summaryrefslogtreecommitdiff
path: root/debian/patches-applied
Commit message (Collapse)AuthorAge
* Import Debian changes 1.1.8-3.2Tianon Gravi2019-01-08
| | | | | | | | pam (1.1.8-3.2) unstable; urgency=medium * Non-maintainer upload. * Fix CVE-2015-3238: DoS/user enumeration due to blocking pipe in pam_unix module (Closes: #789986)
* Import Debian changes 1.1.8-3.1Michael Gilbert2019-01-08
| | | | | | | | | | pam (1.1.8-3.1) unstable; urgency=high * Non-maintainer upload by the Security Team. * Fix CVE-2013-7041: case-insensitive comparison used for verifying passwords in the pam_userdb module (closes: #731368). * Fix CVE-2014-2583: multiple directory traversal issues in the pam_timestamp module (closes: 757555)
* Properly regen the contents of PAM.8, so that it will be renamed to PAM.7 on ↵Steve Langasek2019-01-08
| | | | install
* Add missing patch to autogenerated pam_env.8Steve Langasek2019-01-08
|
* Ensure autogenerated files are after source files in all relevant patches,Steve Langasek2019-01-08
| | | | so that regenerating documentation doesn't cause build skew.
* Drop another couple of patches that are already upstreamSteve Langasek2019-01-08
|
* Another round of patch refreshingSteve Langasek2019-01-08
|
* debian/patches/fix-manpage-crud: drop, manpages now being generatedSteve Langasek2019-01-08
| | | | upstream with a newer, fixed xsltproc.
* Refresh patchesSteve Langasek2019-01-08
|
* debian/patches-applied/pam-loginuid-in-containers: pam_loginuid:Steve Langasek2019-01-08
| | | | Ignore failure in user namespaces.
* Ditch autoconf patch in favor of a build-dependency on dh-autoreconf,Steve Langasek2019-01-08
| | | | | which will let us keep up-to-date with newer autotools. In the present instance, this gets us aarch64 support.
* Whoops, commit a patch that I managed to not get addedSteve Langasek2019-01-08
|
* debian/patches-applied/glibc-2_16-compilation-fix.patch: fix missingSteve Langasek2019-01-08
| | | | | include causing build failure with eglibc 2.16. Thanks to Daniel Schepler <dschepler@gmail.com>. Closes: #693450.
* Adjust the pam_env documentation to match the module behavior resultingSteve Langasek2019-01-08
| | | | from the previous security upload. Closes: #693995.
* Confirm NMU for bug #611136; thanks to Michael Gilbert.Steve Langasek2019-01-08
|
* debian/patches-applied/update-motd: new module option for pam_motd,Steve Langasek2019-01-08
| | | | | 'noupdate', which suppresses the call to run-parts /etc/update-motd.d. LP: #805423.
* debian/patches-applied/update-motd: set a sane umask before callingSteve Langasek2019-01-08
| | | | | run-parts, and restore the old mask afterwards, so /run/motd gets consistent permissions. LP: #871943.
* debian/patches-applied/hurd_no_setfsuid: we don't want to check allSteve Langasek2019-01-08
| | | | | | setre*id() calls; we know that there are situations where some of these may fail but we don't care. As long as the last setre*id() call in each set succeeds, that's the state we mean to be in.
* * debian/patches-applied/pam_env-fix-overflow.patch: fix stack overflowKees Cook2019-01-08
| | | | | | in environment file parsing (CVE-2011-3148). * debian/patches-applied/pam_env-fix-dos.patch: fix DoS in environment file parsing (CVE-2011-3149).
* debian/patches-applied/update-motd: correctly clear environment whenKees Cook2019-01-08
| | | | building motd.
* debian/patches-applied/hurd_no_setfsuid: check all set*id() calls.Kees Cook2019-01-08
|
* debian/patches-applied/{007_modules_pam_unix,055_pam_unix_nullok_secure}:Kees Cook2019-01-08
| | | | drop unneeded no-op change to reduce delta from upstream.
* debian/patches-applied/022_pam_unix_group_time_miscfixes,Kees Cook2019-01-08
| | | | | | debian/patches-applied/026_pam_unix_passwd_unknown_user, debian/patches-applied/054_pam_security_abstract_securetty_handling: improve descriptions.
* * debian/patches-applied/008_modules_pam_limits_chroot:Kees Cook2019-01-08
| | | | | - fix off-by-one when parsing configuration file. - when using chroot, chdir() to root to lose links to old tree.
* debian/patches-applied/pam_unix_dont_trust_chkpwd_caller.patch: useKees Cook2019-01-08
| | | | setresgid() to wipe out saved-gid just in case.
* make sure we're passing ctrl to the function if we need to check PAM_DEBUGSteve Langasek2019-01-08
|
* debian/patches-applied/027_pam_limits_better_init_allow_explicit_root:Steve Langasek2019-01-08
| | | | | | don't reset the process niceness for root; since it's root, they can still renice to a lower nice level if they need to and changing the nice level by default is unexpected behavior. Closes: #594377.
* merge preliminary multiarch supportSteve Langasek2019-01-08
|\
| * merge from squeezeSteve Langasek2019-01-08
| |\
| | * * debian/patches-applied/no_PATH_MAX_on_hurd: define PATH_MAX forSteve Langasek2019-01-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | compatibility when it's not already set. Closes: #552043. * debian/local/pam-auth-update: Don't try to pass embedded newlines to debconf; backslash-escape them instead and use CAPB escape. * debian/local/pam-auth-update: sort additional module options before writing them out, so that we don't wind up with a different config file on every invocation. Thanks to Jim Paris <jim@jtan.com> for the patch. Closes: #594123.
| * | merge from trunkSteve Langasek2019-01-08
| |\ \ | | |/
| * | merge from trunkSteve Langasek2019-01-08
| |\ \
| * | | New patch to give us proper multiarch module path lookups in conjunction withSteve Langasek2019-01-08
| | | | | | | | | | | | | | | | | | | | | | | | the non-standard configure arguments in debian/rules: look in /lib/$(DEB_HOST_GNU_TYPE)/security first, then /lib/security as a fallback.
* | | | * debian/patches-applied/027_pam_limits_better_init_allow_explicit_root:Kees Cook2019-01-08
| | | | | | | | | | | | | | | | | | | | - only report about unknown kernel rlimits when "debug" is set (Closes: 625226, LP: #794531).
* | | | debian/patches-applied/027_pam_limits_better_init_allow_explicit_root:Steve Langasek2019-01-08
| | | | | | | | | | | | | | | | | | | | set a better default RLIMIT_MEMLOCK value for BSD kernels. Thanks to Petr Salinger for the fix. Closes: #602902.
* | | | refresh other patches for new upstream releaseSteve Langasek2019-01-08
| | | |
* | | | Port hurd_no_setfsuid patch to new pam_modutil_{drop,restore}_privSteve Langasek2019-01-08
| | | | | | | | | | | | | | | | interface; now possibly upstreamable
* | | | update the existing 027_pam_limits_better_init_allow_explicit_root patchSteve Langasek2019-01-08
| | | | | | | | | | | | | | | | | | | | | | | | instead of creating a new parse-kernel-rlimits.patch, to keep these changes logically grouped together; and add a DEP3 patch header here since we didn't have one before
* | | | parse-kernel-rlimits.patch has been forwarded upstream nowKees Cook2019-01-08
| | | |
* | | | debian/patches-applied/parse-kernel-rlimits.patch: load rlimit defaultsKees Cook2019-01-08
| | | | | | | | | | | | | | | | | | | | | | | | from the kernel (via /proc/1/limits), instead of continuing to hardcode the settings internally. Fall back to internal defaults when the kernel rlimits are not found. Closes: #620302. (LP: #746655, #391761)
* | | | fix up the patch to be proper CSteve Langasek2019-01-08
| | | |
* | | | debian/patches-applied/hurd_no_setfsuid: handle some new calls toSteve Langasek2019-01-08
| | | | | | | | | | | | | | | | | | | | setfsuid in pam_xauth that I overlooked, so that the build works again on non-Linux. Closes: #613630.
* | | | debian/patches-applied/no_PATH_MAX_on_hurd: define PATH_MAX forSteve Langasek2019-01-08
| | | | | | | | | | | | | | | | compatibility when it's not already set. Closes: #552043.
* | | | one more patch tweakSteve Langasek2019-01-08
| | | |
* | | | further patch fixup to match upstreamSteve Langasek2019-01-08
| | | |
* | | | fix a typo in the patchSteve Langasek2019-01-08
| | | |
* | | | debian/patches/007_modules_pam_unix: drop compatibility handling ofSteve Langasek2019-01-08
| | | | | | | | | | | | | | | | | | | | 'max=' no-op; use of this option will now log an error, as warned three years ago.
* | | | refresh other patches for new upstream versionSteve Langasek2019-01-08
| | | |
* | | | debian/patches/hurd_no_setfsuid: pam_env and pam_mail now also useSteve Langasek2019-01-08
| | | | | | | | | | | | | | | | setfsuid, so patch them to be likewise Hurd-safe.
* | | | Drop patches conditional_module,_conditional_man andSteve Langasek2019-01-08
| | | | | | | | | | | | | | | | mkhomedir_linking.patch, which are included upstream.