|
 |
c28ff7 |
diff -up Linux-PAM-1.3.1/configure.ac.pam-usertype-SYS_UID_MAX Linux-PAM-1.3.1/configure.ac
|
|
|
c28ff7 |
--- Linux-PAM-1.3.1/configure.ac.pam-usertype-SYS_UID_MAX 2022-06-22 16:41:09.169146826 +0200
|
|
|
c28ff7 |
+++ Linux-PAM-1.3.1/configure.ac 2022-06-22 16:43:54.343373619 +0200
|
|
|
c28ff7 |
@@ -615,12 +615,6 @@ if test x"$opt_uidmin" == x; then
|
|
|
c28ff7 |
fi
|
|
|
c28ff7 |
AC_DEFINE_UNQUOTED(PAM_USERTYPE_UIDMIN, $opt_uidmin, [Minimum regular user uid.])
|
|
|
c28ff7 |
|
|
|
c28ff7 |
-AC_ARG_WITH([sysuidmin], AS_HELP_STRING([--with-sysuidmin=<number>],[default value for system user min uid (101)]), opt_sysuidmin=$withval)
|
|
|
c28ff7 |
-if test x"$opt_sysuidmin" == x; then
|
|
|
c28ff7 |
- opt_sysuidmin=101
|
|
|
c28ff7 |
-fi
|
|
|
c28ff7 |
-AC_DEFINE_UNQUOTED(PAM_USERTYPE_SYSUIDMIN, $opt_sysuidmin, [Minimum system user uid.])
|
|
|
c28ff7 |
-
|
|
|
c28ff7 |
AC_ARG_WITH([kerneloverflowuid], AS_HELP_STRING([--with-kernel-overflow-uid=<number>],[kernel overflow uid, default (uint16_t)-2=65534]), opt_kerneloverflowuid=$withval)
|
|
|
c28ff7 |
if test x"$opt_kerneloverflowuid" == x; then
|
|
|
c28ff7 |
opt_kerneloverflowuid=65534
|
|
|
c28ff7 |
diff -up Linux-PAM-1.3.1/modules/pam_usertype/pam_usertype.8.xml.pam-usertype-SYS_UID_MAX Linux-PAM-1.3.1/modules/pam_usertype/pam_usertype.8.xml
|
|
|
c28ff7 |
--- Linux-PAM-1.3.1/modules/pam_usertype/pam_usertype.8.xml.pam-usertype-SYS_UID_MAX 2022-06-22 16:41:09.155146722 +0200
|
|
|
c28ff7 |
+++ Linux-PAM-1.3.1/modules/pam_usertype/pam_usertype.8.xml 2022-06-22 16:41:09.169146826 +0200
|
|
|
c28ff7 |
@@ -31,7 +31,7 @@
|
|
|
c28ff7 |
pam_usertype.so is designed to succeed or fail authentication
|
|
|
c28ff7 |
based on type of the account of the authenticated user.
|
|
|
c28ff7 |
The type of the account is decided with help of
|
|
|
c28ff7 |
- <emphasis>SYS_UID_MIN</emphasis> and <emphasis>SYS_UID_MAX</emphasis>
|
|
|
c28ff7 |
+ <emphasis>SYS_UID_MAX</emphasis>
|
|
|
c28ff7 |
settings in <emphasis>/etc/login.defs</emphasis>. One use is to select
|
|
|
c28ff7 |
whether to load other modules based on this test.
|
|
|
c28ff7 |
</para>
|
|
|
c28ff7 |
diff -up Linux-PAM-1.3.1/modules/pam_usertype/pam_usertype.c.pam-usertype-SYS_UID_MAX Linux-PAM-1.3.1/modules/pam_usertype/pam_usertype.c
|
|
|
c28ff7 |
--- Linux-PAM-1.3.1/modules/pam_usertype/pam_usertype.c.pam-usertype-SYS_UID_MAX 2022-06-22 16:41:09.155146722 +0200
|
|
|
c28ff7 |
+++ Linux-PAM-1.3.1/modules/pam_usertype/pam_usertype.c 2022-06-22 16:41:09.169146826 +0200
|
|
|
c28ff7 |
@@ -277,7 +277,6 @@ static int
|
|
|
c28ff7 |
pam_usertype_is_system(pam_handle_t *pamh, uid_t uid)
|
|
|
c28ff7 |
{
|
|
|
c28ff7 |
uid_t uid_min;
|
|
|
c28ff7 |
- uid_t sys_min;
|
|
|
c28ff7 |
uid_t sys_max;
|
|
|
c28ff7 |
|
|
|
c28ff7 |
if (uid == (uid_t)-1) {
|
|
|
c28ff7 |
@@ -285,21 +284,19 @@ pam_usertype_is_system(pam_handle_t *pam
|
|
|
c28ff7 |
return PAM_USER_UNKNOWN;
|
|
|
c28ff7 |
}
|
|
|
c28ff7 |
|
|
|
c28ff7 |
- if (uid <= 99) {
|
|
|
c28ff7 |
- /* Reserved. */
|
|
|
c28ff7 |
- return PAM_SUCCESS;
|
|
|
c28ff7 |
- }
|
|
|
c28ff7 |
-
|
|
|
c28ff7 |
if (uid == PAM_USERTYPE_OVERFLOW_UID) {
|
|
|
c28ff7 |
/* nobody */
|
|
|
c28ff7 |
return PAM_SUCCESS;
|
|
|
c28ff7 |
}
|
|
|
c28ff7 |
|
|
|
c28ff7 |
uid_min = pam_usertype_get_id(pamh, "UID_MIN", PAM_USERTYPE_UIDMIN);
|
|
|
c28ff7 |
- sys_min = pam_usertype_get_id(pamh, "SYS_UID_MIN", PAM_USERTYPE_SYSUIDMIN);
|
|
|
c28ff7 |
sys_max = pam_usertype_get_id(pamh, "SYS_UID_MAX", uid_min - 1);
|
|
|
c28ff7 |
|
|
|
c28ff7 |
- return uid >= sys_min && uid <= sys_max ? PAM_SUCCESS : PAM_AUTH_ERR;
|
|
|
c28ff7 |
+ if (uid <= sys_max && uid < uid_min) {
|
|
|
c28ff7 |
+ return PAM_SUCCESS;
|
|
|
c28ff7 |
+ }
|
|
|
c28ff7 |
+
|
|
|
c28ff7 |
+ return PAM_AUTH_ERR;
|
|
|
c28ff7 |
}
|
|
|
c28ff7 |
|
|
|
c28ff7 |
static int
|
|
|
c28ff7 |
@@ -336,7 +333,7 @@ pam_usertype_evaluate(struct pam_usertyp
|
|
|
c28ff7 |
|
|
|
c28ff7 |
/**
|
|
|
c28ff7 |
* Arguments:
|
|
|
c28ff7 |
- * - issystem: uid in <SYS_UID_MIN, SYS_UID_MAX>
|
|
|
c28ff7 |
+ * - issystem: uid less than SYS_UID_MAX
|
|
|
c28ff7 |
* - isregular: not issystem
|
|
|
c28ff7 |
* - use_uid: use user that runs application not that is being authenticate (same as in pam_succeed_if)
|
|
|
c28ff7 |
* - audit: log unknown users to syslog
|