Commit graph

9 commits

Author SHA1 Message Date
Drew DeVault c89e00a97e Fix swaylock w/shadow on glibc, improve security
Today I learned that GNU flaunts the POSIX standard in yet another
creative way. Additionally, this adds some security improvements,
namely:

- Zeroing out password buffers in the privileged child process
- setuid/setgid after reading /etc/shadow
2018-10-06 12:20:12 -04:00
Arkadiusz Hiler eed0bc3ebd Add support for installing binaries with DT_RPATH
It's better to use DT_RPATH dynamic section of the elf binary to store
the paths of libraries to load instead of overwriting LD_LIBRARY_PATH
for the whole environment, causing surprises. This solution is much more
transparent and perfectly suitable for running contained installations
of wayland/wlroots/sway.

The code unsetting the LD_LIBRARY_PATH/LD_PRELOAD was also deleted as
it's a placebo security at best - we should trust the execution path
that leads us to running sway, and it's way too late to care about those
variables since we already started executing our compositor, thus we
would be compromised anyway.
2018-09-30 15:37:01 +03:00
Drew DeVault c977349120 Add support for building swaylock without PAM
This involves setuid'ing swaylock, which then forks and drops perms on
the parent process. The child process remains root and listens on a pipe
for requests to validate passwords against /etc/shadow.
2018-09-28 13:53:01 +02:00
sghctoma 6de777a986 Add FreeBSD-specific PAM configuration
The "login" PAM configuration means somathing entirely different on
FreeBSD than on Linux: if you try to authenticate as the calling user,
it OKs the request without prompting for password. The "passwd" config
implements the desired functionality, therefore it should be used by
swaylock.
2018-08-30 09:58:57 +02:00
Bruno Pinto 55ed2736b5
[swaylock] Install pam module 2018-04-20 01:29:47 +01:00
Drew DeVault 066143adef Add password buffer, refactor rendering/surfaces 2018-04-04 18:47:48 -04:00
Drew DeVault 1fe3cb8965 Link swaylock to xkbcommon 2018-04-04 18:47:48 -04:00
Drew DeVault 1008d4cc91 Split seat code into its own file 2018-04-04 18:47:48 -04:00
Drew DeVault b32bf595ae Initial swaylock port 2018-04-04 18:47:48 -04:00