Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to master grimoire by Arjan Bouter (9d237df6bbd9f9323a70924bb5ad854dc91fa493)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Arjan Bouter <scm AT mail.sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to master grimoire by Arjan Bouter (9d237df6bbd9f9323a70924bb5ad854dc91fa493)
  • Date: Fri, 30 Jun 2006 05:18:25 -0500

GIT changes to master grimoire by Arjan Bouter <abouter AT sourcemage.org>:

security-libs/linux-pam/BUILD | 3
security-libs/linux-pam/CONFIGURE | 3
security-libs/linux-pam/DEPENDS | 3
security-libs/linux-pam/DETAILS | 4
security-libs/linux-pam/FINAL | 4
security-libs/linux-pam/HISTORY | 13
security-libs/linux-pam/INSTALL | 17
security-libs/linux-pam/POST_INSTALL | 4
security-libs/linux-pam/PRE_BUILD | 6
security-libs/linux-pam/pam-selinux.patch | 2143
------------------------------
security-libs/linux-pam/pam.d/other | 12
security-libs/linux-pam/pam.d/rexec | 10
security-libs/linux-pam/pam.d/rlogin | 11
security-libs/linux-pam/pam.d/rsh | 10
security-libs/linux-pam/pam.d/vlock | 4
15 files changed, 36 insertions(+), 2211 deletions(-)

New commits:
commit 9d237df6bbd9f9323a70924bb5ad854dc91fa493
Author: Arjan Bouter <abouter AT sourcemage.org>
Commit: Arjan Bouter <abouter AT sourcemage.org>

Fixed up the mess this spell became

diff --git a/security-libs/linux-pam/BUILD b/security-libs/linux-pam/BUILD
index d4353ae..9115105 100755
--- a/security-libs/linux-pam/BUILD
+++ b/security-libs/linux-pam/BUILD
@@ -12,8 +12,5 @@ #autoconf
$OPTS &&
sedit "s/examples//" Makefile &&
sedit "s/read yes//" conf/install_conf &&
-if [ "$PAM_SELINUX" == "y" ] ; then
- invoke_gcc
-fi &&
make_single &&
make
diff --git a/security-libs/linux-pam/CONFIGURE
b/security-libs/linux-pam/CONFIGURE
index 4adcd23..361d7d9 100755
--- a/security-libs/linux-pam/CONFIGURE
+++ b/security-libs/linux-pam/CONFIGURE
@@ -1,2 +1,3 @@
-config_query PAM_SELINUX "Enable selinux support?" n &&
+config_query PAM_SECTTY "Install a default /etc/securetty?" n &&
+config_query PAM_SELINUX "Enable selinux support?" n &&
config_query PAM_DOCS "Build documentation?" n
diff --git a/security-libs/linux-pam/DEPENDS b/security-libs/linux-pam/DEPENDS
index 77b9610..4a031a3 100755
--- a/security-libs/linux-pam/DEPENDS
+++ b/security-libs/linux-pam/DEPENDS
@@ -4,8 +4,7 @@ depends gnupg &&
depends smgl-fhs &&

if [ "${PAM_SELINUX}" == "y" ]; then
- depends libselinux &&
- depends gcc34
+ depends libselinux
fi &&

if [ "${PAM_DOCS}" == "y" ]; then
diff --git a/security-libs/linux-pam/DETAILS b/security-libs/linux-pam/DETAILS
index a9b5f99..9eabe3c 100755
--- a/security-libs/linux-pam/DETAILS
+++ b/security-libs/linux-pam/DETAILS
@@ -12,12 +12,10 @@ SOURCE_DIRECTORY=$BUILD_DIRECTORY/Linux-
SOURCE_GPG=kernel.gpg:$SOURCE2
SOURCE2_IGNORE=signature

- # only with libselinux patch
- GCC_VERSION=3.4
WEB_SITE=http://www.us.kernel.org/pub/linux/libs/pam
ENTERED=20010922
LICENSE[0]=GPL
- PATCHLEVEL=1
+ PATCHLEVEL=2
KEYWORDS="security libs"
SHORT="Linux-PAM provides a flexibile authentication mechanism."
cat << EOF
diff --git a/security-libs/linux-pam/FINAL b/security-libs/linux-pam/FINAL
new file mode 100755
index 0000000..3c5860a
--- /dev/null
+++ b/security-libs/linux-pam/FINAL
@@ -0,0 +1,4 @@
+if ( grep -q vc /etc/securetty ); then
+ message "${MESSAGE_COLOR}/etc/securetty now uses the static/udev format
of /dev/tty#."
+ message "If you are still using devfs make sure /etc/securetty is of
/dev/vc/#${DEFAULT_COLOR}"
+fi
diff --git a/security-libs/linux-pam/HISTORY b/security-libs/linux-pam/HISTORY
index 519c56f..fda5d27 100644
--- a/security-libs/linux-pam/HISTORY
+++ b/security-libs/linux-pam/HISTORY
@@ -1,7 +1,18 @@
+2006-06-29 Arjan Bouter <abouter AT sourcemage.org>
+ * DETAILS,BUILD: removed unneeded gcc34 invokation
+ * POST_INSTALL: renamed to FINAL
+ * CONFIGURE,INSTALL: fixed securetty install and made it optional
+ * INSTALL: removed forced (ever adding!) installation of selinux rule
+ * PRE_BUILD: removed unneeded patches
+ * pam-selinux.patch: removed
+ * pam.d/vlock: removed, installed by vlock spell
+ * pam.d/r*: removed, installed by RSH providers
+ * pam.d/other: changed default, unconfigured, behaviour to log and
deny
+ as suggested in the docs
+
2006-06-29 Ladislav Hagara <hgr AT vabo.cz>
* DETAILS: 0.99.5.0, removed UPDATED and BUILD_API
converted to vendor gpg checking (kernel.gpg)
- * INSTALL: make install -> default_install

2006-06-10 Arwed v. Merkatz <v.merkatz AT gmx.net>
* DEPENDS: use correct switch to turn off libprelude, bug #11875
diff --git a/security-libs/linux-pam/INSTALL b/security-libs/linux-pam/INSTALL
index 054ddc0..545479f 100755
--- a/security-libs/linux-pam/INSTALL
+++ b/security-libs/linux-pam/INSTALL
@@ -1,16 +1,17 @@
-default_install &&
+make install &&

-if [ "$PAM_SELINUX" == "y" ] ; then
- echo "session required pam_selinux.so multiple" >>
/etc/pam.d/login
-fi &&
+# this is a BUG, the SA should decide if/when selinux is configured
+# properly. Activating it before that breaks login, which is BAD.
+#if [ "$PAM_SELINUX" == "y" ]; then
+# echo "session required pam_selinux.so multiple" >>
/etc/pam.d/login
+#fi &&

-if [ ! -f /etc/securetty ]
-then
+if [ "$PAM_SECTTY" == "y" ]; then
. /etc/sysconfig/devices &&
if [ "$DEVICES" == "devfs" ]
then
- cp $SCRIPT_DIRECTORY/securetty.devfs /etc/securetty
+ install_config_file $SCRIPT_DIRECTORY/securetty.devfs /etc/securetty
else
- cp $SCRIPT_DIRECTORY/securetty.udev /etc/securetty
+ install_config_file $SCRIPT_DIRECTORY/securetty.udev /etc/securetty
fi
fi
diff --git a/security-libs/linux-pam/POST_INSTALL
b/security-libs/linux-pam/POST_INSTALL
deleted file mode 100755
index 3c5860a..0000000
--- a/security-libs/linux-pam/POST_INSTALL
+++ /dev/null
@@ -1,4 +0,0 @@
-if ( grep -q vc /etc/securetty ); then
- message "${MESSAGE_COLOR}/etc/securetty now uses the static/udev format
of /dev/tty#."
- message "If you are still using devfs make sure /etc/securetty is of
/dev/vc/#${DEFAULT_COLOR}"
-fi
diff --git a/security-libs/linux-pam/PRE_BUILD
b/security-libs/linux-pam/PRE_BUILD
deleted file mode 100755
index 2510193..0000000
--- a/security-libs/linux-pam/PRE_BUILD
+++ /dev/null
@@ -1,6 +0,0 @@
-default_pre_build &&
-cd ${SOURCE_DIRECTORY} &&
-if [ "$PAM_SELINUX" == "y" ]; then
- patch -p1 < ${SCRIPT_DIRECTORY}/pam-selinux.patch &&
- autoconf
-fi
diff --git a/security-libs/linux-pam/pam-selinux.patch
b/security-libs/linux-pam/pam-selinux.patch
deleted file mode 100644
index 956dbcc..0000000
--- a/security-libs/linux-pam/pam-selinux.patch
+++ /dev/null
@@ -1,2143 +0,0 @@
-diff -uNr Linux-PAM-0.79.old/configure.in Linux-PAM-0.79/configure.in
---- Linux-PAM-0.79.old/configure.in 2005-03-30 06:32:52.000000000 -0800
-+++ Linux-PAM-0.79/configure.in 2005-05-24 18:03:58.000000000 -0700
-@@ -230,6 +230,13 @@
- if test $HAVE_LIBNSL = yes ; then
- pwdblibs="$pwdblibs -lnsl"
- fi
-+AC_CHECK_LIB(selinux, getfilecon, HAVE_LIBSELINUX=yes ;
AC_DEFINE(HAVE_LIBSELINUX),
-+ HAVE_LIBSELINUX=no)
-+AC_SUBST(HAVE_LIBSELINUX)
-+
-+if test $HAVE_LIBSELINUX = yes ; then
-+ pwdblibs="$pwdblibs -lselinux"
-+fi
- AC_CHECK_LIB(pwdb, pwdb_db_name, HAVE_LIBPWDB=yes ; AC_DEFINE(HAVE_LIBPWDB),
- HAVE_LIBPWDB=no,$pwdblibs)
- AC_SUBST(HAVE_LIBPWDB)
-diff -uNr Linux-PAM-0.79.old/modules/pam_pwdb/Makefile
Linux-PAM-0.79/modules/pam_pwdb/Makefile
---- Linux-PAM-0.79.old/modules/pam_pwdb/Makefile 2004-09-28
06:49:24.000000000 -0700
-+++ Linux-PAM-0.79/modules/pam_pwdb/Makefile 2005-05-24 18:03:58.000000000
-0700
-@@ -11,7 +11,7 @@
-
- ifeq ($(HAVE_LIBPWDB),yes)
-
--EXTRALS += -lpwdb
-+EXTRALS += -lpwdb -lselinux
- EXTRAS += -DCHKPWD_HELPER=\"$(SUPLEMENTED)/$(CHKPWD)\"
-
- ifeq ($(HAVE_LIBCRYPT),yes)
-@@ -56,7 +56,7 @@
-
- $(CHKPWD): pwdb_chkpwd.o md5_good.o md5_broken.o \
- md5_crypt_good.o md5_crypt_broken.o
-- $(CC) $(CFLAGS) -o $(CHKPWD) $^ $(LDFLAGS) -lpwdb $(EXTRALS)
-+ $(CC) $(CFLAGS) -o $(CHKPWD) $^ $(LDFLAGS) -lpwdb $(EXTRALS)
-lselinux
-
- pwdb_chkpwd.o: pwdb_chkpwd.c pam_unix_md.-c bigcrypt.-c
-
-diff -uNr Linux-PAM-0.79.old/modules/pam_rootok/Makefile
Linux-PAM-0.79/modules/pam_rootok/Makefile
---- Linux-PAM-0.79.old/modules/pam_rootok/Makefile 2000-11-19
15:54:05.000000000 -0800
-+++ Linux-PAM-0.79/modules/pam_rootok/Makefile 2005-05-24 18:03:58.000000000
-0700
-@@ -13,3 +13,6 @@
- TITLE=pam_rootok
-
- include ../Simple.Rules
-+
-+CFLAGS += -DWITH_SELINUX
-+LINK_PAMMODUTILS += -lselinux
-diff -uNr Linux-PAM-0.79.old/modules/pam_rootok/pam_rootok.c
Linux-PAM-0.79/modules/pam_rootok/pam_rootok.c
---- Linux-PAM-0.79.old/modules/pam_rootok/pam_rootok.c 2002-05-26
16:00:28.000000000 -0700
-+++ Linux-PAM-0.79/modules/pam_rootok/pam_rootok.c 2005-05-24
18:03:58.000000000 -0700
-@@ -39,6 +39,11 @@
- }
-
-
-+#ifdef WITH_SELINUX
-+#include <selinux/selinux.h>
-+#include <selinux/av_permissions.h>
-+#endif
-+
- /* argument parsing */
-
- #define PAM_DEBUG_ARG 01
-@@ -72,7 +77,10 @@
- int retval = PAM_AUTH_ERR;
-
- ctrl = _pam_parse(argc, argv);
-- if (getuid() == 0)
-+ if (getuid() == 0)
-+#ifdef WITH_SELINUX
-+ if (is_selinux_enabled()<1 || checkPasswdAccess(PASSWD__ROOTOK)==0)
-+#endif
- retval = PAM_SUCCESS;
-
- if (ctrl & PAM_DEBUG_ARG) {
-diff -uNr Linux-PAM-0.79.old/modules/pam_selinux/Makefile
Linux-PAM-0.79/modules/pam_selinux/Makefile
---- Linux-PAM-0.79.old/modules/pam_selinux/Makefile 1969-12-31
16:00:00.000000000 -0800
-+++ Linux-PAM-0.79/modules/pam_selinux/Makefile 2005-05-24
18:03:58.000000000 -0700
-@@ -0,0 +1,19 @@
-+#
-+# $Id: Makefile,v 1.5 2003/07/08 03:16:28 nalin Exp $
-+#
-+
-+include ../../Make.Rules
-+
-+TITLE=pam_selinux
-+APPLICATION=$(TITLE)_check
-+APPMODE=04511
-+MAN8=$(TITLE).8 $(TITLE)_check.8
-+MODULE_SIMPLE_EXTRALIBS=-lselinux
-+
-+#MODULE_SIMPLE_INSTALL=$(MAKE) $(APPLICATION); $(INSTALL) -m $(APPMODE)
$(APPLICATION) $(FAKEROOT)$(SUPLEMENTED)
-+
-+include ../Simple.Rules
-+
-+$(APPLICATION): $(APPLICATION).c
-+ $(CC) $(CFLAGS) $(INCLUDE_PAMMODUTILS) -o $@ $^ $(LINK_PAMMODUTILS)
-lpam -lpam_misc
-+
-diff -uNr Linux-PAM-0.79.old/modules/pam_selinux/README
Linux-PAM-0.79/modules/pam_selinux/README
---- Linux-PAM-0.79.old/modules/pam_selinux/README 1969-12-31
16:00:00.000000000 -0800
-+++ Linux-PAM-0.79/modules/pam_selinux/README 2005-05-24 18:03:58.000000000
-0700
-@@ -0,0 +1,17 @@
-+This is pam_selinux, a module for setting the default security context
after
-+login via PAM.
-+
-+Background: SELinux provides a mechanism for allowing people to login with
-+different security contexts.
-+
-+The module takes these arguments:
-+The module takes these arguments:
-+ close Only execute the close_session portion of the module.
-+ debug Log debug messages (with priority DEBUG) to syslog.

-+ nottys Do not set security context on controlling tty
-+ verbose Attempt to tell the user when security context is set.
-+ open Only execute the open_session portion of the module.
-+
-+Dan Walsh <dwalsh AT redhat.com>
-+
-+
-diff -uNr Linux-PAM-0.79.old/modules/pam_selinux/pam_selinux.8
Linux-PAM-0.79/modules/pam_selinux/pam_selinux.8
---- Linux-PAM-0.79.old/modules/pam_selinux/pam_selinux.8 1969-12-31
16:00:00.000000000 -0800
-+++ Linux-PAM-0.79/modules/pam_selinux/pam_selinux.8 2005-05-24
18:03:58.000000000 -0700
-@@ -0,0 +1,63 @@
-+.TH pam_selinux 8 2003/08/26 "Red Hat Linux" "System Administrator's Manual"
-+.SH NAME
-+pam_selinux \- set the default security context after login via PAM.
-+.SH SYNOPSIS
-+.B session optional /lib/security/pam_selinux.so
-+.br
-+
-+.SH DESCRIPTION
-+In a nutshell, pam_selinux sets up the default security context for the
next execed
-+shell.
-+
-+When an application opens a session using pam_selinux, the shell that gets
-+executed will be run in the default security context, or if the user chooses
-+and the pam file allows the selected security context. Also the controlling
-+tty will have it's security context modified to match the users.
-+
-+Adding pam_selinux into a pam file could cause other pam modules to change
-+their behavior if the exec another application. The close and open option
help
-+mitigate this problem. close option will only cause the close portion of
the
-+pam_selinux to execute, and open will only cause the open portion to run.
You
-+can add pam_selinux to the config file twice. Add the pam_selinux close as
the
-+'first' session entry and open as the 'last' session entry. This way when
pam
-+executes the open pass through the modules, pam_selinux open_session will
-+happen last. When pam executes the close pass through the modules
pam_selinux
-+close_session will happen first.
-+
-+.SH ARGUMENTS
-+.IP close
-+Only execute the close_session portion of the module.
-+.IP debug
-+turns on debugging via \fBsyslog(3)\fR.
-+.IP multiple
-+tells pam_selinux.so to allow the user to select the security context they
will
-+login with, if the user has more than one role.
-+.IP open
-+Only execute the open_session portion of the module.
-+.IP nottys
-+Do not try to setup the ttys security context.
-+.IP verbose
-+attempt to inform the user when security context is set.
-+
-+.SH EXAMPLE
-+\fB/etc/pam.d/some-login-program\fP:
-+.br
-+auth required /lib/security/pam_unix.so
-+.br
-+session required /lib/security/pam_permit.so
-+session optional /lib/security/pam_selinux.so
-+.br
-+
-+.SH CAVEATS
-+Setting the following line will cause the login to fail
-+auth sufficient /lib/security/pam_selinux.so verbose
-+
-+
-+.SH SEE ALSO
-+pam_selinux_check(8)
-+
-+.SH BUGS
-+Let's hope not, but if you find any, please email the author.
-+
-+.SH AUTHOR
-+Dan Walsh <dwalsh AT redhat.com>
-diff -uNr Linux-PAM-0.79.old/modules/pam_selinux/pam_selinux.c
Linux-PAM-0.79/modules/pam_selinux/pam_selinux.c
---- Linux-PAM-0.79.old/modules/pam_selinux/pam_selinux.c 1969-12-31
16:00:00.000000000 -0800
-+++ Linux-PAM-0.79/modules/pam_selinux/pam_selinux.c 2005-05-24
18:03:58.000000000 -0700
-@@ -0,0 +1,644 @@
-+/******************************************************************************
-+ * A module for Linux-PAM that will set the default security context after
login
-+ * via PAM.
-+ *
-+ * Copyright (c) 2003 Red Hat, Inc.
-+ * Written by Dan Walsh <dwalsh AT redhat.com>
-+ *
-+ * Redistribution and use in source and binary forms, with or without
-+ * modification, are permitted provided that the following conditions
-+ * are met:
-+ * 1. Redistributions of source code must retain the above copyright
-+ * notice, and the entire permission notice in its entirety,
-+ * including the disclaimer of warranties.
-+ * 2. Redistributions in binary form must reproduce the above copyright
-+ * notice, this list of conditions and the following disclaimer in the
-+ * documentation and/or other materials provided with the distribution.
-+ * 3. The name of the author may not be used to endorse or promote
-+ * products derived from this software without specific prior
-+ * written permission.
-+ *
-+ * ALTERNATIVELY, this product may be distributed under the terms of
-+ * the GNU Public License, in which case the provisions of the GPL are
-+ * required INSTEAD OF the above restrictions. (This clause is
-+ * necessary due to a potential bad interaction between the GPL and
-+ * the restrictions contained in a BSD-style copyright.)
-+ *
-+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
-+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-+ * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
-+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
-+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
-+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
-+ * OF THE POSSIBILITY OF SUCH DAMAGE.
-+ *
-+ */
-+
-+#define PAM_SM_AUTH
-+#define PAM_SM_SESSION
-+
-+#include "../../_pam_aconf.h"
-+
-+#include <errno.h>
-+#include <limits.h>
-+#include <pwd.h>
-+#include <stdio.h>
-+#include <stdlib.h>
-+#include <string.h>
-+#include <unistd.h>
-+#include <sys/types.h>
-+#include <sys/stat.h>
-+#include <fcntl.h>
-+#include <linux/limits.h>
-+
-+#include "../../_pam_aconf.h"
-+#include <security/pam_modules.h>
-+#include <security/_pam_macros.h>
-+#include <security/_pam_modutil.h>
-+
-+#include <libintl.h>
-+#define _(x) gettext(x)
-+
-+#ifndef PAM_SELINUX_MAIN
-+#define MODULE "pam_selinux"
-+
-+#include <selinux/selinux.h>
-+#include <selinux/get_context_list.h>
-+#include <selinux/flask.h>
-+#include <selinux/selinux.h>
-+#include <selinux/context.h>
-+
-+static int send_text( struct pam_conv *conv, const char *text, int debug) {
-+ struct pam_message message;
-+ const struct pam_message *messages[] = {&message};
-+ struct pam_response *responses;
-+ int retval;
-+
-+ memset(&message, 0, sizeof(message));
-+ message.msg_style = PAM_TEXT_INFO;
-+ message.msg = text;
-+ if (debug)
-+ syslog(LOG_NOTICE, MODULE ": %s", message.msg);
-+ retval = conv->conv(1, messages, &responses, conv->appdata_ptr);
-+ if (responses)
-+ _pam_drop_reply(responses, 1);
-+ return retval;
-+}
-+
-+/*
-+ * This function sends a message to the user and gets the response. The
caller
-+ * is responsible for freeing the responses.
-+ */
-+static int query_response( struct pam_conv *conv, const char *text,
-+ struct pam_response **responses, int debug) {
-+ struct pam_message message;
-+ const struct pam_message *messages[] = {&message};
-+
-+ memset(&message, 0, sizeof(message));
-+ message.msg_style = PAM_PROMPT_ECHO_ON;
-+ message.msg = text;
-+
-+ if (debug)
-+ syslog(LOG_NOTICE, MODULE ": %s", message.msg);
-+
-+ return conv->conv(1, messages, responses, conv->appdata_ptr);
-+}
-+
-+static const security_context_t
-+select_context( pam_handle_t *pamh, security_context_t* contextlist,int
debug)
-+{
-+ struct pam_conv *conv;
-+
-+ if (pam_get_item(pamh, PAM_CONV, (const void**) &conv) == PAM_SUCCESS &&
-+ conv) {
-+ if (conv->conv != NULL) {
-+ struct pam_response *responses;
-+ char *text=calloc(PATH_MAX,1);
-+
-+ if (text == NULL)
-+ return (security_context_t) strdup(contextlist[0]);
-+
-+ snprintf(text, PATH_MAX,
-+ _("Your default context is %s. \n"), contextlist[0]);
-+ send_text(conv,text,debug);
-+ free(text);
-+ query_response(conv,_("Do you want to choose a different one? [n]"),
-+ &responses,debug);
-+ if (responses && (responses[0].resp[0] == 'y') ||
-+ (responses[0].resp[0] == 'Y'))
-+ {
-+ int choice=0;
-+ int i;
-+ char *prompt=_("Enter number of choice: ");
-+ int len=strlen(prompt);
-+ char buf[PATH_MAX];
-+
-+ _pam_drop_reply(responses, 1);
-+ for (i = 0; contextlist[i]; i++) {
-+ len+=strlen(contextlist[i]) + 10;
-+ }
-+ text=calloc(len,1);
-+ for (i = 0; contextlist[i]; i++) {
-+ snprintf(buf, PATH_MAX,
-+ "[%d] %s\n", i+1, contextlist[i]);
-+ strncat(text,buf,len);
-+ }
-+ strcat(text,prompt);
-+ while ((choice < 1) || (choice > i)) {
-+ query_response(conv,text,&responses,debug);
-+ choice = strtol (responses[0].resp, NULL, 10);
-+ _pam_drop_reply(responses, 1);
-+ }
-+ free(text);
-+ return (security_context_t) strdup(contextlist[choice-1]);
-+ }
-+ else if (responses)
-+ _pam_drop_reply(responses, 1);
-+ } else {
-+ if (debug)
-+ syslog(LOG_NOTICE, _("%s: bogus conversation function"),MODULE);
-+ }
-+ } else {
-+ if (debug)
-+ syslog(LOG_NOTICE, _("%s: no conversation function"),MODULE);
-+ }
-+ return (security_context_t) strdup(contextlist[0]);
-+}
-+
-+static const security_context_t
-+manual_context( pam_handle_t *pamh, char *user, int debug)
-+{
-+ struct pam_conv *conv;
-+ security_context_t newcon;
-+ context_t new_context;
-+ int mls_enabled = is_selinux_mls_enabled();
-+
-+ if (pam_get_item(pamh, PAM_CONV, (const void**) &conv) == PAM_SUCCESS) {
-+ if (conv && conv->conv != NULL) {
-+ struct pam_response *responses;
-+
-+ while (1) {
-+ query_response(conv,
-+ _("Would you like to enter a security context? [y]
"),
-+ &responses,debug);
-+ if ((responses[0].resp[0] == 'y') || (responses[0].resp[0] == 'Y') ||
-+ (responses[0].resp[0] == '\0') )
-+ {
-+ if (mls_enabled)
-+ new_context = context_new ("user:role:type:level");
-+ else
-+ new_context = context_new ("user:role:type");
-+ _pam_drop_reply(responses, 1);
-+
-+ /* Allow the user to enter each field of the context individually */
-+ if (context_user_set (new_context, user))
-+ {
-+ context_free (new_context);
-+ return NULL;
-+ }
-+ query_response(conv,_("role: "),&responses,debug);
-+ if (context_role_set (new_context, responses[0].resp))
-+ {
-+ _pam_drop_reply(responses, 1);
-+ context_free (new_context);
-+ return NULL;
-+ }
-+ _pam_drop_reply(responses, 1);
-+ query_response(conv,_("type: "),&responses,debug);
-+ if (context_type_set (new_context, responses[0].resp))
-+ {
-+ _pam_drop_reply(responses, 1);
-+ context_free (new_context);
-+ return NULL;
-+ }
-+ _pam_drop_reply(responses, 1);
-+ if (mls_enabled)
-+ {
-+ query_response(conv,_("level: "),&responses,debug);
-+ if (context_range_set (new_context, responses[0].resp))
-+ {
-+ context_free (new_context);
-+ return NULL;
-+ }
-+ }
-+ /* Get the string value of the context and see if it is valid. */
-+ if (!security_check_context(context_str(new_context))) {
-+ newcon = strdup(context_str(new_context));
-+ context_free (new_context);
-+ return newcon;
-+ }
-+ else
-+ send_text(conv,_("Not a valid security context"),debug);
-+ }
-+ else {
-+ _pam_drop_reply(responses, 1);
-+ return NULL;
-+ }
-+ } /* end while */
-+ } else {
-+ if (debug)
-+ syslog(LOG_NOTICE, _("%s: bogus conversation function"),MODULE);
-+ }
-+ } else {
-+ if (debug)
-+ syslog(LOG_NOTICE, _("%s: no conversation function"),MODULE);
-+ }
-+ return NULL;
-+}
-+
-+static void security_restorelabel_tty(const char *tty,
-+ security_context_t context) {
-+ char ttybuf[PATH_MAX];
-+ const char *ptr;
-+
-+ if (context==NULL)
-+ return;
-+
-+ if(strncmp("/dev/", tty, 5)) {
-+ snprintf(ttybuf,sizeof(ttybuf),"/dev/%s",tty);
-+ ptr = ttybuf;
-+ }
-+ else
-+ ptr = tty;
-+
-+ if (setfilecon(ptr, context))
-+ {
-+ syslog(LOG_NOTICE,
-+ _("Warning! Could not relabel %s with %s, not
relabeling.\n"),
-+ ttybuf,context);
-+ }
-+}
-+
-+static security_context_t security_label_tty(char *tty,
-+ security_context_t usercon) {
-+ char ttybuf[PATH_MAX];
-+ int status=0;
-+ security_context_t newdev_context=NULL; /* The new context of a device */
-+ security_context_t prev_context=NULL; /* The new context of a device */
-+ const char *ptr;
-+
-+ if(strncmp("/dev/", tty, 5))
-+ {
-+ snprintf(ttybuf,sizeof(ttybuf),"/dev/%s",tty);
-+ ptr = ttybuf;
-+ }
-+ else
-+ ptr = tty;
-+
-+ if (getfilecon(ptr, &prev_context) < 0)
-+ {
-+ syslog(LOG_NOTICE,
-+ _("Warning! Could not get current context for %s, not
relabeling."), ptr);
-+ return NULL;
-+ }
-+ if( security_compute_relabel(usercon,prev_context,SECCLASS_CHR_FILE,
-+ &newdev_context)!=0)
-+ {
-+ syslog(LOG_NOTICE,
-+ _("Warning! Could not get new context for %s, not
relabeling."),
-+ ptr);
-+ syslog(LOG_NOTICE, "usercon=%s, prev_context=%s\n", usercon,
prev_context);
-+ freecon(prev_context);
-+ return NULL;
-+ }
-+ status=setfilecon(ptr,newdev_context);
-+ if (status)
-+ {
-+ syslog(LOG_NOTICE,
-+ _("Warning! Could not relabel %s with %s, not
relabeling.%s"),
-+ ptr,newdev_context,strerror(errno));
-+ freecon(prev_context);
-+ prev_context=NULL;
-+ }
-+ freecon(newdev_context);
-+ return prev_context;
-+}
-+
-+static security_context_t user_context=NULL;
-+static security_context_t prev_user_context=NULL;
-+static security_context_t ttyn_context=NULL; /* The current context of
ttyn device */
-+static int selinux_enabled=0;
-+static char *ttyn=NULL;
-+
-+/* Tell the user that access has been granted. */
-+static void
-+verbose_message(pam_handle_t *pamh, char *msg, int debug)
-+{
-+ struct pam_conv *conv;
-+ struct pam_message message;
-+ const struct pam_message *messages[] = {&message};
-+ struct pam_response *responses;
-+ if (pam_get_item(pamh, PAM_CONV, (const void**) &conv) == PAM_SUCCESS) {
-+ if (conv && conv->conv != NULL) {
-+ char text[PATH_MAX];
-+
-+ memset(&message, 0, sizeof(message));
-+ message.msg_style = PAM_TEXT_INFO;
-+ snprintf(text, sizeof(text), msg);
-+
-+ message.msg = text;
-+ if (debug)
-+ syslog(LOG_NOTICE, MODULE ": %s", message.msg);
-+ conv->conv(1, messages, &responses, conv->appdata_ptr);
-+ if (responses)
-+ _pam_drop_reply(responses, 1);
-+ } else {
-+ if (debug)
-+ syslog(LOG_NOTICE, _("%s: bogus conversation function"),MODULE);
-+ }
-+ } else {
-+ if (debug)
-+ syslog(LOG_NOTICE,_("%s: no conversation function"),MODULE);
-+ }
-+}
-+
-+PAM_EXTERN int
-+pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, const char
**argv)
-+{
-+ /* Fail by default. */
-+ return PAM_AUTH_ERR;
-+}
-+
-+PAM_EXTERN int
-+pam_sm_setcred(pam_handle_t *pamh, int flags, int argc, const char **argv)
-+{
-+ return PAM_SUCCESS;
-+}
-+
-+PAM_EXTERN int
-+pam_sm_open_session(pam_handle_t *pamh, int flags, int argc, const char
**argv)
-+{
-+ int i, debug = 0, ttys=1, has_tty=isatty(0), verbose=0, multiple=0,
close_session=0;
-+ int ret=0;
-+ security_context_t* contextlist=NULL;
-+ int num_contexts = 0;
-+ char *username=NULL;
-+ const char *tty=NULL;
-+
-+ /* Parse arguments. */
-+ for (i = 0; i < argc; i++) {
-+ if (strcmp(argv[i], "debug") == 0) {
-+ debug = 1;
-+ }
-+ if (strcmp(argv[i], "nottys") == 0) {
-+ ttys = 0;
-+ }
-+ if (strcmp(argv[i], "verbose") == 0) {
-+ verbose = 1;
-+ }
-+ if (strcmp(argv[i], "multiple") == 0) {
-+ multiple = 1;
-+ }
-+ if (strcmp(argv[i], "close") == 0) {
-+ close_session = 1;
-+ }
-+ }
-+
-+ if (debug)
-+ syslog(LOG_NOTICE, MODULE ": %s", "Open Session");
-+
-+ /* this module is only supposed to execute close_session */
-+ if (close_session)
-+ return PAM_SUCCESS;
-+
-+ if (!(selinux_enabled = is_selinux_enabled()>0) )
-+ return PAM_SUCCESS;
-+
-+ if (pam_get_item(pamh, PAM_USER, (const void**)&username) != PAM_SUCCESS
||
-+ username == NULL) {
-+ return PAM_AUTH_ERR;
-+ }
-+ num_contexts = get_ordered_context_list(username, 0, &contextlist);
-+ if (num_contexts > 0) {
-+ if (multiple && (num_contexts > 1) && has_tty) {
-+ user_context = select_context(pamh,contextlist, debug);
-+ freeconary(contextlist);
-+ } else {
-+ user_context = (security_context_t) strdup(contextlist[0]);
-+ freeconary(contextlist);
-+ }
-+ } else {
-+ if (has_tty) {
-+ user_context = manual_context(pamh,username,debug);
-+ if (user_context == NULL) {
-+ syslog (LOG_ERR, _("Unable to get valid context for %s"), username);
-+ return PAM_AUTH_ERR;
-+ }
-+ } else {
-+ syslog (LOG_ERR, _("Unable to get valid context for %s, No valid
tty"), username);
-+ return PAM_AUTH_ERR;
-+ }
-+ }
-+ if (getexeccon(&prev_user_context)<0) {
-+ prev_user_context=NULL;
-+ }
-+ if (ttys) {
-+ /* Get the name of the terminal. */
-+ if (pam_get_item(pamh, PAM_TTY, (const void**)&tty) != PAM_SUCCESS) {
-+ tty = NULL;
-+ }
-+
-+ if ((tty == NULL) || (strlen(tty) == 0) ||
-+ strcmp(tty, "ssh") == 0 || strncmp(tty, "NODEV", 5) == 0) {
-+ tty = ttyname(STDIN_FILENO);
-+ if ((tty == NULL) || (strlen(tty) == 0)) {
-+ tty = ttyname(STDOUT_FILENO);
-+ }
-+ if ((tty == NULL) || (strlen(tty) == 0)) {
-+ tty = ttyname(STDERR_FILENO);
-+ }
-+ }
-+ }
-+ if(ttys && tty ) {
-+ ttyn=strdup(tty);
-+ ttyn_context=security_label_tty(ttyn,user_context);
-+ }
-+ ret = setexeccon(user_context);
-+ if (ret==0 && verbose) {
-+ char msg[PATH_MAX];
-+ snprintf(msg, sizeof(msg),
-+ _("Security Context %s Assigned"), user_context);
-+ verbose_message(pamh, msg, debug);
-+ }
-+ if (ret) {
-+ syslog(LOG_ERR, _("Error! Unable to set %s executable context %s."),
-+ username, user_context);
-+ freecon(user_context);
-+ return PAM_AUTH_ERR;
-+ } else {
-+ if (debug)
-+ syslog(LOG_NOTICE, _("%s: set %s security context to %s"),MODULE,
-+ username, user_context);
-+ }
-+ freecon(user_context);
-+
-+ return PAM_SUCCESS;
-+}
-+
-+PAM_EXTERN int
-+pam_sm_close_session(pam_handle_t *pamh, int flags, int argc, const char
**argv)
-+{
-+ int i, debug = 0,status=0, open_session=0;
-+ if (! (selinux_enabled ))
-+ return PAM_SUCCESS;
-+
-+ /* Parse arguments. */
-+ for (i = 0; i < argc; i++) {
-+ if (strcmp(argv[i], "debug") == 0) {
-+ debug = 1;
-+ }
-+ if (strcmp(argv[i], "open") == 0) {
-+ open_session = 1;
-+ }
-+ }
-+
-+ if (debug)
-+ syslog(LOG_NOTICE, MODULE ": %s", "Close Session");
-+
-+ if (open_session)
-+ return PAM_SUCCESS;
-+
-+ if (ttyn) {
-+ if (debug)
-+ syslog(LOG_NOTICE, MODULE ":Restore tty %s -> %s",
ttyn,ttyn_context);
-+
-+ security_restorelabel_tty(ttyn,ttyn_context);
-+ freecon(ttyn_context);
-+ free(ttyn);
-+ ttyn=NULL;
-+ }
-+ status=setexeccon(prev_user_context);
-+ freecon(prev_user_context);
-+ if (status) {
-+ syslog(LOG_ERR, _("Error! Unable to set executable context %s."),
-+ prev_user_context);
-+ return PAM_AUTH_ERR;
-+ }
-+
-+ if (debug)
-+ syslog(LOG_NOTICE, _("%s: setcontext back to orginal"),MODULE);
-+
-+ return PAM_SUCCESS;
-+}
-+
-+#else /* PAM_SELINUX_MAIN */
-+
-+/************************************************************************
-+ *
-+ * All PAM code goes in this section.
-+ *
-+ ************************************************************************/
-+
-+#include <unistd.h> /* for getuid(), exit(), getopt() */
-+#include <signal.h>
-+#include <sys/wait.h> /* for wait() */
-+
-+#include <security/pam_appl.h> /* for PAM functions */
-+#include <security/pam_misc.h> /* for misc_conv PAM utility function */
-+
-+#define SERVICE_NAME "pam_selinux_check" /* the name of this program for
PAM */
-+ /* The file containing the context to run
-+ * the scripts under. */
-+int authenticate_via_pam( const char *user , pam_handle_t **pamh);
-+
-+/* authenticate_via_pam()
-+ *
-+ * in: user
-+ * out: nothing
-+ * return: value condition
-+ * ----- ---------
-+ * 1 pam thinks that the user authenticated themselves
properly
-+ * 0 otherwise
-+ *
-+ * this function uses pam to authenticate the user running this
-+ * program. this is the only function in this program that makes pam
-+ * calls.
-+ *
-+ */
-+
-+int authenticate_via_pam( const char *user , pam_handle_t **pamh) {
-+
-+ struct pam_conv *conv;
-+ int result = 0; /* our result, set to 0 (not authenticated) by default
*/
-+
-+ /* this is a jump table of functions for pam to use when it wants to *
-+ * communicate with the user. we'll be using misc_conv(), which is *
-+ * provided for us via pam_misc.h. */
-+ struct pam_conv pam_conversation = {
-+ misc_conv,
-+ NULL
-+ };
-+ conv = &pam_conversation;
-+
-+
-+ /* make `p_pam_handle' a valid pam handle so we can use it when *
-+ * calling pam functions. */
-+ if( PAM_SUCCESS != pam_start( SERVICE_NAME,
-+ user,
-+ conv,
-+ pamh ) ) {
-+ fprintf( stderr, _("failed to initialize PAM\n") );
-+ exit( -1 );
-+ }
-+
-+ if( PAM_SUCCESS != pam_set_item(*pamh, PAM_RUSER, user))
-+ {
-+ fprintf( stderr, _("failed to pam_set_item()\n") );
-+ exit( -1 );
-+ }
-+
-+ /* Ask PAM to authenticate the user running this program */
-+ if( PAM_SUCCESS == pam_authenticate(*pamh,0) ) {
-+ if ( PAM_SUCCESS == pam_open_session(*pamh, 0) )
-+ result = 1; /* user authenticated OK! */
-+ }
-+ return( result );
-+
-+} /* authenticate_via_pam() */
-+
-+int main(int argc, char **argv) {
-+ pam_handle_t *pamh;
-+ int childPid;
-+
-+ if (!authenticate_via_pam(argv[1],&pamh))
-+ exit(-1);
-+
-+ childPid = fork();
-+ if (childPid < 0) {
-+ int errsv = errno;
-+
-+ /* error in fork() */
-+ fprintf(stderr, _("login: failure forking: %s"), strerror(errsv));
-+ pam_close_session(pamh, 0);
-+ /* We're done with PAM. Free `pam_handle'. */
-+ pam_end( pamh, PAM_SUCCESS );
-+ exit(0);
-+ }
-+ if (childPid) {
-+ close(0); close(1); close(2);
-+ struct sigaction sa;
-+ memset(&sa,0,sizeof(sa));
-+ sa.sa_handler = SIG_IGN;
-+ sigaction(SIGQUIT, &sa, NULL);
-+ sigaction(SIGINT, &sa, NULL);
-+ while(wait(NULL) == -1 && errno == EINTR) /**/ ;
-+ openlog("login", LOG_ODELAY, LOG_AUTHPRIV);
-+ pam_close_session(pamh, 0);
-+ /* We're done with PAM. Free `pam_handle'. */
-+ pam_end( pamh, PAM_SUCCESS );
-+ exit(0);
-+ }
-+ argv[0]="/bin/sh";
-+ argv[1]=NULL;
-+
-+ /* NOTE: The environment has not been sanitized. LD_PRELOAD and other fun
-+ * things could be set. */
-+ execv("/bin/sh",argv);
-+ fprintf(stderr,"Failure\n");
-+ return 0;
-+}
-+#endif
-diff -uNr Linux-PAM-0.79.old/modules/pam_selinux/pam_selinux_check.8
Linux-PAM-0.79/modules/pam_selinux/pam_selinux_check.8
---- Linux-PAM-0.79.old/modules/pam_selinux/pam_selinux_check.8 1969-12-31
16:00:00.000000000 -0800
-+++ Linux-PAM-0.79/modules/pam_selinux/pam_selinux_check.8 2005-05-24
18:03:58.000000000 -0700
-@@ -0,0 +1,35 @@
-+.TH pam_selinux_check 8 2002/05/23 "Red Hat Linux" "System Administrator's
Manual"
-+.SH NAME
-+pam_selinux_check \- login program to test pam_selinux_check
-+.SH SYNOPSIS
-+.B pam_selinux_check [user]
-+.br
-+
-+.SH DESCRIPTION
-+With no arguments,
-+.B pam_selinux_check
-+will prompt for user
-+
-+.SH OPTIONS
-+.IP target_user
-+The user to login as.
-+
-+.SH DIAGNOSTICS
-+You must setup a /etc/pam.d/pam_selinux_check file, in order for the check
to work.
-+
-+When checking if a selinux is valid,
-+.B pam_selinux_check
-+returns an exit code of 0 for success and > 0 on error:
-+
-+.nf
-+1: Authentication failure
-+.fi
-+
-+.SH SEE ALSO
-+pam_selinux(8)
-+
-+.SH BUGS
-+Let's hope not, but if you find any, please email the author.
-+
-+.SH AUTHOR
-+Dan Walsh <dwalsh AT redhat.com>
-diff -uNr Linux-PAM-0.79.old/modules/pam_selinux/pam_selinux_check.c
Linux-PAM-0.79/modules/pam_selinux/pam_selinux_check.c
---- Linux-PAM-0.79.old/modules/pam_selinux/pam_selinux_check.c 1969-12-31
16:00:00.000000000 -0800
-+++ Linux-PAM-0.79/modules/pam_selinux/pam_selinux_check.c 2005-05-24
18:03:58.000000000 -0700
-@@ -0,0 +1,43 @@
-+/******************************************************************************
-+ * A module for Linux-PAM that will set the default security context after
login
-+ * via PAM.
-+ *
-+ * Copyright (c) 2003 Red Hat, Inc.
-+ * Written by Dan Walsh <dwalsh AT redhat.com>
-+ *
-+ * Redistribution and use in source and binary forms, with or without
-+ * modification, are permitted provided that the following conditions
-+ * are met:
-+ * 1. Redistributions of source code must retain the above copyright
-+ * notice, and the entire permission notice in its entirety,
-+ * including the disclaimer of warranties.
-+ * 2. Redistributions in binary form must reproduce the above copyright
-+ * notice, this list of conditions and the following disclaimer in the
-+ * documentation and/or other materials provided with the distribution.
-+ * 3. The name of the author may not be used to endorse or promote
-+ * products derived from this software without specific prior
-+ * written permission.
-+ *
-+ * ALTERNATIVELY, this product may be distributed under the terms of
-+ * the GNU Public License, in which case the provisions of the GPL are
-+ * required INSTEAD OF the above restrictions. (This clause is
-+ * necessary due to a potential bad interaction between the GPL and
-+ * the restrictions contained in a BSD-style copyright.)
-+ *
-+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
-+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-+ * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
-+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
-+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
-+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
-+ * OF THE POSSIBILITY OF SUCH DAMAGE.
-+ *
-+ */
-+
-+#define PAM_SELINUX_MAIN 1
-+#include "pam_selinux.c"
-+
-Binary files Linux-PAM-0.79.old/modules/pam_unix/.unix_chkpwd.c.rej.swp and
Linux-PAM-0.79/modules/pam_unix/.unix_chkpwd.c.rej.swp differ
-diff -uNr Linux-PAM-0.79.old/modules/pam_unix/Makefile
Linux-PAM-0.79/modules/pam_unix/Makefile
---- Linux-PAM-0.79.old/modules/pam_unix/Makefile 2004-11-08
00:58:37.000000000 -0800
-+++ Linux-PAM-0.79/modules/pam_unix/Makefile 2005-05-24 18:14:23.000000000
-0700
-@@ -60,9 +60,9 @@
- ########################################################################
-
- CFLAGS += $(USE_CRACKLIB) $(USE_LCKPWDF) $(NEED_LCKPWDF) $(EXTRAS) \
-- $(INCLUDE_PAMMODUTILS)
-+ $(INCLUDE_PAMMODUTILS) -DNIS -DWITH_SELINUX
-
--LDLIBS = $(EXTRALS) $(LINK_PAMMODUTILS)
-+LDLIBS = $(EXTRALS) $(LINK_PAMMODUTILS) -lselinux
-
- ifdef USE_CRACKLIB
- CRACKLIB = -lcrack
-diff -uNr Linux-PAM-0.79.old/modules/pam_unix/lckpwdf.-c
Linux-PAM-0.79/modules/pam_unix/lckpwdf.-c
---- Linux-PAM-0.79.old/modules/pam_unix/lckpwdf.-c 2000-06-20
15:12:02.000000000 -0700
-+++ Linux-PAM-0.79/modules/pam_unix/lckpwdf.-c 2005-05-24 18:03:58.000000000
-0700
-@@ -26,6 +26,9 @@
-
- #include <fcntl.h>
- #include <signal.h>
-+#ifdef WITH_SELINUX
-+#include <selinux/selinux.h>
-+#endif
-
- #define LOCKFILE "/etc/.pwd.lock"
- #define TIMEOUT 15
-@@ -64,6 +67,28 @@
- if (lockfd != -1)
- return -1;
-
-+#ifdef WITH_SELINUX
-+ if(is_selinux_enabled()>0)
-+ {
-+ lockfd = open(LOCKFILE, O_WRONLY);
-+ if(lockfd == -1 && errno == ENOENT)
-+ {
-+ security_context_t create_context;
-+ int rc;
-+
-+ if(getfilecon("/etc/passwd", &create_context))
-+ return -1;
-+ rc = setfscreatecon(create_context);
-+ freecon(create_context);
-+ if(rc)
-+ return -1;
-+ lockfd = open(LOCKFILE, O_CREAT | O_WRONLY, 0600);
-+ if(setfscreatecon(NULL))
-+ return -1;
-+ }
-+ }
-+ else
-+#endif
- lockfd = open(LOCKFILE, O_CREAT | O_WRONLY, 0600);
- if (lockfd == -1)
- return -1;
-diff -uNr Linux-PAM-0.79.old/modules/pam_unix/pam_unix_acct.c
Linux-PAM-0.79/modules/pam_unix/pam_unix_acct.c
---- Linux-PAM-0.79.old/modules/pam_unix/pam_unix_acct.c 2005-01-10
02:10:00.000000000 -0800
-+++ Linux-PAM-0.79/modules/pam_unix/pam_unix_acct.c 2005-05-24
18:03:58.000000000 -0700
-@@ -45,6 +45,15 @@
- #include <pwd.h>
- #include <shadow.h>
- #include <time.h> /* for time() */
-+#include <linux/limits.h>
-+#include <errno.h>
-+#include <sys/wait.h>
-+#ifdef WITH_SELINUX
-+#include <selinux/selinux.h>
-+#define SELINUX_ENABLED is_selinux_enabled()>0
-+#else
-+#define SELINUX_ENABLED 0
-+#endif
-
- #include <security/_pam_macros.h>
-
-@@ -60,7 +69,112 @@
- #endif /* LINUX_PAM */
-
- #include "support.h"
-+struct spwd spwd;
-
-+struct spwd *_unix_run_verify_binary(pam_handle_t *pamh, unsigned int ctrl,
const char *user)
-+{
-+ int retval=0, child, fds[2];
-+ void (*sighandler)(int) = NULL;
-+ D(("running verify_binary"));
-+
-+ /* create a pipe for the messages */
-+ if (pipe(fds) != 0) {
-+ D(("could not make pipe"));
-+ _log_err(LOG_ERR, pamh, "Could not make pipe %s",strerror(errno));
-+ return NULL;
-+ }
-+ D(("called."));
-+
-+ if (off(UNIX_NOREAP, ctrl)) {
-+ /*
-+ * This code arranges that the demise of the child does not cause
-+ * the application to receive a signal it is not expecting - which
-+ * may kill the application or worse.
-+ *
-+ * The "noreap" module argument is provided so that the admin can
-+ * override this behavior.
-+ */
-+ sighandler = signal(SIGCHLD, SIG_DFL);
-+ }
-+
-+ /* fork */
-+ child = fork();
-+ if (child == 0) {
-+ int i=0;
-+ struct rlimit rlim;
-+ static char *envp[] = { NULL };
-+ char *args[] = { NULL, NULL, NULL, NULL };
-+
-+ close(0); close(1);
-+ /* reopen stdin as pipe */
-+ close(fds[0]);
-+ dup2(fds[1], STDOUT_FILENO);
-+
-+ /* XXX - should really tidy up PAM here too */
-+
-+ if (getrlimit(RLIMIT_NOFILE,&rlim)==0) {
-+ for (i=2; i < rlim.rlim_max; i++) {
-+ if (fds[1] != i) {
-+ close(i);
-+ }
-+ }
-+ }
-+ /* exec binary helper */
-+ args[0] = x_strdup(CHKPWD_HELPER);
-+ args[1] = x_strdup(user);
-+ args[2] = x_strdup("verify");
-+
-+ execve(CHKPWD_HELPER, args, envp);
-+
-+ _log_err(LOG_ERR, pamh, "helper binary execve failed:
%s",strerror(errno));
-+ /* should not get here: exit with error */
-+ close (fds[1]);
-+ D(("helper binary is not available"));
-+ exit(PAM_AUTHINFO_UNAVAIL);
-+ } else {
-+ close(fds[1]);
-+ if (child > 0) {
-+ char buf[1024];
-+ int rc=0;
-+ rc=waitpid(child, &retval, 0); /* wait for helper to complete */
-+ if (rc<0) {
-+ _log_err(LOG_ERR, pamh, "unix_chkpwd waitpid returned %d: %s", rc,
strerror(errno));
-+ retval = PAM_AUTH_ERR;
-+ } else {
-+ retval = WEXITSTATUS(retval);
-+ if (retval != PAM_AUTHINFO_UNAVAIL) {
-+ rc = _pammodutil_read(fds[0], buf, sizeof(buf) - 1);
-+ if(rc > 0) {
-+ buf[rc] = '\0';
-+ sscanf(buf,"%ld:%ld:%ld:%ld:%ld:%ld",
-+ &spwd.sp_lstchg, /* last password change */
-+ &spwd.sp_min, /* days until change allowed. */
-+ &spwd.sp_max, /* days before change required */
-+ &spwd.sp_warn, /* days warning for expiration */
-+ &spwd.sp_inact, /* days before account inactive */
-+ &spwd.sp_expire); /* date when account expires */
-+ }
-+ else {
-+ _log_err(LOG_ERR, pamh, " ERROR %d:%s \n",rc, strerror(errno));
-+ }
-+ }
-+ }
-+ } else {
-+ _log_err(LOG_ERR, pamh, "Fork failed %s \n",strerror(errno));
-+ D(("fork failed"));
-+ retval = PAM_AUTH_ERR;
-+ }
-+ close(fds[0]);
-+ }
-+ if (sighandler != NULL) {
-+ (void) signal(SIGCHLD, sighandler); /* restore old signal handler */
-+ }
-+ D(("Returning %d",retval));
-+ if (retval != PAM_SUCCESS) {
-+ return NULL;
-+ }
-+ return &spwd;
-+}
- /*
- * PAM framework looks for this entry-point to pass control to the
- * account management module.
-@@ -128,6 +242,9 @@
- else
- return PAM_SUCCESS;
-
-+ if (!spent && SELINUX_ENABLED )
-+ spent = _unix_run_verify_binary(pamh, ctrl, uname);
-+
- if (!spent)
- if (on(UNIX_BROKEN_SHADOW,ctrl))
- return PAM_SUCCESS;
-diff -uNr Linux-PAM-0.79.old/modules/pam_unix/pam_unix_passwd.c
Linux-PAM-0.79/modules/pam_unix/pam_unix_passwd.c
---- Linux-PAM-0.79.old/modules/pam_unix/pam_unix_passwd.c 2004-11-24
23:36:50.000000000 -0800
-+++ Linux-PAM-0.79/modules/pam_unix/pam_unix_passwd.c 2005-05-24
18:03:58.000000000 -0700
-@@ -57,6 +57,19 @@
- #include <rpcsvc/yp_prot.h>
- #include <rpcsvc/ypclnt.h>
-
-+#include <signal.h>
-+#include <linux/limits.h>
-+#include <errno.h>
-+#include <sys/wait.h>
-+#ifdef WITH_SELINUX
-+static int selinux_enabled=-1;
-+#include <selinux/selinux.h>
-+static security_context_t prev_context=NULL;
-+#define SELINUX_ENABLED (selinux_enabled!=-1 ? selinux_enabled :
selinux_enabled=is_selinux_enabled()>0)
-+#else
-+#define SELINUX_ENABLED 0
-+#endif
-+
- #ifdef USE_CRACKLIB
- #include <crack.h>
- #endif
-@@ -210,6 +223,97 @@
- return master;
- }
-
-+static int _unix_run_shadow_binary(pam_handle_t *pamh, unsigned int ctrl,
const char *user, const char *fromwhat, const char *towhat)
-+{
-+ int retval, child, fds[2];
-+ void (*sighandler)(int) = NULL;
-+
-+ D(("called."));
-+ /* create a pipe for the password */
-+ if (pipe(fds) != 0) {
-+ D(("could not make pipe"));
-+ return PAM_AUTH_ERR;
-+ }
-+
-+ if (off(UNIX_NOREAP, ctrl)) {
-+ /*
-+ * This code arranges that the demise of the child does not cause
-+ * the application to receive a signal it is not expecting - which
-+ * may kill the application or worse.
-+ *
-+ * The "noreap" module argument is provided so that the admin can
-+ * override this behavior.
-+ */
-+ sighandler = signal(SIGCHLD, SIG_DFL);
-+ }
-+
-+ /* fork */
-+ child = fork();
-+ if (child == 0) {
-+ int i=0;
-+ struct rlimit rlim;
-+ static char *envp[] = { NULL };
-+ char *args[] = { NULL, NULL, NULL, NULL };
-+
-+ /* XXX - should really tidy up PAM here too */
-+
-+ close(0); close(1);
-+ /* reopen stdin as pipe */
-+ close(fds[1]);
-+ dup2(fds[0], STDIN_FILENO);
-+
-+ if (getrlimit(RLIMIT_NOFILE,&rlim)==0) {
-+ for (i=2; i < rlim.rlim_max; i++) {
-+ if (fds[0] != i)
-+ close(i);
-+ }
-+ }
-+ /* exec binary helper */
-+ args[0] = x_strdup(CHKPWD_HELPER);
-+ args[1] = x_strdup(user);
-+ args[2] = x_strdup("shadow");
-+
-+ execve(CHKPWD_HELPER, args, envp);
-+
-+ /* should not get here: exit with error */
-+ D(("helper binary is not available"));
-+ exit(PAM_AUTHINFO_UNAVAIL);
-+ } else if (child > 0) {
-+ /* wait for child */
-+ /* if the stored password is NULL */
-+ int rc=0;
-+ if (fromwhat)
-+ write(fds[1], fromwhat, strlen(fromwhat)+1);
-+ else
-+ write(fds[1], "", 1);
-+ if (towhat) {
-+ write(fds[1], towhat, strlen(towhat)+1);
-+ }
-+ else
-+ write(fds[1], "", 1);
-+
-+ close(fds[0]); /* close here to avoid possible SIGPIPE above */
-+ close(fds[1]);
-+ rc=waitpid(child, &retval, 0); /* wait for helper to complete */
-+ if (rc<0) {
-+ _log_err(LOG_ERR, pamh, "unix_chkpwd waitpid returned %d: %s", rc,
strerror(errno));
-+ retval = PAM_AUTH_ERR;
-+ } else {
-+ retval = WEXITSTATUS(retval);
-+ }
-+ } else {
-+ D(("fork failed"));
-+ close(fds[0]);
-+ close(fds[1]);
-+ retval = PAM_AUTH_ERR;
-+ }
-+
-+ if (sighandler != NULL) {
-+ (void) signal(SIGCHLD, sighandler); /* restore old signal handler
*/
-+ }
-+
-+ return retval;
-+}
- static int check_old_password(const char *forwho, const char *newpass)
- {
- static char buf[16384];
-@@ -270,37 +374,58 @@
- }
-
- oldmask = umask(077);
-+
-+#ifdef WITH_SELINUX
-+ if (SELINUX_ENABLED) {
-+ security_context_t passwd_context=NULL;
-+ if (getfilecon("/etc/passwd",&passwd_context)<0) {
-+ return PAM_AUTHTOK_ERR;
-+ };
-+ if (getfscreatecon(&prev_context)<0) {
-+ freecon(passwd_context);
-+ return PAM_AUTHTOK_ERR;
-+ }
-+ if (setfscreatecon(passwd_context)) {
-+ freecon(passwd_context);
-+ freecon(prev_context);
-+ return PAM_AUTHTOK_ERR;
-+ }
-+ freecon(passwd_context);
-+ }
-+#endif
- pwfile = fopen(OPW_TMPFILE, "w");
- umask(oldmask);
- if (pwfile == NULL) {
-- return PAM_AUTHTOK_ERR;
-+ err = 1;
-+ goto done;
- }
-
- opwfile = fopen(OLD_PASSWORDS_FILE, "r");
- if (opwfile == NULL) {
- fclose(pwfile);
-- return PAM_AUTHTOK_ERR;
-+ err = 1;
-+ goto done;
- }
-
-- if (fstat (fileno (opwfile), &st) == -1)
-- {
-- fclose (opwfile);
-- fclose (pwfile);
-- return PAM_AUTHTOK_ERR;
-- }
-+ if (fstat(fileno(opwfile), &st) == -1) {
-+ fclose(opwfile);
-+ fclose(pwfile);
-+ err = 1;
-+ goto done;
-+ }
-
-- if (fchown (fileno (pwfile), st.st_uid, st.st_gid) == -1)
-- {
-- fclose (opwfile);
-- fclose (pwfile);
-- return PAM_AUTHTOK_ERR;
-- }
-- if (fchmod (fileno (pwfile), st.st_mode) == -1)
-- {
-- fclose (opwfile);
-- fclose (pwfile);
-- return PAM_AUTHTOK_ERR;
-- }
-+ if (fchown(fileno(pwfile), st.st_uid, st.st_gid) == -1) {
-+ fclose(opwfile);
-+ fclose(pwfile);
-+ err = 1;
-+ goto done;
-+ }
-+ if (fchmod(fileno(pwfile), st.st_mode) == -1) {
-+ fclose(opwfile);
-+ fclose(pwfile);
-+ err = 1;
-+ goto done;
-+ }
-
- while (fgets(buf, 16380, opwfile)) {
- if (!strncmp(buf, forwho, strlen(forwho))) {
-@@ -357,14 +482,27 @@
- err = 1;
- }
-
-+done:
- if (!err) {
-- if (!rename(OPW_TMPFILE, OLD_PASSWORDS_FILE)) {
-- return PAM_SUCCESS;
-- }
-+ if (rename(OPW_TMPFILE, OLD_PASSWORDS_FILE))
-+ err = 1;
-+ }
-+#ifdef WITH_SELINUX
-+ if (SELINUX_ENABLED) {
-+ if (setfscreatecon(prev_context)) {
-+ err = 1;
-+ }
-+ if (prev_context)
-+ freecon(prev_context);
-+ prev_context=NULL;
-+ }
-+#endif
-+ if (!err) {
-+ return PAM_SUCCESS;
-+ } else {
-+ unlink(OPW_TMPFILE);
-+ return PAM_AUTHTOK_ERR;
- }
--
-- unlink(OPW_TMPFILE);
-- return PAM_AUTHTOK_ERR;
- }
-
- static int _update_passwd(pam_handle_t *pamh,
-@@ -377,38 +515,59 @@
- int oldmask;
-
- oldmask = umask(077);
-+#ifdef WITH_SELINUX
-+ if (SELINUX_ENABLED) {
-+ security_context_t passwd_context=NULL;
-+ if (getfilecon("/etc/passwd",&passwd_context)<0) {
-+ return PAM_AUTHTOK_ERR;
-+ };
-+ if (getfscreatecon(&prev_context)<0) {
-+ freecon(passwd_context);
-+ return PAM_AUTHTOK_ERR;
-+ }
-+ if (setfscreatecon(passwd_context)) {
-+ freecon(passwd_context);
-+ freecon(prev_context);
-+ return PAM_AUTHTOK_ERR;
-+ }
-+ freecon(passwd_context);
-+ }
-+#endif
- pwfile = fopen(PW_TMPFILE, "w");
- umask(oldmask);
- if (pwfile == NULL) {
-- return PAM_AUTHTOK_ERR;
-+ err = 1;
-+ goto done;
- }
-
- opwfile = fopen("/etc/passwd", "r");
- if (opwfile == NULL) {
- fclose(pwfile);
-- return PAM_AUTHTOK_ERR;
-+ err = 1;
-+ goto done;
- }
-
-- if (fstat (fileno (opwfile), &st) == -1)
-- {
-- fclose (opwfile);
-- fclose (pwfile);
-- return PAM_AUTHTOK_ERR;
-- }
-+ if (fstat(fileno(opwfile), &st) == -1) {
-+ fclose(opwfile);
-+ fclose(pwfile);
-+ err = 1;
-+ goto done;
-+ }
-
-- if (fchown (fileno (pwfile), st.st_uid, st.st_gid) == -1)
-- {
-- fclose (opwfile);
-- fclose (pwfile);
-- return PAM_AUTHTOK_ERR;
-- }
-- if (fchmod (fileno (pwfile), st.st_mode) == -1)
-- {
-- fclose (opwfile);
-- fclose (pwfile);
-- }
-+ if (fchown(fileno(pwfile), st.st_uid, st.st_gid) == -1) {
-+ fclose(opwfile);
-+ fclose(pwfile);
-+ err = 1;
-+ goto done;
-+ }
-+ if (fchmod(fileno(pwfile), st.st_mode) == -1) {
-+ fclose(opwfile);
-+ fclose(pwfile);
-+ err = 1;
-+ goto done;
-+ }
-
-- tmpent = fgetpwent (opwfile);
-+ tmpent = fgetpwent(opwfile);
- while (tmpent) {
- if (!strcmp(tmpent->pw_name, forwho)) {
- /* To shut gcc up */
-@@ -435,15 +594,29 @@
- err = 1;
- }
-
-+done:
- if (!err) {
-- if (!rename(PW_TMPFILE, "/etc/passwd")) {
-+ if (!rename(PW_TMPFILE, "/etc/passwd"))
- _log_err(LOG_NOTICE, pamh, "password changed for %s", forwho);
-- return PAM_SUCCESS;
-- }
-+ else
-+ err = 1;
-+ }
-+#ifdef WITH_SELINUX
-+ if (SELINUX_ENABLED) {
-+ if (setfscreatecon(prev_context)) {
-+ err = 1;
-+ }
-+ if (prev_context)
-+ freecon(prev_context);
-+ prev_context=NULL;
-+ }
-+#endif
-+ if (!err) {
-+ return PAM_SUCCESS;
-+ } else {
-+ unlink(PW_TMPFILE);
-+ return PAM_AUTHTOK_ERR;
- }
--
-- unlink(PW_TMPFILE);
-- return PAM_AUTHTOK_ERR;
- }
-
- static int _update_shadow(pam_handle_t *pamh, const char *forwho, char
*towhat)
-@@ -459,37 +632,58 @@
- return PAM_USER_UNKNOWN;
- }
- oldmask = umask(077);
-+
-+#ifdef WITH_SELINUX
-+ if (SELINUX_ENABLED) {
-+ security_context_t shadow_context=NULL;
-+ if (getfilecon("/etc/shadow",&shadow_context)<0) {
-+ return PAM_AUTHTOK_ERR;
-+ };
-+ if (getfscreatecon(&prev_context)<0) {
-+ freecon(shadow_context);
-+ return PAM_AUTHTOK_ERR;
-+ }
-+ if (setfscreatecon(shadow_context)) {
-+ freecon(shadow_context);
-+ freecon(prev_context);
-+ return PAM_AUTHTOK_ERR;
-+ }
-+ freecon(shadow_context);
-+ }
-+#endif
- pwfile = fopen(SH_TMPFILE, "w");
- umask(oldmask);
- if (pwfile == NULL) {
-- return PAM_AUTHTOK_ERR;
-+ err = 1;
-+ goto done;
- }
-
- opwfile = fopen("/etc/shadow", "r");
- if (opwfile == NULL) {
- fclose(pwfile);
-- return PAM_AUTHTOK_ERR;
-+ err = 1;
-+ goto done;
- }
-
-- if (fstat (fileno (opwfile), &st) == -1)
-- {
-- fclose (opwfile);
-- fclose (pwfile);
-- return PAM_AUTHTOK_ERR;
-- }
-+ if (fstat(fileno(opwfile), &st) == -1) {
-+ fclose(opwfile);
-+ fclose(pwfile);
-+ err = 1;
-+ goto done;
-+ }
-
-- if (fchown (fileno (pwfile), st.st_uid, st.st_gid) == -1)
-- {
-- fclose (opwfile);
-- fclose (pwfile);
-- return PAM_AUTHTOK_ERR;
-- }
-- if (fchmod (fileno (pwfile), st.st_mode) == -1)
-- {
-- fclose (opwfile);
-- fclose (pwfile);
-- return PAM_AUTHTOK_ERR;
-- }
-+ if (fchown(fileno(pwfile), st.st_uid, st.st_gid) == -1) {
-+ fclose(opwfile);
-+ fclose(pwfile);
-+ err = 1;
-+ goto done;
-+ }
-+ if (fchmod(fileno(pwfile), st.st_mode) == -1) {
-+ fclose(opwfile);
-+ fclose(pwfile);
-+ err = 1;
-+ goto done;
-+ }
-
- stmpent = fgetspent(opwfile);
- while (stmpent) {
-@@ -516,15 +710,31 @@
- err = 1;
- }
-
-+ done:
- if (!err) {
-- if (!rename(SH_TMPFILE, "/etc/shadow")) {
-+ if (!rename(SH_TMPFILE, "/etc/shadow"))
- _log_err(LOG_NOTICE, pamh, "password changed for %s", forwho);
-- return PAM_SUCCESS;
-- }
-+ else
-+ err = 1;
-+ }
-+
-+#ifdef WITH_SELINUX
-+ if (SELINUX_ENABLED) {
-+ if (setfscreatecon(prev_context)) {
-+ err = 1;
-+ }
-+ if (prev_context)
-+ freecon(prev_context);
-+ prev_context=NULL;
- }
-+#endif
-
-- unlink(SH_TMPFILE);
-- return PAM_AUTHTOK_ERR;
-+ if (!err) {
-+ return PAM_SUCCESS;
-+ } else {
-+ unlink(SH_TMPFILE);
-+ return PAM_AUTHTOK_ERR;
-+ }
- }
-
- static int _do_setpass(pam_handle_t* pamh, const char *forwho, char
*fromwhat,
-@@ -550,6 +760,8 @@
- }
- if (on(UNIX_SHADOW, ctrl) || _unix_shadowed(pwd)) {
- retval = _update_shadow(pamh, forwho, towhat);
-+ if (retval != PAM_SUCCESS && SELINUX_ENABLED)
-+ retval = _unix_run_shadow_binary(pamh, ctrl,
forwho, fromwhat, towhat);
- if (retval == PAM_SUCCESS)
- if (!_unix_shadowed(pwd))
- retval = _update_passwd(pamh, forwho,
"x");
-@@ -631,7 +843,7 @@
- return retval;
- }
-
--static int _unix_verify_shadow(const char *user, unsigned int ctrl)
-+static int _unix_verify_shadow(pam_handle_t *pamh, const char *user,
unsigned int ctrl)
- {
- struct passwd *pwd = NULL; /* Password and shadow password */
- struct spwd *spwdent = NULL; /* file entries for the user */
-@@ -650,6 +862,8 @@
- spwdent = getspnam(user);
- endspent();
-
-+ if (spwdent == NULL && SELINUX_ENABLED )
-+ spwdent = _unix_run_verify_binary(pamh, ctrl, user);
- if (spwdent == NULL)
- return PAM_AUTHINFO_UNAVAIL;
- } else {
-@@ -894,7 +1108,7 @@
- _log_err(LOG_CRIT, pamh,
- "failed to set PAM_OLDAUTHTOK");
- }
-- retval = _unix_verify_shadow(user, ctrl);
-+ retval = _unix_verify_shadow(pamh,user, ctrl);
- if (retval == PAM_AUTHTOK_ERR) {
- if (off(UNIX__IAMROOT, ctrl))
- _make_remark(pamh, ctrl, PAM_ERROR_MSG,
-@@ -1019,7 +1233,7 @@
- }
- }
-
-- retval = _unix_verify_shadow(user, ctrl);
-+ retval = _unix_verify_shadow(pamh, user, ctrl);
- if (retval != PAM_SUCCESS) {
- _log_err(LOG_NOTICE, pamh, "user not authenticated
2");
- #ifdef USE_LCKPWDF
-diff -uNr Linux-PAM-0.79.old/modules/pam_unix/support.c
Linux-PAM-0.79/modules/pam_unix/support.c
---- Linux-PAM-0.79.old/modules/pam_unix/support.c 2005-01-10
02:10:00.000000000 -0800
-+++ Linux-PAM-0.79/modules/pam_unix/support.c 2005-05-24 18:03:58.000000000
-0700
-@@ -15,6 +15,7 @@
- #include <pwd.h>
- #include <shadow.h>
- #include <limits.h>
-+#include <linux/limits.h>
- #include <utmp.h>
- #include <errno.h>
- #include <signal.h>
-@@ -27,7 +28,12 @@
-
- #include "md5.h"
- #include "support.h"
--
-+#ifdef WITH_SELINUX
-+#include <selinux/selinux.h>
-+#define SELINUX_ENABLED is_selinux_enabled()>0
-+#else
-+#define SELINUX_ENABLED 0
-+#endif
- extern char *crypt(const char *key, const char *salt);
- extern char *bigcrypt(const char *key, const char *salt);
-
-@@ -562,18 +568,32 @@
- /* fork */
- child = fork();
- if (child == 0) {
-+ int i=0;
-+ struct rlimit rlim;
- static char *envp[] = { NULL };
-- char *args[] = { NULL, NULL, NULL };
-+ char *args[] = { NULL, NULL, NULL, NULL };
-
- /* XXX - should really tidy up PAM here too */
-
-+ close(0); close(1);
- /* reopen stdin as pipe */
- close(fds[1]);
- dup2(fds[0], STDIN_FILENO);
-
-+ if (getrlimit(RLIMIT_NOFILE,&rlim)==0) {
-+ for (i=2; i < rlim.rlim_max; i++) {
-+ if (fds[0] != i)
-+ close(i);
-+ }
-+ }
- /* exec binary helper */
- args[0] = x_strdup(CHKPWD_HELPER);
- args[1] = x_strdup(user);
-+ if (off(UNIX__NONULL, ctrl)) { /* this means we've succeeded */
-+ args[2]=x_strdup("nullok");
-+ } else {
-+ args[2]=x_strdup("nonull");
-+ }
-
- execve(CHKPWD_HELPER, args, envp);
-
-@@ -583,11 +603,7 @@
- } else if (child > 0) {
- /* wait for child */
- /* if the stored password is NULL */
-- if (off(UNIX__NONULL, ctrl)) { /* this means we've succeeded */
-- write(fds[1], "nullok\0\0", 8);
-- } else {
-- write(fds[1], "nonull\0\0", 8);
-- }
-+ int rc=0;
- if (passwd != NULL) { /* send the password to the child */
- write(fds[1], passwd, strlen(passwd)+1);
- passwd = NULL;
-@@ -596,10 +612,17 @@
- }
- close(fds[0]); /* close here to avoid possible SIGPIPE above */
- close(fds[1]);
-- (void) waitpid(child, &retval, 0); /* wait for helper to complete */
-- retval = (retval == 0) ? PAM_SUCCESS:PAM_AUTH_ERR;
-+ rc=waitpid(child, &retval, 0); /* wait for helper to complete */
-+ if (rc<0) {
-+ _log_err(LOG_ERR, pamh, "unix_chkpwd waitpid returned %d: %s", rc,
strerror(errno));
-+ retval = PAM_AUTH_ERR;
-+ } else {
-+ retval = WEXITSTATUS(retval);
-+ }
- } else {
- D(("fork failed"));
-+ close(fds[0]);
-+ close(fds[1]);
- retval = PAM_AUTH_ERR;
- }
-
-@@ -621,6 +644,7 @@
- char *data_name;
- int retval;
-
-+
- D(("called"));
-
- #ifdef HAVE_PAM_FAIL_DELAY
-@@ -687,7 +711,8 @@
-
- retval = PAM_SUCCESS;
- if (pwd == NULL || salt == NULL || !strcmp(salt, "x") || ((salt[0] ==
'#') && (salt[1] == '#') && !strcmp(salt + 2, name))) {
-- if (geteuid()) {
-+
-+ if (geteuid() || SELINUX_ENABLED) {
- /* we are not root perhaps this is the reason? Run
helper */
- D(("running helper binary"));
- retval = _unix_run_helper_binary(pamh, p, ctrl, name);
-diff -uNr Linux-PAM-0.79.old/modules/pam_unix/support.h
Linux-PAM-0.79/modules/pam_unix/support.h
---- Linux-PAM-0.79.old/modules/pam_unix/support.h 2004-10-06
07:05:17.000000000 -0700
-+++ Linux-PAM-0.79/modules/pam_unix/support.h 2005-05-24 18:03:58.000000000
-0700
-@@ -152,4 +152,5 @@
- ,const char **pass);
- extern int _unix_shadowed(const struct passwd *pwd);
-
-+extern struct spwd *_unix_run_verify_binary(pam_handle_t *pamh, unsigned
int ctrl, const char *user);
- #endif /* _PAM_UNIX_SUPPORT_H */
-diff -uNr Linux-PAM-0.79.old/modules/pam_unix/unix_chkpwd.c
Linux-PAM-0.79/modules/pam_unix/unix_chkpwd.c
---- Linux-PAM-0.79.old/modules/pam_unix/unix_chkpwd.c 2004-11-18
05:41:20.000000000 -0800
-+++ Linux-PAM-0.79/modules/pam_unix/unix_chkpwd.c 2005-05-24
18:20:49.000000000 -0700
-@@ -28,12 +28,23 @@
- #include <syslog.h>
- #include <unistd.h>
- #include <sys/types.h>
-+#include <sys/stat.h>
- #include <pwd.h>
- #include <shadow.h>
- #include <signal.h>
-+#include <time.h>
-+static int selinux_enabled=-1;
-+#ifdef WITH_SELINUX
-+#include <selinux/selinux.h>
-+#define SELINUX_ENABLED (selinux_enabled!=-1 ? selinux_enabled :
selinux_enabled=is_selinux_enabled()>0)
-+static security_context_t prev_context=NULL;
-+#else
-+#define SELINUX_ENABLED 0
-+#endif
-
- #define MAXPASS 200 /* the maximum length of a password */
-
-+#include <security/_pam_types.h>
- #include <security/_pam_macros.h>
-
- #include "md5.h"
-@@ -41,9 +52,6 @@
- extern char *crypt(const char *key, const char *salt);
- extern char *bigcrypt(const char *key, const char *salt);
-
--#define UNIX_PASSED 0
--#define UNIX_FAILED 1
--
- /* syslogging function for errors and other information */
-
- static void _log_err(int err, const char *format,...)
-@@ -112,13 +120,40 @@
- (void) sigaction(SIGQUIT, &action, NULL);
- }
-
-+static int _verify_account(const char * const uname)
-+{
-+ struct spwd *spent;
-+ struct passwd *pwent;
-+
-+ pwent = getpwnam(uname);
-+ if (!pwent) {
-+ _log_err(LOG_ALERT, "could not identify user (from
getpwnam(%s))", uname);
-+ return PAM_USER_UNKNOWN;
-+ }
-+
-+ spent = getspnam( uname );
-+ if (!spent) {
-+ _log_err(LOG_ALERT, "could not get username from shadow
(%s))", uname);
-+ return PAM_AUTHINFO_UNAVAIL; /* Couldn't get username from
shadow */
-+ }
-+ printf("%ld:%ld:%ld:%ld:%ld:%ld",
-+ spent->sp_lstchg, /* last password change */
-+ spent->sp_min, /* days until change allowed. */
-+ spent->sp_max, /* days before change required */
-+ spent->sp_warn, /* days warning for expiration */
-+ spent->sp_inact, /* days before account inactive */
-+ spent->sp_expire); /* date when account expires */
-+
-+ return PAM_SUCCESS;
-+}
-+
- static int _unix_verify_password(const char *name, const char *p, int
nullok)
- {
- struct passwd *pwd = NULL;
- struct spwd *spwdent = NULL;
- char *salt = NULL;
- char *pp = NULL;
-- int retval = UNIX_FAILED;
-+ int retval = PAM_AUTH_ERR;
- int salt_len;
-
- /* UNIX passwords area */
-@@ -156,28 +191,28 @@
- if (pwd == NULL || salt == NULL) {
- _log_err(LOG_ALERT, "check pass; user unknown");
- p = NULL;
-- return retval;
-+ return PAM_USER_UNKNOWN;
- }
-
- salt_len = strlen(salt);
- if (salt_len == 0)
-- return (nullok == 0) ? UNIX_FAILED : UNIX_PASSED;
-+ return (nullok == 0) ? PAM_AUTH_ERR : PAM_SUCCESS;
- else if (p == NULL || strlen(p) == 0)
-- return UNIX_FAILED;
-+ return PAM_AUTHTOK_ERR;
-
- /* the moment of truth -- do we agree with the password? */
-- retval = UNIX_FAILED;
-+ retval = PAM_AUTH_ERR;
- if (!strncmp(salt, "$1$", 3)) {
- pp = Goodcrypt_md5(p, salt);
- if (strcmp(pp, salt) == 0) {
-- retval = UNIX_PASSED;
-+ retval = PAM_SUCCESS;
- } else {
- pp = Brokencrypt_md5(p, salt);
- if (strcmp(pp, salt) == 0)
-- retval = UNIX_PASSED;
-+ retval = PAM_SUCCESS;
- }
- } else if ((*salt == '*') || (salt_len < 13)) {
-- retval = UNIX_FAILED;
-+ retval = PAM_SUCCESS;
- } else {
- pp = bigcrypt(p, salt);
- /*
-@@ -190,7 +225,7 @@
- * Bug 521314: the strncmp comparison is for legacy support.
- */
- if (strncmp(pp, salt, salt_len) == 0) {
-- retval = UNIX_PASSED;
-+ retval = PAM_SUCCESS;
- }
- }
- p = NULL; /* no longer needed here */
-@@ -224,13 +259,174 @@
- return username;
- }
-
-+#define SH_TMPFILE "/etc/nshadow"
-+static int _update_shadow(const char *forwho)
-+{
-+ struct spwd *spwdent = NULL, *stmpent = NULL;
-+ FILE *pwfile, *opwfile;
-+ int err = 1;
-+ int oldmask;
-+ struct stat st;
-+ char pass[MAXPASS + 1];
-+ char towhat[MAXPASS + 1];
-+ int npass=0;
-+
-+ /* read the password from stdin (a pipe from the pam_unix module) */
-+
-+ npass = read(STDIN_FILENO, pass, MAXPASS);
-+
-+ if (npass < 0) { /* is it a valid password? */
-+
-+ _log_err(LOG_DEBUG, "no password supplied");
-+ return PAM_AUTHTOK_ERR;
-+
-+ } else if (npass >= MAXPASS) {
-+
-+ _log_err(LOG_DEBUG, "password too long");
-+ return PAM_AUTHTOK_ERR;
-+
-+ } else {
-+ /* does pass agree with the official one? */
-+ int retval=0;
-+ pass[npass] = '\0'; /* NUL terminate */
-+ retval = _unix_verify_password(forwho, pass, 0);
-+ if (retval != PAM_SUCCESS) {
-+ return retval;
-+ }
-+ }
-+
-+ /* read the password from stdin (a pipe from the pam_unix module) */
-+
-+ npass = read(STDIN_FILENO, towhat, MAXPASS);
-+
-+ if (npass < 0) { /* is it a valid password? */
-+
-+ _log_err(LOG_DEBUG, "no new password supplied");
-+ return PAM_AUTHTOK_ERR;
-+
-+ } else if (npass >= MAXPASS) {
-+
-+ _log_err(LOG_DEBUG, "new password too long");
-+ return PAM_AUTHTOK_ERR;
-+
-+ }
-+
-+ towhat[npass] = '\0'; /* NUL terminate */
-+ spwdent = getspnam(forwho);
-+ if (spwdent == NULL) {
-+ return PAM_USER_UNKNOWN;
-+ }
-+ oldmask = umask(077);
-+
-+#ifdef WITH_SELINUX
-+ if (SELINUX_ENABLED) {
-+ security_context_t shadow_context=NULL;
-+ if (getfilecon("/etc/shadow",&shadow_context)<0) {
-+ return PAM_AUTHTOK_ERR;
-+ };
-+ if (getfscreatecon(&prev_context)<0) {
-+ freecon(shadow_context);
-+ return PAM_AUTHTOK_ERR;
-+ }
-+ if (setfscreatecon(shadow_context)) {
-+ freecon(shadow_context);
-+ freecon(prev_context);
-+ return PAM_AUTHTOK_ERR;
-+ }
-+ freecon(shadow_context);
-+ }
-+#endif
-+ pwfile = fopen(SH_TMPFILE, "w");
-+ umask(oldmask);
-+ if (pwfile == NULL) {
-+ err = 1;
-+ goto done;
-+ }
-+
-+ opwfile = fopen("/etc/shadow", "r");
-+ if (opwfile == NULL) {
-+ fclose(pwfile);
-+ err = 1;
-+ goto done;
-+ }
-+
-+ if (fstat(fileno(opwfile), &st) == -1) {
-+ fclose(opwfile);
-+ fclose(pwfile);
-+ err = 1;
-+ goto done;
-+ }
-+
-+ if (fchown(fileno(pwfile), st.st_uid, st.st_gid) == -1) {
-+ fclose(opwfile);
-+ fclose(pwfile);
-+ err = 1;
-+ goto done;
-+ }
-+ if (fchmod(fileno(pwfile), st.st_mode) == -1) {
-+ fclose(opwfile);
-+ fclose(pwfile);
-+ err = 1;
-+ goto done;
-+ }
-+
-+ stmpent = fgetspent(opwfile);
-+ while (stmpent) {
-+
-+ if (!strcmp(stmpent->sp_namp, forwho)) {
-+ stmpent->sp_pwdp = towhat;
-+ stmpent->sp_lstchg = time(NULL) / (60 * 60 * 24);
-+ err = 0;
-+ D(("Set password %s for %s", stmpent->sp_pwdp, forwho));
-+ }
-+
-+ if (putspent(stmpent, pwfile)) {
-+ D(("error writing entry to shadow file: %s\n", strerror(errno)));
-+ err = 1;
-+ break;
-+ }
-+
-+ stmpent = fgetspent(opwfile);
-+ }
-+ fclose(opwfile);
-+
-+ if (fclose(pwfile)) {
-+ D(("error writing entries to shadow file: %s\n", strerror(errno)));
-+ err = 1;
-+ }
-+
-+ done:
-+ if (!err) {
-+ if (rename(SH_TMPFILE, "/etc/shadow"))
-+ err = 1;
-+ }
-+
-+#ifdef WITH_SELINUX
-+ if (SELINUX_ENABLED) {
-+ if (setfscreatecon(prev_context)) {
-+ err = 1;
-+ }
-+ if (prev_context)
-+ freecon(prev_context);
-+ prev_context=NULL;
-+ }
-+#endif
-+
-+ if (!err) {
-+ return PAM_SUCCESS;
-+ } else {
-+ unlink(SH_TMPFILE);
-+ return PAM_AUTHTOK_ERR;
-+ }
-+}
-+
- int main(int argc, char *argv[])
- {
- char pass[MAXPASS + 1];
-- char option[8];
-+ char *option;
- int npass, nullok;
- int force_failure = 0;
-- int retval = UNIX_FAILED;
-+ int retval = PAM_AUTH_ERR;
- char *user;
-
- /*
-@@ -247,8 +443,7 @@
- * account).
- */
-
-- if (isatty(STDIN_FILENO)) {
--
-+ if (isatty(STDIN_FILENO) || argc != 3 ) {
- _log_err(LOG_NOTICE
- ,"inappropriate use of Unix helper binary [UID=%d]"
- ,getuid());
-@@ -256,35 +451,45 @@
- ,"This binary is not designed for running in this way\n"
- "-- the system administrator has been informed\n");
- sleep(10); /* this should discourage/annoy the user */
-- return UNIX_FAILED;
-+ return PAM_SYSTEM_ERR;
- }
-
- /*
-- * determine the current user's name is
-+ * determine the current user's name is.
-+ * On a SELinux enabled system, policy will prevent third parties
from using
-+ * unix_chkpwd as a password guesser. Leaving the existing check
prevents
-+ * su from working, Since the current uid is the users and the
password is
-+ * for root.
- */
-- user = getuidname(getuid());
-- if (argc == 2) {
-- /* if the caller specifies the username, verify that user
-- matches it */
-- if (strcmp(user, argv[1])) {
-- force_failure = 1;
-- }
-+ if (SELINUX_ENABLED) {
-+ user=argv[1];
-+ }
-+ else {
-+ user = getuidname(getuid());
-+ /* if the caller specifies the username, verify that user
-+ matches it */
-+ if (strcmp(user, argv[1])) {
-+ return PAM_AUTH_ERR;
-+ }
-+ }
-+
-+ option=argv[2];
-+
-+ if (strncmp(argv[2], "verify", 8) == 0) {
-+ /* Get the account information from the shadow file */
-+ return _verify_account(argv[1]);
-+ }
-+
-+ if (strncmp(option, "shadow", 8) == 0) {
-+ /* Attempting to change the password */
-+ return _update_shadow(argv[1]);
- }
-
- /* read the nullok/nonull option */
--
-- npass = read(STDIN_FILENO, option, 8);
--
-- if (npass < 0) {
-- _log_err(LOG_DEBUG, "no option supplied");
-- return UNIX_FAILED;
-- } else {
-- option[7] = '\0';
-- if (strncmp(option, "nullok", 8) == 0)
-- nullok = 1;
-- else
-- nullok = 0;
-- }
-+ if (strncmp(option, "nullok", 8) == 0)
-+ nullok = 1;
-+ else
-+ nullok = 0;
-
- /* read the password from stdin (a pipe from the pam_unix module) */
-
-@@ -317,10 +522,10 @@
-
- /* return pass or fail */
-
-- if ((retval != UNIX_PASSED) || force_failure) {
-- return UNIX_FAILED;
-+ if ((retval != PAM_SUCCESS) || force_failure) {
-+ return PAM_AUTH_ERR;
- } else {
-- return UNIX_PASSED;
-+ return PAM_SUCCESS;
- }
- }
-
diff --git a/security-libs/linux-pam/pam.d/other
b/security-libs/linux-pam/pam.d/other
index b89aac5..6194b80 100755
--- a/security-libs/linux-pam/pam.d/other
+++ b/security-libs/linux-pam/pam.d/other
@@ -1,7 +1,9 @@
#
-# The PAM configuration file for the `other' service
+# default configuration: /etc/pam.d/other
#
-auth required pam_unix.so
-account required pam_unix.so
-password required pam_unix.so
-session required pam_unix.so
+auth required pam_warn.so
+auth required pam_deny.so
+account required pam_deny.so
+password required pam_warn.so
+password required pam_deny.so
+session required pam_deny.so
diff --git a/security-libs/linux-pam/pam.d/rexec
b/security-libs/linux-pam/pam.d/rexec
deleted file mode 100755
index 65cb933..0000000
--- a/security-libs/linux-pam/pam.d/rexec
+++ /dev/null
@@ -1,10 +0,0 @@
-#
-# The PAM configuration file for the `rexec' service
-#
-auth requisite pam_securetty.so
-auth requisite pam_nologin.so
-auth sufficient pam_rhosts_auth.so
-auth required pam_unix.so
-account required pam_unix.so
-session required pam_unix.so
-session required pam_limits.so
diff --git a/security-libs/linux-pam/pam.d/rlogin
b/security-libs/linux-pam/pam.d/rlogin
deleted file mode 100755
index 261a970..0000000
--- a/security-libs/linux-pam/pam.d/rlogin
+++ /dev/null
@@ -1,11 +0,0 @@
-#
-# The PAM configuration file for the `rlogin' service
-# this application passes control to `login' if it fails
-#
-auth requisite pam_securetty.so
-auth requisite pam_nologin.so
-auth required pam_rhosts_auth.so
-account required pam_unix.so
-password required pam_unix.so shadow md5 nullok
-session required pam_unix.so
-session required pam_limits.so
diff --git a/security-libs/linux-pam/pam.d/rsh
b/security-libs/linux-pam/pam.d/rsh
deleted file mode 100755
index 24fc85f..0000000
--- a/security-libs/linux-pam/pam.d/rsh
+++ /dev/null
@@ -1,10 +0,0 @@
-#
-# The PAM configuration file for the `rsh' service
-#
-auth requisite pam_securetty.so
-auth requisite pam_nologin.so
-auth sufficient pam_rhosts_auth.so
-auth required pam_unix.so
-account required pam_unix.so
-session required pam_unix.so
-session required pam_limits.so
diff --git a/security-libs/linux-pam/pam.d/vlock
b/security-libs/linux-pam/pam.d/vlock
deleted file mode 100755
index b4ea08c..0000000
--- a/security-libs/linux-pam/pam.d/vlock
+++ /dev/null
@@ -1,4 +0,0 @@
-#
-# The PAM configuration file for the `vlock' service
-#
-auth required pam_unix.so




Archive powered by MHonArc 2.6.24.

Top of Page