From a8ed91793767918d566bd64b6cd74cf1fbe39aad Mon Sep 17 00:00:00 2001 From: des Date: Fri, 12 Apr 2002 22:27:25 +0000 Subject: Major cleanup: - add __unused where appropriate - PAM_RETURN -> return since OpenPAM already logs the return value. - make PAM_LOG use openpam_log() - make PAM_VERBOSE_ERROR use openpam_get_option() and check flags for PAM_SILENT - remove dummy functions since OpenPAM handles missing service functions - fix various warnings Sponsored by: DARPA, NAI Labs --- lib/libpam/libpam/pam_debug_log.c | 94 ++-------- lib/libpam/libpam/security/pam_mod_misc.h | 13 +- lib/libpam/modules/pam_deny/pam_deny.c | 76 +++----- lib/libpam/modules/pam_ftp/pam_ftp.c | 76 ++------ lib/libpam/modules/pam_kerberosIV/klogin.c | 7 +- lib/libpam/modules/pam_kerberosIV/klogin.h | 5 + lib/libpam/modules/pam_kerberosIV/pam_kerberosIV.c | 54 +++--- lib/libpam/modules/pam_krb5/pam_krb5.c | 198 +++++++++------------ lib/libpam/modules/pam_lastlog/pam_lastlog.c | 105 +++-------- .../modules/pam_login_access/pam_login_access.c | 85 +-------- lib/libpam/modules/pam_nologin/pam_nologin.c | 81 ++------- lib/libpam/modules/pam_opie/pam_opie.c | 84 ++------- lib/libpam/modules/pam_opieaccess/pam_opieaccess.c | 87 ++------- lib/libpam/modules/pam_permit/pam_permit.c | 78 +++----- lib/libpam/modules/pam_radius/pam_radius.c | 125 ++++--------- lib/libpam/modules/pam_rootok/pam_rootok.c | 73 +------- lib/libpam/modules/pam_securetty/pam_securetty.c | 86 +-------- lib/libpam/modules/pam_self/pam_self.c | 94 ++-------- lib/libpam/modules/pam_ssh/pam_ssh.c | 183 +++++++++---------- lib/libpam/modules/pam_tacplus/pam_tacplus.c | 110 +++--------- lib/libpam/modules/pam_unix/pam_unix.c | 103 ++++------- lib/libpam/modules/pam_wheel/pam_wheel.c | 97 +++------- 22 files changed, 499 insertions(+), 1415 deletions(-) create mode 100644 lib/libpam/modules/pam_kerberosIV/klogin.h (limited to 'lib/libpam') diff --git a/lib/libpam/libpam/pam_debug_log.c b/lib/libpam/libpam/pam_debug_log.c index 14e9b79..2dfb1ea 100644 --- a/lib/libpam/libpam/pam_debug_log.c +++ b/lib/libpam/libpam/pam_debug_log.c @@ -32,105 +32,31 @@ __FBSDID("$FreeBSD$"); #include #include #include -#include #include #include #include -#define FMTBUFSIZ 256 - -static char *modulename(const char *); - -/* Log a debug message, including the function name and a - * cleaned up filename. - */ -void -_pam_log(struct options *options, const char *file, const char *function, - const char *format, ...) -{ - va_list ap; - char *fmtbuf, *modname; - - if (pam_test_option(options, PAM_OPT_DEBUG, NULL)) { - modname = modulename(file); - va_start(ap, format); - asprintf(&fmtbuf, "%s: %s: %s", modname, function, format); - vsyslog(LOG_DEBUG, fmtbuf, ap); - free(fmtbuf); - va_end(ap); - } -} - -/* Log a return value, including the function name and a - * cleaned up filename. - */ -void -_pam_log_retval(struct options *options, const char *file, const char *function, - int retval) -{ - char *modname; - - if (pam_test_option(options, PAM_OPT_DEBUG, NULL)) { - modname = modulename(file); - - switch (retval) { - case PAM_SUCCESS: - syslog(LOG_DEBUG, "%s: %s: returning PAM_SUCCESS", - modname, function); - break; - case PAM_AUTH_ERR: - syslog(LOG_DEBUG, "%s: %s: returning PAM_AUTH_ERR", - modname, function); - break; - case PAM_IGNORE: - syslog(LOG_DEBUG, "%s: %s: returning PAM_IGNORE", - modname, function); - break; - case PAM_PERM_DENIED: - syslog(LOG_DEBUG, "%s: %s: returning PAM_PERM_DENIED", - modname, function); - break; - default: - syslog(LOG_DEBUG, "%s: %s: returning (%d)", - modname, function, retval); - } - - free(modname); - } -} - /* Print a verbose error, including the function name and a * cleaned up filename. */ void -_pam_verbose_error(pam_handle_t *pamh, struct options *options, +_pam_verbose_error(pam_handle_t *pamh, int flags, const char *file, const char *function, const char *format, ...) { va_list ap; - char *statusmsg, *fmtbuf, *modname; + char *fmtbuf, *modname, *period; - if (!pam_test_option(options, PAM_OPT_NO_WARN, NULL)) { - modname = modulename(file); + if (!(flags & PAM_SILENT) || !openpam_get_option(pamh, "no_warn")) { + modname = basename(file); + period = strchr(modname, '.'); + if (period == NULL) + period = strchr(modname, '\0'); va_start(ap, format); - asprintf(&fmtbuf, "%s: %s: %s", modname, function, format); - vasprintf(&statusmsg, fmtbuf, ap); - pam_error(pamh, "%s", statusmsg); - free(statusmsg); + asprintf(&fmtbuf, "%.*s: %s: %s", period - modname, modname, + function, format); + pam_verror(pamh, fmtbuf, ap); free(fmtbuf); va_end(ap); } } - -static char * -modulename(const char *file) -{ - char *modname, *period; - - modname = strdup(basename(file)); - period = strchr(modname, '.'); - if (period != NULL) - *period = '\0'; - - return modname; -} diff --git a/lib/libpam/libpam/security/pam_mod_misc.h b/lib/libpam/libpam/security/pam_mod_misc.h index 5a541b2..8e50ff6 100644 --- a/lib/libpam/libpam/security/pam_mod_misc.h +++ b/lib/libpam/libpam/security/pam_mod_misc.h @@ -58,22 +58,17 @@ void pam_std_option(struct options *, struct opttab *, int, const char **); int pam_test_option(struct options *, enum opt, char **); void pam_set_option(struct options *, enum opt); void pam_clear_option(struct options *, enum opt); -void _pam_log(struct options *, const char *, const char *, const char *, ...); -void _pam_log_retval(struct options *, const char *, const char *, int); -void _pam_verbose_error(pam_handle_t *, struct options *, const char *, +void _pam_verbose_error(pam_handle_t *, int, const char *, const char *, const char *, ...); __END_DECLS #define PAM_LOG(args...) \ - _pam_log(&options, __FILE__, __FUNCTION__, ##args) + openpam_log(PAM_LOG_DEBUG, ##args) #define PAM_RETURN(arg) \ - do { \ - _pam_log_retval(&options, __FILE__, __FUNCTION__, arg); \ - return arg; \ - } while (0) + return (arg) #define PAM_VERBOSE_ERROR(args...) \ - _pam_verbose_error(pamh, &options, __FILE__, __FUNCTION__, ##args) + _pam_verbose_error(pamh, flags, __FILE__, __FUNCTION__, ##args) #endif diff --git a/lib/libpam/modules/pam_deny/pam_deny.c b/lib/libpam/modules/pam_deny/pam_deny.c index 02dc8a5..2c91e26 100644 --- a/lib/libpam/modules/pam_deny/pam_deny.c +++ b/lib/libpam/modules/pam_deny/pam_deny.c @@ -36,90 +36,58 @@ __FBSDID("$FreeBSD$"); #include #include -#include PAM_EXTERN int -pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, int argc, const char **argv) +pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, + int argc __unused, const char *argv[] __unused) { - struct options options; + const char *user; + int r; - pam_std_option(&options, NULL, argc, argv); + if ((r = pam_get_user(pamh, &user, NULL)) != PAM_SUCCESS) + return (r); - PAM_LOG("Options processed"); - - PAM_VERBOSE_ERROR("Unconditional deny"); - - PAM_RETURN(PAM_AUTH_ERR); + return (PAM_AUTH_ERR); } PAM_EXTERN int -pam_sm_setcred(pam_handle_t *pamh, int flags __unused, int argc, const char **argv) +pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused, + int argc __unused, const char *argv[] __unused) { - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_VERBOSE_ERROR("Unconditional deny"); - PAM_RETURN(PAM_CRED_UNAVAIL); + return (PAM_AUTH_ERR); } PAM_EXTERN int -pam_sm_acct_mgmt(pam_handle_t *pamh, int flags __unused, int argc ,const char **argv) +pam_sm_acct_mgmt(pam_handle_t *pamh __unused, int flags __unused, + int argc __unused, const char *argv[] __unused) { - struct options options; - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_VERBOSE_ERROR("Unconditional deny"); - - PAM_RETURN(PAM_ACCT_EXPIRED); + return (PAM_AUTH_ERR); } PAM_EXTERN int -pam_sm_chauthtok(pam_handle_t *pamh, int flags __unused, int argc, const char **argv) +pam_sm_chauthtok(pam_handle_t *pamh __unused, int flags __unused, + int argc __unused, const char *argv[] __unused) { - struct options options; - - pam_std_option(&options, NULL, argc, argv); - PAM_LOG("Options processed"); - - PAM_VERBOSE_ERROR("Unconditional deny"); - - PAM_RETURN(PAM_PERM_DENIED); + return (PAM_AUTH_ERR); } PAM_EXTERN int -pam_sm_open_session(pam_handle_t *pamh, int flags __unused, int argc, const char **argv) +pam_sm_open_session(pam_handle_t *pamh __unused, int flags __unused, + int argc __unused, const char *argv[] __unused) { - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - PAM_VERBOSE_ERROR("Unconditional deny"); - - PAM_RETURN(PAM_SESSION_ERR); + return (PAM_AUTH_ERR); } PAM_EXTERN int -pam_sm_close_session(pam_handle_t *pamh, int flags __unused, int argc, const char **argv) +pam_sm_close_session(pam_handle_t *pamh __unused, int flags __unused, + int argc __unused, const char *argv[] __unused) { - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_VERBOSE_ERROR("Unconditional deny"); - PAM_RETURN(PAM_SESSION_ERR); + return (PAM_AUTH_ERR); } PAM_MODULE_ENTRY("pam_deny"); diff --git a/lib/libpam/modules/pam_ftp/pam_ftp.c b/lib/libpam/modules/pam_ftp/pam_ftp.c index e99fbd8..8ad9a5c 100644 --- a/lib/libpam/modules/pam_ftp/pam_ftp.c +++ b/lib/libpam/modules/pam_ftp/pam_ftp.c @@ -48,9 +48,6 @@ __FBSDID("$FreeBSD$"); #include #define PAM_SM_AUTH -#define PAM_SM_ACCOUNT -#define PAM_SM_SESSION -#define PAM_SM_PASSWORD #include #include @@ -75,7 +72,7 @@ static const char *anonusers[] = {"ftp", "anonymous", NULL}; * Place username in *userret * Return 1 if listed 0 otherwise */ -static int +static int lookup(const char *user, char *list, const char **userret) { int anon, i; @@ -112,8 +109,9 @@ lookup(const char *user, char *list, const char **userret) * If this is the case, set the PAM_RUSER to the entered email address * and succeed, otherwise fail. */ -PAM_EXTERN int -pam_sm_authenticate(pam_handle_t * pamh, int flags __unused, int argc, const char **argv) +PAM_EXTERN int +pam_sm_authenticate(pam_handle_t * pamh, int flags __unused, + int argc, const char *argv[]) { struct options options; int retval, anon; @@ -126,7 +124,7 @@ pam_sm_authenticate(pam_handle_t * pamh, int flags __unused, int argc, const cha retval = pam_get_user(pamh, &user, NULL); if (retval != PAM_SUCCESS || user == NULL) - PAM_RETURN(PAM_USER_UNKNOWN); + return (PAM_USER_UNKNOWN); PAM_LOG("Got user: %s", user); @@ -143,7 +141,7 @@ pam_sm_authenticate(pam_handle_t * pamh, int flags __unused, int argc, const cha if (anon) { retval = pam_set_item(pamh, PAM_USER, (const void *)user); if (retval != PAM_SUCCESS) - PAM_RETURN(retval); + return (retval); prompt = GUEST_PROMPT; PAM_LOG("Doing anonymous"); } @@ -154,7 +152,7 @@ pam_sm_authenticate(pam_handle_t * pamh, int flags __unused, int argc, const cha retval = pam_prompt(pamh, PAM_PROMPT_ECHO_OFF, &token, "%s", prompt); if (retval != PAM_SUCCESS) - PAM_RETURN(PAM_AUTHINFO_UNAVAIL); + return (PAM_AUTHINFO_UNAVAIL); PAM_LOG("Got password"); @@ -192,67 +190,15 @@ pam_sm_authenticate(pam_handle_t * pamh, int flags __unused, int argc, const cha retval = PAM_AUTH_ERR; } - PAM_RETURN(retval); -} - -PAM_EXTERN int -pam_sm_setcred(pam_handle_t * pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, other_options, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_SUCCESS); + return (retval); } PAM_EXTERN int -pam_sm_acct_mgmt(pam_handle_t *pamh __unused, int flags __unused, int argc ,const char **argv) +pam_sm_setcred(pam_handle_t * pamh __unused, int flags __unused, + int argc __unused, const char *argv[] __unused) { - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); -} - -PAM_EXTERN int -pam_sm_chauthtok(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); -} - -PAM_EXTERN int -pam_sm_open_session(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); -} - -PAM_EXTERN int -pam_sm_close_session(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - PAM_RETURN(PAM_IGNORE); + return (PAM_SUCCESS); } PAM_MODULE_ENTRY("pam_ftp"); diff --git a/lib/libpam/modules/pam_kerberosIV/klogin.c b/lib/libpam/modules/pam_kerberosIV/klogin.c index ae51f74..0743e86 100644 --- a/lib/libpam/modules/pam_kerberosIV/klogin.c +++ b/lib/libpam/modules/pam_kerberosIV/klogin.c @@ -52,6 +52,8 @@ static const char sccsid[] = "@(#)klogin.c 8.3 (Berkeley) 4/2/94"; #include #include +#include "klogin.h" + #define INITIAL_TICKET "krbtgt" #define VERIFY_SERVICE "rcmd" @@ -65,14 +67,11 @@ extern char *krbtkfile_env; * 1 if Kerberos failed (try local password in login) */ int -klogin(pw, instance, localhost, password) - struct passwd *pw; - char *instance, *localhost, *password; +klogin(struct passwd *pw, char *instance, char *localhost, const char *password) { int kerror; char realm[REALM_SZ], savehost[MAXHOSTNAMELEN]; char tkt_location[MAXPATHLEN]; - char *krb_get_phost(); extern int noticketsdontcomplain; #ifdef KLOGIN_PARANOID diff --git a/lib/libpam/modules/pam_kerberosIV/klogin.h b/lib/libpam/modules/pam_kerberosIV/klogin.h new file mode 100644 index 0000000..e126a0b --- /dev/null +++ b/lib/libpam/modules/pam_kerberosIV/klogin.h @@ -0,0 +1,5 @@ +/* + * $FreeBSD$ + */ + +int klogin(struct passwd *, char *, char *, const char *); diff --git a/lib/libpam/modules/pam_kerberosIV/pam_kerberosIV.c b/lib/libpam/modules/pam_kerberosIV/pam_kerberosIV.c index 71e22c3..40f5a72 100644 --- a/lib/libpam/modules/pam_kerberosIV/pam_kerberosIV.c +++ b/lib/libpam/modules/pam_kerberosIV/pam_kerberosIV.c @@ -1,6 +1,13 @@ /*- * Copyright 1998 Juniper Networks, Inc. * All rights reserved. + * Copyright (c) 2002 Networks Associates Technology, Inc. + * All rights reserved. + * + * Portions of this software were developed for the FreeBSD Project by + * ThinkSec AS and NAI Labs, the Security Research Division of Network + * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 + * ("CBOSS"), as part of the DARPA CHATS research program. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions @@ -10,6 +17,9 @@ * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. + * 3. The name of the author may not be used to endorse or promote + * products derived from this software without specific prior written + * permission. * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE @@ -38,9 +48,7 @@ __FBSDID("$FreeBSD$"); #include #include -#define PASSWORD_PROMPT "Password:" - -extern int klogin(struct passwd *, char *, char *, char *); +#include "klogin.h" /* Globals used by klogin.c */ int notickets = 1; @@ -48,9 +56,9 @@ int noticketsdontcomplain = 1; char *krbtkfile_env; PAM_EXTERN int -pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, const char **argv) +pam_sm_authenticate(pam_handle_t *pamh, int flags, + int argc __unused, const char *argv[] __unused) { - struct options options; int retval; const char *user; char *principal; @@ -59,47 +67,41 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, const char **argv) char localhost[MAXHOSTNAMELEN + 1]; struct passwd *pwd; - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - retval = pam_get_user(pamh, &user, NULL); if (retval != PAM_SUCCESS) - PAM_RETURN(retval); + return (retval); PAM_LOG("Got user: %s", user); - retval = pam_get_pass(pamh, &password, PASSWORD_PROMPT, &options); + retval = pam_get_authtok(pamh, PAM_AUTHTOK, &password, NULL); if (retval != PAM_SUCCESS) - PAM_RETURN(retval); + return (retval); PAM_LOG("Got password"); if (gethostname(localhost, sizeof localhost - 1) == -1) - PAM_RETURN(PAM_SYSTEM_ERR); + return (PAM_SYSTEM_ERR); PAM_LOG("Got localhost: %s", localhost); principal = strdup(user); if (principal == NULL) - PAM_RETURN(PAM_BUF_ERR); + return (PAM_BUF_ERR); instance = strchr(principal, '.'); if (instance != NULL) *instance++ = '\0'; else - instance = ""; + instance = strchr(principal, '\0'); PAM_LOG("Got principal.instance: %s.%s", principal, instance); retval = PAM_AUTH_ERR; pwd = getpwnam(user); if (pwd != NULL) { - if (klogin(pwd, instance, localhost, (char *)password) == 0) { - if (!(flags & PAM_SILENT) && notickets && !noticketsdontcomplain) - pam_prompt(pamh, PAM_ERROR_MSG, - "Warning: no Kerberos tickets issued", - NULL); + if (klogin(pwd, instance, localhost, password) == 0) { + if (notickets && !noticketsdontcomplain) + PAM_VERBOSE_ERROR("Warning: no Kerberos tickets issued"); /* * XXX - I think the ticket file isn't supposed to * be created until pam_sm_setcred() is called. @@ -121,19 +123,15 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, const char **argv) if (retval != PAM_SUCCESS) PAM_VERBOSE_ERROR("Kerberos IV refuses you"); - PAM_RETURN(retval); + return (retval); } PAM_EXTERN int -pam_sm_setcred(pam_handle_t *pamh, int flags, int argc, const char **argv) +pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused, + int argc __unused, const char *argv[] __unused) { - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - PAM_RETURN(PAM_SUCCESS); + return (PAM_SUCCESS); } PAM_MODULE_ENTRY("pam_kerberosIV"); diff --git a/lib/libpam/modules/pam_krb5/pam_krb5.c b/lib/libpam/modules/pam_krb5/pam_krb5.c index 396390d..e94152e 100644 --- a/lib/libpam/modules/pam_krb5/pam_krb5.c +++ b/lib/libpam/modules/pam_krb5/pam_krb5.c @@ -4,7 +4,7 @@ * All rights reserved * Copyright (c) 2002 Networks Associates Technology, Inc. * All rights reserved. - * + * * Portions of this software were developed for the FreeBSD Project by * ThinkSec AS and NAI Labs, the Security Research Division of Network * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 @@ -22,13 +22,13 @@ * 3. The name of the author may not be used to endorse or promote * products derived from this software without specific prior * written permission. - * + * * ALTERNATIVELY, this product may be distributed under the terms of * the GNU Public License, in which case the provisions of the GPL are * required INSTEAD OF the above restrictions. (This clause is * necessary due to a potential bad interaction between the GPL and * the restrictions contained in a BSD-style copyright.) - * + * * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE @@ -41,17 +41,17 @@ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED * OF THE POSSIBILITY OF SUCH DAMAGE. * --------------------------------------------------------------------------- - * + * * This software may contain code from Naomaru Itoi: - * + * * PAM-kerberos5 module Copyright notice. * Naomaru Itoi , June 24, 1997. - * + * * ---------------------------------------------------------------------------- * COPYRIGHT (c) 1997 * THE REGENTS OF THE UNIVERSITY OF MICHIGAN * ALL RIGHTS RESERVED - * + * * PERMISSION IS GRANTED TO USE, COPY, CREATE DERIVATIVE WORKS AND REDISTRIBUTE * THIS SOFTWARE AND SUCH DERIVATIVE WORKS FOR ANY PURPOSE, SO LONG AS THE NAME * OF THE UNIVERSITY OF MICHIGAN IS NOT USED IN ANY ADVERTISING OR PUBLICITY @@ -59,7 +59,7 @@ * WRITTEN PRIOR AUTHORIZATION. IF THE ABOVE COPYRIGHT NOTICE OR ANY OTHER * IDENTIFICATION OF THE UNIVERSITY OF MICHIGAN IS INCLUDED IN ANY COPY OF ANY * PORTION OF THIS SOFTWARE, THEN THE DISCLAIMER BELOW MUST ALSO BE INCLUDED. - * + * * THE SOFTWARE IS PROVIDED AS IS, WITHOUT REPRESENTATION FROM THE UNIVERSITY OF * MICHIGAN AS TO ITS FITNESS FOR ANY PURPOSE, AND WITHOUT WARRANTY BY THE * UNIVERSITY OF MICHIGAN OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING @@ -69,19 +69,19 @@ * CONSEQUENTIAL DAMAGES, WITH RESPECT TO ANY CLAIM ARISING OUT OF OR IN * CONNECTION WITH THE USE OF THE SOFTWARE, EVEN IF IT HAS BEEN OR IS HEREAFTER * ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. - * + * * PAM-kerberos5 module is written based on PAM-kerberos4 module * by Derrick J. Brashear and kerberos5-1.0pl1 by M.I.T. kerberos team. * Permission to use, copy, modify, distribute this software is hereby * granted, as long as it is granted by Derrick J. Brashear and - * M.I.T. kerberos team. Followings are their copyright information. + * M.I.T. kerberos team. Followings are their copyright information. * ---------------------------------------------------------------------------- - * + * * This software may contain code from Derrick J. Brashear: - * - * + * + * * Copyright (c) Derrick J. Brashear, 1996. All rights reserved - * + * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: @@ -94,13 +94,13 @@ * 3. The name of the author may not be used to endorse or promote * products derived from this software without specific prior * written permission. - * + * * ALTERNATIVELY, this product may be distributed under the terms of * the GNU Public License, in which case the provisions of the GPL are * required INSTEAD OF the above restrictions. (This clause is * necessary due to a potential bad interaction between the GPL and * the restrictions contained in a BSD-style copyright.) - * + * * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE @@ -112,23 +112,23 @@ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED * OF THE POSSIBILITY OF SUCH DAMAGE. - * + * * ---------------------------------------------------------------------------- - * + * * This software may contain code from MIT Kerberos 5: - * + * * Copyright Notice and Legal Administrivia * ---------------------------------------- - * + * * Copyright (C) 1996 by the Massachusetts Institute of Technology. - * + * * All rights reserved. - * + * * Export of this software from the United States of America may require * a specific license from the United States Government. It is the * responsibility of any person or organization contemplating export to * obtain such a license before exporting. - * + * * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and * distribute this software and its documentation for any purpose and * without fee is hereby granted, provided that the above copyright @@ -139,62 +139,62 @@ * permission. M.I.T. makes no representations about the suitability of * this software for any purpose. It is provided "as is" without express * or implied warranty. - * + * * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. - * + * * Individual source code files are copyright MIT, Cygnus Support, * OpenVision, Oracle, Sun Soft, and others. - * + * * Project Athena, Athena, Athena MUSE, Discuss, Hesiod, Kerberos, Moira, * and Zephyr are trademarks of the Massachusetts Institute of Technology * (MIT). No commercial use of these trademarks may be made without * prior written permission of MIT. - * + * * "Commercial use" means use of a name in a product or other for-profit * manner. It does NOT prevent a commercial firm from referring to the * MIT trademarks in order to convey information (although in doing so, * recognition of their trademark status should be given). - * + * * The following copyright and permission notice applies to the * OpenVision Kerberos Administration system located in kadmin/create, * kadmin/dbutil, kadmin/passwd, kadmin/server, lib/kadm5, and portions * of lib/rpc: - * + * * Copyright, OpenVision Technologies, Inc., 1996, All Rights Reserved - * - * WARNING: Retrieving the OpenVision Kerberos Administration system - * source code, as described below, indicates your acceptance of the - * following terms. If you do not agree to the following terms, do not + * + * WARNING: Retrieving the OpenVision Kerberos Administration system + * source code, as described below, indicates your acceptance of the + * following terms. If you do not agree to the following terms, do not * retrieve the OpenVision Kerberos administration system. - * + * * You may freely use and distribute the Source Code and Object Code * compiled from it, with or without modification, but this Source * Code is provided to you "AS IS" EXCLUSIVE OF ANY WARRANTY, * INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY OR * FITNESS FOR A PARTICULAR PURPOSE, OR ANY OTHER WARRANTY, WHETHER * EXPRESS OR IMPLIED. IN NO EVENT WILL OPENVISION HAVE ANY LIABILITY - * FOR ANY LOST PROFITS, LOSS OF DATA OR COSTS OF PROCUREMENT OF + * FOR ANY LOST PROFITS, LOSS OF DATA OR COSTS OF PROCUREMENT OF * SUBSTITUTE GOODS OR SERVICES, OR FOR ANY SPECIAL, INDIRECT, OR - * CONSEQUENTIAL DAMAGES ARISING OUT OF THIS AGREEMENT, INCLUDING, - * WITHOUT LIMITATION, THOSE RESULTING FROM THE USE OF THE SOURCE - * CODE, OR THE FAILURE OF THE SOURCE CODE TO PERFORM, OR FOR ANY + * CONSEQUENTIAL DAMAGES ARISING OUT OF THIS AGREEMENT, INCLUDING, + * WITHOUT LIMITATION, THOSE RESULTING FROM THE USE OF THE SOURCE + * CODE, OR THE FAILURE OF THE SOURCE CODE TO PERFORM, OR FOR ANY * OTHER REASON. - * + * * OpenVision retains all copyrights in the donated Source Code. OpenVision * also retains copyright to derivative works of the Source Code, whether - * created by OpenVision or by a third party. The OpenVision copyright - * notice must be preserved if derivative works are made based on the + * created by OpenVision or by a third party. The OpenVision copyright + * notice must be preserved if derivative works are made based on the * donated Source Code. - * - * OpenVision Technologies, Inc. has donated this Kerberos - * Administration system to MIT for inclusion in the standard - * Kerberos 5 distribution. This donation underscores our - * commitment to continuing Kerberos technology development - * and our gratitude for the valuable work which has been + * + * OpenVision Technologies, Inc. has donated this Kerberos + * Administration system to MIT for inclusion in the standard + * Kerberos 5 distribution. This donation underscores our + * commitment to continuing Kerberos technology development + * and our gratitude for the valuable work which has been * performed by MIT and the Kerberos community. - * + * */ #include @@ -216,7 +216,6 @@ __FBSDID("$FreeBSD$"); #define PAM_SM_AUTH #define PAM_SM_ACCOUNT -#define PAM_SM_SESSION #define PAM_SM_PASSWORD #include @@ -237,7 +236,13 @@ static void compat_free_data_contents(krb5_context, krb5_data *); #define PASSWORD_PROMPT "Password:" #define NEW_PASSWORD_PROMPT "New Password:" -enum { PAM_OPT_AUTH_AS_SELF=PAM_OPT_STD_MAX, PAM_OPT_CCACHE, PAM_OPT_FORWARDABLE, PAM_OPT_NO_CCACHE, PAM_OPT_REUSE_CCACHE }; +enum { + PAM_OPT_AUTH_AS_SELF = PAM_OPT_STD_MAX, + PAM_OPT_CCACHE, + PAM_OPT_FORWARDABLE, + PAM_OPT_NO_CCACHE, + PAM_OPT_REUSE_CCACHE +}; static struct opttab other_options[] = { { "auth_as_self", PAM_OPT_AUTH_AS_SELF }, @@ -252,7 +257,8 @@ static struct opttab other_options[] = { * authentication management */ PAM_EXTERN int -pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, int argc, const char **argv) +pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, + int argc, const char *argv[]) { krb5_error_code krbret; krb5_context pam_context; @@ -272,13 +278,13 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, int argc, const char retval = pam_get_user(pamh, &user, USER_PROMPT); if (retval != PAM_SUCCESS) - PAM_RETURN(retval); + return (retval); PAM_LOG("Got user: %s", user); retval = pam_get_item(pamh, PAM_RUSER, (const void **)&sourceuser); if (retval != PAM_SUCCESS) - PAM_RETURN(retval); + return (retval); PAM_LOG("Got ruser: %s", sourceuser); @@ -292,7 +298,7 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, int argc, const char krbret = krb5_init_context(&pam_context); if (krbret != 0) { PAM_VERBOSE_ERROR("Kerberos 5 error"); - PAM_RETURN(PAM_SERVICE_ERR); + return (PAM_SERVICE_ERR); } PAM_LOG("Context initialised"); @@ -479,11 +485,12 @@ cleanup3: if (retval != PAM_SUCCESS) PAM_VERBOSE_ERROR("Kerberos 5 refuses you"); - PAM_RETURN(retval); + return (retval); } PAM_EXTERN int -pam_sm_setcred(pam_handle_t *pamh, int flags, int argc, const char **argv) +pam_sm_setcred(pam_handle_t *pamh, int flags, + int argc, const char *argv[]) { krb5_error_code krbret; @@ -506,30 +513,30 @@ pam_sm_setcred(pam_handle_t *pamh, int flags, int argc, const char **argv) PAM_LOG("Options processed"); if (flags & PAM_DELETE_CRED) - PAM_RETURN(PAM_SUCCESS); + return (PAM_SUCCESS); if (flags & PAM_REFRESH_CRED) - PAM_RETURN(PAM_SUCCESS); + return (PAM_SUCCESS); if (flags & PAM_REINITIALIZE_CRED) - PAM_RETURN(PAM_SUCCESS); + return (PAM_SUCCESS); if (!(flags & PAM_ESTABLISH_CRED)) - PAM_RETURN(PAM_SERVICE_ERR); + return (PAM_SERVICE_ERR); PAM_LOG("Establishing credentials"); /* Get username */ retval = pam_get_item(pamh, PAM_USER, (const void **)&user); if (retval != PAM_SUCCESS) - PAM_RETURN(retval); + return (retval); PAM_LOG("Got user: %s", user); krbret = krb5_init_context(&pam_context); if (krbret != 0) { PAM_LOG("Error krb5_init_context(): %s", error_message(krbret)); - PAM_RETURN(PAM_SERVICE_ERR); + return (PAM_SERVICE_ERR); } PAM_LOG("Context initialised"); @@ -711,15 +718,16 @@ cleanup3: setegid(egid); PAM_LOG("Done seteuid() & setegid()"); - - PAM_RETURN(retval); + + return (retval); } -/* +/* * account management */ PAM_EXTERN int -pam_sm_acct_mgmt(pam_handle_t *pamh, int flags __unused, int argc, const char **argv) +pam_sm_acct_mgmt(pam_handle_t *pamh, int flags __unused, + int argc, const char *argv[]) { krb5_error_code krbret; krb5_context pam_context; @@ -735,20 +743,20 @@ pam_sm_acct_mgmt(pam_handle_t *pamh, int flags __unused, int argc, const char ** retval = pam_get_item(pamh, PAM_USER, (const void **)&user); if (retval != PAM_SUCCESS) - PAM_RETURN(retval); + return (retval); PAM_LOG("Got user: %s", user); retval = pam_get_data(pamh, "ccache", (const void **)&ccache); if (retval != PAM_SUCCESS) - PAM_RETURN(PAM_SUCCESS); + return (PAM_SUCCESS); PAM_LOG("Got ccache"); krbret = krb5_init_context(&pam_context); if (krbret != 0) { PAM_LOG("Error krb5_init_context(): %s", error_message(krbret)); - PAM_RETURN(PAM_PERM_DENIED); + return (PAM_PERM_DENIED); } PAM_LOG("Context initialised"); @@ -774,44 +782,16 @@ cleanup: krb5_free_context(pam_context); PAM_LOG("Done cleanup"); - PAM_RETURN(retval); - -} - -/* - * session management - * - * logging only - */ -PAM_EXTERN int -pam_sm_open_session(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_SUCCESS); -} - -PAM_EXTERN int -pam_sm_close_session(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); + return (retval); - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_SUCCESS); } -/* +/* * password management */ PAM_EXTERN int -pam_sm_chauthtok(pam_handle_t *pamh, int flags, int argc, const char **argv) +pam_sm_chauthtok(pam_handle_t *pamh, int flags, + int argc, const char *argv[]) { krb5_error_code krbret; krb5_context pam_context; @@ -829,18 +809,18 @@ pam_sm_chauthtok(pam_handle_t *pamh, int flags, int argc, const char **argv) PAM_LOG("Options processed"); if (!(flags & PAM_UPDATE_AUTHTOK)) - PAM_RETURN(PAM_AUTHTOK_ERR); + return (PAM_AUTHTOK_ERR); retval = pam_get_item(pamh, PAM_USER, (const void **)&user); if (retval != PAM_SUCCESS) - PAM_RETURN(retval); + return (retval); PAM_LOG("Got user: %s", user); krbret = krb5_init_context(&pam_context); if (krbret != 0) { PAM_LOG("Error krb5_init_context(): %s", error_message(krbret)); - PAM_RETURN(PAM_SERVICE_ERR); + return (PAM_SERVICE_ERR); } PAM_LOG("Context initialised"); @@ -941,7 +921,7 @@ cleanup3: PAM_LOG("Done cleanup3"); - PAM_RETURN(retval); + return (retval); } PAM_MODULE_ENTRY("pam_krb5"); @@ -1003,10 +983,10 @@ verify_krb_v5_tgt(krb5_context context, krb5_ccache ccache, phost[BUFSIZ - 1] = '\0'; /* - * Do we have service/ keys? - * (use default/configured keytab, kvno IGNORE_VNO to get the - * first match, and ignore enctype.) - */ + * Do we have service/ keys? + * (use default/configured keytab, kvno IGNORE_VNO to get the + * first match, and ignore enctype.) + */ retval = krb5_kt_read_service_key(context, NULL, princ, 0, 0, &keyblock); if (retval != 0) diff --git a/lib/libpam/modules/pam_lastlog/pam_lastlog.c b/lib/libpam/modules/pam_lastlog/pam_lastlog.c index 81f94ff..fea8154 100644 --- a/lib/libpam/modules/pam_lastlog/pam_lastlog.c +++ b/lib/libpam/modules/pam_lastlog/pam_lastlog.c @@ -57,69 +57,16 @@ __FBSDID("$FreeBSD$"); #include #include -#define PAM_SM_AUTH -#define PAM_SM_ACCOUNT #define PAM_SM_SESSION -#define PAM_SM_PASSWORD #include #include #include -extern int login_access(const char *, const char *); - PAM_EXTERN int -pam_sm_authenticate(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) +pam_sm_open_session(pam_handle_t *pamh, int flags, + int argc __unused, const char *argv[] __unused) { - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); -} - -PAM_EXTERN int -pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); -} - -PAM_EXTERN int -pam_sm_acct_mgmt(pam_handle_t *pamh __unused, int flags __unused, int argc ,const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); -} - -PAM_EXTERN int -pam_sm_chauthtok(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); -} - -PAM_EXTERN int -pam_sm_open_session(pam_handle_t *pamh, int flags, int argc, const char **argv) -{ - struct options options; struct passwd *pwd; struct utmp utmp; struct lastlog ll; @@ -127,31 +74,27 @@ pam_sm_open_session(pam_handle_t *pamh, int flags, int argc, const char **argv) off_t llpos; int fd, pam_err; - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - pam_err = pam_get_item(pamh, PAM_USER, (const void **)&user); + pam_err = pam_get_user(pamh, &user, NULL); if (pam_err != PAM_SUCCESS) - PAM_RETURN(pam_err); + return (pam_err); if (user == NULL || (pwd = getpwnam(user)) == NULL) - PAM_RETURN(PAM_SERVICE_ERR); + return (PAM_SERVICE_ERR); PAM_LOG("Got user: %s", user); pam_err = pam_get_item(pamh, PAM_RHOST, (const void **)&rhost); if (pam_err != PAM_SUCCESS) - PAM_RETURN(pam_err); - + return (pam_err); + pam_err = pam_get_item(pamh, PAM_TTY, (const void **)&tty); if (pam_err != PAM_SUCCESS) - PAM_RETURN(pam_err); + return (pam_err); if (tty == NULL) - PAM_RETURN(PAM_SERVICE_ERR); - + return (PAM_SERVICE_ERR); + fd = open(_PATH_LASTLOG, O_RDWR|O_CREAT, 0644); if (fd == -1) { syslog(LOG_ERR, "cannot open %s: %m", _PATH_LASTLOG); - PAM_RETURN(PAM_SERVICE_ERR); + return (PAM_SERVICE_ERR); } /* @@ -175,21 +118,21 @@ pam_sm_open_session(pam_handle_t *pamh, int flags, int argc, const char **argv) if (lseek(fd, llpos, L_SET) != llpos) goto file_err; } - + bzero(&ll, sizeof(ll)); time(&ll.ll_time); - + /* note: does not need to be NUL-terminated */ strncpy(ll.ll_line, tty, sizeof(ll.ll_line)); if (rhost != NULL) /* note: does not need to be NUL-terminated */ strncpy(ll.ll_host, rhost, sizeof(ll.ll_host)); - + if (write(fd, (char *)&ll, sizeof(ll)) != sizeof(ll) || close(fd) != 0) goto file_err; PAM_LOG("Login recorded in %s", _PATH_LASTLOG); - + /* * Record session in utmp(5) and wtmp(5). */ @@ -201,25 +144,21 @@ pam_sm_open_session(pam_handle_t *pamh, int flags, int argc, const char **argv) strncpy(utmp.ut_host, rhost, sizeof(utmp.ut_host)); (void)strncpy(utmp.ut_line, tty, sizeof(utmp.ut_line)); login(&utmp); - - PAM_RETURN(PAM_IGNORE); - + + return (PAM_IGNORE); + file_err: syslog(LOG_ERR, "%s: %m", _PATH_LASTLOG); close(fd); - PAM_RETURN(PAM_SERVICE_ERR); + return (PAM_SERVICE_ERR); } PAM_EXTERN int -pam_sm_close_session(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) +pam_sm_close_session(pam_handle_t *pamh __unused, int flags __unused, + int argc __unused, const char *argv[] __unused) { - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - PAM_RETURN(PAM_SUCCESS); + return (PAM_SUCCESS); } PAM_MODULE_ENTRY("pam_lastlog"); diff --git a/lib/libpam/modules/pam_login_access/pam_login_access.c b/lib/libpam/modules/pam_login_access/pam_login_access.c index 87cf450..8f8ac54 100644 --- a/lib/libpam/modules/pam_login_access/pam_login_access.c +++ b/lib/libpam/modules/pam_login_access/pam_login_access.c @@ -44,10 +44,7 @@ __FBSDID("$FreeBSD$"); #include #include -#define PAM_SM_AUTH #define PAM_SM_ACCOUNT -#define PAM_SM_SESSION -#define PAM_SM_PASSWORD #include #include @@ -56,57 +53,29 @@ __FBSDID("$FreeBSD$"); #include "pam_login_access.h" PAM_EXTERN int -pam_sm_authenticate(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) +pam_sm_acct_mgmt(pam_handle_t *pamh, int flags __unused, + int argc __unused, const char *argv[] __unused) { - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); -} - -PAM_EXTERN int -pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); -} - -PAM_EXTERN int -pam_sm_acct_mgmt(pam_handle_t *pamh, int flags __unused, int argc ,const char **argv) -{ - struct options options; const char *rhost, *tty, *user; char hostname[MAXHOSTNAMELEN]; int pam_err; - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - pam_err = pam_get_item(pamh, PAM_USER, (const void **)&user); if (pam_err != PAM_SUCCESS) - PAM_RETURN(pam_err); + return (pam_err); if (user == NULL) - PAM_RETURN(PAM_SERVICE_ERR); + return (PAM_SERVICE_ERR); PAM_LOG("Got user: %s", user); pam_err = pam_get_item(pamh, PAM_RHOST, (const void **)&rhost); if (pam_err != PAM_SUCCESS) - PAM_RETURN(pam_err); + return (pam_err); pam_err = pam_get_item(pamh, PAM_TTY, (const void **)&tty); if (pam_err != PAM_SUCCESS) - PAM_RETURN(pam_err); + return (pam_err); gethostname(hostname, sizeof hostname); @@ -114,55 +83,19 @@ pam_sm_acct_mgmt(pam_handle_t *pamh, int flags __unused, int argc ,const char ** PAM_LOG("Checking login.access for user %s on tty %s", user, tty); if (login_access(user, tty) != 0) - PAM_RETURN(PAM_SUCCESS); + return (PAM_SUCCESS); PAM_VERBOSE_ERROR("%s is not allowed to log in on %s", user, tty); } else { PAM_LOG("Checking login.access for user %s from host %s", user, rhost); if (login_access(user, rhost) != 0) - PAM_RETURN(PAM_SUCCESS); + return (PAM_SUCCESS); PAM_VERBOSE_ERROR("%s is not allowed to log in from %s", user, rhost); } - - PAM_RETURN(PAM_AUTH_ERR); -} - -PAM_EXTERN int -pam_sm_chauthtok(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); -} - -PAM_EXTERN int -pam_sm_open_session(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); -} - -PAM_EXTERN int -pam_sm_close_session(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - PAM_RETURN(PAM_IGNORE); + return (PAM_AUTH_ERR); } PAM_MODULE_ENTRY("pam_login_access"); diff --git a/lib/libpam/modules/pam_nologin/pam_nologin.c b/lib/libpam/modules/pam_nologin/pam_nologin.c index 4becc6e..f148be6 100644 --- a/lib/libpam/modules/pam_nologin/pam_nologin.c +++ b/lib/libpam/modules/pam_nologin/pam_nologin.c @@ -47,9 +47,6 @@ __FBSDID("$FreeBSD$"); #include #define PAM_SM_AUTH -#define PAM_SM_ACCOUNT -#define PAM_SM_SESSION -#define PAM_SM_PASSWORD #include #include @@ -60,23 +57,19 @@ __FBSDID("$FreeBSD$"); static char nologin_def[] = NOLOGIN; PAM_EXTERN int -pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, int argc, const char **argv) +pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, + int argc __unused, const char *argv[] __unused) { login_cap_t *lc; - struct options options; struct passwd *pwd; struct stat st; int retval, fd; const char *user, *nologin; char *mtmp; - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - retval = pam_get_user(pamh, &user, NULL); if (retval != PAM_SUCCESS) - PAM_RETURN(retval); + return (retval); PAM_LOG("Got user: %s", user); @@ -87,7 +80,7 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, int argc, const char fd = open(nologin, O_RDONLY, 0); if (fd < 0) - PAM_RETURN(PAM_SUCCESS); + return (PAM_SUCCESS); PAM_LOG("Opened %s file", NOLOGIN); @@ -100,9 +93,9 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, int argc, const char else retval = PAM_AUTH_ERR; } - + if (fstat(fd, &st) < 0) - PAM_RETURN(retval); + return (retval); mtmp = malloc(st.st_size + 1); if (mtmp != NULL) { @@ -111,71 +104,19 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, int argc, const char pam_error(pamh, "%s", mtmp, NULL); free(mtmp); } - + if (retval != PAM_SUCCESS) PAM_VERBOSE_ERROR("Administrator refusing you: %s", NOLOGIN); - PAM_RETURN(retval); -} - -PAM_EXTERN int -pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_SUCCESS); -} - -PAM_EXTERN int -pam_sm_acct_mgmt(pam_handle_t *pamh __unused, int flags __unused, int argc ,const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); + return (retval); } PAM_EXTERN int -pam_sm_chauthtok(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) +pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused, + int argc __unused, const char *argv[] __unused) { - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); -} - -PAM_EXTERN int -pam_sm_open_session(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); -} - -PAM_EXTERN int -pam_sm_close_session(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - PAM_RETURN(PAM_IGNORE); + return (PAM_SUCCESS); } PAM_MODULE_ENTRY("pam_nologin"); diff --git a/lib/libpam/modules/pam_opie/pam_opie.c b/lib/libpam/modules/pam_opie/pam_opie.c index b4bafc9..e5c1488 100644 --- a/lib/libpam/modules/pam_opie/pam_opie.c +++ b/lib/libpam/modules/pam_opie/pam_opie.c @@ -1,7 +1,7 @@ /*- * Copyright 2000 James Bloom * All rights reserved. - * Based upon code Copyright 1998 Juniper Networks, Inc. + * Based upon code Copyright 1998 Juniper Networks, Inc. * Copyright (c) 2001,2002 Networks Associates Technology, Inc. * All rights reserved. * @@ -46,16 +46,13 @@ __FBSDID("$FreeBSD$"); #include #define PAM_SM_AUTH -#define PAM_SM_ACCOUNT -#define PAM_SM_SESSION -#define PAM_SM_PASSWORD #include #include #include enum { - PAM_OPT_AUTH_AS_SELF = PAM_OPT_STD_MAX, + PAM_OPT_AUTH_AS_SELF = PAM_OPT_STD_MAX, PAM_OPT_NO_FAKE_PROMPTS }; @@ -66,7 +63,8 @@ static struct opttab other_options[] = { }; PAM_EXTERN int -pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, int argc, const char **argv) +pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, + int argc, const char *argv[]) { struct opie opie; struct options options; @@ -86,13 +84,13 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, int argc, const char user = NULL; if (pam_test_option(&options, PAM_OPT_AUTH_AS_SELF, NULL)) { if ((pwd = getpwnam(getlogin())) == NULL) - PAM_RETURN(PAM_AUTH_ERR); + return (PAM_AUTH_ERR); user = pwd->pw_name; } else { retval = pam_get_user(pamh, (const char **)&user, NULL); if (retval != PAM_SUCCESS) - PAM_RETURN(retval); + return (retval); } PAM_LOG("Got user: %s", user); @@ -110,22 +108,22 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, int argc, const char */ /* XXX generates a const warning because of incorrect prototype */ if (opiechallenge(&opie, (char *)user, challenge) != 0 && - pam_test_option(&options, PAM_OPT_NO_FAKE_PROMPTS, NULL)) - PAM_RETURN(PAM_AUTH_ERR); - + pam_test_option(&options, PAM_OPT_NO_FAKE_PROMPTS, NULL)) + return (PAM_AUTH_ERR); + /* * It doesn't make sense to use a password that has already been * typed in, since we haven't presented the challenge to the user * yet, so clear the stored password. */ pam_set_item(pamh, PAM_AUTHTOK, NULL); - + for (i = 0; i < 2; i++) { snprintf(prompt, sizeof prompt, promptstr[i], challenge); retval = pam_get_authtok(pamh, PAM_AUTHTOK, &response, prompt); if (retval != PAM_SUCCESS) { opieunlock(); - PAM_RETURN(retval); + return (retval); } PAM_LOG("Completed challenge %d: %s", i, response); @@ -147,67 +145,15 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, int argc, const char * success or lack thereof. */ retval = opieverify(&opie, resp) == 0 ? PAM_SUCCESS : PAM_AUTH_ERR; - PAM_RETURN(retval); -} - -PAM_EXTERN int -pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, other_options, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_SUCCESS); + return (retval); } PAM_EXTERN int -pam_sm_acct_mgmt(pam_handle_t *pamh __unused, int flags __unused, int argc ,const char **argv) +pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused, + int argc __unused, const char *argv[] __unused) { - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); -} - -PAM_EXTERN int -pam_sm_chauthtok(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); -} - -PAM_EXTERN int -pam_sm_open_session(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); -} - -PAM_EXTERN int -pam_sm_close_session(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - PAM_RETURN(PAM_IGNORE); + return (PAM_SUCCESS); } PAM_MODULE_ENTRY("pam_opie"); diff --git a/lib/libpam/modules/pam_opieaccess/pam_opieaccess.c b/lib/libpam/modules/pam_opieaccess/pam_opieaccess.c index 1d559d7..d9499d9 100644 --- a/lib/libpam/modules/pam_opieaccess/pam_opieaccess.c +++ b/lib/libpam/modules/pam_opieaccess/pam_opieaccess.c @@ -46,108 +46,49 @@ __FBSDID("$FreeBSD$"); #include #define PAM_SM_AUTH -#define PAM_SM_ACCOUNT -#define PAM_SM_SESSION -#define PAM_SM_PASSWORD #include #include #include PAM_EXTERN int -pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, int argc, const char **argv) +pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, + int argc __unused, const char *argv[] __unused) { - struct options options; struct opie opie; struct passwd *pwent; char *luser, *rhost; int r; - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - r = pam_get_item(pamh, PAM_USER, (const void **)&luser); if (r != PAM_SUCCESS) - PAM_RETURN(r); + return (r); if (luser == NULL) - PAM_RETURN(PAM_SERVICE_ERR); + return (PAM_SERVICE_ERR); pwent = getpwnam(luser); if (pwent == NULL || opielookup(&opie, luser) != 0) - PAM_RETURN(PAM_IGNORE); - + return (PAM_IGNORE); + r = pam_get_item(pamh, PAM_RHOST, (const void **)&rhost); if (r != PAM_SUCCESS) - PAM_RETURN(r); - + return (r); + if ((rhost == NULL || opieaccessfile(rhost)) && opiealways(pwent->pw_dir) != 0) - PAM_RETURN(PAM_IGNORE); - - PAM_VERBOSE_ERROR("Refused; remote host is not in opieaccess"); - - PAM_RETURN(PAM_AUTH_ERR); -} - -PAM_EXTERN int -pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_SUCCESS); -} - -PAM_EXTERN int -pam_sm_acct_mgmt(pam_handle_t *pamh __unused, int flags __unused, int argc ,const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); + return (PAM_IGNORE); - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); -} - -PAM_EXTERN int -pam_sm_chauthtok(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); -} - -PAM_EXTERN int -pam_sm_open_session(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); + PAM_VERBOSE_ERROR("Refused; remote host is not in opieaccess"); - PAM_RETURN(PAM_IGNORE); + return (PAM_AUTH_ERR); } PAM_EXTERN int -pam_sm_close_session(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) +pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused, + int argc __unused, const char *argv[] __unused) { - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - PAM_RETURN(PAM_IGNORE); + return (PAM_SUCCESS); } PAM_MODULE_ENTRY("pam_opieaccess"); diff --git a/lib/libpam/modules/pam_permit/pam_permit.c b/lib/libpam/modules/pam_permit/pam_permit.c index 632fbcb..fe0a4ed 100644 --- a/lib/libpam/modules/pam_permit/pam_permit.c +++ b/lib/libpam/modules/pam_permit/pam_permit.c @@ -36,94 +36,58 @@ __FBSDID("$FreeBSD$"); #include #include -#include - -#define NOBODY "nobody" PAM_EXTERN int -pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, int argc, const char **argv) +pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, + int argc __unused, const char *argv[] __unused) { - struct options options; - int retval; const char *user; + int r; - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - /* We always need to know who the user is */ - user = NULL; - retval = pam_get_user(pamh, &user, NULL); - if (retval != PAM_SUCCESS) - PAM_RETURN(retval); - - PAM_LOG("Got user: %s", user); + if ((r = pam_get_user(pamh, &user, NULL)) != PAM_SUCCESS) + return (r); - if (user == NULL || *user == '\0') - pam_set_item(pamh, PAM_USER, (const void *)NOBODY); - user = NULL; - - PAM_RETURN(PAM_SUCCESS); + return (PAM_SUCCESS); } PAM_EXTERN int -pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) +pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused, + int argc __unused, const char *argv[] __unused) { - struct options options; - - pam_std_option(&options, NULL, argc, argv); - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_SUCCESS); + return (PAM_SUCCESS); } PAM_EXTERN int -pam_sm_acct_mgmt(pam_handle_t *pamh __unused, int flags __unused, int argc ,const char **argv) +pam_sm_acct_mgmt(pam_handle_t *pamh __unused, int flags __unused, + int argc __unused, const char *argv[] __unused) { - struct options options; - - pam_std_option(&options, NULL, argc, argv); - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_SUCCESS); + return (PAM_SUCCESS); } PAM_EXTERN int -pam_sm_chauthtok(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) +pam_sm_chauthtok(pam_handle_t *pamh __unused, int flags __unused, + int argc __unused, const char *argv[] __unused) { - struct options options; - - pam_std_option(&options, NULL, argc, argv); - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_SUCCESS); + return (PAM_SUCCESS); } PAM_EXTERN int -pam_sm_open_session(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) +pam_sm_open_session(pam_handle_t *pamh __unused, int flags __unused, + int argc __unused, const char *argv[] __unused) { - struct options options; - - pam_std_option(&options, NULL, argc, argv); - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_SUCCESS); + return (PAM_SUCCESS); } PAM_EXTERN int -pam_sm_close_session(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) +pam_sm_close_session(pam_handle_t *pamh __unused, int flags __unused, + int argc __unused, const char *argv[] __unused) { - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - PAM_RETURN(PAM_SUCCESS); + return (PAM_SUCCESS); } PAM_MODULE_ENTRY("pam_permit"); diff --git a/lib/libpam/modules/pam_radius/pam_radius.c b/lib/libpam/modules/pam_radius/pam_radius.c index 56eaff4..a6a3074 100644 --- a/lib/libpam/modules/pam_radius/pam_radius.c +++ b/lib/libpam/modules/pam_radius/pam_radius.c @@ -46,15 +46,15 @@ __FBSDID("$FreeBSD$"); #include #define PAM_SM_AUTH -#define PAM_SM_ACCOUNT -#define PAM_SM_SESSION -#define PAM_SM_PASSWORD #include #include #include -enum { PAM_OPT_CONF=PAM_OPT_STD_MAX, PAM_OPT_TEMPLATE_USER }; +enum { + PAM_OPT_CONF = PAM_OPT_STD_MAX, + PAM_OPT_TEMPLATE_USER +}; static struct opttab other_options[] = { { "conf", PAM_OPT_CONF }, @@ -83,7 +83,7 @@ build_access_request(struct rad_handle *radh, const char *user, if (rad_create_request(radh, RAD_ACCESS_REQUEST) == -1) { syslog(LOG_CRIT, "rad_create_request: %s", rad_strerror(radh)); - return -1; + return (-1); } if ((user != NULL && rad_put_string(radh, RAD_USER_NAME, user) == -1) || @@ -92,18 +92,18 @@ build_access_request(struct rad_handle *radh, const char *user, (gethostname(host, sizeof host) != -1 && rad_put_string(radh, RAD_NAS_IDENTIFIER, host) == -1)) { syslog(LOG_CRIT, "rad_put_string: %s", rad_strerror(radh)); - return -1; + return (-1); } if (state != NULL && rad_put_attr(radh, RAD_STATE, state, state_len) == -1) { syslog(LOG_CRIT, "rad_put_attr: %s", rad_strerror(radh)); - return -1; + return (-1); } if (rad_put_int(radh, RAD_SERVICE_TYPE, RAD_AUTHENTICATE_ONLY) == -1) { syslog(LOG_CRIT, "rad_put_int: %s", rad_strerror(radh)); - return -1; + return (-1); } - return 0; + return (0); } static int @@ -120,7 +120,7 @@ do_accept(pam_handle_t *pamh, struct rad_handle *radh) if (s == NULL) { syslog(LOG_CRIT, "rad_cvt_string: out of memory"); - return -1; + return (-1); } pam_set_item(pamh, PAM_USER, s); free(s); @@ -128,9 +128,9 @@ do_accept(pam_handle_t *pamh, struct rad_handle *radh) } if (attrtype == -1) { syslog(LOG_CRIT, "rad_get_attr: %s", rad_strerror(radh)); - return -1; + return (-1); } - return 0; + return (0); } static int @@ -164,13 +164,13 @@ do_challenge(pam_handle_t *pamh, struct rad_handle *radh, const char *user) if (num_msgs >= MAX_CHALLENGE_MSGS) { syslog(LOG_CRIT, "Too many RADIUS challenge messages"); - return PAM_SERVICE_ERR; + return (PAM_SERVICE_ERR); } msgs[num_msgs].msg = rad_cvt_string(attrval, attrlen); if (msgs[num_msgs].msg == NULL) { syslog(LOG_CRIT, "rad_cvt_string: out of memory"); - return PAM_SERVICE_ERR; + return (PAM_SERVICE_ERR); } msgs[num_msgs].msg_style = PAM_TEXT_INFO; msg_ptrs[num_msgs] = &msgs[num_msgs]; @@ -180,13 +180,13 @@ do_challenge(pam_handle_t *pamh, struct rad_handle *radh, const char *user) } if (attrtype == -1) { syslog(LOG_CRIT, "rad_get_attr: %s", rad_strerror(radh)); - return PAM_SERVICE_ERR; + return (PAM_SERVICE_ERR); } if (num_msgs == 0) { msgs[num_msgs].msg = strdup("(null RADIUS challenge): "); if (msgs[num_msgs].msg == NULL) { syslog(LOG_CRIT, "Out of memory"); - return PAM_SERVICE_ERR; + return (PAM_SERVICE_ERR); } msgs[num_msgs].msg_style = PAM_TEXT_INFO; msg_ptrs[num_msgs] = &msgs[num_msgs]; @@ -195,25 +195,26 @@ do_challenge(pam_handle_t *pamh, struct rad_handle *radh, const char *user) msgs[num_msgs-1].msg_style = PAM_PROMPT_ECHO_ON; if ((retval = pam_get_item(pamh, PAM_CONV, &item)) != PAM_SUCCESS) { syslog(LOG_CRIT, "do_challenge: cannot get PAM_CONV"); - return retval; + return (retval); } conv = (const struct pam_conv *)item; if ((retval = conv->conv(num_msgs, msg_ptrs, &resp, conv->appdata_ptr)) != PAM_SUCCESS) - return retval; + return (retval); if (build_access_request(radh, user, resp[num_msgs-1].resp, state, statelen) == -1) - return PAM_SERVICE_ERR; + return (PAM_SERVICE_ERR); memset(resp[num_msgs-1].resp, 0, strlen(resp[num_msgs-1].resp)); free(resp[num_msgs-1].resp); free(resp); while (num_msgs > 0) free(msgs[--num_msgs].msg); - return PAM_SUCCESS; + return (PAM_SUCCESS); } PAM_EXTERN int -pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, int argc, const char **argv) +pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, + int argc, const char *argv[]) { struct options options; struct rad_handle *radh; @@ -233,20 +234,20 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, int argc, const char retval = pam_get_user(pamh, &user, NULL); if (retval != PAM_SUCCESS) - PAM_RETURN(retval); + return (retval); PAM_LOG("Got user: %s", user); retval = pam_get_authtok(pamh, PAM_AUTHTOK, &pass, PASSWORD_PROMPT); if (retval != PAM_SUCCESS) - PAM_RETURN(retval); + return (retval); PAM_LOG("Got password"); radh = rad_open(); if (radh == NULL) { syslog(LOG_CRIT, "rad_open failed"); - PAM_RETURN(PAM_SERVICE_ERR); + return (PAM_SERVICE_ERR); } PAM_LOG("Radius opened"); @@ -254,14 +255,14 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, int argc, const char if (rad_config(radh, conf_file) == -1) { syslog(LOG_ALERT, "rad_config: %s", rad_strerror(radh)); rad_close(radh); - PAM_RETURN(PAM_SERVICE_ERR); + return (PAM_SERVICE_ERR); } PAM_LOG("Radius config file read"); if (build_access_request(radh, user, pass, NULL, 0) == -1) { rad_close(radh); - PAM_RETURN(PAM_SERVICE_ERR); + return (PAM_SERVICE_ERR); } PAM_LOG("Radius build access done"); @@ -273,7 +274,7 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, int argc, const char e = do_accept(pamh, radh); rad_close(radh); if (e == -1) - PAM_RETURN(PAM_SERVICE_ERR); + return (PAM_SERVICE_ERR); if (template_user != NULL) { PAM_LOG("Trying template user: %s", @@ -288,7 +289,7 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, int argc, const char retval = pam_get_item(pamh, PAM_USER, (const void **)&tmpuser); if (retval != PAM_SUCCESS) - PAM_RETURN(retval); + return (retval); if (getpwnam(tmpuser) == NULL) { pam_set_item(pamh, PAM_USER, template_user); @@ -296,18 +297,18 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, int argc, const char } } - PAM_RETURN(PAM_SUCCESS); + return (PAM_SUCCESS); case RAD_ACCESS_REJECT: rad_close(radh); PAM_VERBOSE_ERROR("Radius rejection"); - PAM_RETURN(PAM_AUTH_ERR); + return (PAM_AUTH_ERR); case RAD_ACCESS_CHALLENGE: retval = do_challenge(pamh, radh, user); if (retval != PAM_SUCCESS) { rad_close(radh); - PAM_RETURN(retval); + return (retval); } break; @@ -316,76 +317,24 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, int argc, const char rad_strerror(radh)); rad_close(radh); PAM_VERBOSE_ERROR("Radius failure"); - PAM_RETURN(PAM_AUTHINFO_UNAVAIL); + return (PAM_AUTHINFO_UNAVAIL); default: syslog(LOG_CRIT, "rad_send_request: unexpected return value"); rad_close(radh); PAM_VERBOSE_ERROR("Radius error"); - PAM_RETURN(PAM_SERVICE_ERR); + return (PAM_SERVICE_ERR); } } } PAM_EXTERN int -pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) +pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused, + int argc __unused, const char *argv[] __unused) { - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_SUCCESS); -} - -PAM_EXTERN int -pam_sm_acct_mgmt(pam_handle_t *pamh __unused, int flags __unused, int argc ,const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); -} - -PAM_EXTERN int -pam_sm_chauthtok(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); -} - -PAM_EXTERN int -pam_sm_open_session(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); -} - -PAM_EXTERN int -pam_sm_close_session(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - PAM_RETURN(PAM_IGNORE); + return (PAM_SUCCESS); } PAM_MODULE_ENTRY("pam_radius"); diff --git a/lib/libpam/modules/pam_rootok/pam_rootok.c b/lib/libpam/modules/pam_rootok/pam_rootok.c index 1134836..16fab1f 100644 --- a/lib/libpam/modules/pam_rootok/pam_rootok.c +++ b/lib/libpam/modules/pam_rootok/pam_rootok.c @@ -43,90 +43,31 @@ __FBSDID("$FreeBSD$"); #include #define PAM_SM_AUTH -#define PAM_SM_ACCOUNT -#define PAM_SM_SESSION -#define PAM_SM_PASSWORD #include #include #include PAM_EXTERN int -pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, int argc, const char **argv) +pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, + int argc __unused, const char *argv[] __unused) { - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); if (getuid() == 0) - PAM_RETURN(PAM_SUCCESS); + return (PAM_SUCCESS); PAM_VERBOSE_ERROR("Refused; not superuser"); PAM_LOG("User is not superuser"); - PAM_RETURN(PAM_AUTH_ERR); -} - -PAM_EXTERN int -pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_SUCCESS); -} - -PAM_EXTERN int -pam_sm_acct_mgmt(pam_handle_t *pamh __unused, int flags __unused, int argc ,const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); + return (PAM_AUTH_ERR); } PAM_EXTERN int -pam_sm_chauthtok(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) +pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused, + int argc __unused, const char *argv[] __unused) { - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); -} - -PAM_EXTERN int -pam_sm_open_session(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); -} - -PAM_EXTERN int -pam_sm_close_session(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - PAM_RETURN(PAM_IGNORE); + return (PAM_SUCCESS); } PAM_MODULE_ENTRY("pam_rootok"); diff --git a/lib/libpam/modules/pam_securetty/pam_securetty.c b/lib/libpam/modules/pam_securetty/pam_securetty.c index 93db9c1..5dd7c90 100644 --- a/lib/libpam/modules/pam_securetty/pam_securetty.c +++ b/lib/libpam/modules/pam_securetty/pam_securetty.c @@ -43,10 +43,7 @@ __FBSDID("$FreeBSD$"); #include #include -#define PAM_SM_AUTH #define PAM_SM_ACCOUNT -#define PAM_SM_SESSION -#define PAM_SM_PASSWORD #include #include @@ -54,59 +51,30 @@ __FBSDID("$FreeBSD$"); #define TTY_PREFIX "/dev/" -PAM_EXTERN int -pam_sm_authenticate(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); -} - -PAM_EXTERN -int -pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_SUCCESS); -} - PAM_EXTERN int -pam_sm_acct_mgmt(pam_handle_t *pamh __unused, int flags __unused, int argc ,const char **argv) +pam_sm_acct_mgmt(pam_handle_t *pamh __unused, int flags __unused, + int argc __unused, const char *argv[] __unused) { - struct options options; struct passwd *pwd; struct ttyent *ty; const char *user, *tty; int pam_err; - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - pam_err = pam_get_user(pamh, &user, NULL); if (pam_err != PAM_SUCCESS) - PAM_RETURN(pam_err); + return (pam_err); if (user == NULL || (pwd = getpwnam(user)) == NULL) - PAM_RETURN(PAM_SERVICE_ERR); + return (PAM_SERVICE_ERR); PAM_LOG("Got user: %s", user); /* If the user is not root, secure ttys do not apply */ if (pwd->pw_uid != 0) - PAM_RETURN(PAM_SUCCESS); + return (PAM_SUCCESS); pam_err = pam_get_item(pamh, PAM_TTY, (const void **)&tty); if (pam_err != PAM_SUCCESS) - PAM_RETURN(pam_err); + return (pam_err); PAM_LOG("Got TTY: %s", tty); @@ -118,46 +86,10 @@ pam_sm_acct_mgmt(pam_handle_t *pamh __unused, int flags __unused, int argc ,cons if (tty != NULL && (ty = getttynam(tty)) != NULL && (ty->ty_status & TTY_SECURE) != 0) - PAM_RETURN(PAM_SUCCESS); - - PAM_VERBOSE_ERROR("Not on secure TTY"); - PAM_RETURN(PAM_AUTH_ERR); -} - -PAM_EXTERN int -pam_sm_chauthtok(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); -} - -PAM_EXTERN int -pam_sm_open_session(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); + return (PAM_SUCCESS); - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); -} - -PAM_EXTERN int -pam_sm_close_session(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); + PAM_VERBOSE_ERROR("Not on secure TTY"); + return (PAM_AUTH_ERR); } PAM_MODULE_ENTRY("pam_securetty"); diff --git a/lib/libpam/modules/pam_self/pam_self.c b/lib/libpam/modules/pam_self/pam_self.c index e3252bf..63df46c 100644 --- a/lib/libpam/modules/pam_self/pam_self.c +++ b/lib/libpam/modules/pam_self/pam_self.c @@ -44,112 +44,46 @@ __FBSDID("$FreeBSD$"); #include #define PAM_SM_AUTH -#define PAM_SM_ACCOUNT -#define PAM_SM_SESSION -#define PAM_SM_PASSWORD #include #include #include -enum { - PAM_OPT_ALLOW_ROOT = PAM_OPT_STD_MAX, -}; - -static struct opttab other_options[] = { - { "allow_root", PAM_OPT_ALLOW_ROOT }, - { NULL, 0 } -}; +#define OPT_ALLOW_ROOT "allow_root" PAM_EXTERN int -pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, int argc, const char **argv) +pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, + int argc __unused, const char *argv[] __unused) { - struct options options; struct passwd *pwd; const char *luser; int pam_err; uid_t uid; - pam_std_option(&options, other_options, argc, argv); - - PAM_LOG("Options processed"); - pam_err = pam_get_user(pamh, &luser, NULL); if (pam_err != PAM_SUCCESS) - PAM_RETURN(pam_err); + return (pam_err); if (luser == NULL || (pwd = getpwnam(luser)) == NULL) - PAM_RETURN(PAM_AUTH_ERR); + return (PAM_AUTH_ERR); uid = getuid(); - if (uid == 0 && !pam_test_option(&options, PAM_OPT_ALLOW_ROOT, NULL)) - PAM_RETURN(PAM_AUTH_ERR); - - if (uid == (uid_t)pwd->pw_uid) - PAM_RETURN(PAM_SUCCESS); - - PAM_VERBOSE_ERROR("Refused; source and target users differ"); - - PAM_RETURN(PAM_AUTH_ERR); -} - -PAM_EXTERN int -pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_SUCCESS); -} - -PAM_EXTERN int -pam_sm_acct_mgmt(pam_handle_t *pamh __unused, int flags __unused, int argc ,const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); + if (uid == 0 && !openpam_get_option(pamh, OPT_ALLOW_ROOT)) + return (PAM_AUTH_ERR); - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); -} - -PAM_EXTERN int -pam_sm_chauthtok(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); -} - -PAM_EXTERN int -pam_sm_open_session(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); + if (uid == (uid_t)pwd->pw_uid) + return (PAM_SUCCESS); - PAM_LOG("Options processed"); + PAM_VERBOSE_ERROR("Refused; source and target users differ"); - PAM_RETURN(PAM_IGNORE); + return (PAM_AUTH_ERR); } PAM_EXTERN int -pam_sm_close_session(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) +pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused, + int argc __unused, const char *argv[] __unused) { - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - PAM_RETURN(PAM_IGNORE); + return (PAM_SUCCESS); } PAM_MODULE_ENTRY("pam_self"); diff --git a/lib/libpam/modules/pam_ssh/pam_ssh.c b/lib/libpam/modules/pam_ssh/pam_ssh.c index 929ff4f..36c86dd 100644 --- a/lib/libpam/modules/pam_ssh/pam_ssh.c +++ b/lib/libpam/modules/pam_ssh/pam_ssh.c @@ -52,13 +52,10 @@ __FBSDID("$FreeBSD$"); #include #define PAM_SM_AUTH -#define PAM_SM_ACCOUNT #define PAM_SM_SESSION -#define PAM_SM_PASSWORD #include #include -#include #include #include @@ -119,8 +116,8 @@ auth_via_key(pam_handle_t *pamh, const char *file, const char *dir, /* locate the user's private key file */ if (!asprintf(&path, "%s/%s", dir, file)) { - openpam_log(PAM_LOG_ERROR, "%s: %m", MODULE_NAME); - return PAM_SERVICE_ERR; + openpam_log(PAM_LOG_ERROR, "%m"); + return (PAM_SERVICE_ERR); } /* Try to decrypt the private key with the passphrase provided. If @@ -128,7 +125,7 @@ auth_via_key(pam_handle_t *pamh, const char *file, const char *dir, comment = NULL; if ((retval = openpam_borrow_cred(pamh, user)) != PAM_SUCCESS) - return retval; + return (retval); key = key_load_private(path, pass, &comment); openpam_restore_cred(pamh); free(path); @@ -136,38 +133,38 @@ auth_via_key(pam_handle_t *pamh, const char *file, const char *dir, comment = strdup(file); if (!key) { free(comment); - return PAM_AUTH_ERR; + return (PAM_AUTH_ERR); } /* save the key and comment to pass to ssh-agent in the session phase */ if (!asprintf(&data_name, "ssh_private_key_%d", key_idx)) { - openpam_log(PAM_LOG_ERROR, "%s: %m", MODULE_NAME); + openpam_log(PAM_LOG_ERROR, "%m"); free(comment); - return PAM_SERVICE_ERR; + return (PAM_SERVICE_ERR); } retval = pam_set_data(pamh, data_name, key, key_cleanup); free(data_name); if (retval != PAM_SUCCESS) { key_free(key); free(comment); - return retval; + return (retval); } if (!asprintf(&data_name, "ssh_key_comment_%d", key_idx)) { - openpam_log(PAM_LOG_ERROR, "%s: %m", MODULE_NAME); + openpam_log(PAM_LOG_ERROR, "%m"); free(comment); - return PAM_SERVICE_ERR; + return (PAM_SERVICE_ERR); } retval = pam_set_data(pamh, data_name, comment, ssh_cleanup); free(data_name); if (retval != PAM_SUCCESS) { free(comment); - return retval; + return (retval); } ++key_idx; - return PAM_SUCCESS; + return (PAM_SUCCESS); } @@ -202,7 +199,7 @@ add_keys(pam_handle_t *pamh) saved = environ; if ((environ = pam_getenvlist(pamh)) == NULL) { environ = saved; - openpam_log(PAM_LOG_ERROR, "%s: %m", MODULE_NAME); + openpam_log(PAM_LOG_ERROR, "%m"); return (PAM_BUF_ERR); } ac = ssh_get_authentication_connection(); @@ -212,8 +209,8 @@ add_keys(pam_handle_t *pamh) environ = saved; } if (!ac) { - openpam_log(PAM_LOG_ERROR, "%s: %s: %m", MODULE_NAME, socket); - return PAM_SESSION_ERR; + openpam_log(PAM_LOG_ERROR, "%m"); + return (PAM_SESSION_ERR); } /* hand off each private key to the agent */ @@ -221,18 +218,18 @@ add_keys(pam_handle_t *pamh) final = 0; for (key_idx = 0; ; key_idx++) { if (!asprintf(&data_name, "ssh_private_key_%d", key_idx)) { - openpam_log(PAM_LOG_ERROR, "%s: %m", MODULE_NAME); + openpam_log(PAM_LOG_ERROR, "%m"); ssh_close_authentication_connection(ac); - return PAM_SERVICE_ERR; + return (PAM_SERVICE_ERR); } retval = pam_get_data(pamh, data_name, (const void **)&key); free(data_name); if (retval != PAM_SUCCESS) break; if (!asprintf(&data_name, "ssh_key_comment_%d", key_idx)) { - openpam_log(PAM_LOG_ERROR, "%s: %m", MODULE_NAME); + openpam_log(PAM_LOG_ERROR, "%m"); ssh_close_authentication_connection(ac); - return PAM_SERVICE_ERR; + return (PAM_SERVICE_ERR); } retval = pam_get_data(pamh, data_name, (const void **)&comment); @@ -245,19 +242,19 @@ add_keys(pam_handle_t *pamh) } ssh_close_authentication_connection(ac); - return final ? PAM_SUCCESS : PAM_SESSION_ERR; + return (final ? PAM_SUCCESS : PAM_SESSION_ERR); } PAM_EXTERN int pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, - int argc, const char **argv) + int argc __unused, const char *argv[] __unused) { int authenticated; /* user authenticated? */ char *dotdir; /* .ssh dir name */ char *file; /* current key file */ - char *keyfiles; /* list of key files to add */ - int options; /* options for pam_get_pass() */ + const char *kfspec; /* list of key files to add */ + char *keyfiles; const char *pass; /* passphrase */ const struct passwd *pwent; /* user's passwd entry */ struct passwd *pwent_keep; /* our own copy */ @@ -265,28 +262,27 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, const char *user; /* username */ keyfiles = NULL; - options = 0; - for (; argc; argc--, argv++) - if (strncmp(*argv, OPT_KEYFILES "=", sizeof OPT_KEYFILES) - == 0) { - if (!(keyfiles = strchr(*argv, '=') + 1)) - return PAM_AUTH_ERR; - } else if (strcmp(*argv, OPT_TRY_FIRST_PASS) == 0) - options |= PAM_OPT_TRY_FIRST_PASS; - else if (strcmp(*argv, OPT_USE_FIRST_PASS) == 0) - options |= PAM_OPT_USE_FIRST_PASS; - + if ((kfspec = openpam_get_option(pamh, OPT_KEYFILES)) != NULL) { + if ((kfspec = strchr(kfspec, '=')) == NULL) { + openpam_log(PAM_LOG_ERROR, "invalid keyfile list"); + return (PAM_SERVICE_ERR); + } + ++kfspec; + } else { + kfspec = DEF_KEYFILES; + } if ((retval = pam_get_user(pamh, &user, NULL)) != PAM_SUCCESS) - return retval; - if (!((pwent = getpwnam(user)) && pwent->pw_dir)) - return PAM_AUTH_ERR; + return (retval); + if (user == NULL || (pwent = getpwnam(user)) == NULL || + pwent->pw_dir == NULL || pwent->pw_dir[0] == '\0') + return (PAM_AUTH_ERR); /* pass prompt message to application and receive passphrase */ retval = pam_get_authtok(pamh, PAM_AUTHTOK, &pass, NEED_PASSPHRASE); if (retval != PAM_SUCCESS) - return retval; + return (retval); OpenSSL_add_all_algorithms(); /* required for DSA */ @@ -295,50 +291,51 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, session phase */ if (!asprintf(&dotdir, "%s/%s", pwent->pw_dir, SSH_CLIENT_DIR)) { - openpam_log(PAM_LOG_ERROR, "%s: %m", MODULE_NAME); - return PAM_SERVICE_ERR; + openpam_log(PAM_LOG_ERROR, "%m"); + return (PAM_SERVICE_ERR); } authenticated = 0; - keyfiles = strdup(keyfiles ? keyfiles : DEF_KEYFILES); + keyfiles = strdup(kfspec); for (file = strtok(keyfiles, SEP_KEYFILES); file; file = strtok(NULL, SEP_KEYFILES)) if (auth_via_key(pamh, file, dotdir, pwent, pass) == PAM_SUCCESS) authenticated++; - free(dotdir); free(keyfiles); + free(dotdir); if (!authenticated) - return PAM_AUTH_ERR; + return (PAM_AUTH_ERR); /* copy the passwd entry (in case successive calls are made) and save it for the session phase */ if (!(pwent_keep = malloc(sizeof *pwent))) { openpam_log(PAM_LOG_ERROR, "%m"); - return PAM_SERVICE_ERR; + return (PAM_SERVICE_ERR); } (void) memcpy(pwent_keep, pwent, sizeof *pwent_keep); if ((retval = pam_set_data(pamh, "ssh_passwd_entry", pwent_keep, ssh_cleanup)) != PAM_SUCCESS) { free(pwent_keep); - return retval; + return (retval); } - return PAM_SUCCESS; + return (PAM_SUCCESS); } PAM_EXTERN int pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused, - int argc __unused, const char **argv __unused) + int argc __unused, const char *argv[] __unused) { - return PAM_SUCCESS; + + return (PAM_SUCCESS); } PAM_EXTERN int pam_sm_open_session(pam_handle_t *pamh, int flags __unused, - int argc __unused, const char **argv __unused) + int argc __unused, const char *argv[] __unused) { char *agent_socket; /* agent socket */ char *env_end; /* end of env */ @@ -359,7 +356,7 @@ pam_sm_open_session(pam_handle_t *pamh, int flags __unused, /* dump output of ssh-agent in ~/.ssh */ if ((retval = pam_get_data(pamh, "ssh_passwd_entry", (const void **)&pwent)) != PAM_SUCCESS) - return retval; + return (retval); /* * Use reference counts to limit agents to one per user per host. @@ -379,8 +376,8 @@ pam_sm_open_session(pam_handle_t *pamh, int flags __unused, (void) gethostname(hname, sizeof hname); if (asprintf(&per_agent, "%s/.ssh/agent-%s", pwent->pw_dir, hname) == -1) { - openpam_log(PAM_LOG_ERROR, "%s: %m", MODULE_NAME); - return PAM_SERVICE_ERR; + openpam_log(PAM_LOG_ERROR, "%m"); + return (PAM_SERVICE_ERR); } /* save the per-agent filename in case we want to delete it on @@ -389,14 +386,14 @@ pam_sm_open_session(pam_handle_t *pamh, int flags __unused, if ((retval = pam_set_data(pamh, "ssh_agent_env_agent", per_agent, ssh_cleanup)) != PAM_SUCCESS) { free(per_agent); - return retval; + return (retval); } /* take on the user's privileges for writing files and starting the agent */ if ((retval = openpam_borrow_cred(pamh, pwent)) != PAM_SUCCESS) - return retval; + return (retval); /* Try to create the per-agent file or open it for reading if it exists. If we can't do either, we won't try to link a @@ -416,11 +413,10 @@ pam_sm_open_session(pam_handle_t *pamh, int flags __unused, env_read = popen(SSH_AGENT, "r"); openpam_restore_cred(pamh); if (!env_read) { - openpam_log(PAM_LOG_ERROR, "%s: %s: %m", MODULE_NAME, - SSH_AGENT); + openpam_log(PAM_LOG_ERROR, "%s: %m", SSH_AGENT); if (env_write >= 0) (void) close(env_write); - return PAM_SESSION_ERR; + return (PAM_SESSION_ERR); } } @@ -451,7 +447,7 @@ pam_sm_open_session(pam_handle_t *pamh, int flags __unused, (void) close(env_write); if (agent_socket) free(agent_socket); - return PAM_SERVICE_ERR; + return (PAM_SERVICE_ERR); } *env_value++ = '\0'; @@ -463,7 +459,7 @@ pam_sm_open_session(pam_handle_t *pamh, int flags __unused, if (strcmp(&env_string[strlen(env_string) - strlen(ENV_SOCKET_SUFFIX)], ENV_SOCKET_SUFFIX) == 0 && !(agent_socket = strdup(env_value))) { - openpam_log(PAM_LOG_ERROR, "%s: %m", MODULE_NAME); + openpam_log(PAM_LOG_ERROR, "%m"); if (start_agent) (void) pclose(env_read); else @@ -472,7 +468,7 @@ pam_sm_open_session(pam_handle_t *pamh, int flags __unused, (void) close(env_write); if (agent_socket) free(agent_socket); - return PAM_SERVICE_ERR; + return (PAM_SERVICE_ERR); } else if (strcmp(&env_string[strlen(env_string) - strlen(ENV_PID_SUFFIX)], ENV_PID_SUFFIX) == 0 && ((agent_pid = strdup(env_value)) == NULL || @@ -488,7 +484,7 @@ pam_sm_open_session(pam_handle_t *pamh, int flags __unused, free(agent_socket); if (agent_pid) free(agent_pid); - return retval; + return (retval); } } @@ -498,56 +494,54 @@ pam_sm_open_session(pam_handle_t *pamh, int flags __unused, if (start_agent) { switch (retval = pclose(env_read)) { case -1: - openpam_log(PAM_LOG_ERROR, "%s: %s: %m", MODULE_NAME, - SSH_AGENT); + openpam_log(PAM_LOG_ERROR, "%s: %m", SSH_AGENT); if (agent_socket) free(agent_socket); - return PAM_SESSION_ERR; + return (PAM_SESSION_ERR); case 0: break; case 127: - openpam_log(PAM_LOG_ERROR, "%s: cannot execute %s", - MODULE_NAME, SSH_AGENT); + openpam_log(PAM_LOG_ERROR, "cannot execute %s", + SSH_AGENT); if (agent_socket) free(agent_socket); - return PAM_SESSION_ERR; + return (PAM_SESSION_ERR); default: - openpam_log(PAM_LOG_ERROR, "%s: %s exited %s %d", - MODULE_NAME, + openpam_log(PAM_LOG_ERROR, "%s exited %s %d", SSH_AGENT, WIFSIGNALED(retval) ? "on signal" : "with status", WIFSIGNALED(retval) ? WTERMSIG(retval) : WEXITSTATUS(retval)); if (agent_socket) free(agent_socket); - return PAM_SESSION_ERR; + return (PAM_SESSION_ERR); } } else (void) fclose(env_read); if (!agent_socket) - return PAM_SESSION_ERR; + return (PAM_SESSION_ERR); if (start_agent && (retval = add_keys(pamh)) != PAM_SUCCESS) - return retval; + return (retval); free(agent_socket); /* if we couldn't access the per-agent file, don't link a per-session filename to it */ if (no_link) - return PAM_SUCCESS; + return (PAM_SUCCESS); /* the per-session file contains the display name or tty name as well as the hostname */ if ((retval = pam_get_item(pamh, PAM_TTY, (const void **)&tty)) != PAM_SUCCESS) - return retval; + return (retval); if (asprintf(&per_session, "%s/.ssh/agent-%s-%s", pwent->pw_dir, hname, tty) == -1) { - openpam_log(PAM_LOG_ERROR, "%s: %m", MODULE_NAME); - return PAM_SERVICE_ERR; + openpam_log(PAM_LOG_ERROR, "%m"); + return (PAM_SERVICE_ERR); } /* save the per-session filename so we can delete it on session @@ -556,19 +550,19 @@ pam_sm_open_session(pam_handle_t *pamh, int flags __unused, if ((retval = pam_set_data(pamh, "ssh_agent_env_session", per_session, ssh_cleanup)) != PAM_SUCCESS) { free(per_session); - return retval; + return (retval); } (void) unlink(per_session); /* remove cruft */ (void) link(per_agent, per_session); - return PAM_SUCCESS; + return (PAM_SUCCESS); } PAM_EXTERN int pam_sm_close_session(pam_handle_t *pamh, int flags __unused, - int argc __unused, const char **argv __unused) + int argc __unused, const char *argv[] __unused) { const char *env_file; /* ssh-agent environment */ pid_t pid; /* ssh-agent process id */ @@ -588,7 +582,7 @@ pam_sm_close_session(pam_handle_t *pamh, int flags __unused, (const void **)&env_file)) == PAM_SUCCESS && env_file && stat(env_file, &sb) == 0) { if (sb.st_nlink > 1) - return PAM_SUCCESS; + return (PAM_SUCCESS); (void) unlink(env_file); } @@ -596,35 +590,20 @@ pam_sm_close_session(pam_handle_t *pamh, int flags __unused, if ((retval = pam_get_data(pamh, "ssh_agent_pid", (const void **)&ssh_agent_pid)) != PAM_SUCCESS) - return retval; + return (retval); /* Kill the agent. SSH's ssh-agent does not have a -k option, so just call kill(). */ pid = atoi(ssh_agent_pid); if (pid <= 0) - return PAM_SESSION_ERR; + return (PAM_SESSION_ERR); if (kill(pid, SIGTERM) != 0) { - openpam_log(PAM_LOG_ERROR, "%s: %s: %m", MODULE_NAME, - ssh_agent_pid); - return PAM_SESSION_ERR; + openpam_log(PAM_LOG_ERROR, "%s: %m", ssh_agent_pid); + return (PAM_SESSION_ERR); } - return PAM_SUCCESS; -} - -PAM_EXTERN int -pam_sm_acct_mgmt(pam_handle_t *pamh __unused, int flags __unused, - int argc __unused, const char **argv __unused) -{ - return (PAM_IGNORE); -} - -PAM_EXTERN int -pam_sm_chauthtok(pam_handle_t *pamh __unused, int flags __unused, - int argc __unused, const char **argv __unused) -{ - return (PAM_IGNORE); + return (PAM_SUCCESS); } PAM_MODULE_ENTRY(MODULE_NAME); diff --git a/lib/libpam/modules/pam_tacplus/pam_tacplus.c b/lib/libpam/modules/pam_tacplus/pam_tacplus.c index 9dfe937..19e3185 100644 --- a/lib/libpam/modules/pam_tacplus/pam_tacplus.c +++ b/lib/libpam/modules/pam_tacplus/pam_tacplus.c @@ -47,15 +47,15 @@ __FBSDID("$FreeBSD$"); #include #define PAM_SM_AUTH -#define PAM_SM_ACCOUNT -#define PAM_SM_SESSION -#define PAM_SM_PASSWORD #include #include #include -enum { PAM_OPT_CONF=PAM_OPT_STD_MAX, PAM_OPT_TEMPLATE_USER }; +enum { + PAM_OPT_CONF = PAM_OPT_STD_MAX, + PAM_OPT_TEMPLATE_USER +}; static struct opttab other_options[] = { { "conf", PAM_OPT_CONF }, @@ -114,8 +114,8 @@ set_msg(struct tac_handle *tach, const char *msg) } PAM_EXTERN int -pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, int argc, - const char **argv) +pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, + int argc, const char *argv[]) { struct options options; int retval; @@ -135,40 +135,40 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, int argc, tach = tac_open(); if (tach == NULL) { syslog(LOG_CRIT, "tac_open failed"); - PAM_RETURN(PAM_SERVICE_ERR); + return (PAM_SERVICE_ERR); } if (tac_config(tach, conf_file) == -1) { syslog(LOG_ALERT, "tac_config: %s", tac_strerror(tach)); tac_close(tach); - PAM_RETURN(PAM_SERVICE_ERR); + return (PAM_SERVICE_ERR); } if (tac_create_authen(tach, TAC_AUTHEN_LOGIN, TAC_AUTHEN_TYPE_ASCII, TAC_AUTHEN_SVC_LOGIN) == -1) { syslog(LOG_CRIT, "tac_create_authen: %s", tac_strerror(tach)); tac_close(tach); - PAM_RETURN(PAM_SERVICE_ERR); + return (PAM_SERVICE_ERR); } PAM_LOG("Done tac_open() ... tac_close()"); retval = do_item(pamh, tach, PAM_USER, tac_set_user, "tac_set_user"); if (retval != PAM_SUCCESS) - PAM_RETURN(retval); + return (retval); PAM_LOG("Done user"); retval = do_item(pamh, tach, PAM_TTY, tac_set_port, "tac_set_port"); if (retval != PAM_SUCCESS) - PAM_RETURN(retval); + return (retval); PAM_LOG("Done tty"); retval = do_item(pamh, tach, PAM_RHOST, tac_set_rem_addr, "tac_set_rem_addr"); if (retval != PAM_SUCCESS) - PAM_RETURN(retval); + return (retval); - for ( ; ; ) { + for (;;) { char *srvr_msg; size_t msg_len; const char *user_msg; @@ -181,7 +181,7 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, int argc, syslog(LOG_CRIT, "tac_send_authen: %s", tac_strerror(tach)); tac_close(tach); - PAM_RETURN(PAM_AUTHINFO_UNAVAIL); + return (PAM_AUTHINFO_UNAVAIL); } status = TAC_AUTHEN_STATUS(sflags); if (!TAC_AUTHEN_NOECHO(sflags)) @@ -205,7 +205,7 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, int argc, */ retval = pam_get_item(pamh, PAM_USER, &item); if (retval != PAM_SUCCESS) - PAM_RETURN(retval); + return (retval); user = (const char *)item; if (getpwnam(user) == NULL) { pam_set_item(pamh, PAM_USER, @@ -213,17 +213,17 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, int argc, PAM_LOG("Using template user"); } } - PAM_RETURN(PAM_SUCCESS); + return (PAM_SUCCESS); case TAC_AUTHEN_STATUS_FAIL: tac_close(tach); PAM_VERBOSE_ERROR("TACACS+ authentication failed"); - PAM_RETURN(PAM_AUTH_ERR); + return (PAM_AUTH_ERR); case TAC_AUTHEN_STATUS_GETUSER: case TAC_AUTHEN_STATUS_GETPASS: if ((srvr_msg = get_msg(tach)) == NULL) - PAM_RETURN(PAM_SERVICE_ERR); + return (PAM_SERVICE_ERR); if (status == TAC_AUTHEN_STATUS_GETUSER) retval = pam_get_user(pamh, &user_msg, *srvr_msg ? srvr_msg : NULL); @@ -235,30 +235,30 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, int argc, if (retval != PAM_SUCCESS) { /* XXX - send a TACACS+ abort packet */ tac_close(tach); - PAM_RETURN(retval); + return (retval); } if (set_msg(tach, user_msg) == -1) - PAM_RETURN(PAM_SERVICE_ERR); + return (PAM_SERVICE_ERR); break; case TAC_AUTHEN_STATUS_GETDATA: if ((srvr_msg = get_msg(tach)) == NULL) - PAM_RETURN(PAM_SERVICE_ERR); + return (PAM_SERVICE_ERR); retval = pam_prompt(pamh, pam_test_option(&options, PAM_OPT_ECHO_PASS, NULL) - ? PAM_PROMPT_ECHO_ON : PAM_PROMPT_ECHO_OFF, + ? PAM_PROMPT_ECHO_ON : PAM_PROMPT_ECHO_OFF, &data_msg, "%s", *srvr_msg ? srvr_msg : "Data:"); free(srvr_msg); if (retval != PAM_SUCCESS) { /* XXX - send a TACACS+ abort packet */ tac_close(tach); - PAM_RETURN(retval); + return (retval); } retval = set_msg(tach, data_msg); memset(data_msg, 0, strlen(data_msg)); free(data_msg); if (retval == -1) - PAM_RETURN(PAM_SERVICE_ERR); + return (PAM_SERVICE_ERR); break; case TAC_AUTHEN_STATUS_ERROR: @@ -272,7 +272,7 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, int argc, syslog(LOG_CRIT, "tac_send_authen: server detected error"); tac_close(tach); - PAM_RETURN(PAM_AUTHINFO_UNAVAIL); + return (PAM_AUTHINFO_UNAVAIL); break; case TAC_AUTHEN_STATUS_RESTART: @@ -281,69 +281,17 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, int argc, syslog(LOG_CRIT, "tac_send_authen: unexpected status %#x", status); tac_close(tach); - PAM_RETURN(PAM_AUTHINFO_UNAVAIL); + return (PAM_AUTHINFO_UNAVAIL); } } } PAM_EXTERN int -pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) +pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused, + int argc __unused, const char *argv[] __unused) { - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); -} - -PAM_EXTERN int -pam_sm_acct_mgmt(pam_handle_t *pamh __unused, int flags __unused, int argc ,const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); -} - -PAM_EXTERN int -pam_sm_chauthtok(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); -} - -PAM_EXTERN int -pam_sm_open_session(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); -} - -PAM_EXTERN int -pam_sm_close_session(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - PAM_RETURN(PAM_IGNORE); + return (PAM_IGNORE); } PAM_MODULE_ENTRY("pam_tacplus"); diff --git a/lib/libpam/modules/pam_unix/pam_unix.c b/lib/libpam/modules/pam_unix/pam_unix.c index ed74b90..29f22d9 100644 --- a/lib/libpam/modules/pam_unix/pam_unix.c +++ b/lib/libpam/modules/pam_unix/pam_unix.c @@ -69,7 +69,6 @@ __FBSDID("$FreeBSD$"); #define PAM_SM_AUTH #define PAM_SM_ACCOUNT -#define PAM_SM_SESSION #define PAM_SM_PASSWORD #include @@ -115,7 +114,8 @@ static int yp_passwd(const char *user, const char *pass); * authentication management */ PAM_EXTERN int -pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, int argc, const char **argv) +pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, + int argc, const char *argv[]) { login_cap_t *lc; struct options options; @@ -132,7 +132,7 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, int argc, const char } else { retval = pam_get_user(pamh, &user, NULL); if (retval != PAM_SUCCESS) - PAM_RETURN(retval); + return (retval); pwd = getpwnam(user); } @@ -144,7 +144,7 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, int argc, const char if (realpw[0] == '\0') { if (!(flags & PAM_DISALLOW_NULL_AUTHTOK) && pam_test_option(&options, PAM_OPT_NULLOK, NULL)) - PAM_RETURN(PAM_SUCCESS); + return (PAM_SUCCESS); realpw = "*"; } lc = login_getpwclass(pwd); @@ -157,32 +157,29 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, int argc, const char retval = pam_get_authtok(pamh, PAM_AUTHTOK, &pass, prompt); login_close(lc); if (retval != PAM_SUCCESS) - PAM_RETURN(retval); + return (retval); PAM_LOG("Got password"); if (strcmp(crypt(pass, realpw), realpw) == 0) - PAM_RETURN(PAM_SUCCESS); + return (PAM_SUCCESS); PAM_VERBOSE_ERROR("UNIX authentication refused"); - PAM_RETURN(PAM_AUTH_ERR); + return (PAM_AUTH_ERR); } PAM_EXTERN int -pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) +pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused, + int argc __unused, const char *argv[] __unused) { - struct options options; - - pam_std_option(&options, other_options, argc, argv); - - PAM_LOG("Options processed"); - PAM_RETURN(PAM_SUCCESS); + return (PAM_SUCCESS); } -/* +/* * account management */ PAM_EXTERN int -pam_sm_acct_mgmt(pam_handle_t *pamh, int flags __unused, int argc, const char **argv) +pam_sm_acct_mgmt(pam_handle_t *pamh, int flags __unused, + int argc, const char *argv[]) { struct addrinfo hints, *res; struct options options; @@ -200,25 +197,25 @@ pam_sm_acct_mgmt(pam_handle_t *pamh, int flags __unused, int argc, const char ** retval = pam_get_user(pamh, &user, NULL); if (retval != PAM_SUCCESS) - PAM_RETURN(retval); + return (retval); if (user == NULL || (pwd = getpwnam(user)) == NULL) - PAM_RETURN(PAM_SERVICE_ERR); + return (PAM_SERVICE_ERR); PAM_LOG("Got user: %s", user); retval = pam_get_item(pamh, PAM_RHOST, (const void **)&rhost); if (retval != PAM_SUCCESS) - PAM_RETURN(retval); + return (retval); retval = pam_get_item(pamh, PAM_TTY, (const void **)&tty); if (retval != PAM_SUCCESS) - PAM_RETURN(retval); + return (retval); if (*pwd->pw_passwd == '\0' && (flags & PAM_DISALLOW_NULL_AUTHTOK) != 0) return (PAM_NEW_AUTHTOK_REQD); - + lc = login_getpwclass(pwd); if (lc == NULL) { PAM_LOG("Unable to get login class for user %s", user); @@ -234,13 +231,13 @@ pam_sm_acct_mgmt(pam_handle_t *pamh, int flags __unused, int argc, const char ** * Check pw_expire before pw_change - no point in letting the * user change the password on an expired account. */ - + if (pwd->pw_expire) { warntime = login_getcaptime(lc, "warnexpire", DEFAULT_WARN, DEFAULT_WARN); if (tp.tv_sec >= pwd->pw_expire) { login_close(lc); - PAM_RETURN(PAM_ACCT_EXPIRED); + return (PAM_ACCT_EXPIRED); } else if (pwd->pw_expire - tp.tv_sec < warntime && (flags & PAM_SILENT) == 0) { pam_error(pamh, "Warning: your account expires on %s", @@ -283,53 +280,25 @@ pam_sm_acct_mgmt(pam_handle_t *pamh, int flags __unused, int argc, const char ** /* * Check host / tty / time-of-day restrictions */ - + if (!auth_hostok(lc, rhost, rhostip) || !auth_ttyok(lc, tty) || !auth_timeok(lc, time(NULL))) retval = PAM_AUTH_ERR; - - login_close(lc); - - PAM_RETURN(retval); -} -/* - * session management - * - * logging only - */ -PAM_EXTERN int -pam_sm_open_session(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, other_options, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_SUCCESS); -} - -PAM_EXTERN int -pam_sm_close_session(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, other_options, argc, argv); - - PAM_LOG("Options processed"); + login_close(lc); - PAM_RETURN(PAM_SUCCESS); + return (retval); } -/* +/* * password management * * standard Unix and NIS password changing */ PAM_EXTERN int -pam_sm_chauthtok(pam_handle_t *pamh, int flags, int argc, const char **argv) +pam_sm_chauthtok(pam_handle_t *pamh, int flags, + int argc, const char *argv[]) { struct options options; struct passwd *pwd; @@ -346,7 +315,7 @@ pam_sm_chauthtok(pam_handle_t *pamh, int flags, int argc, const char **argv) else { retval = pam_get_user(pamh, &user, NULL); if (retval != PAM_SUCCESS) - PAM_RETURN(retval); + return (retval); pwd = getpwnam(user); } @@ -364,13 +333,13 @@ pam_sm_chauthtok(pam_handle_t *pamh, int flags, int argc, const char **argv) * XXX check PAM_DISALLOW_NULL_AUTHTOK */ PAM_LOG("Got password"); - PAM_RETURN(PAM_SUCCESS); + return (PAM_SUCCESS); } else { retval = pam_get_authtok(pamh, PAM_OLDAUTHTOK, &pass, NULL); if (retval != PAM_SUCCESS) - PAM_RETURN(retval); + return (retval); PAM_LOG("Got password"); } encrypted = crypt(pass, pwd->pw_passwd); @@ -379,17 +348,17 @@ pam_sm_chauthtok(pam_handle_t *pamh, int flags, int argc, const char **argv) if (strcmp(encrypted, pwd->pw_passwd) != 0) { pam_set_item(pamh, PAM_OLDAUTHTOK, NULL); - PAM_RETURN(PAM_AUTH_ERR); + return (PAM_AUTH_ERR); } - PAM_RETURN(PAM_SUCCESS); + return (PAM_SUCCESS); } else if (flags & PAM_UPDATE_AUTHTOK) { PAM_LOG("UPDATE round; checking user password"); retval = pam_get_authtok(pamh, PAM_OLDAUTHTOK, &pass, NULL); if (retval != PAM_SUCCESS) - PAM_RETURN(retval); + return (retval); PAM_LOG("Got old password"); @@ -403,7 +372,7 @@ pam_sm_chauthtok(pam_handle_t *pamh, int flags, int argc, const char **argv) if (retval != PAM_SUCCESS) { PAM_VERBOSE_ERROR("Unable to get new password"); - PAM_RETURN(PAM_PERM_DENIED); + return (PAM_PERM_DENIED); } PAM_LOG("Got new password: %s", new_pass); @@ -411,7 +380,7 @@ pam_sm_chauthtok(pam_handle_t *pamh, int flags, int argc, const char **argv) #ifdef YP /* If NIS is set in the passwd database, use it */ if ((usrdup = strdup(user)) == NULL) - PAM_RETURN(PAM_BUF_ERR); + return (PAM_BUF_ERR); res = use_yp(usrdup, 0, 0); free(usrdup); if (res == USER_YP_ONLY) { @@ -453,7 +422,7 @@ pam_sm_chauthtok(pam_handle_t *pamh, int flags, int argc, const char **argv) PAM_LOG("Illegal 'flags'"); } - PAM_RETURN(retval); + return (retval); } /* Mostly stolen from passwd(1)'s local_passwd.c - markm */ @@ -606,7 +575,7 @@ yp_passwd(const char *user __unused, const char *pass) * The yppasswd.x file said `unix authentication required', * so I added it. This is the only reason it is in here. * My yppasswdd doesn't use it, but maybe some others out there - * do. --okir + * do. --okir */ clnt->cl_auth = authunix_create_default(); diff --git a/lib/libpam/modules/pam_wheel/pam_wheel.c b/lib/libpam/modules/pam_wheel/pam_wheel.c index f9d9d21..b4137ae 100644 --- a/lib/libpam/modules/pam_wheel/pam_wheel.c +++ b/lib/libpam/modules/pam_wheel/pam_wheel.c @@ -49,16 +49,18 @@ __FBSDID("$FreeBSD$"); #include #define PAM_SM_AUTH -#define PAM_SM_ACCOUNT -#define PAM_SM_SESSION -#define PAM_SM_PASSWORD #include #include #include -enum { PAM_OPT_DENY=PAM_OPT_STD_MAX, PAM_OPT_GROUP, PAM_OPT_TRUST, - PAM_OPT_AUTH_AS_SELF, PAM_OPT_NOROOT_OK }; +enum { + PAM_OPT_DENY = PAM_OPT_STD_MAX, + PAM_OPT_GROUP, + PAM_OPT_TRUST, + PAM_OPT_AUTH_AS_SELF, + PAM_OPT_NOROOT_OK +}; static struct opttab other_options[] = { { "deny", PAM_OPT_DENY }, @@ -80,7 +82,8 @@ in_list(char *const *list, const char *member) } PAM_EXTERN int -pam_sm_authenticate(pam_handle_t * pamh, int flags __unused, int argc, const char **argv) +pam_sm_authenticate(pam_handle_t * pamh, int flags __unused, + int argc, const char *argv[]) { struct options options; struct passwd *pwd; @@ -96,12 +99,12 @@ pam_sm_authenticate(pam_handle_t * pamh, int flags __unused, int argc, const cha retval = pam_get_user(pamh, &targetuser, NULL); if (retval != PAM_SUCCESS) - PAM_RETURN(retval); + return (retval); pwd = getpwnam(targetuser); if (pwd != NULL) tuid = pwd->pw_uid; else - PAM_RETURN(PAM_AUTH_ERR); + return (PAM_AUTH_ERR); PAM_LOG("Got target user: %s uid: %d", targetuser, tuid); @@ -114,21 +117,21 @@ pam_sm_authenticate(pam_handle_t * pamh, int flags __unused, int argc, const cha pwd = getpwnam(user); } if (pwd == NULL) - PAM_RETURN(PAM_AUTH_ERR); + return (PAM_AUTH_ERR); PAM_LOG("Got user: %s", user); PAM_LOG("User's primary uid, gid: %d, %d", pwd->pw_uid, pwd->pw_gid); /* Ignore if already uid 0 */ if (pwd->pw_uid == 0) - PAM_RETURN(PAM_IGNORE); + return (PAM_IGNORE); PAM_LOG("Not superuser"); /* If authenticating as something non-superuser, return OK */ if (pam_test_option(&options, PAM_OPT_NOROOT_OK, NULL)) if (tuid != 0) - PAM_RETURN(PAM_SUCCESS); + return (PAM_SUCCESS); PAM_LOG("Checking group"); @@ -141,10 +144,10 @@ pam_sm_authenticate(pam_handle_t * pamh, int flags __unused, int argc, const cha if (grp == NULL || grp->gr_mem == NULL) { if (pam_test_option(&options, PAM_OPT_DENY, NULL)) - PAM_RETURN(PAM_IGNORE); + return (PAM_IGNORE); else { PAM_VERBOSE_ERROR("Permission denied"); - PAM_RETURN(PAM_AUTH_ERR); + return (PAM_AUTH_ERR); } } @@ -154,79 +157,27 @@ pam_sm_authenticate(pam_handle_t * pamh, int flags __unused, int argc, const cha if (pam_test_option(&options, PAM_OPT_DENY, NULL)) { PAM_VERBOSE_ERROR("Member of group %s; denied", grp->gr_name); - PAM_RETURN(PAM_PERM_DENIED); + return (PAM_PERM_DENIED); } if (pam_test_option(&options, PAM_OPT_TRUST, NULL)) - PAM_RETURN(PAM_SUCCESS); - PAM_RETURN(PAM_IGNORE); + return (PAM_SUCCESS); + return (PAM_IGNORE); } if (pam_test_option(&options, PAM_OPT_DENY, NULL)) - PAM_RETURN(PAM_SUCCESS); + return (PAM_SUCCESS); PAM_VERBOSE_ERROR("Not member of group %s; denied", grp->gr_name); - PAM_RETURN(PAM_PERM_DENIED); -} - -PAM_EXTERN int -pam_sm_setcred(pam_handle_t * pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, other_options, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_SUCCESS); + return (PAM_PERM_DENIED); } PAM_EXTERN int -pam_sm_acct_mgmt(pam_handle_t *pamh __unused, int flags __unused, int argc ,const char **argv) +pam_sm_setcred(pam_handle_t * pamh __unused, int flags __unused, + int argc __unused, const char *argv[] __unused) { - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); -} - -PAM_EXTERN int -pam_sm_chauthtok(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); -} - -PAM_EXTERN int -pam_sm_open_session(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - - PAM_RETURN(PAM_IGNORE); -} - -PAM_EXTERN int -pam_sm_close_session(pam_handle_t *pamh __unused, int flags __unused, int argc, const char **argv) -{ - struct options options; - - pam_std_option(&options, NULL, argc, argv); - - PAM_LOG("Options processed"); - PAM_RETURN(PAM_IGNORE); + return (PAM_SUCCESS); } PAM_MODULE_ENTRY("pam_wheel"); -- cgit v1.1