through months of testing only to show up within hours of release.
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@611 185d5e19-27fe-0310-9dcf-9bff6b9f3609
apparently didn't do it consistently. For some reason, it built fine on
one of my dev machines, but nowhere else.
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@604 185d5e19-27fe-0310-9dcf-9bff6b9f3609
that searches for it. If the service name contains a path separator
character, treat it is a relative or absolute path to the policy file.
This need to be documented either in pam.conf(5) or in pam_start(3) once
the feature mechanism is no longer experimental.
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@600 185d5e19-27fe-0310-9dcf-9bff6b9f3609
Use it to control policy and module file checks. The default settings
correspond to the current behavior: disallow path separators in policy
names, but allow them in module names; verify ownership and permissions
for both policy files and modules.
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@594 185d5e19-27fe-0310-9dcf-9bff6b9f3609
but within a double-quoted string, it is a line continuation.
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@585 185d5e19-27fe-0310-9dcf-9bff6b9f3609
Fix line continuation (newline is stripped, not quoted)
Further improve the documentation
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@567 185d5e19-27fe-0310-9dcf-9bff6b9f3609
If the first character encountered is a quote, immediately allocate a
single byte. This way, if the word we've started reading is actually
an empty quoted string ('' or ""), we correctly return an empty string
instead of NULL.
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@553 185d5e19-27fe-0310-9dcf-9bff6b9f3609
trailing whitespace, openpam_readword() should *always* push back the
last character read (which is a no-op in the EOF case).
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@550 185d5e19-27fe-0310-9dcf-9bff6b9f3609
string, reallocating the string if necessary.
Add an openpam_readword() function that reads a single word from a
file according to the usual shell quoting rules.
Add an openpam_readlinev() function that uses openpam_readword() to
read an entire line and return a list of the words it contained.
Rewrite openpam_parse_chain() using openpam_readlinev(), which greatly
simplifies the code and ensures correct parsing of module option.
Thanks to Maëlle Lesage for pointing out the issue and writing an
early version of what became the main loop in openpam_readword().
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@547 185d5e19-27fe-0310-9dcf-9bff6b9f3609
version of openpam_log() that's actually used. Internal debugging
messages therefore went to the default case and were logged as errors,
spamming /var/log/messages and the console.
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@544 185d5e19-27fe-0310-9dcf-9bff6b9f3609
reasons, it is easier to use the 3-clause BSD license even for new
additions to OpenPAM.
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@543 185d5e19-27fe-0310-9dcf-9bff6b9f3609
which will cause syslog() to log the wrong error message if the format
string contains %m.
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@537 185d5e19-27fe-0310-9dcf-9bff6b9f3609
Move prototype from "opempam_impl.h" to <security/openpam.h>.
Generate openpam_straddch(3) man page.
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@535 185d5e19-27fe-0310-9dcf-9bff6b9f3609
determine whether to stop searching for a policy. After r487,
multiple policies for the same service would be concatenated, whereas
the intention was that the one that came first in the policy path
should eclipse the others.
While there, take the time to reorganize the front end of the policy
loading code, both to clarify the logic and to produce better log
messages in case of errors. The most important change is that
openpam_load_chain() now opens and vets the policy file before calling
openpam_parse_chain(), so it is better able to distinguish between
errors relating to the file itself and errors relating to its
contents.
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@524 185d5e19-27fe-0310-9dcf-9bff6b9f3609
is currently equivalent to PAM_LOG_DEBUG, and is used only by the
library call tracing macros (ENTER*() and RETURN*()). It should
eventually replace PAM_LOG_DEBUG throughout the library, except
perhaps for a few particularly interesting messages; PAM_LOG_DEBUG
will be reserved for modules.
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@522 185d5e19-27fe-0310-9dcf-9bff6b9f3609
the requested primitive. This is a significant change, but it should
only affect poorly-written PAM modules, and the alternative is a
potential fail-open situation.
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@501 185d5e19-27fe-0310-9dcf-9bff6b9f3609
Dag-Erling Smørgrav