From 513fdf69d3f9ebb0b027c7bc08dd27fffad0e6be Mon Sep 17 00:00:00 2001
From: Björn Esser <besser82@fedoraproject.org>
Date: Sep 23 2021 09:14:32 +0000
Subject: [PATCH 1/4] pam_console: Fix race condition for BUILT_SOURCES on parallel build.


Signed-off-by: Björn Esser <besser82@fedoraproject.org>

---

diff --git a/pam_console/Makefile.am b/pam_console/Makefile.am
index 5aebea5..75c89f0 100644
--- a/pam_console/Makefile.am
+++ b/pam_console/Makefile.am
@@ -44,6 +44,8 @@ secureconf_DATA = console.perms console.handlers
 FLEX_OPTS = -Cr
 BISON_OPTS = -d
 
+BUILT_SOURCES = configfile.tab.h configfile.tab.c configfile.lex.c
+
 pam_console_la_SOURCES = pam_console.c pam_console.h regerr.c handlers.c handlers.h
 pam_console_apply_SOURCES = pam_console_apply.c pam_console.h chmod.c modechange.c regerr.c \
 			 configfile.c configfile.h hashtable.c hashtable.h hashtable_private.h
@@ -51,15 +53,17 @@ pam_console_apply_SOURCES = pam_console_apply.c pam_console.h chmod.c modechange
 pam_console_la_CFLAGS = $(AM_CFLAGS)
 pam_console_apply_CFLAGS = $(AM_CFLAGS) @EXE_CFLAGS@
 
+configfile.tab.h: configfile.tab.c
+
 configfile.tab.c: configfile.y
 	$(YACC) $(BISON_OPTS) -o $@ -p _pc_yy $<
 	sh $(srcdir)/sed-static $@
 
-configfile.lex.c: configfile.l configfile.tab.c
+configfile.lex.c: configfile.l configfile.tab.h
 	$(LEX) $(FLEX_OPTS) -o$@ -P_pc_yy $<
 	sh $(srcdir)/sed-static $@
 
-configfile.c: configfile.tab.c configfile.lex.c
+configfile.c: configfile.tab.h configfile.tab.c configfile.lex.c
 
 install-data-local:
 	mkdir -p $(DESTDIR)$(secureconfdir)/console.apps

From 7bd9c85b7a47dedbf42af9a22e596401b1f6a7ed Mon Sep 17 00:00:00 2001
From: Björn Esser <besser82@fedoraproject.org>
Date: Sep 23 2021 09:14:32 +0000
Subject: [PATCH 2/4] Makefile: Use xz compression for release tarballs.


Signed-off-by: Björn Esser <besser82@fedoraproject.org>

---

diff --git a/Makefile b/Makefile
index b6deddf..8914bb9 100644
--- a/Makefile
+++ b/Makefile
@@ -10,6 +10,6 @@ force-tag:
 	git tag --force $(TAG)
 
 dist:
-	@rm -f $(TAG).tar.bz2 
-	git archive --format=tar --prefix=$(TAG)/ $(TAG) | bzip2 > $(TAG).tar.bz2
-	@echo "The archive is in $(TAG).tar.bz2" 
+	@rm -f $(TAG).tar.xz
+	git archive --format=tar --prefix=$(TAG)/ $(TAG) | xz > $(TAG).tar.xz
+	@echo "The archive is in $(TAG).tar.xz"

From 17ff1d044f5629e7ac035e0dc244c65542e30548 Mon Sep 17 00:00:00 2001
From: Björn Esser <besser82@fedoraproject.org>
Date: Sep 23 2021 09:14:32 +0000
Subject: [PATCH 3/4] Fix trailing white-space characters.


Signed-off-by: Björn Esser <besser82@fedoraproject.org>

---

diff --git a/CHANGELOG.pam-redhat b/CHANGELOG.pam-redhat
index 30209ef..507b35c 100644
--- a/CHANGELOG.pam-redhat
+++ b/CHANGELOG.pam-redhat
@@ -42,7 +42,7 @@ without autoconf support.
 * pam_console: allow printing to multifunction devices
 
 0.99.8-1: Mon Jul 23 2007
-* pam_console: decrement console use count properly - CVE-2007-1716 
+* pam_console: decrement console use count properly - CVE-2007-1716
 * pam_console: add more displays to console class
 * pam_console: add some firewire devices to default.perms (#240770)
 
@@ -92,7 +92,7 @@ without autoconf support.
 
 0.99.2-1: Tue Jan 03 2006
 
-* pam_console: fixed uninitialized value on broken config file 
+* pam_console: fixed uninitialized value on broken config file
   (#141053, patch by Jay Fenlason)
 * pam_console: man page fixes.
 * pam_loginuid: added option require_auditd to require auditd running (Steve Grubb).
@@ -144,8 +144,8 @@ without autoconf support.
 * pam_console: Don't check the ownership of terminal on logout - we don't
   have it on X crash (tmraz)
 * pam_stack: Fix memory leaks (tmraz)
-* pam_timestamp: Ignore the timestamp file if it's older than oldest 
+* pam_timestamp: Ignore the timestamp file if it's older than oldest
   login (tmraz)
 * Allow using pam_console for authentication (tmraz)
-* Add a file parameter to pam_console_apply to apply its work only on 
+* Add a file parameter to pam_console_apply to apply its work only on
   that file (tmraz)
diff --git a/pam_console/configfile.c b/pam_console/configfile.c
index d0cba3a..6b28e58 100644
--- a/pam_console/configfile.c
+++ b/pam_console/configfile.c
@@ -28,11 +28,11 @@ g_slist_append(GSList *l, void *d)
 	memb = _do_malloc(sizeof(*memb));
 	memb->next = NULL;
 	memb->data = d;
-	
+
 	if (l == NULL) {
 		return memb;
 	}
-	
+
 	n = l;
 	while (n->next != NULL) {
 		n = n->next;
diff --git a/pam_console/configfile.y b/pam_console/configfile.y
index a298ff9..ea4a221 100644
--- a/pam_console/configfile.y
+++ b/pam_console/configfile.y
@@ -41,10 +41,10 @@ str_hash(unsigned char *s)
 {
         unsigned int hash = 5381;
 	int c;
-	                
+
 	while ((c = *s++))
 		hash = ((hash << 5) + hash) + c; /* hash * 33 + c */
-	                                    
+
 	return hash;
 }
 
@@ -90,7 +90,7 @@ classdef:
 		  class *c;
 
 		  c = hashtable_search(namespace, $2);
-		  if (c) { 
+		  if (c) {
 			empty_class(c);
 		  } else {
 			c = malloc(sizeof(class));
diff --git a/pam_console/console.handlers b/pam_console/console.handlers
index 453cfca..c7c02c9 100644
--- a/pam_console/console.handlers
+++ b/pam_console/console.handlers
@@ -1,6 +1,6 @@
 # /etc/security/console.handlers
 #
-# This file is provided for configuration of handlers which will be 
+# This file is provided for configuration of handlers which will be
 # executed when user obtains console lock and when he loses it.
 # Additionally it is used for a configuration of console device names.
 #
diff --git a/pam_console/console.perms.5 b/pam_console/console.perms.5
index 84e5819..cfbb0da 100644
--- a/pam_console/console.perms.5
+++ b/pam_console/console.perms.5
@@ -4,7 +4,7 @@
 .SH NAME
 console.perms \- permissions control file for users at the system console
 .SH DESCRIPTION
-/etc/security/console.perms and .perms files in the 
+/etc/security/console.perms and .perms files in the
 /etc/security/console.perms.d directory determine the permissions that will be
 given to priviledged users of the console at login time, and the
 permissions to which to revert when the users log out.  They are
diff --git a/pam_console/handlers.c b/pam_console/handlers.c
index 1a94578..84d62a6 100644
--- a/pam_console/handlers.c
+++ b/pam_console/handlers.c
@@ -39,18 +39,18 @@ enum flags { HF_LOGFAIL, HF_WAIT, HF_SETUID, HF_TTY, HF_USER, HF_PARAM };
 struct console_handler {
         char *executable;
         enum types type;
-        char *flags; /* this is a double zero terminated array 
+        char *flags; /* this is a double zero terminated array
                         allocated in one blob with executable */
         struct console_handler *next;
 };
 
 static struct console_handler *first_handler;
 
-static void 
+static void
 console_free_handlers (struct console_handler *handler) {
         if (handler != NULL) {
                 console_free_handlers(handler->next);
-                free(handler->executable);                
+                free(handler->executable);
                 free(handler);
         }
 }
@@ -63,15 +63,15 @@ console_parse_handlers (pam_handle_t *pamh, const char *handlers_name) {
         int skip = 0;
         int rv = PAM_SESSION_ERR;
         struct console_handler **previous_handler_ptr;
-        
+
         fh = fopen(handlers_name, "r");
         if (fh == NULL) {
                 _pam_log(pamh, LOG_ERR, FALSE, "cannot open file %s for reading", handlers_name);
                 return rv;
         }
-        
+
         previous_handler_ptr = &first_handler;
-        
+
         while (fgets(linebuf, sizeof(linebuf), fh) != NULL)
         {
                 int len;
@@ -81,7 +81,7 @@ console_parse_handlers (pam_handle_t *pamh, const char *handlers_name) {
                 char *destptr = NULL; /* needed to silence warning */
                 struct console_handler *handler;
                 enum states { EXECUTABLE, TYPE, FLAGS } state;
-                
+
                 len = strlen(linebuf);
                 if (linebuf[len-1] != '\n') {
                         _pam_log(pamh, LOG_INFO, FALSE, "line too long or not ending with new line char - will be ignored");
@@ -99,17 +99,17 @@ console_parse_handlers (pam_handle_t *pamh, const char *handlers_name) {
                 for (ptr = linebuf; isspace(*ptr); ptr++);
                 if (*ptr == '\0')
                         continue;
-                
+
                 /* something on the line */
                 if ((handler=calloc(sizeof(*handler), 1)) == NULL)
                         goto fail_exit;
                 *previous_handler_ptr = handler;
                 previous_handler_ptr = &handler->next;
-                                                                                                                                                        
+
                 if ((handler->executable=malloc(len-(ptr-linebuf)+1)) == NULL) {
                         goto fail_exit;
                 }
-                
+
                 state = EXECUTABLE;
                 handler->type = UNKNOWN;
                 while ((tokptr=strtok_r(ptr, " \t", &temp)) != NULL) {
@@ -121,7 +121,7 @@ console_parse_handlers (pam_handle_t *pamh, const char *handlers_name) {
                         else if (state == TYPE) {
                                 if (strcmp(tokptr, "lock") == 0) {
                                         handler->type = LOCK;
-                                } 
+                                }
                                 else if (strcmp(tokptr, "unlock") == 0) {
                                         handler->type = UNLOCK;
                                 }
@@ -129,7 +129,7 @@ console_parse_handlers (pam_handle_t *pamh, const char *handlers_name) {
                                         handler->type = CONSOLEDEVS;
                                 }
                         }
-                        
+
                         if (state == FLAGS) {
                                 strcpy(destptr, tokptr);
                                 destptr += strlen(destptr) + 1;
@@ -138,11 +138,11 @@ console_parse_handlers (pam_handle_t *pamh, const char *handlers_name) {
                                 state++;
                         }
                 }
-                *destptr = '\0';                
+                *destptr = '\0';
         }
         forget = fclose(fh);
 
-        return PAM_SUCCESS;        
+        return PAM_SUCCESS;
 
 fail_exit:
         console_free_handlers(first_handler);
@@ -285,7 +285,7 @@ execute_handler(pam_handle_t *pamh, struct console_handler *handler, const char 
 	else if (WIFSIGNALED(rv))
 		_pam_log(pamh, LOG_ERR, !logfail, "handler '%s' caught a signal %d",
 			handler->executable, (int)WTERMSIG(rv));
-			
+
         return 0;
 }
 
diff --git a/pam_console/hashtable.c b/pam_console/hashtable.c
index 06b72c2..c9300f0 100644
--- a/pam_console/hashtable.c
+++ b/pam_console/hashtable.c
@@ -87,7 +87,7 @@ hashtable_expand(struct hashtable *h)
         h->table = newtable;
     }
     /* Plan B: realloc instead */
-    else 
+    else
     {
         newtable = (struct entry **)
                    realloc(h->table, newsize * sizeof(struct entry *));
@@ -224,23 +224,23 @@ hashtable_destroy(struct hashtable *h, int free_kv)
 /*
  * Copyright (c) 2002, Christopher Clark
  * All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
- * 
+ *
  * * Redistributions in binary form must reproduce the above copyright
  * notice, this list of conditions and the following disclaimer in the
  * documentation and/or other materials provided with the distribution.
- * 
+ *
  * * Neither the name of the original author; nor the names of any contributors
  * may be used to endorse or promote products derived from this software
  * without specific prior written permission.
- * 
- * 
+ *
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
diff --git a/pam_console/hashtable.h b/pam_console/hashtable.h
index f88671c..c8aa287 100644
--- a/pam_console/hashtable.h
+++ b/pam_console/hashtable.h
@@ -19,7 +19,7 @@ struct hashtable;
  *      v = (struct some_value *)   malloc(sizeof(struct some_value));
  *
  *      (initialise k and v to suitable values)
- * 
+ *
  *      if (! hashtable_insert(h,k,v) )
  *      {     exit(-1);               }
  *
@@ -33,7 +33,7 @@ struct hashtable;
 
 /* Macros may be used to define type-safe(r) hashtable access functions, with
  * methods specialized to take known key and value types as parameters.
- * 
+ *
  * Example:
  *
  * Insert this at the start of your file:
@@ -63,7 +63,7 @@ struct hashtable;
 
 /*****************************************************************************
  * create_hashtable
-   
+
  * @name                    create_hashtable
  * @param   minsize         minimum initial size of hashtable
  * @param   hashfunction    function for hashing keys
@@ -78,7 +78,7 @@ create_hashtable(unsigned int minsize,
 
 /*****************************************************************************
  * hashtable_insert
-   
+
  * @name        hashtable_insert
  * @param   h   the hashtable to insert into
  * @param   k   the key - hashtable claims ownership and will free on removal
@@ -95,7 +95,7 @@ create_hashtable(unsigned int minsize,
  * If in doubt, remove before insert.
  */
 
-int 
+int
 hashtable_insert(struct hashtable *h, void *k, void *v);
 
 #define DEFINE_HASHTABLE_INSERT(fnname, keytype, valuetype) \
@@ -106,7 +106,7 @@ int fnname (struct hashtable *h, keytype *k, valuetype *v) \
 
 /*****************************************************************************
  * hashtable_search
-   
+
  * @name        hashtable_search
  * @param   h   the hashtable to search
  * @param   k   the key to search for  - does not claim ownership
@@ -124,7 +124,7 @@ valuetype * fnname (struct hashtable *h, keytype *k) \
 
 /*****************************************************************************
  * hashtable_remove
-   
+
  * @name        hashtable_remove
  * @param   h   the hashtable to remove the item from
  * @param   k   the key to search for  - does not claim ownership
@@ -143,7 +143,7 @@ valuetype * fnname (struct hashtable *h, keytype *k) \
 
 /*****************************************************************************
  * hashtable_count
-   
+
  * @name        hashtable_count
  * @param   h   the hashtable
  * @return      the number of items stored in the hashtable
@@ -154,7 +154,7 @@ hashtable_count(struct hashtable *h);
 
 /*****************************************************************************
  * hashtable_destroy
-   
+
  * @name        hashtable_destroy
  * @param   h   the hashtable
  * @param       free_values     whether to call 'free' on the remaining values
@@ -168,23 +168,23 @@ hashtable_destroy(struct hashtable *h, int free_values);
 /*
  * Copyright (c) 2002, Christopher Clark
  * All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
- * 
+ *
  * * Redistributions in binary form must reproduce the above copyright
  * notice, this list of conditions and the following disclaimer in the
  * documentation and/or other materials provided with the distribution.
- * 
+ *
  * * Neither the name of the original author; nor the names of any contributors
  * may be used to endorse or promote products derived from this software
  * without specific prior written permission.
- * 
- * 
+ *
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
diff --git a/pam_console/hashtable_private.h b/pam_console/hashtable_private.h
index 3e95f60..3a558e6 100644
--- a/pam_console/hashtable_private.h
+++ b/pam_console/hashtable_private.h
@@ -54,23 +54,23 @@ indexFor(unsigned int tablelength, unsigned int hashvalue)
 /*
  * Copyright (c) 2002, Christopher Clark
  * All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
- * 
+ *
  * * Redistributions in binary form must reproduce the above copyright
  * notice, this list of conditions and the following disclaimer in the
  * documentation and/or other materials provided with the distribution.
- * 
+ *
  * * Neither the name of the original author; nor the names of any contributors
  * may be used to endorse or promote products derived from this software
  * without specific prior written permission.
- * 
- * 
+ *
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
diff --git a/pam_console/pam_console.c b/pam_console/pam_console.c
index 10a7f00..6de9abb 100644
--- a/pam_console/pam_console.c
+++ b/pam_console/pam_console.c
@@ -191,7 +191,7 @@ check_console_name(pam_handle_t *pamh, const char *consolename, int nonroot_ok, 
     if (!found) {
         /* not found */
         _pam_log(pamh, LOG_INFO, TRUE, "no matching console regex found");
-        return 0;      
+        return 0;
     }
 
     /* add some policy here -- not really the PAM way of doing things, but
@@ -218,7 +218,7 @@ check_console_name(pam_handle_t *pamh, const char *consolename, int nonroot_ok, 
         int l;
         char *dot = NULL;
         char *path = full_path + 1;
-        
+
         full_path[0] = '\0';
         strcpy(path, "/tmp/.X11-unix/X");
         l = sizeof(full_path) - 2 - strlen(path);
@@ -239,7 +239,7 @@ check_console_name(pam_handle_t *pamh, const char *consolename, int nonroot_ok, 
         }
         else if (!on_set) {  /* there is no X11 socket in case of X11 crash */
             _pam_log(pamh, LOG_DEBUG, TRUE, "can't find X11 socket to examine for %s probably due to X crash", consolename);
-            statted = 1; 
+            statted = 1;
         }
     }
 
@@ -561,9 +561,9 @@ pam_sm_open_session(pam_handle_t *pamh, int flags UNUSED,
     }
 
     /* get configuration */
-    if (!configfileparsed) { 
+    if (!configfileparsed) {
         console_parse_handlers(pamh, consolehandlers);
-        configfileparsed = 1; 
+        configfileparsed = 1;
     }
 
     /* return success quietly if not a terminal login */
@@ -582,7 +582,7 @@ pam_sm_open_session(pam_handle_t *pamh, int flags UNUSED,
 	/* errors will be logged and are not critical */
 	console_run_handlers(pamh, TRUE, username, tty);
     }
-    
+
     free(lockfile);
     return ret;
 }
@@ -655,7 +655,7 @@ pam_sm_close_session(pam_handle_t *pamh, int flags UNUSED,
 		if (pam_modutil_read (fd, consoleuser, st.st_size) == -1) {
 		    _pam_log(pamh, LOG_ERR, FALSE,
 			    "\"impossible\" read error on %s", consolelock);
-		    err = PAM_SESSION_ERR; 
+		    err = PAM_SESSION_ERR;
 		    close(fd);
 		    goto decrement;
 		}
diff --git a/pam_console/pam_console_apply.8 b/pam_console/pam_console_apply.8
index 46827a6..f069bc3 100644
--- a/pam_console/pam_console_apply.8
+++ b/pam_console/pam_console_apply.8
@@ -3,7 +3,7 @@
 .SH NAME
 pam_console_apply \- set or revoke permissions for users at the system console
 .SH SYNOPSIS
-.B pam_console_apply 
+.B pam_console_apply
 [-f <fstab file>] [-c <console.perms file>] [-r] [-t <tty>] [-s] [-d] [<device file> ...]
 .SH DESCRIPTION
 \fBpam_console_apply\fP is a helper executable which sets or resets permissions
diff --git a/pam_console/pam_console_apply.c b/pam_console/pam_console_apply.c
index f4c88fd..ad33660 100644
--- a/pam_console/pam_console_apply.c
+++ b/pam_console/pam_console_apply.c
@@ -107,10 +107,10 @@ main(int argc, char **argv)
 			case 'r':
 				  sense = Reset;
 				  break;
-			case 's': 
+			case 's':
 				  syslogging = TRUE;
 				  break;
-			case 'd': 
+			case 'd':
 				  debug = TRUE;
 				  break;
 			default:
@@ -132,7 +132,7 @@ main(int argc, char **argv)
 		parse_files();
 	else
 		parse_file(consoleperms);
-		
+
         if (sense != Reset && (fd=open(consolelock, O_RDONLY)) != -1) {
 		if (fstat (fd, &st)) {
 			_pam_log(NULL, LOG_ERR, FALSE,

From 614ce9985c1d5789b47026a42f2fe150b3e89d88 Mon Sep 17 00:00:00 2001
From: Björn Esser <besser82@fedoraproject.org>
Date: Sep 23 2021 09:15:35 +0000
Subject: [PATCH 4/4] New release 1.1.5


Signed-off-by: Björn Esser <besser82@fedoraproject.org>

---

diff --git a/CHANGELOG.pam-redhat b/CHANGELOG.pam-redhat
index 507b35c..e405ec0 100644
--- a/CHANGELOG.pam-redhat
+++ b/CHANGELOG.pam-redhat
@@ -4,6 +4,11 @@ Changelog of pam-redhat modules
 This changelog describes only changes after branching of pam-redhat modules
 without autoconf support.
 
+1.1.5: Thu Sep 23 2021
+* pam_console: fix covscan issues
+* pam_console: Fix race condition for BUILT_SOURCES on parallel build
+* Makefile: Use xz compression for release tarballs
+
 1.1.4: Wed Nov 11 2020
 * pam_console: update compilation flags
 
diff --git a/Makefile b/Makefile
index 8914bb9..7455914 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-VERSION=1.1.4
+VERSION=1.1.5
 TAG=pam-redhat-$(VERSION)
 
 nothing:

