Star0
11
Code
Code
Issues1
Pull Requests6
Discussion
Wiki
Analysis
Star0
11
Open
update to 1.7.0 #117
Funda WangAdd on Nov 25, 2024
update to 1.7.0 #117
Open
Funda WangAdd on Nov 25, 2024
Merged fromrefs/pull/117/headintomaster
Total: 16 files changed+152-536
DLinux-PAM-1.5.3.tar.xz+0-0
Binary files do not support preview
ALinux-PAM-1.7.0-fix-xtests-name.patch+11-0
@@ -0,0 +1,11 @@
1+--- a/xtests/meson.build 2024-11-25 13:23:24.365535019 +0800
2++++ b/xtests/meson.build 2024-11-25 13:23:35.891646844 +0800
3+@@ -40,7 +40,7 @@
4+ args: [
5+ files('run-xtests.sh'),
6+ meson.current_source_dir(),
7+- fs.name(tst_exe),
8++ fs.name(tst_exe.name()),
9+ ],
10+ env: ['MESON_BUILD_SUBDIR=' + meson.current_build_dir()],
11+ is_parallel: false,
ALinux-PAM-1.7.0.tar.xz+0-0
Binary files do not support preview
Madd-sm3-crypt-support.patch+33-69
@@ -4,44 +4,21 @@ Date: Fri, 14 Jan 2022 11:46:20 +0800
4Subject: [PATCH] add sm3 crypt support4Subject: [PATCH] add sm3 crypt support
5 5 
6---6---
7- modules/pam_unix/pam_unix.8 | 9 +-
8 modules/pam_unix/pam_unix.8.xml | 16 +++-7 modules/pam_unix/pam_unix.8.xml | 16 +++-
9 modules/pam_unix/passverify.c | 5 +-8 modules/pam_unix/passverify.c | 5 +-
10 modules/pam_unix/support.c | 4 +-9 modules/pam_unix/support.c | 4 +-
11 modules/pam_unix/support.h | 6 +-10 modules/pam_unix/support.h | 6 +-
12- xtests/Makefile.am | 6 +-11+ xtests/meson.build | 1 +
13 xtests/tst-pam_unix5.c | 151 ++++++++++++++++++++++++++++++++12 xtests/tst-pam_unix5.c | 151 ++++++++++++++++++++++++++++++++
14 xtests/tst-pam_unix5.pamd | 5 ++13 xtests/tst-pam_unix5.pamd | 5 ++
15 xtests/tst-pam_unix5.sh | 41 +++++++++14 xtests/tst-pam_unix5.sh | 41 +++++++++
16- 9 files changed, 233 insertions(+), 10 deletions(-)15+ 8 files changed, 223 insertions(+), 6 deletions(-)
17 create mode 100644 xtests/tst-pam_unix5.c16 create mode 100644 xtests/tst-pam_unix5.c
18 create mode 100644 xtests/tst-pam_unix5.pamd17 create mode 100644 xtests/tst-pam_unix5.pamd
19 create mode 100644 xtests/tst-pam_unix5.sh18 create mode 100644 xtests/tst-pam_unix5.sh
20 19 
21-diff --git a/modules/pam_unix/pam_unix.8 b/modules/pam_unix/pam_unix.8
22-index 438717f..6f31c10 100644
23---- a/modules/pam_unix/pam_unix.8
24-+++ b/modules/pam_unix/pam_unix.8
25-@@ -201,9 +201,16 @@ When a user changes their password next, encrypt it with the yescrypt algorithm\
26- function\&.
27- .RE
28- .PP
29-+sm3
30-+.RS 4
31-+When a user changes their password next, encrypt it with the SM3 algorithm\&. The SM3 algorithm must be supported by the
32-+\fBcrypt\fR(3)
33-+function\&.
34-+.RE
35-+.PP
36- rounds=n
37- .RS 4
38--Set the optional number of rounds of the SHA256, SHA512, blowfish, gost\-yescrypt, and yescrypt password hashing algorithms to
39-+Set the optional number of rounds of the SHA256, SHA512, blowfish, gost\-yescrypt, yescrypt and SM3 password hashing algorithms to
40- \fIn\fR\&.
41- .RE
42- .PP
43diff --git a/modules/pam_unix/pam_unix.8.xml b/modules/pam_unix/pam_unix.8.xml20diff --git a/modules/pam_unix/pam_unix.8.xml b/modules/pam_unix/pam_unix.8.xml
44-index dfc0427..7d61869 10064421+index d2cd198..416e144 100644
45--- a/modules/pam_unix/pam_unix.8.xml22--- a/modules/pam_unix/pam_unix.8.xml
46+++ b/modules/pam_unix/pam_unix.8.xml23+++ b/modules/pam_unix/pam_unix.8.xml
47@@ -366,6 +366,20 @@24@@ -366,6 +366,20 @@
@@ -75,10 +52,10 @@ index dfc0427..7d61869 100644
75 <replaceable>n</replaceable>.52 <replaceable>n</replaceable>.
76 </para>53 </para>
77diff --git a/modules/pam_unix/passverify.c b/modules/pam_unix/passverify.c54diff --git a/modules/pam_unix/passverify.c b/modules/pam_unix/passverify.c
78-index 81b10d8..1aee153 10064455+index e8d0b91..846550d 100644
79--- a/modules/pam_unix/passverify.c56--- a/modules/pam_unix/passverify.c
80+++ b/modules/pam_unix/passverify.c57+++ b/modules/pam_unix/passverify.c
81-@@ -445,6 +445,8 @@ PAMH_ARG_DECL(char * create_password_hash,58+@@ -475,6 +475,8 @@ PAMH_ARG_DECL(char * create_password_hash,
82 algoid = "$5$";59 algoid = "$5$";
83 } else if (on(UNIX_SHA512_PASS, ctrl)) {60 } else if (on(UNIX_SHA512_PASS, ctrl)) {
84 algoid = "$6$";61 algoid = "$6$";
@@ -87,7 +64,7 @@ index 81b10d8..1aee153 100644
87 } else { /* must be crypt/bigcrypt */64 } else { /* must be crypt/bigcrypt */
88 char tmppass[9];65 char tmppass[9];
89 char *hashed;66 char *hashed;
90-@@ -492,7 +494,8 @@ PAMH_ARG_DECL(char * create_password_hash,67+@@ -521,7 +523,8 @@ PAMH_ARG_DECL(char * create_password_hash,
91 on(UNIX_GOST_YESCRYPT_PASS, ctrl) ? "gost_yescrypt" :68 on(UNIX_GOST_YESCRYPT_PASS, ctrl) ? "gost_yescrypt" :
92 on(UNIX_BLOWFISH_PASS, ctrl) ? "blowfish" :69 on(UNIX_BLOWFISH_PASS, ctrl) ? "blowfish" :
93 on(UNIX_SHA256_PASS, ctrl) ? "sha256" :70 on(UNIX_SHA256_PASS, ctrl) ? "sha256" :
@@ -98,29 +75,29 @@ index 81b10d8..1aee153 100644
98 pam_overwrite_string(sp);75 pam_overwrite_string(sp);
99 }76 }
100diff --git a/modules/pam_unix/support.c b/modules/pam_unix/support.c77diff --git a/modules/pam_unix/support.c b/modules/pam_unix/support.c
101-index 043273d..4052868 10064478+index dfdc9fc..0e10575 100644
102--- a/modules/pam_unix/support.c79--- a/modules/pam_unix/support.c
103+++ b/modules/pam_unix/support.c80+++ b/modules/pam_unix/support.c
104-@@ -99,7 +99,7 @@ unsigned long long _set_ctrl(pam_handle_t *pamh, int flags, int *remember,81+@@ -191,7 +191,7 @@ unsigned long long _set_ctrl(pam_handle_t *pamh, int flags, int *remember,
105- free (val);82+ const char *key = NULL;
106- 83+ if (on(UNIX_YESCRYPT_PASS, ctrl))
107- /* read number of rounds for crypt algo */84+ key = "YESCRYPT_COST_FACTOR";
108-- if (rounds && (on(UNIX_SHA256_PASS, ctrl) || on(UNIX_SHA512_PASS, ctrl))) {85+- else if (on(UNIX_SHA256_PASS, ctrl) || on(UNIX_SHA512_PASS, ctrl))
109-+ if (rounds && (on(UNIX_SHA256_PASS, ctrl) || on(UNIX_SHA512_PASS, ctrl) || on(UNIX_SM3_PASS, ctrl))) {86++ else if (on(UNIX_SHA256_PASS, ctrl) || on(UNIX_SHA512_PASS, ctrl) || on(UNIX_SM3_PASS, ctrl))
110- val = pam_modutil_search_key(pamh, LOGIN_DEFS, "SHA_CRYPT_MAX_ROUNDS");87+ key = "SHA_CRYPT_MAX_ROUNDS";
111- 88+ else
112- if (val) {89+ key = NULL;
113-@@ -194,7 +194,7 @@ unsigned long long _set_ctrl(pam_handle_t *pamh, int flags, int *remember,90+@@ -232,7 +232,7 @@ unsigned long long _set_ctrl(pam_handle_t *pamh, int flags, int *remember,
114- } else if (on(UNIX_BLOWFISH_PASS, ctrl)) {91+ *rounds = 4;
115- if (*rounds < 4 || *rounds > 31)92+ else if (*rounds > 31)
116- *rounds = 5;93+ *rounds = 31;
117- } else if (on(UNIX_SHA256_PASS, ctrl) || on(UNIX_SHA512_PASS, ctrl)) {94- } else if (on(UNIX_SHA256_PASS, ctrl) || on(UNIX_SHA512_PASS, ctrl)) {
118+ } else if (on(UNIX_SHA256_PASS, ctrl) || on(UNIX_SHA512_PASS, ctrl) || on(UNIX_SM3_PASS, ctrl)) {95+ } else if (on(UNIX_SHA256_PASS, ctrl) || on(UNIX_SHA512_PASS, ctrl) || on(UNIX_SM3_PASS, ctrl)) {
119 if ((*rounds < 1000) || (*rounds == INT_MAX)) {96 if ((*rounds < 1000) || (*rounds == INT_MAX)) {
120 /* don't care about bogus values */97 /* don't care about bogus values */
121 *rounds = 0;98 *rounds = 0;
122diff --git a/modules/pam_unix/support.h b/modules/pam_unix/support.h99diff --git a/modules/pam_unix/support.h b/modules/pam_unix/support.h
123-index 8105400..b5712b5 100644100+index e8f629d..23d77c3 100644
124--- a/modules/pam_unix/support.h101--- a/modules/pam_unix/support.h
125+++ b/modules/pam_unix/support.h102+++ b/modules/pam_unix/support.h
126@@ -101,10 +101,11 @@ typedef struct {103@@ -101,10 +101,11 @@ typedef struct {
@@ -145,31 +122,18 @@ index 8105400..b5712b5 100644
145 };122 };
146 123
147 #define UNIX_DEFAULTS (unix_args[UNIX__NONULL].flag)124 #define UNIX_DEFAULTS (unix_args[UNIX__NONULL].flag)
148-diff --git a/xtests/Makefile.am b/xtests/Makefile.am125+diff --git a/xtests/meson.build b/xtests/meson.build
149-index acf9746..33693de 100644126+index 96b2612..3d98288 100644
150---- a/xtests/Makefile.am127+--- a/xtests/meson.build
151-+++ b/xtests/Makefile.am128++++ b/xtests/meson.build
152-@@ -14,9 +14,9 @@ EXTRA_DIST = run-xtests.sh tst-pam_dispatch1.pamd tst-pam_dispatch2.pamd \129+@@ -21,6 +21,7 @@ xtest_progs = [
153- tst-pam_dispatch3.pamd tst-pam_dispatch4.pamd \130+ 'tst-pam_unix2',
154- tst-pam_dispatch5.pamd \131+ 'tst-pam_unix3',
155- tst-pam_unix1.pamd tst-pam_unix2.pamd tst-pam_unix3.pamd \132+ 'tst-pam_unix4',
156-- tst-pam_unix4.pamd \133++ 'tst-pam_unix5',
157-+ tst-pam_unix4.pamd tst-pam_unix5.pamd \134+ ]
158- tst-pam_unix1.sh tst-pam_unix2.sh tst-pam_unix3.sh \
159-- tst-pam_unix4.sh \
160-+ tst-pam_unix4.sh tst-pam_unix5.sh \
161- access.conf tst-pam_access1.pamd tst-pam_access1.sh \
162- tst-pam_access2.pamd tst-pam_access2.sh \
163- tst-pam_access3.pamd tst-pam_access3.sh \
164-@@ -40,7 +40,7 @@ EXTRA_DIST = run-xtests.sh tst-pam_dispatch1.pamd tst-pam_dispatch2.pamd \
165 135
166- XTESTS = tst-pam_dispatch1 tst-pam_dispatch2 tst-pam_dispatch3 \136+ foreach prog: xtest_progs
167- tst-pam_dispatch4 tst-pam_dispatch5 \
168-- tst-pam_unix1 tst-pam_unix2 tst-pam_unix3 tst-pam_unix4 \
169-+ tst-pam_unix1 tst-pam_unix2 tst-pam_unix3 tst-pam_unix4 tst-pam_unix5 \
170- tst-pam_access1 tst-pam_access2 tst-pam_access3 \
171- tst-pam_access4 tst-pam_limits1 tst-pam_succeed_if1 \
172- tst-pam_group1 tst-pam_authfail tst-pam_authsucceed \
173diff --git a/xtests/tst-pam_unix5.c b/xtests/tst-pam_unix5.c137diff --git a/xtests/tst-pam_unix5.c b/xtests/tst-pam_unix5.c
174new file mode 100644138new file mode 100644
175index 0000000..6e6e378139index 0000000..6e6e378
@@ -386,5 +350,5 @@ index 0000000..a6be19b
386+/usr/sbin/userdel -r tstpamunix 2> /dev/null350+/usr/sbin/userdel -r tstpamunix 2> /dev/null
387+exit $RET351+exit $RET
388-- 352--
389-2.33.0353+2.43.5
390 354 
Dbackport-CVE-2024-10041-pam_unix-try-to-set-uid-to-0-for-unix_chkpwd.patch+0-79
@@ -1,79 +0,0 @@
1-From b7b96362087414e52524d3d9d9b3faa21e1db620 Mon Sep 17 00:00:00 2001
2-From: Tobias Stoeckmann <tobias@stoeckmann.org>
3-Date: Wed, 24 Jan 2024 18:57:42 +0100
4-Subject: [PATCH] pam_unix: try to set uid to 0 for unix_chkpwd
5- 
6-The geteuid check does not cover all cases. If a program runs with
7-elevated capabilities like CAP_SETUID then we can still check
8-credentials of other users.
9- 
10-Keep logging for future analysis though.
11- 
12-Resolves: https://github.com/linux-pam/linux-pam/issues/747
13-Fixes: b3020da7da38 ("pam_unix/passverify: always run the helper to obtain shadow password file entries")
14- 
15-Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
16- 
17-Conflict:NA
18-Reference:https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620
19----
20- modules/pam_unix/pam_unix_acct.c | 17 +++++++++--------
21- modules/pam_unix/support.c | 14 +++++++-------
22- 2 files changed, 16 insertions(+), 15 deletions(-)
23- 
24-diff --git a/modules/pam_unix/pam_unix_acct.c b/modules/pam_unix/pam_unix_acct.c
25-index 8f5ed3e..7ffcb9e 100644
26---- a/modules/pam_unix/pam_unix_acct.c
27-+++ b/modules/pam_unix/pam_unix_acct.c
28-@@ -110,14 +110,15 @@ int _unix_run_verify_binary(pam_handle_t *pamh, unsigned long long ctrl,
29- _exit(PAM_AUTHINFO_UNAVAIL);
30- }
31-
32-- if (geteuid() == 0) {
33-- /* must set the real uid to 0 so the helper will not error
34-- out if pam is called from setuid binary (su, sudo...) */
35-- if (setuid(0) == -1) {
36-- pam_syslog(pamh, LOG_ERR, "setuid failed: %m");
37-- printf("-1\n");
38-- fflush(stdout);
39-- _exit(PAM_AUTHINFO_UNAVAIL);
40-+ /* must set the real uid to 0 so the helper will not error
41-+ out if pam is called from setuid binary (su, sudo...) */
42-+ if (setuid(0) == -1) {
43-+ uid_t euid = geteuid();
44-+ pam_syslog(pamh, euid == 0 ? LOG_ERR : LOG_DEBUG, "setuid failed: %m");
45-+ if (euid == 0) {
46-+ printf("-1\n");
47-+ fflush(stdout);
48-+ _exit(PAM_AUTHINFO_UNAVAIL);
49- }
50- }
51-
52-diff --git a/modules/pam_unix/support.c b/modules/pam_unix/support.c
53-index 4052868..ff46155 100644
54---- a/modules/pam_unix/support.c
55-+++ b/modules/pam_unix/support.c
56-@@ -513,13 +513,13 @@ static int _unix_run_helper_binary(pam_handle_t *pamh, const char *passwd,
57- _exit(PAM_AUTHINFO_UNAVAIL);
58- }
59-
60-- if (geteuid() == 0) {
61-- /* must set the real uid to 0 so the helper will not error
62-- out if pam is called from setuid binary (su, sudo...) */
63-- if (setuid(0) == -1) {
64-- D(("setuid failed"));
65-- _exit(PAM_AUTHINFO_UNAVAIL);
66-- }
67-+ /* must set the real uid to 0 so the helper will not error
68-+ out if pam is called from setuid binary (su, sudo...) */
69-+ if (setuid(0) == -1) {
70-+ D(("setuid failed"));
71-+ if (geteuid() == 0) {
72-+ _exit(PAM_AUTHINFO_UNAVAIL);
73-+ }
74- }
75-
76- /* exec binary helper */
77---
78-2.46.0
79- 
Dbackport-CVE-2024-10041.patch+0-95
@@ -1,95 +0,0 @@
1-From b3020da7da384d769f27a8713257fbe1001878be Mon Sep 17 00:00:00 2001
2-From: "Dmitry V. Levin" <ldv@strace.io>
3-Date: Mon, 1 Jan 2024 12:00:00 +0000
4-Subject: [PATCH] pam_unix/passverify: always run the helper to obtain shadow
5- password file entries
6- 
7-Initially, when pam_unix.so verified the password, it used to try to
8-obtain the shadow password file entry for the given user by invoking
9-getspnam(3), and only when that didn't work and the effective uid
10-was nonzero, pam_unix.so used to invoke the helper as a fallback.
11- 
12-When SELinux support was introduced by commit
13-67aab1ff5515054341a438cf9804e9c9b3a88033, the fallback was extended
14-also for the case when SELinux was enabled.
15- 
16-Later, commit f220cace205332a3dc34e7b37a85e7627e097e7d extended the
17-fallback conditions for the case when pam_modutil_getspnam() failed
18-with EACCES.
19- 
20-Since commit 470823c4aacef5cb3b1180be6ed70846b61a3752, the helper is
21-invoked as a fallback when pam_modutil_getspnam() fails for any reason.
22- 
23-The ultimate solution for the case when pam_unix.so does not have
24-permissions to obtain the shadow password file entry is to stop trying
25-to use pam_modutil_getspnam() and to invoke the helper instead.
26-Here are two recent examples.
27- 
28-https://github.com/linux-pam/linux-pam/pull/484 describes a system
29-configuration where libnss_systemd is enabled along with libnss_files
30-in the shadow entry of nsswitch.conf, so when libnss_files is unable
31-to obtain the shadow password file entry for the root user, e.g. when
32-SELinux is enabled, NSS falls back to libnss_systemd which returns
33-a synthesized shadow password file entry for the root user, which
34-in turn locks the root user out.
35- 
36-https://bugzilla.redhat.com/show_bug.cgi?id=2150155 describes
37-essentially the same problem in a similar system configuration.
38- 
39-This commit is the final step in the direction of addressing the issue:
40-for password verification pam_unix.so now invokes the helper instead of
41-making the pam_modutil_getspnam() call.
42- 
43-* modules/pam_unix/passverify.c (get_account_info) [!HELPER_COMPILE]:
44-Always return PAM_UNIX_RUN_HELPER instead of trying to obtain
45-the shadow password file entry.
46- 
47-Complements: https://github.com/linux-pam/linux-pam/pull/386
48-Resolves: https://github.com/linux-pam/linux-pam/pull/484
49-Link: https://github.com/authselect/authselect/commit/1e78f7e048747024a846fd22d68afc6993734e92
50- 
51-Conflict:NA
52-Reference:https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be
53----
54- modules/pam_unix/passverify.c | 21 +++++++++++----------
55- 1 file changed, 11 insertions(+), 10 deletions(-)
56- 
57-diff --git a/modules/pam_unix/passverify.c b/modules/pam_unix/passverify.c
58-index 1aee153..9f349e5 100644
59---- a/modules/pam_unix/passverify.c
60-+++ b/modules/pam_unix/passverify.c
61-@@ -237,20 +237,21 @@ PAMH_ARG_DECL(int get_account_info,
62- return PAM_UNIX_RUN_HELPER;
63- #endif
64- } else if (is_pwd_shadowed(*pwd)) {
65-+#ifdef HELPER_COMPILE
66- /*
67-- * ...and shadow password file entry for this user,
68-+ * shadow password file entry for this user,
69- * if shadowing is enabled
70- */
71-- *spwdent = pam_modutil_getspnam(pamh, name);
72-- if (*spwdent == NULL) {
73--#ifndef HELPER_COMPILE
74-- /* still a chance the user can authenticate */
75-- return PAM_UNIX_RUN_HELPER;
76--#endif
77-- return PAM_AUTHINFO_UNAVAIL;
78-- }
79-- if ((*spwdent)->sp_pwdp == NULL)
80-+ *spwdent = getspnam(name);
81-+ if (*spwdent == NULL || (*spwdent)->sp_pwdp == NULL)
82- return PAM_AUTHINFO_UNAVAIL;
83-+#else
84-+ /*
85-+ * The helper has to be invoked to deal with
86-+ * the shadow password file entry.
87-+ */
88-+ return PAM_UNIX_RUN_HELPER;
89-+#endif
90- }
91- } else {
92- return PAM_USER_UNKNOWN;
93---
94-2.46.0
95- 
Mbackport-CVE-2024-10963.patch+19-25
@@ -3,9 +3,6 @@ From: Thorsten Kukuk <kukuk@suse.com>
3Date: Thu, 14 Nov 2024 10:27:28 +01003Date: Thu, 14 Nov 2024 10:27:28 +0100
4Subject: [PATCH] pam_access: rework resolving of tokens as hostname4Subject: [PATCH] pam_access: rework resolving of tokens as hostname
5 5 
6-Conflict:Context adaptation
7-Reference:https://github.com/linux-pam/linux-pam/commit/940747f88c16e029b69a74e80a2e94f65cb3e628
8- 
9* modules/pam_access/pam_access.c: separate resolving of IP addresses6* modules/pam_access/pam_access.c: separate resolving of IP addresses
10 from hostnames. Don't resolve TTYs or display variables as hostname7 from hostnames. Don't resolve TTYs or display variables as hostname
11 (#834).8 (#834).
@@ -20,12 +17,12 @@ Reference:https://github.com/linux-pam/linux-pam/commit/940747f88c16e029b69a74e8
20 3 files changed, 105 insertions(+), 17 deletions(-)17 3 files changed, 105 insertions(+), 17 deletions(-)
21 18 
22diff --git a/modules/pam_access/access.conf.5.xml b/modules/pam_access/access.conf.5.xml19diff --git a/modules/pam_access/access.conf.5.xml b/modules/pam_access/access.conf.5.xml
23-index 0b93db00..10b8ba92 10064420+index 0b93db00e4..10b8ba9252 100644
24--- a/modules/pam_access/access.conf.5.xml21--- a/modules/pam_access/access.conf.5.xml
25+++ b/modules/pam_access/access.conf.5.xml22+++ b/modules/pam_access/access.conf.5.xml
26-@@ -226,6 +226,10 @@23+@@ -233,6 +233,10 @@
27- item and the line will be most probably ignored. For this reason, it is not24+ An IPv6 link local host address must contain the interface
28- recommended to put spaces around the ':' characters.25+ identifier. IPv6 link local network/netmask is not supported.
29 </para>26 </para>
30+ <para>27+ <para>
31+ Hostnames should be written as Fully-Qualified Host Name (FQHN) to avoid28+ Hostnames should be written as Fully-Qualified Host Name (FQHN) to avoid
@@ -35,10 +32,10 @@ index 0b93db00..10b8ba92 100644
35 32
36 <refsect1 xml:id="access.conf-see_also">33 <refsect1 xml:id="access.conf-see_also">
37diff --git a/modules/pam_access/pam_access.8.xml b/modules/pam_access/pam_access.8.xml34diff --git a/modules/pam_access/pam_access.8.xml b/modules/pam_access/pam_access.8.xml
38-index c991d7a0..71a4f7ee 10064435+index c991d7a097..71a4f7ee94 100644
39--- a/modules/pam_access/pam_access.8.xml36--- a/modules/pam_access/pam_access.8.xml
40+++ b/modules/pam_access/pam_access.8.xml37+++ b/modules/pam_access/pam_access.8.xml
41-@@ -25,11 +25,14 @@38+@@ -22,11 +22,14 @@
42 <arg choice="opt" rep="norepeat">39 <arg choice="opt" rep="norepeat">
43 debug40 debug
44 </arg>41 </arg>
@@ -53,8 +50,8 @@ index c991d7a0..71a4f7ee 100644
53+ nodns50+ nodns
54 </arg>51 </arg>
55 <arg choice="opt" rep="norepeat">52 <arg choice="opt" rep="norepeat">
56- accessfile=<replaceable>file</replaceable>53+ quiet_log
57-@@ -112,6 +115,33 @@54+@@ -132,6 +135,33 @@
58 </listitem>55 </listitem>
59 </varlistentry>56 </varlistentry>
60 57
@@ -87,8 +84,8 @@ index c991d7a0..71a4f7ee 100644
87+84+
88 <varlistentry>85 <varlistentry>
89 <term>86 <term>
90- fieldsep=separators87+ quiet_log
91-@@ -153,20 +183,6 @@88+@@ -185,20 +215,6 @@
92 </listitem>89 </listitem>
93 </varlistentry>90 </varlistentry>
94 91
@@ -110,27 +107,27 @@ index c991d7a0..71a4f7ee 100644
110 </refsect1>107 </refsect1>
111 108
112diff --git a/modules/pam_access/pam_access.c b/modules/pam_access/pam_access.c109diff --git a/modules/pam_access/pam_access.c b/modules/pam_access/pam_access.c
113-index 48e7c7e9..109115e9 100644110+index 48e7c7e974..109115e9cf 100644
114--- a/modules/pam_access/pam_access.c111--- a/modules/pam_access/pam_access.c
115+++ b/modules/pam_access/pam_access.c112+++ b/modules/pam_access/pam_access.c
116-@@ -92,6 +92,7 @@ struct login_info {113+@@ -100,6 +100,7 @@ struct login_info {
117- int debug; /* Print debugging messages. */
118 int only_new_group_syntax; /* Only allow group entries of the form "(xyz)" */114 int only_new_group_syntax; /* Only allow group entries of the form "(xyz)" */
119 int noaudit; /* Do not audit denials */115 int noaudit; /* Do not audit denials */
116+ int quiet_log; /* Do not log denials */
120+ int nodns; /* Do not try to resolve tokens as hostnames */117+ int nodns; /* Do not try to resolve tokens as hostnames */
121 const char *fs; /* field separator */118 const char *fs; /* field separator */
122 const char *sep; /* list-element separator */119 const char *sep; /* list-element separator */
123 int from_remote_host; /* If PAM_RHOST was used for from */120 int from_remote_host; /* If PAM_RHOST was used for from */
124-@@ -143,6 +144,8 @@ parse_args(pam_handle_t *pamh, struct login_info *loginfo,121+@@ -154,6 +155,8 @@ parse_args(pam_handle_t *pamh, struct login_info *loginfo,
125- loginfo->only_new_group_syntax = YES;
126- } else if (strcmp (argv[i], "noaudit") == 0) {
127 loginfo->noaudit = YES;122 loginfo->noaudit = YES;
123+ } else if (strcmp (argv[i], "quiet_log") == 0) {
124+ loginfo->quiet_log = YES;
128+ } else if (strcmp (argv[i], "nodns") == 0) {125+ } else if (strcmp (argv[i], "nodns") == 0) {
129+ loginfo->nodns = YES;126+ loginfo->nodns = YES;
130 } else {127 } else {
131 pam_syslog(pamh, LOG_ERR, "unrecognized option [%s]", argv[i]);128 pam_syslog(pamh, LOG_ERR, "unrecognized option [%s]", argv[i]);
132 }129 }
133-@@ -637,7 +640,7 @@ remote_match (pam_handle_t *pamh, char *tok, struct login_info *item)130+@@ -820,7 +823,7 @@ remote_match (pam_handle_t *pamh, char *tok, struct login_info *item)
134 if ((str_len = strlen(string)) > tok_len131 if ((str_len = strlen(string)) > tok_len
135 && strcasecmp(tok, string + str_len - tok_len) == 0)132 && strcasecmp(tok, string + str_len - tok_len) == 0)
136 return YES;133 return YES;
@@ -139,7 +136,7 @@ index 48e7c7e9..109115e9 100644
139 struct addrinfo hint;136 struct addrinfo hint;
140 137
141 memset (&hint, '\0', sizeof (hint));138 memset (&hint, '\0', sizeof (hint));
142-@@ -712,6 +715,39 @@ string_match (pam_handle_t *pamh, const char *tok, const char *string,139+@@ -895,6 +898,39 @@ string_match (pam_handle_t *pamh, const char *tok, const char *string,
143 }140 }
144 141
145 142
@@ -179,7 +176,7 @@ index 48e7c7e9..109115e9 100644
179 /* network_netmask_match - match a string against one token176 /* network_netmask_match - match a string against one token
180 * where string is a hostname or ip (v4,v6) address and tok177 * where string is a hostname or ip (v4,v6) address and tok
181 * represents either a hostname, a single ip (v4,v6) address178 * represents either a hostname, a single ip (v4,v6) address
182-@@ -773,10 +809,42 @@ network_netmask_match (pam_handle_t *pamh,179+@@ -956,10 +992,42 @@ network_netmask_match (pam_handle_t *pamh,
183 return NO;180 return NO;
184 }181 }
185 }182 }
@@ -223,6 +220,3 @@ index 48e7c7e9..109115e9 100644
223 * Let getaddrinfo sort everything out220 * Let getaddrinfo sort everything out
224 */221 */
225 if (getaddrinfo (tok, NULL, NULL, &ai) != 0)222 if (getaddrinfo (tok, NULL, NULL, &ai) != 0)
226---
227-2.33.0
228- 
Dbackport-CVE-2024-22365-pam_namespace-protect_dir-use-O_DIRECTORY-to-prevent.patch+0-58
@@ -1,58 +0,0 @@
1-From 031bb5a5d0d950253b68138b498dc93be69a64cb Mon Sep 17 00:00:00 2001
2-From: Matthias Gerstner <matthias.gerstner@suse.de>
3-Date: Wed, 27 Dec 2023 14:01:59 +0100
4-Subject: [PATCH] pam_namespace: protect_dir(): use O_DIRECTORY to prevent
5- local DoS situations
6- 
7-Without O_DIRECTORY the path crawling logic is subject to e.g. FIFOs
8-being placed in user controlled directories, causing the PAM module to
9-block indefinitely during `openat()`.
10- 
11-Pass O_DIRECTORY to cause the `openat()` to fail if the path does not
12-refer to a directory.
13- 
14-With this the check whether the final path element is a directory
15-becomes unnecessary, drop it.
16----
17- modules/pam_namespace/pam_namespace.c | 18 +-----------------
18- 1 file changed, 1 insertion(+), 17 deletions(-)
19- 
20-diff --git a/modules/pam_namespace/pam_namespace.c b/modules/pam_namespace/pam_namespace.c
21-index 2528cff8..f72d6718 100644
22---- a/modules/pam_namespace/pam_namespace.c
23-+++ b/modules/pam_namespace/pam_namespace.c
24-@@ -1201,7 +1201,7 @@ static int protect_dir(const char *path, mode_t mode, int do_mkdir,
25- int dfd = AT_FDCWD;
26- int dfd_next;
27- int save_errno;
28-- int flags = O_RDONLY;
29-+ int flags = O_RDONLY | O_DIRECTORY;
30- int rv = -1;
31- struct stat st;
32-
33-@@ -1255,22 +1255,6 @@ static int protect_dir(const char *path, mode_t mode, int do_mkdir,
34- rv = openat(dfd, dir, flags);
35- }
36-
37-- if (rv != -1) {
38-- if (fstat(rv, &st) != 0) {
39-- save_errno = errno;
40-- close(rv);
41-- rv = -1;
42-- errno = save_errno;
43-- goto error;
44-- }
45-- if (!S_ISDIR(st.st_mode)) {
46-- close(rv);
47-- errno = ENOTDIR;
48-- rv = -1;
49-- goto error;
50-- }
51-- }
52--
53- if (flags & O_NOFOLLOW) {
54- /* we are inside user-owned dir - protect */
55- if (protect_mount(rv, p, idata) == -1) {
56---
57-2.33.0
58- 
Dbackport-pam_access-make-non-resolveable-hostname-a-debug-out.patch+0-33
@@ -1,33 +0,0 @@
1-From 741acf4ff707d53b94947736a01eeeda5e2c7e98 Mon Sep 17 00:00:00 2001
2-From: Thorsten Kukuk <kukuk@suse.com>
3-Date: Fri, 4 Aug 2023 15:46:16 +0200
4-Subject: [PATCH] pam_access: make non-resolveable hostname a debug output
5- (#590)
6- 
7-Conflict:NA
8-Reference:https://github.com/linux-pam/linux-pam/commit/741acf4ff707d53b94947736a01eeeda5e2c7e98
9- 
10-* modules/pam_access/pam_access.c (network_netmask_match): Don't print
11-an error if a string is not resolveable, only a debug message in debug
12-mode. We even don't know if that entry is for remote logins or not.
13----
14- modules/pam_access/pam_access.c | 3 ++-
15- 1 file changed, 2 insertions(+), 1 deletion(-)
16- 
17-diff --git a/modules/pam_access/pam_access.c b/modules/pam_access/pam_access.c
18-index f70b7e49..985dc7de 100644
19---- a/modules/pam_access/pam_access.c
20-+++ b/modules/pam_access/pam_access.c
21-@@ -876,7 +876,8 @@ network_netmask_match (pam_handle_t *pamh,
22- */
23- if (getaddrinfo (tok, NULL, NULL, &ai) != 0)
24- {
25-- pam_syslog(pamh, LOG_ERR, "cannot resolve hostname \"%s\"", tok);
26-+ if (item->debug)
27-+ pam_syslog(pamh, LOG_DEBUG, "cannot resolve hostname \"%s\"", tok);
28-
29- return NO;
30- }
31---
32-2.33.0
33- 
Dbackport-pam_pwhistory-fix-passing-NULL-filename-argument-to-pwhistory-helper.patch+0-67
@@ -1,67 +0,0 @@
1-From 80dc2d410595b5193d32f965185710df27f3984e Mon Sep 17 00:00:00 2001
2-From: Md Zain Hasib <hasibm@vmware.com>
3-Date: Sat, 29 Jul 2023 11:01:35 +0530
4-Subject: [PATCH] pam_pwhistory: fix passing NULL filename argument to
5- pwhistory helper
6- 
7-This change fixes a bug when pwhistory_helper is invoked from
8-pam_pwhistory with an NULL filename, pwhistory_helper receives a short
9-circuited argc count of 3, ignoring the rest of the arguments passed
10-due to filename being NULL. To resolve the issue, an empty string is
11-passed in case the filename is empty, which is later changed back to
12-NULL in pwhistory_helper so that it can be passed to opasswd to read
13-the default opasswd file.
14- 
15-* modules/pam_pwhistory/pam_pwhistory.c (run_save_helper,
16-run_check_helper): Replace NULL filename argument with an empty string.
17-* modules/pam_pwhistory/pwhistory_helper.c (main): Replace empty string
18-filename argument with NULL.
19- 
20-Fixes: 11c35109a67f ("pam_pwhistory: Enable alternate location for password history file (#396)")
21-Signed-off-by: Dmitry V. Levin <ldv@strace.io>
22- 
23-Reference: https://github.com/linux-pam/linux-pam/commit/80dc2d410595b5193d32f965185710df27f3984e
24-Conflict: NA
25----
26- modules/pam_pwhistory/pam_pwhistory.c | 4 ++--
27- modules/pam_pwhistory/pwhistory_helper.c | 2 +-
28- 2 files changed, 3 insertions(+), 3 deletions(-)
29- 
30-diff --git a/modules/pam_pwhistory/pam_pwhistory.c b/modules/pam_pwhistory/pam_pwhistory.c
31-index 5a7fb81..98ddffc 100644
32---- a/modules/pam_pwhistory/pam_pwhistory.c
33-+++ b/modules/pam_pwhistory/pam_pwhistory.c
34-@@ -141,7 +141,7 @@ run_save_helper(pam_handle_t *pamh, const char *user,
35- args[0] = (char *)PWHISTORY_HELPER;
36- args[1] = (char *)"save";
37- args[2] = (char *)user;
38-- args[3] = (char *)filename;
39-+ args[3] = (char *)((filename != NULL) ? filename : "");
40- DIAG_POP_IGNORE_CAST_QUAL;
41- if (asprintf(&args[4], "%d", howmany) < 0 ||
42- asprintf(&args[5], "%d", debug) < 0)
43-@@ -228,7 +228,7 @@ run_check_helper(pam_handle_t *pamh, const char *user,
44- args[0] = (char *)PWHISTORY_HELPER;
45- args[1] = (char *)"check";
46- args[2] = (char *)user;
47-- args[3] = (char *)filename;
48-+ args[3] = (char *)((filename != NULL) ? filename : "");
49- DIAG_POP_IGNORE_CAST_QUAL;
50- if (asprintf(&args[4], "%d", debug) < 0)
51- {
52-diff --git a/modules/pam_pwhistory/pwhistory_helper.c b/modules/pam_pwhistory/pwhistory_helper.c
53-index 469d95f..fb9a1e3 100644
54---- a/modules/pam_pwhistory/pwhistory_helper.c
55-+++ b/modules/pam_pwhistory/pwhistory_helper.c
56-@@ -108,7 +108,7 @@ main(int argc, char *argv[])
57-
58- option = argv[1];
59- user = argv[2];
60-- filename = argv[3];
61-+ filename = (argv[3][0] != '\0') ? argv[3] : NULL;
62-
63- if (strcmp(option, "check") == 0 && argc == 5)
64- return check_history(user, filename, argv[4]);
65---
66-2.43.0
67- 
Dbackport-pam_selinux-fix-formatting-of-audit-messages.patch+0-26
@@ -1,26 +0,0 @@
1-From 1648734a69c31e9ce834da70144ac9a453296807 Mon Sep 17 00:00:00 2001
2-From: Steve Grubb <sgrubb@redhat.com>
3-Date: Fri, 4 Aug 2023 17:45:45 -0400
4-Subject: [PATCH] pam_selinux: fix formatting of audit messages
5- 
6-pam_selinux uses audit_log_user_message to write to the audit system.
7-It does not take an op argument, so you have to add one yourself. Otherwise
8-the pam_selinux part of the message is lost because it's not in key=value
9-format.
10----
11- modules/pam_selinux/pam_selinux.c | 2 +-
12- 1 file changed, 1 insertion(+), 1 deletion(-)
13- 
14-diff --git a/modules/pam_selinux/pam_selinux.c b/modules/pam_selinux/pam_selinux.c
15-index e52e0fc45..713b3f73f 100644
16---- a/modules/pam_selinux/pam_selinux.c
17-+++ b/modules/pam_selinux/pam_selinux.c
18-@@ -97,7 +97,7 @@ send_audit_message(const pam_handle_t *pamh, int success, const char *default_co
19- pam_syslog(pamh, LOG_ERR, "Error translating selected context '%s'.", selected_context);
20- selected_raw = NULL;
21- }
22-- if (asprintf(&msg, "pam: default-context=%s selected-context=%s",
23-+ if (asprintf(&msg, "op=pam_selinux default-context=%s selected-context=%s",
24- default_raw ? default_raw : (default_context ? default_context : "?"),
25- selected_raw ? selected_raw : (selected_context ? selected_context : "?")) < 0) {
26- msg = NULL; /* asprintf leaves msg in undefined state on failure */
Dbackport-pam_shells-Plug-econf-memory-leak.patch+0-22
@@ -1,22 +0,0 @@
1-From 1a734af22a9f35a9a09edaea44a4e0767de6343b Mon Sep 17 00:00:00 2001
2-From: Tobias Stoeckmann <tobias@stoeckmann.org>
3-Date: Thu, 18 May 2023 17:55:21 +0200
4-Subject: [PATCH] pam_shells: Plug econf memory leak
5- 
6-Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
7----
8- modules/pam_shells/pam_shells.c | 1 +
9- 1 file changed, 1 insertion(+)
10- 
11-diff --git a/modules/pam_shells/pam_shells.c b/modules/pam_shells/pam_shells.c
12-index 05c09c656..276a56dd5 100644
13---- a/modules/pam_shells/pam_shells.c
14-+++ b/modules/pam_shells/pam_shells.c
15-@@ -112,6 +112,7 @@ static int perform_check(pam_handle_t *pamh)
16- if (!retval)
17- break;
18- }
19-+ econf_free (keys);
20- econf_free (key_file);
21- #else
22- char shellFileLine[256];
Dchange-ndbm-to-gdbm.patch+0-25
@@ -1,25 +0,0 @@
1-From c8ff297d3ca1d5a195147c32859b87dba820c281 Mon Sep 17 00:00:00 2001
2-From: gaoyi <gaoyi15$huawei.com>
3-Date: Wed, 28 Oct 2020 19:37:25 +0800
4-Subject: [PATCH] change ndbm to gdbm
5- 
6----
7- configure.ac | 2 +-
8- 1 file changed, 1 insertion(+), 1 deletion(-)
9- 
10-diff --git a/configure.ac b/configure.ac
11-index b9b0f83..7262199 100644
12---- a/configure.ac
13-+++ b/configure.ac
14-@@ -447,7 +447,7 @@ if test x"$WITH_DB" != xno ; then
15- LIBS=$old_libs
16- fi
17- if test -z "$LIBDB" ; then
18-- AC_CHECK_LIB([ndbm],[dbm_store], LIBDB="-lndbm", LIBDB="")
19-+ AC_CHECK_LIB([gdbm_compat],[dbm_store], LIBDB="-lgdbm_compat", LIBDB="")
20- if test -n "$LIBDB" ; then
21- AC_CHECK_HEADERS(ndbm.h)
22- fi
23---
24-2.33.0
25- 
Apam-1.7.0-fop-optional.patch+50-0
@@ -0,0 +1,50 @@
1+From 5cab1abeebddf12f506826e4a037c903b188c0c4 Mon Sep 17 00:00:00 2001
2+From: Yaakov Selkowitz <yselkowi@redhat.com>
3+Date: Mon, 4 Nov 2024 22:55:18 -0500
4+Subject: [PATCH] doc: make PDF documentation optional
5+ 
6+While building any documentation requires xsltproc, only the PDF
7+documentation requires fop, which is dependency-heavy, and not always
8+available (e.g. it is not included in RHEL). This allows the HTML
9+documentation to be built while skipping the PDFs.
10+---
11+ doc/guide-meson.build | 2 ++
12+ meson.build | 2 +-
13+ 2 files changed, 3 insertions(+), 1 deletion(-)
14+ 
15+diff --git a/doc/guide-meson.build b/doc/guide-meson.build
16+index e29d16e2..4ec8a69f 100644
17+--- a/doc/guide-meson.build
18++++ b/doc/guide-meson.build
19+@@ -56,6 +56,7 @@ custom_target(
20+ )
21+
22+
23++if prog_fop.found()
24+ fop = custom_target(
25+ input: xml,
26+ output: name + '.fop',
27+@@ -85,6 +86,7 @@ custom_target(
28+ install_dir: pdfdir,
29+ install_tag: 'doc',
30+ )
31++endif
32+
33+
34+ subdir('html')
35+diff --git a/meson.build b/meson.build
36+index e3d8cc2a..664bd126 100644
37+--- a/meson.build
38++++ b/meson.build
39+@@ -502,7 +502,7 @@ if enable_docs
40+ endif
41+ prog_fop = find_program(
42+ 'fop',
43+- required: feature_docs,
44++ required: false,
45+ disabler: true,
46+ )
47+
48+--
49+2.47.0
50+ 
Mpam.spec+38-36
@@ -3,8 +3,8 @@
3%define _secconfdir %{_sysconfdir}/security3%define _secconfdir %{_sysconfdir}/security
4%define _pamconfdir %{_sysconfdir}/pam.d4%define _pamconfdir %{_sysconfdir}/pam.d
5Name: pam5Name: pam
6-Version: 1.5.36+Version: 1.7.0
7-Release: 87+Release: 1
8Summary: Pluggable Authentication Modules for Linux8Summary: Pluggable Authentication Modules for Linux
9License: BSD-3-Clause AND GPL-2.0-or-later9License: BSD-3-Clause AND GPL-2.0-or-later
10URL: http://www.linux-pam.org/10URL: http://www.linux-pam.org/
@@ -20,21 +20,30 @@ Source18: https://www.gnu.org/licenses/old-licenses/gpl-2.0.txt
20Provides: %{name}-sm3 = %{version}-%{release}20Provides: %{name}-sm3 = %{version}-%{release}
21 21 
22Patch1: bugfix-pam-1.1.8-faillock-systemtime.patch22Patch1: bugfix-pam-1.1.8-faillock-systemtime.patch
23-Patch2: backport-CVE-2024-22365-pam_namespace-protect_dir-use-O_DIRECTORY-to-prevent.patch23+Patch2: Linux-PAM-1.7.0-fix-xtests-name.patch
24-Patch3: backport-pam_pwhistory-fix-passing-NULL-filename-argument-to-pwhistory-helper.patch24+Patch3: pam-1.7.0-fop-optional.patch
25-Patch4: backport-pam_shells-Plug-econf-memory-leak.patch
26-Patch5: backport-pam_selinux-fix-formatting-of-audit-messages.patch
27-Patch6: backport-pam_access-make-non-resolveable-hostname-a-debug-out.patch
28Patch7: backport-CVE-2024-10963.patch25Patch7: backport-CVE-2024-10963.patch
29-Patch8: backport-CVE-2024-10041.patch
30-Patch9: backport-CVE-2024-10041-pam_unix-try-to-set-uid-to-0-for-unix_chkpwd.patch
31 26 
32-Patch9000:change-ndbm-to-gdbm.patch27+Patch9001: add-sm3-crypt-support.patch
33-Patch9001:add-sm3-crypt-support.patch
34 28 
35-BuildRequires: autoconf automake libtool bison flex sed cracklib-devel gdbm-devel29+BuildRequires: meson >= 0.62.0
36-BuildRequires: perl-interpreter pkgconfig gettext-devel libtirpc-devel libnsl2-devel30+BuildRequires: pkgconfig(audit)
37-BuildRequires: audit-libs-devel libselinux-devel31+BuildRequires: pkgconfig(libcrypt)
32+BuildRequires: pkgconfig(libcrypto)
33+BuildRequires: pkgconfig(libnsl)
34+BuildRequires: pkgconfig(libselinux)
35+BuildRequires: pkgconfig(libsystemd) >= 254
36+BuildRequires: pkgconfig(libtirpc)
37+BuildRequires: gdbm-devel
38+BuildRequires: /usr/bin/bison
39+BuildRequires: /usr/bin/elinks
40+BuildRequires: /usr/bin/flex
41+BuildRequires: /usr/bin/gettext
42+BuildRequires: /usr/bin/msgfmt
43+BuildRequires: /usr/bin/xmlcatalog
44+BuildRequires: /usr/bin/xmllint
45+BuildRequires: /usr/bin/xsltproc
46+BuildRequires: docbook5-style-xsl docbook5-schemas
LFunda Wang
LLinux_zhang2024Nov 25, 2024

新增构建依赖是来自pam-1.7.0 上游的指导说明？还是参考业界同版本的编译方案？ 本次pr，28行至45行有较多新增构建依赖，对此有些疑惑（如何确定需要这些依赖？） ?

likedislike
Funda WangFunda WangNov 25, 2024

新增构建依赖是来自pam-1.7.0 上游的指导说明？还是参考业界同版本的编译方案？ 本次pr，28行至45行有较多新增构建依赖，对此有些疑惑（如何确定需要这些依赖？） ?

理论上说，研究编译脚本。不管是 autotools，cmake 还是 meson，都有其编译脚本。编译脚本里会写明编译过程中依赖什么上游软件的什么版本。比如pkgconfig(libsystemd) >= 254来自这一行： https://github.com/linux-pam/linux-pam/blob/940747f88c16e029b69a74e80a2e94f65cb3e628/meson.build#L322

还有一种办法是不断进行构建，通过编译失败的日志，来判断需要增加哪些 buildrequires。比如这个过程： https://eulermaker.compass-ci.openeuler.openatom.cn/package/build?osProject=fundawang:master:epol:cmake&packageName=pam

likedislike
LLinux_zhang2024Nov 26, 2024

新增构建依赖是来自pam-1.7.0 上游的指导说明？还是参考业界同版本的编译方案？ 本次pr，28行至45行有较多新增构建依赖，对此有些疑惑（如何确定需要这些依赖？） ?

非常感谢您的解惑 👍

likedislike
38 47 
39Requires: cracklib libpwquality coreutils glibc audit-libs libselinux libxcrypt-sm348Requires: cracklib libpwquality coreutils glibc audit-libs libselinux libxcrypt-sm3
40 49 
@@ -56,26 +65,20 @@ Requires: %{name} = %{version}-%{release}
56cp %{S:18} .65cp %{S:18} .
57 66 
58%build67%build
59-autoreconf -i68+%meson \
60-%configure \69+ --libdir=%{_pamlibdir} \
61- --disable-rpath \70+ --includedir=%{_includedir}/security \
62- --libdir=%{_pamlibdir} \71+ -Ddb=gdbm \
63- --includedir=%{_includedir}/security \72+ -Deconf=disabled \
64- --disable-static \73+ -Dpam_lastlog=enabled
65- --disable-prelude \74+%meson_build
66- --enable-db=ndbm \
67- --enable-lastlog
68- 
69-make -C po update-gmo
70-%make_build
71 75 
72%install76%install
73-%make_install77+%meson_install
74-%delete_la
75 78 
76mkdir -p doc/README.d79mkdir -p doc/README.d
77-for readme in modules/pam_*/README ; do80+for readme in %{_vpath_builddir}/modules/pam_*/*.txt ; do
78- cp -f ${readme} doc/README.d/README.`dirname ${readme} | sed -e 's@^modules/@@'`81+ cp -f ${readme} doc/README.d/README.`dirname ${readme} | sed -e 's@^%{_vpath_builddir}/modules/@@'`
79done82done
80 83 
81ln -sf pam_sepermit.so $RPM_BUILD_ROOT%{_moduledir}/pam_selinux_permit.so84ln -sf pam_sepermit.so $RPM_BUILD_ROOT%{_moduledir}/pam_selinux_permit.so
@@ -85,9 +88,6 @@ rm -f $RPM_BUILD_ROOT%{_sysconfdir}/environment
85 88 
86install -d -m 755 $RPM_BUILD_ROOT%{_pamconfdir}89install -d -m 755 $RPM_BUILD_ROOT%{_pamconfdir}
87 90 
88-install -m 644 -D modules/pam_namespace/pam_namespace.service \
89- %{buildroot}%{_unitdir}/pam_namespace.service
90- 
91install -m 644 %{SOURCE5} $RPM_BUILD_ROOT%{_pamconfdir}/other91install -m 644 %{SOURCE5} $RPM_BUILD_ROOT%{_pamconfdir}/other
92install -m 644 %{SOURCE6} $RPM_BUILD_ROOT%{_pamconfdir}/system-auth92install -m 644 %{SOURCE6} $RPM_BUILD_ROOT%{_pamconfdir}/system-auth
93install -m 644 %{SOURCE7} $RPM_BUILD_ROOT%{_pamconfdir}/password-auth93install -m 644 %{SOURCE7} $RPM_BUILD_ROOT%{_pamconfdir}/password-auth
@@ -108,11 +108,11 @@ rm -fr $RPM_BUILD_ROOT/usr/share/doc/pam
108%find_lang Linux-PAM108%find_lang Linux-PAM
109 109 
110%check110%check
111-%make_build check111+%meson_test
112 112 
113%files -f Linux-PAM.lang113%files -f Linux-PAM.lang
114%license Copyright COPYING gpl-2.0.txt 114%license Copyright COPYING gpl-2.0.txt
115-%doc AUTHORS README ChangeLog NEWS115+%doc AUTHORS README NEWS
116%doc doc/README.d/116%doc doc/README.d/
117%dir %{_pamconfdir}117%dir %{_pamconfdir}
118%config(noreplace) %{_pamconfdir}/other118%config(noreplace) %{_pamconfdir}/other
@@ -129,7 +129,6 @@ rm -fr $RPM_BUILD_ROOT/usr/share/doc/pam
129%attr(0755,root,root) %{_sbindir}/pwhistory_helper129%attr(0755,root,root) %{_sbindir}/pwhistory_helper
130%{_sbindir}/faillock130%{_sbindir}/faillock
131%{_sbindir}/mkhomedir_helper131%{_sbindir}/mkhomedir_helper
132-%{_sbindir}/pam_namespace_helper
133%attr(0755,root,root) %{_sbindir}/pam_namespace_helper132%attr(0755,root,root) %{_sbindir}/pam_namespace_helper
134%dir %{_moduledir}133%dir %{_moduledir}
135%{_moduledir}/pam*.so134%{_moduledir}/pam*.so
@@ -167,6 +166,9 @@ rm -fr $RPM_BUILD_ROOT/usr/share/doc/pam
167 166 
168 167 
169%changelog168%changelog
169+* Wed Dec 25 2024 Funda Wang <fundawang@yeah.net> - 1.7.0-1
170+- update to 1.7.0
171+ 
170* Tue Dec 17 2024 dongyuzhen <dongyuzhen@h-partners.com> - 1.5.3-8172* Tue Dec 17 2024 dongyuzhen <dongyuzhen@h-partners.com> - 1.5.3-8
171- fix CVE-2024-10041173- fix CVE-2024-10041
172 174 
Mpam.yaml+1-1
@@ -1,4 +1,4 @@
1version_control: github1version_control: github
2src_repo: linux-pam/linux-pam2src_repo: linux-pam/linux-pam
3tag_prefix: ^v3tag_prefix: ^v
4-seperator: .4+separator: .