diff options
author | V3n3RiX <venerix@redcorelinux.org> | 2017-10-09 18:53:29 +0100 |
---|---|---|
committer | V3n3RiX <venerix@redcorelinux.org> | 2017-10-09 18:53:29 +0100 |
commit | 4f2d7949f03e1c198bc888f2d05f421d35c57e21 (patch) | |
tree | ba5f07bf3f9d22d82e54a462313f5d244036c768 /sys-apps/shadow/files |
reinit the tree, so we can have metadata
Diffstat (limited to 'sys-apps/shadow/files')
-rw-r--r-- | sys-apps/shadow/files/default/useradd | 7 | ||||
-rw-r--r-- | sys-apps/shadow/files/pam.d-include/passwd | 8 | ||||
-rw-r--r-- | sys-apps/shadow/files/pam.d-include/shadow | 8 | ||||
-rw-r--r-- | sys-apps/shadow/files/shadow-4.1.3-dots-in-usernames.patch | 10 | ||||
-rw-r--r-- | sys-apps/shadow/files/shadow-4.4-CVE-2017-2616.patch | 62 | ||||
-rw-r--r-- | sys-apps/shadow/files/shadow-4.4-load_defaults.patch | 37 | ||||
-rw-r--r-- | sys-apps/shadow/files/shadow-4.4-prototypes.patch | 42 | ||||
-rw-r--r-- | sys-apps/shadow/files/shadow-4.4-su-snprintf.patch | 29 |
8 files changed, 203 insertions, 0 deletions
diff --git a/sys-apps/shadow/files/default/useradd b/sys-apps/shadow/files/default/useradd new file mode 100644 index 000000000000..ae81dbb3a02b --- /dev/null +++ b/sys-apps/shadow/files/default/useradd @@ -0,0 +1,7 @@ +# useradd defaults file +GROUP=100 +HOME=/home +INACTIVE=-1 +EXPIRE= +SHELL=/bin/bash +SKEL=/etc/skel diff --git a/sys-apps/shadow/files/pam.d-include/passwd b/sys-apps/shadow/files/pam.d-include/passwd new file mode 100644 index 000000000000..960b32eab3eb --- /dev/null +++ b/sys-apps/shadow/files/pam.d-include/passwd @@ -0,0 +1,8 @@ +#%PAM-1.0 + +auth sufficient pam_rootok.so +auth include system-auth + +account include system-auth + +password include system-auth diff --git a/sys-apps/shadow/files/pam.d-include/shadow b/sys-apps/shadow/files/pam.d-include/shadow new file mode 100644 index 000000000000..743b2f0260d6 --- /dev/null +++ b/sys-apps/shadow/files/pam.d-include/shadow @@ -0,0 +1,8 @@ +#%PAM-1.0 + +auth sufficient pam_rootok.so +auth required pam_permit.so + +account include system-auth + +password required pam_permit.so diff --git a/sys-apps/shadow/files/shadow-4.1.3-dots-in-usernames.patch b/sys-apps/shadow/files/shadow-4.1.3-dots-in-usernames.patch new file mode 100644 index 000000000000..efcb33dbd9ef --- /dev/null +++ b/sys-apps/shadow/files/shadow-4.1.3-dots-in-usernames.patch @@ -0,0 +1,10 @@ +--- shadow-4.1.3/libmisc/chkname.c ++++ shadow-4.1.3/libmisc/chkname.c +@@ -66,6 +66,7 @@ + ( ('0' <= *name) && ('9' >= *name) ) || + ('_' == *name) || + ('-' == *name) || ++ ('.' == *name) || + ( ('$' == *name) && ('\0' == *(name + 1)) ) + )) { + return false; diff --git a/sys-apps/shadow/files/shadow-4.4-CVE-2017-2616.patch b/sys-apps/shadow/files/shadow-4.4-CVE-2017-2616.patch new file mode 100644 index 000000000000..b788ec35342f --- /dev/null +++ b/sys-apps/shadow/files/shadow-4.4-CVE-2017-2616.patch @@ -0,0 +1,62 @@ +From 08fd4b69e84364677a10e519ccb25b71710ee686 Mon Sep 17 00:00:00 2001 +From: Tobias Stoeckmann <tobias@stoeckmann.org> +Date: Thu, 23 Feb 2017 09:47:29 -0600 +Subject: [PATCH] su: properly clear child PID + +If su is compiled with PAM support, it is possible for any local user +to send SIGKILL to other processes with root privileges. There are +only two conditions. First, the user must be able to perform su with +a successful login. This does NOT have to be the root user, even using +su with the same id is enough, e.g. "su $(whoami)". Second, SIGKILL +can only be sent to processes which were executed after the su process. +It is not possible to send SIGKILL to processes which were already +running. I consider this as a security vulnerability, because I was +able to write a proof of concept which unlocked a screen saver of +another user this way. +--- + src/su.c | 19 +++++++++++++++++-- + 1 file changed, 17 insertions(+), 2 deletions(-) + +diff --git a/src/su.c b/src/su.c +index f20d230..d86aa86 100644 +--- a/src/su.c ++++ b/src/su.c +@@ -379,11 +379,13 @@ static void prepare_pam_close_session (void) + /* wake child when resumed */ + kill (pid, SIGCONT); + stop = false; ++ } else { ++ pid_child = 0; + } + } while (!stop); + } + +- if (0 != caught) { ++ if (0 != caught && 0 != pid_child) { + (void) fputs ("\n", stderr); + (void) fputs (_("Session terminated, terminating shell..."), + stderr); +@@ -393,9 +395,22 @@ static void prepare_pam_close_session (void) + snprintf (wait_msg, sizeof wait_msg, _(" ...waiting for child to terminate.\n")); + + (void) signal (SIGALRM, kill_child); ++ (void) signal (SIGCHLD, catch_signals); + (void) alarm (2); + +- (void) wait (&status); ++ sigemptyset (&ourset); ++ if ((sigaddset (&ourset, SIGALRM) != 0) ++ || (sigprocmask (SIG_BLOCK, &ourset, NULL) != 0)) { ++ fprintf (stderr, _("%s: signal masking malfunction\n"), Prog); ++ kill_child (0); ++ } else { ++ while (0 == waitpid (pid_child, &status, WNOHANG)) { ++ sigsuspend (&ourset); ++ } ++ pid_child = 0; ++ (void) sigprocmask (SIG_UNBLOCK, &ourset, NULL); ++ } ++ + (void) fputs (_(" ...terminated.\n"), stderr); + } + diff --git a/sys-apps/shadow/files/shadow-4.4-load_defaults.patch b/sys-apps/shadow/files/shadow-4.4-load_defaults.patch new file mode 100644 index 000000000000..4c0b84f68036 --- /dev/null +++ b/sys-apps/shadow/files/shadow-4.4-load_defaults.patch @@ -0,0 +1,37 @@ +From 507f96cdeb54079fb636c7ce21e371f7a16a520e Mon Sep 17 00:00:00 2001 +From: Tomas Mraz <tmraz@fedoraproject.org> +Date: Thu, 25 Aug 2016 11:20:34 +0200 +Subject: [PATCH] Fix regression in useradd not loading defaults properly. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The get_defaults() has to be called before processing the flags. + +Signed-off-by: Tomáš Mráz <tmraz@fedoraproject.org> +--- + src/useradd.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/useradd.c b/src/useradd.c +index fefa234..6c43e7e 100644 +--- a/src/useradd.c ++++ b/src/useradd.c +@@ -2027,6 +2027,8 @@ int main (int argc, char **argv) + is_shadow_grp = sgr_file_present (); + #endif + ++ get_defaults (); ++ + process_flags (argc, argv); + + #ifdef ENABLE_SUBIDS +@@ -2036,8 +2038,6 @@ int main (int argc, char **argv) + (!user_id || (user_id <= uid_max && user_id >= uid_min)); + #endif /* ENABLE_SUBIDS */ + +- get_defaults (); +- + #ifdef ACCT_TOOLS_SETUID + #ifdef USE_PAM + { diff --git a/sys-apps/shadow/files/shadow-4.4-prototypes.patch b/sys-apps/shadow/files/shadow-4.4-prototypes.patch new file mode 100644 index 000000000000..5209a2988f7b --- /dev/null +++ b/sys-apps/shadow/files/shadow-4.4-prototypes.patch @@ -0,0 +1,42 @@ +https://github.com/shadow-maint/shadow/pull/53 + +From 32c0b283ef5d68b63e4ec05fb22ed0db938fea67 Mon Sep 17 00:00:00 2001 +From: Mike Frysinger <vapier@gentoo.org> +Date: Mon, 5 Dec 2016 17:15:29 -0500 +Subject: [PATCH] include getdef.h for getdef_bool prototype + +Otherwise we get build warnings like: +sgroupio.c:255:6: warning: implicit declaration of function 'getdef_bool' [-Wimplicit-function-declaration] +shadowio.c:131:6: warning: implicit declaration of function 'getdef_bool' [-Wimplicit-function-declaration] +--- + lib/sgroupio.c | 1 + + lib/shadowio.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/lib/sgroupio.c b/lib/sgroupio.c +index f2685779a12b..5423626a01da 100644 +--- a/lib/sgroupio.c ++++ b/lib/sgroupio.c +@@ -40,6 +40,7 @@ + #include "prototypes.h" + #include "defines.h" + #include "commonio.h" ++#include "getdef.h" + #include "sgroupio.h" + + /*@null@*/ /*@only@*/struct sgrp *__sgr_dup (const struct sgrp *sgent) +diff --git a/lib/shadowio.c b/lib/shadowio.c +index 6e44ab24d69c..5fa3d312bbf9 100644 +--- a/lib/shadowio.c ++++ b/lib/shadowio.c +@@ -40,6 +40,7 @@ + #include <shadow.h> + #include <stdio.h> + #include "commonio.h" ++#include "getdef.h" + #include "shadowio.h" + #ifdef WITH_TCB + #include <tcb.h> +-- +2.11.0.rc2 + diff --git a/sys-apps/shadow/files/shadow-4.4-su-snprintf.patch b/sys-apps/shadow/files/shadow-4.4-su-snprintf.patch new file mode 100644 index 000000000000..45667c8e4bf9 --- /dev/null +++ b/sys-apps/shadow/files/shadow-4.4-su-snprintf.patch @@ -0,0 +1,29 @@ +fix from upstream + +From 67d2bb6e0a5ac124ce1f026dd5723217b1493194 Mon Sep 17 00:00:00 2001 +From: Serge Hallyn <serge@hallyn.com> +Date: Sun, 18 Sep 2016 21:31:18 -0500 +Subject: [PATCH] su.c: fix missing length argument to snprintf + +--- + src/su.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/su.c b/src/su.c +index 0c50a9456afd..93ffd2fbe2b4 100644 +--- a/src/su.c ++++ b/src/su.c +@@ -373,8 +373,8 @@ static void prepare_pam_close_session (void) + stderr); + (void) kill (-pid_child, caught); + +- snprintf (kill_msg, _(" ...killed.\n")); +- snprintf (wait_msg, _(" ...waiting for child to terminate.\n")); ++ snprintf (kill_msg, 256, _(" ...killed.\n")); ++ snprintf (wait_msg, 256, _(" ...waiting for child to terminate.\n")); + + (void) signal (SIGALRM, kill_child); + (void) alarm (2); +-- +2.11.0.rc2 + |