rooty/yubico-pam
1
0
Fork 0
mirror of https://github.com/Yubico/yubico-pam.git synced 2025-02-20 12:54:16 +01:00
Code Issues Projects Releases Wiki Activity

Scrub sensitive data from memory

Browse Source 
Fixes issue #185
This commit is contained in:
Gabriel Kihlman 2019-02-04 19:50:30 +01:00
parent 456c2a125d
commit 76034c1054
No known key found for this signature in database
GPG Key ID: C59A56181B3BF1F7
2 changed files with 23 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
configure.ac
View File

@ -159,6 +159,20 @@ if test "$gl_gcc_warnings" = yes; then
gl_WARN_ADD([-fdiagnostics-show-option]) gl_WARN_ADD([-fdiagnostics-show-option])
fi fi
# Enable more secure memset if available
AC_CHECK_FUNCS([memset_s explicit_bzero explicit_memset])
AC_MSG_CHECKING(whether we can use inline asm code)
AC_LINK_IFELSE([AC_LANG_PROGRAM([[]],
[[
int a = 42;
int *pnt = &a;
__asm__ __volatile__ ("" : : "r"(pnt) : "memory");
]])],
[AC_MSG_RESULT(yes)
AC_DEFINE([HAVE_INLINE_ASM], [1], [inline asm code can be used])]
[AC_MSG_RESULT(no)]
)
AC_CONFIG_FILES(Makefile) AC_CONFIG_FILES(Makefile)
AC_CONFIG_FILES(tests/Makefile) AC_CONFIG_FILES(tests/Makefile)
AC_OUTPUT AC_OUTPUT

10
pam_yubico.c
View File

@ -1,5 +1,5 @@
/* Written by Simon Josefsson <simon@yubico.com>. /* Written by Simon Josefsson <simon@yubico.com>.
* Copyright (c) 2006-2016 Yubico AB * Copyright (c) 2006-2019 Yubico AB
* Copyright (c) 2011 Tollef Fog Heen <tfheen@err.no> * Copyright (c) 2011 Tollef Fog Heen <tfheen@err.no>
* All rights reserved. * All rights reserved.
* *
@ -45,6 +45,7 @@
#include "util.h" #include "util.h"
#include "drop_privs.h" #include "drop_privs.h"
#include "ykbzero.h"
#include <ykclient.h> #include <ykclient.h>
@ -998,7 +999,7 @@ pam_sm_authenticate (pam_handle_t * pamh,
pam_strerror (pamh, retval)); pam_strerror (pamh, retval));
goto done; goto done;
} }
DBG ("get password returned: %s", password); DBG ("get password returned: /* not logged */");
} }
if (cfg->use_first_pass && password == NULL) if (cfg->use_first_pass && password == NULL)
@ -1264,7 +1265,12 @@ pam_sm_authenticate (pam_handle_t * pamh,
done: done:
if (onlypasswd) if (onlypasswd)
{
insecure_memzero(onlypasswd, strlen(onlypasswd));
free(onlypasswd); free(onlypasswd);
}
insecure_memzero(otp, sizeof(otp));
insecure_memzero(otp_id, sizeof(otp_id));
if (templates > 0) if (templates > 0)
{ {
size_t i; size_t i;