1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
|
Index: modules/pam_securetty/pam_securetty.8.xml
===================================================================
RCS file: /cvsroot/pam/Linux-PAM/modules/pam_securetty/pam_securetty.8.xml,v
retrieving revision 1.4
retrieving revision 1.6
diff -u -p -r1.4 -r1.6
--- modules/pam_securetty/pam_securetty.8.xml 18 Aug 2008 13:29:25 -0000 1.4
+++ modules/pam_securetty/pam_securetty.8.xml 25 Nov 2010 16:58:59 -0000 1.6
@@ -33,7 +33,9 @@
user is logging in on a "secure" tty, as defined by the listing
in <filename>/etc/securetty</filename>. pam_securetty also checks
to make sure that <filename>/etc/securetty</filename> is a plain
- file and not world writable.
+ file and not world writable. It will also allow root logins on
+ the tty specified with <option>console=</option> switch on the
+ kernel command line.
</para>
<para>
This module has no effect on non-root users and requires that the
@@ -61,6 +63,18 @@
</para>
</listitem>
</varlistentry>
+ <varlistentry>
+ <term>
+ <option>noconsole</option>
+ </term>
+ <listitem>
+ <para>
+ Do not automatically allow root logins on the kernel console
+ device, as specified on the kernel command line, if it is
+ not also specified in the <filename>/etc/securetty</filename> file.
+ </para>
+ </listitem>
+ </varlistentry>
</variablelist>
</refsect1>
Index: modules/pam_securetty/pam_securetty.c
===================================================================
RCS file: /cvsroot/pam/Linux-PAM/modules/pam_securetty/pam_securetty.c,v
retrieving revision 1.14
retrieving revision 1.15
diff -u -p -r1.14 -r1.15
--- modules/pam_securetty/pam_securetty.c 10 Sep 2009 10:19:58 -0000 1.14
+++ modules/pam_securetty/pam_securetty.c 24 Nov 2010 12:28:01 -0000 1.15
@@ -2,6 +2,7 @@
#define SECURETTY_FILE "/etc/securetty"
#define TTY_PREFIX "/dev/"
+#define CMDLINE_FILE "/proc/cmdline"
/*
* by Elliot Lee <sopwith@redhat.com>, Red Hat Software.
@@ -22,6 +23,7 @@
#include <pwd.h>
#include <string.h>
#include <ctype.h>
+#include <limits.h>
/*
* here, we make a definition for the externally accessible function
@@ -38,6 +40,7 @@
#include <security/pam_ext.h>
#define PAM_DEBUG_ARG 0x0001
+#define PAM_NOCONSOLE_ARG 0x0002
static int
_pam_parse (const pam_handle_t *pamh, int argc, const char **argv)
@@ -51,6 +54,8 @@ _pam_parse (const pam_handle_t *pamh, in
if (!strcmp(*argv,"debug"))
ctrl |= PAM_DEBUG_ARG;
+ else if (!strcmp(*argv, "noconsole"))
+ ctrl |= PAM_NOCONSOLE_ARG;
else {
pam_syslog(pamh, LOG_ERR, "unknown option: %s", *argv);
}
@@ -144,6 +149,40 @@ securetty_perform_check (pam_handle_t *p
}
fclose(ttyfile);
+ if (retval && !(ctrl & PAM_NOCONSOLE_ARG)) {
+ FILE *cmdlinefile;
+
+ /* Allow access from the kernel console, if enabled */
+ cmdlinefile = fopen(CMDLINE_FILE, "r");
+
+ if (cmdlinefile != NULL) {
+ char line[LINE_MAX], *p;
+
+ line[0] = 0;
+ fgets(line, sizeof(line), cmdlinefile);
+ fclose(cmdlinefile);
+
+ for (p = line; p; p = strstr(p+1, "console=")) {
+ char *e;
+
+ /* Test whether this is a beginning of a word? */
+ if (p > line && p[-1] != ' ')
+ continue;
+
+ /* Ist this our console? */
+ if (strncmp(p + 8, uttyname, strlen(uttyname)))
+ continue;
+
+ /* Is there any garbage after the TTY name? */
+ e = p + 8 + strlen(uttyname);
+ if (*e == ',' || *e == ' ' || *e == '\n' || *e == 0) {
+ retval = 0;
+ break;
+ }
+ }
+ }
+ }
+
if (retval) {
pam_syslog(pamh, LOG_WARNING, "access denied: tty '%s' is not secure !",
uttyname);
|
