Skip to contentSkip to conversation

PAM support in Busybox if linux-pam is built

PATCH New Dmitry 2 participants 4 messages Aug 15, 2012 – Aug 23, 2012

lore
Share & tools
lore

Dmitry

author
#0 lore raw

PATCH 1/2 PAM support in Busybox if linux-pam is built

Signed-off-by Dmitry <[email protected]>
---
 package/busybox/Config.in  |   11 +++++++++++
 package/busybox/busybox.mk |   12 ++++++++++++
 2 files changed, 23 insertions(+), 0 deletions(-)
package/busybox/Config.in +11 -0
index dedcf18..2a9cbf1 100644
@@ -62,6 +62,17 @@ config BR2_PACKAGE_BUSYBOX_WATCHDOG
 	  Install the watchdog daemon startup script,
 	  that just start at the boot the busybox watchdog daemon.
 
+config BR2_PACKAGE_BUSYBOX_PAM
+	bool "Enable PAM support in Busybox"
+	default n
+	depends on BR2_PACKAGE_LINUX_PAM
+	help
+	  If this item is selected, Busybox login will use the PAM stack
+	  for local logins. Local logins with null password are allowed
+	  for users with records in /etc/passwd ("default" and "root").
+	  The default PAM configuration file requires user accounts with
+	  nonzero length passwords.
+
 if BR2_PACKAGE_BUSYBOX_WATCHDOG
 
 config BR2_PACKAGE_BUSYBOX_WATCHDOG_PERIOD
package/busybox/busybox.mk +12 -0
index 17ee50a..c97ce77 100644
@@ -161,6 +161,17 @@ define BUSYBOX_INSTALL_WATCHDOG_SCRIPT
 endef
 endif
 
+ifeq ($(BR2_PACKAGE_BUSYBOX_PAM),y)
+BUSYBOX_DEPENDENCIES += linux-pam
+define BUSYBOX_ENABLE_PAM
+	$(call KCONFIG_ENABLE_OPT,CONFIG_PAM,$(BUSYBOX_BUILD_CONFIG))
+endef
+else
+define BUSYBOX_ENABLE_PAM
+	$(call KCONFIG_DISABLE_OPT,CONFIG_PAM,$(BUSYBOX_BUILD_CONFIG))
+endef
+endif
+
 # We do this here to avoid busting a modified .config in configure
 BUSYBOX_POST_EXTRACT_HOOKS += BUSYBOX_COPY_CONFIG
 

@@ -176,6 +187,7 @@ define BUSYBOX_CONFIGURE_CMDS
 	$(BUSYBOX_DISABLE_MMU_APPLETS)
 	$(BUSYBOX_SET_INIT)
 	$(BUSYBOX_SET_WATCHDOG)
+	$(BUSYBOX_ENABLE_PAM)
 	@yes "" | $(MAKE) ARCH=$(KERNEL_ARCH) CROSS_COMPILE="$(TARGET_CROSS)" \
 		-C $(@D) oldconfig
 endef
Signature · 1 line
1.7.2.5
author
#1 lore raw

PATCH 2/2 Provide PAM default configuration files when building linux-pam package

Signed-off-by Dmitry <[email protected]>
---
 package/linux-pam/default      |    8 ++++++++
 package/linux-pam/linux-pam.mk |    8 ++++++++
 package/linux-pam/login        |    9 +++++++++
 3 files changed, 25 insertions(+), 0 deletions(-)
 create mode 100644 package/linux-pam/default
 create mode 100644 package/linux-pam/login
package/linux-pam/default new file +8 -0
new file mode 100644
index 0000000..0bd5ba0
@@ -0,0 +1,8 @@
+#
+# default; standard UN*X access
+#
+auth     required       pam_unix.so
+account  required       pam_unix.so
+password required       pam_unix.so
+session  required       pam_unix.so
+
package/linux-pam/linux-pam.mk +8 -0
index 48cb073..99161c6 100644
@@ -24,4 +24,12 @@ ifeq ($(BR2_PACKAGE_LIBINTL),y)
 	LINUX_PAM_MAKE_OPT += LIBS=-lintl
 endif
 
+define LINUX_PAM_CONFFILES
+	mkdir -p $(TARGET_DIR)/etc/pam.d
+	cp $($(PKG)_DIR_PREFIX)/$(RAWNAME)/default $(TARGET_DIR)/etc/pam.d
+	cp $($(PKG)_DIR_PREFIX)/$(RAWNAME)/login $(TARGET_DIR)/etc/pam.d
+endef
+
+LINUX_PAM_POST_PATCH_HOOKS = LINUX_PAM_CONFFILES
+
 $(eval $(autotools-package))
package/linux-pam/login new file +9 -0
new file mode 100644
index 0000000..d65a9d4
@@ -0,0 +1,9 @@
+#
+# login: allow local logins to users with entries in /etc/passwd and
+# /etc/shadow even with null password
+#
+auth      required       pam_unix.so nullok
+account   required       pam_unix.so nullok
+password  required       pam_unix.so nullok
+session   required       pam_unix.so nullok
+
Signature · 1 line
1.7.2.5
#2 lore raw

PATCH 2/2 Provide PAM default configuration files when building linux-pam package

package/linux-pam/linux-pam.mk ifeq ($(BR2_PACKAGE_LIBINTL),y) · line 31

Quoted 5 lines · Dmitry
package/linux-pam/linux-pam.mk +5 -0
+define LINUX_PAM_CONFFILES
+	mkdir -p $(TARGET_DIR)/etc/pam.d
+	cp $($(PKG)_DIR_PREFIX)/$(RAWNAME)/default $(TARGET_DIR)/etc/pam.d
+	cp $($(PKG)_DIR_PREFIX)/$(RAWNAME)/login $(TARGET_DIR)/etc/pam.d
+endef

We normally hard-code the directory name: the build is always executed from
the buildroot directory, and the package directory normally doesn't change. So:

	cp package/linux-pam/default $(TARGET_DIR)/etc/pam.d

This will also allow you to do it in the post-install hook.

Also, I would use $(INSTALL) instead of cp (but that's personal preference,
cp is used in other places as well):

	$(INSTALL) -D -m 0644 package/linux-pam/default $(TARGET_DIR)/etc/pam.d/default

(since it uses -D, the mkdir can be removed).

Regards,
Arnout

Signature · 6 lines
Arnout Vandecappelle                               arnout at mind be
Senior Embedded Software Architect                 +32-16-286540
Essensium/Mind                                     http://www.mind.be
G.Geenslaan 9, 3001 Leuven, Belgium                BE 872 984 063 RPR Leuven
LinkedIn profile: http://www.linkedin.com/in/arnoutvandecappelle
GPG fingerprint:  7CB5 E4CC 6C2E EFD4 6E3D A754 F963 ECAB 2450 2F1F
author
#3 lore raw

PATCH 2/2 Provide PAM default configuration files when building linux-pam package

Arnout,

Quoted 5 lines · Arnout Vandecappelle

We normally hard-code the directory name: the build is always executed from
the buildroot directory, and the package directory normally doesn't change. So:

        cp package/linux-pam/default $(TARGET_DIR)/etc/pam.d

This will also allow you to do it in the post-install hook.

I try to avoid any hardcoding. Would it be better to make RAWNAME also available at the install phase?

Quoted 6 lines

Also, I would use $(INSTALL) instead of cp (but that's personal preference,
cp is used in other places as well):

        $(INSTALL) -D -m 0644 package/linux-pam/default

$(TARGET_DIR)/etc/pam.d/default
(since it uses -D, the mkdir can be removed).

Thanks for the suggestion. I hope to also get Thomas' opinion and if there are further improvement suggestions I'll try to incorporate yours as well.

Thanks.

Signature · 3 lines
Dmitry Golubovsky

Anywhere on the Web