Python : Add query to detect PAM authorization bypass

[ghost]

Using only a call to pam_authenticate to check the validity of a login can lead to authorization bypass vulnerabilities. A pam_authenticate only verifies the credentials of a user. It does not check if a user has an appropriate authorization to actually login. This means a user with a expired login or a password can still access the system.

This PR includes a qhelp describing the issue, a query which detects instances where a call to pam_acc_mgmt does not follow a call to pam_authenticate and it's corresponding tests.

Some of the public CVE's I can find using this query are :

• CVE-2022-0860 found in cobbler/cobbler
• fredhutch/motuz

[ghost]

@RasmusWL This should ideally also find CVE-2022-1049 found in clusterlabs/pcs and fixed in ClusterLabs/pcs@fb86000#diff-e8d00a7c356632c11156ad3e8ce897f66538c4cc4a849487f9a5ddc0a19eafb8L53

However, CodeQL does not seem to be able to trace the flow from the prep_fn function defined here

[RasmusWL]

Thanks for this submission 👍 I'll take a look at it either tomorrow or next week.

[RasmusWL]

Besides inline comments, I would like you to merge the test files to a single, and remove all the stuff that is not absolutely required to make the example work (I highlight a bit of it, but I think there are more things that can be removed).

[ghost]

@RasmusWL Thanks for the quick response. I have made the changes you sought. Any thoughts on how I could handle the clusterlabs/pcs case I mentioned above?

[RasmusWL]

I have made the changes you sought.

Thanks 🙏 I made an other minor adjustment, simplifying the code a little bit more. Hope you don't mind.

Any thoughts on how I could handle the clusterlabs/pcs case I mentioned above?

This is sadly a known problem, which is highlighted by this bit of test code. In the code below, a limitation from type trackers is that we don't treat also_x as a result from foo() 😞 So nothing you can do about it, but thanks for highlighting it 👍

def id(obj):
    return obj

x = foo()
also_x = id(x)

[RasmusWL]

I think this looks ok now 👍

[ghost]

@RasmusWL Ping.

[RasmusWL]

Thanks. I've just gotten back from vacation. Need to do a little internal testing of this before merging.

[RasmusWL]

Had a chance to look at some results, which looks good to me, so added @precision high. Will merge this PR once tests turn green.