diff options
| author | des <des@FreeBSD.org> | 2014-09-08 09:19:01 +0000 |
|---|---|---|
| committer | des <des@FreeBSD.org> | 2014-09-08 09:19:01 +0000 |
| commit | b5f87ea11c1944c18b6a1f1f4a06b1198aeebd98 (patch) | |
| tree | b6011510a27c476f361ac3cc4460f9fe3163fe0e | |
| parent | 919007c39628e5308b1031b5a22207758407c429 (diff) | |
| download | FreeBSD-src-b5f87ea11c1944c18b6a1f1f4a06b1198aeebd98.zip FreeBSD-src-b5f87ea11c1944c18b6a1f1f4a06b1198aeebd98.tar.gz | |
Fail rather than segfault if neither PAM_TTY nor PAM_RHOST is set.
PR: 83099
MFC after: 3 days
| -rw-r--r-- | lib/libpam/modules/pam_login_access/pam_login_access.c | 17 |
1 files changed, 10 insertions, 7 deletions
diff --git a/lib/libpam/modules/pam_login_access/pam_login_access.c b/lib/libpam/modules/pam_login_access/pam_login_access.c index 945d5eb..c0a4e73 100644 --- a/lib/libpam/modules/pam_login_access/pam_login_access.c +++ b/lib/libpam/modules/pam_login_access/pam_login_access.c @@ -79,7 +79,14 @@ pam_sm_acct_mgmt(pam_handle_t *pamh, int flags __unused, gethostname(hostname, sizeof hostname); - if (rhost == NULL || *(const char *)rhost == '\0') { + if (rhost != NULL && *(const char *)rhost != '\0') { + PAM_LOG("Checking login.access for user %s from host %s", + (const char *)user, (const char *)rhost); + if (login_access(user, rhost) != 0) + return (PAM_SUCCESS); + PAM_VERBOSE_ERROR("%s is not allowed to log in from %s", + user, rhost); + } else if (tty != NULL || *(const char *)tty != '\0') { PAM_LOG("Checking login.access for user %s on tty %s", (const char *)user, (const char *)tty); if (login_access(user, tty) != 0) @@ -87,12 +94,8 @@ pam_sm_acct_mgmt(pam_handle_t *pamh, int flags __unused, PAM_VERBOSE_ERROR("%s is not allowed to log in on %s", user, tty); } else { - PAM_LOG("Checking login.access for user %s from host %s", - (const char *)user, (const char *)rhost); - if (login_access(user, rhost) != 0) - return (PAM_SUCCESS); - PAM_VERBOSE_ERROR("%s is not allowed to log in from %s", - user, rhost); + PAM_VERBOSE_ERROR("PAM_RHOST or PAM_TTY required"); + return (PAM_AUTHINFO_UNAVAIL); } return (PAM_AUTH_ERR); |
