Commit Graph

14 Commits

Author SHA1 Message Date
Ross Burton fc91e068cc libpam: only use pam_systemd.so if systemd is enabled
So that sysvinit images don't warn on every login only add it to common-session
if systemd is a DISTRO_FEATURE.

[ YOCTO #3805 ]

(From OE-Core rev: 3ccb0855a7a6b147e5025855c6376747ba72986a)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2013-09-22 12:19:42 +01:00
Ming Liu 82ac6aaa29 libpam: deny all services for the OTHER entries
To be secure, change behavior of the OTHER entries to warn and deny
access to everything by stating pam_deny.so on all services.

(From OE-Core rev: 4ca0af699b5b4b3cf95b3e76482651949fd922ac)

Signed-off-by: Ming Liu <ming.liu@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2013-07-31 06:59:58 +01:00
Ming Liu 784d7b7729 libpam: add a new 'nullok_secure' option support to pam_unix
Debian patch to add a new 'nullok_secure' option to pam_unix, which
accepts users with null passwords only when the applicant is connected
from a tty listed in /etc/securetty.

The original pam_unix.so was configured with nullok_secure in
meta/recipes-extended/pam/libpam/pam.d/common-auth, but no such code
exists actually.

The patch set comes from:
http://patch-tracker.debian.org/patch/series/view/pam/1.1.3-7.1/054_pam_security_abstract_securetty_handling
http://patch-tracker.debian.org/patch/series/view/pam/1.1.3-7.1/055_pam_unix_nullok_secure

(From OE-Core rev: 10cdd66fe800cffe3f2cbf5c95550b4f7902a311)

Signed-off-by: Ming Liu <ming.liu@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2013-07-24 11:35:33 +01:00
Wenzong Fan cc53a1af6f libpam: Fix for CVE-2010-4708
Change default for user_readenv to 0 and document the
new default for user_readenv.

This fix from:
http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/modules/pam_env
/pam_env.c?r1=1.22&r2=1.23&view=patch
http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/modules/pam_env
/pam_env.8.xml?r1=1.7&r2=1.8&view=patch

(From OE-Core rev: 871ae7a6453b3b66610fd8bbaa770c92be850e19)

Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2013-06-19 18:03:34 +01:00
Kai Kang c1ac96dde1 libpam: backport patches from upstream
Backport patches from linux-pam git repo to fix test case
tst-pam_pwhistory1 failure.

[YOCTO #4107]

(From OE-Core rev: 65e4a9f050ae588ec794808315a206d94ca7a861)

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2013-04-17 11:41:30 +01:00
Richard Purdie dbfb8dc7fb pam: Fix case where ${B} != ${S}
(From OE-Core rev: 3d27366f17e597380fee738f14f119d880a77985)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2013-03-22 16:54:35 +00:00
Koen Kooi e344f3e7d5 libpam: register PAM session with logind
This make screen/tmux/etc work as intended.

(From OE-Core rev: 58731bbdbd4ab4cfd560f14758a65efdfad2e28f)

Signed-off-by: Martin Donnelly <martin.donnelly@ge.com>
Signed-off-by: Koen Kooi <koen@dominion.thruhere.net>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2013-01-20 12:58:56 +00:00
Richard Purdie 91ece5d566 libpam: Fix missing DESTDIR for a mkdir causing build failures
(From OE-Core rev: c39e823138cbf4210e17bdb95ca322ec0a6c8f78)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2012-08-19 13:32:06 +01:00
Khem Raj 973512c32c libpam: Update recipes from 1.1.5 -> 1.1.6
Drop include-sys-resource.patch already fixed upstream
LIC_FILE_CHKSUM change is due to deletion of space in
COPYING file see
http://git.fedorahosted.org/cgit/linux-pam.git/commit/COPYING?id=1814aec611a5f9e03eceee81237ad3a3f51c954a

(From OE-Core rev: 619092b699bfd79e060755fa41645cac7ac4fd0d)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2012-08-19 10:48:21 +01:00
Khem Raj 19bf330db7 libpam: Fix build with eglibc 2.16
pam_unix_acct.c: In function '_unix_run_verify_binary':
pam_unix_acct.c:97:19: error: storage size of 'rlim' isn't known
pam_unix_acct.c:106:19: error: 'RLIMIT_NOFILE' undeclared (first use in
this function)
pam_unix_acct.c:106:19: note: each undeclared identifier is reported
only once for each function it appears in

(From OE-Core rev: e59a0bac95ce025a6b826be28ccc9e42ca4b5a29)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2012-07-17 10:54:01 +01:00
Kang Kai b1a020621c libpam: update to 1.1.4 and add subpackage xtests
Update libpam to 1.1.4, and add dependecy cracklib because run xtexts will
need pam-plugin-cracklib.
There are some additional checks under subdirectory xtests and make it
as a subpackage libpam-xtests.

(From OE-Core rev: f9158bf219479c2da56dd21a13ecee3176cd6f8a)

Signed-off-by: Kang Kai <kai.kang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2011-07-27 12:02:41 +01:00
Scott Garman 0dbd791e5b recipes: Add Upstream-Status to various recipe patches
Add Upstream-Status tag to patches for the following recipes:

openssh
dbus-glib
expat
opensp
sgml-common
at
cpio (GPLv3 version)
libpam
icu

(From OE-Core rev: 0702602332ad63c2cfaa207516497bb0b75bfdf3)

Signed-off-by: Scott Garman <scott.a.garman@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2011-05-17 15:14:42 +01:00
Khem Raj 45e0eabb3a libpam_1.1.3.bb: Fix compilation on uclibc when innetgr is absent
(From OE-Core rev: a0d441ec7c43fe1b4490c1c9b03a0cf5811109fd)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2011-04-04 14:09:41 +01:00
Scott Garman 698cef8322 libpam: upgrade to version 1.1.3
* Removed obsolete crossbinary patch
* Added source checksums
* Added LIC_FILES_CHKSUM and SUMMARY entries

Signed-off-by: Scott Garman <scott.a.garman@intel.com>
2010-11-24 13:25:21 -08:00