picking through the old pr by afoxman · Pull Request #3 · afoxman/pam-u2f

afoxman · 2025-12-19T23:55:37Z

No description provided.

Add support for storing an encrypted auth token in u2f_keys. The auth token is passed to PAM and may be used by other PAM modules. The encryption key is derived using the FIDO2 hmac-secret extension.

Debug log whether authtok is enabled and when token descryption is successful. Yubico#294 (comment)

… section

`brew` has for some time packaged libfido2. We can use those builds to simplify our pipeline. Ensure linking to the same OpenSSL version as libfido2 through `brew deps`.

For some reason, openssl@3 is sometimes not listed as "installed". Be less restrictive and list all dependencies regardless of their currently perceived state by brew.

Add preprocessor constant `DEVLIST_LEN` to replace magic number 64 in allocations of device info list.

- Attempting to install `pkg-config` or `pkgconf` results in brew complaining about conflicts. Rely on whatever version already present. - macos-14 seemingly needs an explicit libtool install.

CodeQL action v2 will be deprecated on 2024-12-05.

Under Linux the read call seems to accept NULL as a parameter: $ cat try.c #include <unistd.h> #include <err.h> int main(void) { int i = read(0, NULL, 4); err(1, "read"); return 0; } $ make try cc try.c -o try $ ./try </dev/random try: read: Bad address Such behaviour is not specified by POSIX, so we should catch it. Since we are at it, catching read(-1, ...) is probably a good idea, since code that does that is arguably wrong.

Instead, use more meaningful status codes: - PAM_SYSTEM_ERR if getpwuid_r(), gethostname(), or pam_modutil_{drop,regain}_priv() fails; - PAM_BUF_ERR if memory allocation routines fails; and - PAM_ABORT for any uncaught errors. This commit is part of a fix for YSA-2025-01 / CVE-2025-23013.

Move PAM return value handling to get_devices_from_authfile(): If `nouserok` is set, return - PAM_IGNORE if open() returns ENOENT; - PAM_IGNORE if user is not found in the authfile; - PAM_IGNORE if user is found in the but have no credentials; - PAM_AUTHINFO_UNAVAIL otherwise. If `nouserok` is *not* set, return - PAM_USER_UNKNOWN if user is not found in the authfile; - PAM_USER_UNKNOWN if user is found but have no credentials; - PAM_AUTHINFO_UNAVAIL otherwise. This commit is part of a fix for YSA-2025-01 / CVE-2025-23013.

This simplifies reasoning about the return value in pam_sm_authenticate(). Function returns PAM_SUCCESS if successful, PAM_AUTH_ERR otherwise.

autoconf/automake/libtool are only needed if building from git, as the dist tarball is not depending on autotools. The reference to GNU Autotools has been moved under "Building from Git", since this detail is interesting only for those who clone the project.

While fixing terminology, I noticed redundant variations of the same logging message in strings(1). This is not very important, but less is more.

Ensure path is absolute if provided (the script would fail if FAKEROOT is supplied as relative path) Erase FAKEROOT before exiting if created with `mktemp -d`

Split options on multiple lines and sort Invoke 'cmake --build' instead of 'make' (drop assumptions on underlying build system) Drop pushd/popd in favour of supplied build and source directories. Use subshell when necessary. Cache `nproc` into a variable

Use ninja for faster build. Drop autoconf/automake/libtool from workflow dependencies, and add ninja.

The current revision of the script does not use any bashism nor pipes that require 'pipefail'. We can downgrade to the plain sh interpreter.

This fixes the following warning by libfuzzer: WARNING: no interesting inputs were found so far. Is the code instrumented for coverage?

- clone libfido2 and libcbor only if not previously done - libcbor is patched with libfido2/fuzz/README only on first clone - use existing corpus if available

Generate the file-level coverage summary report (`llvm-cov report`) and print it on stdout. Optionally generate the line-oriented coverage report (`llvm-cov show`). This is enabled if the WITH_COVERAGE_REPORT environment variable is defined. The report will be generated in a directory called "cov-report" under $WORKDIR.

The release procedure assumes that gpg will not armor the detached signature. The assumption might turn out wrong if the user sets the `armor` option in their ~/.gnupg/gpg.conf.

Will be removed by GitHub 2025-04-01.

afoxman · 2025-12-20T00:01:30Z

  int debug;
  int verbose;
  int nouser;
+  int authtok;


authtok covered, the rest were removed

afoxman · 2025-12-20T00:08:29Z

    { "verbose",           no_argument,       NULL, 'v'         },
    { "username",          required_argument, NULL, 'u'         },
    { "nouser",            no_argument,       NULL, 'n'         },
+    { "authtok",           no_argument,       NULL, 'a'         },


added authtok as password, ditched the pam args

afoxman · 2025-12-20T00:08:37Z

 "                             authenticator, defaults to the current user name\n"
 "  -n, --nouser             Print only registration information (key handle,\n"
 "                             public key, and options), useful for appending\n"
+"  -a, --authtok            Read a PAM auth token (usually a password) that\n"


afoxman · 2025-12-20T00:08:50Z

 "\n"
 "Report bugs at <" PACKAGE_BUGREPORT ">.\n";
  /* clang-format on */
+  char *saveptr = NULL;


afoxman · 2025-12-20T00:09:03Z

+  args->pam_pinverification = -1;

-  while ((c = getopt_long(argc, argv, "ho:i:t:rPNVdvu:n", options, NULL)) !=
+  while ((c = getopt_long(argc, argv, "ho:i:t:rPNVdvu:nap:", options, NULL)) !=


afoxman · 2025-12-20T00:09:26Z

      case 'n':
        args->nouser = 1;
        break;
+      case 'a':


covered as password, not authtok. removed pam stuff

afoxman · 2025-12-20T00:15:24Z

+  size_t enc_authtok_len = 0;

  parse_args(argc, argv, &args);
+  if (args.authtok && args.no_user_presence) {


covered (modified)

zhihengq and others added 30 commits April 29, 2023 23:16

authtok: add support for decrypting an auth token

d8a6ef1

Add support for storing an encrypted auth token in u2f_keys. The auth token is passed to PAM and may be used by other PAM modules. The encryption key is derived using the FIDO2 hmac-secret extension.

authtok: fix uninitialized and unused variables

3be1882

authtok: fix some issues with auth token support

f74618f

authtok: include required header file

808f5aa

authtok: skip hmac secret if no PIN or UV

d30f019

authtok: simplify make_cred in pamu2fcfg

66df754

authtok: add more debug logging

bb9394e

Debug log whether authtok is enabled and when token descryption is successful. Yubico#294 (comment)

ci: also use macos-13 runner

db5ecf7

Updated README to add source acquisition instructions in the Building…

8b2f6b4

… section

README: drop definite article

f5fcf97

README: drop quotes

b3a68a2

ci: install libfido2 from brew on osx

cd0125c

`brew` has for some time packaged libfido2. We can use those builds to simplify our pipeline. Ensure linking to the same OpenSSL version as libfido2 through `brew deps`.

ci: also run regression tests on macos

457f06c

ci: fix codeql workflow

067fa36

ci: list all libfido2 dependencies

5c4fd9c

For some reason, openssl@3 is sometimes not listed as "installed". Be less restrictive and list all dependencies regardless of their currently perceived state by brew.

ci: bump checkout to v4

ac623c7

fuzz: bump libfido2 to 1.14.0

e70b056

misc: fix grammatical errors and phrasing of log messages

a464101

misc: replace magic number with DEVLIST_LEN

ff26d4f

Add preprocessor constant `DEVLIST_LEN` to replace magic number 64 in allocations of device info list.

ci: replace macos-11 with macos-14

a255217

ci: update to 24.04 runners

0022081

ci: fixup macos workflow

b98d8ad

- Attempting to install `pkg-config` or `pkgconf` results in brew complaining about conflicts. Rely on whatever version already present. - macos-14 seemingly needs an explicit libtool install.

ci: bump libfido2, libcbor

91cfeef

ci: update CodeQL

d10b6df

CodeQL action v2 will be deprecated on 2024-12-05.

ci: rotate out macos-12, bring in macos-15

aad898b

fuzz: Fix compiler warnings

321abc0

pam: let do_*authentication() return PAM_*

cdddb28

This simplifies reasoning about the return value in pam_sm_authenticate(). Function returns PAM_SUCCESS if successful, PAM_AUTH_ERR otherwise.

dacav and others added 23 commits December 19, 2025 15:04

README: minimal dependencies

2fd8a3e

README: little tweaks

d8494ad

README: cmake info

a1d4326

Reduce string redundancy

66e941b

While fixing terminology, I noticed redundant variations of the same logging message in strings(1). This is not very important, but less is more.

Fix terminology in prompts

6f2bb9c

README: update terminology

9f43840

man: update terminology

ff710e9

fuzz: fix FAKEROOT

fdda835

Ensure path is absolute if provided (the script would fail if FAKEROOT is supplied as relative path) Erase FAKEROOT before exiting if created with `mktemp -d`

fuzz: use cmake to build pam_u2f

626e1c9

fuzz: Use ninja(1) for building

10bfdac

Use ninja for faster build. Drop autoconf/automake/libtool from workflow dependencies, and add ninja.

fuzz: script shebang + copyright

992c7d3

The current revision of the script does not use any bashism nor pipes that require 'pipefail'. We can downgrade to the plain sh interpreter.

fuzz: Add missing compile options

084d52c

This fixes the following warning by libfuzzer: WARNING: no interesting inputs were found so far. Is the code instrumented for coverage?

fuzz: reuse data in multiple runs of fuzz-linux-asan.sh

e10e466

- clone libfido2 and libcbor only if not previously done - libcbor is patched with libfido2/fuzz/README only on first clone - use existing corpus if available

NEWS: prepare for 1.4.0

95cc602

Bump version (1.4.0)

945b944

release 1.4.0

4959622

autotools: enforce --no-armor when signing release

43717c0

The release procedure assumes that gpg will not armor the detached signature. The assumption might turn out wrong if the user sets the `armor` option in their ~/.gnupg/gpg.conf.

ci: drop ubuntu 20.04 runners

baa302a

Will be removed by GitHub 2025-04-01.

Merge branch 'zhihengq-authtok' into authtok

d472822

Restore changes lost during initial cross-fork merge.

49c8379

afoxman commented Dec 20, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

picking through the old pr#3

picking through the old pr#3
afoxman wants to merge 103 commits into
mainfrom
authtok

afoxman commented Dec 19, 2025

Uh oh!

afoxman Dec 20, 2025

Uh oh!

afoxman Dec 20, 2025

Uh oh!

afoxman Dec 20, 2025

Uh oh!

afoxman Dec 20, 2025

Uh oh!

afoxman Dec 20, 2025

Uh oh!

afoxman Dec 20, 2025

Uh oh!

afoxman Dec 20, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

afoxman commented Dec 19, 2025

Uh oh!

afoxman Dec 20, 2025

Choose a reason for hiding this comment

Uh oh!

afoxman Dec 20, 2025

Choose a reason for hiding this comment

Uh oh!

afoxman Dec 20, 2025

Choose a reason for hiding this comment

Uh oh!

afoxman Dec 20, 2025

Choose a reason for hiding this comment

Uh oh!

afoxman Dec 20, 2025

Choose a reason for hiding this comment

Uh oh!

afoxman Dec 20, 2025

Choose a reason for hiding this comment

Uh oh!

afoxman Dec 20, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants