Skip to contentSkip to conversation

If linux-pam is built, enable dbm functionality in Berkeley DB

PATCH New Dmitry 3 participants 13 messages Sep 8, 2012 – Sep 12, 2012

lore
Share & tools
lore

Dmitry

author
#0 lore raw

PATCH 1/4 If linux-pam is built, enable dbm functionality in Berkeley DB

The linux-pam library has the pam_userdb module which uses a dbm-compatible database to authenticate users. Berkeley DB provides such functionality, so it has to be condidionally enabled if linux-pam is used.

Signed-off-by Dmitry <[email protected]>
---
 package/berkeleydb/berkeleydb.mk |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)
package/berkeleydb/berkeleydb.mk +1 -0
index 3037da6..3ca334f 100644
@@ -30,6 +30,7 @@ define BERKELEYDB_CONFIGURE_CMDS
 		$(if $(BR2_INSTALL_LIBSTDCPP),--enable-cxx,--disable-cxx) \
 		--disable-java \
 		--disable-tcl \
+		$(if $(BR2_PACKAGE_LINUX_PAM),--enable-dbm,--disable-dbm) \
 		--disable-compat185 \
 		$(SHARED_STATIC_LIBS_OPTS) \
 		--with-pic \
Signature · 1 line
1.7.2.5
author
#1 lore raw

PATCH 2/4 Make Berkeley DB a dependency of linux-pam and make sure it is selected

The pam_userdb module is used to verify a username/password pair against values stored in a Berkeley DB database. The database is indexed by the username, and the data fields corresponding to the username keys are the passwords (from man 8 pam_userdb).

Signed-off-by Dmitry <[email protected]>
---
 package/linux-pam/Config.in    |    1 +
 package/linux-pam/linux-pam.mk |    2 +-
 2 files changed, 2 insertions(+), 1 deletions(-)
package/linux-pam/Config.in +1 -0
index 722b875..65e7b69 100644
@@ -4,6 +4,7 @@ config BR2_PACKAGE_LINUX_PAM
 	select BR2_PACKAGE_GETTEXT if BR2_NEEDS_GETTEXT_IF_LOCALE
 	select BR2_PACKAGE_FLEX
 	select BR2_PACKAGE_FLEX_LIBFL
+	select BR2_PACKAGE_BERKELEYDB
 	depends on (BR2_ENABLE_LOCALE && BR2_USE_WCHAR)
 	help
 	  A Security Framework that Provides Authentication for Applications
package/linux-pam/linux-pam.mk +1 -1
index 48cb073..5e0ecf0 100644
@@ -15,7 +15,7 @@ LINUX_PAM_CONF_OPT = \
 	--disable-regenerate-docu \
 	--enable-securedir=/lib/security \
 	--libdir=/lib
-LINUX_PAM_DEPENDENCIES = $(if $(BR2_NEEDS_GETTEXT_IF_LOCALE),gettext libintl) flex
+LINUX_PAM_DEPENDENCIES = $(if $(BR2_NEEDS_GETTEXT_IF_LOCALE),gettext libintl) flex berkeleydb
 LINUX_PAM_AUTORECONF = YES
 LINUX_PAM_LICENSE = BSD-3c
 LINUX_PAM_LICENSE_FILES = Copyright
Signature · 1 line
1.7.2.5
#2 lore raw

PATCH 2/4 Make Berkeley DB a dependency of linux-pam and make sure it is selected

Le Sat, 8 Sep 2012 00:21:04 -0400,
Dmitry <[email protected]> a ?crit :

package/linux-pam/linux-pam.mk LINUX_PAM_CONF_OPT = \ · line 18

Quoted 2 lines
package/linux-pam/linux-pam.mk +1 -1
-LINUX_PAM_DEPENDENCIES = $(if $(BR2_NEEDS_GETTEXT_IF_LOCALE),gettext libintl) flex
+LINUX_PAM_DEPENDENCIES = $(if $(BR2_NEEDS_GETTEXT_IF_LOCALE),gettext libintl) flex berkeleydb

Looking at the code, the dependency indeed looks necessary. But isn't it possible to rework a bit linux-pam to make this dependency optional (and then submit this upstream)? Of course, if you don't care about making this dependency optional, then just keep it as it is.

Best regards,

Thomas

Signature · 4 lines
Thomas Petazzoni, Free Electrons
Kernel, drivers, real-time and embedded Linux
development, consulting, training and support.
http://free-electrons.com
author
#3 lore raw

PATCH 2/4 Make Berkeley DB a dependency of linux-pam and make sure it is selected

Thomas,

Quoted 10 lines · Thomas Petazzoni

Le Sat, 8 Sep 2012 00:21:04 -0400,
Dmitry <[email protected]> a ?crit :

package/linux-pam/linux-pam.mk LINUX_PAM_CONF_OPT = \ · line 18

Quoted 2 lines
package/linux-pam/linux-pam.mk +1 -1
-LINUX_PAM_DEPENDENCIES = $(if $(BR2_NEEDS_GETTEXT_IF_LOCALE),gettext libintl) flex
+LINUX_PAM_DEPENDENCIES = $(if $(BR2_NEEDS_GETTEXT_IF_LOCALE),gettext libintl) flex berkeleydb

Looking at the code, the dependency indeed looks necessary. But isn't it possible to rework a bit linux-pam to make this dependency optional (and then submit this upstream)? Of course, if you don't care about making this dependency optional, then just keep it as it is.

I don't think such change in linux-pam is really needed. I'd keep it here given the fix is trivial, and BerkeleyDB is not a huge library.

Thanks.

Signature · 3 lines
Dmitry Golubovsky

Anywhere on the Web
#4 lore raw

PATCH 2/4 Make Berkeley DB a dependency of linux-pam and make sure it is selected

Le Tue, 11 Sep 2012 10:44:03 -0400,
Dmitry Golubovsky <[email protected]> a ?crit :

Quoted 7 lines
Quoted 4 lines

Looking at the code, the dependency indeed looks necessary. But isn't it possible to rework a bit linux-pam to make this dependency optional (and then submit this upstream)? Of course, if you don't care about making this dependency optional, then just keep it as it is.

I don't think such change in linux-pam is really needed. I'd keep it here given the fix is trivial, and BerkeleyDB is not a huge library.

Ok, fine with me.

Thomas

Signature · 4 lines
Thomas Petazzoni, Free Electrons
Kernel, drivers, real-time and embedded Linux
development, consulting, training and support.
http://free-electrons.com
#5 lore raw

PATCH 2/4 Make Berkeley DB a dependency of linux-pam and make sure it is selected

In reply to Dmitry
Quoted 4 lines · Dmitry

The pam_userdb module is used to verify a username/password pair against values stored in a Berkeley DB database. The database is indexed by the username, and the data fields corresponding to the username keys are the passwords (from man 8 pam_userdb).

There is a patch on the list that introduces gdbm. Do you think that could
be an alternative for berkeleydb?

Regards,
Arnout

Signature · 6 lines
Arnout Vandecappelle                               arnout at mind be
Senior Embedded Software Architect                 +32-16-286540
Essensium/Mind                                     http://www.mind.be
G.Geenslaan 9, 3001 Leuven, Belgium                BE 872 984 063 RPR Leuven
LinkedIn profile: http://www.linkedin.com/in/arnoutvandecappelle
GPG fingerprint:  7CB5 E4CC 6C2E EFD4 6E3D A754 F963 ECAB 2450 2F1F
author
#6 lore raw

PATCH 2/4 Make Berkeley DB a dependency of linux-pam and make sure it is selected

Arnout,

Quoted 10 lines · Arnout Vandecappelle
Quoted 5 lines · Dmitry

The pam_userdb module is used to verify a username/password pair against values stored in a Berkeley DB database. The database is indexed by the username, and the data fields corresponding to the username keys are the passwords (from man 8 pam_userdb).

There is a patch on the list that introduces gdbm. Do you think that could
be an alternative for berkeleydb?

I'm not sure. We'll need a choice of configurations then, whether to use gdbm or berkeleyDB for linux-pam. What if both are selected in menuconfig?

BerkeleyDB is much more advanced than GDBM, IMHO. One might prefer GDBM over Berkeley DB because of license perhaps, but otherwise why?

If we want to implement it further, here's the possible logic:

PAM's configure.in shows that there may be variants in --enable-db options. which means the logic would be:

1. See if Berkeley or GDBM is selected. If none, disable pam_userdb in PAM --enable-db=no
2. If Berkeley is selected, enable dbm in it and specify proper option in --enable-db=ndbm (I guess)
3. If GDBM is selected, specify proper option in --enable-db=db (again I guess, maybe other way around)
4. If both are selected? there is an option --enable-db=yes which lets PAM decide by itself, then dbm should be enabled in BerkeleyDB anyway (it seems like configure only looks at headers*)

Does anybody disagree with such logic?

Plus, the database selected for PAM should become a PAM dependency. Which we cannot tell unless we have a configure choice for the database in PAM, but this turns the above logic upside down: PAM now drives the database selection.

Or we can make both databases, if selected, dependencies of PAM - at worst this only affects the building order.

And what is the status of the GDBM patch?

Thanks.

------------------------
* as in the failed autobuilder case, PAM's configure decided to build pam_userdb if BerkeleyDB was selected (headers were present) even though dbm was not enabled in it - linkage test was not done.

Signature · 3 lines
Dmitry Golubovsky

Anywhere on the Web
#7 lore raw

PATCH 2/4 Make Berkeley DB a dependency of linux-pam and make sure it is selected

Quoted 11 lines · Dmitry Golubovsky

Arnout,

Quoted 8 lines · Arnout Vandecappelle
Quoted 5 lines · Dmitry

The pam_userdb module is used to verify a username/password pair against values stored in a Berkeley DB database. The database is indexed by the username, and the data fields corresponding to the username keys are the passwords (from man 8 pam_userdb).

Quoted 6 lines
Quoted 2 lines

There is a patch on the list that introduces gdbm. Do you think that could
be an alternative for berkeleydb?

I'm not sure. We'll need a choice of configurations then, whether to use gdbm or berkeleyDB for linux-pam. What if both are selected in menuconfig?

I meant: maybe that's a simpler dependency than a specially-configured
berkeleydb.

Quoted 18 lines

BerkeleyDB is much more advanced than GDBM, IMHO. One might prefer GDBM over Berkeley DB because of license perhaps, but otherwise why?

If we want to implement it further, here's the possible logic:

PAM's configure.in shows that there may be variants in --enable-db options. which means the logic would be:

1. See if Berkeley or GDBM is selected. If none, disable pam_userdb in PAM --enable-db=no
2. If Berkeley is selected, enable dbm in it and specify proper option in --enable-db=ndbm (I guess)
3. If GDBM is selected, specify proper option in --enable-db=db (again I guess, maybe other way around)
4. If both are selected? there is an option --enable-db=yes which lets PAM decide by itself, then dbm should be enabled in BerkeleyDB anyway (it seems like configure only looks at headers*)

Quoted 1 line

Does anybody disagree with such logic?

Looks good. Although there should probably be a third config symbol
to simplify the logic - but we don't even have that yet for xml2/expat.

Quoted 7 lines

Plus, the database selected for PAM should become a PAM dependency. Which we cannot tell unless we have a configure choice for the database in PAM, but this turns the above logic upside down: PAM now drives the database selection.

Or we can make both databases, if selected, dependencies of PAM - at worst this only affects the building order.

Yep, that's the way to do it.

Quoted 1 line

And what is the status of the GDBM patch?

It's a bit hidden in the perl series, but I just acked it.

Quoted 7 lines

Thanks.

------------------------
* as in the failed autobuilder case, PAM's configure decided to build pam_userdb if BerkeleyDB was selected (headers were present) even though dbm was not enabled in it - linkage test was not done.

Since these patches are still under review, maybe it's best to first
commit an individual patch that just does --disable-db ? Can you do that and check if it fixes the autobuilder issue?

Regards,
Arnout

Signature · 6 lines
Arnout Vandecappelle                               arnout at mind be
Senior Embedded Software Architect                 +32-16-286540
Essensium/Mind                                     http://www.mind.be
G.Geenslaan 9, 3001 Leuven, Belgium                BE 872 984 063 RPR Leuven
LinkedIn profile: http://www.linkedin.com/in/arnoutvandecappelle
GPG fingerprint:  7CB5 E4CC 6C2E EFD4 6E3D A754 F963 ECAB 2450 2F1F
author
#8 lore raw

PATCH 2/4 Make Berkeley DB a dependency of linux-pam and make sure it is selected

Arnout,

Quoted 5 lines · Arnout Vandecappelle

Since these patches are still under review, maybe it's best to first
commit an individual patch that just does --disable-db ? Can you do that and check if it fixes the autobuilder issue?

I have just submitted such patch. Let's see how autobuilder results change. In my test linux-pam compiled without pam_userdb.so, and berkeleydb was selected in menuconfig.

Thanks.

Signature · 3 lines
Dmitry Golubovsky

Anywhere on the Web
author
#9 lore raw

PATCH 3/4 Provide PAM default configuration files when building linux-pam package

In reply to Dmitry
Signed-off-by Dmitry <[email protected]>
---
 package/linux-pam/default      |    8 ++++++++
 package/linux-pam/linux-pam.mk |    7 +++++++
 package/linux-pam/login        |    9 +++++++++
 3 files changed, 24 insertions(+), 0 deletions(-)
 create mode 100644 package/linux-pam/default
 create mode 100644 package/linux-pam/login
package/linux-pam/default new file +8 -0
new file mode 100644
index 0000000..0bd5ba0
@@ -0,0 +1,8 @@
+#
+# default; standard UN*X access
+#
+auth     required       pam_unix.so
+account  required       pam_unix.so
+password required       pam_unix.so
+session  required       pam_unix.so
+
package/linux-pam/linux-pam.mk +7 -0
index 5e0ecf0..8ab3a97 100644
@@ -24,4 +24,11 @@ ifeq ($(BR2_PACKAGE_LIBINTL),y)
 	LINUX_PAM_MAKE_OPT += LIBS=-lintl
 endif
 
+define LINUX_PAM_CONFFILES
+	$(INSTALL) -D -m 0644 package/linux-pam/default $(TARGET_DIR)/etc/pam.d/default
+	$(INSTALL) -D -m 0644 package/linux-pam/login $(TARGET_DIR)/etc/pam.d/login
+endef
+
+LINUX_PAM_POST_INSTALL_TARGET_HOOKS += LINUX_PAM_CONFFILES
+
 $(eval $(autotools-package))
package/linux-pam/login new file +9 -0
new file mode 100644
index 0000000..d65a9d4
@@ -0,0 +1,9 @@
+#
+# login: allow local logins to users with entries in /etc/passwd and
+# /etc/shadow even with null password
+#
+auth      required       pam_unix.so nullok
+account   required       pam_unix.so nullok
+password  required       pam_unix.so nullok
+session   required       pam_unix.so nullok
+
Signature · 1 line
1.7.2.5
author
#10 lore raw

PATCH 4/4 PAM support in Busybox if linux-pam is built

In reply to Dmitry
Signed-off-by Dmitry <[email protected]>
---
 package/busybox/Config.in  |   15 +++++++++++++++
 package/busybox/busybox.mk |   12 ++++++++++++
 2 files changed, 27 insertions(+), 0 deletions(-)
package/busybox/Config.in +15 -0
index dedcf18..21ff3fb 100644
@@ -62,6 +62,21 @@ config BR2_PACKAGE_BUSYBOX_WATCHDOG
 	  Install the watchdog daemon startup script,
 	  that just start at the boot the busybox watchdog daemon.
 
+config BR2_PACKAGE_BUSYBOX_PAM
+	bool "Enable PAM support in Busybox"
+	default n
+	depends on BR2_PACKAGE_LINUX_PAM
+	help
+	  If this item is selected, Busybox login will use the PAM stack
+	  for local logins. Local logins with null password are allowed
+	  for users with records in /etc/passwd ("default" and "root") 
+	  per the /etc/pam.d/login file.
+	  The default PAM configuration file /etc/pam.d/default requires 
+	  user accounts with nonzero length passwords.
+	  These files are provided by the linux-pam package. Buildroot
+	  users opting to use PAM are strongly advised to supply their
+	  own PAM configuration files for proper authentication model.
+
 if BR2_PACKAGE_BUSYBOX_WATCHDOG
 
 config BR2_PACKAGE_BUSYBOX_WATCHDOG_PERIOD
package/busybox/busybox.mk +12 -0
index 33f8633..21942c6 100644
@@ -164,6 +164,17 @@ define BUSYBOX_INSTALL_WATCHDOG_SCRIPT
 endef
 endif
 
+ifeq ($(BR2_PACKAGE_BUSYBOX_PAM),y)
+BUSYBOX_DEPENDENCIES += linux-pam
+define BUSYBOX_ENABLE_PAM
+	$(call KCONFIG_ENABLE_OPT,CONFIG_PAM,$(BUSYBOX_BUILD_CONFIG))
+endef
+else
+define BUSYBOX_ENABLE_PAM
+	$(call KCONFIG_DISABLE_OPT,CONFIG_PAM,$(BUSYBOX_BUILD_CONFIG))
+endef
+endif
+
 # We do this here to avoid busting a modified .config in configure
 BUSYBOX_POST_EXTRACT_HOOKS += BUSYBOX_COPY_CONFIG
 

@@ -179,6 +190,7 @@ define BUSYBOX_CONFIGURE_CMDS
 	$(BUSYBOX_DISABLE_MMU_APPLETS)
 	$(BUSYBOX_SET_INIT)
 	$(BUSYBOX_SET_WATCHDOG)
+	$(BUSYBOX_ENABLE_PAM)
 	@yes "" | $(MAKE) ARCH=$(KERNEL_ARCH) CROSS_COMPILE="$(TARGET_CROSS)" \
 		-C $(@D) oldconfig
 endef
Signature · 1 line
1.7.2.5
#11 lore raw

PATCH 1/4 If linux-pam is built, enable dbm functionality in Berkeley DB

In reply to Dmitry

Le Sat, 8 Sep 2012 00:21:03 -0400,
Dmitry <[email protected]> a ?crit :

package/berkeleydb/berkeleydb.mk define BERKELEYDB_CONFIGURE_CMDS · line 33

Quoted 1 line
package/berkeleydb/berkeleydb.mk +1 -0
+		$(if $(BR2_PACKAGE_LINUX_PAM),--enable-dbm,--disable-dbm) \

I don't really like this. I think you should rather add a configuration sub-option in package/berkeleydb/Config.in to enable/disable DBM support, and then have berkeleydb.mk test this configuration option, and the linux-pam/Config.in package select it.

I don't like when one package recipe pokes into the configuration options of another package.

Best regards,

Thomas

Signature · 4 lines
Thomas Petazzoni, Free Electrons
Kernel, drivers, real-time and embedded Linux
development, consulting, training and support.
http://free-electrons.com
author
#12 lore raw

PATCH 1/4 If linux-pam is built, enable dbm functionality in Berkeley DB

Thomas,

Quoted 9 lines · Thomas Petazzoni

Le Sat, 8 Sep 2012 00:21:03 -0400,
Dmitry <[email protected]> a ?crit :

Quoted 1 line

+ $(if $(BR2_PACKAGE_LINUX_PAM),--enable-dbm,--disable-dbm) \

I don't really like this. I think you should rather add a configuration sub-option in package/berkeleydb/Config.in to enable/disable DBM support, and then have berkeleydb.mk test this configuration option, and the linux-pam/Config.in package select it.

Well, adding extra config options is what I really wanted to avoid. But this may be just my way of thinking.

Quoted 2 lines

I don't like when one package recipe pokes into the configuration options of another package.

It is not a problem to add such configuration item, I'll do it.

Thanks.

Signature · 3 lines
Dmitry Golubovsky

Anywhere on the Web