Added security testbed for osv scalibr pammisconfig

pammisconfig/Dockerfile

@@ -0,0 +1,28 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+FROM ubuntu:22.04
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends libpam-modules \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN mkdir -p /etc/pam.d /app
+
+COPY etc/pam.d/ /etc/pam.d/
+COPY etc/pam.conf /etc/pam.conf
+
+WORKDIR /app
+
+CMD ["/bin/bash"]

pammisconfig/README.md

@@ -0,0 +1,20 @@
+# PAM Misconfiguration Testbed
+
+This testbed exercises the SCALIBR PAM misconfiguration detector. It provides
+intentionally vulnerable PAM configurations under `/etc/pam.d/` and the legacy
+`/etc/pam.conf` file to trigger all detection checks.
+
+## Build & Run
+
+```sh
+docker build -t pammisconfig-testbed .
+docker run -it --rm -v $(pwd):/app pammisconfig-testbed
+```
+
+## Vulnerability Coverage
+
+| File | Triggered checks |
+| --- | --- |
+| `/etc/pam.d/sshd` | pam_permit bypass, pam_succeed_if broad condition, nullok auth option |
+| `/etc/pam.d/sudo` | pam_permit as only optional auth module (only auth entry) |
+| `/etc/pam.conf` | pam_permit bypass, pam_succeed_if broad condition, nullok auth option |

pammisconfig/etc/pam.conf

@@ -0,0 +1,17 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+sshd auth sufficient pam_permit.so
+sshd auth sufficient pam_succeed_if.so uid >= 1000
+sshd auth sufficient pam_unix.so nullok

pammisconfig/etc/pam.d/sshd

@@ -0,0 +1,17 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+auth sufficient pam_permit.so
+auth sufficient pam_succeed_if.so uid >= 1000
+auth sufficient pam_unix.so nullok

pammisconfig/etc/pam.d/sudo

@@ -0,0 +1,15 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+auth optional pam_permit.so