packages/pam
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

backport patch libpam use close_range() to close file descriptors

Browse Source
This commit is contained in:
hugel 2025-03-24 16:16:50 +08:00
parent b9f52c02ce
commit dca3fb442d
2 changed files with 88 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

83
backport-libpam-use-close_range-to-close-file-descriptors.patch Normal file
View File

@ -0,0 +1,83 @@
From d6103b30050554d7b6ca6d55cb5b4ed3c9516663 Mon Sep 17 00:00:00 2001
From: Iker Pedrosa <ipedrosa@redhat.com>
Date: Wed, 25 Oct 2023 09:46:15 +0200
Subject: [PATCH] libpam: use close_range() to close file descriptors
* configure.ac: check whether close_range() is available in the system.
* libpam/pam_modutil_sanitize.c: use close_range() to close all file
descriptors. If the interface isn't available use the previous
approach.
Link: https://github.com/linux-pam/linux-pam/pull/276
Resolves: https://issues.redhat.com/browse/RHEL-5099
Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
Conflict:NA
Reference:https://github.com/linux-pam/linux-pam/commit/d6103b30050554d7b6ca6d55cb5b4ed3c9516663
---
configure.ac | 1 +
libpam/pam_modutil_sanitize.c | 19 +++++++++++++++++--
2 files changed, 18 insertions(+), 2 deletions(-)
diff --git a/configure.ac b/configure.ac
index 39124d87..b6a8d6fb 100644
--- a/configure.ac
+++ b/configure.ac
@@ -638,6 +638,7 @@ AC_CHECK_FUNCS(quotactl)
AC_CHECK_FUNCS(unshare)
AC_CHECK_FUNCS(explicit_bzero memset_explicit)
AC_CHECK_FUNCS([ruserok_af ruserok], [break])
+AC_CHECK_FUNCS(close_range)
AC_ARG_ENABLE([regenerate-docu],
AS_HELP_STRING([--disable-regenerate-docu],[Don't re-build documentation from XML sources]),
diff --git a/libpam/pam_modutil_sanitize.c b/libpam/pam_modutil_sanitize.c
index f26e8ec0..1b8af743 100644
--- a/libpam/pam_modutil_sanitize.c
+++ b/libpam/pam_modutil_sanitize.c
@@ -11,6 +11,10 @@
#include <syslog.h>
#include <sys/resource.h>
+#ifndef CLOSE_RANGE_UNSHARE
+#define CLOSE_RANGE_UNSHARE (1U << 1)
+#endif /* CLOSE_RANGE_UNSHARE */
+
/*
* Creates a pipe, closes its write end, redirects fd to its read end.
* Returns fd on success, -1 otherwise.
@@ -84,9 +88,8 @@ redirect_out(pam_handle_t *pamh, enum pam_modutil_redirect_fd mode,
return fd;
}
-/* Closes all descriptors after stderr. */
static void
-close_fds(void)
+close_fds_iteratively(void)
{
/*
* An arbitrary upper limit for the maximum file descriptor number
@@ -111,6 +114,18 @@ close_fds(void)
close(fd);
}
+/* Closes all descriptors after stderr. */
+static void
+close_fds(void)
+{
+#ifdef HAVE_CLOSE_RANGE
+ if (close_range(STDERR_FILENO+1, -1U, CLOSE_RANGE_UNSHARE) == 0)
+ return;
+#endif /* HAVE_CLOSE_RANGE */
+
+ close_fds_iteratively();
+}
+
int
pam_modutil_sanitize_helper_fds(pam_handle_t *pamh,
enum pam_modutil_redirect_fd stdin_mode,
--
2.33.0

6
pam.spec
View File

@ -4,7 +4,7 @@
%define _pamconfdir %{_sysconfdir}/pam.d
Name: pam
Version: 1.5.3
Release: 7
Release: 8
Summary: Pluggable Authentication Modules for Linux
License: BSD and GPLv2+
URL: http://www.linux-pam.org/
@ -27,6 +27,7 @@ Patch4: backport-pam_access-make-non-resolveable-hostname-a-debug-out.patch
Patch5: backport-CVE-2024-10963.patch
Patch6: backport-CVE-2024-10041.patch
Patch7: backport-CVE-2024-10041-pam_unix-try-to-set-uid-to-0-for-unix_chkpwd.patch
Patch8: backport-libpam-use-close_range-to-close-file-descriptors.patch
Patch9000:change-ndbm-to-gdbm.patch
Patch9001:add-sm3-crypt-support.patch
@ -181,6 +182,9 @@ make check
%changelog
* Mon Mar 24 2025 hugel <gengqihu2@h-partners.com> - 1.5.3-8
- backport patch libpam use close_range() to close file descriptors
* Fri Dec 27 2024 dongyuzhen <dongyuzhen@h-partners.com> - 1.5.3-7
- fix tst-pam_unix5 test case failure