[PATCH 0/1] libpam: Setting suid bit for unix_chkpwd

[PATCH 0/1] libpam: Setting suid bit for unix_chkpwd

[wenzong.fan]

From: Wenzong Fan <wenzong.fan@windriver.com>

Fix for [yocto #1252]

The crontab can't be run by a normal user while pam enabled for it, the real
issue is unix_chkpwd can't access shadow file with normal permission on lsb
images, set suid bit for unix_chkpwd would be fix this issue.

The following changes since commit 36396b6ecb0c84c6752cdc8118c496e8ec05a388:
  Richard Purdie (1):
        xcb/libpthreads: Add BBCLASSEXTEND to resolve missing providers in world builds

are available in the git repository at:

  git://git.pokylinux.org/poky-contrib wenzong/1252
  http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=wenzong/1252

Wenzong Fan (1):
  libpam: Setting suid bit for unix_chkpwd

 meta/recipes-extended/pam/libpam_1.1.4.bb |    8 +++++++-
 1 files changed, 7 insertions(+), 1 deletions(-)

[PATCH 1/1] libpam: Setting suid bit for unix_chkpwd

[wenzong.fan]

From: Wenzong Fan <wenzong.fan@windriver.com>

[YOCTO #1252]

While pam_unix.so required by an application on lsb image, it will need to
call the unix_chkpwd to get userinfo from shadow file. This fix get a normal
user could read shadow file via unix_chkpwd.

Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
---
 meta/recipes-extended/pam/libpam_1.1.4.bb |    8 +++++++-
 1 files changed, 7 insertions(+), 1 deletions(-)

diff --git a/meta/recipes-extended/pam/libpam_1.1.4.bb b/meta/recipes-extended/pam/libpam_1.1.4.bb
index ae20a97..ca54bd8 100644
--- a/meta/recipes-extended/pam/libpam_1.1.4.bb
+++ b/meta/recipes-extended/pam/libpam_1.1.4.bb
@@ -9,7 +9,7 @@ SECTION = "base"
 LICENSE = "GPLv2+ | BSD"
 LIC_FILES_CHKSUM = "file://COPYING;md5=ca0395de9a86191a078b8b79302e3083"
 
-PR = "r1"
+PR = "r2"
 
 DEPENDS = "bison flex cracklib"
 RDEPENDS_${PN}-runtime = "libpam pam-plugin-deny pam-plugin-permit pam-plugin-warn pam-plugin-unix"
@@ -85,3 +85,9 @@ do_install() {
 	install -d ${D}${sysconfdir}/pam.d/     
 	install -m 0644 ${WORKDIR}/pam.d/* ${D}${sysconfdir}/pam.d/
 }
+
+pkg_postinst_pam-plugin-unix () {
+    # below is necessary to allow unix_chkpwd get user info from shadow file
+    # on lsb images
+    chmod 4755 /usr/sbin/unix_chkpwd
+}
-- 
1.7.0.4

Re: [PATCH 1/1] libpam: Setting suid bit for unix_chkpwd

[Khem Raj]

On 8/20/2011 12:58 AM, wenzong.fan@windriver.com wrote:
> From: Wenzong Fan<wenzong.fan@windriver.com>
>
> [YOCTO #1252]
>
> While pam_unix.so required by an application on lsb image, it will need to
> call the unix_chkpwd to get userinfo from shadow file. This fix get a normal
> user could read shadow file via unix_chkpwd.
>
> Signed-off-by: Wenzong Fan<wenzong.fan@windriver.com>
> ---
>   meta/recipes-extended/pam/libpam_1.1.4.bb |    8 +++++++-
>   1 files changed, 7 insertions(+), 1 deletions(-)
>
> diff --git a/meta/recipes-extended/pam/libpam_1.1.4.bb b/meta/recipes-extended/pam/libpam_1.1.4.bb
> index ae20a97..ca54bd8 100644
> --- a/meta/recipes-extended/pam/libpam_1.1.4.bb
> +++ b/meta/recipes-extended/pam/libpam_1.1.4.bb
> @@ -9,7 +9,7 @@ SECTION = "base"
>   LICENSE = "GPLv2+ | BSD"
>   LIC_FILES_CHKSUM = "file://COPYING;md5=ca0395de9a86191a078b8b79302e3083"
>
> -PR = "r1"
> +PR = "r2"
>
>   DEPENDS = "bison flex cracklib"
>   RDEPENDS_${PN}-runtime = "libpam pam-plugin-deny pam-plugin-permit pam-plugin-warn pam-plugin-unix"
> @@ -85,3 +85,9 @@ do_install() {
>   	install -d ${D}${sysconfdir}/pam.d/
>   	install -m 0644 ${WORKDIR}/pam.d/* ${D}${sysconfdir}/pam.d/
>   }
> +
> +pkg_postinst_pam-plugin-unix () {
> +    # below is necessary to allow unix_chkpwd get user info from shadow file
> +    # on lsb images
> +    chmod 4755 /usr/sbin/unix_chkpwd

may be its better to use corresponding metadata variables instead of 
hardcoding /usr/sbin here

> +}

Re: [PATCH 1/1] libpam: Setting suid bit for unix_chkpwd

[Scott Garman]

On 08/20/2011 09:05 AM, Khem Raj wrote:
> On 8/20/2011 12:58 AM, wenzong.fan@windriver.com wrote:
>> From: Wenzong Fan<wenzong.fan@windriver.com>
>>
>> [YOCTO #1252]
>>
>> While pam_unix.so required by an application on lsb image, it will
>> need to
>> call the unix_chkpwd to get userinfo from shadow file. This fix get a
>> normal
>> user could read shadow file via unix_chkpwd.
>>
>> Signed-off-by: Wenzong Fan<wenzong.fan@windriver.com>
>> ---
>> meta/recipes-extended/pam/libpam_1.1.4.bb | 8 +++++++-
>> 1 files changed, 7 insertions(+), 1 deletions(-)
>>
>> diff --git a/meta/recipes-extended/pam/libpam_1.1.4.bb
>> b/meta/recipes-extended/pam/libpam_1.1.4.bb
>> index ae20a97..ca54bd8 100644
>> --- a/meta/recipes-extended/pam/libpam_1.1.4.bb
>> +++ b/meta/recipes-extended/pam/libpam_1.1.4.bb
>> @@ -9,7 +9,7 @@ SECTION = "base"
>> LICENSE = "GPLv2+ | BSD"
>> LIC_FILES_CHKSUM = "file://COPYING;md5=ca0395de9a86191a078b8b79302e3083"
>>
>> -PR = "r1"
>> +PR = "r2"
>>
>> DEPENDS = "bison flex cracklib"
>> RDEPENDS_${PN}-runtime = "libpam pam-plugin-deny pam-plugin-permit
>> pam-plugin-warn pam-plugin-unix"
>> @@ -85,3 +85,9 @@ do_install() {
>> install -d ${D}${sysconfdir}/pam.d/
>> install -m 0644 ${WORKDIR}/pam.d/* ${D}${sysconfdir}/pam.d/
>> }
>> +
>> +pkg_postinst_pam-plugin-unix () {
>> + # below is necessary to allow unix_chkpwd get user info from shadow
>> file
>> + # on lsb images
>> + chmod 4755 /usr/sbin/unix_chkpwd
>
> may be its better to use corresponding metadata variables instead of
> hardcoding /usr/sbin here

With Khem's recommended tweak:

Acked-by: Scott Garman <scott.a.garman@intel.com>

-- 
Scott Garman
Embedded Linux Engineer - Yocto Project
Intel Open Source Technology Center

Re: [PATCH 1/1] libpam: Setting suid bit for unix_chkpwd

[wenzong fan]

On 08/22/2011 10:30 AM, Scott Garman wrote:
> On 08/20/2011 09:05 AM, Khem Raj wrote:
>> On 8/20/2011 12:58 AM, wenzong.fan@windriver.com wrote:
>>> From: Wenzong Fan<wenzong.fan@windriver.com>
>>>
>>> [YOCTO #1252]
>>>
>>> While pam_unix.so required by an application on lsb image, it will
>>> need to
>>> call the unix_chkpwd to get userinfo from shadow file. This fix get a
>>> normal
>>> user could read shadow file via unix_chkpwd.
>>>
>>> Signed-off-by: Wenzong Fan<wenzong.fan@windriver.com>
>>> ---
>>> meta/recipes-extended/pam/libpam_1.1.4.bb | 8 +++++++-
>>> 1 files changed, 7 insertions(+), 1 deletions(-)
>>>
>>> diff --git a/meta/recipes-extended/pam/libpam_1.1.4.bb
>>> b/meta/recipes-extended/pam/libpam_1.1.4.bb
>>> index ae20a97..ca54bd8 100644
>>> --- a/meta/recipes-extended/pam/libpam_1.1.4.bb
>>> +++ b/meta/recipes-extended/pam/libpam_1.1.4.bb
>>> @@ -9,7 +9,7 @@ SECTION = "base"
>>> LICENSE = "GPLv2+ | BSD"
>>> LIC_FILES_CHKSUM = 
>>> "file://COPYING;md5=ca0395de9a86191a078b8b79302e3083"
>>>
>>> -PR = "r1"
>>> +PR = "r2"
>>>
>>> DEPENDS = "bison flex cracklib"
>>> RDEPENDS_${PN}-runtime = "libpam pam-plugin-deny pam-plugin-permit
>>> pam-plugin-warn pam-plugin-unix"
>>> @@ -85,3 +85,9 @@ do_install() {
>>> install -d ${D}${sysconfdir}/pam.d/
>>> install -m 0644 ${WORKDIR}/pam.d/* ${D}${sysconfdir}/pam.d/
>>> }
>>> +
>>> +pkg_postinst_pam-plugin-unix () {
>>> + # below is necessary to allow unix_chkpwd get user info from shadow
>>> file
>>> + # on lsb images
>>> + chmod 4755 /usr/sbin/unix_chkpwd
>>
>> may be its better to use corresponding metadata variables instead of
>> hardcoding /usr/sbin here
>
> With Khem's recommended tweak:

Good point, patch v2 will be sent with this updates.

Thanks
Wenzong
>
> Acked-by: Scott Garman <scott.a.garman@intel.com>
>