diff options
Diffstat (limited to 'Linux-PAM/modules')
127 files changed, 8742 insertions, 3708 deletions
diff --git a/Linux-PAM/modules/Makefile.am b/Linux-PAM/modules/Makefile.am index 1272b0e8..c79f5957 100644 --- a/Linux-PAM/modules/Makefile.am +++ b/Linux-PAM/modules/Makefile.am @@ -6,10 +6,10 @@ SUBDIRS = pam_access pam_cracklib pam_debug pam_deny pam_echo \ pam_env pam_filter pam_ftp pam_group pam_issue pam_keyinit \ pam_lastlog pam_limits pam_listfile pam_localuser pam_mail \ pam_mkhomedir pam_motd pam_nologin pam_permit pam_rhosts pam_rootok \ - pam_securetty pam_selinux pam_shells pam_stress pam_succeed_if \ - pam_tally pam_time pam_umask pam_unix pam_userdb pam_warn \ - pam_wheel pam_xauth pam_exec pam_namespace pam_loginuid \ - pam_faildelay + pam_securetty pam_selinux pam_sepermit pam_shells pam_stress \ + pam_succeed_if pam_tally pam_time pam_tty_audit pam_umask \ + pam_unix pam_userdb pam_warn pam_wheel pam_xauth pam_exec \ + pam_namespace pam_loginuid pam_faildelay CLEANFILES = *~ diff --git a/Linux-PAM/modules/pam_access/README b/Linux-PAM/modules/pam_access/README index a3adcc8f..ec0d67e0 100644 --- a/Linux-PAM/modules/pam_access/README +++ b/Linux-PAM/modules/pam_access/README @@ -12,6 +12,9 @@ of non-networked logins. By default rules for access management are taken from config file /etc/security /access.conf if you don't specify another file. +If Linux PAM is compiled with audit support the module will report when it +denies access based on origin (host or tty). + OPTIONS accessfile=/path/to/access.conf @@ -24,6 +27,10 @@ debug A lot of debug informations are printed with syslog(3). +noaudit + + Do not report logins from disallowed hosts and ttys to the audit subsystem. + fieldsep=separators This option modifies the field separator character that pam_access will diff --git a/Linux-PAM/modules/pam_access/access.conf.5 b/Linux-PAM/modules/pam_access/access.conf.5 index fcd33bb4..9b8fb70b 100644 --- a/Linux-PAM/modules/pam_access/access.conf.5 +++ b/Linux-PAM/modules/pam_access/access.conf.5 @@ -1,32 +1,32 @@ .\" Title: access.conf .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/> -.\" Date: 06/22/2007 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "ACCESS.CONF" "5" "06/22/2007" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "ACCESS\.CONF" "5" "01/08/2008" "Linux-PAM Manual" "Linux\-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -access.conf \- the login access control table file +access.conf - the login access control table file .SH "DESCRIPTION" .PP The -\fI/etc/security/access.conf\fR +\fI/etc/security/access\.conf\fR file specifies (\fIuser/group\fR, \fIhost\fR), (\fIuser/group\fR, \fInetwork/netmask\fR) or (\fIuser/group\fR, -\fItty\fR) combinations for which a login will be either accepted or refused. +\fItty\fR) combinations for which a login will be either accepted or refused\. .PP When someone logs in, the file -\fIaccess.conf\fR +\fIaccess\.conf\fR is scanned for the first entry that matches the (\fIuser/group\fR, \fIhost\fR) or (\fIuser/group\fR, \fInetwork/netmask\fR) combination, or, in case of non\-networked logins, the first entry that matches the (\fIuser/group\fR, -\fItty\fR) combination. The permissions field of that table entry determines whether the login will be accepted or refused. +\fItty\fR) combination\. The permissions field of that table entry determines whether the login will be accepted or refused\. .PP Each line of the login access control table has three fields separated by a ":" character (colon): .PP @@ -35,92 +35,92 @@ Each line of the login access control table has three fields separated by a ":" .PP The first field, the \fIpermission\fR -field, can be either a "\fI+\fR" character (plus) for access granted or a "\fI\-\fR" character (minus) for access denied. +field, can be either a "\fI+\fR" character (plus) for access granted or a "\fI\-\fR" character (minus) for access denied\. .PP The second field, the \fIusers\fR/\fIgroup\fR field, should be a list of one or more login names, group names, or \fIALL\fR -(which always matches). To differentiate user entries from group entries, group entries should be written with brackets, e.g. -\fI(group)\fR. +(which always matches)\. To differentiate user entries from group entries, group entries should be written with brackets, e\.g\. +\fI(group)\fR\. .PP The third field, the \fIorigins\fR -field, should be a list of one or more tty names (for non\-networked logins), host names, domain names (begin with "."), host addresses, internet network numbers (end with "."), internet network addresses with network mask (where network mask can be a decimal number or an internet address also), +field, should be a list of one or more tty names (for non\-networked logins), host names, domain names (begin with "\."), host addresses, internet network numbers (end with "\."), internet network addresses with network mask (where network mask can be a decimal number or an internet address also), \fIALL\fR (which always matches) or \fILOCAL\fR -(which matches any string that does not contain a "." character). If supported by the system you can use +(which matches any string that does not contain a "\." character)\. If supported by the system you can use \fI@netgroupname\fR -in host or user patterns. +in host or user patterns\. .PP The \fIEXCEPT\fR -operator makes it possible to write very compact rules. +operator makes it possible to write very compact rules\. .PP If the \fBnodefgroup\fR -is not set, the group file is searched when a name does not match that of the logged\-in user. Only groups are matched in which users are explicitly listed. However the PAM module does not look at the primary group id of a user. +is not set, the group file is searched when a name does not match that of the logged\-in user\. Only groups are matched in which users are explicitly listed\. However the PAM module does not look at the primary group id of a user\. .PP -The "\fI#\fR" character at start of line (no space at front) can be used to mark this line as a comment line. +The "\fI#\fR" character at start of line (no space at front) can be used to mark this line as a comment line\. .SH "EXAMPLES" .PP These are some example lines which might be specified in -\fI/etc/security/access.conf\fR. +\fI/etc/security/access\.conf\fR\. .PP User \fIroot\fR should be allowed to get access via \fIcron\fR, X11 terminal \fI:0\fR, -\fItty1\fR, ..., +\fItty1\fR, \.\.\., \fItty5\fR, -\fItty6\fR. +\fItty6\fR\. .PP + : root : crond :0 tty1 tty2 tty3 tty4 tty5 tty6 .PP User \fIroot\fR -should be allowed to get access from hosts which own the IPv4 addresses. This does not mean that the connection have to be a IPv4 one, a IPv6 connection from a host with one of this IPv4 addresses does work, too. +should be allowed to get access from hosts which own the IPv4 addresses\. This does not mean that the connection have to be a IPv4 one, a IPv6 connection from a host with one of this IPv4 addresses does work, too\. .PP -+ : root : 192.168.200.1 192.168.200.4 192.168.200.9 ++ : root : 192\.168\.200\.1 192\.168\.200\.4 192\.168\.200\.9 .PP -+ : root : 127.0.0.1 ++ : root : 127\.0\.0\.1 .PP User \fIroot\fR should get access from network -192.168.201. -where the term will be evaluated by string matching. But it might be better to use network/netmask instead. The same meaning of -192.168.201. +192\.168\.201\. +where the term will be evaluated by string matching\. But it might be better to use network/netmask instead\. The same meaning of +192\.168\.201\. is -\fI192.168.201.0/24\fR +\fI192\.168\.201\.0/24\fR or -\fI192.168.201.0/255.255.255.0\fR. +\fI192\.168\.201\.0/255\.255\.255\.0\fR\. .PP -+ : root : 192.168.201. ++ : root : 192\.168\.201\. .PP User \fIroot\fR should be able to have access from hosts -\fIfoo1.bar.org\fR +\fIfoo1\.bar\.org\fR and -\fIfoo2.bar.org\fR -(uses string matching also). +\fIfoo2\.bar\.org\fR +(uses string matching also)\. .PP -+ : root : foo1.bar.org foo2.bar.org ++ : root : foo1\.bar\.org foo2\.bar\.org .PP User \fIroot\fR should be able to have access from domain -\fIfoo.bar.org\fR -(uses string matching also). +\fIfoo\.bar\.org\fR +(uses string matching also)\. .PP -+ : root : .foo.bar.org ++ : root : \.foo\.bar\.org .PP User \fIroot\fR -should be denied to get access from all other sources. +should be denied to get access from all other sources\. .PP \- : root : ALL .PP @@ -128,7 +128,7 @@ User \fIfoo\fR and members of netgroup \fIadmins\fR -should be allowed to get access from all sources. This will only work if netgroup service is available. +should be allowed to get access from all sources\. This will only work if netgroup service is available\. .PP + : @admins foo : ALL .PP @@ -136,21 +136,21 @@ User \fIjohn\fR and \fIfoo\fR -should get access from IPv6 host address. +should get access from IPv6 host address\. .PP + : john foo : 2001:4ca0:0:101::1 .PP User \fIjohn\fR -should get access from IPv6 net/mask. +should get access from IPv6 net/mask\. .PP + : john : 2001:4ca0:0:101::/64 .PP -Disallow console logins to all but the shutdown, sync and all other accounts, which are a member of the wheel group. +Disallow console logins to all but the shutdown, sync and all other accounts, which are a member of the wheel group\. .PP \-:ALL EXCEPT (wheel) shutdown sync:LOCAL .PP -All other users should be denied to get access from all sources. +All other users should be denied to get access from all sources\. .PP \- : ALL : ALL .SH "SEE ALSO" @@ -165,6 +165,6 @@ Original \fBlogin.access\fR(5) manual was provided by Guido van Rooij which was renamed to \fBaccess.conf\fR(5) -to reflect relation to default config file. +to reflect relation to default config file\. .PP -Network address / netmask description and example text was introduced by Mike Becher <mike.becher@lrz\-muenchen.de>. +Network address / netmask description and example text was introduced by Mike Becher <mike\.becher@lrz\-muenchen\.de>\. diff --git a/Linux-PAM/modules/pam_access/pam_access.8 b/Linux-PAM/modules/pam_access/pam_access.8 index ca8cc5b0..415df624 100644 --- a/Linux-PAM/modules/pam_access/pam_access.8 +++ b/Linux-PAM/modules/pam_access/pam_access.8 @@ -1,96 +1,103 @@ .\" Title: pam_access .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/> -.\" Date: 06/22/2007 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "PAM_ACCESS" "8" "06/22/2007" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_ACCESS" "8" "01/08/2008" "Linux-PAM Manual" "Linux-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_access \- PAM module for logdaemon style login access control +pam_access - PAM module for logdaemon style login access control .SH "SYNOPSIS" .HP 14 -\fBpam_access.so\fR [debug] [nodefgroup] [accessfile=\fIfile\fR] [fieldsep=\fIsep\fR] [listsep=\fIsep\fR] +\fBpam_access\.so\fR [debug] [nodefgroup] [noaudit] [accessfile=\fIfile\fR] [fieldsep=\fIsep\fR] [listsep=\fIsep\fR] .SH "DESCRIPTION" .PP -The pam_access PAM module is mainly for access management. It provides logdaemon style login access control based on login names, host or domain names, internet addresses or network numbers, or on terminal line names in case of non\-networked logins. +The pam_access PAM module is mainly for access management\. It provides logdaemon style login access control based on login names, host or domain names, internet addresses or network numbers, or on terminal line names in case of non\-networked logins\. .PP By default rules for access management are taken from config file -\fI/etc/security/access.conf\fR -if you don't specify another file. +\fI/etc/security/access\.conf\fR +if you don\'t specify another file\. +.PP +If Linux PAM is compiled with audit support the module will report when it denies access based on origin (host or tty)\. .SH "OPTIONS" .PP -\fBaccessfile=\fR\fB\fI/path/to/access.conf\fR\fR +\fBaccessfile=\fR\fB\fI/path/to/access\.conf\fR\fR .RS 4 Indicate an alternative -\fIaccess.conf\fR -style configuration file to override the default. This can be useful when different services need different access lists. +\fIaccess\.conf\fR +style configuration file to override the default\. This can be useful when different services need different access lists\. .RE .PP \fBdebug\fR .RS 4 A lot of debug informations are printed with -\fBsyslog\fR(3). +\fBsyslog\fR(3)\. +.RE +.PP +\fBnoaudit\fR +.RS 4 +Do not report logins from disallowed hosts and ttys to the audit subsystem\. .RE .PP \fBfieldsep=\fR\fB\fIseparators\fR\fR .RS 4 -This option modifies the field separator character that pam_access will recognize when parsing the access configuration file. For example: +This option modifies the field separator character that pam_access will recognize when parsing the access configuration file\. For example: \fBfieldsep=|\fR -will cause the default `:' character to be treated as part of a field value and `|' becomes the field separator. Doing this may be useful in conjuction with a system that wants to use pam_access with X based applications, since the +will cause the default `:\' character to be treated as part of a field value and `|\' becomes the field separator\. Doing this may be useful in conjuction with a system that wants to use pam_access with X based applications, since the \fBPAM_TTY\fR -item is likely to be of the form "hostname:0" which includes a `:' character in its value. But you should not need this. +item is likely to be of the form "hostname:0" which includes a `:\' character in its value\. But you should not need this\. .RE .PP \fBlistsep=\fR\fB\fIseparators\fR\fR .RS 4 -This option modifies the list separator character that pam_access will recognize when parsing the access configuration file. For example: +This option modifies the list separator character that pam_access will recognize when parsing the access configuration file\. For example: \fBlistsep=,\fR -will cause the default ` ' (space) and `\\t' (tab) characters to be treated as part of a list element value and `,' becomes the only list element separator. Doing this may be useful on a system with group information obtained from a Windows domain, where the default built\-in groups "Domain Users", "Domain Admins" contain a space. +will cause the default ` \' (space) and `\et\' (tab) characters to be treated as part of a list element value and `,\' becomes the only list element separator\. Doing this may be useful on a system with group information obtained from a Windows domain, where the default built\-in groups "Domain Users", "Domain Admins" contain a space\. .RE .PP \fBnodefgroup\fR .RS 4 -The group database will not be used for tokens not identified as account name. +The group database will not be used for tokens not identified as account name\. .RE .SH "MODULE SERVICES PROVIDED" .PP -All services are supported. +All services are supported\. .SH "RETURN VALUES" .PP PAM_SUCCESS .RS 4 -Access was granted. +Access was granted\. .RE .PP PAM_PERM_DENIED .RS 4 -Access was not granted. +Access was not granted\. .RE .PP PAM_IGNORE .RS 4 \fBpam_setcred\fR -was called which does nothing. +was called which does nothing\. .RE .PP PAM_ABORT .RS 4 -Not all relevant data or options could be gotten. +Not all relevant data or options could be gotten\. .RE .PP PAM_USER_UNKNOWN .RS 4 -The user is not known to the system. +The user is not known to the system\. .RE .SH "FILES" .PP -\fI/etc/security/access.conf\fR +\fI/etc/security/access\.conf\fR .RS 4 Default configuration file .RE @@ -99,7 +106,7 @@ Default configuration file \fBaccess.conf\fR(5), \fBpam.d\fR(8), -\fBpam\fR(8). +\fBpam\fR(8)\. .SH "AUTHORS" .PP -The logdaemon style login access control scheme was designed and implemented by Wietse Venema. The pam_access PAM module was developed by Alexei Nogin <alexei@nogin.dnttm.ru>. The IPv6 support and the network(address) / netmask feature was developed and provided by Mike Becher <mike.becher@lrz\-muenchen.de>. +The logdaemon style login access control scheme was designed and implemented by Wietse Venema\. The pam_access PAM module was developed by Alexei Nogin <alexei@nogin\.dnttm\.ru>\. The IPv6 support and the network(address) / netmask feature was developed and provided by Mike Becher <mike\.becher@lrz\-muenchen\.de>\. diff --git a/Linux-PAM/modules/pam_access/pam_access.8.xml b/Linux-PAM/modules/pam_access/pam_access.8.xml index 1d814e88..21970d49 100644 --- a/Linux-PAM/modules/pam_access/pam_access.8.xml +++ b/Linux-PAM/modules/pam_access/pam_access.8.xml @@ -29,6 +29,9 @@ nodefgroup </arg> <arg choice="opt"> + noaudit + </arg> + <arg choice="opt"> accessfile=<replaceable>file</replaceable> </arg> <arg choice="opt"> @@ -54,6 +57,10 @@ <filename>/etc/security/access.conf</filename> if you don't specify another file. </para> + <para> + If Linux PAM is compiled with audit support the module will report + when it denies access based on origin (host or tty). + </para> </refsect1> <refsect1 id="pam_access-options"> @@ -87,6 +94,17 @@ <varlistentry> <term> + <option>noaudit</option> + </term> + <listitem> + <para> + Do not report logins from disallowed hosts and ttys to the audit subsystem. + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term> <option>fieldsep=<replaceable>separators</replaceable></option> </term> <listitem> diff --git a/Linux-PAM/modules/pam_access/pam_access.c b/Linux-PAM/modules/pam_access/pam_access.c index e12bc721..edb8fb0a 100644 --- a/Linux-PAM/modules/pam_access/pam_access.c +++ b/Linux-PAM/modules/pam_access/pam_access.c @@ -46,6 +46,10 @@ #include <netdb.h> #include <sys/socket.h> +#ifdef HAVE_LIBAUDIT +#include <libaudit.h> +#endif + /* * here, we make definitions for the externally accessible functions * in this file (these definitions are required for static modules @@ -81,17 +85,11 @@ /* Delimiters for fields and for lists of users, ttys or hosts. */ -static const char *fs = ":"; /* field separator */ -static const char *sep = ", \t"; /* list-element separator */ - - /* Constants to be used in assignments only, not in comparisons... */ +#define ALL 2 #define YES 1 #define NO 0 -/* Only allow group entries of the form "(xyz)" */ -static int only_new_group_syntax = NO; - /* * A structure to bundle up all login-related information to keep the * functional interfaces as generic as possible. @@ -100,12 +98,13 @@ struct login_info { const struct passwd *user; const char *from; const char *config_file; + int debug; /* Print debugging messages. */ + int only_new_group_syntax; /* Only allow group entries of the form "(xyz)" */ + int noaudit; /* Do not audit denials */ + const char *fs; /* field separator */ + const char *sep; /* list-element separator */ }; -/* Print debugging messages. - Default is NO which means don't print debugging messages. */ -static char pam_access_debug = NO; - /* Parse module config arguments */ static int @@ -113,17 +112,22 @@ parse_args(pam_handle_t *pamh, struct login_info *loginfo, int argc, const char **argv) { int i; - + + loginfo->noaudit = NO; + loginfo->debug = NO; + loginfo->only_new_group_syntax = NO; + loginfo->fs = ":"; + loginfo->sep = ", \t"; for (i=0; i<argc; ++i) { if (!strncmp("fieldsep=", argv[i], 9)) { /* the admin wants to override the default field separators */ - fs = argv[i]+9; + loginfo->fs = argv[i]+9; } else if (!strncmp("listsep=", argv[i], 8)) { /* the admin wants to override the default list separators */ - sep = argv[i]+8; + loginfo->sep = argv[i]+8; } else if (!strncmp("accessfile=", argv[i], 11)) { FILE *fp = fopen(11 + argv[i], "r"); @@ -138,9 +142,11 @@ parse_args(pam_handle_t *pamh, struct login_info *loginfo, } } else if (strcmp (argv[i], "debug") == 0) { - pam_access_debug = YES; + loginfo->debug = YES; } else if (strcmp (argv[i], "nodefgroup") == 0) { - only_new_group_syntax = YES; + loginfo->only_new_group_syntax = YES; + } else if (strcmp (argv[i], "noaudit") == 0) { + loginfo->noaudit = YES; } else { pam_syslog(pamh, LOG_ERR, "unrecognized option [%s]", argv[i]); } @@ -156,10 +162,10 @@ typedef int match_func (pam_handle_t *, char *, struct login_info *); static int list_match (pam_handle_t *, char *, char *, struct login_info *, match_func *); static int user_match (pam_handle_t *, char *, struct login_info *); -static int group_match (pam_handle_t *, const char *, const char *); +static int group_match (pam_handle_t *, const char *, const char *, int); static int from_match (pam_handle_t *, char *, struct login_info *); -static int string_match (pam_handle_t *, const char *, const char *); -static int network_netmask_match (pam_handle_t *, const char *, const char *); +static int string_match (pam_handle_t *, const char *, const char *, int); +static int network_netmask_match (pam_handle_t *, const char *, const char *, int); /* isipaddr - find out if string provided is an IP address or not */ @@ -325,11 +331,12 @@ login_access (pam_handle_t *pamh, struct login_info *item) char *users; /* becomes list of login names */ char *froms; /* becomes list of terminals or hosts */ int match = NO; + int nonall_match = NO; int end; int lineno = 0; /* for diagnostics */ char *sptr; - if (pam_access_debug) + if (item->debug) pam_syslog (pamh, LOG_DEBUG, "login_access: user=%s, from=%s, file=%s", item->user->pw_name, @@ -361,8 +368,8 @@ login_access (pam_handle_t *pamh, struct login_info *item) continue; /* Allow field seperator in last field of froms */ - if (!(perm = strtok_r(line, fs, &sptr)) - || !(users = strtok_r(NULL, fs, &sptr)) + if (!(perm = strtok_r(line, item->fs, &sptr)) + || !(users = strtok_r(NULL, item->fs, &sptr)) || !(froms = strtok_r(NULL, "\n", &sptr))) { pam_syslog(pamh, LOG_ERR, "%s: line %d: bad field count", item->config_file, lineno); @@ -373,17 +380,22 @@ login_access (pam_handle_t *pamh, struct login_info *item) item->config_file, lineno); continue; } - if (pam_access_debug) + if (item->debug) pam_syslog (pamh, LOG_DEBUG, "line %d: %s : %s : %s", lineno, perm, users, froms); - match = list_match(pamh, froms, NULL, item, from_match); - if (pam_access_debug) - pam_syslog (pamh, LOG_DEBUG, - "from_match=%d, \"%s\"", match, item->from); - match = match && list_match (pamh, users, NULL, item, user_match); - if (pam_access_debug) + match = list_match(pamh, users, NULL, item, user_match); + if (item->debug) pam_syslog (pamh, LOG_DEBUG, "user_match=%d, \"%s\"", match, item->user->pw_name); + if (match) { + match = list_match(pamh, froms, NULL, item, from_match); + if (!match && perm[0] == '+') { + nonall_match = YES; + } + if (item->debug) + pam_syslog (pamh, LOG_DEBUG, + "from_match=%d, \"%s\"", match, item->from); + } } (void) fclose(fp); } else if (errno == ENOENT) { @@ -394,6 +406,13 @@ login_access (pam_handle_t *pamh, struct login_info *item) pam_syslog(pamh, LOG_ERR, "cannot open %s: %m", item->config_file); return NO; } +#ifdef HAVE_LIBAUDIT + if (!item->noaudit && line[0] == '-' && (match == YES || (match == ALL && + nonall_match == YES))) { + pam_modutil_audit_write(pamh, AUDIT_ANOM_LOGIN_LOCATION, + "pam_access", 0); + } +#endif return (match == NO || (line[0] == '+')); } @@ -407,7 +426,7 @@ list_match(pam_handle_t *pamh, char *list, char *sptr, char *tok; int match = NO; - if (pam_access_debug && list != NULL) + if (item->debug && list != NULL) pam_syslog (pamh, LOG_DEBUG, "list_match: list=%s, item=%s", list, item->user->pw_name); @@ -418,8 +437,8 @@ list_match(pam_handle_t *pamh, char *list, char *sptr, * the match is affected by any exceptions. */ - for (tok = strtok_r(list, sep, &sptr); tok != 0; - tok = strtok_r(NULL, sep, &sptr)) { + for (tok = strtok_r(list, item->sep, &sptr); tok != 0; + tok = strtok_r(NULL, item->sep, &sptr)) { if (strcasecmp(tok, "EXCEPT") == 0) /* EXCEPT: give up */ break; if ((match = (*match_fn) (pamh, tok, item))) /* YES */ @@ -428,10 +447,12 @@ list_match(pam_handle_t *pamh, char *list, char *sptr, /* Process exceptions to matches. */ if (match != NO) { - while ((tok = strtok_r(NULL, sep, &sptr)) && strcasecmp(tok, "EXCEPT")) + while ((tok = strtok_r(NULL, item->sep, &sptr)) && strcasecmp(tok, "EXCEPT")) /* VOID */ ; - if (tok == 0 || list_match(pamh, NULL, sptr, item, match_fn) == NO) - return (match); + if (tok == 0) + return match; + if (list_match(pamh, NULL, sptr, item, match_fn) == NO) + return YES; /* drop special meaning of ALL */ } return (NO); } @@ -453,7 +474,7 @@ static char *myhostname(void) static int netgroup_match (pam_handle_t *pamh, const char *netgroup, - const char *machine, const char *user) + const char *machine, const char *user, int debug) { char *mydomain = NULL; int retval; @@ -462,7 +483,7 @@ netgroup_match (pam_handle_t *pamh, const char *netgroup, retval = innetgr (netgroup, machine, user, mydomain); - if (pam_access_debug == YES) + if (debug == YES) pam_syslog (pamh, LOG_DEBUG, "netgroup_match: %d (netgroup=%s, machine=%s, user=%s, domain=%s)", retval, netgroup ? netgroup : "NULL", @@ -480,8 +501,9 @@ user_match (pam_handle_t *pamh, char *tok, struct login_info *item) char *string = item->user->pw_name; struct login_info fake_item; char *at; + int rv; - if (pam_access_debug) + if (item->debug) pam_syslog (pamh, LOG_DEBUG, "user_match: tok=%s, item=%s", tok, string); @@ -500,12 +522,12 @@ user_match (pam_handle_t *pamh, char *tok, struct login_info *item) return (user_match (pamh, tok, item) && from_match (pamh, at + 1, &fake_item)); } else if (tok[0] == '@') /* netgroup */ - return (netgroup_match (pamh, tok + 1, (char *) 0, string)); + return (netgroup_match (pamh, tok + 1, (char *) 0, string, item->debug)); else if (tok[0] == '(' && tok[strlen(tok) - 1] == ')') - return (group_match (pamh, tok, string)); - else if (string_match (pamh, tok, string)) /* ALL or exact match */ - return YES; - else if (only_new_group_syntax == NO && + return (group_match (pamh, tok, string, item->debug)); + else if ((rv=string_match (pamh, tok, string, item->debug)) != NO) /* ALL or exact match */ + return rv; + else if (item->only_new_group_syntax == NO && pam_modutil_user_in_group_nam_nam (pamh, item->user->pw_name, tok)) /* try group membership */ @@ -518,11 +540,12 @@ user_match (pam_handle_t *pamh, char *tok, struct login_info *item) /* group_match - match a username against token named group */ static int -group_match (pam_handle_t *pamh, const char *tok, const char* usr) +group_match (pam_handle_t *pamh, const char *tok, const char* usr, + int debug) { char grptok[BUFSIZ]; - if (pam_access_debug) + if (debug) pam_syslog (pamh, LOG_DEBUG, "group_match: grp=%s, user=%s", grptok, usr); @@ -548,8 +571,9 @@ from_match (pam_handle_t *pamh UNUSED, char *tok, struct login_info *item) const char *string = item->from; int tok_len; int str_len; + int rv; - if (pam_access_debug) + if (item->debug) pam_syslog (pamh, LOG_DEBUG, "from_match: tok=%s, item=%s", tok, string); @@ -565,10 +589,10 @@ from_match (pam_handle_t *pamh UNUSED, char *tok, struct login_info *item) if (string == NULL) { return NO; } else if (tok[0] == '@') { /* netgroup */ - return (netgroup_match (pamh, tok + 1, string, (char *) 0)); - } else if (string_match(pamh, tok, string)) { + return (netgroup_match (pamh, tok + 1, string, (char *) 0, item->debug)); + } else if ((rv = string_match(pamh, tok, string, item->debug)) != NO) { /* ALL or exact match */ - return (YES); + return rv; } else if (tok[0] == '.') { /* domain: match last fields */ if ((str_len = strlen(string)) > (tok_len = strlen(tok)) && strcasecmp(tok, string + str_len - tok_len) == 0) @@ -614,7 +638,7 @@ from_match (pam_handle_t *pamh UNUSED, char *tok, struct login_info *item) } } else if (isipaddr(string, NULL, NULL) == YES) { /* Assume network/netmask with a IP of a host. */ - if (network_netmask_match(pamh, tok, string)) + if (network_netmask_match(pamh, tok, string, item->debug)) return YES; } else { /* Assume network/netmask with a name of a host. */ @@ -641,7 +665,7 @@ from_match (pam_handle_t *pamh UNUSED, char *tok, struct login_info *item) : (void *) &((struct sockaddr_in6 *) runp->ai_addr)->sin6_addr, buf, sizeof (buf)); - if (network_netmask_match(pamh, tok, buf)) + if (network_netmask_match(pamh, tok, buf, item->debug)) { freeaddrinfo (res); return YES; @@ -658,10 +682,11 @@ from_match (pam_handle_t *pamh UNUSED, char *tok, struct login_info *item) /* string_match - match a string against one token */ static int -string_match (pam_handle_t *pamh, const char *tok, const char *string) +string_match (pam_handle_t *pamh, const char *tok, const char *string, + int debug) { - if (pam_access_debug) + if (debug) pam_syslog (pamh, LOG_DEBUG, "string_match: tok=%s, item=%s", tok, string); @@ -672,7 +697,7 @@ string_match (pam_handle_t *pamh, const char *tok, const char *string) */ if (strcasecmp(tok, "ALL") == 0) { /* all: always matches */ - return (YES); + return (ALL); } else if (string != NULL) { if (strcasecmp(tok, string) == 0) { /* try exact match */ return (YES); @@ -690,9 +715,9 @@ string_match (pam_handle_t *pamh, const char *tok, const char *string) */ static int network_netmask_match (pam_handle_t *pamh, - const char *tok, const char *string) + const char *tok, const char *string, int debug) { - if (pam_access_debug) + if (debug) pam_syslog (pamh, LOG_DEBUG, "network_netmask_match: tok=%s, item=%s", tok, string); @@ -771,6 +796,22 @@ pam_sm_authenticate (pam_handle_t *pamh, int flags UNUSED, return PAM_USER_UNKNOWN; } + if ((user_pw=pam_modutil_getpwnam(pamh, user))==NULL) + return (PAM_USER_UNKNOWN); + + /* + * Bundle up the arguments to avoid unnecessary clumsiness later on. + */ + loginfo.user = user_pw; + loginfo.config_file = PAM_ACCESS_CONFIG; + + /* parse the argument list */ + + if (!parse_args(pamh, &loginfo, argc, argv)) { + pam_syslog(pamh, LOG_ERR, "failed to parse the module arguments"); + return PAM_ABORT; + } + /* remote host name */ if (pam_get_item(pamh, PAM_RHOST, &void_from) @@ -799,7 +840,7 @@ pam_sm_authenticate (pam_handle_t *pamh, int flags UNUSED, return PAM_ABORT; } from = void_from; - if (pam_access_debug) + if (loginfo.debug) pam_syslog (pamh, LOG_DEBUG, "cannot determine tty or remote hostname, using service %s", from); @@ -817,22 +858,7 @@ pam_sm_authenticate (pam_handle_t *pamh, int flags UNUSED, } } - if ((user_pw=pam_modutil_getpwnam(pamh, user))==NULL) - return (PAM_USER_UNKNOWN); - - /* - * Bundle up the arguments to avoid unnecessary clumsiness later on. - */ - loginfo.user = user_pw; loginfo.from = from; - loginfo.config_file = PAM_ACCESS_CONFIG; - - /* parse the argument list */ - - if (!parse_args(pamh, &loginfo, argc, argv)) { - pam_syslog(pamh, LOG_ERR, "failed to parse the module arguments"); - return PAM_ABORT; - } if (login_access(pamh, &loginfo)) { return (PAM_SUCCESS); diff --git a/Linux-PAM/modules/pam_cracklib/pam_cracklib.8 b/Linux-PAM/modules/pam_cracklib/pam_cracklib.8 index 8ccf8059..7796b419 100644 --- a/Linux-PAM/modules/pam_cracklib/pam_cracklib.8 +++ b/Linux-PAM/modules/pam_cracklib/pam_cracklib.8 @@ -1,33 +1,33 @@ .\" Title: pam_cracklib .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/> -.\" Date: 06/20/2007 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "PAM_CRACKLIB" "8" "06/20/2007" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_CRACKLIB" "8" "01/08/2008" "Linux-PAM Manual" "Linux\-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_cracklib \- PAM module to check the password against dictionary words +pam_cracklib - PAM module to check the password against dictionary words .SH "SYNOPSIS" .HP 16 -\fBpam_cracklib.so\fR [\fI...\fR] +\fBpam_cracklib\.so\fR [\fI\.\.\.\fR] .SH "DESCRIPTION" .PP This module can be plugged into the \fIpassword\fR -stack of a given application to provide some plug\-in strength\-checking for passwords. +stack of a given application to provide some plug\-in strength\-checking for passwords\. .PP -The action of this module is to prompt the user for a password and check its strength against a system dictionary and a set of rules for identifying poor choices. +The action of this module is to prompt the user for a password and check its strength against a system dictionary and a set of rules for identifying poor choices\. .PP -The first action is to prompt for a single password, check its strength and then, if it is considered strong, prompt for the password a second time (to verify that it was typed correctly on the first occasion). All being well, the password is passed on to subsequent modules to be installed as the new authentication token. +The first action is to prompt for a single password, check its strength and then, if it is considered strong, prompt for the password a second time (to verify that it was typed correctly on the first occasion)\. All being well, the password is passed on to subsequent modules to be installed as the new authentication token\. .PP The strength checks works in the following manner: at first the \fBCracklib\fR -routine is called to check if the password is part of a dictionary; if this is not the case an additional set of strength checks is done. These checks are: +routine is called to check if the password is part of a dictionary; if this is not the case an additional set of strength checks is done\. These checks are: .PP Palindrome .RS 4 @@ -43,15 +43,15 @@ Similar .RS 4 Is the new password too much like the old one? This is primarily controlled by one argument, \fBdifok\fR -which is a number of characters that if different between the old and new are enough to accept the new password, this defaults to 10 or 1/2 the size of the new password whichever is smaller. +which is a number of characters that if different between the old and new are enough to accept the new password, this defaults to 10 or 1/2 the size of the new password whichever is smaller\. .sp To avoid the lockup associated with trying to change a long and complicated password, \fBdifignore\fR -is available. This argument can be used to specify the minimum length a new password needs to be before the +is available\. This argument can be used to specify the minimum length a new password needs to be before the \fBdifok\fR -value is ignored. The default value for +value is ignored\. The default value for \fBdifignore\fR -is 23. +is 23\. .RE .PP Simple @@ -61,7 +61,7 @@ Is the new password too small? This is controlled by 5 arguments \fBdcredit\fR, \fBucredit\fR, \fBlcredit\fR, and -\fBocredit\fR. See the section on the arguments for the details of how these work and there defaults. +\fBocredit\fR\. See the section on the arguments for the details of how these work and there defaults\. .RE .PP Rotated @@ -72,10 +72,10 @@ Is the new password a rotated version of the old password? Already used .RS 4 Was the password used in the past? Previously used passwords are to be found in -\fI/etc/security/opasswd\fR. +\fI/etc/security/opasswd\fR\. .RE .PP -This module with no arguments will work well for standard unix password encryption. With md5 encryption, passwords can be longer than 8 characters and the default settings for this module can make it hard for the user to choose a satisfactory new password. Notably, the requirement that the new password contain no more than 1/2 of the characters in the old password becomes a non\-trivial constraint. For example, an old password of the form "the quick brown fox jumped over the lazy dogs" would be difficult to change... In addition, the default action is to allow passwords as small as 5 characters in length. For a md5 systems it can be a good idea to increase the required minimum size of a password. One can then allow more credit for different kinds of characters but accept that the new password may share most of these characters with the old password. +This module with no arguments will work well for standard unix password encryption\. With md5 encryption, passwords can be longer than 8 characters and the default settings for this module can make it hard for the user to choose a satisfactory new password\. Notably, the requirement that the new password contain no more than 1/2 of the characters in the old password becomes a non\-trivial constraint\. For example, an old password of the form "the quick brown fox jumped over the lazy dogs" would be difficult to change\.\.\. In addition, the default action is to allow passwords as small as 5 characters in length\. For a md5 systems it can be a good idea to increase the required minimum size of a password\. One can then allow more credit for different kinds of characters but accept that the new password may share most of these characters with the old password\. .SH "OPTIONS" .PP .PP @@ -83,21 +83,21 @@ This module with no arguments will work well for standard unix password encrypti .RS 4 This option makes the module write information to \fBsyslog\fR(3) -indicating the behavior of the module (this option does not write password information to the log file). +indicating the behavior of the module (this option does not write password information to the log file)\. .RE .PP \fBtype=\fR\fB\fIXXX\fR\fR .RS 4 -The default action is for the module to use the following prompts when requesting passwords: "New UNIX password: " and "Retype UNIX password: ". The default word +The default action is for the module to use the following prompts when requesting passwords: "New UNIX password: " and "Retype UNIX password: "\. The default word \fIUNIX\fR -can be replaced with this option. +can be replaced with this option\. .RE .PP \fBretry=\fR\fB\fIN\fR\fR .RS 4 Prompt user at most \fIN\fR -times before returning with error. The default is +times before returning with error\. The default is \fI1\fR .RE .PP @@ -105,98 +105,98 @@ times before returning with error. The default is .RS 4 This argument will change the default of \fI5\fR -for the number of characters in the new password that must not be present in the old password. In addition, if 1/2 of the characters in the new password are different then the new password will be accepted anyway. +for the number of characters in the new password that must not be present in the old password\. In addition, if 1/2 of the characters in the new password are different then the new password will be accepted anyway\. .RE .PP \fBdifignore=\fR\fB\fIN\fR\fR .RS 4 -How many characters should the password have before difok will be ignored. The default is -\fI23\fR. +How many characters should the password have before difok will be ignored\. The default is +\fI23\fR\. .RE .PP \fBminlen=\fR\fB\fIN\fR\fR .RS 4 -The minimum acceptable size for the new password (plus one if credits are not disabled which is the default). In addition to the number of characters in the new password, credit (of +1 in length) is given for each different kind of character (\fIother\fR, +The minimum acceptable size for the new password (plus one if credits are not disabled which is the default)\. In addition to the number of characters in the new password, credit (of +1 in length) is given for each different kind of character (\fIother\fR, \fIupper\fR, \fIlower\fR and -\fIdigit\fR). The default for this parameter is +\fIdigit\fR)\. The default for this parameter is \fI9\fR -which is good for a old style UNIX password all of the same type of character but may be too low to exploit the added security of a md5 system. Note that there is a pair of length limits in +which is good for a old style UNIX password all of the same type of character but may be too low to exploit the added security of a md5 system\. Note that there is a pair of length limits in \fICracklib\fR itself, a "way too short" limit of 4 which is hard coded in and a defined limit (6) that will be checked without reference to -\fBminlen\fR. If you want to allow passwords as short as 5 characters you should not use this module. +\fBminlen\fR\. If you want to allow passwords as short as 5 characters you should not use this module\. .RE .PP \fBdcredit=\fR\fB\fIN\fR\fR .RS 4 -(N >= 0) This is the maximum credit for having digits in the new password. If you have less than or +(N >= 0) This is the maximum credit for having digits in the new password\. If you have less than or \fIN\fR digits, each digit will count +1 towards meeting the current \fBminlen\fR -value. The default for +value\. The default for \fBdcredit\fR is 1 which is the recommended value for \fBminlen\fR -less than 10. +less than 10\. .sp -(N < 0) This is the minimum number of digits that must be met for a new password. +(N < 0) This is the minimum number of digits that must be met for a new password\. .RE .PP \fBucredit=\fR\fB\fIN\fR\fR .RS 4 -(N >= 0) This is the maximum credit for having upper case letters in the new password. If you have less than or +(N >= 0) This is the maximum credit for having upper case letters in the new password\. If you have less than or \fIN\fR upper case letters each letter will count +1 towards meeting the current \fBminlen\fR -value. The default for +value\. The default for \fBucredit\fR is \fI1\fR which is the recommended value for \fBminlen\fR -less than 10. +less than 10\. .sp -(N > 0) This is the minimum number of upper case letters that must be met for a new password. +(N > 0) This is the minimum number of upper case letters that must be met for a new password\. .RE .PP \fBlcredit=\fR\fB\fIN\fR\fR .RS 4 -(N >= 0) This is the maximum credit for having lower case letters in the new password. If you have less than or +(N >= 0) This is the maximum credit for having lower case letters in the new password\. If you have less than or \fIN\fR lower case letters, each letter will count +1 towards meeting the current \fBminlen\fR -value. The default for +value\. The default for \fBlcredit\fR is 1 which is the recommended value for \fBminlen\fR -less than 10. +less than 10\. .sp -(N < 0) This is the minimum number of lower case letters that must be met for a new password. +(N < 0) This is the minimum number of lower case letters that must be met for a new password\. .RE .PP \fBocredit=\fR\fB\fIN\fR\fR .RS 4 -(N >= 0) This is the maximum credit for having other characters in the new password. If you have less than or +(N >= 0) This is the maximum credit for having other characters in the new password\. If you have less than or \fIN\fR other characters, each character will count +1 towards meeting the current \fBminlen\fR -value. The default for +value\. The default for \fBocredit\fR is 1 which is the recommended value for \fBminlen\fR -less than 10. +less than 10\. .sp -(N < 0) This is the minimum number of other characters that must be met for a new password. +(N < 0) This is the minimum number of other characters that must be met for a new password\. .RE .PP \fBminclass=\fR\fB\fIN\fR\fR .RS 4 -The minimum number of required classes of characters for the new password. The default number is zero. The four classes are digits, upper and lower letters and other characters. The difference to the +The minimum number of required classes of characters for the new password\. The default number is zero\. The four classes are digits, upper and lower letters and other characters\. The difference to the \fBcredit\fR -check is that a specific class if of characters is not required. Instead +check is that a specific class if of characters is not required\. Instead \fIN\fR -out of four of the classes are required. +out of four of the classes are required\. .RE .PP \fBuse_authtok\fR @@ -205,41 +205,41 @@ This argument is used to \fIforce\fR the module to not prompt the user for a new password but use the one provided by the previously stacked \fIpassword\fR -module. +module\. .RE .PP \fBdictpath=\fR\fB\fI/path/to/dict\fR\fR .RS 4 -Path to the cracklib dictionaries. +Path to the cracklib dictionaries\. .RE .SH "MODULE SERVICES PROVIDED" .PP Only he \fBpassword\fR -service is supported. +service is supported\. .SH "RETURN VALUES" .PP .PP PAM_SUCCESS .RS 4 -The new password passes all checks. +The new password passes all checks\. .RE .PP PAM_AUTHTOK_ERR .RS 4 -No new password was entered, the username could not be determined or the new password fails the strength checks. +No new password was entered, the username could not be determined or the new password fails the strength checks\. .RE .PP PAM_AUTHTOK_RECOVERY_ERR .RS 4 -The old password was not supplied by a previous stackked module or got not requested from the user. The first error can happen if +The old password was not supplied by a previous stacked module or got not requested from the user\. The first error can happen if \fBuse_authtok\fR -is specified. +is specified\. .RE .PP PAM_SERVICE_ERR .RS 4 -A internal error occured. +A internal error occured\. .RE .SH "EXAMPLES" .PP @@ -249,53 +249,51 @@ For an example of the use of this module, we show how it may be stacked with the .RS 4 .nf # -# These lines stack two password type modules. In this example the -# user is given 3 opportunities to enter a strong password. The +# These lines stack two password type modules\. In this example the +# user is given 3 opportunities to enter a strong password\. The # "use_authtok" argument ensures that the pam_unix module does not # prompt for a password, but instead uses the one provided by -# pam_cracklib. +# pam_cracklib\. # -passwd password required pam_cracklib.so retry=3 -passwd password required pam_unix.so use_authtok +passwd password required pam_cracklib\.so retry=3 +passwd password required pam_unix\.so use_authtok .fi .RE -.sp .PP Another example (in the -\fI/etc/pam.d/passwd\fR +\fI/etc/pam\.d/passwd\fR format) is for the case that you want to use md5 password encryption: .sp .RS 4 .nf -#%PAM\-1.0 +#%PAM\-1\.0 # # These lines allow a md5 systems to support passwords of at least 14 # bytes with extra credit of 2 for digits and 2 for others the new # password must have at least three bytes that are not present in the # old password # -password required pam_cracklib.so \\ +password required pam_cracklib\.so \e difok=3 minlen=15 dcredit= 2 ocredit=2 -password required pam_unix.so use_authtok nullok md5 +password required pam_unix\.so use_authtok nullok md5 .fi .RE -.sp .PP -And here is another example in case you don't want to use credits: +And here is another example in case you don\'t want to use credits: .sp .RS 4 .nf -#%PAM\-1.0 +#%PAM\-1\.0 # # These lines require the user to select a password with a minimum # length of 8 and with at least 1 digit number, 1 upper case letter, # and 1 other character # -password required pam_cracklib.so \\ +password required pam_cracklib\.so \e dcredit=\-1 ucredit=\-1 ocredit=\-1 lcredit=0 minlen=8 -password required pam_unix.so use_authtok nullok md5 +password required pam_unix\.so use_authtok nullok md5 .fi .RE @@ -308,4 +306,4 @@ password required pam_unix.so use_authtok nullok md5 \fBpam\fR(8) .SH "AUTHOR" .PP -pam_cracklib was written by Cristian Gafton <gafton@redhat.com> +pam_cracklib was written by Cristian Gafton <gafton@redhat\.com> diff --git a/Linux-PAM/modules/pam_cracklib/pam_cracklib.8.xml b/Linux-PAM/modules/pam_cracklib/pam_cracklib.8.xml index f97ad8fb..589e7b44 100644 --- a/Linux-PAM/modules/pam_cracklib/pam_cracklib.8.xml +++ b/Linux-PAM/modules/pam_cracklib/pam_cracklib.8.xml @@ -412,7 +412,7 @@ <term>PAM_AUTHTOK_RECOVERY_ERR</term> <listitem> <para> - The old password was not supplied by a previous stackked + The old password was not supplied by a previous stacked module or got not requested from the user. The first error can happen if <option>use_authtok</option> is specified. diff --git a/Linux-PAM/modules/pam_debug/pam_debug.8 b/Linux-PAM/modules/pam_debug/pam_debug.8 index ae4a1407..a50b9bfe 100644 --- a/Linux-PAM/modules/pam_debug/pam_debug.8 +++ b/Linux-PAM/modules/pam_debug/pam_debug.8 @@ -1,53 +1,62 @@ .\" Title: pam_debug .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/> -.\" Date: 06/23/2006 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "PAM_DEBUG" "8" "06/23/2006" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_DEBUG" "8" "01/08/2008" "Linux-PAM Manual" "Linux\-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_debug \- PAM module to debug the PAM stack +pam_debug - PAM module to debug the PAM stack .SH "SYNOPSIS" .HP 13 -\fBpam_debug.so\fR [auth=\fIvalue\fR] [cred=\fIvalue\fR] [acct=\fIvalue\fR] [prechauthtok=\fIvalue\fR] [chauthtok=\fIvalue\fR] [auth=\fIvalue\fR] [open_session=\fIvalue\fR] [close_session=\fIvalue\fR] +\fBpam_debug\.so\fR [auth=\fIvalue\fR] [cred=\fIvalue\fR] [acct=\fIvalue\fR] [prechauthtok=\fIvalue\fR] [chauthtok=\fIvalue\fR] [auth=\fIvalue\fR] [open_session=\fIvalue\fR] [close_session=\fIvalue\fR] .SH "DESCRIPTION" .PP -The pam_debug PAM module is intended as a debugging aide for determining how the PAM stack is operating. This module returns what its module arguments tell it to return. +The pam_debug PAM module is intended as a debugging aide for determining how the PAM stack is operating\. This module returns what its module arguments tell it to return\. .SH "OPTIONS" -.TP 3n +.PP \fBauth=\fR\fB\fIvalue\fR\fR +.RS 4 The \fBpam_sm_authenticate\fR(3) function will return -\fIvalue\fR. -.TP 3n +\fIvalue\fR\. +.RE +.PP \fBcred=\fR\fB\fIvalue\fR\fR +.RS 4 The \fBpam_sm_setcred\fR(3) function will return -\fIvalue\fR. -.TP 3n +\fIvalue\fR\. +.RE +.PP \fBacct=\fR\fB\fIvalue\fR\fR +.RS 4 The \fBpam_sm_acct_mgmt\fR(3) function will return -\fIvalue\fR. -.TP 3n +\fIvalue\fR\. +.RE +.PP \fBprechauthtok=\fR\fB\fIvalue\fR\fR +.RS 4 The \fBpam_sm_chauthtok\fR(3) function will return \fIvalue\fR if the \fIPAM_PRELIM_CHECK\fR -flag is set. -.TP 3n +flag is set\. +.RE +.PP \fBchauthtok=\fR\fB\fIvalue\fR\fR +.RS 4 The \fBpam_sm_chauthtok\fR(3) function will return @@ -56,23 +65,28 @@ if the \fIPAM_PRELIM_CHECK\fR flag is \fBnot\fR -set. -.TP 3n +set\. +.RE +.PP \fBopen_session=\fR\fB\fIvalue\fR\fR +.RS 4 The \fBpam_sm_open_session\fR(3) function will return -\fIvalue\fR. -.TP 3n +\fIvalue\fR\. +.RE +.PP \fBclose_session=\fR\fB\fIvalue\fR\fR +.RS 4 The \fBpam_sm_close_session\fR(3) function will return -\fIvalue\fR. +\fIvalue\fR\. +.RE .PP Where \fIvalue\fR -can be one of: success, open_err, symbol_err, service_err, system_err, buf_err, perm_denied, auth_err, cred_insufficient, authinfo_unavail, user_unknown, maxtries, new_authtok_reqd, acct_expired, session_err, cred_unavail, cred_expired, cred_err, no_module_data, conv_err, authtok_err, authtok_recover_err, authtok_lock_busy, authtok_disable_aging, try_again, ignore, abort, authtok_expired, module_unknown, bad_item, conv_again, incomplete. +can be one of: success, open_err, symbol_err, service_err, system_err, buf_err, perm_denied, auth_err, cred_insufficient, authinfo_unavail, user_unknown, maxtries, new_authtok_reqd, acct_expired, session_err, cred_unavail, cred_expired, cred_err, no_module_data, conv_err, authtok_err, authtok_recover_err, authtok_lock_busy, authtok_disable_aging, try_again, ignore, abort, authtok_expired, module_unknown, bad_item, conv_again, incomplete\. .SH "MODULE SERVICES PROVIDED" .PP The services @@ -81,21 +95,23 @@ The services \fBpassword\fR and \fBsession\fR -are supported. +are supported\. .SH "RETURN VALUES" -.TP 3n +.PP PAM_SUCCESS -Default return code if no other value was specified, else specified return value. +.RS 4 +Default return code if no other value was specified, else specified return value\. +.RE .SH "EXAMPLES" .sp -.RS 3n +.RS 4 .nf -auth requisite pam_permit.so -auth [success=2 default=ok] pam_debug.so auth=perm_denied cred=success -auth [default=reset] pam_debug.so auth=success cred=perm_denied -auth [success=done default=die] pam_debug.so -auth optional pam_debug.so auth=perm_denied cred=perm_denied -auth sufficient pam_debug.so auth=success cred=success +auth requisite pam_permit\.so +auth [success=2 default=ok] pam_debug\.so auth=perm_denied cred=success +auth [default=reset] pam_debug\.so auth=success cred=perm_denied +auth [success=done default=die] pam_debug\.so +auth optional pam_debug\.so auth=perm_denied cred=perm_denied +auth sufficient pam_debug\.so auth=success cred=success .fi .RE @@ -107,4 +123,4 @@ auth sufficient pam_debug.so auth=success cred=success \fBpam\fR(8) .SH "AUTHOR" .PP -pam_debug was written by Andrew G. Morgan <morgan@kernel.org>. +pam_debug was written by Andrew G\. Morgan <morgan@kernel\.org>\. diff --git a/Linux-PAM/modules/pam_deny/pam_deny.8 b/Linux-PAM/modules/pam_deny/pam_deny.8 index f9f2d439..7e078d34 100644 --- a/Linux-PAM/modules/pam_deny/pam_deny.8 +++ b/Linux-PAM/modules/pam_deny/pam_deny.8 @@ -1,65 +1,73 @@ .\" Title: pam_deny .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/> -.\" Date: 06/21/2006 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "PAM_DENY" "8" "06/21/2006" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_DENY" "8" "01/08/2008" "Linux-PAM Manual" "Linux\-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_deny \- The locking\-out PAM module +pam_deny - The locking-out PAM module .SH "SYNOPSIS" .HP 12 -\fBpam_deny.so\fR +\fBpam_deny\.so\fR .SH "DESCRIPTION" .PP -This module can be used to deny access. It always indicates a failure to the application through the PAM framework. It might be suitable for using for default (the -\fIOTHER\fR) entries. +This module can be used to deny access\. It always indicates a failure to the application through the PAM framework\. It might be suitable for using for default (the +\fIOTHER\fR) entries\. .SH "OPTIONS" .PP -This module does not recognice any options. +This module does not recognise any options\. .SH "MODULE SERVICES PROVIDED" .PP All services (\fBaccount\fR, \fBauth\fR, \fBpassword\fR and -\fBsession\fR) are supported. +\fBsession\fR) are supported\. .SH "RETURN VALUES" .PP -.TP 3n +.PP PAM_AUTH_ERR -This is returned by the account and auth services. -.TP 3n +.RS 4 +This is returned by the account and auth services\. +.RE +.PP PAM_CRED_ERR -This is returned by the setcred function. -.TP 3n +.RS 4 +This is returned by the setcred function\. +.RE +.PP PAM_AUTHTOK_ERR -This is returned by the password service. -.TP 3n +.RS 4 +This is returned by the password service\. +.RE +.PP PAM_SESSION_ERR -This is returned by the session service. +.RS 4 +This is returned by the session service\. +.RE .SH "EXAMPLES" .sp -.RS 3n +.RS 4 .nf -#%PAM\-1.0 +#%PAM\-1\.0 # -# If we don't have config entries for a service, the -# OTHER entries are used. To be secure, warn and deny -# access to everything. -other auth required pam_warn.so -other auth required pam_deny.so -other account required pam_warn.so -other account required pam_deny.so -other password required pam_warn.so -other password required pam_deny.so -other session required pam_warn.so -other session required pam_deny.so +# If we don\'t have config entries for a service, the +# OTHER entries are used\. To be secure, warn and deny +# access to everything\. +other auth required pam_warn\.so +other auth required pam_deny\.so +other account required pam_warn\.so +other account required pam_deny\.so +other password required pam_warn\.so +other password required pam_deny\.so +other session required pam_warn\.so +other session required pam_deny\.so .fi .RE @@ -71,4 +79,4 @@ other session required pam_deny.so \fBpam\fR(8) .SH "AUTHOR" .PP -pam_deny was written by Andrew G. Morgan <morgan@kernel.org> +pam_deny was written by Andrew G\. Morgan <morgan@kernel\.org> diff --git a/Linux-PAM/modules/pam_deny/pam_deny.8.xml b/Linux-PAM/modules/pam_deny/pam_deny.8.xml index 91916003..e50beb2d 100644 --- a/Linux-PAM/modules/pam_deny/pam_deny.8.xml +++ b/Linux-PAM/modules/pam_deny/pam_deny.8.xml @@ -35,7 +35,7 @@ <refsect1 id="pam_deny-options"> <title>OPTIONS</title> - <para>This module does not recognice any options.</para> + <para>This module does not recognise any options.</para> </refsect1> <refsect1 id="pam_deny-services"> diff --git a/Linux-PAM/modules/pam_echo/pam_echo.8 b/Linux-PAM/modules/pam_echo/pam_echo.8 index 423a8e1b..7c996d89 100644 --- a/Linux-PAM/modules/pam_echo/pam_echo.8 +++ b/Linux-PAM/modules/pam_echo/pam_echo.8 @@ -1,78 +1,98 @@ .\" Title: pam_echo .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/> -.\" Date: 06/21/2006 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "PAM_ECHO" "8" "06/21/2006" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_ECHO" "8" "01/08/2008" "Linux-PAM Manual" "Linux-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_echo \- PAM module for printing text messages +pam_echo - PAM module for printing text messages .SH "SYNOPSIS" .HP 12 -\fBpam_echo.so\fR [file=\fI/path/message\fR] +\fBpam_echo\.so\fR [file=\fI/path/message\fR] .SH "DESCRIPTION" .PP The \fIpam_echo\fR -PAM module is for printing text messages to inform user about special things. Sequences starting with the +PAM module is for printing text messages to inform user about special things\. Sequences starting with the \fI%\fR character are interpreted in the following way: -.TP 3n +.PP \fI%H\fR -The name of the remote host (PAM_RHOST). -.TP 3n +.RS 4 +The name of the remote host (PAM_RHOST)\. +.RE +.PP \fB%h\fR -The name of the local host. -.TP 3n +.RS 4 +The name of the local host\. +.RE +.PP \fI%s\fR -The service name (PAM_SERVICE). -.TP 3n +.RS 4 +The service name (PAM_SERVICE)\. +.RE +.PP \fI%t\fR -The name of the controlling terminal (PAM_TTY). -.TP 3n +.RS 4 +The name of the controlling terminal (PAM_TTY)\. +.RE +.PP \fI%U\fR -The remote user name (PAM_RUSER). -.TP 3n +.RS 4 +The remote user name (PAM_RUSER)\. +.RE +.PP \fI%u\fR -The local user name (PAM_USER). +.RS 4 +The local user name (PAM_USER)\. +.RE .PP All other sequences beginning with \fI%\fR expands to the characters following the \fI%\fR -character. +character\. .SH "OPTIONS" -.TP 3n +.PP \fBfile=\fR\fB\fI/path/message\fR\fR +.RS 4 The content of the file \fI/path/message\fR -will be printed with the PAM conversion function as PAM_TEXT_INFO. +will be printed with the PAM conversion function as PAM_TEXT_INFO\. +.RE .SH "MODULE SERVICES PROVIDED" .PP -All services are supported. +All services are supported\. .SH "RETURN VALUES" -.TP 3n +.PP PAM_BUF_ERR -Memory buffer error. -.TP 3n +.RS 4 +Memory buffer error\. +.RE +.PP PAM_SUCCESS -Message was successful printed. -.TP 3n +.RS 4 +Message was successful printed\. +.RE +.PP PAM_IGNORE -PAM_SILENT flag was given or message file does not exist, no message printed. +.RS 4 +PAM_SILENT flag was given or message file does not exist, no message printed\. +.RE .SH "EXAMPLES" .PP For an example of the use of this module, we show how it may be used to print informations about good passwords: .sp -.RS 3n +.RS 4 .nf -password optional pam_echo.so file=/usr/share/doc/good\-password.txt -password required pam_unix.so +password optional pam_echo\.so file=/usr/share/doc/good\-password\.txt +password required pam_unix\.so .fi .RE @@ -85,4 +105,4 @@ password required pam_unix.so \fBpam\fR(8) .SH "AUTHOR" .PP -Thorsten Kukuk <kukuk@thkukuk.de> +Thorsten Kukuk <kukuk@thkukuk\.de> diff --git a/Linux-PAM/modules/pam_env/pam_env.8 b/Linux-PAM/modules/pam_env/pam_env.8 index e7746de3..9d3a9d59 100644 --- a/Linux-PAM/modules/pam_env/pam_env.8 +++ b/Linux-PAM/modules/pam_env/pam_env.8 @@ -1,89 +1,109 @@ .\" Title: pam_env .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/> -.\" Date: 06/21/2006 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "PAM_ENV" "8" "06/21/2006" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_ENV" "8" "01/08/2008" "Linux-PAM Manual" "Linux-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_env \- PAM module to set/unset environment variables +pam_env - PAM module to set/unset environment variables .SH "SYNOPSIS" .HP 11 -\fBpam_env.so\fR [debug] [conffile=\fIconf\-file\fR] [envfile=\fIenv\-file\fR] [readenv=\fI0|1\fR] +\fBpam_env\.so\fR [debug] [conffile=\fIconf\-file\fR] [envfile=\fIenv\-file\fR] [readenv=\fI0|1\fR] .SH "DESCRIPTION" .PP -The pam_env PAM module allows the (un)setting of environment variables. Supported is the use of previously set environment variables as well as +The pam_env PAM module allows the (un)setting of environment variables\. Supported is the use of previously set environment variables as well as \fIPAM_ITEM\fRs such as -\fIPAM_RHOST\fR. +\fIPAM_RHOST\fR\. .PP By default rules for (un)setting of variables is taken from the config file -\fI/etc/security/pam_env.conf\fR -if no other file is specified. +\fI/etc/security/pam_env\.conf\fR +if no other file is specified\. .PP This module can also parse a file with simple \fIKEY=VAL\fR pairs on seperate lines (\fI/etc/environment\fR -by default). You can change the default file to parse, with the +by default)\. You can change the default file to parse, with the \fIenvfile\fR flag and turn it on or off by setting the \fIreadenv\fR -flag to 1 or 0 respectively. +flag to 1 or 0 respectively\. .SH "OPTIONS" -.TP 3n -\fBconffile=\fR\fB\fI/path/to/pam_env.conf\fR\fR +.PP +\fBconffile=\fR\fB\fI/path/to/pam_env\.conf\fR\fR +.RS 4 Indicate an alternative -\fIpam_env.conf\fR -style configuration file to override the default. This can be useful when different services need different environments. -.TP 3n +\fIpam_env\.conf\fR +style configuration file to override the default\. This can be useful when different services need different environments\. +.RE +.PP \fBdebug\fR +.RS 4 A lot of debug informations are printed with -\fBsyslog\fR(3). -.TP 3n +\fBsyslog\fR(3)\. +.RE +.PP \fBenvfile=\fR\fB\fI/path/to/environment\fR\fR +.RS 4 Indicate an alternative \fIenvironment\fR -file to override the default. This can be useful when different services need different environments. -.TP 3n +file to override the default\. This can be useful when different services need different environments\. +.RE +.PP \fBreadenv=\fR\fB\fI0|1\fR\fR -Turns on or off the reading of the file specified by envfile (0 is off, 1 is on). By default this option is on. +.RS 4 +Turns on or off the reading of the file specified by envfile (0 is off, 1 is on)\. By default this option is on\. +.RE .SH "MODULE SERVICES PROVIDED" .PP The \fBauth\fR and \fBsession\fR -services are supported. +services are supported\. .SH "RETURN VALUES" -.TP 3n +.PP PAM_ABORT -Not all relevant data or options could be gotten. -.TP 3n +.RS 4 +Not all relevant data or options could be gotten\. +.RE +.PP PAM_BUF_ERR -Memory buffer error. -.TP 3n +.RS 4 +Memory buffer error\. +.RE +.PP PAM_IGNORE -No pam_env.conf and environment file was found. -.TP 3n +.RS 4 +No pam_env\.conf and environment file was found\. +.RE +.PP PAM_SUCCESS -Environment variables were set. +.RS 4 +Environment variables were set\. +.RE .SH "FILES" -.TP 3n -\fI/etc/security/pam_env.conf\fR +.PP +\fI/etc/security/pam_env\.conf\fR +.RS 4 Default configuration file -.TP 3n +.RE +.PP \fI/etc/environment\fR +.RS 4 Default environment file +.RE .SH "SEE ALSO" .PP \fBpam_env.conf\fR(5), \fBpam.d\fR(8), -\fBpam\fR(8). +\fBpam\fR(8)\. .SH "AUTHOR" .PP -pam_env was written by Dave Kinchlea <kinch@kinch.ark.com>. +pam_env was written by Dave Kinchlea <kinch@kinch\.ark\.com>\. diff --git a/Linux-PAM/modules/pam_env/pam_env.conf.5 b/Linux-PAM/modules/pam_env/pam_env.conf.5 index 17c1a19d..3840407f 100644 --- a/Linux-PAM/modules/pam_env/pam_env.conf.5 +++ b/Linux-PAM/modules/pam_env/pam_env.conf.5 @@ -1,41 +1,41 @@ .\" Title: pam_env.conf .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/> -.\" Date: 06/21/2006 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "PAM_ENV.CONF" "5" "06/21/2006" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_ENV\.CONF" "5" "01/08/2008" "Linux-PAM Manual" "Linux\-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_env.conf \- the environment variables config file +pam_env.conf - the environment variables config file .SH "DESCRIPTION" .PP The -\fI/etc/security/pam_env.conf\fR +\fI/etc/security/pam_env\.conf\fR file specifies the environment variables to be set, unset or modified by -\fBpam_env\fR(8). When someone logs in, this file is read and the environment variables are set according. +\fBpam_env\fR(8)\. When someone logs in, this file is read and the environment variables are set according\. .PP -Each line starts with the variable name, there are then two possible options for each variable DEFAULT and OVERRIDE. DEFAULT allows and administrator to set the value of the variable to some default value, if none is supplied then the empty string is assumed. The OVERRIDE option tells pam_env that it should enter in its value (overriding the default value) if there is one to use. OVERRIDE is not used, "" is assumed and no override will be done. +Each line starts with the variable name, there are then two possible options for each variable DEFAULT and OVERRIDE\. DEFAULT allows and administrator to set the value of the variable to some default value, if none is supplied then the empty string is assumed\. The OVERRIDE option tells pam_env that it should enter in its value (overriding the default value) if there is one to use\. OVERRIDE is not used, "" is assumed and no override will be done\. .PP \fIVARIABLE\fR [\fIDEFAULT=[value]\fR] [\fIOVERRIDE=[value]\fR] .PP -(Possibly non\-existent) environment variables may be used in values using the ${string} syntax and (possibly non\-existent) PAM_ITEMs may be used in values using the @{string} syntax. Both the $ and @ characters can be backslash escaped to be used as literal values values can be delimited with "", escaped " not supported. Note that many environment variables that you would like to use may not be set by the time the module is called. For example, HOME is used below several times, but many PAM applications don't make it available by the time you need it. +(Possibly non\-existent) environment variables may be used in values using the ${string} syntax and (possibly non\-existent) PAM_ITEMs may be used in values using the @{string} syntax\. Both the $ and @ characters can be backslash escaped to be used as literal values values can be delimited with "", escaped " not supported\. Note that many environment variables that you would like to use may not be set by the time the module is called\. For example, HOME is used below several times, but many PAM applications don\'t make it available by the time you need it\. .PP -The "\fI#\fR" character at start of line (no space at front) can be used to mark this line as a comment line. +The "\fI#\fR" character at start of line (no space at front) can be used to mark this line as a comment line\. .SH "EXAMPLES" .PP These are some example lines which might be specified in -\fI/etc/security/pam_env.conf\fR. +\fI/etc/security/pam_env\.conf\fR\. .PP Set the REMOTEHOST variable for any hosts that are remote, default to "localhost" rather than not being set at all .sp -.RS 3n +.RS 4 .nf REMOTEHOST DEFAULT=localhost OVERRIDE=@{PAM_RHOST} @@ -44,35 +44,35 @@ Set the REMOTEHOST variable for any hosts that are remote, default to "localhost .PP Set the DISPLAY variable if it seems reasonable .sp -.RS 3n +.RS 4 .nf - DISPLAY DEFAULT=${REMOTEHOST}:0.0 OVERRIDE=${DISPLAY} + DISPLAY DEFAULT=${REMOTEHOST}:0\.0 OVERRIDE=${DISPLAY} .fi .RE .PP Now some simple variables .sp -.RS 3n +.RS 4 .nf PAGER DEFAULT=less MANPAGER DEFAULT=less LESS DEFAULT="M q e h15 z23 b80" NNTPSERVER DEFAULT=localhost - PATH DEFAULT=${HOME}/bin:/usr/local/bin:/bin\\ + PATH DEFAULT=${HOME}/bin:/usr/local/bin:/bin\e :/usr/bin:/usr/local/bin/X11:/usr/bin/X11 .fi .RE .PP -Silly examples of escaped variables, just to show how they work. +Silly examples of escaped variables, just to show how they work\. .sp -.RS 3n +.RS 4 .nf - DOLLAR DEFAULT=\\$ - DOLLARDOLLAR DEFAULT= OVERRIDE=\\$${DOLLAR} - DOLLARPLUS DEFAULT=\\${REMOTEHOST}${REMOTEHOST} - ATSIGN DEFAULT="" OVERRIDE=\\@ + DOLLAR DEFAULT=\e$ + DOLLARDOLLAR DEFAULT= OVERRIDE=\e$${DOLLAR} + DOLLARPLUS DEFAULT=\e${REMOTEHOST}${REMOTEHOST} + ATSIGN DEFAULT="" OVERRIDE=\e@ .fi .RE @@ -84,4 +84,4 @@ Silly examples of escaped variables, just to show how they work. \fBpam\fR(8) .SH "AUTHOR" .PP -pam_env was written by Dave Kinchlea <kinch@kinch.ark.com>. +pam_env was written by Dave Kinchlea <kinch@kinch\.ark\.com>\. diff --git a/Linux-PAM/modules/pam_exec/README b/Linux-PAM/modules/pam_exec/README index 8ff9a742..f0845205 100644 --- a/Linux-PAM/modules/pam_exec/README +++ b/Linux-PAM/modules/pam_exec/README @@ -6,6 +6,11 @@ DESCRIPTION pam_exec is a PAM module that can be used to run an external command. +The child's environment is set to the current PAM environment list, as returned +by pam_getenvlist(3) In addition, the following PAM items are exported as +environment variables: PAM_RHOST, PAM_RUSER, PAM_SERVICE, PAM_TTY, and PAM_USER +. + OPTIONS debug @@ -16,6 +21,11 @@ log=file The output of the command is appended to file +quiet + + Per default pam_exec.so will echo the exit status of the external command + if it fails. Specifying this option will suppress the message. + seteuid Per default pam_exec.so will execute the external command with the real diff --git a/Linux-PAM/modules/pam_exec/pam_exec.8 b/Linux-PAM/modules/pam_exec/pam_exec.8 index ae8f8a46..9ac2ccbb 100644 --- a/Linux-PAM/modules/pam_exec/pam_exec.8 +++ b/Linux-PAM/modules/pam_exec/pam_exec.8 @@ -1,35 +1,55 @@ .\" Title: pam_exec .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/> -.\" Date: 06/09/2006 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 02/04/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "PAM_EXEC" "8" "06/09/2006" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_EXEC" "8" "02/04/2008" "Linux-PAM Manual" "Linux\-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_exec \- PAM module which calls an external command +pam_exec - PAM module which calls an external command .SH "SYNOPSIS" .HP 12 -\fBpam_exec.so\fR [debug] [seteuid] [log=\fIfile\fR] \fIcommand\fR [\fI...\fR] +\fBpam_exec\.so\fR [debug] [seteuid] [quiet] [log=\fIfile\fR] \fIcommand\fR [\fI\.\.\.\fR] .SH "DESCRIPTION" .PP -pam_exec is a PAM module that can be used to run an external command. +pam_exec is a PAM module that can be used to run an external command\. +.PP +The child\'s environment is set to the current PAM environment list, as returned by +\fBpam_getenvlist\fR(3) +In addition, the following PAM items are exported as environment variables: +\fIPAM_RHOST\fR, +\fIPAM_RUSER\fR, +\fIPAM_SERVICE\fR, +\fIPAM_TTY\fR, and +\fIPAM_USER\fR\. .SH "OPTIONS" .PP -.TP 3n +.PP \fBdebug\fR -Print debug information. -.TP 3n +.RS 4 +Print debug information\. +.RE +.PP \fBlog=\fR\fB\fIfile\fR\fR +.RS 4 The output of the command is appended to \fIfile\fR -.TP 3n +.RE +.PP +\fBquiet\fR +.RS 4 +Per default pam_exec\.so will echo the exit status of the external command if it fails\. Specifying this option will suppress the message\. +.RE +.PP \fBseteuid\fR -Per default pam_exec.so will execute the external command with the real user ID of the calling process. Specifying this option means the command is run with the effective user ID. +.RS 4 +Per default pam_exec\.so will execute the external command with the real user ID of the calling process\. Specifying this option means the command is run with the effective user ID\. +.RE .SH "MODULE SERVICES PROVIDED" .PP The services @@ -38,45 +58,53 @@ The services \fBpassword\fR and \fBsession\fR -are supported. +are supported\. .SH "RETURN VALUES" .PP -.TP 3n +.PP PAM_SUCCESS -The external command runs successfull. -.TP 3n +.RS 4 +The external command runs successfull\. +.RE +.PP PAM_SERVICE_ERR -No argument or a wrong number of arguments were given. -.TP 3n +.RS 4 +No argument or a wrong number of arguments were given\. +.RE +.PP PAM_SYSTEM_ERR -A system error occured or the command to execute failed. -.TP 3n +.RS 4 +A system error occured or the command to execute failed\. +.RE +.PP PAM_IGNORE +.RS 4 \fBpam_setcred\fR -was called, which does not execute the command. +was called, which does not execute the command\. +.RE .SH "EXAMPLES" .PP Add the following line to -\fI/etc/pam.d/passwd\fR +\fI/etc/pam\.d/passwd\fR to rebuild the NIS database after each local password change: .sp -.RS 3n +.RS 4 .nf - passwd optional pam_exec.so seteuid make \-C /var/yp + passwd optional pam_exec\.so seteuid make \-C /var/yp .fi .RE .sp This will execute the command .sp -.RS 3n +.RS 4 .nf make \-C /var/yp .fi .RE .sp -with effective user ID. +with effective user ID\. .SH "SEE ALSO" .PP @@ -85,4 +113,4 @@ with effective user ID. \fBpam\fR(8) .SH "AUTHOR" .PP -pam_exec was written by Thorsten Kukuk <kukuk@thkukuk.de>. +pam_exec was written by Thorsten Kukuk <kukuk@thkukuk\.de>\. diff --git a/Linux-PAM/modules/pam_exec/pam_exec.8.xml b/Linux-PAM/modules/pam_exec/pam_exec.8.xml index 1e8bb0ba..f4dc1e15 100644 --- a/Linux-PAM/modules/pam_exec/pam_exec.8.xml +++ b/Linux-PAM/modules/pam_exec/pam_exec.8.xml @@ -25,6 +25,9 @@ seteuid </arg> <arg choice="opt"> + quiet + </arg> + <arg choice="opt"> log=<replaceable>file</replaceable> </arg> <arg choice="plain"> @@ -45,6 +48,18 @@ an external command. </para> + <para> + The child's environment is set to the current PAM environment list, as + returned by + <citerefentry> + <refentrytitle>pam_getenvlist</refentrytitle><manvolnum>3</manvolnum> + </citerefentry> + In addition, the following PAM items are + exported as environment variables: <emphasis>PAM_RHOST</emphasis>, + <emphasis>PAM_RUSER</emphasis>, <emphasis>PAM_SERVICE</emphasis>, + <emphasis>PAM_TTY</emphasis>, and <emphasis>PAM_USER</emphasis>. + </para> + </refsect1> <refsect1 id="pam_exec-options"> @@ -78,6 +93,19 @@ <varlistentry> <term> + <option>quiet</option> + </term> + <listitem> + <para> + Per default pam_exec.so will echo the exit status of the + external command if it fails. + Specifying this option will suppress the message. + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term> <option>seteuid</option> </term> <listitem> diff --git a/Linux-PAM/modules/pam_exec/pam_exec.c b/Linux-PAM/modules/pam_exec/pam_exec.c index 34ba7404..766c0a06 100644 --- a/Linux-PAM/modules/pam_exec/pam_exec.c +++ b/Linux-PAM/modules/pam_exec/pam_exec.c @@ -59,11 +59,24 @@ #include <security/pam_modutil.h> #include <security/pam_ext.h> +#define ENV_ITEM(n) { (n), #n } +static struct { + int item; + const char *name; +} env_items[] = { + ENV_ITEM(PAM_SERVICE), + ENV_ITEM(PAM_USER), + ENV_ITEM(PAM_TTY), + ENV_ITEM(PAM_RHOST), + ENV_ITEM(PAM_RUSER), +}; + static int call_exec (pam_handle_t *pamh, int argc, const char **argv) { int debug = 0; int call_setuid = 0; + int quiet = 0; int optargc; const char *logfile = NULL; pid_t pid; @@ -85,6 +98,8 @@ call_exec (pam_handle_t *pamh, int argc, const char **argv) logfile = &argv[optargc][4]; else if (strcasecmp (argv[optargc], "seteuid") == 0) call_setuid = 1; + else if (strcasecmp (argv[optargc], "quiet") == 0) + quiet = 1; else break; /* Unknown option, assume program to execute. */ } @@ -115,6 +130,7 @@ call_exec (pam_handle_t *pamh, int argc, const char **argv) { pam_syslog (pamh, LOG_ERR, "%s failed: exit code %d", argv[optargc], WEXITSTATUS(status)); + if (!quiet) pam_error (pamh, _("%s failed: exit code %d"), argv[optargc], WEXITSTATUS(status)); } @@ -123,6 +139,7 @@ call_exec (pam_handle_t *pamh, int argc, const char **argv) pam_syslog (pamh, LOG_ERR, "%s failed: caught signal %d%s", argv[optargc], WTERMSIG(status), WCOREDUMP(status) ? " (core dumped)" : ""); + if (!quiet) pam_error (pamh, _("%s failed: caught signal %d%s"), argv[optargc], WTERMSIG(status), WCOREDUMP(status) ? " (core dumped)" : ""); @@ -131,6 +148,7 @@ call_exec (pam_handle_t *pamh, int argc, const char **argv) { pam_syslog (pamh, LOG_ERR, "%s failed: unknown status 0x%x", argv[optargc], status); + if (!quiet) pam_error (pamh, _("%s failed: unknown status 0x%x"), argv[optargc], status); } @@ -208,22 +226,61 @@ call_exec (pam_handle_t *pamh, int argc, const char **argv) exit (ENOMEM); for (i = 0; i < (argc - optargc); i++) - arggv[i] = argv[i+optargc]; + arggv[i] = strdup(argv[i+optargc]); arggv[i] = NULL; + char **envlist, **tmp; + int envlen, nitems; + + /* + * Set up the child's environment list. It consists of the PAM + * environment, plus a few hand-picked PAM items. + */ + envlist = pam_getenvlist(pamh); + for (envlen = 0; envlist[envlen] != NULL; ++envlen) + /* nothing */ ; + nitems = sizeof(env_items) / sizeof(*env_items); + tmp = realloc(envlist, (envlen + nitems + 1) * sizeof(*envlist)); + if (tmp == NULL) + { + free(envlist); + pam_syslog (pamh, LOG_ERR, "realloc environment failed : %m"); + exit (ENOMEM); + } + envlist = tmp; + for (i = 0; i < nitems; ++i) + { + const void *item; + char *envstr; + + if (pam_get_item(pamh, env_items[i].item, &item) != PAM_SUCCESS || item == NULL) + continue; + asprintf(&envstr, "%s=%s", env_items[i].name, (const char *)item); + if (envstr == NULL) + { + free(envlist); + pam_syslog (pamh, LOG_ERR, "prepare environment failed : %m"); + exit (ENOMEM); + } + envlist[envlen++] = envstr; + envlist[envlen] = NULL; + } + if (debug) pam_syslog (pamh, LOG_DEBUG, "Calling %s ...", arggv[0]); - if (execv (arggv[0], arggv) == -1) + if (execve (arggv[0], arggv, envlist) == -1) { int err = errno; - pam_syslog (pamh, LOG_ERR, "execv(%s,...) failed: %m", + pam_syslog (pamh, LOG_ERR, "execve(%s,...) failed: %m", arggv[0]); + free(envlist); exit (err); } + free(envlist); exit (1); /* should never be reached. */ } - return PAM_SYSTEM_ERR; + return PAM_SYSTEM_ERR; /* will never be reached. */ } PAM_EXTERN int diff --git a/Linux-PAM/modules/pam_faildelay/pam_faildelay.8 b/Linux-PAM/modules/pam_faildelay/pam_faildelay.8 index 86eb031a..7e5312a4 100644 --- a/Linux-PAM/modules/pam_faildelay/pam_faildelay.8 +++ b/Linux-PAM/modules/pam_faildelay/pam_faildelay.8 @@ -1,54 +1,62 @@ .\" Title: pam_faildelay .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/> -.\" Date: 12/06/2006 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "PAM_FAILDELAY" "8" "12/06/2006" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_FAILDELAY" "8" "01/08/2008" "Linux-PAM Manual" "Linux\-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_faildelay \- Change the delay on failure per\-application +pam_faildelay - Change the delay on failure per-application .SH "SYNOPSIS" .HP 17 -\fBpam_faildelay.so\fR [debug] [delay=\fImicroseconds\fR] +\fBpam_faildelay\.so\fR [debug] [delay=\fImicroseconds\fR] .SH "DESCRIPTION" .PP -pam_faildelay is a PAM module that can be used to set the delay on failure per\-application. +pam_faildelay is a PAM module that can be used to set the delay on failure per\-application\. .PP If no \fBdelay\fR is given, pam_faildelay will use the value of FAIL_DELAY from -\fI/etc/login.defs\fR. +\fI/etc/login\.defs\fR\. .SH "OPTIONS" -.TP 3n +.PP \fBdebug\fR -Turns on debugging messages sent to syslog. -.TP 3n +.RS 4 +Turns on debugging messages sent to syslog\. +.RE +.PP \fBdelay=\fR\fB\fIN\fR\fR -Set the delay on failure to N microseconds. +.RS 4 +Set the delay on failure to N microseconds\. +.RE .SH "MODULE SERVICES PROVIDED" .PP Only the \fBauth\fR -service is supported. +service is supported\. .SH "RETURN VALUES" -.TP 3n +.PP PAM_IGNORE -Delay was successful adjusted. -.TP 3n +.RS 4 +Delay was successful adjusted\. +.RE +.PP PAM_SYSTEM_ERR -The specified delay was not valid. +.RS 4 +The specified delay was not valid\. +.RE .SH "EXAMPLES" .PP The following example will set the delay on failure to 10 seconds: .sp -.RS 3n +.RS 4 .nf -auth optional pam_faildelay.so delay=10000000 +auth optional pam_faildelay\.so delay=10000000 .fi .RE @@ -62,4 +70,4 @@ auth optional pam_faildelay.so delay=10000000 \fBpam\fR(8) .SH "AUTHOR" .PP -pam_faildelay was written by Darren Tucker <dtucker@zip.com.au>. +pam_faildelay was written by Darren Tucker <dtucker@zip\.com\.au>\. diff --git a/Linux-PAM/modules/pam_faildelay/pam_faildelay.c b/Linux-PAM/modules/pam_faildelay/pam_faildelay.c index 16cb7458..072b7dd3 100644 --- a/Linux-PAM/modules/pam_faildelay/pam_faildelay.c +++ b/Linux-PAM/modules/pam_faildelay/pam_faildelay.c @@ -216,7 +216,7 @@ int pam_sm_setcred(pam_handle_t *pamh UNUSED, int flags UNUSED, /* static module data */ -struct pam_module _pam_rootok_modstruct = { +struct pam_module _pam_faildelay_modstruct = { "pam_faildelay", pam_sm_authenticate, pam_sm_setcred, diff --git a/Linux-PAM/modules/pam_filter/pam_filter.8 b/Linux-PAM/modules/pam_filter/pam_filter.8 index 7def7fe9..5b91a4be 100644 --- a/Linux-PAM/modules/pam_filter/pam_filter.8 +++ b/Linux-PAM/modules/pam_filter/pam_filter.8 @@ -1,66 +1,73 @@ .\" Title: pam_filter .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/> -.\" Date: 06/09/2006 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "PAM_FILTER" "8" "06/09/2006" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_FILTER" "8" "01/08/2008" "Linux-PAM Manual" "Linux\-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_filter \- PAM filter module +pam_filter - PAM filter module .SH "SYNOPSIS" .HP 14 -\fBpam_filter.so\fR [debug] [new_term] [non_term] run1|run2 \fIfilter\fR [\fI...\fR] +\fBpam_filter\.so\fR [debug] [new_term] [non_term] run1|run2 \fIfilter\fR [\fI\.\.\.\fR] .SH "DESCRIPTION" .PP -This module is intended to be a platform for providing access to all of the input/output that passes between the user and the application. It is only suitable for tty\-based and (stdin/stdout) applications. +This module is intended to be a platform for providing access to all of the input/output that passes between the user and the application\. It is only suitable for tty\-based and (stdin/stdout) applications\. .PP To function this module requires \fIfilters\fR -to be installed on the system. The single filter provided with the module simply transposes upper and lower case letters in the input and output streams. (This can be very annoying and is not kind to termcap based editors). +to be installed on the system\. The single filter provided with the module simply transposes upper and lower case letters in the input and output streams\. (This can be very annoying and is not kind to termcap based editors)\. .PP -Each component of the module has the potential to invoke the desired filter. The filter is always +Each component of the module has the potential to invoke the desired filter\. The filter is always \fBexecv\fR(2) with the privilege of the calling application and \fInot\fR -that of the user. For this reason it cannot usually be killed by the user without closing their session. +that of the user\. For this reason it cannot usually be killed by the user without closing their session\. .SH "OPTIONS" .PP -.TP 3n +.PP \fBdebug\fR -Print debug information. -.TP 3n +.RS 4 +Print debug information\. +.RE +.PP \fBnew_term\fR +.RS 4 The default action of the filter is to set the \fIPAM_TTY\fR -item to indicate the terminal that the user is using to connect to the application. This argument indicates that the filter should set +item to indicate the terminal that the user is using to connect to the application\. This argument indicates that the filter should set \fIPAM_TTY\fR -to the filtered pseudo\-terminal. -.TP 3n +to the filtered pseudo\-terminal\. +.RE +.PP \fBnon_term\fR -don't try to set the +.RS 4 +don\'t try to set the \fIPAM_TTY\fR -item. -.TP 3n +item\. +.RE +.PP \fBrunX\fR -In order that the module can invoke a filter it should know when to invoke it. This argument is required to tell the filter when to do this. +.RS 4 +In order that the module can invoke a filter it should know when to invoke it\. This argument is required to tell the filter when to do this\. .sp Permitted values for \fIX\fR are \fI1\fR and -\fI2\fR. These indicate the precise time that the filter is to be run. To understand this concept it will be useful to have read the +\fI2\fR\. These indicate the precise time that the filter is to be run\. To understand this concept it will be useful to have read the \fBpam\fR(3) -manual page. Basically, for each management group there are up to two ways of calling the module's functions. In the case of the +manual page\. Basically, for each management group there are up to two ways of calling the module\'s functions\. In the case of the \fIauthentication\fR and \fIsession\fR -components there are actually two separate functions. For the case of authentication, these functions are +components there are actually two separate functions\. For the case of authentication, these functions are \fBpam_authenticate\fR(3) and \fBpam_setcred\fR(3), here @@ -70,20 +77,20 @@ means run the filter from the function and \fBrun2\fR means run the filter from -\fBpam_setcred\fR. In the case of the session modules, +\fBpam_setcred\fR\. In the case of the session modules, \fIrun1\fR implies that the filter is invoked at the \fBpam_open_session\fR(3) stage, and \fIrun2\fR for -\fBpam_close_session\fR(3). +\fBpam_close_session\fR(3)\. .sp -For the case of the account component. Either +For the case of the account component\. Either \fIrun1\fR or \fIrun2\fR -may be used. +may be used\. .sp For the case of the password component, \fIrun1\fR @@ -95,10 +102,13 @@ phase) and \fIrun2\fR is used to indicate that the filter is run on the second occasion (the \fIPAM_UPDATE_AUTHTOK\fR -phase). -.TP 3n +phase)\. +.RE +.PP \fBfilter\fR -The full pathname of the filter to be run and any command line arguments that the filter might expect. +.RS 4 +The full pathname of the filter to be run and any command line arguments that the filter might expect\. +.RE .SH "MODULE SERVICES PROVIDED" .PP The services @@ -107,24 +117,28 @@ The services \fBpassword\fR and \fBsession\fR -are supported. +are supported\. .SH "RETURN VALUES" .PP -.TP 3n +.PP PAM_SUCCESS -The new filter was set successfull. -.TP 3n +.RS 4 +The new filter was set successfull\. +.RE +.PP PAM_ABORT -Critical error, immediate abort. +.RS 4 +Critical error, immediate abort\. +.RE .SH "EXAMPLES" .PP Add the following line to -\fI/etc/pam.d/login\fR +\fI/etc/pam\.d/login\fR to see how to configure login to transpose upper and lower case letters once the user has logged in: .sp -.RS 3n +.RS 4 .nf - session required pam_filter.so run1 /lib/security/pam_filter/upperLOWER + session required pam_filter\.so run1 /lib/security/pam_filter/upperLOWER .fi .RE @@ -137,4 +151,4 @@ to see how to configure login to transpose upper and lower case letters once the \fBpam\fR(8) .SH "AUTHOR" .PP -pam_filter was written by Andrew G. Morgan <morgan@kernel.org>. +pam_filter was written by Andrew G\. Morgan <morgan@kernel\.org>\. diff --git a/Linux-PAM/modules/pam_filter/upperLOWER/upperLOWER.c b/Linux-PAM/modules/pam_filter/upperLOWER/upperLOWER.c index c0fc5b17..0ede4a0d 100644 --- a/Linux-PAM/modules/pam_filter/upperLOWER/upperLOWER.c +++ b/Linux-PAM/modules/pam_filter/upperLOWER/upperLOWER.c @@ -7,6 +7,7 @@ #include "config.h" +#include <ctype.h> #include <stdio.h> #include <stdlib.h> #include <syslog.h> @@ -15,14 +16,10 @@ #include <unistd.h> #include "pam_filter.h" -#include <security/pam_modules.h> -#include <security/_pam_macros.h> #include <security/pam_modutil.h> /* ---------------------------------------------------------------- */ -#include <ctype.h> - static void do_transpose(char *buffer,int len) { int i; diff --git a/Linux-PAM/modules/pam_ftp/pam_ftp.8 b/Linux-PAM/modules/pam_ftp/pam_ftp.8 index 0c730267..e07c9885 100644 --- a/Linux-PAM/modules/pam_ftp/pam_ftp.8 +++ b/Linux-PAM/modules/pam_ftp/pam_ftp.8 @@ -1,84 +1,94 @@ .\" Title: pam_ftp .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/> -.\" Date: 06/09/2006 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "PAM_FTP" "8" "06/09/2006" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_FTP" "8" "01/08/2008" "Linux-PAM Manual" "Linux\-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_ftp \- PAM module for anonymous access module +pam_ftp - PAM module for anonymous access module .SH "SYNOPSIS" .HP 11 -\fBpam_ftp.so\fR [debug] [ignore] [users=\fIXXX,YYY,\fR...] +\fBpam_ftp\.so\fR [debug] [ignore] [users=\fIXXX,YYY,\fR...] .SH "DESCRIPTION" .PP -pam_ftp is a PAM module which provides a pluggable anonymous ftp mode of access. +pam_ftp is a PAM module which provides a pluggable anonymous ftp mode of access\. .PP -This module intercepts the user's name and password. If the name is +This module intercepts the user\'s name and password\. If the name is \fIftp\fR or -\fIanonymous\fR, the user's password is broken up at the +\fIanonymous\fR, the user\'s password is broken up at the \fI@\fR delimiter into a \fIPAM_RUSER\fR and a \fIPAM_RHOST\fR -part; these pam\-items being set accordingly. The username (\fIPAM_USER\fR) is set to -\fIftp\fR. In this case the module succeeds. Alternatively, the module sets the +part; these pam\-items being set accordingly\. The username (\fIPAM_USER\fR) is set to +\fIftp\fR\. In this case the module succeeds\. Alternatively, the module sets the \fIPAM_AUTHTOK\fR -item with the entered password and fails. +item with the entered password and fails\. .PP -This module is not safe and easily spoofable. +This module is not safe and easily spoofable\. .SH "OPTIONS" .PP -.TP 3n +.PP \fBdebug\fR -Print debug information. -.TP 3n +.RS 4 +Print debug information\. +.RE +.PP \fBignore\fR -Pay no attention to the email address of the user (if supplied). -.TP 3n -\fBftp=\fR\fB\fIXXX,YYY,...\fR\fR +.RS 4 +Pay no attention to the email address of the user (if supplied)\. +.RE +.PP +\fBftp=\fR\fB\fIXXX,YYY,\.\.\.\fR\fR +.RS 4 Instead of \fIftp\fR or \fIanonymous\fR, provide anonymous login to the comma separated list of users: -\fB\fIXXX,YYY,...\fR\fR. Should the applicant enter one of these usernames the returned username is set to the first in the list: -\fIXXX\fR. +\fB\fIXXX,YYY,\.\.\.\fR\fR\. Should the applicant enter one of these usernames the returned username is set to the first in the list: +\fIXXX\fR\. +.RE .SH "MODULE SERVICES PROVIDED" .PP Only the \fBauth\fR -service is supported. +service is supported\. .SH "RETURN VALUES" .PP -.TP 3n +.PP PAM_SUCCESS -The authentication was successfull. -.TP 3n +.RS 4 +The authentication was successfull\. +.RE +.PP PAM_USER_UNKNOWN -User not known. +.RS 4 +User not known\. +.RE .SH "EXAMPLES" .PP Add the following line to -\fI/etc/pam.d/ftpd\fR +\fI/etc/pam\.d/ftpd\fR to handle ftp style anonymous login: .sp -.RS 3n +.RS 4 .nf # -# ftpd; add ftp\-specifics. These lines enable anonymous ftp over +# ftpd; add ftp\-specifics\. These lines enable anonymous ftp over # standard UN*X access (the listfile entry blocks access to # users listed in /etc/ftpusers) # -auth sufficient pam_ftp.so -auth required pam_unix.so use_first_pass -auth required pam_listfile.so \\ +auth sufficient pam_ftp\.so +auth required pam_unix\.so use_first_pass +auth required pam_listfile\.so \e onerr=succeed item=user sense=deny file=/etc/ftpusers .fi @@ -92,4 +102,4 @@ auth required pam_listfile.so \\ \fBpam\fR(8) .SH "AUTHOR" .PP -pam_ftp was written by Andrew G. Morgan <morgan@kernel.org>. +pam_ftp was written by Andrew G\. Morgan <morgan@kernel\.org>\. diff --git a/Linux-PAM/modules/pam_group/group.conf.5 b/Linux-PAM/modules/pam_group/group.conf.5 index 0e36ebf4..8a0cc9f0 100644 --- a/Linux-PAM/modules/pam_group/group.conf.5 +++ b/Linux-PAM/modules/pam_group/group.conf.5 @@ -1,24 +1,24 @@ .\" Title: group.conf .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/> -.\" Date: 06/21/2006 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "GROUP.CONF" "5" "06/21/2006" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "GROUP\.CONF" "5" "01/08/2008" "Linux-PAM Manual" "Linux\-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -group.conf \- configuration file for the pam_group module +group.conf - configuration file for the pam_group module .SH "DESCRIPTION" .PP -The pam_group PAM module does not authenticate the user, but instead it grants group memberships (in the credential setting phase of the authentication module) to the user. Such memberships are based on the service they are applying for. +The pam_group PAM module does not authenticate the user, but instead it grants group memberships (in the credential setting phase of the authentication module) to the user\. Such memberships are based on the service they are applying for\. .PP For this module to function correctly there must be a correctly formatted -\fI/etc/security/group.conf\fR -file present. White spaces are ignored and lines maybe extended with '\\' (escaped newlines). Text following a '#' is ignored to the end of the line. +\fI/etc/security/group\.conf\fR +file present\. White spaces are ignored and lines maybe extended with \'\e\' (escaped newlines)\. Text following a \'#\' is ignored to the end of the line\. .PP The syntax of the lines is as follows: .PP @@ -27,45 +27,45 @@ The syntax of the lines is as follows: .PP The first field, the \fIservices\fR -field, is a logic list of PAM service names that the rule applies to. +field, is a logic list of PAM service names that the rule applies to\. .PP The second field, the \fItty\fR -field, is a logic list of terminal names that this rule applies to. +field, is a logic list of terminal names that this rule applies to\. .PP The third field, the \fIusers\fR -field, is a logic list of users or a netgroup of users to whom this rule applies. +field, is a logic list of users or a netgroup of users to whom this rule applies\. .PP -For these items the simple wildcard '*' may be used only once. With netgroups no wildcards or logic operators are allowed. +For these items the simple wildcard \'*\' may be used only once\. With netgroups no wildcards or logic operators are allowed\. .PP The \fItimes\fR -field is used to indicate "when" these groups are to be given to the user. The format here is a logic list of day/time\-range entries. The days are specified by a sequence of two character entries, MoTuSa for example is Monday Tuesday and Saturday. Note that repeated days are unset MoMo = no day, and MoWk = all weekdays bar Monday. The two character combinations accepted are Mo Tu We Th Fr Sa Su Wk Wd Al, the last two being week\-end days and all 7 days of the week respectively. As a final example, AlFr means all days except Friday. +field is used to indicate "when" these groups are to be given to the user\. The format here is a logic list of day/time\-range entries\. The days are specified by a sequence of two character entries, MoTuSa for example is Monday Tuesday and Saturday\. Note that repeated days are unset MoMo = no day, and MoWk = all weekdays bar Monday\. The two character combinations accepted are Mo Tu We Th Fr Sa Su Wk Wd Al, the last two being week\-end days and all 7 days of the week respectively\. As a final example, AlFr means all days except Friday\. .PP -Each day/time\-range can be prefixed with a '!' to indicate "anything but". The time\-range part is two 24\-hour times HHMM, separated by a hyphen, indicating the start and finish time (if the finish time is smaller than the start time it is deemed to apply on the following day). +Each day/time\-range can be prefixed with a \'!\' to indicate "anything but"\. The time\-range part is two 24\-hour times HHMM, separated by a hyphen, indicating the start and finish time (if the finish time is smaller than the start time it is deemed to apply on the following day)\. .PP The \fIgroups\fR -field is a comma or space separated list of groups that the user inherits membership of. These groups are added if the previous fields are satisfied by the user's request. +field is a comma or space separated list of groups that the user inherits membership of\. These groups are added if the previous fields are satisfied by the user\'s request\. .PP -For a rule to be active, ALL of service+ttys+users must be satisfied by the applying process. +For a rule to be active, ALL of service+ttys+users must be satisfied by the applying process\. .SH "EXAMPLES" .PP These are some example lines which might be specified in -\fI/etc/security/group.conf\fR. +\fI/etc/security/group\.conf\fR\. .PP -Running 'xsh' on tty* (any ttyXXX device), the user 'us' is given access to the floppy (through membership of the floppy group) +Running \'xsh\' on tty* (any ttyXXX device), the user \'us\' is given access to the floppy (through membership of the floppy group) .sp -.RS 3n +.RS 4 .nf xsh;tty*&!ttyp*;us;Al0000\-2400;floppy .fi .RE .PP -Running 'xsh' on tty* (any ttyXXX device), the user 'sword' is given access to games (through membership of the floppy group) after work hours. +Running \'xsh\' on tty* (any ttyXXX device), the user \'sword\' is given access to games (through membership of the floppy group) after work hours\. .sp -.RS 3n +.RS 4 .nf xsh; tty* ;sword;!Wk0900\-1800;games, sound xsh; tty* ;*;Al0900\-1800;floppy @@ -80,4 +80,4 @@ xsh; tty* ;*;Al0900\-1800;floppy \fBpam\fR(8) .SH "AUTHOR" .PP -pam_group was written by Andrew G. Morgan <morgan@kernel.org>. +pam_group was written by Andrew G\. Morgan <morgan@kernel\.org>\. diff --git a/Linux-PAM/modules/pam_group/pam_group.8 b/Linux-PAM/modules/pam_group/pam_group.8 index 7058f1aa..5d40198a 100644 --- a/Linux-PAM/modules/pam_group/pam_group.8 +++ b/Linux-PAM/modules/pam_group/pam_group.8 @@ -1,80 +1,94 @@ .\" Title: pam_group .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/> -.\" Date: 06/22/2006 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "PAM_GROUP" "8" "06/22/2006" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_GROUP" "8" "01/08/2008" "Linux-PAM Manual" "Linux-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_group \- PAM module for group access +pam_group - PAM module for group access .SH "SYNOPSIS" .HP 13 -\fBpam_group.so\fR +\fBpam_group\.so\fR .SH "DESCRIPTION" .PP -The pam_group PAM module does not authenticate the user, but instead it grants group memberships (in the credential setting phase of the authentication module) to the user. Such memberships are based on the service they are applying for. +The pam_group PAM module does not authenticate the user, but instead it grants group memberships (in the credential setting phase of the authentication module) to the user\. Such memberships are based on the service they are applying for\. .PP By default rules for group memberships are taken from config file -\fI/etc/security/group.conf\fR. +\fI/etc/security/group\.conf\fR\. .PP -This module's usefulness relies on the file\-systems accessible to the user. The point being that once granted the membership of a group, the user may attempt to create a +This module\'s usefulness relies on the file\-systems accessible to the user\. The point being that once granted the membership of a group, the user may attempt to create a \fBsetgid\fR -binary with a restricted group ownership. Later, when the user is not given membership to this group, they can recover group membership with the precompiled binary. The reason that the file\-systems that the user has access to are so significant, is the fact that when a system is mounted +binary with a restricted group ownership\. Later, when the user is not given membership to this group, they can recover group membership with the precompiled binary\. The reason that the file\-systems that the user has access to are so significant, is the fact that when a system is mounted \fInosuid\fR -the user is unable to create or execute such a binary file. For this module to provide any level of security, all file\-systems that the user has write access to should be mounted -\fInosuid\fR. +the user is unable to create or execute such a binary file\. For this module to provide any level of security, all file\-systems that the user has write access to should be mounted +\fInosuid\fR\. .PP The pam_group module fuctions in parallel with the \fI/etc/group\fR -file. If the user is granted any groups based on the behavior of this module, they are granted +file\. If the user is granted any groups based on the behavior of this module, they are granted \fIin addition\fR to those entries \fI/etc/group\fR -(or equivalent). +(or equivalent)\. .SH "OPTIONS" .PP -This module does not recognice any options. +This module does not recognise any options\. .SH "MODULE SERVICES PROVIDED" .PP Only the \fBauth\fR -service is supported. +service is supported\. .SH "RETURN VALUES" -.TP 3n +.PP PAM_SUCCESS -group membership was granted. -.TP 3n +.RS 4 +group membership was granted\. +.RE +.PP PAM_ABORT -Not all relevant data could be gotten. -.TP 3n +.RS 4 +Not all relevant data could be gotten\. +.RE +.PP PAM_BUF_ERR -Memory buffer error. -.TP 3n +.RS 4 +Memory buffer error\. +.RE +.PP PAM_CRED_ERR -Group membership was not granted. -.TP 3n +.RS 4 +Group membership was not granted\. +.RE +.PP PAM_IGNORE +.RS 4 \fBpam_sm_authenticate\fR -was called which does nothing. -.TP 3n +was called which does nothing\. +.RE +.PP PAM_USER_UNKNOWN -The user is not known to the system. +.RS 4 +The user is not known to the system\. +.RE .SH "FILES" -.TP 3n -\fI/etc/security/group.conf\fR +.PP +\fI/etc/security/group\.conf\fR +.RS 4 Default configuration file +.RE .SH "SEE ALSO" .PP \fBgroup.conf\fR(5), \fBpam.d\fR(8), -\fBpam\fR(8). +\fBpam\fR(8)\. .SH "AUTHORS" .PP -pam_group was written by Andrew G. Morgan <morgan@kernel.org>. +pam_group was written by Andrew G\. Morgan <morgan@kernel\.org>\. diff --git a/Linux-PAM/modules/pam_group/pam_group.8.xml b/Linux-PAM/modules/pam_group/pam_group.8.xml index 61c7eef1..f7488fb3 100644 --- a/Linux-PAM/modules/pam_group/pam_group.8.xml +++ b/Linux-PAM/modules/pam_group/pam_group.8.xml @@ -62,7 +62,7 @@ <refsect1 id="pam_group-options"> <title>OPTIONS</title> - <para>This module does not recognice any options.</para> + <para>This module does not recognise any options.</para> </refsect1> <refsect1 id="pam_group-services"> diff --git a/Linux-PAM/modules/pam_issue/pam_issue.8 b/Linux-PAM/modules/pam_issue/pam_issue.8 index 011a5e91..dd94c246 100644 --- a/Linux-PAM/modules/pam_issue/pam_issue.8 +++ b/Linux-PAM/modules/pam_issue/pam_issue.8 @@ -1,94 +1,128 @@ .\" Title: pam_issue .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/> -.\" Date: 06/17/2006 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "PAM_ISSUE" "8" "06/17/2006" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_ISSUE" "8" "01/08/2008" "Linux-PAM Manual" "Linux\-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_issue \- PAM module to add issue file to user prompt +pam_issue - PAM module to add issue file to user prompt .SH "SYNOPSIS" .HP 13 -\fBpam_issue.so\fR [noesc] [issue=\fIissue\-file\-name\fR] +\fBpam_issue\.so\fR [noesc] [issue=\fIissue\-file\-name\fR] .SH "DESCRIPTION" .PP -pam_issue is a PAM module to prepend an issue file to the username prompt. It also by default parses escape codes in the issue file similar to some common getty's (using \\x format). +pam_issue is a PAM module to prepend an issue file to the username prompt\. It also by default parses escape codes in the issue file similar to some common getty\'s (using \ex format)\. .PP Recognized escapes: -.TP 3n -\fB\\d\fR +.PP +\fB\ed\fR +.RS 4 current day -.TP 3n -\fB\\l\fR +.RE +.PP +\fB\el\fR +.RS 4 name of this tty -.TP 3n -\fB\\m\fR +.RE +.PP +\fB\em\fR +.RS 4 machine architecture (uname \-m) -.TP 3n -\fB\\n\fR -machine's network node hostname (uname \-n) -.TP 3n -\fB\\o\fR +.RE +.PP +\fB\en\fR +.RS 4 +machine\'s network node hostname (uname \-n) +.RE +.PP +\fB\eo\fR +.RS 4 domain name of this system -.TP 3n -\fB\\r\fR +.RE +.PP +\fB\er\fR +.RS 4 release number of operating system (uname \-r) -.TP 3n -\fB\\t\fR +.RE +.PP +\fB\et\fR +.RS 4 current time -.TP 3n -\fB\\s\fR +.RE +.PP +\fB\es\fR +.RS 4 operating system name (uname \-s) -.TP 3n -\fB\\u\fR +.RE +.PP +\fB\eu\fR +.RS 4 number of users currently logged in -.TP 3n -\fB\\U\fR -same as \\u except it is suffixed with "user" or "users" (eg. "1 user" or "10 users") -.TP 3n -\fB\\v\fR +.RE +.PP +\fB\eU\fR +.RS 4 +same as \eu except it is suffixed with "user" or "users" (eg\. "1 user" or "10 users") +.RE +.PP +\fB\ev\fR +.RS 4 operating system version and build date (uname \-v) +.RE .SH "OPTIONS" .PP -.TP 3n +.PP \fBnoesc\fR -Turns off escape code parsing. -.TP 3n +.RS 4 +Turns off escape code parsing\. +.RE +.PP \fBissue=\fR\fB\fIissue\-file\-name\fR\fR -The file to output if not using the default. +.RS 4 +The file to output if not using the default\. +.RE .SH "MODULE SERVICES PROVIDED" .PP Only the \fBauth\fR -service is supported. +service is supported\. .SH "RETURN VALUES" .PP -.TP 3n +.PP PAM_BUF_ERR -Memory buffer error. -.TP 3n +.RS 4 +Memory buffer error\. +.RE +.PP PAM_IGNORE -The prompt was already changed. -.TP 3n +.RS 4 +The prompt was already changed\. +.RE +.PP PAM_SERVICE_ERR -A service module error occured. -.TP 3n +.RS 4 +A service module error occured\. +.RE +.PP PAM_SUCCESS -The new prompt was set successfull. +.RS 4 +The new prompt was set successfull\. +.RE .SH "EXAMPLES" .PP Add the following line to -\fI/etc/pam.d/login\fR +\fI/etc/pam\.d/login\fR to set the user specific issue at login: .sp -.RS 3n +.RS 4 .nf - auth optional pam_issue.so issue=/etc/issue + auth optional pam_issue\.so issue=/etc/issue .fi .RE @@ -101,4 +135,4 @@ to set the user specific issue at login: \fBpam\fR(8) .SH "AUTHOR" .PP -pam_issue was written by Ben Collins <bcollins@debian.org>. +pam_issue was written by Ben Collins <bcollins@debian\.org>\. diff --git a/Linux-PAM/modules/pam_keyinit/README b/Linux-PAM/modules/pam_keyinit/README index da22a535..38344d9a 100644 --- a/Linux-PAM/modules/pam_keyinit/README +++ b/Linux-PAM/modules/pam_keyinit/README @@ -1,24 +1,68 @@ -# $Id: README,v 1.1 2006/06/27 12:34:07 t8m Exp $ -*- text -*- -# +pam_keyinit — Kernel session keyring initialiser module -This module makes sure the calling process has its own session keyring rather -than using the default per-user session keyring. +â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â” -The following words may be supplied as arguments to the module through the PAM -configuration scripts: +DESCRIPTION - (*) "force" +The pam_keyinit PAM module ensures that the invoking process has a session +keyring other than the user default session keyring. - This will cause the process's current session keyring to be replaced with - a new one. If this isn't supplied, a session keyring will only be created - if the process doesn't already have its own. +The session component of the module checks to see if the process's session +keyring is the user default, and, if it is, creates a new anonymous session +keyring with which to replace it. - (*) "revoke" +If a new session keyring is created, it will install a link to the user common +keyring in the session keyring so that keys common to the user will be +automatically accessible through it. - If the module actually created a keyring, this will cause that keyring to - be revoked on session closure. +The session keyring of the invoking process will thenceforth be inherited by +all its children unless they override it. - (*) "debug" +This module is intended primarily for use by login processes. Be aware that +after the session keyring has been replaced, the old session keyring and the +keys it contains will no longer be accessible. + +This module should not, generally, be invoked by programs like su, since it is +usually desirable for the key set to percolate through to the alternate +context. The keys have their own permissions system to manage this. + +This module should be included as early as possible in a PAM configuration, so +that other PAM modules can attach tokens to the keyring. + +The keyutils package is used to manipulate keys more directly. This can be +obtained from: + +Keyutils + +OPTIONS + +debug + + Log debug information with syslog(3). + +force + + Causes the session keyring of the invoking process to be replaced + unconditionally. + +revoke + + Causes the session keyring of the invoking process to be revoked when the + invoking process exits if the session keyring was created for this process + in the first place. + +EXAMPLES + +Add this line to your login entries to start each login session with its own +session keyring: + +session required pam_keyinit.so + + +This will prevent keys from one session leaking into another session for the +same user. + +AUTHOR + +pam_keyinit was written by David Howells, <dhowells@redhat.com>. - This will cause the module to write some debugging information to the - syslog. diff --git a/Linux-PAM/modules/pam_keyinit/pam_keyinit.8 b/Linux-PAM/modules/pam_keyinit/pam_keyinit.8 index 40b1e125..b833cfee 100644 --- a/Linux-PAM/modules/pam_keyinit/pam_keyinit.8 +++ b/Linux-PAM/modules/pam_keyinit/pam_keyinit.8 @@ -1,133 +1,124 @@ -.\"Generated by db2man.xsl. Don't modify this, modify the source. -.de Sh \" Subsection -.br -.if t .Sp -.ne 5 -.PP -\fB\\$1\fR -.PP -.. -.de Sp \" Vertical space (when we can't use .PP) -.if t .sp .5v -.if n .sp -.. -.de Ip \" List item -.br -.ie \\n(.$>=3 .ne \\$3 -.el .ne 3 -.IP "\\$1" \\$2 -.. -.TH "PAM_KEYINIT" 8 "" "" "" -.SH NAME -pam_keyinit \- Kernel session keyring initialiser module -.SH "SYNOPSIS" +.\" Title: pam_keyinit +.\" Author: +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual +.\" +.TH "PAM_KEYINIT" "8" "01/08/2008" "Linux-PAM Manual" "Linux\-PAM Manual" +.\" disable hyphenation +.nh +.\" disable justification (adjust text to left margin only) .ad l -.hy 0 +.SH "NAME" +pam_keyinit - Kernel session keyring initialiser module +.SH "SYNOPSIS" .HP 15 -\fBpam_keyinit\&.so\fR [debug] [force] [revoke] -.ad -.hy - +\fBpam_keyinit\.so\fR [debug] [force] [revoke] .SH "DESCRIPTION" - .PP -The pam_keyinit PAM module ensures that the invoking process has a session keyring other than the user default session keyring\&. - +The pam_keyinit PAM module ensures that the invoking process has a session keyring other than the user default session keyring\. .PP -The session component of the module checks to see if the process's session keyring is the user default, and, if it is, creates a new anonymous session keyring with which to replace it\&. - +The session component of the module checks to see if the process\'s session keyring is the user default, and, if it is, creates a new anonymous session keyring with which to replace it\. .PP -If a new session keyring is created, it will install a link to the user common keyring in the session keyring so that keys common to the user will be automatically accessible through it\&. - +If a new session keyring is created, it will install a link to the user common keyring in the session keyring so that keys common to the user will be automatically accessible through it\. .PP -The session keyring of the invoking process will thenceforth be inherited by all its children unless they override it\&. - +The session keyring of the invoking process will thenceforth be inherited by all its children unless they override it\. .PP -This module is intended primarily for use by login processes\&. Be aware that after the session keyring has been replaced, the old session keyring and the keys it contains will no longer be accessible\&. - +This module is intended primarily for use by login processes\. Be aware that after the session keyring has been replaced, the old session keyring and the keys it contains will no longer be accessible\. .PP -This module should not, generally, be invoked by programs like \fIsu\fR, since it is usually desirable for the key set to percolate through to the alternate context\&. The keys have their own permissions system to manage this\&. - +This module should not, generally, be invoked by programs like +\fBsu\fR, since it is usually desirable for the key set to percolate through to the alternate context\. The keys have their own permissions system to manage this\. .PP -This module should be included as early as possible in a PAM configuration, so that other PAM modules can attach tokens to the keyring\&. - +This module should be included as early as possible in a PAM configuration, so that other PAM modules can attach tokens to the keyring\. .PP -The keyutils package is used to manipulate keys more directly\&. This included in the Fedora Extras 5+ and Red Hat Enterprise Linux 4 U2+ and can also be obtained from: - +The keyutils package is used to manipulate keys more directly\. This can be obtained from: .PP - Keyutils : \fIhttp://people.redhat.com/~dhowells/keyutils/\fR +\fI Keyutils \fR\&[1] .SH "OPTIONS" - -.TP +.PP \fBdebug\fR -Log debug information with \fBsyslog\fR(3)\&. - -.TP +.RS 4 +Log debug information with +\fBsyslog\fR(3)\. +.RE +.PP \fBforce\fR -Causes the session keyring of the invoking process to be replaced unconditionally\&. - -.TP +.RS 4 +Causes the session keyring of the invoking process to be replaced unconditionally\. +.RE +.PP \fBrevoke\fR -Causes the session keyring of the invoking process to be revoked when the invoking process exits if the session keyring was created for this process in the first place\&. - +.RS 4 +Causes the session keyring of the invoking process to be revoked when the invoking process exits if the session keyring was created for this process in the first place\. +.RE .SH "MODULE SERVICES PROVIDED" - .PP -Only the \fIsession\fR service is supported\&. - +Only the +\fBsession\fR +service is supported\. .SH "RETURN VALUES" - -.TP +.PP PAM_SUCCESS +.RS 4 This module will usually return this value - -.TP +.RE +.PP PAM_AUTH_ERR -Authentication failure\&. - -.TP +.RS 4 +Authentication failure\. +.RE +.PP PAM_BUF_ERR -Memory buffer error\&. - -.TP +.RS 4 +Memory buffer error\. +.RE +.PP PAM_IGNORE -The return value should be ignored by PAM dispatch\&. - -.TP +.RS 4 +The return value should be ignored by PAM dispatch\. +.RE +.PP PAM_SERVICE_ERR -Cannot determine the user name\&. - -.TP +.RS 4 +Cannot determine the user name\. +.RE +.PP PAM_SESSION_ERR -This module will return this value if its arguments are invalid or if a system error such as ENOMEM occurs\&. - -.TP +.RS 4 +This module will return this value if its arguments are invalid or if a system error such as ENOMEM occurs\. +.RE +.PP PAM_USER_UNKNOWN -User not known\&. - +.RS 4 +User not known\. +.RE .SH "EXAMPLES" - .PP -Add this line to your login entries to start each login session with its own session keyring: - +Add this line to your login entries to start each login session with its own session keyring: +.sp +.RS 4 .nf - -session required pam_keyinit\&.so +session required pam_keyinit\.so .fi - - +.RE .PP -This will prevent keys from one session leaking into another session for the same user\&. - +This will prevent keys from one session leaking into another session for the same user\. .SH "SEE ALSO" - .PP - \fBpam\&.conf\fR(5), \fBpam\&.d\fR(8), \fBpam\fR(8) \fBkeyctl\fR(1) +\fBpam.conf\fR(5), +\fBpam.d\fR(8), +\fBpam\fR(8) +\fBkeyctl\fR(1) .SH "AUTHOR" - .PP -pam_keyinit was written by David Howells, <dhowells@redhat\&.com>\&. - +pam_keyinit was written by David Howells, <dhowells@redhat\.com>\. +.SH "NOTES" +.IP " 1." 4 +Keyutils +.RS 4 +\%http://people.redhat.com/~dhowells/keyutils/ +.RE diff --git a/Linux-PAM/modules/pam_lastlog/pam_lastlog.8 b/Linux-PAM/modules/pam_lastlog/pam_lastlog.8 index 81b04470..95cb99df 100644 --- a/Linux-PAM/modules/pam_lastlog/pam_lastlog.8 +++ b/Linux-PAM/modules/pam_lastlog/pam_lastlog.8 @@ -1,85 +1,107 @@ .\" Title: pam_lastlog .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/> -.\" Date: 06/09/2006 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "PAM_LASTLOG" "8" "06/09/2006" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_LASTLOG" "8" "01/08/2008" "Linux-PAM Manual" "Linux\-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_lastlog \- PAM module to display date of last login +pam_lastlog - PAM module to display date of last login .SH "SYNOPSIS" .HP 15 -\fBpam_lastlog.so\fR [debug] [silent] [never] [nodate] [nohost] [noterm] [nowtmp] +\fBpam_lastlog\.so\fR [debug] [silent] [never] [nodate] [nohost] [noterm] [nowtmp] .SH "DESCRIPTION" .PP -pam_lastlog is a PAM module to display a line of information about the last login of the user. In addition, the module maintains the +pam_lastlog is a PAM module to display a line of information about the last login of the user\. In addition, the module maintains the \fI/var/log/lastlog\fR -file. +file\. .PP -Some applications may perform this function themselves. In such cases, this module is not necessary. +Some applications may perform this function themselves\. In such cases, this module is not necessary\. .SH "OPTIONS" -.TP 3n +.PP \fBdebug\fR -Print debug information. -.TP 3n +.RS 4 +Print debug information\. +.RE +.PP \fBsilent\fR -Don't inform the user about any previous login, just upate the +.RS 4 +Don\'t inform the user about any previous login, just upate the \fI/var/log/lastlog\fR -file. -.TP 3n +file\. +.RE +.PP \fBnever\fR +.RS 4 If the \fI/var/log/lastlog\fR -file does not contain any old entries for the user, indicate that the user has never previously logged in with a welcome message. -.TP 3n +file does not contain any old entries for the user, indicate that the user has never previously logged in with a welcome message\. +.RE +.PP \fBnodate\fR -Don't display the date of the last login. -.TP 3n +.RS 4 +Don\'t display the date of the last login\. +.RE +.PP \fBnoterm\fR -Don't display the terminal name on which the last login was attempted. -.TP 3n +.RS 4 +Don\'t display the terminal name on which the last login was attempted\. +.RE +.PP \fBnohost\fR -Don't indicate from which host the last login was attempted. -.TP 3n +.RS 4 +Don\'t indicate from which host the last login was attempted\. +.RE +.PP \fBnowtmp\fR -Don't update the wtmp entry. +.RS 4 +Don\'t update the wtmp entry\. +.RE .SH "MODULE SERVICES PROVIDED" .PP Only the \fBsession\fR -service is supported. +service is supported\. .SH "RETURN VALUES" .PP -.TP 3n +.PP PAM_SUCCESS -Everything was successfull. -.TP 3n +.RS 4 +Everything was successfull\. +.RE +.PP PAM_SERVICE_ERR -Internal service module error. -.TP 3n +.RS 4 +Internal service module error\. +.RE +.PP PAM_USER_UNKNOWN -User not known. +.RS 4 +User not known\. +.RE .SH "EXAMPLES" .PP Add the following line to -\fI/etc/pam.d/login\fR +\fI/etc/pam\.d/login\fR to display the last login time of an user: .sp -.RS 3n +.RS 4 .nf - session required pam_lastlog.so nowtmp + session required pam_lastlog\.so nowtmp .fi .RE .SH "FILES" -.TP 3n +.PP \fI/var/log/lastlog\fR +.RS 4 Lastlog logging file +.RE .SH "SEE ALSO" .PP @@ -88,4 +110,4 @@ Lastlog logging file \fBpam\fR(8) .SH "AUTHOR" .PP -pam_lastlog was written by Andrew G. Morgan <morgan@kernel.org>. +pam_lastlog was written by Andrew G\. Morgan <morgan@kernel\.org>\. diff --git a/Linux-PAM/modules/pam_limits/README b/Linux-PAM/modules/pam_limits/README index 26336711..3c59052a 100644 --- a/Linux-PAM/modules/pam_limits/README +++ b/Linux-PAM/modules/pam_limits/README @@ -16,6 +16,9 @@ module option then the files in the above directory are not parsed. The module must not be called by a multithreaded application. +If Linux PAM is compiled with audit support the module will report when it +denies access based on limit of maximum number of concurrent login sessions. + OPTIONS change_uid @@ -41,6 +44,10 @@ utmp_early to compensate for this behavior and at the same time maintain system-wide consistency with a single limits.conf file. +noaudit + + Do not report exceeded maximum logins count to the audit subsystem. + EXAMPLES These are some example lines which might be specified in /etc/security/ diff --git a/Linux-PAM/modules/pam_limits/limits.conf b/Linux-PAM/modules/pam_limits/limits.conf index d3463638..5d5c3f70 100644 --- a/Linux-PAM/modules/pam_limits/limits.conf +++ b/Linux-PAM/modules/pam_limits/limits.conf @@ -33,7 +33,7 @@ # - locks - max number of file locks the user can hold # - sigpending - max number of pending signals # - msgqueue - max memory used by POSIX message queues (bytes) -# - nice - max nice priority allowed to raise to +# - nice - max nice priority allowed to raise to values: [-20, 19] # - rtprio - max realtime priority # #<domain> <type> <item> <value> diff --git a/Linux-PAM/modules/pam_limits/limits.conf.5 b/Linux-PAM/modules/pam_limits/limits.conf.5 index 9fef98d7..134dc741 100644 --- a/Linux-PAM/modules/pam_limits/limits.conf.5 +++ b/Linux-PAM/modules/pam_limits/limits.conf.5 @@ -1,17 +1,17 @@ .\" Title: limits.conf .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.72.0 <http://docbook.sf.net/> -.\" Date: 08/30/2007 +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 .\" Manual: Linux-PAM Manual .\" Source: Linux-PAM Manual .\" -.TH "LIMITS.CONF" "5" "08/30/2007" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "LIMITS\.CONF" "5" "01/08/2008" "Linux-PAM Manual" "Linux\-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -limits.conf \- configuration file for the pam_limits module +limits.conf - configuration file for the pam_limits module .SH "DESCRIPTION" .PP The syntax of the lines is as follows: @@ -26,46 +26,49 @@ The fields listed above should be filled as follows: .PP \fB<domain>\fR .RS 4 +.sp .RS 4 \h'-04'\(bu\h'+03'a username .RE +.sp .RS 4 \h'-04'\(bu\h'+03'a groupname, with \fB@group\fR -syntax. This should not be confused with netgroups. +syntax\. This should not be confused with netgroups\. .RE +.sp .RS 4 \h'-04'\(bu\h'+03'the wildcard -\fB*\fR, for default entry. +\fB*\fR, for default entry\. .RE +.sp .RS 4 \h'-04'\(bu\h'+03'the wildcard \fB%\fR, for maxlogins limit only, can also be used with \fI%group\fR -syntax. +syntax\. .RE .RE .PP \fB<type>\fR .RS 4 -.RS 4 .PP \fBhard\fR .RS 4 for enforcing \fBhard\fR -resource limits. These limits are set by the superuser and enforced by the Kernel. The user cannot raise his requirement of system resources above such values. +resource limits\. These limits are set by the superuser and enforced by the Kernel\. The user cannot raise his requirement of system resources above such values\. .RE .PP \fBsoft\fR .RS 4 for enforcing \fBsoft\fR -resource limits. These limits are ones that the user can move up or down within the permitted range by any pre\-exisiting +resource limits\. These limits are ones that the user can move up or down within the permitted range by any pre\-existing \fBhard\fR -limits. The values specified with this token can be thought of as +limits\. The values specified with this token can be thought of as \fIdefault\fR -values, for normal system usage. +values, for normal system usage\. .RE .PP \fB\-\fR @@ -74,16 +77,14 @@ for enforcing both \fBsoft\fR and \fBhard\fR -resource limits together. +resource limits together\. .sp -Note, if you specify a type of '\-' but neglect to supply the item and value fields then the module will never enforce any limits on the specified user/group etc. . -.RE +Note, if you specify a type of \'\-\' but neglect to supply the item and value fields then the module will never enforce any limits on the specified user/group etc\. \. .RE .RE .PP \fB<item>\fR .RS 4 -.RS 4 .PP \fBcore\fR .RS 4 @@ -153,48 +154,47 @@ the priority to run user process with (negative values boost process priority) .PP \fBlocks\fR .RS 4 -maximum locked files (Linux 2.4 and higher) +maximum locked files (Linux 2\.4 and higher) .RE .PP \fBsigpending\fR .RS 4 -maximum number of pending signals (Linux 2.6 and higher) +maximum number of pending signals (Linux 2\.6 and higher) .RE .PP \fBmsqqueue\fR .RS 4 -maximum memory used by POSIX message queues (bytes) (Linux 2.6 and higher) +maximum memory used by POSIX message queues (bytes) (Linux 2\.6 and higher) .RE .PP \fBnice\fR .RS 4 -maximum nice priority allowed to raise to (Linux 2.6.12 and higher) +maximum nice priority allowed to raise to (Linux 2\.6\.12 and higher) values: [\-20,19] .RE .PP \fBrtprio\fR .RS 4 -maximum realtime priority allowed for non\-privileged processes (Linux 2.6.12 and higher) -.RE +maximum realtime priority allowed for non\-privileged processes (Linux 2\.6\.12 and higher) .RE .RE .PP In general, individual limits have priority over group limits, so if you impose no limits for \fIadmin\fR -group, but one of the members in this group have a limits line, the user will have its limits set according to this line. +group, but one of the members in this group have a limits line, the user will have its limits set according to this line\. .PP Also, please note that all limit settings are set -\fIper login\fR. They are not global, nor are they permanent; existing only for the duration of the session. +\fIper login\fR\. They are not global, nor are they permanent; existing only for the duration of the session\. .PP In the \fIlimits\fR -configuration file, the '\fB#\fR' character introduces a comment \- after which the rest of the line is ignored. +configuration file, the \'\fB#\fR\' character introduces a comment \- after which the rest of the line is ignored\. .PP The pam_limits module does its best to report configuration problems found in its configuration file via -\fBsyslog\fR(3). +\fBsyslog\fR(3)\. .SH "EXAMPLES" .PP These are some example lines which might be specified in -\fI/etc/security/limits.conf\fR. +\fI/etc/security/limits\.conf\fR\. .sp .RS 4 .nf @@ -216,4 +216,4 @@ ftp hard nproc 0 \fBpam\fR(8) .SH "AUTHOR" .PP -pam_limits was initially written by Cristian Gafton <gafton@redhat.com> +pam_limits was initially written by Cristian Gafton <gafton@redhat\.com> diff --git a/Linux-PAM/modules/pam_limits/limits.conf.5.xml b/Linux-PAM/modules/pam_limits/limits.conf.5.xml index 48798470..fb1fad27 100644 --- a/Linux-PAM/modules/pam_limits/limits.conf.5.xml +++ b/Linux-PAM/modules/pam_limits/limits.conf.5.xml @@ -82,7 +82,7 @@ <para> for enforcing <emphasis remap='B'>soft</emphasis> resource limits. These limits are ones that the user can move up or down within the - permitted range by any pre-exisiting <emphasis remap='B'>hard</emphasis> + permitted range by any pre-existing <emphasis remap='B'>hard</emphasis> limits. The values specified with this token can be thought of as <emphasis>default</emphasis> values, for normal system usage. </para> @@ -214,7 +214,7 @@ <varlistentry> <term><option>nice</option></term> <listitem> - <para>maximum nice priority allowed to raise to (Linux 2.6.12 and higher)</para> + <para>maximum nice priority allowed to raise to (Linux 2.6.12 and higher) values: [-20,19]</para> </listitem> </varlistentry> <varlistentry> diff --git a/Linux-PAM/modules/pam_limits/pam_limits.8 b/Linux-PAM/modules/pam_limits/pam_limits.8 index 4f01e4cf..dffb5c81 100644 --- a/Linux-PAM/modules/pam_limits/pam_limits.8 +++ b/Linux-PAM/modules/pam_limits/pam_limits.8 @@ -1,125 +1,132 @@ .\" Title: pam_limits .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/> -.\" Date: 04/30/2007 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "PAM_LIMITS" "8" "04/30/2007" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_LIMITS" "8" "01/08/2008" "Linux-PAM Manual" "Linux-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_limits \- PAM module to limit resources +pam_limits - PAM module to limit resources .SH "SYNOPSIS" .HP 14 -\fBpam_limits.so\fR [change_uid] [conf=\fI/path/to/limits.conf\fR] [debug] [utmp_early] +\fBpam_limits\.so\fR [change_uid] [conf=\fI/path/to/limits\.conf\fR] [debug] [utmp_early] [noaudit] .SH "DESCRIPTION" .PP -The pam_limits PAM module sets limits on the system resources that can be obtained in a user\-session. Users of +The pam_limits PAM module sets limits on the system resources that can be obtained in a user\-session\. Users of \fIuid=0\fR -are affected by this limits, too. +are affected by this limits, too\. .PP By default limits are taken from the -\fI/etc/security/limits.conf\fR -config file. Then individual files from the -\fI/etc/security/limits.d/\fR -directory are read. The files are parsed one after another in the order of "C" locale. The effect of the individual files is the same as if all the files were concatenated together in the order of parsing. If a config file is explicitely specified with a module option then the files in the above directory are not parsed. +\fI/etc/security/limits\.conf\fR +config file\. Then individual files from the +\fI/etc/security/limits\.d/\fR +directory are read\. The files are parsed one after another in the order of "C" locale\. The effect of the individual files is the same as if all the files were concatenated together in the order of parsing\. If a config file is explicitely specified with a module option then the files in the above directory are not parsed\. .PP -The module must not be called by a multithreaded application. +The module must not be called by a multithreaded application\. +.PP +If Linux PAM is compiled with audit support the module will report when it denies access based on limit of maximum number of concurrent login sessions\. .SH "OPTIONS" .PP \fBchange_uid\fR .RS 4 -Change real uid to the user for who the limits are set up. Use this option if you have problems like login not forking a shell for user who has no processes. Be warned that something else may break when you do this. +Change real uid to the user for who the limits are set up\. Use this option if you have problems like login not forking a shell for user who has no processes\. Be warned that something else may break when you do this\. .RE .PP -\fBconf=\fR\fB\fI/path/to/limits.conf\fR\fR +\fBconf=\fR\fB\fI/path/to/limits\.conf\fR\fR .RS 4 -Indicate an alternative limits.conf style configuration file to override the default. +Indicate an alternative limits\.conf style configuration file to override the default\. .RE .PP \fBdebug\fR .RS 4 -Print debug information. +Print debug information\. .RE .PP \fButmp_early\fR .RS 4 -Some broken applications actually allocate a utmp entry for the user before the user is admitted to the system. If some of the services you are configuring PAM for do this, you can selectively use this module argument to compensate for this behavior and at the same time maintain system\-wide consistency with a single limits.conf file. +Some broken applications actually allocate a utmp entry for the user before the user is admitted to the system\. If some of the services you are configuring PAM for do this, you can selectively use this module argument to compensate for this behavior and at the same time maintain system\-wide consistency with a single limits\.conf file\. +.RE +.PP +\fBnoaudit\fR +.RS 4 +Do not report exceeded maximum logins count to the audit subsystem\. .RE .SH "MODULE SERVICES PROVIDED" .PP Only the \fBsession\fR -service is supported. +service is supported\. .SH "RETURN VALUES" .PP PAM_ABORT .RS 4 -Cannot get current limits. +Cannot get current limits\. .RE .PP PAM_IGNORE .RS 4 -No limits found for this user. +No limits found for this user\. .RE .PP PAM_PERM_DENIED .RS 4 -New limits could not be set. +New limits could not be set\. .RE .PP PAM_SERVICE_ERR .RS 4 -Cannot read config file. +Cannot read config file\. .RE .PP PAM_SESSEION_ERR .RS 4 -Error recovering account name. +Error recovering account name\. .RE .PP PAM_SUCCESS .RS 4 -Limits were changed. +Limits were changed\. .RE .PP PAM_USER_UNKNOWN .RS 4 -The user is not known to the system. +The user is not known to the system\. .RE .SH "FILES" .PP -\fI/etc/security/limits.conf\fR +\fI/etc/security/limits\.conf\fR .RS 4 Default configuration file .RE .SH "EXAMPLES" .PP For the services you need resources limits (login for example) put a the following line in -\fI/etc/pam.d/login\fR +\fI/etc/pam\.d/login\fR as the last line for that service (usually after the pam_unix session line): .sp .RS 4 .nf -#%PAM\-1.0 +#%PAM\-1\.0 # # Resource limits imposed on login sessions via pam_limits # -session required pam_limits.so +session required pam_limits\.so .fi .RE .PP -Replace "login" for each service you are using this module. +Replace "login" for each service you are using this module\. .SH "SEE ALSO" .PP \fBlimits.conf\fR(5), \fBpam.d\fR(8), -\fBpam\fR(8). +\fBpam\fR(8)\. .SH "AUTHORS" .PP -pam_limits was initially written by Cristian Gafton <gafton@redhat.com> +pam_limits was initially written by Cristian Gafton <gafton@redhat\.com> diff --git a/Linux-PAM/modules/pam_limits/pam_limits.8.xml b/Linux-PAM/modules/pam_limits/pam_limits.8.xml index 9f13bb68..98afdcd4 100644 --- a/Linux-PAM/modules/pam_limits/pam_limits.8.xml +++ b/Linux-PAM/modules/pam_limits/pam_limits.8.xml @@ -34,6 +34,9 @@ <arg choice="opt"> utmp_early </arg> + <arg choice="opt"> + noaudit + </arg> </cmdsynopsis> </refsynopsisdiv> @@ -57,6 +60,11 @@ <para> The module must not be called by a multithreaded application. </para> + <para> + If Linux PAM is compiled with audit support the module will report + when it denies access based on limit of maximum number of concurrent + login sessions. + </para> </refsect1> <refsect1 id="pam_limits-options"> @@ -111,6 +119,16 @@ </para> </listitem> </varlistentry> + <varlistentry> + <term> + <option>noaudit</option> + </term> + <listitem> + <para> + Do not report exceeded maximum logins count to the audit subsystem. + </para> + </listitem> + </varlistentry> </variablelist> </refsect1> diff --git a/Linux-PAM/modules/pam_limits/pam_limits.c b/Linux-PAM/modules/pam_limits/pam_limits.c index d65e64bf..f1e29b85 100644 --- a/Linux-PAM/modules/pam_limits/pam_limits.c +++ b/Linux-PAM/modules/pam_limits/pam_limits.c @@ -41,6 +41,10 @@ #include <pwd.h> #include <locale.h> +#ifdef HAVE_LIBAUDIT +#include <libaudit.h> +#endif + /* Module defines */ #define LINE_LENGTH 1024 @@ -101,6 +105,7 @@ struct pam_limit_s { #define PAM_DEBUG_ARG 0x0001 #define PAM_DO_SETREUID 0x0002 #define PAM_UTMP_EARLY 0x0004 +#define PAM_NO_AUDIT 0x0008 /* Limits from globbed files. */ #define LIMITS_CONF_GLOB LIMITS_FILE_DIR @@ -126,6 +131,8 @@ _pam_parse (const pam_handle_t *pamh, int argc, const char **argv, ctrl |= PAM_DO_SETREUID; } else if (!strcmp(*argv,"utmp_early")) { ctrl |= PAM_UTMP_EARLY; + } else if (!strcmp(*argv,"noaudit")) { + ctrl |= PAM_NO_AUDIT; } else { pam_syslog(pamh, LOG_ERR, "unknown option: %s", *argv); } @@ -595,6 +602,13 @@ static int setup_limits(pam_handle_t *pamh, D(("skip login limit check for uid=0")); } else if (pl->login_limit > 0) { if (check_logins(pamh, uname, pl->login_limit, ctrl, pl) == LOGIN_ERR) { +#ifdef HAVE_LIBAUDIT + if (!(ctrl & PAM_NO_AUDIT)) { + pam_modutil_audit_write(pamh, AUDIT_ANOM_LOGIN_SESSIONS, + "pam_limits", PAM_PERM_DENIED); + /* ignore return value as we fail anyway */ + } +#endif retval |= LOGIN_ERR; } } else if (pl->login_limit == 0) { diff --git a/Linux-PAM/modules/pam_listfile/README b/Linux-PAM/modules/pam_listfile/README index 51bb13d2..7fe7051b 100644 --- a/Linux-PAM/modules/pam_listfile/README +++ b/Linux-PAM/modules/pam_listfile/README @@ -55,7 +55,7 @@ onerr=[succeed|fail] apply=[user|@group] Restrict the user class for which the restriction apply. Note that with - item=[user|ruser|group] this oes not make sense, but for item=[tty|rhost| + item=[user|ruser|group] this does not make sense, but for item=[tty|rhost| shell] it have a meaning. quiet diff --git a/Linux-PAM/modules/pam_listfile/pam_listfile.8 b/Linux-PAM/modules/pam_listfile/pam_listfile.8 index 0103aa5e..e14525d8 100644 --- a/Linux-PAM/modules/pam_listfile/pam_listfile.8 +++ b/Linux-PAM/modules/pam_listfile/pam_listfile.8 @@ -1,23 +1,23 @@ .\" Title: pam_listfile .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.72.0 <http://docbook.sf.net/> -.\" Date: 08/25/2007 +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 .\" Manual: Linux-PAM Manual .\" Source: Linux-PAM Manual .\" -.TH "PAM_LISTFILE" "8" "08/25/2007" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_LISTFILE" "8" "01/08/2008" "Linux-PAM Manual" "Linux\-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_listfile \- deny or allow services based on an arbitrary file +pam_listfile - deny or allow services based on an arbitrary file .SH "SYNOPSIS" .HP 16 -\fBpam_listfile.so\fR item=[tty|user|rhost|ruser|group|shell] sense=[allow|deny] file=\fI/path/filename\fR onerr=[succeed|fail] [apply=[\fIuser\fR|\fI@group\fR]] [quiet] +\fBpam_listfile\.so\fR item=[tty|user|rhost|ruser|group|shell] sense=[allow|deny] file=\fI/path/filename\fR onerr=[succeed|fail] [apply=[\fIuser\fR|\fI@group\fR]] [quiet] .SH "DESCRIPTION" .PP -pam_listfile is a PAM module which provides a way to deny or allow services based on an arbitrary file. +pam_listfile is a PAM module which provides a way to deny or allow services based on an arbitrary file\. .PP The module gets the \fBitem\fR @@ -29,15 +29,15 @@ specifies the username, \fIPAM_RHOST\fR; and ruser specifies the name of the remote user (if available) who made the request, \fIPAM_RUSER\fR \-\- and looks for an instance of that item in the -\fBfile=\fR\fB\fIfilename\fR\fR. +\fBfile=\fR\fB\fIfilename\fR\fR\. \fIfilename\fR -contains one line per item listed. If the item is found, then if +contains one line per item listed\. If the item is found, then if \fBsense=\fR\fB\fIallow\fR\fR, \fIPAM_SUCCESS\fR is returned, causing the authorization request to succeed; else if \fBsense=\fR\fB\fIdeny\fR\fR, \fIPAM_AUTH_ERR\fR -is returned, causing the authorization request to fail. +is returned, causing the authorization request to fail\. .PP If an error is encountered (for instance, if \fIfilename\fR @@ -49,54 +49,54 @@ is returned, otherwise if \fIPAM_AUTH_ERR\fR or \fIPAM_SERVICE_ERR\fR -(as appropriate) will be returned. +(as appropriate) will be returned\. .PP An additional argument, -\fBapply=\fR, can be used to restrict the application of the above to a specific user (\fBapply=\fR\fB\fIusername\fR\fR) or a given group (\fBapply=\fR\fB\fI@groupname\fR\fR). This added restriction is only meaningful when used with the +\fBapply=\fR, can be used to restrict the application of the above to a specific user (\fBapply=\fR\fB\fIusername\fR\fR) or a given group (\fBapply=\fR\fB\fI@groupname\fR\fR)\. This added restriction is only meaningful when used with the \fItty\fR, \fIrhost\fR and \fIshell\fR -items. +items\. .PP -Besides this last one, all arguments should be specified; do not count on any default behavior. +Besides this last one, all arguments should be specified; do not count on any default behavior\. .PP -No credentials are awarded by this module. +No credentials are awarded by this module\. .SH "OPTIONS" .PP .PP \fBitem=[tty|user|rhost|ruser|group|shell]\fR .RS 4 -What is listed in the file and should be checked for. +What is listed in the file and should be checked for\. .RE .PP \fBsense=[allow|deny]\fR .RS 4 -Action to take if found in file, if the item is NOT found in the file, then the opposite action is requested. +Action to take if found in file, if the item is NOT found in the file, then the opposite action is requested\. .RE .PP \fBfile=\fR\fB\fI/path/filename\fR\fR .RS 4 -File containing one item per line. The file needs to be a plain file and not world writeable. +File containing one item per line\. The file needs to be a plain file and not world writeable\. .RE .PP \fBonerr=[succeed|fail]\fR .RS 4 -What to do if something weird happens like being unable to open the file. +What to do if something weird happens like being unable to open the file\. .RE .PP \fBapply=[\fR\fB\fIuser\fR\fR\fB|\fR\fB\fI@group\fR\fR\fB]\fR .RS 4 -Restrict the user class for which the restriction apply. Note that with +Restrict the user class for which the restriction apply\. Note that with \fBitem=[user|ruser|group]\fR -this oes not make sense, but for +this does not make sense, but for \fBitem=[tty|rhost|shell]\fR -it have a meaning. +it have a meaning\. .RE .PP \fBquiet\fR .RS 4 -Do not treat service refusals or missing list files as errors that need to be logged. +Do not treat service refusals or missing list files as errors that need to be logged\. .RE .SH "MODULE SERVICES PROVIDED" .PP @@ -106,47 +106,47 @@ The services \fBpassword\fR and \fBsession\fR -are supported. +are supported\. .SH "RETURN VALUES" .PP .PP PAM_AUTH_ERR .RS 4 -Authentication failure. +Authentication failure\. .RE .PP PAM_BUF_ERR .RS 4 -Memory buffer error. +Memory buffer error\. .RE .PP PAM_IGNORE .RS 4 The rule does not apply to the \fBapply\fR -option. +option\. .RE .PP PAM_SERVICE_ERR .RS 4 -Error in service module. +Error in service module\. .RE .PP PAM_SUCCESS .RS 4 -Success. +Success\. .RE .SH "EXAMPLES" .PP -Classic 'ftpusers' authentication can be implemented with this entry in -\fI/etc/pam.d/ftpd\fR: +Classic \'ftpusers\' authentication can be implemented with this entry in +\fI/etc/pam\.d/ftpd\fR: .sp .RS 4 .nf # # deny ftp\-access to users listed in the /etc/ftpusers file # -auth required pam_listfile.so \e +auth required pam_listfile\.so \e onerr=succeed item=user sense=deny file=/etc/ftpusers .fi @@ -156,10 +156,10 @@ Note, users listed in \fI/etc/ftpusers\fR file are (counterintuitively) \fInot\fR -allowed access to the ftp service. +allowed access to the ftp service\. .PP To allow login access only for certain users, you can use a -\fI/etc/pam.d/login\fR +\fI/etc/pam\.d/login\fR entry like this: .sp .RS 4 @@ -167,17 +167,17 @@ entry like this: # # permit login to users listed in /etc/loginusers # -auth required pam_listfile.so \e +auth required pam_listfile\.so \e onerr=fail item=user sense=allow file=/etc/loginusers .fi .RE .sp For this example to work, all users who are allowed to use the login service should be listed in the file -\fI/etc/loginusers\fR. Unless you are explicitly trying to lock out root, make sure that when you do this, you leave a way for root to log in, either by listing root in +\fI/etc/loginusers\fR\. Unless you are explicitly trying to lock out root, make sure that when you do this, you leave a way for root to log in, either by listing root in \fI/etc/loginusers\fR, or by listing a user who is able to \fIsu\fR -to the root account. +to the root account\. .SH "SEE ALSO" .PP @@ -186,4 +186,4 @@ to the root account. \fBpam\fR(8) .SH "AUTHOR" .PP -pam_listfile was written by Michael K. Johnson <johnsonm@redhat.com> and Elliot Lee <sopwith@cuc.edu>. +pam_listfile was written by Michael K\. Johnson <johnsonm@redhat\.com> and Elliot Lee <sopwith@cuc\.edu>\. diff --git a/Linux-PAM/modules/pam_listfile/pam_listfile.8.xml b/Linux-PAM/modules/pam_listfile/pam_listfile.8.xml index 2aab4962..e54e80a4 100644 --- a/Linux-PAM/modules/pam_listfile/pam_listfile.8.xml +++ b/Linux-PAM/modules/pam_listfile/pam_listfile.8.xml @@ -153,7 +153,7 @@ <listitem> <para> Restrict the user class for which the restriction apply. Note that - with <option>item=[user|ruser|group]</option> this oes not make sense, + with <option>item=[user|ruser|group]</option> this does not make sense, but for <option>item=[tty|rhost|shell]</option> it have a meaning. </para> </listitem> diff --git a/Linux-PAM/modules/pam_localuser/pam_localuser.8 b/Linux-PAM/modules/pam_localuser/pam_localuser.8 index e88f0b57..24709bf1 100644 --- a/Linux-PAM/modules/pam_localuser/pam_localuser.8 +++ b/Linux-PAM/modules/pam_localuser/pam_localuser.8 @@ -1,37 +1,37 @@ .\" Title: pam_localuser .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.0 <http://docbook.sf.net/> -.\" Date: 12/13/2006 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "PAM_LOCALUSER" "8" "12/13/2006" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_LOCALUSER" "8" "01/08/2008" "Linux-PAM Manual" "Linux\-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_localuser \- require users to be listed in /etc/passwd +pam_localuser - require users to be listed in /etc/passwd .SH "SYNOPSIS" .HP 17 -\fBpam_localuser.so\fR [debug] [file=\fI/path/passwd\fR] +\fBpam_localuser\.so\fR [debug] [file=\fI/path/passwd\fR] .SH "DESCRIPTION" .PP -pam_localuser is a PAM module to help implementing site\-wide login policies, where they typically include a subset of the network's users and a few accounts that are local to a particular workstation. Using pam_localuser and pam_wheel or pam_listfile is an effective way to restrict access to either local users and/or a subset of the network's users. +pam_localuser is a PAM module to help implementing site\-wide login policies, where they typically include a subset of the network\'s users and a few accounts that are local to a particular workstation\. Using pam_localuser and pam_wheel or pam_listfile is an effective way to restrict access to either local users and/or a subset of the network\'s users\. .PP -This could also be implemented using pam_listfile.so and a very short awk script invoked by cron, but it's common enough to have been separated out. +This could also be implemented using pam_listfile\.so and a very short awk script invoked by cron, but it\'s common enough to have been separated out\. .SH "OPTIONS" .PP .PP \fBdebug\fR -.RS 3n -Print debug information. +.RS 4 +Print debug information\. .RE .PP \fBfile=\fR\fB\fI/path/passwd\fR\fR -.RS 3n +.RS 4 Use a file other than -\fI/etc/passwd\fR. +\fI/etc/passwd\fR\. .RE .SH "MODULE SERVICES PROVIDED" .PP @@ -39,34 +39,34 @@ All services (\fBaccount\fR, \fBauth\fR, \fBpassword\fR and -\fBsession\fR) are supported. +\fBsession\fR) are supported\. .SH "RETURN VALUES" .PP .PP PAM_SUCCESS -.RS 3n -The new localuser was set successfull. +.RS 4 +The new localuser was set successfull\. .RE .PP PAM_SERVICE_ERR -.RS 3n -No username was given. +.RS 4 +No username was given\. .RE .PP PAM_USER_UNKNOWN -.RS 3n -User not known. +.RS 4 +User not known\. .RE .SH "EXAMPLES" .PP Add the following line to -\fI/etc/pam.d/su\fR -to allow only local users in group wheel to use su. +\fI/etc/pam\.d/su\fR +to allow only local users in group wheel to use su\. .sp -.RS 3n +.RS 4 .nf -account sufficient pam_localuser.so -account required pam_wheel.so +account sufficient pam_localuser\.so +account required pam_wheel\.so .fi .RE @@ -74,8 +74,8 @@ account required pam_wheel.so .SH "FILES" .PP \fI/etc/passwd\fR -.RS 3n -Local user account information. +.RS 4 +Local user account information\. .RE .SH "SEE ALSO" .PP @@ -85,4 +85,4 @@ Local user account information. \fBpam\fR(8) .SH "AUTHOR" .PP -pam_localuser was written by Nalin Dahyabhai <nalin@redhat.com>. +pam_localuser was written by Nalin Dahyabhai <nalin@redhat\.com>\. diff --git a/Linux-PAM/modules/pam_loginuid/pam_loginuid.8 b/Linux-PAM/modules/pam_loginuid/pam_loginuid.8 index ef0f95f1..f914c41d 100644 --- a/Linux-PAM/modules/pam_loginuid/pam_loginuid.8 +++ b/Linux-PAM/modules/pam_loginuid/pam_loginuid.8 @@ -1,48 +1,52 @@ .\" Title: pam_loginuid .\" Author: -.\" Generator: DocBook XSL Stylesheets vsnapshot_2006\-08\-24_0226 <http://docbook.sf.net/> -.\" Date: 09/06/2006 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "PAM_LOGINUID" "8" "09/06/2006" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_LOGINUID" "8" "01/08/2008" "Linux-PAM Manual" "Linux\-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_loginuid \- Record user's login uid to the process attribute +pam_loginuid - Record user's login uid to the process attribute .SH "SYNOPSIS" .HP 16 -\fBpam_loginuid.so\fR [require_auditd] +\fBpam_loginuid\.so\fR [require_auditd] .SH "DESCRIPTION" .PP -The pam_loginuid module sets the loginuid process attribute for the process that was authenticated. This is necessary for applications to be correctly audited. This PAM module should only be used for entry point applications like: login, sshd, gdm, vsftpd, crond and atd. There are probably other entry point applications besides these. You should not use it for applications like sudo or su as that defeats the purpose by changing the loginuid to the account they just switched to. +The pam_loginuid module sets the loginuid process attribute for the process that was authenticated\. This is necessary for applications to be correctly audited\. This PAM module should only be used for entry point applications like: login, sshd, gdm, vsftpd, crond and atd\. There are probably other entry point applications besides these\. You should not use it for applications like sudo or su as that defeats the purpose by changing the loginuid to the account they just switched to\. .SH "OPTIONS" -.TP 3n +.PP \fBrequire_auditd\fR -This option, when given, will cause this module to query the audit daemon status and deny logins if it is not running. +.RS 4 +This option, when given, will cause this module to query the audit daemon status and deny logins if it is not running\. +.RE .SH "MODULE SERVICES PROVIDED" .PP The \fBsession\fR -service is supported. +service is supported\. .SH "RETURN VALUES" .PP -.TP 3n +.PP PAM_SESSION_ERR -An error occured during session management. +.RS 4 +An error occured during session management\. +.RE .SH "EXAMPLES" .sp -.RS 3n +.RS 4 .nf -#%PAM\-1.0 -auth required pam_unix.so -auth required pam_nologin.so -account required pam_unix.so -password required pam_unix.so -session required pam_unix.so -session required pam_loginuid.so +#%PAM\-1\.0 +auth required pam_unix\.so +auth required pam_nologin\.so +account required pam_unix\.so +password required pam_unix\.so +session required pam_unix\.so +session required pam_loginuid\.so .fi .RE @@ -56,4 +60,4 @@ session required pam_loginuid.so \fBauditd\fR(8) .SH "AUTHOR" .PP -pam_loginuid was written by Steve Grubb <sgrubb@redhat.com> +pam_loginuid was written by Steve Grubb <sgrubb@redhat\.com> diff --git a/Linux-PAM/modules/pam_mail/pam_mail.8 b/Linux-PAM/modules/pam_mail/pam_mail.8 index 6d8a69a8..4c575a90 100644 --- a/Linux-PAM/modules/pam_mail/pam_mail.8 +++ b/Linux-PAM/modules/pam_mail/pam_mail.8 @@ -1,26 +1,26 @@ .\" Title: pam_mail .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/> -.\" Date: 06/09/2006 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "PAM_MAIL" "8" "06/09/2006" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_MAIL" "8" "01/08/2008" "Linux-PAM Manual" "Linux\-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_mail \- Inform about available mail +pam_mail - Inform about available mail .SH "SYNOPSIS" .HP 12 -\fBpam_mail.so\fR [close] [debug] [dir=\fImaildir\fR] [empty] [hash=\fIcount\fR] [noenv] [nopen] [quit] [standard] +\fBpam_mail\.so\fR [close] [debug] [dir=\fImaildir\fR] [empty] [hash=\fIcount\fR] [noenv] [nopen] [quit] [standard] .SH "DESCRIPTION" .PP -The pam_mail PAM module provides the "you have new mail" service to the user. It can be plugged into any application that has credential or session hooks. It gives a single message indicating the +The pam_mail PAM module provides the "you have new mail" service to the user\. It can be plugged into any application that has credential or session hooks\. It gives a single message indicating the \fInewness\fR -of any mail it finds in the user's mail folder. This module also sets the PAM environment variable, -\fBMAIL\fR, to the user's mail directory. +of any mail it finds in the user\'s mail folder\. This module also sets the PAM environment variable, +\fBMAIL\fR, to the user\'s mail directory\. .PP If the mail spool file (be it \fI/var/mail/$USER\fR @@ -28,76 +28,102 @@ or a pathname given with the \fBdir=\fR parameter) is a directory then pam_mail assumes it is in the \fIMaildir\fR -format. +format\. .SH "OPTIONS" .PP -.TP 3n +.PP \fBclose\fR -Indicate if the user has any mail also on logout. -.TP 3n +.RS 4 +Indicate if the user has any mail also on logout\. +.RE +.PP \fBdebug\fR -Print debug information. -.TP 3n +.RS 4 +Print debug information\. +.RE +.PP \fBdir=\fR\fB\fImaildir\fR\fR -Look for the users' mail in an alternative location defined by -\fImaildir/<login>\fR. The default location for mail is -\fI/var/mail/<login>\fR. Note, if the supplied +.RS 4 +Look for the users\' mail in an alternative location defined by +\fImaildir/<login>\fR\. The default location for mail is +\fI/var/mail/<login>\fR\. Note, if the supplied \fImaildir\fR -is prefixed by a '~', the directory is interpreted as indicating a file in the user's home directory. -.TP 3n +is prefixed by a \'~\', the directory is interpreted as indicating a file in the user\'s home directory\. +.RE +.PP \fBempty\fR -Also print message if user has no mail. -.TP 3n +.RS 4 +Also print message if user has no mail\. +.RE +.PP \fBhash=\fR\fB\fIcount\fR\fR -Mail directory hash depth. For example, a +.RS 4 +Mail directory hash depth\. For example, a \fIhashcount\fR of 2 would make the mail file be -\fI/var/spool/mail/u/s/user\fR. -.TP 3n +\fI/var/spool/mail/u/s/user\fR\. +.RE +.PP \fBnoenv\fR +.RS 4 Do not set the \fBMAIL\fR -environment variable. -.TP 3n +environment variable\. +.RE +.PP \fBnopen\fR -Don't print any mail information on login. This flag is useful to get the +.RS 4 +Don\'t print any mail information on login\. This flag is useful to get the \fBMAIL\fR -environment variable set, but to not display any information about it. -.TP 3n +environment variable set, but to not display any information about it\. +.RE +.PP \fBquiet\fR -Only report when there is new mail. -.TP 3n +.RS 4 +Only report when there is new mail\. +.RE +.PP \fBstandard\fR -Old style "You have..." format which doesn't show the mail spool being used. This also implies "empty". +.RS 4 +Old style "You have\.\.\." format which doesn\'t show the mail spool being used\. This also implies "empty"\. +.RE .SH "MODULE SERVICES PROVIDED" .PP The \fBauth\fR and \fBaccount\fR -services are supported. +services are supported\. .SH "RETURN VALUES" -.TP 3n +.PP PAM_BUF_ERR -Memory buffer error. -.TP 3n +.RS 4 +Memory buffer error\. +.RE +.PP PAM_SERVICE_ERR -Badly formed arguments. -.TP 3n +.RS 4 +Badly formed arguments\. +.RE +.PP PAM_SUCCESS -Success. -.TP 3n +.RS 4 +Success\. +.RE +.PP PAM_USER_UNKNOWN -User not known. +.RS 4 +User not known\. +.RE .SH "EXAMPLES" .PP Add the following line to -\fI/etc/pam.d/login\fR -to indicate that the user has new mail when they login to the system. +\fI/etc/pam\.d/login\fR +to indicate that the user has new mail when they login to the system\. .sp -.RS 3n +.RS 4 .nf -session optional pam_mail.so standard +session optional pam_mail\.so standard .fi .RE @@ -110,4 +136,4 @@ session optional pam_mail.so standard \fBpam\fR(8) .SH "AUTHOR" .PP -pam_mail was written by Andrew G. Morgan <morgan@kernel.org>. +pam_mail was written by Andrew G\. Morgan <morgan@kernel\.org>\. diff --git a/Linux-PAM/modules/pam_mkhomedir/pam_mkhomedir.8 b/Linux-PAM/modules/pam_mkhomedir/pam_mkhomedir.8 index 1364e01f..a6a096d0 100644 --- a/Linux-PAM/modules/pam_mkhomedir/pam_mkhomedir.8 +++ b/Linux-PAM/modules/pam_mkhomedir/pam_mkhomedir.8 @@ -1,82 +1,100 @@ .\" Title: pam_mkhomedir .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/> -.\" Date: 06/02/2006 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "PAM_MKHOMEDIR" "8" "06/02/2006" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_MKHOMEDIR" "8" "01/08/2008" "Linux-PAM Manual" "Linux-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_mkhomedir \- PAM module to create users home directory +pam_mkhomedir - PAM module to create users home directory .SH "SYNOPSIS" .HP 17 -\fBpam_mkhomedir.so\fR [silent] [umask=\fImode\fR] [skel=\fIskeldir\fR] +\fBpam_mkhomedir\.so\fR [silent] [umask=\fImode\fR] [skel=\fIskeldir\fR] .SH "DESCRIPTION" .PP -The pam_mkhomedir PAM module will create a users home directory if it does not exist when the session begins. This allows users to be present in central database (such as NIS, kerberos or LDAP) without using a distributed file system or pre\-creating a large number of directories. The skeleton directory (usually -\fI/etc/skel/\fR) is used to copy default files and also set's a umask for the creation. +The pam_mkhomedir PAM module will create a users home directory if it does not exist when the session begins\. This allows users to be present in central database (such as NIS, kerberos or LDAP) without using a distributed file system or pre\-creating a large number of directories\. The skeleton directory (usually +\fI/etc/skel/\fR) is used to copy default files and also set\'s a umask for the creation\. .PP -The new users home directory will not be removed after logout of the user. +The new users home directory will not be removed after logout of the user\. .SH "OPTIONS" -.TP 3n +.PP \fBsilent\fR -Don't print informative messages. -.TP 3n +.RS 4 +Don\'t print informative messages\. +.RE +.PP \fBumask=\fR\fB\fImask\fR\fR +.RS 4 The user file\-creation mask is set to -\fImask\fR. The default value of mask is 0022. -.TP 3n +\fImask\fR\. The default value of mask is 0022\. +.RE +.PP \fBskel=\fR\fB\fI/path/to/skel/directory\fR\fR +.RS 4 Indicate an alternative \fIskel\fR directory to override the default -\fI/etc/skel\fR. +\fI/etc/skel\fR\. +.RE .SH "MODULE SERVICES PROVIDED" .PP Only the \fBsession\fR -service is supported. +service is supported\. .SH "RETURN VALUES" -.TP 3n +.PP PAM_BUF_ERR -Memory buffer error. -.TP 3n +.RS 4 +Memory buffer error\. +.RE +.PP PAM_CRED_INSUFFICIENT -Insufficient credentials to access authentication data. -.TP 3n +.RS 4 +Insufficient credentials to access authentication data\. +.RE +.PP PAM_PERM_DENIED -Not enough permissions to create the new directory or read the skel directory. -.TP 3n +.RS 4 +Not enough permissions to create the new directory or read the skel directory\. +.RE +.PP PAM_USER_UNKNOWN -User not known to the underlying authentication module. -.TP 3n +.RS 4 +User not known to the underlying authentication module\. +.RE +.PP PAM_SUCCESS -Environment variables were set. +.RS 4 +Environment variables were set\. +.RE .SH "FILES" -.TP 3n +.PP \fI/etc/skel\fR +.RS 4 Default skel directory +.RE .SH "EXAMPLES" .PP -A sample /etc/pam.d/login file: +A sample /etc/pam\.d/login file: .sp -.RS 3n +.RS 4 .nf - auth requisite pam_securetty.so - auth sufficient pam_ldap.so - auth required pam_unix.so - auth required pam_nologin.so - account sufficient pam_ldap.so - account required pam_unix.so - password required pam_unix.so - session required pam_mkhomedir.so skel=/etc/skel/ umask=0022 - session required pam_unix.so - session optional pam_lastlog.so - session optional pam_mail.so standard + auth requisite pam_securetty\.so + auth sufficient pam_ldap\.so + auth required pam_unix\.so + auth required pam_nologin\.so + account sufficient pam_ldap\.so + account required pam_unix\.so + password required pam_unix\.so + session required pam_mkhomedir\.so skel=/etc/skel/ umask=0022 + session required pam_unix\.so + session optional pam_lastlog\.so + session optional pam_mail\.so standard .fi .RE @@ -85,7 +103,7 @@ A sample /etc/pam.d/login file: .PP \fBpam.d\fR(8), -\fBpam\fR(8). +\fBpam\fR(8)\. .SH "AUTHOR" .PP -pam_mkhomedir was written by Jason Gunthorpe <jgg@debian.org>. +pam_mkhomedir was written by Jason Gunthorpe <jgg@debian\.org>\. diff --git a/Linux-PAM/modules/pam_motd/pam_motd.8 b/Linux-PAM/modules/pam_motd/pam_motd.8 index 74bfb586..0368be06 100644 --- a/Linux-PAM/modules/pam_motd/pam_motd.8 +++ b/Linux-PAM/modules/pam_motd/pam_motd.8 @@ -1,53 +1,53 @@ .\" Title: pam_motd .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.0 <http://docbook.sf.net/> -.\" Date: 10/26/2006 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "PAM_MOTD" "8" "10/26/2006" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_MOTD" "8" "01/08/2008" "Linux-PAM Manual" "Linux\-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_motd \- Display the motd file +pam_motd - Display the motd file .SH "SYNOPSIS" .HP 12 -\fBpam_motd.so\fR [motd=\fI/path/filename\fR] +\fBpam_motd\.so\fR [motd=\fI/path/filename\fR] .SH "DESCRIPTION" .PP -pam_motd is a PAM module that can be used to display arbitrary motd (message of the day) files after a succesful login. By default the +pam_motd is a PAM module that can be used to display arbitrary motd (message of the day) files after a succesful login\. By default the \fI/etc/motd\fR -file is shown. The message size is limited to 64KB. +file is shown\. The message size is limited to 64KB\. .SH "OPTIONS" .PP \fBmotd=\fR\fB\fI/path/filename\fR\fR -.RS 3n +.RS 4 The \fI/path/filename\fR -file is displayed as message of the day. +file is displayed as message of the day\. .RE .SH "MODULE SERVICES PROVIDED" .PP Only the \fBsession\fR -service is supported. +service is supported\. .SH "RETURN VALUES" .PP PAM_IGNORE -.RS 3n -This is the only return value of this module. +.RS 4 +This is the only return value of this module\. .RE .SH "EXAMPLES" .PP The suggested usage for -\fI/etc/pam.d/login\fR +\fI/etc/pam\.d/login\fR is: .sp -.RS 3n +.RS 4 .nf -session optional pam_motd.so motd=/etc/motd +session optional pam_motd\.so motd=/etc/motd .fi .RE @@ -61,4 +61,4 @@ session optional pam_motd.so motd=/etc/motd \fBpam\fR(8) .SH "AUTHOR" .PP -pam_motd was written by Ben Collins <bcollins@debian.org>. +pam_motd was written by Ben Collins <bcollins@debian\.org>\. diff --git a/Linux-PAM/modules/pam_namespace/Makefile.am b/Linux-PAM/modules/pam_namespace/Makefile.am index 002678ba..05d47cf3 100644 --- a/Linux-PAM/modules/pam_namespace/Makefile.am +++ b/Linux-PAM/modules/pam_namespace/Makefile.am @@ -15,13 +15,14 @@ endif EXTRA_DIST = README namespace.conf namespace.init $(MAN5) $(MAN8) $(XMLS) tst-pam_namespace -noinst_HEADERS = md5.h +noinst_HEADERS = md5.h pam_namespace.h argv_parse.h securelibdir = $(SECUREDIR) secureconfdir = $(SCONFIGDIR) +namespaceddir = $(SCONFIGDIR)/namespace.d AM_CFLAGS = -I$(top_srcdir)/libpam/include -I$(top_srcdir)/libpamc/include \ - -DPAM_NAMESPACE_CONFIG=\"$(SCONFIGDIR)/namespace.conf\" + -DSECURECONF_DIR=\"$(SCONFIGDIR)/\" AM_LDFLAGS = -no-undefined -avoid-version -module if HAVE_VERSIONING AM_LDFLAGS += -Wl,--version-script=$(srcdir)/../modules.map @@ -29,11 +30,13 @@ endif if HAVE_UNSHARE securelib_LTLIBRARIES = pam_namespace.la -pam_namespace_la_SOURCES = pam_namespace.c pam_namespace.h md5.c md5.h +pam_namespace_la_SOURCES = pam_namespace.c md5.c argv_parse.c pam_namespace_la_LIBADD = -L$(top_builddir)/libpam -lpam @LIBSELINUX@ secureconf_DATA = namespace.conf secureconf_SCRIPTS = namespace.init +namespaced_DATA = + TESTS = tst-pam_namespace man_MANS = $(MAN5) $(MAN8) endif diff --git a/Linux-PAM/modules/pam_namespace/argv_parse.c b/Linux-PAM/modules/pam_namespace/argv_parse.c new file mode 100644 index 00000000..acc76d74 --- /dev/null +++ b/Linux-PAM/modules/pam_namespace/argv_parse.c @@ -0,0 +1,165 @@ +/* + * argv_parse.c --- utility function for parsing a string into a + * argc, argv array. + * + * This file defines a function argv_parse() which parsing a + * passed-in string, handling double quotes and backslashes, and + * creates an allocated argv vector which can be freed using the + * argv_free() function. + * + * See argv_parse.h for the formal definition of the functions. + * + * Copyright 1999 by Theodore Ts'o. + * + * Permission to use, copy, modify, and distribute this software for + * any purpose with or without fee is hereby granted, provided that + * the above copyright notice and this permission notice appear in all + * copies. THE SOFTWARE IS PROVIDED "AS IS" AND THEODORE TS'O (THE + * AUTHOR) DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, + * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. + * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER + * RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION + * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR + * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. (Isn't + * it sick that the U.S. culture of lawsuit-happy lawyers requires + * this kind of disclaimer?) + * + * Version 1.1, modified 2/27/1999 + */ + +#include <stdlib.h> +#include <ctype.h> +#include <string.h> +#include "argv_parse.h" + +#define STATE_WHITESPACE 1 +#define STATE_TOKEN 2 +#define STATE_QUOTED 3 + +/* + * Returns 0 on success, -1 on failure. + */ +int argv_parse(const char *in_buf, int *ret_argc, char ***ret_argv) +{ + int argc = 0, max_argc = 0; + char **argv, **new_argv, *buf, ch; + const char *cp = 0; + char *outcp = 0; + int state = STATE_WHITESPACE; + + buf = malloc(strlen(in_buf)+1); + if (!buf) + return -1; + + max_argc = 0; argc = 0; argv = 0; + outcp = buf; + for (cp = in_buf; (ch = *cp); cp++) { + if (state == STATE_WHITESPACE) { + if (isspace((int) ch)) + continue; + /* Not whitespace, so start a new token */ + state = STATE_TOKEN; + if (argc >= max_argc) { + max_argc += 3; + new_argv = realloc(argv, + (max_argc+1)*sizeof(char *)); + if (!new_argv) { + if (argv) free(argv); + free(buf); + return -1; + } + argv = new_argv; + } + argv[argc++] = outcp; + } + if (state == STATE_QUOTED) { + if (ch == '"') + state = STATE_TOKEN; + else + *outcp++ = ch; + continue; + } + /* Must be processing characters in a word */ + if (isspace((int) ch)) { + /* + * Terminate the current word and start + * looking for the beginning of the next word. + */ + *outcp++ = 0; + state = STATE_WHITESPACE; + continue; + } + if (ch == '"') { + state = STATE_QUOTED; + continue; + } + if (ch == '\\') { + ch = *++cp; + switch (ch) { + case '\0': + ch = '\\'; cp--; break; + case 'n': + ch = '\n'; break; + case 't': + ch = '\t'; break; + case 'b': + ch = '\b'; break; + } + } + *outcp++ = ch; + } + if (state != STATE_WHITESPACE) + *outcp++ = '\0'; + if (argv == 0) { + argv = malloc(sizeof(char *)); + free(buf); + } + argv[argc] = 0; + if (ret_argc) + *ret_argc = argc; + if (ret_argv) + *ret_argv = argv; + return 0; +} + +void argv_free(char **argv) +{ + if (*argv) + free(*argv); + free(argv); +} + +#ifdef DEBUG_ARGV_PARSE +/* + * For debugging + */ + +#include <stdio.h> + +int main(int argc, char **argv) +{ + int ac, ret; + char **av, **cpp; + char buf[256]; + + while (!feof(stdin)) { + if (fgets(buf, sizeof(buf), stdin) == NULL) + break; + ret = argv_parse(buf, &ac, &av); + if (ret != 0) { + printf("Argv_parse returned %d!\n", ret); + continue; + } + printf("Argv_parse returned %d arguments...\n", ac); + for (cpp = av; *cpp; cpp++) { + if (cpp != av) + printf(", "); + printf("'%s'", *cpp); + } + printf("\n"); + argv_free(av); + } + exit(0); +} +#endif diff --git a/Linux-PAM/modules/pam_namespace/argv_parse.h b/Linux-PAM/modules/pam_namespace/argv_parse.h new file mode 100644 index 00000000..c7878fc1 --- /dev/null +++ b/Linux-PAM/modules/pam_namespace/argv_parse.h @@ -0,0 +1,43 @@ +/* + * argv_parse.h --- header file for the argv parser. + * + * This file defines the interface for the functions argv_parse() and + * argv_free(). + * + *********************************************************************** + * int argv_parse(char *in_buf, int *ret_argc, char ***ret_argv) + * + * This function takes as its first argument a string which it will + * parse into an argv argument vector, with each white-space separated + * word placed into its own slot in the argv. This function handles + * double quotes and backslashes so that the parsed words can contain + * special characters. The count of the number words found in the + * parsed string, as well as the argument vector, are returned into + * ret_argc and ret_argv, respectively. + *********************************************************************** + * extern void argv_free(char **argv); + * + * This function frees the argument vector created by argv_parse(). + *********************************************************************** + * + * Copyright 1999 by Theodore Ts'o. + * + * Permission to use, copy, modify, and distribute this software for + * any purpose with or without fee is hereby granted, provided that + * the above copyright notice and this permission notice appear in all + * copies. THE SOFTWARE IS PROVIDED "AS IS" AND THEODORE TS'O (THE + * AUTHOR) DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, + * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. + * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER + * RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION + * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR + * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. (Isn't + * it sick that the U.S. culture of lawsuit-happy lawyers requires + * this kind of disclaimer?) + * + * Version 1.1, modified 2/27/1999 + */ + +extern int argv_parse(const char *in_buf, int *ret_argc, char ***ret_argv); +extern void argv_free(char **argv); diff --git a/Linux-PAM/modules/pam_namespace/namespace.conf.5 b/Linux-PAM/modules/pam_namespace/namespace.conf.5 index 0a4d98e4..6a3cc9e3 100644 --- a/Linux-PAM/modules/pam_namespace/namespace.conf.5 +++ b/Linux-PAM/modules/pam_namespace/namespace.conf.5 @@ -1,95 +1,133 @@ .\" Title: namespace.conf .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/> -.\" Date: 06/20/2007 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 02/13/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "NAMESPACE.CONF" "5" "06/20/2007" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "NAMESPACE\.CONF" "5" "02/13/2008" "Linux-PAM Manual" "Linux\-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -namespace.conf \- the namespace configuration file +namespace.conf - the namespace configuration file .SH "DESCRIPTION" .PP -This module allows setup of private namespaces with polyinstantiated directories. Directories can be polyinstantiated based on user name or, in the case of SELinux, user name, sensitivity level or complete security context. If an executable script -\fI/etc/security/namespace.init\fR -exists, it is used to initialize the namespace every time a new instance directory is setup. The script receives the polyinstantiated directory path and the instance directory path as its arguments. +The +\fIpam_namespace\.so\fR +module allows setup of private namespaces with polyinstantiated directories\. Directories can be polyinstantiated based on user name or, in the case of SELinux, user name, sensitivity level or complete security context\. If an executable script +\fI/etc/security/namespace\.init\fR +exists, it is used to initialize the namespace every time a new instance directory is setup\. The script receives the polyinstantiated directory path and the instance directory path as its arguments\. .PP The -\fI/etc/security/namespace.conf\fR -file specifies which directories are polyinstantiated, how they are polyinstantiated, how instance directories would be named, and any users for whom polyinstantiation would not be performed. +\fI/etc/security/namespace\.conf\fR +file specifies which directories are polyinstantiated, how they are polyinstantiated, how instance directories would be named, and any users for whom polyinstantiation would not be performed\. .PP When someone logs in, the file -\fInamespace.conf\fR -is scanned where each non comment line represents one polyinstantiated directory with space separated fields as follows: +\fInamespace\.conf\fR +is scanned\. Comments are marked by +\fI#\fR +characters\. Each non comment line represents one polyinstantiated directory\. The fields are separated by spaces but can be quoted by +\fI"\fR +characters also escape sequences +\fI\eb\fR, +\fI\en\fR, and +\fI\et\fR +are recognized\. The fields are as follows: .PP - \fIpolydir\fR -\fI instance_prefix\fR -\fI method\fR -\fI list_of_uids\fR +\fIinstance_prefix\fR +\fImethod\fR +\fIlist_of_uids\fR .PP The first field, -\fIpolydir\fR, is the absolute pathname of the directory to polyinstantiate. Special entry $HOME is supported to designate user's home directory. This field cannot be blank. +\fIpolydir\fR, is the absolute pathname of the directory to polyinstantiate\. The special string +\fI$HOME\fR +is replaced with the user\'s home directory, and +\fI$USER\fR +with the username\. This field cannot be blank\. .PP The second field, \fIinstance_prefix\fR -is the string prefix used to build the pathname for the instantiation of <polydir>. Depending on the polyinstantiation +is the string prefix used to build the pathname for the instantiation of <polydir>\. Depending on the polyinstantiation \fImethod\fR -it is then appended with "instance differentiation string" to generate the final instance directory path. This directory is created if it did not exist already, and is then bind mounted on the <polydir> to provide an instance of <polydir> based on the <method> column. The special string $HOME is replaced with the user's home directory, and $USER with the username. This field cannot be blank. The directory where polyinstantiated instances are to be created, must exist and must have, by default, the mode of 000. The requirement that the instance parent be of mode 000 can be overridden with the command line option -\fIignore_instance_parent_mode\fR +it is then appended with "instance differentiation string" to generate the final instance directory path\. This directory is created if it did not exist already, and is then bind mounted on the <polydir> to provide an instance of <polydir> based on the <method> column\. The special string +\fI$HOME\fR +is replaced with the user\'s home directory, and +\fI$USER\fR +with the username\. This field cannot be blank\. .PP The third field, -\fImethod\fR, is the method used for polyinstantiation. It can take 3 different values; "user" for polyinstantiation based on user name, "level" for polyinstantiation based on process MLS level and user name, and "context" for polyinstantiation based on process security context and user name Methods "context" and "level" are only available with SELinux. This field cannot be blank. +\fImethod\fR, is the method used for polyinstantiation\. It can take these values; "user" for polyinstantiation based on user name, "level" for polyinstantiation based on process MLS level and user name, "context" for polyinstantiation based on process security context and user name, "tmpfs" for mounting tmpfs filesystem as an instance dir, and "tmpdir" for creating temporary directory as an instance dir which is removed when the user\'s session is closed\. Methods "context" and "level" are only available with SELinux\. This field cannot be blank\. .PP The fourth field, -\fIlist_of_uids\fR, is a comma separated list of user names for whom the polyinstantiation is not performed. If left blank, polyinstantiation will be performed for all users. +\fIlist_of_uids\fR, is a comma separated list of user names for whom the polyinstantiation is not performed\. If left blank, polyinstantiation will be performed for all users\. If the list is preceded with a single "~" character, polyinstantiation is performed only for users in the list\. +.PP +The +\fImethod\fR +field can contain also following optional flags separated by +\fI:\fR +characters\. +.PP +\fIcreate\fR=\fImode\fR,\fIowner\fR,\fIgroup\fR +\- create the polyinstantiated directory\. The mode, owner and group parameters are optional\. The default for mode is determined by umask, the default owner is the user whose session is opened, the default group is the primary group of the user\. +.PP +\fIiscript\fR=\fIpath\fR +\- path to the instance directory init script\. The base directory for relative paths is +\fI/etc/security/namespace\.d\fR\. +.PP +\fInoinit\fR +\- instance directory init script will not be executed\. +.PP +\fIshared\fR +\- the instance directories for "context" and "level" methods will not contain the user name and will be shared among all users\. +.PP +The directory where polyinstantiated instances are to be created, must exist and must have, by default, the mode of 0000\. The requirement that the instance parent be of mode 0000 can be overridden with the command line option +\fIignore_instance_parent_mode\fR .PP -In case of context or level polyinstantiation the SELinux context which is used for polyinstantiation is the context used for executing a new process as obtained by getexeccon. This context must be set by the calling application or -\fIpam_selinux.so\fR -module. If this context is not set the polyinstatiation will be based just on user name. +In case of context or level polyinstantiation the SELinux context which is used for polyinstantiation is the context used for executing a new process as obtained by getexeccon\. This context must be set by the calling application or +\fIpam_selinux\.so\fR +module\. If this context is not set the polyinstatiation will be based just on user name\. .PP -The "instance differentiation string" is <user name> for "user" method and <user name>_<raw directory context> for "context" and "level" methods. If the whole string is too long the end of it is replaced with md5sum of itself. Also when command line option +The "instance differentiation string" is <user name> for "user" method and <user name>_<raw directory context> for "context" and "level" methods\. If the whole string is too long the end of it is replaced with md5sum of itself\. Also when command line option \fIgen_hash\fR -is used the whole string is replaced with md5sum of itself. +is used the whole string is replaced with md5sum of itself\. .SH "EXAMPLES" .PP These are some example lines which might be specified in -\fI/etc/security/namespace.conf\fR. +\fI/etc/security/namespace\.conf\fR\. .sp .RS 4 .nf # The following three lines will polyinstantiate /tmp, - # /var/tmp and user's home directories. /tmp and /var/tmp + # /var/tmp and user\'s home directories\. /tmp and /var/tmp # will be polyinstantiated based on the security level # as well as user name, whereas home directory will be - # polyinstantiated based on the full security context and user name. + # polyinstantiated based on the full security context and user name\. # Polyinstantiation will not be performed for user root # and adm for directories /tmp and /var/tmp, whereas home - # directories will be polyinstantiated for all users. + # directories will be polyinstantiated for all users\. # # Note that instance directories do not have to reside inside - # the polyinstantiated directory. In the examples below, + # the polyinstantiated directory\. In the examples below, # instances of /tmp will be created in /tmp\-inst directory, # where as instances of /var/tmp and users home directories # will reside within the directories that are being - # polyinstantiated. + # polyinstantiated\. # /tmp /tmp\-inst/ level root,adm /var/tmp /var/tmp/tmp\-inst/ level root,adm - $HOME $HOME/$USER.inst/inst\- context + $HOME $HOME/$USER\.inst/inst\- context .fi .RE .PP -For the <service>s you need polyinstantiation (login for example) put the following line in /etc/pam.d/<service> as the last line for session group: +For the <service>s you need polyinstantiation (login for example) put the following line in /etc/pam\.d/<service> as the last line for session group: .PP -session required pam_namespace.so [arguments] +session required pam_namespace\.so [arguments] .PP -This module also depends on pam_selinux.so setting the context. +This module also depends on pam_selinux\.so setting the context\. .SH "SEE ALSO" .PP @@ -98,4 +136,4 @@ This module also depends on pam_selinux.so setting the context. \fBpam\fR(8) .SH "AUTHORS" .PP -The namespace.conf manual page was written by Janak Desai <janak@us.ibm.com>. +The namespace\.conf manual page was written by Janak Desai <janak@us\.ibm\.com>\. More features added by Tomas Mraz <tmraz@redhat\.com>\. diff --git a/Linux-PAM/modules/pam_namespace/namespace.conf.5.xml b/Linux-PAM/modules/pam_namespace/namespace.conf.5.xml index db48cdcb..a1769600 100644 --- a/Linux-PAM/modules/pam_namespace/namespace.conf.5.xml +++ b/Linux-PAM/modules/pam_namespace/namespace.conf.5.xml @@ -20,8 +20,9 @@ <title>DESCRIPTION</title> <para> - This module allows setup of private namespaces with polyinstantiated - directories. Directories can be polyinstantiated based on user name + The <emphasis>pam_namespace.so</emphasis> module allows setup of + private namespaces with polyinstantiated directories. + Directories can be polyinstantiated based on user name or, in the case of SELinux, user name, sensitivity level or complete security context. If an executable script <filename>/etc/security/namespace.init</filename> exists, it is used to initialize the namespace every time a new instance @@ -38,19 +39,23 @@ <para> When someone logs in, the file <filename>namespace.conf</filename> is - scanned where each non comment line represents one polyinstantiated - directory with space separated fields as follows: + scanned. Comments are marked by <emphasis>#</emphasis> characters. + Each non comment line represents one polyinstantiated + directory. The fields are separated by spaces but can be quoted by + <emphasis>"</emphasis> characters also escape + sequences <emphasis>\b</emphasis>, <emphasis>\n</emphasis>, and + <emphasis>\t</emphasis> are recognized. The fields are as follows: </para> - <para> - <replaceable>polydir</replaceable> <replaceable> instance_prefix</replaceable> <replaceable> method</replaceable> <replaceable> list_of_uids</replaceable> + <para><replaceable>polydir</replaceable> <replaceable>instance_prefix</replaceable> <replaceable>method</replaceable> <replaceable>list_of_uids</replaceable> </para> <para> The first field, <replaceable>polydir</replaceable>, is the absolute - pathname of the directory to polyinstantiate. Special entry $HOME is - supported to designate user's home directory. This field cannot be - blank. + pathname of the directory to polyinstantiate. The special string + <emphasis>$HOME</emphasis> is replaced with the user's home directory, + and <emphasis>$USER</emphasis> with the username. This field cannot + be blank. </para> <para> @@ -62,20 +67,20 @@ instance directory path. This directory is created if it did not exist already, and is then bind mounted on the <polydir> to provide an instance of <polydir> based on the <method> column. - The special string $HOME is replaced with the user's home directory, - and $USER with the username. This field cannot be blank. - The directory where polyinstantiated instances are to be - created, must exist and must have, by default, the mode of 000. The - requirement that the instance parent be of mode 000 can be overridden - with the command line option <replaceable>ignore_instance_parent_mode</replaceable> + The special string <emphasis>$HOME</emphasis> is replaced with the + user's home directory, and <emphasis>$USER</emphasis> with the username. + This field cannot be blank. </para> <para> The third field, <replaceable>method</replaceable>, is the method - used for polyinstantiation. It can take 3 different values; "user" + used for polyinstantiation. It can take these values; "user" for polyinstantiation based on user name, "level" for - polyinstantiation based on process MLS level and user name, and "context" for - polyinstantiation based on process security context and user name + polyinstantiation based on process MLS level and user name, "context" for + polyinstantiation based on process security context and user name, + "tmpfs" for mounting tmpfs filesystem as an instance dir, and + "tmpdir" for creating temporary directory as an instance dir which is + removed when the user's session is closed. Methods "context" and "level" are only available with SELinux. This field cannot be blank. </para> @@ -84,7 +89,41 @@ The fourth field, <replaceable>list_of_uids</replaceable>, is a comma separated list of user names for whom the polyinstantiation is not performed. If left blank, polyinstantiation will be performed - for all users. + for all users. If the list is preceded with a single "~" character, + polyinstantiation is performed only for users in the list. + </para> + + <para> + The <replaceable>method</replaceable> field can contain also following + optional flags separated by <emphasis>:</emphasis> characters. + </para> + + <para><emphasis>create</emphasis>=<replaceable>mode</replaceable>,<replaceable>owner</replaceable>,<replaceable>group</replaceable> + - create the polyinstantiated directory. The mode, owner and group parameters + are optional. The default for mode is determined by umask, the default + owner is the user whose session is opened, the default group is the + primary group of the user. + </para> + + <para><emphasis>iscript</emphasis>=<replaceable>path</replaceable> + - path to the instance directory init script. The base directory for relative + paths is <filename>/etc/security/namespace.d</filename>. + </para> + + <para><emphasis>noinit</emphasis> + - instance directory init script will not be executed. + </para> + + <para><emphasis>shared</emphasis> + - the instance directories for "context" and "level" methods will not + contain the user name and will be shared among all users. + </para> + + <para> + The directory where polyinstantiated instances are to be + created, must exist and must have, by default, the mode of 0000. The + requirement that the instance parent be of mode 0000 can be overridden + with the command line option <emphasis>ignore_instance_parent_mode</emphasis> </para> <para> @@ -101,7 +140,7 @@ method and <user name>_<raw directory context> for "context" and "level" methods. If the whole string is too long the end of it is replaced with md5sum of itself. Also when command line option - <replaceable>gen_hash</replaceable> is used the whole string is replaced + <emphasis>gen_hash</emphasis> is used the whole string is replaced with md5sum of itself. </para> @@ -165,6 +204,7 @@ <title>AUTHORS</title> <para> The namespace.conf manual page was written by Janak Desai <janak@us.ibm.com>. + More features added by Tomas Mraz <tmraz@redhat.com>. </para> </refsect1> </refentry> diff --git a/Linux-PAM/modules/pam_namespace/namespace.init b/Linux-PAM/modules/pam_namespace/namespace.init index 0e9be68f..424c6d0c 100755 --- a/Linux-PAM/modules/pam_namespace/namespace.init +++ b/Linux-PAM/modules/pam_namespace/namespace.init @@ -1,24 +1,24 @@ #!/bin/sh -p -# This is only a boilerplate for the instance initialization script. -# It receives polydir path as $1 and the instance path as $2. +# It receives polydir path as $1, the instance path as $2, +# a flag whether the instance dir was newly created (0 - no, 1 - yes) in $3, +# and user name in $4. # -# If you intend to polyinstantiate /tmp and you also want to use the X windows -# environment, you will have to use this script to bind mount the socket that -# is used by the X server to communicate with its clients. X server places -# this socket in /tmp/.X11-unix directory, which will get obscured by -# polyinstantiation. Uncommenting the following lines will bind mount -# the relevant directory at an alternative location (/.tmp/.X11-unix) such -# that the X server, window manager and X clients, can still find the -# socket X0 at the polyinstanted /tmp/.X11-unix. -# -#if [ $1 = /tmp ]; then -# if [ ! -f /.tmp/.X11-unix ]; then -# mkdir -p /.tmp/.X11-unix -# fi -# mount --bind /tmp/.X11-unix /.tmp/.X11-unix -# cp -fp -- /tmp/.X0-lock "$2/.X0-lock" -# mkdir -- "$2/.X11-unix" -# ln -fs -- /.tmp/.X11-unix/X0 "$2/.X11-unix/X0" -#fi +# The following section will copy the contents of /etc/skel if this is a +# newly created home directory. +if [ "$3" = 1 ]; then + # This line will fix the labeling on all newly created directories + [ -x /sbin/restorecon ] && /sbin/restorecon "$1" + user="$4" + passwd=$(getent passwd "$user") + homedir=$(echo "$passwd" | cut -f6 -d":") + if [ "$1" = "$homedir" ]; then + gid=$(echo "$passwd" | cut -f4 -d":") + cp -rT /etc/skel "$homedir" + chown -R "$user":"$gid" "$homedir" + mode=$(awk '/^UMASK/{gsub("#.*$", "", $2); printf "%o", and(0777,compl(strtonum("0" $2))); exit}' /etc/login.defs) + chmod ${mode:-700} "$homedir" + [ -x /sbin/restorecon ] && /sbin/restorecon -R "$homedir" + fi +fi exit 0 diff --git a/Linux-PAM/modules/pam_namespace/pam_namespace.8 b/Linux-PAM/modules/pam_namespace/pam_namespace.8 index 8d136c99..a318c57f 100644 --- a/Linux-PAM/modules/pam_namespace/pam_namespace.8 +++ b/Linux-PAM/modules/pam_namespace/pam_namespace.8 @@ -1,27 +1,27 @@ .\" Title: pam_namespace .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/> -.\" Date: 06/20/2007 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 02/13/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "PAM_NAMESPACE" "8" "06/20/2007" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_NAMESPACE" "8" "02/13/2008" "Linux-PAM Manual" "Linux-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_namespace \- PAM module for configuring namespace for a session +pam_namespace - PAM module for configuring namespace for a session .SH "SYNOPSIS" .HP 17 -\fBpam_namespace.so\fR [debug] [unmnt_remnt] [unmnt_only] [require_selinux] [gen_hash] [ignore_config_error] [ignore_instance_parent_mode] [no_unmount_on_close] +\fBpam_namespace\.so\fR [debug] [unmnt_remnt] [unmnt_only] [require_selinux] [gen_hash] [ignore_config_error] [ignore_instance_parent_mode] [no_unmount_on_close] [use_current_context] [use_default_context] .SH "DESCRIPTION" .PP -The pam_namespace PAM module sets up a private namespace for a session with polyinstantiated directories. A polyinstantiated directory provides a different instance of itself based on user name, or when using SELinux, user name, security context or both. If an executable script -\fI/etc/security/namespace.init\fR -exists, it is used to initialize the namespace every time a new instance directory is setup. The script receives the polyinstantiated directory path and the instance directory path as its arguments. +The pam_namespace PAM module sets up a private namespace for a session with polyinstantiated directories\. A polyinstantiated directory provides a different instance of itself based on user name, or when using SELinux, user name, security context or both\. If an executable script +\fI/etc/security/namespace\.init\fR +exists, it is used to initialize the namespace every time a new instance directory is setup\. The script receives the polyinstantiated directory path, the instance directory path, flag whether the instance directory was newly created (0 for no, 1 for yes), and the user name as its arguments\. .PP -The pam_namespace module disassociates the session namespace from the parent namespace. Any mounts/unmounts performed in the parent namespace, such as mounting of devices, are not reflected in the session namespace. To propagate selected mount/unmount events from the parent namespace into the disassociated session namespace, an administrator may use the special shared\-subtree feature. For additional information on shared\-subtree feature, please refer to the mount(8) man page and the shared\-subtree description at http://lwn.net/Articles/159077 and http://lwn.net/Articles/159092. +The pam_namespace module disassociates the session namespace from the parent namespace\. Any mounts/unmounts performed in the parent namespace, such as mounting of devices, are not reflected in the session namespace\. To propagate selected mount/unmount events from the parent namespace into the disassociated session namespace, an administrator may use the special shared\-subtree feature\. For additional information on shared\-subtree feature, please refer to the mount(8) man page and the shared\-subtree description at http://lwn\.net/Articles/159077 and http://lwn\.net/Articles/159092\. .SH "OPTIONS" .PP \fBdebug\fR @@ -31,7 +31,7 @@ A lot of debug information is logged using syslog .PP \fBunmnt_remnt\fR .RS 4 -For programs such as su and newrole, the login session has already setup a polyinstantiated namespace. For these programs, polyinstantiation is performed based on new user id or security context, however the command first needs to undo the polyinstantiation performed by login. This argument instructs the command to first undo previous polyinstantiation before proceeding with new polyinstantiation based on new id/context +For programs such as su and newrole, the login session has already setup a polyinstantiated namespace\. For these programs, polyinstantiation is performed based on new user id or security context, however the command first needs to undo the polyinstantiation performed by login\. This argument instructs the command to first undo previous polyinstantiation before proceeding with new polyinstantiation based on new id/context .RE .PP \fBunmnt_only\fR @@ -46,81 +46,101 @@ If selinux is not enabled, return failure .PP \fBgen_hash\fR .RS 4 -Instead of using the security context string for the instance name, generate and use its md5 hash. +Instead of using the security context string for the instance name, generate and use its md5 hash\. .RE .PP \fBignore_config_error\fR .RS 4 -If a line in the configuration file corresponding to a polyinstantiated directory contains format error, skip that line process the next line. Without this option, pam will return an error to the calling program resulting in termination of the session. +If a line in the configuration file corresponding to a polyinstantiated directory contains format error, skip that line process the next line\. Without this option, pam will return an error to the calling program resulting in termination of the session\. .RE .PP \fBignore_instance_parent_mode\fR .RS 4 -Instance parent directories by default are expected to have the restrictive mode of 000. Using this option, an administrator can choose to ignore the mode of the instance parent. This option should be used with caution as it will reduce security and isolation goals of the polyinstantiation mechanism. +Instance parent directories by default are expected to have the restrictive mode of 000\. Using this option, an administrator can choose to ignore the mode of the instance parent\. This option should be used with caution as it will reduce security and isolation goals of the polyinstantiation mechanism\. .RE .PP \fBno_unmount_on_close\fR .RS 4 -For certain trusted programs such as newrole, open session is called from a child process while the parent perfoms close session and pam end functions. For these commands use this option to instruct pam_close_session to not unmount the bind mounted polyinstantiated directory in the parent. +For certain trusted programs such as newrole, open session is called from a child process while the parent perfoms close session and pam end functions\. For these commands use this option to instruct pam_close_session to not unmount the bind mounted polyinstantiated directory in the parent\. +.RE +.PP +\fBuse_current_context\fR +.RS 4 +Useful for services which do not change the SELinux context with setexeccon call\. The module will use the current SELinux context of the calling process for the level and context polyinstantiation\. +.RE +.PP +\fBuse_default_context\fR +.RS 4 +Useful for services which do not use pam_selinux for changing the SELinux context with setexeccon call\. The module will use the default SELinux context of the user for the level and context polyinstantiation\. .RE .SH "MODULE SERVICES PROVIDED" .PP The \fBsession\fR -service is supported. +service is supported\. The module must not be called from multithreaded processes\. .SH "RETURN VALUES" .PP PAM_SUCCESS .RS 4 -Namespace setup was successful. +Namespace setup was successful\. .RE .PP PAM_SERVICE_ERR .RS 4 -Unexpected system error occurred while setting up namespace. +Unexpected system error occurred while setting up namespace\. .RE .PP PAM_SESSION_ERR .RS 4 -Unexpected namespace configuration error occurred. +Unexpected namespace configuration error occurred\. .RE .SH "FILES" .PP -\fI/etc/security/namespace.conf\fR +\fI/etc/security/namespace\.conf\fR +.RS 4 +Main configuration file +.RE +.PP +\fI/etc/security/namespace\.d\fR +.RS 4 +Directory for additional configuration files +.RE +.PP +\fI/etc/security/namespace\.init\fR .RS 4 -Configuration file +Init script for instance directories .RE .SH "EXAMPLES" .PP -For the <service>s you need polyinstantiation (login for example) put the following line in /etc/pam.d/<service> as the last line for session group: +For the <service>s you need polyinstantiation (login for example) put the following line in /etc/pam\.d/<service> as the last line for session group: .PP -session required pam_namespace.so [arguments] +session required pam_namespace\.so [arguments] .PP To use polyinstantiation with graphical display manager gdm, insert the following line, before exit 0, in /etc/gdm/PostSession/Default: .PP /usr/sbin/gdm\-safe\-restart .PP -This allows gdm to restart after each session and appropriately adjust namespaces of display manager and the X server. If polyinstantiation of /tmp is desired along with the graphical environment, then additional configuration changes are needed to address the interaction of X server and font server namespaces with their use of /tmp to create communication sockets. Please use the initialization script -\fI/etc/security/namespace.init\fR -to ensure that the X server and its clients can appropriately access the communication socket X0. Please refer to the sample instructions provided in the comment section of the instance initialization script -\fI/etc/security/namespace.init\fR. In addition, perform the following changes to use graphical environment with polyinstantiation of /tmp: +This allows gdm to restart after each session and appropriately adjust namespaces of display manager and the X server\. If polyinstantiation of /tmp is desired along with the graphical environment, then additional configuration changes are needed to address the interaction of X server and font server namespaces with their use of /tmp to create communication sockets\. Please use the initialization script +\fI/etc/security/namespace\.init\fR +to ensure that the X server and its clients can appropriately access the communication socket X0\. Please refer to the sample instructions provided in the comment section of the instance initialization script +\fI/etc/security/namespace\.init\fR\. In addition, perform the following changes to use graphical environment with polyinstantiation of /tmp: .PP .sp .RS 4 .nf - 1. Disable the use of font server by commenting out "FontPath" - line in /etc/X11/xorg.conf. If you do want to use the font server + 1\. Disable the use of font server by commenting out "FontPath" + line in /etc/X11/xorg\.conf\. If you do want to use the font server then you will have to augment the instance initialization - script to appropriately provide /tmp/.font\-unix from the - polyinstantiated /tmp. - 2. Ensure that the gdm service is setup to use pam_namespace, - as described above, by modifying /etc/pam.d/gdm. - 3. Ensure that the display manager is configured to restart X server - with each new session. This default setup can be verified by - making sure that /usr/share/gdm/defaults.conf contains + script to appropriately provide /tmp/\.font\-unix from the + polyinstantiated /tmp\. + 2\. Ensure that the gdm service is setup to use pam_namespace, + as described above, by modifying /etc/pam\.d/gdm\. + 3\. Ensure that the display manager is configured to restart X server + with each new session\. This default setup can be verified by + making sure that /usr/share/gdm/defaults\.conf contains "AlwaysRestartServer=true", and it is not overridden by - /etc/gdm/custom.conf. + /etc/gdm/custom\.conf\. .fi .RE @@ -131,7 +151,7 @@ to ensure that the X server and its clients can appropriately access the communi \fBnamespace.conf\fR(5), \fBpam.d\fR(8), \fBmount\fR(8), -\fBpam\fR(8). +\fBpam\fR(8)\. .SH "AUTHORS" .PP -The namespace setup scheme was designed by Stephen Smalley, Janak Desai and Chad Sellers. The pam_namespace PAM module was developed by Janak Desai <janak@us.ibm.com>, Chad Sellers <csellers@tresys.com> and Steve Grubb <sgrubb@redhat.com>. +The namespace setup scheme was designed by Stephen Smalley, Janak Desai and Chad Sellers\. The pam_namespace PAM module was developed by Janak Desai <janak@us\.ibm\.com>, Chad Sellers <csellers@tresys\.com> and Steve Grubb <sgrubb@redhat\.com>\. Additional improvements by Xavier Toth <txtoth@gmail\.com> and Tomas Mraz <tmraz@redhat\.com>\. diff --git a/Linux-PAM/modules/pam_namespace/pam_namespace.8.xml b/Linux-PAM/modules/pam_namespace/pam_namespace.8.xml index e1b307ae..32c5359d 100644 --- a/Linux-PAM/modules/pam_namespace/pam_namespace.8.xml +++ b/Linux-PAM/modules/pam_namespace/pam_namespace.8.xml @@ -46,6 +46,12 @@ <arg choice="opt"> no_unmount_on_close </arg> + <arg choice="opt"> + use_current_context + </arg> + <arg choice="opt"> + use_default_context + </arg> </cmdsynopsis> </refsynopsisdiv> @@ -60,7 +66,9 @@ script <filename>/etc/security/namespace.init</filename> exists, it is used to initialize the namespace every time a new instance directory is setup. The script receives the polyinstantiated - directory path and the instance directory path as its arguments. + directory path, the instance directory path, flag whether the instance + directory was newly created (0 for no, 1 for yes), and the user name + as its arguments. </para> <para> @@ -198,13 +206,42 @@ </listitem> </varlistentry> + <varlistentry> + <term> + <option>use_current_context</option> + </term> + <listitem> + <para> + Useful for services which do not change the SELinux context + with setexeccon call. The module will use the current SELinux + context of the calling process for the level and context + polyinstantiation. + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term> + <option>use_default_context</option> + </term> + <listitem> + <para> + Useful for services which do not use pam_selinux for changing + the SELinux context with setexeccon call. The module will use + the default SELinux context of the user for the level and context + polyinstantiation. + </para> + </listitem> + </varlistentry> + </variablelist> </refsect1> <refsect1 id="pam_namespace-services"> <title>MODULE SERVICES PROVIDED</title> <para> - The <option>session</option> service is supported. + The <option>session</option> service is supported. The module must not + be called from multithreaded processes. </para> </refsect1> @@ -244,7 +281,21 @@ <varlistentry> <term><filename>/etc/security/namespace.conf</filename></term> <listitem> - <para>Configuration file</para> + <para>Main configuration file</para> + </listitem> + </varlistentry> + + <varlistentry> + <term><filename>/etc/security/namespace.d</filename></term> + <listitem> + <para>Directory for additional configuration files</para> + </listitem> + </varlistentry> + + <varlistentry> + <term><filename>/etc/security/namespace.init</filename></term> + <listitem> + <para>Init script for instance directories</para> </listitem> </varlistentry> </variablelist> @@ -330,7 +381,10 @@ <para> The namespace setup scheme was designed by Stephen Smalley, Janak Desai and Chad Sellers. - The pam_namespace PAM module was developed by Janak Desai <janak@us.ibm.com>, Chad Sellers <csellers@tresys.com> and Steve Grubb <sgrubb@redhat.com>. + The pam_namespace PAM module was developed by Janak Desai <janak@us.ibm.com>, + Chad Sellers <csellers@tresys.com> and Steve Grubb <sgrubb@redhat.com>. + Additional improvements by Xavier Toth <txtoth@gmail.com> and Tomas Mraz + <tmraz@redhat.com>. </para> </refsect1> </refentry> diff --git a/Linux-PAM/modules/pam_namespace/pam_namespace.c b/Linux-PAM/modules/pam_namespace/pam_namespace.c index d3612f59..d0741fd2 100644 --- a/Linux-PAM/modules/pam_namespace/pam_namespace.c +++ b/Linux-PAM/modules/pam_namespace/pam_namespace.c @@ -3,11 +3,13 @@ * establishing a session via PAM. * * (C) Copyright IBM Corporation 2005 - * (C) Copyright Red Hat 2006 + * (C) Copyright Red Hat, Inc. 2006, 2008 * All Rights Reserved. * * Written by: Janak Desai <janak@us.ibm.com> * With Revisions by: Steve Grubb <sgrubb@redhat.com> + * Contributions by: Xavier Toth <txtoth@gmail.com>, + * Tomas Mraz <tmraz@redhat.com> * Derived from a namespace setup patch by Chad Sellers <cdselle@tycho.nsa.gov> * * Permission is hereby granted, free of charge, to any person obtaining a @@ -31,79 +33,36 @@ */ #include "pam_namespace.h" - -/* - * Copies the contents of ent into pent - */ -static int copy_ent(const struct polydir_s *ent, struct polydir_s *pent) -{ - unsigned int i; - - strcpy(pent->dir, ent->dir); - strcpy(pent->instance_prefix, ent->instance_prefix); - pent->method = ent->method; - pent->num_uids = ent->num_uids; - if (ent->num_uids) { - uid_t *pptr, *eptr; - - pent->uid = (uid_t *) malloc(ent->num_uids * sizeof(uid_t)); - if (!(pent->uid)) { - return -1; - } - for (i = 0, pptr = pent->uid, eptr = ent->uid; i < ent->num_uids; - i++, eptr++, pptr++) - *pptr = *eptr; - } else - pent->uid = NULL; - return 0; -} +#include "argv_parse.h" /* * Adds an entry for a polyinstantiated directory to the linked list of * polyinstantiated directories. It is called from process_line() while * parsing the namespace configuration file. */ -static int add_polydir_entry(struct instance_data *idata, - const struct polydir_s *ent) +static void add_polydir_entry(struct instance_data *idata, + struct polydir_s *ent) { - struct polydir_s *pent; - int rc = 0; - - /* - * Allocate an entry to hold information about a directory to - * polyinstantiate, populate it with information from 2nd argument - * and add the entry to the linked list of polyinstantiated - * directories. - */ - pent = (struct polydir_s *) malloc(sizeof(struct polydir_s)); - if (!pent) { - rc = -1; - goto out; - } - /* Make copy */ - rc = copy_ent(ent,pent); - if(rc < 0) - goto out_clean; - /* Now attach to linked list */ - pent->next = NULL; + ent->next = NULL; if (idata->polydirs_ptr == NULL) - idata->polydirs_ptr = pent; + idata->polydirs_ptr = ent; else { struct polydir_s *tail; tail = idata->polydirs_ptr; while (tail->next) tail = tail->next; - tail->next = pent; + tail->next = ent; } - goto out; -out_clean: - free(pent); -out: - return rc; } +static void del_polydir(struct polydir_s *poly) +{ + free(poly->uid); + free(poly->init_script); + free(poly); +} /* * Deletes all the entries in the linked list. @@ -115,11 +74,184 @@ static void del_polydir_list(struct polydir_s *polydirs_ptr) while (dptr) { struct polydir_s *tptr = dptr; dptr = dptr->next; - free(tptr->uid); - free(tptr); + del_polydir(tptr); + } +} + +static void cleanup_data(pam_handle_t *pamh UNUSED , void *data, int err UNUSED) +{ + del_polydir_list(data); +} + +static char *expand_variables(const char *orig, const char *var_names[], const char *var_values[]) +{ + const char *src = orig; + char *dst; + char *expanded; + char c; + size_t dstlen = 0; + while (*src) { + if (*src == '$') { + int i; + for (i = 0; var_names[i]; i++) { + int namelen = strlen(var_names[i]); + if (strncmp(var_names[i], src+1, namelen) == 0) { + dstlen += strlen(var_values[i]) - 1; /* $ */ + src += namelen; + break; + } + } + } + ++dstlen; + ++src; + } + if ((dst=expanded=malloc(dstlen + 1)) == NULL) + return NULL; + src = orig; + while ((c=*src) != '\0') { + if (c == '$') { + int i; + for (i = 0; var_names[i]; i++) { + int namelen = strlen(var_names[i]); + if (strncmp(var_names[i], src+1, namelen) == 0) { + dst = stpcpy(dst, var_values[i]); + --dst; + c = *dst; /* replace $ */ + src += namelen; + break; + } + } + } + *dst = c; + ++dst; + ++src; + } + *dst = '\0'; + return expanded; +} + +static int parse_create_params(char *params, struct polydir_s *poly) +{ + char *sptr; + struct passwd *pwd; + struct group *grp; + + poly->mode = (mode_t)ULONG_MAX; + poly->owner = (uid_t)ULONG_MAX; + poly->group = (gid_t)ULONG_MAX; + + if (*params != '=') + return 0; + params++; + + params = strtok_r(params, ",", &sptr); + if (params == NULL) + return 0; + + errno = 0; + poly->mode = (mode_t)strtoul(params, NULL, 0); + if (errno != 0) { + poly->mode = (mode_t)ULONG_MAX; + } + + params = strtok_r(NULL, ",", &sptr); + if (params == NULL) + return 0; + + pwd = getpwnam(params); /* session modules are not reentrant */ + if (pwd == NULL) + return -1; + poly->owner = pwd->pw_uid; + + params = strtok_r(NULL, ",", &sptr); + if (params == NULL) { + poly->group = pwd->pw_gid; + return 0; + } + grp = getgrnam(params); + if (grp == NULL) + return -1; + poly->group = grp->gr_gid; + + return 0; +} + +static int parse_iscript_params(char *params, struct polydir_s *poly) +{ + if (*params != '=') + return 0; + params++; + + if (*params != '\0') { + if (*params != '/') { /* path is relative to NAMESPACE_D_DIR */ + if (asprintf(&poly->init_script, "%s%s", NAMESPACE_D_DIR, params) == -1) + return -1; + } else { + poly->init_script = strdup(params); } + if (poly->init_script == NULL) + return -1; + } + return 0; } +static int parse_method(char *method, struct polydir_s *poly, + struct instance_data *idata) +{ + enum polymethod pm; + char *sptr; + static const char *method_names[] = { "user", "context", "level", "tmpdir", + "tmpfs", NULL }; + static const char *flag_names[] = { "create", "noinit", "iscript", + "shared", NULL }; + static const unsigned int flag_values[] = { POLYDIR_CREATE, POLYDIR_NOINIT, + POLYDIR_ISCRIPT, POLYDIR_SHARED }; + int i; + char *flag; + + method = strtok_r(method, ":", &sptr); + pm = NONE; + + for (i = 0; method_names[i]; i++) { + if (strcmp(method, method_names[i]) == 0) { + pm = i + 1; /* 0 = NONE */ + } + } + + if (pm == NONE) { + pam_syslog(idata->pamh, LOG_NOTICE, "Unknown method"); + return -1; + } + + poly->method = pm; + + while ((flag=strtok_r(NULL, ":", &sptr)) != NULL) { + for (i = 0; flag_names[i]; i++) { + int namelen = strlen(flag_names[i]); + + if (strncmp(flag, flag_names[i], namelen) == 0) { + poly->flags |= flag_values[i]; + switch (flag_values[i]) { + case POLYDIR_CREATE: + if (parse_create_params(flag+namelen, poly) != 0) { + pam_syslog(idata->pamh, LOG_CRIT, "Invalid create parameters"); + return -1; + } + break; + + case POLYDIR_ISCRIPT: + if (parse_iscript_params(flag+namelen, poly) != 0) { + pam_syslog(idata->pamh, LOG_CRIT, "Memory allocation error"); + return -1; + }; + break; + } + } + } + } + + return 0; +} /* * Called from parse_config_file, this function processes a single line @@ -129,17 +261,23 @@ static void del_polydir_list(struct polydir_s *polydirs_ptr) * polyinstatiated directory structure and then calling add_polydir_entry to * add that entry to the linked list of polyinstantiated directories. */ -static int process_line(char *line, const char *home, +static int process_line(char *line, const char *home, const char *rhome, struct instance_data *idata) { - const char *dir, *instance_prefix; - const char *method, *uids; + char *dir = NULL, *instance_prefix = NULL, *rdir = NULL; + char *method, *uids; char *tptr; - struct polydir_s poly; + struct polydir_s *poly; int retval = 0; + char **config_options = NULL; + static const char *var_names[] = {"HOME", "USER", NULL}; + const char *var_values[] = {home, idata->user}; + const char *rvar_values[] = {rhome, idata->ruser}; + int len; - poly.uid = NULL; - poly.num_uids = 0; + poly = calloc(1, sizeof(*poly)); + if (poly == NULL) + goto erralloc; /* * skip the leading white space @@ -171,19 +309,27 @@ static int process_line(char *line, const char *home, * Initialize and scan the five strings from the line from the * namespace configuration file. */ - dir = strtok_r(line, " \t", &tptr); + retval = argv_parse(line, NULL, &config_options); + if (retval != 0) { + goto erralloc; + } + + dir = config_options[0]; if (dir == NULL) { pam_syslog(idata->pamh, LOG_NOTICE, "Invalid line missing polydir"); goto skipping; } - instance_prefix = strtok_r(NULL, " \t", &tptr); + instance_prefix = config_options[1]; if (instance_prefix == NULL) { pam_syslog(idata->pamh, LOG_NOTICE, "Invalid line missing instance_prefix"); + instance_prefix = NULL; goto skipping; } - method = strtok_r(NULL, " \t", &tptr); + method = config_options[2]; if (method == NULL) { pam_syslog(idata->pamh, LOG_NOTICE, "Invalid line missing method"); + instance_prefix = NULL; + dir = NULL; goto skipping; } @@ -193,81 +339,83 @@ static int process_line(char *line, const char *home, * any of the other fields are blank, the line is incomplete so * skip it. */ - uids = strtok_r(NULL, " \t", &tptr); + uids = config_options[3]; /* - * If the directory being polyinstantiated is the home directory - * of the user who is establishing a session, we have to swap - * the "$HOME" string with the user's home directory that is - * passed in as an argument. + * Expand $HOME and $USER in poly dir and instance dir prefix */ - if (strcmp(dir, "$HOME") == 0) { - dir = home; + if ((rdir=expand_variables(dir, var_names, rvar_values)) == NULL) { + instance_prefix = NULL; + dir = NULL; + goto erralloc; } - - /* - * Expand $HOME and $USER in instance dir prefix - */ - if ((tptr = strstr(instance_prefix, "$USER")) != 0) { - /* FIXME: should only support this if method is USER or BOTH */ - char *expanded = alloca(strlen(idata->user) + strlen(instance_prefix)-5+1); - *tptr = 0; - sprintf(expanded, "%s%s%s", instance_prefix, idata->user, tptr+5); - instance_prefix = expanded; + + if ((dir=expand_variables(dir, var_names, var_values)) == NULL) { + instance_prefix = NULL; + goto erralloc; } - if ((tptr = strstr(instance_prefix, "$HOME")) != 0) { - char *expanded = alloca(strlen(home)+strlen(instance_prefix)-5+1); - *tptr = 0; - sprintf(expanded, "%s%s%s", instance_prefix, home, tptr+5); - instance_prefix = expanded; + + if ((instance_prefix=expand_variables(instance_prefix, var_names, var_values)) + == NULL) { + goto erralloc; } - /* - * Ensure that all pathnames are absolute path names. - */ - if ((dir[0] != '/') || (instance_prefix[0] != '/')) { - pam_syslog(idata->pamh, LOG_NOTICE,"Pathnames must start with '/'"); - goto skipping; + if (idata->flags & PAMNS_DEBUG) { + pam_syslog(idata->pamh, LOG_DEBUG, "Expanded polydir: '%s'", dir); + pam_syslog(idata->pamh, LOG_DEBUG, "Expanded ruser polydir: '%s'", rdir); + pam_syslog(idata->pamh, LOG_DEBUG, "Expanded instance prefix: '%s'", instance_prefix); } - if (strstr(dir, "..") || strstr(instance_prefix, "..")) { - pam_syslog(idata->pamh, LOG_NOTICE,"Pathnames must not contain '..'"); - goto skipping; + + len = strlen(dir); + if (len > 0 && dir[len-1] == '/') { + dir[len-1] = '\0'; } + len = strlen(rdir); + if (len > 0 && rdir[len-1] == '/') { + rdir[len-1] = '\0'; + } + + if (dir[0] == '\0' || rdir[0] == '\0') { + pam_syslog(idata->pamh, LOG_NOTICE, "Invalid polydir"); + goto skipping; + } + /* * Populate polyinstantiated directory structure with appropriate * pathnames and the method with which to polyinstantiate. */ - if (strlen(dir) >= sizeof(poly.dir) - || strlen(instance_prefix) >= sizeof(poly.instance_prefix)) { + if (strlen(dir) >= sizeof(poly->dir) + || strlen(rdir) >= sizeof(poly->rdir) + || strlen(instance_prefix) >= sizeof(poly->instance_prefix)) { pam_syslog(idata->pamh, LOG_NOTICE, "Pathnames too long"); + goto skipping; } - strcpy(poly.dir, dir); - strcpy(poly.instance_prefix, instance_prefix); - - poly.method = NONE; - if (strcmp(method, "user") == 0) - poly.method = USER; + strcpy(poly->dir, dir); + strcpy(poly->rdir, rdir); + strcpy(poly->instance_prefix, instance_prefix); -#ifdef WITH_SELINUX - if (strcmp(method, "level") == 0) { - if (idata->flags & PAMNS_CTXT_BASED_INST) - poly.method = LEVEL; - else - poly.method = USER; + if (parse_method(method, poly, idata) != 0) { + goto skipping; } - if (strcmp(method, "context") == 0) { - if (idata->flags & PAMNS_CTXT_BASED_INST) - poly.method = CONTEXT; - else - poly.method = USER; + if (poly->method == TMPDIR) { + if (sizeof(poly->instance_prefix) - strlen(poly->instance_prefix) < 7) { + pam_syslog(idata->pamh, LOG_NOTICE, "Pathnames too long"); + goto skipping; + } + strcat(poly->instance_prefix, "XXXXXX"); } -#endif - - if ( poly.method == NONE) { - pam_syslog(idata->pamh, LOG_NOTICE, "Illegal method"); + /* + * Ensure that all pathnames are absolute path names. + */ + if ((poly->dir[0] != '/') || (poly->method != TMPFS && poly->instance_prefix[0] != '/')) { + pam_syslog(idata->pamh, LOG_NOTICE, "Pathnames must start with '/'"); + goto skipping; + } + if (strstr(dir, "..") || strstr(poly->instance_prefix, "..")) { + pam_syslog(idata->pamh, LOG_NOTICE, "Pathnames must not contain '..'"); goto skipping; } @@ -281,16 +429,19 @@ static int process_line(char *line, const char *home, uid_t *uidptr; const char *ustr, *sstr; int count, i; - + + if (*uids == '~') { + poly->flags |= POLYDIR_EXCLUSIVE; + uids++; + } for (count = 0, ustr = sstr = uids; sstr; ustr = sstr + 1, count++) sstr = strchr(ustr, ','); - poly.num_uids = count; - poly.uid = (uid_t *) malloc(count * sizeof (uid_t)); - uidptr = poly.uid; + poly->num_uids = count; + poly->uid = (uid_t *) malloc(count * sizeof (uid_t)); + uidptr = poly->uid; if (uidptr == NULL) { - pam_syslog(idata->pamh, LOG_NOTICE, "out of memory"); - goto skipping; + goto erralloc; } ustr = uids; @@ -304,7 +455,7 @@ static int process_line(char *line, const char *home, pwd = pam_modutil_getpwnam(idata->pamh, ustr); if (pwd == NULL) { pam_syslog(idata->pamh, LOG_ERR, "Unknown user %s in configuration", ustr); - poly.num_uids--; + poly->num_uids--; } else { *uidptr = pwd->pw_uid; uidptr++; @@ -317,20 +468,24 @@ static int process_line(char *line, const char *home, * Add polyinstantiated directory structure to the linked list * of all polyinstantiated directory structures. */ - if (add_polydir_entry(idata, &poly) < 0) { - pam_syslog(idata->pamh, LOG_ERR, "Allocation Error"); - retval = PAM_SERVICE_ERR; - } - free(poly.uid); + add_polydir_entry(idata, poly); goto out; +erralloc: + pam_syslog(idata->pamh, LOG_CRIT, "Memory allocation error"); + skipping: if (idata->flags & PAMNS_IGN_CONFIG_ERR) retval = 0; else retval = PAM_SERVICE_ERR; + del_polydir(poly); out: + free(rdir); + free(dir); + free(instance_prefix); + argv_free(config_options); return retval; } @@ -344,15 +499,15 @@ out: static int parse_config_file(struct instance_data *idata) { FILE *fil; - char *home; + char *home, *rhome; + const char *confname; struct passwd *cpwd; - char *line = NULL; + char *line; int retval; size_t len = 0; - - if (idata->flags & PAMNS_DEBUG) - pam_syslog(idata->pamh, LOG_DEBUG, "Parsing config file %s", - PAM_NAMESPACE_CONFIG); + glob_t globbuf; + const char *oldlocale; + size_t n; /* * Extract the user's home directory to resolve $HOME entries @@ -364,35 +519,86 @@ static int parse_config_file(struct instance_data *idata) "Error getting home dir for '%s'", idata->user); return PAM_SESSION_ERR; } - home = strdupa(cpwd->pw_dir); + if ((home=strdup(cpwd->pw_dir)) == NULL) { + pam_syslog(idata->pamh, LOG_CRIT, + "Memory allocation error"); + return PAM_SESSION_ERR; + } + + cpwd = pam_modutil_getpwnam(idata->pamh, idata->ruser); + if (!cpwd) { + pam_syslog(idata->pamh, LOG_ERR, + "Error getting home dir for '%s'", idata->ruser); + free(home); + return PAM_SESSION_ERR; + } + + if ((rhome=strdup(cpwd->pw_dir)) == NULL) { + pam_syslog(idata->pamh, LOG_CRIT, + "Memory allocation error"); + free(home); + return PAM_SESSION_ERR; + } /* * Open configuration file, read one line at a time and call * process_line to process each line. */ - fil = fopen(PAM_NAMESPACE_CONFIG, "r"); - if (fil == NULL) { - pam_syslog(idata->pamh, LOG_ERR, "Error opening config file"); - return PAM_SERVICE_ERR; - } - /* Use unlocked IO */ - __fsetlocking(fil, FSETLOCKING_BYCALLER); + memset(&globbuf, '\0', sizeof(globbuf)); + oldlocale = setlocale(LC_COLLATE, "C"); + glob(NAMESPACE_D_GLOB, 0, NULL, &globbuf); + if (oldlocale != NULL) + setlocale(LC_COLLATE, oldlocale); - /* loop reading the file */ - while (getline(&line, &len, fil) > 0) { - retval = process_line(line, home, idata); - if (retval) { - pam_syslog(idata->pamh, LOG_ERR, - "Error processing conf file line %s", line); - fclose(fil); - free(line); - return PAM_SERVICE_ERR; - } - } - fclose(fil); - free(line); + confname = PAM_NAMESPACE_CONFIG; + n = 0; + for (;;) { + if (idata->flags & PAMNS_DEBUG) + pam_syslog(idata->pamh, LOG_DEBUG, "Parsing config file %s", + confname); + fil = fopen(confname, "r"); + if (fil == NULL) { + pam_syslog(idata->pamh, LOG_ERR, "Error opening config file %s", + confname); + globfree(&globbuf); + free(rhome); + free(home); + return PAM_SERVICE_ERR; + } + + /* Use unlocked IO */ + __fsetlocking(fil, FSETLOCKING_BYCALLER); + + line = NULL; + /* loop reading the file */ + while (getline(&line, &len, fil) > 0) { + retval = process_line(line, home, rhome, idata); + if (retval) { + pam_syslog(idata->pamh, LOG_ERR, + "Error processing conf file %s line %s", confname, line); + fclose(fil); + free(line); + globfree(&globbuf); + free(rhome); + free(home); + return PAM_SERVICE_ERR; + } + } + fclose(fil); + free(line); + + if (n >= globbuf.gl_pathc) + break; + confname = globbuf.gl_pathv[n]; + n++; + } + + globfree(&globbuf); + free(rhome); + free(home); + /* All done...just some debug stuff */ if (idata->flags & PAMNS_DEBUG) { struct polydir_s *dptr = idata->polydirs_ptr; @@ -419,6 +625,7 @@ static int parse_config_file(struct instance_data *idata) * directory's list of override uids. If the uid is one of the override * uids for the polyinstantiated directory, polyinstantiation is not * performed for that user for that directory. + * If exclusive is set the returned values are opposite. */ static int ns_override(struct polydir_s *polyptr, struct instance_data *idata, uid_t uid) @@ -432,11 +639,11 @@ static int ns_override(struct polydir_s *polyptr, struct instance_data *idata, for (i = 0; i < polyptr->num_uids; i++) { if (uid == polyptr->uid[i]) { - return 1; + return !(polyptr->flags & POLYDIR_EXCLUSIVE); } } - return 0; + return !!(polyptr->flags & POLYDIR_EXCLUSIVE); } /* @@ -490,7 +697,19 @@ static int form_context(const struct polydir_s *polyptr, if (polyptr->method == USER) return PAM_SUCCESS; - rc = getexeccon(&scon); + if (idata->flags & PAMNS_USE_CURRENT_CONTEXT) { + rc = getcon(&scon); + } else if (idata->flags & PAMNS_USE_DEFAULT_CONTEXT) { + char *seuser = NULL, *level = NULL; + + if ((rc=getseuserbyname(idata->user, &seuser, &level)) == 0) { + rc = get_default_context_with_level(seuser, level, NULL, &scon); + free(seuser); + free(level); + } + } else { + rc = getexeccon(&scon); + } if (rc < 0 || scon == NULL) { pam_syslog(idata->pamh, LOG_ERR, "Error getting exec context, %m"); @@ -565,7 +784,7 @@ static int form_context(const struct polydir_s *polyptr, /* * poly_name returns the name of the polyinstantiated instance directory - * based on the method used for polyinstantiation (user, context or both) + * based on the method used for polyinstantiation (user, context or level) * In addition, the function also returns the security contexts of the * original directory to polyinstantiate and the polyinstantiated instance * directory. @@ -581,6 +800,7 @@ static int poly_name(const struct polydir_s *polyptr, char **i_name, { int rc; char *hash = NULL; + enum polymethod pm; #ifdef WITH_SELINUX security_context_t rawcon = NULL; #endif @@ -600,7 +820,23 @@ static int poly_name(const struct polydir_s *polyptr, char **i_name, * Set the name of the polyinstantiated instance dir based on the * polyinstantiation method. */ - switch (polyptr->method) { + + pm = polyptr->method; + if (pm == LEVEL || pm == USER) { +#ifdef WITH_SELINUX + if (!(idata->flags & PAMNS_CTXT_BASED_INST)) +#else + pam_syslog(idata->pamh, LOG_NOTICE, + "Context and level methods not available, using user method"); +#endif + if (polyptr->flags & POLYDIR_SHARED) { + rc = PAM_IGNORE; + goto fail; + } + pm = USER; + } + + switch (pm) { case USER: if (asprintf(i_name, "%s", idata->user) < 0) { *i_name = NULL; @@ -614,15 +850,28 @@ static int poly_name(const struct polydir_s *polyptr, char **i_name, if (selinux_trans_to_raw_context(*i_context, &rawcon) < 0) { pam_syslog(idata->pamh, LOG_ERR, "Error translating directory context"); goto fail; - } - if (asprintf(i_name, "%s_%s", rawcon, idata->user) < 0) { - *i_name = NULL; - goto fail; + } + if (polyptr->flags & POLYDIR_SHARED) { + if (asprintf(i_name, "%s", rawcon) < 0) { + *i_name = NULL; + goto fail; + } + } else { + if (asprintf(i_name, "%s_%s", rawcon, idata->user) < 0) { + *i_name = NULL; + goto fail; + } } break; #endif /* WITH_SELINUX */ + case TMPDIR: + case TMPFS: + if ((*i_name=strdup("")) == NULL) + goto fail; + return PAM_SUCCESS; + default: if (idata->flags & PAMNS_DEBUG) pam_syslog(idata->pamh, LOG_ERR, "Unknown method"); @@ -643,7 +892,7 @@ static int poly_name(const struct polydir_s *polyptr, char **i_name, hash = NULL; } else { char *newname; - if (asprintf(&newname, "%.*s_%s", NAMESPACE_MAX_DIR_LEN-1-strlen(hash), + if (asprintf(&newname, "%.*s_%s", NAMESPACE_MAX_DIR_LEN-1-(int)strlen(hash), *i_name, hash) < 0) { goto fail; } @@ -726,12 +975,13 @@ static int check_inst_parent(char *ipath, struct instance_data *idata) * execute it and pass directory to polyinstantiate and instance * directory as arguments. */ -static int inst_init(const struct polydir_s *polyptr, char *ipath, - struct instance_data *idata) +static int inst_init(const struct polydir_s *polyptr, const char *ipath, + struct instance_data *idata, int newdir) { pid_t rc, pid; sighandler_t osighand = NULL; int status; + const char *init_script = NAMESPACE_INIT_SCRIPT; osighand = signal(SIGCHLD, SIG_DFL); if (osighand == SIG_ERR) { @@ -740,8 +990,11 @@ static int inst_init(const struct polydir_s *polyptr, char *ipath, goto out; } - if (access(NAMESPACE_INIT_SCRIPT, F_OK) == 0) { - if (access(NAMESPACE_INIT_SCRIPT, X_OK) < 0) { + if ((polyptr->flags & POLYDIR_ISCRIPT) && polyptr->init_script) + init_script = polyptr->init_script; + + if (access(init_script, F_OK) == 0) { + if (access(init_script, X_OK) < 0) { if (idata->flags & PAMNS_DEBUG) pam_syslog(idata->pamh, LOG_ERR, "Namespace init script not executable"); @@ -756,8 +1009,8 @@ static int inst_init(const struct polydir_s *polyptr, char *ipath, exit(1); } #endif - if (execl(NAMESPACE_INIT_SCRIPT, NAMESPACE_INIT_SCRIPT, - polyptr->dir, ipath, (char *)NULL) < 0) + if (execl(init_script, init_script, + polyptr->dir, ipath, newdir?"1":"0", idata->user, (char *)NULL) < 0) exit(1); } else if (pid > 0) { while (((rc = waitpid(pid, &status, 0)) == (pid_t)-1) && @@ -788,46 +1041,116 @@ out: return rc; } +static int create_polydir(struct polydir_s *polyptr, + struct instance_data *idata) +{ + mode_t mode; + int rc; +#ifdef WITH_SELINUX + security_context_t dircon, oldcon = NULL; +#endif + const char *dir = polyptr->dir; + + if (polyptr->mode != (mode_t)ULONG_MAX) + mode = polyptr->mode; + else + mode = 0777; + +#ifdef WITH_SELINUX + if (idata->flags & PAMNS_SELINUX_ENABLED) { + getfscreatecon(&oldcon); + rc = matchpathcon(dir, S_IFDIR, &dircon); + if (rc) { + pam_syslog(idata->pamh, LOG_NOTICE, + "Unable to get default context for directory %s, check your policy: %m", dir); + } else { + if (idata->flags & PAMNS_DEBUG) + pam_syslog(idata->pamh, LOG_DEBUG, + "Polydir %s context: %s", dir, (char *)dircon); + if (setfscreatecon(dircon) != 0) + pam_syslog(idata->pamh, LOG_NOTICE, + "Error setting context for directory %s: %m", dir); + freecon(dircon); + } + matchpathcon_fini(); + } +#endif + + rc = mkdir(dir, mode); + if (rc != 0) { + pam_syslog(idata->pamh, LOG_ERR, + "Error creating directory %s: %m", dir); + return PAM_SESSION_ERR; + } + +#ifdef WITH_SELINUX + if (idata->flags & PAMNS_SELINUX_ENABLED) { + if (setfscreatecon(oldcon) != 0) + pam_syslog(idata->pamh, LOG_NOTICE, + "Error resetting fs create context: %m"); + freecon(oldcon); + } +#endif + + if (idata->flags & PAMNS_DEBUG) + pam_syslog(idata->pamh, LOG_DEBUG, "Created polydir %s", dir); + + if (polyptr->mode != (mode_t)ULONG_MAX) { + /* explicit mode requested */ + if (chmod(dir, mode) != 0) { + pam_syslog(idata->pamh, LOG_ERR, + "Error changing mode of directory %s: %m", dir); + rmdir(dir); + return PAM_SESSION_ERR; + } + } + + if (polyptr->owner != (uid_t)ULONG_MAX) { + if (chown(dir, polyptr->owner, polyptr->group) != 0) { + pam_syslog(idata->pamh, LOG_ERR, + "Unable to change owner on directory %s: %m", dir); + rmdir(dir); + return PAM_SESSION_ERR; + } + if (idata->flags & PAMNS_DEBUG) + pam_syslog(idata->pamh, LOG_DEBUG, + "Polydir owner %u group %u from configuration", polyptr->owner, polyptr->group); + } else { + if (chown(dir, idata->uid, idata->gid) != 0) { + pam_syslog(idata->pamh, LOG_ERR, + "Unable to change owner on directory %s: %m", dir); + rmdir(dir); + return PAM_SESSION_ERR; + } + if (idata->flags & PAMNS_DEBUG) + pam_syslog(idata->pamh, LOG_DEBUG, + "Polydir owner %u group %u", idata->uid, idata->gid); + } + + return PAM_SUCCESS; +} + /* * Create polyinstantiated instance directory (ipath). */ #ifdef WITH_SELINUX -static int create_dirs(const struct polydir_s *polyptr, char *ipath, +static int create_dirs(struct polydir_s *polyptr, char *ipath, struct stat *statbuf, security_context_t icontext, security_context_t ocontext, struct instance_data *idata) #else -static int create_dirs(const struct polydir_s *polyptr, char *ipath, +static int create_dirs(struct polydir_s *polyptr, char *ipath, struct stat *statbuf, struct instance_data *idata) #endif { - struct stat statbuf, newstatbuf; - int rc, fd; + struct stat newstatbuf; + int fd; + int newdir = 0; /* - * stat the directory to polyinstantiate, so its owner-group-mode - * can be propagated to instance directory + * Check to make sure instance parent is valid. */ - rc = PAM_SUCCESS; - if (stat(polyptr->dir, &statbuf) < 0) { - pam_syslog(idata->pamh, LOG_ERR, "Error stating %s, %m", - polyptr->dir); - return PAM_SESSION_ERR; - } - - /* - * Make sure we are dealing with a directory - */ - if (!S_ISDIR(statbuf.st_mode)) { - pam_syslog(idata->pamh, LOG_ERR, "poly dir %s is not a dir", - polyptr->dir); - return PAM_SESSION_ERR; - } - - /* - * Check to make sure instance parent is valid. - */ - if (check_inst_parent(ipath, idata)) - return PAM_SESSION_ERR; + if (check_inst_parent(ipath, idata)) + return PAM_SESSION_ERR; /* * Create instance directory and set its security context to the context @@ -835,7 +1158,17 @@ static int create_dirs(const struct polydir_s *polyptr, char *ipath, * attributes to match that of the original directory that is being * polyinstantiated. */ - if (mkdir(ipath, S_IRUSR) < 0) { + + if (polyptr->method == TMPDIR) { + if (mkdtemp(polyptr->instance_prefix) == NULL) { + pam_syslog(idata->pamh, LOG_ERR, "Error creating temporary instance %s, %m", + polyptr->instance_prefix); + polyptr->method = NONE; /* do not clean up! */ + return PAM_SESSION_ERR; + } + /* copy the actual directory name to ipath */ + strcpy(ipath, polyptr->instance_prefix); + } else if (mkdir(ipath, S_IRUSR) < 0) { if (errno == EEXIST) goto inst_init; else { @@ -845,6 +1178,7 @@ static int create_dirs(const struct polydir_s *polyptr, char *ipath, } } + newdir = 1; /* Open a descriptor to it to prevent races */ fd = open(ipath, O_DIRECTORY | O_RDONLY); if (fd < 0) { @@ -881,9 +1215,9 @@ static int create_dirs(const struct polydir_s *polyptr, char *ipath, rmdir(ipath); return PAM_SESSION_ERR; } - if (newstatbuf.st_uid != statbuf.st_uid || - newstatbuf.st_gid != statbuf.st_gid) { - if (fchown(fd, statbuf.st_uid, statbuf.st_gid) < 0) { + if (newstatbuf.st_uid != statbuf->st_uid || + newstatbuf.st_gid != statbuf->st_gid) { + if (fchown(fd, statbuf->st_uid, statbuf->st_gid) < 0) { pam_syslog(idata->pamh, LOG_ERR, "Error changing owner for %s, %m", ipath); @@ -892,7 +1226,7 @@ static int create_dirs(const struct polydir_s *polyptr, char *ipath, return PAM_SESSION_ERR; } } - if (fchmod(fd, statbuf.st_mode & 07777) < 0) { + if (fchmod(fd, statbuf->st_mode & 07777) < 0) { pam_syslog(idata->pamh, LOG_ERR, "Error changing mode for %s, %m", ipath); close(fd); @@ -909,8 +1243,10 @@ static int create_dirs(const struct polydir_s *polyptr, char *ipath, */ inst_init: - rc = inst_init(polyptr, ipath, idata); - return rc; + if (polyptr->flags & POLYDIR_NOINIT) + return PAM_SUCCESS; + + return inst_init(polyptr, ipath, idata, newdir); } @@ -921,13 +1257,13 @@ inst_init: * security attributes, and performs bind mount to setup the process * namespace. */ -static int ns_setup(const struct polydir_s *polyptr, +static int ns_setup(struct polydir_s *polyptr, struct instance_data *idata) { int retval = 0; char *inst_dir = NULL; char *instname = NULL; - char *dir; + struct stat statbuf; #ifdef WITH_SELINUX security_context_t instcontext = NULL, origcontext = NULL; #endif @@ -936,9 +1272,36 @@ static int ns_setup(const struct polydir_s *polyptr, pam_syslog(idata->pamh, LOG_DEBUG, "Set namespace for directory %s", polyptr->dir); - dir = strrchr(polyptr->dir, '/'); - if (dir && strlen(dir) > 1) - dir++; + while (stat(polyptr->dir, &statbuf) < 0) { + if (retval || !(polyptr->flags & POLYDIR_CREATE)) { + pam_syslog(idata->pamh, LOG_ERR, "Error stating %s, %m", + polyptr->dir); + return PAM_SESSION_ERR; + } else { + if (create_polydir(polyptr, idata) != PAM_SUCCESS) + return PAM_SESSION_ERR; + retval = PAM_SESSION_ERR; /* bail out on next failed stat */ + } + } + + /* + * Make sure we are dealing with a directory + */ + if (!S_ISDIR(statbuf.st_mode)) { + pam_syslog(idata->pamh, LOG_ERR, "Polydir %s is not a dir", + polyptr->dir); + return PAM_SESSION_ERR; + } + + if (polyptr->method == TMPFS) { + if (mount("tmpfs", polyptr->dir, "tmpfs", 0, NULL) < 0) { + pam_syslog(idata->pamh, LOG_ERR, "Error mounting tmpfs on %s, %m", + polyptr->dir); + return PAM_SESSION_ERR; + } + /* we must call inst_init after the mount in this case */ + return inst_init(polyptr, "tmpfs", idata, 1); + } /* * Obtain the name of instance pathname based on the @@ -952,9 +1315,10 @@ static int ns_setup(const struct polydir_s *polyptr, retval = poly_name(polyptr, &instname, idata); #endif - if (retval) { - pam_syslog(idata->pamh, LOG_ERR, "Error getting instance name"); - goto error_out; + if (retval != PAM_SUCCESS) { + if (retval != PAM_IGNORE) + pam_syslog(idata->pamh, LOG_ERR, "Error getting instance name"); + goto cleanup; } else { #ifdef WITH_SELINUX if ((idata->flags & PAMNS_DEBUG) && @@ -976,10 +1340,10 @@ static int ns_setup(const struct polydir_s *polyptr, * contexts, owner, group and mode bits. */ #ifdef WITH_SELINUX - retval = create_dirs(polyptr, inst_dir, instcontext, + retval = create_dirs(polyptr, inst_dir, &statbuf, instcontext, origcontext, idata); #else - retval = create_dirs(polyptr, inst_dir, idata); + retval = create_dirs(polyptr, inst_dir, &statbuf, idata); #endif if (retval < 0) { @@ -1044,6 +1408,58 @@ static int cwd_in(char *dir, struct instance_data *idata) return retval; } +static int cleanup_tmpdirs(struct instance_data *idata) +{ + struct polydir_s *pptr; + pid_t rc, pid; + sighandler_t osighand = NULL; + int status; + + osighand = signal(SIGCHLD, SIG_DFL); + if (osighand == SIG_ERR) { + pam_syslog(idata->pamh, LOG_ERR, "Cannot set signal value"); + rc = PAM_SESSION_ERR; + goto out; + } + + for (pptr = idata->polydirs_ptr; pptr; pptr = pptr->next) { + if (pptr->method == TMPDIR && access(pptr->instance_prefix, F_OK) == 0) { + pid = fork(); + if (pid == 0) { +#ifdef WITH_SELINUX + if (idata->flags & PAMNS_SELINUX_ENABLED) { + if (setexeccon(NULL) < 0) + exit(1); + } +#endif + if (execl("/bin/rm", "/bin/rm", "-rf", pptr->instance_prefix, (char *)NULL) < 0) + exit(1); + } else if (pid > 0) { + while (((rc = waitpid(pid, &status, 0)) == (pid_t)-1) && + (errno == EINTR)); + if (rc == (pid_t)-1) { + pam_syslog(idata->pamh, LOG_ERR, "waitpid failed- %m"); + rc = PAM_SESSION_ERR; + goto out; + } + if (!WIFEXITED(status) || WIFSIGNALED(status) > 0) { + pam_syslog(idata->pamh, LOG_ERR, + "Error removing %s", pptr->instance_prefix); + } + } else if (pid < 0) { + pam_syslog(idata->pamh, LOG_ERR, + "Cannot fork to run namespace init script, %m"); + rc = PAM_SESSION_ERR; + goto out; + } + } + } + + rc = PAM_SUCCESS; +out: + signal(SIGCHLD, osighand); + return rc; +} /* * This function checks to see if polyinstantiation is needed for any @@ -1056,34 +1472,18 @@ static int setup_namespace(struct instance_data *idata, enum unmnt_op unmnt) int retval = 0, need_poly = 0, changing_dir = 0; char *cptr, *fptr, poly_parent[PATH_MAX]; struct polydir_s *pptr; - uid_t req_uid; - const void *ruser_name; - struct passwd *pwd; if (idata->flags & PAMNS_DEBUG) pam_syslog(idata->pamh, LOG_DEBUG, "Set up namespace for pid %d", getpid()); - retval = pam_get_item(idata->pamh, PAM_RUSER, &ruser_name); - if (ruser_name == NULL || retval != PAM_SUCCESS) { - retval = PAM_SUCCESS; - req_uid = getuid(); - } else { - pwd = pam_modutil_getpwnam(idata->pamh, ruser_name); - if (pwd != NULL) { - req_uid = pwd->pw_uid; - } else { - req_uid = getuid(); - } - } - /* * Cycle through all polyinstantiated directory entries to see if * polyinstantiation is needed at all. */ for (pptr = idata->polydirs_ptr; pptr; pptr = pptr->next) { if (ns_override(pptr, idata, idata->uid)) { - if (unmnt == NO_UNMNT || ns_override(pptr, idata, req_uid)) { + if (unmnt == NO_UNMNT || ns_override(pptr, idata, idata->ruid)) { if (idata->flags & PAMNS_DEBUG) pam_syslog(idata->pamh, LOG_DEBUG, "Overriding poly for user %d for dir %s", @@ -1092,7 +1492,7 @@ static int setup_namespace(struct instance_data *idata, enum unmnt_op unmnt) if (idata->flags & PAMNS_DEBUG) pam_syslog(idata->pamh, LOG_DEBUG, "Need unmount ns for user %d for dir %s", - idata->uid, pptr->dir); + idata->ruid, pptr->dir); need_poly = 1; break; } @@ -1108,17 +1508,19 @@ static int setup_namespace(struct instance_data *idata, enum unmnt_op unmnt) } /* - * If polyinstnatiation is needed, call the unshare system call to + * If polyinstantiation is needed, call the unshare system call to * disassociate from the parent namespace. */ if (need_poly) { if (unshare(CLONE_NEWNS) < 0) { - pam_syslog(idata->pamh, LOG_ERR, + pam_syslog(idata->pamh, LOG_ERR, "Unable to unshare from parent namespace, %m"); return PAM_SESSION_ERR; } - } else + } else { + del_polydir_list(idata->polydirs_ptr); return PAM_SUCCESS; + } /* * Again cycle through all polyinstantiated directories, this time, @@ -1127,7 +1529,7 @@ static int setup_namespace(struct instance_data *idata, enum unmnt_op unmnt) for (pptr = idata->polydirs_ptr; pptr; pptr = pptr->next) { enum unmnt_op dir_unmnt = unmnt; if (ns_override(pptr, idata, idata->uid)) { - if (unmnt == NO_UNMNT || ns_override(pptr, idata, req_uid)) { + if (unmnt == NO_UNMNT || ns_override(pptr, idata, idata->ruid)) { continue; } else { dir_unmnt = UNMNT_ONLY; @@ -1144,8 +1546,9 @@ static int setup_namespace(struct instance_data *idata, enum unmnt_op unmnt) * bind mounted instance_parent directory that we are trying to * umount */ - if ((changing_dir = cwd_in(pptr->dir, idata)) < 0) { - return PAM_SESSION_ERR; + if ((changing_dir = cwd_in(pptr->rdir, idata)) < 0) { + retval = PAM_SESSION_ERR; + goto out; } else if (changing_dir) { if (idata->flags & PAMNS_DEBUG) pam_syslog(idata->pamh, LOG_DEBUG, "changing cwd"); @@ -1156,7 +1559,7 @@ static int setup_namespace(struct instance_data *idata, enum unmnt_op unmnt) * directory where original contents of the polydir * are available from */ - strcpy(poly_parent, pptr->dir); + strcpy(poly_parent, pptr->rdir); fptr = strchr(poly_parent, '/'); cptr = strrchr(poly_parent, '/'); if (fptr && cptr && (fptr == cptr)) @@ -1169,24 +1572,36 @@ static int setup_namespace(struct instance_data *idata, enum unmnt_op unmnt) } } - if (umount(pptr->dir) < 0) { + if (umount(pptr->rdir) < 0) { int saved_errno = errno; pam_syslog(idata->pamh, LOG_ERR, "Unmount of %s failed, %m", - pptr->dir); - if (saved_errno != EINVAL) - return PAM_SESSION_ERR; + pptr->rdir); + if (saved_errno != EINVAL) { + retval = PAM_SESSION_ERR; + goto out; + } } else if (idata->flags & PAMNS_DEBUG) pam_syslog(idata->pamh, LOG_DEBUG, "Umount succeeded %s", - pptr->dir); + pptr->rdir); } if (dir_unmnt != UNMNT_ONLY) { retval = ns_setup(pptr, idata); + if (retval == PAM_IGNORE) + retval = PAM_SUCCESS; if (retval != PAM_SUCCESS) break; } } - +out: + if (retval != PAM_SUCCESS) + cleanup_tmpdirs(idata); + else if (pam_set_data(idata->pamh, NAMESPACE_POLYDIR_DATA, idata->polydirs_ptr, + cleanup_data) != PAM_SUCCESS) { + pam_syslog(idata->pamh, LOG_ERR, "Unable to set namespace data"); + cleanup_tmpdirs(idata); + return PAM_SYSTEM_ERR; + } return retval; } @@ -1225,8 +1640,10 @@ static int orig_namespace(struct instance_data *idata) } else if (idata->flags & PAMNS_DEBUG) pam_syslog(idata->pamh, LOG_DEBUG, "Unmount of %s succeeded", pptr->dir); - } + } } + + cleanup_tmpdirs(idata); return 0; } @@ -1239,7 +1656,7 @@ static int orig_namespace(struct instance_data *idata) * The return value from this function is used when selecting the * polyinstantiation method. If context change is not requested then * the polyinstantiation method is set to USER, even if the configuration - * file lists the method as "context" or "both". + * file lists the method as "context" or "level". */ static int ctxt_based_inst_needed(void) { @@ -1257,6 +1674,55 @@ static int ctxt_based_inst_needed(void) #endif +static int get_user_data(struct instance_data *idata) +{ + int retval; + char *user_name; + struct passwd *pwd; + /* + * Lookup user and fill struct items + */ + retval = pam_get_item(idata->pamh, PAM_USER, (void*) &user_name ); + if ( user_name == NULL || retval != PAM_SUCCESS ) { + pam_syslog(idata->pamh, LOG_ERR, "Error recovering pam user name"); + return PAM_SESSION_ERR; + } + + pwd = pam_modutil_getpwnam(idata->pamh, user_name); + if (!pwd) { + pam_syslog(idata->pamh, LOG_ERR, "user unknown '%s'", user_name); + return PAM_USER_UNKNOWN; + } + + /* + * Add the user info to the instance data so we can refer to them later. + */ + idata->user[0] = 0; + strncat(idata->user, user_name, sizeof(idata->user) - 1); + idata->uid = pwd->pw_uid; + idata->gid = pwd->pw_gid; + + /* Fill in RUSER too */ + retval = pam_get_item(idata->pamh, PAM_RUSER, (void*) &user_name ); + if ( user_name != NULL && retval == PAM_SUCCESS && user_name[0] != '\0' ) { + strncat(idata->ruser, user_name, sizeof(idata->ruser) - 1); + pwd = pam_modutil_getpwnam(idata->pamh, user_name); + } else { + pwd = pam_modutil_getpwuid(idata->pamh, getuid()); + } + if (!pwd) { + pam_syslog(idata->pamh, LOG_ERR, "user unknown '%s'", user_name); + return PAM_USER_UNKNOWN; + } + user_name = pwd->pw_name; + + idata->ruser[0] = 0; + strncat(idata->ruser, user_name, sizeof(idata->ruser) - 1); + idata->ruid = pwd->pw_uid; + + return PAM_SUCCESS; +} + /* * Entry point from pam_open_session call. */ @@ -1265,8 +1731,6 @@ PAM_EXTERN int pam_sm_open_session(pam_handle_t *pamh, int flags UNUSED, { int i, retval; struct instance_data idata; - char *user_name; - struct passwd *pwd; enum unmnt_op unmnt = NO_UNMNT; /* init instance data */ @@ -1290,6 +1754,14 @@ PAM_EXTERN int pam_sm_open_session(pam_handle_t *pamh, int flags UNUSED, idata.flags |= PAMNS_IGN_CONFIG_ERR; if (strcmp(argv[i], "ignore_instance_parent_mode") == 0) idata.flags |= PAMNS_IGN_INST_PARENT_MODE; + if (strcmp(argv[i], "use_current_context") == 0) { + idata.flags |= PAMNS_USE_CURRENT_CONTEXT; + idata.flags |= PAMNS_CTXT_BASED_INST; + } + if (strcmp(argv[i], "use_default_context") == 0) { + idata.flags |= PAMNS_USE_DEFAULT_CONTEXT; + idata.flags |= PAMNS_CTXT_BASED_INST; + } if (strcmp(argv[i], "unmnt_remnt") == 0) unmnt = UNMNT_REMNT; if (strcmp(argv[i], "unmnt_only") == 0) @@ -1305,27 +1777,9 @@ PAM_EXTERN int pam_sm_open_session(pam_handle_t *pamh, int flags UNUSED, if (idata.flags & PAMNS_DEBUG) pam_syslog(idata.pamh, LOG_DEBUG, "open_session - start"); - /* - * Lookup user and fill struct items - */ - retval = pam_get_item(idata.pamh, PAM_USER, (void*) &user_name ); - if ( user_name == NULL || retval != PAM_SUCCESS ) { - pam_syslog(idata.pamh, LOG_ERR, "Error recovering pam user name"); - return PAM_SESSION_ERR; - } - - pwd = pam_modutil_getpwnam(idata.pamh, user_name); - if (!pwd) { - pam_syslog(idata.pamh, LOG_ERR, "user unknown '%s'", user_name); - return PAM_SESSION_ERR; - } - - /* - * Add the user info to the instance data so we can refer to them later. - */ - idata.user[0] = 0; - strncat(idata.user, user_name, sizeof(idata.user) - 1); - idata.uid = pwd->pw_uid; + retval = get_user_data(&idata); + if (retval != PAM_SUCCESS) + return retval; /* * Parse namespace configuration file which lists directories to @@ -1351,7 +1805,8 @@ PAM_EXTERN int pam_sm_open_session(pam_handle_t *pamh, int flags UNUSED, } else if (idata.flags & PAMNS_DEBUG) pam_syslog(idata.pamh, LOG_DEBUG, "Nothing to polyinstantiate"); - del_polydir_list(idata.polydirs_ptr); + if (retval != PAM_SUCCESS) + del_polydir_list(idata.polydirs_ptr); return retval; } @@ -1364,8 +1819,7 @@ PAM_EXTERN int pam_sm_close_session(pam_handle_t *pamh, int flags UNUSED, { int i, retval; struct instance_data idata; - char *user_name; - struct passwd *pwd; + void *polyptr; /* init instance data */ idata.flags = 0; @@ -1407,38 +1861,16 @@ PAM_EXTERN int pam_sm_close_session(pam_handle_t *pamh, int flags UNUSED, return PAM_SUCCESS; } - /* - * Lookup user and fill struct items - */ - retval = pam_get_item(idata.pamh, PAM_USER, (void*) &user_name ); - if ( user_name == NULL || retval != PAM_SUCCESS ) { - pam_syslog(idata.pamh, LOG_ERR, "Error recovering pam user name"); - return PAM_SESSION_ERR; - } - - pwd = pam_modutil_getpwnam(idata.pamh, user_name); - if (!pwd) { - pam_syslog(idata.pamh, LOG_ERR, "user unknown '%s'", user_name); - return PAM_SESSION_ERR; - } - - /* - * Add the user info to the instance data so we can refer to them later. - */ - idata.user[0] = 0; - strncat(idata.user, user_name, sizeof(idata.user) - 1); - idata.uid = pwd->pw_uid; + retval = get_user_data(&idata); + if (retval != PAM_SUCCESS) + return retval; - /* - * Parse namespace configuration file which lists directories that - * are polyinstantiated, directories where instance directories are - * created and the method used for polyinstantiation. - */ - retval = parse_config_file(&idata); - if ((retval != PAM_SUCCESS) || !idata.polydirs_ptr) { - del_polydir_list(idata.polydirs_ptr); - return PAM_SESSION_ERR; - } + retval = pam_get_data(idata.pamh, NAMESPACE_POLYDIR_DATA, (const void **)&polyptr); + if (retval != PAM_SUCCESS || polyptr == NULL) + /* nothing to reset */ + return PAM_SUCCESS; + + idata.polydirs_ptr = polyptr; if (idata.flags & PAMNS_DEBUG) pam_syslog(idata.pamh, LOG_DEBUG, "Resetting namespace for pid %d", @@ -1453,7 +1885,9 @@ PAM_EXTERN int pam_sm_close_session(pam_handle_t *pamh, int flags UNUSED, pam_syslog(idata.pamh, LOG_DEBUG, "resetting namespace ok for pid %d", getpid()); } - del_polydir_list(idata.polydirs_ptr); + + pam_set_data(idata.pamh, NAMESPACE_POLYDIR_DATA, NULL, NULL); + return PAM_SUCCESS; } diff --git a/Linux-PAM/modules/pam_namespace/pam_namespace.h b/Linux-PAM/modules/pam_namespace/pam_namespace.h index 0847ec08..bfc0da17 100644 --- a/Linux-PAM/modules/pam_namespace/pam_namespace.h +++ b/Linux-PAM/modules/pam_namespace/pam_namespace.h @@ -47,6 +47,7 @@ #include <dlfcn.h> #include <stdarg.h> #include <pwd.h> +#include <grp.h> #include <limits.h> #include <sys/types.h> #include <sys/stat.h> @@ -56,6 +57,8 @@ #include <libgen.h> #include <fcntl.h> #include <sched.h> +#include <glob.h> +#include <locale.h> #include "security/pam_modules.h" #include "security/pam_modutil.h" #include "security/pam_ext.h" @@ -63,6 +66,7 @@ #ifdef WITH_SELINUX #include <selinux/selinux.h> +#include <selinux/get_context_list.h> #include <selinux/context.h> #endif @@ -73,14 +77,16 @@ /* * Module defines */ -#ifndef PAM_NAMESPACE_CONFIG -#define PAM_NAMESPACE_CONFIG "/etc/security/namespace.conf" +#ifndef SECURECONF_DIR +#define SECURECONF_DIR "/etc/security/" #endif -#ifndef NAMESPACE_INIT_SCRIPT -#define NAMESPACE_INIT_SCRIPT "/etc/security/namespace.init" -#endif +#define PAM_NAMESPACE_CONFIG (SECURECONF_DIR "namespace.conf") +#define NAMESPACE_INIT_SCRIPT (SECURECONF_DIR "namespace.init") +#define NAMESPACE_D_DIR (SECURECONF_DIR "namespace.d/") +#define NAMESPACE_D_GLOB (SECURECONF_DIR "namespace.d/*.conf") +/* module flags */ #define PAMNS_DEBUG 0x00000100 /* Running in debug mode */ #define PAMNS_SELINUX_ENABLED 0x00000400 /* SELinux is enabled */ #define PAMNS_CTXT_BASED_INST 0x00000800 /* Context based instance needed */ @@ -88,8 +94,19 @@ #define PAMNS_IGN_CONFIG_ERR 0x00004000 /* Ignore format error in conf file */ #define PAMNS_IGN_INST_PARENT_MODE 0x00008000 /* Ignore instance parent mode */ #define PAMNS_NO_UNMOUNT_ON_CLOSE 0x00010000 /* no unmount at session close */ +#define PAMNS_USE_CURRENT_CONTEXT 0x00020000 /* use getcon instead of getexeccon */ +#define PAMNS_USE_DEFAULT_CONTEXT 0x00040000 /* use get_default_context instead of getexeccon */ + +/* polydir flags */ +#define POLYDIR_EXCLUSIVE 0x00000001 /* polyinstatiate exclusively for override uids */ +#define POLYDIR_CREATE 0x00000002 /* create the polydir */ +#define POLYDIR_NOINIT 0x00000004 /* no init script */ +#define POLYDIR_SHARED 0x00000008 /* share context/level instances among users */ +#define POLYDIR_ISCRIPT 0x00000010 /* non default init script */ + #define NAMESPACE_MAX_DIR_LEN 80 +#define NAMESPACE_POLYDIR_DATA "pam_namespace:polydir_data" /* * Polyinstantiation method options, based on user, security context @@ -100,6 +117,8 @@ enum polymethod { USER, CONTEXT, LEVEL, + TMPDIR, + TMPFS }; /* @@ -124,10 +143,16 @@ enum unmnt_op { */ struct polydir_s { char dir[PATH_MAX]; /* directory to polyinstantiate */ + char rdir[PATH_MAX]; /* directory to unmount (based on RUSER) */ char instance_prefix[PATH_MAX]; /* prefix for instance dir path name */ enum polymethod method; /* method used to polyinstantiate */ unsigned int num_uids; /* number of override uids */ uid_t *uid; /* list of override uids */ + unsigned int flags; /* polydir flags */ + char *init_script; /* path to init script */ + uid_t owner; /* user which should own the polydir */ + gid_t group; /* group which should own the polydir */ + mode_t mode; /* mode of the polydir */ struct polydir_s *next; /* pointer to the next polydir entry */ }; @@ -135,6 +160,9 @@ struct instance_data { pam_handle_t *pamh; /* The pam handle for this instance */ struct polydir_s *polydirs_ptr; /* The linked list pointer */ char user[LOGIN_NAME_MAX]; /* User name */ + char ruser[LOGIN_NAME_MAX]; /* Requesting user name */ uid_t uid; /* The uid of the user */ - unsigned long flags; /* Flags for debug, selinux etc */ + gid_t gid; /* The gid of the user's primary group */ + uid_t ruid; /* The uid of the requesting user */ + unsigned long flags; /* Flags for debug, selinux etc */ }; diff --git a/Linux-PAM/modules/pam_nologin/pam_nologin.8 b/Linux-PAM/modules/pam_nologin/pam_nologin.8 index 5e502266..8d5d1742 100644 --- a/Linux-PAM/modules/pam_nologin/pam_nologin.8 +++ b/Linux-PAM/modules/pam_nologin/pam_nologin.8 @@ -1,89 +1,103 @@ .\" Title: pam_nologin .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/> -.\" Date: 06/04/2006 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "PAM_NOLOGIN" "8" "06/04/2006" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_NOLOGIN" "8" "01/08/2008" "Linux-PAM Manual" "Linux\-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_nologin \- Prevent non\-root users from login +pam_nologin - Prevent non-root users from login .SH "SYNOPSIS" .HP 15 -\fBpam_nologin.so\fR [file=\fI/path/nologin\fR] [successok] +\fBpam_nologin\.so\fR [file=\fI/path/nologin\fR] [successok] .SH "DESCRIPTION" .PP pam_nologin is a PAM module that prevents users from logging into the system when \fI/etc/nologin\fR -exists. The contents of the +exists\. The contents of the \fI/etc/nologin\fR -file are displayed to the user. The pam_nologin module has no effect on the root user's ability to log in. +file are displayed to the user\. The pam_nologin module has no effect on the root user\'s ability to log in\. .SH "OPTIONS" -.TP 3n +.PP \fBfile=\fR\fB\fI/path/nologin\fR\fR +.RS 4 Use this file instead the default -\fI/etc/nologin\fR. -.TP 3n +\fI/etc/nologin\fR\. +.RE +.PP \fBsuccessok\fR -Return PAM_SUCCESS if no file exists, the default is PAM_IGNORE. +.RS 4 +Return PAM_SUCCESS if no file exists, the default is PAM_IGNORE\. +.RE .SH "MODULE SERVICES PROVIDED" .PP The \fBauth\fR and \fBacct\fR -services are supported. +services are supported\. .SH "RETURN VALUES" -.TP 3n +.PP PAM_AUTH_ERR +.RS 4 The user is not root and \fI/etc/nologin\fR -exists, so the user is not permitted to log in. -.TP 3n +exists, so the user is not permitted to log in\. +.RE +.PP PAM_BUF_ERR -Memory buffer error. -.TP 3n +.RS 4 +Memory buffer error\. +.RE +.PP PAM_IGNORE -This is the default return value. -.TP 3n +.RS 4 +This is the default return value\. +.RE +.PP PAM_SUCCESS +.RS 4 Success: either the user is root or the \fI/etc/nologin\fR -file does not exist. -.TP 3n +file does not exist\. +.RE +.PP PAM_USER_UNKNOWN -User not known to the underlying authentication module. +.RS 4 +User not known to the underlying authentication module\. +.RE .SH "EXAMPLES" .PP The suggested usage for -\fI/etc/pam.d/login\fR +\fI/etc/pam\.d/login\fR is: .sp -.RS 3n +.RS 4 .nf -auth required pam_nologin.so +auth required pam_nologin\.so .fi .RE .sp .SH "NOTES" .PP -In order to make this module effective, all login methods should be secured by it. It should be used as a +In order to make this module effective, all login methods should be secured by it\. It should be used as a \fIrequired\fR method listed before any \fIsufficient\fR -methods in order to get standard Unix nologin semantics. Note, the use of +methods in order to get standard Unix nologin semantics\. Note, the use of \fBsuccessok\fR module argument causes the module to return \fIPAM_SUCCESS\fR and as such would break such a configuration \- failing \fIsufficient\fR modules would lead to a successful login because the nologin module -\fIsucceeded\fR. +\fIsucceeded\fR\. .SH "SEE ALSO" .PP @@ -93,4 +107,4 @@ modules would lead to a successful login because the nologin module \fBpam\fR(8) .SH "AUTHOR" .PP -pam_nologin was written by Michael K. Johnson <johnsonm@redhat.com>. +pam_nologin was written by Michael K\. Johnson <johnsonm@redhat\.com>\. diff --git a/Linux-PAM/modules/pam_permit/README b/Linux-PAM/modules/pam_permit/README index e09ec9cf..d479dccd 100644 --- a/Linux-PAM/modules/pam_permit/README +++ b/Linux-PAM/modules/pam_permit/README @@ -14,7 +14,7 @@ This module is very dangerous. It should be used with extreme caution. OPTIONS -This module does not recognice any options. +This module does not recognise any options. EXAMPLES diff --git a/Linux-PAM/modules/pam_permit/pam_permit.8 b/Linux-PAM/modules/pam_permit/pam_permit.8 index ce3c3290..720ba32b 100644 --- a/Linux-PAM/modules/pam_permit/pam_permit.8 +++ b/Linux-PAM/modules/pam_permit/pam_permit.8 @@ -1,32 +1,32 @@ .\" Title: pam_permit .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/> -.\" Date: 06/04/2006 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "PAM_PERMIT" "8" "06/04/2006" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_PERMIT" "8" "01/08/2008" "Linux-PAM Manual" "Linux\-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_permit \- The promiscuous module +pam_permit - The promiscuous module .SH "SYNOPSIS" .HP 14 -\fBpam_permit.so\fR +\fBpam_permit\.so\fR .SH "DESCRIPTION" .PP -pam_permit is a PAM module that always permit access. It does nothing else. +pam_permit is a PAM module that always permit access\. It does nothing else\. .PP -In the case of authentication, the user's name will be set to +In the case of authentication, the user\'s name will be set to \fInobody\fR -if the application didn't set one. Many applications and PAM modules become confused if this name is unknown. +if the application didn\'t set one\. Many applications and PAM modules become confused if this name is unknown\. .PP -This module is very dangerous. It should be used with extreme caution. +This module is very dangerous\. It should be used with extreme caution\. .SH "OPTIONS" .PP -This module does not recognice any options. +This module does not recognise any options\. .SH "MODULE SERVICES PROVIDED" .PP The services @@ -35,18 +35,20 @@ The services \fBpassword\fR and \fBsession\fR -are supported. +are supported\. .SH "RETURN VALUES" -.TP 3n +.PP PAM_SUCCESS -This module always returns this value. +.RS 4 +This module always returns this value\. +.RE .SH "EXAMPLES" .PP -Add this line to your other login entries to disable account management, but continue to permit users to log in. +Add this line to your other login entries to disable account management, but continue to permit users to log in\. .sp -.RS 3n +.RS 4 .nf -account required pam_permit.so +account required pam_permit\.so .fi .RE @@ -59,4 +61,4 @@ account required pam_permit.so \fBpam\fR(8) .SH "AUTHOR" .PP -pam_permit was written by Andrew G. Morgan, <morgan@kernel.org>. +pam_permit was written by Andrew G\. Morgan, <morgan@kernel\.org>\. diff --git a/Linux-PAM/modules/pam_permit/pam_permit.8.xml b/Linux-PAM/modules/pam_permit/pam_permit.8.xml index 3992f43f..4db7a963 100644 --- a/Linux-PAM/modules/pam_permit/pam_permit.8.xml +++ b/Linux-PAM/modules/pam_permit/pam_permit.8.xml @@ -44,7 +44,7 @@ <refsect1 id="pam_permit-options"> <title>OPTIONS</title> - <para> This module does not recognice any options.</para> + <para> This module does not recognise any options.</para> </refsect1> <refsect1 id="pam_permit-services"> diff --git a/Linux-PAM/modules/pam_rhosts/Makefile.am b/Linux-PAM/modules/pam_rhosts/Makefile.am index 26fdf9c6..547ad621 100644 --- a/Linux-PAM/modules/pam_rhosts/Makefile.am +++ b/Linux-PAM/modules/pam_rhosts/Makefile.am @@ -1,12 +1,12 @@ # -# Copyright (c) 2005, 2006 Thorsten Kukuk <kukuk@suse.de> +# Copyright (c) 2005, 2006, 2008 Thorsten Kukuk <kukuk@suse.de> # CLEANFILES = *~ -EXTRA_DIST = README $(MANS) $(XMLS) tst-pam_rhosts_auth tst-pam_rhosts +EXTRA_DIST = README $(MANS) $(XMLS) tst-pam_rhosts -TESTS = tst-pam_rhosts_auth tst-pam_rhosts +TESTS = tst-pam_rhosts man_MANS = pam_rhosts.8 @@ -21,8 +21,7 @@ if HAVE_VERSIONING AM_LDFLAGS += -Wl,--version-script=$(srcdir)/../modules.map endif -securelib_LTLIBRARIES = pam_rhosts_auth.la pam_rhosts.la -pam_rhosts_auth_la_LIBADD = -L$(top_builddir)/libpam -lpam +securelib_LTLIBRARIES = pam_rhosts.la pam_rhosts_la_LIBADD = -L$(top_builddir)/libpam -lpam if ENABLE_REGENERATE_MAN diff --git a/Linux-PAM/modules/pam_rhosts/pam_rhosts.8 b/Linux-PAM/modules/pam_rhosts/pam_rhosts.8 index 0d7f4a16..23f03112 100644 --- a/Linux-PAM/modules/pam_rhosts/pam_rhosts.8 +++ b/Linux-PAM/modules/pam_rhosts/pam_rhosts.8 @@ -1,85 +1,95 @@ .\" Title: pam_rhosts .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/> -.\" Date: 06/28/2006 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "PAM_RHOSTS" "8" "06/28/2006" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_RHOSTS" "8" "01/08/2008" "Linux-PAM Manual" "Linux\-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_rhosts \- The rhosts PAM module +pam_rhosts - The rhosts PAM module .SH "SYNOPSIS" .HP 14 -\fBpam_rhosts.so\fR +\fBpam_rhosts\.so\fR .SH "DESCRIPTION" .PP This module performs the standard network authentication for services, as used by traditional implementations of \fBrlogin\fR and \fBrsh\fR -etc. +etc\. .PP The authentication mechanism of this module is based on the contents of two files; -\fI/etc/hosts.equiv\fR +\fI/etc/hosts\.equiv\fR (or and -\fI~/.rhosts\fR. Firstly, hosts listed in the former file are treated as equivalent to the localhost. Secondly, entries in the user's own copy of the latter file is used to map "\fIremote\-host remote\-user\fR" pairs to that user's account on the current host. Access is granted to the user if their host is present in -\fI/etc/hosts.equiv\fR -and their remote account is identical to their local one, or if their remote account has an entry in their personal configuration file. +\fI~/\.rhosts\fR\. Firstly, hosts listed in the former file are treated as equivalent to the localhost\. Secondly, entries in the user\'s own copy of the latter file is used to map "\fIremote\-host remote\-user\fR" pairs to that user\'s account on the current host\. Access is granted to the user if their host is present in +\fI/etc/hosts\.equiv\fR +and their remote account is identical to their local one, or if their remote account has an entry in their personal configuration file\. .PP The module authenticates a remote user (internally specified by the item \fIPAM_RUSER\fR connecting from the remote host (internally specified by the item -\fBPAM_RHOST\fR). Accordingly, for applications to be compatible this authentication module they must set these items prior to calling -\fBpam_authenticate()\fR. The module is not capable of independently probing the network connection for such information. +\fBPAM_RHOST\fR)\. Accordingly, for applications to be compatible this authentication module they must set these items prior to calling +\fBpam_authenticate()\fR\. The module is not capable of independently probing the network connection for such information\. .SH "OPTIONS" -.TP 3n +.PP \fBdebug\fR -Print debug information. -.TP 3n +.RS 4 +Print debug information\. +.RE +.PP \fBsilent\fR -Don't print informative messages. -.TP 3n +.RS 4 +Don\'t print informative messages\. +.RE +.PP \fBsuperuser=\fR\fB\fIaccount\fR\fR +.RS 4 Handle \fIaccount\fR -as root. +as root\. +.RE .SH "MODULE SERVICES PROVIDED" .PP Only the \fBauth\fR -service is supported. +service is supported\. .SH "RETURN VALUES" -.TP 3n +.PP PAM_AUTH_ERR -The remote host, remote user name or the local user name couldn't be determined or access was denied by -\fI.rhosts\fR -file. -.TP 3n +.RS 4 +The remote host, remote user name or the local user name couldn\'t be determined or access was denied by +\fI\.rhosts\fR +file\. +.RE +.PP PAM_USER_UNKNOWN -User is not known to system. +.RS 4 +User is not known to system\. +.RE .SH "EXAMPLES" .PP To grant a remote user access by -\fI/etc/hosts.equiv\fR +\fI/etc/hosts\.equiv\fR or -\fI.rhosts\fR +\fI\.rhosts\fR for \fBrsh\fR add the following lines to -\fI/etc/pam.d/rsh\fR: +\fI/etc/pam\.d/rsh\fR: .sp -.RS 3n +.RS 4 .nf -#%PAM\-1.0 +#%PAM\-1\.0 # -auth required pam_rhosts.so -auth required pam_nologin.so -auth required pam_env.so -auth required pam_unix.so +auth required pam_rhosts\.so +auth required pam_nologin\.so +auth required pam_env\.so +auth required pam_unix\.so .fi .RE @@ -95,4 +105,4 @@ auth required pam_unix.so \fBpam\fR(8) .SH "AUTHOR" .PP -pam_rhosts was written by Thorsten Kukuk <kukuk@thkukuk.de> +pam_rhosts was written by Thorsten Kukuk <kukuk@thkukuk\.de> diff --git a/Linux-PAM/modules/pam_rootok/pam_rootok.8 b/Linux-PAM/modules/pam_rootok/pam_rootok.8 index 79618050..ba86ea77 100644 --- a/Linux-PAM/modules/pam_rootok/pam_rootok.8 +++ b/Linux-PAM/modules/pam_rootok/pam_rootok.8 @@ -1,66 +1,72 @@ .\" Title: pam_rootok .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/> -.\" Date: 06/23/2006 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "PAM_ROOTOK" "8" "06/23/2006" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_ROOTOK" "8" "01/08/2008" "Linux-PAM Manual" "Linux\-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_rootok \- Gain only root access +pam_rootok - Gain only root access .SH "SYNOPSIS" .HP 14 -\fBpam_rootok.so\fR [debug] +\fBpam_rootok\.so\fR [debug] .SH "DESCRIPTION" .PP pam_rootok is a PAM module that authenticates the user if their \fIUID\fR is -\fI0\fR. Applications that are created setuid\-root generally retain the +\fI0\fR\. Applications that are created setuid\-root generally retain the \fIUID\fR -of the user but run with the authority of an enhanced effective\-UID. It is the real +of the user but run with the authority of an enhanced effective\-UID\. It is the real \fIUID\fR -that is checked. +that is checked\. .SH "OPTIONS" -.TP 3n +.PP \fBdebug\fR -Print debug information. +.RS 4 +Print debug information\. +.RE .SH "MODULE SERVICES PROVIDED" .PP Only the \fBauth\fR -service is supported. +service is supported\. .SH "RETURN VALUES" -.TP 3n +.PP PAM_SUCCESS +.RS 4 The \fIUID\fR is -\fI0\fR. -.TP 3n +\fI0\fR\. +.RE +.PP PAM_AUTH_ERR +.RS 4 The \fIUID\fR is \fBnot\fR -\fI0\fR. +\fI0\fR\. +.RE .SH "EXAMPLES" .PP In the case of the \fBsu\fR(1) -application the historical usage is to permit the superuser to adopt the identity of a lesser user without the use of a password. To obtain this behavior with PAM the following pair of lines are needed for the corresponding entry in the -\fI/etc/pam.d/su\fR +application the historical usage is to permit the superuser to adopt the identity of a lesser user without the use of a password\. To obtain this behavior with PAM the following pair of lines are needed for the corresponding entry in the +\fI/etc/pam\.d/su\fR configuration file: .sp -.RS 3n +.RS 4 .nf -# su authentication. Root is granted access by default. -auth sufficient pam_rootok.so -auth required pam_unix.so +# su authentication\. Root is granted access by default\. +auth sufficient pam_rootok\.so +auth required pam_unix\.so .fi .RE @@ -74,4 +80,4 @@ auth required pam_unix.so \fBpam\fR(8) .SH "AUTHOR" .PP -pam_rootok was written by Andrew G. Morgan, <morgan@kernel.org>. +pam_rootok was written by Andrew G\. Morgan, <morgan@kernel\.org>\. diff --git a/Linux-PAM/modules/pam_securetty/pam_securetty.8 b/Linux-PAM/modules/pam_securetty/pam_securetty.8 index f72e611f..f37c5710 100644 --- a/Linux-PAM/modules/pam_securetty/pam_securetty.8 +++ b/Linux-PAM/modules/pam_securetty/pam_securetty.8 @@ -1,74 +1,86 @@ .\" Title: pam_securetty .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/> -.\" Date: 06/04/2006 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "PAM_SECURETTY" "8" "06/04/2006" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_SECURETTY" "8" "01/08/2008" "Linux-PAM Manual" "Linux\-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_securetty \- Limit root login to special devices +pam_securetty - Limit root login to special devices .SH "SYNOPSIS" .HP 17 -\fBpam_securetty.so\fR [debug] +\fBpam_securetty\.so\fR [debug] .SH "DESCRIPTION" .PP pam_securetty is a PAM module that allows root logins only if the user is logging in on a "secure" tty, as defined by the listing in -\fI/etc/securetty\fR. pam_securetty also checks to make sure that +\fI/etc/securetty\fR\. pam_securetty also checks to make sure that \fI/etc/securetty\fR -is a plain file and not world writable. +is a plain file and not world writable\. .PP This module has no effect on non\-root users and requires that the application fills in the \fBPAM_TTY\fR -item correctly. +item correctly\. .PP For canonical usage, should be listed as a \fBrequired\fR authentication method before any \fBsufficient\fR -authentication methods. +authentication methods\. .SH "OPTIONS" -.TP 3n +.PP \fBdebug\fR -Print debug information. +.RS 4 +Print debug information\. +.RE .SH "MODULE SERVICES PROVIDED" .PP Only the \fBauth\fR -service is supported. +service is supported\. .SH "RETURN VALUES" -.TP 3n +.PP PAM_SUCCESS -The user is allowed to continue authentication. Either the user is not root, or the root user is trying to log in on an acceptable device. -.TP 3n +.RS 4 +The user is allowed to continue authentication\. Either the user is not root, or the root user is trying to log in on an acceptable device\. +.RE +.PP PAM_AUTH_ERR -Authentication is rejected. Either root is attempting to log in via an unacceptable device, or the +.RS 4 +Authentication is rejected\. Either root is attempting to log in via an unacceptable device, or the \fI/etc/securetty\fR -file is world writable or not a normal file. -.TP 3n +file is world writable or not a normal file\. +.RE +.PP PAM_INCOMPLETE -An application error occurred. pam_securetty was not able to get information it required from the application that called it. -.TP 3n +.RS 4 +An application error occurred\. pam_securetty was not able to get information it required from the application that called it\. +.RE +.PP PAM_SERVICE_ERR -An error occurred while the module was determining the user's name or tty, or the module could not open -\fI/etc/securetty\fR. -.TP 3n +.RS 4 +An error occurred while the module was determining the user\'s name or tty, or the module could not open +\fI/etc/securetty\fR\. +.RE +.PP PAM_IGNORE +.RS 4 The module could not find the user name in the \fI/etc/passwd\fR -file to verify whether the user had a UID of 0. Therefore, the results of running this module are ignored. +file to verify whether the user had a UID of 0\. Therefore, the results of running this module are ignored\. +.RE .SH "EXAMPLES" .PP .sp -.RS 3n +.RS 4 .nf -auth required pam_securetty.so -auth required pam_unix.so +auth required pam_securetty\.so +auth required pam_unix\.so .fi .RE @@ -82,4 +94,4 @@ auth required pam_unix.so \fBpam\fR(8) .SH "AUTHOR" .PP -pam_securetty was written by Elliot Lee <sopwith@cuc.edu>. +pam_securetty was written by Elliot Lee <sopwith@cuc\.edu>\. diff --git a/Linux-PAM/modules/pam_selinux/Makefile.am b/Linux-PAM/modules/pam_selinux/Makefile.am index d11b507c..baf782a8 100644 --- a/Linux-PAM/modules/pam_selinux/Makefile.am +++ b/Linux-PAM/modules/pam_selinux/Makefile.am @@ -1,8 +1,9 @@ # -# Copyright (c) 2005, 2006 Thorsten Kukuk <kukuk@thkukuk.de> +# Copyright (c) 2005, 2006, 2007 Thorsten Kukuk <kukuk@thkukuk.de> # CLEANFILES = *~ +MAINTAINERCLEANFILES = $(MANS) README EXTRA_DIST = README $(XMLS) pam_selinux.8 pam_selinux_check.8 \ tst-pam_selinux diff --git a/Linux-PAM/modules/pam_selinux/pam_selinux.8 b/Linux-PAM/modules/pam_selinux/pam_selinux.8 index 6709ac9c..ec26025d 100644 --- a/Linux-PAM/modules/pam_selinux/pam_selinux.8 +++ b/Linux-PAM/modules/pam_selinux/pam_selinux.8 @@ -1,92 +1,92 @@ .\" Title: pam_selinux .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/> -.\" Date: 06/20/2007 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "PAM_SELINUX" "8" "06/20/2007" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_SELINUX" "8" "01/08/2008" "Linux-PAM Manual" "Linux\-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_selinux \- PAM module to set the default security context +pam_selinux - PAM module to set the default security context .SH "SYNOPSIS" .HP 15 -\fBpam_selinux.so\fR [close] [debug] [open] [nottys] [verbose] [select_context] [use_current_range] +\fBpam_selinux\.so\fR [close] [debug] [open] [nottys] [verbose] [select_context] [use_current_range] .SH "DESCRIPTION" .PP -In a nutshell, pam_selinux sets up the default security context for the next execed shell. +In a nutshell, pam_selinux sets up the default security context for the next execed shell\. .PP -When an application opens a session using pam_selinux, the shell that gets executed will be run in the default security context, or if the user chooses and the pam file allows the selected security context. Also the controlling tty will have it's security context modified to match the users. +When an application opens a session using pam_selinux, the shell that gets executed will be run in the default security context, or if the user chooses and the pam file allows the selected security context\. Also the controlling tty will have it\'s security context modified to match the users\. .PP -Adding pam_selinux into a pam file could cause other pam modules to change their behavior if the exec another application. The close and open option help mitigate this problem. close option will only cause the close portion of the pam_selinux to execute, and open will only cause the open portion to run. You can add pam_selinux to the config file twice. Add the pam_selinux close as the executes the open pass through the modules, pam_selinux open_session will happen last. When PAM executes the close pass through the modules pam_selinux close_session will happen first. +Adding pam_selinux into a pam file could cause other pam modules to change their behavior if the exec another application\. The close and open option help mitigate this problem\. close option will only cause the close portion of the pam_selinux to execute, and open will only cause the open portion to run\. You can add pam_selinux to the config file twice\. Add the pam_selinux close as the executes the open pass through the modules, pam_selinux open_session will happen last\. When PAM executes the close pass through the modules pam_selinux close_session will happen first\. .SH "OPTIONS" .PP \fBclose\fR .RS 4 -Only execute the close_session portion of the module. +Only execute the close_session portion of the module\. .RE .PP \fBdebug\fR .RS 4 Turns on debugging via -\fBsyslog\fR(3). +\fBsyslog\fR(3)\. .RE .PP \fBopen\fR .RS 4 -Only execute the open_session portion of the module. +Only execute the open_session portion of the module\. .RE .PP \fBnottys\fR .RS 4 -Do not try to setup the ttys security context. +Do not try to setup the ttys security context\. .RE .PP \fBverbose\fR .RS 4 -attempt to inform the user when security context is set. +attempt to inform the user when security context is set\. .RE .PP \fBselect_context\fR .RS 4 -Attempt to ask the user for a custom security context role. If MLS is on ask also for sensitivity level. +Attempt to ask the user for a custom security context role\. If MLS is on ask also for sensitivity level\. .RE .PP \fBuse_current_range\fR .RS 4 -Use the sensitivity range of the process for the user context. This option and the select_context option are mutually exclusive. +Use the sensitivity range of the process for the user context\. This option and the select_context option are mutually exclusive\. .RE .SH "MODULE SERVICES PROVIDED" .PP Only the \fBsession\fR -service is supported. +service is supported\. .SH "RETURN VALUES" .PP PAM_AUTH_ERR .RS 4 -Unable to get or set a valid context. +Unable to get or set a valid context\. .RE .PP PAM_SUCCESS .RS 4 -The security context was set successfull. +The security context was set successfull\. .RE .PP PAM_USER_UNKNOWN .RS 4 -The user is not known to the system. +The user is not known to the system\. .RE .SH "EXAMPLES" .sp .RS 4 .nf -auth required pam_unix.so -session required pam_permit.so -session optional pam_selinux.so +auth required pam_unix\.so +session required pam_permit\.so +session optional pam_selinux\.so .fi .RE @@ -98,4 +98,4 @@ session optional pam_selinux.so \fBpam\fR(8) .SH "AUTHOR" .PP -pam_selinux was written by Dan Walsh <dwalsh@redhat.com>. +pam_selinux was written by Dan Walsh <dwalsh@redhat\.com>\. diff --git a/Linux-PAM/modules/pam_sepermit/Makefile.am b/Linux-PAM/modules/pam_sepermit/Makefile.am new file mode 100644 index 00000000..579e142f --- /dev/null +++ b/Linux-PAM/modules/pam_sepermit/Makefile.am @@ -0,0 +1,43 @@ +# +# Copyright (c) 2005, 2006, 2007 Thorsten Kukuk <kukuk@thkukuk.de> +# Copyright (c) 2008 Red Hat, Inc. +# + +CLEANFILES = *~ +MAINTAINERCLEANFILES = $(MANS) README + +EXTRA_DIST = README $(XMLS) pam_sepermit.8 sepermit.conf tst-pam_sepermit + +if HAVE_LIBSELINUX + TESTS = tst-pam_sepermit + man_MANS = pam_sepermit.8 +endif + +XMLS = README.xml pam_sepermit.8.xml + +securelibdir = $(SECUREDIR) +secureconfdir = $(SCONFIGDIR) +sepermitlockdir = ${localstatedir}/run/sepermit + +AM_CFLAGS = -I$(top_srcdir)/libpam/include -I$(top_srcdir)/libpamc/include \ + -I$(top_srcdir)/libpam_misc/include \ + -D SEPERMIT_CONF_FILE=\"$(SCONFIGDIR)/sepermit.conf\" \ + -D SEPERMIT_LOCKDIR=\"$(sepermitlockdir)\" + +pam_sepermit_la_LIBADD = -L$(top_builddir)/libpam -lpam @LIBSELINUX@ +pam_sepermit_la_LDFLAGS = -no-undefined -avoid-version -module +if HAVE_VERSIONING + pam_sepermit_la_LDFLAGS += -Wl,--version-script=$(srcdir)/../modules.map +endif + +if HAVE_LIBSELINUX + secureconf_DATA = sepermit.conf + sepermitlock_DATA = + + securelib_LTLIBRARIES = pam_sepermit.la +endif +if ENABLE_REGENERATE_MAN +noinst_DATA = README pam_sepermit.8 +README: pam_sepermit.8.xml +-include $(top_srcdir)/Make.xml.rules +endif diff --git a/Linux-PAM/modules/pam_sepermit/Makefile.in b/Linux-PAM/modules/pam_sepermit/Makefile.in new file mode 100644 index 00000000..9ab1aece --- /dev/null +++ b/Linux-PAM/modules/pam_sepermit/Makefile.in @@ -0,0 +1,722 @@ +# Makefile.in generated by automake 1.10 from Makefile.am. +# @configure_input@ + +# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, +# 2003, 2004, 2005, 2006 Free Software Foundation, Inc. +# This Makefile.in is free software; the Free Software Foundation +# gives unlimited permission to copy and/or distribute it, +# with or without modifications, as long as this notice is preserved. + +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY, to the extent permitted by law; without +# even the implied warranty of MERCHANTABILITY or FITNESS FOR A +# PARTICULAR PURPOSE. + +@SET_MAKE@ + +# +# Copyright (c) 2005, 2006, 2007 Thorsten Kukuk <kukuk@thkukuk.de> +# Copyright (c) 2008 Red Hat, Inc. +# + + +VPATH = @srcdir@ +pkgdatadir = $(datadir)/@PACKAGE@ +pkglibdir = $(libdir)/@PACKAGE@ +pkgincludedir = $(includedir)/@PACKAGE@ +am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd +install_sh_DATA = $(install_sh) -c -m 644 +install_sh_PROGRAM = $(install_sh) -c +install_sh_SCRIPT = $(install_sh) -c +INSTALL_HEADER = $(INSTALL_DATA) +transform = $(program_transform_name) +NORMAL_INSTALL = : +PRE_INSTALL = : +POST_INSTALL = : +NORMAL_UNINSTALL = : +PRE_UNINSTALL = : +POST_UNINSTALL = : +build_triplet = @build@ +host_triplet = @host@ +@HAVE_VERSIONING_TRUE@am__append_1 = -Wl,--version-script=$(srcdir)/../modules.map +subdir = modules/pam_sepermit +DIST_COMMON = README $(srcdir)/Makefile.am $(srcdir)/Makefile.in +ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 +am__aclocal_m4_deps = $(top_srcdir)/m4/gettext.m4 \ + $(top_srcdir)/m4/iconv.m4 \ + $(top_srcdir)/m4/jh_path_xml_catalog.m4 \ + $(top_srcdir)/m4/ld-O1.m4 $(top_srcdir)/m4/ld-as-needed.m4 \ + $(top_srcdir)/m4/lib-ld.m4 $(top_srcdir)/m4/lib-link.m4 \ + $(top_srcdir)/m4/lib-prefix.m4 $(top_srcdir)/m4/libprelude.m4 \ + $(top_srcdir)/m4/nls.m4 $(top_srcdir)/m4/po.m4 \ + $(top_srcdir)/m4/progtest.m4 $(top_srcdir)/acinclude.m4 \ + $(top_srcdir)/configure.in +am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ + $(ACLOCAL_M4) +mkinstalldirs = $(SHELL) $(top_srcdir)/mkinstalldirs +CONFIG_HEADER = $(top_builddir)/config.h +CONFIG_CLEAN_FILES = +am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`; +am__vpath_adj = case $$p in \ + $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \ + *) f=$$p;; \ + esac; +am__strip_dir = `echo $$p | sed -e 's|^.*/||'`; +am__installdirs = "$(DESTDIR)$(securelibdir)" "$(DESTDIR)$(man8dir)" \ + "$(DESTDIR)$(secureconfdir)" "$(DESTDIR)$(sepermitlockdir)" +securelibLTLIBRARIES_INSTALL = $(INSTALL) +LTLIBRARIES = $(securelib_LTLIBRARIES) +pam_sepermit_la_DEPENDENCIES = +pam_sepermit_la_SOURCES = pam_sepermit.c +pam_sepermit_la_OBJECTS = pam_sepermit.lo +pam_sepermit_la_LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) \ + $(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \ + $(pam_sepermit_la_LDFLAGS) $(LDFLAGS) -o $@ +@HAVE_LIBSELINUX_TRUE@am_pam_sepermit_la_rpath = -rpath \ +@HAVE_LIBSELINUX_TRUE@ $(securelibdir) +DEFAULT_INCLUDES = -I. -I$(top_builddir)@am__isrc@ +depcomp = $(SHELL) $(top_srcdir)/depcomp +am__depfiles_maybe = depfiles +COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \ + $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) +LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \ + --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) \ + $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) +CCLD = $(CC) +LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \ + --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \ + $(LDFLAGS) -o $@ +SOURCES = pam_sepermit.c +DIST_SOURCES = pam_sepermit.c +man8dir = $(mandir)/man8 +NROFF = nroff +MANS = $(man_MANS) +secureconfDATA_INSTALL = $(INSTALL_DATA) +sepermitlockDATA_INSTALL = $(INSTALL_DATA) +DATA = $(noinst_DATA) $(secureconf_DATA) $(sepermitlock_DATA) +ETAGS = etags +CTAGS = ctags +DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) +ACLOCAL = @ACLOCAL@ +AMTAR = @AMTAR@ +AR = @AR@ +AUTOCONF = @AUTOCONF@ +AUTOHEADER = @AUTOHEADER@ +AUTOMAKE = @AUTOMAKE@ +AWK = @AWK@ +BROWSER = @BROWSER@ +CC = @CC@ +CCDEPMODE = @CCDEPMODE@ +CFLAGS = @CFLAGS@ +CPP = @CPP@ +CPPFLAGS = @CPPFLAGS@ +CXX = @CXX@ +CXXCPP = @CXXCPP@ +CXXDEPMODE = @CXXDEPMODE@ +CXXFLAGS = @CXXFLAGS@ +CYGPATH_W = @CYGPATH_W@ +DEFS = @DEFS@ +DEPDIR = @DEPDIR@ +ECHO = @ECHO@ +ECHO_C = @ECHO_C@ +ECHO_N = @ECHO_N@ +ECHO_T = @ECHO_T@ +EGREP = @EGREP@ +EXEEXT = @EXEEXT@ +F77 = @F77@ +FFLAGS = @FFLAGS@ +FO2PDF = @FO2PDF@ +GMSGFMT = @GMSGFMT@ +GMSGFMT_015 = @GMSGFMT_015@ +GREP = @GREP@ +HAVE_KEY_MANAGEMENT = @HAVE_KEY_MANAGEMENT@ +INSTALL = @INSTALL@ +INSTALL_DATA = @INSTALL_DATA@ +INSTALL_PROGRAM = @INSTALL_PROGRAM@ +INSTALL_SCRIPT = @INSTALL_SCRIPT@ +INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ +INTLLIBS = @INTLLIBS@ +INTL_MACOSX_LIBS = @INTL_MACOSX_LIBS@ +LDFLAGS = @LDFLAGS@ +LEX = @LEX@ +LEXLIB = @LEXLIB@ +LEX_OUTPUT_ROOT = @LEX_OUTPUT_ROOT@ +LIBAUDIT = @LIBAUDIT@ +LIBCRACK = @LIBCRACK@ +LIBCRYPT = @LIBCRYPT@ +LIBDB = @LIBDB@ +LIBDL = @LIBDL@ +LIBICONV = @LIBICONV@ +LIBINTL = @LIBINTL@ +LIBNSL = @LIBNSL@ +LIBOBJS = @LIBOBJS@ +LIBPRELUDE_CFLAGS = @LIBPRELUDE_CFLAGS@ +LIBPRELUDE_CONFIG = @LIBPRELUDE_CONFIG@ +LIBPRELUDE_CONFIG_PREFIX = @LIBPRELUDE_CONFIG_PREFIX@ +LIBPRELUDE_LDFLAGS = @LIBPRELUDE_LDFLAGS@ +LIBPRELUDE_LIBS = @LIBPRELUDE_LIBS@ +LIBPRELUDE_PREFIX = @LIBPRELUDE_PREFIX@ +LIBPRELUDE_PTHREAD_CFLAGS = @LIBPRELUDE_PTHREAD_CFLAGS@ +LIBS = @LIBS@ +LIBSELINUX = @LIBSELINUX@ +LIBTOOL = @LIBTOOL@ +LN_S = @LN_S@ +LTLIBICONV = @LTLIBICONV@ +LTLIBINTL = @LTLIBINTL@ +LTLIBOBJS = @LTLIBOBJS@ +MAKEINFO = @MAKEINFO@ +MKDIR_P = @MKDIR_P@ +MSGFMT = @MSGFMT@ +MSGFMT_015 = @MSGFMT_015@ +MSGMERGE = @MSGMERGE@ +OBJEXT = @OBJEXT@ +PACKAGE = @PACKAGE@ +PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@ +PACKAGE_NAME = @PACKAGE_NAME@ +PACKAGE_STRING = @PACKAGE_STRING@ +PACKAGE_TARNAME = @PACKAGE_TARNAME@ +PACKAGE_VERSION = @PACKAGE_VERSION@ +PAM_READ_BOTH_CONFS = @PAM_READ_BOTH_CONFS@ +PATH_SEPARATOR = @PATH_SEPARATOR@ +PIE_CFLAGS = @PIE_CFLAGS@ +PIE_LDFLAGS = @PIE_LDFLAGS@ +POSUB = @POSUB@ +RANLIB = @RANLIB@ +SCONFIGDIR = @SCONFIGDIR@ +SECUREDIR = @SECUREDIR@ +SED = @SED@ +SET_MAKE = @SET_MAKE@ +SHELL = @SHELL@ +STRIP = @STRIP@ +USE_NLS = @USE_NLS@ +VERSION = @VERSION@ +WITH_DEBUG = @WITH_DEBUG@ +WITH_PAMLOCKING = @WITH_PAMLOCKING@ +XGETTEXT = @XGETTEXT@ +XGETTEXT_015 = @XGETTEXT_015@ +XMLCATALOG = @XMLCATALOG@ +XMLLINT = @XMLLINT@ +XML_CATALOG_FILE = @XML_CATALOG_FILE@ +XSLTPROC = @XSLTPROC@ +YACC = @YACC@ +YFLAGS = @YFLAGS@ +abs_builddir = @abs_builddir@ +abs_srcdir = @abs_srcdir@ +abs_top_builddir = @abs_top_builddir@ +abs_top_srcdir = @abs_top_srcdir@ +ac_ct_CC = @ac_ct_CC@ +ac_ct_CXX = @ac_ct_CXX@ +ac_ct_F77 = @ac_ct_F77@ +am__include = @am__include@ +am__leading_dot = @am__leading_dot@ +am__quote = @am__quote@ +am__tar = @am__tar@ +am__untar = @am__untar@ +bindir = @bindir@ +build = @build@ +build_alias = @build_alias@ +build_cpu = @build_cpu@ +build_os = @build_os@ +build_vendor = @build_vendor@ +builddir = @builddir@ +datadir = @datadir@ +datarootdir = @datarootdir@ +docdir = @docdir@ +dvidir = @dvidir@ +exec_prefix = @exec_prefix@ +host = @host@ +host_alias = @host_alias@ +host_cpu = @host_cpu@ +host_os = @host_os@ +host_vendor = @host_vendor@ +htmldir = @htmldir@ +includedir = @includedir@ +infodir = @infodir@ +install_sh = @install_sh@ +libc_cv_fpie = @libc_cv_fpie@ +libdir = @libdir@ +libexecdir = @libexecdir@ +localedir = @localedir@ +localstatedir = @localstatedir@ +mandir = @mandir@ +mkdir_p = @mkdir_p@ +oldincludedir = @oldincludedir@ +pam_cv_ld_as_needed = @pam_cv_ld_as_needed@ +pam_xauth_path = @pam_xauth_path@ +pdfdir = @pdfdir@ +prefix = @prefix@ +program_transform_name = @program_transform_name@ +psdir = @psdir@ +sbindir = @sbindir@ +sharedstatedir = @sharedstatedir@ +srcdir = @srcdir@ +sysconfdir = @sysconfdir@ +target_alias = @target_alias@ +top_builddir = @top_builddir@ +top_srcdir = @top_srcdir@ +CLEANFILES = *~ +MAINTAINERCLEANFILES = $(MANS) README +EXTRA_DIST = README $(XMLS) pam_sepermit.8 sepermit.conf tst-pam_sepermit +@HAVE_LIBSELINUX_TRUE@TESTS = tst-pam_sepermit +@HAVE_LIBSELINUX_TRUE@man_MANS = pam_sepermit.8 +XMLS = README.xml pam_sepermit.8.xml +securelibdir = $(SECUREDIR) +secureconfdir = $(SCONFIGDIR) +sepermitlockdir = ${localstatedir}/run/sepermit +AM_CFLAGS = -I$(top_srcdir)/libpam/include -I$(top_srcdir)/libpamc/include \ + -I$(top_srcdir)/libpam_misc/include \ + -D SEPERMIT_CONF_FILE=\"$(SCONFIGDIR)/sepermit.conf\" \ + -D SEPERMIT_LOCKDIR=\"$(sepermitlockdir)\" + +pam_sepermit_la_LIBADD = -L$(top_builddir)/libpam -lpam @LIBSELINUX@ +pam_sepermit_la_LDFLAGS = -no-undefined -avoid-version -module \ + $(am__append_1) +@HAVE_LIBSELINUX_TRUE@secureconf_DATA = sepermit.conf +@HAVE_LIBSELINUX_TRUE@sepermitlock_DATA = +@HAVE_LIBSELINUX_TRUE@securelib_LTLIBRARIES = pam_sepermit.la +@ENABLE_REGENERATE_MAN_TRUE@noinst_DATA = README pam_sepermit.8 +all: all-am + +.SUFFIXES: +.SUFFIXES: .c .lo .o .obj +$(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps) + @for dep in $?; do \ + case '$(am__configure_deps)' in \ + *$$dep*) \ + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh \ + && exit 0; \ + exit 1;; \ + esac; \ + done; \ + echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu modules/pam_sepermit/Makefile'; \ + cd $(top_srcdir) && \ + $(AUTOMAKE) --gnu modules/pam_sepermit/Makefile +.PRECIOUS: Makefile +Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status + @case '$?' in \ + *config.status*) \ + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \ + *) \ + echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \ + cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \ + esac; + +$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES) + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh + +$(top_srcdir)/configure: $(am__configure_deps) + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh +$(ACLOCAL_M4): $(am__aclocal_m4_deps) + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh +install-securelibLTLIBRARIES: $(securelib_LTLIBRARIES) + @$(NORMAL_INSTALL) + test -z "$(securelibdir)" || $(MKDIR_P) "$(DESTDIR)$(securelibdir)" + @list='$(securelib_LTLIBRARIES)'; for p in $$list; do \ + if test -f $$p; then \ + f=$(am__strip_dir) \ + echo " $(LIBTOOL) --mode=install $(securelibLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) '$$p' '$(DESTDIR)$(securelibdir)/$$f'"; \ + $(LIBTOOL) --mode=install $(securelibLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) "$$p" "$(DESTDIR)$(securelibdir)/$$f"; \ + else :; fi; \ + done + +uninstall-securelibLTLIBRARIES: + @$(NORMAL_UNINSTALL) + @list='$(securelib_LTLIBRARIES)'; for p in $$list; do \ + p=$(am__strip_dir) \ + echo " $(LIBTOOL) --mode=uninstall rm -f '$(DESTDIR)$(securelibdir)/$$p'"; \ + $(LIBTOOL) --mode=uninstall rm -f "$(DESTDIR)$(securelibdir)/$$p"; \ + done + +clean-securelibLTLIBRARIES: + -test -z "$(securelib_LTLIBRARIES)" || rm -f $(securelib_LTLIBRARIES) + @list='$(securelib_LTLIBRARIES)'; for p in $$list; do \ + dir="`echo $$p | sed -e 's|/[^/]*$$||'`"; \ + test "$$dir" != "$$p" || dir=.; \ + echo "rm -f \"$${dir}/so_locations\""; \ + rm -f "$${dir}/so_locations"; \ + done +pam_sepermit.la: $(pam_sepermit_la_OBJECTS) $(pam_sepermit_la_DEPENDENCIES) + $(pam_sepermit_la_LINK) $(am_pam_sepermit_la_rpath) $(pam_sepermit_la_OBJECTS) $(pam_sepermit_la_LIBADD) $(LIBS) + +mostlyclean-compile: + -rm -f *.$(OBJEXT) + +distclean-compile: + -rm -f *.tab.c + +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pam_sepermit.Plo@am__quote@ + +.c.o: +@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< +@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(COMPILE) -c $< + +.c.obj: +@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'` +@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'` + +.c.lo: +@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< +@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $< + +mostlyclean-libtool: + -rm -f *.lo + +clean-libtool: + -rm -rf .libs _libs +install-man8: $(man8_MANS) $(man_MANS) + @$(NORMAL_INSTALL) + test -z "$(man8dir)" || $(MKDIR_P) "$(DESTDIR)$(man8dir)" + @list='$(man8_MANS) $(dist_man8_MANS) $(nodist_man8_MANS)'; \ + l2='$(man_MANS) $(dist_man_MANS) $(nodist_man_MANS)'; \ + for i in $$l2; do \ + case "$$i" in \ + *.8*) list="$$list $$i" ;; \ + esac; \ + done; \ + for i in $$list; do \ + if test -f $(srcdir)/$$i; then file=$(srcdir)/$$i; \ + else file=$$i; fi; \ + ext=`echo $$i | sed -e 's/^.*\\.//'`; \ + case "$$ext" in \ + 8*) ;; \ + *) ext='8' ;; \ + esac; \ + inst=`echo $$i | sed -e 's/\\.[0-9a-z]*$$//'`; \ + inst=`echo $$inst | sed -e 's/^.*\///'`; \ + inst=`echo $$inst | sed '$(transform)'`.$$ext; \ + echo " $(INSTALL_DATA) '$$file' '$(DESTDIR)$(man8dir)/$$inst'"; \ + $(INSTALL_DATA) "$$file" "$(DESTDIR)$(man8dir)/$$inst"; \ + done +uninstall-man8: + @$(NORMAL_UNINSTALL) + @list='$(man8_MANS) $(dist_man8_MANS) $(nodist_man8_MANS)'; \ + l2='$(man_MANS) $(dist_man_MANS) $(nodist_man_MANS)'; \ + for i in $$l2; do \ + case "$$i" in \ + *.8*) list="$$list $$i" ;; \ + esac; \ + done; \ + for i in $$list; do \ + ext=`echo $$i | sed -e 's/^.*\\.//'`; \ + case "$$ext" in \ + 8*) ;; \ + *) ext='8' ;; \ + esac; \ + inst=`echo $$i | sed -e 's/\\.[0-9a-z]*$$//'`; \ + inst=`echo $$inst | sed -e 's/^.*\///'`; \ + inst=`echo $$inst | sed '$(transform)'`.$$ext; \ + echo " rm -f '$(DESTDIR)$(man8dir)/$$inst'"; \ + rm -f "$(DESTDIR)$(man8dir)/$$inst"; \ + done +install-secureconfDATA: $(secureconf_DATA) + @$(NORMAL_INSTALL) + test -z "$(secureconfdir)" || $(MKDIR_P) "$(DESTDIR)$(secureconfdir)" + @list='$(secureconf_DATA)'; for p in $$list; do \ + if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \ + f=$(am__strip_dir) \ + echo " $(secureconfDATA_INSTALL) '$$d$$p' '$(DESTDIR)$(secureconfdir)/$$f'"; \ + $(secureconfDATA_INSTALL) "$$d$$p" "$(DESTDIR)$(secureconfdir)/$$f"; \ + done + +uninstall-secureconfDATA: + @$(NORMAL_UNINSTALL) + @list='$(secureconf_DATA)'; for p in $$list; do \ + f=$(am__strip_dir) \ + echo " rm -f '$(DESTDIR)$(secureconfdir)/$$f'"; \ + rm -f "$(DESTDIR)$(secureconfdir)/$$f"; \ + done +install-sepermitlockDATA: $(sepermitlock_DATA) + @$(NORMAL_INSTALL) + test -z "$(sepermitlockdir)" || $(MKDIR_P) "$(DESTDIR)$(sepermitlockdir)" + @list='$(sepermitlock_DATA)'; for p in $$list; do \ + if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \ + f=$(am__strip_dir) \ + echo " $(sepermitlockDATA_INSTALL) '$$d$$p' '$(DESTDIR)$(sepermitlockdir)/$$f'"; \ + $(sepermitlockDATA_INSTALL) "$$d$$p" "$(DESTDIR)$(sepermitlockdir)/$$f"; \ + done + +uninstall-sepermitlockDATA: + @$(NORMAL_UNINSTALL) + @list='$(sepermitlock_DATA)'; for p in $$list; do \ + f=$(am__strip_dir) \ + echo " rm -f '$(DESTDIR)$(sepermitlockdir)/$$f'"; \ + rm -f "$(DESTDIR)$(sepermitlockdir)/$$f"; \ + done + +ID: $(HEADERS) $(SOURCES) $(LISP) $(TAGS_FILES) + list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \ + unique=`for i in $$list; do \ + if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ + done | \ + $(AWK) ' { files[$$0] = 1; } \ + END { for (i in files) print i; }'`; \ + mkid -fID $$unique +tags: TAGS + +TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \ + $(TAGS_FILES) $(LISP) + tags=; \ + here=`pwd`; \ + list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \ + unique=`for i in $$list; do \ + if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ + done | \ + $(AWK) ' { files[$$0] = 1; } \ + END { for (i in files) print i; }'`; \ + if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \ + test -n "$$unique" || unique=$$empty_fix; \ + $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \ + $$tags $$unique; \ + fi +ctags: CTAGS +CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \ + $(TAGS_FILES) $(LISP) + tags=; \ + here=`pwd`; \ + list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \ + unique=`for i in $$list; do \ + if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ + done | \ + $(AWK) ' { files[$$0] = 1; } \ + END { for (i in files) print i; }'`; \ + test -z "$(CTAGS_ARGS)$$tags$$unique" \ + || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \ + $$tags $$unique + +GTAGS: + here=`$(am__cd) $(top_builddir) && pwd` \ + && cd $(top_srcdir) \ + && gtags -i $(GTAGS_ARGS) $$here + +distclean-tags: + -rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags + +check-TESTS: $(TESTS) + @failed=0; all=0; xfail=0; xpass=0; skip=0; ws='[ ]'; \ + srcdir=$(srcdir); export srcdir; \ + list=' $(TESTS) '; \ + if test -n "$$list"; then \ + for tst in $$list; do \ + if test -f ./$$tst; then dir=./; \ + elif test -f $$tst; then dir=; \ + else dir="$(srcdir)/"; fi; \ + if $(TESTS_ENVIRONMENT) $${dir}$$tst; then \ + all=`expr $$all + 1`; \ + case " $(XFAIL_TESTS) " in \ + *$$ws$$tst$$ws*) \ + xpass=`expr $$xpass + 1`; \ + failed=`expr $$failed + 1`; \ + echo "XPASS: $$tst"; \ + ;; \ + *) \ + echo "PASS: $$tst"; \ + ;; \ + esac; \ + elif test $$? -ne 77; then \ + all=`expr $$all + 1`; \ + case " $(XFAIL_TESTS) " in \ + *$$ws$$tst$$ws*) \ + xfail=`expr $$xfail + 1`; \ + echo "XFAIL: $$tst"; \ + ;; \ + *) \ + failed=`expr $$failed + 1`; \ + echo "FAIL: $$tst"; \ + ;; \ + esac; \ + else \ + skip=`expr $$skip + 1`; \ + echo "SKIP: $$tst"; \ + fi; \ + done; \ + if test "$$failed" -eq 0; then \ + if test "$$xfail" -eq 0; then \ + banner="All $$all tests passed"; \ + else \ + banner="All $$all tests behaved as expected ($$xfail expected failures)"; \ + fi; \ + else \ + if test "$$xpass" -eq 0; then \ + banner="$$failed of $$all tests failed"; \ + else \ + banner="$$failed of $$all tests did not behave as expected ($$xpass unexpected passes)"; \ + fi; \ + fi; \ + dashes="$$banner"; \ + skipped=""; \ + if test "$$skip" -ne 0; then \ + skipped="($$skip tests were not run)"; \ + test `echo "$$skipped" | wc -c` -le `echo "$$banner" | wc -c` || \ + dashes="$$skipped"; \ + fi; \ + report=""; \ + if test "$$failed" -ne 0 && test -n "$(PACKAGE_BUGREPORT)"; then \ + report="Please report to $(PACKAGE_BUGREPORT)"; \ + test `echo "$$report" | wc -c` -le `echo "$$banner" | wc -c` || \ + dashes="$$report"; \ + fi; \ + dashes=`echo "$$dashes" | sed s/./=/g`; \ + echo "$$dashes"; \ + echo "$$banner"; \ + test -z "$$skipped" || echo "$$skipped"; \ + test -z "$$report" || echo "$$report"; \ + echo "$$dashes"; \ + test "$$failed" -eq 0; \ + else :; fi + +distdir: $(DISTFILES) + @srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ + topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ + list='$(DISTFILES)'; \ + dist_files=`for file in $$list; do echo $$file; done | \ + sed -e "s|^$$srcdirstrip/||;t" \ + -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \ + case $$dist_files in \ + */*) $(MKDIR_P) `echo "$$dist_files" | \ + sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \ + sort -u` ;; \ + esac; \ + for file in $$dist_files; do \ + if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \ + if test -d $$d/$$file; then \ + dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \ + if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \ + cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \ + fi; \ + cp -pR $$d/$$file $(distdir)$$dir || exit 1; \ + else \ + test -f $(distdir)/$$file \ + || cp -p $$d/$$file $(distdir)/$$file \ + || exit 1; \ + fi; \ + done +check-am: all-am + $(MAKE) $(AM_MAKEFLAGS) check-TESTS +check: check-am +all-am: Makefile $(LTLIBRARIES) $(MANS) $(DATA) +installdirs: + for dir in "$(DESTDIR)$(securelibdir)" "$(DESTDIR)$(man8dir)" "$(DESTDIR)$(secureconfdir)" "$(DESTDIR)$(sepermitlockdir)"; do \ + test -z "$$dir" || $(MKDIR_P) "$$dir"; \ + done +install: install-am +install-exec: install-exec-am +install-data: install-data-am +uninstall: uninstall-am + +install-am: all-am + @$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am + +installcheck: installcheck-am +install-strip: + $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ + install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ + `test -z '$(STRIP)' || \ + echo "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'"` install +mostlyclean-generic: + +clean-generic: + -test -z "$(CLEANFILES)" || rm -f $(CLEANFILES) + +distclean-generic: + -test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES) + +maintainer-clean-generic: + @echo "This command is intended for maintainers to use" + @echo "it deletes files that may require special tools to rebuild." + -test -z "$(MAINTAINERCLEANFILES)" || rm -f $(MAINTAINERCLEANFILES) +clean: clean-am + +clean-am: clean-generic clean-libtool clean-securelibLTLIBRARIES \ + mostlyclean-am + +distclean: distclean-am + -rm -rf ./$(DEPDIR) + -rm -f Makefile +distclean-am: clean-am distclean-compile distclean-generic \ + distclean-tags + +dvi: dvi-am + +dvi-am: + +html: html-am + +info: info-am + +info-am: + +install-data-am: install-man install-secureconfDATA \ + install-securelibLTLIBRARIES install-sepermitlockDATA + +install-dvi: install-dvi-am + +install-exec-am: + +install-html: install-html-am + +install-info: install-info-am + +install-man: install-man8 + +install-pdf: install-pdf-am + +install-ps: install-ps-am + +installcheck-am: + +maintainer-clean: maintainer-clean-am + -rm -rf ./$(DEPDIR) + -rm -f Makefile +maintainer-clean-am: distclean-am maintainer-clean-generic + +mostlyclean: mostlyclean-am + +mostlyclean-am: mostlyclean-compile mostlyclean-generic \ + mostlyclean-libtool + +pdf: pdf-am + +pdf-am: + +ps: ps-am + +ps-am: + +uninstall-am: uninstall-man uninstall-secureconfDATA \ + uninstall-securelibLTLIBRARIES uninstall-sepermitlockDATA + +uninstall-man: uninstall-man8 + +.MAKE: install-am install-strip + +.PHONY: CTAGS GTAGS all all-am check check-TESTS check-am clean \ + clean-generic clean-libtool clean-securelibLTLIBRARIES ctags \ + distclean distclean-compile distclean-generic \ + distclean-libtool distclean-tags distdir dvi dvi-am html \ + html-am info info-am install install-am install-data \ + install-data-am install-dvi install-dvi-am install-exec \ + install-exec-am install-html install-html-am install-info \ + install-info-am install-man install-man8 install-pdf \ + install-pdf-am install-ps install-ps-am install-secureconfDATA \ + install-securelibLTLIBRARIES install-sepermitlockDATA \ + install-strip installcheck installcheck-am installdirs \ + maintainer-clean maintainer-clean-generic mostlyclean \ + mostlyclean-compile mostlyclean-generic mostlyclean-libtool \ + pdf pdf-am ps ps-am tags uninstall uninstall-am uninstall-man \ + uninstall-man8 uninstall-secureconfDATA \ + uninstall-securelibLTLIBRARIES uninstall-sepermitlockDATA + +@ENABLE_REGENERATE_MAN_TRUE@README: pam_sepermit.8.xml +@ENABLE_REGENERATE_MAN_TRUE@-include $(top_srcdir)/Make.xml.rules +# Tell versions [3.59,3.63) of GNU make to not export all variables. +# Otherwise a system limit (for SysV at least) may be exceeded. +.NOEXPORT: diff --git a/Linux-PAM/modules/pam_sepermit/README b/Linux-PAM/modules/pam_sepermit/README new file mode 100644 index 00000000..11429832 --- /dev/null +++ b/Linux-PAM/modules/pam_sepermit/README @@ -0,0 +1,51 @@ +pam_sepermit — PAM module to allow/deny login depending on SELinux enforcement +state + +â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â” + +DESCRIPTION + +The pam_sepermit module allows or denies login depending on SELinux enforcement +state. + +When the user which is logging in matches an entry in the config file he is +allowed access only when the SELinux is in enforcing mode. Otherwise he is +denied access. For users not matching any entry in the config file the +pam_sepermit module returns PAM_IGNORE return value. + +The config file contains a simple list of user names one per line. If the name +is prefixed with @ character it means that all users in the group name match. +If it is prefixed with a % character the SELinux user is used to match against +the name instead of the account name. Note that when SELinux is disabled the +SELinux user assigned to the account cannot be determined. This means that such +entries are never matched when SELinux is disabled and pam_sepermit will return +PAM_IGNORE. + +Each user name in the configuration file can have optional arguments separated +by : character. The only currently recognized argument is exclusive. The +pam_sepermit module will allow only single concurrent user session for the user +with this argument specified and it will attempt to kill all processes of the +user after logout. + +OPTIONS + +debug + + Turns on debugging via syslog(3). + +conf=/path/to/config/file + + Path to alternative config file overriding the default. + +EXAMPLES + +auth [success=done ignore=ignore default=bad] pam_sepermit.so +auth required pam_unix.so +account required pam_unix.so +session required pam_permit.so + + +AUTHOR + +pam_sepermit was written by Tomas Mraz <tmraz@redhat.com>. + diff --git a/Linux-PAM/modules/pam_sepermit/README.xml b/Linux-PAM/modules/pam_sepermit/README.xml new file mode 100644 index 00000000..bb65951c --- /dev/null +++ b/Linux-PAM/modules/pam_sepermit/README.xml @@ -0,0 +1,41 @@ +<?xml version="1.0" encoding='UTF-8'?> +<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN" +"http://www.docbook.org/xml/4.3/docbookx.dtd" +[ +<!-- +<!ENTITY pamaccess SYSTEM "pam_sepermit.8.xml"> +--> +]> + +<article> + + <articleinfo> + + <title> + <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" + href="pam_sepermit.8.xml" xpointer='xpointer(//refnamediv[@id = "pam_sepermit-name"]/*)'/> + </title> + + </articleinfo> + + <section> + <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" + href="pam_sepermit.8.xml" xpointer='xpointer(//refsect1[@id = "pam_sepermit-description"]/*)'/> + </section> + + <section> + <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" + href="pam_sepermit.8.xml" xpointer='xpointer(//refsect1[@id = "pam_sepermit-options"]/*)'/> + </section> + + <section> + <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" + href="pam_sepermit.8.xml" xpointer='xpointer(//refsect1[@id = "pam_sepermit-examples"]/*)'/> + </section> + + <section> + <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" + href="pam_sepermit.8.xml" xpointer='xpointer(//refsect1[@id = "pam_sepermit-author"]/*)'/> + </section> + +</article> diff --git a/Linux-PAM/modules/pam_sepermit/pam_sepermit.8 b/Linux-PAM/modules/pam_sepermit/pam_sepermit.8 new file mode 100644 index 00000000..217d3df5 --- /dev/null +++ b/Linux-PAM/modules/pam_sepermit/pam_sepermit.8 @@ -0,0 +1,110 @@ +.\" Title: pam_sepermit +.\" Author: +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 02/04/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual +.\" +.TH "PAM_SEPERMIT" "8" "02/04/2008" "Linux-PAM Manual" "Linux\-PAM Manual" +.\" disable hyphenation +.nh +.\" disable justification (adjust text to left margin only) +.ad l +.SH "NAME" +pam_sepermit - PAM module to allow/deny login depending on SELinux enforcement state +.SH "SYNOPSIS" +.HP 16 +\fBpam_sepermit\.so\fR [debug] [conf=\fI/path/to/config/file\fR] +.SH "DESCRIPTION" +.PP +The pam_sepermit module allows or denies login depending on SELinux enforcement state\. +.PP +When the user which is logging in matches an entry in the config file he is allowed access only when the SELinux is in enforcing mode\. Otherwise he is denied access\. For users not matching any entry in the config file the pam_sepermit module returns PAM_IGNORE return value\. +.PP +The config file contains a simple list of user names one per line\. If the +\fIname\fR +is prefixed with +\fI@\fR +character it means that all users in the group +\fIname\fR +match\. If it is prefixed with a +\fI%\fR +character the SELinux user is used to match against the +\fIname\fR +instead of the account name\. Note that when SELinux is disabled the SELinux user assigned to the account cannot be determined\. This means that such entries are never matched when SELinux is disabled and pam_sepermit will return PAM_IGNORE\. +.PP +Each user name in the configuration file can have optional arguments separated by +\fI:\fR +character\. The only currently recognized argument is +\fIexclusive\fR\. The pam_sepermit module will allow only single concurrent user session for the user with this argument specified and it will attempt to kill all processes of the user after logout\. +.SH "OPTIONS" +.PP +\fBdebug\fR +.RS 4 +Turns on debugging via +\fBsyslog\fR(3)\. +.RE +.PP +\fBconf=\fR\fB\fI/path/to/config/file\fR\fR +.RS 4 +Path to alternative config file overriding the default\. +.RE +.SH "MODULE SERVICES PROVIDED" +.PP +Only the +\fBauth\fR +and +\fBaccount\fR +services are supported\. +.SH "RETURN VALUES" +.PP +PAM_AUTH_ERR +.RS 4 +SELinux is disabled or in the permissive mode and the user matches\. +.RE +.PP +PAM_SUCCESS +.RS 4 +SELinux is in the enforcing mode and the user matches\. +.RE +.PP +PAM_IGNORE +.RS 4 +The user does not match any entry in the config file\. +.RE +.PP +PAM_USER_UNKNOWN +.RS 4 +The module was unable to determine the user\'s name\. +.RE +.PP +PAM_SERVICE_ERR +.RS 4 +Error during reading or parsing the config file\. +.RE +.SH "FILES" +.PP +\fI/etc/security/sepermit\.conf\fR +.RS 4 +Default configuration file +.RE +.SH "EXAMPLES" +.sp +.RS 4 +.nf +auth [success=done ignore=ignore default=bad] pam_sepermit\.so +auth required pam_unix\.so +account required pam_unix\.so +session required pam_permit\.so + +.fi +.RE +.SH "SEE ALSO" +.PP + +\fBpam.conf\fR(5), +\fBpam.d\fR(8), +\fBpam\fR(8) +.SH "AUTHOR" +.PP +pam_sepermit was written by Tomas Mraz <tmraz@redhat\.com>\. diff --git a/Linux-PAM/modules/pam_sepermit/pam_sepermit.8.xml b/Linux-PAM/modules/pam_sepermit/pam_sepermit.8.xml new file mode 100644 index 00000000..c2546b62 --- /dev/null +++ b/Linux-PAM/modules/pam_sepermit/pam_sepermit.8.xml @@ -0,0 +1,189 @@ +<?xml version="1.0" encoding='UTF-8'?> +<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN" + "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd"> + +<refentry id="pam_sepermit"> + + <refmeta> + <refentrytitle>pam_sepermit</refentrytitle> + <manvolnum>8</manvolnum> + <refmiscinfo class="sectdesc">Linux-PAM Manual</refmiscinfo> + </refmeta> + + <refnamediv id="pam_sepermit-name"> + <refname>pam_sepermit</refname> + <refpurpose>PAM module to allow/deny login depending on SELinux enforcement state</refpurpose> + </refnamediv> + + <refsynopsisdiv> + <cmdsynopsis id="pam_sepermit-cmdsynopsis"> + <command>pam_sepermit.so</command> + <arg choice="opt"> + debug + </arg> + <arg choice="opt"> + conf=<replaceable>/path/to/config/file</replaceable> + </arg> + </cmdsynopsis> + </refsynopsisdiv> + + <refsect1 id="pam_sepermit-description"> + <title>DESCRIPTION</title> + <para> + The pam_sepermit module allows or denies login depending on SELinux + enforcement state. + </para> + <para> + When the user which is logging in matches an entry in the config file + he is allowed access only when the SELinux is in enforcing mode. Otherwise + he is denied access. For users not matching any entry in the config file + the pam_sepermit module returns PAM_IGNORE return value. + </para> + <para> + The config file contains a simple list of user names one per line. If the + <replaceable>name</replaceable> is prefixed with <emphasis>@</emphasis> character it means that all + users in the group <replaceable>name</replaceable> match. If it is prefixed + with a <emphasis>%</emphasis> character the SELinux user is used to match against the <replaceable>name</replaceable> + instead of the account name. Note that when SELinux is disabled the + SELinux user assigned to the account cannot be determined. This means that + such entries are never matched when SELinux is disabled and pam_sepermit + will return PAM_IGNORE. + </para> + <para> + Each user name in the configuration file can have optional arguments separated + by <emphasis>:</emphasis> character. The only currently recognized argument is <emphasis>exclusive</emphasis>. + The pam_sepermit module will allow only single concurrent user session for + the user with this argument specified and it will attempt to kill all processes + of the user after logout. + </para> + </refsect1> + + <refsect1 id="pam_sepermit-options"> + <title>OPTIONS</title> + <variablelist> + <varlistentry> + <term> + <option>debug</option> + </term> + <listitem> + <para> + Turns on debugging via + <citerefentry> + <refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum> + </citerefentry>. + </para> + </listitem> + </varlistentry> + <varlistentry> + <term> + <option>conf=<replaceable>/path/to/config/file</replaceable></option> + </term> + <listitem> + <para> + Path to alternative config file overriding the default. + </para> + </listitem> + </varlistentry> + </variablelist> + </refsect1> + + <refsect1 id="pam_sepermit-services"> + <title>MODULE SERVICES PROVIDED</title> + <para> + Only the <option>auth</option> and <option>account</option> + services are supported. + </para> + </refsect1> + + <refsect1 id='pam_sepermit-return_values'> + <title>RETURN VALUES</title> + <variablelist> + <varlistentry> + <term>PAM_AUTH_ERR</term> + <listitem> + <para> + SELinux is disabled or in the permissive mode and the user + matches. + </para> + </listitem> + </varlistentry> + <varlistentry> + <term>PAM_SUCCESS</term> + <listitem> + <para> + SELinux is in the enforcing mode and the user matches. + </para> + </listitem> + </varlistentry> + <varlistentry> + <term>PAM_IGNORE</term> + <listitem> + <para> + The user does not match any entry in the config file. + </para> + </listitem> + </varlistentry> + <varlistentry> + <term>PAM_USER_UNKNOWN</term> + <listitem> + <para> + The module was unable to determine the user's name. + </para> + </listitem> + </varlistentry> + <varlistentry> + <term>PAM_SERVICE_ERR</term> + <listitem> + <para> + Error during reading or parsing the config file. + </para> + </listitem> + </varlistentry> + </variablelist> + </refsect1> + + <refsect1 id="pam_sepermit-files"> + <title>FILES</title> + <variablelist> + <varlistentry> + <term><filename>/etc/security/sepermit.conf</filename></term> + <listitem> + <para>Default configuration file</para> + </listitem> + </varlistentry> + </variablelist> + </refsect1> + + <refsect1 id='pam_sepermit-examples'> + <title>EXAMPLES</title> + <programlisting> +auth [success=done ignore=ignore default=bad] pam_sepermit.so +auth required pam_unix.so +account required pam_unix.so +session required pam_permit.so + </programlisting> + </refsect1> + + <refsect1 id='pam_sepermit-see_also'> + <title>SEE ALSO</title> + <para> + <citerefentry> + <refentrytitle>pam.conf</refentrytitle><manvolnum>5</manvolnum> + </citerefentry>, + <citerefentry> + <refentrytitle>pam.d</refentrytitle><manvolnum>8</manvolnum> + </citerefentry>, + <citerefentry> + <refentrytitle>pam</refentrytitle><manvolnum>8</manvolnum> + </citerefentry> + </para> + </refsect1> + + <refsect1 id='pam_sepermit-author'> + <title>AUTHOR</title> + <para> + pam_sepermit was written by Tomas Mraz <tmraz@redhat.com>. + </para> + </refsect1> + +</refentry> diff --git a/Linux-PAM/modules/pam_sepermit/pam_sepermit.c b/Linux-PAM/modules/pam_sepermit/pam_sepermit.c new file mode 100644 index 00000000..47f95030 --- /dev/null +++ b/Linux-PAM/modules/pam_sepermit/pam_sepermit.c @@ -0,0 +1,405 @@ +/****************************************************************************** + * A module for Linux-PAM that allows/denies acces based on SELinux state. + * + * Copyright (c) 2007, 2008 Red Hat, Inc. + * Originally written by Tomas Mraz <tmraz@redhat.com> + * Contributions by Dan Walsh <dwalsh@redhat.com> + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, and the entire permission notice in its entirety, + * including the disclaimer of warranties. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. The name of the author may not be used to endorse or promote + * products derived from this software without specific prior + * written permission. + * + * ALTERNATIVELY, this product may be distributed under the terms of + * the GNU Public License, in which case the provisions of the GPL are + * required INSTEAD OF the above restrictions. (This clause is + * necessary due to a potential bad interaction between the GPL and + * the restrictions contained in a BSD-style copyright.) + * + * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED + * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, + * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES + * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR + * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * + */ + +#include "config.h" + +#include <errno.h> +#include <pwd.h> +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <syslog.h> +#include <ctype.h> +#include <signal.h> +#include <limits.h> +#include <sys/types.h> +#include <sys/stat.h> +#include <fcntl.h> +#include <unistd.h> +#include <pwd.h> +#include <dirent.h> + +#define PAM_SM_AUTH +#define PAM_SM_ACCOUNT + +#include <security/pam_modules.h> +#include <security/_pam_macros.h> +#include <security/pam_modutil.h> +#include <security/pam_ext.h> + +#include <selinux/selinux.h> + +#define MODULE "pam_sepermit" +#define OPT_DELIM ":" + +struct lockfd { + uid_t uid; + int fd; + int debug; +}; + +#define PROC_BASE "/proc" +#define MAX_NAMES (int)(sizeof(unsigned long)*8) + +static int +match_process_uid(pid_t pid, uid_t uid) +{ + char buf[128]; + uid_t puid; + FILE *f; + int re = 0; + + snprintf (buf, sizeof buf, PROC_BASE "/%d/status", pid); + if (!(f = fopen (buf, "r"))) + return 0; + + while (fgets(buf, sizeof buf, f)) { + if (sscanf (buf, "Uid:\t%d", &puid)) { + re = uid == puid; + break; + } + } + fclose(f); + return re; +} + +static int +check_running (pam_handle_t *pamh, uid_t uid, int killall, int debug) +{ + DIR *dir; + struct dirent *de; + pid_t *pid_table, pid, self; + int i; + int pids, max_pids; + int running = 0; + self = getpid(); + if (!(dir = opendir(PROC_BASE))) { + pam_syslog(pamh, LOG_ERR, "Failed to open proc directory file %s:", PROC_BASE); + return -1; + } + max_pids = 256; + pid_table = malloc(max_pids * sizeof (pid_t)); + if (!pid_table) { + pam_syslog(pamh, LOG_CRIT, "Memory allocation error"); + return -1; + } + pids = 0; + while ((de = readdir (dir)) != NULL) { + if (!(pid = (pid_t)atoi(de->d_name)) || pid == self) + continue; + + if (pids == max_pids) { + if (!(pid_table = realloc(pid_table, 2*pids*sizeof(pid_t)))) { + pam_syslog(pamh, LOG_CRIT, "Memory allocation error"); + return -1; + } + max_pids *= 2; + } + pid_table[pids++] = pid; + } + + (void)closedir(dir); + + for (i = 0; i < pids; i++) { + pid_t id; + + if (match_process_uid(pid_table[i], uid) == 0) + continue; + id = pid_table[i]; + + if (killall) { + if (debug) + pam_syslog(pamh, LOG_NOTICE, "Attempting to kill %d", id); + kill(id, SIGKILL); + } + running++; + } + + free(pid_table); + return running; +} + +static void +sepermit_unlock(pam_handle_t *pamh, void *plockfd, int error_status UNUSED) +{ + struct lockfd *lockfd = plockfd; + struct flock fl; + + memset(&fl, 0, sizeof(fl)); + fl.l_type = F_UNLCK; + fl.l_whence = SEEK_SET; + + if (lockfd->debug) + pam_syslog(pamh, LOG_ERR, "Unlocking fd: %d uid: %d", lockfd->fd, lockfd->uid); + + /* Don't kill uid==0 */ + if (lockfd->uid) + /* This is a DOS but it prevents an app from forking to prevent killing */ + while(check_running(pamh, lockfd->uid, 1, lockfd->debug) > 0) + continue; + + fcntl(lockfd->fd, F_SETLK, &fl); + close(lockfd->fd); + free(lockfd); +} + +static int +sepermit_lock(pam_handle_t *pamh, const char *user, int debug) +{ + char buf[PATH_MAX]; + struct flock fl; + + memset(&fl, 0, sizeof(fl)); + fl.l_type = F_WRLCK; + fl.l_whence = SEEK_SET; + + struct passwd *pw = pam_modutil_getpwnam( pamh, user ); + if (!pw) { + pam_syslog(pamh, LOG_ERR, "Unable to find uid for user %s", user); + return -1; + } + if (check_running(pamh, pw->pw_uid, 0, debug) > 0) { + pam_syslog(pamh, LOG_ERR, "User %s processes are running. Exclusive login not allowed", user); + return -1; + } + + snprintf(buf, sizeof(buf), "%s/%d.lock", SEPERMIT_LOCKDIR, pw->pw_uid); + int fd = open(buf, O_RDWR | O_CREAT, S_IRUSR | S_IWUSR); + if (fd < 0) { + pam_syslog(pamh, LOG_ERR, "Unable to open lock file %s/%d.lock", SEPERMIT_LOCKDIR, pw->pw_uid); + return -1; + } + + if (fcntl(fd, F_SETLK, &fl) == -1) { + pam_syslog(pamh, LOG_ERR, "User %s with exclusive login already logged in", user); + close(fd); + return -1; + } + struct lockfd *lockfd=calloc(1, sizeof(struct lockfd)); + if (!lockfd) { + close(fd); + pam_syslog(pamh, LOG_CRIT, "Memory allocation error"); + return -1; + } + lockfd->uid = pw->pw_uid; + lockfd->debug = debug; + lockfd->fd=fd; + pam_set_data(pamh, MODULE, lockfd, sepermit_unlock); + return 0; +} + +/* return 0 when matched, -1 when unmatched, pam error otherwise */ +static int +sepermit_match(pam_handle_t *pamh, const char *cfgfile, const char *user, + const char *seuser, int debug) +{ + FILE *f; + char *line = NULL; + char *start; + size_t len = 0; + int matched = 0; + int exclusive = 0; + + f = fopen(cfgfile, "r"); + + if (!f) { + pam_syslog(pamh, LOG_ERR, "Failed to open config file %s: %m", cfgfile); + return PAM_SERVICE_ERR; + } + + while (!matched && getline(&line, &len, f) != -1) { + size_t n; + char *sptr; + char *opt; + + if (line[0] == '#') + continue; + + start = line; + while (isspace(*start)) + ++start; + n = strlen(start); + while (n > 0 && isspace(start[n-1])) { + --n; + } + if (n == 0) + continue; + + start[n] = '\0'; + start = strtok_r(start, OPT_DELIM, &sptr); + + switch (start[0]) { + case '@': + ++start; + if (debug) + pam_syslog(pamh, LOG_NOTICE, "Matching user %s against group %s", user, start); + if (pam_modutil_user_in_group_nam_nam(pamh, user, start)) { + matched = 1; + } + break; + case '%': + ++start; + if (debug) + pam_syslog(pamh, LOG_NOTICE, "Matching seuser %s against seuser %s", seuser, start); + if (strcmp(seuser, start) == 0) { + matched = 1; + } + break; + default: + if (debug) + pam_syslog(pamh, LOG_NOTICE, "Matching user %s against user %s", user, start); + if (strcmp(user, start) == 0) { + matched = 1; + } + } + if (matched) + while ((opt=strtok_r(NULL, OPT_DELIM, &sptr)) != NULL) { + if (strcmp(opt, "exclusive") == 0) + exclusive = 1; + else if (debug) { + pam_syslog(pamh, LOG_NOTICE, "Unknown user option: %s", opt); + } + } + } + + free(line); + fclose(f); + if (matched) + return exclusive ? sepermit_lock(pamh, user, debug) : 0; + else + return -1; +} + +PAM_EXTERN int +pam_sm_authenticate(pam_handle_t *pamh, int flags UNUSED, + int argc, const char **argv) +{ + int i; + int rv; + int debug = 0; + int sense = PAM_AUTH_ERR; + const char *user = NULL; + char *seuser = NULL; + char *level = NULL; + const char *cfgfile = SEPERMIT_CONF_FILE; + + /* Parse arguments. */ + for (i = 0; i < argc; i++) { + if (strcmp(argv[i], "debug") == 0) { + debug = 1; + } + if (strcmp(argv[i], "conf=") == 0) { + cfgfile = argv[i] + 5; + } + } + + if (debug) + pam_syslog(pamh, LOG_NOTICE, "Parsing config file: %s", cfgfile); + + if (pam_get_user(pamh, &user, NULL) != PAM_SUCCESS || user == NULL + || *user == '\0') { + pam_syslog(pamh, LOG_ERR, "Cannot determine the user's name"); + return PAM_USER_UNKNOWN; + } + + if (is_selinux_enabled() > 0) { + if (security_getenforce() == 1) { + if (debug) + pam_syslog(pamh, LOG_NOTICE, "Enforcing mode, access will be allowed on match"); + sense = PAM_SUCCESS; + } + + if (getseuserbyname(user, &seuser, &level) != 0) { + seuser = NULL; + level = NULL; + pam_syslog(pamh, LOG_ERR, "getseuserbyname failed: %m"); + } + } + + if (debug && sense != PAM_SUCCESS) + pam_syslog(pamh, LOG_NOTICE, "Access will not be allowed on match"); + + rv = sepermit_match(pamh, cfgfile, user, seuser, debug); + + if (debug) + pam_syslog(pamh, LOG_NOTICE, "sepermit_match returned: %d", rv); + + free(seuser); + free(level); + + switch (rv) { + case -1: + return PAM_IGNORE; + case 0: + return sense; + } + + return rv; +} + +PAM_EXTERN int +pam_sm_setcred (pam_handle_t *pamh UNUSED, int flags UNUSED, + int argc UNUSED, const char **argv UNUSED) +{ + return PAM_IGNORE; +} + +PAM_EXTERN int +pam_sm_acct_mgmt(pam_handle_t *pamh, int flags, + int argc, const char **argv) +{ + return pam_sm_authenticate(pamh, flags, argc, argv); +} + +#ifdef PAM_STATIC + +/* static module data */ + +struct pam_module _pam_sepermit_modstruct = { + "pam_sepermit", + pam_sm_authenticate, + pam_sm_setcred, + pam_sm_acct_mgmt, + NULL, + NULL, + NULL +}; +#endif + diff --git a/Linux-PAM/modules/pam_sepermit/sepermit.conf b/Linux-PAM/modules/pam_sepermit/sepermit.conf new file mode 100644 index 00000000..951f3dfe --- /dev/null +++ b/Linux-PAM/modules/pam_sepermit/sepermit.conf @@ -0,0 +1,11 @@ +# /etc/security/sepermit.conf +# +# Each line contains either: +# - an user name +# - a group name, with @group syntax +# - a SELinux user name, with %seuser syntax +# Each line can contain optional arguments separated by : +# The possible arguments are: +# - exclusive - only single login session will +# be allowed for the user and the user's processes +# will be killed on logout diff --git a/Linux-PAM/modules/pam_sepermit/tst-pam_sepermit b/Linux-PAM/modules/pam_sepermit/tst-pam_sepermit new file mode 100755 index 00000000..6e6d2363 --- /dev/null +++ b/Linux-PAM/modules/pam_sepermit/tst-pam_sepermit @@ -0,0 +1,2 @@ +#!/bin/sh +../../tests/tst-dlopen .libs/pam_sepermit.so diff --git a/Linux-PAM/modules/pam_shells/README b/Linux-PAM/modules/pam_shells/README index 38e6484c..f4658be3 100644 --- a/Linux-PAM/modules/pam_shells/README +++ b/Linux-PAM/modules/pam_shells/README @@ -11,7 +11,7 @@ It also checks if /etc/shells is a plain file and not world writable. OPTIONS -This module does not recognice any options. +This module does not recognise any options. EXAMPLES diff --git a/Linux-PAM/modules/pam_shells/pam_shells.8 b/Linux-PAM/modules/pam_shells/pam_shells.8 index f41a1ed4..0287d3ee 100644 --- a/Linux-PAM/modules/pam_shells/pam_shells.8 +++ b/Linux-PAM/modules/pam_shells/pam_shells.8 @@ -1,59 +1,73 @@ -.\" ** You probably do not want to edit this file directly ** -.\" It was generated using the DocBook XSL Stylesheets (version 1.69.1). -.\" Instead of manually editing it, you probably should edit the DocBook XML -.\" source for it and then use the DocBook XSL Stylesheets to regenerate it. -.TH "PAM_SHELLS" "8" "06/06/2006" "Linux\-PAM Manual" "Linux\-PAM Manual" +.\" Title: pam_shells +.\" Author: +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual +.\" +.TH "PAM_SHELLS" "8" "01/08/2008" "Linux-PAM Manual" "Linux\-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_shells \- PAM module to check for valid login shell +pam_shells - PAM module to check for valid login shell .SH "SYNOPSIS" .HP 14 -\fBpam_shells.so\fR +\fBpam_shells\.so\fR .SH "DESCRIPTION" .PP pam_shells is a PAM module that only allows access to the system if the users shell is listed in -\fI/etc/shells\fR. +\fI/etc/shells\fR\. .PP It also checks if \fI/etc/shells\fR -is a plain file and not world writable. +is a plain file and not world writable\. .SH "OPTIONS" .PP -This module does not recognice any options. +This module does not recognise any options\. .SH "MODULE SERVICES PROVIDED" .PP The services \fBauth\fR and \fBaccount\fR -are supported. +are supported\. .SH "RETURN VALUES" -.TP +.PP PAM_AUTH_ERR -Access to the system was denied. -.TP +.RS 4 +Access to the system was denied\. +.RE +.PP PAM_SUCCESS +.RS 4 The users login shell was listed as valid shell in -\fI/etc/shells\fR. -.TP +\fI/etc/shells\fR\. +.RE +.PP PAM_SERVICE_ERR -The module was not able to get the name of the user. +.RS 4 +The module was not able to get the name of the user\. +.RE .SH "EXAMPLES" .PP + +.sp +.RS 4 .nf -auth required pam_shells.so +auth required pam_shells\.so .fi +.RE .sp .SH "SEE ALSO" .PP + \fBshells\fR(5), \fBpam.conf\fR(5), \fBpam.d\fR(8), \fBpam\fR(8) .SH "AUTHOR" .PP -pam_shells was written by Erik Troan <ewt@redhat.com>. +pam_shells was written by Erik Troan <ewt@redhat\.com>\. diff --git a/Linux-PAM/modules/pam_shells/pam_shells.8.xml b/Linux-PAM/modules/pam_shells/pam_shells.8.xml index 604e3572..abbd5cbd 100644 --- a/Linux-PAM/modules/pam_shells/pam_shells.8.xml +++ b/Linux-PAM/modules/pam_shells/pam_shells.8.xml @@ -38,7 +38,7 @@ <refsect1 id="pam_shells-options"> <title>OPTIONS</title> - <para> This module does not recognice any options.</para> + <para> This module does not recognise any options.</para> </refsect1> <refsect1 id="pam_shells-services"> diff --git a/Linux-PAM/modules/pam_stress/README b/Linux-PAM/modules/pam_stress/README index b4273f50..e64bf2d3 100644 --- a/Linux-PAM/modules/pam_stress/README +++ b/Linux-PAM/modules/pam_stress/README @@ -1,6 +1,4 @@ # -# $Id: README,v 1.1.1.1 2000/06/20 22:11:57 agmorgan Exp $ -# # This describes the behavior of this module with respect to the # /etc/pam.conf file. # diff --git a/Linux-PAM/modules/pam_succeed_if/README b/Linux-PAM/modules/pam_succeed_if/README index 4516a9d1..6e4907c6 100644 --- a/Linux-PAM/modules/pam_succeed_if/README +++ b/Linux-PAM/modules/pam_succeed_if/README @@ -50,7 +50,7 @@ field <= number field eq number - Field has a value numerically less equal to number. + Field has a value numerically equal to number. field >= number diff --git a/Linux-PAM/modules/pam_succeed_if/pam_succeed_if.8 b/Linux-PAM/modules/pam_succeed_if/pam_succeed_if.8 index 30af456c..d3390b48 100644 --- a/Linux-PAM/modules/pam_succeed_if/pam_succeed_if.8 +++ b/Linux-PAM/modules/pam_succeed_if/pam_succeed_if.8 @@ -1,47 +1,57 @@ .\" Title: pam_succeed_if .\" Author: -.\" Generator: DocBook XSL Stylesheets vsnapshot_2006\-08\-24_0226 <http://docbook.sf.net/> -.\" Date: 08/31/2006 -.\" Manual: Linux\-PAM -.\" Source: Linux\-PAM +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM +.\" Source: Linux-PAM .\" -.TH "PAM_SUCCEED_IF" "8" "08/31/2006" "Linux\-PAM" "Linux\-PAM" +.TH "PAM_SUCCEED_IF" "8" "01/08/2008" "Linux-PAM" "Linux\-PAM" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_succeed_if \- test account characteristics +pam_succeed_if - test account characteristics .SH "SYNOPSIS" .HP 18 -\fBpam_succeed_if.so\fR [\fIflag\fR...] [\fIcondition\fR...] +\fBpam_succeed_if\.so\fR [\fIflag\fR...] [\fIcondition\fR...] .SH "DESCRIPTION" .PP -pam_succeed_if.so is designed to succeed or fail authentication based on characteristics of the account belonging to the user being authenticated. One use is to select whether to load other modules based on this test. +pam_succeed_if\.so is designed to succeed or fail authentication based on characteristics of the account belonging to the user being authenticated\. One use is to select whether to load other modules based on this test\. .PP -The module should be given one or more conditions as module arguments, and authentication will succeed only if all of the conditions are met. +The module should be given one or more conditions as module arguments, and authentication will succeed only if all of the conditions are met\. .SH "OPTIONS" .PP The following \fIflag\fRs are supported: -.TP 3n +.PP \fBdebug\fR -Turns on debugging messages sent to syslog. -.TP 3n +.RS 4 +Turns on debugging messages sent to syslog\. +.RE +.PP \fBuse_uid\fR -Evaluate conditions using the account of the user whose UID the application is running under instead of the user being authenticated. -.TP 3n +.RS 4 +Evaluate conditions using the account of the user whose UID the application is running under instead of the user being authenticated\. +.RE +.PP \fBquiet\fR -Don't log failure or success to the system log. -.TP 3n +.RS 4 +Don\'t log failure or success to the system log\. +.RE +.PP \fBquiet_fail\fR -Don't log failure to the system log. -.TP 3n +.RS 4 +Don\'t log failure to the system log\. +.RE +.PP \fBquiet_success\fR -Don't log success to the system log. +.RS 4 +Don\'t log success to the system log\. +.RE .PP -\fICondition\fRs are three words: a field, a test, and a value to test for. +\fICondition\fRs are three words: a field, a test, and a value to test for\. .PP Available fields are \fIuser\fR, @@ -51,85 +61,123 @@ Available fields are \fIhome\fR and \fIservice\fR: -.TP 3n +.PP \fBfield < number\fR -Field has a value numerically less than number. -.TP 3n +.RS 4 +Field has a value numerically less than number\. +.RE +.PP \fBfield <= number\fR -Field has a value numerically less than or equal to number. -.TP 3n +.RS 4 +Field has a value numerically less than or equal to number\. +.RE +.PP \fBfield eq number\fR -Field has a value numerically less equal to number. -.TP 3n +.RS 4 +Field has a value numerically equal to number\. +.RE +.PP \fBfield >= number\fR -Field has a value numerically greater than or equal to number. -.TP 3n +.RS 4 +Field has a value numerically greater than or equal to number\. +.RE +.PP \fBfield > number\fR -Field has a value numerically greater than number. -.TP 3n +.RS 4 +Field has a value numerically greater than number\. +.RE +.PP \fBfield ne number\fR -Field has a value numerically different from number. -.TP 3n +.RS 4 +Field has a value numerically different from number\. +.RE +.PP \fBfield = string\fR -Field exactly matches the given string. -.TP 3n +.RS 4 +Field exactly matches the given string\. +.RE +.PP \fBfield != string\fR -Field does not match the given string. -.TP 3n +.RS 4 +Field does not match the given string\. +.RE +.PP \fBfield =~ glob\fR -Field matches the given glob. -.TP 3n +.RS 4 +Field matches the given glob\. +.RE +.PP \fBfield !~ glob\fR -Field does not match the given glob. -.TP 3n -\fBfield in item:item:...\fR -Field is contained in the list of items separated by colons. -.TP 3n -\fBfield notin item:item:...\fR -Field is not contained in the list of items separated by colons. -.TP 3n +.RS 4 +Field does not match the given glob\. +.RE +.PP +\fBfield in item:item:\.\.\.\fR +.RS 4 +Field is contained in the list of items separated by colons\. +.RE +.PP +\fBfield notin item:item:\.\.\.\fR +.RS 4 +Field is not contained in the list of items separated by colons\. +.RE +.PP \fBuser ingroup group\fR -User is in given group. -.TP 3n +.RS 4 +User is in given group\. +.RE +.PP \fBuser notingroup group\fR -User is not in given group. -.TP 3n +.RS 4 +User is not in given group\. +.RE +.PP \fBuser innetgr netgroup\fR -(user,host) is in given netgroup. -.TP 3n +.RS 4 +(user,host) is in given netgroup\. +.RE +.PP \fBuser notinnetgr group\fR -(user,host) is not in given netgroup. +.RS 4 +(user,host) is not in given netgroup\. +.RE .SH "MODULE SERVICES PROVIDED" .PP -All services are supported. +All services are supported\. .SH "RETURN VALUES" -.TP 3n +.PP PAM_SUCCESS -The condition was true. -.TP 3n +.RS 4 +The condition was true\. +.RE +.PP PAM_AUTH_ERR -The condition was false. -.TP 3n +.RS 4 +The condition was false\. +.RE +.PP PAM_SERVICE_ERR -A service error occured or the arguments can't be parsed as numbers. +.RS 4 +A service error occured or the arguments can\'t be parsed as numbers\. +.RE .SH "EXAMPLES" .PP To emulate the behaviour of \fIpam_wheel\fR, except there is no fallback to group 0: .sp -.RS 3n +.RS 4 .nf -auth required pam_succeed_if.so quiet user ingroup wheel +auth required pam_succeed_if\.so quiet user ingroup wheel .fi .RE .PP -Given that the type matches, only loads the othermodule rule if the UID is over 500. Adjust the number after default to skip several rules. +Given that the type matches, only loads the othermodule rule if the UID is over 500\. Adjust the number after default to skip several rules\. .sp -.RS 3n +.RS 4 .nf -type [default=1 success=ignore] pam_succeed_if.so quiet uid > 500 -type required othermodule.so arguments... +type [default=1 success=ignore] pam_succeed_if\.so quiet uid > 500 +type required othermodule\.so arguments\.\.\. .fi .RE @@ -140,4 +188,4 @@ type required othermodule.so arguments... \fBpam\fR(8) .SH "AUTHOR" .PP -Nalin Dahyabhai <nalin@redhat.com> +Nalin Dahyabhai <nalin@redhat\.com> diff --git a/Linux-PAM/modules/pam_succeed_if/pam_succeed_if.8.xml b/Linux-PAM/modules/pam_succeed_if/pam_succeed_if.8.xml index b7ad29e6..d064e03b 100644 --- a/Linux-PAM/modules/pam_succeed_if/pam_succeed_if.8.xml +++ b/Linux-PAM/modules/pam_succeed_if/pam_succeed_if.8.xml @@ -120,7 +120,7 @@ <term><option>field eq number</option></term> <listitem> <para> - Field has a value numerically less equal to number. + Field has a value numerically equal to number. </para> </listitem> </varlistentry> diff --git a/Linux-PAM/modules/pam_tally/Makefile.am b/Linux-PAM/modules/pam_tally/Makefile.am index 4fad738f..c4c181a9 100644 --- a/Linux-PAM/modules/pam_tally/Makefile.am +++ b/Linux-PAM/modules/pam_tally/Makefile.am @@ -28,11 +28,9 @@ securelib_LTLIBRARIES = pam_tally.la sbin_PROGRAMS = pam_tally pam_tally_SOURCES = pam_tally_app.c -pam_tally_LDADD = -L$(top_builddir)/libpam -lpam if ENABLE_REGENERATE_MAN noinst_DATA = README README: pam_tally.8.xml -include $(top_srcdir)/Make.xml.rules endif - diff --git a/Linux-PAM/modules/pam_tally/README b/Linux-PAM/modules/pam_tally/README index cfd8a468..d3bf5354 100644 --- a/Linux-PAM/modules/pam_tally/README +++ b/Linux-PAM/modules/pam_tally/README @@ -39,7 +39,7 @@ GLOBAL OPTIONS audit - Will display the username typed if the user is not found. + Will log the user name into the system log if the user is not found. AUTH OPTIONS @@ -81,10 +81,6 @@ AUTH OPTIONS Root account can become unavailable. - even_deny_root_account - - Root account can become unavailable. - per_user If /var/log/faillog contains a non-zero .fail_max/.fail_locktime field diff --git a/Linux-PAM/modules/pam_tally/pam_tally.8 b/Linux-PAM/modules/pam_tally/pam_tally.8 index a4476b6b..4e767170 100644 --- a/Linux-PAM/modules/pam_tally/pam_tally.8 +++ b/Linux-PAM/modules/pam_tally/pam_tally.8 @@ -1,133 +1,158 @@ .\" Title: pam_tally .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/> -.\" Date: 06/18/2006 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "PAM_TALLY" "8" "06/18/2006" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_TALLY" "8" "01/08/2008" "Linux-PAM Manual" "Linux\-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_tally \- The login counter (tallying) module +pam_tally - The login counter (tallying) module .SH "SYNOPSIS" .HP 13 -\fBpam_tally.so\fR [file=\fI/path/to/counter\fR] [onerr=[\fIfail\fR|\fIsucceed\fR]] [magic_root] [even_deny_root_account] [deny=\fIn\fR] [lock_time=\fIn\fR] [unlock_time=\fIn\fR] [per_user] [no_lock_time] [no_reset] [audit] +\fBpam_tally\.so\fR [file=\fI/path/to/counter\fR] [onerr=[\fIfail\fR|\fIsucceed\fR]] [magic_root] [even_deny_root_account] [deny=\fIn\fR] [lock_time=\fIn\fR] [unlock_time=\fIn\fR] [per_user] [no_lock_time] [no_reset] [audit] .HP 10 \fBpam_tally\fR [\-\-file\ \fI/path/to/counter\fR] [\-\-user\ \fIusername\fR] [\-\-reset[=\fIn\fR]] [\-\-quiet] .SH "DESCRIPTION" .PP -This module maintains a count of attempted accesses, can reset count on success, can deny access if too many attempts fail. +This module maintains a count of attempted accesses, can reset count on success, can deny access if too many attempts fail\. .PP pam_tally comes in two parts: -\fBpam_tally.so\fR +\fBpam_tally\.so\fR and -\fBpam_tally\fR. The former is the PAM module and the latter, a stand\-alone program. +\fBpam_tally\fR\. The former is the PAM module and the latter, a stand\-alone program\. \fBpam_tally\fR -is an (optional) application which can be used to interrogate and manipulate the counter file. It can display users' counts, set individual counts, or clear all counts. Setting artificially high counts may be useful for blocking users without changing their passwords. For example, one might find it useful to clear all counts every midnight from a cron job. The +is an (optional) application which can be used to interrogate and manipulate the counter file\. It can display users\' counts, set individual counts, or clear all counts\. Setting artificially high counts may be useful for blocking users without changing their passwords\. For example, one might find it useful to clear all counts every midnight from a cron job\. The \fBfaillog\fR(8) -command can be used instead of pam_tally to to maintain the counter file. +command can be used instead of pam_tally to to maintain the counter file\. .PP Normally, failed attempts to access \fIroot\fR will \fBnot\fR -cause the root account to become blocked, to prevent denial\-of\-service: if your users aren't given shell accounts and root may only login via +cause the root account to become blocked, to prevent denial\-of\-service: if your users aren\'t given shell accounts and root may only login via \fBsu\fR -or at the machine console (not telnet/rsh, etc), this is safe. +or at the machine console (not telnet/rsh, etc), this is safe\. .SH "OPTIONS" -.TP 3n +.PP GLOBAL OPTIONS +.RS 4 This can be used for \fIauth\fR and \fIaccount\fR -services. -.RS 3n -.TP 3n +services\. +.PP \fBonerr=[\fR\fB\fIfail\fR\fR\fB|\fR\fB\fIsucceed\fR\fR\fB]\fR +.RS 4 If something weird happens (like unable to open the file), return with \fBPAM_SUCESS\fR if \fBonerr=\fR\fB\fIsucceed\fR\fR -is given, else with the corresponding PAM error code. -.TP 3n +is given, else with the corresponding PAM error code\. +.RE +.PP \fBfile=\fR\fB\fI/path/to/counter\fR\fR -File where to keep counts. Default is -\fI/var/log/faillog\fR. -.TP 3n +.RS 4 +File where to keep counts\. Default is +\fI/var/log/faillog\fR\. +.RE +.PP \fBaudit\fR -Will display the username typed if the user is not found. +.RS 4 +Will log the user name into the system log if the user is not found\. +.RE .RE -.TP 3n +.PP AUTH OPTIONS -Authentication phase first checks if user should be denied access and if not it increments attempted login counter. Then on call to +.RS 4 +Authentication phase first checks if user should be denied access and if not it increments attempted login counter\. Then on call to \fBpam_setcred\fR(3) -it resets the attempts counter. -.RS 3n -.TP 3n +it resets the attempts counter\. +.PP \fBdeny=\fR\fB\fIn\fR\fR +.RS 4 Deny access if tally for this user exceeds -\fIn\fR. -.TP 3n +\fIn\fR\. +.RE +.PP \fBlock_time=\fR\fB\fIn\fR\fR +.RS 4 Always deny for \fIn\fR -seconds after failed attempt. -.TP 3n +seconds after failed attempt\. +.RE +.PP \fBunlock_time=\fR\fB\fIn\fR\fR +.RS 4 Allow access after \fIn\fR -seconds after failed attempt. If this option is used the user will be locked out for the specified amount of time after he exceeded his maximum allowed attempts. Otherwise the account is locked until the lock is removed by a manual intervention of the system administrator. -.TP 3n +seconds after failed attempt\. If this option is used the user will be locked out for the specified amount of time after he exceeded his maximum allowed attempts\. Otherwise the account is locked until the lock is removed by a manual intervention of the system administrator\. +.RE +.PP \fBmagic_root\fR -If the module is invoked by a user with uid=0 the counter is not incremented. The sys\-admin should use this for user launched services, like -\fBsu\fR, otherwise this argument should be omitted. -.TP 3n +.RS 4 +If the module is invoked by a user with uid=0 the counter is not incremented\. The sys\-admin should use this for user launched services, like +\fBsu\fR, otherwise this argument should be omitted\. +.RE +.PP \fBno_lock_time\fR -Do not use the .fail_locktime field in +.RS 4 +Do not use the \.fail_locktime field in \fI/var/log/faillog\fR -for this user. -.TP 3n +for this user\. +.RE +.PP \fBno_reset\fR -Don't reset count on successful entry, only decrement. -.TP 3n -\fBeven_deny_root_account\fR -Root account can become unavailable. -.TP 3n +.RS 4 +Don\'t reset count on successful entry, only decrement\. +.RE +.PP \fBeven_deny_root_account\fR -Root account can become unavailable. -.TP 3n +.RS 4 +Root account can become unavailable\. +.RE +.PP \fBper_user\fR +.RS 4 If \fI/var/log/faillog\fR -contains a non\-zero .fail_max/.fail_locktime field for this user then use it instead of +contains a non\-zero \.fail_max/\.fail_locktime field for this user then use it instead of \fBdeny=\fR\fB\fIn\fR\fR/ \fBlock_time=\fR\fB\fIn\fR\fR -parameter. -.TP 3n +parameter\. +.RE +.PP \fBno_lock_time\fR -Don't use .fail_locktime filed in +.RS 4 +Don\'t use \.fail_locktime filed in \fI/var/log/faillog\fR -for this user. +for this user\. +.RE .RE -.TP 3n +.PP ACCOUNT OPTIONS +.RS 4 Account phase resets attempts counter if the user is \fBnot\fR -magic root. This phase can be used optionaly for services which don't call +magic root\. This phase can be used optionaly for services which don\'t call \fBpam_setcred\fR(3) -correctly or if the reset should be done regardless of the failure of the account phase of other modules. -.RS 3n -.TP 3n +correctly or if the reset should be done regardless of the failure of the account phase of other modules\. +.PP \fBmagic_root\fR -If the module is invoked by a user with uid=0 the counter is not incremented. The sys\-admin should use this for user launched services, like -\fBsu\fR, otherwise this argument should be omitted. -.TP 3n +.RS 4 +If the module is invoked by a user with uid=0 the counter is not incremented\. The sys\-admin should use this for user launched services, like +\fBsu\fR, otherwise this argument should be omitted\. +.RE +.PP \fBno_reset\fR -Don't reset count on successful entry, only decrement. +.RS 4 +Don\'t reset count on successful entry, only decrement\. +.RE .RE .SH "MODULE SERVICES PROVIDED" .PP @@ -135,47 +160,55 @@ The \fBauth\fR and \fBaccount\fR -services are supported. +services are supported\. .SH "RETURN VALUES" -.TP 3n +.PP PAM_AUTH_ERR -A invalid option was given, the module was not able to retrive the user name, no valid counter file was found, or too many failed logins. -.TP 3n +.RS 4 +A invalid option was given, the module was not able to retrive the user name, no valid counter file was found, or too many failed logins\. +.RE +.PP PAM_SUCCESS -Everything was successfull. -.TP 3n +.RS 4 +Everything was successfull\. +.RE +.PP PAM_USER_UNKNOWN -User not known. +.RS 4 +User not known\. +.RE .SH "EXAMPLES" .PP Add the following line to -\fI/etc/pam.d/login\fR -to lock the account after too many failed logins. The number of allowed fails is specified by +\fI/etc/pam\.d/login\fR +to lock the account after too many failed logins\. The number of allowed fails is specified by \fI/var/log/faillog\fR and needs to be set with pam_tally or \fBfaillog\fR(8) -before. +before\. .sp -.RS 3n +.RS 4 .nf -auth required pam_securetty.so -auth required pam_tally.so per_user -auth required pam_env.so -auth required pam_unix.so -auth required pam_nologin.so -account required pam_unix.so -password required pam_unix.so -session required pam_limits.so -session required pam_unix.so -session required pam_lastlog.so nowtmp -session optional pam_mail.so standard +auth required pam_securetty\.so +auth required pam_tally\.so per_user +auth required pam_env\.so +auth required pam_unix\.so +auth required pam_nologin\.so +account required pam_unix\.so +password required pam_unix\.so +session required pam_limits\.so +session required pam_unix\.so +session required pam_lastlog\.so nowtmp +session optional pam_mail\.so standard .fi .RE .SH "FILES" -.TP 3n +.PP \fI/var/log/faillog\fR +.RS 4 failure logging file +.RE .SH "SEE ALSO" .PP @@ -185,4 +218,4 @@ failure logging file \fBpam\fR(8) .SH "AUTHOR" .PP -pam_tally was written by Tim Baverstock and Tomas Mraz. +pam_tally was written by Tim Baverstock and Tomas Mraz\. diff --git a/Linux-PAM/modules/pam_tally/pam_tally.8.xml b/Linux-PAM/modules/pam_tally/pam_tally.8.xml index 1261130a..4f89269e 100644 --- a/Linux-PAM/modules/pam_tally/pam_tally.8.xml +++ b/Linux-PAM/modules/pam_tally/pam_tally.8.xml @@ -146,7 +146,7 @@ </term> <listitem> <para> - Will display the username typed if the user is not found. + Will log the user name into the system log if the user is not found. </para> </listitem> </varlistentry> @@ -250,16 +250,6 @@ </varlistentry> <varlistentry> <term> - <option>even_deny_root_account</option> - </term> - <listitem> - <para> - Root account can become unavailable. - </para> - </listitem> - </varlistentry> - <varlistentry> - <term> <option>per_user</option> </term> <listitem> diff --git a/Linux-PAM/modules/pam_tally/pam_tally.c b/Linux-PAM/modules/pam_tally/pam_tally.c index 66fc5f35..8814659a 100644 --- a/Linux-PAM/modules/pam_tally/pam_tally.c +++ b/Linux-PAM/modules/pam_tally/pam_tally.c @@ -37,14 +37,16 @@ * modules include file to define the function prototypes. */ +#ifndef MAIN #define PAM_SM_AUTH #define PAM_SM_ACCOUNT /* #define PAM_SM_SESSION */ /* #define PAM_SM_PASSWORD */ -#include <security/pam_modules.h> #include <security/pam_modutil.h> #include <security/pam_ext.h> +#endif +#include <security/pam_modules.h> #ifndef TRUE #define TRUE 1L @@ -94,7 +96,7 @@ struct tally_options { #define OPT_PER_USER 010 #define OPT_NO_LOCK_TIME 020 #define OPT_NO_RESET 040 -#define OPT_AUDIT 100 +#define OPT_AUDIT 0100 /*---------------------------------------------------------------------*/ @@ -115,6 +117,9 @@ tally_log (const pam_handle_t *pamh UNUSED, int priority UNUSED, fprintf(stderr,"\n"); va_end(args); } + +#define pam_modutil_getpwnam(pamh,user) getpwnam(user) + #endif /*---------------------------------------------------------------------*/ @@ -353,7 +358,7 @@ get_tally(pam_handle_t *pamh, tally_t *tally, uid_t uid, return PAM_AUTH_ERR; } - if ( fileinfo.st_size <= uid * sizeof(struct faillog) ) { + if ( (size_t)fileinfo.st_size <= uid * sizeof(struct faillog) ) { memset(fsp, 0, sizeof(struct faillog)); *tally=0; diff --git a/Linux-PAM/modules/pam_time/README b/Linux-PAM/modules/pam_time/README index abafd936..05eaec2c 100644 --- a/Linux-PAM/modules/pam_time/README +++ b/Linux-PAM/modules/pam_time/README @@ -14,6 +14,9 @@ from which they are making their request. By default rules for time/port access are taken from config file /etc/security/ time.conf. +If Linux PAM is compiled with audit support the module will report when it +denies access. + EXAMPLES These are some example lines which might be specified in /etc/security/ diff --git a/Linux-PAM/modules/pam_time/pam_time.8 b/Linux-PAM/modules/pam_time/pam_time.8 index 89506830..2edfac91 100644 --- a/Linux-PAM/modules/pam_time/pam_time.8 +++ b/Linux-PAM/modules/pam_time/pam_time.8 @@ -1,63 +1,86 @@ .\" Title: pam_time .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/> -.\" Date: 06/21/2006 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "PAM_TIME" "8" "06/21/2006" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_TIME" "8" "01/08/2008" "Linux-PAM Manual" "Linux-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_time \- PAM module for time control access +pam_time - PAM module for time control access .SH "SYNOPSIS" .HP 12 -\fBpam_time.so\fR +\fBpam_time\.so\fR [debug] [noaudit] .SH "DESCRIPTION" .PP -The pam_time PAM module does not authenticate the user, but instead it restricts access to a system and or specific applications at various times of the day and on specific days or over various terminal lines. This module can be configured to deny access to (individual) users based on their name, the time of day, the day of week, the service they are applying for and their terminal from which they are making their request. +The pam_time PAM module does not authenticate the user, but instead it restricts access to a system and or specific applications at various times of the day and on specific days or over various terminal lines\. This module can be configured to deny access to (individual) users based on their name, the time of day, the day of week, the service they are applying for and their terminal from which they are making their request\. .PP By default rules for time/port access are taken from config file -\fI/etc/security/time.conf\fR. +\fI/etc/security/time\.conf\fR\. +.PP +If Linux PAM is compiled with audit support the module will report when it denies access\. .SH "OPTIONS" .PP -This module does not recognice any options. +\fBdebug\fR +.RS 4 +Some debug informations are printed with +\fBsyslog\fR(3)\. +.RE +.PP +\fBnoaudit\fR +.RS 4 +Do not report logins at disallowed time to the audit subsystem\. +.RE .SH "MODULE SERVICES PROVIDED" .PP Only the \fBaccount\fR -service is supported. +service is supported\. .SH "RETURN VALUES" -.TP 3n +.PP PAM_SUCCESS -Access was granted. -.TP 3n +.RS 4 +Access was granted\. +.RE +.PP PAM_ABORT -Not all relevant data could be gotten. -.TP 3n +.RS 4 +Not all relevant data could be gotten\. +.RE +.PP PAM_BUF_ERR -Memory buffer error. -.TP 3n +.RS 4 +Memory buffer error\. +.RE +.PP PAM_PERM_DENIED -Access was not granted. -.TP 3n +.RS 4 +Access was not granted\. +.RE +.PP PAM_USER_UNKNOWN -The user is not known to the system. +.RS 4 +The user is not known to the system\. +.RE .SH "FILES" -.TP 3n -\fI/etc/security/time.conf\fR +.PP +\fI/etc/security/time\.conf\fR +.RS 4 Default configuration file +.RE .SH "EXAMPLES" .sp -.RS 3n +.RS 4 .nf -#%PAM\-1.0 +#%PAM\-1\.0 # # apply pam_time accounting to login requests # -login account required pam_time.so +login account required pam_time\.so .fi .RE @@ -66,7 +89,7 @@ login account required pam_time.so \fBtime.conf\fR(5), \fBpam.d\fR(8), -\fBpam\fR(8). +\fBpam\fR(8)\. .SH "AUTHOR" .PP -pam_time was written by Andrew G. Morgan <morgan@kernel.org>. +pam_time was written by Andrew G\. Morgan <morgan@kernel\.org>\. diff --git a/Linux-PAM/modules/pam_time/pam_time.8.xml b/Linux-PAM/modules/pam_time/pam_time.8.xml index 1ec7eb0e..e0b149a7 100644 --- a/Linux-PAM/modules/pam_time/pam_time.8.xml +++ b/Linux-PAM/modules/pam_time/pam_time.8.xml @@ -22,6 +22,12 @@ <refsynopsisdiv> <cmdsynopsis id="pam_time-cmdsynopsis"> <command>pam_time.so</command> + <arg choice="opt"> + debug + </arg> + <arg choice="opt"> + noaudit + </arg> </cmdsynopsis> </refsynopsisdiv> @@ -41,11 +47,40 @@ By default rules for time/port access are taken from config file <filename>/etc/security/time.conf</filename>. </para> + <para> + If Linux PAM is compiled with audit support the module will report + when it denies access. + </para> </refsect1> <refsect1 id="pam_time-options"> <title>OPTIONS</title> - <para>This module does not recognice any options.</para> + <variablelist> + + <varlistentry> + <term> + <option>debug</option> + </term> + <listitem> + <para> + Some debug informations are printed with + <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>. + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term> + <option>noaudit</option> + </term> + <listitem> + <para> + Do not report logins at disallowed time to the audit subsystem. + </para> + </listitem> + </varlistentry> + + </variablelist> </refsect1> <refsect1 id="pam_time-services"> diff --git a/Linux-PAM/modules/pam_time/pam_time.c b/Linux-PAM/modules/pam_time/pam_time.c index 56b418f4..8e3b2486 100644 --- a/Linux-PAM/modules/pam_time/pam_time.c +++ b/Linux-PAM/modules/pam_time/pam_time.c @@ -22,9 +22,16 @@ #include <fcntl.h> #include <netdb.h> +#ifdef HAVE_LIBAUDIT +#include <libaudit.h> +#endif + #define PAM_TIME_BUFLEN 1000 #define FIELD_SEPARATOR ';' /* this is new as of .02 */ +#define PAM_DEBUG_ARG 0x0001 +#define PAM_NO_AUDIT 0x0002 + #ifndef TRUE # define TRUE 1 #endif @@ -46,6 +53,29 @@ typedef enum { AND, OR } operator; #include <security/_pam_macros.h> #include <security/pam_modules.h> #include <security/pam_ext.h> +#include <security/pam_modutil.h> + +static int +_pam_parse (const pam_handle_t *pamh, int argc, const char **argv) +{ + int ctrl = 0; + + /* step through arguments */ + for (; argc-- > 0; ++argv) { + + /* generic options */ + + if (!strcmp(*argv, "debug")) { + ctrl |= PAM_DEBUG_ARG; + } else if (!strcmp(*argv, "noaudit")) { + ctrl |= PAM_NO_AUDIT; + } else { + pam_syslog(pamh, LOG_ERR, "unknown option: %s", *argv); + } + } + + return ctrl; +} /* --- static functions for checking whether the user should be let in --- */ @@ -567,11 +597,15 @@ check_account(pam_handle_t *pamh, const char *service, PAM_EXTERN int pam_sm_acct_mgmt(pam_handle_t *pamh, int flags UNUSED, - int argc UNUSED, const char **argv UNUSED) + int argc, const char **argv) { const void *service=NULL, *void_tty=NULL; const char *tty; const char *user=NULL; + int ctrl; + int rv; + + ctrl = _pam_parse(pamh, argc, argv); /* set service name */ @@ -620,7 +654,19 @@ pam_sm_acct_mgmt(pam_handle_t *pamh, int flags UNUSED, D(("user=%s", user)); D(("tty=%s", tty)); - return check_account(pamh, service, tty, user); + rv = check_account(pamh, service, tty, user); + if (rv != PAM_SUCCESS) { +#ifdef HAVE_LIBAUDIT + if (!(ctrl & PAM_NO_AUDIT)) { + pam_modutil_audit_write(pamh, AUDIT_ANOM_LOGIN_TIME, + "pam_time", rv); /* ignore return value as we fail anyway */ + } +#endif + if (ctrl & PAM_DEBUG_ARG) { + pam_syslog(pamh, LOG_DEBUG, "user %s rejected", user); + } + } + return rv; } /* end of module definition */ diff --git a/Linux-PAM/modules/pam_time/time.conf.5 b/Linux-PAM/modules/pam_time/time.conf.5 index 400344a6..34b6e60c 100644 --- a/Linux-PAM/modules/pam_time/time.conf.5 +++ b/Linux-PAM/modules/pam_time/time.conf.5 @@ -1,79 +1,78 @@ .\" Title: time.conf .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/> -.\" Date: 06/21/2006 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "TIME.CONF" "5" "06/21/2006" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "TIME\.CONF" "5" "01/08/2008" "Linux-PAM Manual" "Linux\-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -time.conf \- configuration file for the pam_time module +time.conf - configuration file for the pam_time module .SH "DESCRIPTION" .PP -The pam_time PAM module does not authenticate the user, but instead it restricts access to a system and or specific applications at various times of the day and on specific days or over various terminal lines. This module can be configured to deny access to (individual) users based on their name, the time of day, the day of week, the service they are applying for and their terminal from which they are making their request. +The pam_time PAM module does not authenticate the user, but instead it restricts access to a system and or specific applications at various times of the day and on specific days or over various terminal lines\. This module can be configured to deny access to (individual) users based on their name, the time of day, the day of week, the service they are applying for and their terminal from which they are making their request\. .PP For this module to function correctly there must be a correctly formatted -\fI/etc/security/time.conf\fR -file present. White spaces are ignored and lines maybe extended with '\\' (escaped newlines). Text following a '#' is ignored to the end of the line. +\fI/etc/security/time\.conf\fR +file present\. White spaces are ignored and lines maybe extended with \'\e\' (escaped newlines)\. Text following a \'#\' is ignored to the end of the line\. .PP The syntax of the lines is as follows: .PP \fIservices\fR;\fIttys\fR;\fIusers\fR;\fItimes\fR .PP -In words, each rule occupies a line, terminated with a newline or the beginning of a comment; a '\fB#\fR'. It contains four fields separated with semicolons, '\fB;\fR'. +In words, each rule occupies a line, terminated with a newline or the beginning of a comment; a \'\fB#\fR\'\. It contains four fields separated with semicolons, \'\fB;\fR\'\. .PP The first field, the \fIservices\fR -field, is a logic list of PAM service names that the rule applies to. +field, is a logic list of PAM service names that the rule applies to\. .PP The second field, the \fItty\fR -field, is a logic list of terminal names that this rule applies to. +field, is a logic list of terminal names that this rule applies to\. .PP The third field, the \fIusers\fR -field, is a logic list of users or a netgroup of users to whom this rule applies. +field, is a logic list of users or a netgroup of users to whom this rule applies\. .PP -For these items the simple wildcard '*' may be used only once. With netgroups no wildcards or logic operators are allowed. +For these items the simple wildcard \'*\' may be used only once\. With netgroups no wildcards or logic operators are allowed\. .PP The \fItimes\fR -field is used to indicate the times at which this rule applies. The format here is a logic list of day/time\-range entries. The days are specified by a sequence of two character entries, MoTuSa for example is Monday Tuesday and Saturday. Note that repeated days are unset MoMo = no day, and MoWk = all weekdays bar Monday. The two character combinations accepted are Mo Tu We Th Fr Sa Su Wk Wd Al, the last two being week\-end days and all 7 days of the week respectively. As a final example, AlFr means all days except Friday. +field is used to indicate the times at which this rule applies\. The format here is a logic list of day/time\-range entries\. The days are specified by a sequence of two character entries, MoTuSa for example is Monday Tuesday and Saturday\. Note that repeated days are unset MoMo = no day, and MoWk = all weekdays bar Monday\. The two character combinations accepted are Mo Tu We Th Fr Sa Su Wk Wd Al, the last two being week\-end days and all 7 days of the week respectively\. As a final example, AlFr means all days except Friday\. .PP -Each day/time\-range can be prefixed with a '!' to indicate "anything but". The time\-range part is two 24\-hour times HHMM, separated by a hyphen, indicating the start and finish time (if the finish time is smaller than the start time it is deemed to apply on the following day). +Each day/time\-range can be prefixed with a \'!\' to indicate "anything but"\. The time\-range part is two 24\-hour times HHMM, separated by a hyphen, indicating the start and finish time (if the finish time is smaller than the start time it is deemed to apply on the following day)\. .PP -For a rule to be active, ALL of service+ttys+users must be satisfied by the applying process. +For a rule to be active, ALL of service+ttys+users must be satisfied by the applying process\. .PP -Note, currently there is no daemon enforcing the end of a session. This needs to be remedied. +Note, currently there is no daemon enforcing the end of a session\. This needs to be remedied\. .PP Poorly formatted rules are logged as errors using -\fBsyslog\fR(3). +\fBsyslog\fR(3)\. .SH "EXAMPLES" .PP These are some example lines which might be specified in -\fI/etc/security/time.conf\fR. +\fI/etc/security/time\.conf\fR\. .PP All users except for \fIroot\fR are denied access to console\-login at all times: .sp -.RS 3n +.RS 4 .nf login ; tty* & !ttyp* ; !root ; !Al0000\-2400 .fi .RE -.sp .PP -Games (configured to use PAM) are only to be accessed out of working hours. This rule does not apply to the user +Games (configured to use PAM) are only to be accessed out of working hours\. This rule does not apply to the user \fIwaster\fR: .sp -.RS 3n +.RS 4 .nf games ; * ; !waster ; Wd0000\-2400 | Wk1800\-0800 @@ -89,4 +88,4 @@ games ; * ; !waster ; Wd0000\-2400 | Wk1800\-0800 \fBpam\fR(8) .SH "AUTHOR" .PP -pam_time was written by Andrew G. Morgan <morgan@kernel.org>. +pam_time was written by Andrew G\. Morgan <morgan@kernel\.org>\. diff --git a/Linux-PAM/modules/pam_tty_audit/Makefile.am b/Linux-PAM/modules/pam_tty_audit/Makefile.am new file mode 100644 index 00000000..5bb64585 --- /dev/null +++ b/Linux-PAM/modules/pam_tty_audit/Makefile.am @@ -0,0 +1,30 @@ +# +# Copyright (c) 2005, 2006 Thorsten Kukuk <kukuk@suse.de> +# + +CLEANFILES = *~ + +EXTRA_DIST = README $(MANS) $(XMLS) + +man_MANS = pam_tty_audit.8 +XMLS = README.xml pam_tty_audit.8.xml + +securelibdir = $(SECUREDIR) + +AM_CFLAGS = -I$(top_srcdir)/libpam/include -I$(top_srcdir)/libpamc/include +AM_LDFLAGS = -no-undefined -avoid-version -module +if HAVE_VERSIONING + AM_LDFLAGS += -Wl,--version-script=$(srcdir)/../modules.map +endif + +if HAVE_AUDIT_TTY_STATUS + pam_tty_audit_la_LIBADD = -L$(top_builddir)/libpam -lpam + securelib_LTLIBRARIES = pam_tty_audit.la +endif + +if ENABLE_REGENERATE_MAN +noinst_DATA = README +README: pam_tty_audit.8.xml +-include $(top_srcdir)/Make.xml.rules +endif + diff --git a/Linux-PAM/modules/pam_tty_audit/Makefile.in b/Linux-PAM/modules/pam_tty_audit/Makefile.in new file mode 100644 index 00000000..51ea30b4 --- /dev/null +++ b/Linux-PAM/modules/pam_tty_audit/Makefile.in @@ -0,0 +1,591 @@ +# Makefile.in generated by automake 1.10 from Makefile.am. +# @configure_input@ + +# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, +# 2003, 2004, 2005, 2006 Free Software Foundation, Inc. +# This Makefile.in is free software; the Free Software Foundation +# gives unlimited permission to copy and/or distribute it, +# with or without modifications, as long as this notice is preserved. + +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY, to the extent permitted by law; without +# even the implied warranty of MERCHANTABILITY or FITNESS FOR A +# PARTICULAR PURPOSE. + +@SET_MAKE@ + +# +# Copyright (c) 2005, 2006 Thorsten Kukuk <kukuk@suse.de> +# + + +VPATH = @srcdir@ +pkgdatadir = $(datadir)/@PACKAGE@ +pkglibdir = $(libdir)/@PACKAGE@ +pkgincludedir = $(includedir)/@PACKAGE@ +am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd +install_sh_DATA = $(install_sh) -c -m 644 +install_sh_PROGRAM = $(install_sh) -c +install_sh_SCRIPT = $(install_sh) -c +INSTALL_HEADER = $(INSTALL_DATA) +transform = $(program_transform_name) +NORMAL_INSTALL = : +PRE_INSTALL = : +POST_INSTALL = : +NORMAL_UNINSTALL = : +PRE_UNINSTALL = : +POST_UNINSTALL = : +build_triplet = @build@ +host_triplet = @host@ +@HAVE_VERSIONING_TRUE@am__append_1 = -Wl,--version-script=$(srcdir)/../modules.map +subdir = modules/pam_tty_audit +DIST_COMMON = README $(srcdir)/Makefile.am $(srcdir)/Makefile.in +ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 +am__aclocal_m4_deps = $(top_srcdir)/m4/gettext.m4 \ + $(top_srcdir)/m4/iconv.m4 \ + $(top_srcdir)/m4/jh_path_xml_catalog.m4 \ + $(top_srcdir)/m4/ld-O1.m4 $(top_srcdir)/m4/ld-as-needed.m4 \ + $(top_srcdir)/m4/lib-ld.m4 $(top_srcdir)/m4/lib-link.m4 \ + $(top_srcdir)/m4/lib-prefix.m4 $(top_srcdir)/m4/libprelude.m4 \ + $(top_srcdir)/m4/nls.m4 $(top_srcdir)/m4/po.m4 \ + $(top_srcdir)/m4/progtest.m4 $(top_srcdir)/acinclude.m4 \ + $(top_srcdir)/configure.in +am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ + $(ACLOCAL_M4) +mkinstalldirs = $(SHELL) $(top_srcdir)/mkinstalldirs +CONFIG_HEADER = $(top_builddir)/config.h +CONFIG_CLEAN_FILES = +am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`; +am__vpath_adj = case $$p in \ + $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \ + *) f=$$p;; \ + esac; +am__strip_dir = `echo $$p | sed -e 's|^.*/||'`; +am__installdirs = "$(DESTDIR)$(securelibdir)" "$(DESTDIR)$(man8dir)" +securelibLTLIBRARIES_INSTALL = $(INSTALL) +LTLIBRARIES = $(securelib_LTLIBRARIES) +pam_tty_audit_la_DEPENDENCIES = +pam_tty_audit_la_SOURCES = pam_tty_audit.c +pam_tty_audit_la_OBJECTS = pam_tty_audit.lo +@HAVE_AUDIT_TTY_STATUS_TRUE@am_pam_tty_audit_la_rpath = -rpath \ +@HAVE_AUDIT_TTY_STATUS_TRUE@ $(securelibdir) +DEFAULT_INCLUDES = -I. -I$(top_builddir)@am__isrc@ +depcomp = $(SHELL) $(top_srcdir)/depcomp +am__depfiles_maybe = depfiles +COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \ + $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) +LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \ + --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) \ + $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) +CCLD = $(CC) +LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \ + --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \ + $(LDFLAGS) -o $@ +SOURCES = pam_tty_audit.c +DIST_SOURCES = pam_tty_audit.c +man8dir = $(mandir)/man8 +NROFF = nroff +MANS = $(man_MANS) +DATA = $(noinst_DATA) +ETAGS = etags +CTAGS = ctags +DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) +ACLOCAL = @ACLOCAL@ +AMTAR = @AMTAR@ +AR = @AR@ +AUTOCONF = @AUTOCONF@ +AUTOHEADER = @AUTOHEADER@ +AUTOMAKE = @AUTOMAKE@ +AWK = @AWK@ +BROWSER = @BROWSER@ +CC = @CC@ +CCDEPMODE = @CCDEPMODE@ +CFLAGS = @CFLAGS@ +CPP = @CPP@ +CPPFLAGS = @CPPFLAGS@ +CXX = @CXX@ +CXXCPP = @CXXCPP@ +CXXDEPMODE = @CXXDEPMODE@ +CXXFLAGS = @CXXFLAGS@ +CYGPATH_W = @CYGPATH_W@ +DEFS = @DEFS@ +DEPDIR = @DEPDIR@ +ECHO = @ECHO@ +ECHO_C = @ECHO_C@ +ECHO_N = @ECHO_N@ +ECHO_T = @ECHO_T@ +EGREP = @EGREP@ +EXEEXT = @EXEEXT@ +F77 = @F77@ +FFLAGS = @FFLAGS@ +FO2PDF = @FO2PDF@ +GMSGFMT = @GMSGFMT@ +GMSGFMT_015 = @GMSGFMT_015@ +GREP = @GREP@ +HAVE_KEY_MANAGEMENT = @HAVE_KEY_MANAGEMENT@ +INSTALL = @INSTALL@ +INSTALL_DATA = @INSTALL_DATA@ +INSTALL_PROGRAM = @INSTALL_PROGRAM@ +INSTALL_SCRIPT = @INSTALL_SCRIPT@ +INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ +INTLLIBS = @INTLLIBS@ +INTL_MACOSX_LIBS = @INTL_MACOSX_LIBS@ +LDFLAGS = @LDFLAGS@ +LEX = @LEX@ +LEXLIB = @LEXLIB@ +LEX_OUTPUT_ROOT = @LEX_OUTPUT_ROOT@ +LIBAUDIT = @LIBAUDIT@ +LIBCRACK = @LIBCRACK@ +LIBCRYPT = @LIBCRYPT@ +LIBDB = @LIBDB@ +LIBDL = @LIBDL@ +LIBICONV = @LIBICONV@ +LIBINTL = @LIBINTL@ +LIBNSL = @LIBNSL@ +LIBOBJS = @LIBOBJS@ +LIBPRELUDE_CFLAGS = @LIBPRELUDE_CFLAGS@ +LIBPRELUDE_CONFIG = @LIBPRELUDE_CONFIG@ +LIBPRELUDE_CONFIG_PREFIX = @LIBPRELUDE_CONFIG_PREFIX@ +LIBPRELUDE_LDFLAGS = @LIBPRELUDE_LDFLAGS@ +LIBPRELUDE_LIBS = @LIBPRELUDE_LIBS@ +LIBPRELUDE_PREFIX = @LIBPRELUDE_PREFIX@ +LIBPRELUDE_PTHREAD_CFLAGS = @LIBPRELUDE_PTHREAD_CFLAGS@ +LIBS = @LIBS@ +LIBSELINUX = @LIBSELINUX@ +LIBTOOL = @LIBTOOL@ +LN_S = @LN_S@ +LTLIBICONV = @LTLIBICONV@ +LTLIBINTL = @LTLIBINTL@ +LTLIBOBJS = @LTLIBOBJS@ +MAKEINFO = @MAKEINFO@ +MKDIR_P = @MKDIR_P@ +MSGFMT = @MSGFMT@ +MSGFMT_015 = @MSGFMT_015@ +MSGMERGE = @MSGMERGE@ +OBJEXT = @OBJEXT@ +PACKAGE = @PACKAGE@ +PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@ +PACKAGE_NAME = @PACKAGE_NAME@ +PACKAGE_STRING = @PACKAGE_STRING@ +PACKAGE_TARNAME = @PACKAGE_TARNAME@ +PACKAGE_VERSION = @PACKAGE_VERSION@ +PAM_READ_BOTH_CONFS = @PAM_READ_BOTH_CONFS@ +PATH_SEPARATOR = @PATH_SEPARATOR@ +PIE_CFLAGS = @PIE_CFLAGS@ +PIE_LDFLAGS = @PIE_LDFLAGS@ +POSUB = @POSUB@ +RANLIB = @RANLIB@ +SCONFIGDIR = @SCONFIGDIR@ +SECUREDIR = @SECUREDIR@ +SED = @SED@ +SET_MAKE = @SET_MAKE@ +SHELL = @SHELL@ +STRIP = @STRIP@ +USE_NLS = @USE_NLS@ +VERSION = @VERSION@ +WITH_DEBUG = @WITH_DEBUG@ +WITH_PAMLOCKING = @WITH_PAMLOCKING@ +XGETTEXT = @XGETTEXT@ +XGETTEXT_015 = @XGETTEXT_015@ +XMLCATALOG = @XMLCATALOG@ +XMLLINT = @XMLLINT@ +XML_CATALOG_FILE = @XML_CATALOG_FILE@ +XSLTPROC = @XSLTPROC@ +YACC = @YACC@ +YFLAGS = @YFLAGS@ +abs_builddir = @abs_builddir@ +abs_srcdir = @abs_srcdir@ +abs_top_builddir = @abs_top_builddir@ +abs_top_srcdir = @abs_top_srcdir@ +ac_ct_CC = @ac_ct_CC@ +ac_ct_CXX = @ac_ct_CXX@ +ac_ct_F77 = @ac_ct_F77@ +am__include = @am__include@ +am__leading_dot = @am__leading_dot@ +am__quote = @am__quote@ +am__tar = @am__tar@ +am__untar = @am__untar@ +bindir = @bindir@ +build = @build@ +build_alias = @build_alias@ +build_cpu = @build_cpu@ +build_os = @build_os@ +build_vendor = @build_vendor@ +builddir = @builddir@ +datadir = @datadir@ +datarootdir = @datarootdir@ +docdir = @docdir@ +dvidir = @dvidir@ +exec_prefix = @exec_prefix@ +host = @host@ +host_alias = @host_alias@ +host_cpu = @host_cpu@ +host_os = @host_os@ +host_vendor = @host_vendor@ +htmldir = @htmldir@ +includedir = @includedir@ +infodir = @infodir@ +install_sh = @install_sh@ +libc_cv_fpie = @libc_cv_fpie@ +libdir = @libdir@ +libexecdir = @libexecdir@ +localedir = @localedir@ +localstatedir = @localstatedir@ +mandir = @mandir@ +mkdir_p = @mkdir_p@ +oldincludedir = @oldincludedir@ +pam_cv_ld_as_needed = @pam_cv_ld_as_needed@ +pam_xauth_path = @pam_xauth_path@ +pdfdir = @pdfdir@ +prefix = @prefix@ +program_transform_name = @program_transform_name@ +psdir = @psdir@ +sbindir = @sbindir@ +sharedstatedir = @sharedstatedir@ +srcdir = @srcdir@ +sysconfdir = @sysconfdir@ +target_alias = @target_alias@ +top_builddir = @top_builddir@ +top_srcdir = @top_srcdir@ +CLEANFILES = *~ +EXTRA_DIST = README $(MANS) $(XMLS) +man_MANS = pam_tty_audit.8 +XMLS = README.xml pam_tty_audit.8.xml +securelibdir = $(SECUREDIR) +AM_CFLAGS = -I$(top_srcdir)/libpam/include -I$(top_srcdir)/libpamc/include +AM_LDFLAGS = -no-undefined -avoid-version -module $(am__append_1) +@HAVE_AUDIT_TTY_STATUS_TRUE@pam_tty_audit_la_LIBADD = -L$(top_builddir)/libpam -lpam +@HAVE_AUDIT_TTY_STATUS_TRUE@securelib_LTLIBRARIES = pam_tty_audit.la +@ENABLE_REGENERATE_MAN_TRUE@noinst_DATA = README +all: all-am + +.SUFFIXES: +.SUFFIXES: .c .lo .o .obj +$(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps) + @for dep in $?; do \ + case '$(am__configure_deps)' in \ + *$$dep*) \ + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh \ + && exit 0; \ + exit 1;; \ + esac; \ + done; \ + echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu modules/pam_tty_audit/Makefile'; \ + cd $(top_srcdir) && \ + $(AUTOMAKE) --gnu modules/pam_tty_audit/Makefile +.PRECIOUS: Makefile +Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status + @case '$?' in \ + *config.status*) \ + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \ + *) \ + echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \ + cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \ + esac; + +$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES) + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh + +$(top_srcdir)/configure: $(am__configure_deps) + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh +$(ACLOCAL_M4): $(am__aclocal_m4_deps) + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh +install-securelibLTLIBRARIES: $(securelib_LTLIBRARIES) + @$(NORMAL_INSTALL) + test -z "$(securelibdir)" || $(MKDIR_P) "$(DESTDIR)$(securelibdir)" + @list='$(securelib_LTLIBRARIES)'; for p in $$list; do \ + if test -f $$p; then \ + f=$(am__strip_dir) \ + echo " $(LIBTOOL) --mode=install $(securelibLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) '$$p' '$(DESTDIR)$(securelibdir)/$$f'"; \ + $(LIBTOOL) --mode=install $(securelibLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) "$$p" "$(DESTDIR)$(securelibdir)/$$f"; \ + else :; fi; \ + done + +uninstall-securelibLTLIBRARIES: + @$(NORMAL_UNINSTALL) + @list='$(securelib_LTLIBRARIES)'; for p in $$list; do \ + p=$(am__strip_dir) \ + echo " $(LIBTOOL) --mode=uninstall rm -f '$(DESTDIR)$(securelibdir)/$$p'"; \ + $(LIBTOOL) --mode=uninstall rm -f "$(DESTDIR)$(securelibdir)/$$p"; \ + done + +clean-securelibLTLIBRARIES: + -test -z "$(securelib_LTLIBRARIES)" || rm -f $(securelib_LTLIBRARIES) + @list='$(securelib_LTLIBRARIES)'; for p in $$list; do \ + dir="`echo $$p | sed -e 's|/[^/]*$$||'`"; \ + test "$$dir" != "$$p" || dir=.; \ + echo "rm -f \"$${dir}/so_locations\""; \ + rm -f "$${dir}/so_locations"; \ + done +pam_tty_audit.la: $(pam_tty_audit_la_OBJECTS) $(pam_tty_audit_la_DEPENDENCIES) + $(LINK) $(am_pam_tty_audit_la_rpath) $(pam_tty_audit_la_OBJECTS) $(pam_tty_audit_la_LIBADD) $(LIBS) + +mostlyclean-compile: + -rm -f *.$(OBJEXT) + +distclean-compile: + -rm -f *.tab.c + +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pam_tty_audit.Plo@am__quote@ + +.c.o: +@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< +@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(COMPILE) -c $< + +.c.obj: +@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'` +@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'` + +.c.lo: +@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< +@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $< + +mostlyclean-libtool: + -rm -f *.lo + +clean-libtool: + -rm -rf .libs _libs +install-man8: $(man8_MANS) $(man_MANS) + @$(NORMAL_INSTALL) + test -z "$(man8dir)" || $(MKDIR_P) "$(DESTDIR)$(man8dir)" + @list='$(man8_MANS) $(dist_man8_MANS) $(nodist_man8_MANS)'; \ + l2='$(man_MANS) $(dist_man_MANS) $(nodist_man_MANS)'; \ + for i in $$l2; do \ + case "$$i" in \ + *.8*) list="$$list $$i" ;; \ + esac; \ + done; \ + for i in $$list; do \ + if test -f $(srcdir)/$$i; then file=$(srcdir)/$$i; \ + else file=$$i; fi; \ + ext=`echo $$i | sed -e 's/^.*\\.//'`; \ + case "$$ext" in \ + 8*) ;; \ + *) ext='8' ;; \ + esac; \ + inst=`echo $$i | sed -e 's/\\.[0-9a-z]*$$//'`; \ + inst=`echo $$inst | sed -e 's/^.*\///'`; \ + inst=`echo $$inst | sed '$(transform)'`.$$ext; \ + echo " $(INSTALL_DATA) '$$file' '$(DESTDIR)$(man8dir)/$$inst'"; \ + $(INSTALL_DATA) "$$file" "$(DESTDIR)$(man8dir)/$$inst"; \ + done +uninstall-man8: + @$(NORMAL_UNINSTALL) + @list='$(man8_MANS) $(dist_man8_MANS) $(nodist_man8_MANS)'; \ + l2='$(man_MANS) $(dist_man_MANS) $(nodist_man_MANS)'; \ + for i in $$l2; do \ + case "$$i" in \ + *.8*) list="$$list $$i" ;; \ + esac; \ + done; \ + for i in $$list; do \ + ext=`echo $$i | sed -e 's/^.*\\.//'`; \ + case "$$ext" in \ + 8*) ;; \ + *) ext='8' ;; \ + esac; \ + inst=`echo $$i | sed -e 's/\\.[0-9a-z]*$$//'`; \ + inst=`echo $$inst | sed -e 's/^.*\///'`; \ + inst=`echo $$inst | sed '$(transform)'`.$$ext; \ + echo " rm -f '$(DESTDIR)$(man8dir)/$$inst'"; \ + rm -f "$(DESTDIR)$(man8dir)/$$inst"; \ + done + +ID: $(HEADERS) $(SOURCES) $(LISP) $(TAGS_FILES) + list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \ + unique=`for i in $$list; do \ + if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ + done | \ + $(AWK) ' { files[$$0] = 1; } \ + END { for (i in files) print i; }'`; \ + mkid -fID $$unique +tags: TAGS + +TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \ + $(TAGS_FILES) $(LISP) + tags=; \ + here=`pwd`; \ + list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \ + unique=`for i in $$list; do \ + if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ + done | \ + $(AWK) ' { files[$$0] = 1; } \ + END { for (i in files) print i; }'`; \ + if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \ + test -n "$$unique" || unique=$$empty_fix; \ + $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \ + $$tags $$unique; \ + fi +ctags: CTAGS +CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \ + $(TAGS_FILES) $(LISP) + tags=; \ + here=`pwd`; \ + list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \ + unique=`for i in $$list; do \ + if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ + done | \ + $(AWK) ' { files[$$0] = 1; } \ + END { for (i in files) print i; }'`; \ + test -z "$(CTAGS_ARGS)$$tags$$unique" \ + || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \ + $$tags $$unique + +GTAGS: + here=`$(am__cd) $(top_builddir) && pwd` \ + && cd $(top_srcdir) \ + && gtags -i $(GTAGS_ARGS) $$here + +distclean-tags: + -rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags + +distdir: $(DISTFILES) + @srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ + topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ + list='$(DISTFILES)'; \ + dist_files=`for file in $$list; do echo $$file; done | \ + sed -e "s|^$$srcdirstrip/||;t" \ + -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \ + case $$dist_files in \ + */*) $(MKDIR_P) `echo "$$dist_files" | \ + sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \ + sort -u` ;; \ + esac; \ + for file in $$dist_files; do \ + if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \ + if test -d $$d/$$file; then \ + dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \ + if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \ + cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \ + fi; \ + cp -pR $$d/$$file $(distdir)$$dir || exit 1; \ + else \ + test -f $(distdir)/$$file \ + || cp -p $$d/$$file $(distdir)/$$file \ + || exit 1; \ + fi; \ + done +check-am: all-am +check: check-am +all-am: Makefile $(LTLIBRARIES) $(MANS) $(DATA) +installdirs: + for dir in "$(DESTDIR)$(securelibdir)" "$(DESTDIR)$(man8dir)"; do \ + test -z "$$dir" || $(MKDIR_P) "$$dir"; \ + done +install: install-am +install-exec: install-exec-am +install-data: install-data-am +uninstall: uninstall-am + +install-am: all-am + @$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am + +installcheck: installcheck-am +install-strip: + $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ + install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ + `test -z '$(STRIP)' || \ + echo "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'"` install +mostlyclean-generic: + +clean-generic: + -test -z "$(CLEANFILES)" || rm -f $(CLEANFILES) + +distclean-generic: + -test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES) + +maintainer-clean-generic: + @echo "This command is intended for maintainers to use" + @echo "it deletes files that may require special tools to rebuild." +clean: clean-am + +clean-am: clean-generic clean-libtool clean-securelibLTLIBRARIES \ + mostlyclean-am + +distclean: distclean-am + -rm -rf ./$(DEPDIR) + -rm -f Makefile +distclean-am: clean-am distclean-compile distclean-generic \ + distclean-tags + +dvi: dvi-am + +dvi-am: + +html: html-am + +info: info-am + +info-am: + +install-data-am: install-man install-securelibLTLIBRARIES + +install-dvi: install-dvi-am + +install-exec-am: + +install-html: install-html-am + +install-info: install-info-am + +install-man: install-man8 + +install-pdf: install-pdf-am + +install-ps: install-ps-am + +installcheck-am: + +maintainer-clean: maintainer-clean-am + -rm -rf ./$(DEPDIR) + -rm -f Makefile +maintainer-clean-am: distclean-am maintainer-clean-generic + +mostlyclean: mostlyclean-am + +mostlyclean-am: mostlyclean-compile mostlyclean-generic \ + mostlyclean-libtool + +pdf: pdf-am + +pdf-am: + +ps: ps-am + +ps-am: + +uninstall-am: uninstall-man uninstall-securelibLTLIBRARIES + +uninstall-man: uninstall-man8 + +.MAKE: install-am install-strip + +.PHONY: CTAGS GTAGS all all-am check check-am clean clean-generic \ + clean-libtool clean-securelibLTLIBRARIES ctags distclean \ + distclean-compile distclean-generic distclean-libtool \ + distclean-tags distdir dvi dvi-am html html-am info info-am \ + install install-am install-data install-data-am install-dvi \ + install-dvi-am install-exec install-exec-am install-html \ + install-html-am install-info install-info-am install-man \ + install-man8 install-pdf install-pdf-am install-ps \ + install-ps-am install-securelibLTLIBRARIES install-strip \ + installcheck installcheck-am installdirs maintainer-clean \ + maintainer-clean-generic mostlyclean mostlyclean-compile \ + mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \ + tags uninstall uninstall-am uninstall-man uninstall-man8 \ + uninstall-securelibLTLIBRARIES + +@ENABLE_REGENERATE_MAN_TRUE@README: pam_tty_audit.8.xml +@ENABLE_REGENERATE_MAN_TRUE@-include $(top_srcdir)/Make.xml.rules +# Tell versions [3.59,3.63) of GNU make to not export all variables. +# Otherwise a system limit (for SysV at least) may be exceeded. +.NOEXPORT: diff --git a/Linux-PAM/modules/pam_tty_audit/README b/Linux-PAM/modules/pam_tty_audit/README new file mode 100644 index 00000000..ed9369e3 --- /dev/null +++ b/Linux-PAM/modules/pam_tty_audit/README @@ -0,0 +1,48 @@ +pam_tty_audit — Enable or disable TTY auditing for specified users + +â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â” + +DESCRIPTION + +The pam_tty_audit PAM module is used to enable or disable TTY auditing. By +default, the kernel does not audit input on any TTY. + +OPTIONS + +disable=patterns + + For each user matching one of comma-separated glob patterns, disable TTY + auditing. This overrides any previous enable option matchin the same user + name on the command line. + +enable=patterns + + For each user matching one of comma-separated glob patterns, enable TTY + auditing. This overrides any previous disable option matching the same user + name on the command line. + +open_only + + Set the TTY audit flag when opening the session, but do not restore it when + closing the session. Using this option is necessary for some services that + don't fork() to run the authenticated session, such as sudo. + +NOTES + +When TTY auditing is enabled, it is inherited by all processes started by that +user. In particular, daemons restarted by an user will still have TTY auditing +enabled, and audit TTY input even by other users unless auditing for these +users is explicitly disabled. Therefore, it is recommended to use disable=* as +the first option for most daemons using PAM. + +EXAMPLES + +Audit all administrative actions. + +session required pam_tty_audit.so disable=* enable=root + + +AUTHOR + +pam_tty_audit was written by Miloslav TrmaÄ <mitr@redhat.com>. + diff --git a/Linux-PAM/modules/pam_tty_audit/README.xml b/Linux-PAM/modules/pam_tty_audit/README.xml new file mode 100644 index 00000000..4dad6bbe --- /dev/null +++ b/Linux-PAM/modules/pam_tty_audit/README.xml @@ -0,0 +1,41 @@ +<?xml version="1.0" encoding='UTF-8'?> +<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN" +"http://www.docbook.org/xml/4.3/docbookx.dtd"> + +<article> + + <articleinfo> + + <title> + <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" + href="pam_tty_audit.8.xml" xpointer='xpointer(//refnamediv[@id = "pam_tty_audit-name"]/*)'/> + </title> + + </articleinfo> + + <section> + <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" + href="pam_tty_audit.8.xml" xpointer='xpointer(//refsect1[@id = "pam_tty_audit-description"]/*)'/> + </section> + + <section> + <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" + href="pam_tty_audit.8.xml" xpointer='xpointer(//refsect1[@id = "pam_tty_audit-options"]/*)'/> + </section> + + <section> + <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" + href="pam_tty_audit.8.xml" xpointer='xpointer(//refsect1[@id = "pam_tty_audit-notes"]/*)'/> + </section> + + <section> + <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" + href="pam_tty_audit.8.xml" xpointer='xpointer(//refsect1[@id = "pam_tty_audit-examples"]/*)'/> + </section> + + <section> + <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" + href="pam_tty_audit.8.xml" xpointer='xpointer(//refsect1[@id = "pam_tty_audit-author"]/*)'/> + </section> + +</article> diff --git a/Linux-PAM/modules/pam_tty_audit/pam_tty_audit.8 b/Linux-PAM/modules/pam_tty_audit/pam_tty_audit.8 new file mode 100644 index 00000000..5111155c --- /dev/null +++ b/Linux-PAM/modules/pam_tty_audit/pam_tty_audit.8 @@ -0,0 +1,80 @@ +.\" Title: pam_tty_audit +.\" Author: +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 02/04/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual +.\" +.TH "PAM_TTY_AUDIT" "8" "02/04/2008" "Linux-PAM Manual" "Linux\-PAM Manual" +.\" disable hyphenation +.nh +.\" disable justification (adjust text to left margin only) +.ad l +.SH "NAME" +pam_tty_audit - Enable or disable TTY auditing for specified users +.SH "SYNOPSIS" +.HP 17 +\fBpam_tty_audit\.so\fR [disable=\fIpatterns\fR] [enable=\fIpatterns\fR] +.SH "DESCRIPTION" +.PP +The pam_tty_audit PAM module is used to enable or disable TTY auditing\. By default, the kernel does not audit input on any TTY\. +.SH "OPTIONS" +.PP +\fBdisable=\fR\fB\fIpatterns\fR\fR +.RS 4 +For each user matching one of comma\-separated glob +\fB\fIpatterns\fR\fR, disable TTY auditing\. This overrides any previous +\fBenable\fR +option matchin the same user name on the command line\. +.RE +.PP +\fBenable=\fR\fB\fIpatterns\fR\fR +.RS 4 +For each user matching one of comma\-separated glob +\fB\fIpatterns\fR\fR, enable TTY auditing\. This overrides any previous +\fBdisable\fR +option matching the same user name on the command line\. +.RE +.PP +\fBopen_only\fR +.RS 4 +Set the TTY audit flag when opening the session, but do not restore it when closing the session\. Using this option is necessary for some services that don\'t +\fBfork()\fR +to run the authenticated session, such as +\fBsudo\fR\. +.RE +.SH "MODULE SERVICES PROVIDED" +.PP +Only the +\fBsession\fR +service is supported\. +.SH "RETURN VALUES" +.PP +PAM_SESSION_ERR +.RS 4 +Error reading or modifying the TTY audit flag\. See the system log for more details\. +.RE +.PP +PAM_SUCCESS +.RS 4 +Success\. +.RE +.SH "NOTES" +.PP +When TTY auditing is enabled, it is inherited by all processes started by that user\. In particular, daemons restarted by an user will still have TTY auditing enabled, and audit TTY input even by other users unless auditing for these users is explicitly disabled\. Therefore, it is recommended to use +\fBdisable=*\fR +as the first option for most daemons using PAM\. +.SH "EXAMPLES" +.PP +Audit all administrative actions\. +.sp +.RS 4 +.nf +session required pam_tty_audit\.so disable=* enable=root + +.fi +.RE +.sp +.SH "AUTHOR" +.PP +pam_tty_audit was written by Miloslav TrmaÄ <mitr@redhat\.com>\. diff --git a/Linux-PAM/modules/pam_tty_audit/pam_tty_audit.8.xml b/Linux-PAM/modules/pam_tty_audit/pam_tty_audit.8.xml new file mode 100644 index 00000000..f6f0602f --- /dev/null +++ b/Linux-PAM/modules/pam_tty_audit/pam_tty_audit.8.xml @@ -0,0 +1,145 @@ +<?xml version="1.0" encoding='UTF-8'?> +<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN" + "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd"> + +<refentry id="pam_tty_audit"> + + <refmeta> + <refentrytitle>pam_tty_audit</refentrytitle> + <manvolnum>8</manvolnum> + <refmiscinfo class="sectdesc">Linux-PAM Manual</refmiscinfo> + </refmeta> + + <refnamediv id="pam_tty_audit-name"> + <refname>pam_tty_audit</refname> + <refpurpose>Enable or disable TTY auditing for specified users</refpurpose> + </refnamediv> + + <refsynopsisdiv> + <cmdsynopsis id="pam_tty_audit-cmdsynopsis"> + <command>pam_tty_audit.so</command> + <arg choice="opt"> + disable=<replaceable>patterns</replaceable> + </arg> + <arg choice="opt"> + enable=<replaceable>patterns</replaceable> + </arg> + </cmdsynopsis> + </refsynopsisdiv> + + <refsect1 id="pam_tty_audit-description"> + <title>DESCRIPTION</title> + <para> + The pam_tty_audit PAM module is used to enable or disable TTY auditing. + By default, the kernel does not audit input on any TTY. + </para> + </refsect1> + + <refsect1 id="pam_tty_audit-options"> + <title>OPTIONS</title> + <variablelist> + <varlistentry> + <term> + <option>disable=<replaceable>patterns</replaceable></option> + </term> + <listitem> + <para> + For each user matching one of comma-separated glob + <option><replaceable>patterns</replaceable></option>, disable + TTY auditing. This overrides any previous <option>enable</option> + option matchin the same user name on the command line. + </para> + </listitem> + </varlistentry> + <varlistentry> + <term> + <option>enable=<replaceable>patterns</replaceable></option> + </term> + <listitem> + <para> + For each user matching one of comma-separated glob + <option><replaceable>patterns</replaceable></option>, enable + TTY auditing. This overrides any previous <option>disable</option> + option matching the same user name on the command line. + </para> + </listitem> + </varlistentry> + <varlistentry> + <term> + <option>open_only</option> + </term> + <listitem> + <para> + Set the TTY audit flag when opening the session, but do not restore + it when closing the session. Using this option is necessary for + some services that don't <function>fork()</function> to run the + authenticated session, such as <command>sudo</command>. + </para> + </listitem> + </varlistentry> + </variablelist> + </refsect1> + + <refsect1 id="pam_tty_audit-services"> + <title>MODULE SERVICES PROVIDED</title> + <para> + Only the <emphasis remap='B'>session</emphasis> service is supported. + </para> + </refsect1> + + <refsect1 id='pam_tty_audit-return_values'> + <title>RETURN VALUES</title> + <variablelist> + <varlistentry> + <term>PAM_SESSION_ERR</term> + <listitem> + <para> + Error reading or modifying the TTY audit flag. See the system log + for more details. + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term>PAM_SUCCESS</term> + <listitem> + <para> + Success. + </para> + </listitem> + </varlistentry> + + </variablelist> + </refsect1> + + <refsect1 id='pam_tty_audit-notes'> + <title>NOTES</title> + <para> + When TTY auditing is enabled, it is inherited by all processes started by + that user. In particular, daemons restarted by an user will still have + TTY auditing enabled, and audit TTY input even by other users unless + auditing for these users is explicitly disabled. Therefore, it is + recommended to use <option>disable=*</option> as the first option for + most daemons using PAM. + </para> + </refsect1> + + <refsect1 id='pam_tty_audit-examples'> + <title>EXAMPLES</title> + <para> + Audit all administrative actions. + <programlisting> +session required pam_tty_audit.so disable=* enable=root + </programlisting> + </para> + </refsect1> + + <refsect1 id='pam_tty_audit-author'> + <title>AUTHOR</title> + <para> + pam_tty_audit was written by Miloslav Trmač + <mitr@redhat.com>. + </para> + </refsect1> + +</refentry> diff --git a/Linux-PAM/modules/pam_tty_audit/pam_tty_audit.c b/Linux-PAM/modules/pam_tty_audit/pam_tty_audit.c new file mode 100644 index 00000000..d57dbbe3 --- /dev/null +++ b/Linux-PAM/modules/pam_tty_audit/pam_tty_audit.c @@ -0,0 +1,346 @@ +/* Copyright © 2007, 2008 Red Hat, Inc. All rights reserved. + Red Hat author: Miloslav TrmaÄ <mitr@redhat.com> + + Redistribution and use in source and binary forms of Linux-PAM, with + or without modification, are permitted provided that the following + conditions are met: + + 1. Redistributions of source code must retain any existing copyright + notice, and this entire permission notice in its entirety, + including the disclaimer of warranties. + + 2. Redistributions in binary form must reproduce all prior and current + copyright notices, this list of conditions, and the following + disclaimer in the documentation and/or other materials provided + with the distribution. + + 3. The name of any author may not be used to endorse or promote + products derived from this software without their specific prior + written permission. + + ALTERNATIVELY, this product may be distributed under the terms of the + GNU General Public License, in which case the provisions of the GNU + GPL are required INSTEAD OF the above restrictions. (This clause is + necessary due to a potential conflict between the GNU GPL and the + restrictions contained in a BSD-style copyright.) + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED + WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF + MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. + IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT, + INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, + BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS + OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND + ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR + TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE + USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH + DAMAGE. */ + +#include <errno.h> +#include <fnmatch.h> +#include <stdlib.h> +#include <string.h> +#include <syslog.h> +#include <sys/socket.h> +#include <unistd.h> + +#include <libaudit.h> +#include <linux/netlink.h> + +#define PAM_SM_SESSION + +#include <security/pam_ext.h> +#include <security/pam_modules.h> +#include <security/pam_modutil.h> + +#define DATANAME "pam_tty_audit_last_state" + +/* Open an audit netlink socket */ +static int +nl_open (void) +{ + return socket (AF_NETLINK, SOCK_RAW, NETLINK_AUDIT); +} + +static int +nl_send (int fd, unsigned type, unsigned flags, const void *data, size_t size) +{ + struct sockaddr_nl addr; + struct msghdr msg; + struct nlmsghdr nlm; + struct iovec iov[2]; + ssize_t res; + + nlm.nlmsg_len = NLMSG_LENGTH (size); + nlm.nlmsg_type = type; + nlm.nlmsg_flags = NLM_F_REQUEST | flags; + nlm.nlmsg_seq = 0; + nlm.nlmsg_pid = 0; + iov[0].iov_base = &nlm; + iov[0].iov_len = sizeof (nlm); + iov[1].iov_base = (void *)data; + iov[1].iov_len = size; + addr.nl_family = AF_NETLINK; + addr.nl_pid = 0; + addr.nl_groups = 0; + msg.msg_name = &addr; + msg.msg_namelen = sizeof (addr); + msg.msg_iov = iov; + msg.msg_iovlen = 2; + msg.msg_control = NULL; + msg.msg_controllen = 0; + msg.msg_flags = 0; + res = sendmsg (fd, &msg, 0); + if (res == -1) + return -1; + if ((size_t)res != nlm.nlmsg_len) + { + errno = EIO; + return -1; + } + return 0; +} + +static int +nl_recv (int fd, unsigned type, void *buf, size_t size) +{ + struct sockaddr_nl addr; + struct msghdr msg; + struct nlmsghdr nlm; + struct iovec iov[2]; + ssize_t res; + + again: + iov[0].iov_base = &nlm; + iov[0].iov_len = sizeof (nlm); + msg.msg_name = &addr; + msg.msg_namelen = sizeof (addr); + msg.msg_iov = iov; + msg.msg_iovlen = 1; + msg.msg_control = NULL; + msg.msg_controllen = 0; + if (type != NLMSG_ERROR) + { + res = recvmsg (fd, &msg, MSG_PEEK); + if (res == -1) + return -1; + if (res != NLMSG_LENGTH (0)) + { + errno = EIO; + return -1; + } + if (nlm.nlmsg_type == NLMSG_ERROR) + { + struct nlmsgerr err; + + iov[1].iov_base = &err; + iov[1].iov_len = sizeof (err); + msg.msg_iovlen = 2; + res = recvmsg (fd, &msg, 0); + if (res == -1) + return -1; + if ((size_t)res != NLMSG_LENGTH (sizeof (err)) + || nlm.nlmsg_type != NLMSG_ERROR) + { + errno = EIO; + return -1; + } + if (err.error == 0) + goto again; + errno = -err.error; + return -1; + } + } + if (size != 0) + { + iov[1].iov_base = buf; + iov[1].iov_len = size; + msg.msg_iovlen = 2; + } + res = recvmsg (fd, &msg, 0); + if (res == -1) + return -1; + if ((size_t)res != NLMSG_LENGTH (size) + || nlm.nlmsg_type != type) + { + errno = EIO; + return -1; + } + return 0; +} + +static int +nl_recv_ack (int fd) +{ + struct nlmsgerr err; + + if (nl_recv (fd, NLMSG_ERROR, &err, sizeof (err)) != 0) + return -1; + if (err.error != 0) + { + errno = -err.error; + return -1; + } + return 0; +} + +static void +cleanup_old_status (pam_handle_t *pamh, void *data, int error_status) +{ + (void)pamh; + (void)error_status; + free (data); +} + +int +pam_sm_open_session (pam_handle_t *pamh, int flags, int argc, const char **argv) +{ + enum command { CMD_NONE, CMD_ENABLE, CMD_DISABLE }; + + enum command command; + struct audit_tty_status *old_status, new_status; + const char *user; + int i, fd, open_only; + + (void)flags; + + if (pam_get_user (pamh, &user, NULL) != PAM_SUCCESS) + { + pam_syslog (pamh, LOG_ERR, "error determining target user's name"); + return PAM_SESSION_ERR; + } + + command = CMD_NONE; + open_only = 0; + for (i = 0; i < argc; i++) + { + if (strncmp (argv[i], "enable=", 7) == 0 + || strncmp (argv[i], "disable=", 8) == 0) + { + enum command this_command; + char *copy, *tok_data, *tok; + + this_command = *argv[i] == 'e' ? CMD_ENABLE : CMD_DISABLE; + copy = strdup (strchr (argv[i], '=') + 1); + if (copy == NULL) + return PAM_SESSION_ERR; + for (tok = strtok_r (copy, ",", &tok_data); tok != NULL; + tok = strtok_r (NULL, ",", &tok_data)) + { + if (fnmatch (tok, user, 0) == 0) + { + command = this_command; + break; + } + } + free (copy); + } + else if (strcmp (argv[i], "open_only") == 0) + open_only = 1; + else + { + pam_syslog (pamh, LOG_ERR, "unknown option `%s'", argv[i]); + return PAM_SESSION_ERR; + } + } + if (command == CMD_NONE) + return PAM_SUCCESS; + + old_status = malloc (sizeof (*old_status)); + if (old_status == NULL) + return PAM_SESSION_ERR; + + fd = nl_open (); + if (fd == -1 + || nl_send (fd, AUDIT_TTY_GET, 0, NULL, 0) != 0 + || nl_recv (fd, AUDIT_TTY_GET, old_status, sizeof (*old_status)) != 0) + { + pam_syslog (pamh, LOG_ERR, "error reading current audit status: %m"); + if (fd != -1) + close (fd); + free (old_status); + return PAM_SESSION_ERR; + } + + new_status.enabled = (command == CMD_ENABLE ? 1 : 0); + if (old_status->enabled == new_status.enabled) + { + free (old_status); + goto ok_fd; + } + + if (open_only == 0 + && pam_set_data (pamh, DATANAME, old_status, cleanup_old_status) + != PAM_SUCCESS) + { + pam_syslog (pamh, LOG_ERR, "error saving old audit status"); + close (fd); + free (old_status); + return PAM_SESSION_ERR; + } + + if (nl_send (fd, AUDIT_TTY_SET, NLM_F_ACK, &new_status, + sizeof (new_status)) != 0 + || nl_recv_ack (fd) != 0) + { + pam_syslog (pamh, LOG_ERR, "error setting current audit status: %m"); + close (fd); + if (open_only != 0) + free (old_status); + return PAM_SESSION_ERR; + } + /* Fall through */ + ok_fd: + close (fd); + pam_syslog (pamh, LOG_DEBUG, "changed status from %d to %d", + old_status->enabled, new_status.enabled); + if (open_only != 0) + free (old_status); + return PAM_SUCCESS; +} + +int +pam_sm_close_session (pam_handle_t *pamh, int flags, int argc, + const char **argv) +{ + const void *status_; + + (void)flags; + (void)argc; + (void)argv; + if (pam_get_data (pamh, DATANAME, &status_) == PAM_SUCCESS) + { + const struct audit_tty_status *status; + int fd; + + status = status_; + + fd = nl_open (); + if (fd == -1 + || nl_send (fd, AUDIT_TTY_SET, NLM_F_ACK, status, + sizeof (*status)) != 0 + || nl_recv_ack (fd) != 0) + { + pam_syslog (pamh, LOG_ERR, "error restoring audit status: %m"); + if (fd != -1) + close (fd); + return PAM_SESSION_ERR; + } + close (fd); + pam_syslog (pamh, LOG_ERR, "restored status to %d", status->enabled); + } + return PAM_SUCCESS; +} + +/* static module data */ +#ifdef PAM_STATIC +struct pam_module _pam_tty_audit_modstruct = { + "pam_tty_audit", + NULL, + NULL, + NULL, + pam_sm_open_session, + pam_sm_close_session, + NULL +}; +#endif diff --git a/Linux-PAM/modules/pam_umask/pam_umask.8 b/Linux-PAM/modules/pam_umask/pam_umask.8 index 43160d63..8c0a7fb0 100644 --- a/Linux-PAM/modules/pam_umask/pam_umask.8 +++ b/Linux-PAM/modules/pam_umask/pam_umask.8 @@ -1,86 +1,106 @@ .\" Title: pam_umask .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/> -.\" Date: 08/06/2006 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "PAM_UMASK" "8" "08/06/2006" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_UMASK" "8" "01/08/2008" "Linux-PAM Manual" "Linux\-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_umask \- PAM module to set the file mode creation mask +pam_umask - PAM module to set the file mode creation mask .SH "SYNOPSIS" .HP 13 -\fBpam_umask.so\fR [debug] [silent] [usergroups] [umask=\fImask\fR] +\fBpam_umask\.so\fR [debug] [silent] [usergroups] [umask=\fImask\fR] .SH "DESCRIPTION" .PP -pam_umask is a PAM module to set the file mode creation mask of the current environment. The umask affects the default permissions assigned to newly created files. +pam_umask is a PAM module to set the file mode creation mask of the current environment\. The umask affects the default permissions assigned to newly created files\. .PP The PAM module tries to get the umask value from the following places in the following order: -.TP 3n -\(bu -umask= argument -.TP 3n -\(bu -umask= entry of the users GECOS field -.TP 3n -\(bu -pri= entry of the users GECOS field -.TP 3n -\(bu -ulimit= entry of the users GECOS field -.TP 3n -\(bu -UMASK= entry from /etc/default/login -.TP 3n -\(bu -UMASK entry from /etc/login.defs +.sp +.RS 4 +\h'-04'\(bu\h'+03'umask= argument +.RE +.sp +.RS 4 +\h'-04'\(bu\h'+03'umask= entry of the users GECOS field +.RE +.sp +.RS 4 +\h'-04'\(bu\h'+03'pri= entry of the users GECOS field +.RE +.sp +.RS 4 +\h'-04'\(bu\h'+03'ulimit= entry of the users GECOS field +.RE +.sp +.RS 4 +\h'-04'\(bu\h'+03'UMASK= entry from /etc/default/login +.RE +.sp +.RS 4 +\h'-04'\(bu\h'+03'UMASK entry from /etc/login\.defs +.RE .sp .RE .SH "OPTIONS" .PP -.TP 3n +.PP \fBdebug\fR -Print debug information. -.TP 3n +.RS 4 +Print debug information\. +.RE +.PP \fBsilent\fR -Don't print informative messages. -.TP 3n +.RS 4 +Don\'t print informative messages\. +.RE +.PP \fBusergroups\fR -If the user is not root, and the user ID is equal to the group ID, and the username is the same as primary group name, the umask group bits are set to be the same as owner bits (examples: 022 \-> 002, 077 \-> 007). -.TP 3n +.RS 4 +If the user is not root, and the user ID is equal to the group ID, and the username is the same as primary group name, the umask group bits are set to be the same as owner bits (examples: 022 \-> 002, 077 \-> 007)\. +.RE +.PP \fBumask=\fR\fB\fImask\fR\fR -Sets the calling process's file mode creation mask (umask) to +.RS 4 +Sets the calling process\'s file mode creation mask (umask) to \fBmask\fR -& 0777. The value is interpreted as Octal. +& 0777\. The value is interpreted as Octal\. +.RE .SH "MODULE SERVICES PROVIDED" .PP Only the \fBsession\fR -service is supported. +service is supported\. .SH "RETURN VALUES" .PP -.TP 3n +.PP PAM_SUCCESS -The new umask was set successfull. -.TP 3n +.RS 4 +The new umask was set successfull\. +.RE +.PP PAM_SERVICE_ERR -No username was given. -.TP 3n +.RS 4 +No username was given\. +.RE +.PP PAM_USER_UNKNOWN -User not known. +.RS 4 +User not known\. +.RE .SH "EXAMPLES" .PP Add the following line to -\fI/etc/pam.d/login\fR +\fI/etc/pam\.d/login\fR to set the user specific umask at login: .sp -.RS 3n +.RS 4 .nf - session optional pam_umask.so umask=0022 + session optional pam_umask\.so umask=0022 .fi .RE @@ -93,4 +113,4 @@ to set the user specific umask at login: \fBpam\fR(8) .SH "AUTHOR" .PP -pam_umask was written by Thorsten Kukuk <kukuk@thkukuk.de>. +pam_umask was written by Thorsten Kukuk <kukuk@thkukuk\.de>\. diff --git a/Linux-PAM/modules/pam_unix/Makefile.am b/Linux-PAM/modules/pam_unix/Makefile.am index f9d77f4c..4d2c58b8 100644 --- a/Linux-PAM/modules/pam_unix/Makefile.am +++ b/Linux-PAM/modules/pam_unix/Makefile.am @@ -7,8 +7,8 @@ CLEANFILES = *~ EXTRA_DIST = README md5.c md5_crypt.c lckpwdf.-c $(MANS) CHANGELOG \ tst-pam_unix $(XMLS) -man_MANS = pam_unix.8 unix_chkpwd.8 -XMLS = README.xml pam_unix.8.xml +man_MANS = pam_unix.8 unix_chkpwd.8 unix_update.8 +XMLS = README.xml pam_unix.8.xml unix_chkpwd.8.xml unix_update.8.xml TESTS = tst-pam_unix @@ -16,7 +16,8 @@ securelibdir = $(SECUREDIR) secureconfdir = $(SCONFIGDIR) AM_CFLAGS = -I$(top_srcdir)/libpam/include -I$(top_srcdir)/libpamc/include \ - -DCHKPWD_HELPER=\"$(sbindir)/unix_chkpwd\" + -DCHKPWD_HELPER=\"$(sbindir)/unix_chkpwd\" \ + -DUPDATE_HELPER=\"$(sbindir)/unix_update\" if HAVE_LIBSELINUX AM_CFLAGS += -D"WITH_SELINUX" @@ -34,24 +35,31 @@ pam_unix_la_LIBADD = @LIBCRACK@ @LIBNSL@ -L$(top_builddir)/libpam -lpam \ securelib_LTLIBRARIES = pam_unix.la -noinst_HEADERS = md5.h support.h yppasswd.h bigcrypt.h +noinst_HEADERS = md5.h support.h yppasswd.h bigcrypt.h passverify.h -sbin_PROGRAMS = unix_chkpwd +sbin_PROGRAMS = unix_chkpwd unix_update noinst_PROGRAMS = bigcrypt pam_unix_la_SOURCES = bigcrypt.c pam_unix_acct.c \ pam_unix_auth.c pam_unix_passwd.c pam_unix_sess.c support.c \ - yppasswd_xdr.c md5_good.c md5_broken.c + passverify.c yppasswd_xdr.c md5_good.c md5_broken.c bigcrypt_SOURCES = bigcrypt.c bigcrypt_main.c bigcrypt_CFLAGS = $(AM_CFLAGS) bigcrypt_LDADD = @LIBCRYPT@ -unix_chkpwd_SOURCES = unix_chkpwd.c md5_good.c md5_broken.c bigcrypt.c -unix_chkpwd_CFLAGS = $(AM_CFLAGS) @PIE_CFLAGS@ +unix_chkpwd_SOURCES = unix_chkpwd.c md5_good.c md5_broken.c bigcrypt.c \ + passverify.c +unix_chkpwd_CFLAGS = $(AM_CFLAGS) @PIE_CFLAGS@ -DHELPER_COMPILE=\"unix_chkpwd\" unix_chkpwd_LDFLAGS = @PIE_LDFLAGS@ -unix_chkpwd_LDADD = -L$(top_builddir)/libpam -lpam @LIBCRYPT@ @LIBSELINUX@ +unix_chkpwd_LDADD = @LIBCRYPT@ @LIBSELINUX@ + +unix_update_SOURCES = unix_update.c md5_good.c md5_broken.c bigcrypt.c \ + passverify.c +unix_update_CFLAGS = $(AM_CFLAGS) @PIE_CFLAGS@ -DHELPER_COMPILE=\"unix_update\" +unix_update_LDFLAGS = @PIE_LDFLAGS@ +unix_update_LDADD = @LIBCRYPT@ @LIBSELINUX@ if ENABLE_REGENERATE_MAN noinst_DATA = README diff --git a/Linux-PAM/modules/pam_unix/README b/Linux-PAM/modules/pam_unix/README index 3421eb31..fb2efab4 100644 --- a/Linux-PAM/modules/pam_unix/README +++ b/Linux-PAM/modules/pam_unix/README @@ -114,6 +114,23 @@ bigcrypt When a user changes their password next, encrypt it with the DEC C2 algorithm. +sha256 + + When a user changes their password next, encrypt it with the SHA256 + algorithm. If the SHA256 algorithm is not known to the libcrypt, fall back + to MD5. + +sha512 + + When a user changes their password next, encrypt it with the SHA512 + algorithm. If the SHA512 algorithm is not known to the libcrypt, fall back + to MD5. + +rounds=n + + Set the optional number of rounds of the SHA256 and SHA512 password hashing + algorithms to n. + broken_shadow Ignore errors reading shadow inforation for users in the account management diff --git a/Linux-PAM/modules/pam_unix/bigcrypt.c b/Linux-PAM/modules/pam_unix/bigcrypt.c index d825bc71..9cd55384 100644 --- a/Linux-PAM/modules/pam_unix/bigcrypt.c +++ b/Linux-PAM/modules/pam_unix/bigcrypt.c @@ -51,7 +51,9 @@ char *bigcrypt(const char *key, const char *salt) { char *dec_c2_cryptbuf; - +#ifdef HAVE_CRYPT_R + struct crypt_data *cdata; +#endif unsigned long int keylen, n_seg, j; char *cipher_ptr, *plaintext_ptr, *tmp_ptr, *salt_ptr; char keybuf[KEYBUF_SIZE + 1]; @@ -63,6 +65,14 @@ char *bigcrypt(const char *key, const char *salt) if (!dec_c2_cryptbuf) { return NULL; } +#ifdef HAVE_CRYPT_R + cdata = malloc(sizeof(*cdata)); + if(!cdata) { + free(dec_c2_cryptbuf); + return NULL; + } + cdata->initialized = 0; +#endif memset(keybuf, 0, KEYBUF_SIZE + 1); memset(dec_c2_cryptbuf, 0, CBUF_SIZE); @@ -92,8 +102,11 @@ char *bigcrypt(const char *key, const char *salt) plaintext_ptr = keybuf; /* do the first block with supplied salt */ +#ifdef HAVE_CRYPT_R + tmp_ptr = crypt_r(plaintext_ptr, salt, cdata); /* libc crypt_r() */ +#else tmp_ptr = crypt(plaintext_ptr, salt); /* libc crypt() */ - +#endif /* and place in the static area */ strncpy(cipher_ptr, tmp_ptr, 13); cipher_ptr += ESEGMENT_SIZE + SALT_SIZE; @@ -110,7 +123,11 @@ char *bigcrypt(const char *key, const char *salt) if (n_seg > 1) { for (j = 2; j <= n_seg; j++) { +#ifdef HAVE_CRYPT_R + tmp_ptr = crypt_r(plaintext_ptr, salt_ptr, cdata); +#else tmp_ptr = crypt(plaintext_ptr, salt_ptr); +#endif /* skip the salt for seg!=0 */ strncpy(cipher_ptr, (tmp_ptr + SALT_SIZE), ESEGMENT_SIZE); @@ -122,7 +139,10 @@ char *bigcrypt(const char *key, const char *salt) } D(("key=|%s|, salt=|%s|\nbuf=|%s|\n", key, salt, dec_c2_cryptbuf)); - /* this is the <NUL> terminated encrypted password */ +#ifdef HAVE_CRYPT_R + free(cdata); +#endif + /* this is the <NUL> terminated encrypted password */ return dec_c2_cryptbuf; } diff --git a/Linux-PAM/modules/pam_unix/pam_unix.8 b/Linux-PAM/modules/pam_unix/pam_unix.8 index e57de221..d826a4a9 100644 --- a/Linux-PAM/modules/pam_unix/pam_unix.8 +++ b/Linux-PAM/modules/pam_unix/pam_unix.8 @@ -1,133 +1,179 @@ .\" Title: pam_unix .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/> -.\" Date: 09/20/2006 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/28/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "PAM_UNIX" "8" "09/20/2006" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_UNIX" "8" "01/28/2008" "Linux-PAM Manual" "Linux\-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_unix \- Module for traditional password authentication +pam_unix - Module for traditional password authentication .SH "SYNOPSIS" .HP 12 -\fBpam_unix.so\fR [...] +\fBpam_unix\.so\fR [\.\.\.] .SH "DESCRIPTION" .PP -This is the standard Unix authentication module. It uses standard calls from the system's libraries to retrieve and set account information as well as authentication. Usually this is obtained from the /etc/passwd and the /etc/shadow file as well if shadow is enabled. +This is the standard Unix authentication module\. It uses standard calls from the system\'s libraries to retrieve and set account information as well as authentication\. Usually this is obtained from the /etc/passwd and the /etc/shadow file as well if shadow is enabled\. .PP -The account component performs the task of establishing the status of the user's account and password based on the following +The account component performs the task of establishing the status of the user\'s account and password based on the following \fIshadow\fR -elements: expire, last_change, max_change, min_change, warn_change. In the case of the latter, it may offer advice to the user on changing their password or, through the +elements: expire, last_change, max_change, min_change, warn_change\. In the case of the latter, it may offer advice to the user on changing their password or, through the \fBPAM_AUTHTOKEN_REQD\fR -return, delay giving service to the user until they have established a new password. The entries listed above are documented in the +return, delay giving service to the user until they have established a new password\. The entries listed above are documented in the \fBshadow\fR(5) -manual page. Should the user's record not contain one or more of these entries, the corresponding +manual page\. Should the user\'s record not contain one or more of these entries, the corresponding \fIshadow\fR -check is not performed. +check is not performed\. .PP -The authentication component performs the task of checking the users credentials (password). The default action of this module is to not permit the user access to a service if their official password is blank. +The authentication component performs the task of checking the users credentials (password)\. The default action of this module is to not permit the user access to a service if their official password is blank\. .PP A helper binary, -\fBunix_chkpwd\fR(8), is provided to check the user's password when it is stored in a read protected database. This binary is very simple and will only check the password of the user invoking it. It is called transparently on behalf of the user by the authenticating component of this module. In this way it is possible for applications like +\fBunix_chkpwd\fR(8), is provided to check the user\'s password when it is stored in a read protected database\. This binary is very simple and will only check the password of the user invoking it\. It is called transparently on behalf of the user by the authenticating component of this module\. In this way it is possible for applications like \fBxlock\fR(1) -to work without being setuid\-root. The module, by default, will temporarily turn off SIGCHLD handling for the duration of execution of the helper binary. This is generally the right thing to do, as many applications are not prepared to handle this signal from a child they didn't know was -\fBfork()\fRd. The +to work without being setuid\-root\. The module, by default, will temporarily turn off SIGCHLD handling for the duration of execution of the helper binary\. This is generally the right thing to do, as many applications are not prepared to handle this signal from a child they didn\'t know was +\fBfork()\fRd\. The \fBnoreap\fR -module argument can be used to suppress this temporary shielding and may be needed for use with certain applications. +module argument can be used to suppress this temporary shielding and may be needed for use with certain applications\. .PP -The password component of this module performs the task of updating the user's password. +The password component of this module performs the task of updating the user\'s password\. .PP -The session component of this module logs when a user logins or leave the system. +The session component of this module logs when a user logins or leave the system\. .PP -Remaining arguments, supported by others functions of this module, are silently ignored. Other arguments are logged as errors through -\fBsyslog\fR(3). +Remaining arguments, supported by others functions of this module, are silently ignored\. Other arguments are logged as errors through +\fBsyslog\fR(3)\. .SH "OPTIONS" -.TP 3n +.PP \fBdebug\fR +.RS 4 Turns on debugging via -\fBsyslog\fR(3). -.TP 3n +\fBsyslog\fR(3)\. +.RE +.PP \fBaudit\fR -A little more extreme than debug. -.TP 3n +.RS 4 +A little more extreme than debug\. +.RE +.PP \fBnullok\fR -The default action of this module is to not permit the user access to a service if their official password is blank. The +.RS 4 +The default action of this module is to not permit the user access to a service if their official password is blank\. The \fBnullok\fR -argument overrides this default. -.TP 3n +argument overrides this default\. +.RE +.PP \fBtry_first_pass\fR -Before prompting the user for their password, the module first tries the previous stacked module's password in case that satisfies this module as well. -.TP 3n +.RS 4 +Before prompting the user for their password, the module first tries the previous stacked module\'s password in case that satisfies this module as well\. +.RE +.PP \fBuse_first_pass\fR +.RS 4 The argument \fBuse_first_pass\fR -forces the module to use a previous stacked modules password and will never prompt the user \- if no password is available or the password is not appropriate, the user will be denied access. -.TP 3n +forces the module to use a previous stacked modules password and will never prompt the user \- if no password is available or the password is not appropriate, the user will be denied access\. +.RE +.PP \fBnodelay\fR -This argument can be used to discourage the authentication component from requesting a delay should the authentication as a whole fail. The default action is for the module to request a delay\-on\-failure of the order of two second. -.TP 3n +.RS 4 +This argument can be used to discourage the authentication component from requesting a delay should the authentication as a whole fail\. The default action is for the module to request a delay\-on\-failure of the order of two second\. +.RE +.PP \fBuse_authtok\fR +.RS 4 When password changing enforce the module to set the new password to the one provided by a previously stacked \fBpassword\fR module (this is used in the example of the stacking of the \fBpam_cracklib\fR -module documented above). -.TP 3n +module documented above)\. +.RE +.PP \fBnot_set_pass\fR -This argument is used to inform the module that it is not to pay attention to/make available the old or new passwords from/to other (stacked) password modules. -.TP 3n +.RS 4 +This argument is used to inform the module that it is not to pay attention to/make available the old or new passwords from/to other (stacked) password modules\. +.RE +.PP \fBnis\fR -NIS RPC is used for setting new passwords. -.TP 3n +.RS 4 +NIS RPC is used for setting new passwords\. +.RE +.PP \fBremember=\fR\fB\fIn\fR\fR +.RS 4 The last \fIn\fR passwords for each user are saved in \fI/etc/security/opasswd\fR -in order to force password change history and keep the user from alternating between the same password too frequently. -.TP 3n +in order to force password change history and keep the user from alternating between the same password too frequently\. +.RE +.PP \fBshadow\fR -Try to maintain a shadow based system. -.TP 3n +.RS 4 +Try to maintain a shadow based system\. +.RE +.PP \fBmd5\fR -When a user changes their password next, encrypt it with the MD5 algorithm. -.TP 3n +.RS 4 +When a user changes their password next, encrypt it with the MD5 algorithm\. +.RE +.PP \fBbigcrypt\fR -When a user changes their password next, encrypt it with the DEC C2 algorithm. -.TP 3n +.RS 4 +When a user changes their password next, encrypt it with the DEC C2 algorithm\. +.RE +.PP +\fBsha256\fR +.RS 4 +When a user changes their password next, encrypt it with the SHA256 algorithm\. If the SHA256 algorithm is not known to the libcrypt, fall back to MD5\. +.RE +.PP +\fBsha512\fR +.RS 4 +When a user changes their password next, encrypt it with the SHA512 algorithm\. If the SHA512 algorithm is not known to the libcrypt, fall back to MD5\. +.RE +.PP +\fBrounds=\fR\fB\fIn\fR\fR +.RS 4 +Set the optional number of rounds of the SHA256 and SHA512 password hashing algorithms to +\fIn\fR\. +.RE +.PP \fBbroken_shadow\fR -Ignore errors reading shadow inforation for users in the account management module. +.RS 4 +Ignore errors reading shadow inforation for users in the account management module\. +.RE .PP Invalid arguments are logged with -\fBsyslog\fR(3). +\fBsyslog\fR(3)\. .SH "MODULE SERVICES PROVIDED" .PP -All service are supported. +All service are supported\. .SH "RETURN VALUES" -.TP 3n +.PP PAM_IGNORE -Ignore this module. +.RS 4 +Ignore this module\. +.RE .SH "EXAMPLES" .PP An example usage for -\fI/etc/pam.d/login\fR +\fI/etc/pam\.d/login\fR would be: .sp -.RS 3n +.RS 4 .nf # Authenticate the user -auth required pam_unix.so +auth required pam_unix\.so # Ensure users account and password are still active -account required pam_unix.so +account required pam_unix\.so # Change the users password, but at first check the strength # with pam_cracklib(8) -password required pam_cracklib.so retry=3 minlen=6 difok=3 -password required pam_unix.so use_authtok nullok md5 -session required pam_unix.so +password required pam_cracklib\.so retry=3 minlen=6 difok=3 +password required pam_unix\.so use_authtok nullok md5 +session required pam_unix\.so .fi .RE @@ -140,4 +186,4 @@ session required pam_unix.so \fBpam\fR(8) .SH "AUTHOR" .PP -pam_unix was written by various people. +pam_unix was written by various people\. diff --git a/Linux-PAM/modules/pam_unix/pam_unix.8.xml b/Linux-PAM/modules/pam_unix/pam_unix.8.xml index 41757977..290cb2b9 100644 --- a/Linux-PAM/modules/pam_unix/pam_unix.8.xml +++ b/Linux-PAM/modules/pam_unix/pam_unix.8.xml @@ -260,6 +260,43 @@ </varlistentry> <varlistentry> <term> + <option>sha256</option> + </term> + <listitem> + <para> + When a user changes their password next, + encrypt it with the SHA256 algorithm. If the + SHA256 algorithm is not known to the libcrypt, + fall back to MD5. + </para> + </listitem> + </varlistentry> + <varlistentry> + <term> + <option>sha512</option> + </term> + <listitem> + <para> + When a user changes their password next, + encrypt it with the SHA512 algorithm. If the + SHA512 algorithm is not known to the libcrypt, + fall back to MD5. + </para> + </listitem> + </varlistentry> + <varlistentry> + <term> + <option>rounds=<replaceable>n</replaceable></option> + </term> + <listitem> + <para> + Set the optional number of rounds of the SHA256 and SHA512 + password hashing algorithms to <replaceable>n</replaceable>. + </para> + </listitem> + </varlistentry> + <varlistentry> + <term> <option>broken_shadow</option> </term> <listitem> diff --git a/Linux-PAM/modules/pam_unix/pam_unix_acct.c b/Linux-PAM/modules/pam_unix/pam_unix_acct.c index cb2550df..c09bc175 100644 --- a/Linux-PAM/modules/pam_unix/pam_unix_acct.c +++ b/Linux-PAM/modules/pam_unix/pam_unix_acct.c @@ -47,10 +47,6 @@ #include <time.h> /* for time() */ #include <errno.h> #include <sys/wait.h> -#ifdef WITH_SELINUX -#include <selinux/selinux.h> -#define SELINUX_ENABLED is_selinux_enabled()>0 -#endif #include <security/_pam_macros.h> @@ -63,12 +59,10 @@ #include <security/pam_modutil.h> #include "support.h" +#include "passverify.h" -#ifdef WITH_SELINUX - -struct spwd spwd; - -struct spwd *_unix_run_verify_binary(pam_handle_t *pamh, unsigned int ctrl, const char *user) +int _unix_run_verify_binary(pam_handle_t *pamh, unsigned int ctrl, + const char *user, int *daysleft) { int retval=0, child, fds[2]; void (*sighandler)(int) = NULL; @@ -78,7 +72,7 @@ struct spwd *_unix_run_verify_binary(pam_handle_t *pamh, unsigned int ctrl, cons if (pipe(fds) != 0) { D(("could not make pipe")); pam_syslog(pamh, LOG_ERR, "Could not make pipe: %m"); - return NULL; + return PAM_AUTH_ERR; } D(("called.")); @@ -117,7 +111,7 @@ struct spwd *_unix_run_verify_binary(pam_handle_t *pamh, unsigned int ctrl, cons } } - if (SELINUX_ENABLED && geteuid() == 0) { + if (geteuid() == 0) { /* must set the real uid to 0 so the helper will not error out if pam is called from setuid binary (su, sudo...) */ setuid(0); @@ -126,7 +120,7 @@ struct spwd *_unix_run_verify_binary(pam_handle_t *pamh, unsigned int ctrl, cons /* exec binary helper */ args[0] = x_strdup(CHKPWD_HELPER); args[1] = x_strdup(user); - args[2] = x_strdup("verify"); + args[2] = x_strdup("chkexpiry"); execve(CHKPWD_HELPER, args, envp); @@ -134,11 +128,12 @@ struct spwd *_unix_run_verify_binary(pam_handle_t *pamh, unsigned int ctrl, cons /* should not get here: exit with error */ close (fds[1]); D(("helper binary is not available")); + printf("-1\n"); exit(PAM_AUTHINFO_UNAVAIL); } else { close(fds[1]); if (child > 0) { - char buf[1024]; + char buf[32]; int rc=0; rc=waitpid(child, &retval, 0); /* wait for helper to complete */ if (rc<0) { @@ -146,22 +141,16 @@ struct spwd *_unix_run_verify_binary(pam_handle_t *pamh, unsigned int ctrl, cons retval = PAM_AUTH_ERR; } else { retval = WEXITSTATUS(retval); - if (retval != PAM_AUTHINFO_UNAVAIL) { - rc = pam_modutil_read(fds[0], buf, sizeof(buf) - 1); - if(rc > 0) { + rc = pam_modutil_read(fds[0], buf, sizeof(buf) - 1); + if(rc > 0) { buf[rc] = '\0'; - if (sscanf(buf,"%ld:%ld:%ld:%ld:%ld:%ld", - &spwd.sp_lstchg, /* last password change */ - &spwd.sp_min, /* days until change allowed. */ - &spwd.sp_max, /* days before change required */ - &spwd.sp_warn, /* days warning for expiration */ - &spwd.sp_inact, /* days before account inactive */ - &spwd.sp_expire) /* date when account expires */ != 6 ) retval = PAM_AUTH_ERR; + if (sscanf(buf,"%d", daysleft) != 1 ) + retval = PAM_AUTH_ERR; } - else { - pam_syslog(pamh, LOG_ERR, " ERROR %d: %m", rc); retval = PAM_AUTH_ERR; + else { + pam_syslog(pamh, LOG_ERR, "read unix_chkpwd output error %d: %m", rc); + retval = PAM_AUTH_ERR; } - } } } else { pam_syslog(pamh, LOG_ERR, "Fork failed: %m"); @@ -174,15 +163,9 @@ struct spwd *_unix_run_verify_binary(pam_handle_t *pamh, unsigned int ctrl, cons (void) signal(SIGCHLD, sighandler); /* restore old signal handler */ } D(("Returning %d",retval)); - if (retval != PAM_SUCCESS) { - return NULL; - } - return &spwd; + return retval; } -#endif - - /* * PAM framework looks for this entry-point to pass control to the * account management module. @@ -195,14 +178,13 @@ PAM_EXTERN int pam_sm_acct_mgmt(pam_handle_t * pamh, int flags, const void *void_uname; const char *uname; int retval, daysleft; - time_t curdays; struct spwd *spent; struct passwd *pwent; char buf[256]; D(("called.")); - ctrl = _set_ctrl(pamh, flags, NULL, argc, argv); + ctrl = _set_ctrl(pamh, flags, NULL, NULL, argc, argv); retval = pam_get_item(pamh, PAM_USER, &void_uname); uname = void_uname; @@ -214,134 +196,90 @@ PAM_EXTERN int pam_sm_acct_mgmt(pam_handle_t * pamh, int flags, return PAM_USER_UNKNOWN; } - pwent = pam_modutil_getpwnam(pamh, uname); - if (!pwent) { + retval = get_account_info(pamh, uname, &pwent, &spent); + if (retval == PAM_USER_UNKNOWN) { pam_syslog(pamh, LOG_ALERT, "could not identify user (from getpwnam(%s))", uname); - return PAM_USER_UNKNOWN; + return retval; } - if (!strcmp( pwent->pw_passwd, "*NP*" )) { /* NIS+ */ - uid_t save_euid, save_uid; - - save_euid = geteuid(); - save_uid = getuid(); - if (save_uid == pwent->pw_uid) - setreuid( save_euid, save_uid ); - else { - setreuid( 0, -1 ); - if (setreuid( -1, pwent->pw_uid ) == -1) { - setreuid( -1, 0 ); - setreuid( 0, -1 ); - if(setreuid( -1, pwent->pw_uid ) == -1) - return PAM_CRED_INSUFFICIENT; - } - } - spent = pam_modutil_getspnam (pamh, uname); - if (save_uid == pwent->pw_uid) - setreuid( save_uid, save_euid ); - else { - if (setreuid( -1, 0 ) == -1) - setreuid( save_uid, -1 ); - setreuid( -1, save_euid ); - } - - } else if (_unix_shadowed (pwent)) - spent = pam_modutil_getspnam (pamh, uname); - else + if (retval == PAM_SUCCESS && spent == NULL) return PAM_SUCCESS; -#ifdef WITH_SELINUX - if (!spent && SELINUX_ENABLED ) - spent = _unix_run_verify_binary(pamh, ctrl, uname); -#endif - - if (!spent) + if (retval == PAM_UNIX_RUN_HELPER) { + retval = _unix_run_verify_binary(pamh, ctrl, uname, &daysleft); + if (retval == PAM_AUTHINFO_UNAVAIL && + on(UNIX_BROKEN_SHADOW, ctrl)) + return PAM_SUCCESS; + } else if (retval != PAM_SUCCESS) { if (on(UNIX_BROKEN_SHADOW,ctrl)) return PAM_SUCCESS; + else + return retval; + } else + retval = check_shadow_expiry(pamh, spent, &daysleft); - if (!spent) - return PAM_AUTHINFO_UNAVAIL; /* Couldn't get username from shadow */ - - curdays = time(NULL) / (60 * 60 * 24); - D(("today is %d, last change %d", curdays, spent->sp_lstchg)); - if ((curdays > spent->sp_expire) && (spent->sp_expire != -1)) { + switch (retval) { + case PAM_ACCT_EXPIRED: pam_syslog(pamh, LOG_NOTICE, - "account %s has expired (account expired)", - uname); + "account %s has expired (account expired)", + uname); _make_remark(pamh, ctrl, PAM_ERROR_MSG, - _("Your account has expired; please contact your system administrator")); - D(("account expired")); - return PAM_ACCT_EXPIRED; - } - if (spent->sp_lstchg == 0) { - pam_syslog(pamh, LOG_NOTICE, - "expired password for user %s (root enforced)", - uname); - _make_remark(pamh, ctrl, PAM_ERROR_MSG, - _("You are required to change your password immediately (root enforced)")); - D(("need a new password")); - return PAM_NEW_AUTHTOK_REQD; - } - if (curdays < spent->sp_lstchg) { - pam_syslog(pamh, LOG_DEBUG, - "account %s has password changed in future", - uname); - return PAM_SUCCESS; - } - if ((curdays - spent->sp_lstchg > spent->sp_max) - && (curdays - spent->sp_lstchg > spent->sp_inact) - && (curdays - spent->sp_lstchg > spent->sp_max + spent->sp_inact) - && (spent->sp_max != -1) && (spent->sp_inact != -1)) { + _("Your account has expired; please contact your system administrator")); + break; + case PAM_NEW_AUTHTOK_REQD: + if (daysleft == 0) { + pam_syslog(pamh, LOG_NOTICE, + "expired password for user %s (root enforced)", + uname); + _make_remark(pamh, ctrl, PAM_ERROR_MSG, + _("You are required to change your password immediately (root enforced)")); + } else { + pam_syslog(pamh, LOG_DEBUG, + "expired password for user %s (password aged)", + uname); + _make_remark(pamh, ctrl, PAM_ERROR_MSG, + _("You are required to change your password immediately (password aged)")); + } + break; + case PAM_AUTHTOK_EXPIRED: pam_syslog(pamh, LOG_NOTICE, - "account %s has expired (failed to change password)", - uname); - _make_remark(pamh, ctrl, PAM_ERROR_MSG, - _("Your account has expired; please contact your system administrator")); - D(("account expired 2")); - return PAM_ACCT_EXPIRED; - } - if ((curdays - spent->sp_lstchg > spent->sp_max) && (spent->sp_max != -1)) { - pam_syslog(pamh, LOG_DEBUG, - "expired password for user %s (password aged)", - uname); + "account %s has expired (failed to change password)", + uname); _make_remark(pamh, ctrl, PAM_ERROR_MSG, - _("You are required to change your password immediately (password aged)")); - D(("need a new password 2")); - return PAM_NEW_AUTHTOK_REQD; - } - if ((curdays - spent->sp_lstchg > spent->sp_max - spent->sp_warn) - && (spent->sp_max != -1) && (spent->sp_warn != -1)) { - daysleft = (spent->sp_lstchg + spent->sp_max) - curdays; - pam_syslog(pamh, LOG_DEBUG, - "password for user %s will expire in %d days", - uname, daysleft); -#ifdef HAVE_DNGETTEXT - snprintf (buf, sizeof (buf), - dngettext(PACKAGE, - "Warning: your password will expire in %d day", - "Warning: your password will expire in %d days", - daysleft), - daysleft); + _("Your account has expired; please contact your system administrator")); + break; + case PAM_SUCCESS: + if (daysleft >= 0) { + pam_syslog(pamh, LOG_DEBUG, + "password for user %s will expire in %d days", + uname, daysleft); +#if defined HAVE_DNGETTEXT && defined ENABLE_NLS + snprintf (buf, sizeof (buf), + dngettext(PACKAGE, + "Warning: your password will expire in %d day", + "Warning: your password will expire in %d days", + daysleft), + daysleft); #else - if (daysleft == 1) - snprintf(buf, sizeof (buf), - _("Warning: your password will expire in %d day"), - daysleft); - else - snprintf(buf, sizeof (buf), - /* TRANSLATORS: only used if dngettext is not support -ed */ - _("Warning: your password will expire in %d days"), - daysleft); + if (daysleft == 1) + snprintf(buf, sizeof (buf), + _("Warning: your password will expire in %d day"), + daysleft); + else + snprintf(buf, sizeof (buf), + /* TRANSLATORS: only used if dngettext is not supported */ + _("Warning: your password will expire in %d days"), + daysleft); #endif - _make_remark(pamh, ctrl, PAM_TEXT_INFO, buf); + _make_remark(pamh, ctrl, PAM_TEXT_INFO, buf); + } } D(("all done")); - return PAM_SUCCESS; + return retval; } diff --git a/Linux-PAM/modules/pam_unix/pam_unix_auth.c b/Linux-PAM/modules/pam_unix/pam_unix_auth.c index 3004bee8..dfedd608 100644 --- a/Linux-PAM/modules/pam_unix/pam_unix_auth.c +++ b/Linux-PAM/modules/pam_unix/pam_unix_auth.c @@ -111,7 +111,7 @@ PAM_EXTERN int pam_sm_authenticate(pam_handle_t * pamh, int flags D(("called.")); - ctrl = _set_ctrl(pamh, flags, NULL, argc, argv); + ctrl = _set_ctrl(pamh, flags, NULL, NULL, argc, argv); /* Get a few bytes so we can pass our return value to pam_sm_setcred(). */ diff --git a/Linux-PAM/modules/pam_unix/pam_unix_passwd.c b/Linux-PAM/modules/pam_unix/pam_unix_passwd.c index c8ee5492..432f687f 100644 --- a/Linux-PAM/modules/pam_unix/pam_unix_passwd.c +++ b/Linux-PAM/modules/pam_unix/pam_unix_passwd.c @@ -2,6 +2,7 @@ * Main coding by Elliot Lee <sopwith@redhat.com>, Red Hat Software. * Copyright (C) 1996. * Copyright (c) Jan Rêkorajski, 1999. + * Copyright (c) Red Hat, Inc., 2007, 2008. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions @@ -63,7 +64,6 @@ #ifdef WITH_SELINUX static int selinux_enabled=-1; #include <selinux/selinux.h> -static security_context_t prev_context=NULL; #define SELINUX_ENABLED (selinux_enabled!=-1 ? selinux_enabled : (selinux_enabled=is_selinux_enabled()>0)) #endif @@ -84,6 +84,7 @@ static security_context_t prev_context=NULL; #include "yppasswd.h" #include "md5.h" #include "support.h" +#include "passverify.h" #include "bigcrypt.h" #if !((__GLIBC__ == 2) && (__GLIBC_MINOR__ >= 1)) @@ -92,15 +93,6 @@ extern int getrpcport(const char *host, unsigned long prognum, #endif /* GNU libc 2.1 */ /* - * PAM framework looks for these entry-points to pass control to the - * password changing module. - */ - -#if defined(USE_LCKPWDF) && !defined(HAVE_LCKPWDF) -# include "./lckpwdf.-c" -#endif - -/* How it works: Gets in username (has to be done) from the calling program Does authentication of user (only if we are not running as root) @@ -108,82 +100,15 @@ extern int getrpcport(const char *host, unsigned long prognum, Sets it. */ -/* passwd/salt conversion macros */ - -#define ascii_to_bin(c) ((c)>='a'?(c-59):(c)>='A'?((c)-53):(c)-'.') -#define bin_to_ascii(c) ((c)>=38?((c)-38+'a'):(c)>=12?((c)-12+'A'):(c)+'.') - /* data tokens */ #define _UNIX_OLD_AUTHTOK "-UN*X-OLD-PASS" #define _UNIX_NEW_AUTHTOK "-UN*X-NEW-PASS" #define MAX_PASSWD_TRIES 3 -#define PW_TMPFILE "/etc/npasswd" -#define SH_TMPFILE "/etc/nshadow" #ifndef CRACKLIB_DICTS #define CRACKLIB_DICTS NULL #endif -#define OPW_TMPFILE "/etc/security/nopasswd" -#define OLD_PASSWORDS_FILE "/etc/security/opasswd" - -/* - * i64c - convert an integer to a radix 64 character - */ -static int i64c(int i) -{ - if (i < 0) - return ('.'); - else if (i > 63) - return ('z'); - if (i == 0) - return ('.'); - if (i == 1) - return ('/'); - if (i >= 2 && i <= 11) - return ('0' - 2 + i); - if (i >= 12 && i <= 37) - return ('A' - 12 + i); - if (i >= 38 && i <= 63) - return ('a' - 38 + i); - return ('\0'); -} - -static char *crypt_md5_wrapper(const char *pass_new) -{ - /* - * Code lifted from Marek Michalkiewicz's shadow suite. (CG) - * removed use of static variables (AGM) - */ - - struct timeval tv; - MD5_CTX ctx; - unsigned char result[16]; - char *cp = (char *) result; - unsigned char tmp[16]; - int i; - char *x = NULL; - - GoodMD5Init(&ctx); - gettimeofday(&tv, (struct timezone *) 0); - GoodMD5Update(&ctx, (void *) &tv, sizeof tv); - i = getpid(); - GoodMD5Update(&ctx, (void *) &i, sizeof i); - i = clock(); - GoodMD5Update(&ctx, (void *) &i, sizeof i); - GoodMD5Update(&ctx, result, sizeof result); - GoodMD5Final(tmp, &ctx); - strcpy(cp, "$1$"); /* magic for the MD5 */ - cp += strlen(cp); - for (i = 0; i < 8; i++) - *cp++ = i64c(tmp[i] & 077); - *cp = '\0'; - - /* no longer need cleartext */ - x = Goodcrypt_md5(pass_new, (const char *) result); - - return x; -} static char *getNISserver(pam_handle_t *pamh) { @@ -217,7 +142,8 @@ static char *getNISserver(pam_handle_t *pamh) #ifdef WITH_SELINUX -static int _unix_run_shadow_binary(pam_handle_t *pamh, unsigned int ctrl, const char *user, const char *fromwhat, const char *towhat) +static int _unix_run_update_binary(pam_handle_t *pamh, unsigned int ctrl, const char *user, + const char *fromwhat, const char *towhat, int remember) { int retval, child, fds[2]; void (*sighandler)(int) = NULL; @@ -247,7 +173,8 @@ static int _unix_run_shadow_binary(pam_handle_t *pamh, unsigned int ctrl, const size_t i=0; struct rlimit rlim; static char *envp[] = { NULL }; - char *args[] = { NULL, NULL, NULL, NULL }; + char *args[] = { NULL, NULL, NULL, NULL, NULL, NULL }; + char buffer[16]; /* XXX - should really tidy up PAM here too */ @@ -270,11 +197,18 @@ static int _unix_run_shadow_binary(pam_handle_t *pamh, unsigned int ctrl, const } /* exec binary helper */ - args[0] = x_strdup(CHKPWD_HELPER); + args[0] = x_strdup(UPDATE_HELPER); args[1] = x_strdup(user); - args[2] = x_strdup("shadow"); + args[2] = x_strdup("update"); + if (on(UNIX_SHADOW, ctrl)) + args[3] = x_strdup("1"); + else + args[3] = x_strdup("0"); - execve(CHKPWD_HELPER, args, envp); + snprintf(buffer, sizeof(buffer), "%d", remember); + args[4] = x_strdup(buffer); + + execve(UPDATE_HELPER, args, envp); /* should not get here: exit with error */ D(("helper binary is not available")); @@ -297,7 +231,7 @@ static int _unix_run_shadow_binary(pam_handle_t *pamh, unsigned int ctrl, const close(fds[1]); rc=waitpid(child, &retval, 0); /* wait for helper to complete */ if (rc<0) { - pam_syslog(pamh, LOG_ERR, "unix_chkpwd waitpid returned %d: %m", rc); + pam_syslog(pamh, LOG_ERR, "unix_update waitpid failed: %m"); retval = PAM_AUTH_ERR; } else { retval = WEXITSTATUS(retval); @@ -354,393 +288,6 @@ static int check_old_password(const char *forwho, const char *newpass) return retval; } -static int save_old_password(pam_handle_t *pamh, - const char *forwho, const char *oldpass, - int howmany) -{ - static char buf[16384]; - static char nbuf[16384]; - char *s_luser, *s_uid, *s_npas, *s_pas, *pass; - int npas; - FILE *pwfile, *opwfile; - int err = 0; - int oldmask; - int found = 0; - struct passwd *pwd = NULL; - struct stat st; - - if (howmany < 0) { - return PAM_SUCCESS; - } - - if (oldpass == NULL) { - return PAM_SUCCESS; - } - - oldmask = umask(077); - -#ifdef WITH_SELINUX - if (SELINUX_ENABLED) { - security_context_t passwd_context=NULL; - if (getfilecon("/etc/passwd",&passwd_context)<0) { - return PAM_AUTHTOK_ERR; - }; - if (getfscreatecon(&prev_context)<0) { - freecon(passwd_context); - return PAM_AUTHTOK_ERR; - } - if (setfscreatecon(passwd_context)) { - freecon(passwd_context); - freecon(prev_context); - return PAM_AUTHTOK_ERR; - } - freecon(passwd_context); - } -#endif - pwfile = fopen(OPW_TMPFILE, "w"); - umask(oldmask); - if (pwfile == NULL) { - err = 1; - goto done; - } - - opwfile = fopen(OLD_PASSWORDS_FILE, "r"); - if (opwfile == NULL) { - fclose(pwfile); - err = 1; - goto done; - } - - if (fstat(fileno(opwfile), &st) == -1) { - fclose(opwfile); - fclose(pwfile); - err = 1; - goto done; - } - - if (fchown(fileno(pwfile), st.st_uid, st.st_gid) == -1) { - fclose(opwfile); - fclose(pwfile); - err = 1; - goto done; - } - if (fchmod(fileno(pwfile), st.st_mode) == -1) { - fclose(opwfile); - fclose(pwfile); - err = 1; - goto done; - } - - while (fgets(buf, 16380, opwfile)) { - if (!strncmp(buf, forwho, strlen(forwho))) { - char *sptr; - buf[strlen(buf) - 1] = '\0'; - s_luser = strtok_r(buf, ":", &sptr); - s_uid = strtok_r(NULL, ":", &sptr); - s_npas = strtok_r(NULL, ":", &sptr); - s_pas = strtok_r(NULL, ":", &sptr); - npas = strtol(s_npas, NULL, 10) + 1; - while (npas > howmany) { - s_pas = strpbrk(s_pas, ","); - if (s_pas != NULL) - s_pas++; - npas--; - } - pass = crypt_md5_wrapper(oldpass); - if (s_pas == NULL) - snprintf(nbuf, sizeof(nbuf), "%s:%s:%d:%s\n", - s_luser, s_uid, npas, pass); - else - snprintf(nbuf, sizeof(nbuf),"%s:%s:%d:%s,%s\n", - s_luser, s_uid, npas, s_pas, pass); - _pam_delete(pass); - if (fputs(nbuf, pwfile) < 0) { - err = 1; - break; - } - found = 1; - } else if (fputs(buf, pwfile) < 0) { - err = 1; - break; - } - } - fclose(opwfile); - - if (!found) { - pwd = pam_modutil_getpwnam(pamh, forwho); - if (pwd == NULL) { - err = 1; - } else { - pass = crypt_md5_wrapper(oldpass); - snprintf(nbuf, sizeof(nbuf), "%s:%lu:1:%s\n", - forwho, (unsigned long)pwd->pw_uid, pass); - _pam_delete(pass); - if (fputs(nbuf, pwfile) < 0) { - err = 1; - } - } - } - - if (fclose(pwfile)) { - D(("error writing entries to old passwords file: %m")); - err = 1; - } - -done: - if (!err) { - if (rename(OPW_TMPFILE, OLD_PASSWORDS_FILE)) - err = 1; - } -#ifdef WITH_SELINUX - if (SELINUX_ENABLED) { - if (setfscreatecon(prev_context)) { - err = 1; - } - if (prev_context) - freecon(prev_context); - prev_context=NULL; - } -#endif - if (!err) { - return PAM_SUCCESS; - } else { - unlink(OPW_TMPFILE); - return PAM_AUTHTOK_ERR; - } -} - -static int _update_passwd(pam_handle_t *pamh, - const char *forwho, const char *towhat) -{ - struct passwd *tmpent = NULL; - struct stat st; - FILE *pwfile, *opwfile; - int err = 1; - int oldmask; - - oldmask = umask(077); -#ifdef WITH_SELINUX - if (SELINUX_ENABLED) { - security_context_t passwd_context=NULL; - if (getfilecon("/etc/passwd",&passwd_context)<0) { - return PAM_AUTHTOK_ERR; - }; - if (getfscreatecon(&prev_context)<0) { - freecon(passwd_context); - return PAM_AUTHTOK_ERR; - } - if (setfscreatecon(passwd_context)) { - freecon(passwd_context); - freecon(prev_context); - return PAM_AUTHTOK_ERR; - } - freecon(passwd_context); - } -#endif - pwfile = fopen(PW_TMPFILE, "w"); - umask(oldmask); - if (pwfile == NULL) { - err = 1; - goto done; - } - - opwfile = fopen("/etc/passwd", "r"); - if (opwfile == NULL) { - fclose(pwfile); - err = 1; - goto done; - } - - if (fstat(fileno(opwfile), &st) == -1) { - fclose(opwfile); - fclose(pwfile); - err = 1; - goto done; - } - - if (fchown(fileno(pwfile), st.st_uid, st.st_gid) == -1) { - fclose(opwfile); - fclose(pwfile); - err = 1; - goto done; - } - if (fchmod(fileno(pwfile), st.st_mode) == -1) { - fclose(opwfile); - fclose(pwfile); - err = 1; - goto done; - } - - tmpent = fgetpwent(opwfile); - while (tmpent) { - if (!strcmp(tmpent->pw_name, forwho)) { - /* To shut gcc up */ - union { - const char *const_charp; - char *charp; - } assigned_passwd; - assigned_passwd.const_charp = towhat; - - tmpent->pw_passwd = assigned_passwd.charp; - err = 0; - } - if (putpwent(tmpent, pwfile)) { - D(("error writing entry to password file: %m")); - err = 1; - break; - } - tmpent = fgetpwent(opwfile); - } - fclose(opwfile); - - if (fclose(pwfile)) { - D(("error writing entries to password file: %m")); - err = 1; - } - -done: - if (!err) { - if (!rename(PW_TMPFILE, "/etc/passwd")) - pam_syslog(pamh, LOG_NOTICE, "password changed for %s", forwho); - else - err = 1; - } -#ifdef WITH_SELINUX - if (SELINUX_ENABLED) { - if (setfscreatecon(prev_context)) { - err = 1; - } - if (prev_context) - freecon(prev_context); - prev_context=NULL; - } -#endif - if (!err) { - return PAM_SUCCESS; - } else { - unlink(PW_TMPFILE); - return PAM_AUTHTOK_ERR; - } -} - -static int _update_shadow(pam_handle_t *pamh, const char *forwho, char *towhat) -{ - struct spwd *spwdent = NULL, *stmpent = NULL; - struct stat st; - FILE *pwfile, *opwfile; - int err = 1; - int oldmask; - - spwdent = getspnam(forwho); - if (spwdent == NULL) { - return PAM_USER_UNKNOWN; - } - oldmask = umask(077); - -#ifdef WITH_SELINUX - if (SELINUX_ENABLED) { - security_context_t shadow_context=NULL; - if (getfilecon("/etc/shadow",&shadow_context)<0) { - return PAM_AUTHTOK_ERR; - }; - if (getfscreatecon(&prev_context)<0) { - freecon(shadow_context); - return PAM_AUTHTOK_ERR; - } - if (setfscreatecon(shadow_context)) { - freecon(shadow_context); - freecon(prev_context); - return PAM_AUTHTOK_ERR; - } - freecon(shadow_context); - } -#endif - pwfile = fopen(SH_TMPFILE, "w"); - umask(oldmask); - if (pwfile == NULL) { - err = 1; - goto done; - } - - opwfile = fopen("/etc/shadow", "r"); - if (opwfile == NULL) { - fclose(pwfile); - err = 1; - goto done; - } - - if (fstat(fileno(opwfile), &st) == -1) { - fclose(opwfile); - fclose(pwfile); - err = 1; - goto done; - } - - if (fchown(fileno(pwfile), st.st_uid, st.st_gid) == -1) { - fclose(opwfile); - fclose(pwfile); - err = 1; - goto done; - } - if (fchmod(fileno(pwfile), st.st_mode) == -1) { - fclose(opwfile); - fclose(pwfile); - err = 1; - goto done; - } - - stmpent = fgetspent(opwfile); - while (stmpent) { - - if (!strcmp(stmpent->sp_namp, forwho)) { - stmpent->sp_pwdp = towhat; - stmpent->sp_lstchg = time(NULL) / (60 * 60 * 24); - err = 0; - D(("Set password %s for %s", stmpent->sp_pwdp, forwho)); - } - - if (putspent(stmpent, pwfile)) { - D(("error writing entry to shadow file: %m")); - err = 1; - break; - } - - stmpent = fgetspent(opwfile); - } - fclose(opwfile); - - if (fclose(pwfile)) { - D(("error writing entries to shadow file: %m")); - err = 1; - } - - done: - if (!err) { - if (!rename(SH_TMPFILE, "/etc/shadow")) - pam_syslog(pamh, LOG_NOTICE, "password changed for %s", forwho); - else - err = 1; - } - -#ifdef WITH_SELINUX - if (SELINUX_ENABLED) { - if (setfscreatecon(prev_context)) { - err = 1; - } - if (prev_context) - freecon(prev_context); - prev_context=NULL; - } -#endif - - if (!err) { - return PAM_SUCCESS; - } else { - unlink(SH_TMPFILE); - return PAM_AUTHTOK_ERR; - } -} - static int _do_setpass(pam_handle_t* pamh, const char *forwho, const char *fromwhat, char *towhat, unsigned int ctrl, int remember) @@ -768,9 +315,7 @@ static int _do_setpass(pam_handle_t* pamh, const char *forwho, enum clnt_stat err; /* Unlock passwd file to avoid deadlock */ -#ifdef USE_LCKPWDF - ulckpwdf(); -#endif + unlock_pwdf(); unlocked = 1; /* Initialize password information */ @@ -830,129 +375,63 @@ static int _do_setpass(pam_handle_t* pamh, const char *forwho, } if (_unix_comesfromsource(pamh, forwho, 1, 0)) { -#ifdef USE_LCKPWDF if(unlocked) { - int i = 0; - /* These values for the number of attempts and the sleep time - are, of course, completely arbitrary. - My reading of the PAM docs is that, once pam_chauthtok() has been - called with PAM_UPDATE_AUTHTOK, we are obliged to take any - reasonable steps to make sure the token is updated; so retrying - for 1/10 sec. isn't overdoing it. */ - while((retval = lckpwdf()) != 0 && i < 100) { - usleep(1000); - i++; - } - if(retval != 0) { + if (lock_pwdf() != PAM_SUCCESS) { return PAM_AUTHTOK_LOCK_BUSY; } } +#ifdef WITH_SELINUX + if (unix_selinux_confined()) + return _unix_run_update_binary(pamh, ctrl, forwho, fromwhat, towhat, remember); #endif /* first, save old password */ - if (save_old_password(pamh, forwho, fromwhat, remember)) { + if (save_old_password(forwho, fromwhat, remember)) { retval = PAM_AUTHTOK_ERR; goto done; } - if (on(UNIX_SHADOW, ctrl) || _unix_shadowed(pwd)) { - retval = _update_shadow(pamh, forwho, towhat); -#ifdef WITH_SELINUX - if (retval != PAM_SUCCESS && SELINUX_ENABLED) - retval = _unix_run_shadow_binary(pamh, ctrl, forwho, fromwhat, towhat); -#endif + if (on(UNIX_SHADOW, ctrl) || is_pwd_shadowed(pwd)) { + retval = unix_update_shadow(pamh, forwho, towhat); if (retval == PAM_SUCCESS) - if (!_unix_shadowed(pwd)) - retval = _update_passwd(pamh, forwho, "x"); + if (!is_pwd_shadowed(pwd)) + retval = unix_update_passwd(pamh, forwho, "x"); } else { - retval = _update_passwd(pamh, forwho, towhat); + retval = unix_update_passwd(pamh, forwho, towhat); } } done: -#ifdef USE_LCKPWDF - ulckpwdf(); -#endif + unlock_pwdf(); return retval; } static int _unix_verify_shadow(pam_handle_t *pamh, const char *user, unsigned int ctrl) { - struct passwd *pwd = NULL; /* Password and shadow password */ - struct spwd *spwdent = NULL; /* file entries for the user */ - time_t curdays; - int retval = PAM_SUCCESS; + struct passwd *pwent = NULL; /* Password and shadow password */ + struct spwd *spent = NULL; /* file entries for the user */ + int daysleft; + int retval; - /* UNIX passwords area */ - pwd = getpwnam(user); /* Get password file entry... */ - if (pwd == NULL) - return PAM_AUTHINFO_UNAVAIL; /* We don't need to do the rest... */ + retval = get_account_info(pamh, user, &pwent, &spent); + if (retval == PAM_USER_UNKNOWN) { + return retval; + } - if (_unix_shadowed(pwd)) { - /* ...and shadow password file entry for this user, if shadowing - is enabled */ - setspent(); - spwdent = getspnam(user); - endspent(); + if (retval == PAM_SUCCESS && spent == NULL) + return PAM_SUCCESS; -#ifdef WITH_SELINUX - if (spwdent == NULL && SELINUX_ENABLED ) - spwdent = _unix_run_verify_binary(pamh, ctrl, user); -#endif - if (spwdent == NULL) - return PAM_AUTHINFO_UNAVAIL; - } else { - if (strcmp(pwd->pw_passwd,"*NP*") == 0) { /* NIS+ */ - uid_t save_uid; - - save_uid = geteuid(); - seteuid (pwd->pw_uid); - spwdent = getspnam( user ); - seteuid (save_uid); - - if (spwdent == NULL) - return PAM_AUTHINFO_UNAVAIL; - } else - spwdent = NULL; + if (retval == PAM_UNIX_RUN_HELPER) { + retval = _unix_run_verify_binary(pamh, ctrl, user, &daysleft); + if (retval == PAM_AUTH_ERR || retval == PAM_USER_UNKNOWN) + return retval; } + else if (retval == PAM_SUCCESS) + retval = check_shadow_expiry(pamh, spent, &daysleft); + + if (on(UNIX__IAMROOT, ctrl) || retval == PAM_NEW_AUTHTOK_REQD) + return PAM_SUCCESS; - if (spwdent != NULL) { - /* We have the user's information, now let's check if their account - has expired (60 * 60 * 24 = number of seconds in a day) */ - - if (off(UNIX__IAMROOT, ctrl)) { - /* Get the current number of days since 1970 */ - curdays = time(NULL) / (60 * 60 * 24); - if (curdays < spwdent->sp_lstchg) { - pam_syslog(pamh, LOG_DEBUG, - "account %s has password changed in future", - user); - curdays = spwdent->sp_lstchg; - } - if ((curdays - spwdent->sp_lstchg < spwdent->sp_min) - && (spwdent->sp_min != -1)) - /* - * The last password change was too recent. - */ - retval = PAM_AUTHTOK_ERR; - else if ((curdays - spwdent->sp_lstchg > spwdent->sp_max) - && (curdays - spwdent->sp_lstchg > spwdent->sp_inact) - && (curdays - spwdent->sp_lstchg > - spwdent->sp_max + spwdent->sp_inact) - && (spwdent->sp_max != -1) && (spwdent->sp_inact != -1) - && (spwdent->sp_lstchg != 0)) - /* - * Their password change has been put off too long, - */ - retval = PAM_ACCT_EXPIRED; - else if ((curdays > spwdent->sp_expire) && (spwdent->sp_expire != -1) - && (spwdent->sp_lstchg != 0)) - /* - * OR their account has just plain expired - */ - retval = PAM_ACCT_EXPIRED; - } - } return retval; } @@ -1020,8 +499,9 @@ PAM_EXTERN int pam_sm_chauthtok(pam_handle_t * pamh, int flags, int argc, const char **argv) { unsigned int ctrl, lctrl; - int retval, i; + int retval; int remember = -1; + int rounds = -1; /* <DO NOT free() THESE> */ const char *user; @@ -1030,7 +510,7 @@ PAM_EXTERN int pam_sm_chauthtok(pam_handle_t * pamh, int flags, D(("called.")); - ctrl = _set_ctrl(pamh, flags, &remember, argc, argv); + ctrl = _set_ctrl(pamh, flags, &remember, &rounds, argc, argv); /* * First get the name of a user @@ -1239,40 +719,23 @@ PAM_EXTERN int pam_sm_chauthtok(pam_handle_t * pamh, int flags, pass_new = pass_old = NULL; /* tidy up */ return retval; } -#ifdef USE_LCKPWDF - /* These values for the number of attempts and the sleep time - are, of course, completely arbitrary. - My reading of the PAM docs is that, once pam_chauthtok() has been - called with PAM_UPDATE_AUTHTOK, we are obliged to take any - reasonable steps to make sure the token is updated; so retrying - for 1/10 sec. isn't overdoing it. */ - i=0; - while((retval = lckpwdf()) != 0 && i < 100) { - usleep(1000); - i++; - } - if(retval != 0) { + if (lock_pwdf() != PAM_SUCCESS) { return PAM_AUTHTOK_LOCK_BUSY; } -#endif if (pass_old) { retval = _unix_verify_password(pamh, user, pass_old, ctrl); if (retval != PAM_SUCCESS) { pam_syslog(pamh, LOG_NOTICE, "user password changed by another process"); -#ifdef USE_LCKPWDF - ulckpwdf(); -#endif + unlock_pwdf(); return retval; } } retval = _unix_verify_shadow(pamh, user, ctrl); if (retval != PAM_SUCCESS) { - pam_syslog(pamh, LOG_NOTICE, "user not authenticated 2"); -#ifdef USE_LCKPWDF - ulckpwdf(); -#endif + pam_syslog(pamh, LOG_NOTICE, "user shadow entry expired"); + unlock_pwdf(); return retval; } @@ -1281,9 +744,7 @@ PAM_EXTERN int pam_sm_chauthtok(pam_handle_t * pamh, int flags, pam_syslog(pamh, LOG_NOTICE, "new password not acceptable 2"); pass_new = pass_old = NULL; /* tidy up */ -#ifdef USE_LCKPWDF - ulckpwdf(); -#endif + unlock_pwdf(); return retval; } @@ -1296,51 +757,13 @@ PAM_EXTERN int pam_sm_chauthtok(pam_handle_t * pamh, int flags, * First we encrypt the new password. */ - if (on(UNIX_MD5_PASS, ctrl)) { - tpass = crypt_md5_wrapper(pass_new); - } else { - /* - * Salt manipulation is stolen from Rick Faith's passwd - * program. Sorry Rick :) -- alex - */ - - time_t tm; - char salt[3]; - - time(&tm); - salt[0] = bin_to_ascii(tm & 0x3f); - salt[1] = bin_to_ascii((tm >> 6) & 0x3f); - salt[2] = '\0'; - - if (off(UNIX_BIGCRYPT, ctrl) && strlen(pass_new) > 8) { - /* - * to avoid using the _extensions_ of the bigcrypt() - * function we truncate the newly entered password - * [Problems that followed from this are fixed as per - * Bug 521314.] - */ - char *temp = malloc(9); - - if (temp == NULL) { - pam_syslog(pamh, LOG_CRIT, - "out of memory for password"); - pass_new = pass_old = NULL; /* tidy up */ -#ifdef USE_LCKPWDF - ulckpwdf(); -#endif - return PAM_BUF_ERR; - } - /* copy first 8 bytes of password */ - strncpy(temp, pass_new, 8); - temp[8] = '\0'; - - /* no longer need cleartext */ - tpass = bigcrypt(temp, salt); - - _pam_delete(temp); /* tidy up */ - } else { - tpass = bigcrypt(pass_new, salt); - } + tpass = create_password_hash(pass_new, ctrl, rounds); + if (tpass == NULL) { + pam_syslog(pamh, LOG_CRIT, + "out of memory for password"); + pass_new = pass_old = NULL; /* tidy up */ + unlock_pwdf(); + return PAM_BUF_ERR; } D(("password processed")); @@ -1349,7 +772,7 @@ PAM_EXTERN int pam_sm_chauthtok(pam_handle_t * pamh, int flags, retval = _do_setpass(pamh, user, pass_old, tpass, ctrl, remember); - /* _do_setpass has called ulckpwdf for us */ + /* _do_setpass has called unlock_pwdf for us */ _pam_delete(tpass); pass_old = pass_new = NULL; diff --git a/Linux-PAM/modules/pam_unix/pam_unix_sess.c b/Linux-PAM/modules/pam_unix/pam_unix_sess.c index b7af4503..3379df42 100644 --- a/Linux-PAM/modules/pam_unix/pam_unix_sess.c +++ b/Linux-PAM/modules/pam_unix/pam_unix_sess.c @@ -1,5 +1,5 @@ /* - * $Id: pam_unix_sess.c,v 1.9 2006/06/17 16:44:58 kukuk Exp $ + * $Id: pam_unix_sess.c,v 1.10 2008/01/23 15:35:13 t8m Exp $ * * Copyright Alexander O. Yuriev, 1996. All rights reserved. * Copyright Jan Rêkorajski, 1999. All rights reserved. @@ -73,7 +73,7 @@ PAM_EXTERN int pam_sm_open_session(pam_handle_t * pamh, int flags, D(("called.")); - ctrl = _set_ctrl(pamh, flags, NULL, argc, argv); + ctrl = _set_ctrl(pamh, flags, NULL, NULL, argc, argv); retval = pam_get_item(pamh, PAM_USER, (void *) &user_name); if (user_name == NULL || *user_name == '\0' || retval != PAM_SUCCESS) { @@ -107,7 +107,7 @@ PAM_EXTERN int pam_sm_close_session(pam_handle_t * pamh, int flags, D(("called.")); - ctrl = _set_ctrl(pamh, flags, NULL, argc, argv); + ctrl = _set_ctrl(pamh, flags, NULL, NULL, argc, argv); retval = pam_get_item(pamh, PAM_USER, (void *) &user_name); if (user_name == NULL || *user_name == '\0' || retval != PAM_SUCCESS) { diff --git a/Linux-PAM/modules/pam_unix/passverify.c b/Linux-PAM/modules/pam_unix/passverify.c new file mode 100644 index 00000000..6d588e63 --- /dev/null +++ b/Linux-PAM/modules/pam_unix/passverify.c @@ -0,0 +1,1129 @@ +/* + * Copyright information at end of file. + */ +#include "config.h" +#include <security/_pam_macros.h> +#include <security/pam_modules.h> +#include "support.h" +#include <stdio.h> +#include <string.h> +#include <sys/types.h> +#include <unistd.h> +#include <pwd.h> +#include <shadow.h> +#include <syslog.h> +#include <stdarg.h> +#include <signal.h> +#include <errno.h> +#include <time.h> +#include <sys/time.h> +#include <sys/stat.h> +#include <fcntl.h> +#ifdef HAVE_CRYPT_H +#include <crypt.h> +#endif + +#include "md5.h" +#include "bigcrypt.h" +#include "passverify.h" + +#ifdef WITH_SELINUX +#include <selinux/selinux.h> +#define SELINUX_ENABLED is_selinux_enabled()>0 +#else +#define SELINUX_ENABLED 0 +#endif + +#ifdef HELPER_COMPILE +#define pam_modutil_getpwnam(h,n) getpwnam(n) +#define pam_modutil_getspnam(h,n) getspnam(n) +#define pam_syslog(h,a,b,c) helper_log_err(a,b,c) +#else +#include <security/pam_modutil.h> +#include <security/pam_ext.h> +#endif + +#if defined(USE_LCKPWDF) && !defined(HAVE_LCKPWDF) +# include "./lckpwdf.-c" +#endif + +static void +strip_hpux_aging(char *hash) +{ + static const char valid[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZ" + "abcdefghijklmnopqrstuvwxyz" + "0123456789./"; + if ((*hash != '$') && (strlen(hash) > 13)) { + for (hash += 13; *hash != '\0'; hash++) { + if (strchr(valid, *hash) == NULL) { + *hash = '\0'; + break; + } + } + } +} + +int +verify_pwd_hash(const char *p, char *hash, unsigned int nullok) +{ + size_t hash_len; + char *pp = NULL; + int retval; + D(("called")); + + strip_hpux_aging(hash); + hash_len = strlen(hash); + if (!hash_len) { + /* the stored password is NULL */ + if (nullok) { /* this means we've succeeded */ + D(("user has empty password - access granted")); + retval = PAM_SUCCESS; + } else { + D(("user has empty password - access denied")); + retval = PAM_AUTH_ERR; + } + } else if (!p || *hash == '*' || *hash == '!') { + retval = PAM_AUTH_ERR; + } else { + if (!strncmp(hash, "$1$", 3)) { + pp = Goodcrypt_md5(p, hash); + if (pp && strcmp(pp, hash) != 0) { + _pam_delete(pp); + pp = Brokencrypt_md5(p, hash); + } + } else if (*hash != '$' && hash_len >= 13) { + pp = bigcrypt(p, hash); + if (pp && hash_len == 13 && strlen(pp) > hash_len) { + _pam_overwrite(pp + hash_len); + } + } else { + /* + * Ok, we don't know the crypt algorithm, but maybe + * libcrypt knows about it? We should try it. + */ +#ifdef HAVE_CRYPT_R + struct crypt_data *cdata; + cdata = malloc(sizeof(*cdata)); + if (cdata != NULL) { + cdata->initialized = 0; + pp = x_strdup(crypt_r(p, hash, cdata)); + memset(cdata, '\0', sizeof(*cdata)); + free(cdata); + } +#else + pp = x_strdup(crypt(p, hash)); +#endif + } + p = NULL; /* no longer needed here */ + + /* the moment of truth -- do we agree with the password? */ + D(("comparing state of pp[%s] and salt[%s]", pp, salt)); + + if (pp && strcmp(pp, hash) == 0) { + retval = PAM_SUCCESS; + } else { + retval = PAM_AUTH_ERR; + } + } + + if (pp) + _pam_delete(pp); + D(("done [%d].", retval)); + + return retval; +} + +int +is_pwd_shadowed(const struct passwd *pwd) +{ + if (pwd != NULL) { + if (strcmp(pwd->pw_passwd, "x") == 0) { + return 1; + } + if ((pwd->pw_passwd[0] == '#') && + (pwd->pw_passwd[1] == '#') && + (strcmp(pwd->pw_name, pwd->pw_passwd + 2) == 0)) { + return 1; + } + } + return 0; +} + +#ifdef HELPER_COMPILE +int +get_account_info(const char *name, + struct passwd **pwd, struct spwd **spwdent) +#else +int +get_account_info(pam_handle_t *pamh, const char *name, + struct passwd **pwd, struct spwd **spwdent) +#endif +{ + /* UNIX passwords area */ + *pwd = pam_modutil_getpwnam(pamh, name); /* Get password file entry... */ + *spwdent = NULL; + + if (*pwd != NULL) { + if (strcmp((*pwd)->pw_passwd, "*NP*") == 0) + { /* NIS+ */ +#ifdef HELPER_COMPILE + uid_t save_euid, save_uid; + + save_euid = geteuid(); + save_uid = getuid(); + if (save_uid == (*pwd)->pw_uid) + setreuid(save_euid, save_uid); + else { + setreuid(0, -1); + if (setreuid(-1, (*pwd)->pw_uid) == -1) { + setreuid(-1, 0); + setreuid(0, -1); + if(setreuid(-1, (*pwd)->pw_uid) == -1) + return PAM_CRED_INSUFFICIENT; + } + } + + *spwdent = pam_modutil_getspnam(pamh, name); + if (save_uid == (*pwd)->pw_uid) + setreuid(save_uid, save_euid); + else { + setreuid(-1, 0); + setreuid(save_uid, -1); + setreuid(-1, save_euid); + } + + if (*spwdent == NULL || (*spwdent)->sp_pwdp == NULL) + return PAM_AUTHINFO_UNAVAIL; +#else + /* we must run helper for NIS+ passwords */ + return PAM_UNIX_RUN_HELPER; +#endif + } else if (is_pwd_shadowed(*pwd)) { + /* + * ...and shadow password file entry for this user, + * if shadowing is enabled + */ +#ifndef HELPER_COMPILE + if (geteuid() || SELINUX_ENABLED) + return PAM_UNIX_RUN_HELPER; +#endif + *spwdent = pam_modutil_getspnam(pamh, name); + if (*spwdent == NULL || (*spwdent)->sp_pwdp == NULL) + return PAM_AUTHINFO_UNAVAIL; + } + } else { + return PAM_USER_UNKNOWN; + } + return PAM_SUCCESS; +} + +#ifdef HELPER_COMPILE +int +get_pwd_hash(const char *name, + struct passwd **pwd, char **hash) +#else +int +get_pwd_hash(pam_handle_t *pamh, const char *name, + struct passwd **pwd, char **hash) +#endif +{ + int retval; + struct spwd *spwdent = NULL; + +#ifdef HELPER_COMPILE + retval = get_account_info(name, pwd, &spwdent); +#else + retval = get_account_info(pamh, name, pwd, &spwdent); +#endif + if (retval != PAM_SUCCESS) { + return retval; + } + + if (spwdent) + *hash = x_strdup(spwdent->sp_pwdp); + else + *hash = x_strdup((*pwd)->pw_passwd); + if (*hash == NULL) + return PAM_BUF_ERR; + + return PAM_SUCCESS; +} + +#ifdef HELPER_COMPILE +int +check_shadow_expiry(struct spwd *spent, int *daysleft) +#else +int +check_shadow_expiry(pam_handle_t *pamh, struct spwd *spent, int *daysleft) +#endif +{ + long int curdays; + *daysleft = -1; + curdays = (long int)(time(NULL) / (60 * 60 * 24)); + D(("today is %d, last change %d", curdays, spent->sp_lstchg)); + if ((curdays > spent->sp_expire) && (spent->sp_expire != -1)) { + D(("account expired")); + return PAM_ACCT_EXPIRED; + } + if (spent->sp_lstchg == 0) { + D(("need a new password")); + *daysleft = 0; + return PAM_NEW_AUTHTOK_REQD; + } + if (curdays < spent->sp_lstchg) { + pam_syslog(pamh, LOG_DEBUG, + "account %s has password changed in future", + spent->sp_namp); + return PAM_SUCCESS; + } + if ((curdays - spent->sp_lstchg > spent->sp_max) + && (curdays - spent->sp_lstchg > spent->sp_inact) + && (curdays - spent->sp_lstchg > spent->sp_max + spent->sp_inact) + && (spent->sp_max != -1) && (spent->sp_inact != -1)) { + *daysleft = (int)((spent->sp_lstchg + spent->sp_max) - curdays); + D(("authtok expired")); + return PAM_AUTHTOK_EXPIRED; + } + if ((curdays - spent->sp_lstchg > spent->sp_max) && (spent->sp_max != -1)) { + D(("need a new password 2")); + return PAM_NEW_AUTHTOK_REQD; + } + if ((curdays - spent->sp_lstchg > spent->sp_max - spent->sp_warn) + && (spent->sp_max != -1) && (spent->sp_warn != -1)) { + *daysleft = (int)((spent->sp_lstchg + spent->sp_max) - curdays); + D(("warn before expiry")); + } + return PAM_SUCCESS; + +} + +/* passwd/salt conversion macros */ + +#define PW_TMPFILE "/etc/npasswd" +#define SH_TMPFILE "/etc/nshadow" +#define OPW_TMPFILE "/etc/security/nopasswd" + +/* + * i64c - convert an integer to a radix 64 character + */ +static int +i64c(int i) +{ + if (i < 0) + return ('.'); + else if (i > 63) + return ('z'); + if (i == 0) + return ('.'); + if (i == 1) + return ('/'); + if (i >= 2 && i <= 11) + return ('0' - 2 + i); + if (i >= 12 && i <= 37) + return ('A' - 12 + i); + if (i >= 38 && i <= 63) + return ('a' - 38 + i); + return ('\0'); +} + +/* <where> must point to a buffer of at least <length>+1 length */ +static void +crypt_make_salt(char *where, int length) +{ + struct timeval tv; + MD5_CTX ctx; + unsigned char tmp[16]; + unsigned char *src = (unsigned char *)where; + int i; +#ifdef PAM_PATH_RANDOMDEV + int fd; + int rv; + + if ((rv = fd = open(PAM_PATH_RANDOMDEV, O_RDONLY)) != -1) { + while ((rv = read(fd, where, length)) != length && errno == EINTR); + close (fd); + } + if (rv != length) { +#endif + /* + * Code lifted from Marek Michalkiewicz's shadow suite. (CG) + * removed use of static variables (AGM) + * + * will work correctly only for length <= 16 */ + src = tmp; + GoodMD5Init(&ctx); + gettimeofday(&tv, (struct timezone *) 0); + GoodMD5Update(&ctx, (void *) &tv, sizeof tv); + i = getpid(); + GoodMD5Update(&ctx, (void *) &i, sizeof i); + i = clock(); + GoodMD5Update(&ctx, (void *) &i, sizeof i); + GoodMD5Update(&ctx, src, length); + GoodMD5Final(tmp, &ctx); +#ifdef PAM_PATH_RANDOMDEV + } +#endif + for (i = 0; i < length; i++) + *where++ = i64c(src[i] & 077); + *where = '\0'; +} + +char * +crypt_md5_wrapper(const char *pass_new) +{ + unsigned char result[16]; + char *cp = (char *) result; + + cp = stpcpy(cp, "$1$"); /* magic for the MD5 */ + crypt_make_salt(cp, 8); + + /* no longer need cleartext */ + cp = Goodcrypt_md5(pass_new, (const char *) result); + pass_new = NULL; + + return cp; +} + +char * +create_password_hash(const char *password, unsigned int ctrl, int rounds) +{ + const char *algoid; + char salt[64]; /* contains rounds number + max 16 bytes of salt + algo id */ + char *sp; + + if (on(UNIX_MD5_PASS, ctrl)) { + return crypt_md5_wrapper(password); + } + if (on(UNIX_SHA256_PASS, ctrl)) { + algoid = "$5$"; + } else if (on(UNIX_SHA512_PASS, ctrl)) { + algoid = "$6$"; + } else { /* must be crypt/bigcrypt */ + char tmppass[9]; + char *crypted; + + crypt_make_salt(salt, 2); + if (off(UNIX_BIGCRYPT, ctrl) && strlen(password) > 8) { + strncpy(tmppass, password, sizeof(tmppass)-1); + tmppass[sizeof(tmppass)-1] = '\0'; + password = tmppass; + } + crypted = bigcrypt(password, salt); + memset(tmppass, '\0', sizeof(tmppass)); + password = NULL; + return crypted; + } + + sp = stpcpy(salt, algoid); + if (on(UNIX_ALGO_ROUNDS, ctrl)) { + sp += snprintf(sp, sizeof(salt) - 3, "rounds=%u$", rounds); + } + crypt_make_salt(sp, 8); + /* For now be conservative so the resulting hashes + * are not too long. 8 bytes of salt prevents dictionary + * attacks well enough. */ + sp = crypt(password, salt); + if (strncmp(algoid, sp, strlen(algoid)) != 0) { + /* libc doesn't know the algorithm, use MD5 */ + memset(sp, '\0', strlen(sp)); + return crypt_md5_wrapper(password); + } + + return x_strdup(sp); +} + +#ifdef WITH_SELINUX +int +unix_selinux_confined(void) +{ + static int confined = -1; + int fd; + char tempfile[]="/etc/.pwdXXXXXX"; + + if (confined != -1) + return confined; + + /* cannot be confined without SELinux enabled */ + if (!SELINUX_ENABLED){ + confined = 0; + return confined; + } + + /* let's try opening shadow read only */ + if ((fd=open("/etc/shadow", O_RDONLY)) != -1) { + close(fd); + confined = 0; + return confined; + } + + if (errno == EACCES) { + confined = 1; + return confined; + } + + /* shadow opening failed because of other reasons let's try + creating a file in /etc */ + if ((fd=mkstemp(tempfile)) != -1) { + unlink(tempfile); + close(fd); + confined = 0; + return confined; + } + + confined = 1; + return confined; +} + +#else +int +unix_selinux_confined(void) +{ + return 0; +} +#endif + +#ifdef USE_LCKPWDF +int +lock_pwdf(void) +{ + int i; + int retval; + +#ifndef HELPER_COMPILE + if (unix_selinux_confined()) { + return PAM_SUCCESS; + } +#endif + /* These values for the number of attempts and the sleep time + are, of course, completely arbitrary. + My reading of the PAM docs is that, once pam_chauthtok() has been + called with PAM_UPDATE_AUTHTOK, we are obliged to take any + reasonable steps to make sure the token is updated; so retrying + for 1/10 sec. isn't overdoing it. */ + i=0; + while((retval = lckpwdf()) != 0 && i < 100) { + usleep(1000); + i++; + } + if(retval != 0) { + return PAM_AUTHTOK_LOCK_BUSY; + } + return PAM_SUCCESS; +} + +void +unlock_pwdf(void) +{ +#ifndef HELPER_COMPILE + if (unix_selinux_confined()) { + return; + } +#endif + ulckpwdf(); +} +#else +int +lock_pwdf(void) +{ + return PAM_SUCCESS; +} + +void +unlock_pwdf(void) +{ + return; +} +#endif + +int +save_old_password(const char *forwho, const char *oldpass, + int howmany) +{ + static char buf[16384]; + static char nbuf[16384]; + char *s_luser, *s_uid, *s_npas, *s_pas, *pass; + int npas; + FILE *pwfile, *opwfile; + int err = 0; + int oldmask; + int found = 0; + struct passwd *pwd = NULL; + struct stat st; +#ifdef WITH_SELINUX + security_context_t prev_context=NULL; +#endif + + if (howmany < 0) { + return PAM_SUCCESS; + } + + if (oldpass == NULL) { + return PAM_SUCCESS; + } + + oldmask = umask(077); + +#ifdef WITH_SELINUX + if (SELINUX_ENABLED) { + security_context_t passwd_context=NULL; + if (getfilecon("/etc/passwd",&passwd_context)<0) { + return PAM_AUTHTOK_ERR; + }; + if (getfscreatecon(&prev_context)<0) { + freecon(passwd_context); + return PAM_AUTHTOK_ERR; + } + if (setfscreatecon(passwd_context)) { + freecon(passwd_context); + freecon(prev_context); + return PAM_AUTHTOK_ERR; + } + freecon(passwd_context); + } +#endif + pwfile = fopen(OPW_TMPFILE, "w"); + umask(oldmask); + if (pwfile == NULL) { + err = 1; + goto done; + } + + opwfile = fopen(OLD_PASSWORDS_FILE, "r"); + if (opwfile == NULL) { + fclose(pwfile); + err = 1; + goto done; + } + + if (fstat(fileno(opwfile), &st) == -1) { + fclose(opwfile); + fclose(pwfile); + err = 1; + goto done; + } + + if (fchown(fileno(pwfile), st.st_uid, st.st_gid) == -1) { + fclose(opwfile); + fclose(pwfile); + err = 1; + goto done; + } + if (fchmod(fileno(pwfile), st.st_mode) == -1) { + fclose(opwfile); + fclose(pwfile); + err = 1; + goto done; + } + + while (fgets(buf, 16380, opwfile)) { + if (!strncmp(buf, forwho, strlen(forwho))) { + char *sptr = NULL; + found = 1; + if (howmany == 0) + continue; + buf[strlen(buf) - 1] = '\0'; + s_luser = strtok_r(buf, ":", &sptr); + s_uid = strtok_r(NULL, ":", &sptr); + s_npas = strtok_r(NULL, ":", &sptr); + s_pas = strtok_r(NULL, ":", &sptr); + npas = strtol(s_npas, NULL, 10) + 1; + while (npas > howmany) { + s_pas = strpbrk(s_pas, ","); + if (s_pas != NULL) + s_pas++; + npas--; + } + pass = crypt_md5_wrapper(oldpass); + if (s_pas == NULL) + snprintf(nbuf, sizeof(nbuf), "%s:%s:%d:%s\n", + s_luser, s_uid, npas, pass); + else + snprintf(nbuf, sizeof(nbuf),"%s:%s:%d:%s,%s\n", + s_luser, s_uid, npas, s_pas, pass); + _pam_delete(pass); + if (fputs(nbuf, pwfile) < 0) { + err = 1; + break; + } + } else if (fputs(buf, pwfile) < 0) { + err = 1; + break; + } + } + fclose(opwfile); + + if (!found) { + pwd = getpwnam(forwho); + if (pwd == NULL) { + err = 1; + } else { + pass = crypt_md5_wrapper(oldpass); + snprintf(nbuf, sizeof(nbuf), "%s:%lu:1:%s\n", + forwho, (unsigned long)pwd->pw_uid, pass); + _pam_delete(pass); + if (fputs(nbuf, pwfile) < 0) { + err = 1; + } + } + } + + if (fclose(pwfile)) { + D(("error writing entries to old passwords file: %m")); + err = 1; + } + +done: + if (!err) { + if (rename(OPW_TMPFILE, OLD_PASSWORDS_FILE)) + err = 1; + } +#ifdef WITH_SELINUX + if (SELINUX_ENABLED) { + if (setfscreatecon(prev_context)) { + err = 1; + } + if (prev_context) + freecon(prev_context); + prev_context=NULL; + } +#endif + if (!err) { + return PAM_SUCCESS; + } else { + unlink(OPW_TMPFILE); + return PAM_AUTHTOK_ERR; + } +} + +#ifdef HELPER_COMPILE +int +unix_update_passwd(const char *forwho, const char *towhat) +#else +int +unix_update_passwd(pam_handle_t *pamh, const char *forwho, const char *towhat) +#endif +{ + struct passwd *tmpent = NULL; + struct stat st; + FILE *pwfile, *opwfile; + int err = 1; + int oldmask; +#ifdef WITH_SELINUX + security_context_t prev_context=NULL; +#endif + + oldmask = umask(077); +#ifdef WITH_SELINUX + if (SELINUX_ENABLED) { + security_context_t passwd_context=NULL; + if (getfilecon("/etc/passwd",&passwd_context)<0) { + return PAM_AUTHTOK_ERR; + }; + if (getfscreatecon(&prev_context)<0) { + freecon(passwd_context); + return PAM_AUTHTOK_ERR; + } + if (setfscreatecon(passwd_context)) { + freecon(passwd_context); + freecon(prev_context); + return PAM_AUTHTOK_ERR; + } + freecon(passwd_context); + } +#endif + pwfile = fopen(PW_TMPFILE, "w"); + umask(oldmask); + if (pwfile == NULL) { + err = 1; + goto done; + } + + opwfile = fopen("/etc/passwd", "r"); + if (opwfile == NULL) { + fclose(pwfile); + err = 1; + goto done; + } + + if (fstat(fileno(opwfile), &st) == -1) { + fclose(opwfile); + fclose(pwfile); + err = 1; + goto done; + } + + if (fchown(fileno(pwfile), st.st_uid, st.st_gid) == -1) { + fclose(opwfile); + fclose(pwfile); + err = 1; + goto done; + } + if (fchmod(fileno(pwfile), st.st_mode) == -1) { + fclose(opwfile); + fclose(pwfile); + err = 1; + goto done; + } + + tmpent = fgetpwent(opwfile); + while (tmpent) { + if (!strcmp(tmpent->pw_name, forwho)) { + /* To shut gcc up */ + union { + const char *const_charp; + char *charp; + } assigned_passwd; + assigned_passwd.const_charp = towhat; + + tmpent->pw_passwd = assigned_passwd.charp; + err = 0; + } + if (putpwent(tmpent, pwfile)) { + D(("error writing entry to password file: %m")); + err = 1; + break; + } + tmpent = fgetpwent(opwfile); + } + fclose(opwfile); + + if (fclose(pwfile)) { + D(("error writing entries to password file: %m")); + err = 1; + } + +done: + if (!err) { + if (!rename(PW_TMPFILE, "/etc/passwd")) +#ifdef HELPER_COMPILE + helper_log_err( +#else + pam_syslog(pamh, +#endif + LOG_NOTICE, "password changed for %s", forwho); + else + err = 1; + } +#ifdef WITH_SELINUX + if (SELINUX_ENABLED) { + if (setfscreatecon(prev_context)) { + err = 1; + } + if (prev_context) + freecon(prev_context); + prev_context=NULL; + } +#endif + if (!err) { + return PAM_SUCCESS; + } else { + unlink(PW_TMPFILE); + return PAM_AUTHTOK_ERR; + } +} + +#ifdef HELPER_COMPILE +int +unix_update_shadow(const char *forwho, char *towhat) +#else +int +unix_update_shadow(pam_handle_t *pamh, const char *forwho, char *towhat) +#endif +{ + struct spwd *spwdent = NULL, *stmpent = NULL; + struct stat st; + FILE *pwfile, *opwfile; + int err = 1; + int oldmask; +#ifdef WITH_SELINUX + security_context_t prev_context=NULL; +#endif + + spwdent = getspnam(forwho); + if (spwdent == NULL) { + return PAM_USER_UNKNOWN; + } + oldmask = umask(077); + +#ifdef WITH_SELINUX + if (SELINUX_ENABLED) { + security_context_t shadow_context=NULL; + if (getfilecon("/etc/shadow",&shadow_context)<0) { + return PAM_AUTHTOK_ERR; + }; + if (getfscreatecon(&prev_context)<0) { + freecon(shadow_context); + return PAM_AUTHTOK_ERR; + } + if (setfscreatecon(shadow_context)) { + freecon(shadow_context); + freecon(prev_context); + return PAM_AUTHTOK_ERR; + } + freecon(shadow_context); + } +#endif + pwfile = fopen(SH_TMPFILE, "w"); + umask(oldmask); + if (pwfile == NULL) { + err = 1; + goto done; + } + + opwfile = fopen("/etc/shadow", "r"); + if (opwfile == NULL) { + fclose(pwfile); + err = 1; + goto done; + } + + if (fstat(fileno(opwfile), &st) == -1) { + fclose(opwfile); + fclose(pwfile); + err = 1; + goto done; + } + + if (fchown(fileno(pwfile), st.st_uid, st.st_gid) == -1) { + fclose(opwfile); + fclose(pwfile); + err = 1; + goto done; + } + if (fchmod(fileno(pwfile), st.st_mode) == -1) { + fclose(opwfile); + fclose(pwfile); + err = 1; + goto done; + } + + stmpent = fgetspent(opwfile); + while (stmpent) { + + if (!strcmp(stmpent->sp_namp, forwho)) { + stmpent->sp_pwdp = towhat; + stmpent->sp_lstchg = time(NULL) / (60 * 60 * 24); + err = 0; + D(("Set password %s for %s", stmpent->sp_pwdp, forwho)); + } + + if (putspent(stmpent, pwfile)) { + D(("error writing entry to shadow file: %m")); + err = 1; + break; + } + + stmpent = fgetspent(opwfile); + } + fclose(opwfile); + + if (fclose(pwfile)) { + D(("error writing entries to shadow file: %m")); + err = 1; + } + + done: + if (!err) { + if (!rename(SH_TMPFILE, "/etc/shadow")) +#ifdef HELPER_COMPILE + helper_log_err( +#else + pam_syslog(pamh, +#endif + LOG_NOTICE, "password changed for %s", forwho); + else + err = 1; + } + +#ifdef WITH_SELINUX + if (SELINUX_ENABLED) { + if (setfscreatecon(prev_context)) { + err = 1; + } + if (prev_context) + freecon(prev_context); + prev_context=NULL; + } +#endif + + if (!err) { + return PAM_SUCCESS; + } else { + unlink(SH_TMPFILE); + return PAM_AUTHTOK_ERR; + } +} + +#ifdef HELPER_COMPILE + +int +helper_verify_password(const char *name, const char *p, int nullok) +{ + struct passwd *pwd = NULL; + char *salt = NULL; + int retval; + + retval = get_pwd_hash(name, &pwd, &salt); + + if (pwd == NULL || salt == NULL) { + helper_log_err(LOG_WARNING, "check pass; user unknown"); + retval = PAM_USER_UNKNOWN; + } else { + retval = verify_pwd_hash(p, salt, nullok); + } + + if (salt) { + _pam_overwrite(salt); + _pam_drop(salt); + } + + p = NULL; /* no longer needed here */ + + return retval; +} + +void +helper_log_err(int err, const char *format, ...) +{ + va_list args; + + va_start(args, format); + openlog(HELPER_COMPILE, LOG_CONS | LOG_PID, LOG_AUTHPRIV); + vsyslog(err, format, args); + va_end(args); + closelog(); +} + +static void +su_sighandler(int sig) +{ +#ifndef SA_RESETHAND + /* emulate the behaviour of the SA_RESETHAND flag */ + if ( sig == SIGILL || sig == SIGTRAP || sig == SIGBUS || sig = SIGSERV ) + signal(sig, SIG_DFL); +#endif + if (sig > 0) { + _exit(sig); + } +} + +void +setup_signals(void) +{ + struct sigaction action; /* posix signal structure */ + + /* + * Setup signal handlers + */ + (void) memset((void *) &action, 0, sizeof(action)); + action.sa_handler = su_sighandler; +#ifdef SA_RESETHAND + action.sa_flags = SA_RESETHAND; +#endif + (void) sigaction(SIGILL, &action, NULL); + (void) sigaction(SIGTRAP, &action, NULL); + (void) sigaction(SIGBUS, &action, NULL); + (void) sigaction(SIGSEGV, &action, NULL); + action.sa_handler = SIG_IGN; + action.sa_flags = 0; + (void) sigaction(SIGTERM, &action, NULL); + (void) sigaction(SIGHUP, &action, NULL); + (void) sigaction(SIGINT, &action, NULL); + (void) sigaction(SIGQUIT, &action, NULL); +} + +char * +getuidname(uid_t uid) +{ + struct passwd *pw; + static char username[256]; + + pw = getpwuid(uid); + if (pw == NULL) + return NULL; + + strncpy(username, pw->pw_name, sizeof(username)); + username[sizeof(username) - 1] = '\0'; + + return username; +} + +int +read_passwords(int fd, int npass, char **passwords) +{ + int rbytes = 0; + int offset = 0; + int i = 0; + char *pptr; + while (npass > 0) { + rbytes = read(fd, passwords[i]+offset, MAXPASS-offset); + + if (rbytes < 0) { + if (errno == EINTR) continue; + break; + } + if (rbytes == 0) + break; + + while (npass > 0 && (pptr=memchr(passwords[i]+offset, '\0', rbytes)) + != NULL) { + rbytes -= pptr - (passwords[i]+offset) + 1; + i++; + offset = 0; + npass--; + if (rbytes > 0) { + if (npass > 0) + memcpy(passwords[i], pptr+1, rbytes); + memset(pptr+1, '\0', rbytes); + } + } + offset += rbytes; + } + + /* clear up */ + if (offset > 0 && npass > 0) { + memset(passwords[i], '\0', offset); + } + + return i; +} + +#endif +/* ****************************************************************** * + * Copyright (c) Jan Rêkorajski 1999. + * Copyright (c) Andrew G. Morgan 1996-8. + * Copyright (c) Alex O. Yuriev, 1996. + * Copyright (c) Cristian Gafton 1996. + * Copyright (c) Red Hat, Inc. 1996, 2007, 2008. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, and the entire permission notice in its entirety, + * including the disclaimer of warranties. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. The name of the author may not be used to endorse or promote + * products derived from this software without specific prior + * written permission. + * + * ALTERNATIVELY, this product may be distributed under the terms of + * the GNU Public License, in which case the provisions of the GPL are + * required INSTEAD OF the above restrictions. (This clause is + * necessary due to a potential bad interaction between the GPL and + * the restrictions contained in a BSD-style copyright.) + * + * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED + * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, + * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES + * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR + * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + */ diff --git a/Linux-PAM/modules/pam_unix/passverify.h b/Linux-PAM/modules/pam_unix/passverify.h new file mode 100644 index 00000000..e8e112d0 --- /dev/null +++ b/Linux-PAM/modules/pam_unix/passverify.h @@ -0,0 +1,124 @@ +/* + * Copyright information at end of file. + */ + +#include <sys/types.h> +#include <pwd.h> +#include <security/pam_modules.h> + +#define PAM_UNIX_RUN_HELPER PAM_CRED_INSUFFICIENT + +#define MAXPASS 200 /* the maximum length of a password */ + +#define OLD_PASSWORDS_FILE "/etc/security/opasswd" + +int +verify_pwd_hash(const char *p, char *hash, unsigned int nullok); + +int +is_pwd_shadowed(const struct passwd *pwd); + +char * +crypt_md5_wrapper(const char *pass_new); + +char * +create_password_hash(const char *password, unsigned int ctrl, int rounds); + +int +unix_selinux_confined(void); + +int +lock_pwdf(void); + +void +unlock_pwdf(void); + +int +save_old_password(const char *forwho, const char *oldpass, + int howmany); + +#ifdef HELPER_COMPILE +void +helper_log_err(int err, const char *format,...); + +int +helper_verify_password(const char *name, const char *p, int nullok); + +void +setup_signals(void); + +char * +getuidname(uid_t uid); + +int +read_passwords(int fd, int npass, char **passwords); + +int +get_account_info(const char *name, + struct passwd **pwd, struct spwd **spwdent); + +int +get_pwd_hash(const char *name, + struct passwd **pwd, char **hash); + +int +check_shadow_expiry(struct spwd *spent, int *daysleft); + +int +unix_update_passwd(const char *forwho, const char *towhat); + +int +unix_update_shadow(const char *forwho, char *towhat); +#else +int +get_account_info(pam_handle_t *pamh, const char *name, + struct passwd **pwd, struct spwd **spwdent); + +int +get_pwd_hash(pam_handle_t *pamh, const char *name, + struct passwd **pwd, char **hash); + +int +check_shadow_expiry(pam_handle_t *pamh, struct spwd *spent, int *daysleft); + +int +unix_update_passwd(pam_handle_t *pamh, const char *forwho, const char *towhat); + +int +unix_update_shadow(pam_handle_t *pamh, const char *forwho, char *towhat); +#endif + +/* ****************************************************************** * + * Copyright (c) Red Hat, Inc. 2007. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, and the entire permission notice in its entirety, + * including the disclaimer of warranties. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. The name of the author may not be used to endorse or promote + * products derived from this software without specific prior + * written permission. + * + * ALTERNATIVELY, this product may be distributed under the terms of + * the GNU Public License, in which case the provisions of the GPL are + * required INSTEAD OF the above restrictions. (This clause is + * necessary due to a potential bad interaction between the GPL and + * the restrictions contained in a BSD-style copyright.) + * + * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED + * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, + * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES + * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR + * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + */ diff --git a/Linux-PAM/modules/pam_unix/support.c b/Linux-PAM/modules/pam_unix/support.c index 1472b966..b82cad26 100644 --- a/Linux-PAM/modules/pam_unix/support.c +++ b/Linux-PAM/modules/pam_unix/support.c @@ -26,9 +26,8 @@ #include <security/pam_ext.h> #include <security/pam_modutil.h> -#include "md5.h" #include "support.h" -#include "bigcrypt.h" +#include "passverify.h" #ifdef WITH_SELINUX #include <selinux/selinux.h> #define SELINUX_ENABLED is_selinux_enabled()>0 @@ -53,8 +52,8 @@ int _make_remark(pam_handle_t * pamh, unsigned int ctrl, * set the control flags for the UNIX module. */ -int _set_ctrl(pam_handle_t *pamh, int flags, int *remember, int argc, - const char **argv) +int _set_ctrl(pam_handle_t *pamh, int flags, int *remember, int *rounds, + int argc, const char **argv) { unsigned int ctrl; @@ -110,6 +109,16 @@ int _set_ctrl(pam_handle_t *pamh, int flags, int *remember, int argc, *remember = 400; } } + if (rounds != NULL) { + if (j == UNIX_ALGO_ROUNDS) { + *rounds = strtol(*argv + 7, NULL, 10); + if ((*rounds < 1000) || (*rounds == INT_MAX)) + /* don't care about bogus values */ + unset(UNIX_ALGO_ROUNDS, ctrl); + if (*rounds >= 10000000) + *rounds = 9999999; + } + } } ++argv; /* step to next argument */ @@ -377,95 +386,6 @@ int _unix_comesfromsource(pam_handle_t *pamh, } /* - * _unix_blankpasswd() is a quick check for a blank password - * - * returns TRUE if user does not have a password - * - to avoid prompting for one in such cases (CG) - */ - -int -_unix_blankpasswd (pam_handle_t *pamh, unsigned int ctrl, const char *name) -{ - struct passwd *pwd = NULL; - struct spwd *spwdent = NULL; - char *salt = NULL; - int retval; - - D(("called")); - - /* - * This function does not have to be too smart if something goes - * wrong, return FALSE and let this case to be treated somewhere - * else (CG) - */ - - if (on(UNIX__NONULL, ctrl)) - return 0; /* will fail but don't let on yet */ - - /* UNIX passwords area */ - - /* Get password file entry... */ - pwd = pam_modutil_getpwnam (pamh, name); - - if (pwd != NULL) { - if (strcmp( pwd->pw_passwd, "*NP*" ) == 0) - { /* NIS+ */ - uid_t save_euid, save_uid; - - save_euid = geteuid(); - save_uid = getuid(); - if (save_uid == pwd->pw_uid) - setreuid( save_euid, save_uid ); - else { - setreuid( 0, -1 ); - if (setreuid( -1, pwd->pw_uid ) == -1) { - setreuid( -1, 0 ); - setreuid( 0, -1 ); - if(setreuid( -1, pwd->pw_uid ) == -1) - /* Will fail elsewhere. */ - return 0; - } - } - - spwdent = pam_modutil_getspnam (pamh, name); - if (save_uid == pwd->pw_uid) - setreuid( save_uid, save_euid ); - else { - if (setreuid( -1, 0 ) == -1) - setreuid( save_uid, -1 ); - setreuid( -1, save_euid ); - } - } else if (_unix_shadowed(pwd)) { - /* - * ...and shadow password file entry for this user, - * if shadowing is enabled - */ - spwdent = pam_modutil_getspnam(pamh, name); - } - if (spwdent) - salt = x_strdup(spwdent->sp_pwdp); - else - salt = x_strdup(pwd->pw_passwd); - } - /* Does this user have a password? */ - if (salt == NULL) { - retval = 0; - } else { - if (strlen(salt) == 0) - retval = 1; - else - retval = 0; - } - - /* tidy up */ - - if (salt) - _pam_delete(salt); - - return retval; -} - -/* * verify the password of a user */ @@ -519,7 +439,7 @@ static int _unix_run_helper_binary(pam_handle_t *pamh, const char *passwd, } } - if (SELINUX_ENABLED && geteuid() == 0) { + if (geteuid() == 0) { /* must set the real uid to 0 so the helper will not error out if pam is called from setuid binary (su, sudo...) */ setuid(0); @@ -573,13 +493,66 @@ static int _unix_run_helper_binary(pam_handle_t *pamh, const char *passwd, return retval; } +/* + * _unix_blankpasswd() is a quick check for a blank password + * + * returns TRUE if user does not have a password + * - to avoid prompting for one in such cases (CG) + */ + +int +_unix_blankpasswd (pam_handle_t *pamh, unsigned int ctrl, const char *name) +{ + struct passwd *pwd = NULL; + char *salt = NULL; + int retval; + + D(("called")); + + /* + * This function does not have to be too smart if something goes + * wrong, return FALSE and let this case to be treated somewhere + * else (CG) + */ + + if (on(UNIX__NONULL, ctrl)) + return 0; /* will fail but don't let on yet */ + + /* UNIX passwords area */ + + retval = get_pwd_hash(pamh, name, &pwd, &salt); + + if (retval == PAM_UNIX_RUN_HELPER) { + /* salt will not be set here so we can return immediately */ + if (_unix_run_helper_binary(pamh, NULL, ctrl, name) == PAM_SUCCESS) + return 1; + else + return 0; + } + + /* Does this user have a password? */ + if (salt == NULL) { + retval = 0; + } else { + if (strlen(salt) == 0) + retval = 1; + else + retval = 0; + } + + /* tidy up */ + + if (salt) + _pam_delete(salt); + + return retval; +} + int _unix_verify_password(pam_handle_t * pamh, const char *name ,const char *p, unsigned int ctrl) { struct passwd *pwd = NULL; - struct spwd *spwdent = NULL; char *salt = NULL; - char *pp = NULL; char *data_name; int retval; @@ -597,48 +570,7 @@ int _unix_verify_password(pam_handle_t * pamh, const char *name D(("locating user's record")); - /* UNIX passwords area */ - pwd = pam_modutil_getpwnam (pamh, name); /* Get password file entry... */ - - if (pwd != NULL) { - if (strcmp( pwd->pw_passwd, "*NP*" ) == 0) - { /* NIS+ */ - uid_t save_euid, save_uid; - - save_euid = geteuid(); - save_uid = getuid(); - if (save_uid == pwd->pw_uid) - setreuid( save_euid, save_uid ); - else { - setreuid( 0, -1 ); - if (setreuid( -1, pwd->pw_uid ) == -1) { - setreuid( -1, 0 ); - setreuid( 0, -1 ); - if(setreuid( -1, pwd->pw_uid ) == -1) - return PAM_CRED_INSUFFICIENT; - } - } - - spwdent = pam_modutil_getspnam (pamh, name); - if (save_uid == pwd->pw_uid) - setreuid( save_uid, save_euid ); - else { - if (setreuid( -1, 0 ) == -1) - setreuid( save_uid, -1 ); - setreuid( -1, save_euid ); - } - } else if (_unix_shadowed(pwd)) { - /* - * ...and shadow password file entry for this user, - * if shadowing is enabled - */ - spwdent = pam_modutil_getspnam (pamh, name); - } - if (spwdent) - salt = x_strdup(spwdent->sp_pwdp); - else - salt = x_strdup(pwd->pw_passwd); - } + retval = get_pwd_hash(pamh, name, &pwd, &salt); data_name = (char *) malloc(sizeof(FAIL_PREFIX) + strlen(name)); if (data_name == NULL) { @@ -648,20 +580,13 @@ int _unix_verify_password(pam_handle_t * pamh, const char *name strcpy(data_name + sizeof(FAIL_PREFIX) - 1, name); } - retval = PAM_SUCCESS; - if (pwd == NULL || salt == NULL || !strcmp(salt, "x") || ((salt[0] == '#') && (salt[1] == '#') && !strcmp(salt + 2, name))) { - - if (pwd != NULL && (geteuid() || SELINUX_ENABLED)) { - /* we are not root perhaps this is the reason? Run helper */ + if (retval != PAM_SUCCESS) { + if (retval == PAM_UNIX_RUN_HELPER) { D(("running helper binary")); retval = _unix_run_helper_binary(pamh, p, ctrl, name); } else { D(("user's record unavailable")); p = NULL; - if (pwd == NULL) - retval = PAM_USER_UNKNOWN; - else - retval = PAM_AUTHINFO_UNAVAIL; if (on(UNIX_AUDIT, ctrl)) { /* this might be a typo and the user has given a password instead of a username. Careful with this. */ @@ -679,48 +604,7 @@ int _unix_verify_password(pam_handle_t * pamh, const char *name } } } else { - size_t salt_len = strlen(salt); - if (!salt_len) { - /* the stored password is NULL */ - if (off(UNIX__NONULL, ctrl)) {/* this means we've succeeded */ - D(("user has empty password - access granted")); - retval = PAM_SUCCESS; - } else { - D(("user has empty password - access denied")); - retval = PAM_AUTH_ERR; - } - } else if (!p || *salt == '*' || *salt == '!') { - retval = PAM_AUTH_ERR; - } else { - if (!strncmp(salt, "$1$", 3)) { - pp = Goodcrypt_md5(p, salt); - if (pp && strcmp(pp, salt) != 0) { - _pam_delete(pp); - pp = Brokencrypt_md5(p, salt); - } - } else if (*salt != '$' && salt_len >= 13) { - pp = bigcrypt(p, salt); - if (pp && salt_len == 13 && strlen(pp) > salt_len) { - _pam_overwrite(pp + salt_len); - } - } else { - /* - * Ok, we don't know the crypt algorithm, but maybe - * libcrypt nows about it? We should try it. - */ - pp = x_strdup (crypt(p, salt)); - } - p = NULL; /* no longer needed here */ - - /* the moment of truth -- do we agree with the password? */ - D(("comparing state of pp[%s] and salt[%s]", pp, salt)); - - if (pp && strcmp(pp, salt) == 0) { - retval = PAM_SUCCESS; - } else { - retval = PAM_AUTH_ERR; - } - } + retval = verify_pwd_hash(p, salt, off(UNIX__NONULL, ctrl)); } if (retval == PAM_SUCCESS) { @@ -809,8 +693,6 @@ cleanup: _pam_delete(data_name); if (salt) _pam_delete(salt); - if (pp) - _pam_delete(pp); D(("done [%d].", retval)); @@ -971,26 +853,12 @@ int _unix_read_password(pam_handle_t * pamh return PAM_SUCCESS; } -int _unix_shadowed(const struct passwd *pwd) -{ - if (pwd != NULL) { - if (strcmp(pwd->pw_passwd, "x") == 0) { - return 1; - } - if ((pwd->pw_passwd[0] == '#') && - (pwd->pw_passwd[1] == '#') && - (strcmp(pwd->pw_name, pwd->pw_passwd + 2) == 0)) { - return 1; - } - } - return 0; -} - /* ****************************************************************** * * Copyright (c) Jan Rêkorajski 1999. * Copyright (c) Andrew G. Morgan 1996-8. * Copyright (c) Alex O. Yuriev, 1996. * Copyright (c) Cristian Gafton 1996. + * Copyright (c) Red Hat, Inc. 2007. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions diff --git a/Linux-PAM/modules/pam_unix/support.h b/Linux-PAM/modules/pam_unix/support.h index 1eb662fc..3ccdc5c7 100644 --- a/Linux-PAM/modules/pam_unix/support.h +++ b/Linux-PAM/modules/pam_unix/support.h @@ -1,5 +1,5 @@ /* - * $Id: support.h,v 1.12 2005/09/26 14:27:09 t8m Exp $ + * $Id: support.h,v 1.14 2008/01/23 15:35:13 t8m Exp $ */ #ifndef _PAM_UNIX_SUPPORT_H @@ -84,8 +84,12 @@ typedef struct { #define UNIX_NOREAP 21 /* don't reap child process */ #define UNIX_BROKEN_SHADOW 22 /* ignore errors reading password aging * information during acct management */ +#define UNIX_SHA256_PASS 23 /* new password hashes will use SHA256 */ +#define UNIX_SHA512_PASS 24 /* new password hashes will use SHA512 */ +#define UNIX_ALGO_ROUNDS 25 /* optional number of rounds for new + password hash algorithms */ /* -------------- */ -#define UNIX_CTRLS_ 23 /* number of ctrl arguments defined */ +#define UNIX_CTRLS_ 26 /* number of ctrl arguments defined */ static const UNIX_Ctrls unix_args[UNIX_CTRLS_] = @@ -116,6 +120,9 @@ static const UNIX_Ctrls unix_args[UNIX_CTRLS_] = /* UNIX_REMEMBER_PASSWD */ {"remember=", _ALL_ON_, 02000000}, /* UNIX_NOREAP */ {"noreap", _ALL_ON_, 04000000}, /* UNIX_BROKEN_SHADOW */ {"broken_shadow", _ALL_ON_, 010000000}, +/* UNIX_SHA256_PASS */ {"sha256", _ALL_ON_^(040420000), 020000000}, +/* UNIX_SHA512_PASS */ {"sha512", _ALL_ON_^(020420000), 040000000}, +/* UNIX_ALGO_ROUNDS */ {"rounds=", _ALL_ON_, 0100000000}, }; #define UNIX_DEFAULTS (unix_args[UNIX__NONULL].flag) @@ -131,8 +138,8 @@ static const UNIX_Ctrls unix_args[UNIX_CTRLS_] = extern int _make_remark(pam_handle_t * pamh, unsigned int ctrl ,int type, const char *text); -extern int _set_ctrl(pam_handle_t * pamh, int flags, int *remember, int argc, - const char **argv); +extern int _set_ctrl(pam_handle_t * pamh, int flags, int *remember, int *rounds, + int argc, const char **argv); extern int _unix_getpwnam (pam_handle_t *pamh, const char *name, int files, int nis, struct passwd **ret); @@ -149,7 +156,7 @@ extern int _unix_read_password(pam_handle_t * pamh ,const char *prompt2 ,const char *data_name ,const void **pass); -extern int _unix_shadowed(const struct passwd *pwd); -extern struct spwd *_unix_run_verify_binary(pam_handle_t *pamh, unsigned int ctrl, const char *user); +extern int _unix_run_verify_binary(pam_handle_t *pamh, + unsigned int ctrl, const char *user, int *daysleft); #endif /* _PAM_UNIX_SUPPORT_H */ diff --git a/Linux-PAM/modules/pam_unix/unix_chkpwd.8 b/Linux-PAM/modules/pam_unix/unix_chkpwd.8 index 02ccfe4a..6c7f0647 100644 --- a/Linux-PAM/modules/pam_unix/unix_chkpwd.8 +++ b/Linux-PAM/modules/pam_unix/unix_chkpwd.8 @@ -1,80 +1,38 @@ -.\" Copyright (C) 2003 International Business Machines Corporation -.\" This file is distributed according to the GNU General Public License. -.\" See the file COPYING in the top level source directory for details. +.\" Title: unix_chkpwd +.\" Author: +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/28/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.de Sh \" Subsection -.br -.if t .Sp -.ne 5 -.PP -\fB\\$1\fR -.PP -.. -.de Sp \" Vertical space (when we can't use .PP) -.if t .sp .5v -.if n .sp -.. -.de Ip \" List item -.br -.ie \\n(.$>=3 .ne \\$3 -.el .ne 3 -.IP "\\$1" \\$2 -.. -.TH "UNIX_CHKPWD" 8 "2003-03-21" "Linux-PAM 0.76" "Linux-PAM Manual" -.SH NAME -unix_chkpwd \- helper binary that verifies the password of the current user -.SH "SYNOPSIS" +.TH "UNIX_CHKPWD" "8" "01/28/2008" "Linux-PAM Manual" "Linux\-PAM Manual" +.\" disable hyphenation +.nh +.\" disable justification (adjust text to left margin only) .ad l -.hy 0 - -/sbin/unix_chkpwd [\fIusername\fR] -.sp -.ad -.hy +.SH "NAME" +unix_chkpwd - Helper binary that verifies the password of the current user +.SH "SYNOPSIS" +.HP 12 +\fBunix_chkpwd\fR [\.\.\.] .SH "DESCRIPTION" .PP -\fBunix_chkpwd\fR is a helper program for the pam_unix module that verifies -the password of the current user. It is not intended to be run directly from -the command line and logs a security violation if done so. - -It is typically installed setuid root or setgid shadow. -.SH "OPTIONS" +\fIunix_chkpwd\fR +is a helper program for the +\fIpam_unix\fR +module that verifies the password of the current user\. It also checks password and account expiration dates in +\fIshadow\fR\. It is not intended to be run directly from the command line and logs a security violation if done so\. .PP -unix_pwdchk optionally takes the following argument: -.TP -\fIusername\fR -The username of the user whose password you want to check: this must match the current user id. - -.SH "INPUTS" +It is typically installed setuid root or setgid shadow\. .PP -unix_pwdchk expects the following inputs via stdin: -.TP -\fIoption\fR -Either nullok or nonull, depending on whether the user can have an empty password. -.TP -\fIpassword\fR -The password to verify. - -.SH "RETURN CODES" -.PP -\fBunix_chkpwd\fR has the following return codes: -.TP -1 -unix_chkpwd was inappropriately called from the command line or the password is incorrect. - -.TP -0 -The password is correct. - -.SH "HISTORY" -Written by Andrew Morgan - +The interface of the helper \- command line options, and input/output data format are internal to the +\fIpam_unix\fR +module and it should not be called directly from applications\. .SH "SEE ALSO" - .PP -\fBpam\fR(8) - -.SH AUTHOR -Emily Ratliff. +\fBpam_unix\fR(8) +.SH "AUTHOR" +.PP +Written by Andrew Morgan and other various people\. diff --git a/Linux-PAM/modules/pam_unix/unix_chkpwd.8.xml b/Linux-PAM/modules/pam_unix/unix_chkpwd.8.xml new file mode 100644 index 00000000..a10dbe33 --- /dev/null +++ b/Linux-PAM/modules/pam_unix/unix_chkpwd.8.xml @@ -0,0 +1,67 @@ +<?xml version="1.0" encoding='UTF-8'?> +<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN" + "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd"> + +<refentry id="unix_chkpwd"> + + <refmeta> + <refentrytitle>unix_chkpwd</refentrytitle> + <manvolnum>8</manvolnum> + <refmiscinfo class="sectdesc">Linux-PAM Manual</refmiscinfo> + </refmeta> + + <refnamediv id="unix_chkpwd-name"> + <refname>unix_chkpwd</refname> + <refpurpose>Helper binary that verifies the password of the current user</refpurpose> + </refnamediv> + + <refsynopsisdiv> + <cmdsynopsis id="unix_chkpwd-cmdsynopsis"> + <command>unix_chkpwd</command> + <arg choice="opt"> + ... + </arg> + </cmdsynopsis> + </refsynopsisdiv> + + <refsect1 id="unix_chkpwd-description"> + + <title>DESCRIPTION</title> + + <para> + <emphasis>unix_chkpwd</emphasis> is a helper program for the + <emphasis>pam_unix</emphasis> module that verifies the + password of the current user. It also checks password and account + expiration dates in <emphasis>shadow</emphasis>. It is not intended to + be run directly from the command line and logs a security violation if + done so. + </para> + + <para> + It is typically installed setuid root or setgid shadow. + </para> + + <para> + The interface of the helper - command line options, and input/output + data format are internal to the <emphasis>pam_unix</emphasis> + module and it should not be called directly from applications. + </para> + </refsect1> + + <refsect1 id='unix_chkpwd-see_also'> + <title>SEE ALSO</title> + <para> + <citerefentry> + <refentrytitle>pam_unix</refentrytitle><manvolnum>8</manvolnum> + </citerefentry> + </para> + </refsect1> + + <refsect1 id='unix_chkpwd-author'> + <title>AUTHOR</title> + <para> + Written by Andrew Morgan and other various people. + </para> + </refsect1> + +</refentry> diff --git a/Linux-PAM/modules/pam_unix/unix_chkpwd.c b/Linux-PAM/modules/pam_unix/unix_chkpwd.c index 486a8498..11ac3aac 100644 --- a/Linux-PAM/modules/pam_unix/unix_chkpwd.c +++ b/Linux-PAM/modules/pam_unix/unix_chkpwd.c @@ -13,7 +13,6 @@ #include "config.h" -#include <stdarg.h> #include <stdio.h> #include <stdlib.h> #include <string.h> @@ -25,401 +24,34 @@ #include <shadow.h> #include <signal.h> #include <time.h> -#ifdef WITH_SELINUX -#include <selinux/selinux.h> -#define SELINUX_ENABLED (selinux_enabled!=-1 ? selinux_enabled : (selinux_enabled=is_selinux_enabled()>0)) -static security_context_t prev_context=NULL; -static int selinux_enabled=-1; -#else -#define SELINUX_ENABLED 0 -#endif - -#define MAXPASS 200 /* the maximum length of a password */ #include <security/_pam_types.h> #include <security/_pam_macros.h> -#include "md5.h" -#include "bigcrypt.h" - -/* syslogging function for errors and other information */ - -static void _log_err(int err, const char *format,...) -{ - va_list args; - - va_start(args, format); - openlog("unix_chkpwd", LOG_CONS | LOG_PID, LOG_AUTHPRIV); - vsyslog(err, format, args); - va_end(args); - closelog(); -} - -static int _unix_shadowed(const struct passwd *pwd) -{ - char hashpass[1024]; - if (pwd != NULL) { - if (strcmp(pwd->pw_passwd, "x") == 0) { - return 1; - } - if (strlen(pwd->pw_name) < sizeof(hashpass) - 2) { - strcpy(hashpass, "##"); - strcpy(hashpass + 2, pwd->pw_name); - if (strcmp(pwd->pw_passwd, hashpass) == 0) { - return 1; - } - } - } - return 0; -} - -static void su_sighandler(int sig) -{ -#ifndef SA_RESETHAND - /* emulate the behaviour of the SA_RESETHAND flag */ - if ( sig == SIGILL || sig == SIGTRAP || sig == SIGBUS || sig = SIGSERV ) - signal(sig, SIG_DFL); -#endif - if (sig > 0) { - _log_err(LOG_NOTICE, "caught signal %d.", sig); - exit(sig); - } -} - -static void setup_signals(void) -{ - struct sigaction action; /* posix signal structure */ - - /* - * Setup signal handlers - */ - (void) memset((void *) &action, 0, sizeof(action)); - action.sa_handler = su_sighandler; -#ifdef SA_RESETHAND - action.sa_flags = SA_RESETHAND; -#endif - (void) sigaction(SIGILL, &action, NULL); - (void) sigaction(SIGTRAP, &action, NULL); - (void) sigaction(SIGBUS, &action, NULL); - (void) sigaction(SIGSEGV, &action, NULL); - action.sa_handler = SIG_IGN; - action.sa_flags = 0; - (void) sigaction(SIGTERM, &action, NULL); - (void) sigaction(SIGHUP, &action, NULL); - (void) sigaction(SIGINT, &action, NULL); - (void) sigaction(SIGQUIT, &action, NULL); -} +#include "passverify.h" -static int _verify_account(const char * const uname) +static int _check_expiry(const char *uname) { struct spwd *spent; struct passwd *pwent; + int retval; + int daysleft; - pwent = getpwnam(uname); - if (!pwent) { - _log_err(LOG_ALERT, "could not identify user (from getpwnam(%s))", uname); - return PAM_USER_UNKNOWN; + retval = get_account_info(uname, &pwent, &spent); + if (retval != PAM_SUCCESS) { + helper_log_err(LOG_ALERT, "could not obtain user info (%s)", uname); + printf("-1\n"); + return retval; } - - spent = getspnam( uname ); - if (!spent) { - _log_err(LOG_ALERT, "could not get username from shadow (%s))", uname); - return PAM_AUTHINFO_UNAVAIL; /* Couldn't get username from shadow */ + + if (spent == NULL) { + printf("-1\n"); + return retval; } - printf("%ld:%ld:%ld:%ld:%ld:%ld", - spent->sp_lstchg, /* last password change */ - spent->sp_min, /* days until change allowed. */ - spent->sp_max, /* days before change required */ - spent->sp_warn, /* days warning for expiration */ - spent->sp_inact, /* days before account inactive */ - spent->sp_expire); /* date when account expires */ - - return PAM_SUCCESS; -} - -static int _unix_verify_password(const char *name, const char *p, int nullok) -{ - struct passwd *pwd = NULL; - struct spwd *spwdent = NULL; - char *salt = NULL; - char *pp = NULL; - int retval = PAM_AUTH_ERR; - size_t salt_len; - - /* UNIX passwords area */ - setpwent(); - pwd = getpwnam(name); /* Get password file entry... */ - endpwent(); - if (pwd != NULL) { - if (_unix_shadowed(pwd)) { - /* - * ...and shadow password file entry for this user, - * if shadowing is enabled - */ - setspent(); - spwdent = getspnam(name); - endspent(); - if (spwdent != NULL) - salt = x_strdup(spwdent->sp_pwdp); - else - pwd = NULL; - } else { - if (strcmp(pwd->pw_passwd, "*NP*") == 0) { /* NIS+ */ - uid_t save_uid; - - save_uid = geteuid(); - seteuid(pwd->pw_uid); - spwdent = getspnam(name); - seteuid(save_uid); - - salt = x_strdup(spwdent->sp_pwdp); - } else { - salt = x_strdup(pwd->pw_passwd); - } - } - } - if (pwd == NULL || salt == NULL) { - _log_err(LOG_WARNING, "check pass; user unknown"); - p = NULL; - return PAM_USER_UNKNOWN; - } - - salt_len = strlen(salt); - if (salt_len == 0) { - return (nullok == 0) ? PAM_AUTH_ERR : PAM_SUCCESS; - } - if (p == NULL || strlen(p) == 0) { - _pam_overwrite(salt); - _pam_drop(salt); - return PAM_AUTHTOK_ERR; - } - - /* the moment of truth -- do we agree with the password? */ - retval = PAM_AUTH_ERR; - if (!strncmp(salt, "$1$", 3)) { - pp = Goodcrypt_md5(p, salt); - if (pp && strcmp(pp, salt) == 0) { - retval = PAM_SUCCESS; - } else { - _pam_overwrite(pp); - _pam_drop(pp); - pp = Brokencrypt_md5(p, salt); - if (pp && strcmp(pp, salt) == 0) - retval = PAM_SUCCESS; - } - } else if (*salt == '$') { - /* - * Ok, we don't know the crypt algorithm, but maybe - * libcrypt nows about it? We should try it. - */ - pp = x_strdup (crypt(p, salt)); - if (pp && strcmp(pp, salt) == 0) { - retval = PAM_SUCCESS; - } - } else if (*salt == '*' || *salt == '!' || salt_len < 13) { - retval = PAM_AUTH_ERR; - } else { - pp = bigcrypt(p, salt); - /* - * Note, we are comparing the bigcrypt of the password with - * the contents of the password field. If the latter was - * encrypted with regular crypt (and not bigcrypt) it will - * have been truncated for storage relative to the output - * of bigcrypt here. As such we need to compare only the - * stored string with the subset of bigcrypt's result. - * Bug 521314. - */ - if (pp && salt_len == 13 && strlen(pp) > salt_len) { - _pam_overwrite(pp+salt_len); - } - - if (pp && strcmp(pp, salt) == 0) { - retval = PAM_SUCCESS; - } - } - p = NULL; /* no longer needed here */ - - /* clean up */ - _pam_overwrite(pp); - _pam_drop(pp); - - return retval; -} - -static char *getuidname(uid_t uid) -{ - struct passwd *pw; - static char username[32]; - - pw = getpwuid(uid); - if (pw == NULL) - return NULL; - - strncpy(username, pw->pw_name, sizeof(username)); - username[sizeof(username) - 1] = '\0'; - - return username; -} -#define SH_TMPFILE "/etc/nshadow" -static int _update_shadow(const char *forwho) -{ - struct spwd *spwdent = NULL, *stmpent = NULL; - FILE *pwfile, *opwfile; - int err = 1; - int oldmask; - struct stat st; - char pass[MAXPASS + 1]; - char towhat[MAXPASS + 1]; - int npass=0; - - /* read the password from stdin (a pipe from the pam_unix module) */ - - npass = read(STDIN_FILENO, pass, MAXPASS); - - if (npass < 0) { /* is it a valid password? */ - - _log_err(LOG_DEBUG, "no password supplied"); - return PAM_AUTHTOK_ERR; - - } else if (npass >= MAXPASS) { - - _log_err(LOG_DEBUG, "password too long"); - return PAM_AUTHTOK_ERR; - - } else { - /* does pass agree with the official one? */ - int retval=0; - pass[npass] = '\0'; /* NUL terminate */ - retval = _unix_verify_password(forwho, pass, 0); - if (retval != PAM_SUCCESS) { + retval = check_shadow_expiry(spent, &daysleft); + printf("%d\n", daysleft); return retval; - } - } - - /* read the password from stdin (a pipe from the pam_unix module) */ - - npass = read(STDIN_FILENO, towhat, MAXPASS); - - if (npass < 0) { /* is it a valid password? */ - - _log_err(LOG_DEBUG, "no new password supplied"); - return PAM_AUTHTOK_ERR; - - } else if (npass >= MAXPASS) { - - _log_err(LOG_DEBUG, "new password too long"); - return PAM_AUTHTOK_ERR; - - } - - towhat[npass] = '\0'; /* NUL terminate */ - spwdent = getspnam(forwho); - if (spwdent == NULL) { - return PAM_USER_UNKNOWN; - } - oldmask = umask(077); - -#ifdef WITH_SELINUX - if (SELINUX_ENABLED) { - security_context_t shadow_context=NULL; - if (getfilecon("/etc/shadow",&shadow_context)<0) { - return PAM_AUTHTOK_ERR; - }; - if (getfscreatecon(&prev_context)<0) { - freecon(shadow_context); - return PAM_AUTHTOK_ERR; - } - if (setfscreatecon(shadow_context)) { - freecon(shadow_context); - freecon(prev_context); - return PAM_AUTHTOK_ERR; - } - freecon(shadow_context); - } -#endif - pwfile = fopen(SH_TMPFILE, "w"); - umask(oldmask); - if (pwfile == NULL) { - err = 1; - goto done; - } - - opwfile = fopen("/etc/shadow", "r"); - if (opwfile == NULL) { - fclose(pwfile); - err = 1; - goto done; - } - - if (fstat(fileno(opwfile), &st) == -1) { - fclose(opwfile); - fclose(pwfile); - err = 1; - goto done; - } - - if (fchown(fileno(pwfile), st.st_uid, st.st_gid) == -1) { - fclose(opwfile); - fclose(pwfile); - err = 1; - goto done; - } - if (fchmod(fileno(pwfile), st.st_mode) == -1) { - fclose(opwfile); - fclose(pwfile); - err = 1; - goto done; - } - - stmpent = fgetspent(opwfile); - while (stmpent) { - - if (!strcmp(stmpent->sp_namp, forwho)) { - stmpent->sp_pwdp = towhat; - stmpent->sp_lstchg = time(NULL) / (60 * 60 * 24); - err = 0; - D(("Set password %s for %s", stmpent->sp_pwdp, forwho)); - } - - if (putspent(stmpent, pwfile)) { - D(("error writing entry to shadow file: %m")); - err = 1; - break; - } - - stmpent = fgetspent(opwfile); - } - fclose(opwfile); - - if (fclose(pwfile)) { - D(("error writing entries to shadow file: %m")); - err = 1; - } - - done: - if (!err) { - if (rename(SH_TMPFILE, "/etc/shadow")) - err = 1; - } - -#ifdef WITH_SELINUX - if (SELINUX_ENABLED) { - if (setfscreatecon(prev_context)) { - err = 1; - } - if (prev_context) - freecon(prev_context); - prev_context=NULL; - } -#endif - - if (!err) { - return PAM_SUCCESS; - } else { - unlink(SH_TMPFILE); - return PAM_AUTHTOK_ERR; - } } int main(int argc, char *argv[]) @@ -427,9 +59,10 @@ int main(int argc, char *argv[]) char pass[MAXPASS + 1]; char *option; int npass, nullok; - int force_failure = 0; + int blankpass = 0; int retval = PAM_AUTH_ERR; char *user; + char *passwords[] = { pass }; /* * Catch or ignore as many signal as possible. @@ -446,7 +79,7 @@ int main(int argc, char *argv[]) */ if (isatty(STDIN_FILENO) || argc != 3 ) { - _log_err(LOG_NOTICE + helper_log_err(LOG_NOTICE ,"inappropriate use of Unix helper binary [UID=%d]" ,getuid()); fprintf(stderr @@ -458,11 +91,9 @@ int main(int argc, char *argv[]) /* * Determine what the current user's name is. - * On a SELinux enabled system with a strict policy leaving the - * existing check prevents shadow password authentication from working. * We must thus skip the check if the real uid is 0. */ - if (SELINUX_ENABLED && getuid() == 0) { + if (getuid() == 0) { user=argv[1]; } else { @@ -476,63 +107,49 @@ int main(int argc, char *argv[]) option=argv[2]; - if (strncmp(argv[2], "verify", 8) == 0) { - /* Get the account information from the shadow file */ - return _verify_account(argv[1]); - } - - if (strncmp(option, "shadow", 8) == 0) { - /* Attempting to change the password */ - return _update_shadow(argv[1]); - } - + if (strcmp(option, "chkexpiry") == 0) + /* Check account information from the shadow file */ + return _check_expiry(argv[1]); /* read the nullok/nonull option */ - if (strncmp(option, "nullok", 8) == 0) + else if (strcmp(option, "nullok") == 0) nullok = 1; - else + else if (strcmp(option, "nonull") == 0) nullok = 0; + else + return PAM_SYSTEM_ERR; /* read the password from stdin (a pipe from the pam_unix module) */ - npass = read(STDIN_FILENO, pass, MAXPASS); + npass = read_passwords(STDIN_FILENO, 1, passwords); - if (npass < 0) { /* is it a valid password? */ - - _log_err(LOG_DEBUG, "no password supplied"); - - } else if (npass >= MAXPASS) { - - _log_err(LOG_DEBUG, "password too long"); - - } else { - if (npass == 0) { - /* the password is NULL */ - - retval = _unix_verify_password(user, NULL, nullok); - - } else { - /* does pass agree with the official one? */ - - pass[npass] = '\0'; /* NUL terminate */ - retval = _unix_verify_password(user, pass, nullok); + if (npass != 1) { /* is it a valid password? */ + helper_log_err(LOG_DEBUG, "no password supplied"); + *pass = '\0'; + } - } + if (*pass == '\0') { + blankpass = 1; } + retval = helper_verify_password(user, pass, nullok); + memset(pass, '\0', MAXPASS); /* clear memory of the password */ /* return pass or fail */ - if ((retval != PAM_SUCCESS) || force_failure) { - _log_err(LOG_NOTICE, "password check failed for user (%s)", user); - return PAM_AUTH_ERR; + if (retval != PAM_SUCCESS) { + if (!nullok || !blankpass) + /* no need to log blank pass test */ + helper_log_err(LOG_NOTICE, "password check failed for user (%s)", user); + return PAM_AUTH_ERR; } else { - return PAM_SUCCESS; + return PAM_SUCCESS; } } /* * Copyright (c) Andrew G. Morgan, 1996. All rights reserved + * Copyright (c) Red Hat, Inc., 2007,2008. All rights reserved * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions diff --git a/Linux-PAM/modules/pam_unix/unix_update.8 b/Linux-PAM/modules/pam_unix/unix_update.8 new file mode 100644 index 00000000..f0be3de1 --- /dev/null +++ b/Linux-PAM/modules/pam_unix/unix_update.8 @@ -0,0 +1,37 @@ +.\" Title: unix_update +.\" Author: +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/28/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual +.\" +.TH "UNIX_UPDATE" "8" "01/28/2008" "Linux-PAM Manual" "Linux\-PAM Manual" +.\" disable hyphenation +.nh +.\" disable justification (adjust text to left margin only) +.ad l +.SH "NAME" +unix_update - Helper binary that updates the password of a given user +.SH "SYNOPSIS" +.HP 12 +\fBunix_update\fR [\.\.\.] +.SH "DESCRIPTION" +.PP + +\fIunix_update\fR +is a helper program for the +\fIpam_unix\fR +module that updates the password of a given user\. It is not intended to be run directly from the command line and logs a security violation if done so\. +.PP +The purpose of the helper is to enable tighter confinement of login and password changing services\. The helper is thus called only when SELinux is enabled and in the enforcing mode on the system\. +.PP +The interface of the helper \- command line options, and input/output data format are internal to the +\fIpam_unix\fR +module and it should not be called directly from applications\. +.SH "SEE ALSO" +.PP + +\fBpam_unix\fR(8) +.SH "AUTHOR" +.PP +Written by Tomas Mraz and other various people\. diff --git a/Linux-PAM/modules/pam_unix/unix_update.8.xml b/Linux-PAM/modules/pam_unix/unix_update.8.xml new file mode 100644 index 00000000..07695951 --- /dev/null +++ b/Linux-PAM/modules/pam_unix/unix_update.8.xml @@ -0,0 +1,67 @@ +<?xml version="1.0" encoding='UTF-8'?> +<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN" + "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd"> + +<refentry id="unix_update"> + + <refmeta> + <refentrytitle>unix_update</refentrytitle> + <manvolnum>8</manvolnum> + <refmiscinfo class="sectdesc">Linux-PAM Manual</refmiscinfo> + </refmeta> + + <refnamediv id="unix_update-name"> + <refname>unix_update</refname> + <refpurpose>Helper binary that updates the password of a given user</refpurpose> + </refnamediv> + + <refsynopsisdiv> + <cmdsynopsis id="unix_update-cmdsynopsis"> + <command>unix_update</command> + <arg choice="opt"> + ... + </arg> + </cmdsynopsis> + </refsynopsisdiv> + + <refsect1 id="unix_update-description"> + + <title>DESCRIPTION</title> + + <para> + <emphasis>unix_update</emphasis> is a helper program for the + <emphasis>pam_unix</emphasis> module that updates the + password of a given user. It is not intended to be run directly + from the command line and logs a security violation if done so. + </para> + + <para> + The purpose of the helper is to enable tighter confinement of + login and password changing services. The helper is thus called only + when SELinux is enabled and in the enforcing mode on the system. + </para> + + <para> + The interface of the helper - command line options, and input/output + data format are internal to the <emphasis>pam_unix</emphasis> + module and it should not be called directly from applications. + </para> + </refsect1> + + <refsect1 id='unix_update-see_also'> + <title>SEE ALSO</title> + <para> + <citerefentry> + <refentrytitle>pam_unix</refentrytitle><manvolnum>8</manvolnum> + </citerefentry> + </para> + </refsect1> + + <refsect1 id='unix_update-author'> + <title>AUTHOR</title> + <para> + Written by Tomas Mraz and other various people. + </para> + </refsect1> + +</refentry> diff --git a/Linux-PAM/modules/pam_unix/unix_update.c b/Linux-PAM/modules/pam_unix/unix_update.c new file mode 100644 index 00000000..595b7f8b --- /dev/null +++ b/Linux-PAM/modules/pam_unix/unix_update.c @@ -0,0 +1,187 @@ +/* + * This program is designed to run setuid(root) or with sufficient + * privilege to read all of the unix password databases. It is designed + * to provide a mechanism for the current user (defined by this + * process' uid) to verify their own password. + * + * The password is read from the standard input. The exit status of + * this program indicates whether the user is authenticated or not. + * + * Copyright information is located at the end of the file. + * + */ + +#include "config.h" + +#include <stdarg.h> +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <syslog.h> +#include <unistd.h> +#include <sys/types.h> +#include <sys/stat.h> +#include <pwd.h> +#include <shadow.h> +#include <signal.h> +#include <time.h> +#include <sys/time.h> + +#include <security/_pam_types.h> +#include <security/_pam_macros.h> + +#include "passverify.h" + +static int +set_password(const char *forwho, const char *shadow, const char *remember) +{ + struct passwd *pwd = NULL; + int retval; + char pass[MAXPASS + 1]; + char towhat[MAXPASS + 1]; + int npass = 0; + /* we don't care about number format errors because the helper + should be called internally only */ + int doshadow = atoi(shadow); + int nremember = atoi(remember); + char *passwords[] = { pass, towhat }; + + /* read the password from stdin (a pipe from the pam_unix module) */ + + npass = read_passwords(STDIN_FILENO, 2, passwords); + + if (npass != 2) { /* is it a valid password? */ + if (npass == 1) { + helper_log_err(LOG_DEBUG, "no new password supplied"); + memset(pass, '\0', MAXPASS); + } else { + helper_log_err(LOG_DEBUG, "no valid passwords supplied"); + } + return PAM_AUTHTOK_ERR; + } + + if (lock_pwdf() != PAM_SUCCESS) + return PAM_AUTHTOK_LOCK_BUSY; + + pwd = getpwnam(forwho); + + if (pwd == NULL) { + retval = PAM_USER_UNKNOWN; + goto done; + } + + /* does pass agree with the official one? + we always allow change from null pass */ + retval = helper_verify_password(forwho, pass, 1); + if (retval != PAM_SUCCESS) { + goto done; + } + + /* first, save old password */ + if (save_old_password(forwho, pass, nremember)) { + retval = PAM_AUTHTOK_ERR; + goto done; + } + + if (doshadow || is_pwd_shadowed(pwd)) { + retval = unix_update_shadow(forwho, towhat); + if (retval == PAM_SUCCESS) + if (!is_pwd_shadowed(pwd)) + retval = unix_update_passwd(forwho, "x"); + } else { + retval = unix_update_passwd(forwho, towhat); + } + +done: + memset(pass, '\0', MAXPASS); + memset(towhat, '\0', MAXPASS); + + unlock_pwdf(); + + if (retval == PAM_SUCCESS) { + return PAM_SUCCESS; + } else { + return PAM_AUTHTOK_ERR; + } +} + +int main(int argc, char *argv[]) +{ + char *option; + + /* + * Catch or ignore as many signal as possible. + */ + setup_signals(); + + /* + * we establish that this program is running with non-tty stdin. + * this is to discourage casual use. It does *NOT* prevent an + * intruder from repeatadly running this program to determine the + * password of the current user (brute force attack, but one for + * which the attacker must already have gained access to the user's + * account). + */ + + if (isatty(STDIN_FILENO) || argc != 5 ) { + helper_log_err(LOG_NOTICE + ,"inappropriate use of Unix helper binary [UID=%d]" + ,getuid()); + fprintf(stderr + ,"This binary is not designed for running in this way\n" + "-- the system administrator has been informed\n"); + sleep(10); /* this should discourage/annoy the user */ + return PAM_SYSTEM_ERR; + } + + /* We must be root to read/update shadow. + */ + if (geteuid() != 0) { + return PAM_CRED_INSUFFICIENT; + } + + option = argv[2]; + + if (strcmp(option, "update") == 0) { + /* Attempting to change the password */ + return set_password(argv[1], argv[3], argv[4]); + } + + return PAM_SYSTEM_ERR; +} + +/* + * Copyright (c) Andrew G. Morgan, 1996. All rights reserved + * Copyright (c) Red Hat, Inc., 2007, 2008. All rights reserved + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, and the entire permission notice in its entirety, + * including the disclaimer of warranties. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. The name of the author may not be used to endorse or promote + * products derived from this software without specific prior + * written permission. + * + * ALTERNATIVELY, this product may be distributed under the terms of + * the GNU Public License, in which case the provisions of the GPL are + * required INSTEAD OF the above restrictions. (This clause is + * necessary due to a potential bad interaction between the GPL and + * the restrictions contained in a BSD-style copyright.) + * + * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED + * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, + * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES + * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR + * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + */ diff --git a/Linux-PAM/modules/pam_userdb/pam_userdb.8 b/Linux-PAM/modules/pam_userdb/pam_userdb.8 index b1ad6677..c4a908f3 100644 --- a/Linux-PAM/modules/pam_userdb/pam_userdb.8 +++ b/Linux-PAM/modules/pam_userdb/pam_userdb.8 @@ -1,94 +1,126 @@ .\" Title: pam_userdb .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/> -.\" Date: 06/07/2006 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "PAM_USERDB" "8" "06/07/2006" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_USERDB" "8" "01/08/2008" "Linux-PAM Manual" "Linux\-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_userdb \- PAM module to authenticate against a db database +pam_userdb - PAM module to authenticate against a db database .SH "SYNOPSIS" .HP 14 -\fBpam_userdb.so\fR db=\fI/path/database\fR [debug] [crypt=[crypt|none]] [icase] [dump] [try_first_pass] [use_first_pass] [unknown_ok] [key_only] +\fBpam_userdb\.so\fR db=\fI/path/database\fR [debug] [crypt=[crypt|none]] [icase] [dump] [try_first_pass] [use_first_pass] [unknown_ok] [key_only] .SH "DESCRIPTION" .PP -The pam_userdb module is used to verify a username/password pair against values stored in a Berkeley DB database. The database is indexed by the username, and the data fields corresponding to the username keys are the passwords. +The pam_userdb module is used to verify a username/password pair against values stored in a Berkeley DB database\. The database is indexed by the username, and the data fields corresponding to the username keys are the passwords\. .SH "OPTIONS" -.TP 3n +.PP \fBcrypt=[crypt|none]\fR -Indicates whether encrypted or plaintext passwords are stored in the database. If it is +.RS 4 +Indicates whether encrypted or plaintext passwords are stored in the database\. If it is \fBcrypt\fR, passwords should be stored in the database in \fBcrypt\fR(3) -form. If +form\. If \fBnone\fR -is selected, passwords should be stored in the database as plaintext. -.TP 3n +is selected, passwords should be stored in the database as plaintext\. +.RE +.PP \fBdb=\fR\fB\fI/path/database\fR\fR +.RS 4 Use the \fI/path/database\fR -database for performing lookup. There is no default; the module will return +database for performing lookup\. There is no default; the module will return \fBPAM_IGNORE\fR -if no database is provided. -.TP 3n +if no database is provided\. +.RE +.PP \fBdebug\fR -Print debug information. -.TP 3n +.RS 4 +Print debug information\. +.RE +.PP \fBdump\fR -Dump all the entries in the database to the log. Don't do this by default! -.TP 3n +.RS 4 +Dump all the entries in the database to the log\. Don\'t do this by default! +.RE +.PP \fBicase\fR -Make the password verification to be case insensitive (ie when working with registration numbers and such). Only works with plaintext password storage. -.TP 3n +.RS 4 +Make the password verification to be case insensitive (ie when working with registration numbers and such)\. Only works with plaintext password storage\. +.RE +.PP \fBtry_first_pass\fR -Use the authentication token previously obtained by another module that did the conversation with the application. If this token can not be obtained then the module will try to converse. This option can be used for stacking different modules that need to deal with the authentication tokens. -.TP 3n +.RS 4 +Use the authentication token previously obtained by another module that did the conversation with the application\. If this token can not be obtained then the module will try to converse\. This option can be used for stacking different modules that need to deal with the authentication tokens\. +.RE +.PP \fBuse_first_pass\fR -Use the authentication token previously obtained by another module that did the conversation with the application. If this token can not be obtained then the module will fail. This option can be used for stacking different modules that need to deal with the authentication tokens. -.TP 3n +.RS 4 +Use the authentication token previously obtained by another module that did the conversation with the application\. If this token can not be obtained then the module will fail\. This option can be used for stacking different modules that need to deal with the authentication tokens\. +.RE +.PP \fBunknown_ok\fR -Do not return error when checking for a user that is not in the database. This can be used to stack more than one pam_userdb module that will check a username/password pair in more than a database. -.TP 3n +.RS 4 +Do not return error when checking for a user that is not in the database\. This can be used to stack more than one pam_userdb module that will check a username/password pair in more than a database\. +.RE +.PP \fBkey_only\fR -The username and password are concatenated together in the database hash as 'username\-password' with a random value. if the concatenation of the username and password with a dash in the middle returns any result, the user is valid. this is useful in cases where the username may not be unique but the username and password pair are. +.RS 4 +The username and password are concatenated together in the database hash as \'username\-password\' with a random value\. if the concatenation of the username and password with a dash in the middle returns any result, the user is valid\. this is useful in cases where the username may not be unique but the username and password pair are\. +.RE .SH "MODULE SERVICES PROVIDED" .PP The services \fBauth\fR and \fBaccount\fR -are supported. +are supported\. .SH "RETURN VALUES" -.TP 3n +.PP PAM_AUTH_ERR -Authentication failure. -.TP 3n +.RS 4 +Authentication failure\. +.RE +.PP PAM_AUTHTOK_RECOVERY_ERR -Authentication information cannot be recovered. -.TP 3n +.RS 4 +Authentication information cannot be recovered\. +.RE +.PP PAM_BUF_ERR -Memory buffer error. -.TP 3n +.RS 4 +Memory buffer error\. +.RE +.PP PAM_CONV_ERR -Conversation failure. -.TP 3n +.RS 4 +Conversation failure\. +.RE +.PP PAM_SERVICE_ERR -Error in service module. -.TP 3n +.RS 4 +Error in service module\. +.RE +.PP PAM_SUCCESS -Success. -.TP 3n +.RS 4 +Success\. +.RE +.PP PAM_USER_UNKNOWN -User not known to the underlying authentication module. +.RS 4 +User not known to the underlying authentication module\. +.RE .SH "EXAMPLES" .sp -.RS 3n +.RS 4 .nf -auth sufficient pam_userdb.so icase db=/etc/dbtest.db +auth sufficient pam_userdb\.so icase db=/etc/dbtest\.db .fi .RE @@ -101,4 +133,4 @@ auth sufficient pam_userdb.so icase db=/etc/dbtest.db \fBpam\fR(8) .SH "AUTHOR" .PP -pam_userdb was written by Cristian Gafton >gafton@redhat.com<. +pam_userdb was written by Cristian Gafton >gafton@redhat\.com<\. diff --git a/Linux-PAM/modules/pam_warn/README b/Linux-PAM/modules/pam_warn/README index d9619b53..a0713173 100644 --- a/Linux-PAM/modules/pam_warn/README +++ b/Linux-PAM/modules/pam_warn/README @@ -11,7 +11,7 @@ that it does not want to affect the authentication process. OPTIONS -This module does not recognice any options. +This module does not recognise any options. EXAMPLES diff --git a/Linux-PAM/modules/pam_warn/pam_warn.8 b/Linux-PAM/modules/pam_warn/pam_warn.8 index 4e2c67c5..4f1e868e 100644 --- a/Linux-PAM/modules/pam_warn/pam_warn.8 +++ b/Linux-PAM/modules/pam_warn/pam_warn.8 @@ -1,28 +1,28 @@ .\" Title: pam_warn .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/> -.\" Date: 06/09/2006 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "PAM_WARN" "8" "06/09/2006" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_WARN" "8" "01/08/2008" "Linux-PAM Manual" "Linux\-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_warn \- PAM module which logs all PAM items if called +pam_warn - PAM module which logs all PAM items if called .SH "SYNOPSIS" .HP 12 -\fBpam_warn.so\fR +\fBpam_warn\.so\fR .SH "DESCRIPTION" .PP pam_warn is a PAM module that logs the service, terminal, user, remote user and remote host to -\fBsyslog\fR(3). The items are not probed for, but instead obtained from the standard PAM items. The module always returns -\fBPAM_IGNORE\fR, indicating that it does not want to affect the authentication process. +\fBsyslog\fR(3)\. The items are not probed for, but instead obtained from the standard PAM items\. The module always returns +\fBPAM_IGNORE\fR, indicating that it does not want to affect the authentication process\. .SH "OPTIONS" .PP -This module does not recognice any options. +This module does not recognise any options\. .SH "MODULE SERVICES PROVIDED" .PP The services @@ -31,28 +31,30 @@ The services \fBpassword\fR and \fBsession\fR -are supported. +are supported\. .SH "RETURN VALUES" -.TP 3n +.PP PAM_IGNORE -This module always returns PAM_IGNORE. +.RS 4 +This module always returns PAM_IGNORE\. +.RE .SH "EXAMPLES" .sp -.RS 3n +.RS 4 .nf -#%PAM\-1.0 +#%PAM\-1\.0 # -# If we don't have config entries for a service, the -# OTHER entries are used. To be secure, warn and deny -# access to everything. -other auth required pam_warn.so -other auth required pam_deny.so -other account required pam_warn.so -other account required pam_deny.so -other password required pam_warn.so -other password required pam_deny.so -other session required pam_warn.so -other session required pam_deny.so +# If we don\'t have config entries for a service, the +# OTHER entries are used\. To be secure, warn and deny +# access to everything\. +other auth required pam_warn\.so +other auth required pam_deny\.so +other account required pam_warn\.so +other account required pam_deny\.so +other password required pam_warn\.so +other password required pam_deny\.so +other session required pam_warn\.so +other session required pam_deny\.so .fi .RE @@ -64,4 +66,4 @@ other session required pam_deny.so \fBpam\fR(8) .SH "AUTHOR" .PP -pam_warn was written by Andrew G. Morgan <morgan@kernel.org>. +pam_warn was written by Andrew G\. Morgan <morgan@kernel\.org>\. diff --git a/Linux-PAM/modules/pam_warn/pam_warn.8.xml b/Linux-PAM/modules/pam_warn/pam_warn.8.xml index 1aa70f59..b3261b86 100644 --- a/Linux-PAM/modules/pam_warn/pam_warn.8.xml +++ b/Linux-PAM/modules/pam_warn/pam_warn.8.xml @@ -35,7 +35,7 @@ <refsect1 id="pam_warn-options"> <title>OPTIONS</title> - <para>This module does not recognice any options.</para> + <para>This module does not recognise any options.</para> </refsect1> <refsect1 id="pam_warn-services"> diff --git a/Linux-PAM/modules/pam_wheel/pam_wheel.8 b/Linux-PAM/modules/pam_wheel/pam_wheel.8 index ae29c37e..7da719a3 100644 --- a/Linux-PAM/modules/pam_wheel/pam_wheel.8 +++ b/Linux-PAM/modules/pam_wheel/pam_wheel.8 @@ -1,91 +1,117 @@ .\" Title: pam_wheel .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/> -.\" Date: 06/09/2006 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "PAM_WHEEL" "8" "06/09/2006" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_WHEEL" "8" "01/08/2008" "Linux-PAM Manual" "Linux\-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_wheel \- Only permit root access to members of group wheel +pam_wheel - Only permit root access to members of group wheel .SH "SYNOPSIS" .HP 13 -\fBpam_wheel.so\fR [debug] [deny] [group=\fIname\fR] [root_only] [trust] [use_uid] +\fBpam_wheel\.so\fR [debug] [deny] [group=\fIname\fR] [root_only] [trust] [use_uid] .SH "DESCRIPTION" .PP The pam_wheel PAM module is used to enforce the so\-called \fIwheel\fR -group. By default it permits root access to the system if the applicant user is a member of the +group\. By default it permits root access to the system if the applicant user is a member of the \fIwheel\fR -group. If no group with this name exist, the module is using the group with the group\-ID -\fB0\fR. +group\. If no group with this name exist, the module is using the group with the group\-ID +\fB0\fR\. .SH "OPTIONS" -.TP 3n +.PP \fBdebug\fR -Print debug information. -.TP 3n +.RS 4 +Print debug information\. +.RE +.PP \fBdeny\fR +.RS 4 Reverse the sense of the auth operation: if the user is trying to get UID 0 access and is a member of the wheel group (or the group of the \fBgroup\fR -option), deny access. Conversely, if the user is not in the group, return PAM_IGNORE (unless +option), deny access\. Conversely, if the user is not in the group, return PAM_IGNORE (unless \fBtrust\fR -was also specified, in which case we return PAM_SUCCESS). -.TP 3n +was also specified, in which case we return PAM_SUCCESS)\. +.RE +.PP \fBgroup=\fR\fB\fIname\fR\fR +.RS 4 Instead of checking the wheel or GID 0 groups, use the \fB\fIname\fR\fR -group to perform the authentication. -.TP 3n +group to perform the authentication\. +.RE +.PP \fBroot_only\fR -The check for wheel membership is done only. -.TP 3n +.RS 4 +The check for wheel membership is done only\. +.RE +.PP \fBtrust\fR -The pam_wheel module will return PAM_SUCCESS instead of PAM_IGNORE if the user is a member of the wheel group (thus with a little play stacking the modules the wheel members may be able to su to root without being prompted for a passwd). -.TP 3n +.RS 4 +The pam_wheel module will return PAM_SUCCESS instead of PAM_IGNORE if the user is a member of the wheel group (thus with a little play stacking the modules the wheel members may be able to su to root without being prompted for a passwd)\. +.RE +.PP \fBuse_uid\fR -The check for wheel membership will be done against the current uid instead of the original one (useful when jumping with su from one account to another for example). +.RS 4 +The check for wheel membership will be done against the current uid instead of the original one (useful when jumping with su from one account to another for example)\. +.RE .SH "MODULE SERVICES PROVIDED" .PP The \fBauth\fR and \fBaccount\fR -services are supported. +services are supported\. .SH "RETURN VALUES" -.TP 3n +.PP PAM_AUTH_ERR -Authentication failure. -.TP 3n +.RS 4 +Authentication failure\. +.RE +.PP PAM_BUF_ERR -Memory buffer error. -.TP 3n +.RS 4 +Memory buffer error\. +.RE +.PP PAM_IGNORE -The return value should be ignored by PAM dispatch. -.TP 3n +.RS 4 +The return value should be ignored by PAM dispatch\. +.RE +.PP PAM_PERM_DENY -Permission denied. -.TP 3n +.RS 4 +Permission denied\. +.RE +.PP PAM_SERVICE_ERR -Cannot determine the user name. -.TP 3n +.RS 4 +Cannot determine the user name\. +.RE +.PP PAM_SUCCESS -Success. -.TP 3n +.RS 4 +Success\. +.RE +.PP PAM_USER_UNKNOWN -User not known. +.RS 4 +User not known\. +.RE .SH "EXAMPLES" .PP -The root account gains access by default (rootok), only wheel members can become root (wheel) but Unix authenticate non\-root applicants. +The root account gains access by default (rootok), only wheel members can become root (wheel) but Unix authenticate non\-root applicants\. .sp -.RS 3n +.RS 4 .nf -su auth sufficient pam_rootok.so -su auth required pam_wheel.so -su auth required pam_unix.so +su auth sufficient pam_rootok\.so +su auth required pam_wheel\.so +su auth required pam_unix\.so .fi .RE @@ -98,4 +124,4 @@ su auth required pam_unix.so \fBpam\fR(8) .SH "AUTHOR" .PP -pam_wheel was written by Cristian Gafton <gafton@redhat.com>. +pam_wheel was written by Cristian Gafton <gafton@redhat\.com>\. diff --git a/Linux-PAM/modules/pam_wheel/pam_wheel.c b/Linux-PAM/modules/pam_wheel/pam_wheel.c index ca0e171d..d7d8096e 100644 --- a/Linux-PAM/modules/pam_wheel/pam_wheel.c +++ b/Linux-PAM/modules/pam_wheel/pam_wheel.c @@ -274,8 +274,7 @@ struct pam_module _pam_wheel_modstruct = { pam_sm_acct_mgmt, NULL, NULL, - NULL, - NULL, + NULL }; #endif /* PAM_STATIC */ diff --git a/Linux-PAM/modules/pam_xauth/README b/Linux-PAM/modules/pam_xauth/README index 1e134d70..4e0e3ec4 100644 --- a/Linux-PAM/modules/pam_xauth/README +++ b/Linux-PAM/modules/pam_xauth/README @@ -77,9 +77,9 @@ pam_open_session() and pam_close_session() with the ruid set to the uid of the calling user and the euid set to root, and must have provided as the PAM_USER item the name of the target user. -pam_xauth calls xauth(1) the source user to extract the key for $DISPLAY, then -calls xauth as the target user to merge the key into the a temporary database -and later remove the database. +pam_xauth calls xauth(1) as the source user to extract the key for $DISPLAY, +then calls xauth as the target user to merge the key into the a temporary +database and later remove the database. pam_xauth cannot be told to not remove the keys when the session is closed. diff --git a/Linux-PAM/modules/pam_xauth/pam_xauth.8 b/Linux-PAM/modules/pam_xauth/pam_xauth.8 index 85f5dbf3..026180a3 100644 --- a/Linux-PAM/modules/pam_xauth/pam_xauth.8 +++ b/Linux-PAM/modules/pam_xauth/pam_xauth.8 @@ -1,109 +1,127 @@ .\" Title: pam_xauth .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/> -.\" Date: 06/09/2006 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual +.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/> +.\" Date: 01/08/2008 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual .\" -.TH "PAM_XAUTH" "8" "06/09/2006" "Linux\-PAM Manual" "Linux\-PAM Manual" +.TH "PAM_XAUTH" "8" "01/08/2008" "Linux-PAM Manual" "Linux\-PAM Manual" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .SH "NAME" -pam_xauth \- PAM module to forward xauth keys between users +pam_xauth - PAM module to forward xauth keys between users .SH "SYNOPSIS" .HP 13 -\fBpam_xauth.so\fR [debug] [xauthpath=\fI/path/to/xauth\fR] [systemuser=\fIUID\fR] [targetuser=\fIUID\fR] +\fBpam_xauth\.so\fR [debug] [xauthpath=\fI/path/to/xauth\fR] [systemuser=\fIUID\fR] [targetuser=\fIUID\fR] .SH "DESCRIPTION" .PP -The pam_xauth PAM module is designed to forward xauth keys (sometimes referred to as "cookies") between users. +The pam_xauth PAM module is designed to forward xauth keys (sometimes referred to as "cookies") between users\. .PP Without pam_xauth, when xauth is enabled and a user uses the \fBsu\fR(1) -command to assume another user's priviledges, that user is no longer able to access the original user's X display because the new user does not have the key needed to access the display. pam_xauth solves the problem by forwarding the key from the user running su (the source user) to the user whose identity the source user is assuming (the target user) when the session is created, and destroying the key when the session is torn down. +command to assume another user\'s priviledges, that user is no longer able to access the original user\'s X display because the new user does not have the key needed to access the display\. pam_xauth solves the problem by forwarding the key from the user running su (the source user) to the user whose identity the source user is assuming (the target user) when the session is created, and destroying the key when the session is torn down\. .PP This means, for example, that when you run \fBsu\fR(1) from an xterm sesssion, you will be able to run X programs without explicitly dealing with the \fBxauth\fR(1) -xauth command or ~/.Xauthority files. +xauth command or ~/\.Xauthority files\. .PP -pam_xauth will only forward keys if xauth can list a key connected to the $DISPLAY environment variable. +pam_xauth will only forward keys if xauth can list a key connected to the $DISPLAY environment variable\. .PP Primitive access control is provided by -\fI~/.xauth/export\fR -in the invoking user's home directory and -\fI~/.xauth/import\fR -in the target user's home directory. +\fI~/\.xauth/export\fR +in the invoking user\'s home directory and +\fI~/\.xauth/import\fR +in the target user\'s home directory\. .PP If a user has a -\fI~/.xauth/import\fR -file, the user will only receive cookies from users listed in the file. If there is no -\fI~/.xauth/import\fR -file, the user will accept cookies from any other user. +\fI~/\.xauth/import\fR +file, the user will only receive cookies from users listed in the file\. If there is no +\fI~/\.xauth/import\fR +file, the user will accept cookies from any other user\. .PP If a user has a -\fI.xauth/export\fR -file, the user will only forward cookies to users listed in the file. If there is no -\fI~/.xauth/export\fR +\fI\.xauth/export\fR +file, the user will only forward cookies to users listed in the file\. If there is no +\fI~/\.xauth/export\fR file, and the invoking user is not -\fBroot\fR, the user will forward cookies to any other user. If there is no -\fI~/.xauth/export\fR +\fBroot\fR, the user will forward cookies to any other user\. If there is no +\fI~/\.xauth/export\fR file, and the invoking user is \fBroot\fR, the user will \fInot\fR -forward cookies to other users. +forward cookies to other users\. .PP Both the import and export files support wildcards (such as -\fI*\fR). Both the import and export files can be empty, signifying that no users are allowed. +\fI*\fR)\. Both the import and export files can be empty, signifying that no users are allowed\. .SH "OPTIONS" -.TP 3n +.PP \fBdebug\fR -Print debug information. -.TP 3n +.RS 4 +Print debug information\. +.RE +.PP \fBxauthpath=\fR\fB\fI/path/to/xauth\fR\fR +.RS 4 Specify the path the xauth program (it is expected in \fI/usr/X11R6/bin/xauth\fR, \fI/usr/bin/xauth\fR, or \fI/usr/bin/X11/xauth\fR -by default). -.TP 3n +by default)\. +.RE +.PP \fBsystemuser=\fR\fB\fIUID\fR\fR -Specify the highest UID which will be assumed to belong to a "system" user. pam_xauth will refuse to forward credentials to users with UID less than or equal to this number, except for root and the "targetuser", if specified. -.TP 3n +.RS 4 +Specify the highest UID which will be assumed to belong to a "system" user\. pam_xauth will refuse to forward credentials to users with UID less than or equal to this number, except for root and the "targetuser", if specified\. +.RE +.PP \fBtargetuser=\fR\fB\fIUID\fR\fR -Specify a single target UID which is exempt from the systemuser check. +.RS 4 +Specify a single target UID which is exempt from the systemuser check\. +.RE .SH "MODULE SERVICES PROVIDED" .PP Only the \fBsession\fR -service is supported. +service is supported\. .SH "RETURN VALUES" -.TP 3n +.PP PAM_BUF_ERR -Memory buffer error. -.TP 3n +.RS 4 +Memory buffer error\. +.RE +.PP PAM_PERM_DENIED -Permission denied by import/export file. -.TP 3n +.RS 4 +Permission denied by import/export file\. +.RE +.PP PAM_SESSION_ERR -Cannot determine user name, UID or access users home directory. -.TP 3n +.RS 4 +Cannot determine user name, UID or access users home directory\. +.RE +.PP PAM_SUCCESS -Success. -.TP 3n +.RS 4 +Success\. +.RE +.PP PAM_USER_UNKNOWN -User not known. +.RS 4 +User not known\. +.RE .SH "EXAMPLES" .PP Add the following line to -\fI/etc/pam.d/su\fR +\fI/etc/pam\.d/su\fR to forward xauth keys between users when calling su: .sp -.RS 3n +.RS 4 .nf -session optional pam_xauth.so +session optional pam_xauth\.so .fi .RE @@ -113,23 +131,27 @@ session optional pam_xauth.so pam_xauth will work \fIonly\fR if it is used from a setuid application in which the -\fBgetuid\fR() call returns the id of the user running the application, and for which PAM can supply the name of the account that the user is attempting to assume. The typical application of this type is -\fBsu\fR(1). The application must call both +\fBgetuid\fR() call returns the id of the user running the application, and for which PAM can supply the name of the account that the user is attempting to assume\. The typical application of this type is +\fBsu\fR(1)\. The application must call both \fBpam_open_session\fR() and -\fBpam_close_session\fR() with the ruid set to the uid of the calling user and the euid set to root, and must have provided as the PAM_USER item the name of the target user. +\fBpam_close_session\fR() with the ruid set to the uid of the calling user and the euid set to root, and must have provided as the PAM_USER item the name of the target user\. .PP pam_xauth calls \fBxauth\fR(1) -the source user to extract the key for $DISPLAY, then calls xauth as the target user to merge the key into the a temporary database and later remove the database. +as the source user to extract the key for $DISPLAY, then calls xauth as the target user to merge the key into the a temporary database and later remove the database\. .PP -pam_xauth cannot be told to not remove the keys when the session is closed. +pam_xauth cannot be told to not remove the keys when the session is closed\. .SH "FILES" -.TP 3n -\fI~/.xauth/import\fR +.PP +\fI~/\.xauth/import\fR +.RS 4 XXX -.TP 3n -\fI~/.xauth/export\fR +.RE +.PP +\fI~/\.xauth/export\fR +.RS 4 XXX +.RE .SH "SEE ALSO" .PP @@ -138,4 +160,4 @@ XXX \fBpam\fR(8) .SH "AUTHOR" .PP -pam_xauth was written by Nalin Dahyabhai <nalin@redhat.com>, based on original version by Michael K. Johnson <johnsonm@redhat.com>. +pam_xauth was written by Nalin Dahyabhai <nalin@redhat\.com>, based on original version by Michael K\. Johnson <johnsonm@redhat\.com>\. diff --git a/Linux-PAM/modules/pam_xauth/pam_xauth.8.xml b/Linux-PAM/modules/pam_xauth/pam_xauth.8.xml index 94453d00..f6323f26 100644 --- a/Linux-PAM/modules/pam_xauth/pam_xauth.8.xml +++ b/Linux-PAM/modules/pam_xauth/pam_xauth.8.xml @@ -237,7 +237,7 @@ session optional pam_xauth.so pam_xauth calls <citerefentry> <refentrytitle>xauth</refentrytitle><manvolnum>1</manvolnum> - </citerefentry> the source user to extract the key for $DISPLAY, + </citerefentry> as the source user to extract the key for $DISPLAY, then calls xauth as the target user to merge the key into the a temporary database and later remove the database. </para> |