From nobody Fri Jun 24 09:35:19 2022 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 5A88E87278F; Fri, 24 Jun 2022 09:35:19 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4LTsRW27zNz3McZ; Fri, 24 Jun 2022 09:35:19 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1656063319; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=LaV4Z1uyzOu46L9Hrtrwl2ZEtxMJGeEz8FtkAbjVwtc=; b=Dz4HL1QCZsROtXq1aM7mZ/w2tfZUh3tY1IH6begKa9xTr7EDrGJ/ecJCX9Uo9urwE1TCqC UYLQ6Srk8KG61hRYsdjmEFZXs+QNl+VsuidL1+Vi8i6vGEgRODhTsKmkAM190pB8m8zMdL ZQwqyZ2K/SUzjX3+21kJmRPmX8LMg8NzgevL/XMlzPY03r2wiH15+xA6xPlrVrPIU5amGc y9gRliZ/npywSxs9dIsSc8jncIi9WGdLgiyY+txm8nM/B8p8sWpX4IAZmAzPRNBy7dcb9O FNLHexY8SBfmuMQFMiSuHnD82JaBFLTCH1eCSUvNNJfdGb76paZ281yhqq28jA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 2A16D51F5; Fri, 24 Jun 2022 09:35:19 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 25O9ZJ3b066207; Fri, 24 Jun 2022 09:35:19 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 25O9ZJKD066206; Fri, 24 Jun 2022 09:35:19 GMT (envelope-from git) Date: Fri, 24 Jun 2022 09:35:19 GMT Message-Id: <202206240935.25O9ZJKD066206@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Ka Ho Ng Subject: git: ea80848e1c06 - stable/13 - pam_exec: fix segfault when authtok is null List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-branches@freebsd.org X-BeenThere: dev-commits-src-branches@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: khng X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: ea80848e1c0639e2ac8d3f974ddb9c6233491eb3 Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1656063319; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=LaV4Z1uyzOu46L9Hrtrwl2ZEtxMJGeEz8FtkAbjVwtc=; b=b75hsZM+P8sizVdKYd2VEKcMPEvLQw6q6y9LXUAgcU+dr7RcIY4unLzeoupqt4br4bIJ2J ZP1Z3V52sZhARoqiJKWF90x406dz0c+lGLdih4AFJFx47W2OB4wTZm0TALtrgKcOVzBHQV RqaGinqponV7NvVmXn4Nv71NFwo6Gd24QHT+xtmsxAu/wAcm9HJlN+CKOMAzpXi0xA1rCk nbWDeO5yCAtKjZqzxMc3qg0CzvyZiwfu/G6Hou/8P5N2kY20HccnLgDbXX5FDQv7UacBMR 7Wq+FJ48jqSz19aaA01zQRthPzn02J44ua05iX7pb9AQhJjES9F4IzYUaeoKgw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1656063319; a=rsa-sha256; cv=none; b=lsGuF/ccKxRifkGbFehb4o3+3evSWsresHzSZv9FqZ4bQYV5T+lkzE2RBtFe0Spo/kGWsE qQUIO5DcRC6sGly+wKVlLHphQfko/NCmlKtJJHnKFbkUxNAe1pLx3Y9V5238r5eFlUL/A+ e6/g4LrR+39Hc4jmZ1NwcpcKvga7RCZcIUZANSBZwopmkrJhpV7DT6/Npy+V3J9NIrYpzG WKVuuE1EDC+s0ZS1CXMzIpqvGWgvR8JYDulgMy9v7H8qVwy52dXEpoUoqO2pN8t4EAPC4b 8jfgthx9lGSQMDOShaRxxvsojKHtS1ecwfMZvjVSNHcXjNT7+X/ZirLD0Kohlw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch stable/13 has been updated by khng: URL: https://cgit.FreeBSD.org/src/commit/?id=ea80848e1c0639e2ac8d3f974ddb9c6233491eb3 commit ea80848e1c0639e2ac8d3f974ddb9c6233491eb3 Author: Yan Ka Chiu AuthorDate: 2022-05-22 16:33:02 +0000 Commit: Ka Ho Ng CommitDate: 2022-06-24 09:09:59 +0000 pam_exec: fix segfault when authtok is null According to pam_exec(8), the `expose_authtok` option should be ignored when the service function is `pam_sm_setcred`. Currently `pam_exec` only prevent prompt for anth token when `expose_authtok` is set on `pam_sm_setcred`. This subsequently led to segfault when there isn't an existing auth token available. Bug reported on this: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=263893 After reading https://reviews.freebsd.org/rS349556 I am not sure if the default behaviour supposed to be simply not prompt for authentication token, or is it to ignore the option entirely as stated in the man page. This patch is therefore only adding an additional NULL check on the item `pam_get_item` provide, and exit with `PAM_SYSTEM_ERR` when such item is NULL. MFC after: 1 week Reviewed by: des, khng Differential Revision: https://reviews.freebsd.org/D35169 (cherry picked from commit b75e0eed345d2ab047a6b1b00a9a7c3bf92e992c) --- lib/libpam/modules/pam_exec/pam_exec.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/lib/libpam/modules/pam_exec/pam_exec.c b/lib/libpam/modules/pam_exec/pam_exec.c index b8f2e1d8fdfc..ef2680d80525 100644 --- a/lib/libpam/modules/pam_exec/pam_exec.c +++ b/lib/libpam/modules/pam_exec/pam_exec.c @@ -261,6 +261,13 @@ _pam_exec(pam_handle_t *pamh, /* don't prompt, only expose existing token */ rc = pam_get_item(pamh, PAM_AUTHTOK, &item); authtok = item; + if (authtok == NULL && rc == PAM_SUCCESS) { + openpam_log(PAM_LOG_ERROR, + "%s: pam_get_authtok(): %s", + func, "authentication token not available"); + OUT(PAM_SYSTEM_ERR); + } + } else { rc = pam_get_authtok(pamh, PAM_AUTHTOK, &authtok, NULL); }