From 0ccf6e6afa7eb6f5dc8b8c6689caa8bb190fef0d Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Tue, 29 Dec 2015 14:21:38 -0800
Subject: [PATCH 06/19] /etc/default/login

Add support for /etc/default/login configuration.
Original date:2009-03-31 owner:yippi type:feature
---
 daemon/gdm-session-worker.c | 83 +++++++++++++++++++++++++++++++++++++++++----
 1 file changed, 76 insertions(+), 7 deletions(-)

diff --git a/daemon/gdm-session-worker.c b/daemon/gdm-session-worker.c
index 93c9e82..5fc83d6 100644
--- a/daemon/gdm-session-worker.c
+++ b/daemon/gdm-session-worker.c
@@ -222,6 +222,33 @@ G_DEFINE_TYPE_WITH_CODE (GdmSessionWorker,
                          G_IMPLEMENT_INTERFACE (GDM_DBUS_TYPE_WORKER,
                                                 worker_interface_init))
 
+#if __sun
+#include <deflt.h>
+
+/*
+ * gdm_read_default
+ *
+ * This function is used to support systems that have the /etc/default/login
+ * interface to control programs that affect security.  This is a Solaris
+ * thing, though some users on other systems may find it useful.
+ */
+static gchar *
+gdm_read_default (gchar *key)
+{
+    gchar *retval = NULL;
+
+    if (defopen ("/etc/default/login") == 0) {
+       int flags = defcntl (DC_GETFLAGS, 0);
+
+       TURNOFF (flags, DC_CASE);
+       (void) defcntl (DC_SETFLAGS, flags);  /* ignore case */
+       retval = g_strdup (defread (key));
+       (void) defopen ((char *)NULL);
+    }
+    return retval;
+}
+#endif
+
 #ifdef WITH_CONSOLE_KIT
 static gboolean
 open_ck_session (GdmSessionWorker  *worker)
@@ -1351,6 +1378,28 @@ gdm_session_worker_authorize_user (GdmSessionWorker *worker,
         g_debug ("GdmSessionWorker: determining if authenticated user (password required:%d) is authorized to session",
                  password_is_required);
 
+#ifdef __sun
+        char *consoleonly = gdm_read_default ("CONSOLE=");
+
+        if ((consoleonly != NULL) &&
+            (strcmp (consoleonly, "/dev/console") == 0)) {
+
+                if (worker->priv->hostname != NULL &&
+                    worker->priv->hostname[0] != '\0') {
+                        struct passwd *passwd_entry;
+
+                        passwd_entry = getpwnam (worker->priv->username);
+                        if (passwd_entry->pw_uid == 0) {
+                                error_code = PAM_PERM_DENIED;
+
+                                g_debug ("The system administrator is not allowed to log in remotely");
+                                g_set_error (error, GDM_SESSION_WORKER_ERROR, GDM_SESSION_WORKER_ERROR_AUTHORIZING, "%s", pam_strerror (worker->priv->pam_handle, error_code));
+                                goto out;
+                        }
+                }
+        }
+#endif
+
         authentication_flags = 0;
 
         if (password_is_required) {
@@ -1716,6 +1765,7 @@ gdm_session_worker_accredit_user (GdmSessionWorker  *worker,
         gid_t    gid;
         char    *shell;
         char    *home;
+        char    *path_str;
         int      error_code;
 
         ret = FALSE;
@@ -1756,18 +1806,26 @@ gdm_session_worker_accredit_user (GdmSessionWorker  *worker,
                                                                 home,
                                                                 shell);
 
-        /* Let's give the user a default PATH if he doesn't already have one
-         */
-        if (!gdm_session_worker_environment_variable_is_set (worker, "PATH")) {
+        path_str = NULL;
+
+#ifdef __sun
+        if (uid == 0)
+                path_str = gdm_read_default ("SUPATH=");
+
+        if (path_str == NULL)
+                path_str = gdm_read_default ("PATH=");
+#endif
+
+        if (path_str == NULL)  {
                 if (strcmp (BINDIR, "/usr/bin") == 0) {
-                        gdm_session_worker_set_environment_variable (worker, "PATH",
-                                                                     GDM_SESSION_DEFAULT_PATH);
+                        path_str = GDM_SESSION_DEFAULT_PATH;
                 } else {
-                        gdm_session_worker_set_environment_variable (worker, "PATH",
-                                                                     BINDIR ":" GDM_SESSION_DEFAULT_PATH);
+                        path_str = BINDIR ":" GDM_SESSION_DEFAULT_PATH;
                 }
         }
 
+        gdm_session_worker_set_environment_variable (worker, "PATH", path_str);
+
         if (! _change_user (worker, uid, gid)) {
                 g_debug ("GdmSessionWorker: Unable to change to user");
                 error_code = PAM_SYSTEM_ERR;
@@ -2768,6 +2826,17 @@ do_setup (GdmSessionWorker *worker)
         GError  *error;
         gboolean res;
 
+#ifdef __sun
+        char    *passreq;
+
+        passreq = gdm_read_default ("PASSREQ=");
+
+        if ((passreq != NULL) && g_ascii_strcasecmp (passreq, "YES") == 0)
+                worker->priv->password_is_required = TRUE;
+        else
+                worker->priv->password_is_required = FALSE;
+#endif
+
         error = NULL;
         res = gdm_session_worker_initialize_pam (worker,
                                                  worker->priv->service,
-- 
2.7.4

