From 513fdf69d3f9ebb0b027c7bc08dd27fffad0e6be Mon Sep 17 00:00:00 2001 From: Björn Esser Date: Sep 23 2021 09:14:32 +0000 Subject: [PATCH 1/4] pam_console: Fix race condition for BUILT_SOURCES on parallel build. Signed-off-by: Björn Esser --- diff --git a/pam_console/Makefile.am b/pam_console/Makefile.am index 5aebea5..75c89f0 100644 --- a/pam_console/Makefile.am +++ b/pam_console/Makefile.am @@ -44,6 +44,8 @@ secureconf_DATA = console.perms console.handlers FLEX_OPTS = -Cr BISON_OPTS = -d +BUILT_SOURCES = configfile.tab.h configfile.tab.c configfile.lex.c + pam_console_la_SOURCES = pam_console.c pam_console.h regerr.c handlers.c handlers.h pam_console_apply_SOURCES = pam_console_apply.c pam_console.h chmod.c modechange.c regerr.c \ configfile.c configfile.h hashtable.c hashtable.h hashtable_private.h @@ -51,15 +53,17 @@ pam_console_apply_SOURCES = pam_console_apply.c pam_console.h chmod.c modechange pam_console_la_CFLAGS = $(AM_CFLAGS) pam_console_apply_CFLAGS = $(AM_CFLAGS) @EXE_CFLAGS@ +configfile.tab.h: configfile.tab.c + configfile.tab.c: configfile.y $(YACC) $(BISON_OPTS) -o $@ -p _pc_yy $< sh $(srcdir)/sed-static $@ -configfile.lex.c: configfile.l configfile.tab.c +configfile.lex.c: configfile.l configfile.tab.h $(LEX) $(FLEX_OPTS) -o$@ -P_pc_yy $< sh $(srcdir)/sed-static $@ -configfile.c: configfile.tab.c configfile.lex.c +configfile.c: configfile.tab.h configfile.tab.c configfile.lex.c install-data-local: mkdir -p $(DESTDIR)$(secureconfdir)/console.apps From 7bd9c85b7a47dedbf42af9a22e596401b1f6a7ed Mon Sep 17 00:00:00 2001 From: Björn Esser Date: Sep 23 2021 09:14:32 +0000 Subject: [PATCH 2/4] Makefile: Use xz compression for release tarballs. Signed-off-by: Björn Esser --- diff --git a/Makefile b/Makefile index b6deddf..8914bb9 100644 --- a/Makefile +++ b/Makefile @@ -10,6 +10,6 @@ force-tag: git tag --force $(TAG) dist: - @rm -f $(TAG).tar.bz2 - git archive --format=tar --prefix=$(TAG)/ $(TAG) | bzip2 > $(TAG).tar.bz2 - @echo "The archive is in $(TAG).tar.bz2" + @rm -f $(TAG).tar.xz + git archive --format=tar --prefix=$(TAG)/ $(TAG) | xz > $(TAG).tar.xz + @echo "The archive is in $(TAG).tar.xz" From 17ff1d044f5629e7ac035e0dc244c65542e30548 Mon Sep 17 00:00:00 2001 From: Björn Esser Date: Sep 23 2021 09:14:32 +0000 Subject: [PATCH 3/4] Fix trailing white-space characters. Signed-off-by: Björn Esser --- diff --git a/CHANGELOG.pam-redhat b/CHANGELOG.pam-redhat index 30209ef..507b35c 100644 --- a/CHANGELOG.pam-redhat +++ b/CHANGELOG.pam-redhat @@ -42,7 +42,7 @@ without autoconf support. * pam_console: allow printing to multifunction devices 0.99.8-1: Mon Jul 23 2007 -* pam_console: decrement console use count properly - CVE-2007-1716 +* pam_console: decrement console use count properly - CVE-2007-1716 * pam_console: add more displays to console class * pam_console: add some firewire devices to default.perms (#240770) @@ -92,7 +92,7 @@ without autoconf support. 0.99.2-1: Tue Jan 03 2006 -* pam_console: fixed uninitialized value on broken config file +* pam_console: fixed uninitialized value on broken config file (#141053, patch by Jay Fenlason) * pam_console: man page fixes. * pam_loginuid: added option require_auditd to require auditd running (Steve Grubb). @@ -144,8 +144,8 @@ without autoconf support. * pam_console: Don't check the ownership of terminal on logout - we don't have it on X crash (tmraz) * pam_stack: Fix memory leaks (tmraz) -* pam_timestamp: Ignore the timestamp file if it's older than oldest +* pam_timestamp: Ignore the timestamp file if it's older than oldest login (tmraz) * Allow using pam_console for authentication (tmraz) -* Add a file parameter to pam_console_apply to apply its work only on +* Add a file parameter to pam_console_apply to apply its work only on that file (tmraz) diff --git a/pam_console/configfile.c b/pam_console/configfile.c index d0cba3a..6b28e58 100644 --- a/pam_console/configfile.c +++ b/pam_console/configfile.c @@ -28,11 +28,11 @@ g_slist_append(GSList *l, void *d) memb = _do_malloc(sizeof(*memb)); memb->next = NULL; memb->data = d; - + if (l == NULL) { return memb; } - + n = l; while (n->next != NULL) { n = n->next; diff --git a/pam_console/configfile.y b/pam_console/configfile.y index a298ff9..ea4a221 100644 --- a/pam_console/configfile.y +++ b/pam_console/configfile.y @@ -41,10 +41,10 @@ str_hash(unsigned char *s) { unsigned int hash = 5381; int c; - + while ((c = *s++)) hash = ((hash << 5) + hash) + c; /* hash * 33 + c */ - + return hash; } @@ -90,7 +90,7 @@ classdef: class *c; c = hashtable_search(namespace, $2); - if (c) { + if (c) { empty_class(c); } else { c = malloc(sizeof(class)); diff --git a/pam_console/console.handlers b/pam_console/console.handlers index 453cfca..c7c02c9 100644 --- a/pam_console/console.handlers +++ b/pam_console/console.handlers @@ -1,6 +1,6 @@ # /etc/security/console.handlers # -# This file is provided for configuration of handlers which will be +# This file is provided for configuration of handlers which will be # executed when user obtains console lock and when he loses it. # Additionally it is used for a configuration of console device names. # diff --git a/pam_console/console.perms.5 b/pam_console/console.perms.5 index 84e5819..cfbb0da 100644 --- a/pam_console/console.perms.5 +++ b/pam_console/console.perms.5 @@ -4,7 +4,7 @@ .SH NAME console.perms \- permissions control file for users at the system console .SH DESCRIPTION -/etc/security/console.perms and .perms files in the +/etc/security/console.perms and .perms files in the /etc/security/console.perms.d directory determine the permissions that will be given to priviledged users of the console at login time, and the permissions to which to revert when the users log out. They are diff --git a/pam_console/handlers.c b/pam_console/handlers.c index 1a94578..84d62a6 100644 --- a/pam_console/handlers.c +++ b/pam_console/handlers.c @@ -39,18 +39,18 @@ enum flags { HF_LOGFAIL, HF_WAIT, HF_SETUID, HF_TTY, HF_USER, HF_PARAM }; struct console_handler { char *executable; enum types type; - char *flags; /* this is a double zero terminated array + char *flags; /* this is a double zero terminated array allocated in one blob with executable */ struct console_handler *next; }; static struct console_handler *first_handler; -static void +static void console_free_handlers (struct console_handler *handler) { if (handler != NULL) { console_free_handlers(handler->next); - free(handler->executable); + free(handler->executable); free(handler); } } @@ -63,15 +63,15 @@ console_parse_handlers (pam_handle_t *pamh, const char *handlers_name) { int skip = 0; int rv = PAM_SESSION_ERR; struct console_handler **previous_handler_ptr; - + fh = fopen(handlers_name, "r"); if (fh == NULL) { _pam_log(pamh, LOG_ERR, FALSE, "cannot open file %s for reading", handlers_name); return rv; } - + previous_handler_ptr = &first_handler; - + while (fgets(linebuf, sizeof(linebuf), fh) != NULL) { int len; @@ -81,7 +81,7 @@ console_parse_handlers (pam_handle_t *pamh, const char *handlers_name) { char *destptr = NULL; /* needed to silence warning */ struct console_handler *handler; enum states { EXECUTABLE, TYPE, FLAGS } state; - + len = strlen(linebuf); if (linebuf[len-1] != '\n') { _pam_log(pamh, LOG_INFO, FALSE, "line too long or not ending with new line char - will be ignored"); @@ -99,17 +99,17 @@ console_parse_handlers (pam_handle_t *pamh, const char *handlers_name) { for (ptr = linebuf; isspace(*ptr); ptr++); if (*ptr == '\0') continue; - + /* something on the line */ if ((handler=calloc(sizeof(*handler), 1)) == NULL) goto fail_exit; *previous_handler_ptr = handler; previous_handler_ptr = &handler->next; - + if ((handler->executable=malloc(len-(ptr-linebuf)+1)) == NULL) { goto fail_exit; } - + state = EXECUTABLE; handler->type = UNKNOWN; while ((tokptr=strtok_r(ptr, " \t", &temp)) != NULL) { @@ -121,7 +121,7 @@ console_parse_handlers (pam_handle_t *pamh, const char *handlers_name) { else if (state == TYPE) { if (strcmp(tokptr, "lock") == 0) { handler->type = LOCK; - } + } else if (strcmp(tokptr, "unlock") == 0) { handler->type = UNLOCK; } @@ -129,7 +129,7 @@ console_parse_handlers (pam_handle_t *pamh, const char *handlers_name) { handler->type = CONSOLEDEVS; } } - + if (state == FLAGS) { strcpy(destptr, tokptr); destptr += strlen(destptr) + 1; @@ -138,11 +138,11 @@ console_parse_handlers (pam_handle_t *pamh, const char *handlers_name) { state++; } } - *destptr = '\0'; + *destptr = '\0'; } forget = fclose(fh); - return PAM_SUCCESS; + return PAM_SUCCESS; fail_exit: console_free_handlers(first_handler); @@ -285,7 +285,7 @@ execute_handler(pam_handle_t *pamh, struct console_handler *handler, const char else if (WIFSIGNALED(rv)) _pam_log(pamh, LOG_ERR, !logfail, "handler '%s' caught a signal %d", handler->executable, (int)WTERMSIG(rv)); - + return 0; } diff --git a/pam_console/hashtable.c b/pam_console/hashtable.c index 06b72c2..c9300f0 100644 --- a/pam_console/hashtable.c +++ b/pam_console/hashtable.c @@ -87,7 +87,7 @@ hashtable_expand(struct hashtable *h) h->table = newtable; } /* Plan B: realloc instead */ - else + else { newtable = (struct entry **) realloc(h->table, newsize * sizeof(struct entry *)); @@ -224,23 +224,23 @@ hashtable_destroy(struct hashtable *h, int free_kv) /* * Copyright (c) 2002, Christopher Clark * All rights reserved. - * + * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: - * + * * * Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. - * + * * * Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. - * + * * * Neither the name of the original author; nor the names of any contributors * may be used to endorse or promote products derived from this software * without specific prior written permission. - * - * + * + * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR diff --git a/pam_console/hashtable.h b/pam_console/hashtable.h index f88671c..c8aa287 100644 --- a/pam_console/hashtable.h +++ b/pam_console/hashtable.h @@ -19,7 +19,7 @@ struct hashtable; * v = (struct some_value *) malloc(sizeof(struct some_value)); * * (initialise k and v to suitable values) - * + * * if (! hashtable_insert(h,k,v) ) * { exit(-1); } * @@ -33,7 +33,7 @@ struct hashtable; /* Macros may be used to define type-safe(r) hashtable access functions, with * methods specialized to take known key and value types as parameters. - * + * * Example: * * Insert this at the start of your file: @@ -63,7 +63,7 @@ struct hashtable; /***************************************************************************** * create_hashtable - + * @name create_hashtable * @param minsize minimum initial size of hashtable * @param hashfunction function for hashing keys @@ -78,7 +78,7 @@ create_hashtable(unsigned int minsize, /***************************************************************************** * hashtable_insert - + * @name hashtable_insert * @param h the hashtable to insert into * @param k the key - hashtable claims ownership and will free on removal @@ -95,7 +95,7 @@ create_hashtable(unsigned int minsize, * If in doubt, remove before insert. */ -int +int hashtable_insert(struct hashtable *h, void *k, void *v); #define DEFINE_HASHTABLE_INSERT(fnname, keytype, valuetype) \ @@ -106,7 +106,7 @@ int fnname (struct hashtable *h, keytype *k, valuetype *v) \ /***************************************************************************** * hashtable_search - + * @name hashtable_search * @param h the hashtable to search * @param k the key to search for - does not claim ownership @@ -124,7 +124,7 @@ valuetype * fnname (struct hashtable *h, keytype *k) \ /***************************************************************************** * hashtable_remove - + * @name hashtable_remove * @param h the hashtable to remove the item from * @param k the key to search for - does not claim ownership @@ -143,7 +143,7 @@ valuetype * fnname (struct hashtable *h, keytype *k) \ /***************************************************************************** * hashtable_count - + * @name hashtable_count * @param h the hashtable * @return the number of items stored in the hashtable @@ -154,7 +154,7 @@ hashtable_count(struct hashtable *h); /***************************************************************************** * hashtable_destroy - + * @name hashtable_destroy * @param h the hashtable * @param free_values whether to call 'free' on the remaining values @@ -168,23 +168,23 @@ hashtable_destroy(struct hashtable *h, int free_values); /* * Copyright (c) 2002, Christopher Clark * All rights reserved. - * + * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: - * + * * * Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. - * + * * * Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. - * + * * * Neither the name of the original author; nor the names of any contributors * may be used to endorse or promote products derived from this software * without specific prior written permission. - * - * + * + * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR diff --git a/pam_console/hashtable_private.h b/pam_console/hashtable_private.h index 3e95f60..3a558e6 100644 --- a/pam_console/hashtable_private.h +++ b/pam_console/hashtable_private.h @@ -54,23 +54,23 @@ indexFor(unsigned int tablelength, unsigned int hashvalue) /* * Copyright (c) 2002, Christopher Clark * All rights reserved. - * + * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: - * + * * * Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. - * + * * * Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. - * + * * * Neither the name of the original author; nor the names of any contributors * may be used to endorse or promote products derived from this software * without specific prior written permission. - * - * + * + * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR diff --git a/pam_console/pam_console.c b/pam_console/pam_console.c index 10a7f00..6de9abb 100644 --- a/pam_console/pam_console.c +++ b/pam_console/pam_console.c @@ -191,7 +191,7 @@ check_console_name(pam_handle_t *pamh, const char *consolename, int nonroot_ok, if (!found) { /* not found */ _pam_log(pamh, LOG_INFO, TRUE, "no matching console regex found"); - return 0; + return 0; } /* add some policy here -- not really the PAM way of doing things, but @@ -218,7 +218,7 @@ check_console_name(pam_handle_t *pamh, const char *consolename, int nonroot_ok, int l; char *dot = NULL; char *path = full_path + 1; - + full_path[0] = '\0'; strcpy(path, "/tmp/.X11-unix/X"); l = sizeof(full_path) - 2 - strlen(path); @@ -239,7 +239,7 @@ check_console_name(pam_handle_t *pamh, const char *consolename, int nonroot_ok, } else if (!on_set) { /* there is no X11 socket in case of X11 crash */ _pam_log(pamh, LOG_DEBUG, TRUE, "can't find X11 socket to examine for %s probably due to X crash", consolename); - statted = 1; + statted = 1; } } @@ -561,9 +561,9 @@ pam_sm_open_session(pam_handle_t *pamh, int flags UNUSED, } /* get configuration */ - if (!configfileparsed) { + if (!configfileparsed) { console_parse_handlers(pamh, consolehandlers); - configfileparsed = 1; + configfileparsed = 1; } /* return success quietly if not a terminal login */ @@ -582,7 +582,7 @@ pam_sm_open_session(pam_handle_t *pamh, int flags UNUSED, /* errors will be logged and are not critical */ console_run_handlers(pamh, TRUE, username, tty); } - + free(lockfile); return ret; } @@ -655,7 +655,7 @@ pam_sm_close_session(pam_handle_t *pamh, int flags UNUSED, if (pam_modutil_read (fd, consoleuser, st.st_size) == -1) { _pam_log(pamh, LOG_ERR, FALSE, "\"impossible\" read error on %s", consolelock); - err = PAM_SESSION_ERR; + err = PAM_SESSION_ERR; close(fd); goto decrement; } diff --git a/pam_console/pam_console_apply.8 b/pam_console/pam_console_apply.8 index 46827a6..f069bc3 100644 --- a/pam_console/pam_console_apply.8 +++ b/pam_console/pam_console_apply.8 @@ -3,7 +3,7 @@ .SH NAME pam_console_apply \- set or revoke permissions for users at the system console .SH SYNOPSIS -.B pam_console_apply +.B pam_console_apply [-f ] [-c ] [-r] [-t ] [-s] [-d] [ ...] .SH DESCRIPTION \fBpam_console_apply\fP is a helper executable which sets or resets permissions diff --git a/pam_console/pam_console_apply.c b/pam_console/pam_console_apply.c index f4c88fd..ad33660 100644 --- a/pam_console/pam_console_apply.c +++ b/pam_console/pam_console_apply.c @@ -107,10 +107,10 @@ main(int argc, char **argv) case 'r': sense = Reset; break; - case 's': + case 's': syslogging = TRUE; break; - case 'd': + case 'd': debug = TRUE; break; default: @@ -132,7 +132,7 @@ main(int argc, char **argv) parse_files(); else parse_file(consoleperms); - + if (sense != Reset && (fd=open(consolelock, O_RDONLY)) != -1) { if (fstat (fd, &st)) { _pam_log(NULL, LOG_ERR, FALSE, From 614ce9985c1d5789b47026a42f2fe150b3e89d88 Mon Sep 17 00:00:00 2001 From: Björn Esser Date: Sep 23 2021 09:15:35 +0000 Subject: [PATCH 4/4] New release 1.1.5 Signed-off-by: Björn Esser --- diff --git a/CHANGELOG.pam-redhat b/CHANGELOG.pam-redhat index 507b35c..e405ec0 100644 --- a/CHANGELOG.pam-redhat +++ b/CHANGELOG.pam-redhat @@ -4,6 +4,11 @@ Changelog of pam-redhat modules This changelog describes only changes after branching of pam-redhat modules without autoconf support. +1.1.5: Thu Sep 23 2021 +* pam_console: fix covscan issues +* pam_console: Fix race condition for BUILT_SOURCES on parallel build +* Makefile: Use xz compression for release tarballs + 1.1.4: Wed Nov 11 2020 * pam_console: update compilation flags diff --git a/Makefile b/Makefile index 8914bb9..7455914 100644 --- a/Makefile +++ b/Makefile @@ -1,4 +1,4 @@ -VERSION=1.1.4 +VERSION=1.1.5 TAG=pam-redhat-$(VERSION) nothing: