← Back to branch summary

~ubuntu-branches/ubuntu/breezy/pam/breezy

« back to all changes in this revision

Viewing changes to debian/patches-applied/029_pam_limits_capabilities

  • Committer: Bazaar Package Importer
  • Author(s): Sam Hartman
  • Date: 2004-06-28 14:28:08 UTC
  • mfrom: (2.1.1 warty)
  • Revision ID: james.westby@ubuntu.com-20040628142808-adikk7vtfg3pzcjw
Tags: 0.76-22
http://bugs.debian.org/254904
* Add uploaders
* Document location of repository
* Fix options containing arguments in pam_unix, Closes: #254904

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches-applied/029_pam_limits_capabilities
 
1
Index: Linux-PAM/Make.Rules.in
 
2
===================================================================
 
3
RCS file: /afs/sipb/project/debian/cvs/pam/Linux-PAM/Make.Rules.in,v
 
4
retrieving revision 1.3
 
5
diff -u -r1.3 Make.Rules.in
 
6
--- Linux-PAM/Make.Rules.in     15 Sep 2002 20:17:56 -0000      1.3
 
7
+++ Linux-PAM/Make.Rules.in     22 Sep 2002 19:35:35 -0000
 
8
@@ -106,5 +106,5 @@
 
9
 RANLIB=@RANLIB@
 
10
 STRIP=@STRIP@
 
11
 CC_STATIC=@CC_STATIC@
 
12
-
 
13
-LINKLIBS = $(NEED_LINK_LIB_C) $(LIBDL)
 
14
+LIBS=@LIBS@
 
15
+LINKLIBS = $(NEED_LINK_LIB_C) $(LIBDL) 
 
16
Index: Linux-PAM/_pam_aconf.h.in
 
17
===================================================================
 
18
RCS file: /afs/sipb/project/debian/cvs/pam/Linux-PAM/_pam_aconf.h.in,v
 
19
retrieving revision 1.2
 
20
diff -u -r1.2 _pam_aconf.h.in
 
21
--- Linux-PAM/_pam_aconf.h.in   21 Sep 2002 18:11:03 -0000      1.2
 
22
+++ Linux-PAM/_pam_aconf.h.in   22 Sep 2002 19:35:35 -0000
 
23
@@ -74,12 +74,15 @@
 
24
 /* read both confs - read /etc/pam.d and /etc/pam.conf in serial */
 
25
 #undef PAM_READ_BOTH_CONFS
 
26
 
 
27
+#undef HAVE_SYS_CAPABILITY_H
 
28
+
 
29
 #undef HAVE_PATHS_H
 
30
 #ifdef HAVE_PATHS_H
 
31
 #include <paths.h>
 
32
 #endif
 
33
 /* location of the mail spool directory */
 
34
 #undef PAM_PATH_MAILDIR
 
35
+
 
36
 
 
37
 /* where should we include setfsuid's prototype from? If this is not
 
38
    defined, we get it from unistd.h */
 
39
Index: Linux-PAM/configure.in
 
40
===================================================================
 
41
RCS file: /afs/sipb/project/debian/cvs/pam/Linux-PAM/configure.in,v
 
42
retrieving revision 1.13
 
43
diff -u -r1.13 configure.in
 
44
--- Linux-PAM/configure.in      21 Sep 2002 18:38:49 -0000      1.13
 
45
+++ Linux-PAM/configure.in      22 Sep 2002 19:46:38 -0000
 
46
@@ -235,7 +235,7 @@
 
47
 AC_HEADER_DIRENT
 
48
 AC_HEADER_STDC
 
49
 AC_HEADER_SYS_WAIT
 
50
-AC_CHECK_HEADERS(fcntl.h limits.h malloc.h sys/file.h sys/ioctl.h sys/time.h syslog.h net/if.h termios.h unistd.h sys/fsuid.h)
 
51
+AC_CHECK_HEADERS(fcntl.h limits.h malloc.h sys/file.h sys/ioctl.h sys/time.h syslog.h net/if.h termios.h unistd.h sys/fsuid.h sys/capability.h )
 
52
 
 
53
 dnl Linux wants features.h in some of the source files.
 
54
 AC_CHECK_HEADERS(features.h)
 
55
@@ -401,6 +401,7 @@
 
56
 AC_FUNC_MEMCMP
 
57
 AC_FUNC_VPRINTF
 
58
 AC_CHECK_FUNCS(gethostname gettimeofday mkdir select strcspn strdup strerror strspn strstr strtol uname)
 
59
+AC_CHECK_LIB(cap, cap_init)
 
60
 
 
61
 AC_CHECK_FUNCS(getpwnam_r getgrnam_r)
 
62
 
 
63
Index: Linux-PAM/modules/pam_limits/pam_limits.c
 
64
===================================================================
 
65
RCS file: /afs/sipb/project/debian/cvs/pam/Linux-PAM/modules/pam_limits/pam_limits.c,v
 
66
retrieving revision 1.10
 
67
diff -u -r1.10 pam_limits.c
 
68
--- Linux-PAM/modules/pam_limits/pam_limits.c   22 Sep 2002 00:04:48 -0000      1.10
 
69
+++ Linux-PAM/modules/pam_limits/pam_limits.c   22 Sep 2002 19:43:07 -0000
 
70
@@ -19,6 +19,10 @@
 
71
 
 
72
 #include <security/_pam_aconf.h>
 
73
 
 
74
+#ifdef HAVE_SYS_CAPABILITY_H
 
75
+#include <sys/capability.h>
 
76
+#include <sys/prctl.h>
 
77
+#endif /* HAVE_SYS_CAPABILITY_H */
 
78
 #include <stdio.h>
 
79
 #include <unistd.h>
 
80
 #include <string.h>
 
81
@@ -72,6 +76,10 @@
 
82
                              specific user or to count all logins */
 
83
     int priority;       /* the priority to run user process with */
 
84
   char chroot_dir[8092] ;      /* directory to chroot into */
 
85
+#ifdef HAVE_SYS_CAPABILITY_H
 
86
+  cap_t capabilities; /*capability handle*/
 
87
+  int caps_set;
 
88
+#endif /* HAVE_SYS_CAPABILITY_H */
 
89
     int supported[RLIM_NLIMITS];
 
90
     struct user_limits_struct limits[RLIM_NLIMITS];
 
91
     char conf_file[BUFSIZ];
 
92
@@ -83,6 +91,7 @@
 
93
 
 
94
 #define LIMIT_PRI RLIM_NLIMITS+3
 
95
 #define LIMIT_CHROOT RLIM_NLIMITS+4
 
96
+#define LIMIT_CAPS RLIM_NLIMITS+5
 
97
 
 
98
 #define LIMIT_SOFT  1
 
99
 #define LIMIT_HARD  2
 
100
@@ -308,6 +317,10 @@
 
101
     pl->login_limit = -2;
 
102
     pl->login_limit_def = LIMITS_DEF_NONE;
 
103
 
 
104
+#ifdef HAVE_SYS_CAPABILITY_H
 
105
+    pl->capabilities = cap_init();
 
106
+    pl->caps_set = 0;
 
107
+#endif /* HAVE_SYS_CAPABILITY_H */
 
108
     pl->chroot_dir[0] = '\0';
 
109
     
 
110
     return retval;
 
111
@@ -364,6 +377,10 @@
 
112
        limit_item = LIMIT_PRI;
 
113
     } else if (strcmp(lim_item, "chroot") == 0) {
 
114
        limit_item = LIMIT_CHROOT;
 
115
+#ifdef HAVE_SYS_CAPABILITY_H
 
116
+    } else if (strcmp(lim_item, "capabilities") == 0) {
 
117
+       limit_item = LIMIT_CAPS;
 
118
+#endif /* HAVE_SYS_CAPABILITY_H */
 
119
     } else {
 
120
         _pam_log(LOG_DEBUG,"unknown limit item '%s'", lim_item);
 
121
         return;
 
122
@@ -430,7 +447,9 @@
 
123
     if ( (limit_item != LIMIT_LOGIN)
 
124
         && (limit_item != LIMIT_NUMSYSLOGINS)
 
125
         && (limit_item != LIMIT_PRI)
 
126
-        && (limit_item != LIMIT_CHROOT)) {
 
127
+        && (limit_item != LIMIT_CHROOT)
 
128
+        && (limit_item != LIMIT_CAPS)
 
129
+        ) {
 
130
         if (limit_type & LIMIT_SOFT) {
 
131
            if (pl->limits[limit_item].src_soft < source) {
 
132
                 return;
 
133
@@ -454,7 +473,15 @@
 
134
                pl->priority = limit_value;
 
135
        } else if (limit_item == LIMIT_CHROOT) {
 
136
          strncpy(pl->chroot_dir, value_orig, sizeof(pl->chroot_dir));
 
137
-       } else {
 
138
+       }
 
139
+#ifdef HAVE_SYS_CAPABILITY_H
 
140
+       else if (limit_item == LIMIT_CAPS) {
 
141
+         pl->capabilities = cap_from_text(value_orig);
 
142
+         prctl(PR_SET_KEEPCAPS, 1);
 
143
+         pl->caps_set = 1;
 
144
+       }
 
145
+#endif /*HAVE_SYS_CAPABILITY_H*/
 
146
+       else {
 
147
                if (pl->login_limit_def < source) {
 
148
                    return;
 
149
                } else {
 
150
@@ -631,6 +658,12 @@
 
151
        if (i != 0)
 
152
            retval = LIMIT_ERR;
 
153
     }
 
154
+#ifdef HAVE_SYS_CAPABILITY_H
 
155
+    if (!retval && pl->caps_set) {
 
156
+       retval = cap_set_proc(pl->capabilities) ? LIMIT_ERR : 0;
 
157
+       cap_free(pl->capabilities);
 
158
+    }
 
159
+#endif /* HAVE_SYS_CAPABILITY_H */
 
160
     return retval;
 
161
 }
 
162