[Buildroot] [PATCH 1/4] If linux-pam is built, enable dbm functionality in Berkeley DB

[Buildroot] [PATCH 1/4] If linux-pam is built, enable dbm functionality in Berkeley DB

[Dmitry]

The linux-pam library has the pam_userdb module which uses a
dbm-compatible database to authenticate users. Berkeley DB provides
such functionality, so it has to be condidionally enabled if linux-pam
is used.

Signed-off-by: Dmitry <golubovsky@gmail.com>
---
 package/berkeleydb/berkeleydb.mk |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/package/berkeleydb/berkeleydb.mk b/package/berkeleydb/berkeleydb.mk
index 3037da6..3ca334f 100644
--- a/package/berkeleydb/berkeleydb.mk
+++ b/package/berkeleydb/berkeleydb.mk
@@ -30,6 +30,7 @@ define BERKELEYDB_CONFIGURE_CMDS
 		$(if $(BR2_INSTALL_LIBSTDCPP),--enable-cxx,--disable-cxx) \
 		--disable-java \
 		--disable-tcl \
+		$(if $(BR2_PACKAGE_LINUX_PAM),--enable-dbm,--disable-dbm) \
 		--disable-compat185 \
 		$(SHARED_STATIC_LIBS_OPTS) \
 		--with-pic \
-- 
1.7.2.5

[Buildroot] [PATCH 2/4] Make Berkeley DB a dependency of linux-pam and make sure it is selected

[Dmitry]

The pam_userdb module is used to verify a username/password pair
against values stored in a Berkeley DB database. The database is
indexed by the username, and the data fields corresponding to the
username keys are the passwords (from man 8 pam_userdb).

Signed-off-by: Dmitry <golubovsky@gmail.com>
---
 package/linux-pam/Config.in    |    1 +
 package/linux-pam/linux-pam.mk |    2 +-
 2 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/package/linux-pam/Config.in b/package/linux-pam/Config.in
index 722b875..65e7b69 100644
--- a/package/linux-pam/Config.in
+++ b/package/linux-pam/Config.in
@@ -4,6 +4,7 @@ config BR2_PACKAGE_LINUX_PAM
 	select BR2_PACKAGE_GETTEXT if BR2_NEEDS_GETTEXT_IF_LOCALE
 	select BR2_PACKAGE_FLEX
 	select BR2_PACKAGE_FLEX_LIBFL
+	select BR2_PACKAGE_BERKELEYDB
 	depends on (BR2_ENABLE_LOCALE && BR2_USE_WCHAR)
 	help
 	  A Security Framework that Provides Authentication for Applications
diff --git a/package/linux-pam/linux-pam.mk b/package/linux-pam/linux-pam.mk
index 48cb073..5e0ecf0 100644
--- a/package/linux-pam/linux-pam.mk
+++ b/package/linux-pam/linux-pam.mk
@@ -15,7 +15,7 @@ LINUX_PAM_CONF_OPT = \
 	--disable-regenerate-docu \
 	--enable-securedir=/lib/security \
 	--libdir=/lib
-LINUX_PAM_DEPENDENCIES = $(if $(BR2_NEEDS_GETTEXT_IF_LOCALE),gettext libintl) flex
+LINUX_PAM_DEPENDENCIES = $(if $(BR2_NEEDS_GETTEXT_IF_LOCALE),gettext libintl) flex berkeleydb
 LINUX_PAM_AUTORECONF = YES
 LINUX_PAM_LICENSE = BSD-3c
 LINUX_PAM_LICENSE_FILES = Copyright
-- 
1.7.2.5

[Buildroot] [PATCH 3/4] Provide PAM default configuration files when building linux-pam package

[Dmitry]

Signed-off-by: Dmitry <golubovsky@gmail.com>
---
 package/linux-pam/default      |    8 ++++++++
 package/linux-pam/linux-pam.mk |    7 +++++++
 package/linux-pam/login        |    9 +++++++++
 3 files changed, 24 insertions(+), 0 deletions(-)
 create mode 100644 package/linux-pam/default
 create mode 100644 package/linux-pam/login

diff --git a/package/linux-pam/default b/package/linux-pam/default
new file mode 100644
index 0000000..0bd5ba0
--- /dev/null
+++ b/package/linux-pam/default
@@ -0,0 +1,8 @@
+#
+# default; standard UN*X access
+#
+auth     required       pam_unix.so
+account  required       pam_unix.so
+password required       pam_unix.so
+session  required       pam_unix.so
+
diff --git a/package/linux-pam/linux-pam.mk b/package/linux-pam/linux-pam.mk
index 5e0ecf0..8ab3a97 100644
--- a/package/linux-pam/linux-pam.mk
+++ b/package/linux-pam/linux-pam.mk
@@ -24,4 +24,11 @@ ifeq ($(BR2_PACKAGE_LIBINTL),y)
 	LINUX_PAM_MAKE_OPT += LIBS=-lintl
 endif
 
+define LINUX_PAM_CONFFILES
+	$(INSTALL) -D -m 0644 package/linux-pam/default $(TARGET_DIR)/etc/pam.d/default
+	$(INSTALL) -D -m 0644 package/linux-pam/login $(TARGET_DIR)/etc/pam.d/login
+endef
+
+LINUX_PAM_POST_INSTALL_TARGET_HOOKS += LINUX_PAM_CONFFILES
+
 $(eval $(autotools-package))
diff --git a/package/linux-pam/login b/package/linux-pam/login
new file mode 100644
index 0000000..d65a9d4
--- /dev/null
+++ b/package/linux-pam/login
@@ -0,0 +1,9 @@
+#
+# login: allow local logins to users with entries in /etc/passwd and
+# /etc/shadow even with null password
+#
+auth      required       pam_unix.so nullok
+account   required       pam_unix.so nullok
+password  required       pam_unix.so nullok
+session   required       pam_unix.so nullok
+
-- 
1.7.2.5

[Buildroot] [PATCH 4/4] PAM support in Busybox if linux-pam is built

[Dmitry]

Signed-off-by: Dmitry <golubovsky@gmail.com>
---
 package/busybox/Config.in  |   15 +++++++++++++++
 package/busybox/busybox.mk |   12 ++++++++++++
 2 files changed, 27 insertions(+), 0 deletions(-)

diff --git a/package/busybox/Config.in b/package/busybox/Config.in
index dedcf18..21ff3fb 100644
--- a/package/busybox/Config.in
+++ b/package/busybox/Config.in
@@ -62,6 +62,21 @@ config BR2_PACKAGE_BUSYBOX_WATCHDOG
 	  Install the watchdog daemon startup script,
 	  that just start at the boot the busybox watchdog daemon.
 
+config BR2_PACKAGE_BUSYBOX_PAM
+	bool "Enable PAM support in Busybox"
+	default n
+	depends on BR2_PACKAGE_LINUX_PAM
+	help
+	  If this item is selected, Busybox login will use the PAM stack
+	  for local logins. Local logins with null password are allowed
+	  for users with records in /etc/passwd ("default" and "root") 
+	  per the /etc/pam.d/login file.
+	  The default PAM configuration file /etc/pam.d/default requires 
+	  user accounts with nonzero length passwords.
+	  These files are provided by the linux-pam package. Buildroot
+	  users opting to use PAM are strongly advised to supply their
+	  own PAM configuration files for proper authentication model.
+
 if BR2_PACKAGE_BUSYBOX_WATCHDOG
 
 config BR2_PACKAGE_BUSYBOX_WATCHDOG_PERIOD
diff --git a/package/busybox/busybox.mk b/package/busybox/busybox.mk
index 33f8633..21942c6 100644
--- a/package/busybox/busybox.mk
+++ b/package/busybox/busybox.mk
@@ -164,6 +164,17 @@ define BUSYBOX_INSTALL_WATCHDOG_SCRIPT
 endef
 endif
 
+ifeq ($(BR2_PACKAGE_BUSYBOX_PAM),y)
+BUSYBOX_DEPENDENCIES += linux-pam
+define BUSYBOX_ENABLE_PAM
+	$(call KCONFIG_ENABLE_OPT,CONFIG_PAM,$(BUSYBOX_BUILD_CONFIG))
+endef
+else
+define BUSYBOX_ENABLE_PAM
+	$(call KCONFIG_DISABLE_OPT,CONFIG_PAM,$(BUSYBOX_BUILD_CONFIG))
+endef
+endif
+
 # We do this here to avoid busting a modified .config in configure
 BUSYBOX_POST_EXTRACT_HOOKS += BUSYBOX_COPY_CONFIG
 
@@ -179,6 +190,7 @@ define BUSYBOX_CONFIGURE_CMDS
 	$(BUSYBOX_DISABLE_MMU_APPLETS)
 	$(BUSYBOX_SET_INIT)
 	$(BUSYBOX_SET_WATCHDOG)
+	$(BUSYBOX_ENABLE_PAM)
 	@yes "" | $(MAKE) ARCH=$(KERNEL_ARCH) CROSS_COMPILE="$(TARGET_CROSS)" \
 		-C $(@D) oldconfig
 endef
-- 
1.7.2.5

[Buildroot] [PATCH 1/4] If linux-pam is built, enable dbm functionality in Berkeley DB

[Thomas Petazzoni]

Le Sat,  8 Sep 2012 00:21:03 -0400,
Dmitry <golubovsky@gmail.com> a ?crit :

> +		$(if $(BR2_PACKAGE_LINUX_PAM),--enable-dbm,--disable-dbm) \

I don't really like this. I think you should rather add a configuration
sub-option in package/berkeleydb/Config.in to enable/disable DBM
support, and then have berkeleydb.mk test this configuration option,
and the linux-pam/Config.in package select it.

I don't like when one package recipe pokes into the configuration
options of another package.

Best regards,

Thomas
-- 
Thomas Petazzoni, Free Electrons
Kernel, drivers, real-time and embedded Linux
development, consulting, training and support.
http://free-electrons.com

[Buildroot] [PATCH 2/4] Make Berkeley DB a dependency of linux-pam and make sure it is selected

[Thomas Petazzoni]

Le Sat,  8 Sep 2012 00:21:04 -0400,
Dmitry <golubovsky@gmail.com> a ?crit :

> -LINUX_PAM_DEPENDENCIES = $(if $(BR2_NEEDS_GETTEXT_IF_LOCALE),gettext libintl) flex
> +LINUX_PAM_DEPENDENCIES = $(if $(BR2_NEEDS_GETTEXT_IF_LOCALE),gettext libintl) flex berkeleydb

Looking at the code, the dependency indeed looks necessary. But isn't
it possible to rework a bit linux-pam to make this dependency optional
(and then submit this upstream)? Of course, if you don't care about
making this dependency optional, then just keep it as it is.

Best regards,

Thomas
-- 
Thomas Petazzoni, Free Electrons
Kernel, drivers, real-time and embedded Linux
development, consulting, training and support.
http://free-electrons.com

[Buildroot] [PATCH 2/4] Make Berkeley DB a dependency of linux-pam and make sure it is selected

[Dmitry Golubovsky]

Thomas,

On Tue, Sep 11, 2012 at 10:32 AM, Thomas Petazzoni
<thomas.petazzoni@free-electrons.com> wrote:
> Le Sat,  8 Sep 2012 00:21:04 -0400,
> Dmitry <golubovsky@gmail.com> a ?crit :
>
>> -LINUX_PAM_DEPENDENCIES = $(if $(BR2_NEEDS_GETTEXT_IF_LOCALE),gettext libintl) flex
>> +LINUX_PAM_DEPENDENCIES = $(if $(BR2_NEEDS_GETTEXT_IF_LOCALE),gettext libintl) flex berkeleydb
>
> Looking at the code, the dependency indeed looks necessary. But isn't
> it possible to rework a bit linux-pam to make this dependency optional
> (and then submit this upstream)? Of course, if you don't care about
> making this dependency optional, then just keep it as it is.

I don't think such change in linux-pam is really needed. I'd keep it
here given the fix is trivial, and BerkeleyDB is not a huge library.

Thanks.

-- 
Dmitry Golubovsky

Anywhere on the Web

[Buildroot] [PATCH 2/4] Make Berkeley DB a dependency of linux-pam and make sure it is selected

[Thomas Petazzoni]

Le Tue, 11 Sep 2012 10:44:03 -0400,
Dmitry Golubovsky <golubovsky@gmail.com> a ?crit :

> > Looking at the code, the dependency indeed looks necessary. But isn't
> > it possible to rework a bit linux-pam to make this dependency optional
> > (and then submit this upstream)? Of course, if you don't care about
> > making this dependency optional, then just keep it as it is.
> 
> I don't think such change in linux-pam is really needed. I'd keep it
> here given the fix is trivial, and BerkeleyDB is not a huge library.

Ok, fine with me.

Thomas
-- 
Thomas Petazzoni, Free Electrons
Kernel, drivers, real-time and embedded Linux
development, consulting, training and support.
http://free-electrons.com

[Buildroot] [PATCH 1/4] If linux-pam is built, enable dbm functionality in Berkeley DB

[Dmitry Golubovsky]

Thomas,

On Tue, Sep 11, 2012 at 10:32 AM, Thomas Petazzoni
<thomas.petazzoni@free-electrons.com> wrote:
> Le Sat,  8 Sep 2012 00:21:03 -0400,
> Dmitry <golubovsky@gmail.com> a ?crit :
>
>> +             $(if $(BR2_PACKAGE_LINUX_PAM),--enable-dbm,--disable-dbm) \
>
> I don't really like this. I think you should rather add a configuration
> sub-option in package/berkeleydb/Config.in to enable/disable DBM
> support, and then have berkeleydb.mk test this configuration option,
> and the linux-pam/Config.in package select it.

Well, adding extra config options is what I really wanted to avoid.
But this may be just my way of thinking.

> I don't like when one package recipe pokes into the configuration
> options of another package.

It is not a problem to add such configuration item, I'll do it.

Thanks.

-- 
Dmitry Golubovsky

Anywhere on the Web

[Buildroot] [PATCH 2/4] Make Berkeley DB a dependency of linux-pam and make sure it is selected

[Arnout Vandecappelle]

On 09/08/12 06:21, Dmitry wrote:
> The pam_userdb module is used to verify a username/password pair
> against values stored in a Berkeley DB database. The database is
> indexed by the username, and the data fields corresponding to the
> username keys are the passwords (from man 8 pam_userdb).

  There is a patch on the list that introduces gdbm.  Do you think that could
be an alternative for berkeleydb?

  Regards,
  Arnout
-- 
Arnout Vandecappelle                               arnout at mind be
Senior Embedded Software Architect                 +32-16-286540
Essensium/Mind                                     http://www.mind.be
G.Geenslaan 9, 3001 Leuven, Belgium                BE 872 984 063 RPR Leuven
LinkedIn profile: http://www.linkedin.com/in/arnoutvandecappelle
GPG fingerprint:  7CB5 E4CC 6C2E EFD4 6E3D A754 F963 ECAB 2450 2F1F

[Buildroot] [PATCH 2/4] Make Berkeley DB a dependency of linux-pam and make sure it is selected

[Dmitry Golubovsky]

Arnout,

On Tue, Sep 11, 2012 at 3:18 PM, Arnout Vandecappelle <arnout@mind.be> wrote:
> On 09/08/12 06:21, Dmitry wrote:
>>
>> The pam_userdb module is used to verify a username/password pair
>> against values stored in a Berkeley DB database. The database is
>> indexed by the username, and the data fields corresponding to the
>> username keys are the passwords (from man 8 pam_userdb).
>
>
>  There is a patch on the list that introduces gdbm.  Do you think that could
> be an alternative for berkeleydb?

I'm not sure. We'll need a choice of configurations then, whether to
use gdbm or berkeleyDB for linux-pam. What if both are selected in
menuconfig?

BerkeleyDB is much more advanced than GDBM, IMHO. One might prefer
GDBM over Berkeley DB because of license perhaps, but otherwise why?

If we want to implement it further, here's the possible logic:

PAM's configure.in shows that there may be variants in --enable-db
options. which means the logic would be:

1. See if Berkeley or GDBM is selected. If none, disable pam_userdb in
PAM --enable-db=no
2. If Berkeley is selected, enable dbm in it and specify proper option
in --enable-db=ndbm (I guess)
3. If GDBM is selected, specify proper option in --enable-db=db (again
I guess, maybe other way around)
4. If both are selected? there is an option --enable-db=yes which lets
PAM decide by itself, then dbm should be enabled in BerkeleyDB anyway
(it seems like configure only looks at headers*)

Does anybody disagree with such logic?

Plus, the database selected for PAM should become a PAM dependency.
Which we cannot tell unless we have a configure choice for the
database in PAM, but this turns the above logic upside down: PAM now
drives the database selection.

Or we can make both databases, if selected, dependencies of PAM - at
worst this only affects the building order.

And what is the status of the GDBM patch?

Thanks.

------------------------
* as in the failed autobuilder case, PAM's configure decided to build
pam_userdb if BerkeleyDB was selected (headers were present) even
though dbm was not enabled in it - linkage test was not done.

-- 
Dmitry Golubovsky

Anywhere on the Web

[Buildroot] [PATCH 2/4] Make Berkeley DB a dependency of linux-pam and make sure it is selected

[Arnout Vandecappelle]

On 09/11/12 21:52, Dmitry Golubovsky wrote:
> Arnout,
>
> On Tue, Sep 11, 2012 at 3:18 PM, Arnout Vandecappelle<arnout@mind.be>  wrote:
>> On 09/08/12 06:21, Dmitry wrote:
>>>
>>> The pam_userdb module is used to verify a username/password pair
>>> against values stored in a Berkeley DB database. The database is
>>> indexed by the username, and the data fields corresponding to the
>>> username keys are the passwords (from man 8 pam_userdb).
>>
>>
>>   There is a patch on the list that introduces gdbm.  Do you think that could
>> be an alternative for berkeleydb?
>
> I'm not sure. We'll need a choice of configurations then, whether to
> use gdbm or berkeleyDB for linux-pam. What if both are selected in
> menuconfig?

  I meant: maybe that's a simpler dependency than a specially-configured
berkeleydb.


> BerkeleyDB is much more advanced than GDBM, IMHO. One might prefer
> GDBM over Berkeley DB because of license perhaps, but otherwise why?
>
> If we want to implement it further, here's the possible logic:
>
> PAM's configure.in shows that there may be variants in --enable-db
> options. which means the logic would be:
>
> 1. See if Berkeley or GDBM is selected. If none, disable pam_userdb in
> PAM --enable-db=no
> 2. If Berkeley is selected, enable dbm in it and specify proper option
> in --enable-db=ndbm (I guess)
> 3. If GDBM is selected, specify proper option in --enable-db=db (again
> I guess, maybe other way around)
> 4. If both are selected? there is an option --enable-db=yes which lets
> PAM decide by itself, then dbm should be enabled in BerkeleyDB anyway
> (it seems like configure only looks at headers*)
>
> Does anybody disagree with such logic?

  Looks good.  Although there should probably be a third config symbol
to simplify the logic - but we don't even have that yet for xml2/expat.


> Plus, the database selected for PAM should become a PAM dependency.
> Which we cannot tell unless we have a configure choice for the
> database in PAM, but this turns the above logic upside down: PAM now
> drives the database selection.
>
> Or we can make both databases, if selected, dependencies of PAM - at
> worst this only affects the building order.

  Yep, that's the way to do it.


> And what is the status of the GDBM patch?

  It's a bit hidden in the perl series, but I just acked it.

>
> Thanks.
>
> ------------------------
> * as in the failed autobuilder case, PAM's configure decided to build
> pam_userdb if BerkeleyDB was selected (headers were present) even
> though dbm was not enabled in it - linkage test was not done.

  Since these patches are still under review, maybe it's best to first
commit an individual patch that just does --disable-db ?  Can you do
that and check if it fixes the autobuilder issue?

  Regards,
  Arnout
-- 
Arnout Vandecappelle                               arnout at mind be
Senior Embedded Software Architect                 +32-16-286540
Essensium/Mind                                     http://www.mind.be
G.Geenslaan 9, 3001 Leuven, Belgium                BE 872 984 063 RPR Leuven
LinkedIn profile: http://www.linkedin.com/in/arnoutvandecappelle
GPG fingerprint:  7CB5 E4CC 6C2E EFD4 6E3D A754 F963 ECAB 2450 2F1F

[Buildroot] [PATCH 2/4] Make Berkeley DB a dependency of linux-pam and make sure it is selected

[Dmitry Golubovsky]

Arnout,

On Wed, Sep 12, 2012 at 1:31 AM, Arnout Vandecappelle <arnout@mind.be> wrote:

>
>  Since these patches are still under review, maybe it's best to first
> commit an individual patch that just does --disable-db ?  Can you do
> that and check if it fixes the autobuilder issue?
>

I have just submitted such patch. Let's see how autobuilder results
change. In my test linux-pam compiled without pam_userdb.so, and
berkeleydb was selected in menuconfig.

Thanks.

-- 
Dmitry Golubovsky

Anywhere on the Web