summaryrefslogtreecommitdiff
path: root/debian/patches-applied
diff options
context:
space:
mode:
authorSteve Langasek <vorlon@debian.org>2008-07-26 19:56:10 -0700
committerSteve Langasek <steve.langasek@ubuntu.com>2019-01-03 17:01:55 -0800
commitfe177a4cc394567465a75ed4899e0f67024a52fb (patch)
tree4423bfb418b9a89c9387d1db1f6c1f6dbef7a6e5 /debian/patches-applied
parent1ee085e4abdbe67fc98116e87c18296bf2edd7b0 (diff)
New patch pam_unix_fix_sgid_shadow_auth.patch, fixing an upstream
regression which prevents sgid shadow apps from being able to authenticate any more because the module forces use of the helper and the helper won't allow authentication of arbitrary users. This change does mean we're going to be noisier for the time being in an SELinux environment, which should be addressed but is not a regression on Debian.
Diffstat (limited to 'debian/patches-applied')
-rw-r--r--debian/patches-applied/pam_unix_fix_sgid_shadow_auth.patch25
-rw-r--r--debian/patches-applied/series1
2 files changed, 26 insertions, 0 deletions
diff --git a/debian/patches-applied/pam_unix_fix_sgid_shadow_auth.patch b/debian/patches-applied/pam_unix_fix_sgid_shadow_auth.patch
new file mode 100644
index 00000000..df5ffcf7
--- /dev/null
+++ b/debian/patches-applied/pam_unix_fix_sgid_shadow_auth.patch
@@ -0,0 +1,25 @@
+Revert upstream change that prevents pam_unix from working with sgid
+shadow applications.
+
+Authors: Steve Langasek <vorlon@debian.org>
+
+Upstream status: to be submitted (and debated...)
+
+Index: pam.deb/modules/pam_unix/passverify.c
+===================================================================
+--- pam.deb.orig/modules/pam_unix/passverify.c
++++ pam.deb/modules/pam_unix/passverify.c
+@@ -198,11 +198,11 @@
+ * ...and shadow password file entry for this user,
+ * if shadowing is enabled
+ */
++ *spwdent = pam_modutil_getspnam(pamh, name);
+ #ifndef HELPER_COMPILE
+- if (geteuid() || SELINUX_ENABLED)
++ if (*spwdent == NULL && (geteuid() || SELINUX_ENABLED))
+ return PAM_UNIX_RUN_HELPER;
+ #endif
+- *spwdent = pam_modutil_getspnam(pamh, name);
+ if (*spwdent == NULL || (*spwdent)->sp_pwdp == NULL)
+ return PAM_AUTHINFO_UNAVAIL;
+ }
diff --git a/debian/patches-applied/series b/debian/patches-applied/series
index c67db0e0..168065ab 100644
--- a/debian/patches-applied/series
+++ b/debian/patches-applied/series
@@ -1,6 +1,7 @@
thread-safe_save_old_password.patch
setreuid_juggling.patch
no_helper_for_nis+.patch
+pam_unix_fix_sgid_shadow_auth.patch
007_modules_pam_unix
008_modules_pam_limits_chroot
021_nis_cleanup