Caspar Schutijser <[email protected]> writes: > On Thu, Oct 22, 2026 at 01:58:23PM +0200, Antoine Jacoutot wrote: >> On Thu, Oct 22, 2026 at 12:30:50PM +0100, Stuart Henderson wrote: >> > On 2026/10/21 20:37, Caspar Schutijser wrote: >> > > Hi, >> > > >> > > Below is a diff to make xscreensaver work with _permit_setugid. >> > > Run-time tested by me. >> > > >> > > Comments or OKs? >> > > >> > > Caspar >> > > >> > > >> > > Index: Makefile >> > > =================================================================== >> > > RCS file: /cvs/ports/x11/xscreensaver/Makefile,v >> > > diff -u -p -r1.125 Makefile >> > > --- Makefile 17 Apr 2026 15:14:06 -0000 1.125 >> > > +++ Makefile 21 Oct 2026 18:37:09 -0000 >> > > @@ -9,7 +9,7 @@ COMMENT= screen saver and locker for the >> > > # Ideally this wants a bsdauth driver to be written, change to being >> > > # installed setgid auth, and figure out any issues resulting. >> > >> > If someone wants a little coding project, the above would be handy... >> > (xscreensaver seems much better than xlock at stopping password >> > keypresses from getting through to terminals...) >> >> There was an initial work on this: >> https://cvsweb.openbsd.org/checkout/ports/x11/xscreensaver/files/Attic/passwd-bsd_auth.c?rev=1.3 >> https://cvsweb.openbsd.org/checkout/ports/x11/xscreensaver/patches/Attic/patch-driver_setuid_c?rev=1.1 >> https://cvsweb.openbsd.org/checkout/ports/x11/xscreensaver/patches/Attic/patch-driver_passwd_c?rev=1.1 >> https://cvsweb.openbsd.org/checkout/ports/x11/xscreensaver/patches/Attic/patch-config_h_in?rev=1.1 > > Good to know, thanks. I'll have a look at this in the next few days. > But Manuel, if you already have a diff, that would be nice too!
Sure. Here's what I had. This was really a work in progress as I was discovering bsdauth along the way. Also at the time I was working on version 6.09. Hope this help.
>From 7b06f03ebfc0a595721ab661b5d661ed77b0073b Mon Sep 17 00:00:00 2001 From: Manuel Giraud <[email protected]> Date: Thu, 4 Jul 2024 10:43:21 +0200 Subject: [PATCH 1/2] fix OpenBSD shadow test --- configure.ac | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac index dc2ad2f..3c78d55 100644 --- a/configure.ac +++ b/configure.ac @@ -2628,7 +2628,7 @@ if test "$with_shadow" = yes ; then #include <unistd.h> #include <sys/types.h> #include <pwd.h>], - [struct spwd *p = getspnam_shadow("nobody"); + [struct passwd *p = getpwnam_shadow("nobody"); const char *pw = p->pw_passwd;], [ac_cv_pwnam_shadow=yes], [ac_cv_pwnam_shadow=no])]) -- 2.55.0
>From 26970e7bda09a1e85700262b8df1a0474f79e9f9 Mon Sep 17 00:00:00 2001 From: Manuel Giraud <[email protected]> Date: Mon, 8 Jul 2024 20:24:15 +0200 Subject: [PATCH 2/2] BSD Authentication support Tested on OpenBSD only. --- configure.ac | 45 ++++++++++++++++++++++++- driver/Makefile.in | 10 ++++-- driver/auth.h | 4 +++ driver/passwd-bsdauth.c | 69 ++++++++++++++++++++++++++++++++++++++ driver/passwd.c | 3 ++ driver/xscreensaver-auth.c | 4 +++ 6 files changed, 132 insertions(+), 3 deletions(-) create mode 100644 driver/passwd-bsdauth.c diff --git a/configure.ac b/configure.ac index 3c78d55..3301e5e 100644 --- a/configure.ac +++ b/configure.ac @@ -267,6 +267,9 @@ AH_TEMPLATE([HAVE_SHADOW_PASSWD], AH_TEMPLATE([HAVE_PWNAM_SHADOW_PASSWD], [Define this if your system uses getpwnam_shadow.]) +AH_TEMPLATE([HAVE_BSDAUTH], + [Define this if your system uses BSD Authentication system.]) + AH_TEMPLATE([HAVE_ENHANCED_PASSWD], [Define this for DEC/SCO "Enhanced Security" with getprpwnam.]) @@ -2709,8 +2712,44 @@ if test "$enable_locking" = yes -a "$have_pam" = no ; then esac fi +############################################################################### +# +# Check for BSD Authentication system. +# +############################################################################### +have_bsdauth=no +with_bsdauth_req=unspecified -if test "$have_shadow_adjunct" = yes ; then +AC_ARG_WITH(bsdauth, +[ --with-bsdauth Include support for BSD Authentication system.], + [with_bsdauth="$withval"; with_bsdauth_req="$withval"],[with_bsdauth=yes]) + +HANDLE_X_PATH_ARG(with_bsdauth, --with-bsdauth, BSD Authentication system) + +if test "$enable_locking" = no ; then + with_bsdauth_req=no + with_bsdauth=no +fi + +if test "$with_bsdauth" = yes ; then + AC_CACHE_CHECK([for BSD Authentication system], ac_cv_bsdauth, + [AC_TRY_X_COMPILE([#include <stdlib.h> + #include <unistd.h> + #include <sys/types.h> + #include <login_cap.h> + #include <bsd_auth.h>], + [auth_session_t *as = auth_open(); + auth_close(as);], + [ac_cv_bsdauth=yes], + [ac_cv_bsdauth=no])]) + if test "$ac_cv_bsdauth" = yes; then + have_bsdauth=yes + fi +fi + +if test "$have_bsdauth" = yes ; then + AC_DEFINE(HAVE_BSDAUTH) +elif test "$have_shadow_adjunct" = yes ; then AC_DEFINE(HAVE_ADJUNCT_PASSWD) elif test "$have_shadow_enhanced" = yes ; then AC_DEFINE(HAVE_ENHANCED_PASSWD) @@ -4297,6 +4336,10 @@ if test "$have_pam" = yes; then PASSWD_OBJS="$PASSWD_OBJS \$(PAM_OBJS)" INSTALL_PAM="install-pam" fi +if test "$have_bsdauth" = yes; then + PASSWD_SRCS="$PASSWD_SRCS \$(BSDAUTH_SRCS)" + PASSWD_OBJS="$PASSWD_OBJS \$(BSDAUTH_OBJS)" +fi if test "$enable_pam_check_account_type" = yes; then COMMENT_PAM_CHECK_ACCOUNT="" else diff --git a/driver/Makefile.in b/driver/Makefile.in index 4b3c1cb..1b26d80 100644 --- a/driver/Makefile.in +++ b/driver/Makefile.in @@ -131,6 +131,9 @@ GFX_LIBS = $(LIBS_PRE) $(XFT_LIBS) $(XDPMS_LIBS) $(XINERAMA_LIBS) \ PWENT_SRCS = passwd-pwent.c PWENT_OBJS = passwd-pwent.o +BSDAUTH_SRCS = passwd-bsdauth.c +BSDAUTH_OBJS = passwd-bsdauth.o + KERBEROS_SRCS = passwd-kerberos.c KERBEROS_OBJS = passwd-kerberos.o @@ -235,7 +238,7 @@ EXTRAS = README Makefile.in \ TARFILES = $(DAEMON_SRCS) $(GFX_SRCS) $(AUTH_SRCS) $(SYSTEMD_SRCS) \ $(CMD_SRCS) $(GTK_SRCS) $(MOTIF_SRCS) $(PWENT_SRCS) \ - $(KERBEROS_SRCS) $(PAM_SRCS) \ + $(KERBEROS_SRCS) $(BSDAUTH_SRCS) $(PAM_SRCS) \ $(HDRS) $(MENA) $(MENB) $(TEST_SRCS) $(EXTRAS) # Using $(MAKE) directly means the shell executes things even with "make -n" @@ -689,7 +692,7 @@ distdepend: check_men update_ad_version XScreenSaver_ad.h XScreenSaver_Xm_ad.h -s '# DO NOT DELETE: updated by make distdepend' $(DEPEND_FLAGS) -- \ $(INCLUDES_1) $(DEFS) $(DEPEND_DEFINES) $(CFLAGS) $(X_CFLAGS) -- \ $(SAVER_SRCS_1) $(SYSTEMD_SRCS) $(MOTIF_SRCS) $(GTK_SRCS) \ - $(PWENT_SRCS) $(KERBEROS_SRCS) $(PAM_SRCS) \ + $(PWENT_SRCS) $(KERBEROS_SRCS) $(BSDAUTH_SRCS) $(PAM_SRCS) \ $(LOCK_SRCS_1) $(DEMO_SRCS_1) $(CMD_SRCS) \ $(TEST_SRCS) 2>/dev/null | \ sort -d | \ @@ -1017,6 +1020,9 @@ demo-Gtk.o: $(UTILS_SRC)/xmu.h demo-Gtk.o: $(UTILS_SRC)/xscreensaver-intl.h demo-Xm.o: ../config.h demo-Xm-widgets.o: ../config.h +passwd-bsdauth.o: $(srcdir)/auth.h +passwd-bsdauth.o: $(srcdir)/blurb.h +passwd-bsdauth.o: ../config.h passwd-kerberos.o: $(srcdir)/auth.h passwd-kerberos.o: $(srcdir)/blurb.h passwd-kerberos.o: ../config.h diff --git a/driver/auth.h b/driver/auth.h index 80a49ba..d2c04c3 100644 --- a/driver/auth.h +++ b/driver/auth.h @@ -61,6 +61,10 @@ extern Bool kerberos_lock_init (void); extern Bool kerberos_passwd_valid_p (void *closure, const char *plaintext); #endif +#ifdef HAVE_BSDAUTH +extern Bool bsdauth_passwd_valid_p (void *closure, const char *plaintext); +#endif + #ifdef HAVE_PAM extern Bool pam_priv_init (void); extern Bool pam_try_unlock (void *closure, diff --git a/driver/passwd-bsdauth.c b/driver/passwd-bsdauth.c new file mode 100644 index 0000000..17da477 --- /dev/null +++ b/driver/passwd-bsdauth.c @@ -0,0 +1,69 @@ +/* passwd-bsdauth.c --- verifying typed passwords with the BSD + * Authentication system. + * xscreensaver, Copyright © 1993-2022 Jamie Zawinski <[email protected]> + * + * Permission to use, copy, modify, distribute, and sell this software and its + * documentation for any purpose is hereby granted without fee, provided that + * the above copyright notice appear in all copies and that both that + * copyright notice and this permission notice appear in supporting + * documentation. No representations are made about the suitability of this + * software for any purpose. It is provided "as is" without express or + * implied warranty. + */ + +#ifdef HAVE_CONFIG_H +# include "config.h" +#endif + +#ifndef NO_LOCKING /* whole file */ + +#include <stdlib.h> +#ifdef HAVE_UNISTD_H +# include <unistd.h> +#endif + +#include <stdio.h> +#include <string.h> +#include <sys/types.h> +#include <pwd.h> +#include <login_cap.h> +#include <bsd_auth.h> + +#ifdef __bsdi__ +# include <sys/param.h> +# if _BSDI_VERSION >= 199608 +# define BSD_AUTH +# endif +#endif /* __bsdi__ */ + + +#include "blurb.h" +#include "auth.h" + +/* This can be called at any time, and says whether the typed password + belongs to either the logged in user (real uid, not effective); or + to root. + */ +Bool +bsdauth_passwd_valid_p (void *closure, const char *typed_passwd) +{ + struct passwd *p = getpwuid (getuid ()); + char *pass = strdup (typed_passwd); + + if (p && auth_userokay (p->pw_name, NULL, NULL, pass)) + return True; + +#ifdef ALLOW_ROOT_PASSWD + /* 'pass' was nuked by the previous auth_userokay call */ + else if ((pass = strdup (typed_passwd)) && + auth_userokay ("root", NULL, NULL, pass)) + return True; +#endif /* ALLOW_ROOT_PASSWD */ + + else + return False; +} + +#else /* NO_LOCKING */ +int _ignore_; +#endif /* NO_LOCKING -- whole file */ diff --git a/driver/passwd.c b/driver/passwd.c index 11ca134..ac88cd2 100644 --- a/driver/passwd.c +++ b/driver/passwd.c @@ -92,6 +92,9 @@ struct auth_methods methods[] = { # ifdef HAVE_KERBEROS { "KRB", kerberos_lock_init, 0, kerberos_passwd_valid_p, 0, }, # endif +# ifdef HAVE_BSDAUTH + { "BSD", 0, 0, bsdauth_passwd_valid_p, 0, }, +# endif # ifdef PASSWD_HELPER_PROGRAM { "EXT", 0, ext_priv_init, ext_passwd_valid_p, 0, }, # endif diff --git a/driver/xscreensaver-auth.c b/driver/xscreensaver-auth.c index a65cc0d..079157b 100644 --- a/driver/xscreensaver-auth.c +++ b/driver/xscreensaver-auth.c @@ -340,7 +340,11 @@ main (int argc, char **argv) if (!splash_p && !init_p) lock_priv_init (); + /* I have not found a way to drop privileges and have access to + bsdauth at least on OpenBSD. */ +#if !defined(HAVE_BSDAUTH) || !defined(__OpenBSD__) disavow_privileges (); +#endif if (!splash_p && !init_p) lock_init (); -- 2.55.0
-- Manuel Giraud
