linux/poky.git/meta/recipes-extended/pam/libpam, branch python3

libpam: Fix build with musl

2015-12-12T23:42:55+00:00

Define strndupa if not available in libc additionally fix headers to explicitly needed include files which glibc was including indirectly (From OE-Core rev: 24097d8bb481ed1312c45b2e93527a271f56e4be) Signed-off-by: Khem Raj Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

libpam: Fix build with uclibc

2015-10-27T07:24:26+00:00

libpam needs to adjust for posix utmpx uclibc now disables utmp Change-Id: Ibcb7cb621527f318eb8b6e2741647ccb4c6bb39c (From OE-Core rev: e4c8a15d36d05d2b17b1dcf1d4238616c5b814f5) Signed-off-by: Khem Raj Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

libpam: Fix patch broken during upgrade

2015-08-09T22:15:33+00:00

"0x200" became "0200" during the upgrade to libpam 1.2.1 in: http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/?id=88dd997d9941b63ae9eead6690ecf2b785c0740c and this broke the IMAGE_FEATURES like debug-tweaks. I've converted all the values to octal here to match the original header file convention and make it clearer. [YOCTO #8033] (From OE-Core rev: 588e19058f631a1cc78002e1969a5459cd626afb) Signed-off-by: Richard Purdie

libpam: Upgrade v1.1.6 -> v1.2.1

2015-07-20T09:40:42+00:00

Dropped upstreamed patches(commit-id): - add-checks-for-crypt-returning-NULL.patch(8dc056c) - destdirfix.patch(d7e6b92) - libpam-fix-for-CVE-2010-4708.patch(4c430f6) Dropped backported patches(commit-id): - pam_timestamp-fix-potential-directory-traversal-issu.patch(9dcead8) - reflect-the-enforce_for_root-semantics-change-in-pam.patch(bd07ad3) Forward ported patches: - pam-unix-nullok-secure.patch - crypt_configure.patch (From OE-Core rev: 8683206f7ba85f693751415f896a0cc62931e3c4) Signed-off-by: Amarnath Valluri Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

libpam: Fix wrong crypt library detection

2015-06-08T16:34:03+00:00

Surfaced when building with musl This details are in patch headers Enabel innetgr.patch for musl as well (From OE-Core rev: 6ec229d8dec6a5978ebf6b264c332590c8be0b3a) Signed-off-by: Khem Raj Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

libpam / xtests: remove bash dependency

2014-09-29T11:12:43+00:00

There's not bash specific syntax in the xtests scripts: $ cd Linux-PAM-1.1.6/xtests # replace /bin/bash to /bin/sh and check the bashisms: $ checkbashisms *.sh No output So the runtime dependency to bash could be removed. (From OE-Core rev: 1917bf7aa74aa1b86756c73c56537db2591115e5) Signed-off-by: Wenzong Fan Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

libpam: Security Advisory - CVE-2014-2583

2014-06-17T09:23:53+00:00

v2 changes: * update format for commit log * add Upstream-Status for patch Multiple directory traversal vulnerabilities in pam_timestamp.c in the pam_timestamp module for Linux-PAM (aka pam) 1.1.8 allow local users to create aribitrary files or possibly bypass authentication via a .. (dot dot) in the (1) PAM_RUSER value to the get_ruser function or (2) PAM_TTY value to the check_tty funtion, which is used by the format_timestamp_name function. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2583 (From OE-Core rev: 69255c84ebd99629da8174e1e73fd8c715e49b52) Signed-off-by: Yue Tao Signed-off-by: Wenzong Fan Signed-off-by: Richard Purdie

libpam: only use pam_systemd.so if systemd is enabled

2013-09-22T11:19:42+00:00

So that sysvinit images don't warn on every login only add it to common-session if systemd is a DISTRO_FEATURE. [ YOCTO #3805 ] (From OE-Core rev: 3ccb0855a7a6b147e5025855c6376747ba72986a) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

libpam: deny all services for the OTHER entries

2013-07-31T05:59:58+00:00

To be secure, change behavior of the OTHER entries to warn and deny access to everything by stating pam_deny.so on all services. (From OE-Core rev: 4ca0af699b5b4b3cf95b3e76482651949fd922ac) Signed-off-by: Ming Liu Signed-off-by: Saul Wold Signed-off-by: Richard Purdie

libpam: add a new 'nullok_secure' option support to pam_unix

2013-07-24T10:35:33+00:00

Debian patch to add a new 'nullok_secure' option to pam_unix, which accepts users with null passwords only when the applicant is connected from a tty listed in /etc/securetty. The original pam_unix.so was configured with nullok_secure in meta/recipes-extended/pam/libpam/pam.d/common-auth, but no such code exists actually. The patch set comes from: http://patch-tracker.debian.org/patch/series/view/pam/1.1.3-7.1/054_pam_security_abstract_securetty_handling http://patch-tracker.debian.org/patch/series/view/pam/1.1.3-7.1/055_pam_unix_nullok_secure (From OE-Core rev: 10cdd66fe800cffe3f2cbf5c95550b4f7902a311) Signed-off-by: Ming Liu Signed-off-by: Saul Wold Signed-off-by: Richard Purdie