File fix-for-cve-2022-22967-bsc-1200566.patch of Package salt

From 3995efe9259f4dee9fedb9a1ece5fecdc975559a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pablo=20Su=C3=A1rez=20Hern=C3=A1ndez?=
 <psuarezhernandez@suse.com>
Date: Thu, 16 Jun 2022 09:37:38 +0100
Subject: [PATCH] Fix for CVE-2022-22967 (bsc#1200566)

---
 salt/auth/pam.py                    |  2 +-
 tests/pytests/unit/auth/test_pam.py | 33 +++++++++++++++++++++++++++++
 2 files changed, 34 insertions(+), 1 deletion(-)
 create mode 100644 tests/pytests/unit/auth/test_pam.py

diff --git a/salt/auth/pam.py b/salt/auth/pam.py
index 1635f6fa42..49e795dc14 100644
--- a/salt/auth/pam.py
+++ b/salt/auth/pam.py
@@ -211,7 +211,7 @@ def authenticate(username, password):
 
     retval = PAM_AUTHENTICATE(handle, 0)
     if retval == 0:
-        PAM_ACCT_MGMT(handle, 0)
+        retval = PAM_ACCT_MGMT(handle, 0)
     PAM_END(handle, 0)
     return retval == 0
 
diff --git a/tests/pytests/unit/auth/test_pam.py b/tests/pytests/unit/auth/test_pam.py
new file mode 100644
index 0000000000..a2e9860848
--- /dev/null
+++ b/tests/pytests/unit/auth/test_pam.py
@@ -0,0 +1,33 @@
+import pytest
+import salt.auth.pam
+from tests.support.mock import patch
+
+
+@pytest.fixture(autouse=True)
+def configure_loader_modules():
+    with patch.object(salt.auth.pam, "__opts__", {}, create=True):
+        yield
+
+
+@pytest.fixture
+def mock_pam():
+    with patch("salt.auth.pam.CALLOC", autospec=True), patch(
+        "salt.auth.pam.pointer", autospec=True
+    ), patch("salt.auth.pam.PamHandle", autospec=True), patch(
+        "salt.auth.pam.PAM_START", autospec=True, return_value=0
+    ), patch(
+        "salt.auth.pam.PAM_AUTHENTICATE", autospec=True, return_value=0
+    ), patch(
+        "salt.auth.pam.PAM_END", autospec=True
+    ):
+        yield
+
+
+def test_cve_if_pam_acct_mgmt_returns_nonzero_authenticate_should_be_false(mock_pam):
+    with patch("salt.auth.pam.PAM_ACCT_MGMT", autospec=True, return_value=42):
+        assert salt.auth.pam.authenticate(username="fnord", password="fnord") is False
+
+
+def test_if_pam_acct_mgmt_returns_zero_authenticate_should_be_true(mock_pam):
+    with patch("salt.auth.pam.PAM_ACCT_MGMT", autospec=True, return_value=0):
+        assert salt.auth.pam.authenticate(username="fnord", password="fnord") is True
-- 
2.36.1