From: Gustavo Zacarias Date: Thu, 18 Dec 2014 18:04:41 +0000 (-0300) Subject: linux-pam: add security patches X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=c165b0e580b6236c3efe93156e02d68d3013c575;p=buildroot.git linux-pam: add security patches To fix: CVE-2013-7041 - use case sensitive comparison in pam_userdb CVE-2014-2583 - potential path traversal issue in pam_timestamp Also add hash file (computed, the hash files upstream cover up to 1.1.7) Signed-off-by: Gustavo Zacarias Signed-off-by: Peter Korsgaard --- diff --git a/package/linux-pam/0001-configure.patch b/package/linux-pam/0001-configure.patch new file mode 100644 index 0000000000..d39261f74e --- /dev/null +++ b/package/linux-pam/0001-configure.patch @@ -0,0 +1,19 @@ +Add check for ruserok + +ruserok is not available/functional in uclibc, provide conditions for compilation +where needed. + +Signed-off-by: Dmitry Golubovsky + +diff -urN a/configure.in b/configure.in +--- a/configure.in 2012-08-17 03:48:24.000000000 -0500 ++++ b/configure.in 2013-07-17 09:49:23.760254684 -0500 +@@ -526,7 +526,7 @@ + AC_CHECK_FUNCS(strcspn strdup strspn strstr strtol uname) + AC_CHECK_FUNCS(getutent_r getpwnam_r getpwuid_r getgrnam_r getgrgid_r getspnam_r) + AC_CHECK_FUNCS(getgrouplist getline getdelim) +-AC_CHECK_FUNCS(inet_ntop inet_pton innetgr ruserok_af) ++AC_CHECK_FUNCS(inet_ntop inet_pton innetgr ruserok_af ruserok) + + AC_CHECK_FUNCS(unshare, [UNSHARE=yes], [UNSHARE=no]) + AM_CONDITIONAL([HAVE_UNSHARE], [test "$UNSHARE" = yes]) diff --git a/package/linux-pam/0002-doc-makefile-am.patch b/package/linux-pam/0002-doc-makefile-am.patch new file mode 100644 index 0000000000..8fa2dda2fc --- /dev/null +++ b/package/linux-pam/0002-doc-makefile-am.patch @@ -0,0 +1,31 @@ +Disable generation of documentation + +Generation of documentation is not necessary in Buildroot, disable it completely. + +Signed-off-by: Dmitry Golubovsky + +diff -urN a/doc/Makefile.am b/doc/Makefile.am +--- a/doc/Makefile.am 2012-08-15 06:08:43.000000000 -0500 ++++ b/doc/Makefile.am 2013-07-17 09:54:53.000000000 -0500 +@@ -2,8 +2,6 @@ + # Copyright (c) 2005, 2006 Thorsten Kukuk + # + +-SUBDIRS = man specs sag adg mwg +- + CLEANFILES = *~ + + dist_html_DATA = index.html +@@ -11,11 +9,4 @@ + ####################################################### + + releasedocs: all +- $(mkinstalldirs) $(top_builddir)/Linux-PAM-$(VERSION)/doc/specs +- cp -av specs/draft-morgan-pam-current.txt \ +- $(top_builddir)/Linux-PAM-$(VERSION)/doc/specs/ +- cp -av $(srcdir)/specs/rfc86.0.txt \ +- $(top_builddir)/Linux-PAM-$(VERSION)/doc/specs/ +- make -C sag releasedocs +- make -C adg releasedocs +- make -C mwg releasedocs ++ /bin/true diff --git a/package/linux-pam/0003-group.patch b/package/linux-pam/0003-group.patch new file mode 100644 index 0000000000..a94cf9e3db --- /dev/null +++ b/package/linux-pam/0003-group.patch @@ -0,0 +1,26 @@ +Conditionally compile per innetgr availability + +innetgr is not available/functional in uclibc, provide conditions for compilation. + +Signed-off-by: Dmitry Golubovsky + +Index: linux-pam-1.1.4/modules/pam_group/pam_group.c +============================================================================ +--- linux-pam-1.1.4/modules/pam_group/pam_group.c 2011-06-21 05:04:56.000000000 -0400 ++++ linux-pam-1.1.4/modules/pam_group/pam_group.c 2012-08-09 21:35:06.000000000 -0400 +@@ -655,8 +655,14 @@ + continue; + } + /* If buffer starts with @, we are using netgroups */ +- if (buffer[0] == '@') ++ if (buffer[0] == '@') { ++#ifdef HAVE_INNETGR + good &= innetgr (&buffer[1], NULL, user, NULL); ++#else ++ good = 0; ++ pam_syslog (pamh, LOG_ERR, "pam_group does not have netgroup support"); ++#endif /* HAVE_INNETGR */ ++ } + /* otherwise, if the buffer starts with %, it's a UNIX group */ + else if (buffer[0] == '%') + good &= pam_modutil_user_in_group_nam_nam(pamh, user, &buffer[1]); diff --git a/package/linux-pam/0004-mkdir.patch b/package/linux-pam/0004-mkdir.patch new file mode 100644 index 0000000000..00056daf3d --- /dev/null +++ b/package/linux-pam/0004-mkdir.patch @@ -0,0 +1,17 @@ +$(mkdir_p) is obsolete for newer automake, use $(MKDIR_P) instead. +Upstream should really gettextize with a newer version before packing up. + +Signed-off-by: Gustavo Zacarias + +diff -Nura Linux-PAM-1.1.7.orig/po/Makefile.in.in Linux-PAM-1.1.7/po/Makefile.in.in +--- Linux-PAM-1.1.7.orig/po/Makefile.in.in 2013-09-11 20:45:16.610770002 -0300 ++++ Linux-PAM-1.1.7/po/Makefile.in.in 2013-09-11 20:45:28.030145316 -0300 +@@ -31,7 +31,7 @@ + INSTALL = @INSTALL@ + INSTALL_DATA = @INSTALL_DATA@ + mkinstalldirs = $(SHELL) @install_sh@ -d +-mkdir_p = @mkdir_p@ ++mkdir_p = @MKDIR_P@ + + GMSGFMT_ = @GMSGFMT@ + GMSGFMT_no = @GMSGFMT@ diff --git a/package/linux-pam/0005-succeed.patch b/package/linux-pam/0005-succeed.patch new file mode 100644 index 0000000000..8a675efa20 --- /dev/null +++ b/package/linux-pam/0005-succeed.patch @@ -0,0 +1,31 @@ +Conditionally compile per innetgr availability + +innetgr is not available/functional in uclibc, provide conditions for compilation. + +Signed-off-by: Dmitry Golubovsky + +Index: linux-pam-1.1.4/modules/pam_succeed_if/pam_succeed_if.c +============================================================================ +--- linux-pam-1.1.4/modules/pam_succeed_if/pam_succeed_if.c 2011-06-21 05:04:56.000000000 -0400 ++++ linux-pam-1.1.4/modules/pam_succeed_if/pam_succeed_if.c 2012-08-09 21:05:02.000000000 -0400 +@@ -233,16 +233,20 @@ + static int + evaluate_innetgr(const char *host, const char *user, const char *group) + { ++#ifdef HAVE_INNETGR + if (innetgr(group, host, user, NULL) == 1) + return PAM_SUCCESS; ++#endif /* HAVE_INNETGR */ + return PAM_AUTH_ERR; + } + /* Return PAM_SUCCESS if the (host,user) is NOT in the netgroup. */ + static int + evaluate_notinnetgr(const char *host, const char *user, const char *group) + { ++#ifdef HAVE_INNETGR + if (innetgr(group, host, user, NULL) == 0) + return PAM_SUCCESS; ++#endif /* HAVE_INNETGR */ + return PAM_AUTH_ERR; + } + diff --git a/package/linux-pam/0006-time.patch b/package/linux-pam/0006-time.patch new file mode 100644 index 0000000000..58d7c9f024 --- /dev/null +++ b/package/linux-pam/0006-time.patch @@ -0,0 +1,26 @@ +Conditionally compile per innetgr availability + +innetgr is not available/functional in uclibc, provide conditions for compilation. + +Signed-off-by: Dmitry Golubovsky + +Index: linux-pam-1.1.4/modules/pam_time/pam_time.c +============================================================================ +--- linux-pam-1.1.4/modules/pam_time/pam_time.c 2011-06-21 05:04:56.000000000 -0400 ++++ linux-pam-1.1.4/modules/pam_time/pam_time.c 2012-08-09 21:02:29.000000000 -0400 +@@ -554,8 +554,14 @@ + continue; + } + /* If buffer starts with @, we are using netgroups */ +- if (buffer[0] == '@') ++ if (buffer[0] == '@') { ++#ifdef HAVE_INNETGR + good &= innetgr (&buffer[1], NULL, user, NULL); ++#else ++ good = 0; ++ pam_syslog (pamh, LOG_ERR, "pam_time does not have netgroup support"); ++#endif /* HAVE_INNETGR */ ++ } + else + good &= logic_field(pamh, user, buffer, count, is_same); + D(("with user: %s", good ? "passes":"fails" )); diff --git a/package/linux-pam/0007-rhosts.patch b/package/linux-pam/0007-rhosts.patch new file mode 100644 index 0000000000..58f9adbb1a --- /dev/null +++ b/package/linux-pam/0007-rhosts.patch @@ -0,0 +1,24 @@ +Conditionally compile per ruserok availability + +ruserok is not available/functional in uclibc, provide conditions for compilation. + +Signed-off-by: Dmitry Golubovsky + +Index: linux-pam-1.1.4/modules/pam_rhosts/pam_rhosts.c +============================================================================ +--- linux-pam-1.1.4/modules/pam_rhosts/pam_rhosts.c 2011-06-21 05:04:56.000000000 -0400 ++++ linux-pam-1.1.4/modules/pam_rhosts/pam_rhosts.c 2012-08-09 21:19:34.000000000 -0400 +@@ -114,8 +114,12 @@ + #ifdef HAVE_RUSEROK_AF + retval = ruserok_af (rhost, as_root, ruser, luser, PF_UNSPEC); + #else ++ #ifdef HAVE_RUSEROK + retval = ruserok (rhost, as_root, ruser, luser); +-#endif ++ #else ++ retval = -1; ++ #endif /* HAVE_RUSEROK */ ++#endif /*HAVE_RUSEROK_AF */ + if (retval != 0) { + if (!opt_silent || opt_debug) + pam_syslog(pamh, LOG_WARNING, "denied access to %s@%s as %s", diff --git a/package/linux-pam/0008-fix-CVE-2014-2583.patch b/package/linux-pam/0008-fix-CVE-2014-2583.patch new file mode 100644 index 0000000000..a8b5f7bb71 --- /dev/null +++ b/package/linux-pam/0008-fix-CVE-2014-2583.patch @@ -0,0 +1,53 @@ +From 9dcead87e6d7f66d34e7a56d11a30daca367dffb Mon Sep 17 00:00:00 2001 +From: "Dmitry V. Levin" +Date: Wed, 26 Mar 2014 22:17:23 +0000 +Subject: pam_timestamp: fix potential directory traversal issue (ticket #27) + +pam_timestamp uses values of PAM_RUSER and PAM_TTY as components of +the timestamp pathname it creates, so extra care should be taken to +avoid potential directory traversal issues. + +* modules/pam_timestamp/pam_timestamp.c (check_tty): Treat +"." and ".." tty values as invalid. +(get_ruser): Treat "." and ".." ruser values, as well as any ruser +value containing '/', as invalid. + +Fixes CVE-2014-2583. + +Reported-by: Sebastian Krahmer +Signed-off-by: Gustavo Zacarias + +diff --git a/modules/pam_timestamp/pam_timestamp.c b/modules/pam_timestamp/pam_timestamp.c +index 5193733..b3f08b1 100644 +--- a/modules/pam_timestamp/pam_timestamp.c ++++ b/modules/pam_timestamp/pam_timestamp.c +@@ -158,7 +158,7 @@ check_tty(const char *tty) + tty = strrchr(tty, '/') + 1; + } + /* Make sure the tty wasn't actually a directory (no basename). */ +- if (strlen(tty) == 0) { ++ if (!strlen(tty) || !strcmp(tty, ".") || !strcmp(tty, "..")) { + return NULL; + } + return tty; +@@ -243,6 +243,17 @@ get_ruser(pam_handle_t *pamh, char *ruserbuf, size_t ruserbuflen) + if (pwd != NULL) { + ruser = pwd->pw_name; + } ++ } else { ++ /* ++ * This ruser is used by format_timestamp_name as a component ++ * of constructed timestamp pathname, so ".", "..", and '/' ++ * are disallowed to avoid potential path traversal issues. ++ */ ++ if (!strcmp(ruser, ".") || ++ !strcmp(ruser, "..") || ++ strchr(ruser, '/')) { ++ ruser = NULL; ++ } + } + if (ruser == NULL || strlen(ruser) >= ruserbuflen) { + *ruserbuf = '\0'; +-- +cgit v0.10.2 + diff --git a/package/linux-pam/0009-fix-CVE-2013-7041.patch b/package/linux-pam/0009-fix-CVE-2013-7041.patch new file mode 100644 index 0000000000..ed58807356 --- /dev/null +++ b/package/linux-pam/0009-fix-CVE-2013-7041.patch @@ -0,0 +1,50 @@ +From 57a1e2b274d0a6376d92ada9926e5c5741e7da20 Mon Sep 17 00:00:00 2001 +From: "Dmitry V. Levin" +Date: Fri, 24 Jan 2014 22:18:32 +0000 +Subject: pam_userdb: fix password hash comparison + +Starting with commit Linux-PAM-0-77-28-g0b3e583 that introduced hashed +passwords support in pam_userdb, hashes are compared case-insensitively. +This bug leads to accepting hashes for completely different passwords in +addition to those that should be accepted. + +Additionally, commit Linux-PAM-1_1_6-13-ge2a8187 that added support for +modern password hashes with different lengths and settings, did not +update the hash comparison accordingly, which leads to accepting +computed hashes longer than stored hashes when the latter is a prefix +of the former. + +* modules/pam_userdb/pam_userdb.c (user_lookup): Reject the computed +hash whose length differs from the stored hash length. +Compare computed and stored hashes case-sensitively. +Fixes CVE-2013-7041. + +Bug-Debian: http://bugs.debian.org/731368 +Signed-off-by: Gustavo Zacarias + +diff --git a/modules/pam_userdb/pam_userdb.c b/modules/pam_userdb/pam_userdb.c +index de8b5b1..ff040e6 100644 +--- a/modules/pam_userdb/pam_userdb.c ++++ b/modules/pam_userdb/pam_userdb.c +@@ -222,12 +222,15 @@ user_lookup (pam_handle_t *pamh, const char *database, const char *cryptmode, + } else { + cryptpw = crypt (pass, data.dptr); + +- if (cryptpw) { +- compare = strncasecmp (data.dptr, cryptpw, data.dsize); ++ if (cryptpw && strlen(cryptpw) == (size_t)data.dsize) { ++ compare = memcmp(data.dptr, cryptpw, data.dsize); + } else { + compare = -2; + if (ctrl & PAM_DEBUG_ARG) { +- pam_syslog(pamh, LOG_INFO, "crypt() returned NULL"); ++ if (cryptpw) ++ pam_syslog(pamh, LOG_INFO, "lengths of computed and stored hashes differ"); ++ else ++ pam_syslog(pamh, LOG_INFO, "crypt() returned NULL"); + } + }; + +-- +cgit v0.10.2 + diff --git a/package/linux-pam/linux-pam-01-configure.patch b/package/linux-pam/linux-pam-01-configure.patch deleted file mode 100644 index d39261f74e..0000000000 --- a/package/linux-pam/linux-pam-01-configure.patch +++ /dev/null @@ -1,19 +0,0 @@ -Add check for ruserok - -ruserok is not available/functional in uclibc, provide conditions for compilation -where needed. - -Signed-off-by: Dmitry Golubovsky - -diff -urN a/configure.in b/configure.in ---- a/configure.in 2012-08-17 03:48:24.000000000 -0500 -+++ b/configure.in 2013-07-17 09:49:23.760254684 -0500 -@@ -526,7 +526,7 @@ - AC_CHECK_FUNCS(strcspn strdup strspn strstr strtol uname) - AC_CHECK_FUNCS(getutent_r getpwnam_r getpwuid_r getgrnam_r getgrgid_r getspnam_r) - AC_CHECK_FUNCS(getgrouplist getline getdelim) --AC_CHECK_FUNCS(inet_ntop inet_pton innetgr ruserok_af) -+AC_CHECK_FUNCS(inet_ntop inet_pton innetgr ruserok_af ruserok) - - AC_CHECK_FUNCS(unshare, [UNSHARE=yes], [UNSHARE=no]) - AM_CONDITIONAL([HAVE_UNSHARE], [test "$UNSHARE" = yes]) diff --git a/package/linux-pam/linux-pam-02-doc-makefile-am.patch b/package/linux-pam/linux-pam-02-doc-makefile-am.patch deleted file mode 100644 index 8fa2dda2fc..0000000000 --- a/package/linux-pam/linux-pam-02-doc-makefile-am.patch +++ /dev/null @@ -1,31 +0,0 @@ -Disable generation of documentation - -Generation of documentation is not necessary in Buildroot, disable it completely. - -Signed-off-by: Dmitry Golubovsky - -diff -urN a/doc/Makefile.am b/doc/Makefile.am ---- a/doc/Makefile.am 2012-08-15 06:08:43.000000000 -0500 -+++ b/doc/Makefile.am 2013-07-17 09:54:53.000000000 -0500 -@@ -2,8 +2,6 @@ - # Copyright (c) 2005, 2006 Thorsten Kukuk - # - --SUBDIRS = man specs sag adg mwg -- - CLEANFILES = *~ - - dist_html_DATA = index.html -@@ -11,11 +9,4 @@ - ####################################################### - - releasedocs: all -- $(mkinstalldirs) $(top_builddir)/Linux-PAM-$(VERSION)/doc/specs -- cp -av specs/draft-morgan-pam-current.txt \ -- $(top_builddir)/Linux-PAM-$(VERSION)/doc/specs/ -- cp -av $(srcdir)/specs/rfc86.0.txt \ -- $(top_builddir)/Linux-PAM-$(VERSION)/doc/specs/ -- make -C sag releasedocs -- make -C adg releasedocs -- make -C mwg releasedocs -+ /bin/true diff --git a/package/linux-pam/linux-pam-03-group.patch b/package/linux-pam/linux-pam-03-group.patch deleted file mode 100644 index a94cf9e3db..0000000000 --- a/package/linux-pam/linux-pam-03-group.patch +++ /dev/null @@ -1,26 +0,0 @@ -Conditionally compile per innetgr availability - -innetgr is not available/functional in uclibc, provide conditions for compilation. - -Signed-off-by: Dmitry Golubovsky - -Index: linux-pam-1.1.4/modules/pam_group/pam_group.c -============================================================================ ---- linux-pam-1.1.4/modules/pam_group/pam_group.c 2011-06-21 05:04:56.000000000 -0400 -+++ linux-pam-1.1.4/modules/pam_group/pam_group.c 2012-08-09 21:35:06.000000000 -0400 -@@ -655,8 +655,14 @@ - continue; - } - /* If buffer starts with @, we are using netgroups */ -- if (buffer[0] == '@') -+ if (buffer[0] == '@') { -+#ifdef HAVE_INNETGR - good &= innetgr (&buffer[1], NULL, user, NULL); -+#else -+ good = 0; -+ pam_syslog (pamh, LOG_ERR, "pam_group does not have netgroup support"); -+#endif /* HAVE_INNETGR */ -+ } - /* otherwise, if the buffer starts with %, it's a UNIX group */ - else if (buffer[0] == '%') - good &= pam_modutil_user_in_group_nam_nam(pamh, user, &buffer[1]); diff --git a/package/linux-pam/linux-pam-04-mkdir.patch b/package/linux-pam/linux-pam-04-mkdir.patch deleted file mode 100644 index 00056daf3d..0000000000 --- a/package/linux-pam/linux-pam-04-mkdir.patch +++ /dev/null @@ -1,17 +0,0 @@ -$(mkdir_p) is obsolete for newer automake, use $(MKDIR_P) instead. -Upstream should really gettextize with a newer version before packing up. - -Signed-off-by: Gustavo Zacarias - -diff -Nura Linux-PAM-1.1.7.orig/po/Makefile.in.in Linux-PAM-1.1.7/po/Makefile.in.in ---- Linux-PAM-1.1.7.orig/po/Makefile.in.in 2013-09-11 20:45:16.610770002 -0300 -+++ Linux-PAM-1.1.7/po/Makefile.in.in 2013-09-11 20:45:28.030145316 -0300 -@@ -31,7 +31,7 @@ - INSTALL = @INSTALL@ - INSTALL_DATA = @INSTALL_DATA@ - mkinstalldirs = $(SHELL) @install_sh@ -d --mkdir_p = @mkdir_p@ -+mkdir_p = @MKDIR_P@ - - GMSGFMT_ = @GMSGFMT@ - GMSGFMT_no = @GMSGFMT@ diff --git a/package/linux-pam/linux-pam-05-succeed.patch b/package/linux-pam/linux-pam-05-succeed.patch deleted file mode 100644 index 8a675efa20..0000000000 --- a/package/linux-pam/linux-pam-05-succeed.patch +++ /dev/null @@ -1,31 +0,0 @@ -Conditionally compile per innetgr availability - -innetgr is not available/functional in uclibc, provide conditions for compilation. - -Signed-off-by: Dmitry Golubovsky - -Index: linux-pam-1.1.4/modules/pam_succeed_if/pam_succeed_if.c -============================================================================ ---- linux-pam-1.1.4/modules/pam_succeed_if/pam_succeed_if.c 2011-06-21 05:04:56.000000000 -0400 -+++ linux-pam-1.1.4/modules/pam_succeed_if/pam_succeed_if.c 2012-08-09 21:05:02.000000000 -0400 -@@ -233,16 +233,20 @@ - static int - evaluate_innetgr(const char *host, const char *user, const char *group) - { -+#ifdef HAVE_INNETGR - if (innetgr(group, host, user, NULL) == 1) - return PAM_SUCCESS; -+#endif /* HAVE_INNETGR */ - return PAM_AUTH_ERR; - } - /* Return PAM_SUCCESS if the (host,user) is NOT in the netgroup. */ - static int - evaluate_notinnetgr(const char *host, const char *user, const char *group) - { -+#ifdef HAVE_INNETGR - if (innetgr(group, host, user, NULL) == 0) - return PAM_SUCCESS; -+#endif /* HAVE_INNETGR */ - return PAM_AUTH_ERR; - } - diff --git a/package/linux-pam/linux-pam-06-time.patch b/package/linux-pam/linux-pam-06-time.patch deleted file mode 100644 index 58d7c9f024..0000000000 --- a/package/linux-pam/linux-pam-06-time.patch +++ /dev/null @@ -1,26 +0,0 @@ -Conditionally compile per innetgr availability - -innetgr is not available/functional in uclibc, provide conditions for compilation. - -Signed-off-by: Dmitry Golubovsky - -Index: linux-pam-1.1.4/modules/pam_time/pam_time.c -============================================================================ ---- linux-pam-1.1.4/modules/pam_time/pam_time.c 2011-06-21 05:04:56.000000000 -0400 -+++ linux-pam-1.1.4/modules/pam_time/pam_time.c 2012-08-09 21:02:29.000000000 -0400 -@@ -554,8 +554,14 @@ - continue; - } - /* If buffer starts with @, we are using netgroups */ -- if (buffer[0] == '@') -+ if (buffer[0] == '@') { -+#ifdef HAVE_INNETGR - good &= innetgr (&buffer[1], NULL, user, NULL); -+#else -+ good = 0; -+ pam_syslog (pamh, LOG_ERR, "pam_time does not have netgroup support"); -+#endif /* HAVE_INNETGR */ -+ } - else - good &= logic_field(pamh, user, buffer, count, is_same); - D(("with user: %s", good ? "passes":"fails" )); diff --git a/package/linux-pam/linux-pam-07-rhosts.patch b/package/linux-pam/linux-pam-07-rhosts.patch deleted file mode 100644 index 58f9adbb1a..0000000000 --- a/package/linux-pam/linux-pam-07-rhosts.patch +++ /dev/null @@ -1,24 +0,0 @@ -Conditionally compile per ruserok availability - -ruserok is not available/functional in uclibc, provide conditions for compilation. - -Signed-off-by: Dmitry Golubovsky - -Index: linux-pam-1.1.4/modules/pam_rhosts/pam_rhosts.c -============================================================================ ---- linux-pam-1.1.4/modules/pam_rhosts/pam_rhosts.c 2011-06-21 05:04:56.000000000 -0400 -+++ linux-pam-1.1.4/modules/pam_rhosts/pam_rhosts.c 2012-08-09 21:19:34.000000000 -0400 -@@ -114,8 +114,12 @@ - #ifdef HAVE_RUSEROK_AF - retval = ruserok_af (rhost, as_root, ruser, luser, PF_UNSPEC); - #else -+ #ifdef HAVE_RUSEROK - retval = ruserok (rhost, as_root, ruser, luser); --#endif -+ #else -+ retval = -1; -+ #endif /* HAVE_RUSEROK */ -+#endif /*HAVE_RUSEROK_AF */ - if (retval != 0) { - if (!opt_silent || opt_debug) - pam_syslog(pamh, LOG_WARNING, "denied access to %s@%s as %s", diff --git a/package/linux-pam/linux-pam.hash b/package/linux-pam/linux-pam.hash new file mode 100644 index 0000000000..3f420c2ba0 --- /dev/null +++ b/package/linux-pam/linux-pam.hash @@ -0,0 +1,2 @@ +# Locally computed hashes, not provided by upstream +sha256 c4b1f23a236d169e2496fea20721578d864ba00f7242d2b41d81050ac87a1e55 Linux-PAM-1.1.8.tar.bz2