Revive the pam_deny and pam_permit modules from Linux-PAM. They are

simple enough to be trusted.

Add account management functionality to the pam_unix module.

These changes should make it possible to use PAM in some ports.

Submitted by:	Max Khon <fjoe@iclub.nsu.ru>

6 files changed, 163 insertions, 2 deletions

diff --git a/lib/libpam/libpam/Makefile b/lib/libpam/libpam/Makefile
index 7603a65..ddcc688 100644
--- a/lib/libpam/libpam/Makefile
+++ b/lib/libpam/libpam/Makefile
@@ -61,9 +61,11 @@ HDRS3=		pam_mod_misc.h
 
 # Static PAM modules:
 STATIC_MODULES+= ${MODOBJDIR}/pam_cleartext_pass_ok/libpam_cleartext_pass_ok.a
+STATIC_MODULES+= ${MODOBJDIR}/pam_deny/libpam_deny.a
 .if defined(MAKE_KERBEROS4)
 STATIC_MODULES+= ${MODOBJDIR}/pam_kerberosIV/libpam_kerberosIV.a
 .endif
+STATIC_MODULES+= ${MODOBJDIR}/pam_permit/libpam_permit.a
 STATIC_MODULES+= ${MODOBJDIR}/pam_radius/libpam_radius.a
 STATIC_MODULES+= ${MODOBJDIR}/pam_skey/libpam_skey.a
 STATIC_MODULES+= ${MODOBJDIR}/pam_tacplus/libpam_tacplus.a
diff --git a/lib/libpam/modules/Makefile b/lib/libpam/modules/Makefile
index 5a3e3c1..74136ba 100644
--- a/lib/libpam/modules/Makefile
+++ b/lib/libpam/modules/Makefile
@@ -25,9 +25,11 @@
 #	$FreeBSD$
 
 SUBDIR+=	pam_cleartext_pass_ok
+SUBDIR+=	pam_deny
 .if defined(MAKE_KERBEROS4)
 SUBDIR+=	pam_kerberosIV
 .endif
+SUBDIR+=	pam_permit
 SUBDIR+=	pam_radius
 SUBDIR+=	pam_skey
 SUBDIR+=	pam_tacplus
diff --git a/lib/libpam/modules/pam_deny/Makefile b/lib/libpam/modules/pam_deny/Makefile
new file mode 100644
index 0000000..17b1447
--- /dev/null
+++ b/lib/libpam/modules/pam_deny/Makefile
@@ -0,0 +1,41 @@
+# Copyright 1999 Max Khon.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+# ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+# SUCH DAMAGE.
+#
+#	$FreeBSD$
+
+PAMDIR=		${.CURDIR}/../../../../contrib/libpam
+
+.PATH:		${PAMDIR}/modules/pam_deny
+
+LIB=		pam_deny
+SHLIB_NAME=	pam_deny.so
+SRCS=		pam_deny.c
+CFLAGS+=	-Wall
+CFLAGS+=	-I${PAMDIR}/libpam/include
+DPADD+=		${LIBGCC_PIC}
+LDADD+=		-lgcc_pic
+INTERNALLIB=	yes
+INTERNALSTATICLIB=yes
+
+.include <bsd.lib.mk>
diff --git a/lib/libpam/modules/pam_permit/Makefile b/lib/libpam/modules/pam_permit/Makefile
new file mode 100644
index 0000000..8863ff5
--- /dev/null
+++ b/lib/libpam/modules/pam_permit/Makefile
@@ -0,0 +1,42 @@
+# Copyright 1999 Max Khon.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+# ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+# SUCH DAMAGE.
+#
+#	$FreeBSD$
+
+PAMDIR=		${.CURDIR}/../../../../contrib/libpam
+
+.PATH:		${PAMDIR}/modules/pam_permit
+
+LIB=		pam_permit
+SHLIB_NAME=	pam_permit.so
+SRCS=		pam_permit.c
+CFLAGS+=	-Wall
+CFLAGS+=	-I${PAMDIR}/libpam/include
+CFLAGS+=	-I${.CURDIR}/../../libpam
+DPADD+=		${LIBGCC_PIC}
+LDADD+=		-lgcc_pic
+INTERNALLIB=	yes
+INTERNALSTATICLIB=yes
+
+.include <bsd.lib.mk>
diff --git a/lib/libpam/modules/pam_unix/Makefile b/lib/libpam/modules/pam_unix/Makefile
index d3bb689..d049e2b 100644
--- a/lib/libpam/modules/pam_unix/Makefile
+++ b/lib/libpam/modules/pam_unix/Makefile
@@ -32,8 +32,8 @@ SRCS=		pam_unix.c
 CFLAGS+=	-Wall
 CFLAGS+=	-I${PAMDIR}/libpam/include
 CFLAGS+=	-I${.CURDIR}/../../libpam
-DPADD+=		${LIBGCC_PIC}
-LDADD+=		-lgcc_pic
+DPADD+=		${LIBUTIL} ${LIBGCC_PIC}
+LDADD+=		-lutil -lgcc_pic
 INTERNALLIB=	yes
 INTERNALSTATICLIB=yes
 
diff --git a/lib/libpam/modules/pam_unix/pam_unix.c b/lib/libpam/modules/pam_unix/pam_unix.c
index b68a9d4..329b784 100644
--- a/lib/libpam/modules/pam_unix/pam_unix.c
+++ b/lib/libpam/modules/pam_unix/pam_unix.c
@@ -27,18 +27,26 @@
  */
 
 #include <sys/types.h>
+#include <sys/time.h>
+#include <login_cap.h>
 #include <pwd.h>
 #include <stdlib.h>
 #include <string.h>
+#include <stdio.h>
 #include <unistd.h>
 
 #define PAM_SM_AUTH
+#define PAM_SM_ACCOUNT
 #include <security/pam_modules.h>
 
 #include "pam_mod_misc.h"
 
 #define PASSWORD_PROMPT	"Password:"
 
+/*
+ * authentication management
+ */
+
 PAM_EXTERN int
 pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc,
     const char **argv)
@@ -87,4 +95,70 @@ pam_sm_setcred(pam_handle_t *pamh, int flags, int argc, const char **argv)
 	return PAM_SUCCESS;
 }
 
+/* 
+ * account management
+ *
+ * check pw_change and pw_expire fields
+ */
+PAM_EXTERN
+int pam_sm_acct_mgmt(pam_handle_t *pamh, int flags,
+		     int argc, const char **argv)
+{
+	const char *user;
+	struct passwd *pw;
+	struct timeval tp;
+	time_t warntime;
+	login_cap_t *lc = NULL;
+	char buf[128];
+	int retval;
+
+	retval = pam_get_item(pamh, PAM_USER, (const void **)&user);
+	if (retval != PAM_SUCCESS || user == NULL)
+		/* some implementations return PAM_SUCCESS here */
+		return PAM_USER_UNKNOWN;
+
+	if ((pw = getpwnam(user)) == NULL)
+		return PAM_USER_UNKNOWN;
+
+	retval = PAM_SUCCESS;
+	lc = login_getpwclass(pw);
+
+	if (pw->pw_change || pw->pw_expire)
+		gettimeofday(&tp, NULL);
+
+#define DEFAULT_WARN  (2L * 7L * 86400L)  /* Two weeks */
+
+	warntime = login_getcaptime(lc, "warnpassword", DEFAULT_WARN,
+	    DEFAULT_WARN);
+
+	if (pw->pw_change) {
+		if (tp.tv_sec >= pw->pw_change)
+			/* some implementations return PAM_AUTHTOK_EXPIRED */
+			retval = PAM_NEW_AUTHTOK_REQD;
+		else if (pw->pw_change - tp.tv_sec < warntime) {
+			snprintf(buf, sizeof(buf),
+			    "Warning: your password expires on %s",
+			    ctime(&pw->pw_change));
+			pam_prompt(pamh, PAM_ERROR_MSG, buf, NULL);
+		}
+	}
+
+	warntime = login_getcaptime(lc, "warnexpire", DEFAULT_WARN,
+	    DEFAULT_WARN);
+
+	if (pw->pw_expire) {
+		if (tp.tv_sec >= pw->pw_expire)
+			retval = PAM_ACCT_EXPIRED;
+		else if (pw->pw_expire - tp.tv_sec < warntime) {
+			snprintf(buf, sizeof(buf),
+			    "Warning: your account expires on %s",
+			    ctime(&pw->pw_expire));
+			pam_prompt(pamh, PAM_ERROR_MSG, buf, NULL);
+		}
+	}
+
+	login_close(lc);
+	return retval;
+}
+
 PAM_MODULE_ENTRY("pam_unix");