For full Linux-PAM compatibility, add a trailing NUL character whenpassing the authentication token to the external program.Approved by: re (kib)Submitted by: Thomas Munro <[email protected]>MFC aft
For full Linux-PAM compatibility, add a trailing NUL character whenpassing the authentication token to the external program.Approved by: re (kib)Submitted by: Thomas Munro <[email protected]>MFC after: 1 weekDifferential Revision: D16950
show more ...
Add support for Linux-PAM's badly named expose_authtok option.Submitted by: Thomas Munro <[email protected]>MFC after: 1 weekDifferential Revision: D16171
lib: further adoption of SPDX licensing ID tags.Mainly focus on files that use BSD 2-Clause license, however the tool Iwas using mis-identified many licenses so this was mostly a manual - errorpr
lib: further adoption of SPDX licensing ID tags.Mainly focus on files that use BSD 2-Clause license, however the tool Iwas using mis-identified many licenses so this was mostly a manual - errorprone - task.The Software Package Data Exchange (SPDX) group provides a specificationto make it easier for automated tools to detect and summarize well knownopensource licenses. We are gradually adopting the specification, notingthat the tags are considered only advisory and do not, in any way,superceed or replace the license texts.
DIRDEPS_BUILD: Update dependencies.Sponsored by: Dell EMC Isilon
Add options to capture stdout and / or stderr and pass the output onto the user. There is currently no buffering, so the result may besomewhat unpredictable if the conversation function adds a new
Add options to capture stdout and / or stderr and pass the output onto the user. There is currently no buffering, so the result may besomewhat unpredictable if the conversation function adds a newline,like openpam_ttyconv() does.Clean up and simplify the environment handling code, which triggeredan inexplicable bug on some systems.MFC after: 2 weeks
Revert r314780libpam: extra bounds checking through reallocarray(3).It appears to be causing brokenness when reporting PAM_* environmentvariables. This requires more investigation.Reported by:
Revert r314780libpam: extra bounds checking through reallocarray(3).It appears to be causing brokenness when reporting PAM_* environmentvariables. This requires more investigation.Reported by: lstewart
libpam: extra bounds checking through reallocarray(3).Reviewed by: desMFC after: 1 week
Revert r314777: wrong log, the change was to libpam.
libfetch: extra bounds checking through reallocarray(3).Reviewed by: desMFC after: 1 week
Fix typo when deregistering the VLAN unconfig event handlerSubmitted by: Masao Uebayashi <[email protected]>MFC after: 3 days
Updated/new dependencies
Updated dependencies
Updated/new Makefile.depend
Sync FreeBSD's bmake branch with Juniper's internal bmake branch.Requested by: Simon Gerraty <[email protected]>
Fixes to man8 groff mandoc style, usage mistakes, or typos.PR: 168016Submitted by: Nobuyuki KoganemaruApproved by: gjbMFC after: 3 days
Fix error messages containing the executed command nameBefore, we took the first argument to pam_exec(8). With the addition ofoptions in front of the command, this could be wrong.Now, options ar
Fix error messages containing the executed command nameBefore, we took the first argument to pam_exec(8). With the addition ofoptions in front of the command, this could be wrong.Now, options are parsed before calling _pam_exec() and messages containthe proper command name.While here, fix a warning.Sponsored by: Yakaz (http://www.yakaz.com)
Use program exit status as pam_exec return code (optional)pam_exec(8) now accepts a new option "return_prog_exit_status". Whenset, the program exit status is used as the pam_exec return code. Ita
Use program exit status as pam_exec return code (optional)pam_exec(8) now accepts a new option "return_prog_exit_status". Whenset, the program exit status is used as the pam_exec return code. Itallows the program to tell why the step failed (eg. user unknown).However, if it exits with a code not allowed by the calling PAM servicemodule function (see $PAM_SM_FUNC below), a warning is logged andPAM_SERVICE_ERR is returned.The following changes are related to this new feature but they apply nomatter if the "return_prog_exit_status" option is set or not.The environment passed to the program is extended: o $PAM_SM_FUNC contains the name of the PAM service module function (eg. pam_sm_authenticate). o All valid PAM return codes' numerical values are available through variables named after the return code name. For instance, $PAM_SUCCESS, $PAM_USER_UNKNOWN or $PAM_PERM_DENIED.pam_exec return code better reflects what went on: o If the program exits with !0, the return code is now PAM_PERM_DENIED, not PAM_SYSTEM_ERR. o If the program fails because of a signal (WIFSIGNALED) or doesn't terminate normally (!WIFEXITED), the return code is now PAM_SERVICE_ERR, not PAM_SYSTEM_ERR. o If a syscall in pam_exec fails, the return code remains PAM_SYSTEM_ERR.waitpid(2) is called in a loop. If it returns because of EINTR, do itagain. Before, it would return PAM_SYSTEM_ERR without waiting for thechild to exit.Several log messages now include the PAM service module function name.The man page is updated accordingly.Reviewed by: gleb@, des@Sponsored by: Yakaz (http://www.yakaz.com)MFC after: 2 weeks
Build lib/ with WARNS=6 by default.Similar to libexec/, do the same with lib/. Make WARNS=6 the norm andlower it when needed.I'm setting WARNS?=0 for secure/. It seems secure/ includes theMakef
Build lib/ with WARNS=6 by default.Similar to libexec/, do the same with lib/. Make WARNS=6 the norm andlower it when needed.I'm setting WARNS?=0 for secure/. It seems secure/ includes theMakefile.inc provided by lib/. I'm not going to touch that directory.Most of the code there is contributed anyway.
Include <stdio.h> for asprintf().Submitted by: Pawel Worach
childerr needs to be volatile so gcc won't optimize it away.PR: bin/85830MFC after: 1 week
When (re)allocating space for an array of pointers to char, usesizeof(*list), not sizeof(**list). (i.e., sizeof(pointer) rather thansizeof(char)).It is possible that this buffer overflow is expl
When (re)allocating space for an array of pointers to char, usesizeof(*list), not sizeof(**list). (i.e., sizeof(pointer) rather thansizeof(char)).It is possible that this buffer overflow is exploitable, but it wasadded after RELENG_5 forked and hasn't been MFCed, so this will notreceive an advisory.Submitted by: Vitezslav NovyMFC after: 1 day
Assorted markup fixes.Approved by: re
12