summaryrefslogtreecommitdiff
path: root/modules
Commit message (Collapse)AuthorAge
* pam_pwhistory: Always record the old password even when root changes it.Tomas Mraz2012-05-28
| | | | | | modules/pam_pwhistory/pam_pwhistory.c (pam_sm_chauthtok): Use the UID of the process instead of the target user UID (same as in pam_cracklib) to check for root. Always record old password.
* pam_cracklib: Add enforce_for_root option.Tomas Mraz2012-05-24
| | | | | | modules/pam_cracklib/pam_cracklib.c (_pam_parse): Recognize the enforce_for_root option. (pam_sm_chauthtok): Enforce errors for root with the option. modules/pam_cracklib/pam_cracklib.8.xml: Document the enforce_for_root option.
* pam_cracklib: Add maxclassrepeat, gecoscheck checks and remove unused difignore.Tomas Mraz2012-04-30
| | | | | | | | | | modules/pam_cracklib/pam_cracklib.c (_pam_parse): Recognize the maxclassrepeat, gecoscheck options. Ignore difignore option. (simple): Add the check for the same class repetition. (usercheck): Refactor into wordcheck(). (gecoscheck): New test for words from the GECOS field. (password_check): Call the gecoscheck(). (pam_sm_chauthtok): Drop the diff_ignore from options struct. modules/pam_cracklib/pam_cracklib.8.xml: Document the maxclassrepeat and gecoscheck checks, update the documentation of the difok test.
* pam_lastlog: Never lock out the root account.Tomas Mraz2012-04-30
| | | | | | modules/pam_lastlog/pam_lastlog.c (pam_sm_authenticate): Return PAM_SUCCESS if uid==0. modules/pam_lastlog/pam_lastlog.8.xml: Improve documentation.
* pam_lastlog: add possibility to lock out inactive users in auth or accountTomas Mraz2012-04-17
| | | | | | | | | | | | | * modules/pam_lastlog/pam_lastlog.8.xml: Document the new functionality and option. * modules/pam_lastlog/pam_lastlog.c: Add the inactive user lock out. (_pam_session_parse): Renamed from _pam_parse. (_pam_auth_parse): New function to parse auth arguments. (_last_login_open): Factor out opening of the lastlog file. (_last_login_read): Factor out opening of the lastlog file. (pam_sm_authenticate): Implement the lockout functionality. (pam_sm_setcred): Just return PAM_SUCCESS. (pam_sm_acct_mgmt): Call pam_sm_authenticate().
* Check for crypt() failure returning NULL.Paul Wouters2012-04-11
| | | | | | * modules/pam_unix/pam_unix_passwd.c (pam_sm_chauthtok): Adjust syslog message. * modules/pam_unix/passverify.c (create_password_hash): Check for crypt() returning NULL.
* pam_unix: make configuration consistent in --enable-static-modules modeDmitry V. Levin2012-02-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In --enable-static-modules mode, it was not possible to use "pam_unix" in PAM config files. Instead, different names had to be used for each management group: pam_unix_auth, pam_unix_acct, pam_unix_passwd and pam_unix_session. This change makes pam_unix configuration consistent with other PAM modules. * README: Remove the paragraph describing pam_unix distinctions in --enable-static-modules mode. * libpam/pam_static_modules.h (_pam_unix_acct_modstruct, _pam_unix_auth_modstruct, _pam_unix_passwd_modstruct, _pam_unix_session_modstruct): Remove. (_pam_unix_modstruct): New pam_module declaration. * modules/pam_unix/pam_unix_static.h: New file. * modules/pam_unix/pam_unix_static.c: Likewise. * modules/pam_unix/Makefile.am (noinst_HEADERS): Add pam_unix_static.h (pam_unix_la_SOURCES) [STATIC_MODULES]: Add pam_unix_static.c * modules/pam_unix/pam_unix_acct.c [PAM_STATIC]: Include pam_unix_static.h [PAM_STATIC] (_pam_unix_acct_modstruct): Remove. * modules/pam_unix/pam_unix_auth.c [PAM_STATIC]: Include pam_unix_static.h [PAM_STATIC] (_pam_unix_auth_modstruct): Remove. * modules/pam_unix/pam_unix_passwd.c [PAM_STATIC]: Include pam_unix_static.h [PAM_STATIC] (_pam_unix_passwd_modstruct): Remove. * modules/pam_unix/pam_unix_sess.c [PAM_STATIC]: Include pam_unix_static.h [PAM_STATIC] (_pam_unix_session_modstruct): Remove. Suggested-by: Matveychikov Ilya <i.matveychikov@securitycode.ru>
* Fix compile time errors in --enable-static-modules modeMatveychikov Ilya2012-01-27
| | | | | | | | | | | | | | | * libpam/pam_static_modules.h (_pam_rhosts_auth_modstruct): Remove obsolete declaration. (static_modules): Remove undefined reference to _pam_rhosts_auth_modstruct. * modules/pam_pwhistory/opasswd.h: Rename {save,check}_old_password to {save,check}_old_pass in order to avoid conflicts with pam_unix. * modules/pam_pwhistory/opasswd.c: Likewise. * modules/pam_pwhistory/pam_pwhistory.c: Likewise. * modules/pam_tally2/pam_tally2.c: Rename _pam_tally_modstruct to _pam_tally2_modstruct. Signed-off-by: Matveychikov Ilya <i.matveychikov@securitycode.ru>
* Do not unmount anything by default in pam_namespace close session call.Tomas Mraz2012-01-26
| | | | | | | | * modules/pam_namespace/pam_namespace.c (pam_sm_close_session): Recognize the unmount_on_close option and make the default to be to not unmount. * modules/pam_namespace/pam_namespace.h: Rename PAMNS_NO_UNMOUNT_ON_CLOSE to PAMNS_UNMOUNT_ON_CLOSE. * modules/pam_namespace/pam_namespace.8.xml: Document the change.
* Make / mount as rslave instead of bind mounting polydirs.Tomas Mraz2012-01-24
| | | | | | | | | * modules/pam_namespace/pam_namespace.c (protect_dir): Drop the always argument. (check_inst_parent): Drop the always argument from protect_dir(). (create_polydir): Likewise. (ns_setup): Likewise and do not mark the polydir with MS_PRIVATE. (setup_namespace): Mark the / with MS_SLAVE|MS_REC. * modules/pam_namespace/pam_namespace.8.xml: Reflect the change in docs.
* Add possibility to match ruser, rhost, and tty in pam_succeed_if.Tomas Mraz2012-01-13
| | | | | | | * modules/pam_succeed_if/pam_succeed_if.c (evaluate): Match ruser, rhost, and tty as left operand. * modules/pam_succeed_if/pam_succeed_if.8.xml: Document the new possible left operands.
* Fix matching of usernames in the pam_unix remember feature.Tomas Mraz2012-01-03
| | | | | | | * modules/pam_unix/pam_unix_passwd.c (check_old_password): Make sure we match only the whole username in opasswd entry. * modules/pam_unix/passverify.c (save_old_password): Likewise make sure we match only the whole username in opasswd entry.
* pam_selinux.8.xml: updateDmitry V. Levin2011-11-03
| | | | | | | | | | | * modules/pam_selinux/pam_selinux.8.xml (pam_selinux-cmdsynopsis): Reorder options, add new "restore" option. pam_selinux-description): Rewrite. (pam_selinux-options): Reorder options, describe new "restore" option. (pam_selinux-return_values): Remove PAM_AUTH_ERR, PAM_SESSION_ERR and PAM_BUF_ERR. (pam_selinux-see_also): Remove pam.conf(5). Add execve(2), tty(4) and selinux(8).
* pam_selinux.c: add "restore" optionDmitry V. Levin2011-11-03
| | | | | * modules/pam_selinux/pam_selinux.c (pam_sm_open_session): Add new "restore" option.
* pam_selinux.c: rewrite using pam_get_data/pam_set_dataDmitry V. Levin2011-11-03
| | | | | | | | | | | | * modules/pam_selinux/pam_selinux.c (security_restorelabel_tty, security_label_tty): Remove old functions. (module_data_t): New structure. (free_module_data, cleanup, get_module_data, get_item, set_exec_context, set_file_context, compute_exec_context, compute_tty_context, restore_context, set_context, create_context): New functions. (pam_sm_authenticate, pam_sm_setcred, pam_sm_open_session, pam_sm_close_session): Use them.
* Use libpam.la/libpam_misc.la to link with -lpam/-lpam_miscDmitry V. Levin2011-10-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | GNU automake documentation recommends to avoid using -l options in LDADD or LIBADD when referring to libraries built by the package. Instead, it recommends to write the file name of the library explicitly, and use -l option only to list third-party libraries. As result, the default value of *_DEPENDENCIES will list all local libraries and omit the other ones. * modules/pam_access/Makefile.am (pam_access_la_LIBADD): Replace "-L$(top_builddir)/libpam -lpam" with "$(top_builddir)/libpam/libpam.la", to follow GNU automake recommendations. * modules/pam_cracklib/Makefile.am (pam_cracklib_la_LIBADD): Likewise. * modules/pam_debug/Makefile.am (pam_debug_la_LIBADD): Likewise. * modules/pam_deny/Makefile.am (pam_deny_la_LIBADD): Likewise. * modules/pam_echo/Makefile.am (pam_echo_la_LIBADD): Likewise. * modules/pam_env/Makefile.am (pam_env_la_LIBADD): Likewise. * modules/pam_exec/Makefile.am (pam_exec_la_LIBADD): Likewise. * modules/pam_faildelay/Makefile.am (pam_faildelay_la_LIBADD): Likewise. * modules/pam_filter/Makefile.am (pam_filter_la_LIBADD): Likewise. * modules/pam_filter/upperLOWER/Makefile.am (LDADD): Likewise. * modules/pam_ftp/Makefile.am (pam_ftp_la_LIBADD): Likewise. * modules/pam_group/Makefile.am (pam_group_la_LIBADD): Likewise. * modules/pam_issue/Makefile.am (pam_issue_la_LIBADD): Likewise. * modules/pam_keyinit/Makefile.am (pam_keyinit_la_LIBADD): Likewise. * modules/pam_lastlog/Makefile.am (pam_lastlog_la_LIBADD): Likewise. * modules/pam_limits/Makefile.am (pam_limits_la_LIBADD): Likewise. * modules/pam_listfile/Makefile.am (pam_listfile_la_LIBADD): Likewise. * modules/pam_localuser/Makefile.am (pam_localuser_la_LIBADD): Likewise. * modules/pam_loginuid/Makefile.am (pam_loginuid_la_LIBADD): Likewise. * modules/pam_mail/Makefile.am (pam_mail_la_LIBADD): Likewise. * modules/pam_mkhomedir/Makefile.am (pam_mkhomedir_la_LIBADD, mkhomedir_helper_LDADD): Likewise. * modules/pam_motd/Makefile.am (pam_motd_la_LIBADD): Likewise. * modules/pam_namespace/Makefile.am (pam_namespace_la_LIBADD): Likewise. * modules/pam_nologin/Makefile.am (pam_nologin_la_LIBADD): Likewise. * modules/pam_permit/Makefile.am (pam_permit_la_LIBADD): Likewise. * modules/pam_pwhistory/Makefile.am (pam_pwhistory_la_LIBADD): Likewise. * modules/pam_rhosts/Makefile.am (pam_rhosts_la_LIBADD): Likewise. * modules/pam_rootok/Makefile.am (pam_rootok_la_LIBADD): Likewise. * modules/pam_securetty/Makefile.am (pam_securetty_la_LIBADD): Likewise. * modules/pam_sepermit/Makefile.am (pam_sepermit_la_LIBADD): Likewise. * modules/pam_shells/Makefile.am (pam_shells_la_LIBADD): Likewise. * modules/pam_stress/Makefile.am (pam_stress_la_LIBADD): Likewise. * modules/pam_succeed_if/Makefile.am (pam_succeed_if_la_LIBADD): Likewise. * modules/pam_tally/Makefile.am (pam_tally_la_LIBADD): Likewise. * modules/pam_tally2/Makefile.am (pam_tally2_la_LIBADD, pam_tally2_LDADD): Likewise. * modules/pam_time/Makefile.am (pam_time_la_LIBADD): Likewise. * modules/pam_timestamp/Makefile.am (pam_timestamp_la_LIBADD, pam_timestamp_check_LDADD, hmacfile_LDADD): Likewise. * modules/pam_tty_audit/Makefile.am (pam_tty_audit_la_LIBADD): Likewise. * modules/pam_umask/Makefile.am (pam_umask_la_LIBADD): Likewise. * modules/pam_unix/Makefile.am (pam_unix_la_LIBADD): Likewise. * modules/pam_userdb/Makefile.am (pam_userdb_la_LIBADD): Likewise. * modules/pam_warn/Makefile.am (pam_warn_la_LIBADD): Likewise. * modules/pam_wheel/Makefile.am (pam_wheel_la_LIBADD): Likewise. * modules/pam_xauth/Makefile.am (pam_xauth_la_LIBADD): Likewise. * tests/Makefile.am (LDADD): Likewise. * examples/Makefile.am (LDADD): Replace "-L$(top_builddir)/libpam -lpam" with "$(top_builddir)/libpam/libpam.la", and "-L$(top_builddir)/libpam_misc -lpam_misc" with "$(top_builddir)/libpam_misc/libpam_misc.la", to follow GNU automake recommendations. * xtests/Makefile.am (LDADD): Likewise. * modules/pam_selinux/Makefile.am (pam_selinux_la_LIBADD): Likewise.
* Fix usage of LIBADD, LDADD and LDFLAGSDmitry V. Levin2011-10-28
| | | | | | | | | | | | | | * modules/pam_selinux/Makefile.am: Rename pam_selinux_check_LDFLAGS to pam_selinux_check_LDADD. * modules/pam_userdb/Makefile.am: Split out pam_userdb_la_LIBADD from AM_LDFLAGS. * modules/pam_warn/Makefile.am: Split out pam_warn_la_LIBADD from AM_LDFLAGS. * modules/pam_wheel/Makefile.am: Split out pam_wheel_la_LIBADD from AM_LDFLAGS. * modules/pam_xauth/Makefile.am: split out pam_xauth_la_LIBADD from AM_LDFLAGS. * xtests/Makefile.am: Rename AM_LDFLAGS to LDADD.
* Update .gitignore filesDmitry V. Levin2011-10-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * .gitignore: Add common ignore patterns. * m4/.gitignore: Unignore local m4 files. * dynamic/.gitignore: Unignore Makefile. * libpamc/test/modules/.gitignore: Likewise. * libpamc/test/regress/.gitignore: Likewise. * po/.gitignore: Add Makevars.template. * conf/.gitignore: Remove common ignore patterns. * conf/pam_conv1/.gitignore: Likewise. * doc/.gitignore: Likewise. * doc/specs/.gitignore: Likewise. * doc/specs/formatter/.gitignore: Likewise. * examples/.gitignore: Likewise. * modules/pam_filter/upperLOWER/.gitignore: Likewise. * modules/pam_mkhomedir/.gitignore: Likewise. * modules/pam_selinux/.gitignore: Likewise. * modules/pam_stress/.gitignore: Likewise. * modules/pam_tally/.gitignore: Likewise. * modules/pam_tally2/.gitignore: Likewise. * modules/pam_timestamp/.gitignore: Likewise. * modules/pam_unix/.gitignore: Likewise. * tests/.gitignore: Likewise. * xtests/.gitignore: Likewise. * doc/adg/.gitignore: Remove. * doc/man/.gitignore: Remove. * doc/mwg/.gitignore: Remove. * doc/sag/.gitignore: Remove. * libpamc/.gitignore: Remove. * libpamc/test/.gitignore: Remove. * libpam/.gitignore: Remove. * libpam_misc/.gitignore: Remove. * modules/.gitignore: Remove. * modules/pam_access/.gitignore: Remove. * modules/pam_cracklib/.gitignore: Remove. * modules/pam_debug/.gitignore: Remove. * modules/pam_deny/.gitignore: Remove. * modules/pam_echo/.gitignore: Remove. * modules/pam_env/.gitignore: Remove. * modules/pam_exec/.gitignore: Remove. * modules/pam_faildelay/.gitignore: Remove. * modules/pam_filter/.gitignore: Remove. * modules/pam_ftp/.gitignore: Remove. * modules/pam_group/.gitignore: Remove. * modules/pam_issue/.gitignore: Remove. * modules/pam_keyinit/.gitignore: Remove. * modules/pam_lastlog/.gitignore: Remove. * modules/pam_limits/.gitignore: Remove. * modules/pam_listfile/.gitignore: Remove. * modules/pam_localuser/.gitignore: Remove. * modules/pam_loginuid/.gitignore: Remove. * modules/pam_mail/.gitignore: Remove. * modules/pam_motd/.gitignore: Remove. * modules/pam_namespace/.gitignore: Remove. * modules/pam_nologin/.gitignore: Remove. * modules/pam_permit/.gitignore: Remove. * modules/pam_pwhistory/.gitignore: Remove. * modules/pam_rhosts/.gitignore: Remove. * modules/pam_rootok/.gitignore: Remove. * modules/pam_securetty/.gitignore: Remove. * modules/pam_sepermit/.gitignore: Remove. * modules/pam_shells/.gitignore: Remove. * modules/pam_succeed_if/.gitignore: Remove. * modules/pam_time/.gitignore: Remove. * modules/pam_tty_audit/.gitignore: Remove. * modules/pam_umask/.gitignore: Remove. * modules/pam_userdb/.gitignore: Remove. * modules/pam_warn/.gitignore: Remove. * modules/pam_wheel/.gitignore: Remove. * modules/pam_xauth/.gitignore: Remove.
* Remove modules/pam_timestamp/hmacfile from distributionDmitry V. Levin2011-10-27
| | | | | | * modules/pam_timestamp/Makefile.am (dist_TESTS): Add tst-pam_timestamp. (nodist_TESTS): Add hmacfile. (EXTRA_DIST): Replace TESTS with dist_TESTS.
* Rename all .cvsignore files to .gitignoreDmitry V. Levin2011-10-27
|
* Fix whitespace issuesDmitry V. Levin2011-10-26
| | | | | | Cleanup trailing whitespaces, indentation that uses spaces before tabs, and blank lines at EOF. Make the project free of warnings reported by git diff --check 4b825dc642cb6eb9a060e54bf8d69288fbee4904 HEAD
* 2011-10-25 Thorsten Kukuk <kukuk@thkukuk.de>Thorsten Kukuk2011-10-25
| | | | | | | | | * release version 1.1.5 * configure.in: Bump version number. * modules/pam_tally2/pam_tally2.8.xml: Remove never used option "no_lock_time".
* pam_env: abort when encountering an overflowed environment variable expansionKees Cook2011-10-14
| | | | | | | * modules/pam_env/pam_env.c (_expand_arg): Abort when encountering an overflowed environment variable expansion. Fixes CVE-2011-3149. Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/pam/+bug/874565
* pam_env: correctly count leading whitespace when parsing environment fileKees Cook2011-10-14
| | | | | | | * modules/pam_env/pam_env.c (_assemble_line): Correctly count leading whitespace. Fixes CVE-2011-3148. Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/pam/+bug/874469
* If getdomainname() fails or domainname not set use NULL as domain in innetgr().Tomas Mraz2011-10-10
|
* Add hostname resolution cache.Tomas Mraz2011-10-10
|
* Correct the FSF address.Tomas Mraz2011-08-25
|
* Fix the split on @ in the user field. (Red Hat Bug #732081)Tomas Mraz2011-08-25
|
* Fix missing dereference.Tomas Mraz2011-08-23
|
* Fix order of librariesThorsten Kukuk2011-06-24
|
* 2011-06-21 Thorsten Kukuk <kukuk@thkukuk.de>Thorsten Kukuk2011-06-21
| | | | | | | | * modules/pam_limits/pam_limits.c: Add set_all option, read limits from PID one if no limit is specified and set_all is set. * modules/pam_limits/pam_limits.8.xml: Document set_all option. Based on Patch by Kees Cook.
* Initialize the fake_item from item.Tomas Mraz2011-06-15
|
* Avoid memleaks and fd leak in error paths.Tomas Mraz2011-06-15
|
* Do not crash when remember, minlen, or rounds options are used with wrong ↵Tomas Mraz2011-06-15
| | | | module type.
* Cleanups of pam_pwhistory code. Make opasswd entry parsing more robust.Tomas Mraz2011-06-15
| | | | | | | | | * modules/pam_pwhistory/opasswd.c (check_old_password): Do not needlessly call strdupa(). (save_old_password): Avoid memleaks in error paths. Avoid memleak of buf. Make the opasswd entry parsing more robust. * modules/pam_pwhistory/pam_pwhistory.8.xml: Document the special meaning of remember=0.
* Avoid leaking memory and dir handle on realloc failure.Tomas Mraz2011-06-15
|
* 2011-06-14 Thorsten Kukuk <kukuk@thkukuk.de>Thorsten Kukuk2011-06-14
| | | | | | | | | | * configure.in: Check for libtirpc bye default. * libpam/Makefile.am: Add support for libtirpc. * modules/pam_access/Makefile.am: Likewise. * modules/pam_unix/Makefile.am: Likewise. * modules/pam_unix/pam_unix_passwd.c: Change ifdefs for new libtirpc support. * modules/pam_unix/yppasswd_xdr.c: Only compile if we have rpc/rpc.h.
* Test also whether the tty is in the /sys/class/tty/console/active file.Tomas Mraz2011-06-13
|
* Detect the shared / mount and enable private mounts based on that.Tomas Mraz2011-06-07
|
* Define the MS_PRIVATE and MS_REC flags if they are not in sys/mount.h.Tomas Mraz2011-06-06
|
* Rewrite of the field parsing in pam_group and pam_time.Tomas Mraz2011-06-06
|
* Check for return value of pam_get_item() in pam_echo module.Tomas Mraz2011-06-02
|
* Guard for pam_get_user() error in pam_filter module.Tomas Mraz2011-06-02
|
* Guards for memory allocation errors in pam_cracklib module.Tomas Mraz2011-06-02
|
* Add support for the mount_private option to pam_namespace.Tomas Mraz2011-06-02
|
* 2011-05-30 Thorsten Kukuk <kukuk@thkukuk.de>Thorsten Kukuk2011-05-30
| | | | | | | | | | | * modules/pam_timestamp/pam_timestamp.c (main): Remove unsused variable pretval. * modules/pam_stress/pam_stress.c (converse): **message is const. (stress_get_password): pmsg is const. (pam_sm_chauthtok): Likewise. * libpam/pam_item.c (pam_get_user): Make pmsg const and remove casts.
* 2011-05-30 Thorsten Kukuk <kukuk@thkukuk.de>Thorsten Kukuk2011-05-30
| | | | | * modules/pam_env/pam_env.c (_pam_parse): Implement debug option. Based on patch by Tomas Mraz.
* 2011-05-24 Thorsten Kukuk <kukuk@thkukuk.de>Thorsten Kukuk2011-05-24
| | | | | | * modules/pam_listfile/pam_listfile.c (pam_sm_authenticate): quiet option has no argument, print no missing file if quiet is set [sf#3194930].
* 2011-05-04 Thorsten Kukuk <kukuk@thkukuk.de>kukuk2011-05-04
| | | | | * modules/pam_lastlog/pam_lastlog.c (last_login_failed): Don't abort with error if btmp file does not exist.
* Clear the whole MD5 context.Tomas Mraz2011-03-21
|
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-24 07:23:52 +0000