[linux-pam] pam_unix: fix build in --enable-selinux mode
by Dmitry V. Levin
commit 0603b28023ebe44151466bfb33c60687922e0b0b
Author: Dmitry V. Levin <ldv(a)altlinux.org>
Date: Wed Oct 10 18:13:07 2012 +0000
pam_unix: fix build in --enable-selinux mode
glibc's <sys/wait.h> starting with commit
http://sourceware.org/git/?p=glibc.git;a=commitdiff;h=glibc-2.15-231-gd94...
does not include <sys/resource.h> for POSIX 2008 conformance reasons, so
when pam is being built with SELinux support enabled, pam_unix_passwd.c
uses getrlimit(2) and therefore should include <sys/resource.h> without
relying on other headers.
* modules/pam_unix/pam_unix_passwd.c: Include <sys/resource.h>.
Reported-by: Guido Trentalancia <guido(a)trentalancia.com>
Reported-by: "Jory A. Pratt" <anarchy(a)gentoo.org>
Reported-by: Diego Elio Pettenò <flameeyes(a)flameeyes.eu>
modules/pam_unix/pam_unix_passwd.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
---
diff --git a/modules/pam_unix/pam_unix_passwd.c b/modules/pam_unix/pam_unix_passwd.c
index 9e1302d..94bc3ec 100644
--- a/modules/pam_unix/pam_unix_passwd.c
+++ b/modules/pam_unix/pam_unix_passwd.c
@@ -58,6 +58,7 @@
#include <signal.h>
#include <errno.h>
#include <sys/wait.h>
+#include <sys/resource.h>
#include <security/_pam_macros.h>
11 years, 6 months
[linux-pam] pam_namespace: add mntopts flag for tmpfs mount options
by Tomáš Mráz
commit fbcbb0e302b0c7561e565531b47fba9477b238ba
Author: Tomas Mraz <tmraz(a)fedoraproject.org>
Date: Wed Oct 10 19:46:02 2012 +0200
pam_namespace: add mntopts flag for tmpfs mount options
modules/pam_namespace/pam_namespace.h: Add mount_opts member to polydir
structure.
modules/pam_namespace/pam_namespace.c (del_polydir): Free the mount_opts.
(parse_method): Parse the mntopts flag.
(ns_setup): Pass the mount_opts to mount().
modules/pam_namespace/namespace.conf.5.xml: Document the mntopts flag.
modules/pam_namespace/namespace.conf.5.xml | 8 ++++++++
modules/pam_namespace/pam_namespace.c | 21 ++++++++++++++++++---
modules/pam_namespace/pam_namespace.h | 2 ++
3 files changed, 28 insertions(+), 3 deletions(-)
---
diff --git a/modules/pam_namespace/namespace.conf.5.xml b/modules/pam_namespace/namespace.conf.5.xml
index 673099b..c7698cb 100644
--- a/modules/pam_namespace/namespace.conf.5.xml
+++ b/modules/pam_namespace/namespace.conf.5.xml
@@ -119,6 +119,14 @@
contain the user name and will be shared among all users.
</para>
+ <para><emphasis>mntopts</emphasis>=<replaceable>value</replaceable>
+ - value of this flag is passed to the mount call when the tmpfs mount is
+ done. It allows for example the specification of the maximum size of the
+ tmpfs instance that is created by the mount call. See <citerefentry>
+ <refentrytitle>mount</refentrytitle><manvolnum>8</manvolnum>
+ </citerefentry> for details.
+ </para>
+
<para>
The directory where polyinstantiated instances are to be
created, must exist and must have, by default, the mode of 0000. The
diff --git a/modules/pam_namespace/pam_namespace.c b/modules/pam_namespace/pam_namespace.c
index a40f05e..e0d5e30 100644
--- a/modules/pam_namespace/pam_namespace.c
+++ b/modules/pam_namespace/pam_namespace.c
@@ -64,6 +64,7 @@ static void del_polydir(struct polydir_s *poly)
if (poly) {
free(poly->uid);
free(poly->init_script);
+ free(poly->mount_opts);
free(poly);
}
}
@@ -237,9 +238,9 @@ static int parse_method(char *method, struct polydir_s *poly,
static const char *method_names[] = { "user", "context", "level", "tmpdir",
"tmpfs", NULL };
static const char *flag_names[] = { "create", "noinit", "iscript",
- "shared", NULL };
+ "shared", "mntopts", NULL };
static const unsigned int flag_values[] = { POLYDIR_CREATE, POLYDIR_NOINIT,
- POLYDIR_ISCRIPT, POLYDIR_SHARED };
+ POLYDIR_ISCRIPT, POLYDIR_SHARED, POLYDIR_MNTOPTS };
int i;
char *flag;
@@ -279,6 +280,20 @@ static int parse_method(char *method, struct polydir_s *poly,
return -1;
};
break;
+
+ case POLYDIR_MNTOPTS:
+ if (flag[namelen] != '=')
+ break;
+ if (poly->method != TMPFS) {
+ pam_syslog(idata->pamh, LOG_WARNING, "Mount options applicable only to tmpfs method");
+ break;
+ }
+ free(poly->mount_opts); /* if duplicate mntopts specified */
+ if ((poly->mount_opts = strdup(flag+namelen+1)) == NULL) {
+ pam_syslog(idata->pamh, LOG_CRIT, "Memory allocation error");
+ return -1;
+ }
+ break;
}
}
}
@@ -1464,7 +1479,7 @@ static int ns_setup(struct polydir_s *polyptr,
}
if (polyptr->method == TMPFS) {
- if (mount("tmpfs", polyptr->dir, "tmpfs", 0, NULL) < 0) {
+ if (mount("tmpfs", polyptr->dir, "tmpfs", 0, polyptr->mount_opts) < 0) {
pam_syslog(idata->pamh, LOG_ERR, "Error mounting tmpfs on %s, %m",
polyptr->dir);
return PAM_SESSION_ERR;
diff --git a/modules/pam_namespace/pam_namespace.h b/modules/pam_namespace/pam_namespace.h
index 51d2388..47ebcc3 100644
--- a/modules/pam_namespace/pam_namespace.h
+++ b/modules/pam_namespace/pam_namespace.h
@@ -116,6 +116,7 @@
#define POLYDIR_NOINIT 0x00000004 /* no init script */
#define POLYDIR_SHARED 0x00000008 /* share context/level instances among users */
#define POLYDIR_ISCRIPT 0x00000010 /* non default init script */
+#define POLYDIR_MNTOPTS 0x00000020 /* mount options for tmpfs mount */
#define NAMESPACE_MAX_DIR_LEN 80
@@ -164,6 +165,7 @@ struct polydir_s {
uid_t *uid; /* list of override uids */
unsigned int flags; /* polydir flags */
char *init_script; /* path to init script */
+ char *mount_opts; /* mount options for tmpfs mount */
uid_t owner; /* user which should own the polydir */
gid_t group; /* group which should own the polydir */
mode_t mode; /* mode of the polydir */
11 years, 6 months
[linux-pam] Created tag v1.1.6
by Dmitry V. Levin
The signed tag 'v1.1.6' was created.
Tagger: Dmitry V. Levin <ldv(a)altlinux.org>
Date: Fri Aug 17 09:48:15 2012 +0000
Linux-PAM 1.1.6 release
Changes since the last tag 'Linux-PAM-1_1_5':
Dmitry V. Levin (18):
Fix whitespace issues
Rename all .cvsignore files to .gitignore
Remove modules/pam_timestamp/hmacfile from distribution
Fix "make distcheck"
Generate ChangeLog from git log
Create release tarballs using safe ownership and permissions
Remove generated files
Move generated auxiliary files to build-aux directory
Update .gitignore files
Fix usage of LIBADD, LDADD and LDFLAGS
Use libpam.la/libpam_misc.la to link with -lpam/-lpam_misc
pam_selinux.c: rewrite using pam_get_data/pam_set_data
pam_selinux.c: add "restore" option
pam_selinux.8.xml: update
pam_start: fix memory leak on error path
Fix SUBDIRS for --enable-static-modules mode
Make --disable-cracklib compatible with --enable-static-modules mode
pam_unix: make configuration consistent in --enable-static-modules mode
Matveychikov Ilya (2):
configure: fix typo in --disable-nis help string
Fix compile time errors in --enable-static-modules mode
Paul Wouters (1):
Check for crypt() failure returning NULL.
Stevan Bajić (1):
RLIMIT_* variables are no longer defined unless you explicitly include sys/resource.h.
Thorsten Kukuk (2):
Small documentation and define fixes
release version 1.1.6
Tomas Mraz (18):
Fix matching of usernames in the pam_unix remember feature.
Merge branch 'master' of ssh://git.fedorahosted.org/git/linux-pam
Add possibility to match ruser, rhost, and tty in pam_succeed_if.
Make / mount as rslave instead of bind mounting polydirs.
Do not unmount anything by default in pam_namespace close session call.
Add missing includes for types used in the pam_modutil.h.
pam_lastlog: add possibility to lock out inactive users in auth or account
pam_lastlog: Never lock out the root account.
pam_cracklib: Add maxclassrepeat, gecoscheck checks and remove unused difignore.
pam_cracklib: Add enforce_for_root option.
pam_pwhistory: Always record the old password even when root changes it.
Pulled new translations from Transifex.
pam_timestamp: Fix copy&paste error in manpage.
pam_cracklib: Add monotonic character sequence checking.
pam_umask: correct the documentation of GECOS field parsing
New autotools do not create empty directories on install.
Document limits.d also in the limits.conf manpage.
Respect PAM_AUTHTOK_TYPE in pam_get_authtok_verify().
11 years, 6 months