[linux-pam] Support alternative "vendor configuration" files as fallback to /etc (Ticket#34, patch from ay Sieve
by kukuk
commit 10b83ef224a5e9c3e2663b3f08dd17090acc58ab
Author: Thorsten Kukuk <kukuk(a)thkukuk.de>
Date: Wed Mar 25 15:00:38 2015 +0100
Support alternative "vendor configuration" files as fallback to /etc
(Ticket#34, patch from ay Sievers <kay(a)vrfy.org>)
* doc/man/pam.8.xml: document additonal config directory
* libpam/pam_handlers.c: add /usr/lib/pam.d as config file fallback directory
* libpam/pam_private.h: adjust defines
doc/man/pam.8.xml | 18 +++++++
libpam/pam_handlers.c | 124 ++++++++++++++++++++++++++++++++-----------------
libpam/pam_private.h | 9 ++--
3 files changed, 105 insertions(+), 46 deletions(-)
---
diff --git a/doc/man/pam.8.xml b/doc/man/pam.8.xml
index 1267f01..d36baae 100644
--- a/doc/man/pam.8.xml
+++ b/doc/man/pam.8.xml
@@ -52,6 +52,14 @@
<filename>/etc/pam.conf</filename>.
</para>
+ <para>
+ Vendor-supplied PAM configuration files might be installed in
+ the system directory <filename>/usr/lib/pam.d/</filename> instead
+ of the machine configuration directory <filename>/etc/pam.d/</filename>.
+ If no machine configuration file is found, the vendor-supplied file
+ is used. All files in <filename>/etc/pam.d/</filename> override
+ files with the same name in <filename>/usr/lib/pam.d/</filename>.
+ </para>
<para>From the point of view of the system administrator, for whom this
manual is provided, it is not of primary importance to understand the
@@ -140,6 +148,16 @@ closing hook for modules to affect the services available to a user.</para>
</para>
</listitem>
</varlistentry>
+ <varlistentry>
+ <term><filename>/usr/lib/pam.d</filename></term>
+ <listitem>
+ <para>
+ the <emphasis remap='B'>Linux-PAM</emphasis> vendor configuration
+ directory. Files in <filename>/etc/pam.d</filename> override
+ files with the same name in this directory.
+ </para>
+ </listitem>
+ </varlistentry>
</variablelist>
</refsect1>
diff --git a/libpam/pam_handlers.c b/libpam/pam_handlers.c
index df3a1d9..bc3fd9d 100644
--- a/libpam/pam_handlers.c
+++ b/libpam/pam_handlers.c
@@ -274,6 +274,66 @@ static int _pam_parse_conf_file(pam_handle_t *pamh, FILE *f
return ( (x < 0) ? PAM_ABORT:PAM_SUCCESS );
}
+static int
+_pam_open_config_file(pam_handle_t *pamh
+ , const char *service
+ , char **path
+ , FILE **file)
+{
+ char *p;
+ FILE *f;
+ int err = 0;
+
+ /* Absolute path */
+ if (service[0] == '/') {
+ p = _pam_strdup(service);
+ if (p == NULL) {
+ pam_syslog(pamh, LOG_CRIT, "strdup failed");
+ return PAM_BUF_ERR;
+ }
+
+ f = fopen(service, "r");
+ if (f != NULL) {
+ *path = p;
+ *file = f;
+ return PAM_SUCCESS;
+ }
+
+ _pam_drop(p);
+ return PAM_ABORT;
+ }
+
+ /* Local Machine Configuration /etc/pam.d/ */
+ if (asprintf (&p, PAM_CONFIG_DF, service) < 0) {
+ pam_syslog(pamh, LOG_CRIT, "asprintf failed");
+ return PAM_BUF_ERR;
+ }
+ D(("opening %s", p));
+ f = fopen(p, "r");
+ if (f != NULL) {
+ *path = p;
+ *file = f;
+ return PAM_SUCCESS;
+ }
+
+ /* System Configuration /usr/lib/pam.d/ */
+ _pam_drop(p);
+ if (asprintf (&p, PAM_CONFIG_DIST_DF, service) < 0) {
+ pam_syslog(pamh, LOG_CRIT, "asprintf failed");
+ return PAM_BUF_ERR;
+ }
+ D(("opening %s", p));
+ f = fopen(p, "r");
+ if (f != NULL) {
+ *path = p;
+ *file = f;
+ return PAM_SUCCESS;
+ }
+ _pam_drop(p);
+
+ return PAM_ABORT;
+}
+
static int _pam_load_conf_file(pam_handle_t *pamh, const char *config_name
, const char *service /* specific file */
, int module_type /* specific type */
@@ -284,7 +344,7 @@ static int _pam_load_conf_file(pam_handle_t *pamh, const char *config_name
)
{
FILE *f;
- char *config_path = NULL;
+ char *path = NULL;
int retval = PAM_ABORT;
D(("_pam_load_conf_file called"));
@@ -297,39 +357,29 @@ static int _pam_load_conf_file(pam_handle_t *pamh, const char *config_name
if (config_name == NULL) {
D(("no config file supplied"));
- pam_syslog(pamh, LOG_ERR, "(%s) no config file supplied", service);
+ pam_syslog(pamh, LOG_ERR, "(%s) no config name supplied", service);
return PAM_ABORT;
}
- if (config_name[0] != '/') {
- if (asprintf (&config_path, PAM_CONFIG_DF, config_name) < 0) {
- pam_syslog(pamh, LOG_CRIT, "asprintf failed");
- return PAM_BUF_ERR;
- }
- config_name = config_path;
- }
-
- D(("opening %s", config_name));
- f = fopen(config_name, "r");
- if (f != NULL) {
+ if (_pam_open_config_file(pamh, config_name, &path, &f) == PAM_SUCCESS) {
retval = _pam_parse_conf_file(pamh, f, service, module_type, stack_level
#ifdef PAM_READ_BOTH_CONFS
, not_other
#endif /* PAM_READ_BOTH_CONFS */
);
- fclose(f);
if (retval != PAM_SUCCESS)
pam_syslog(pamh, LOG_ERR,
"_pam_load_conf_file: error reading %s: %s",
- config_name, pam_strerror(pamh, retval));
+ path, pam_strerror(pamh, retval));
+ _pam_drop(path);
+ fclose(f);
} else {
D(("unable to open %s", config_name));
pam_syslog(pamh, LOG_ERR,
- "_pam_load_conf_file: unable to open %s",
+ "_pam_load_conf_file: unable to open config for %s",
config_name);
}
- _pam_drop(config_path);
return retval;
}
@@ -396,39 +446,31 @@ int _pam_init_handlers(pam_handle_t *pamh)
struct stat test_d;
/* Is there a PAM_CONFIG_D directory? */
- if ( stat(PAM_CONFIG_D, &test_d) == 0 && S_ISDIR(test_d.st_mode) ) {
- char *filename;
+ if ((stat(PAM_CONFIG_D, &test_d) == 0 && S_ISDIR(test_d.st_mode)) ||
+ (stat(PAM_CONFIG_DIST_D, &test_d) == 0 && S_ISDIR(test_d.st_mode))) {
+ char *path = NULL;
int read_something=0;
- D(("searching " PAM_CONFIG_D " for config files"));
- if (asprintf(&filename, PAM_CONFIG_DF, pamh->service_name) < 0) {
- pam_syslog(pamh, LOG_ERR,
- "_pam_init_handlers: no memory; service %s",
- pamh->service_name);
- return PAM_BUF_ERR;
- }
- D(("opening %s", filename));
- f = fopen(filename, "r");
- if (f != NULL) {
- /* would test magic here? */
+ if (_pam_open_config_file(pamh, pamh->service_name, &path, &f) == PAM_SUCCESS) {
retval = _pam_parse_conf_file(pamh, f, pamh->service_name,
PAM_T_ANY, 0
#ifdef PAM_READ_BOTH_CONFS
, 0
#endif /* PAM_READ_BOTH_CONFS */
);
- fclose(f);
if (retval != PAM_SUCCESS) {
pam_syslog(pamh, LOG_ERR,
"_pam_init_handlers: error reading %s",
- filename);
+ path);
pam_syslog(pamh, LOG_ERR, "_pam_init_handlers: [%s]",
pam_strerror(pamh, retval));
} else {
read_something = 1;
}
+ _pam_drop(path);
+ fclose(f);
} else {
- D(("unable to open %s", filename));
+ D(("unable to open configuration for %s", pamh->service_name));
#ifdef PAM_READ_BOTH_CONFS
D(("checking %s", PAM_CONFIG));
@@ -443,14 +485,11 @@ int _pam_init_handlers(pam_handle_t *pamh)
* use "other"
*/
}
- _pam_drop(filename);
if (retval == PAM_SUCCESS) {
- /* now parse the PAM_DEFAULT_SERVICE_FILE */
+ /* now parse the PAM_DEFAULT_SERVICE */
- D(("opening %s", PAM_DEFAULT_SERVICE_FILE));
- f = fopen(PAM_DEFAULT_SERVICE_FILE, "r");
- if (f != NULL) {
+ if (_pam_open_config_file(pamh, PAM_DEFAULT_SERVICE, &path, &f) == PAM_SUCCESS) {
/* would test magic here? */
retval = _pam_parse_conf_file(pamh, f, PAM_DEFAULT_SERVICE,
PAM_T_ANY, 0
@@ -458,22 +497,23 @@ int _pam_init_handlers(pam_handle_t *pamh)
, 0
#endif /* PAM_READ_BOTH_CONFS */
);
- fclose(f);
if (retval != PAM_SUCCESS) {
pam_syslog(pamh, LOG_ERR,
"_pam_init_handlers: error reading %s",
- PAM_DEFAULT_SERVICE_FILE);
+ path);
pam_syslog(pamh, LOG_ERR,
"_pam_init_handlers: [%s]",
pam_strerror(pamh, retval));
} else {
read_something = 1;
}
+ _pam_drop(path);
+ fclose(f);
} else {
- D(("unable to open %s", PAM_DEFAULT_SERVICE_FILE));
+ D(("unable to open %s", PAM_DEFAULT_SERVICE));
pam_syslog(pamh, LOG_ERR,
"_pam_init_handlers: no default config %s",
- PAM_DEFAULT_SERVICE_FILE);
+ PAM_DEFAULT_SERVICE);
}
if (!read_something) { /* nothing read successfully */
retval = PAM_ABORT;
diff --git a/libpam/pam_private.h b/libpam/pam_private.h
index d93283c..1138277 100644
--- a/libpam/pam_private.h
+++ b/libpam/pam_private.h
@@ -24,12 +24,13 @@
/* the Linux-PAM configuration file */
-#define PAM_CONFIG "/etc/pam.conf"
-#define PAM_CONFIG_D "/etc/pam.d"
-#define PAM_CONFIG_DF "/etc/pam.d/%s"
+#define PAM_CONFIG "/etc/pam.conf"
+#define PAM_CONFIG_D "/etc/pam.d"
+#define PAM_CONFIG_DF "/etc/pam.d/%s"
+#define PAM_CONFIG_DIST_D "/usr/lib/pam.d"
+#define PAM_CONFIG_DIST_DF "/usr/lib/pam.d/%s"
#define PAM_DEFAULT_SERVICE "other" /* lower case */
-#define PAM_DEFAULT_SERVICE_FILE PAM_CONFIG_D "/" PAM_DEFAULT_SERVICE
#ifdef PAM_LOCKING
/*
9 years, 1 month
[linux-pam] pam_env: expand @{HOME} and @{SHELL} and enhance documentation (Ticket#24 and #29)
by kukuk
commit 73bdfac8c091492f466342feb8f2f5daa2f4c39b
Author: Thorsten Kukuk <kukuk(a)thkukuk.de>
Date: Wed Mar 25 14:49:46 2015 +0100
pam_env: expand @{HOME} and @{SHELL} and enhance documentation
(Ticket#24 and #29)
* modules/pam_env/pam_env.c: Replace @{HOME} and @{SHELL} with passwd entries
* modules/pam_env/pam_env.conf.5.xml: Document @{HOME} and @{SHELL}
* modules/pam_env/pam_env.8.xml: Enhance documentation
modules/pam_env/pam_env.8.xml | 39 +++++++++++++++++++++++------------
modules/pam_env/pam_env.c | 15 ++++++++++++-
modules/pam_env/pam_env.conf.5.xml | 11 ++++++---
3 files changed, 46 insertions(+), 19 deletions(-)
---
diff --git a/modules/pam_env/pam_env.8.xml b/modules/pam_env/pam_env.8.xml
index 309643f..6eac6c8 100644
--- a/modules/pam_env/pam_env.8.xml
+++ b/modules/pam_env/pam_env.8.xml
@@ -53,17 +53,23 @@
<emphasis>PAM_RHOST</emphasis>.
</para>
<para>
- By default rules for (un)setting of variables is taken from the
- config file <filename>/etc/security/pam_env.conf</filename> if
- no other file is specified.
+ By default rules for (un)setting of variables are taken from the
+ config file <filename>/etc/security/pam_env.conf</filename>. An
+ alternate file can be specified with the <emphasis>conffile</emphasis>
+ option.
</para>
<para>
- This module can also parse a file with simple
- <emphasis>KEY=VAL</emphasis> pairs on separate lines
- (<filename>/etc/environment</filename> by default). You can
- change the default file to parse, with the <emphasis>envfile</emphasis>
- flag and turn it on or off by setting the <emphasis>readenv</emphasis>
- flag to 1 or 0 respectively.
+ Second a file (<filename>/etc/environment</filename> by default) with simple
+ <emphasis>KEY=VAL</emphasis> pairs on separate lines will be read.
+ With the <emphasis>envfile</emphasis> option an alternate file can be specified.
+ And with the <emphasis>readenv</emphasis> option this can be completly disabled.
+ </para>
+ <para>
+ Third it will read a user configuration file
+ (<filename>$HOME/.pam_environment</filename> by default).
+ The default file file can be changed with the
+ <emphasis>user_envfile</emphasis> option
+ and it can be turned on and off with the <emphasis>user_readenv</emphasis> option.
</para>
<para>
Since setting of PAM environment variables can have side effects
@@ -107,8 +113,11 @@
<listitem>
<para>
Indicate an alternative <filename>environment</filename>
- file to override the default. This can be useful when different
- services need different environments.
+ file to override the default. The syntax are simple
+ <emphasis>KEY=VAL</emphasis> pairs on separate lines. The
+ <emphasis>export</emphasis> instruction can be specified for bash
+ compatibility, but will be ignored.
+ This can be useful when different services need different environments.
</para>
</listitem>
</varlistentry>
@@ -133,9 +142,11 @@
<listitem>
<para>
Indicate an alternative <filename>.pam_environment</filename>
- file to override the default. This can be useful when different
- services need different environments. The filename is relative to
- the user home directory.
+ file to override the default.The syntax is the same as
+ for <emphasis>/etc/environment</emphasis>.
+ The filename is relative to the user home directory.
+ This can be useful when different services need different
+ environments.
</para>
</listitem>
</varlistentry>
diff --git a/modules/pam_env/pam_env.c b/modules/pam_env/pam_env.c
index e04f5b5..1bfdf08 100644
--- a/modules/pam_env/pam_env.c
+++ b/modules/pam_env/pam_env.c
@@ -676,7 +676,7 @@ static const char * _pam_get_item_byname(pam_handle_t *pamh, const char *name)
const void *itemval;
D(("Called."));
- if (strcmp(name, "PAM_USER") == 0) {
+ if (strcmp(name, "PAM_USER") == 0 || strcmp(name, "HOME") == 0 || strcmp(name, "SHELL") == 0) {
item = PAM_USER;
} else if (strcmp(name, "PAM_USER_PROMPT") == 0) {
item = PAM_USER_PROMPT;
@@ -696,6 +696,19 @@ static const char * _pam_get_item_byname(pam_handle_t *pamh, const char *name)
D(("pam_get_item failed"));
return NULL; /* let pam_get_item() log the error */
}
+
+ if (itemval && (strcmp(name, "HOME") == 0 || strcmp(name, "SHELL") == 0)) {
+ struct passwd *user_entry;
+ user_entry = pam_modutil_getpwnam (pamh, (char *) itemval);
+ if (!user_entry) {
+ pam_syslog(pamh, LOG_ERR, "No such user!?");
+ return NULL;
+ }
+ return (strcmp(name, "SHELL") == 0) ?
+ user_entry->pw_shell :
+ user_entry->pw_dir;
+ }
+
D(("Exit."));
return itemval;
}
diff --git a/modules/pam_env/pam_env.conf.5.xml b/modules/pam_env/pam_env.conf.5.xml
index 45950b8..4040275 100644
--- a/modules/pam_env/pam_env.conf.5.xml
+++ b/modules/pam_env/pam_env.conf.5.xml
@@ -43,14 +43,16 @@
<para>
(Possibly non-existent) environment variables may be used in values
- using the ${string} syntax and (possibly non-existent) PAM_ITEMs may
- be used in values using the @{string} syntax. Both the $ and @
- characters can be backslash escaped to be used as literal values
+ using the ${string} syntax and (possibly non-existent) PAM_ITEMs as well
+ as HOME and SHELL may be used in values using the @{string} syntax. Both
+ the $ and @ characters can be backslash escaped to be used as literal values
values can be delimited with "", escaped " not supported.
Note that many environment variables that you would like to use
may not be set by the time the module is called.
- For example, HOME is used below several times, but
+ For example, ${HOME} is used below several times, but
many PAM applications don't make it available by the time you need it.
+ The special variables @{HOME} and @{SHELL} are expanded to the values
+ for the user from his <emphasis>passwd</emphasis> entry.
</para>
<para>
@@ -92,6 +94,7 @@
NNTPSERVER DEFAULT=localhost
PATH DEFAULT=${HOME}/bin:/usr/local/bin:/bin\
:/usr/bin:/usr/local/bin/X11:/usr/bin/X11
+ XDG_DATA_HOME @{HOME}/share/
</programlisting>
<para>
9 years, 1 month
[linux-pam] Clarify pam_access docs re PAM service names and X $DISPLAY value testing. (Ticket #39)
by kukuk
commit 7b39983f3a7b5e7522f1672e49dcbfe579f0228f
Author: Thorsten Kukuk <kukuk(a)thkukuk.de>
Date: Tue Mar 24 16:57:14 2015 +0100
Clarify pam_access docs re PAM service names and X $DISPLAY value testing.
(Ticket #39)
* modules/pam_access/access.conf.5.xml
* modules/pam_access/pam_access.8.xml
Signed-off-by: Karl O. Pinc <kop at meme.com>
modules/pam_access/access.conf.5.xml | 40 +++++++++++++++++++++++++++------
modules/pam_access/pam_access.8.xml | 5 ++-
2 files changed, 35 insertions(+), 10 deletions(-)
---
diff --git a/modules/pam_access/access.conf.5.xml b/modules/pam_access/access.conf.5.xml
index a4d3419..d686d92 100644
--- a/modules/pam_access/access.conf.5.xml
+++ b/modules/pam_access/access.conf.5.xml
@@ -21,8 +21,12 @@
<para>
The <filename>/etc/security/access.conf</filename> file specifies
(<replaceable>user/group</replaceable>, <replaceable>host</replaceable>),
- (<replaceable>user/group</replaceable>, <replaceable>network/netmask</replaceable>) or
- (<replaceable>user/group</replaceable>, <replaceable>tty</replaceable>)
+ (<replaceable>user/group</replaceable>, <replaceable>network/netmask</replaceable>),
+ (<replaceable>user/group</replaceable>, <replaceable>tty</replaceable>),
+ (<replaceable>user/group</replaceable>,
+ <replaceable>X-$DISPLAY-value</replaceable>), or
+ (<replaceable>user/group</replaceable>,
+ <replaceable>pam-service-name</replaceable>)
combinations for which a login will be either accepted or refused.
</para>
<para>
@@ -33,7 +37,14 @@
combination, or, in case of non-networked logins, the first entry
that matches the
(<replaceable>user/group</replaceable>, <replaceable>tty</replaceable>)
- combination. The permissions field of that table entry determines
+ combination, or in the case of non-networked logins without a
+ tty, the first entry that matches the
+ (<replaceable>user/group</replaceable>,
+ <replaceable>X-$DISPLAY-value</replaceable>) or
+ (<replaceable>user/group</replaceable>,
+ <replaceable>pam-service-name/</replaceable>)
+ combination. The permissions field of that table entry
+ determines
whether the login will be accepted or refused.
</para>
@@ -65,14 +76,27 @@
<para>
The third field, the <replaceable>origins</replaceable>
field, should be a list of one or more tty names (for non-networked
- logins), host names, domain names (begin with "."), host addresses,
+ logins), X <varname>$DISPLAY</varname> values or PAM service
+ names (for non-networked logins without a tty), host names,
+ domain names (begin with "."), host addresses,
internet network numbers (end with "."), internet network addresses
with network mask (where network mask can be a decimal number or an
internet address also), <emphasis>ALL</emphasis> (which always matches)
- or <emphasis>LOCAL</emphasis>. <emphasis>LOCAL</emphasis>
- keyword matches if and only if the <emphasis>PAM_RHOST</emphasis> is
- not set and <origin> field is thus set from
- <emphasis>PAM_TTY</emphasis> or <emphasis>PAM_SERVICE</emphasis>".
+ or <emphasis>LOCAL</emphasis>. The <emphasis>LOCAL</emphasis>
+ keyword matches if and only if
+ <citerefentry><refentrytitle>pam_get_item</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
+ when called with an <parameter>item_type</parameter> of
+ <emphasis>PAM_RHOST</emphasis>, returns <code>NULL</code> or an
+ empty string (and therefore the
+ <replaceable>origins</replaceable> field is compared against the
+ return value of
+ <citerefentry><refentrytitle>pam_get_item</refentrytitle><manvolnum>3</manvolnum></citerefentry>
+ called with an <parameter>item_type</parameter> of
+ <emphasis>PAM_TTY</emphasis> or, absent that,
+ <emphasis>PAM_SERVICE</emphasis>).
+ </para>
+
+ <para>
If supported by the system you can use
<emphasis>@netgroupname</emphasis> in host or user patterns. The
<emphasis>@@netgroupname</emphasis> syntax is supported in the user
diff --git a/modules/pam_access/pam_access.8.xml b/modules/pam_access/pam_access.8.xml
index 710e2e7..c629a9f 100644
--- a/modules/pam_access/pam_access.8.xml
+++ b/modules/pam_access/pam_access.8.xml
@@ -50,7 +50,8 @@
The pam_access PAM module is mainly for access management.
It provides logdaemon style login access control based on login
names, host or domain names, internet addresses or network numbers,
- or on terminal line names in case of non-networked logins.
+ or on terminal line names, X <varname>$DISPLAY</varname> values,
+ or PAM service names in case of non-networked logins.
</para>
<para>
By default rules for access management are taken from config file
@@ -59,7 +60,7 @@
</para>
<para>
If Linux PAM is compiled with audit support the module will report
- when it denies access based on origin (host or tty).
+ when it denies access based on origin (host, tty, etc.).
</para>
</refsect1>
9 years, 1 month
[linux-pam] Don't use sudo directory, the timestamp format is different (Ticket#32)
by kukuk
commit 89915a23a085d414bce61040364810be3975e261
Author: Thorsten Kukuk <kukuk(a)thkukuk.de>
Date: Tue Mar 24 14:39:41 2015 +0100
Don't use sudo directory, the timestamp format is different (Ticket#32)
* modules/pam_timestamp/pam_timestamp.c: Change default timestamp directory.
modules/pam_timestamp/pam_timestamp.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
---
diff --git a/modules/pam_timestamp/pam_timestamp.c b/modules/pam_timestamp/pam_timestamp.c
index b3f08b1..1bf0e84 100644
--- a/modules/pam_timestamp/pam_timestamp.c
+++ b/modules/pam_timestamp/pam_timestamp.c
@@ -58,6 +58,7 @@
#include <unistd.h>
#include <utmp.h>
#include <syslog.h>
+#include <paths.h>
#include "hmacsha1.h"
#include <security/pam_modules.h>
@@ -69,7 +70,7 @@
* for the timestamp_timeout parameter. */
#define DEFAULT_TIMESTAMP_TIMEOUT (5 * 60)
#define MODULE "pam_timestamp"
-#define TIMESTAMPDIR "/var/run/sudo"
+#define TIMESTAMPDIR _PATH_VARRUN "/" MODULE
#define TIMESTAMPKEY TIMESTAMPDIR "/_pam_timestamp_key"
/* Various buffers we use need to be at least as large as either PATH_MAX or
9 years, 1 month
[linux-pam] Enhance group.conf examples (Ticket#35)
by kukuk
commit eb9cd6f43132b2a7b54c621b4a80adf176628d20
Author: Thorsten Kukuk <kukuk(a)thkukuk.de>
Date: Tue Mar 24 14:34:58 2015 +0100
Enhance group.conf examples (Ticket#35)
* modules/pam_group/group.conf.5.xml: Enhance example by logic group entry.
modules/pam_group/group.conf.5.xml | 6 +++---
1 files changed, 3 insertions(+), 3 deletions(-)
---
diff --git a/modules/pam_group/group.conf.5.xml b/modules/pam_group/group.conf.5.xml
index 3a7e3f5..fc5370f 100644
--- a/modules/pam_group/group.conf.5.xml
+++ b/modules/pam_group/group.conf.5.xml
@@ -106,11 +106,11 @@
<programlisting>xsh;tty*&!ttyp*;us;Al0000-2400;floppy</programlisting>
<para>
- Running 'xsh' on tty* (any ttyXXX device), the user 'sword' is given access
- to games (through membership of the floppy group) after work hours.
+ Running 'xsh' on tty* (any ttyXXX device), the users 'sword', 'pike' and
+ 'shield' are given access to games (through membership of the floppy group) after work hours.
</para>
<programlisting>
-xsh; tty* ;sword;!Wk0900-1800;games, sound
+xsh; tty* ;sword|pike|shield;!Wk0900-1800;games, sound
xsh; tty* ;*;Al0900-1800;floppy
</programlisting>
<para>
9 years, 1 month
[linux-pam] Document timestampdir option (Ticket#33)
by kukuk
commit d8a664cac10bf857cc0ab4d38be028ba39e5fcbc
Author: Thorsten Kukuk <kukuk(a)thkukuk.de>
Date: Tue Mar 24 14:22:02 2015 +0100
Document timestampdir option (Ticket#33)
* modules/pam_timestamp/pam_timestamp.8.xml: Add timestampdir option.
modules/pam_timestamp/pam_timestamp.8.xml | 19 +++++++++++++++++--
1 files changed, 17 insertions(+), 2 deletions(-)
---
diff --git a/modules/pam_timestamp/pam_timestamp.8.xml b/modules/pam_timestamp/pam_timestamp.8.xml
index 07a5cf1..e19a0bc 100644
--- a/modules/pam_timestamp/pam_timestamp.8.xml
+++ b/modules/pam_timestamp/pam_timestamp.8.xml
@@ -19,6 +19,9 @@
<cmdsynopsis id="pam_timestamp-cmdsynopsis">
<command>pam_timestamp.so</command>
<arg choice="opt">
+ timestampdir=<replaceable>directory</replaceable>
+ </arg>
+ <arg choice="opt">
timestamp_timeout=<replaceable>number</replaceable>
</arg>
<arg choice="opt">
@@ -55,11 +58,23 @@ file as grounds for succeeding.
<variablelist>
<varlistentry>
<term>
+ <option>timestampdir=<replaceable>directory</replaceable></option>
+ </term>
+ <listitem>
+ <para>
+ Specify an alternate directory where
+ <emphasis>pam_timestamp</emphasis> creates timestamp files.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>
<option>timestamp_timeout=<replaceable>number</replaceable></option>
</term>
<listitem>
<para>
- How long should pam_timestamp treat timestamp as valid after their
+ How long should <emphasis>pam_timestamp</emphasis>
+ treat timestamp as valid after their
last modification date (in seconds). Default is 300 seconds.
</para>
</listitem>
@@ -152,7 +167,7 @@ session optional pam_timestamp.so
<title>FILES</title>
<variablelist>
<varlistentry>
- <term><filename>/var/run/sudo/...</filename></term>
+ <term><filename>/var/run/pam_timestamp/...</filename></term>
<listitem>
<para>timestamp files and directories</para>
</listitem>
9 years, 1 month
[linux-pam] Adjust documentation (Ticket#36)
by kukuk
commit 0698382cf55ad79d0d591fad9609c68eabfac2a2
Author: Thorsten Kukuk <kukuk(a)thkukuk.de>
Date: Tue Mar 24 13:03:06 2015 +0100
Adjust documentation (Ticket#36)
* libpam/pam_delay.c: Change 25% in comment to 50% as used in code.
* doc/man/pam_fail_delay.3.xml: Change 25% to 50%
doc/man/pam_fail_delay.3.xml | 2 +-
libpam/pam_delay.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
---
diff --git a/doc/man/pam_fail_delay.3.xml b/doc/man/pam_fail_delay.3.xml
index a101cf3..392298a 100644
--- a/doc/man/pam_fail_delay.3.xml
+++ b/doc/man/pam_fail_delay.3.xml
@@ -39,7 +39,7 @@
<citerefentry>
<refentrytitle>pam_authenticate</refentrytitle><manvolnum>3</manvolnum>
</citerefentry> fail, the failing return to the application is
- delayed by an amount of time randomly distributed (by up to 25%)
+ delayed by an amount of time randomly distributed (by up to 50%)
about this longest value.
</para>
<para>
diff --git a/libpam/pam_delay.c b/libpam/pam_delay.c
index cb6c9d5..972e72b 100644
--- a/libpam/pam_delay.c
+++ b/libpam/pam_delay.c
@@ -81,7 +81,7 @@ static unsigned int _pam_compute_delay(unsigned int seed, unsigned int base)
/* **********************************************************************
* the following function sleeps for a random time. The actual time
* slept is computed above.. It is based on the requested time but will
- * differ by up to +/- 25%.
+ * differ by up to +/- 50%.
*/
void _pam_await_timer(pam_handle_t *pamh, int status)
9 years, 1 month