmacfile.c: In function ‘testvectors’: + modules/pam_timestamp/hmacfile.c:121:44: warning: format ‘%lu’ expects argument of type ‘long unsigned int’, but argument 2 has type ‘size_t’ {aka ‘unsigned int’} [-Wformat=] + 121 | printf("Incorrect result for vector %lu\n", i + 1); + | ~~^ ~~~~~ + | | | + | | size_t {aka unsigned int} + | long unsigned int + | %u + modules/pam_timestamp/hmacfile.c:128:30: warning: format ‘%lu’ expects argument of type ‘long unsigned int’, but argument 2 has type ‘size_t’ {aka ‘unsigned int’} [-Wformat=] + 128 | printf("Error in vector %lu.\n", i + 1); + | ~~^ ~~~~~ + | | | + | | size_t {aka unsigned int} + | long unsigned int + | %u + In function ‘strncpy’, + inlined from ‘pam_sm_open_session’ at modules/pam_timestamp/pam_timestamp.c:584:4: + /usr/include/bits/string_fortified.h:106:10: warning: ‘__builtin___strncpy_chk’ output may be truncated copying between 1 and 4095 bytes from a string of length 4095 [-Wstringop-truncation] + + * modules/pam_timestamp/hmacfile.c (testvectors): Cast the argument + of type size_t to unsigned long before passing it to printf. + * modules/pam_timestamp/pam_timestamp.c (pam_sm_open_session): Use + memcpy instead of strncpy as the source is not NUL-terminated, add an + extra check to ensure that iterator stays inside bounds. + +2020-03-19 Dmitry V. Levin <ldv@altlinux.org> + + modules/pam_unix: fix gcc compilation warnings. + When setreuid() fails, there is no way to proceed any further: either + the process credentials are unchanged but inappropriate, or they are + in an inconsistent state and nothing good could be made out of it. + This fixes the following compilation warnings: + + modules/pam_unix/passverify.c:209:5: warning: ignoring return value of 'setreuid', declared with attribute warn_unused_result [-Wunused-result] + modules/pam_unix/passverify.c:211:5: warning: ignoring return value of 'setreuid', declared with attribute warn_unused_result [-Wunused-result] + modules/pam_unix/passverify.c:213:6: warning: ignoring return value of 'setreuid', declared with attribute warn_unused_result [-Wunused-result] + modules/pam_unix/passverify.c:214:6: warning: ignoring return value of 'setreuid', declared with attribute warn_unused_result [-Wunused-result] + modules/pam_unix/passverify.c:222:5: warning: ignoring return value of 'setreuid', declared with attribute warn_unused_result [-Wunused-result] + modules/pam_unix/passverify.c:224:5: warning: ignoring return value of 'setreuid', declared with attribute warn_unused_result [-Wunused-result] + modules/pam_unix/passverify.c:225:5: warning: ignoring return value of 'setreuid', declared with attribute warn_unused_result [-Wunused-result] + modules/pam_unix/passverify.c:226:5: warning: ignoring return value of 'setreuid', declared with attribute warn_unused_result [-Wunused-result] + modules/pam_unix/passverify.c:209:5: warning: ignoring return value of 'setreuid', declared with attribute warn_unused_result [-Wunused-result] + modules/pam_unix/passverify.c:211:5: warning: ignoring return value of 'setreuid', declared with attribute warn_unused_result [-Wunused-result] + modules/pam_unix/passverify.c:213:6: warning: ignoring return value of 'setreuid', declared with attribute warn_unused_result [-Wunused-result] + modules/pam_unix/passverify.c:214:6: warning: ignoring return value of 'setreuid', declared with attribute warn_unused_result [-Wunused-result] + modules/pam_unix/passverify.c:222:5: warning: ignoring return value of 'setreuid', declared with attribute warn_unused_result [-Wunused-result] + modules/pam_unix/passverify.c:224:5: warning: ignoring return value of 'setreuid', declared with attribute warn_unused_result [-Wunused-result] + modules/pam_unix/passverify.c:225:5: warning: ignoring return value of 'setreuid', declared with attribute warn_unused_result [-Wunused-result] + modules/pam_unix/passverify.c:226:5: warning: ignoring return value of 'setreuid', declared with attribute warn_unused_result [-Wunused-result] + + * modules/pam_unix/passverify.c (get_account_info) [HELPER_COMPILE]: + Always check setreuid return code and return PAM_CRED_INSUFFICIENT + if setreuid failed. + +2020-03-19 Dmitry V. Levin <ldv@altlinux.org> + + modules/pam_access: fix compilation warning. + Fix the following compilation warning reported by gcc + when HAVE_LIBAUDIT is not set: + + modules/pam_access/pam_access.c: In function ‘login_access’: + modules/pam_access/pam_access.c:338:13: warning: variable ‘nonall_match’ set but not used [-Wunused-but-set-variable] + 338 | int nonall_match = NO; + | ^~~~~~~~~~~~ + + * modules/pam_access/pam_access.c (login_access): Enclose nonall_match + variable with HAVE_LIBAUDIT #ifdef's. + +2020-03-19 Dmitry V. Levin <ldv@altlinux.org> + + conf/pam_conv1: fix clang compilation warnings. + Fix the following compilation warnings reported by clang: + + pam_conv_y.y:12:23: warning: unused variable 'bisonid' [-Wunused-const-variable] + static const char bisonid[]= + ^ + pam_conv_l.l:12:23: warning: unused variable 'lexid' [-Wunused-const-variable] + static const char lexid[]= + ^ + + These static variables lost their meaning after repository conversion + from cvs to git and can be safely removed. + + * conf/pam_conv1/pam_conv_l.l (lexid): Remove. + * conf/pam_conv1/pam_conv_y.y (bisonid): Remove. + +2020-03-18 Dmitry V. Levin <ldv@altlinux.org> + + modules/pam_timestamp: fix clang compilation warning. + modules/pam_timestamp/pam_timestamp.c:807:17: warning: logical not + is only applied to the left hand side of this comparison + [-Wlogical-not-parentheses] + } else if (!timestamp_good(st.st... + ^ + + * modules/pam_timestamp/pam_timestamp.c (main): Change timestamp_good + return code check to a more traditional form. + +2020-03-18 Dmitry V. Levin <ldv@altlinux.org> + + github: check for whitespace errors on push and pull requests. + * .github/workflows/whitespace-errors-check.yml: New file. + + modules/pam_timestamp: fix EXTRA_DIST. + * modules/pam_timestamp/Makefile.am (EXTRA_DIST): Replace "$(man_MANS)" + with "$(MANS)" as the former is conditional on HAVE_DOC. + + modules/pam_namespace: fix EXTRA_DIST. + * modules/pam_namespace/Makefile.am (EXTRA_DIST): Replace + "$(MAN5) $(MAN8)" with "$(MANS)" as the former is conditional + on HAVE_DOC. + +2020-03-17 Christian Göttsche <cgzones@googlemail.com> + + pam_usertype: exclude man-page generation when configured with --disable-doc + * modules/pam_usertype/Makefile.am (man_MANS): Make conditional + on HAVE_DOC. + + Resolves: https://github.com/linux-pam/linux-pam/pull/193 + +2020-03-17 Christian Göttsche <cgzones@googlemail.com> + + pam_namespace: ignore pam_namespace_helper in git. + * modules/pam_namespace/.gitignore: New file. + + Resolves: https://github.com/linux-pam/linux-pam/pull/192 + +2020-03-13 Weblate <noreply@weblate.org> + + Update translation files. + Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/ + +2020-03-13 Ondrej Sulek <feonsu@gmail.com> + + Translated using Weblate (Slovak) + Currently translated at 100.0% (117 of 117 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/sk/ + +2020-03-13 Yuri Chornoivan <yurchor@ukr.net> + + Translated using Weblate (Ukrainian) + Currently translated at 100.0% (117 of 117 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/uk/ + +2020-03-13 Dmitry V. Levin <ldv@altlinux.org> + + Translated using Weblate (Portuguese (Brazil)) + Currently translated at 100.0% (117 of 117 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/pt_BR/ + + Translated using Weblate (Portuguese) + + Currently translated at 100.0% (117 of 117 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/pt/ + + Translated using Weblate (German) + + Currently translated at 91.4% (107 of 117 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/de/ + +2020-03-13 Tomas Mraz <tmraz@fedoraproject.org> + + Adjust README with instructions for package prerequsities. + Also remove obsolete static modules instructions + +2020-03-11 Dmitry V. Levin <ldv@altlinux.org> + + pam_get_authtok: fix i18n of default prompts. + Change formatting of default prompts, making them translatable + to those languages that use a different word order. + From non-i18n perspective this change is essentially a no-op. + + * libpam/pam_get_authtok.c (PROMPTCURRENT): Replace with + PROMPT_CURRENT_ARG and PROMPT_CURRENT_NOARG. + (PROMPT1): Replace with PROMPT_NEW_ARG and PROMPT_NEW_NOARG. + (PROMPT2): Replace with PROMPT_RETYPE_ARG and PROMPT_RETYPE_NOARG. + (pam_get_authtok_internal, pam_get_authtok_verify): Use new macros. + * po/Linux-PAM.pot: Regenerated. + + Resolves: https://github.com/linux-pam/linux-pam/issues/29 + +2020-03-11 ikerexxe <ipedrosa@redhat.com> + + pam_selinux: check unknown object classes or permissions in current policy + Explanation: check whether unknown object classes or permissions are allowed or denied in the current policy + + Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1680961 + +2020-03-06 Weblate <noreply@weblate.org> + + Update translation files. + Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/ + +2020-03-06 Milo Casagrande <milo@milo.name> + + Translated using Weblate (Italian) + Currently translated at 100.0% (117 of 117 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/it/ + +2020-03-06 Dmitry V. Levin <ldv@altlinux.org> + + Translated using Weblate (Zulu) + Currently translated at 63.2% (74 of 117 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/zu/ + + Translated using Weblate (Chinese (Traditional)) + + Currently translated at 81.1% (95 of 117 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/zh_TW/ + + Translated using Weblate (Chinese (Simplified)) + + Currently translated at 81.1% (95 of 117 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/zh_CN/ + + Translated using Weblate (Tamil) + + Currently translated at 81.1% (95 of 117 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/ta/ + + Translated using Weblate (Sinhala) + + Currently translated at 65.8% (77 of 117 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/si/ + + Translated using Weblate (Russian) + + Currently translated at 100.0% (117 of 117 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/ru/ + + Translated using Weblate (Portuguese (Brazil)) + + Currently translated at 81.1% (95 of 117 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/pt_BR/ + + Translated using Weblate (Kazakh) + + Currently translated at 81.1% (95 of 117 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/kk/ + + Translated using Weblate (Japanese) + + Currently translated at 81.1% (95 of 117 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/ja/ + + Translated using Weblate (Hungarian) + + Currently translated at 81.1% (95 of 117 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/hu/ + + Translated using Weblate (Hindi) + + Currently translated at 81.1% (95 of 117 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/hi/ + + Translated using Weblate (Spanish) + + Currently translated at 81.1% (95 of 117 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/es/ + + Translated using Weblate (German) + + Currently translated at 81.1% (95 of 117 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/de/ + +2020-03-06 Oğuz Ersen <oguzersen@protonmail.com> + + Translated using Weblate (Turkish) + Currently translated at 100.0% (117 of 117 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/tr/ + +2020-03-06 Geert Warrink <geert.warrink@onsnet.nu> + + Translated using Weblate (Dutch) + Currently translated at 100.0% (117 of 117 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/nl/ + +2020-03-06 Julien Humbert <julroy67@gmail.com> + + Translated using Weblate (French) + Currently translated at 100.0% (117 of 117 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/fr/ + +2020-03-06 Piotr Drąg <piotrdrag@gmail.com> + + Translated using Weblate (Polish) + Currently translated at 100.0% (117 of 117 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/pl/ + + Translated using Weblate (Polish) + + Currently translated at 100.0% (117 of 117 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/pl/ + +2020-03-06 Tomas Mraz <tmraz@fedoraproject.org> + + Add missing file to EXTRA_DIST. + * tests/Makefile.am: Add confdir to EXTRA_DIST. + + New API call pam_start_confdir() + To load PAM stack configurations from specified directory + +2020-03-05 Dmitry V. Levin <ldv@altlinux.org> + + Fix remaining references to sourceforge.net. + Linux-PAM moved to github long time ago, update the remaining + bug tracking references to point to github issues tracker. + + * README: Refer to https://github.com/linux-pam/linux-pam/issues + instead of sourceforge.net. + * po/Makevars: Refer to https://github.com/linux-pam/linux-pam/issues + instead of http://sourceforge.net/projects/pam . + * po/Linux-PAM.pot: Regenerated. + +2020-03-05 Dmitry V. Levin <ldv@altlinux.org> + + pam_unix: fix --disable-nis compilation warnings. + When the build is configured using --disable-nis option, gcc complains: + + pam_unix_passwd.c: In function '_do_setpass': + pam_unix_passwd.c:398:8: warning: unused variable 'master' [-Wunused-variable] + + support.c: In function '_unix_getpwnam': + support.c:305:21: warning: parameter 'nis' set but not used [-Wunused-but-set-parameter] + + * modules/pam_unix/pam_unix_passwd.c (_do_setpass): Move the definition + of "master" variable to [HAVE_NIS]. + * modules/pam_unix/support.c (_unix_getpwnam) [!(HAVE_YP_GET_DEFAULT_DOMAIN + && HAVE_YP_BIND && HAVE_YP_MATCH && HAVE_YP_UNBIND)]: Do not assign + the unused parameter but mark it as used. + +2020-03-05 Dmitry V. Levin <ldv@altlinux.org> + + Sort NEWS entries. + * NEWS (1.4.0): Sort module-related news entries. + +2020-03-05 Dmitry V. Levin <ldv@altlinux.org> + + Fix whitespace issues. + Remove trailing whitespace introduced by commit + f9c9c72121eada731e010ab3620762bcf63db08f. + Remove blank lines at EOF introduced by commit + 65d6735c5949ec233df9813f734e918a93fa36cf. + + This makes the project free of warnings reported by + git diff --check 4b825dc642cb6eb9a060e54bf8d69288fbee4904 HEAD + + * doc/custom-html.xsl: Remove blank line at EOF. + * doc/custom-man.xsl: Likewise. + * modules/pam_motd/pam_motd.c: Remove trailing whitespace. + +2020-03-04 ed@s5h.net <ed@s5h.net> + + Adding package dependency hints to README. + +2020-03-04 Mark Wutzke <mark.wutzke@alliedtelesis.co.nz> + + Use cached 'crypt' library result correctly. + Configure script incorrectly used a non-cached variable (ac_lib) in the + cached code path. This results in no -lcrypt being defined resulting in + link errors on a re-build. + + Update configure.ac to use ac_cv_search_crypt (via ac_res) to setup the + correct library arguments. + +2020-03-03 Tomas Mraz <tmraz@fedoraproject.org> + + Prepare for the 1.4.0 release. + + Updated LINGUAS to remove completely untranslated languages. + Updated pot and po files + +2020-03-03 Tomáš Mráz <tmraz@redhat.com> + + Translated using Weblate (Czech) + Currently translated at 100.0% (116 of 116 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/cs/ + +2020-03-03 Oğuz Ersen <oguzersen@protonmail.com> + + Translated using Weblate (Turkish) + Currently translated at 100.0% (121 of 121 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/tr/ + +2020-03-03 Julien Humbert <julroy67@gmail.com> + + Translated using Weblate (French) + Currently translated at 100.0% (121 of 121 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/fr/ + +2020-03-03 Piotr Drąg <piotrdrag@gmail.com> + + Translated using Weblate (Polish) + Currently translated at 100.0% (121 of 121 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/pl/ + + Translated using Weblate (Polish) + + Currently translated at 100.0% (121 of 121 strings) + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/pl/ + +2020-03-03 Jean-Baptiste Holcroft <jean-baptiste@holcroft.fr> + + Deleted translation using Weblate (Cornish) + Deleted translation using Weblate (German (Low)) + + Deleted translation using Weblate (Angika) + + Deleted translation using Weblate (English (United Kingdom)) + + Deleted translation using Weblate (Asturian) + + Deleted translation using Weblate (bal (generated)) + + Deleted translation using Weblate (Bodo) + + Deleted translation using Weblate (Breton) + + Deleted translation using Weblate (Cornish) + + Deleted translation using Weblate (Cornish) + + Deleted translation using Weblate (ilo (generated)) + + Deleted translation using Weblate (Maithili) + + Deleted translation using Weblate (Pedi) + + Deleted translation using Weblate (Tibetan) + + Deleted translation using Weblate (Twi) + + Deleted translation using Weblate (wba (generated)) + +2020-03-03 Weblate <noreply@weblate.org> + + Update translation files. + Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. + + Translation: linux-pam/master + Translate-URL: https://translate.fedoraproject.org/projects/linux-pam/master/ + +2020-02-27 Iker Pedrosa <ikerpedrosam@gmail.com> + + pam_tty_audit: if kernel audit is disabled return PAM_IGNORE. + If kernel audit is disabled the socket open will return
+ EPROTONOSUPPORT.
+ Return PAM_IGNORE from pam_tty_audit and log a warning
+ in this situation so login is not blocked by the module. + +2020-02-26 Dmitry V. Levin <ldv@altlinux.org> + + pam_modutil_sanitize_helper_fds: fix SIGPIPE effect of PAM_MODUTIL_PIPE_FD + When pam_modutil_sanitize_helper_fds() is invoked with + PAM_MODUTIL_PIPE_FD to provide a dummy pipe descriptor for stdout + or stderr, it closes the read end of the newly created dummy pipe. + The negative side effect of this approach is that any write to such + descriptor triggers a SIGPIPE. Avoid this by closing the write end of + the dummy pipe and using its read end as a dummy pipe descriptor for + output. Any read from such descriptor returns 0, and any write just + fails with EBADF, which should work better with unprepared writers. + + * libpam/pam_modutil_sanitize.c (redirect_out_pipe): Remove. + (redirect_out): Call redirect_in_pipe instead of redirect_out_pipe. + + Fixes: b0ec5d1e ("Introduce pam_modutil_sanitize_helper_fds") + +2020-02-26 TBK <tbk@jjtc.eu> + + libpamc: Use ISO C99 uintX_t types instead of u_intX_t. + u_intX_t is a glibcism this fixes the issue of compiling against musl libc. + +2020-02-25 Tomas Mraz <tmraz@fedoraproject.org> + + pam_group, pam_time: Fix regression in documentation from last change. + * modules/pam_group/group.conf.5.xml: Replace bare & with &. + * modules/pam_time/time.conf.5.xml: Likewise. + +2020-02-24 Tomas Mraz <tmraz@fedoraproject.org> + + pam_limits: Document the unwanted effect of set_all with systemd. + + misc_conv: Use PAM_MAX_RESP_SIZE to limit the length of the input. + + pam_group, pam_time: Fix logical error with multiple ! operators. + * modules/pam_group/group.conf.5.xml: Document what logic list means. + * modules/pam_time/time.conf.5.xml: Likewise. + * modules/pam_group/pam_group.c (logic_field): Clear the not operator for the + further operations. + * modules/pam_time/pam_time.c (logic_field): Likewise. + +2020-02-24 Tomas Mraz <tmraz@fedoraproject.org> + + pam_shells: Recognize /bin/sh as the default shell. + If the shell is empty in /etc/passwd entry it means /bin/sh. + + * modules/pam_shells/pam_shells.c (perform_check): Use /bin/sh as default shell. + +2020-02-24 Tomas Mraz <tmraz@fedoraproject.org> + + pam_env: Change the default to not read the user .pam_environment file. + * modules/pam_env/pam_env.8.xml: Document the change. + * modules/pam_env/pam_env.c: Set DEFAULT_USER_READ_ENVFILE to 0. + +2020-02-24 Tomas Mraz <tmraz@fedoraproject.org> + + pam_env: code cleanups. + Raise BUF_SIZE to 8192 bytes. + + * modules/pam_env/pam_env.c (_parse_env_file): Ignore lines starting with '='. + (_assemble_line): Detect long lines and binary files. + (_check_var): Avoid overwriting global variable. + (_expand_arg): Avoid repeated strlen calls. + +2020-02-18 Topi Miettinen <toiwoton@gmail.com> + + pam_namespace: secure tmp-inst directories. + When using polyinstantiation for /tmp and/or /var/tmp, pam_namespace + creates subdirectories with fixed name tmp-inst. These paths should be + secured as early as possible to avoid that somehow these directories + could created and controlled by for example a malicious user or + service. + + Ship a systemd service, which creates the directories early in + boot sequence with correct permissions and ownership. + + Closes #111. + +2020-02-18 Tomas Mraz <tmraz@fedoraproject.org> + + Fix warnings from the recent PR merges. + * modules/pam_succeed_if/pam_succeed_if.c: Fix const issues. + * modules/pam_usertype/pam_usertype.c: Avoid maybe used uninitialized warning. + +2020-02-18 Pavel Březina <pbrezina@redhat.com> + + pam_unix: add nullresetok option to allow reset blank passwords. + Adding nullresetok to auth phase of pam_unix module will allow users + with blank password to authenticate in order to immediatelly change + their password even if nullok is not set. + + This allows to have blank password authentication disabled but still + allows administrator to create new user accounts with expired blank + password that must be change on the first login. + +2020-02-18 Serghei Anicheev <serghei.anicheev@gmail.com> + + pam_succeed_if: Add list support for group membership checks. + Examples:
+ account requisite pam_succeed_if.so user ingroup group1:group2
+ OR
+ account requisite pam_succeed_if.so user notingroup group1:group2
+ OR
+ account requisite pam_succeed_if.so user ingroup wheel
+ OR
+ account requisite pam_succeed_if.so user notingroup wheel
+
+ Can be very convenient to grant access based on complex group memberships (LDAP, etc)
+ +2020-02-18 MIZUTA Takeshi <mizuta.takeshi@fujitsu.com> + + Remove redundant header file inclusion. + There are some source code including the same header file redundantly. + We remove these redundant header file inclusion. + +2020-01-29 edneville <ed-github@s5h.net> + + pam_tally[2]: Updating man pages to indicate account leakage without silent + * modules/pam_tally/pam_tally.8.xml: Mention account leakage without silent
+ * modules/pam_tally2/pam_tally2.8.xml: Mention account leakage without silent
+ +2020-01-29 Jakub Wilk <jwilk@jwilk.net> + + pam_keyinit.8: add missing comma. + +2020-01-28 Pavel Březina <pbrezina@redhat.com> + + pam_usertype: new module to tell if uid is in login.defs ranges. + This module will check if the user account type is system or regular based + on its uid. To evaluate the condition it will use 0-99 reserved range + together with `SYS_UID_MIN` and `SYS_UID_MAX` values from `/etc/login.defs`. + + If these values are not set, it uses configure-time defaults + `--with-sys-uid-min` and `--with-uid-min` (according to `login.defs` man page + `SYS_UID_MAX` defaults to `UID_MIN - 1`. + + This information can be used to skip specific module in pam stack + based on the account type. `pam_succeed_if uid < 1000` is used at the moment + however it does not reflect changes to `login.defs`. + +2020-01-27 Fabrice Fontaine <fontaine.fabrice@gmail.com> + + configure.ac: add --enable-doc option. + Allow the user to disable documentation through --disable-doc (enabled + by default), this is especially useful when cross-compiling for embedded + targets + +2020-01-20 Dmitry V. Levin <ldv@altlinux.org> + + Fix remaining -Wcast-qual compilation warnings. + Introduce a new internal header file with definitions of + DIAG_PUSH_IGNORE_CAST_QUAL and DIAG_POP_IGNORE_CAST_QUAL macros, + use them to temporary silence -Wcast-qual compilation warnings + in various modules. + + * libpam/include/pam_cc_compat.h: New file. + * libpam/Makefile.am (noinst_HEADERS): Add include/pam_cc_compat.h. + * modules/pam_mkhomedir/pam_mkhomedir.c: Include "pam_cc_compat.h". + (create_homedir): Wrap execve invocation in DIAG_PUSH_IGNORE_CAST_QUAL + and DIAG_POP_IGNORE_CAST_QUAL. + * modules/pam_namespace/pam_namespace.c: Include "pam_cc_compat.h". + (pam_sm_close_session): Wrap the cast that discards ‘const’ qualifier + in DIAG_PUSH_IGNORE_CAST_QUAL and DIAG_POP_IGNORE_CAST_QUAL. + * modules/pam_tty_audit/pam_tty_audit.c: Include "pam_cc_compat.h". + (nl_send): Wrap the cast that discards ‘const’ qualifier in + DIAG_PUSH_IGNORE_CAST_QUAL and DIAG_POP_IGNORE_CAST_QUAL. + * modules/pam_unix/pam_unix_acct.c: Include "pam_cc_compat.h". + (_unix_run_verify_binary): Wrap execve invocation in + DIAG_PUSH_IGNORE_CAST_QUAL and DIAG_POP_IGNORE_CAST_QUAL. + * modules/pam_unix/pam_unix_passwd.c: Include "pam_cc_compat.h". + (_unix_run_update_binary): Wrap execve invocation in + DIAG_PUSH_IGNORE_CAST_QUAL and DIAG_POP_IGNORE_CAST_QUAL. + * modules/pam_unix/passverify.c: Include "pam_cc_compat.h". + (unix_update_shadow): Wrap the cast that discards ‘const’ qualifier + in DIAG_PUSH_IGNORE_CAST_QUAL and DIAG_POP_IGNORE_CAST_QUAL. + * modules/pam_unix/support.c: Include "pam_cc_compat.h". + (_unix_run_helper_binary): Wrap execve invocation in + DIAG_PUSH_IGNORE_CAST_QUAL and DIAG_POP_IGNORE_CAST_QUAL. + * modules/pam_xauth/pam_xauth.c: Include "pam_cc_compat.h". + (run_coprocess): Wrap execv invocation in DIAG_PUSH_IGNORE_CAST_QUAL + and DIAG_POP_IGNORE_CAST_QUAL. + +2020-01-20 Dmitry V. Levin <ldv@altlinux.org> + + _pam_mkargv: add const qualifier to the first argument. + Also fix the following compilation warning: + + tests/tst-pam_mkargv.c:21:22: warning: initialization discards ‘const’ + qualifier from pointer target type [-Wdiscarded-qualifiers] + char *argvstring = "user = XENDT\\userα user=XENDT\\user1"; + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + + * libpam/pam_misc.c (_pam_mkargv): Add const qualifier to the first + argument. + * libpam/pam_private.h (_pam_mkargv): Likewise. + * tests/tst-pam_mkargv.c (main): Convert argvstring from a pointer into + a static const string, make argvresult array static const. + +2020-01-20 Tomas Mraz <tmraz@fedoraproject.org> + + Fix miscellaneous const issues. + * libpam/pam_modutil_searchkey.c: Avoid assigning empty string literal to + non-const char *. + * modules/pam_filter/pam_filter.c: Avoid using const char **. + * modules/pam_mkhomedir/pam_mkhomedir.c: Properly cast out const for execve(). + * modules/pam_namespace/pam_namespace.c: Properly cast out const from pam data. + * modules/pam_tally2/pam_tally2.c: String literal must be assigned to + const char *. + +2020-01-17 Björn Esser <besser82@fedoraproject.org> + + pam_unix: Return NULL instead of calling crypt_md5_wrapper(). + If the call to the crypt(3) function failed for some reason during + hashing a new login passphrase, the wrapper function for computing + a hash with the md5crypt method was called internally by the pam_unix + module in previous versions of linux-pam. + + With CVE-2012-3287 in mind, the md5crypt method is not considered to + be a safe nor recommended hashing method for a new login passphrase + since at least 2012. Thus pam_unix should error out in case of a + failure in crypt(3) instead of silently computing a hashed passphrase + using a potentially unsafe method. + + * modules/pam_unix/pam_unix.8.xml: Update documentation. + * modules/pam_unix/passverify.c (create_password_hash): Return NULL + on error instead of silently invoke crypt_md5_wrapper(). + +2020-01-15 Hulto <jack.m.mckenna@gmail.com> + + Changed variable salt to hash. + helper_verify_password's variable salt is not just the salt but the whole hash. Renamed for clarity and conformity with the rest of the code. + +2020-01-15 Josef Moellers <jmoellers@suse.de> + + Add two missing va_end() calls According to the man pages, "Each invocation of va_start() must be matched by a corresponding invocation of va_end() in the same function." + +2020-01-15 Steve Langasek <steve.langasek@canonical.com> + + Further grammar fixes. + + Bug-Debian: https://bugs.debian.org/651560 + +2020-01-15 Steve Langasek <steve.langasek@canonical.com> + + Miscellaneous spelling fixes. + + Miscellaneous grammar fixes. + +2020-01-10 Andreas Henriksson <andreas@fatal.se> + + pam_umask: document the 'nousergroups' option. + Add a short description of the nousergroups to the pam_umask(8) + man-page. + +2020-01-10 Andreas Henriksson <andreas@fatal.se> + + pam_umask: add new 'nousergroups' module argument. + This is particularly useful when pam has been built with the new + --enable-usergroups configure switch, allowing users to override + the default-enabled state and disabling usergroups at runtime. + + This is synonymous but opposite to current and previous pam_umask + default that could be changed to enabled at runtime with the usergroups + argument. + +2020-01-10 Andreas Henriksson <andreas@fatal.se> + + pam_umask: build-time usergroups option default. + This change adds a configure option to set the default value of the + usergroups option (of the pam_umask module) at build-time. + + Distributions usually makes the decision if usergroups should be used or + not. This allows them to control the built-in default value, without + having to ship the value in a config file (cluttering up the view + of actually relevant user/system configuration overrides). + +2020-01-02 msalle <mischa.salle@gmail.com> + + pam_access: Fix (IPv6) address prefix size matching. + IPv6 address prefix sizes larger than 128 (i.e. not larger or equal to) should
+ be discarded. Additionally, for IPv4 addresses, the largest valid prefix size
+ should be 32.
+
+ Fixes #161 + +2019-12-18 Tomas Mraz <tmraz@fedoraproject.org> + + Do not use CFLAGS for warning flags set from configure. + To be able to set CFLAGS from make command-line but not to lose the + warning flags. + + * configure.ac: Put warning flags to WARN_CFLAGS instead of CFLAGS. + * */Makefile.am: Apply WARN_CFLAGS to AM_CFLAGS. + +2019-12-17 Balint Reczey <balint.reczey@canonical.com> + + Return only PAM_IGNORE or error from pam_motd. + Follow-up for c81280b16e1831ab0bdd0383486c7e2d1eaf1b5e.
+ * modules/pam_motd/pam_motd.c: Return PAM_IGNORE if pam_putenv succeeds.
+ * modules/pam_motd/pam_motd.8.xml: Document additional possible return values of the module. + +2019-12-16 Dmitry V. Levin <ldv@altlinux.org> + + Add initial Travis CI support. + This runs "make distcheck" using gcc-9, gcc-8, gcc-7, and clang + on x86_64, x86, x32, aarch64, s390x, and ppc64le architectures. + + * .travis.yml: New file. + * ci/install-dependencies.sh: Likewise. + * ci/run-build-and-tests.sh: Likewise. + + Resolves: https://github.com/linux-pam/linux-pam/issues/28 + +2019-12-16 Dmitry V. Levin <ldv@altlinux.org> + + pam_pwhistory: fix build when -lxcrypt is not available. + When xcrypt.h is available but -lxcrypt is not, pam_pwhistory fails to + build with the following diagnostics: + modules/pam_pwhistory/opasswd.c:111: undefined reference to `xcrypt_r' + + Fix this by using the same check for xcrypt as in other modules. + + * modules/pam_pwhistory/opasswd.c: Replace HAVE_XCRYPT_H with + HAVE_LIBXCRYPT. + +2019-12-16 Tomas Mraz <tmraz@fedoraproject.org> + + Fix or suppress various warnings when compiling with -Wall -Wextra. + * conf/pam_conv1/Makefile.am: Add -Wno-unused-function -Wno-sign-compare to CFLAGS. + * doc/specs/Makefile.am: Likewise. + + * libpamc/include/security/pam_client.h: Explicitly compare old_p with NULL. + + * modules/pam_access/pam_access.c: Avoid double const. + + * modules/pam_filter/pam_filter.c: Avoid arbitrary constants. Avoid strncpy() + without copying the NUL byte. + + * modules/pam_group/pam_group.c: Mark switch fallthrough with comment. + * modules/pam_time/pam_time.c: Likewise. + + * modules/pam_limits/pam_limits.c: Remove unused units variable. + + * modules/pam_listfile/pam_listfile.c: Avoid unnecessary strncpy, use pointers. + + * modules/pam_rootok/pam_rootok.c (log_callback): Mark unused parameter. + + * modules/pam_selinux/pam_selinux.c: Use string_to_security_class() instead + of hardcoded value. + + * modules/pam_sepermit/pam_sepermit.c: Properly cast when comparing. + + * modules/pam_succeed_if/pam_succeed_if.c: Mark unused parameters. + + * modules/pam_unix/pam_unix_passwd.c: Remove unused variables and properly + cast for comparison. + + * modules/pam_unix/support.c: Remove unused function. + +2019-12-04 Balint Reczey <balint@balintreczey.hu> + + pam_motd: Export MOTD_SHOWN=pam after showing MOTD. + This is a useful indication for update-motd profile.d snippet which can
+ also try to show MOTD when it is not already shown.
+
+ The use-case for that is showing MOTD in shells in containers without
+ PAM being involved.
+
+ * modules/pam_motd/pam_motd.c: Export MOTD_SHOWN=pam after showing MOTD
+ * modules/pam_motd/pam_motd.8.xml: Mention setting MOTD_SHOWN=pam in the man page
+ +2019-11-28 ppkarwasz <piotr.github@karwasz.org> + + Adds an auth module to pam_keyinit (#150) + Adds an auth module to pam_keyinit, whose implementation of
+ pam_sm_setcred
+ is identical to the implementation of pam_sm_open_session.
+
+ It is useful with PAM applications, which call pam_setcred,
+ before calling pam_open_session.
+
+ * modules/pam_keyinit/pam_keyinit.c: Add an auth module to pam_keyinit.
+
+ * modules/pam_keyinit/pam_keyinit.8.xml: Update the manpage
+ to describe the new functionality.
+ +2019-11-28 Sophie Herold <sophie@hemio.de> + + Lower "bad username" log priority (#154) + * modules/pam_unix/pam_unix_auth.c: Use LOG_NOTICE instead of LOG_ERR.
+ * modules/pam_unix/pam_unix_passwd.c: Likewise.
+ * modules/pam_umask/pam_umask.c: Likewise. + +2019-11-04 Tomas Mraz <tmraz@fedoraproject.org> + + pam_namespace: Support for noexec, nosuid and nodev flags for tmpfs mounts + * modules/pam_namespace/namespace.conf.5.xml: Add documentation for the + noexec, nosuid, and nodev flags support. + * modules/pam_namespace/pam_namespace.c (filter_mntopts): New function to + filter out the flags. + (parse_method): Call the function. + (ns_setup): Apply the flags to the tmpfs mount. + * modules/pam_namespace/pam_namespace.h: Add mount_flags to polydir_s struct. + +2019-11-04 Tomas Mraz <tmraz@fedoraproject.org> + + Optimize the checkgrouplist function. + There is no point in rising the allocation size by doubling when + we can allocate required memory size at once in the second pass. + + * libpam/pam_modutil_ingroup.c (checkgrouplist): Allocate some reasonable + default size in first pass and required size in the second pass. + +2019-10-15 MIZUTA Takeshi <mizuta.takeshi@fujitsu.com> + + doc: fix module type written in MODULE TYPES PROVIDED. + +2019-10-14 Tomas Mraz <tmraz@fedoraproject.org> + + pam_unix: Add logging useful for debugging problems. + Two messages added about obtaining the username are guarded + by the debug option as these should not be normally + logged - they can be useful for debugging but they do not + indicate any special condition. + + The message about authenticating user with blank password is + still just LOG_DEBUG priority but it is logged unconditionally + because it is somewhat extraordinary condition to have an user + with blank password. + + * modules/pam_unix/pam_unix_auth.c (pam_sm_authenticate): Replace + D() macro calls which are not enabled on production builds with + regular pam_syslog() calls. + +2019-10-10 Tomas Mraz <tmraz@fedoraproject.org> + + pam_unix: Fix the spelling of Jan Rękorajski's name. + +2019-10-08 MIZUTA Takeshi <mizuta.takeshi@fujitsu.com> + + doc: fix typo in manpage. + +2019-10-03 MIZUTA Takeshi <mizuta.takeshi@fujitsu.com> + + pam_mkhomedir: Add debug option to pam_mkhomedir(8) man page. + +2019-09-23 Marek Černocký <marek@manet.cz> + + Fixed missing quotes in configure script. + +2019-09-16 Thorsten Kukuk <5908016+thkukuk@users.noreply.github.com> + + Add support for a vendor directory and libeconf (#136) + With this, it is possible for Linux distributors to store their
+ supplied default configuration files somewhere below /usr, while
+ /etc only contains the changes made by the user. The new option
+ --enable-vendordir defines where Linux-PAM should additional look
+ for pam.d/*, login.defs and securetty if this files are not in /etc.
+ libeconf is a key/value configuration file reading library, which
+ handles the split of configuration files in different locations
+ and merges them transparently for the application. + +2019-09-12 Carlos Santos <casantos@redhat.com> + + pam_lastlog: document the 'unlimited' option. + +2019-09-12 Carlos Santos <casantos@redhat.com> + + pam_lastlog: prevent crash due to reduced 'fsize' limit. + It a reduced fsize limit is set in /etc/security/limits.conf and + pam_limits is in use pam_lastlog may cause a crash, e.g. + + ----- begin /etc/pam.d/su ---- + auth sufficient pam_rootok.so + auth required pam_wheel.so use_uid + auth required pam_env.so + auth required pam_unix.so nullok + account required pam_unix.so + password required pam_unix.so nullok + session required pam_limits.so + session required pam_env.so + session required pam_unix.so + session optional pam_lastlog.so + ----- end /etc/pam.d/su ----- + + ----- begin /etc/security/limits.d/fsize.conf ----- + * soft fsize 1710 + * hard fsize 1710 + ----- end /etc/security/limits.d/fsize.conf ----- + + # id user1 + uid=1000(user1) gid=1000(user1) groups=1000(user1) + # su - user1 + Last login: Wed Sep 11 01:52:44 UTC 2019 on console + $ exit + # id user2 + uid=60000(user2) gid=60000(user2) groups=60000(user2) + # su - user2 + File size limit exceeded + + This happens because pam_limits sets RLIMIT_FSIZE before pam_lastlog + attempts to write /var/log/lastlog, leading to a SIGXFSZ signal. + + In order to fix this, and an 'unlimited' option, which leads to saving + the 'fsize' limit and set it to unlimited before writing lastlog. After + that, restore the saved value. If 'fsize' is already unlimited nothing + is done. + + Failing to set the 'fsize' limit is not a fatal error. With luck the + configured limit will suffice, so we try to write lastlog anyway, even + under the risk of dying due to a SIGXFSZ. + + Failing to restore the 'fsize' limit is a fatal error, since we don't + want to keep it unlimited. + +2019-09-11 ed <ed@s5h.net> + + pam_unix_sess.c add uid for opening session. + This adds the UID of the target user to the session open log. + + Also fixing tabulation in pam_unix_sess.c. + +2019-09-09 lifecrisis <15251574+lifecrisis@users.noreply.github.com> + + Fix the man page for "pam_fail_delay()" + This man page contained the incorrect statement that setting the + PAM_FAIL_DELAY item to NULL would disable any form of delay on + authentication failure. + + I removed the incorrect statement and added a paragraph explaining + how an application should properly avoid delays. + + Closes #137. + +2019-09-06 lifecrisis <15251574+lifecrisis@users.noreply.github.com> + + Fix a typo. + There is an extra space where there should not be one. + +2019-09-06 lifecrisis <15251574+lifecrisis@users.noreply.github.com> + + Update a function comment. + The function comment for "_pam_await_timer()" does not mention the + intended behavior of prioritizing the "PAM_FAIL_DELAY" item. + + I updated the comment to make this intention clear. + +2019-09-02 Matt Cowell <matt.cowell@nokia.com> + + pwhistory: fix read of uninitialized data and memory leak when modifying opasswd + The glibc implementation of getline/getdelim does not guarantee a NUL + terminator in lineptr if getline returns failure (-1). This occurs when + the opasswd file exists but is empty. Since strdup is called + immediately afterwards, this causes strdup to read uninitialized memory + and possibly buffer overrun / crash. + + This also fixes a memory leak which always occurs when reading the last + line of the opasswd file. Since the strdup is called before checking + the return code from getline, getdelim, or fgets+strlen, it will + duplicate and never free either: + - The last successfully read line (for getline or getdelim) + - Uninitialized data (if the file is empty) + - A 0 byte string (for fgets+strlen) + + Fix by always checking the return code of getline, getdelim, or + fgets+strlen before calling strdup. + +2019-08-26 Christophe Besson <cbesson@redhat.com> + + libpam/pam_modutil_sanitize.c: optimize the way to close fds. + +2019-08-07 Tomas Mraz <tmraz@fedoraproject.org> + + pam_tty_audit: Manual page clarification about password logging. + * modules/pam_tty_audit/pam_tty_audit.8.xml: Explanation why passwords + can be sometimes logged even when the option is not set. + +2019-08-07 Tomas Mraz <tmraz@fedoraproject.org> + + pam_get_authtok_verify: Avoid duplicate password verification. + If password was already verified by previous modules in the stack + it does not need to be verified by pam_get_authtok_verify either. + + * libpam/pam_get_authtok.c (pam_get_authtok_internal): Set the authtok_verified + appropriately. + (pam_get_authtok_verify): Do not prompt if authtok_verified is set and + set it when the password is verified. + * libpam/pam_private.h: Add authtok_verified to the pam handle struct. + * libpam/pam_start.c (pam_start): Initialize authtok_verified. + +2019-07-16 2*yo <yohann@lepage.info> + + Mention that ./autogen.sh is needeed to be run if you check out the sources from git + +2019-06-27 Tomas Mraz <tmraz@fedoraproject.org> + + pam_unix: Correct MAXPASS define name in the previous two commits. + * modules/pam_unix/pam_unix_passwd.c: Change MAX_PASS to MAXPASS. + * modules/pam_unix/support.c: Likewise. + +2019-06-27 Florian Best <best@univention.de> + + Restrict password length when changing password. + + Trim password at PAM_MAX_RESP_SIZE chars. + Issue #118: Protect against Denial of Service attacks. + To prevent hashsum generation via crypt of very long passwords the + password is now stripped to 512 characters. This is equivalent behavior + to unix_chkpwd. + +2019-05-23 Olaf Mandel <o.mandel@menlosystems.com> + + pam_succeed_if: Request user data only when needed. + Allow for conditions that just check the user field to also work for + users not known to the system. Before this caused a PAM_USER_UNKNOWN + even if no extra data for an existing user was needed. E.g. + + auth sufficient pam_succeed_if.so user = NotKnownToSystem + + modules/pam_succeed_if/pam_succeed_if.c (evaluate): Change the pwd + parameter to an input/output parameter. Lazily request pwd with + pam_modutil_getpwnam() if needed and return PAM_USER_UNKNOWN on failure. + + modules/pam_succeed_if/pam_succeed_if.c (pam_sm_authenticate): Don't + request the pwd if !use_uid anymore and shift the output from audit to + after the evaluate() call. Also make sure not to give the normal failure + message if the lazy pwd loading failed. + +2019-02-26 Maciej S. Szmigiero <mail@maciej.szmigiero.name> + + pam_tally2: Remove unnecessary fsync() + pam_tally2 does fsync() after writing to a tally file. + This causes hard drive cache flushes on every failed SSH login on many + (if not most) filesystems. + And an internet-exposed machine can have a lot of these failed logins. + + This operation however doesn't seem to be necessary - the pam_tally2 + module does not do any operation which would need explicit post-crash + ordering, it just does simple file reads and writes. + And doing a fsync() after them doesn't close any race if the system happens + to crash between a write being posted and its fsync() completion. + + Let's remove this operation to get rid of all these extra cache flushes. + +2019-02-19 vkwitshana <vkwitshana@gmail.com> + + Fixed a grammer mistake. + +2019-01-10 Christopher Head <chead@chead.ca> + + Fix documentation for pam_wheel. + By default, pam_wheel checks for applicant membership in the wheel group + for *all* access requests, regardless of whether the target user is root + or non-root. Only if root_only is provided does it limit the membership + check to cases when the target user is root. Update the documentation to + reflect this. + +2019-01-10 Louis Sautier <sautier.louis@gmail.com> + + Fix a typo in the documentation. + +2019-01-10 Nir Soffer <nsoffer@redhat.com> + + pam_lastlog: Improve silent option documentation. + The silent option explicitly silents only the last login message and not + bad logins. Add a note to the manual to make this clear. + + * modules/pam_lastlog/pam_lastlog.8.xml: Clearify "silent showfailed" + +2019-01-10 Nir Soffer <nsoffer@redhat.com> + + pam_lastlog: Respect PAM_SILENT flag. + pam_lastlog module will not log info about failed login if the session + was opened with PAM_SILENT flag. + + Example use case enabled by this change: + + sudo --non-interactive program + + If this command is run by another program expecting specific output from + the command run by sudo, the unexpected info about failed logins will + break this program. + + * modules/pam_lastlog/pam_lastlog.c: Respect silent option. + (_pam_session_parse): Unset LASTLOG_BTMP if PAM_SILENT is set. + +2019-01-04 Tomas Mraz <tmraz@fedoraproject.org> + + Fix regressions from the last commits. + * configure.ac: Test for logwtmp needs -lutil in LIBS. + * modules/Makefile.am: Fix indentation of variable assignments causing + creation of incorrect Makefile. + +2019-01-04 Rosen Penev <rosenp@gmail.com> + + Replace strndupa with strncpy. + glibc only. A static string is better. + +2019-01-04 Yousong Zhou <yszhou4tech@gmail.com> + + build: ignore pam_lastlog when logwtmp is not available. + * configure.ac: check logwtmp and set COND_BUILD_PAM_LASTLOG + * modules/pam_lastlog/Makefile.am: check COND_BUILD_PAM_LASTLOG + + build: ignore pam_rhosts if neither ruserok nor ruserok_af is available. + * configure.ac: check for ruserok and ruserok_af + * modules/Makefile.am: ignore pam_rhosts/ if it's disabled + * modules/pam_rhosts/pam_rhosts.c: include stdlib.h for malloc and free + +2018-12-20 Tomas Mraz <tmraz@fedoraproject.org> + + pam_motd: Cleanup the code and avoid unnecessary logging. + The pam_motd module will not log if the default motd.d directories + are missing. + + Also cleanup some code cleanliness issues and fix compilation + warnings. + + * modules/pam_motd/pam_motd.c: Constification of constant strings. + (try_to_display_directory): Removed unused function. + (pam_split_string): Replace uint with unsigned int. Fix warnings. + (compare_strings): Fix warnings by proper constification. + (try_to_display_directories_with_overrides): Cleanups. Switch + off the logging if the motd.d directories are missing and they + are default ones. + (pam_sm_open_session): Cleanup warnings. Pass the information + to try_to_display_directories_with_overrides() that non-default + motd options are used. + +2018-12-20 Tomas Mraz <tmraz@fedoraproject.org> + + pam_lastlog: Limit lastlog file use by LASTLOG_UID_MAX option in login.defs. + * modules/pam_lastlog/pam_lastlog.8.xml: Add the documentation of the + LASTLOG_UID_MAX option. + * modules/pam_lastlog/pam_lastlog.c: New function get_lastlog_uid_max(). + (last_login_date): Check the uid against the get_lastlog_uid_max(). + (pam_authenticate): Likewise. + +2018-12-11 Tomas Mraz <tmraz@fedoraproject.org> + + Move the duplicated search_key function to pam_modutil. + * libpam/pam_modutil_searchkey.c: New source file with pam_modutil_search_key(). + * libpam/Makefile.am: Add the pam_modutil_searchkey.c. + * libpam/include/security/pam_modutil.h: Add the pam_modutil_search_key() prototype. + * libpam/libpam.map: Add the pam_modutil_search_key() into a new version. + * modules/pam_faildelay/pam_faildelay.c: Drop search_key() and use + pam_modutil_search_key(). + * modules/pam_umask/pam_umask.c: Likewise. + * modules/pam_unix/support.c: Likewise. + +2018-11-27 Tomas Mraz <tmraz@fedoraproject.org> + + pam_unix: Use pam_syslog instead of helper_log_err. + * modules/pam_unix/passverify.c (verify_pwd_hash): Add pamh argument via + PAMH_ARG_DECL. Call pam_syslog() instead of helper_log_err(). + * modules/pam_unix/passverify.h: Adjust the declaration of verify_pwd_hash(). + * modules/pam_unix/support.c (_unix_verify_password): Add the pamh argument + to verify_pwd_hash() call. + +2018-11-27 Björn Esser <besser82@fedoraproject.org> + + pam_unix: Report unusable hashes found by checksalt to syslog. + libxcrypt can be build-time configured to support (or not support) + various hashing methods. Future versions will also have support for + runtime configuration by the system's vendor and/or administrator. + + For that reason adminstrator should be notified by pam if users cannot + log into their account anymore because of such a change in the system's + configuration of libxcrypt. + + Also check for malformed hashes, like descrypt hashes starting with + "$2...", which might have been generated by unsafe base64 encoding + functions as used in glibc <= 2.16. + Such hashes are likely to be rejected by many recent implementations + of libcrypt. + + * modules/pam_unix/passverify.c (verify_pwd_hash): Report unusable + hashes found by checksalt to syslog. + +2018-11-27 Tomas Mraz <tmraz@fedoraproject.org> + + Revert "pam_unix: Add crypt_default method, if supported." + This reverts commit ad435b386b22b456724dc5c5b8d9f2d1beffc558. + +2018-11-27 Björn Esser <besser82@fedoraproject.org> + + pam_unix: Add crypt_default method, if supported. + libxcrypt since v4.4.0 supports a default method for its + gensalt function on most system configurations. As the + default method is to be considered the strongest available + hash method, it should be preferred over all other hash + methods supported by pam. + + * modules/pam_unix/pam_unix.8.xml: Documentation for crypt_default. + * modules/pam_unix/passverify.c: Add crypt_default method. + * modules/pam_unix/support.h: Likewise. + +2018-11-26 Tomas Mraz <tmraz@fedoraproject.org> + + Revert part of the commit 4da9febc. + pam_unix: Do not return a hard failure on invalid or disabled salt + as in some cases the failure actually is not interesting and can + broke things such as password-less sudo. + + * modules/pam_unix/passverify.c (check_shadow_expiry): Revert checking + of disabled or invalid salt. + +2018-11-23 Björn Esser <besser82@fedoraproject.org> + + pam_unix: Add support for (gost-)yescrypt hashing methods. + libxcrypt (v4.2 and later) has added support for the yescrypt + hashing method; gost-yescrypt has been added in v4.3. + + * modules/pam_unix/pam_unix.8.xml: Documentation for (gost-)yescrypt. + * modules/pam_unix/pam_unix_acct.c: Use 64 bit type for control flags. + * modules/pam_unix/pam_unix_auth.c: Likewise. + * modules/pam_unix/pam_unix_passwd.c: Likewise. + * modules/pam_unix/pam_unix_sess.c: Likewise. + * modules/pam_unix/passverify.c: Add support for (gost-)yescrypt. + * modules/pam_unix/passverify.h: Use 64 bit type for control flags. + * modules/pam_unix/support.c: Set sane rounds for (gost-)yescrypt. + * modules/pam_unix/support.h: Add support for (gost-)yescrypt. + +2018-11-22 Björn Esser <besser82@fedoraproject.org> + + pam_unix: Fix closing curly brace. (#77) + This has been overlooked during review of commit dce80b3f11b3. + + * modules/pam_unix/support.c (_set_ctrl): Fix closing curly brace. + + Closes: https://github.com/linux-pam/linux-pam/issues/77 + +2018-11-22 Björn Esser <besser82@fedoraproject.org> + + pam_unix: Add support for crypt_checksalt, if libcrypt supports it. + libxcrypt v4.3 has added the crypt_checksalt function to whether + the prefix at the begining of a given hash string refers to a + supported hashing method. + + Future revisions of this function will add support to check whether + the hashing method, the prefix refers to, was disabled or considered + deprecated by the system's factory presets or system administrator. + Furthermore it will be able to detect whether the parameters, which + are used by the corresponding hashing method, being encoded in the + hash string are not considered to be strong enough anymore. + + *modules/pam_unix/passverify.c: Add support for crypt_checksalt. + +2018-11-22 Björn Esser <besser82@fedoraproject.org> + + pam_unix: Prefer a gensalt function, that supports auto entropy. + * modules/pam_unix/pam_unix_passwd.c: Initialize rounds parameter to 0. + * modules/pam_unix/passverify.c: Prefer gensalt with auto entropy. + * modules/pam_unix/support.c: Fix sanitizing of rounds parameter. + +2018-11-21 Robert Fairley <rfairley@users.noreply.github.com> + + pam_motd: Fix segmentation fault when no motd_dir specified (#76) + This fixes a regression introduced by #69, where motd_path was set
+ to NULL and passed into strdup() if the motd_dir argument was
+ not specified in the configuration file. This caused a segmentation
+ fault.
+
+ * modules/pam_motd/pam_motd.c: fix checks for NULL in arguments
+ * xtests/Makefile.am: add test scripts and config file
+ * xtests/tst-pam_motd.sh: add running tst-pam_motd4.sh
+ * xtests/tst-pam_motd4.pamd: create
+ * xtests/tst-pam_motd4.sh: create + +2018-11-19 Robert Fairley <rfairley@users.noreply.github.com> + + pam_motd: Support multiple motd paths specified, with filename overrides (#69) + Adds specifying multiple paths to motd files and motd.d
+ directories to be displayed. A colon-separated list of
+ paths is specified as arguments motd and motd_dir to the
+ pam_motd module.
+
+ This gives packages several options to install motd files to.
+ By default, the paths are, with highest priority first:
+ /etc/motd
+ /run/motd
+ /usr/lib/motd
+ /etc/motd.d/
+ /run/motd.d/
+ /usr/lib/motd.d/
+
+ Which is equivalent to the following arguments:
+ motd=/etc/motd:/run/motd:/usr/lib/motd
+ motd_dir=/etc/motd.d:/run/motd.d:/usr/lib/motd.d
+
+ Files with the same filename in a lower-priority directory,
+ as specified by the order in the colon-separated list, are
+ overridden, meaning PAM will not display them.
+
+ This allows a package to contain motd files under
+ /usr/lib instead of the host configuration in /etc.
+ A service may also write a dynamically generated motd in
+ /run/motd.d/ and have PAM display it without needing a
+ symlink from /etc/motd.d/ installed.
+
+ Closes #68
+
+ * modules/pam_motd/pam_motd.8.xml: update documentation
+ * modules/pam_motd/pam_motd.c: add specifying multiple motd paths
+ * xtests/.gitignore: add generated test script
+ * xtests/Makefile.am: add test source, scripts and config files
+ * xtests/tst-pam_motd.c: create
+ * xtests/tst-pam_motd.sh: create
+ * xtests/tst-pam_motd1.pamd: create
+ * xtests/tst-pam_motd1.sh: create
+ * xtests/tst-pam_motd2.pamd: create
+ * xtests/tst-pam_motd2.sh: create
+ * xtests/tst-pam_motd3.pamd: create
+ * xtests/tst-pam_motd3.sh: create + +2018-11-16 Björn Esser <besser82@fedoraproject.org> + + pam_unix: Use bcrypt b-variant for computing new hashes. + Bcrypt hashes used the "$2a$" prefix since 1997. + However, in 2011 an implementation bug was discovered in bcrypt + affecting the handling of characters in passphrases with the 8th + bit set. + + Besides fixing the bug, OpenBSD 5.5 introduced the "$2b$" prefix + for a behavior that exactly matches crypt_blowfish's "$2y$", and + the crypt_blowfish implementation supports it as well since v1.1. + + That said new computed bcrypt hashes should use the "$2b$" prefix. + + * modules/pam_unix/passverify.c: Use bcrypt b-variant. + +2018-06-22 Dmitry V. Levin <ldv@altlinux.org> + + pam_tally, pam_tally2: fix grammar and spelling (#54) + * modules/pam_tally/pam_tally.c (tally_check): Replace + "Account is temporary locked" with "The account is temporarily locked" + in translated messages. + * modules/pam_tally2/pam_tally2.c (tally_check): Likewise. + * po/Linux-PAM.pot: Update pam_tally and pam_tally2 messages. + + Closes: https://github.com/linux-pam/linux-pam/issues/54 + +2018-06-19 Dmitry V. Levin <ldv@altlinux.org> + + Fix grammar of messages printed via pam_prompt. + Turn into proper sentences those messages that are printed without + further modifications using pam_prompt in contexts where proper + sentences are expected. + + * libpam/pam_get_authtok.c (pam_get_authtok_internal): Fix grammar + of the message passed to pam_error. + * modules/pam_limits/pam_limits.c (pam_sm_open_session): Likewise. + * modules/pam_cracklib/pam_cracklib.c (_pam_unix_approve_pass): Fix + grammar of error messages passed to pam_error. + * modules/pam_mail/pam_mail.c (report_mail): Fix grammar of a message + passed to pam_info. + * modules/pam_timestamp/pam_timestamp.c (verbose_success): Likewise. + * modules/pam_selinux/pam_selinux.c (config_context, send_text): Fix + grammar of messages passed to pam_prompt. + * modules/pam_tally/pam_tally.c (tally_check): Fix grammar of messages + passed to pam_info. + * modules/pam_tally2/pam_tally2.c (tally_check): Likewise. + * modules/pam_unix/pam_unix_acct.c (pam_sm_acct_mgmt): Fix grammar + of messages passed to _make_remark. + * modules/pam_unix/pam_unix_passwd.c (_pam_unix_approve_pass, + pam_sm_chauthtok): Likewise. + * po/Linux-PAM.pot: Regenerate. + +2018-06-19 Dmitry V. Levin <ldv@altlinux.org> + + pam_stress: do not mark messages for translation. + pam_stress is not a regular module that needs to be translated. + Besides that, its messages are not easy to understand + and even harder to translate properly. + + * modules/pam_stress/pam_stress.c (pam_sm_chauthtok): Do not mark + messages for translation. + * po/Linux-PAM.pot: Remove pam_stress messages. + +2018-05-31 Dmitry V. Levin <ldv@altlinux.org> + + pam_unix: remove obsolete _UNIX_AUTHTOK, _UNIX_OLD_AUTHTOK, and _UNIX_NEW_AUTHTOK macros + The last use of these macros was removed by commit Linux-PAM-1.3.0~5 + so their definitions should go as well. + + * modules/pam_unix/pam_unix_auth.c (_UNIX_AUTHTOK): Remove. + * modules/pam_unix/pam_unix_passwd.c (_UNIX_OLD_AUTHTOK, + _UNIX_NEW_AUTHTOK): Likewise. + + Complements: 7e09188c5dc4 ("pam_unix: Use pam_get_authtok() instead of + direct pam_prompt() calls.") + +2018-05-31 Dmitry V. Levin <ldv@altlinux.org> + + pam_unix: remove obsolete _unix_read_password prototype. + The function was removed by commit Linux-PAM-1.3.0~5 + so the function prototype should go as well. + + * modules/pam_unix/support.h (_unix_read_password): Remove. + + Complements: 7e09188c5dc4 ("pam_unix: Use pam_get_authtok() instead of + direct pam_prompt() calls.") + 2018-05-18 Thorsten Kukuk <kukuk@thkukuk.de> Release version 1.3.1. @@ -213,7 +3948,7 @@ with LOG_NOTICE. * modules/pam_xauth/pam_xauth.c: Make memory allocation failures LOG_CRIT. -2016-06-15 Dmitry V. Levin <ldv@altlinux.org> +2016-06-14 Dmitry V. Levin <ldv@altlinux.org> pam_timestamp: fix typo in strncmp usage. Before this fix, a typo in check_login_time resulted to ruser and @@ -295,6 +4030,8 @@ * modules/pam_unix/support.c (_unix_read_password): Remove. * modules/pam_unix/support.h: Remove UNIX_NOT_SET_PASS add UNIX_AUTHTOK_TYPE. +2016-04-06 Tomas Mraz <tmraz@fedoraproject.org> + pam_get_authtok(): Add authtok_type support to current password prompt. * libpam/pam_get_authtok.c (pam_get_authtok_internal): When changing password, use different prompt for current password allowing for authtok_type to be @@ -437,6 +4174,8 @@ * modules/pam_tally2/pam_tally2.c (print_one): Check for localtime returning NULL. +2016-03-04 Tomas Mraz <tmraz@fedoraproject.org> + pam_unix: Silence warnings and fix a minor bug. Fixes a minor bug in behavior when is_selinux_enabled() returned negative value. @@ -646,6 +4385,8 @@ * configure.in: Rename to configure.ac. +2015-01-07 Dmitry V. Levin <ldv@altlinux.org> + Remove unmodified GNU gettext files installed by autopoint. These files are part of GNU gettext; we have not modified them, they are installed by autopoint which is called by autoreconf, so they had to be @@ -713,7 +4454,7 @@ doc: fix a trivial typo in pam_authenticate return values (ticket #38) * doc/man/pam_authenticate.3.xml: Fix a typo in PAM_AUTHINFO_UNAVAIL. -2014-12-09 Ronny Chevalier <chevalier.ronny@gmail.com> +2014-12-08 Ronny Chevalier <chevalier.ronny@gmail.com> doc: fix typo in pam_authenticate.3.xml. * doc/man/pam_authenticate.3.xml: Fix typo. @@ -724,6 +4465,8 @@ modules/pam_succeed_if/pam_succeed_if.c (evaluate): Use PAM_RHOST and PAM_TTY properly for the rhost and tty values. +2014-10-17 Tomas Mraz <tmraz@fedoraproject.org> + pam_succeed_if: Use long long type for numeric values. The currently used long with additional conversion to int is too small for uids and gids. @@ -814,7 +4557,7 @@ * modules/pam_unix/passverify.c (save_old_password): Test for missing fields in opasswd entry and skip it. -2014-07-01 Dmitry V. Levin <ldv@altlinux.org> +2014-06-30 Dmitry V. Levin <ldv@altlinux.org> doc: add missing build dependencies for soelim stubs. * doc/man/Makefile.am [ENABLE_REGENERATE_MAN]: Add dependencies for @@ -948,16 +4691,22 @@ * modules/pam_xauth/pam_xauth.c (run_coprocess): Likewise. * modules/pam_unix/support.h (MAX_FD_NO): Remove. +2014-01-27 Dmitry V. Levin <ldv@altlinux.org> + pam_xauth: avoid potential SIGPIPE when writing to xauth process. Similar issue in pam_unix was fixed by commit Linux-PAM-0-73~8. * modules/pam_xauth/pam_xauth.c (run_coprocess): In the parent process, close the read end of input pipe after writing to its write end. +2014-01-27 Dmitry V. Levin <ldv@altlinux.org> + pam_loginuid: log significant loginuid write errors. * modules/pam_loginuid/pam_loginuid.c (set_loginuid): Log those errors during /proc/self/loginuid update that are not ignored. +2014-01-27 Dmitry V. Levin <ldv@altlinux.org> + Fix gratuitous use of strdup and x_strdup. There is no need to copy strings passed as arguments to execve, the only potentially noticeable effect of using strdup/x_strdup @@ -982,6 +4731,8 @@ * modules/pam_xauth/pam_xauth.c (run_coprocess): Do not use strdup for strings passed as arguments to execv. +2014-01-27 Dmitry V. Levin <ldv@altlinux.org> + pam_userdb: fix password hash comparison. Starting with commit Linux-PAM-0-77-28-g0b3e583 that introduced hashed passwords support in pam_userdb, hashes are compared case-insensitively. @@ -1013,6 +4764,8 @@ * modules/pam_loginuid/pam_loginuid.c (set_loginuid): Move loginuid buffer initialization closer to its first use. +2014-01-22 Dmitry V. Levin <ldv@altlinux.org> + libpam_misc: fix an inconsistency in handling memory allocation errors. When misc_conv fails to allocate memory for pam_response array, it returns PAM_CONV_ERR. However, when read_string fails to allocate @@ -1034,6 +4787,8 @@ a null-terminated string and consistently use it where a null-terminated string is expected. +2014-01-20 Dmitry V. Levin <ldv@altlinux.org> + pam_mkhomedir: check and create home directory for the same user (ticket #22) Before pam_mkhomedir helper was introduced in commit 7b14630ef39e71f603aeca0c47edf2f384717176, pam_mkhomedir was checking for @@ -1166,6 +4921,8 @@ pam_sm_acct_mgmt, pam_sm_open_session, pam_sm_close_session): Pass "flags" argument to log_items. +2013-11-20 Dmitry V. Levin <ldv@altlinux.org> + Modernize AM_INIT_AUTOMAKE invocation. Before this change, automake complained that two- and three-arguments forms of AM_INIT_AUTOMAKE are deprecated. @@ -1173,12 +4930,16 @@ * configure.in: Pass PACKAGE and VERSION arguments to AC_INIT instead of AM_INIT_AUTOMAKE. +2013-11-20 Dmitry V. Levin <ldv@altlinux.org> + Fix autoconf warnings. Before this change, autoconf complained that AC_COMPILE_IFELSE and AC_RUN_IFELSE was called before AC_USE_SYSTEM_EXTENSIONS. * configure.in: Call AC_USE_SYSTEM_EXTENSIONS before LT_INIT. +2013-11-20 Dmitry V. Levin <ldv@altlinux.org> + pam_securetty: check return value of fgets. Checking return value of fgets not only silences the warning from glibc but also leads to a cleaner code. @@ -1186,6 +4947,8 @@ * modules/pam_securetty/pam_securetty.c (securetty_perform_check): Check return value of fgets. +2013-11-20 Dmitry V. Levin <ldv@altlinux.org> + pam_lastlog: fix format string. gcc -Wformat justly complains: format '%d' expects argument of type 'int', but argument 5 has type 'time_t' @@ -1287,7 +5050,7 @@ Updated translations from Transifex. * po/*.po: Updated translations from Transifex. -2013-07-02 Dmitry V. Levin <ldv@altlinux.org> +2013-07-01 Dmitry V. Levin <ldv@altlinux.org> pam_rootok: fix linking in --enable-audit mode. pam_rootok.c explicitly uses functions from libaudit, so the module has @@ -1911,6 +5674,8 @@ Rename all .cvsignore files to .gitignore. +2011-10-26 Dmitry V. Levin <ldv@altlinux.org> + Fix whitespace issues. Cleanup trailing whitespaces, indentation that uses spaces before tabs, and blank lines at EOF. Make the project free of warnings reported by |