0a4f5e9af7
Credit Don Lewis and Gleb Smirnoff for their assistance with tracking
...
down the recent openpam_configure() and openpam_dynamic() issues.
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@526 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2012-01-11 00:47:45 +00:00
cf0963e668
Improve error messages by logging the full path of the module we tried
...
to load rather than just the module name.
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@525 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2012-01-11 00:45:09 +00:00
c3d9f63b55
Fix a regression introduced by r487. The count was actually used to
...
determine whether to stop searching for a policy. After r487,
multiple policies for the same service would be concatenated, whereas
the intention was that the one that came first in the policy path
should eclipse the others.
While there, take the time to reorganize the front end of the policy
loading code, both to clarify the logic and to produce better log
messages in case of errors. The most important change is that
openpam_load_chain() now opens and vets the policy file before calling
openpam_parse_chain(), so it is better able to distinguish between
errors relating to the file itself and errors relating to its
contents.
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@524 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2012-01-11 00:29:48 +00:00
88a6cda1a1
Reluctantly document PAM_LOG_LIBDEBUG.
...
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@523 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2012-01-11 00:15:24 +00:00
b616ada557
Add another log level, PAM_LOG_LIBDEBUG, with a negative priority. It
...
is currently equivalent to PAM_LOG_DEBUG, and is used only by the
library call tracing macros (ENTER*() and RETURN*()). It should
eventually replace PAM_LOG_DEBUG throughout the library, except
perhaps for a few particularly interesting messages; PAM_LOG_DEBUG
will be reserved for modules.
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@522 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2012-01-11 00:13:25 +00:00
df3d585d08
Reduce log spam.
...
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@521 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2012-01-11 00:03:18 +00:00
34c9fb6fd3
Only call dlerror() after dlsym() failed.
...
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@520 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2012-01-10 23:57:31 +00:00
31e9142afc
Verify that the target is a regular file.
...
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@519 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2012-01-10 23:50:03 +00:00
407565fc1d
The name of the default policy is (and always has been) "other", not
...
"default".
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@518 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2012-01-10 22:38:13 +00:00
255c7f6727
Detect fdlopen(3)
...
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@517 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2012-01-10 21:26:49 +00:00
8c2f4c74b7
Use fdlopen(3) if it is available.
...
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@516 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2012-01-10 21:26:34 +00:00
8f8a8584fc
Correct usage string
...
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@515 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2012-01-10 21:22:57 +00:00
ca0b4cb0c7
Generate Trac-compatible wiki text for each release from HISTORY.
...
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@514 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2012-01-10 21:16:05 +00:00
fb9c3dcdf5
Normalize whitespace
...
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@513 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2012-01-10 21:05:42 +00:00
41bb288744
The only place RETURNP() is used returns a non-const pointer.
...
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@511 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2012-01-09 13:25:09 +00:00
596b3af085
Use a different default prompt if PAM_RHOST != PAM_HOST.
...
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@510 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2011-12-31 13:14:23 +00:00
8ec4a16273
Don't log an error message if the file does not exist.
...
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@509 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2011-12-22 17:18:53 +00:00
8372b71ce1
Add Matthias Drochner - I wish I'd remembered to do so before I rolled
...
Lycopsida.
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@508 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2011-12-18 17:07:53 +00:00
e630a92713
--with-doc defaults to yes
...
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@507 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2011-12-18 14:43:40 +00:00
59dc4aa601
Update release notes for Lycopsida
...
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@506 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2011-12-18 14:25:12 +00:00
3f02bd9df6
Set version number and release name
...
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@505 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2011-12-18 14:13:08 +00:00
4aca0ed827
Set release date
...
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@504 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2011-12-18 14:11:12 +00:00
95ed7f5d0c
Style / consistency
...
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@503 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2011-12-18 14:00:33 +00:00
dd498bc7ad
Use openpam_check_path_owner_perms()
...
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@502 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2011-12-18 13:59:22 +00:00
996a845863
Report an error if one of the modules in the chain does not implement
...
the requested primitive. This is a significant change, but it should
only affect poorly-written PAM modules, and the alternative is a
potential fail-open situation.
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@501 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2011-12-07 01:28:05 +00:00
229c006c86
Forgotten in previous commit: check the ownership and permissions of the
...
policy file.
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@500 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2011-11-22 12:07:03 +00:00
1a4edb80d7
Factor out and improve the module ownership / permission check, and add
...
a similar (but race-proof) check for the policy file.
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@499 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2011-11-22 11:51:50 +00:00
2b025676c7
Document increased input validation, and credit Sebastian Krahmer for
...
bringing the issue to my attention.
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@498 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2011-11-21 16:27:04 +00:00
b9f0b632da
Validate the service name, closing an attack vector for programs like
...
kcheckpass that let the user specify which policy to apply. See
<URL:http://c-skills.blogspot.com/2011/11/openpam-trickery.html >.
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@497 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2011-11-21 16:25:49 +00:00
026c898ec5
Disallow changing the service name.
...
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@496 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2011-11-21 16:20:45 +00:00
0e65fdb799
Document the module ownership / permissions test.
...
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@495 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2011-11-20 03:03:22 +00:00
d9f7580763
nit
...
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@494 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2011-11-20 02:58:34 +00:00
d98f755c25
Refuse to load a module if it is owned by anyone else than root or the
...
arbitrator or it is writable by group or other.
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@493 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2011-11-20 02:28:15 +00:00
b011e58526
dst can't be const, you idiot.
...
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@492 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2011-11-20 02:04:17 +00:00
6a92548403
Reorganize the headers and centralize the string tables.
...
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@491 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2011-11-12 00:12:32 +00:00
ff73a20a84
Add a strlcpy(3) implementation.
...
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@490 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2011-11-11 03:04:46 +00:00
e8522c7fcc
Always create optv, even if there are no options.
...
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@488 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2011-11-05 20:50:15 +00:00
c86a681052
The count was never used, so ditch it and return plain PAM error codes
...
instead.
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@487 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2011-11-05 20:00:46 +00:00
2603985187
Document quoted option values.
...
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@486 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2011-11-03 16:58:05 +00:00
8b3eca4161
Document quoted option values.
...
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@485 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2011-11-03 16:57:37 +00:00
ba7de9c9c6
Remove debugging code.
...
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@484 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2011-11-03 16:47:26 +00:00
493804d19b
Fix a couple of bugs in the option string reassembly code.
...
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@483 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2011-11-03 16:46:20 +00:00
6835696a2a
Revert large parts of r478. I had forgotten that the module arguments
...
are actually passed to each service function in the classic (argc,
argv) form. The only place where the compiler could have caught this
used a type cast, and it did not show up in testing either because all
of the modules I tested use openpam_get_option(3) instead of
manipulating argv directly.
The cleaned-up policy parsing code remains in place, but options are
once more stored as strings, pretty much the way they appear in the
policy file, except that quotes are stripped.
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@482 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2011-11-03 16:33:02 +00:00
c16faba34e
The include directive expects a service name, not a filename.
...
While there, remember to check for trailing garbage.
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@481 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2011-11-03 16:09:22 +00:00
28c2e4049f
past tense
...
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@480 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2011-11-03 15:55:56 +00:00
b373991f87
namespace violation mumble mumble
...
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@479 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2011-11-03 15:40:15 +00:00
55f6a50684
Major overhaul of the policy parser to support quoted option values. As a
...
bonus, it should now be much easier to read and understand.
This also changes the way options are stored: they are now stored as a list
of { key, value } pairs rather than "key=value" strings.
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@478 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2011-11-03 15:39:18 +00:00
11b10d0991
Minor simplification.
...
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@477 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2011-11-03 15:30:34 +00:00
d40a8fb860
"facility" is more appropriate than "function class"
...
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@476 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2011-11-03 15:30:03 +00:00
9b234e1f88
Provide strlcmp(3) internally on systems that don't already have it.
...
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@475 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2011-11-03 15:29:24 +00:00
Dag-Erling Smørgrav