From dcd7a5748ef6820e3e0d386139d9dd946f0d71fa Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Sat, 27 Apr 2024 14:01:37 +0200 Subject: Adding debian version 1.4.0-9+deb11u1. Signed-off-by: Daniel Baumann --- .../045_pam_dispatch_jump_is_ignore | 34 ++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 debian/patches-applied/045_pam_dispatch_jump_is_ignore (limited to 'debian/patches-applied/045_pam_dispatch_jump_is_ignore') diff --git a/debian/patches-applied/045_pam_dispatch_jump_is_ignore b/debian/patches-applied/045_pam_dispatch_jump_is_ignore new file mode 100644 index 0000000..e19a545 --- /dev/null +++ b/debian/patches-applied/045_pam_dispatch_jump_is_ignore @@ -0,0 +1,34 @@ + +Previously jumps were treated as PAM_IGNORE in the freezing part of +the chain and PAM_OK (aka required) in the frozen part of the chain. +No one on pam-list was able to explain this behavior, so I changed it +to be consistent. + +Index: pam/libpam/pam_dispatch.c +=================================================================== +--- pam.orig/libpam/pam_dispatch.c ++++ pam/libpam/pam_dispatch.c +@@ -260,22 +260,7 @@ + if ( _PAM_ACTION_IS_JUMP(action) ) { + + /* If we are evaluating a cached chain, we treat this +- module as required (aka _PAM_ACTION_OK) as well as +- executing the jump. */ +- +- if (use_cached_chain) { +- if (impression == _PAM_UNDEF +- || (impression == _PAM_POSITIVE +- && status == PAM_SUCCESS) ) { +- if ( retval != PAM_IGNORE || cached_retval == retval ) { +- if ( impression == _PAM_UNDEF && retval == PAM_SUCCESS ) { +- h->grantor = 1; +- } +- impression = _PAM_POSITIVE; +- status = retval; +- } +- } +- } ++ module as ignored as well as executing the jump. */ + + /* this means that we need to skip #action stacked modules */ + while (h->next != NULL && h->next->stack_level >= stack_level && action > 0) { -- cgit v1.2.3