unveil _PATH_LOGIN_CONF_D

Change the error reporting pattern throughout the tree when unveil
fails to report the path that the failure occured on. Suggested by
deraadt@ after some tech discussion.

Work done and verified by A

Change the error reporting pattern throughout the tree when unveil
fails to report the path that the failure occured on. Suggested by
deraadt@ after some tech discussion.

Work done and verified by Ashton Fagg <ashton@fagg.id.au>

ok deraadt@ semarie@ claudio@

show more ...

correct some unveil(2) violations due to "login.conf.db" access (the .db version
of "login.conf"), and stat(2) on _PATH_MASTERPASSWD_LOCK (via pw_mkdb(3)).

problem initially noted by myself for pass

correct some unveil(2) violations due to "login.conf.db" access (the .db version
of "login.conf"), and stat(2) on _PATH_MASTERPASSWD_LOCK (via pw_mkdb(3)).

problem initially noted by myself for passwd(1)
millert@ reported similar problem on chpass(1), su(1), doas(1) and encrypt(1)
mestre@ noted chpass(1) too

ok mestre@ millert@

show more ...

The first unveil userland commit!

unveil _PATH_LOGIN_CONF (/etc/login.conf) which is used by
login_getclass(3) and family before doing password encode. This
is the only filename used by the program

The first unveil userland commit!

unveil _PATH_LOGIN_CONF (/etc/login.conf) which is used by
login_getclass(3) and family before doing password encode. This
is the only filename used by the program during runtime, everything
else happens on stdin/stdout.

show more ...

This does not need pledge "wpath"

Use freezero instead of explicit_bzero+free

OK tb@

Use the safe idiom of cleaning sensitive data from memory with explicit_bzero,
instead of relying on other methods, after readpassphrase. Some programs on
this diff won't benefit that much since it h

Use the safe idiom of cleaning sensitive data from memory with explicit_bzero,
instead of relying on other methods, after readpassphrase. Some programs on
this diff won't benefit that much since it happens near the terminal path, but
someone might copy the unsafe idiom to another program and place it where it
may leak sensitive data.

Discussed aeons ago with tb@, OK deraadt@ and beck@

show more ...

usage() is static and __dead; add prototype for print_passwd;
return instead of exit from main

_PASSWORD_LEN is length that comes out of crypt(), not a meaningful
length for user entered passwords. And the +1 is just superstitious
nonsense inherited from getpass() guts.
Switch to a pleasing fi

_PASSWORD_LEN is length that comes out of crypt(), not a meaningful
length for user entered passwords. And the +1 is just superstitious
nonsense inherited from getpass() guts.
Switch to a pleasing fixed size of 1024.
ok millert

show more ...

convert getpass to readpassphrase. from Dimitris Papastamos

encrypt(1) also needs to pledge "wpath" for getpass().

getpass() opens /dev/tty RW so it can write the prompt.

ok deraadt@

pledge "stdio rpath tty". rpath for the configuration reading done by
login* subsystem, tty for readpassphase()
ok beck

Wrap a long line. Use explicit_bzero. Fix comment describing extra.
From Andre Smagin
Also, should be safe to print errno from newhash() now.
ok millert

increase prefbuf size so that 'encrypt -b 000000000000000000000012' works.
noticed by Andre Smagin.
also check snprintf for overflow so we get better error messages if
somebody decides to pad with ev

increase prefbuf size so that 'encrypt -b 000000000000000000000012' works.
noticed by Andre Smagin.
also check snprintf for overflow so we get better error messages if
somebody decides to pad with even more zeroes, and avoid possible
truncations.

show more ...

remove unused variable

ok tedu@

encrypt can use the scrypt scaling code in libc now via crypt_newhash

fix -b a mode, spotted by rpe

impose some limits on the ideal rounds so nothing too crazy happens when
the clock results are weird

simplify. bcrypt only support and use newer libc APIs. no makekey emul.
ok deraadt
schwarze is a little sad to see the last 1/8 shared man page go, but we
have a support program in place, called the

simplify. bcrypt only support and use newer libc APIs. no makekey emul.
ok deraadt
schwarze is a little sad to see the last 1/8 shared man page go, but we
have a support program in place, called the attic.

show more ...

hoist blowfish up and use bcrypt_newhash directly

remove -m from usage();

kill md5 support, broken since May
ok tedu@

simpler prototype repairs

allow auto scaling bcrypt rounds by CPU power.
ok deraadt jmc sthen

Don't trim whitespace from stdin. Encrypt it the same as other
input sources. Feedback and fixes from ray@ and fgsch@.

ok millert@ (six years ago) ray@ fgsch@