aboutsummaryrefslogtreecommitdiff
path: root/lib/libpam/modules/pam_exec
Commit message (Collapse)AuthorAgeFilesLines
* libpam: Don't put man8 in the dev packageLexi Winter2025-11-101-3/+3
| | | | | | | | | | | | These are user-facing manpages, but were installed in the runtime-dev package since the PAM modules use bsd.lib.mk. Use MANNODEV instead of MAN to put them in the base runtime package instead. Fixes: 031e711647c3 ("packages: Install development manpages in the -dev package") MFC after: 3 days Reviewed by: bapt Sponsored by: https://www.patreon.com/bsdivy Differential Revision: https://reviews.freebsd.org/D53601
* manuals: Fix "unusual .Xr" warnings with a scriptGraham Percival2024-10-151-3/+3
| | | | | | | | | | | | | These were reported by `mandoc -T lint ...` as warnings: - unusual Xr order - unusual Xr punctuation Fixes made by script in https://github.com/Tarsnap/freebsd-doc-scripts Signed-off-by: Graham Percival <gperciva@tarsnap.com> Reviewed by: mhorne, Alexander Ziaee <concussious.bugzilla@runbox.com> Sponsored by: Tarsnap Backup Inc. Pull Request: https://github.com/freebsd/freebsd-src/pull/1464
* Remove residual blank line at start of MakefileWarner Losh2024-07-151-1/+0
| | | | | | | This is a residual of the $FreeBSD$ removal. MFC After: 3 days (though I'll just run the command on the branches) Sponsored by: Netflix
* lib: Automated cleanup of cdefs and other formattingWarner Losh2023-11-271-1/+0
| | | | | | | | | | | | | | | | Apply the following automated changes to try to eliminate no-longer-needed sys/cdefs.h includes as well as now-empty blank lines in a row. Remove /^#if.*\n#endif.*\n#include\s+<sys/cdefs.h>.*\n/ Remove /\n+#include\s+<sys/cdefs.h>.*\n+#if.*\n#endif.*\n+/ Remove /\n+#if.*\n#endif.*\n+/ Remove /^#if.*\n#endif.*\n/ Remove /\n+#include\s+<sys/cdefs.h>\n#include\s+<sys/types.h>/ Remove /\n+#include\s+<sys/cdefs.h>\n#include\s+<sys/param.h>/ Remove /\n+#include\s+<sys/cdefs.h>\n#include\s+<sys/capsicum.h>/ Sponsored by: Netflix
* Remove $FreeBSD$: two-line nroff patternWarner Losh2023-08-161-2/+0
| | | | Remove /^\.\\"\n\.\\"\s*\$FreeBSD\$$\n/
* Remove $FreeBSD$: one-line sh patternWarner Losh2023-08-162-2/+0
| | | | Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/
* Remove $FreeBSD$: one-line .c patternWarner Losh2023-08-161-2/+0
| | | | Remove /^[\s*]*__FBSDID\("\$FreeBSD\$"\);?\s*\n/
* Update/fix Makefile.depend for userlandSimon J. Gerraty2023-04-191-1/+0
|
* Fix dead refs to pam(8) with pam(3) as well as some other PAM functions.Jens Schweikhardt2022-09-161-7/+7
|
* pam_exec: fix segfault when authtok is nullYan Ka Chiu2022-05-221-0/+7
| | | | | | | | | | | | | | | | | | | | | | According to pam_exec(8), the `expose_authtok` option should be ignored when the service function is `pam_sm_setcred`. Currently `pam_exec` only prevent prompt for anth token when `expose_authtok` is set on `pam_sm_setcred`. This subsequently led to segfault when there isn't an existing auth token available. Bug reported on this: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=263893 After reading https://reviews.freebsd.org/rS349556 I am not sure if the default behaviour supposed to be simply not prompt for authentication token, or is it to ignore the option entirely as stated in the man page. This patch is therefore only adding an additional NULL check on the item `pam_get_item` provide, and exit with `PAM_SYSTEM_ERR` when such item is NULL. MFC after: 1 week Reviewed by: des, khng Differential Revision: https://reviews.freebsd.org/D35169
* Apply tentative fix for clang 11 warning in pam_exec(8):Dimitry Andric2020-08-061-1/+2
| | | | | | | | | lib/libpam/modules/pam_exec/pam_exec.c:222:56: error: format specifies type 'char *' but the argument has type 'const void *' [-Werror,-Wformat] if (asprintf(&envstr, "%s=%s", pam_item_env[i].name, item) < 0) ~~ ^~~~ Notes: svn path=/projects/clang1100-import/; revision=363986
* Changes to the expose_password functionality:Dag-Erling Smørgrav2019-06-302-7/+24
| | | | | | | | | | | | | - Implement use_first_pass, allowing expose_password to be used by other service functions than pam_auth() without prompting a second time. - Don't prompt for a password during pam_setcred(). PR: 238041 MFC after: 3 weeks Notes: svn path=/head/; revision=349556
* For full Linux-PAM compatibility, add a trailing NUL character whenDag-Erling Smørgrav2018-09-042-2/+4
| | | | | | | | | | | | passing the authentication token to the external program. Approved by: re (kib) Submitted by: Thomas Munro <munro@ip9.org> MFC after: 1 week Differential Revision: D16950 Notes: svn path=/head/; revision=338453
* Add support for Linux-PAM's badly named expose_authtok option.Dag-Erling Smørgrav2018-08-142-9/+77
| | | | | | | | | Submitted by: Thomas Munro <munro@ip9.org> MFC after: 1 week Differential Revision: D16171 Notes: svn path=/head/; revision=337732
* lib: further adoption of SPDX licensing ID tags.Pedro F. Giffuni2017-11-261-0/+2
| | | | | | | | | | | | | | | Mainly focus on files that use BSD 2-Clause license, however the tool I was using mis-identified many licenses so this was mostly a manual - error prone - task. The Software Package Data Exchange (SPDX) group provides a specification to make it easier for automated tools to detect and summarize well known opensource licenses. We are gradually adopting the specification, noting that the tags are considered only advisory and do not, in any way, superceed or replace the license texts. Notes: svn path=/head/; revision=326219
* DIRDEPS_BUILD: Update dependencies.Bryan Drewery2017-10-311-1/+0
| | | | | | | Sponsored by: Dell EMC Isilon Notes: svn path=/head/; revision=325188
* Add options to capture stdout and / or stderr and pass the output onDag-Erling Smørgrav2017-03-222-114/+244
| | | | | | | | | | | | | | to the user. There is currently no buffering, so the result may be somewhat unpredictable if the conversation function adds a newline, like openpam_ttyconv() does. Clean up and simplify the environment handling code, which triggered an inexplicable bug on some systems. MFC after: 2 weeks Notes: svn path=/head/; revision=315710
* Revert r314780Pedro F. Giffuni2017-03-121-1/+1
| | | | | | | | | | | | libpam: extra bounds checking through reallocarray(3). It appears to be causing brokenness when reporting PAM_* environment variables. This requires more investigation. Reported by: lstewart Notes: svn path=/head/; revision=315164
* libpam: extra bounds checking through reallocarray(3).Pedro F. Giffuni2017-03-061-1/+1
| | | | | | | | Reviewed by: des MFC after: 1 week Notes: svn path=/head/; revision=314780
* Revert r314777: wrong log, the change was to libpam.Pedro F. Giffuni2017-03-061-1/+1
| | | | Notes: svn path=/head/; revision=314779
* libfetch: extra bounds checking through reallocarray(3).Pedro F. Giffuni2017-03-061-1/+1
| | | | | | | | Reviewed by: des MFC after: 1 week Notes: svn path=/head/; revision=314777
* Add META_MODE support.Simon J. Gerraty2015-06-131-0/+19
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | Off by default, build behaves normally. WITH_META_MODE we get auto objdir creation, the ability to start build from anywhere in the tree. Still need to add real targets under targets/ to build packages. Differential Revision: D2796 Reviewed by: brooks imp Notes: svn path=/head/; revision=284345
| * Updated/new dependenciesSimon J. Gerraty2014-11-191-1/+0
| | | | | | | | Notes: svn path=/projects/bmake/; revision=274694
| * Updated dependenciesSimon J. Gerraty2014-05-161-1/+1
| | | | | | | | Notes: svn path=/projects/bmake/; revision=266219
| * Updated dependenciesSimon J. Gerraty2014-05-101-0/+2
| | | | | | | | Notes: svn path=/projects/bmake/; revision=265802
| * Updated dependenciesSimon J. Gerraty2013-03-111-0/+1
| | | | | | | | Notes: svn path=/projects/bmake/; revision=248169
| * Updated dependenciesSimon J. Gerraty2013-02-161-2/+0
| | | | | | | | Notes: svn path=/projects/bmake/; revision=246868
| * Updated/new Makefile.dependSimon J. Gerraty2012-11-081-0/+4
| | | | | | | | Notes: svn path=/projects/bmake/; revision=242788
| * Sync FreeBSD's bmake branch with Juniper's internal bmake branch.Marcel Moolenaar2012-08-221-0/+16
|/ | | | | | | Requested by: Simon Gerraty <sjg@juniper.net> Notes: svn path=/projects/bmake/; revision=239572
* Fixes to man8 groff mandoc style, usage mistakes, or typos.Warren Block2012-05-241-2/+2
| | | | | | | | | | PR: 168016 Submitted by: Nobuyuki Koganemaru Approved by: gjb MFC after: 3 days Notes: svn path=/head/; revision=235873
* Fix error messages containing the executed command nameJean-Sébastien Pédron2012-04-121-31/+77
| | | | | | | | | | | | | | | Before, we took the first argument to pam_exec(8). With the addition of options in front of the command, this could be wrong. Now, options are parsed before calling _pam_exec() and messages contain the proper command name. While here, fix a warning. Sponsored by: Yakaz (http://www.yakaz.com) Notes: svn path=/head/; revision=234184
* Use program exit status as pam_exec return code (optional)Jean-Sébastien Pédron2012-03-262-38/+362
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | pam_exec(8) now accepts a new option "return_prog_exit_status". When set, the program exit status is used as the pam_exec return code. It allows the program to tell why the step failed (eg. user unknown). However, if it exits with a code not allowed by the calling PAM service module function (see $PAM_SM_FUNC below), a warning is logged and PAM_SERVICE_ERR is returned. The following changes are related to this new feature but they apply no matter if the "return_prog_exit_status" option is set or not. The environment passed to the program is extended: o $PAM_SM_FUNC contains the name of the PAM service module function (eg. pam_sm_authenticate). o All valid PAM return codes' numerical values are available through variables named after the return code name. For instance, $PAM_SUCCESS, $PAM_USER_UNKNOWN or $PAM_PERM_DENIED. pam_exec return code better reflects what went on: o If the program exits with !0, the return code is now PAM_PERM_DENIED, not PAM_SYSTEM_ERR. o If the program fails because of a signal (WIFSIGNALED) or doesn't terminate normally (!WIFEXITED), the return code is now PAM_SERVICE_ERR, not PAM_SYSTEM_ERR. o If a syscall in pam_exec fails, the return code remains PAM_SYSTEM_ERR. waitpid(2) is called in a loop. If it returns because of EINTR, do it again. Before, it would return PAM_SYSTEM_ERR without waiting for the child to exit. Several log messages now include the PAM service module function name. The man page is updated accordingly. Reviewed by: gleb@, des@ Sponsored by: Yakaz (http://www.yakaz.com) MFC after: 2 weeks Notes: svn path=/head/; revision=233507
* Build lib/ with WARNS=6 by default.Ed Schouten2010-01-021-1/+1
| | | | | | | | | | | | Similar to libexec/, do the same with lib/. Make WARNS=6 the norm and lower it when needed. I'm setting WARNS?=0 for secure/. It seems secure/ includes the Makefile.inc provided by lib/. I'm not going to touch that directory. Most of the code there is contributed anyway. Notes: svn path=/head/; revision=201381
* Include <stdio.h> for asprintf().Ed Schouten2009-06-141-0/+1
| | | | | | | Submitted by: Pawel Worach Notes: svn path=/head/; revision=194188
* childerr needs to be volatile so gcc won't optimize it away.Dag-Erling Smørgrav2006-11-101-1/+2
| | | | | | | | PR: bin/85830 MFC after: 1 week Notes: svn path=/head/; revision=164154
* When (re)allocating space for an array of pointers to char, useColin Percival2005-09-191-1/+1
| | | | | | | | | | | | | | | sizeof(*list), not sizeof(**list). (i.e., sizeof(pointer) rather than sizeof(char)). It is possible that this buffer overflow is exploitable, but it was added after RELENG_5 forked and hasn't been MFCed, so this will not receive an advisory. Submitted by: Vitezslav Novy MFC after: 1 day Notes: svn path=/head/; revision=150339
* Assorted markup fixes.Ruslan Ermilov2005-06-151-1/+1
| | | | | | | Approved by: re Notes: svn path=/head/; revision=147402
* In addition to the PAM environment, export a handful of useful PAM items.Dag-Erling Smørgrav2005-02-012-8/+62
| | | | | | | Suggested by: Ed Maste <emaste@phaedrus.sandvine.ca> Notes: svn path=/head/; revision=141102
* Mechanically kill hard sentence breaks.Ruslan Ermilov2004-07-021-1/+1
| | | | Notes: svn path=/head/; revision=131504
* style.Makefile(5) policeDavid E. O'Brien2003-03-091-3/+5
| | | | | | | | | (I've tried to keep to the spirit of the original formatting) Reviewed by: des Notes: svn path=/head/; revision=112044
* Don't blame markm for what he didn't do - writing these man pages, forDag-Erling Smørgrav2003-02-061-3/+1
| | | | | | | | instance. Also bump the date since I made substantial modifications earlier today. Notes: svn path=/head/; revision=110451
* Update copyright.Dag-Erling Smørgrav2003-02-061-1/+1
| | | | Notes: svn path=/head/; revision=110448
* Export the PAM environment to the child process instead of the "normal"Dag-Erling Smørgrav2003-02-062-3/+12
| | | | | | | | | environment list, which may be unsafe and / or sensitive. Sponsored by: DARPA, NAI Labs Notes: svn path=/head/; revision=110446
* Just to show that PAM can do almost anything from the ridiculous to theDag-Erling Smørgrav2002-05-233-0/+219
obscene, or - as they say in New York - sophisticated, add pam_echo(8) and pam_exec(8) to our ever-lengthening roster of PAM modules. Sponsored by: DARPA, NAI Labs. Notes: svn path=/head/; revision=97182
generated by cgit v1.2.3 (git 2.25.1) at 2026-03-17 10:34:55 +0000