Hello community, here is the log from the commit of package pam_kwallet for openSUSE:Factory checked in at 2017-10-09 19:43:26 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/pam_kwallet (Old) and /work/SRC/openSUSE:Factory/.pam_kwallet.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "pam_kwallet" Mon Oct 9 19:43:26 2017 rev:15 rq:532037 version:5.11.0 Changes: -------- --- /work/SRC/openSUSE:Factory/pam_kwallet/pam_kwallet.changes 2017-08-28 15:18:20.658785053 +0200 +++ /work/SRC/openSUSE:Factory/.pam_kwallet.new/pam_kwallet.changes 2017-10-09 19:47:21.921840663 +0200 @@ -1,0 +2,27 @@ +Thu Oct 5 12:39:18 CEST 2017 - [email protected] + +- Update to 5.11.0 + * New feature release + * For more details please see: + * https://www.kde.org/announcements/plasma-5.11.0.php +- Changes since 5.10.95: + * None + +------------------------------------------------------------------- +Thu Sep 14 14:29:06 CEST 2017 - [email protected] + +- Update to 5.10.95 + * New feature release + * For more details please see: + * https://www.kde.org/announcements/plasma-5.10.95.php +- Changes since 5.10.5: + * Avoid dropping privileges by initializing gcrypt secmem + * Check for a graphical session + * Several cleanups + * Handle differences in PAM headers +- Remove patches, now upstream: + * 0001-Several-cleanups.patch + * 0002-Avoid-dropping-privileges-by-initializing-gcrypt-sec.patch + * 0003-Check-for-a-graphical-session.patch + +------------------------------------------------------------------- Old: ---- 0001-Several-cleanups.patch 0002-Avoid-dropping-privileges-by-initializing-gcrypt-sec.patch 0003-Check-for-a-graphical-session.patch kwallet-pam-5.10.5.tar.xz New: ---- kwallet-pam-5.11.0.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ pam_kwallet.spec ++++++ --- /var/tmp/diff_new_pack.r8CfWJ/_old 2017-10-09 19:47:23.781758919 +0200 +++ /var/tmp/diff_new_pack.r8CfWJ/_new 2017-10-09 19:47:23.781758919 +0200 @@ -17,20 +17,14 @@ Name: pam_kwallet -Version: 5.10.5 +Version: 5.11.0 Release: 0 Summary: A PAM Module for KWallet signing License: LGPL-2.1 and GPL-2.0+ and GPL-3.0 Group: System/GUI/KDE Url: http://www.kde.org/ -Source0: http://download.kde.org/stable/plasma/%{version}/kwallet-pam-%{version}.tar.xz +Source: kwallet-pam-%{version}.tar.xz Source1: baselibs.conf -# PATCH-FIX-UPSTREAM -Patch1: 0001-Several-cleanups.patch -# PATCH-FIX-UPSTREAM -Patch2: 0002-Avoid-dropping-privileges-by-initializing-gcrypt-sec.patch -# PATCH-FIX-UPSTREAM -Patch3: 0003-Check-for-a-graphical-session.patch BuildRequires: extra-cmake-modules >= 1.2.0 BuildRequires: kf5-filesystem BuildRequires: libgcrypt-devel >= 1.5.0 @@ -59,9 +53,6 @@ %prep %setup -q -n kwallet-pam-%{version} -%patch1 -p1 -%patch2 -p1 -%patch3 -p1 %build %cmake_kf5 -d build -- -DLIBEXEC_INSTALL_DIR=%{_kf5_libexecdir} -DCMAKE_INSTALL_PREFIX=/ ++++++ kwallet-pam-5.10.5.tar.xz -> kwallet-pam-5.11.0.tar.xz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/kwallet-pam-5.10.5/CMakeLists.txt new/kwallet-pam-5.11.0/CMakeLists.txt --- old/kwallet-pam-5.10.5/CMakeLists.txt 2017-08-22 14:16:09.000000000 +0200 +++ new/kwallet-pam-5.11.0/CMakeLists.txt 2017-10-05 14:42:05.000000000 +0200 @@ -1,7 +1,7 @@ project(pam_kwallet) cmake_minimum_required(VERSION 2.8.12) -set(PROJECT_VERSION "5.10.5") +set(PROJECT_VERSION "5.11.0") set(PROJECT_VERSION_MAJOR 5) find_package (ECM 1.2.0 REQUIRED NO_MODULE) @@ -45,6 +45,19 @@ ) endif() +# Handle different PAM header styles: +# - "Linux style" has pam_ext.h +# - "BSD style" has pam_appl.h +# +find_file(PAM_EXT_PATH security/pam_ext.h) +find_file(PAM_APPL_PATH security/pam_appl.h) +if (PAM_EXT_PATH) + add_definitions(-DHAVE_PAM_EXT) +endif() +if (PAM_APPL_PATH) + add_definitions(-DHAVE_PAM_APPL) +endif() + add_library (${library_name} SHARED ${pam_kwallet_SRCS}) set_target_properties (${library_name} PROPERTIES PREFIX "") target_link_libraries (${library_name} diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/kwallet-pam-5.10.5/pam_kwallet.c new/kwallet-pam-5.11.0/pam_kwallet.c --- old/kwallet-pam-5.10.5/pam_kwallet.c 2017-08-22 14:16:09.000000000 +0200 +++ new/kwallet-pam-5.11.0/pam_kwallet.c 2017-10-05 14:42:05.000000000 +0200 @@ -31,17 +31,37 @@ #include <sys/stat.h> #include <sys/syslog.h> #include <sys/wait.h> +#include <sys/types.h> +#include <sys/socket.h> +#include <sys/un.h> + +/* PAM headers. + * + * There are three styles in play: + * - Apple, which has no pam_ext.h, does have pam_appl.h, does have pam_syslog + * - Linux, which has pam_ext.h, does have pam_appl.h, does have pam_syslog + * - BSD, which has no pam_ext.h, does have pam_appl.h, but no pam_syslog + * In the latter case, #define pam_syslog away. + */ #ifdef __APPLE__ #include "pam_darwin.h" #include <security/pam_appl.h> #else #include <security/pam_modules.h> +#ifdef HAVE_PAM_EXT +/* "Linux style" */ #include <security/pam_ext.h> #include <security/_pam_types.h> #endif -#include <sys/types.h> -#include <sys/socket.h> -#include <sys/un.h> +#ifdef HAVE_PAM_APPL +/* "BSD style" .. see also __APPLE__, above */ +#include <security/pam_appl.h> +#ifndef HAVE_PAM_EXT +/* FreeBSD has no pam_syslog(), va-macro it away */ +#define pam_syslog(...) +#endif +#endif +#endif #define KWALLET_PAM_KEYSIZE 56 #define KWALLET_PAM_SALTSIZE 56 @@ -52,6 +72,7 @@ const static char *socketPath = NULL; const static char *kwalletPamDataKey = NULL; const static char *logPrefix = NULL; +static int force_run = 0; #ifdef KWALLET5 const static char *envVar = "PAM_KWALLET5_LOGIN"; @@ -78,6 +99,8 @@ kwalletd = argv[x] + 9; } else if (strstr(argv[x], "socketPath=") != NULL) { socketPath= argv[x] + 11; + } else if (strcmp(argv[x], "force_run") == 0) { + force_run = 1; } } #ifdef KWALLET5 @@ -131,13 +154,14 @@ //We do not return because pam_putenv might work } - char *pamEnv = malloc(strlen(name) + strlen(value) + 2); //2 is for = and \0 + size_t pamEnvSize = strlen(name) + strlen(value) + 2; //2 is for = and \0 + char *pamEnv = malloc(pamEnvSize); if (!pamEnv) { pam_syslog(pamh, LOG_WARNING, "%s: Impossible to allocate memory for pamEnv", logPrefix); return -1; } - sprintf (pamEnv, "%s=%s", name, value); + snprintf (pamEnv, pamEnvSize, "%s=%s", name, value); int ret = pam_putenv(pamh, pamEnv); free(pamEnv); @@ -220,6 +244,29 @@ return result; } +static void cleanup_free(pam_handle_t *pamh, void *ptr, int error_status) +{ + free(ptr); +} + +static int is_graphical_session(pam_handle_t *pamh) +{ + //Detect a graphical session + const char *pam_tty = NULL, *pam_xdisplay = NULL, + *xdg_session_type = NULL, *display = NULL; + + pam_get_item(pamh, PAM_TTY, (const void**) &pam_tty); +#ifdef PAM_XDISPLAY + pam_get_item(pamh, PAM_XDISPLAY, (const void**) &pam_xdisplay); +#endif + xdg_session_type = get_env(pamh, "XDG_SESSION_TYPE"); + + return (pam_xdisplay && strlen(pam_xdisplay) != 0) + || (pam_tty && pam_tty[0] == ':') + || (xdg_session_type && strcmp(xdg_session_type, "x11") == 0) + || (xdg_session_type && strcmp(xdg_session_type, "wayland") == 0); +} + PAM_EXTERN int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, const char **argv) { pam_syslog(pamh, LOG_INFO, "%s: pam_sm_authenticate\n", logPrefix); @@ -277,14 +324,17 @@ return PAM_IGNORE; } - char *key = malloc(sizeof(char) * KWALLET_PAM_KEYSIZE); - if (kwallet_hash(password, userInfo, key) != 0) { + char *key = malloc(KWALLET_PAM_KEYSIZE); + if (!key || kwallet_hash(password, userInfo, key) != 0) { + free(key); pam_syslog(pamh, LOG_ERR, "%s: Fail into creating the hash", logPrefix); return PAM_IGNORE; } - result = pam_set_data(pamh, kwalletPamDataKey, key, NULL); + result = pam_set_data(pamh, kwalletPamDataKey, key, cleanup_free); + if (result != PAM_SUCCESS) { + free(key); pam_syslog(pamh, LOG_ERR, "%s: Impossible to store the hashed password: %s", logPrefix , pam_strerror(pamh, result)); return PAM_IGNORE; @@ -365,9 +415,8 @@ static int better_write(int fd, const char *buffer, int len) { size_t writtenBytes = 0; - int result; while(writtenBytes < len) { - result = write(fd, buffer + writtenBytes, len - writtenBytes); + int result = write(fd, buffer + writtenBytes, len - writtenBytes); if (result < 0) { if (errno != EAGAIN && errno != EINTR) { return -1; @@ -430,6 +479,7 @@ if (result != PAM_SUCCESS) { pam_syslog(pamh, LOG_ERR, "%s: Impossible to set %s env, %s", logPrefix, envVar, pam_strerror(pamh, result)); + free(fullSocket); return; } @@ -439,12 +489,15 @@ if (strlen(fullSocket) > sizeof(local.sun_path)) { pam_syslog(pamh, LOG_ERR, "%s: socket path %s too long to open", logPrefix, fullSocket); + free(fullSocket); return; } strcpy(local.sun_path, fullSocket); + free(fullSocket); + fullSocket = NULL; unlink(local.sun_path);//Just in case it exists from a previous login - pam_syslog(pamh, LOG_INFO, "%s: final socket path: %s", logPrefix, fullSocket); + pam_syslog(pamh, LOG_INFO, "%s: final socket path: %s", logPrefix, local.sun_path); size_t len = strlen(local.sun_path) + sizeof(local.sun_family); if (bind(envSocket, (struct sockaddr *)&local, len) == -1) { @@ -457,7 +510,7 @@ return; } - if (chown(fullSocket, userInfo->pw_uid, userInfo->pw_gid) == -1) { + if (chown(local.sun_path, userInfo->pw_uid, userInfo->pw_gid) == -1) { pam_syslog(pamh, LOG_INFO, "%s: Couldn't change ownership of the socket", logPrefix); return; } @@ -505,6 +558,11 @@ parseArguments(argc, argv); + if (!force_run && !is_graphical_session(pamh)) { + pam_syslog(pamh, LOG_INFO, "%s: not a graphical session, skipping. Use force_run parameter to ignore this.", logPrefix); + return PAM_IGNORE; + } + int result; result = pam_set_data(pamh, "sm_open_session", "1", NULL); if (result != PAM_SUCCESS) { @@ -635,7 +693,8 @@ #else char *fixpath = "share/apps/kwallet/kdewallet.salt"; #endif - char *path = (char*) malloc(strlen(userInfo->pw_dir) + strlen(kdehome) + strlen(fixpath) + 3);//3 == / and \0 + size_t pathSize = strlen(userInfo->pw_dir) + strlen(kdehome) + strlen(fixpath) + 3;//3 == /, / and \0 + char *path = (char*) malloc(pathSize); sprintf(path, "%s/%s/%s", userInfo->pw_dir, kdehome, fixpath); struct stat info; @@ -646,24 +705,35 @@ FILE *fd = fopen(path, "r"); if (fd == NULL) { syslog(LOG_ERR, "%s: Couldn't open file: %s because: %d-%s", logPrefix, path, errno, strerror(errno)); + free(path); return 1; } - salt = (char*) malloc(sizeof(char) * KWALLET_PAM_SALTSIZE); + salt = (char*) malloc(KWALLET_PAM_SALTSIZE); memset(salt, '\0', KWALLET_PAM_SALTSIZE); fread(salt, KWALLET_PAM_SALTSIZE, 1, fd); fclose(fd); } + free(path); + if (salt == NULL) { syslog(LOG_ERR, "%s-kwalletd: Couldn't create or read the salt file", logPrefix); return 1; } gcry_error_t error; + + /* We cannot call GCRYCTL_INIT_SECMEM as it drops privileges if getuid() != geteuid(). + * PAM modules are in many cases executed through setuid binaries, which this call + * would break. + * It was never effective anyway as neither key nor passphrase are in secure memory, + * which is a prerequisite for secure operation... error = gcry_control(GCRYCTL_INIT_SECMEM, 32768, 0); if (error != 0) { + free(salt); syslog(LOG_ERR, "%s-kwalletd: Can't get secure memory: %d", logPrefix, error); return 1; } + */ gcry_control (GCRYCTL_INITIALIZATION_FINISHED, 0); @@ -671,5 +741,7 @@ GCRY_KDF_PBKDF2, GCRY_MD_SHA512, salt, KWALLET_PAM_SALTSIZE, KWALLET_PAM_ITERATIONS,KWALLET_PAM_KEYSIZE, key); - return 0; + + free(salt); + return (int) error; // gcry_kdf_derive returns 0 on success } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/kwallet-pam-5.10.5/pam_kwallet_init.desktop.cmake new/kwallet-pam-5.11.0/pam_kwallet_init.desktop.cmake --- old/kwallet-pam-5.10.5/pam_kwallet_init.desktop.cmake 2017-08-22 14:16:09.000000000 +0200 +++ new/kwallet-pam-5.11.0/pam_kwallet_init.desktop.cmake 2017-10-05 14:42:05.000000000 +0200 @@ -19,6 +19,7 @@ Name[ko]=KWallet PAM 소켓 연결 Name[nl]=KWallet verbinding met PAM-socket Name[nn]=KWallet PAM-socket-tilkopling +Name[pa]=ਕੇ-ਵਾਲਿਟ PAM ਸਾਕਟ ਕਨੈਕਸ਼ਨ Name[pl]=Połączenie do gniazda PAM KPortfela Name[pt]=Ligação por 'Socket' entre PAM e o KWallet Name[pt_BR]=Conexão do Socket PAM do KWallet @@ -55,6 +56,7 @@ Comment[ko]=KWallet PAM 소켓에 연결할 수 없음 Comment[nl]=Verbinden met KWallet PAM-socket Comment[nn]=Kopla til KWallet PAM-socket +Comment[pa]=ਕੇ-ਵਾਲਿਟ PAM ਸਾਕਟ ਨਾਲ ਕਨੈਕਟ ਕਰੋ Comment[pl]=Połącz z gniazdem PAM KPortfela Comment[pt]=Ligar ao 'socket' de PAM do KWallet Comment[pt_BR]=Conecta ao socket PAM do KWallet
