sm-commit AT lists.ibiblio.org
Subject: Source Mage code commit list
List archive
[SM-Commit] GIT changes to master grimoire by Ladislav Hagara (154ada00db1c5d970f93c9daace40ce8a35b2f09)
- From: Ladislav Hagara <scm AT mail.sourcemage.org>
- To: sm-commit AT lists.ibiblio.org
- Subject: [SM-Commit] GIT changes to master grimoire by Ladislav Hagara (154ada00db1c5d970f93c9daace40ce8a35b2f09)
- Date: Thu, 29 Jun 2006 04:12:55 -0500
GIT changes to master grimoire by Ladislav Hagara <ladislav.hagara AT unob.cz>:
security-libs/linux-pam/BUILD | 30
security-libs/linux-pam/CONFIGURE | 3
security-libs/linux-pam/DEPENDS | 25
security-libs/linux-pam/DETAILS | 8
security-libs/linux-pam/HISTORY | 38 +
security-libs/linux-pam/INSTALL | 12
security-libs/linux-pam/WIP | 4
security-libs/linux-pam/pam-selinux.patch | 973
+++++++++++++++++++++++++++---
8 files changed, 989 insertions(+), 104 deletions(-)
New commits:
commit 154ada00db1c5d970f93c9daace40ce8a35b2f09
Author: Ladislav Hagara <ladislav.hagara AT unob.cz>
Commit: Ladislav Hagara <ladislav.hagara AT unob.cz>
linux-pam, started working on it, really very stale, integrated from
devel grimoire (p4)
diff --git a/security-libs/linux-pam/BUILD b/security-libs/linux-pam/BUILD
index 3fecfba..d4353ae 100755
--- a/security-libs/linux-pam/BUILD
+++ b/security-libs/linux-pam/BUILD
@@ -1,13 +1,19 @@
- if ! spell_ok linuxdoc-tools ||
- ! spell_ok tetex; then
- export HAVE_SGML2LATEX=no
- fi
- export HAVE_PS2PDF=no
+if [ "${PAM_DOCS}" == "n" ]; then
+ export SGML2LATEX=no
+fi
- autoconf &&
- ./configure --enable-read-both-confs $OPTS &&
- sedit "s/examples//" Makefile &&
- sedit "s/read yes//" conf/install_conf &&
- sedit "s/read yes//" modules/install_conf &&
- sedit "s/PSER=.*/PSER=/" Make.Rules &&
- make
+export PS2PDF=no
+
+#autoconf &&
+./configure --libdir=/usr/lib \
+ --sbindir=/lib/security \
+ --enable-securedir=/lib/security \
+ --enable-read-both-confs \
+ $OPTS &&
+sedit "s/examples//" Makefile &&
+sedit "s/read yes//" conf/install_conf &&
+if [ "$PAM_SELINUX" == "y" ] ; then
+ invoke_gcc
+fi &&
+make_single &&
+make
diff --git a/security-libs/linux-pam/CONFIGURE
b/security-libs/linux-pam/CONFIGURE
index 6fdcfc0..4adcd23 100755
--- a/security-libs/linux-pam/CONFIGURE
+++ b/security-libs/linux-pam/CONFIGURE
@@ -1 +1,2 @@
-config_query PAM_SELINUX "Enable selinux support?" n
+config_query PAM_SELINUX "Enable selinux support?" n &&
+config_query PAM_DOCS "Build documentation?" n
diff --git a/security-libs/linux-pam/DEPENDS b/security-libs/linux-pam/DEPENDS
index 6211a12..77b9610 100755
--- a/security-libs/linux-pam/DEPENDS
+++ b/security-libs/linux-pam/DEPENDS
@@ -1,19 +1,16 @@
-depends autoconf &&
-if [ "${PAM_SELINUX}" == "y" ]; then
- depends libselinux
-fi &&
-
-depends cracklib &&
+depends autoconf &&
+depends cracklib &&
+depends gnupg &&
depends smgl-fhs &&
-optional_depends tetex \
- "" \
- "" \
- "to build documentation" &&
+if [ "${PAM_SELINUX}" == "y" ]; then
+ depends libselinux &&
+ depends gcc34
+fi &&
-optional_depends linuxdoc-tools \
- "" \
- "" \
- "to build documentation" &&
+if [ "${PAM_DOCS}" == "y" ]; then
+ depends tetex &&
+ depends linuxdoc-tools
+fi
optional_depends libprelude "--enable-prelude" "--without-prelude" "for
prelude ids support"
diff --git a/security-libs/linux-pam/DETAILS b/security-libs/linux-pam/DETAILS
index 2d6ad9a..9d89ead 100755
--- a/security-libs/linux-pam/DETAILS
+++ b/security-libs/linux-pam/DETAILS
@@ -1,15 +1,19 @@
SPELL=linux-pam
- VERSION=0.79
+ VERSION=0.99.3.0
+
SOURCE_HASH='sha512:c03632b884d5d07953df295f03ddf536210011cdb7730981e6b8ab278e990e13f9ef546dea55ddc5725945509bd1496e69ecce192d75f45c5830778cbca2d1cd'
SOURCE=Linux-PAM-$VERSION.tar.bz2
SOURCE_DIRECTORY=$BUILD_DIRECTORY/Linux-PAM-$VERSION
SOURCE_URL[0]=$KERNEL_URL/pub/linux/libs/pam/pre/library/$SOURCE
SOURCE_URL[1]=ftp://ftp.kernel.org/pub/linux/libs/pam/pre/library/$SOURCE
- MD5[0]=e5b9f83ff60b113e68570359c1a9f3d9
+ # only with libselinux patch
+ GCC_VERSION=3.4
WEB_SITE=http://www.us.kernel.org/pub/linux/libs/pam
ENTERED=20010922
UPDATED=20050410
LICENSE[0]=GPL
BUILD_API=2
+ PATCHLEVEL=1
+ KEYWORDS="security libs"
SHORT="Linux-PAM provides a flexibile authentication mechanism."
cat << EOF
Linux-PAM provides a flexible mechanism for authenticating users. PAM
diff --git a/security-libs/linux-pam/HISTORY b/security-libs/linux-pam/HISTORY
index 234634c..b4ea0e6 100644
--- a/security-libs/linux-pam/HISTORY
+++ b/security-libs/linux-pam/HISTORY
@@ -2,7 +2,14 @@
* DEPENDS: use correct switch to turn off libprelude, bug #11875
2006-05-10 Unet <unet AT sourcemage.org>
- * DEPENDS: Added libprelude support
+ * DEPENDS: Added optional_depends on libprelude
+
+2006-03-22 Robin Cook <rcook AT wyrms.net>
+ * INSTALL: removed link lines the not correct.
+ removed extra &&
+
+2006-03-12 Karsten Behrmann <BearPerson AT sourcemage.org>
+ * DETAILS: (automated) Add KEYWORDS
2006-02-08 Eric Sandall <eric AT sandall.us>
* DEPENDS: Depends on smgl-fhs (for directory structure)
@@ -10,6 +17,35 @@
2006-02-06 Eric Sandall <eric AT sandall.us>
* DEPENDS: Depends on gnupg (for SOURCE verification)
+2006-01-22 Sergey Lipnevich <sergey AT sourcemage.org>
+ * DETAILS: upgrade to 0.99.3.0.
+
+2005-12-29 Robin Cook <rcook AT wyrms.net>
+ * CONFIGURE: Added query to build documents
+ * DEPENDS: change tetex and libuxdoc-tool depends by query
+ * BUILD: export variable by query
+ added configure switches form LFS so openssh will build with pam
+
+
+2005-12-14 Sergey Lipnevich <sergey AT sourcemage.org>
+ * DETAILS: upgrade to 0.99.2.1;
+ * BUILD: remove edits for non-existent files.
+
+2005-11-29 Seth Woolley <seth AT tautology.org>
+ * DETAILS: MD5 -> SHA512
+
+2005-07-28 Ladislav Hagara <hgr AT vabo.cz>
+ * DETAILS: 0.80
+
+2005-05-24 David Brown <dmlb2000 AT excite.com>
+ * BUILD: added invoke_gcc
+ * DETAILS: depends on gcc 3.4 but only for libselinux patch
+ * pam-selinux.patch: updated
+ * DEPENDS: depends on gcc34 but only for libselinux patch
+ * INSTALL: added the pam_selinux.so load on the login file in
/etc/pam.d
+ * WIP: added don't want people screwing over others computers until
+ we know it works
+
2005-04-21 Arjan Bouter <abouter AT sourcemage.org>
* PRE_BUILD: fixed selinux patching
diff --git a/security-libs/linux-pam/INSTALL b/security-libs/linux-pam/INSTALL
index e651689..88c0b05 100755
--- a/security-libs/linux-pam/INSTALL
+++ b/security-libs/linux-pam/INSTALL
@@ -1,4 +1,7 @@
make install &&
+if [ "$PAM_SELINUX" == "y" ] ; then
+ echo "session required pam_selinux.so multiple" >>
/etc/pam.d/login
+fi &&
if [ ! -f /etc/securetty ]
then
@@ -9,11 +12,4 @@ then
else
cp $SCRIPT_DIRECTORY/securetty.udev /etc/securetty
fi
-fi &&
-
-ln -sf libpam.so.$VERSION /lib/libpam.so &&
-ln -sf libpam.so.$VERSION /lib/libpam.so.0 &&
-ln -sf libpam_misc.so.$VERSION /lib/libpam_misc.so &&
-ln -sf libpam_misc.so.$VERSION /lib/libpam_misc.so.0 &&
-ln -sf libpamc.so.$VERSION /lib/libpamc.so &&
-ln -sf libpamc.so.$VERSION /lib/libpamc.so.0
+fi
diff --git a/security-libs/linux-pam/WIP b/security-libs/linux-pam/WIP
new file mode 100755
index 0000000..bbf3aad
--- /dev/null
+++ b/security-libs/linux-pam/WIP
@@ -0,0 +1,4 @@
+2005-05-24 David Brown <dmlb2000 AT excite.com>
+
+The selinux stuff shouldn't be integrated to test yet until we know it will
+work
diff --git a/security-libs/linux-pam/pam-selinux.patch
b/security-libs/linux-pam/pam-selinux.patch
index 262a84e..956dbcc 100644
--- a/security-libs/linux-pam/pam-selinux.patch
+++ b/security-libs/linux-pam/pam-selinux.patch
@@ -1,7 +1,7 @@
-diff -Naur Linux-PAM-0.78/configure.in patched-Linux-PAM-0.78/configure.in
---- Linux-PAM-0.78/configure.in 2004-10-06 16:04:34.000000000 +0200
-+++ patched-Linux-PAM-0.78/configure.in 2005-03-10 17:31:48.000000000
+0100
-@@ -224,6 +224,13 @@
+diff -uNr Linux-PAM-0.79.old/configure.in Linux-PAM-0.79/configure.in
+--- Linux-PAM-0.79.old/configure.in 2005-03-30 06:32:52.000000000 -0800
++++ Linux-PAM-0.79/configure.in 2005-05-24 18:03:58.000000000 -0700
+@@ -230,6 +230,13 @@
if test $HAVE_LIBNSL = yes ; then
pwdblibs="$pwdblibs -lnsl"
fi
@@ -15,9 +15,9 @@ diff -Naur Linux-PAM-0.78/configure.in p
AC_CHECK_LIB(pwdb, pwdb_db_name, HAVE_LIBPWDB=yes ; AC_DEFINE(HAVE_LIBPWDB),
HAVE_LIBPWDB=no,$pwdblibs)
AC_SUBST(HAVE_LIBPWDB)
-diff -Naur Linux-PAM-0.78/modules/pam_pwdb/Makefile
patched-Linux-PAM-0.78/modules/pam_pwdb/Makefile
---- Linux-PAM-0.78/modules/pam_pwdb/Makefile 2004-09-28 15:49:24.000000000
+0200
-+++ patched-Linux-PAM-0.78/modules/pam_pwdb/Makefile 2005-03-10
17:31:48.000000000 +0100
+diff -uNr Linux-PAM-0.79.old/modules/pam_pwdb/Makefile
Linux-PAM-0.79/modules/pam_pwdb/Makefile
+--- Linux-PAM-0.79.old/modules/pam_pwdb/Makefile 2004-09-28
06:49:24.000000000 -0700
++++ Linux-PAM-0.79/modules/pam_pwdb/Makefile 2005-05-24 18:03:58.000000000
-0700
@@ -11,7 +11,7 @@
ifeq ($(HAVE_LIBPWDB),yes)
@@ -36,9 +36,9 @@ diff -Naur Linux-PAM-0.78/modules/pam_pw
pwdb_chkpwd.o: pwdb_chkpwd.c pam_unix_md.-c bigcrypt.-c
-diff -Naur Linux-PAM-0.78/modules/pam_rootok/Makefile
patched-Linux-PAM-0.78/modules/pam_rootok/Makefile
---- Linux-PAM-0.78/modules/pam_rootok/Makefile 2000-11-20 00:54:05.000000000
+0100
-+++ patched-Linux-PAM-0.78/modules/pam_rootok/Makefile 2005-03-10
17:31:48.000000000 +0100
+diff -uNr Linux-PAM-0.79.old/modules/pam_rootok/Makefile
Linux-PAM-0.79/modules/pam_rootok/Makefile
+--- Linux-PAM-0.79.old/modules/pam_rootok/Makefile 2000-11-19
15:54:05.000000000 -0800
++++ Linux-PAM-0.79/modules/pam_rootok/Makefile 2005-05-24 18:03:58.000000000
-0700
@@ -13,3 +13,6 @@
TITLE=pam_rootok
@@ -46,9 +46,9 @@ diff -Naur Linux-PAM-0.78/modules/pam_ro
+
+CFLAGS += -DWITH_SELINUX
+LINK_PAMMODUTILS += -lselinux
-diff -Naur Linux-PAM-0.78/modules/pam_rootok/pam_rootok.c
patched-Linux-PAM-0.78/modules/pam_rootok/pam_rootok.c
---- Linux-PAM-0.78/modules/pam_rootok/pam_rootok.c 2002-05-27
01:00:28.000000000 +0200
-+++ patched-Linux-PAM-0.78/modules/pam_rootok/pam_rootok.c 2005-03-10
17:31:48.000000000 +0100
+diff -uNr Linux-PAM-0.79.old/modules/pam_rootok/pam_rootok.c
Linux-PAM-0.79/modules/pam_rootok/pam_rootok.c
+--- Linux-PAM-0.79.old/modules/pam_rootok/pam_rootok.c 2002-05-26
16:00:28.000000000 -0700
++++ Linux-PAM-0.79/modules/pam_rootok/pam_rootok.c 2005-05-24
18:03:58.000000000 -0700
@@ -39,6 +39,11 @@
}
@@ -73,24 +73,870 @@ diff -Naur Linux-PAM-0.78/modules/pam_ro
retval = PAM_SUCCESS;
if (ctrl & PAM_DEBUG_ARG) {
-diff -Naur Linux-PAM-0.78/modules/pam_unix/Makefile
patched-Linux-PAM-0.78/modules/pam_unix/Makefile
---- Linux-PAM-0.78/modules/pam_unix/Makefile 2004-11-08 09:58:37.000000000
+0100
-+++ patched-Linux-PAM-0.78/modules/pam_unix/Makefile 2005-03-10
17:31:48.000000000 +0100
+diff -uNr Linux-PAM-0.79.old/modules/pam_selinux/Makefile
Linux-PAM-0.79/modules/pam_selinux/Makefile
+--- Linux-PAM-0.79.old/modules/pam_selinux/Makefile 1969-12-31
16:00:00.000000000 -0800
++++ Linux-PAM-0.79/modules/pam_selinux/Makefile 2005-05-24
18:03:58.000000000 -0700
+@@ -0,0 +1,19 @@
++#
++# $Id: Makefile,v 1.5 2003/07/08 03:16:28 nalin Exp $
++#
++
++include ../../Make.Rules
++
++TITLE=pam_selinux
++APPLICATION=$(TITLE)_check
++APPMODE=04511
++MAN8=$(TITLE).8 $(TITLE)_check.8
++MODULE_SIMPLE_EXTRALIBS=-lselinux
++
++#MODULE_SIMPLE_INSTALL=$(MAKE) $(APPLICATION); $(INSTALL) -m $(APPMODE)
$(APPLICATION) $(FAKEROOT)$(SUPLEMENTED)
++
++include ../Simple.Rules
++
++$(APPLICATION): $(APPLICATION).c
++ $(CC) $(CFLAGS) $(INCLUDE_PAMMODUTILS) -o $@ $^ $(LINK_PAMMODUTILS)
-lpam -lpam_misc
++
+diff -uNr Linux-PAM-0.79.old/modules/pam_selinux/README
Linux-PAM-0.79/modules/pam_selinux/README
+--- Linux-PAM-0.79.old/modules/pam_selinux/README 1969-12-31
16:00:00.000000000 -0800
++++ Linux-PAM-0.79/modules/pam_selinux/README 2005-05-24 18:03:58.000000000
-0700
+@@ -0,0 +1,17 @@
++This is pam_selinux, a module for setting the default security context
after
++login via PAM.
++
++Background: SELinux provides a mechanism for allowing people to login with
++different security contexts.
++
++The module takes these arguments:
++The module takes these arguments:
++ close Only execute the close_session portion of the module.
++ debug Log debug messages (with priority DEBUG) to syslog.
++ nottys Do not set security context on controlling tty
++ verbose Attempt to tell the user when security context is set.
++ open Only execute the open_session portion of the module.
++
++Dan Walsh <dwalsh AT redhat.com>
++
++
+diff -uNr Linux-PAM-0.79.old/modules/pam_selinux/pam_selinux.8
Linux-PAM-0.79/modules/pam_selinux/pam_selinux.8
+--- Linux-PAM-0.79.old/modules/pam_selinux/pam_selinux.8 1969-12-31
16:00:00.000000000 -0800
++++ Linux-PAM-0.79/modules/pam_selinux/pam_selinux.8 2005-05-24
18:03:58.000000000 -0700
+@@ -0,0 +1,63 @@
++.TH pam_selinux 8 2003/08/26 "Red Hat Linux" "System Administrator's Manual"
++.SH NAME
++pam_selinux \- set the default security context after login via PAM.
++.SH SYNOPSIS
++.B session optional /lib/security/pam_selinux.so
++.br
++
++.SH DESCRIPTION
++In a nutshell, pam_selinux sets up the default security context for the
next execed
++shell.
++
++When an application opens a session using pam_selinux, the shell that gets
++executed will be run in the default security context, or if the user chooses
++and the pam file allows the selected security context. Also the controlling
++tty will have it's security context modified to match the users.
++
++Adding pam_selinux into a pam file could cause other pam modules to change
++their behavior if the exec another application. The close and open option
help
++mitigate this problem. close option will only cause the close portion of
the
++pam_selinux to execute, and open will only cause the open portion to run.
You
++can add pam_selinux to the config file twice. Add the pam_selinux close as
the
++'first' session entry and open as the 'last' session entry. This way when
pam
++executes the open pass through the modules, pam_selinux open_session will
++happen last. When pam executes the close pass through the modules
pam_selinux
++close_session will happen first.
++
++.SH ARGUMENTS
++.IP close
++Only execute the close_session portion of the module.
++.IP debug
++turns on debugging via \fBsyslog(3)\fR.
++.IP multiple
++tells pam_selinux.so to allow the user to select the security context they
will
++login with, if the user has more than one role.
++.IP open
++Only execute the open_session portion of the module.
++.IP nottys
++Do not try to setup the ttys security context.
++.IP verbose
++attempt to inform the user when security context is set.
++
++.SH EXAMPLE
++\fB/etc/pam.d/some-login-program\fP:
++.br
++auth required /lib/security/pam_unix.so
++.br
++session required /lib/security/pam_permit.so
++session optional /lib/security/pam_selinux.so
++.br
++
++.SH CAVEATS
++Setting the following line will cause the login to fail
++auth sufficient /lib/security/pam_selinux.so verbose
++
++
++.SH SEE ALSO
++pam_selinux_check(8)
++
++.SH BUGS
++Let's hope not, but if you find any, please email the author.
++
++.SH AUTHOR
++Dan Walsh <dwalsh AT redhat.com>
+diff -uNr Linux-PAM-0.79.old/modules/pam_selinux/pam_selinux.c
Linux-PAM-0.79/modules/pam_selinux/pam_selinux.c
+--- Linux-PAM-0.79.old/modules/pam_selinux/pam_selinux.c 1969-12-31
16:00:00.000000000 -0800
++++ Linux-PAM-0.79/modules/pam_selinux/pam_selinux.c 2005-05-24
18:03:58.000000000 -0700
+@@ -0,0 +1,644 @@
++/******************************************************************************
++ * A module for Linux-PAM that will set the default security context after
login
++ * via PAM.
++ *
++ * Copyright (c) 2003 Red Hat, Inc.
++ * Written by Dan Walsh <dwalsh AT redhat.com>
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ * notice, and the entire permission notice in its entirety,
++ * including the disclaimer of warranties.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ * notice, this list of conditions and the following disclaimer in the
++ * documentation and/or other materials provided with the distribution.
++ * 3. The name of the author may not be used to endorse or promote
++ * products derived from this software without specific prior
++ * written permission.
++ *
++ * ALTERNATIVELY, this product may be distributed under the terms of
++ * the GNU Public License, in which case the provisions of the GPL are
++ * required INSTEAD OF the above restrictions. (This clause is
++ * necessary due to a potential bad interaction between the GPL and
++ * the restrictions contained in a BSD-style copyright.)
++ *
++ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
++ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
++ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
++ * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++#define PAM_SM_AUTH
++#define PAM_SM_SESSION
++
++#include "../../_pam_aconf.h"
++
++#include <errno.h>
++#include <limits.h>
++#include <pwd.h>
++#include <stdio.h>
++#include <stdlib.h>
++#include <string.h>
++#include <unistd.h>
++#include <sys/types.h>
++#include <sys/stat.h>
++#include <fcntl.h>
++#include <linux/limits.h>
++
++#include "../../_pam_aconf.h"
++#include <security/pam_modules.h>
++#include <security/_pam_macros.h>
++#include <security/_pam_modutil.h>
++
++#include <libintl.h>
++#define _(x) gettext(x)
++
++#ifndef PAM_SELINUX_MAIN
++#define MODULE "pam_selinux"
++
++#include <selinux/selinux.h>
++#include <selinux/get_context_list.h>
++#include <selinux/flask.h>
++#include <selinux/selinux.h>
++#include <selinux/context.h>
++
++static int send_text( struct pam_conv *conv, const char *text, int debug) {
++ struct pam_message message;
++ const struct pam_message *messages[] = {&message};
++ struct pam_response *responses;
++ int retval;
++
++ memset(&message, 0, sizeof(message));
++ message.msg_style = PAM_TEXT_INFO;
++ message.msg = text;
++ if (debug)
++ syslog(LOG_NOTICE, MODULE ": %s", message.msg);
++ retval = conv->conv(1, messages, &responses, conv->appdata_ptr);
++ if (responses)
++ _pam_drop_reply(responses, 1);
++ return retval;
++}
++
++/*
++ * This function sends a message to the user and gets the response. The
caller
++ * is responsible for freeing the responses.
++ */
++static int query_response( struct pam_conv *conv, const char *text,
++ struct pam_response **responses, int debug) {
++ struct pam_message message;
++ const struct pam_message *messages[] = {&message};
++
++ memset(&message, 0, sizeof(message));
++ message.msg_style = PAM_PROMPT_ECHO_ON;
++ message.msg = text;
++
++ if (debug)
++ syslog(LOG_NOTICE, MODULE ": %s", message.msg);
++
++ return conv->conv(1, messages, responses, conv->appdata_ptr);
++}
++
++static const security_context_t
++select_context( pam_handle_t *pamh, security_context_t* contextlist,int
debug)
++{
++ struct pam_conv *conv;
++
++ if (pam_get_item(pamh, PAM_CONV, (const void**) &conv) == PAM_SUCCESS &&
++ conv) {
++ if (conv->conv != NULL) {
++ struct pam_response *responses;
++ char *text=calloc(PATH_MAX,1);
++
++ if (text == NULL)
++ return (security_context_t) strdup(contextlist[0]);
++
++ snprintf(text, PATH_MAX,
++ _("Your default context is %s. \n"), contextlist[0]);
++ send_text(conv,text,debug);
++ free(text);
++ query_response(conv,_("Do you want to choose a different one? [n]"),
++ &responses,debug);
++ if (responses && (responses[0].resp[0] == 'y') ||
++ (responses[0].resp[0] == 'Y'))
++ {
++ int choice=0;
++ int i;
++ char *prompt=_("Enter number of choice: ");
++ int len=strlen(prompt);
++ char buf[PATH_MAX];
++
++ _pam_drop_reply(responses, 1);
++ for (i = 0; contextlist[i]; i++) {
++ len+=strlen(contextlist[i]) + 10;
++ }
++ text=calloc(len,1);
++ for (i = 0; contextlist[i]; i++) {
++ snprintf(buf, PATH_MAX,
++ "[%d] %s\n", i+1, contextlist[i]);
++ strncat(text,buf,len);
++ }
++ strcat(text,prompt);
++ while ((choice < 1) || (choice > i)) {
++ query_response(conv,text,&responses,debug);
++ choice = strtol (responses[0].resp, NULL, 10);
++ _pam_drop_reply(responses, 1);
++ }
++ free(text);
++ return (security_context_t) strdup(contextlist[choice-1]);
++ }
++ else if (responses)
++ _pam_drop_reply(responses, 1);
++ } else {
++ if (debug)
++ syslog(LOG_NOTICE, _("%s: bogus conversation function"),MODULE);
++ }
++ } else {
++ if (debug)
++ syslog(LOG_NOTICE, _("%s: no conversation function"),MODULE);
++ }
++ return (security_context_t) strdup(contextlist[0]);
++}
++
++static const security_context_t
++manual_context( pam_handle_t *pamh, char *user, int debug)
++{
++ struct pam_conv *conv;
++ security_context_t newcon;
++ context_t new_context;
++ int mls_enabled = is_selinux_mls_enabled();
++
++ if (pam_get_item(pamh, PAM_CONV, (const void**) &conv) == PAM_SUCCESS) {
++ if (conv && conv->conv != NULL) {
++ struct pam_response *responses;
++
++ while (1) {
++ query_response(conv,
++ _("Would you like to enter a security context? [y]
"),
++ &responses,debug);
++ if ((responses[0].resp[0] == 'y') || (responses[0].resp[0] == 'Y') ||
++ (responses[0].resp[0] == '\0') )
++ {
++ if (mls_enabled)
++ new_context = context_new ("user:role:type:level");
++ else
++ new_context = context_new ("user:role:type");
++ _pam_drop_reply(responses, 1);
++
++ /* Allow the user to enter each field of the context individually */
++ if (context_user_set (new_context, user))
++ {
++ context_free (new_context);
++ return NULL;
++ }
++ query_response(conv,_("role: "),&responses,debug);
++ if (context_role_set (new_context, responses[0].resp))
++ {
++ _pam_drop_reply(responses, 1);
++ context_free (new_context);
++ return NULL;
++ }
++ _pam_drop_reply(responses, 1);
++ query_response(conv,_("type: "),&responses,debug);
++ if (context_type_set (new_context, responses[0].resp))
++ {
++ _pam_drop_reply(responses, 1);
++ context_free (new_context);
++ return NULL;
++ }
++ _pam_drop_reply(responses, 1);
++ if (mls_enabled)
++ {
++ query_response(conv,_("level: "),&responses,debug);
++ if (context_range_set (new_context, responses[0].resp))
++ {
++ context_free (new_context);
++ return NULL;
++ }
++ }
++ /* Get the string value of the context and see if it is valid. */
++ if (!security_check_context(context_str(new_context))) {
++ newcon = strdup(context_str(new_context));
++ context_free (new_context);
++ return newcon;
++ }
++ else
++ send_text(conv,_("Not a valid security context"),debug);
++ }
++ else {
++ _pam_drop_reply(responses, 1);
++ return NULL;
++ }
++ } /* end while */
++ } else {
++ if (debug)
++ syslog(LOG_NOTICE, _("%s: bogus conversation function"),MODULE);
++ }
++ } else {
++ if (debug)
++ syslog(LOG_NOTICE, _("%s: no conversation function"),MODULE);
++ }
++ return NULL;
++}
++
++static void security_restorelabel_tty(const char *tty,
++ security_context_t context) {
++ char ttybuf[PATH_MAX];
++ const char *ptr;
++
++ if (context==NULL)
++ return;
++
++ if(strncmp("/dev/", tty, 5)) {
++ snprintf(ttybuf,sizeof(ttybuf),"/dev/%s",tty);
++ ptr = ttybuf;
++ }
++ else
++ ptr = tty;
++
++ if (setfilecon(ptr, context))
++ {
++ syslog(LOG_NOTICE,
++ _("Warning! Could not relabel %s with %s, not
relabeling.\n"),
++ ttybuf,context);
++ }
++}
++
++static security_context_t security_label_tty(char *tty,
++ security_context_t usercon) {
++ char ttybuf[PATH_MAX];
++ int status=0;
++ security_context_t newdev_context=NULL; /* The new context of a device */
++ security_context_t prev_context=NULL; /* The new context of a device */
++ const char *ptr;
++
++ if(strncmp("/dev/", tty, 5))
++ {
++ snprintf(ttybuf,sizeof(ttybuf),"/dev/%s",tty);
++ ptr = ttybuf;
++ }
++ else
++ ptr = tty;
++
++ if (getfilecon(ptr, &prev_context) < 0)
++ {
++ syslog(LOG_NOTICE,
++ _("Warning! Could not get current context for %s, not
relabeling."), ptr);
++ return NULL;
++ }
++ if( security_compute_relabel(usercon,prev_context,SECCLASS_CHR_FILE,
++ &newdev_context)!=0)
++ {
++ syslog(LOG_NOTICE,
++ _("Warning! Could not get new context for %s, not
relabeling."),
++ ptr);
++ syslog(LOG_NOTICE, "usercon=%s, prev_context=%s\n", usercon,
prev_context);
++ freecon(prev_context);
++ return NULL;
++ }
++ status=setfilecon(ptr,newdev_context);
++ if (status)
++ {
++ syslog(LOG_NOTICE,
++ _("Warning! Could not relabel %s with %s, not
relabeling.%s"),
++ ptr,newdev_context,strerror(errno));
++ freecon(prev_context);
++ prev_context=NULL;
++ }
++ freecon(newdev_context);
++ return prev_context;
++}
++
++static security_context_t user_context=NULL;
++static security_context_t prev_user_context=NULL;
++static security_context_t ttyn_context=NULL; /* The current context of
ttyn device */
++static int selinux_enabled=0;
++static char *ttyn=NULL;
++
++/* Tell the user that access has been granted. */
++static void
++verbose_message(pam_handle_t *pamh, char *msg, int debug)
++{
++ struct pam_conv *conv;
++ struct pam_message message;
++ const struct pam_message *messages[] = {&message};
++ struct pam_response *responses;
++ if (pam_get_item(pamh, PAM_CONV, (const void**) &conv) == PAM_SUCCESS) {
++ if (conv && conv->conv != NULL) {
++ char text[PATH_MAX];
++
++ memset(&message, 0, sizeof(message));
++ message.msg_style = PAM_TEXT_INFO;
++ snprintf(text, sizeof(text), msg);
++
++ message.msg = text;
++ if (debug)
++ syslog(LOG_NOTICE, MODULE ": %s", message.msg);
++ conv->conv(1, messages, &responses, conv->appdata_ptr);
++ if (responses)
++ _pam_drop_reply(responses, 1);
++ } else {
++ if (debug)
++ syslog(LOG_NOTICE, _("%s: bogus conversation function"),MODULE);
++ }
++ } else {
++ if (debug)
++ syslog(LOG_NOTICE,_("%s: no conversation function"),MODULE);
++ }
++}
++
++PAM_EXTERN int
++pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, const char
**argv)
++{
++ /* Fail by default. */
++ return PAM_AUTH_ERR;
++}
++
++PAM_EXTERN int
++pam_sm_setcred(pam_handle_t *pamh, int flags, int argc, const char **argv)
++{
++ return PAM_SUCCESS;
++}
++
++PAM_EXTERN int
++pam_sm_open_session(pam_handle_t *pamh, int flags, int argc, const char
**argv)
++{
++ int i, debug = 0, ttys=1, has_tty=isatty(0), verbose=0, multiple=0,
close_session=0;
++ int ret=0;
++ security_context_t* contextlist=NULL;
++ int num_contexts = 0;
++ char *username=NULL;
++ const char *tty=NULL;
++
++ /* Parse arguments. */
++ for (i = 0; i < argc; i++) {
++ if (strcmp(argv[i], "debug") == 0) {
++ debug = 1;
++ }
++ if (strcmp(argv[i], "nottys") == 0) {
++ ttys = 0;
++ }
++ if (strcmp(argv[i], "verbose") == 0) {
++ verbose = 1;
++ }
++ if (strcmp(argv[i], "multiple") == 0) {
++ multiple = 1;
++ }
++ if (strcmp(argv[i], "close") == 0) {
++ close_session = 1;
++ }
++ }
++
++ if (debug)
++ syslog(LOG_NOTICE, MODULE ": %s", "Open Session");
++
++ /* this module is only supposed to execute close_session */
++ if (close_session)
++ return PAM_SUCCESS;
++
++ if (!(selinux_enabled = is_selinux_enabled()>0) )
++ return PAM_SUCCESS;
++
++ if (pam_get_item(pamh, PAM_USER, (const void**)&username) != PAM_SUCCESS
||
++ username == NULL) {
++ return PAM_AUTH_ERR;
++ }
++ num_contexts = get_ordered_context_list(username, 0, &contextlist);
++ if (num_contexts > 0) {
++ if (multiple && (num_contexts > 1) && has_tty) {
++ user_context = select_context(pamh,contextlist, debug);
++ freeconary(contextlist);
++ } else {
++ user_context = (security_context_t) strdup(contextlist[0]);
++ freeconary(contextlist);
++ }
++ } else {
++ if (has_tty) {
++ user_context = manual_context(pamh,username,debug);
++ if (user_context == NULL) {
++ syslog (LOG_ERR, _("Unable to get valid context for %s"), username);
++ return PAM_AUTH_ERR;
++ }
++ } else {
++ syslog (LOG_ERR, _("Unable to get valid context for %s, No valid
tty"), username);
++ return PAM_AUTH_ERR;
++ }
++ }
++ if (getexeccon(&prev_user_context)<0) {
++ prev_user_context=NULL;
++ }
++ if (ttys) {
++ /* Get the name of the terminal. */
++ if (pam_get_item(pamh, PAM_TTY, (const void**)&tty) != PAM_SUCCESS) {
++ tty = NULL;
++ }
++
++ if ((tty == NULL) || (strlen(tty) == 0) ||
++ strcmp(tty, "ssh") == 0 || strncmp(tty, "NODEV", 5) == 0) {
++ tty = ttyname(STDIN_FILENO);
++ if ((tty == NULL) || (strlen(tty) == 0)) {
++ tty = ttyname(STDOUT_FILENO);
++ }
++ if ((tty == NULL) || (strlen(tty) == 0)) {
++ tty = ttyname(STDERR_FILENO);
++ }
++ }
++ }
++ if(ttys && tty ) {
++ ttyn=strdup(tty);
++ ttyn_context=security_label_tty(ttyn,user_context);
++ }
++ ret = setexeccon(user_context);
++ if (ret==0 && verbose) {
++ char msg[PATH_MAX];
++ snprintf(msg, sizeof(msg),
++ _("Security Context %s Assigned"), user_context);
++ verbose_message(pamh, msg, debug);
++ }
++ if (ret) {
++ syslog(LOG_ERR, _("Error! Unable to set %s executable context %s."),
++ username, user_context);
++ freecon(user_context);
++ return PAM_AUTH_ERR;
++ } else {
++ if (debug)
++ syslog(LOG_NOTICE, _("%s: set %s security context to %s"),MODULE,
++ username, user_context);
++ }
++ freecon(user_context);
++
++ return PAM_SUCCESS;
++}
++
++PAM_EXTERN int
++pam_sm_close_session(pam_handle_t *pamh, int flags, int argc, const char
**argv)
++{
++ int i, debug = 0,status=0, open_session=0;
++ if (! (selinux_enabled ))
++ return PAM_SUCCESS;
++
++ /* Parse arguments. */
++ for (i = 0; i < argc; i++) {
++ if (strcmp(argv[i], "debug") == 0) {
++ debug = 1;
++ }
++ if (strcmp(argv[i], "open") == 0) {
++ open_session = 1;
++ }
++ }
++
++ if (debug)
++ syslog(LOG_NOTICE, MODULE ": %s", "Close Session");
++
++ if (open_session)
++ return PAM_SUCCESS;
++
++ if (ttyn) {
++ if (debug)
++ syslog(LOG_NOTICE, MODULE ":Restore tty %s -> %s",
ttyn,ttyn_context);
++
++ security_restorelabel_tty(ttyn,ttyn_context);
++ freecon(ttyn_context);
++ free(ttyn);
++ ttyn=NULL;
++ }
++ status=setexeccon(prev_user_context);
++ freecon(prev_user_context);
++ if (status) {
++ syslog(LOG_ERR, _("Error! Unable to set executable context %s."),
++ prev_user_context);
++ return PAM_AUTH_ERR;
++ }
++
++ if (debug)
++ syslog(LOG_NOTICE, _("%s: setcontext back to orginal"),MODULE);
++
++ return PAM_SUCCESS;
++}
++
++#else /* PAM_SELINUX_MAIN */
++
++/************************************************************************
++ *
++ * All PAM code goes in this section.
++ *
++ ************************************************************************/
++
++#include <unistd.h> /* for getuid(), exit(), getopt() */
++#include <signal.h>
++#include <sys/wait.h> /* for wait() */
++
++#include <security/pam_appl.h> /* for PAM functions */
++#include <security/pam_misc.h> /* for misc_conv PAM utility function */
++
++#define SERVICE_NAME "pam_selinux_check" /* the name of this program for
PAM */
++ /* The file containing the context to run
++ * the scripts under. */
++int authenticate_via_pam( const char *user , pam_handle_t **pamh);
++
++/* authenticate_via_pam()
++ *
++ * in: user
++ * out: nothing
++ * return: value condition
++ * ----- ---------
++ * 1 pam thinks that the user authenticated themselves
properly
++ * 0 otherwise
++ *
++ * this function uses pam to authenticate the user running this
++ * program. this is the only function in this program that makes pam
++ * calls.
++ *
++ */
++
++int authenticate_via_pam( const char *user , pam_handle_t **pamh) {
++
++ struct pam_conv *conv;
++ int result = 0; /* our result, set to 0 (not authenticated) by default
*/
++
++ /* this is a jump table of functions for pam to use when it wants to *
++ * communicate with the user. we'll be using misc_conv(), which is *
++ * provided for us via pam_misc.h. */
++ struct pam_conv pam_conversation = {
++ misc_conv,
++ NULL
++ };
++ conv = &pam_conversation;
++
++
++ /* make `p_pam_handle' a valid pam handle so we can use it when *
++ * calling pam functions. */
++ if( PAM_SUCCESS != pam_start( SERVICE_NAME,
++ user,
++ conv,
++ pamh ) ) {
++ fprintf( stderr, _("failed to initialize PAM\n") );
++ exit( -1 );
++ }
++
++ if( PAM_SUCCESS != pam_set_item(*pamh, PAM_RUSER, user))
++ {
++ fprintf( stderr, _("failed to pam_set_item()\n") );
++ exit( -1 );
++ }
++
++ /* Ask PAM to authenticate the user running this program */
++ if( PAM_SUCCESS == pam_authenticate(*pamh,0) ) {
++ if ( PAM_SUCCESS == pam_open_session(*pamh, 0) )
++ result = 1; /* user authenticated OK! */
++ }
++ return( result );
++
++} /* authenticate_via_pam() */
++
++int main(int argc, char **argv) {
++ pam_handle_t *pamh;
++ int childPid;
++
++ if (!authenticate_via_pam(argv[1],&pamh))
++ exit(-1);
++
++ childPid = fork();
++ if (childPid < 0) {
++ int errsv = errno;
++
++ /* error in fork() */
++ fprintf(stderr, _("login: failure forking: %s"), strerror(errsv));
++ pam_close_session(pamh, 0);
++ /* We're done with PAM. Free `pam_handle'. */
++ pam_end( pamh, PAM_SUCCESS );
++ exit(0);
++ }
++ if (childPid) {
++ close(0); close(1); close(2);
++ struct sigaction sa;
++ memset(&sa,0,sizeof(sa));
++ sa.sa_handler = SIG_IGN;
++ sigaction(SIGQUIT, &sa, NULL);
++ sigaction(SIGINT, &sa, NULL);
++ while(wait(NULL) == -1 && errno == EINTR) /**/ ;
++ openlog("login", LOG_ODELAY, LOG_AUTHPRIV);
++ pam_close_session(pamh, 0);
++ /* We're done with PAM. Free `pam_handle'. */
++ pam_end( pamh, PAM_SUCCESS );
++ exit(0);
++ }
++ argv[0]="/bin/sh";
++ argv[1]=NULL;
++
++ /* NOTE: The environment has not been sanitized. LD_PRELOAD and other fun
++ * things could be set. */
++ execv("/bin/sh",argv);
++ fprintf(stderr,"Failure\n");
++ return 0;
++}
++#endif
+diff -uNr Linux-PAM-0.79.old/modules/pam_selinux/pam_selinux_check.8
Linux-PAM-0.79/modules/pam_selinux/pam_selinux_check.8
+--- Linux-PAM-0.79.old/modules/pam_selinux/pam_selinux_check.8 1969-12-31
16:00:00.000000000 -0800
++++ Linux-PAM-0.79/modules/pam_selinux/pam_selinux_check.8 2005-05-24
18:03:58.000000000 -0700
+@@ -0,0 +1,35 @@
++.TH pam_selinux_check 8 2002/05/23 "Red Hat Linux" "System Administrator's
Manual"
++.SH NAME
++pam_selinux_check \- login program to test pam_selinux_check
++.SH SYNOPSIS
++.B pam_selinux_check [user]
++.br
++
++.SH DESCRIPTION
++With no arguments,
++.B pam_selinux_check
++will prompt for user
++
++.SH OPTIONS
++.IP target_user
++The user to login as.
++
++.SH DIAGNOSTICS
++You must setup a /etc/pam.d/pam_selinux_check file, in order for the check
to work.
++
++When checking if a selinux is valid,
++.B pam_selinux_check
++returns an exit code of 0 for success and > 0 on error:
++
++.nf
++1: Authentication failure
++.fi
++
++.SH SEE ALSO
++pam_selinux(8)
++
++.SH BUGS
++Let's hope not, but if you find any, please email the author.
++
++.SH AUTHOR
++Dan Walsh <dwalsh AT redhat.com>
+diff -uNr Linux-PAM-0.79.old/modules/pam_selinux/pam_selinux_check.c
Linux-PAM-0.79/modules/pam_selinux/pam_selinux_check.c
+--- Linux-PAM-0.79.old/modules/pam_selinux/pam_selinux_check.c 1969-12-31
16:00:00.000000000 -0800
++++ Linux-PAM-0.79/modules/pam_selinux/pam_selinux_check.c 2005-05-24
18:03:58.000000000 -0700
+@@ -0,0 +1,43 @@
++/******************************************************************************
++ * A module for Linux-PAM that will set the default security context after
login
++ * via PAM.
++ *
++ * Copyright (c) 2003 Red Hat, Inc.
++ * Written by Dan Walsh <dwalsh AT redhat.com>
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ * notice, and the entire permission notice in its entirety,
++ * including the disclaimer of warranties.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ * notice, this list of conditions and the following disclaimer in the
++ * documentation and/or other materials provided with the distribution.
++ * 3. The name of the author may not be used to endorse or promote
++ * products derived from this software without specific prior
++ * written permission.
++ *
++ * ALTERNATIVELY, this product may be distributed under the terms of
++ * the GNU Public License, in which case the provisions of the GPL are
++ * required INSTEAD OF the above restrictions. (This clause is
++ * necessary due to a potential bad interaction between the GPL and
++ * the restrictions contained in a BSD-style copyright.)
++ *
++ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
++ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
++ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
++ * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++#define PAM_SELINUX_MAIN 1
++#include "pam_selinux.c"
++
+Binary files Linux-PAM-0.79.old/modules/pam_unix/.unix_chkpwd.c.rej.swp and
Linux-PAM-0.79/modules/pam_unix/.unix_chkpwd.c.rej.swp differ
+diff -uNr Linux-PAM-0.79.old/modules/pam_unix/Makefile
Linux-PAM-0.79/modules/pam_unix/Makefile
+--- Linux-PAM-0.79.old/modules/pam_unix/Makefile 2004-11-08
00:58:37.000000000 -0800
++++ Linux-PAM-0.79/modules/pam_unix/Makefile 2005-05-24 18:14:23.000000000
-0700
@@ -60,9 +60,9 @@
########################################################################
CFLAGS += $(USE_CRACKLIB) $(USE_LCKPWDF) $(NEED_LCKPWDF) $(EXTRAS) \
- $(INCLUDE_PAMMODUTILS)
-+ $(INCLUDE_PAMMODUTILS) -DWITH_SELINUX
++ $(INCLUDE_PAMMODUTILS) -DNIS -DWITH_SELINUX
-LDLIBS = $(EXTRALS) $(LINK_PAMMODUTILS)
+LDLIBS = $(EXTRALS) $(LINK_PAMMODUTILS) -lselinux
ifdef USE_CRACKLIB
CRACKLIB = -lcrack
-diff -Naur Linux-PAM-0.78/modules/pam_unix/lckpwdf.-c
patched-Linux-PAM-0.78/modules/pam_unix/lckpwdf.-c
---- Linux-PAM-0.78/modules/pam_unix/lckpwdf.-c 2000-06-21 00:12:02.000000000
+0200
-+++ patched-Linux-PAM-0.78/modules/pam_unix/lckpwdf.-c 2005-03-10
17:31:48.000000000 +0100
+diff -uNr Linux-PAM-0.79.old/modules/pam_unix/lckpwdf.-c
Linux-PAM-0.79/modules/pam_unix/lckpwdf.-c
+--- Linux-PAM-0.79.old/modules/pam_unix/lckpwdf.-c 2000-06-20
15:12:02.000000000 -0700
++++ Linux-PAM-0.79/modules/pam_unix/lckpwdf.-c 2005-05-24 18:03:58.000000000
-0700
@@ -26,6 +26,9 @@
#include <fcntl.h>
@@ -130,9 +976,9 @@ diff -Naur Linux-PAM-0.78/modules/pam_un
lockfd = open(LOCKFILE, O_CREAT | O_WRONLY, 0600);
if (lockfd == -1)
return -1;
-diff -Naur Linux-PAM-0.78/modules/pam_unix/pam_unix_acct.c
patched-Linux-PAM-0.78/modules/pam_unix/pam_unix_acct.c
---- Linux-PAM-0.78/modules/pam_unix/pam_unix_acct.c 2004-11-18
14:41:19.000000000 +0100
-+++ patched-Linux-PAM-0.78/modules/pam_unix/pam_unix_acct.c 2005-03-10
17:31:48.000000000 +0100
+diff -uNr Linux-PAM-0.79.old/modules/pam_unix/pam_unix_acct.c
Linux-PAM-0.79/modules/pam_unix/pam_unix_acct.c
+--- Linux-PAM-0.79.old/modules/pam_unix/pam_unix_acct.c 2005-01-10
02:10:00.000000000 -0800
++++ Linux-PAM-0.79/modules/pam_unix/pam_unix_acct.c 2005-05-24
18:03:58.000000000 -0700
@@ -45,6 +45,15 @@
#include <pwd.h>
#include <shadow.h>
@@ -230,16 +1076,16 @@ diff -Naur Linux-PAM-0.78/modules/pam_un
+ rc = _pammodutil_read(fds[0], buf, sizeof(buf) - 1);
+ if(rc > 0) {
+ buf[rc] = '\0';
-+ if (sscanf(buf,"%ld:%ld:%ld:%ld:%ld:%ld",
++ sscanf(buf,"%ld:%ld:%ld:%ld:%ld:%ld",
+ &spwd.sp_lstchg, /* last password change */
+ &spwd.sp_min, /* days until change allowed. */
+ &spwd.sp_max, /* days before change required */
+ &spwd.sp_warn, /* days warning for expiration */
+ &spwd.sp_inact, /* days before account inactive */
-+ &spwd.sp_expire) /* date when account expires */ != 6 )
retval = PAM_AUTH_ERR;
++ &spwd.sp_expire); /* date when account expires */
+ }
+ else {
-+ _log_err(LOG_ERR, pamh, " ERROR %d:%s \n",rc, strerror(errno));
retval = PAM_AUTH_ERR;
++ _log_err(LOG_ERR, pamh, " ERROR %d:%s \n",rc, strerror(errno));
+ }
+ }
+ }
@@ -272,9 +1118,9 @@ diff -Naur Linux-PAM-0.78/modules/pam_un
if (!spent)
if (on(UNIX_BROKEN_SHADOW,ctrl))
return PAM_SUCCESS;
-diff -Naur Linux-PAM-0.78/modules/pam_unix/pam_unix_passwd.c
patched-Linux-PAM-0.78/modules/pam_unix/pam_unix_passwd.c
---- Linux-PAM-0.78/modules/pam_unix/pam_unix_passwd.c 2004-11-18
14:41:19.000000000 +0100
-+++ patched-Linux-PAM-0.78/modules/pam_unix/pam_unix_passwd.c 2005-03-10
17:31:48.000000000 +0100
+diff -uNr Linux-PAM-0.79.old/modules/pam_unix/pam_unix_passwd.c
Linux-PAM-0.79/modules/pam_unix/pam_unix_passwd.c
+--- Linux-PAM-0.79.old/modules/pam_unix/pam_unix_passwd.c 2004-11-24
23:36:50.000000000 -0800
++++ Linux-PAM-0.79/modules/pam_unix/pam_unix_passwd.c 2005-05-24
18:03:58.000000000 -0700
@@ -57,6 +57,19 @@
#include <rpcsvc/yp_prot.h>
#include <rpcsvc/ypclnt.h>
@@ -287,7 +1133,7 @@ diff -Naur Linux-PAM-0.78/modules/pam_un
+static int selinux_enabled=-1;
+#include <selinux/selinux.h>
+static security_context_t prev_context=NULL;
-+#define SELINUX_ENABLED (selinux_enabled!=-1 ? selinux_enabled :
(selinux_enabled=is_selinux_enabled()>0))
++#define SELINUX_ENABLED (selinux_enabled!=-1 ? selinux_enabled :
selinux_enabled=is_selinux_enabled()>0)
+#else
+#define SELINUX_ENABLED 0
+#endif
@@ -359,14 +1205,14 @@ diff -Naur Linux-PAM-0.78/modules/pam_un
+ /* if the stored password is NULL */
+ int rc=0;
+ if (fromwhat)
-+ _pammodutil_write(fds[1], fromwhat, strlen(fromwhat)+1);
++ write(fds[1], fromwhat, strlen(fromwhat)+1);
+ else
-+ _pammodutil_write(fds[1], "", 1);
++ write(fds[1], "", 1);
+ if (towhat) {
-+ _pammodutil_write(fds[1], towhat, strlen(towhat)+1);
++ write(fds[1], towhat, strlen(towhat)+1);
+ }
+ else
-+ _pammodutil_write(fds[1], "", 1);
++ write(fds[1], "", 1);
+
+ close(fds[0]); /* close here to avoid possible SIGPIPE above */
+ close(fds[1]);
@@ -765,7 +1611,7 @@ diff -Naur Linux-PAM-0.78/modules/pam_un
if (spwdent == NULL)
return PAM_AUTHINFO_UNAVAIL;
} else {
-@@ -888,7 +1102,7 @@
+@@ -894,7 +1108,7 @@
_log_err(LOG_CRIT, pamh,
"failed to set PAM_OLDAUTHTOK");
}
@@ -774,7 +1620,7 @@ diff -Naur Linux-PAM-0.78/modules/pam_un
if (retval == PAM_AUTHTOK_ERR) {
if (off(UNIX__IAMROOT, ctrl))
_make_remark(pamh, ctrl, PAM_ERROR_MSG,
-@@ -1013,7 +1227,7 @@
+@@ -1019,7 +1233,7 @@
}
}
@@ -783,9 +1629,9 @@ diff -Naur Linux-PAM-0.78/modules/pam_un
if (retval != PAM_SUCCESS) {
_log_err(LOG_NOTICE, pamh, "user not authenticated
2");
#ifdef USE_LCKPWDF
-diff -Naur Linux-PAM-0.78/modules/pam_unix/support.c
patched-Linux-PAM-0.78/modules/pam_unix/support.c
---- Linux-PAM-0.78/modules/pam_unix/support.c 2004-10-06 16:05:17.000000000
+0200
-+++ patched-Linux-PAM-0.78/modules/pam_unix/support.c 2005-03-10
17:31:48.000000000 +0100
+diff -uNr Linux-PAM-0.79.old/modules/pam_unix/support.c
Linux-PAM-0.79/modules/pam_unix/support.c
+--- Linux-PAM-0.79.old/modules/pam_unix/support.c 2005-01-10
02:10:00.000000000 -0800
++++ Linux-PAM-0.79/modules/pam_unix/support.c 2005-05-24 18:03:58.000000000
-0700
@@ -15,6 +15,7 @@
#include <pwd.h>
#include <shadow.h>
@@ -893,18 +1739,18 @@ diff -Naur Linux-PAM-0.78/modules/pam_un
/* we are not root perhaps this is the reason? Run
helper */
D(("running helper binary"));
retval = _unix_run_helper_binary(pamh, p, ctrl, name);
-diff -Naur Linux-PAM-0.78/modules/pam_unix/support.h
patched-Linux-PAM-0.78/modules/pam_unix/support.h
---- Linux-PAM-0.78/modules/pam_unix/support.h 2004-10-06 16:05:17.000000000
+0200
-+++ patched-Linux-PAM-0.78/modules/pam_unix/support.h 2005-03-10
17:31:48.000000000 +0100
+diff -uNr Linux-PAM-0.79.old/modules/pam_unix/support.h
Linux-PAM-0.79/modules/pam_unix/support.h
+--- Linux-PAM-0.79.old/modules/pam_unix/support.h 2004-10-06
07:05:17.000000000 -0700
++++ Linux-PAM-0.79/modules/pam_unix/support.h 2005-05-24 18:03:58.000000000
-0700
@@ -152,4 +152,5 @@
,const char **pass);
extern int _unix_shadowed(const struct passwd *pwd);
+extern struct spwd *_unix_run_verify_binary(pam_handle_t *pamh, unsigned
int ctrl, const char *user);
#endif /* _PAM_UNIX_SUPPORT_H */
-diff -Naur Linux-PAM-0.78/modules/pam_unix/unix_chkpwd.c
patched-Linux-PAM-0.78/modules/pam_unix/unix_chkpwd.c
---- Linux-PAM-0.78/modules/pam_unix/unix_chkpwd.c 2004-11-18
14:41:20.000000000 +0100
-+++ patched-Linux-PAM-0.78/modules/pam_unix/unix_chkpwd.c 2005-03-10
17:48:22.000000000 +0100
+diff -uNr Linux-PAM-0.79.old/modules/pam_unix/unix_chkpwd.c
Linux-PAM-0.79/modules/pam_unix/unix_chkpwd.c
+--- Linux-PAM-0.79.old/modules/pam_unix/unix_chkpwd.c 2004-11-18
05:41:20.000000000 -0800
++++ Linux-PAM-0.79/modules/pam_unix/unix_chkpwd.c 2005-05-24
18:20:49.000000000 -0700
@@ -28,12 +28,23 @@
#include <syslog.h>
#include <unistd.h>
@@ -917,7 +1763,7 @@ diff -Naur Linux-PAM-0.78/modules/pam_un
+static int selinux_enabled=-1;
+#ifdef WITH_SELINUX
+#include <selinux/selinux.h>
-+#define SELINUX_ENABLED (selinux_enabled!=-1 ? selinux_enabled :
(selinux_enabled=is_selinux_enabled()>0))
++#define SELINUX_ENABLED (selinux_enabled!=-1 ? selinux_enabled :
selinux_enabled=is_selinux_enabled()>0)
+static security_context_t prev_context=NULL;
+#else
+#define SELINUX_ENABLED 0
@@ -981,35 +1827,30 @@ diff -Naur Linux-PAM-0.78/modules/pam_un
int salt_len;
/* UNIX passwords area */
-@@ -156,28 +191,30 @@
+@@ -156,28 +191,28 @@
if (pwd == NULL || salt == NULL) {
_log_err(LOG_ALERT, "check pass; user unknown");
p = NULL;
- return retval;
-- }
-+ return PAM_USER_UNKNOWN;
-+ }
++ return PAM_USER_UNKNOWN;
+ }
salt_len = strlen(salt);
-- if (salt_len == 0)
+ if (salt_len == 0)
- return (nullok == 0) ? UNIX_FAILED : UNIX_PASSED;
-- else if (p == NULL || strlen(p) == 0)
++ return (nullok == 0) ? PAM_AUTH_ERR : PAM_SUCCESS;
+ else if (p == NULL || strlen(p) == 0)
- return UNIX_FAILED;
-+ if (salt_len == 0) {
-+ return (nullok == 0) ? PAM_AUTH_ERR : PAM_SUCCESS;
-+ }
-+ if (p == NULL || strlen(p) == 0) {
-+ return PAM_AUTHTOK_ERR;
-+ }
++ return PAM_AUTHTOK_ERR;
/* the moment of truth -- do we agree with the password? */
- retval = UNIX_FAILED;
-+ retval = PAM_AUTH_ERR;
++ retval = PAM_AUTH_ERR;
if (!strncmp(salt, "$1$", 3)) {
pp = Goodcrypt_md5(p, salt);
if (strcmp(pp, salt) == 0) {
- retval = UNIX_PASSED;
-+ retval = PAM_SUCCESS;
++ retval = PAM_SUCCESS;
} else {
pp = Brokencrypt_md5(p, salt);
if (strcmp(pp, salt) == 0)
@@ -1018,11 +1859,11 @@ diff -Naur Linux-PAM-0.78/modules/pam_un
}
} else if ((*salt == '*') || (salt_len < 13)) {
- retval = UNIX_FAILED;
-+ retval = PAM_AUTH_ERR;
++ retval = PAM_SUCCESS;
} else {
pp = bigcrypt(p, salt);
/*
-@@ -190,7 +227,7 @@
+@@ -190,7 +225,7 @@
* Bug 521314: the strncmp comparison is for legacy support.
*/
if (strncmp(pp, salt, salt_len) == 0) {
@@ -1031,7 +1872,7 @@ diff -Naur Linux-PAM-0.78/modules/pam_un
}
}
p = NULL; /* no longer needed here */
-@@ -224,13 +261,174 @@
+@@ -224,13 +259,174 @@
return username;
}
@@ -1208,7 +2049,7 @@ diff -Naur Linux-PAM-0.78/modules/pam_un
char *user;
/*
-@@ -247,8 +445,7 @@
+@@ -247,8 +443,7 @@
* account).
*/
@@ -1218,7 +2059,7 @@ diff -Naur Linux-PAM-0.78/modules/pam_un
_log_err(LOG_NOTICE
,"inappropriate use of Unix helper binary [UID=%d]"
,getuid());
-@@ -256,35 +453,45 @@
+@@ -256,35 +451,45 @@
,"This binary is not designed for running in this way\n"
"-- the system administrator has been informed\n");
sleep(10); /* this should discourage/annoy the user */
@@ -1286,7 +2127,7 @@ diff -Naur Linux-PAM-0.78/modules/pam_un
/* read the password from stdin (a pipe from the pam_unix module) */
-@@ -317,10 +524,10 @@
+@@ -317,10 +522,10 @@
/* return pass or fail */
- [SM-Commit] GIT changes to master grimoire by Ladislav Hagara (154ada00db1c5d970f93c9daace40ce8a35b2f09), Ladislav Hagara, 06/29/2006
Archive powered by MHonArc 2.6.24.