diff options
author | yar <yar@FreeBSD.org> | 2007-06-14 13:07:06 +0000 |
---|---|---|
committer | yar <yar@FreeBSD.org> | 2007-06-14 13:07:06 +0000 |
commit | 25b7a16e23d0a9e488fddf3d4bfe804f3e06ab93 (patch) | |
tree | f6e83255b0c269e2512e46d68ad7d2332928ac80 | |
parent | b325dde99be727bd2862bde1914e4c08f915434d (diff) | |
download | FreeBSD-src-25b7a16e23d0a9e488fddf3d4bfe804f3e06ab93.zip FreeBSD-src-25b7a16e23d0a9e488fddf3d4bfe804f3e06ab93.tar.gz |
Use the current user's login class for the decisions about where
the nologin(5) file is located and whether the user may bypass its
restriction.
Add some error checks.
Approved by: des
PR: bin/107612
-rw-r--r-- | lib/libpam/modules/pam_nologin/pam_nologin.8 | 31 | ||||
-rw-r--r-- | lib/libpam/modules/pam_nologin/pam_nologin.c | 73 |
2 files changed, 59 insertions, 45 deletions
diff --git a/lib/libpam/modules/pam_nologin/pam_nologin.8 b/lib/libpam/modules/pam_nologin/pam_nologin.8 index e38be71..9448bf2 100644 --- a/lib/libpam/modules/pam_nologin/pam_nologin.8 +++ b/lib/libpam/modules/pam_nologin/pam_nologin.8 @@ -49,23 +49,24 @@ feature. .Ss NoLogin Account Management Module The NoLogin account management component, .Fn pam_sm_acct_mgmt , -always returns success for the superuser, -and returns success for all other users -if the file -.Pa /var/run/nologin -does not exist. -If -.Pa /var/run/nologin -does exist, -then its contents are echoed -to non-superusers +verifies whether logins are administratively disabled via +.Xr nologin 5 . +It returns success if the user's login class has an "ignorenologin" +capability specified in +.Xr login.conf 5 +or the +.Xr nologin 5 +file does not exist. +If neither condition is met, +then the contents of +.Xr nologin 5 +are echoed before failure is returned. -If a "nologin" capability -is specified in +The location of +.Xr nologin 5 +is specified by a "nologin" capability in .Xr login.conf 5 , -then the file thus specified -is used instead. -This usually defaults to +which defaults to .Pa /var/run/nologin . .Pp The following options may be passed to the module: diff --git a/lib/libpam/modules/pam_nologin/pam_nologin.c b/lib/libpam/modules/pam_nologin/pam_nologin.c index f4b28e5..1be63d2 100644 --- a/lib/libpam/modules/pam_nologin/pam_nologin.c +++ b/lib/libpam/modules/pam_nologin/pam_nologin.c @@ -52,18 +52,19 @@ __FBSDID("$FreeBSD$"); #include <security/pam_modules.h> #include <security/pam_mod_misc.h> -#define NOLOGIN "/var/run/nologin" +#define _PATH_NOLOGIN "/var/run/nologin" -static char nologin_def[] = NOLOGIN; +static char nologin_def[] = _PATH_NOLOGIN; PAM_EXTERN int -pam_sm_acct_mgmt(pam_handle_t *pamh, int flags __unused, +pam_sm_acct_mgmt(pam_handle_t *pamh, int flags, int argc __unused, const char *argv[] __unused) { login_cap_t *lc; struct passwd *pwd; struct stat st; int retval, fd; + ssize_t ss; const char *user, *nologin; char *mtmp; @@ -73,42 +74,54 @@ pam_sm_acct_mgmt(pam_handle_t *pamh, int flags __unused, PAM_LOG("Got user: %s", user); - lc = login_getclass(NULL); - nologin = login_getcapstr(lc, "nologin", nologin_def, nologin_def); - login_close(lc); - lc = NULL; + pwd = getpwnam(user); + if (pwd == NULL) + return (PAM_USER_UNKNOWN); + + /* + * login_getpwclass(3) will select the "root" class by default + * if pwd->pw_uid is 0. That class should have "ignorenologin" + * capability so that super-user can bypass nologin. + */ + lc = login_getpwclass(pwd); + if (lc == NULL) { + PAM_LOG("Unable to get login class for user %s", user); + return (PAM_SERVICE_ERR); + } - fd = open(nologin, O_RDONLY, 0); - if (fd < 0) + if (login_getcapbool(lc, "ignorenologin", 0)) { + login_close(lc); return (PAM_SUCCESS); + } - PAM_LOG("Opened %s file", NOLOGIN); + nologin = login_getcapstr(lc, "nologin", nologin_def, nologin_def); - pwd = getpwnam(user); - if (pwd && pwd->pw_uid == 0) - retval = PAM_SUCCESS; - else { - if (!pwd) - retval = PAM_USER_UNKNOWN; - else - retval = PAM_AUTH_ERR; + fd = open(nologin, O_RDONLY, 0); + if (fd < 0) { + login_close(lc); + return (PAM_SUCCESS); } - if (fstat(fd, &st) < 0) - return (retval); - - mtmp = malloc(st.st_size + 1); - if (mtmp != NULL) { - read(fd, mtmp, st.st_size); - mtmp[st.st_size] = '\0'; - pam_error(pamh, "%s", mtmp); - free(mtmp); + PAM_LOG("Opened %s file", nologin); + + if (fstat(fd, &st) == 0) { + mtmp = malloc(st.st_size + 1); + if (mtmp != NULL) { + ss = read(fd, mtmp, st.st_size); + if (ss > 0) { + mtmp[ss] = '\0'; + pam_error(pamh, "%s", mtmp); + } + free(mtmp); + } } - if (retval != PAM_SUCCESS) - PAM_VERBOSE_ERROR("Administrator refusing you: %s", NOLOGIN); + PAM_VERBOSE_ERROR("Administrator refusing you: %s", nologin); + + close(fd); + login_close(lc); - return (retval); + return (PAM_AUTH_ERR); } PAM_MODULE_ENTRY("pam_nologin"); |