packages/linux-pam: bump version to 1.1.8 -> 1.2.1

PATCH New Brendan Heading 3 participants 3 messages Aug 23, 2015 – Mar 5, 2016

Share & tools

Brendan Heading

author

2015-08-23 19:02 UTC #0 lore raw

PATCH 1/1 packages/linux-pam: bump version to 1.1.8 -> 1.2.1

Move to the latest release of linux-pam. This allows us to remove a number of patches and consolidate the existing ones :

- 0001-configure.patch
- 0007-rhosts.patch

these two patches deal with the ruserok function, which is not usable with uclibc. Consolidated into 0002-Conditionally-compile-per-ruserok-availability.patch.

- 0003-group.patch
- 0005-succeed.patch
- 0006-time.patch

these three patches deal with the innetgr function, which is not usable with uclibc. Consolidated into 0003-Conditionally-compile-per-innetgr-availability.patch.

- 0004-mkdir.patch

Fixed in upstream, no longer required.

- 0002-doc-makefile-am.patch

renamed to 0001-doc-makefile-am.patch.

- 0008-fix-CVE-2014-2583.patch
- 0009-fix-CVE-2013-7041.patch

These patches are already included in the new release and so can be safely deleted.

---
v1 - I thought rather than patching linux-pam 1.1.8 to fix the musl compilation issues, we may as well bump to the newer version first. I have the musl patches waiting, but thought it better to submit this first. This patch includes only the changes necessary to get linux-pam 1.2.1 building under uclibc and glibc (ie just the version bump).

The original set of patches seemed unnecessarily fragmented so I've consolidated them into larger patches based on which aspect they were fixing. Makes dealing with the set of patches a little more convenient. Also added Upstream-status indications which were not originally present. Once we are happy here I will look at submitting these where appropriate.
---

Signed-off-by Brendan Heading <[email protected]>

---
 package/linux-pam/0001-configure.patch             | 19 -----
 ...akefile-am.patch => 0001-doc-makefile-am.patch} |  3 +
 ...tionally-compile-per-ruserok-availability.patch | 49 +++++++++++++
 ...tionally-compile-per-innetgr-availability.patch | 84 ++++++++++++++++++++++
 package/linux-pam/0003-group.patch                 | 26 -------
 package/linux-pam/0004-mkdir.patch                 | 17 -----
 package/linux-pam/0005-succeed.patch               | 31 --------
 package/linux-pam/0006-time.patch                  | 26 -------
 package/linux-pam/0007-rhosts.patch                | 24 -------
 package/linux-pam/0008-fix-CVE-2014-2583.patch     | 53 --------------
 package/linux-pam/0009-fix-CVE-2013-7041.patch     | 50 -------------
 package/linux-pam/linux-pam.hash                   |  2 +-
 package/linux-pam/linux-pam.mk                     |  2 +-
 13 files changed, 138 insertions(+), 248 deletions(-)
 delete mode 100644 package/linux-pam/0001-configure.patch
 rename package/linux-pam/{0002-doc-makefile-am.patch => 0001-doc-makefile-am.patch} (91%)
 create mode 100644 package/linux-pam/0002-Conditionally-compile-per-ruserok-availability.patch
 create mode 100644 package/linux-pam/0003-Conditionally-compile-per-innetgr-availability.patch
 delete mode 100644 package/linux-pam/0003-group.patch
 delete mode 100644 package/linux-pam/0004-mkdir.patch
 delete mode 100644 package/linux-pam/0005-succeed.patch
 delete mode 100644 package/linux-pam/0006-time.patch
 delete mode 100644 package/linux-pam/0007-rhosts.patch
 delete mode 100644 package/linux-pam/0008-fix-CVE-2014-2583.patch
 delete mode 100644 package/linux-pam/0009-fix-CVE-2013-7041.patch

package/linux-pam/0001-configure.patch deleted +0 ~~-19~~

deleted file mode 100644
index d39261f..0000000
@@ -1,19 +0,0 @@
-Add check for ruserok
-
-ruserok is not available/functional in uclibc, provide conditions for compilation
-where needed.
-
-Signed-off-by: Dmitry Golubovsky <[email protected]>
-
-diff -urN a/configure.in b/configure.in
---- a/configure.in	2012-08-17 03:48:24.000000000 -0500
-+++ b/configure.in	2013-07-17 09:49:23.760254684 -0500
-@@ -526,7 +526,7 @@
- AC_CHECK_FUNCS(strcspn strdup strspn strstr strtol uname)
- AC_CHECK_FUNCS(getutent_r getpwnam_r getpwuid_r getgrnam_r getgrgid_r getspnam_r)
- AC_CHECK_FUNCS(getgrouplist getline getdelim)
--AC_CHECK_FUNCS(inet_ntop inet_pton innetgr ruserok_af)
-+AC_CHECK_FUNCS(inet_ntop inet_pton innetgr ruserok_af ruserok)
- 
- AC_CHECK_FUNCS(unshare, [UNSHARE=yes], [UNSHARE=no])
- AM_CONDITIONAL([HAVE_UNSHARE], [test "$UNSHARE" = yes])

package/linux-pam/0001-doc-makefile-am.patch renamed from package/linux-pam/0002-doc-makefile-am.patch +3 -0

similarity index 91%
rename from package/linux-pam/0002-doc-makefile-am.patch
rename to package/linux-pam/0001-doc-makefile-am.patch
index 8fa2dda..ac3ff2b 100644
@@ -3,6 +3,9 @@ Disable generation of documentation
 Generation of documentation is not necessary in Buildroot, disable it completely.
 
 Signed-off-by: Dmitry Golubovsky <[email protected]>
+Signed-off-by: Brendan Heading <[email protected]>
+
+Upstream-status: inappropriate
 
 diff -urN a/doc/Makefile.am b/doc/Makefile.am
 --- a/doc/Makefile.am	2012-08-15 06:08:43.000000000 -0500

package/linux-pam/0002-Conditionally-compile-per-ruserok-availability.patch new file +49 -0

49 lines not on this page · raw message

package/linux-pam/0003-Conditionally-compile-per-innetgr-availability.patch new file +84 -0

84 lines not on this page · raw message

package/linux-pam/0003-group.patch deleted +0 ~~-26~~

deleted file mode 100644
index a94cf9e..0000000
@@ -1,26 +0,0 @@
-Conditionally compile per innetgr availability
-
-innetgr is not available/functional in uclibc, provide conditions for compilation.
-
-Signed-off-by: Dmitry Golubovsky <[email protected]>
-
-Index: linux-pam-1.1.4/modules/pam_group/pam_group.c
-============================================================================
---- linux-pam-1.1.4/modules/pam_group/pam_group.c	2011-06-21 05:04:56.000000000 -0400
-+++ linux-pam-1.1.4/modules/pam_group/pam_group.c	2012-08-09 21:35:06.000000000 -0400
-@@ -655,8 +655,14 @@
- 	    continue;
- 	}
- 	/* If buffer starts with @, we are using netgroups */
--	if (buffer[0] == '@')
-+	if (buffer[0] == '@') {
-+#ifdef HAVE_INNETGR
- 	  good &= innetgr (&buffer[1], NULL, user, NULL);
-+#else
-+	  good = 0;
-+	  pam_syslog (pamh, LOG_ERR, "pam_group does not have netgroup support");
-+#endif  /* HAVE_INNETGR */
-+	}
- 	/* otherwise, if the buffer starts with %, it's a UNIX group */
- 	else if (buffer[0] == '%')
-           good &= pam_modutil_user_in_group_nam_nam(pamh, user, &buffer[1]);

package/linux-pam/0004-mkdir.patch deleted +0 ~~-17~~

deleted file mode 100644
index 00056da..0000000
@@ -1,17 +0,0 @@
-$(mkdir_p) is obsolete for newer automake, use $(MKDIR_P) instead.
-Upstream should really gettextize with a newer version before packing up.
-
-Signed-off-by: Gustavo Zacarias <[email protected]>
-
-diff -Nura Linux-PAM-1.1.7.orig/po/Makefile.in.in Linux-PAM-1.1.7/po/Makefile.in.in
---- Linux-PAM-1.1.7.orig/po/Makefile.in.in	2013-09-11 20:45:16.610770002 -0300
-+++ Linux-PAM-1.1.7/po/Makefile.in.in	2013-09-11 20:45:28.030145316 -0300
-@@ -31,7 +31,7 @@
- INSTALL = @INSTALL@
- INSTALL_DATA = @INSTALL_DATA@
- mkinstalldirs = $(SHELL) @install_sh@ -d
--mkdir_p = @mkdir_p@
-+mkdir_p = @MKDIR_P@
- 
- GMSGFMT_ = @GMSGFMT@
- GMSGFMT_no = @GMSGFMT@

package/linux-pam/0005-succeed.patch deleted +0 ~~-31~~

deleted file mode 100644
index 8a675ef..0000000
@@ -1,31 +0,0 @@
-Conditionally compile per innetgr availability
-
-innetgr is not available/functional in uclibc, provide conditions for compilation.
-
-Signed-off-by: Dmitry Golubovsky <[email protected]>
-
-Index: linux-pam-1.1.4/modules/pam_succeed_if/pam_succeed_if.c
-============================================================================
---- linux-pam-1.1.4/modules/pam_succeed_if/pam_succeed_if.c	2011-06-21 05:04:56.000000000 -0400
-+++ linux-pam-1.1.4/modules/pam_succeed_if/pam_succeed_if.c	2012-08-09 21:05:02.000000000 -0400
-@@ -233,16 +233,20 @@
- static int
- evaluate_innetgr(const char *host, const char *user, const char *group)
- {
-+#ifdef HAVE_INNETGR
- 	if (innetgr(group, host, user, NULL) == 1)
- 		return PAM_SUCCESS;
-+#endif /* HAVE_INNETGR */
- 	return PAM_AUTH_ERR;
- }
- /* Return PAM_SUCCESS if the (host,user) is NOT in the netgroup. */
- static int
- evaluate_notinnetgr(const char *host, const char *user, const char *group)
- {
-+#ifdef HAVE_INNETGR
- 	if (innetgr(group, host, user, NULL) == 0)
- 		return PAM_SUCCESS;
-+#endif /* HAVE_INNETGR */
- 	return PAM_AUTH_ERR;
- }
-

package/linux-pam/0006-time.patch deleted +0 ~~-26~~

deleted file mode 100644
index 58d7c9f..0000000
@@ -1,26 +0,0 @@
-Conditionally compile per innetgr availability
-
-innetgr is not available/functional in uclibc, provide conditions for compilation.
-
-Signed-off-by: Dmitry Golubovsky <[email protected]>
-
-Index: linux-pam-1.1.4/modules/pam_time/pam_time.c
-============================================================================
---- linux-pam-1.1.4/modules/pam_time/pam_time.c	2011-06-21 05:04:56.000000000 -0400
-+++ linux-pam-1.1.4/modules/pam_time/pam_time.c	2012-08-09 21:02:29.000000000 -0400
-@@ -554,8 +554,14 @@
- 	       continue;
- 	  }
- 	  /* If buffer starts with @, we are using netgroups */
--	  if (buffer[0] == '@')
-+	  if (buffer[0] == '@') {
-+#ifdef HAVE_INNETGR
- 	    good &= innetgr (&buffer[1], NULL, user, NULL);
-+#else
-+	    good = 0;
-+	    pam_syslog (pamh, LOG_ERR, "pam_time does not have netgroup support");
-+#endif /* HAVE_INNETGR */
-+	  }
- 	  else
- 	    good &= logic_field(pamh, user, buffer, count, is_same);
- 	  D(("with user: %s", good ? "passes":"fails" ));

package/linux-pam/0007-rhosts.patch deleted +0 ~~-24~~

deleted file mode 100644
index 58f9adb..0000000
@@ -1,24 +0,0 @@
-Conditionally compile per ruserok availability
-
-ruserok is not available/functional in uclibc, provide conditions for compilation.
-
-Signed-off-by: Dmitry Golubovsky <[email protected]>
-
-Index: linux-pam-1.1.4/modules/pam_rhosts/pam_rhosts.c
-============================================================================
---- linux-pam-1.1.4/modules/pam_rhosts/pam_rhosts.c	2011-06-21 05:04:56.000000000 -0400
-+++ linux-pam-1.1.4/modules/pam_rhosts/pam_rhosts.c	2012-08-09 21:19:34.000000000 -0400
-@@ -114,8 +114,12 @@
- #ifdef HAVE_RUSEROK_AF
-     retval = ruserok_af (rhost, as_root, ruser, luser, PF_UNSPEC);
- #else
-+  #ifdef HAVE_RUSEROK
-     retval = ruserok (rhost, as_root, ruser, luser);
--#endif
-+  #else
-+    retval = -1;
-+  #endif  /* HAVE_RUSEROK */
-+#endif  /*HAVE_RUSEROK_AF */
-     if (retval != 0) {
-       if (!opt_silent || opt_debug)
- 	pam_syslog(pamh, LOG_WARNING, "denied access to %s@%s as %s",

package/linux-pam/0008-fix-CVE-2014-2583.patch deleted +0 ~~-53~~

53 lines not on this page · raw message

package/linux-pam/0009-fix-CVE-2013-7041.patch deleted +0 ~~-50~~

50 lines not on this page · raw message

package/linux-pam/linux-pam.hash +1 -1

index 3f420c2..a6a26d1 100644
@@ -1,2 +1,2 @@
 # Locally computed hashes, not provided by upstream
-sha256	c4b1f23a236d169e2496fea20721578d864ba00f7242d2b41d81050ac87a1e55	Linux-PAM-1.1.8.tar.bz2
+sha256	342b1211c0d3b203a7df2540a5b03a428a087bd8a48c17e49ae268f992b334d9	Linux-PAM-1.2.1.tar.bz2

package/linux-pam/linux-pam.mk +1 -1

index 26b627e..cf1b5b7 100644
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-LINUX_PAM_VERSION = 1.1.8
+LINUX_PAM_VERSION = 1.2.1
 LINUX_PAM_SOURCE = Linux-PAM-$(LINUX_PAM_VERSION).tar.bz2
 LINUX_PAM_SITE = http://linux-pam.org/library
 LINUX_PAM_INSTALL_STAGING = YES

Signature · 1 line

2.4.3

Carlos Santos

2016-03-01 02:09 UTC #1 lore raw

PATCH 1/1 packages/linux-pam: bump version to 1.1.8 -> 1.2.1

Quoted 24 lines

Move to the latest release of linux-pam. This allows us to remove a number of patches and consolidate the existing ones :
- 0001-configure.patch
- 0007-rhosts.patch
these two patches deal with the ruserok function, which is not usable with uclibc. Consolidated into 0002-Conditionally-compile-per-ruserok-availability.patch.
- 0003-group.patch
- 0005-succeed.patch
- 0006-time.patch
these three patches deal with the innetgr function, which is not usable with uclibc. Consolidated into 0003-Conditionally-compile-per-innetgr-availability.patch.
- 0004-mkdir.patch
Fixed in upstream, no longer required.
- 0002-doc-makefile-am.patch

Quoted 7 lines

renamed to 0001-doc-makefile-am.patch.
- 0008-fix-CVE-2014-2583.patch
- 0009-fix-CVE-2013-7041.patch
These patches are already included in the new release and so can be safely deleted.

Tested-by Carlos Santos <[email protected]>

Used the following configuration:

BR2_x86_64=y
BR2_x86_corei7=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_CUSTOM=y
BR2_TOOLCHAIN_EXTERNAL_DOWNLOAD=y BR2_TOOLCHAIN_EXTERNAL_URL="http://autobuild.buildroot.org/toolchains/tarballs/x86_64-ctng_locales-linux-gnu.tar.xz" BR2_TOOLCHAIN_EXTERNAL_CUSTOM_PREFIX="x86_64-ctng_locales-linux-gnu" BR2_TOOLCHAIN_EXTERNAL_GCC_4_8=y
BR2_TOOLCHAIN_EXTERNAL_HEADERS_3_9=y
BR2_TOOLCHAIN_EXTERNAL_CUSTOM_GLIBC=y
BR2_TOOLCHAIN_EXTERNAL_CXX=y
BR2_PACKAGE_LIBFFI=y
BR2_PACKAGE_LINUX_PAM=y
BR2_PACKAGE_LIBPAM_RADIUS_AUTH=y
BR2_PACKAGE_LIBPAM_TACPLUS=y

Built linux-pam-1.2.1, libpam-tacplus-1.3.9 and libpam-radius-auth-1.4.0.

Did not perform a run-time test, since it would require a network setup with TACACS+ and RADIUS servers.

Thomas Petazzoni

2016-03-05 15:55 UTC #2 lore raw

PATCH 1/1 packages/linux-pam: bump version to 1.1.8 -> 1.2.1

In reply to Brendan Heading

Hello,

Quoted 24 lines · Brendan Heading

Move to the latest release of linux-pam. This allows us to remove a number of patches and consolidate the existing ones :
- 0001-configure.patch
- 0007-rhosts.patch
these two patches deal with the ruserok function, which is not usable with uclibc. Consolidated into 0002-Conditionally-compile-per-ruserok-availability.patch.
- 0003-group.patch
- 0005-succeed.patch
- 0006-time.patch
these three patches deal with the innetgr function, which is not usable with uclibc. Consolidated into 0003-Conditionally-compile-per-innetgr-availability.patch.
- 0004-mkdir.patch
Fixed in upstream, no longer required.
- 0002-doc-makefile-am.patch

Quoted 7 lines

renamed to 0001-doc-makefile-am.patch.
- 0008-fix-CVE-2014-2583.patch
- 0009-fix-CVE-2013-7041.patch
These patches are already included in the new release and so can be safely deleted.

Thanks for the detailed commit log explaining the status of the different patches. Definitely very useful.

Quoted 6 lines

v1 - I thought rather than patching linux-pam 1.1.8 to fix the musl compilation issues, we may as well bump to the newer version first. I have the musl patches waiting, but thought it better to submit this first. This patch includes only the changes necessary to get linux-pam 1.2.1 building under uclibc and glibc (ie just the version bump).

Unfortunately, building under musl still doesn't work, due to the use of strndpua(). Alpine Linux has a quick patch for this, but unfortunately as usual with no description, no authorship, etc. Could you work on this ?

package/linux-pam/0001-doc-makefile-am.patch Disable generation of documentation · line 8

Quoted 9 lines

package/linux-pam/0001-doc-makefile-am.patch renamed from package/linux-pam/0002-doc-makefile-am.patch +3 -0

@@ -3,6 +3,9 @@ Disable generation of documentation
 Generation of documentation is not necessary in Buildroot, disable it completely.
 
 Signed-off-by: Dmitry Golubovsky <[email protected]>
+Signed-off-by: Brendan Heading <[email protected]>
+
+Upstream-status: inappropriate

I think this patch should be modified to be turned into something that is upstreamable, like a --disable-doc configure flag.

package/linux-pam/0001-doc-makefile-am.patch line 9

Quoted 11 lines

package/linux-pam/0001-doc-makefile-am.patch renamed from package/linux-pam/0002-doc-makefile-am.patch +10 -0

+++ b/package/linux-pam/0002-Conditionally-compile-per-ruserok-availability.patch

@@ -0,0 +1,49 @@
+ruserok is not available/functional in uclibc, provide conditions
+for compilation where needed.
+
+Patch originally by Dmitry Golubovsky <[email protected]> -
+porting to linux-pam 1.2.1.
+
+Signed-off-by: Brendan Heading <[email protected]>
+
+Upstream-status: pending

Where did you submit it? I don't see it on the mailing list, nor in the bug tracker. Am I missing something? I also don't see it integrated in the Git repository. Can you ping upstream about this?

package/linux-pam/0001-doc-makefile-am.patch line 18

Quoted 9 lines

package/linux-pam/0001-doc-makefile-am.patch renamed from package/linux-pam/0002-doc-makefile-am.patch +9 -0

+innetgr is not available/functional in uclibc, provide conditions for
+compilation.
+
+Patch originally by Dmitry Golubovsky <[email protected]> - porting
+to linux-pam 1.2.1.
+
+Signed-off-by: Brendan Heading <[email protected]>
+
+Upstream-status: pending

Same comment.

Thanks!

Thomas

Signature · 3 lines

Thomas Petazzoni, CTO, Free Electrons
Embedded Linux, Kernel and Android engineering
http://free-electrons.com