Commit Graph

64 Commits

Author SHA1 Message Date
Joshua Lock cc2744267f meta: replace uses of bb.data.expand(VARNAME, d) with d.expand(VARNAME)
bb.data.expand(x, d) is deprecated API.

[YOCTO #10678]

(From OE-Core rev: a361babe443da635aed83be46679067457fd6a58)

Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-03-22 11:35:19 +00:00
Joshua Lock c4e2c59088 meta: remove True option to getVar calls
getVar() now defaults to expanding by default, thus remove the True
option from getVar() calls with a regex search and replace.

Search made with the following regex: getVar ?\(( ?[^,()]*), True\)

(From OE-Core rev: 7c552996597faaee2fbee185b250c0ee30ea3b5f)

Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-12-16 10:23:23 +00:00
Maxin B. John 2ce22250c4 libpam: update dependency list
Depend only on bison-native as configure script is checking
only for bison binary and libpam itself doesn't need target bison.

Add libxml2-native for deterministic build (it detects xmlcatalog
and xmllint)

(From OE-Core rev: d904d24a9cb1f15688b9924981d9c3d4dac7065f)

Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-06-03 13:13:25 +01:00
Maxin B. John 87f0a82625 libpam: update to 1.3.0
1.2.1 -> 1.3.0

Remove upstreamed patch:
        a) pam-no-innetgr.patch

Refreshed the following patches for 1.3.0:
        a) crypt_configure.patch
        b) pam-unix-nullok-secure.patch

(From OE-Core rev: ac512ff9fbe41428e3d71d3e943aaa871d8b155a)

Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-30 15:58:12 +01:00
Zhixiong Chi c706b5efb6 libpam: define limits.conf as CONFFILES of package libpam-runtime
Based as security reason, the system must limit users to
simultaneous system logins, or a site-defined number.
To avoid overwriting the /etc/security/limits.conf file after
upgrading this rpm package, we will define the file as
CONFFILES of package libpam-runtime.

(From OE-Core rev: bdd7c1b088f24e54cf0be83324dd6ffe677af079)

Signed-off-by: Zhixiong Chi <Zhixiong.Chi@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-03-10 23:13:54 +00:00
Richard Purdie e0890b662e meta: Drop now pointless manual -dbg packaging
With the autodebug package generation logic, specifically setting FILES_${PN}-dbg
isn't needed in most cases, we can remove them.

(From OE-Core rev: 3ab59d49dd7c18e194b58d1248b4b87709b5a738)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-12-16 11:56:30 +00:00
Khem Raj f1c034be02 libpam: Fix build with musl
Define strndupa if not available in libc additionally fix headers
to explicitly needed include files which glibc was including indirectly

(From OE-Core rev: 24097d8bb481ed1312c45b2e93527a271f56e4be)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-12-12 23:42:55 +00:00
Khem Raj d90d3e88e9 libpam: Fix build with uclibc
libpam needs to adjust for posix utmpx
uclibc now disables utmp

Change-Id: Ibcb7cb621527f318eb8b6e2741647ccb4c6bb39c
(From OE-Core rev: e4c8a15d36d05d2b17b1dcf1d4238616c5b814f5)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-10-27 07:24:26 +00:00
Richard Purdie c75cefe8a3 libpam: Fix patch broken during upgrade
"0x200" became "0200" during the upgrade to libpam 1.2.1 in:
http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/?id=88dd997d9941b63ae9eead6690ecf2b785c0740c
and this broke the IMAGE_FEATURES like debug-tweaks.

I've converted all the values to octal here to match the original
header file convention and make it clearer.

[YOCTO #8033]

(From OE-Core rev: 588e19058f631a1cc78002e1969a5459cd626afb)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-08-09 15:15:33 -07:00
Amarnath Valluri 88dd997d99 libpam: Upgrade v1.1.6 -> v1.2.1
Dropped upstreamed patches(commit-id):
- add-checks-for-crypt-returning-NULL.patch(8dc056c)
- destdirfix.patch(d7e6b92)
- libpam-fix-for-CVE-2010-4708.patch(4c430f6)

Dropped backported patches(commit-id):
- pam_timestamp-fix-potential-directory-traversal-issu.patch(9dcead8)
- reflect-the-enforce_for_root-semantics-change-in-pam.patch(bd07ad3)

Forward ported patches:
- pam-unix-nullok-secure.patch
- crypt_configure.patch

(From OE-Core rev: 8683206f7ba85f693751415f896a0cc62931e3c4)

Signed-off-by: Amarnath Valluri <amarnath.valluri@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-07-20 10:40:42 +01:00
Khem Raj 554e25546f libpam: Fix wrong crypt library detection
Surfaced when building with musl This details are in patch headers
Enabel innetgr.patch for musl as well

(From OE-Core rev: 6ec229d8dec6a5978ebf6b264c332590c8be0b3a)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-06-08 17:34:03 +01:00
Jian Liu 1a46946b82 libpam: avoid overwritting editable files during package updating
Use CONFFILES to mark editable files as such,
  /etc/pam.d/common-session
  /etc/pam.d/common-auth
  /etc/pam.d/common-password
  /etc/pam.d/common-session-noninteractive
  /etc/pam.d/common-account

If there is no %config micro before the file name in the spec file,
this file will be overwritten after updating package.
This will make our settings lost.

(From OE-Core rev: 078fedcc0b7d50e7001c587968319f1b45b3c1ba)

Signed-off-by: Jian Liu <jian.liu@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-12-03 12:24:00 +00:00
Yue Tao 11d9f02cc6 libpam: Stop a QA WARNING when building multlib version
WARNING: QA Issue: lib64-libpam: Files/directories were installed but
not shipped
  /usr/sbin/pam_console_apply

Because the package name is changed to mlprefix-pam-plugin-console. The file
must be appended to that item.

(From OE-Core rev: a9bc116ab80d920b781a8ae31370220fac683f3d)

Signed-off-by: Yue Tao <Yue.Tao@windriver.com>
Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-11-25 13:03:27 +00:00
Wenzong Fan cf558b4782 libpam / xtests: remove bash dependency
There's not bash specific syntax in the xtests scripts:

  $ cd Linux-PAM-1.1.6/xtests
  # replace /bin/bash to /bin/sh and check the bashisms:
  $ checkbashisms *.sh
  No output

So the runtime dependency to bash could be removed.

(From OE-Core rev: 1917bf7aa74aa1b86756c73c56537db2591115e5)

Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-09-29 12:12:43 +01:00
Robert Yang 823ba6e308 libpam: remove MLPREFIX from PN
The commit df3038768f59f7a0c814974ff674d4e59cbdfca4 changed 'libpam' to
'pn', then we don't need the "MLPREFIX + pn" any more, otherwise we
would get the name like: "lib32-lib32-libpam-x", and the warn:

WARNING: QA Issue: lib32-pam-plugin-access rdepends on
lib32-lib32-libpam-suffix, but it isn't a build dependency? [build-deps]

(From OE-Core rev: 804c1284891c2654e1431fe4d777ca41ac466120)

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-08-31 23:40:49 +01:00
Otavio Salvador c07aa7e3b7 libpam: Fix multilib packaging
The plugin runtime dependencies were not including the multilib
prefix, fix it.

(From OE-Core rev: 48ca9989e4ac098532d3e0d4ce2a59eab9159b24)

Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-08-31 23:40:49 +01:00
Otavio Salvador e145cd5aaa libpam: Fix runtime providers
The runtime providers were commented out. Removing the comment brings
up a issue with the native renaming which has been workarounded
disabling the runtime recommendation. This is indeed a workaround so a
FIXME comment has been added to remind about it in case we someday
move to native prefix.

(From OE-Core rev: bb25eac63cb9b2d0e1a45f5002a5e90562471aa1)

Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-08-31 23:40:49 +01:00
Robert Yang 1087a18524 meta: fix RDEPNEDS for the test related pkgs
Add bash, python or perl to the ptest pkgs to fix the RDEPENDS issues.

(From OE-Core rev: d081a85fc76e2b7a469c6c70175ecf7aed9de053)

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-08-28 15:12:44 +01:00
Otavio Salvador f9f818351a libpam: Allow use during build and in SDK
The recipe had libpam hardcoded in some places which were causing
failures as the metadata renaming hooks does not change those,
generating a broken dependencies list.

This patch fixes those and add the native and nativesdk support.

(From OE-Core rev: df3038768f59f7a0c814974ff674d4e59cbdfca4)

Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-08-15 18:21:52 +01:00
Yue Tao 9d40ce5dd1 libpam: Security Advisory - CVE-2014-2583
v2 changes:
* update format for commit log
* add Upstream-Status for patch

Multiple directory traversal vulnerabilities in pam_timestamp.c in the
pam_timestamp module for Linux-PAM (aka pam) 1.1.8 allow local users to
create aribitrary files or possibly bypass authentication via a .. (dot
dot) in the (1) PAM_RUSER value to the get_ruser function or (2) PAM_TTY
value to the check_tty funtion, which is used by the
format_timestamp_name function.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2583

(From OE-Core rev: 69255c84ebd99629da8174e1e73fd8c715e49b52)

Signed-off-by: Yue Tao <Yue.Tao@windriver.com>
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-06-17 10:23:53 +01:00
Otavio Salvador 4c14b09498 Globally replace 'base_contains' calls with 'bb.utils.contains'
The base_contains is kept as a compatibility method and we ought to
not use it in OE-Core so we can remove it from base metadata in
future.

(From OE-Core rev: d83b16dbf0862be387f84228710cb165c6d2b03b)

Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-04-25 17:19:19 +01:00
Hongxu Jia b0bf001251 libpam: fix 64-bit pam plugins not installed when add to 32-bit image
While the BSP is configured as a 64-bit kernel and 32-bit userspace,
add a 64-bit version of libpam to the filesystem, there was a failure:
...
| Computing transaction...error: Can't install
pam-plugin-unix-1.1.6-r2@lib64_x86_64: no package provides libpam-lib64
|
| Saving cache...
...

While using 'lib64' as the multilib suffix of libpam RPROVIDES , the
RPROVIDES was overridden by map_depends_variable in classextend.py.
...
 $RPROVIDES_lib64-libpam [2 operations]
   set data_smart.py:429 [finalize]
     " libpam-${baselib}"
   set classextend.py:71 [map_depends_variable]4532
     "lib64-libpam"
 computed:
   "lib64-libpam"
RPROVIDES_lib64-libpam="lib64-libpam"
...

Rename the suffix could fix this issue.
[YOCTO #4532]

(From OE-Core rev: 77e3d60fa00a41424fe65977b2bf307727a5a26c)

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-04-09 14:31:14 +01:00
Ming Liu a684808899 libpam: fix multilib packaging issue for pam-plugins
libpam might miss ABI specific dependencies for pam-plugins-*, for RPM uses
generic names to check the packages depending on it and doesn't consider the
arch, which will lead to packaging issues in mulbilib build.

pam_plugin_hook is added because the plugin packages are dynamically
generated, so we need to manually process multilib names by add baselib to
RPROVIDES/RDEPENDS as ABI specific tag.

(From OE-Core rev: d08e64a98316d7659b0fb56812667c534f66a1a8)

Signed-off-by: Ming Liu <ming.liu@windriver.com>

I worked with Ming Liu on this particular issue.  You may wonder why
this is necessary let me attempt to explain the underlying causes.

In deb/ipk on a multilib package, the package name has specific multilib
references in it.  I.e. the alternative libraries start with something
like lib32-...  This was done primarily because deb/ipk do not allow two
packages with the same name (but different architectures) to be
installed at the same time.  So the name has to be unique.

In RPM however, the names of the packages and matches with the
architectures and if they are not the same we can do these multilib
installs.  This matches the behavior of other RPM based distributions
and in many ways the tools people are used to working with RPM.  For the
most part this works fine in multilib configurations because additional
per-file dependencies are added that capture the shared library
dependencies with ABI specific information.  This unfortunately fails in
a few cases where plugins are dynamically loaded via dlopen -- such as
libpam.

One possible fix is simply to follow the deb/ipk package naming, but
this causes a design advantage of rpm.  When a package has a dependency
on 'bash', we really don't care what bash is installed, only that -a-
bash is installed.  In the deb/ipk case, the lib32- packages would end
up with a lib32-bash dependency and you could potentially end up with
two 'bash' packages being installed.

So the fix I recommended for the issue was to add the baselib path to
the internal dependencies.  Since we know that the libpam installed in
'lib' needs the modules that were compiled to also work with the 'lib'
version of libpam. While the libpam in 'lib64' need the modules to work
with the 'lib64' version of the plugins.

Existing dependencies are preserved so there is no impact in the ipk/deb
case, the RPM case is resolved as the additional dependency information
is now present for the package manager to select the package we really
want.

If anyone else has a suggestion for an alternative fix, we're interested
-- but this is the best answer we could come up with.  (If any of the
above should be added to the commit message, the YP bug, or
documentation, please let me know and I'll make sure it gets added.)

Signed-off-by: Mark Hatle <mark.hatle@windriver.com>

[YOCTO #4532]
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-04-01 23:37:02 +01:00
Martin Jansa a01af02025 recipes: bump PRs
* resolves following warnings:
  WARNING: Use of PRINC 17 was detected in the recipe meta-openembedded/meta-systemd/recipes-core/systemd/systemd-machine-units_1.0.bb (or one of its .bbappends)
  WARNING: Use of PRINC 1 was detected in the recipe meta-openembedded/meta-gpe/recipes-support/fbreader/fbreader_0.12.10.bb (or one of its .bbappends)
  WARNING: Use of PRINC 1 was detected in the recipe meta-openembedded/meta-gpe/recipes-support/fbreader/fbreader_git.bb (or one of its .bbappends)
  WARNING: Use of PRINC 1 was detected in the recipe meta-openembedded/meta-multimedia/recipes-multimedia/sox/sox_14.4.0.bb (or one of its .bbappends)
  WARNING: Use of PRINC 1 was detected in the recipe meta-openembedded/meta-oe/recipes-multimedia/mplayer/mplayer-common.bb (or one of its .bbappends)
  WARNING: Use of PRINC 1 was detected in the recipe meta-smartphone/meta-android/recipes-bsp/chroot-script/chroot-script_1.0.bb (or one of its .bbappends)
  WARNING: Use of PRINC 1 was detected in the recipe openembedded-core/meta/recipes-connectivity/avahi/avahi-ui_0.6.31.bb (or one of its .bbappends)
  WARNING: Use of PRINC 1 was detected in the recipe openembedded-core/meta/recipes-connectivity/bind/bind_9.8.1.bb (or one of its .bbappends)
  WARNING: Use of PRINC 1 was detected in the recipe openembedded-core/meta/recipes-core/systemd/systemd-serialgetty.bb (or one of its .bbappends)
  WARNING: Use of PRINC 1 was detected in the recipe openembedded-core/meta/recipes-core/sysvinit/sysvinit-inittab_2.88dsf.bb (or one of its .bbappends)
  WARNING: Use of PRINC 1 was detected in the recipe openembedded-core/meta/recipes-extended/screen/screen_4.0.3.bb (or one of its .bbappends)
  WARNING: Use of PRINC 1 was detected in the recipe openembedded-core/meta/recipes-extended/shadow/shadow-securetty_4.1.4.3.bb (or one of its .bbappends)
  WARNING: Use of PRINC 1 was detected in the recipe openembedded-core/meta/recipes-extended/shadow/shadow_4.1.4.3.bb (or one of its .bbappends)
  WARNING: Use of PRINC 1 was detected in the recipe openembedded-core/meta/recipes-graphics/libsdl/libsdl_1.2.15.bb (or one of its .bbappends)
  WARNING: Use of PRINC 1 was detected in the recipe openembedded-core/meta/recipes-graphics/packagegroups/packagegroup-core-x11-xserver.bb (or one of its .bbappends)
  WARNING: Use of PRINC 1 was detected in the recipe openembedded-core/meta/recipes-kernel/modutils-initscripts/modutils-initscripts.bb (or one of its .bbappends)
  WARNING: Use of PRINC 1 was detected in the recipe openembedded-core/meta/recipes-multimedia/libsndfile/libsndfile1_1.0.25.bb (or one of its .bbappends)
  WARNING: Use of PRINC 1 was detected in the recipe openembedded-core/meta/recipes-support/libcap/libcap_2.22.bb (or one of its .bbappends)
  WARNING: Use of PRINC 11 was detected in the recipe openembedded-core/meta/recipes-bsp/keymaps/keymaps_1.0.bb (or one of its .bbappends)
  WARNING: Use of PRINC 11 was detected in the recipe openembedded-core/meta/recipes-core/systemd/systemd-compat-units.bb (or one of its .bbappends)
  WARNING: Use of PRINC 12 was detected in the recipe openembedded-core/meta/recipes-core/initscripts/initscripts_1.0.bb (or one of its .bbappends)
  WARNING: Use of PRINC 13 was detected in the recipe openembedded-core/meta/recipes-core/base-files/base-files_3.0.14.bb (or one of its .bbappends)
  WARNING: Use of PRINC 2 was detected in the recipe meta-openembedded/meta-oe/recipes-navigation/navit/navit_svn.bb (or one of its .bbappends)
  WARNING: Use of PRINC 2 was detected in the recipe meta-openembedded/meta-oe/recipes-support/lvm2/lvm2_2.02.97.bb (or one of its .bbappends)
  WARNING: Use of PRINC 2 was detected in the recipe openembedded-core/meta/recipes-connectivity/portmap/portmap_6.0.bb (or one of its .bbappends)
  WARNING: Use of PRINC 2 was detected in the recipe openembedded-core/meta/recipes-extended/pam/libpam_1.1.6.bb (or one of its .bbappends)
  WARNING: Use of PRINC 2 was detected in the recipe openembedded-core/meta/recipes-graphics/packagegroups/packagegroup-core-x11.bb (or one of its .bbappends)
  WARNING: Use of PRINC 3 was detected in the recipe meta-openembedded/meta-efl/recipes-efl/efl/entrance_svn.bb (or one of its .bbappends)
  WARNING: Use of PRINC 3 was detected in the recipe meta-openembedded/meta-oe/recipes-multimedia/mplayer/mplayer2_git.bb (or one of its .bbappends)
  WARNING: Use of PRINC 3 was detected in the recipe openembedded-core/meta/recipes-bsp/formfactor/formfactor_0.0.bb (or one of its .bbappends)
  WARNING: Use of PRINC 3 was detected in the recipe openembedded-core/meta/recipes-connectivity/avahi/avahi_0.6.31.bb (or one of its .bbappends)
  WARNING: Use of PRINC 3 was detected in the recipe openembedded-core/meta/recipes-connectivity/dhcp/dhcp_4.2.5-P1.bb (or one of its .bbappends)
  WARNING: Use of PRINC 3 was detected in the recipe openembedded-core/meta/recipes-core/init-ifupdown/init-ifupdown_1.0.bb (or one of its .bbappends)
  WARNING: Use of PRINC 3 was detected in the recipe openembedded-core/meta/recipes-graphics/xinput-calibrator/pointercal-xinput_0.0.bb (or one of its .bbappends)
  WARNING: Use of PRINC 5 was detected in the recipe meta-openembedded/meta-oe/recipes-core/meta/distro-feed-configs.bb (or one of its .bbappends)
  WARNING: Use of PRINC 5 was detected in the recipe openembedded-core/meta/recipes-connectivity/bluez/bluez4_4.101.bb (or one of its .bbappends)
  WARNING: Use of PRINC 6 was detected in the recipe openembedded-core/meta/recipes-core/packagegroups/packagegroup-base.bb (or one of its .bbappends)
  WARNING: Use of PRINC 6 was detected in the recipe openembedded-core/meta/recipes-core/packagegroups/packagegroup-core-boot.bb (or one of its .bbappends)
  WARNING: Use of PRINC 6 was detected in the recipe openembedded-core/meta/recipes-graphics/xorg-xserver/xserver-xf86-config_0.1.bb (or one of its .bbappends)
  WARNING: Use of PRINC 7 was detected in the recipe meta-openembedded/meta-oe/recipes-navigation/gpsd/gpsd_3.7.bb (or one of its .bbappends)
  WARNING: Use of PRINC 7 was detected in the recipe openembedded-core/meta/recipes-core/udev/udev-extraconf_1.0.bb (or one of its .bbappends)

(From OE-Core rev: c6825ec6e92e20bb64a051d1576f363c16e98d68)

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-03-05 17:36:37 +00:00
Richard Purdie 6ab56c54f3 classes/recipes: More optimal DISTRO_FEATURES references
Using the contains function results in more optimal sstate checksums
resulting in better cache reuse as we as more consistent code.

(From OE-Core rev: 9c93526756e7cbbff027c88eb972f877bcb1f057)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2013-12-05 14:24:43 +00:00
David Nyström a60c6b3bdc libpam: Avoid host contamination issue w. libprelude
Since we dont use prelude in OE, we just disable autodetection of
prelude in the libpam configuration.

Seems like an old bug:
http://lists.openembedded.org/pipermail/openembedded-devel/2012-March/083804.html

(From OE-Core rev: 9096c6a46cf2467c90873c235b4533faf97d6175)

Signed-off-by: David Nyström <david.nystrom@enea.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2013-09-24 17:24:13 +01:00
Ross Burton fc91e068cc libpam: only use pam_systemd.so if systemd is enabled
So that sysvinit images don't warn on every login only add it to common-session
if systemd is a DISTRO_FEATURE.

[ YOCTO #3805 ]

(From OE-Core rev: 3ccb0855a7a6b147e5025855c6376747ba72986a)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2013-09-22 12:19:42 +01:00
Joe Slater 71abcc96b2 libpam: add PACKAGECONFIG data concerning audit
We do not want libpam to build using audit just
because it happens to be lying around, so we
create PACKAGECONFIG[] data to give us explicit
control.

(From OE-Core rev: 4db6aa2094447f8d2a9c234089a80ddcd78fcbd0)

Signed-off-by: Joe Slater <jslater@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2013-08-26 11:47:19 +01:00
Ming Liu 82ac6aaa29 libpam: deny all services for the OTHER entries
To be secure, change behavior of the OTHER entries to warn and deny
access to everything by stating pam_deny.so on all services.

(From OE-Core rev: 4ca0af699b5b4b3cf95b3e76482651949fd922ac)

Signed-off-by: Ming Liu <ming.liu@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2013-07-31 06:59:58 +01:00
Ming Liu 784d7b7729 libpam: add a new 'nullok_secure' option support to pam_unix
Debian patch to add a new 'nullok_secure' option to pam_unix, which
accepts users with null passwords only when the applicant is connected
from a tty listed in /etc/securetty.

The original pam_unix.so was configured with nullok_secure in
meta/recipes-extended/pam/libpam/pam.d/common-auth, but no such code
exists actually.

The patch set comes from:
http://patch-tracker.debian.org/patch/series/view/pam/1.1.3-7.1/054_pam_security_abstract_securetty_handling
http://patch-tracker.debian.org/patch/series/view/pam/1.1.3-7.1/055_pam_unix_nullok_secure

(From OE-Core rev: 10cdd66fe800cffe3f2cbf5c95550b4f7902a311)

Signed-off-by: Ming Liu <ming.liu@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2013-07-24 11:35:33 +01:00
Martin Jansa c491477e32 libpam: inherit pkgconfig
* missing dependency on pkgconfig-native was causing
  that PKG_CHECK_MODULES(DBUS, dbus-1) stayed unexpanded in
  configure script:
  checking for dbm_store in -lndbm... no
  libpam/1.1.6-r2/Linux-PAM-1.1.6/configure:
  line 14217: syntax error near unexpected token `libtirpc,'
  libpam/1.1.6-r2/Linux-PAM-1.1.6/configure:
  line 14217: `      PKG_CHECK_MODULES(libtirpc, libtirpc,'
  Configure failed. The contents of all config.log files follows to aid
  debugging

(From OE-Core rev: d8d230a164b4e98dbb3a9e6d9bb567c2aabee7f9)

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2013-07-10 09:41:59 +01:00
Ross Burton 763ebb62cd libpam: check if PAM is enabled when building
(From OE-Core rev: fd9bad3e48a605e9fd28c129413300ff6b548788)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2013-06-25 17:44:55 +01:00
Ross Burton 105cbfa793 libpam: fix whitespace in shell function
(From OE-Core rev: 1b4b25d3cebab90398db208281d54e7442d43bcd)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2013-06-25 17:44:55 +01:00
Wenzong Fan cc53a1af6f libpam: Fix for CVE-2010-4708
Change default for user_readenv to 0 and document the
new default for user_readenv.

This fix from:
http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/modules/pam_env
/pam_env.c?r1=1.22&r2=1.23&view=patch
http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/modules/pam_env
/pam_env.8.xml?r1=1.7&r2=1.8&view=patch

(From OE-Core rev: 871ae7a6453b3b66610fd8bbaa770c92be850e19)

Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2013-06-19 18:03:34 +01:00
Mark Hatle 7dcb4452f3 libpam: Avoid wildcards in the SRC_URI
Remove the wildcard from the SRC_URI.  This causes problems when you .bbappend
and add a FILESEXTRAPATHS entry.  The unpack task may be unable to find the
files to unpack leading to an error.

Avoid wildcards at all costs...

(From OE-Core rev: 6d3705123dd2f808a9778326aa04a2854f7b5378)

Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2013-05-29 22:19:04 +01:00
Kai Kang c1ac96dde1 libpam: backport patches from upstream
Backport patches from linux-pam git repo to fix test case
tst-pam_pwhistory1 failure.

[YOCTO #4107]

(From OE-Core rev: 65e4a9f050ae588ec794808315a206d94ca7a861)

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2013-04-17 11:41:30 +01:00
Richard Purdie dbfb8dc7fb pam: Fix case where ${B} != ${S}
(From OE-Core rev: 3d27366f17e597380fee738f14f119d880a77985)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2013-03-22 16:54:35 +00:00
Koen Kooi e344f3e7d5 libpam: register PAM session with logind
This make screen/tmux/etc work as intended.

(From OE-Core rev: 58731bbdbd4ab4cfd560f14758a65efdfad2e28f)

Signed-off-by: Martin Donnelly <martin.donnelly@ge.com>
Signed-off-by: Koen Kooi <koen@dominion.thruhere.net>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2013-01-20 12:58:56 +00:00
Constantin Musca 785512a306 libpam: enable multilib
Fix the following warning:
WARNING: QA Issue: lib32-libpam: Files/directories were installed but not shipped
  /usr/sbin/unix_chkpwd
  /usr/sbin/pam_tally2
  /usr/sbin/mkhomedir_helper
  /usr/sbin/unix_update
  /usr/sbin/pam_timestamp_check
  /usr/sbin/pam_tally

(From OE-Core rev: 1dbb0bc048ceaf4cd2879362ae4a0f1398809349)

Signed-off-by: Constantin Musca <constantinx.musca@intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2013-01-07 11:09:37 +00:00
Martin Jansa 33b31640bf PACKAGES_DYNAMIC: use regexp not glob
* bitbake uses PACKAGES_DYNAMIC as regexp
  ^ could make matching faster (and it will be more clear that we're expecting regexp not glob)
  * made all those last '-' optional, use .* (or nothing)

(From OE-Core rev: 2f3ebdfa5f42dae51063b043cc4b0fbe20b40064)

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2012-10-19 18:02:26 +01:00
Richard Purdie 91ece5d566 libpam: Fix missing DESTDIR for a mkdir causing build failures
(From OE-Core rev: c39e823138cbf4210e17bdb95ca322ec0a6c8f78)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2012-08-19 13:32:06 +01:00
Khem Raj 973512c32c libpam: Update recipes from 1.1.5 -> 1.1.6
Drop include-sys-resource.patch already fixed upstream
LIC_FILE_CHKSUM change is due to deletion of space in
COPYING file see
http://git.fedorahosted.org/cgit/linux-pam.git/commit/COPYING?id=1814aec611a5f9e03eceee81237ad3a3f51c954a

(From OE-Core rev: 619092b699bfd79e060755fa41645cac7ac4fd0d)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2012-08-19 10:48:21 +01:00
Marcin Juszkiewicz bff36f1736 libpam: disable NIS to not link with libtirpc when it is available
I was checking ways to make incremental builds faster so I started using
sstate-cache and SSTATE_MIRRORS. But this gave me some nasty bug:

| Collected errors:
|  * satisfy_dependencies_for: Cannot satisfy the following dependencies
for php-cgi:
|  *    libtirpc1 (>= 0.2.2) *
|  * opkg_install_cmd: Cannot install package php-cgi.

I checked details:

In my previous build libtirpc got built before libpam so libpam found it
and linked. As a result packages depend on libtirpc1 but as there is no
such build dependency sstate handling code did not used libtirpc copy...

(From OE-Core rev: e629bdcd1bcb51f2d2101fb53daeac0bd29ab637)

Signed-off-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2012-08-06 16:09:15 +01:00
Javier Martinez Canillas 4efdf2c82f libpam: use ${localstatedir} and ${sysconfdir} instead of /var and /etc
It is considered good practice to use the build system provided
variables instead of directly specify hardcoded paths.

(From OE-Core rev: 7556e60bf23c07646594a1704b3db7dfc29e631d)

Signed-off-by: Javier Martinez Canillas <javier@dowhile0.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2012-08-06 15:18:49 +01:00
Richard Purdie 73cf0335c4 Remove a number of unneeded import os/bb calls
The bb and os modules are always imported so having these extra import calls
are a waste of space/execution time. They also set a bad example for people
copy and pasting code so clean them up.

(From OE-Core rev: 7d674820958be3a7051ea619effe1a6061d9cbe2)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2012-07-19 12:24:50 +01:00
Richard Purdie bfd279de32 Convert tab indentation in python functions into four-space
(From OE-Core rev: 604d46c686d06d62d5a07b9c7f4fa170f99307d8)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2012-07-19 10:24:50 +01:00
Khem Raj 19bf330db7 libpam: Fix build with eglibc 2.16
pam_unix_acct.c: In function '_unix_run_verify_binary':
pam_unix_acct.c:97:19: error: storage size of 'rlim' isn't known
pam_unix_acct.c:106:19: error: 'RLIMIT_NOFILE' undeclared (first use in
this function)
pam_unix_acct.c:106:19: note: each undeclared identifier is reported
only once for each function it appears in

(From OE-Core rev: e59a0bac95ce025a6b826be28ccc9e42ca4b5a29)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2012-07-17 10:54:01 +01:00
Richard Purdie b1aeaa8b0d meta: Replace bb.data.expand(xxx, d) -> d.expand(xxx)
sed \
 -e 's:bb.data.\(expand([^,()]*\), *\([^) ]*\) *):\2.\1):g' \
 -i `grep -ril bb.data.expand *`

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2012-03-05 10:23:53 -08:00
Robert Yang 8ac3b74dc9 V2 Fix libpam's chmod
The libpam's has an error when generating the rootfs:

chmod: cannot access `/usr/sbin/unix_chkpwd': No such file or directory

This is because the following code in libpam_1.1.5.bb:

pkg_postinst_pam-plugin-unix () {
    # below is necessary to allow unix_chkpwd get user info from shadow file
    # on lsb images
    chmod 4755 ${sbindir}/unix_chkpwd
}

This is to set the setuid permission for unix_chkpwd (the lsb test
requires this), but it lacks a "${D}", and we can do this in the install
stage.

[YOCTO #2049]

(From OE-Core rev: 0725c7f01b173b1cc2090f4a03a274c7017b8a1a)

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2012-03-02 12:25:20 +00:00
Martin Jansa 0761649736 recipes: bump PR to rebuild .la files without libz.la
(From OE-Core rev: 1da6a2dbd5e7aeea6cd45ca05590bdd50b67bf89)

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2012-02-21 17:00:47 +00:00