{"action":"created","comment":{"url":"https://api.github.com/repos/google/google-authenticator/pulls/comments/53841057","id":53841057,"diff_hunk":"@@ -350,10 +352,22 @@ static int open_secret_file(pam_handle_t *pamh, const char *secret_filename,\n     return -1;\n   }\n \n+  // print comparisson\n+  if (params->debug) {\n+    log_message(LOG_INFO, pamh, \"Secret file permissions are %4o\", orig_stat->st_mode & 03577);\n+    if (params->allow_perm) {\n+      log_message(LOG_INFO, pamh, \"Extra file permissions allowed are %4o\", params->allow_perm);\n+    }\n+  }\n+\n   // Check permissions on \"~/.google_authenticator\"\n-  if ((orig_stat->st_mode & 03577) != 0400 ||\n+  if (((orig_stat->st_mode & 03577) != 0400 &&","path":"libpam/pam_google_authenticator.c","position":23,"original_position":23,"commit_id":"bbbbba99bd6f2c0f32d3137d8924d246a7b4e734","original_commit_id":"bbbbba99bd6f2c0f32d3137d8924d246a7b4e734","user":{"login":"ThomasHabets","id":6056,"avatar_url":"https://avatars.githubusercontent.com/u/6056?v=3","gravatar_id":"","url":"https://api.github.com/users/ThomasHabets","html_url":"https://github.com/ThomasHabets","followers_url":"https://api.github.com/users/ThomasHabets/followers","following_url":"https://api.github.com/users/ThomasHabets/following{/other_user}","gists_url":"https://api.github.com/users/ThomasHabets/gists{/gist_id}","starred_url":"https://api.github.com/users/ThomasHabets/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ThomasHabets/subscriptions","organizations_url":"https://api.github.com/users/ThomasHabets/orgs","repos_url":"https://api.github.com/users/ThomasHabets/repos","events_url":"https://api.github.com/users/ThomasHabets/events{/privacy}","received_events_url":"https://api.github.com/users/ThomasHabets/received_events","type":"User","site_admin":false},"body":"This is probably more readable:\r\n\r\n```c\r\nint allow_perm = params->allow_perm;\r\nif (allow_perm == 0) {\r\n  allow_perm == 0400;\r\n}\r\nint wanted_uid = … similar\r\nif ((orig_stat->st_mode & 03577) != allow_perm…","created_at":"2016-02-23T20:04:47Z","updated_at":"2016-02-23T20:04:47Z","html_url":"https://github.com/google/google-authenticator/pull/542#discussion_r53841057","pull_request_url":"https://api.github.com/repos/google/google-authenticator/pulls/542","_links":{"self":{"href":"https://api.github.com/repos/google/google-authenticator/pulls/comments/53841057"},"html":{"href":"https://github.com/google/google-authenticator/pull/542#discussion_r53841057"},"pull_request":{"href":"https://api.github.com/repos/google/google-authenticator/pulls/542"}}},"pull_request":{"url":"https://api.github.com/repos/google/google-authenticator/pulls/542","id":60291222,"html_url":"https://github.com/google/google-authenticator/pull/542","diff_url":"https://github.com/google/google-authenticator/pull/542.diff","patch_url":"https://github.com/google/google-authenticator/pull/542.patch","issue_url":"https://api.github.com/repos/google/google-authenticator/issues/542","number":542,"state":"open","locked":false,"title":"Allow reduction of PAM restrictions","user":{"login":"pantsman0","id":10139336,"avatar_url":"https://avatars.githubusercontent.com/u/10139336?v=3","gravatar_id":"","url":"https://api.github.com/users/pantsman0","html_url":"https://github.com/pantsman0","followers_url":"https://api.github.com/users/pantsman0/followers","following_url":"https://api.github.com/users/pantsman0/following{/other_user}","gists_url":"https://api.github.com/users/pantsman0/gists{/gist_id}","starred_url":"https://api.github.com/users/pantsman0/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pantsman0/subscriptions","organizations_url":"https://api.github.com/users/pantsman0/orgs","repos_url":"https://api.github.com/users/pantsman0/repos","events_url":"https://api.github.com/users/pantsman0/events{/privacy}","received_events_url":"https://api.github.com/users/pantsman0/received_events","type":"User","site_admin":false},"body":"The commits in this PR implement 2 options for the PAM module:\r\n- no_strict_owner\r\n- allow_perm=<perm_octal>\r\n\r\nThese options are documented in the PR, but are intended for use in situations where the user secret files are stored outside the home directory (usually all in the same directory).\r\nThe expectation when using these options is that administrators will consider the risks associated with the requirements of this configuration (such as sticky-it requirements, etc).\r\n\r\nThese scenario that inspired this is the following:\r\n - 2 servers running radius servers\r\n - both servers should support 2FA\r\n - radius processes should not run as root\r\n\r\nThe configuration that we came to for synchronizing the google-authenticator files was to have them in their own separate directory (eg /var/spool/google-authenticator/${USER}.secret).\r\nThis allowed us to have the radius service run as an unprivileged service, and users are not able to interfere with each other's files due to default ACLs applied and sticky-bit settings on the folder.","created_at":"2016-02-23T05:45:53Z","updated_at":"2016-02-23T20:04:47Z","closed_at":null,"merged_at":null,"merge_commit_sha":"cde1b0ac02a8919ff03008728bee57548205622b","assignee":{"login":"ThomasHabets","id":6056,"avatar_url":"https://avatars.githubusercontent.com/u/6056?v=3","gravatar_id":"","url":"https://api.github.com/users/ThomasHabets","html_url":"https://github.com/ThomasHabets","followers_url":"https://api.github.com/users/ThomasHabets/followers","following_url":"https://api.github.com/users/ThomasHabets/following{/other_user}","gists_url":"https://api.github.com/users/ThomasHabets/gists{/gist_id}","starred_url":"https://api.github.com/users/ThomasHabets/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ThomasHabets/subscriptions","organizations_url":"https://api.github.com/users/ThomasHabets/orgs","repos_url":"https://api.github.com/users/ThomasHabets/repos","events_url":"https://api.github.com/users/ThomasHabets/events{/privacy}","received_events_url":"https://api.github.com/users/ThomasHabets/received_events","type":"User","site_admin":false},"milestone":null,"commits_url":"https://api.github.com/repos/google/google-authenticator/pulls/542/commits","review_comments_url":"https://api.github.com/repos/google/google-authenticator/pulls/542/comments","review_comment_url":"https://api.github.com/repos/google/google-authenticator/pulls/comments{/number}","comments_url":"https://api.github.com/repos/google/google-authenticator/issues/542/comments","statuses_url":"https://api.github.com/repos/google/google-authenticator/statuses/bbbbba99bd6f2c0f32d3137d8924d246a7b4e734","head":{"label":"pantsman0:master","ref":"master","sha":"bbbbba99bd6f2c0f32d3137d8924d246a7b4e734","user":{"login":"pantsman0","id":10139336,"avatar_url":"https://avatars.githubusercontent.com/u/10139336?v=3","gravatar_id":"","url":"https://api.github.com/users/pantsman0","html_url":"https://github.com/pantsman0","followers_url":"https://api.github.com/users/pantsman0/followers","following_url":"https://api.github.com/users/pantsman0/following{/other_user}","gists_url":"https://api.github.com/users/pantsman0/gists{/gist_id}","starred_url":"https://api.github.com/users/pantsman0/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pantsman0/subscriptions","organizations_url":"https://api.github.com/users/pantsman0/orgs","repos_url":"https://api.github.com/users/pantsman0/repos","events_url":"https://api.github.com/users/pantsman0/events{/privacy}","received_events_url":"https://api.github.com/users/pantsman0/received_events","type":"User","site_admin":false},"repo":{"id":52265807,"name":"google-authenticator","full_name":"pantsman0/google-authenticator","owner":{"login":"pantsman0","id":10139336,"avatar_url":"https://avatars.githubusercontent.com/u/10139336?v=3","gravatar_id":"","url":"https://api.github.com/users/pantsman0","html_url":"https://github.com/pantsman0","followers_url":"https://api.github.com/users/pantsman0/followers","following_url":"https://api.github.com/users/pantsman0/following{/other_user}","gists_url":"https://api.github.com/users/pantsman0/gists{/gist_id}","starred_url":"https://api.github.com/users/pantsman0/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pantsman0/subscriptions","organizations_url":"https://api.github.com/users/pantsman0/orgs","repos_url":"https://api.github.com/users/pantsman0/repos","events_url":"https://api.github.com/users/pantsman0/events{/privacy}","received_events_url":"https://api.github.com/users/pantsman0/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/pantsman0/google-authenticator","description":"Open source version of Google Authenticator (except the Android app)","fork":true,"url":"https://api.github.com/repos/pantsman0/google-authenticator","forks_url":"https://api.github.com/repos/pantsman0/google-authenticator/forks","keys_url":"https://api.github.com/repos/pantsman0/google-authenticator/keys{/key_id}","collaborators_url":"https://api.github.com/repos/pantsman0/google-authenticator/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/pantsman0/google-authenticator/teams","hooks_url":"https://api.github.com/repos/pantsman0/google-authenticator/hooks","issue_events_url":"https://api.github.com/repos/pantsman0/google-authenticator/issues/events{/number}","events_url":"https://api.github.com/repos/pantsman0/google-authenticator/events","assignees_url":"https://api.github.com/repos/pantsman0/google-authenticator/assignees{/user}","branches_url":"https://api.github.com/repos/pantsman0/google-authenticator/branches{/branch}","tags_url":"https://api.github.com/repos/pantsman0/google-authenticator/tags","blobs_url":"https://api.github.com/repos/pantsman0/google-authenticator/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/pantsman0/google-authenticator/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/pantsman0/google-authenticator/git/refs{/sha}","trees_url":"https://api.github.com/repos/pantsman0/google-authenticator/git/trees{/sha}","statuses_url":"https://api.github.com/repos/pantsman0/google-authenticator/statuses/{sha}","languages_url":"https://api.github.com/repos/pantsman0/google-authenticator/languages","stargazers_url":"https://api.github.com/repos/pantsman0/google-authenticator/stargazers","contributors_url":"https://api.github.com/repos/pantsman0/google-authenticator/contributors","subscribers_url":"https://api.github.com/repos/pantsman0/google-authenticator/subscribers","subscription_url":"https://api.github.com/repos/pantsman0/google-authenticator/subscription","commits_url":"https://api.github.com/repos/pantsman0/google-authenticator/commits{/sha}","git_commits_url":"https://api.github.com/repos/pantsman0/google-authenticator/git/commits{/sha}","comments_url":"https://api.github.com/repos/pantsman0/google-authenticator/comments{/number}","issue_comment_url":"https://api.github.com/repos/pantsman0/google-authenticator/issues/comments{/number}","contents_url":"https://api.github.com/repos/pantsman0/google-authenticator/contents/{+path}","compare_url":"https://api.github.com/repos/pantsman0/google-authenticator/compare/{base}...{head}","merges_url":"https://api.github.com/repos/pantsman0/google-authenticator/merges","archive_url":"https://api.github.com/repos/pantsman0/google-authenticator/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/pantsman0/google-authenticator/downloads","issues_url":"https://api.github.com/repos/pantsman0/google-authenticator/issues{/number}","pulls_url":"https://api.github.com/repos/pantsman0/google-authenticator/pulls{/number}","milestones_url":"https://api.github.com/repos/pantsman0/google-authenticator/milestones{/number}","notifications_url":"https://api.github.com/repos/pantsman0/google-authenticator/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/pantsman0/google-authenticator/labels{/name}","releases_url":"https://api.github.com/repos/pantsman0/google-authenticator/releases{/id}","deployments_url":"https://api.github.com/repos/pantsman0/google-authenticator/deployments","created_at":"2016-02-22T10:28:56Z","updated_at":"2016-02-22T10:28:59Z","pushed_at":"2016-02-23T03:42:14Z","git_url":"git://github.com/pantsman0/google-authenticator.git","ssh_url":"git@github.com:pantsman0/google-authenticator.git","clone_url":"https://github.com/pantsman0/google-authenticator.git","svn_url":"https://github.com/pantsman0/google-authenticator","homepage":"","size":2361,"stargazers_count":0,"watchers_count":0,"language":"Java","has_issues":false,"has_downloads":false,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"google:master","ref":"master","sha":"43ab9724906254796ca33ffcc7e8db94d014ffa6","user":{"login":"google","id":1342004,"avatar_url":"https://avatars.githubusercontent.com/u/1342004?v=3","gravatar_id":"","url":"https://api.github.com/users/google","html_url":"https://github.com/google","followers_url":"https://api.github.com/users/google/followers","following_url":"https://api.github.com/users/google/following{/other_user}","gists_url":"https://api.github.com/users/google/gists{/gist_id}","starred_url":"https://api.github.com/users/google/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/google/subscriptions","organizations_url":"https://api.github.com/users/google/orgs","repos_url":"https://api.github.com/users/google/repos","events_url":"https://api.github.com/users/google/events{/privacy}","received_events_url":"https://api.github.com/users/google/received_events","type":"Organization","site_admin":false},"repo":{"id":24953080,"name":"google-authenticator","full_name":"google/google-authenticator","owner":{"login":"google","id":1342004,"avatar_url":"https://avatars.githubusercontent.com/u/1342004?v=3","gravatar_id":"","url":"https://api.github.com/users/google","html_url":"https://github.com/google","followers_url":"https://api.github.com/users/google/followers","following_url":"https://api.github.com/users/google/following{/other_user}","gists_url":"https://api.github.com/users/google/gists{/gist_id}","starred_url":"https://api.github.com/users/google/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/google/subscriptions","organizations_url":"https://api.github.com/users/google/orgs","repos_url":"https://api.github.com/users/google/repos","events_url":"https://api.github.com/users/google/events{/privacy}","received_events_url":"https://api.github.com/users/google/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/google/google-authenticator","description":"Open source version of Google Authenticator (except the Android app)","fork":false,"url":"https://api.github.com/repos/google/google-authenticator","forks_url":"https://api.github.com/repos/google/google-authenticator/forks","keys_url":"https://api.github.com/repos/google/google-authenticator/keys{/key_id}","collaborators_url":"https://api.github.com/repos/google/google-authenticator/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/google/google-authenticator/teams","hooks_url":"https://api.github.com/repos/google/google-authenticator/hooks","issue_events_url":"https://api.github.com/repos/google/google-authenticator/issues/events{/number}","events_url":"https://api.github.com/repos/google/google-authenticator/events","assignees_url":"https://api.github.com/repos/google/google-authenticator/assignees{/user}","branches_url":"https://api.github.com/repos/google/google-authenticator/branches{/branch}","tags_url":"https://api.github.com/repos/google/google-authenticator/tags","blobs_url":"https://api.github.com/repos/google/google-authenticator/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/google/google-authenticator/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/google/google-authenticator/git/refs{/sha}","trees_url":"https://api.github.com/repos/google/google-authenticator/git/trees{/sha}","statuses_url":"https://api.github.com/repos/google/google-authenticator/statuses/{sha}","languages_url":"https://api.github.com/repos/google/google-authenticator/languages","stargazers_url":"https://api.github.com/repos/google/google-authenticator/stargazers","contributors_url":"https://api.github.com/repos/google/google-authenticator/contributors","subscribers_url":"https://api.github.com/repos/google/google-authenticator/subscribers","subscription_url":"https://api.github.com/repos/google/google-authenticator/subscription","commits_url":"https://api.github.com/repos/google/google-authenticator/commits{/sha}","git_commits_url":"https://api.github.com/repos/google/google-authenticator/git/commits{/sha}","comments_url":"https://api.github.com/repos/google/google-authenticator/comments{/number}","issue_comment_url":"https://api.github.com/repos/google/google-authenticator/issues/comments{/number}","contents_url":"https://api.github.com/repos/google/google-authenticator/contents/{+path}","compare_url":"https://api.github.com/repos/google/google-authenticator/compare/{base}...{head}","merges_url":"https://api.github.com/repos/google/google-authenticator/merges","archive_url":"https://api.github.com/repos/google/google-authenticator/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/google/google-authenticator/downloads","issues_url":"https://api.github.com/repos/google/google-authenticator/issues{/number}","pulls_url":"https://api.github.com/repos/google/google-authenticator/pulls{/number}","milestones_url":"https://api.github.com/repos/google/google-authenticator/milestones{/number}","notifications_url":"https://api.github.com/repos/google/google-authenticator/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/google/google-authenticator/labels{/name}","releases_url":"https://api.github.com/repos/google/google-authenticator/releases{/id}","deployments_url":"https://api.github.com/repos/google/google-authenticator/deployments","created_at":"2014-10-08T17:54:27Z","updated_at":"2016-02-23T17:40:42Z","pushed_at":"2016-02-23T05:45:54Z","git_url":"git://github.com/google/google-authenticator.git","ssh_url":"git@github.com:google/google-authenticator.git","clone_url":"https://github.com/google/google-authenticator.git","svn_url":"https://github.com/google/google-authenticator","homepage":"","size":2479,"stargazers_count":1109,"watchers_count":1109,"language":"Java","has_issues":true,"has_downloads":false,"has_wiki":true,"has_pages":false,"forks_count":252,"mirror_url":null,"open_issues_count":187,"forks":252,"open_issues":187,"watchers":1109,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/google/google-authenticator/pulls/542"},"html":{"href":"https://github.com/google/google-authenticator/pull/542"},"issue":{"href":"https://api.github.com/repos/google/google-authenticator/issues/542"},"comments":{"href":"https://api.github.com/repos/google/google-authenticator/issues/542/comments"},"review_comments":{"href":"https://api.github.com/repos/google/google-authenticator/pulls/542/comments"},"review_comment":{"href":"https://api.github.com/repos/google/google-authenticator/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/google/google-authenticator/pulls/542/commits"},"statuses":{"href":"https://api.github.com/repos/google/google-authenticator/statuses/bbbbba99bd6f2c0f32d3137d8924d246a7b4e734"}}}}