From 472018b4e53ff87ccc92a1f543f40942152b709e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Dag-Erling=20Sm=C3=B8rgrav?= Date: Thu, 2 May 2002 06:08:02 +0000 Subject: [PATCH] Fall in line with Solaris and Linux-PAM wrt use of the "other" policy: use it to fill the gaps in incomplete policies as well as to replace missing ones. Sponsored by: DARPA, NAI Labs git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@137 185d5e19-27fe-0310-9dcf-9bff6b9f3609 --- lib/openpam_configure.c | 70 ++++++++++++++++++++++++++++++----------- lib/openpam_impl.h | 6 ++-- lib/openpam_load.c | 12 +++---- lib/pam_end.c | 4 +-- lib/pam_start.c | 4 +-- 5 files changed, 63 insertions(+), 33 deletions(-) diff --git a/lib/openpam_configure.c b/lib/openpam_configure.c index 8c12e10..a66f823 100644 --- a/lib/openpam_configure.c +++ b/lib/openpam_configure.c @@ -31,7 +31,7 @@ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * - * $P4: //depot/projects/openpam/lib/openpam_configure.c#1 $ + * $P4: //depot/projects/openpam/lib/openpam_configure.c#2 $ */ #include @@ -50,7 +50,7 @@ #define MAX_OPTIONS 256 static int -openpam_read_policy_file(pam_handle_t *pamh, +openpam_read_policy_file(pam_chain_t *policy[], const char *service, const char *filename, int style) @@ -186,7 +186,7 @@ openpam_read_policy_file(pam_handle_t *pamh, * Finally, add the module at the end of the * appropriate chain and bump the counter. */ - r = openpam_add_module(pamh, chain, flag, p, optc, optv); + r = openpam_add_module(policy, chain, flag, p, optc, optv); if (r != PAM_SUCCESS) return (-r); ++n; @@ -214,14 +214,8 @@ static const char *openpam_policy_path[] = { NULL }; -/* - * OpenPAM internal - * - * Configure a service - */ - -int -openpam_configure(pam_handle_t *pamh, +static int +openpam_load_policy(pam_chain_t *policy[], const char *service) { const char **path; @@ -235,24 +229,62 @@ openpam_configure(pam_handle_t *pamh, filename = malloc(len + strlen(service) + 1); if (filename == NULL) { openpam_log(PAM_LOG_ERROR, "malloc(): %m"); - return (PAM_BUF_ERR); + return (-PAM_BUF_ERR); } strcpy(filename, *path); strcat(filename, service); - r = openpam_read_policy_file(pamh, + r = openpam_read_policy_file(policy, service, filename, PAM_D_STYLE); free(filename); } else { - r = openpam_read_policy_file(pamh, + r = openpam_read_policy_file(policy, service, *path, PAM_CONF_STYLE); } - if (r < 0) - return (-r); - if (r > 0) - return (PAM_SUCCESS); + if (r != 0) + return (r); } - return (PAM_SYSTEM_ERR); + return (0); +} + +/* + * OpenPAM internal + * + * Configure a service + */ + +int +openpam_configure(pam_handle_t *pamh, + const char *service) +{ + pam_chain_t *other[PAM_NUM_CHAINS]; + int i, n, r; + + /* try own configuration first */ + r = openpam_load_policy(pamh->chains, service); + if (r < 0) + return (-r); + for (i = n = 0; i < PAM_NUM_CHAINS; ++i) { + if (pamh->chains[i] != NULL) + ++n; + } + if (n == PAM_NUM_CHAINS) + return (PAM_SUCCESS); + + /* fill in the blanks with "other" */ + openpam_load_policy(other, PAM_OTHER); + if (r < 0) + return (-r); + for (i = n = 0; i < PAM_NUM_CHAINS; ++i) { + if (pamh->chains[i] == NULL) { + pamh->chains[i] = other[i]; + other[i] = NULL; + } + if (pamh->chains[i] != NULL) + ++n; + } + openpam_clear_chains(other); + return (n > 0 ? PAM_SUCCESS : PAM_SYSTEM_ERR); } /* diff --git a/lib/openpam_impl.h b/lib/openpam_impl.h index 1fc0184..446af16 100644 --- a/lib/openpam_impl.h +++ b/lib/openpam_impl.h @@ -31,7 +31,7 @@ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * - * $P4: //depot/projects/openpam/lib/openpam_impl.h#13 $ + * $P4: //depot/projects/openpam/lib/openpam_impl.h#14 $ */ #ifndef _OPENPAM_IMPL_H_INCLUDED @@ -108,9 +108,9 @@ struct pam_saved_cred { int openpam_configure(pam_handle_t *, const char *); int openpam_dispatch(pam_handle_t *, int, int); int openpam_findenv(pam_handle_t *, const char *, size_t); -int openpam_add_module(pam_handle_t *, int, int, +int openpam_add_module(pam_chain_t **, int, int, const char *, int, const char **); -void openpam_clear_chains(pam_handle_t *); +void openpam_clear_chains(pam_chain_t **); #ifdef OPENPAM_STATIC_MODULES pam_module_t *openpam_static(const char *); diff --git a/lib/openpam_load.c b/lib/openpam_load.c index 2b88087..abbc491 100644 --- a/lib/openpam_load.c +++ b/lib/openpam_load.c @@ -31,7 +31,7 @@ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * - * $P4: //depot/projects/openpam/lib/openpam_load.c#12 $ + * $P4: //depot/projects/openpam/lib/openpam_load.c#13 $ */ #include @@ -156,7 +156,7 @@ openpam_destroy_chain(pam_chain_t *chain) */ int -openpam_add_module(pam_handle_t *pamh, +openpam_add_module(pam_chain_t *policy[], int chain, int flag, const char *modpath, @@ -178,12 +178,12 @@ openpam_add_module(pam_handle_t *pamh, openpam_destroy_chain(new); return (PAM_OPEN_ERR); } - if ((iterator = pamh->chains[chain]) != NULL) { + if ((iterator = policy[chain]) != NULL) { while (iterator->next != NULL) iterator = iterator->next; iterator->next = new; } else { - pamh->chains[chain] = new; + policy[chain] = new; } return (PAM_SUCCESS); @@ -199,12 +199,12 @@ openpam_add_module(pam_handle_t *pamh, */ void -openpam_clear_chains(pam_handle_t *pamh) +openpam_clear_chains(pam_chain_t *policy[]) { int i; for (i = 0; i < PAM_NUM_CHAINS; ++i) - openpam_destroy_chain(pamh->chains[i]); + openpam_destroy_chain(policy[i]); } /* diff --git a/lib/pam_end.c b/lib/pam_end.c index 21d5a1a..8fb9c29 100644 --- a/lib/pam_end.c +++ b/lib/pam_end.c @@ -31,7 +31,7 @@ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * - * $P4: //depot/projects/openpam/lib/pam_end.c#8 $ + * $P4: //depot/projects/openpam/lib/pam_end.c#9 $ */ #include @@ -72,7 +72,7 @@ pam_end(pam_handle_t *pamh, free(pamh->env); /* clear chains */ - openpam_clear_chains(pamh); + openpam_clear_chains(pamh->chains); /* clear items */ for (i = 0; i < PAM_NUM_ITEMS; ++i) diff --git a/lib/pam_start.c b/lib/pam_start.c index 49976b4..c1b301d 100644 --- a/lib/pam_start.c +++ b/lib/pam_start.c @@ -31,7 +31,7 @@ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * - * $P4: //depot/projects/openpam/lib/pam_start.c#13 $ + * $P4: //depot/projects/openpam/lib/pam_start.c#14 $ */ #include @@ -66,8 +66,6 @@ pam_start(const char *service, goto fail; r = openpam_configure(ph, service); - if (r != PAM_SUCCESS && r != PAM_BUF_ERR) - r = openpam_configure(ph, PAM_OTHER); if (r != PAM_SUCCESS) goto fail;