diff options
| -rw-r--r-- | ChangeLog | 15 | ||||
| -rw-r--r-- | doc/man/pam_putenv.3 | 72 | ||||
| -rw-r--r-- | doc/man/pam_putenv.3.xml | 10 | ||||
| -rw-r--r-- | modules/pam_xauth/pam_xauth.c | 1 | ||||
| -rw-r--r-- | xtests/.cvsignore | 2 | ||||
| -rw-r--r-- | xtests/Makefile.am | 6 | ||||
| -rwxr-xr-x | xtests/run-xtests.sh | 3 | ||||
| -rw-r--r-- | xtests/tst-pam_group1.c | 207 | ||||
| -rw-r--r-- | xtests/tst-pam_group1.pamd | 7 | ||||
| -rwxr-xr-x | xtests/tst-pam_group1.sh | 11 |
10 files changed, 306 insertions, 28 deletions
@@ -1,3 +1,18 @@ +2007-10-01 Thorsten Kukuk <kukuk@thkukuk.de> + + * xtests/tst-pam_group1.c: New test case for user compare in pam_group. + * xtests/tst-pam_group1.sh: Script to run test case. + * xtests/tst-pam_group1.pamd: Config for test case. + * xtests/Makefile.am: Add tst-pam_group1 test case. + * xtests/run-xtests.sh: Save/restore group.conf. + * xtests/group.conf: New. + + * modules/pam_xauth/pam_xauth.c (pam_sm_open_session): Don't + free arguments used for putenv(). + + * doc/man/pam_putenv.3.xml: Document that application has to free + the memory. + 2007-09-27 Tomas Mraz <t8m@centrum.cz> * modules/pam_succeed_if/pam_succeed_if.c (evaluate_inlist): Fix in diff --git a/doc/man/pam_putenv.3 b/doc/man/pam_putenv.3 index 60b49651..b0edc103 100644 --- a/doc/man/pam_putenv.3 +++ b/doc/man/pam_putenv.3 @@ -1,22 +1,22 @@ .\" Title: pam_putenv .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/> -.\" Date: 06/27/2006 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 09/28/2007 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "PAM_PUTENV" "3" "06/27/2006" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_PUTENV" "3" "09/28/2007" "Linux-PAM Manual" "Linux-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_putenv \- set or change PAM environment variable +pam_putenv - set or change PAM environment variable .SH "SYNOPSIS" .sp .ft B .nf -#include <security/pam_appl.h> +#include <security/pam_appl\.h> .fi .ft .HP 15 @@ -27,43 +27,65 @@ The \fBpam_putenv\fR function is used to add or change the value of PAM environment variables as associated with the \fIpamh\fR -handle. +handle\. .PP The \fIpamh\fR -argument is an authentication handle obtained by a prior call to pam_start(). The +argument is an authentication handle obtained by a prior call to pam_start()\. The \fIname_value\fR argument is a single NUL terminated string of one of the following forms: -.TP 3n +.PP NAME=value of variable +.RS 4 In this case the environment variable of the given NAME is set to the indicated value: -\fIvalue of variable\fR. If this variable is already known, it is overwritten. Otherwise it is added to the PAM environment. -.TP 3n +\fIvalue of variable\fR\. If this variable is already known, it is overwritten\. Otherwise it is added to the PAM environment\. +.RE +.PP NAME= -This function sets the variable to an empty value. It is listed separately to indicate that this is the correct way to achieve such a setting. -.TP 3n +.RS 4 +This function sets the variable to an empty value\. It is listed separately to indicate that this is the correct way to achieve such a setting\. +.RE +.PP NAME -Without an '=' the pam_putenv() function will delete the corresponding variable from the PAM environment. +.RS 4 +Without an \'=\' the +\fBpam_putenv\fR() function will delete the corresponding variable from the PAM environment\. +.RE +.PP + +\fBpam_putenv\fR() operates on a copy of +\fIname_value\fR, which means in contrast to +\fBputenv\fR(3), the application is responsible to free the data\. .SH "RETURN VALUES" -.TP 3n +.PP PAM_PERM_DENIED +.RS 4 Argument \fIname_value\fR -given is a NULL pointer. -.TP 3n +given is a NULL pointer\. +.RE +.PP PAM_BAD_ITEM -Variable requested (for deletion) is not currently set. -.TP 3n +.RS 4 +Variable requested (for deletion) is not currently set\. +.RE +.PP PAM_ABORT +.RS 4 The \fIpamh\fR -handle is corrupt. -.TP 3n +handle is corrupt\. +.RE +.PP PAM_BUF_ERR -Memory buffer error. -.TP 3n +.RS 4 +Memory buffer error\. +.RE +.PP PAM_SUCCESS -The environment variable was successfully updated. +.RS 4 +The environment variable was successfully updated\. +.RE .SH "SEE ALSO" .PP diff --git a/doc/man/pam_putenv.3.xml b/doc/man/pam_putenv.3.xml index 5efef381..619b218a 100644 --- a/doc/man/pam_putenv.3.xml +++ b/doc/man/pam_putenv.3.xml @@ -67,12 +67,20 @@ <term>NAME</term> <listitem> <para> - Without an '=' the pam_putenv() function will delete the + Without an '=' the <function>pam_putenv</function>() function + will delete the corresponding variable from the PAM environment. </para> </listitem> </varlistentry> </variablelist> + <para> + <function>pam_putenv</function>() operates on a copy of + <emphasis>name_value</emphasis>, which means in contrast to + <citerefentry> + <refentrytitle>putenv</refentrytitle><manvolnum>3</manvolnum> + </citerefentry>, the application is responsible to free the data. + </para> </refsect1> <refsect1 id="pam_putenv-return_values"> diff --git a/modules/pam_xauth/pam_xauth.c b/modules/pam_xauth/pam_xauth.c index 153210f1..1135d4b7 100644 --- a/modules/pam_xauth/pam_xauth.c +++ b/modules/pam_xauth/pam_xauth.c @@ -578,6 +578,7 @@ pam_sm_open_session (pam_handle_t *pamh, int flags UNUSED, "can't set environment variable '%s'", xauthority); putenv (xauthority); /* The environment owns this string now. */ + xauthority = NULL; /* Don't free environment variables. */ /* set $DISPLAY in pam handle to make su - work */ { diff --git a/xtests/.cvsignore b/xtests/.cvsignore index b840493b..ee175609 100644 --- a/xtests/.cvsignore +++ b/xtests/.cvsignore @@ -16,3 +16,5 @@ tst-pam_limits1 tst-pam_unix1 tst-pam_unix2 tst-pam_unix3 +tst-pam_succeed_if1 +tst-pam_group1 diff --git a/xtests/Makefile.am b/xtests/Makefile.am index 7b030d6d..9c28c975 100644 --- a/xtests/Makefile.am +++ b/xtests/Makefile.am @@ -19,13 +19,15 @@ EXTRA_DIST = run-xtests.sh tst-pam_dispatch1.pamd tst-pam_dispatch2.pamd \ tst-pam_access3.pamd tst-pam_access3.sh \ tst-pam_access4.pamd tst-pam_access4.sh \ limits.conf tst-pam_limits1.pamd tst-pam_limits1.sh \ - tst-pam_succeed_if1.pamd tst-pam_succeed_if.sh + tst-pam_succeed_if1.pamd tst-pam_succeed_if.sh \ + group.conf tst-pam_group1.pamd tst-pam_group1.sh XTESTS = tst-pam_dispatch1 tst-pam_dispatch2 tst-pam_dispatch3 \ tst-pam_dispatch4 tst-pam_cracklib1 tst-pam_cracklib2 \ tst-pam_unix1 tst-pam_unix2 tst-pam_unix3 \ tst-pam_access1 tst-pam_access2 tst-pam_access3 \ - tst-pam_access4 tst-pam_limits1 tst-pam_succeed_if1 + tst-pam_access4 tst-pam_limits1 tst-pam_succeed_if1 \ + tst-pam_group1 noinst_PROGRAMS = $(XTESTS) diff --git a/xtests/run-xtests.sh b/xtests/run-xtests.sh index 24adf121..53dbdf06 100755 --- a/xtests/run-xtests.sh +++ b/xtests/run-xtests.sh @@ -19,6 +19,8 @@ all=0 mkdir -p /etc/security cp /etc/security/access.conf /etc/security/access.conf-pam-xtests install -m 644 "${SRCDIR}"/access.conf /etc/security/access.conf +cp /etc/security/group.conf /etc/security/group.conf-pam-xtests +install -m 644 "${SRCDIR}"/group.conf /etc/security/group.conf cp /etc/security/limits.conf /etc/security/limits.conf-pam-xtests install -m 644 "${SRCDIR}"/limits.conf /etc/security/limits.conf for testname in $XTESTS ; do @@ -43,6 +45,7 @@ for testname in $XTESTS ; do rm -f /etc/pam.d/$testname done mv /etc/security/access.conf-pam-xtests /etc/security/access.conf +mv /etc/security/group.conf-pam-xtests /etc/security/group.conf mv /etc/security/limits.conf-pam-xtests /etc/security/limits.conf if test "$failed" -ne 0; then echo "===================" diff --git a/xtests/tst-pam_group1.c b/xtests/tst-pam_group1.c new file mode 100644 index 00000000..e4e3ca48 --- /dev/null +++ b/xtests/tst-pam_group1.c @@ -0,0 +1,207 @@ +/* + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, and the entire permission notice in its entirety, + * including the disclaimer of warranties. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. The name of the author may not be used to endorse or promote + * products derived from this software without specific prior + * written permission. + * + * ALTERNATIVELY, this product may be distributed under the terms of + * the GNU Public License, in which case the provisions of the GPL are + * required INSTEAD OF the above restrictions. (This clause is + * necessary due to a potential bad interaction between the GPL and + * the restrictions contained in a BSD-style copyright.) + * + * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED + * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, + * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES + * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR + * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +/* + test case: + + Check the following line in group.conf: + + tst-pam_group1;*;tstpamgrp;Al0000-2400;tstpamgrp + + + pam_group should add group tstpamgrp to user tstpamgrp, but not + to tstpamgrp2. +*/ + +#ifdef HAVE_CONFIG_H +#include <config.h> +#endif + +#include <grp.h> +#include <stdio.h> +#include <string.h> +#include <unistd.h> +#include <sys/types.h> +#include <security/pam_appl.h> + +#define GROUP_BLK 10 +#define blk_size(len) (((len-1 + GROUP_BLK)/GROUP_BLK)*GROUP_BLK) + +/* A conversation function which uses an internally-stored value for + the responses. */ +static int +fake_conv (int num_msg, const struct pam_message **msgm UNUSED, + struct pam_response **response, void *appdata_ptr UNUSED) +{ + struct pam_response *reply; + int count; + + /* Sanity test. */ + if (num_msg <= 0) + return PAM_CONV_ERR; + + /* Allocate memory for the responses. */ + reply = calloc (num_msg, sizeof (struct pam_response)); + if (reply == NULL) + return PAM_CONV_ERR; + + /* Each prompt elicits the same response. */ + for (count = 0; count < num_msg; ++count) + { + reply[count].resp_retcode = 0; + reply[count].resp = strdup ("!!"); + } + + /* Set the pointers in the response structure and return. */ + *response = reply; + return PAM_SUCCESS; +} + +static struct pam_conv conv = { + fake_conv, + NULL +}; + +static int debug = 0; + +static int +run_test (const char *user, gid_t groupid, int needit) +{ + pam_handle_t *pamh = NULL; + int retval; + + retval = pam_start("tst-pam_group1", user, &conv, &pamh); + if (retval != PAM_SUCCESS) + { + if (debug) + fprintf (stderr, "pam_group1: pam_start returned %d\n", retval); + return 1; + } + + retval = pam_set_item (pamh, PAM_TTY, "/dev/tty1"); + if (retval != PAM_SUCCESS) + { + if (debug) + fprintf (stderr, + "pam_group1: pam_set_item(PAM_TTY) returned %d\n", + retval); + return 1; + } + + retval = pam_authenticate (pamh, 0); + if (retval != PAM_SUCCESS) + { + if (debug) + fprintf (stderr, "pam_group1: pam_authenticate returned %d\n", retval); + return 1; + } + + retval = pam_setcred (pamh, PAM_ESTABLISH_CRED); + if (retval != PAM_SUCCESS) + { + if (debug) + fprintf (stderr, "pam_group1: pam_setcred returned %d\n", retval); + return 1; + } + + + int no_grps = getgroups(0, NULL); /* find the current number of groups */ + if (no_grps > 0) + { + int i, found; + gid_t *grps = calloc (blk_size (no_grps), sizeof(gid_t)); + + if (getgroups(no_grps, grps) < 0) + { + if (debug) + fprintf (stderr, "pam_group1: getroups returned error: %m\n"); + pam_end (pamh, PAM_SYSTEM_ERR); + return 1; + } + + found = 0; + for (i = 0; i < no_grps; ++i) + { +#if 0 + if (debug) + fprintf (stderr, "gid[%d]=%d\n", i, grps[i]); +#endif + if (grps[i] == groupid) + found = 1; + } + if ((needit && found) || (!needit && !found)) + { + /* everything is ok */ + } + else + { + pam_end (pamh, PAM_SYSTEM_ERR); + if (debug) + fprintf (stderr, + "pam_group1: unexpected result for %s: needit=%d, found=%d\n", + user, needit, found); + return 1; + } + } + + retval = pam_end (pamh,retval); + if (retval != PAM_SUCCESS) + { + if (debug) + fprintf (stderr, "pam_group1: pam_end returned %d\n", retval); + return 1; + } + return 0; +} + +int +main(int argc, char *argv[]) +{ + struct group *grp; + gid_t grpid; + + if (argc > 1 && strcmp (argv[1], "-d") == 0) + debug = 1; + + grp = getgrnam ("tstpamgrp"); + if (grp == NULL) + return 1; + grpid = grp->gr_gid; + + if (run_test ("root", grpid, 0) != 0 || + run_test ("tstpamgrp2", grpid, 0) != 0 || + run_test ("tstpamgrp", grpid, 1) != 0) + return 1; + + return 0; +} diff --git a/xtests/tst-pam_group1.pamd b/xtests/tst-pam_group1.pamd new file mode 100644 index 00000000..d78f3a6c --- /dev/null +++ b/xtests/tst-pam_group1.pamd @@ -0,0 +1,7 @@ +#%PAM-1.0 +auth required pam_group.so +auth required pam_permit.so +account required pam_permit.so +password required pam_permit.so +session required pam_permit.so + diff --git a/xtests/tst-pam_group1.sh b/xtests/tst-pam_group1.sh new file mode 100755 index 00000000..2d38a6ad --- /dev/null +++ b/xtests/tst-pam_group1.sh @@ -0,0 +1,11 @@ +#!/bin/bash + +/usr/sbin/groupadd -p '!!' tstpamgrp +/usr/sbin/useradd -p '!!' tstpamgrp +/usr/sbin/useradd -p '!!' tstpamgrp2 +./tst-pam_group1 +RET=$? +/usr/sbin/userdel -r tstpamgrp 2> /dev/null +/usr/sbin/userdel -r tstpamgrp2 2> /dev/null +/usr/sbin/groupdel tstpamgrp 2> /dev/null +exit $RET |