2d17d3abc8
- Update to version 1.7.2: * build: enabled vendordir by default. * pam_access: fixed stack overflow with huge configuration files. * pam_env: enhanced error diagnostics when ignoring backslash at end of string. * pam_faillock: skip clearing user's failed attempt when auth stack is not run. * pam_mkhomedir: added support for vendordir skeleton directory. * pam_unix: added support for pwaccessd. * pam_unix: added support for PAM_CHANGE_EXPIRED_AUTHTOK. * pam_unix: fixed password expiration warnings for large day values. * pam_unix: hardened temporary file handling. * Multiple minor bug fixes, build fixes, portability fixes, documentation improvements, and translation updates.
Thorsten Kukuk2026-01-22 14:51:46 +00:00
4907fdf28e
Accepting request 1322909 from Linux-PAM
Ana Guerrero2025-12-16 14:49:26 +00:00
96cfeee265
Accepting request 1304812 from Linux-PAM
Ana Guerrero2025-09-16 16:18:03 +00:00
9545def852
pam_mkhomedir: building with vendordir option allows fetching skeleton directory from the vendor directory when creating the user home directory.
Valentin Lefebvre2025-09-15 12:00:47 +00:00
0450972480
Accepting request 1301584 from Linux-PAM
Ana Guerrero2025-08-28 15:18:24 +00:00
ed6a7a6b67
- Update to 1.7.1+git (post-v1.7.1.patch) - disable unix_chkpwd by default, only used as fallback again - pam_modutil_get-overwrite-password-at-free.patch is included
Thorsten Kukuk2025-08-27 14:27:29 +00:00
7a880fc877
Accepting request 1300552 from Linux-PAM
Ana Guerrero2025-08-21 14:57:31 +00:00
d181fd6fc7
- Update to version 1.7.1 - pam_access: do not resolve ttys or display variables as hostnames. - pam_access: added "nodns" option to disallow resolving of tokens as hostnames (CVE-2024-10963). - pam_limits: added support for rttime (RLIMIT_RTTIME). - pam_namespace: fixed potential privilege escalation (CVE-2025-6020). - meson: added support of elogind as a logind provider. - Multiple minor bug fixes, build fixes, portability fixes, documentation improvements, and translation updates. - pam_access-rework-resolving-of-tokens-as-hostname.patch got obsoleted
Thorsten Kukuk2025-06-18 05:59:17 +00:00
8b74d4167f
Accepting request 1255709 from Linux-PAM
Ana Guerrero2025-03-31 09:36:53 +00:00
035f728da8
Accepting request 1228723 from Linux-PAM
Ana Guerrero2024-12-08 10:36:05 +00:00
a01288951c
- pam_access: rework resolving of tokens as hostname - separate resolving of IP addresses from hostnames. Don't resolve TTYs or display variables as hostname. - Add "nodns" option to disallow resolving of tokens as hostname. - [pam_access-rework-resolving-of-tokens-as-hostname.patch, bsc#1233078, CVE-2024-10963]
Thorsten Kukuk2024-12-06 09:32:46 +00:00
95ff3dbfc4
Accepting request 1218188 from Linux-PAM
Ana Guerrero2024-10-27 10:24:03 +00:00
8f4235636c
- Update to version 1.7.0 - build: changed build system from autotools to meson. - libpam_misc: use ECHOCTL in the terminal input - pam_access: support UID and GID in access.conf - pam_env: install environment file in vendordir if vendordir is enabled - pam_issue: only count class user if logind support is enabled - pam_limits: use systemd-logind instead of utmp if logind support is enabled - pam_unix: compare password hashes in constant time - Multiple minor bug fixes, build fixes, portability fixes, documentation improvements, and translation updates. - Drop upstream patches: - pam-bsc1194818-cursor-escape.patch - pam_limits-systemd.patch - pam_issue-systemd.patch
Thorsten Kukuk2024-10-24 12:22:19 +00:00
57200379e7
Accepting request 1200265 from Linux-PAM
Ana Guerrero2024-09-18 13:26:01 +00:00
af312c25cf
- pam_limits-systemd.patch: update to final PR
Thorsten Kukuk2024-09-10 08:22:27 +00:00
0f70ad3ce6
- Add systemd-logind support to pam_limits (pam_limits-systemd.patch) - Remove /usr/etc/pam.d, everything should be migrated - Remove pam_limits from default common-sessions* files. pam_limits is now part of pam-extra and not in our default generated config. - pam_issue-systemd.patch: only count class user sessions
Thorsten Kukuk2024-09-09 08:32:13 +00:00
182f702c59
- disable-pam_env-test.patch: disable tst-pam_env-retval.c as it is broken
Thorsten Kukuk2024-01-18 16:09:06 +00:00
e352b2c661
- Update to version 1.6.0 - Added support of configuration files with arbitrarily long lines. - build: fixed build outside of the source tree. - libpam: added use of getrandom(2) as a source of randomness if available. - libpam: fixed calculation of fail delay with very long delays. - libpam: fixed potential infinite recursion with includes. - libpam: implemented string to number conversions validation when parsing controls in configuration. - pam_access: added quiet_log option. - pam_access: fixed truncation of very long group names. - pam_canonicalize_user: new module to canonicalize user name. - pam_echo: fixed file handling to prevent overflows and short reads. - pam_env: added support of '\' character in environment variable values. - pam_exec: allowed expose_authtok for password PAM_TYPE. - pam_exec: fixed stack overflow with binary output of programs. - pam_faildelay: implemented parameter ranges validation. - pam_listfile: changed to treat \r and \n exactly the same in configuration. - pam_mkhomedir: hardened directory creation against timing attacks. - Please note that using *at functions leads to more open file handles during creation. - pam_namespace: fixed potential local DoS (CVE-2024-22365). - pam_nologin: fixed file handling to prevent short reads. - pam_pwhistory: helper binary is now built only if SELinux support is enabled. - pam_pwhistory: implemented reliable usernames handling when remembering passwords. - pam_shells: changed to allow shell entries with absolute paths only. - pam_succeed_if: fixed treating empty strings as numerical value 0. - pam_unix: added support of disabled password aging. - pam_unix: synchronized password aging with shadow.
Thorsten Kukuk2024-01-18 09:18:10 +00:00
6ea3349808
Accepting request 1108086 from Linux-PAM
Ana Guerrero2023-09-01 12:19:14 +00:00
add873f61e
Accepting request 1105450 from home:kukuk:no-utmp
Thorsten Kukuk2023-08-23 09:38:24 +00:00
8fc5e81cde
- pam_access backports from upstream: - pam_access-doc-IPv6-link-local.patch: Document only partial supported IPv6 link local addresses - pam_access-hostname-debug.patch: Don't print error if we cannot resolve a hostname, does not need to be a hostname - pam_shells-fix-econf-memory-leak.patch: Free econf keys variable - disable-examples.patch: Don't build examples
Thorsten Kukuk2023-08-07 10:24:04 +00:00
Ana Guerrero
Thorsten Kukuk
val4oss
Valentin Lefebvre
Dominique Leuenberger
Josef Möllers