From patchwork Tue Oct 25 19:26:05 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bryce Ferguson X-Patchwork-Id: 686670 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from whitealder.osuosl.org (smtp1.osuosl.org [140.211.166.138]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3t3NSW6x4wz9snm for ; Wed, 26 Oct 2016 06:26:51 +1100 (AEDT) Received: from localhost (localhost [127.0.0.1]) by whitealder.osuosl.org (Postfix) with ESMTP id 7550E9203D; Tue, 25 Oct 2016 19:26:50 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from whitealder.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PNdLAqTpZ2VU; Tue, 25 Oct 2016 19:26:42 +0000 (UTC) Received: from ash.osuosl.org (ash.osuosl.org [140.211.166.34]) by whitealder.osuosl.org (Postfix) with ESMTP id EC22791FE5; Tue, 25 Oct 2016 19:26:35 +0000 (UTC) X-Original-To: buildroot@lists.busybox.net Delivered-To: buildroot@osuosl.org Received: from hemlock.osuosl.org (smtp2.osuosl.org [140.211.166.133]) by ash.osuosl.org (Postfix) with ESMTP id 7E4051C1E97 for ; Tue, 25 Oct 2016 19:26:34 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by hemlock.osuosl.org (Postfix) with ESMTP id 6FA7894CF7 for ; Tue, 25 Oct 2016 19:26:34 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from hemlock.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XEP74cQyIAMQ for ; Tue, 25 Oct 2016 19:26:33 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from ch3vs02.rockwellcollins.com (ch3vs02.rockwellcollins.com [205.175.226.29]) by hemlock.osuosl.org (Postfix) with ESMTPS id 909E08AD5F for ; Tue, 25 Oct 2016 19:26:33 +0000 (UTC) Received: from ofwch3n02.rockwellcollins.com (HELO dtulimr01.rockwellcollins.com) ([205.175.226.14]) by ch3vs02.rockwellcollins.com with ESMTP; 25 Oct 2016 14:26:34 -0500 X-Received: from largo.rockwellcollins.com (unknown [192.168.140.76]) by dtulimr01.rockwellcollins.com (Postfix) with ESMTP id 84148601D8; Tue, 25 Oct 2016 14:26:32 -0500 (CDT) From: Bryce Ferguson To: buildroot@buildroot.org Date: Tue, 25 Oct 2016 14:26:05 -0500 Message-Id: <1477423570-15694-3-git-send-email-bryce.ferguson@rockwellcollins.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1477423570-15694-1-git-send-email-bryce.ferguson@rockwellcollins.com> References: <1477423570-15694-1-git-send-email-bryce.ferguson@rockwellcollins.com> Cc: Niranjan Subject: [Buildroot] [PATCH v13 3/8] linux-pam: add system auth file and host variant X-BeenThere: buildroot@busybox.net X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Discussion and development of buildroot List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: buildroot-bounces@busybox.net Sender: "buildroot" From: Niranjan This patch creates system-auth.pamd file for pam services and adds host-linux-pam variant for creating pam.d files. Signed-off-by: Matthew Weber Reviewed-by: Samuel Martin Signed-off-by: Niranjan Reddy --- Changes v12 -> v13: - No changes Changes v11 -> v12: - No changes Changes v10 -> v11: - Added host-linux-pam variant as it is the dependency for creating pam_conv1 files. - Removed semicolon at the end of if condition (after fi). - Merged system auth patch with host selinux dependencies patch Changes v9 -> v10: - Dropped host linux-pam variant,optional selinux and audit dependencies and created seperate Patches (Suggedted by Thomas). Changes v8 -> v9: - No changes Changes v7 -> v8: - Removed sub-shell around the config file install block and refactored the block to use absolute paths for the copying (Suggested by Samuel) - Changed the enable-db=no configure option to disable-db to be consistent with the rest of the configure options (Suggested by Samuel) Changes v6 -> v7: - Added missing host-pkgconf dependency and removed unneeded host-autoconf dependency(Clayton S.) Changes v5 -> v6: - No changes Changes v4 -> v5: - Dropping unneeded patch (Clayton S.) Changes v1 -> v4: - Did not exist --- package/linux-pam/linux-pam.mk | 41 +++++++++++++++++++++++++++++++++++++- package/linux-pam/system-auth.pamd | 15 ++++++++++++++ 2 files changed, 55 insertions(+), 1 deletion(-) create mode 100644 package/linux-pam/system-auth.pamd diff --git a/package/linux-pam/linux-pam.mk b/package/linux-pam/linux-pam.mk index 6ce3839..57c2be2 100644 --- a/package/linux-pam/linux-pam.mk +++ b/package/linux-pam/linux-pam.mk @@ -8,15 +8,18 @@ LINUX_PAM_VERSION = 1.3.0 LINUX_PAM_SOURCE = Linux-PAM-$(LINUX_PAM_VERSION).tar.bz2 LINUX_PAM_SITE = http://linux-pam.org/library LINUX_PAM_INSTALL_STAGING = YES +# disable cracklib in linux pam config options LINUX_PAM_CONF_OPTS = \ --disable-prelude \ --disable-isadir \ --disable-nis \ --disable-db \ + --disable-cracklib \ --disable-regenerate-docu \ --enable-securedir=/lib/security \ --libdir=/lib -LINUX_PAM_DEPENDENCIES = flex host-flex host-pkgconf +# host-linux-pam is needed for creating pam conf files +LINUX_PAM_DEPENDENCIES = flex host-flex host-pkgconf host-linux-pam LINUX_PAM_AUTORECONF = YES LINUX_PAM_LICENSE = BSD-3c LINUX_PAM_LICENSE_FILES = Copyright @@ -48,6 +51,42 @@ define LINUX_PAM_INSTALL_CONFIG $(TARGET_DIR)/etc/pam.d/other endef +# Use the host-pam pam_conv1 app to create the pam.d files +define LINUX_PAM_CONFIG_FILE_TARGET_INSTALL + if [ -d $(TARGET_DIR)/etc/pam.d/ ]; then \ + mv $(TARGET_DIR)/etc/pam.d/ $(TARGET_DIR)/etc/pam.d.orig/; \ + fi + cd $(TARGET_DIR)/etc/ && cat $(@D)/conf/pam.conf | $(HOST_DIR)/usr/bin/pam_conv1; \ + if [ -d $(TARGET_DIR)/etc/pam.d.orig ]; then \ + cp -a $(TARGET_DIR)/etc/pam.d/* $(TARGET_DIR)/etc/pam.d.orig/; \ + rm -rf $(TARGET_DIR)/etc/pam.d/; \ + mv $(TARGET_DIR)/etc/pam.d.orig/ $(TARGET_DIR)/etc/pam.d/; \ + fi + $(INSTALL) -D -m 0644 package/linux-pam/system-auth.pamd $(TARGET_DIR)/etc/pam.d/system-auth +endef + +LINUX_PAM_POST_INSTALL_TARGET_HOOKS += LINUX_PAM_CONFIG_FILE_TARGET_INSTALL LINUX_PAM_POST_INSTALL_TARGET_HOOKS += LINUX_PAM_INSTALL_CONFIG +HOST_LINUX_PAM_DEPENDENCIES = host-flex host-pkgconf + +HOST_LINUX_PAM_CONF_OPTS = \ + --disable-rpath \ + --enable-read-both-confs \ + --disable-regenerate-docu \ + --disable-isadir \ + --disable-nis \ + --enable-securedir=/lib/security \ + --disable-prelude \ + --disable-cracklib \ + --disable-lckpwdf \ + --disable-db \ + --disable-selinux \ + --disable-audit \ + +define HOST_LINUX_PAM_INSTALL_CMDS + $(INSTALL) -D -m 755 $(@D)/conf/pam_conv1/pam_conv1 $(HOST_DIR)/usr/bin/pam_conv1 +endef + $(eval $(autotools-package)) +$(eval $(host-autotools-package)) diff --git a/package/linux-pam/system-auth.pamd b/package/linux-pam/system-auth.pamd new file mode 100644 index 0000000..2fa116a --- /dev/null +++ b/package/linux-pam/system-auth.pamd @@ -0,0 +1,15 @@ +#%PAM-1.0 +auth required pam_env.so +auth sufficient pam_unix.so +auth required pam_deny.so + +account required pam_unix.so + +#password required pam_cracklib.so try_first_pass retry=3 +password sufficient pam_unix.so md5 shadow try_first_pass +password required pam_deny.so + +session optional pam_keyinit.so revoke +session required pam_limits.so +session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid +session required pam_unix.so