e6520ef815
Fix sendmail improper close-on-exec flag handling. [SA-14:11] Fix ktrace memory disclosure. [SA-14:12] Fix incorrect error handling in PAM policy parser. [SA-14:13] Fix triple-fault when executing from a threaded process. [EN-14:06]
126 lines
3.4 KiB
Diff
126 lines
3.4 KiB
Diff
Index: contrib/openpam/lib/openpam_configure.c
|
|
===================================================================
|
|
--- contrib/openpam/lib/openpam_configure.c.orig
|
|
+++ contrib/openpam/lib/openpam_configure.c
|
|
@@ -1,6 +1,6 @@
|
|
/*-
|
|
* Copyright (c) 2001-2003 Networks Associates Technology, Inc.
|
|
- * Copyright (c) 2004-2012 Dag-Erling Smørgrav
|
|
+ * Copyright (c) 2004-2014 Dag-Erling Smørgrav
|
|
* All rights reserved.
|
|
*
|
|
* This software was developed for the FreeBSD Project by ThinkSec AS and
|
|
@@ -194,6 +194,7 @@
|
|
openpam_log(PAM_LOG_ERROR,
|
|
"%s(%d): missing or invalid facility",
|
|
filename, lineno);
|
|
+ errno = EINVAL;
|
|
goto fail;
|
|
}
|
|
if (facility != fclt && facility != PAM_FACILITY_ANY) {
|
|
@@ -209,6 +210,7 @@
|
|
openpam_log(PAM_LOG_ERROR,
|
|
"%s(%d): missing or invalid service name",
|
|
filename, lineno);
|
|
+ errno = EINVAL;
|
|
goto fail;
|
|
}
|
|
if (wordv[i] != NULL) {
|
|
@@ -215,12 +217,21 @@
|
|
openpam_log(PAM_LOG_ERROR,
|
|
"%s(%d): garbage at end of line",
|
|
filename, lineno);
|
|
+ errno = EINVAL;
|
|
goto fail;
|
|
}
|
|
ret = openpam_load_chain(pamh, servicename, fclt);
|
|
FREEV(wordc, wordv);
|
|
- if (ret < 0)
|
|
+ if (ret < 0) {
|
|
+ /*
|
|
+ * Bogus errno, but this ensures that the
|
|
+ * outer loop does not just ignore the
|
|
+ * error and keep searching.
|
|
+ */
|
|
+ if (errno == ENOENT)
|
|
+ errno = EINVAL;
|
|
goto fail;
|
|
+ }
|
|
continue;
|
|
}
|
|
|
|
@@ -230,6 +241,7 @@
|
|
openpam_log(PAM_LOG_ERROR,
|
|
"%s(%d): missing or invalid control flag",
|
|
filename, lineno);
|
|
+ errno = EINVAL;
|
|
goto fail;
|
|
}
|
|
|
|
@@ -239,6 +251,7 @@
|
|
openpam_log(PAM_LOG_ERROR,
|
|
"%s(%d): missing or invalid module name",
|
|
filename, lineno);
|
|
+ errno = EINVAL;
|
|
goto fail;
|
|
}
|
|
|
|
@@ -248,8 +261,11 @@
|
|
this->flag = ctlf;
|
|
|
|
/* load module */
|
|
- if ((this->module = openpam_load_module(modulename)) == NULL)
|
|
+ if ((this->module = openpam_load_module(modulename)) == NULL) {
|
|
+ if (errno == ENOENT)
|
|
+ errno = ENOEXEC;
|
|
goto fail;
|
|
+ }
|
|
|
|
/*
|
|
* The remaining items in wordv are the module's
|
|
@@ -282,7 +298,11 @@
|
|
* The loop ended because openpam_readword() returned NULL, which
|
|
* can happen for four different reasons: an I/O error (ferror(f)
|
|
* is true), a memory allocation failure (ferror(f) is false,
|
|
- * errno is non-zero)
|
|
+ * feof(f) is false, errno is non-zero), the file ended with an
|
|
+ * unterminated quote or backslash escape (ferror(f) is false,
|
|
+ * feof(f) is true, errno is non-zero), or the end of the file was
|
|
+ * reached without error (ferror(f) is false, feof(f) is true,
|
|
+ * errno is zero).
|
|
*/
|
|
if (ferror(f) || errno != 0)
|
|
goto syserr;
|
|
@@ -411,6 +431,9 @@
|
|
}
|
|
ret = openpam_load_file(pamh, service, facility,
|
|
filename, style);
|
|
+ /* success */
|
|
+ if (ret > 0)
|
|
+ RETURNN(ret);
|
|
/* the file exists, but an error occurred */
|
|
if (ret == -1 && errno != ENOENT)
|
|
RETURNN(ret);
|
|
@@ -420,7 +443,8 @@
|
|
}
|
|
|
|
/* no hit */
|
|
- RETURNN(0);
|
|
+ errno = ENOENT;
|
|
+ RETURNN(-1);
|
|
}
|
|
|
|
/*
|
|
@@ -441,8 +465,10 @@
|
|
openpam_log(PAM_LOG_ERROR, "invalid service name");
|
|
RETURNC(PAM_SYSTEM_ERR);
|
|
}
|
|
- if (openpam_load_chain(pamh, service, PAM_FACILITY_ANY) < 0)
|
|
- goto load_err;
|
|
+ if (openpam_load_chain(pamh, service, PAM_FACILITY_ANY) < 0) {
|
|
+ if (errno != ENOENT)
|
|
+ goto load_err;
|
|
+ }
|
|
for (fclt = 0; fclt < PAM_NUM_FACILITIES; ++fclt) {
|
|
if (pamh->chains[fclt] != NULL)
|
|
continue;
|