Sync from SUSE:SLFO:Main pam_pkcs11 revision 0f15d71ea5160c385d58ba1c7fa078f8

.gitattributes

@@ -0,0 +1,23 @@
+## Default LFS
+*.7z filter=lfs diff=lfs merge=lfs -text
+*.bsp filter=lfs diff=lfs merge=lfs -text
+*.bz2 filter=lfs diff=lfs merge=lfs -text
+*.gem filter=lfs diff=lfs merge=lfs -text
+*.gz filter=lfs diff=lfs merge=lfs -text
+*.jar filter=lfs diff=lfs merge=lfs -text
+*.lz filter=lfs diff=lfs merge=lfs -text
+*.lzma filter=lfs diff=lfs merge=lfs -text
+*.obscpio filter=lfs diff=lfs merge=lfs -text
+*.oxt filter=lfs diff=lfs merge=lfs -text
+*.pdf filter=lfs diff=lfs merge=lfs -text
+*.png filter=lfs diff=lfs merge=lfs -text
+*.rpm filter=lfs diff=lfs merge=lfs -text
+*.tbz filter=lfs diff=lfs merge=lfs -text
+*.tbz2 filter=lfs diff=lfs merge=lfs -text
+*.tgz filter=lfs diff=lfs merge=lfs -text
+*.ttf filter=lfs diff=lfs merge=lfs -text
+*.txz filter=lfs diff=lfs merge=lfs -text
+*.whl filter=lfs diff=lfs merge=lfs -text
+*.xz filter=lfs diff=lfs merge=lfs -text
+*.zip filter=lfs diff=lfs merge=lfs -text
+*.zst filter=lfs diff=lfs merge=lfs -text

baselibs.conf

@@ -0,0 +1,2 @@
+pam_pkcs11
+  supplements "packageand(pam_pkcs11:pam-<targettype>)"

pam_pkcs11-0.5.3-nss-conf.patch

@@ -0,0 +1,36 @@
+Index: pam_pkcs11-pam_pkcs11-0.6.12/etc/pam_pkcs11.conf.example.in
+===================================================================
+--- pam_pkcs11-pam_pkcs11-0.6.12.orig/etc/pam_pkcs11.conf.example.in
++++ pam_pkcs11-pam_pkcs11-0.6.12/etc/pam_pkcs11.conf.example.in
+@@ -9,7 +9,7 @@ pam_pkcs11 {
+   nullok = true;
+ 
+   # Enable debugging support.
+-  debug = true; 
++  debug = false; 
+ 
+   # Do not prompt the user for the passwords but take them from the
+   # PAM_ items instead.
+@@ -48,7 +48,12 @@ pam_pkcs11 {
+   screen_savers = xfce4-screensaver, mate-screensaver, gnome-screensaver, kde4-kscreensaver, kscreensaver, xscreensaver;
+ 
+   # Filename of the PKCS #11 module. The default value is "default"
+-  use_pkcs11_module = opensc;
++  use_pkcs11_module = nss;
++
++  pkcs11_module nss {
++    nss_dir = /etc/pki/nssdb;
++    crl_policy = none;
++  }
+ 
+   pkcs11_module opensc {
+     module = /usr/lib/opensc-pkcs11.so;
+@@ -162,7 +167,7 @@ pam_pkcs11 {
+   # If used null mapper should be the last in the list :-)
+   # Also you should select at least one mapper, otherwise
+   # certificate will not match :-)
+-  use_mappers = digest, cn, pwent, uid, mail, subject, null;
++  use_mappers = ms;
+ 
+   # When no absolute path or module info is provided, use this
+   # value as module search path

pam_pkcs11-0.6.0-nss-autoconf.patch

@@ -0,0 +1,11 @@
+--- pam_pkcs11-0.6.1/src/pam_pkcs11/pam_config.c
++++ pam_pkcs11-0.6.1/src/pam_pkcs11/pam_config.c
+@@ -45,7 +45,7 @@
+         0,				/* int card_only; */
+         0,				/* int wait_for_card; */
+         "default", 			/* const char *pkcs11_module; */
+-        CONFDIR "/pkcs11_module.so",/* const char *pkcs11_module_path; */
++        NULL,				/* const char *pkcs11_module_path; */
+         NULL,                           /* screen savers */
+         NULL,			/* slot_description */
+         -1,				/* int slot_num; */

pam_pkcs11-common-auth-smartcard.pam

@@ -0,0 +1,3 @@
+auth	required	pam_env.so
+auth	required	pam_pkcs11.so
+auth	required	pam_unix2.so use_first_pass

pam_pkcs11-fsf-address.patch

@@ -0,0 +1,13 @@
+Index: pam_pkcs11-pam_pkcs11-0.6.9/COPYING
+===================================================================
+--- pam_pkcs11-pam_pkcs11-0.6.9.orig/COPYING
++++ pam_pkcs11-pam_pkcs11-0.6.9/COPYING
+@@ -2,7 +2,7 @@
+ 		       Version 2.1, February 1999
+ 
+  Copyright (C) 1991, 1999 Free Software Foundation, Inc.
+-     59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
++     51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+  Everyone is permitted to copy and distribute verbatim copies
+  of this license document, but changing it is not allowed.
+ 

pam_pkcs11.changes

@@ -0,0 +1,183 @@
+-------------------------------------------------------------------
+Mon Jan 16 09:31:59 UTC 2023 - Stefan Schubert <schubi@suse.com>
+
+- Migration of PAM settings to /usr/lib/pam.d.
+
+-------------------------------------------------------------------
+Fri Jul 29 08:49:15 UTC 2022 - pgajdos@suse.com
+
+-  use pam rpm macros [bsc#1190957]
+
+-------------------------------------------------------------------
+Sat Jan 15 10:26:28 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>
+
+- update to 0.6.12:
+  * Limit signature length to 65536 bytes
+  * A number of bug fixes and OpenSSL compatibility updates
+  * console output color updates
+  * Add support of ECDSA signature in addition to RSA
+
+-------------------------------------------------------------------
+Thu Oct 14 10:34:54 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
+
+- Added hardening to systemd service(s) (bsc#1181400). Modified:
+  * pkcs11_eventmgr.service
+
+-------------------------------------------------------------------
+Tue Jan 29 22:45:28 CET 2019 - sbrabec@suse.com
+
+- Update to version 0.6.10:
+  * Fix some security issues (thx @frankmorgner):
+    https://www.x41-dsec.de/lab/advisories/x41-2018-003-pam_pkcs11/
+    (drop 0001-verify-using-a-nonce-from-the-system-not-the-card.patch,
+    0002-fixed-buffer-overflow-with-long-home-directory.patch,
+    0003-fixed-wiping-secrets-with-OpenSSL_cleanse.patch).
+  * Fix buffer overflow with long home directory.
+  * Fix wiping secrets (now using OpenSSL_cleanse()).
+  * Verify using a nonce from the system, not the card.
+  * Fix segfalt when checking CRLs
+    (drop pam_pkcs11-crl-check.patch).
+- Add rcpkcs11_eventmgr service symlink.
+
+-------------------------------------------------------------------
+Fri Aug 17 10:12:31 UTC 2018 - vcizek@suse.com
+
+- Address security issues found by X41 D-Sec audit (bsc#1105012)
+  * Authentication Replay
+  * Buffer Overflow
+  * Memory not cleaned properly before free()
+- add patches:
+  * 0001-verify-using-a-nonce-from-the-system-not-the-card.patch
+  * 0002-fixed-buffer-overflow-with-long-home-directory.patch
+  * 0003-fixed-wiping-secrets-with-OpenSSL_cleanse.patch
+
+-------------------------------------------------------------------
+Mon Jul 23 17:36:18 CEST 2018 - sbrabec@suse.com
+
+- Fix segfault and fetch problems when checking CRLs
+  (pam_pkcs11-crl-check.patch).
+
+-------------------------------------------------------------------
+Sun Sep 10 00:08:17 UTC 2017 - jengelh@inai.de
+
+- Repair bulletpoint that skidded in description.
+  Trim description of %name-devel-doc, it does not cotain
+  the programs.
+
+-------------------------------------------------------------------
+Wed Aug  9 15:08:07 UTC 2017 - astieger@suse.com
+
+- add service file bsc#1049219
+
+-------------------------------------------------------------------
+Thu Jul 20 18:02:57 CEST 2017 - sbrabec@suse.com
+
+- Updated to version 0.6.9:
+  * Upstream web moved.
+  * pkcs11_listcerts: Do not fail on certificate error.
+  * Do not fail if card was already unlocked.
+  * Other bug fixes.
+  * Translation updates.
+- Drop upstreamed pam_pkcs11-0.6.8-fix-crypto-cflags.patch.
+- Work around incorrect upstream release process not calling
+  "make dist".
+- Split API documentation into a separate package
+  pam_pkcs11-devel-doc.
+- Add pam_pkcs11-fsf-address.patch.
+
+-------------------------------------------------------------------
+Tue Feb  9 19:02:43 UTC 2016 - antoine.belvire@laposte.net
+
+- Fix build for Tumbleweed:
+  * Add pam_pkcs11-0.6.8-fix-crypto-cflags.patch
+  * Rebuild configure with the bootstrap script (add libtool as
+    build dependency)
+
+-------------------------------------------------------------------
+Tue Jul 10 17:24:56 CEST 2012 - sbrabec@suse.cz
+
+- Updated to version 0.6.8:
+  * Code cleanup.
+  * Bug fixes.
+  * Translation updates.
+
+-------------------------------------------------------------------
+Tue Feb 28 19:54:16 CET 2012 - sbrabec@suse.cz
+
+- Change nssdb path to /etc/pki/nssdb (bnc#463469).
+- Make libdir paths in pam_pkcs11.conf biarch-wise.
+
+-------------------------------------------------------------------
+Wed Jan  5 18:40:44 CET 2011 - sbrabec@suse.cz
+
+- Updated to version 0.6.6:
+  * Compatible with pcsc-lite-1.6.
+  * New mapper API.
+  * Minor fixes.
+  * Translaton updates.
+
+-------------------------------------------------------------------
+Mon Feb  1 12:20:03 UTC 2010 - jengelh@medozas.de
+
+- package baselibs.conf
+
+-------------------------------------------------------------------
+Wed Aug  5 15:55:31 CEST 2009 - sbrabec@suse.cz
+
+- Updated to version 0.6.1:
+  * Added functions to API.
+  * Fixes from openSUSE packages upstreamed.
+  * Minor fixes.
+  * Translaton updates.
+
+-------------------------------------------------------------------
+Thu Jun 25 12:41:19 CEST 2009 - sbrabec@suse.cz
+
+- Supplement pam-32bit/pam-64bit in baselibs.conf (bnc#354164).
+
+-------------------------------------------------------------------
+Wed Oct 15 18:30:29 CEST 2008 - sbrabec@suse.cz
+
+- Fixed all implicit declarations.
+
+-------------------------------------------------------------------
+Tue Sep 23 17:49:42 CEST 2008 - sbrabec@suse.cz
+
+- Fixed uninitialized variable (bnc#351207).
+
+-------------------------------------------------------------------
+Thu Apr 10 12:54:45 CEST 2008 - ro@suse.de
+
+- added baselibs.conf file to build xxbit packages
+  for multilib support
+
+-------------------------------------------------------------------
+Thu Sep  6 21:08:43 CEST 2007 - jberkman@novell.com
+
+- use the same directory for nssdb as the kerberos pkinit plugin
+
+-------------------------------------------------------------------
+Tue Jul 31 17:34:21 CEST 2007 - sbrabec@suse.cz
+
+- Build with NSS instead of openssl.
+- Applied patches from Jacob Berkman: MS UPN OID and NSS
+  configuration.
+- Fixed implicit declaration.
+
+-------------------------------------------------------------------
+Thu Jul 26 14:32:24 CEST 2007 - sbrabec@suse.cz
+
+- Updated to version 0.6.0:
+  * compiler warning fixes
+  * I18N support
+  * new configuration options
+  * support for new environment variables
+  * new tool pkcs11_setup
+  * support for the NSS crypto libraries (off by default)
+  * for more changes see ChangeLog.svn
+
+-------------------------------------------------------------------
+Fri May 12 16:18:38 CEST 2006 - sbrabec@suse.cz
+
+- New SuSE package, version 0.5.3.
+

pam_pkcs11.spec

@@ -0,0 +1,184 @@
+#
+# spec file for package pam_pkcs11
+#
+# Copyright (c) 2023 SUSE LLC
+#
+# All modifications and additions to the file contributed by third parties
+# remain the property of their copyright owners, unless otherwise agreed
+# upon. The license for this file, and modifications and additions to the
+# file, is the same license as for the pristine package itself (unless the
+# license for the pristine package is not an Open Source License, in which
+# case the license is the MIT License). An "Open Source License" is a
+# license that conforms to the Open Source Definition (Version 1.9)
+# published by the Open Source Initiative.
+
+# Please submit bugfixes or comments via https://bugs.opensuse.org/
+#
+
+
+# It seems to be an upstream naming bug:
+%define _name pam_pkcs11-pam_pkcs11
+Name:           pam_pkcs11
+Version:        0.6.12
+Release:        0
+Summary:        PKCS #11 PAM Module
+License:        LGPL-2.1-or-later
+Group:          Productivity/Security
+URL:            https://github.com/OpenSC/pam_pkcs11
+Source:         https://github.com/OpenSC/pam_pkcs11/archive/%{name}-%{version}.tar.gz
+Source1:        pam_pkcs11-common-auth-smartcard.pam
+Source2:        baselibs.conf
+# make dist was not called.
+Source3:        pam_pkcs11-0.6.10-ChangeLog.git
+Source4:        pkcs11_eventmgr.service
+Patch0:         %{name}-fsf-address.patch
+Patch1:         %{name}-0.5.3-nss-conf.patch
+Patch3:         %{name}-0.6.0-nss-autoconf.patch
+BuildRequires:  curl-devel
+BuildRequires:  docbook-xsl-stylesheets
+BuildRequires:  doxygen
+BuildRequires:  fdupes
+BuildRequires:  flex
+BuildRequires:  libtool
+BuildRequires:  libxslt
+BuildRequires:  mozilla-nss-devel
+BuildRequires:  openldap2-devel
+BuildRequires:  openssl-devel
+BuildRequires:  pam-devel
+BuildRequires:  pcsc-lite-devel
+BuildRequires:  pkgconfig
+%{?systemd_requires}
+%if 0%{?suse_version} >= 1210
+BuildRequires:  systemd-rpm-macros
+%endif
+
+%description
+This Linux PAM module allows X.509 a certificate-based user
+authentication. The certificate and its dedicated private key are
+thereby accessed by means of an appropriate PKCS #11 module. For the
+verification of the users' certificates, locally stored CA certificates
+as well as online or locally accessible CRLs are used.
+
+Additionally, the package includes pam_pkcs11-related tools:
+
+* pkcs11_eventmgr: Generates actions on card insert, removal, or
+  time-out events
+
+* pklogin_finder: Gets the login name that maps to a certificate
+
+* pkcs11_inspect: Inspects the contents of a certificate
+
+* make_hash_links: Creates hash link directories for storing CAs and
+CRLs
+
+%package devel-doc
+Summary:        PKCS #11 API PAM Documentation
+# File conflict. devel-doc split was done with 0.6.9 upgrade, after SLE 12 SP3, Leap 42.3.
+Group:          Documentation/HTML
+Conflicts:      pam_pkcs11 < 0.6.9
+
+%description devel-doc
+API documentation for pam_pkcs11
+
+This Linux PAM module allows X.509 a certificate-based user
+authentication.
+
+%prep
+%setup -q -n %{_name}-%{version}
+%patch0 -p1
+%patch1 -p1
+%patch3 -p1
+cp -a %{SOURCE1} common-auth-smartcard
+sed -i s:/lib/:/%{_lib}/:g etc/pam_pkcs11.conf.example.in etc/pkcs11_eventmgr.conf.example
+# make dist was not called and cannot be called on a non git snapshot.
+cp -a %{SOURCE3} ChangeLog.git
+sed -i "/git log/d" Makefile.am
+sed -i '/^HTML_TIMESTAMP/s/YES/NO/' doc/doxygen.conf.in
+
+%build
+./bootstrap
+%configure\
+	--docdir=%{_docdir}/%{name}\
+	--with-nss\
+	--with-curl
+%make_build
+# Generate documentation: This sounds like an upstream bug while making an upstream source tarball.
+%make_build dist
+
+%install
+%make_install
+%if 0%{?suse_version} <= 1500
+mkdir -p %{buildroot}%{_pam_moduledir}
+mv %{buildroot}%{_libdir}/security/* %{buildroot}%{_pam_moduledir}
+%endif
+rm %{buildroot}%{_pam_moduledir}/*.la %{buildroot}%{_libdir}/pam_pkcs11/*.la
+# Hardcoded defaults... no sysconfdir
+install -dm 755 %{buildroot}%{_sysconfdir}/pam_pkcs11/cacerts
+install -dm 755 %{buildroot}%{_sysconfdir}/pam_pkcs11/crls
+cd etc
+for conf in *.conf.example ; do
+    install -m 644 ${conf} %{buildroot}%{_sysconfdir}/pam_pkcs11/${conf%.example}
+done
+cd ..
+mkdir -p %{buildroot}%{_docdir}/%{name}
+cp -a AUTHORS COPYING ChangeLog ChangeLog.git NEWS README README.md TODO doc/pam_pkcs11.html doc/mappers_api.html doc/api doc/README.autologin doc/README.mappers %{buildroot}%{_docdir}/%{name}
+%if 0%{?suse_version} > 1500
+mkdir -p %{buildroot}%{_pam_vendordir}
+cp common-auth-smartcard %{buildroot}%{_pam_vendordir}
+%else
+mkdir -p %{buildroot}%{_sysconfdir}/pam.d
+cp common-auth-smartcard %{buildroot}%{_sysconfdir}/pam.d/
+%endif
+install -D -m 644 %{SOURCE4} %{buildroot}%{_unitdir}/pkcs11_eventmgr.service
+mkdir -p %{buildroot}%{_sbindir}
+ln -s service %{buildroot}%{_sbindir}/rcpkcs11_eventmgr
+%find_lang %{name}
+%fdupes -s %{buildroot}%{_docdir}/%{name}
+
+%pre
+%service_add_pre pkcs11_eventmgr.service
+%if 0%{?suse_version} > 1500
+# Prepare for migration to /usr/lib; save any old .rpmsave
+for i in pam.d/common-auth-smartcard ; do
+     test -f %{_sysconfdir}/${i}.rpmsave && mv -v %{_sysconfdir}/${i}.rpmsave %{_sysconfdir}/${i}.rpmsave.old ||:
+done
+
+%posttrans
+# Migration to /usr/lib, restore just created .rpmsave
+for i in pam.d/common-auth-smartcard ; do
+     test -f %{_sysconfdir}/${i}.rpmsave && mv -v %{_sysconfdir}/${i}.rpmsave %{_sysconfdir}/${i} ||:
+done
+%endif
+
+%post
+%service_add_post pkcs11_eventmgr.service
+
+%preun
+%service_del_preun pkcs11_eventmgr.service
+
+%postun
+%service_del_postun pkcs11_eventmgr.service
+
+%files -f %{name}.lang
+%doc %{_docdir}/%{name}
+%exclude %{_docdir}/%{name}/api
+%{_bindir}/*
+%{_libdir}/pam_pkcs11
+/%{_pam_moduledir}/*.so
+%{_mandir}/man?/*%{ext_man}
+%dir %{_sysconfdir}/pam_pkcs11
+%dir %{_sysconfdir}/pam_pkcs11/cacerts
+%dir %{_sysconfdir}/pam_pkcs11/crls
+%config(noreplace) %{_sysconfdir}/pam_pkcs11/*.conf
+%if 0%{?suse_version} > 1500
+%{_pam_vendordir}/common-auth-smartcard
+%else
+%config(noreplace) %{_sysconfdir}/pam.d/common-auth-smartcard
+%endif
+%{_prefix}/lib/systemd/system/pkcs11_eventmgr.service
+%{_sbindir}/*
+
+%files devel-doc
+%doc %{_docdir}/%{name}/api
+
+%changelog

pkcs11_eventmgr.service

@@ -0,0 +1,22 @@
+[Unit]
+Description=pkcs11 event manager
+
+[Service]
+# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectSystem=full
+ProtectHome=read-only
+ProtectHostname=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictRealtime=true
+# end of automatic additions 
+Type=forking
+ExecStart=/usr/bin/pkcs11_eventmgr
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target