Raphael Pavlidis
b95ffe208b
This commit backports an upstream patch fixing CVE-2024-10963. See: https://github.com/linux-pam/linux-pam/issues/834 https://github.com/linux-pam/linux-pam/pull/854 Fixes: - CVE-2024-10963: Pam: improper hostname interpretation in pam_access leads to access control bypass A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who can access certain services or terminals. https://www.cve.org/CVERecord?id=CVE-2024-10963 Signed-off-by: Raphael Pavlidis <raphael.pavlidis@gmail.com> [Julien: - fix check-package errors - add info in commit log - rebase patch on v1.6.1 to avoid patch offsets - add "CVE:" tag in patch - add comment with patch name near _IGNORE_CVES in .mk ] Signed-off-by: Julien Olivain <ju.o@free.fr>
83 lines
2.3 KiB
Makefile
83 lines
2.3 KiB
Makefile
################################################################################
|
|
#
|
|
# linux-pam
|
|
#
|
|
################################################################################
|
|
|
|
LINUX_PAM_VERSION = 1.6.1
|
|
LINUX_PAM_SOURCE = Linux-PAM-$(LINUX_PAM_VERSION).tar.xz
|
|
LINUX_PAM_SITE = https://github.com/linux-pam/linux-pam/releases/download/v$(LINUX_PAM_VERSION)
|
|
LINUX_PAM_INSTALL_STAGING = YES
|
|
LINUX_PAM_CONF_OPTS = \
|
|
--disable-prelude \
|
|
--disable-isadir \
|
|
--disable-nis \
|
|
--disable-db \
|
|
--disable-regenerate-docu \
|
|
--enable-securedir=/lib/security \
|
|
--libdir=/lib
|
|
LINUX_PAM_DEPENDENCIES = host-flex host-pkgconf \
|
|
$(if $(BR2_PACKAGE_LIBXCRYPT),libxcrypt) \
|
|
$(TARGET_NLS_DEPENDENCIES)
|
|
LINUX_PAM_LICENSE = BSD-3-Clause
|
|
LINUX_PAM_LICENSE_FILES = Copyright
|
|
LINUX_PAM_LIBS = $(TARGET_NLS_LIBS)
|
|
LINUX_PAM_MAKE_OPTS += LIBS="$(LINUX_PAM_LIBS)"
|
|
LINUX_PAM_CPE_ID_VENDOR = linux-pam
|
|
|
|
# 0002-pam_access-rework-resolving-of-tokens-as-hostname.patch
|
|
LINUX_PAM_IGNORE_CVES += CVE-2024-10963
|
|
|
|
ifeq ($(BR2_TOOLCHAIN_HAS_LIBATOMIC),y)
|
|
LINUX_PAM_LIBS += -latomic
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBSELINUX),y)
|
|
LINUX_PAM_CONF_OPTS += --enable-selinux
|
|
LINUX_PAM_DEPENDENCIES += libselinux
|
|
define LINUX_PAM_SELINUX_PAMFILE_TWEAK
|
|
$(SED) 's/^# \(.*pam_selinux.so.*\)$$/\1/' \
|
|
$(TARGET_DIR)/etc/pam.d/login
|
|
endef
|
|
else
|
|
LINUX_PAM_CONF_OPTS += --disable-selinux
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_AUDIT),y)
|
|
LINUX_PAM_CONF_OPTS += --enable-audit
|
|
LINUX_PAM_DEPENDENCIES += audit
|
|
else
|
|
LINUX_PAM_CONF_OPTS += --disable-audit
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_OPENSSL),y)
|
|
LINUX_PAM_CONF_OPTS += --enable-openssl
|
|
LINUX_PAM_DEPENDENCIES += openssl
|
|
else
|
|
LINUX_PAM_CONF_OPTS += --disable-openssl
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_LINUX_PAM_LASTLOG),y)
|
|
LINUX_PAM_CONF_OPTS += --enable-lastlog
|
|
define LINUX_PAM_LASTLOG_PAMFILE_TWEAK
|
|
$(SED) 's/^# \(.*pam_lastlog.so.*\)$$/\1/' \
|
|
$(TARGET_DIR)/etc/pam.d/login
|
|
endef
|
|
else
|
|
LINUX_PAM_CONF_OPTS += --disable-lastlog
|
|
endif
|
|
|
|
# Install default pam config (deny everything except login)
|
|
define LINUX_PAM_INSTALL_CONFIG
|
|
$(INSTALL) -m 0644 -D package/linux-pam/login.pam \
|
|
$(TARGET_DIR)/etc/pam.d/login
|
|
$(INSTALL) -m 0644 -D package/linux-pam/other.pam \
|
|
$(TARGET_DIR)/etc/pam.d/other
|
|
$(LINUX_PAM_LASTLOG_PAMFILE_TWEAK)
|
|
$(LINUX_PAM_SELINUX_PAMFILE_TWEAK)
|
|
endef
|
|
|
|
LINUX_PAM_POST_INSTALL_TARGET_HOOKS += LINUX_PAM_INSTALL_CONFIG
|
|
|
|
$(eval $(autotools-package))
|