Pisilinux/core
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

create core package

Browse Source
This commit is contained in:
aydemir
2015-02-24 11:18:35 +02:00
parent 0e4b743b82
commit 70b25d0f95
1098 changed files with 169545 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
system/base/pam/actions.py
+39
View File
@@ -0,0 +1,39 @@
#!/usr/bin/python
# -*- coding: utf-8 -*-
#
# Licensed under the GNU General Public License, version 3.
# See the file http://www.gnu.org/licenses/gpl.txt
from pisi.actionsapi import autotools
from pisi.actionsapi import pisitools
from pisi.actionsapi import shelltools
from pisi.actionsapi import get
def setup():
pisitools.flags.add("-fPIC -D_GNU_SOURCE")
autotools.autoreconf("-fi")
autotools.configure("--enable-nls \
--enable-securedir=/lib/security \
--enable-isadir=/lib/security")
def build():
# Update .po files
autotools.make("-C po update-gmo")
autotools.make()
def check():
autotools.make("check")
# dlopen check
shelltools.system("./dlopen-test.sh")
pass
def install():
autotools.rawInstall("DESTDIR=%s" % get.installDIR())
pisitools.removeDir("/usr/share/doc/Linux-PAM/")
pisitools.doman("doc/man/*.[0-9]")
pisitools.dodoc("CHANGELOG", "Copyright", "README")
system/base/pam/comar/postInstall.py
+4
View File
@@ -0,0 +1,4 @@
import os
def postInstall(fromVersion, fromRelease, toVersion, toRelease):
os.chmod("/sbin/unix_chkpwd", 04755)
system/base/pam/files/90-nproc.conf
+5
View File
@@ -0,0 +1,5 @@
# Default limit for number of user's processes to prevent
# accidental fork bombs.
# See rhbz #432903 for reasoning.
* soft nproc 1024
system/base/pam/files/dlopen-test.sh
+10
View File
@@ -0,0 +1,10 @@
#!/bin/bash
/sbin/ldconfig -n libpam/.libs
for module in modules/*/.libs/*.so ; do
if ! env LD_LIBRARY_PATH=libpam/.libs \
./dlopen.sh -ldl -lpam -Llibpam/.libs ${module} ; then
echo ERROR module: ${module} cannot be loaded.
exit 1
fi
done
system/base/pam/files/dlopen.sh
+75
View File
@@ -0,0 +1,75 @@
#!/bin/sh
tempdir=`mktemp -d /tmp/dlopenXXXXXX`
test -n "$tempdir" || exit 1
cat >> $tempdir/dlopen.c << _EOF
#include <dlfcn.h>
#include <stdio.h>
#include <limits.h>
#include <sys/stat.h>
/* Simple program to see if dlopen() would succeed. */
int main(int argc, char **argv)
{
int i;
struct stat st;
char buf[PATH_MAX];
for (i = 1; i < argc; i++) {
if (dlopen(argv[i], RTLD_NOW)) {
fprintf(stdout, "dlopen() of \"%s\" succeeded.\n",
argv[i]);
} else {
snprintf(buf, sizeof(buf), "./%s", argv[i]);
if ((stat(buf, &st) == 0) && dlopen(buf, RTLD_NOW)) {
fprintf(stdout, "dlopen() of \"./%s\" "
"succeeded.\n", argv[i]);
} else {
fprintf(stdout, "dlopen() of \"%s\" failed: "
"%s\n", argv[i], dlerror());
return 1;
}
}
}
return 0;
}
_EOF
for arg in $@ ; do
case "$arg" in
"")
;;
-I*|-D*|-f*|-m*|-g*|-O*|-W*)
cflags="$cflags $arg"
;;
-l*|-L*)
ldflags="$ldflags $arg"
;;
/*)
modules="$modules $arg"
;;
*)
modules="$modules $arg"
;;
esac
done
${CC:-gcc} $RPM_OPT_FLAGS $CFLAGS -o $tempdir/dlopen $cflags $tempdir/dlopen.c $ldflags -ldl
retval=0
for module in $modules ; do
case "$module" in
"")
;;
/*)
$tempdir/dlopen "$module"
retval=$?
;;
*)
$tempdir/dlopen ./"$module"
retval=$?
;;
esac
done
rm -f $tempdir/dlopen $tempdir/dlopen.c
rmdir $tempdir
exit $retval
system/base/pam/files/fedora/config-util.pamd
+8
View File
@@ -0,0 +1,8 @@
#%PAM-1.0
auth sufficient pam_rootok.so
auth sufficient pam_timestamp.so
auth include system-auth
account required pam_permit.so
session required pam_permit.so
session optional pam_xauth.so
session optional pam_timestamp.so
system/base/pam/files/fedora/dlopen-test.sh
+10
View File
@@ -0,0 +1,10 @@
#!/bin/bash
/sbin/ldconfig -n libpam/.libs
for module in modules/*/.libs/*.so ; do
if ! env LD_LIBRARY_PATH=libpam/.libs \
./dlopen.sh -ldl -lpam -Llibpam/.libs ${module} ; then
echo ERROR module: ${module} cannot be loaded.
exit 1
fi
done
system/base/pam/files/fedora/dlopen.sh
+75
View File
@@ -0,0 +1,75 @@
#!/bin/sh
tempdir=`mktemp -d /tmp/dlopenXXXXXX`
test -n "$tempdir" || exit 1
cat >> $tempdir/dlopen.c << _EOF
#include <dlfcn.h>
#include <stdio.h>
#include <limits.h>
#include <sys/stat.h>
/* Simple program to see if dlopen() would succeed. */
int main(int argc, char **argv)
{
int i;
struct stat st;
char buf[PATH_MAX];
for (i = 1; i < argc; i++) {
if (dlopen(argv[i], RTLD_NOW)) {
fprintf(stdout, "dlopen() of \"%s\" succeeded.\n",
argv[i]);
} else {
snprintf(buf, sizeof(buf), "./%s", argv[i]);
if ((stat(buf, &st) == 0) && dlopen(buf, RTLD_NOW)) {
fprintf(stdout, "dlopen() of \"./%s\" "
"succeeded.\n", argv[i]);
} else {
fprintf(stdout, "dlopen() of \"%s\" failed: "
"%s\n", argv[i], dlerror());
return 1;
}
}
}
return 0;
}
_EOF
for arg in $@ ; do
case "$arg" in
"")
;;
-I*|-D*|-f*|-m*|-g*|-O*|-W*)
cflags="$cflags $arg"
;;
-l*|-L*)
ldflags="$ldflags $arg"
;;
/*)
modules="$modules $arg"
;;
*)
modules="$modules $arg"
;;
esac
done
${CC:-gcc} $RPM_OPT_FLAGS $CFLAGS -o $tempdir/dlopen $cflags $tempdir/dlopen.c $ldflags -ldl
retval=0
for module in $modules ; do
case "$module" in
"")
;;
/*)
$tempdir/dlopen "$module"
retval=$?
;;
*)
$tempdir/dlopen ./"$module"
retval=$?
;;
esac
done
rm -f $tempdir/dlopen $tempdir/dlopen.c
rmdir $tempdir
exit $retval
system/base/pam/files/fedora/fingerprint-auth.pamd
+18
View File
@@ -0,0 +1,18 @@
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth sufficient pam_fprintd.so
auth required pam_deny.so
account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 500 quiet
account required pam_permit.so
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
system/base/pam/files/fedora/other.pamd
+5
View File
@@ -0,0 +1,5 @@
#%PAM-1.0
auth required pam_deny.so
account required pam_deny.so
password required pam_deny.so
session required pam_deny.so
system/base/pam/files/fedora/password-auth.pamd
+17
View File
@@ -0,0 +1,17 @@
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth sufficient pam_unix.so try_first_pass nullok
auth required pam_deny.so
account required pam_unix.so
password requisite pam_cracklib.so try_first_pass retry=3 type=
password sufficient pam_unix.so try_first_pass use_authtok nullok sha512 shadow
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
system/base/pam/files/fedora/smartcard-auth.pamd
+19
View File
@@ -0,0 +1,19 @@
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth [success=done ignore=ignore default=die] pam_pkcs11.so wait_for_card
auth required pam_deny.so
account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 500 quiet
account required pam_permit.so
password optional pam_pkcs11.so
password requisite pam_cracklib.so try_first_pass retry=3 type=
session optional pam_keyinit.so revoke
session required pam_limits.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
system/base/pam/files/fedora/system-auth.pamd
+17
View File
@@ -0,0 +1,17 @@
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth sufficient pam_unix.so try_first_pass nullok
auth required pam_deny.so
account required pam_unix.so
password requisite pam_cracklib.so try_first_pass retry=3 type=
password sufficient pam_unix.so try_first_pass use_authtok nullok sha512 shadow
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
system/base/pam/files/no-lib64.patch
+20
View File
@@ -0,0 +1,20 @@
Index: Linux-PAM-1.1.1/configure.in
===================================================================
--- Linux-PAM-1.1.1.orig/configure.in
+++ Linux-PAM-1.1.1/configure.in
@@ -24,15 +24,6 @@ dnl If we use /usr as prefix, use /etc f
then
sysconfdir="/etc"
fi
- if test ${libdir} = '${exec_prefix}/lib'
- then
- case "`uname -m`" in
- x86_64|ppc64|s390x|sparc64)
- libdir="/lib64" ;;
- *)
- libdir="/lib" ;;
- esac
- fi
if test ${sbindir} = '${exec_prefix}/sbin'
then
sbindir="/sbin"
system/base/pam/files/nosex-libtirpc-underlinking.patch
+60
View File
@@ -0,0 +1,60 @@
--- Linux-PAM-1.1.6-orig/configure 2012-08-17 11:51:46.000000000 +0300
+++ Linux-PAM-1.1.6/configure 2013-01-23 05:11:03.262654565 +0200
@@ -780,8 +780,6 @@
LIBSELINUX
NIS_LIBS
NIS_CFLAGS
-libtirpc_LIBS
-libtirpc_CFLAGS
PKG_CONFIG
HAVE_LIBDB_FALSE
HAVE_LIBDB_TRUE
@@ -976,9 +974,7 @@
CPP
YACC
YFLAGS
-PKG_CONFIG
-libtirpc_CFLAGS
-libtirpc_LIBS'
+PKG_CONFIG'
# Initialize some variables set by options.
@@ -1672,10 +1668,6 @@
This script will default YFLAGS to the empty string to avoid a
default value of `-d' given by some make applications.
PKG_CONFIG path to pkg-config utility
- libtirpc_CFLAGS
- C compiler flags for libtirpc, overriding pkg-config
- libtirpc_LIBS
- linker flags for libtirpc, overriding pkg-config
Use these variables to override the choices made by `configure' or to help
it to find libraries and programs with nonstandard names/locations.
--- Linux-PAM-1.1.6-orig/configure.in 2012-08-17 11:48:24.000000000 +0300
+++ Linux-PAM-1.1.6/configure.in 2013-01-23 05:13:10.113650173 +0200
@@ -452,13 +452,6 @@
CFLAGS=$old_CFLAGS
LIBS=$old_LIBS
- dnl if there's libtirpc available, prefer that over the system
- dnl implementation.
- PKG_CHECK_MODULES([libtirpc], [libtirpc], [
- CFLAGS="$CFLAGS $libtirpc_CFLAGS"
- LIBS="$LIBS $libtirpc_LIBS"
- ], [:;])
-
AC_SEARCH_LIBS([yp_get_default_domain], [nsl])
AC_CHECK_FUNCS([yp_get_default_domain yperr_string yp_master yp_bind yp_match yp_unbind])
--- Linux-PAM-1.1.6-orig/Makefile.in 2012-08-17 11:51:46.000000000 +0300
+++ Linux-PAM-1.1.6/Makefile.in 2013-01-23 05:16:56.147642347 +0200
@@ -263,8 +263,6 @@
libc_cv_fpie = @libc_cv_fpie@
libdir = @libdir@
libexecdir = @libexecdir@
-libtirpc_CFLAGS = @libtirpc_CFLAGS@
-libtirpc_LIBS = @libtirpc_LIBS@
localedir = @localedir@
localstatedir = @localstatedir@
lt_ECHO = @lt_ECHO@
system/base/pam/files/pam-1.1.8-cve-2013-7041.patch
+52
View File
@@ -0,0 +1,52 @@
From 57a1e2b274d0a6376d92ada9926e5c5741e7da20 Mon Sep 17 00:00:00 2001
From: "Dmitry V. Levin" <ldv@altlinux.org>
Date: Fri, 24 Jan 2014 22:18:32 +0000
Subject: [PATCH] pam_userdb: fix password hash comparison
Starting with commit Linux-PAM-0-77-28-g0b3e583 that introduced hashed
passwords support in pam_userdb, hashes are compared case-insensitively.
This bug leads to accepting hashes for completely different passwords in
addition to those that should be accepted.
Additionally, commit Linux-PAM-1_1_6-13-ge2a8187 that added support for
modern password hashes with different lengths and settings, did not
update the hash comparison accordingly, which leads to accepting
computed hashes longer than stored hashes when the latter is a prefix
of the former.
* modules/pam_userdb/pam_userdb.c (user_lookup): Reject the computed
hash whose length differs from the stored hash length.
Compare computed and stored hashes case-sensitively.
Fixes CVE-2013-7041.
Bug-Debian: http://bugs.debian.org/731368
---
modules/pam_userdb/pam_userdb.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/modules/pam_userdb/pam_userdb.c b/modules/pam_userdb/pam_userdb.c
index de8b5b1..ff040e6 100644
--- a/modules/pam_userdb/pam_userdb.c
+++ b/modules/pam_userdb/pam_userdb.c
@@ -222,12 +222,15 @@ user_lookup (pam_handle_t *pamh, const char *database, const char *cryptmode,
} else {
cryptpw = crypt (pass, data.dptr);
- if (cryptpw) {
- compare = strncasecmp (data.dptr, cryptpw, data.dsize);
+ if (cryptpw && strlen(cryptpw) == (size_t)data.dsize) {
+ compare = memcmp(data.dptr, cryptpw, data.dsize);
} else {
compare = -2;
if (ctrl & PAM_DEBUG_ARG) {
- pam_syslog(pamh, LOG_INFO, "crypt() returned NULL");
+ if (cryptpw)
+ pam_syslog(pamh, LOG_INFO, "lengths of computed and stored hashes differ");
+ else
+ pam_syslog(pamh, LOG_INFO, "crypt() returned NULL");
}
};
--
1.8.3.1
system/base/pam/files/pam-1.1.8-cve-2014-2583.patch
+56
View File
@@ -0,0 +1,56 @@
From 9dcead87e6d7f66d34e7a56d11a30daca367dffb Mon Sep 17 00:00:00 2001
From: "Dmitry V. Levin" <ldv@altlinux.org>
Date: Wed, 26 Mar 2014 22:17:23 +0000
Subject: [PATCH] pam_timestamp: fix potential directory traversal issue
(ticket #27)
pam_timestamp uses values of PAM_RUSER and PAM_TTY as components of
the timestamp pathname it creates, so extra care should be taken to
avoid potential directory traversal issues.
* modules/pam_timestamp/pam_timestamp.c (check_tty): Treat
"." and ".." tty values as invalid.
(get_ruser): Treat "." and ".." ruser values, as well as any ruser
value containing '/', as invalid.
Fixes CVE-2014-2583.
Reported-by: Sebastian Krahmer <krahmer@suse.de>
---
modules/pam_timestamp/pam_timestamp.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/modules/pam_timestamp/pam_timestamp.c b/modules/pam_timestamp/pam_timestamp.c
index 5193733..b3f08b1 100644
--- a/modules/pam_timestamp/pam_timestamp.c
+++ b/modules/pam_timestamp/pam_timestamp.c
@@ -158,7 +158,7 @@ check_tty(const char *tty)
tty = strrchr(tty, '/') + 1;
}
/* Make sure the tty wasn't actually a directory (no basename). */
- if (strlen(tty) == 0) {
+ if (!strlen(tty) || !strcmp(tty, ".") || !strcmp(tty, "..")) {
return NULL;
}
return tty;
@@ -243,6 +243,17 @@ get_ruser(pam_handle_t *pamh, char *ruserbuf, size_t ruserbuflen)
if (pwd != NULL) {
ruser = pwd->pw_name;
}
+ } else {
+ /*
+ * This ruser is used by format_timestamp_name as a component
+ * of constructed timestamp pathname, so ".", "..", and '/'
+ * are disallowed to avoid potential path traversal issues.
+ */
+ if (!strcmp(ruser, ".") ||
+ !strcmp(ruser, "..") ||
+ strchr(ruser, '/')) {
+ ruser = NULL;
+ }
}
if (ruser == NULL || strlen(ruser) >= ruserbuflen) {
*ruserbuf = '\0';
--
1.8.3.1
system/base/pam/pspec.xml
+117
View File
@@ -0,0 +1,117 @@
<?xml version="1.0" ?>
<!DOCTYPE PISI SYSTEM "http://www.pisilinux.org/projeler/pisi/pisi-spec.dtd">
<PISI>
<Source>
<Name>pam</Name>
<Homepage>http://www.kernel.org/pub/linux/libs/pam/</Homepage>
<Packager>
<Name>PisiLinux Community</Name>
<Email>admins@pisilinux.org</Email>
</Packager>
<License>PAM</License>
<IsA>library</IsA>
<Summary>Pluggable Authentication Modules</Summary>
<Description>PAM (Pluggable Authentication Modules) is a system security tool that allows system administrators to set authentication policy without having to recompile programs that handle authentication.</Description>
<Archive sha1sum="f8ce53c67363f78d520392fa1c253c4978058be1" type="tarbz2">http://www.linux-pam.org/library/Linux-PAM-1.1.8.tar.bz2</Archive>
<AdditionalFiles>
<AdditionalFile target="dlopen.sh" permission="0755">dlopen.sh</AdditionalFile>
<AdditionalFile target="dlopen-test.sh" permission="0755">dlopen-test.sh</AdditionalFile>
</AdditionalFiles>
<BuildDependencies>
<Dependency>perl</Dependency>
<Dependency>gettext</Dependency>
<Dependency>cracklib</Dependency>
<Dependency>audit-devel</Dependency>
</BuildDependencies>
<Patches>
<!-- <Patch level="1">Linux-PAM-1.1.6-destdir.patch</Patch> -->
<Patch level="1">no-lib64.patch</Patch>
<Patch level="1">nosex-libtirpc-underlinking.patch</Patch>
<Patch level="1">pam-1.1.8-cve-2013-7041.patch</Patch>
<Patch level="1">pam-1.1.8-cve-2014-2583.patch</Patch>
</Patches>
</Source>
<Package>
<Name>pam</Name>
<RuntimeDependencies>
<Dependency>audit</Dependency>
<Dependency>cracklib</Dependency>
</RuntimeDependencies>
<Files>
<Path fileType="config">/etc</Path>
<Path fileType="library">/lib</Path>
<Path fileType="data">/var/run/console</Path>
<Path fileType="library">/usr/lib</Path>
<Path fileType="executable">/sbin</Path>
<Path fileType="executable">/usr/sbin</Path>
<Path fileType="doc">/usr/share/doc</Path>
<Path fileType="man">/usr/share/man</Path>
<Path fileType="localedata">/usr/share/locale</Path>
</Files>
<AdditionalFiles>
<AdditionalFile owner="root" permission="0644" target="/etc/limit.d/90-nproc.conf">90-nproc.conf</AdditionalFile>
</AdditionalFiles>
<Provides>
<COMAR script="postInstall.py">System.Package</COMAR>
</Provides>
</Package>
<Package>
<Name>pam-devel</Name>
<PartOf>system.devel</PartOf>
<Summary>Development files for pam</Summary>
<RuntimeDependencies>
<Dependency release="current">pam</Dependency>
</RuntimeDependencies>
<Files>
<Path fileType="header">/usr/include</Path>
<Path fileType="man">/usr/share/man/man3</Path>
</Files>
</Package>
<History>
<Update release="6">
<Date>2014-06-10</Date>
<Version>1.1.8</Version>
<Comment>Add patch CVE.</Comment>
<Name>Alihan Öztürk</Name>
<Email>alihan@pisilinux.org</Email>
</Update>
<Update release="5">
<Date>2014-05-11</Date>
<Version>1.1.8</Version>
<Comment>Release bump.</Comment>
<Name>Marcin Bojara</Name>
<Email>marcin@pisilinux.org</Email>
</Update>
<Update release="4">
<Date>2013-10-22</Date>
<Version>1.1.8</Version>
<Comment>Version bump.</Comment>
<Name>Yusuf Aydemir</Name>
<Email>yusuf.aydemir@pisilinux.org</Email>
</Update>
<Update release="3">
<Date>2013-05-16</Date>
<Version>1.1.6</Version>
<Comment>Sandbox fixed.</Comment>
<Name>PisiLinux Community</Name>
<Email>admins@pisilinux.org</Email>
</Update>
<Update release="2">
<Date>2013-02-21</Date>
<Version>1.1.6</Version>
<Comment>Build with new automake, enable tests.</Comment>
<Name>Serdar Soytetir</Name>
<Email>kaptan@pisilinux.org</Email>
</Update>
<Update release="1">
<Date>2012-09-13</Date>
<Version>1.1.6</Version>
<Comment>First release</Comment>
<Name>Erdem Artan</Name>
<Email>admins@pisilinux.org</Email>
</Update>
</History>
</PISI>
system/base/pam/translations.xml
+13
View File
@@ -0,0 +1,13 @@
<?xml version="1.0" ?>
<PISI>
<Source>
<Name>pam</Name>
<Summary xml:lang="tr">PAM - Eklenebilir Yetkilendirme Modülleri</Summary>
<Summary xml:lang="fr">Modules d'Authentification en Greffon (Pluggable Authentication Modules)</Summary>
</Source>
<Package>
<Name>pam-devel</Name>
<Summary xml:lang="tr">pam için geliştirme dosyaları</Summary>
</Package>
</PISI>