Fall in line with Solaris and Linux-PAM wrt use of the "other" policy:
use it to fill the gaps in incomplete policies as well as to replace missing ones. Sponsored by: DARPA, NAI Labs git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/trunk@137 185d5e19-27fe-0310-9dcf-9bff6b9f3609
This commit is contained in:
parent
2cc6bad9fc
commit
472018b4e5
|
@ -31,7 +31,7 @@
|
||||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||||
* SUCH DAMAGE.
|
* SUCH DAMAGE.
|
||||||
*
|
*
|
||||||
* $P4: //depot/projects/openpam/lib/openpam_configure.c#1 $
|
* $P4: //depot/projects/openpam/lib/openpam_configure.c#2 $
|
||||||
*/
|
*/
|
||||||
|
|
||||||
#include <ctype.h>
|
#include <ctype.h>
|
||||||
|
@ -50,7 +50,7 @@
|
||||||
#define MAX_OPTIONS 256
|
#define MAX_OPTIONS 256
|
||||||
|
|
||||||
static int
|
static int
|
||||||
openpam_read_policy_file(pam_handle_t *pamh,
|
openpam_read_policy_file(pam_chain_t *policy[],
|
||||||
const char *service,
|
const char *service,
|
||||||
const char *filename,
|
const char *filename,
|
||||||
int style)
|
int style)
|
||||||
|
@ -186,7 +186,7 @@ openpam_read_policy_file(pam_handle_t *pamh,
|
||||||
* Finally, add the module at the end of the
|
* Finally, add the module at the end of the
|
||||||
* appropriate chain and bump the counter.
|
* appropriate chain and bump the counter.
|
||||||
*/
|
*/
|
||||||
r = openpam_add_module(pamh, chain, flag, p, optc, optv);
|
r = openpam_add_module(policy, chain, flag, p, optc, optv);
|
||||||
if (r != PAM_SUCCESS)
|
if (r != PAM_SUCCESS)
|
||||||
return (-r);
|
return (-r);
|
||||||
++n;
|
++n;
|
||||||
|
@ -214,14 +214,8 @@ static const char *openpam_policy_path[] = {
|
||||||
NULL
|
NULL
|
||||||
};
|
};
|
||||||
|
|
||||||
/*
|
static int
|
||||||
* OpenPAM internal
|
openpam_load_policy(pam_chain_t *policy[],
|
||||||
*
|
|
||||||
* Configure a service
|
|
||||||
*/
|
|
||||||
|
|
||||||
int
|
|
||||||
openpam_configure(pam_handle_t *pamh,
|
|
||||||
const char *service)
|
const char *service)
|
||||||
{
|
{
|
||||||
const char **path;
|
const char **path;
|
||||||
|
@ -235,24 +229,62 @@ openpam_configure(pam_handle_t *pamh,
|
||||||
filename = malloc(len + strlen(service) + 1);
|
filename = malloc(len + strlen(service) + 1);
|
||||||
if (filename == NULL) {
|
if (filename == NULL) {
|
||||||
openpam_log(PAM_LOG_ERROR, "malloc(): %m");
|
openpam_log(PAM_LOG_ERROR, "malloc(): %m");
|
||||||
return (PAM_BUF_ERR);
|
return (-PAM_BUF_ERR);
|
||||||
}
|
}
|
||||||
strcpy(filename, *path);
|
strcpy(filename, *path);
|
||||||
strcat(filename, service);
|
strcat(filename, service);
|
||||||
r = openpam_read_policy_file(pamh,
|
r = openpam_read_policy_file(policy,
|
||||||
service, filename, PAM_D_STYLE);
|
service, filename, PAM_D_STYLE);
|
||||||
free(filename);
|
free(filename);
|
||||||
} else {
|
} else {
|
||||||
r = openpam_read_policy_file(pamh,
|
r = openpam_read_policy_file(policy,
|
||||||
service, *path, PAM_CONF_STYLE);
|
service, *path, PAM_CONF_STYLE);
|
||||||
}
|
}
|
||||||
if (r < 0)
|
if (r != 0)
|
||||||
return (-r);
|
return (r);
|
||||||
if (r > 0)
|
|
||||||
return (PAM_SUCCESS);
|
|
||||||
}
|
}
|
||||||
|
|
||||||
return (PAM_SYSTEM_ERR);
|
return (0);
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* OpenPAM internal
|
||||||
|
*
|
||||||
|
* Configure a service
|
||||||
|
*/
|
||||||
|
|
||||||
|
int
|
||||||
|
openpam_configure(pam_handle_t *pamh,
|
||||||
|
const char *service)
|
||||||
|
{
|
||||||
|
pam_chain_t *other[PAM_NUM_CHAINS];
|
||||||
|
int i, n, r;
|
||||||
|
|
||||||
|
/* try own configuration first */
|
||||||
|
r = openpam_load_policy(pamh->chains, service);
|
||||||
|
if (r < 0)
|
||||||
|
return (-r);
|
||||||
|
for (i = n = 0; i < PAM_NUM_CHAINS; ++i) {
|
||||||
|
if (pamh->chains[i] != NULL)
|
||||||
|
++n;
|
||||||
|
}
|
||||||
|
if (n == PAM_NUM_CHAINS)
|
||||||
|
return (PAM_SUCCESS);
|
||||||
|
|
||||||
|
/* fill in the blanks with "other" */
|
||||||
|
openpam_load_policy(other, PAM_OTHER);
|
||||||
|
if (r < 0)
|
||||||
|
return (-r);
|
||||||
|
for (i = n = 0; i < PAM_NUM_CHAINS; ++i) {
|
||||||
|
if (pamh->chains[i] == NULL) {
|
||||||
|
pamh->chains[i] = other[i];
|
||||||
|
other[i] = NULL;
|
||||||
|
}
|
||||||
|
if (pamh->chains[i] != NULL)
|
||||||
|
++n;
|
||||||
|
}
|
||||||
|
openpam_clear_chains(other);
|
||||||
|
return (n > 0 ? PAM_SUCCESS : PAM_SYSTEM_ERR);
|
||||||
}
|
}
|
||||||
|
|
||||||
/*
|
/*
|
||||||
|
|
|
@ -31,7 +31,7 @@
|
||||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||||
* SUCH DAMAGE.
|
* SUCH DAMAGE.
|
||||||
*
|
*
|
||||||
* $P4: //depot/projects/openpam/lib/openpam_impl.h#13 $
|
* $P4: //depot/projects/openpam/lib/openpam_impl.h#14 $
|
||||||
*/
|
*/
|
||||||
|
|
||||||
#ifndef _OPENPAM_IMPL_H_INCLUDED
|
#ifndef _OPENPAM_IMPL_H_INCLUDED
|
||||||
|
@ -108,9 +108,9 @@ struct pam_saved_cred {
|
||||||
int openpam_configure(pam_handle_t *, const char *);
|
int openpam_configure(pam_handle_t *, const char *);
|
||||||
int openpam_dispatch(pam_handle_t *, int, int);
|
int openpam_dispatch(pam_handle_t *, int, int);
|
||||||
int openpam_findenv(pam_handle_t *, const char *, size_t);
|
int openpam_findenv(pam_handle_t *, const char *, size_t);
|
||||||
int openpam_add_module(pam_handle_t *, int, int,
|
int openpam_add_module(pam_chain_t **, int, int,
|
||||||
const char *, int, const char **);
|
const char *, int, const char **);
|
||||||
void openpam_clear_chains(pam_handle_t *);
|
void openpam_clear_chains(pam_chain_t **);
|
||||||
|
|
||||||
#ifdef OPENPAM_STATIC_MODULES
|
#ifdef OPENPAM_STATIC_MODULES
|
||||||
pam_module_t *openpam_static(const char *);
|
pam_module_t *openpam_static(const char *);
|
||||||
|
|
|
@ -31,7 +31,7 @@
|
||||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||||
* SUCH DAMAGE.
|
* SUCH DAMAGE.
|
||||||
*
|
*
|
||||||
* $P4: //depot/projects/openpam/lib/openpam_load.c#12 $
|
* $P4: //depot/projects/openpam/lib/openpam_load.c#13 $
|
||||||
*/
|
*/
|
||||||
|
|
||||||
#include <dlfcn.h>
|
#include <dlfcn.h>
|
||||||
|
@ -156,7 +156,7 @@ openpam_destroy_chain(pam_chain_t *chain)
|
||||||
*/
|
*/
|
||||||
|
|
||||||
int
|
int
|
||||||
openpam_add_module(pam_handle_t *pamh,
|
openpam_add_module(pam_chain_t *policy[],
|
||||||
int chain,
|
int chain,
|
||||||
int flag,
|
int flag,
|
||||||
const char *modpath,
|
const char *modpath,
|
||||||
|
@ -178,12 +178,12 @@ openpam_add_module(pam_handle_t *pamh,
|
||||||
openpam_destroy_chain(new);
|
openpam_destroy_chain(new);
|
||||||
return (PAM_OPEN_ERR);
|
return (PAM_OPEN_ERR);
|
||||||
}
|
}
|
||||||
if ((iterator = pamh->chains[chain]) != NULL) {
|
if ((iterator = policy[chain]) != NULL) {
|
||||||
while (iterator->next != NULL)
|
while (iterator->next != NULL)
|
||||||
iterator = iterator->next;
|
iterator = iterator->next;
|
||||||
iterator->next = new;
|
iterator->next = new;
|
||||||
} else {
|
} else {
|
||||||
pamh->chains[chain] = new;
|
policy[chain] = new;
|
||||||
}
|
}
|
||||||
return (PAM_SUCCESS);
|
return (PAM_SUCCESS);
|
||||||
|
|
||||||
|
@ -199,12 +199,12 @@ openpam_add_module(pam_handle_t *pamh,
|
||||||
*/
|
*/
|
||||||
|
|
||||||
void
|
void
|
||||||
openpam_clear_chains(pam_handle_t *pamh)
|
openpam_clear_chains(pam_chain_t *policy[])
|
||||||
{
|
{
|
||||||
int i;
|
int i;
|
||||||
|
|
||||||
for (i = 0; i < PAM_NUM_CHAINS; ++i)
|
for (i = 0; i < PAM_NUM_CHAINS; ++i)
|
||||||
openpam_destroy_chain(pamh->chains[i]);
|
openpam_destroy_chain(policy[i]);
|
||||||
}
|
}
|
||||||
|
|
||||||
/*
|
/*
|
||||||
|
|
|
@ -31,7 +31,7 @@
|
||||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||||
* SUCH DAMAGE.
|
* SUCH DAMAGE.
|
||||||
*
|
*
|
||||||
* $P4: //depot/projects/openpam/lib/pam_end.c#8 $
|
* $P4: //depot/projects/openpam/lib/pam_end.c#9 $
|
||||||
*/
|
*/
|
||||||
|
|
||||||
#include <stdlib.h>
|
#include <stdlib.h>
|
||||||
|
@ -72,7 +72,7 @@ pam_end(pam_handle_t *pamh,
|
||||||
free(pamh->env);
|
free(pamh->env);
|
||||||
|
|
||||||
/* clear chains */
|
/* clear chains */
|
||||||
openpam_clear_chains(pamh);
|
openpam_clear_chains(pamh->chains);
|
||||||
|
|
||||||
/* clear items */
|
/* clear items */
|
||||||
for (i = 0; i < PAM_NUM_ITEMS; ++i)
|
for (i = 0; i < PAM_NUM_ITEMS; ++i)
|
||||||
|
|
|
@ -31,7 +31,7 @@
|
||||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||||
* SUCH DAMAGE.
|
* SUCH DAMAGE.
|
||||||
*
|
*
|
||||||
* $P4: //depot/projects/openpam/lib/pam_start.c#13 $
|
* $P4: //depot/projects/openpam/lib/pam_start.c#14 $
|
||||||
*/
|
*/
|
||||||
|
|
||||||
#include <stdlib.h>
|
#include <stdlib.h>
|
||||||
|
@ -66,8 +66,6 @@ pam_start(const char *service,
|
||||||
goto fail;
|
goto fail;
|
||||||
|
|
||||||
r = openpam_configure(ph, service);
|
r = openpam_configure(ph, service);
|
||||||
if (r != PAM_SUCCESS && r != PAM_BUF_ERR)
|
|
||||||
r = openpam_configure(ph, PAM_OTHER);
|
|
||||||
if (r != PAM_SUCCESS)
|
if (r != PAM_SUCCESS)
|
||||||
goto fail;
|
goto fail;
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue