From fbd43954e452484d901b74c5de67ff9b6a9c0c9e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E6=9D=8E=E5=AE=87=E5=93=B2?= Date: Tue, 9 Jul 2024 10:03:01 +0000 Subject: [PATCH] Sync community patches : complete Linux-PAM compliance for forked child in su and login. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: 李宇哲 --- backport-login-su-pam_end-compliance.patch | 50 ++++++++++++++++++++++ util-linux.spec | 10 ++++- 2 files changed, 59 insertions(+), 1 deletion(-) create mode 100644 backport-login-su-pam_end-compliance.patch diff --git a/backport-login-su-pam_end-compliance.patch b/backport-login-su-pam_end-compliance.patch new file mode 100644 index 0000000..38611ce --- /dev/null +++ b/backport-login-su-pam_end-compliance.patch @@ -0,0 +1,50 @@ +From 4660286e9cdff6d95b49295674b96f83af10ea36 Mon Sep 17 00:00:00 2001 +From: "Andrew G. Morgan" +Date: Sat, 27 Nov 2021 21:00:22 -0800 +Subject: [PATCH] Complete Linux-PAM compliance for forked child in su and + login. + +As documented here: + +http://www.linux-pam.org/Linux-PAM-html/adg-interface-by-app-expected.html#adg-pam_end + +The child that is about to exec*() the user shell is supposed to pam_end() +with PAM_DATA_SILENT. This gives the modules a last chance to do a minor +cleanup of the module state before the user's shell is launched. + +Signed-off-by: Andrew G. Morgan +--- + login-utils/login.c | 3 +++ + login-utils/su-common.c | 3 +++ + 2 files changed, 6 insertions(+) + +diff --git a/login-utils/login.c b/login-utils/login.c +index 7229692dd..2c146b977 100644 +--- a/login-utils/login.c ++++ b/login-utils/login.c +@@ -1533,6 +1533,9 @@ int main(int argc, char **argv) + + child_argv[child_argc++] = NULL; + ++ /* http://www.linux-pam.org/Linux-PAM-html/adg-interface-by-app-expected.html#adg-pam_end */ ++ (void) pam_end(cxt.pamh, PAM_SUCCESS|PAM_DATA_SILENT); ++ + execvp(child_argv[0], child_argv + 1); + + if (!strcmp(child_argv[0], "/bin/sh")) +diff --git a/login-utils/su-common.c b/login-utils/su-common.c +index 6b7ddeca7..06282d21a 100644 +--- a/login-utils/su-common.c ++++ b/login-utils/su-common.c +@@ -1263,6 +1263,9 @@ int su_main(int argc, char **argv, int mode) + if (su->simulate_login && chdir(su->pwd->pw_dir) != 0) + warn(_("warning: cannot change directory to %s"), su->pwd->pw_dir); + ++ /* http://www.linux-pam.org/Linux-PAM-html/adg-interface-by-app-expected.html#adg-pam_end */ ++ (void) pam_end(su->pamh, PAM_SUCCESS|PAM_DATA_SILENT); ++ + if (shell) + run_shell(su, shell, command, argv + optind, max(0, argc - optind)); + +-- +2.33.0 diff --git a/util-linux.spec b/util-linux.spec index 94e9bda..c23ed5f 100644 --- a/util-linux.spec +++ b/util-linux.spec @@ -3,7 +3,7 @@ Name: util-linux Version: 2.37.2 -Release: 31 +Release: 32 Summary: A random collection of Linux utilities License: GPLv2 and GPLv2+ and LGPLv2+ and BSD with advertising and Public Domain URL: https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git @@ -150,6 +150,7 @@ Patch6128: backport-hexdump-check-blocksize-when-display-data.patch Patch6129: backport-lslocks-fix-buffer-overflow.patch Patch6130: backport-last-avoid-out-of-bounds-array-access.patch Patch6131: backport-lsipc-fix-semaphore-USED-counter.patch +Patch6132: backport-login-su-pam_end-compliance.patch Patch9000: Add-check-to-resolve-uname26-version-test-failed.patch Patch9001: SKIPPED-no-root-permissions-test.patch @@ -523,6 +524,13 @@ fi %{_mandir}/man8/{swapoff.8*,swapon.8*,switch_root.8*,umount.8*,wdctl.8.gz,wipefs.8*,zramctl.8*} %changelog +* Tue Jul 9 2024 liyuzhe - 2.37.2-32 +- Type:bugfix +- CVE:NA +- SUG:NA +- DESC:sync community patches + backport-login-su-pam_end-compliance.patch + * Tue May 7 2024 zhangyao - 2.37.2-31 - Type:bugfix - CVE:NA -- Gitee