diff options
Diffstat (limited to '')
| -rw-r--r-- | modules/pam_filter/pam_filter.8 | 172 | ||||
| -rw-r--r-- | modules/pam_filter/pam_filter.8.xml | 261 |
2 files changed, 433 insertions, 0 deletions
diff --git a/modules/pam_filter/pam_filter.8 b/modules/pam_filter/pam_filter.8 new file mode 100644 index 0000000..d804faf --- /dev/null +++ b/modules/pam_filter/pam_filter.8 @@ -0,0 +1,172 @@ +'\" t +.\" Title: pam_filter +.\" Author: [see the "AUTHOR" section] +.\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/> +.\" Date: 09/03/2021 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual +.\" Language: English +.\" +.TH "PAM_FILTER" "8" "09/03/2021" "Linux-PAM Manual" "Linux\-PAM Manual" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- +.\" disable hyphenation +.nh +.\" disable justification (adjust text to left margin only) +.ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- +.SH "NAME" +pam_filter \- PAM filter module +.SH "SYNOPSIS" +.HP \w'\fBpam_filter\&.so\fR\ 'u +\fBpam_filter\&.so\fR [debug] [new_term] [non_term] run1|run2 \fIfilter\fR [\fI\&.\&.\&.\fR] +.SH "DESCRIPTION" +.PP +This module is intended to be a platform for providing access to all of the input/output that passes between the user and the application\&. It is only suitable for tty\-based and (stdin/stdout) applications\&. +.PP +To function this module requires +\fIfilters\fR +to be installed on the system\&. The single filter provided with the module simply transposes upper and lower case letters in the input and output streams\&. (This can be very annoying and is not kind to termcap based editors)\&. +.PP +Each component of the module has the potential to invoke the desired filter\&. The filter is always +\fBexecv\fR(2) +with the privilege of the calling application and +\fInot\fR +that of the user\&. For this reason it cannot usually be killed by the user without closing their session\&. +.SH "OPTIONS" +.PP +.PP +\fBdebug\fR +.RS 4 +Print debug information\&. +.RE +.PP +\fBnew_term\fR +.RS 4 +The default action of the filter is to set the +\fIPAM_TTY\fR +item to indicate the terminal that the user is using to connect to the application\&. This argument indicates that the filter should set +\fIPAM_TTY\fR +to the filtered pseudo\-terminal\&. +.RE +.PP +\fBnon_term\fR +.RS 4 +don\*(Aqt try to set the +\fIPAM_TTY\fR +item\&. +.RE +.PP +\fBrunX\fR +.RS 4 +In order that the module can invoke a filter it should know when to invoke it\&. This argument is required to tell the filter when to do this\&. +.sp +Permitted values for +\fIX\fR +are +\fI1\fR +and +\fI2\fR\&. These indicate the precise time that the filter is to be run\&. To understand this concept it will be useful to have read the +\fBpam\fR(3) +manual page\&. Basically, for each management group there are up to two ways of calling the module\*(Aqs functions\&. In the case of the +\fIauthentication\fR +and +\fIsession\fR +components there are actually two separate functions\&. For the case of authentication, these functions are +\fBpam_authenticate\fR(3) +and +\fBpam_setcred\fR(3), here +\fBrun1\fR +means run the filter from the +\fBpam_authenticate\fR +function and +\fBrun2\fR +means run the filter from +\fBpam_setcred\fR\&. In the case of the session modules, +\fIrun1\fR +implies that the filter is invoked at the +\fBpam_open_session\fR(3) +stage, and +\fIrun2\fR +for +\fBpam_close_session\fR(3)\&. +.sp +For the case of the account component\&. Either +\fIrun1\fR +or +\fIrun2\fR +may be used\&. +.sp +For the case of the password component, +\fIrun1\fR +is used to indicate that the filter is run on the first occasion of +\fBpam_chauthtok\fR(3) +(the +\fIPAM_PRELIM_CHECK\fR +phase) and +\fIrun2\fR +is used to indicate that the filter is run on the second occasion (the +\fIPAM_UPDATE_AUTHTOK\fR +phase)\&. +.RE +.PP +\fBfilter\fR +.RS 4 +The full pathname of the filter to be run and any command line arguments that the filter might expect\&. +.RE +.SH "MODULE TYPES PROVIDED" +.PP +All module types (\fBauth\fR, +\fBaccount\fR, +\fBpassword\fR +and +\fBsession\fR) are provided\&. +.SH "RETURN VALUES" +.PP +.PP +PAM_SUCCESS +.RS 4 +The new filter was set successfully\&. +.RE +.PP +PAM_ABORT +.RS 4 +Critical error, immediate abort\&. +.RE +.SH "EXAMPLES" +.PP +Add the following line to +/etc/pam\&.d/login +to see how to configure login to transpose upper and lower case letters once the user has logged in: +.sp +.if n \{\ +.RS 4 +.\} +.nf + session required pam_filter\&.so run1 /lib/security/pam_filter/upperLOWER + +.fi +.if n \{\ +.RE +.\} +.sp +.SH "SEE ALSO" +.PP +\fBpam.conf\fR(5), +\fBpam.d\fR(5), +\fBpam\fR(8) +.SH "AUTHOR" +.PP +pam_filter was written by Andrew G\&. Morgan <morgan@kernel\&.org>\&. diff --git a/modules/pam_filter/pam_filter.8.xml b/modules/pam_filter/pam_filter.8.xml new file mode 100644 index 0000000..7309c35 --- /dev/null +++ b/modules/pam_filter/pam_filter.8.xml @@ -0,0 +1,261 @@ +<?xml version="1.0" encoding='UTF-8'?> +<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN" + "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd"> + +<refentry id="pam_filter"> + + <refmeta> + <refentrytitle>pam_filter</refentrytitle> + <manvolnum>8</manvolnum> + <refmiscinfo class="sectdesc">Linux-PAM Manual</refmiscinfo> + </refmeta> + + <refnamediv id="pam_filter-name"> + <refname>pam_filter</refname> + <refpurpose>PAM filter module</refpurpose> + </refnamediv> + + <refsynopsisdiv> + <cmdsynopsis id="pam_filter-cmdsynopsis"> + <command>pam_filter.so</command> + <arg choice="opt"> + debug + </arg> + <arg choice="opt"> + new_term + </arg> + <arg choice="opt"> + non_term + </arg> + <arg choice="plain"> + run1|run2 + </arg> + <arg choice="plain"> + <replaceable>filter</replaceable> + </arg> + <arg choice="opt"> + <replaceable>...</replaceable> + </arg> + </cmdsynopsis> + </refsynopsisdiv> + + <refsect1 id="pam_filter-description"> + + <title>DESCRIPTION</title> + + <para> + This module is intended to be a platform for providing access to all + of the input/output that passes between the user and the application. + It is only suitable for tty-based and (stdin/stdout) applications. + </para> + <para> + To function this module requires <emphasis>filters</emphasis> to be + installed on the system. + The single filter provided with the module simply transposes upper and + lower case letters in the input and output streams. (This can be very + annoying and is not kind to termcap based editors). + </para> + <para> + Each component of the module has the potential to invoke the + desired filter. The filter is always + <citerefentry> + <refentrytitle>execv</refentrytitle><manvolnum>2</manvolnum> + </citerefentry> with the privilege of the calling application + and <emphasis>not</emphasis> that of the user. For this reason it + cannot usually be killed by the user without closing their session. + </para> + </refsect1> + + <refsect1 id="pam_filter-options"> + + <title>OPTIONS</title> + <para> + <variablelist> + + <varlistentry> + <term> + <option>debug</option> + </term> + <listitem> + <para> + Print debug information. + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term> + <option>new_term</option> + </term> + <listitem> + <para> + The default action of the filter is to set the + <emphasis>PAM_TTY</emphasis> item to indicate the + terminal that the user is using to connect to the + application. This argument indicates that the filter + should set <emphasis>PAM_TTY</emphasis> to the filtered + pseudo-terminal. + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term> + <option>non_term</option> + </term> + <listitem> + <para> + don't try to set the <emphasis>PAM_TTY</emphasis> item. + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term> + <option>runX</option> + </term> + <listitem> + <para> + In order that the module can invoke a filter it should + know when to invoke it. This argument is required to tell + the filter when to do this. + </para> + <para> + Permitted values for <emphasis>X</emphasis> are + <emphasis>1</emphasis> and <emphasis>2</emphasis>. These + indicate the precise time that the filter is to be run. + To understand this concept it will be useful to have read + the <citerefentry> + <refentrytitle>pam</refentrytitle><manvolnum>3</manvolnum> + </citerefentry> manual page. + Basically, for each management group there are up to two ways + of calling the module's functions. + In the case of the <emphasis>authentication</emphasis> and + <emphasis>session</emphasis> components there are actually + two separate functions. For the case of authentication, these + functions are + <citerefentry> + <refentrytitle>pam_authenticate</refentrytitle><manvolnum>3</manvolnum> + </citerefentry> and + <citerefentry> + <refentrytitle>pam_setcred</refentrytitle><manvolnum>3</manvolnum> + </citerefentry>, here <option>run1</option> means run the + filter from the <function>pam_authenticate</function> function + and <option>run2</option> means run the filter from + <function>pam_setcred</function>. In the case of the + session modules, <emphasis>run1</emphasis> implies + that the filter is invoked at the + <citerefentry> + <refentrytitle>pam_open_session</refentrytitle><manvolnum>3</manvolnum> + </citerefentry> stage, and <emphasis>run2</emphasis> for + <citerefentry> + <refentrytitle>pam_close_session</refentrytitle><manvolnum>3</manvolnum> + </citerefentry>. + </para> + <para> + For the case of the account component. Either + <emphasis>run1</emphasis> or <emphasis>run2</emphasis> + may be used. + </para> + <para> + For the case of the password component, <emphasis>run1</emphasis> + is used to indicate that the filter is run on the first + occasion of + <citerefentry> + <refentrytitle>pam_chauthtok</refentrytitle><manvolnum>3</manvolnum> + </citerefentry> (the <emphasis>PAM_PRELIM_CHECK</emphasis> + phase) and <emphasis>run2</emphasis> is used to indicate + that the filter is run on the second occasion (the + <emphasis>PAM_UPDATE_AUTHTOK</emphasis> phase). + + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term> + <option>filter</option> + </term> + <listitem> + <para> + The full pathname of the filter to be run and any command line + arguments that the filter might expect. + </para> + </listitem> + </varlistentry> + </variablelist> + + </para> + </refsect1> + + <refsect1 id="pam_filter-types"> + <title>MODULE TYPES PROVIDED</title> + <para> + All module types (<option>auth</option>, <option>account</option>, + <option>password</option> and <option>session</option>) are provided. + </para> + </refsect1> + + <refsect1 id='pam_filter-return_values'> + <title>RETURN VALUES</title> + <para> + <variablelist> + + <varlistentry> + <term>PAM_SUCCESS</term> + <listitem> + <para> + The new filter was set successfully. + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term>PAM_ABORT</term> + <listitem> + <para> + Critical error, immediate abort. + </para> + </listitem> + </varlistentry> + + </variablelist> + </para> + </refsect1> + + <refsect1 id='pam_filter-examples'> + <title>EXAMPLES</title> + <para> + Add the following line to <filename>/etc/pam.d/login</filename> to + see how to configure login to transpose upper and lower case letters + once the user has logged in: + + <programlisting> + session required pam_filter.so run1 /lib/security/pam_filter/upperLOWER + </programlisting> + </para> + </refsect1> + + <refsect1 id='pam_filter-see_also'> + <title>SEE ALSO</title> + <para> + <citerefentry> + <refentrytitle>pam.conf</refentrytitle><manvolnum>5</manvolnum> + </citerefentry>, + <citerefentry> + <refentrytitle>pam.d</refentrytitle><manvolnum>5</manvolnum> + </citerefentry>, + <citerefentry> + <refentrytitle>pam</refentrytitle><manvolnum>8</manvolnum> + </citerefentry> + </para> + </refsect1> + + <refsect1 id='pam_filter-author'> + <title>AUTHOR</title> + <para> + pam_filter was written by Andrew G. Morgan <morgan@kernel.org>. + </para> + </refsect1> + +</refentry> |