pool/ecryptfs-utils
SHA256
4
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

OBS-URL: https://build.opensuse.org/package/show/security/ecryptfs-utils?expand=0&rev=38

Browse Source
This commit is contained in:
Marcus Meissner 2012-07-04 12:24:54 +00:00 committed by Git OBS Bridge
parent 0e1c9c2457
commit ccabc45bf7
1 changed files with 23 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
ecryptfs-utils.security.patch
View File

@ -2,7 +2,13 @@ Index: ecryptfs-utils-96/src/pam_ecryptfs/pam_ecryptfs.c
=================================================================== ===================================================================
--- ecryptfs-utils-96.orig/src/pam_ecryptfs/pam_ecryptfs.c --- ecryptfs-utils-96.orig/src/pam_ecryptfs/pam_ecryptfs.c
+++ ecryptfs-utils-96/src/pam_ecryptfs/pam_ecryptfs.c +++ ecryptfs-utils-96/src/pam_ecryptfs/pam_ecryptfs.c
@@ -37,8 +37,11 @@ @@ -32,13 +32,17 @@
#include <unistd.h>
#include <errno.h>
#include <syslog.h>
+#include <limits.h>
#include <pwd.h>
#include <sys/types.h>
#include <sys/wait.h> #include <sys/wait.h>
#include <sys/types.h> #include <sys/types.h>
#include <sys/stat.h> #include <sys/stat.h>
@ -14,20 +20,20 @@ Index: ecryptfs-utils-96/src/pam_ecryptfs/pam_ecryptfs.c
#include "../include/ecryptfs.h" #include "../include/ecryptfs.h"
#define PRIVATE_DIR "Private" #define PRIVATE_DIR "Private"
@@ -119,9 +122,10 @@ static int wrap_passphrase_if_necessary( @@ -119,9 +123,10 @@ static int wrap_passphrase_if_necessary(
PAM_EXTERN int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, PAM_EXTERN int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc,
const char **argv) const char **argv)
{ {
- uid_t uid = 0; - uid_t uid = 0;
+ uid_t uid = 0, oeuid = 0; + uid_t uid = 0, oeuid = 0;
+ gid_t gid = 0, oegid = 0, groups[64]; + gid_t gid = 0, oegid = 0, groups[NGROUPS_MAX];
+ int ngids = 0; + int ngids = 0;
char *homedir = NULL; char *homedir = NULL;
- uid_t saved_uid = 0; - uid_t saved_uid = 0;
const char *username; const char *username;
char *passphrase = NULL; char *passphrase = NULL;
char salt[ECRYPTFS_SALT_SIZE]; char salt[ECRYPTFS_SALT_SIZE];
@@ -139,12 +143,25 @@ PAM_EXTERN int pam_sm_authenticate(pam_h @@ -139,12 +144,25 @@ PAM_EXTERN int pam_sm_authenticate(pam_h
pwd = getpwnam(username); pwd = getpwnam(username);
if (pwd) { if (pwd) {
uid = pwd->pw_uid; uid = pwd->pw_uid;
@ -53,7 +59,7 @@ Index: ecryptfs-utils-96/src/pam_ecryptfs/pam_ecryptfs.c
if (!file_exists_dotecryptfs(homedir, "auto-mount")) if (!file_exists_dotecryptfs(homedir, "auto-mount"))
goto out; goto out;
private_mnt = ecryptfs_fetch_private_mnt(homedir); private_mnt = ecryptfs_fetch_private_mnt(homedir);
@@ -158,13 +175,10 @@ PAM_EXTERN int pam_sm_authenticate(pam_h @@ -158,13 +176,10 @@ PAM_EXTERN int pam_sm_authenticate(pam_h
load ecryptfs module if not loaded already */ load ecryptfs module if not loaded already */
if (ecryptfs_get_version(&version) != 0) if (ecryptfs_get_version(&version) != 0)
syslog(LOG_WARNING, "pam_ecryptfs: Can't check if kernel supports ecryptfs\n"); syslog(LOG_WARNING, "pam_ecryptfs: Can't check if kernel supports ecryptfs\n");
@ -67,7 +73,7 @@ Index: ecryptfs-utils-96/src/pam_ecryptfs/pam_ecryptfs.c
if (rc != PAM_SUCCESS) { if (rc != PAM_SUCCESS) {
syslog(LOG_ERR, "pam_ecryptfs: Error retrieving passphrase; rc = [%ld]\n", syslog(LOG_ERR, "pam_ecryptfs: Error retrieving passphrase; rc = [%ld]\n",
rc); rc);
@@ -182,7 +196,12 @@ PAM_EXTERN int pam_sm_authenticate(pam_h @@ -182,7 +197,12 @@ PAM_EXTERN int pam_sm_authenticate(pam_h
} else } else
from_hex(salt, salt_hex, ECRYPTFS_SALT_SIZE); from_hex(salt, salt_hex, ECRYPTFS_SALT_SIZE);
if ((child_pid = fork()) == 0) { if ((child_pid = fork()) == 0) {
@ -81,7 +87,7 @@ Index: ecryptfs-utils-96/src/pam_ecryptfs/pam_ecryptfs.c
if (passphrase == NULL) { if (passphrase == NULL) {
syslog(LOG_ERR, "pam_ecryptfs: NULL passphrase; aborting\n"); syslog(LOG_ERR, "pam_ecryptfs: NULL passphrase; aborting\n");
rc = -EINVAL; rc = -EINVAL;
@@ -240,6 +259,12 @@ out_child: @@ -240,6 +260,12 @@ out_child:
if (tmp_pid == -1) if (tmp_pid == -1)
syslog(LOG_WARNING, "pam_ecryptfs: waitpid() returned with error condition\n"); syslog(LOG_WARNING, "pam_ecryptfs: waitpid() returned with error condition\n");
out: out:
@ -94,7 +100,7 @@ Index: ecryptfs-utils-96/src/pam_ecryptfs/pam_ecryptfs.c
if (private_mnt != NULL) if (private_mnt != NULL)
free(private_mnt); free(private_mnt);
return PAM_SUCCESS; return PAM_SUCCESS;
@@ -338,8 +363,12 @@ static int private_dir(pam_handle_t *pam @@ -338,8 +364,12 @@ static int private_dir(pam_handle_t *pam
syslog(LOG_DEBUG, "pam_ecryptfs: Skipping automatic eCryptfs mount"); syslog(LOG_DEBUG, "pam_ecryptfs: Skipping automatic eCryptfs mount");
return 0; return 0;
} }
@ -108,7 +114,7 @@ Index: ecryptfs-utils-96/src/pam_ecryptfs/pam_ecryptfs.c
execl("/sbin/mount.ecryptfs_private", execl("/sbin/mount.ecryptfs_private",
"mount.ecryptfs_private", NULL); "mount.ecryptfs_private", NULL);
} else { } else {
@@ -348,8 +377,12 @@ static int private_dir(pam_handle_t *pam @@ -348,8 +378,12 @@ static int private_dir(pam_handle_t *pam
syslog(LOG_DEBUG, "pam_ecryptfs: Skipping automatic eCryptfs unmount"); syslog(LOG_DEBUG, "pam_ecryptfs: Skipping automatic eCryptfs unmount");
return 0; return 0;
} }
@ -122,20 +128,20 @@ Index: ecryptfs-utils-96/src/pam_ecryptfs/pam_ecryptfs.c
execl("/sbin/umount.ecryptfs_private", execl("/sbin/umount.ecryptfs_private",
"umount.ecryptfs_private", NULL); "umount.ecryptfs_private", NULL);
} }
@@ -391,9 +424,10 @@ pam_sm_close_session(pam_handle_t *pamh, @@ -391,9 +425,10 @@ pam_sm_close_session(pam_handle_t *pamh,
PAM_EXTERN int pam_sm_chauthtok(pam_handle_t * pamh, int flags, PAM_EXTERN int pam_sm_chauthtok(pam_handle_t * pamh, int flags,
int argc, const char **argv) int argc, const char **argv)
{ {
- uid_t uid = 0; - uid_t uid = 0;
+ uid_t uid = 0, oeuid = 0; + uid_t uid = 0, oeuid = 0;
+ gid_t gid = 0, oegid = 0, groups[64]; + gid_t gid = 0, oegid = 0, groups[NGROUPS_MAX];
+ int ngids = 0; + int ngids = 0;
char *homedir = NULL; char *homedir = NULL;
- uid_t saved_uid = 0; - uid_t saved_uid = 0;
const char *username; const char *username;
char *old_passphrase = NULL; char *old_passphrase = NULL;
char *new_passphrase = NULL; char *new_passphrase = NULL;
@@ -411,6 +445,7 @@ PAM_EXTERN int pam_sm_chauthtok(pam_hand @@ -411,6 +446,7 @@ PAM_EXTERN int pam_sm_chauthtok(pam_hand
pwd = getpwnam(username); pwd = getpwnam(username);
if (pwd) { if (pwd) {
uid = pwd->pw_uid; uid = pwd->pw_uid;
@ -143,7 +149,7 @@ Index: ecryptfs-utils-96/src/pam_ecryptfs/pam_ecryptfs.c
homedir = pwd->pw_dir; homedir = pwd->pw_dir;
name = pwd->pw_name; name = pwd->pw_name;
} }
@@ -418,13 +453,22 @@ PAM_EXTERN int pam_sm_chauthtok(pam_hand @@ -418,13 +454,22 @@ PAM_EXTERN int pam_sm_chauthtok(pam_hand
syslog(LOG_ERR, "pam_ecryptfs: Error getting passwd info for user [%s]; rc = [%ld]\n", username, rc); syslog(LOG_ERR, "pam_ecryptfs: Error getting passwd info for user [%s]; rc = [%ld]\n", username, rc);
goto out; goto out;
} }
@ -169,7 +175,7 @@ Index: ecryptfs-utils-96/src/pam_ecryptfs/pam_ecryptfs.c
goto out; goto out;
} }
/* On the first pass, do nothing except check that we have a password */ /* On the first pass, do nothing except check that we have a password */
@@ -434,14 +478,12 @@ PAM_EXTERN int pam_sm_chauthtok(pam_hand @@ -434,14 +479,12 @@ PAM_EXTERN int pam_sm_chauthtok(pam_hand
syslog(LOG_WARNING, "pam_ecryptfs: PAM passphrase change module retrieved a NULL passphrase; nothing to do\n"); syslog(LOG_WARNING, "pam_ecryptfs: PAM passphrase change module retrieved a NULL passphrase; nothing to do\n");
rc = PAM_AUTHTOK_RECOVER_ERR; rc = PAM_AUTHTOK_RECOVER_ERR;
} }
@ -184,7 +190,7 @@ Index: ecryptfs-utils-96/src/pam_ecryptfs/pam_ecryptfs.c
goto out; goto out;
} }
if ((rc = asprintf(&wrapped_pw_filename, "%s/.ecryptfs/%s", homedir, if ((rc = asprintf(&wrapped_pw_filename, "%s/.ecryptfs/%s", homedir,
@@ -462,7 +504,6 @@ PAM_EXTERN int pam_sm_chauthtok(pam_hand @@ -462,7 +505,6 @@ PAM_EXTERN int pam_sm_chauthtok(pam_hand
goto out; goto out;
} }
@ -192,7 +198,7 @@ Index: ecryptfs-utils-96/src/pam_ecryptfs/pam_ecryptfs.c
if (!old_passphrase || !new_passphrase || *new_passphrase == '\0') { if (!old_passphrase || !new_passphrase || *new_passphrase == '\0') {
syslog(LOG_WARNING, "pam_ecryptfs: PAM passphrase change module retrieved at least one NULL passphrase; nothing to do\n"); syslog(LOG_WARNING, "pam_ecryptfs: PAM passphrase change module retrieved at least one NULL passphrase; nothing to do\n");
rc = PAM_AUTHTOK_RECOVER_ERR; rc = PAM_AUTHTOK_RECOVER_ERR;
@@ -472,7 +513,12 @@ PAM_EXTERN int pam_sm_chauthtok(pam_hand @@ -472,7 +514,12 @@ PAM_EXTERN int pam_sm_chauthtok(pam_hand
if ((child_pid = fork()) == 0) { if ((child_pid = fork()) == 0) {
char passphrase[ECRYPTFS_MAX_PASSWORD_LENGTH + 1]; char passphrase[ECRYPTFS_MAX_PASSWORD_LENGTH + 1];
@ -206,7 +212,7 @@ Index: ecryptfs-utils-96/src/pam_ecryptfs/pam_ecryptfs.c
if ((rc = ecryptfs_unwrap_passphrase(passphrase, if ((rc = ecryptfs_unwrap_passphrase(passphrase,
wrapped_pw_filename, wrapped_pw_filename,
old_passphrase, salt))) { old_passphrase, salt))) {
@@ -492,5 +538,11 @@ out_child: @@ -492,5 +539,11 @@ out_child:
syslog(LOG_WARNING, "pam_ecryptfs: waitpid() returned with error condition\n"); syslog(LOG_WARNING, "pam_ecryptfs: waitpid() returned with error condition\n");
free(wrapped_pw_filename); free(wrapped_pw_filename);
out: out: