| Commit message (Collapse) | Author | Age |
|---|
| |
|
|
|
|
|
|
|
| |
Purpose of commit: new feature
Commit summary:
---------------
Add SELinux support, based on Patch from Red Hat
|
| |
|
|
|
|
|
|
|
|
| |
Purpose of commit: bugfix
Commit summary:
---------------
Fix return value for unknown user (This is PAM_USER_UNKNOWN and
not PAM_AUTHINFO_UNAVAIL).
|
| |
|
|
|
|
|
|
|
|
|
|
| |
Purpose of commit: bugfix
Commit summary:
---------------
Calling pam_chauthtok of pam_unix and entering the correct old password,
but abort on typing the new one, PAM_AUTHTOK_RECOVER_ERR is returned.
Since we got the old token, PAM_AUTHTOK_ERR needs to be returned.
Found by LSB PAM testsuite.
|
| |
|
|
|
|
|
|
|
| |
Purpose of commit: bugfix
Commit summary:
---------------
skip logging of 'user unknown' authentication failure if the user
has passwd entry
|
| |
|
|
|
|
|
|
| |
Purpose of commit: bugfix
Commit summary:
---------------
Convert uid gid from passwd entry always as decimal. Test failure.
|
| |
|
|
|
|
|
|
|
| |
Purpose of commit:
Commit summary:
---------------
bugfix: Last part of fixes from Red Hat
|
| |
|
|
|
|
|
|
|
|
| |
Purpose of commit:
Commit summary:
---------------
bugfix: 440107: Add various patches from Linux Distibutors to make
PAM modules reentrant.
|
| |
|
|
|
|
|
|
|
| |
Purpose of commit:
Commit summary:
---------------
bugfix: Add parts of Steve Grubb's resource leak and other fixes
|
| |
|
|
|
|
|
|
|
| |
Purpose of commit:
Commit summary:
---------------
bugfix: Bug 1027903 and 1027912
|
| |
|
|
|
|
|
|
|
|
|
|
| |
Purpose of commit: bugfix
Commit summary:
---------------
The type of remember in support.c is int, not
long. But we compare remember with LONG_MIN
and LONG_MAX. While this works on 32bit
architectures, this fails on 64bit one.
INT_MIN and INT_MAX should be used.
|
| |
|
|
|
|
|
|
|
| |
Purpose of commit: bugfix
Commit summary:
---------------
Two bug fixes in one: don't trust getlogin() and sanely lower the
time the password databases are locked in pam_unix.
|
| |
|
|
|
|
|
|
| |
Purpose of commit: bugfix
Commit summary:
---------------
This code is needed to complete this bugfix.
|
| |
|
|
|
|
|
|
|
|
|
|
| |
Purpose of commit: new feature
Commit summary:
---------------
some applications are not prepared to get a SIGCHLD from a child
process they didn't think they launched, so we now suppress
this signal for the duration of use of the helper binary.
The 'noreap' module argument is provided to override this new
default.
|
| |
|
|
|
|
|
|
|
|
|
|
| |
Purpose of commit: bugfix
Commit summary:
---------------
bigcrypt does not match crypt when password length is too long.
This led to a pam_unix problem when the module had not set the
password in bigcrypt mode, but was trying to compare with bigcrypt
output. The fix is to use the stored password as a guide to how much
of the encrypted password to compare against.
|
| |
|
|
|
|
|
|
|
| |
Purpose of commit: cleanup
Commit summary:
---------------
be more confident that strings are being initialized correctly
from Nalin.
|
| |
|
|
|
|
|
|
|
| |
Purpose of commit: module reentrancy
Commit summary:
---------------
Commit sample code that uses getpwnam_r instead of getpwnam. All code is
#ifdef'ed out right now.
|
| |
|
|
|
|
|
|
|
| |
Purpose of commit: module reentrancy
Commit summary:
---------------
Commit sample code that uses getpwnam_r instead of getpwnam. All code is
#ifdef'ed out right now.
|
| |
|
|
|
|
|
|
|
|
| |
Purpose of commit: bugfix/cleanup
Commit summary:
---------------
Removed superfluous use of static variables in md5 and bigcrypt routines,
bringing us a step closer to thread-safeness. Eliminated some variable
indirection along the way.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Purpose of commit: minor security bugfix
Commit summary:
---------------
Fixes for the password helper binaries.
Before, there was no check that the password entered was actually that
of the intended user being authenticated. Instead, the password was
checked for the requesting user. While this disstinction sounds like a
security hole, its actually not been a problem in practice. The helper
binaries have only been used in the case that the application is not
setuid-0 and as such even if an improper authentication succeeded, the
application could not change its uid from that of the requesting user.
|
| |
|
|
|
|
|
|
|
|
|
|
| |
Purpose of commit: new feature / bugfix
Commit summary:
---------------
This changes the format of pam_unix log messages, per bug 126423. The
change is extensive (every call to _log_err() now has an additional
argument) but straightforward.
These changes to the logging code incidentally fix the problem reported in
bug 126431.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Purpose of commit: cleanup
Commit summary:
---------------
Changes format of pam_unix 'authentication failure' log messages for
purposes of consistency and clarity.
Note that we do not log the 'user=' item in the case of an invalid username
unless the audit flag is turned on.
Note also that the way we currently log these failures isn't i18n-friendly.
I imagine this will need correcting at some point in the future.
|
| |
|
|
|
|
|
|
|
| |
Purpose of commit: portable handling of utmp in pam_unix
Commit summary:
---------------
Fixes problem with PAM_getlogin() on Solaris (and hopefully other Unices),
as per David Lee's report.
|
| |
|
|
|
|
|
|
|
| |
Purpose of commit: bugfix
Commit summary:
---------------
avoid possibility of SIGPIPE from helper binary non-invocation or
early exit.
|
| |
|
|
|
|
|
|
|
|
|
|
| |
Purpose of commit: bugfix to pam_unix
Commit summary:
---------------
Fixed case where pam_unix would segfault if the app's conversation function
returned a null pointer as the password. Since a null pointer can never be
a valid password unless the password file also has a null field (which we
already check for), we now check for a valid pointer and return PAM_AUTH_ERR
if we don't have one.
|
| |
|
