2N/A/*
2N/A * CDDL HEADER START
2N/A *
2N/A * The contents of this file are subject to the terms of the
2N/A * Common Development and Distribution License (the "License").
2N/A * You may not use this file except in compliance with the License.
2N/A *
2N/A * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
2N/A * or http://www.opensolaris.org/os/licensing.
2N/A * See the License for the specific language governing permissions
2N/A * and limitations under the License.
2N/A *
2N/A * When distributing Covered Code, include this CDDL HEADER in each
2N/A * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
2N/A * If applicable, add the following below this CDDL HEADER, with the
2N/A * fields enclosed by brackets "[]" replaced with your own identifying
2N/A * information: Portions Copyright [yyyy] [name of copyright owner]
2N/A *
2N/A * CDDL HEADER END
2N/A */
2N/A/*
2N/A * Copyright (c) 1996, 2012, Oracle and/or its affiliates. All rights reserved.
2N/A */
2N/A
2N/A#include <syslog.h>
2N/A#include <dlfcn.h>
2N/A#include <sys/types.h>
2N/A#include <sys/stat.h>
2N/A#include <stdlib.h>
2N/A#include <strings.h>
2N/A#include <malloc.h>
2N/A#include <unistd.h>
2N/A#include <fcntl.h>
2N/A#include <errno.h>
2N/A#include <sys/param.h>
2N/A#include <dirent.h>
2N/A
2N/A#include <security/pam_appl.h>
2N/A#include <security/pam_modules.h>
2N/A#include <sys/mman.h>
2N/A
2N/A#include <libintl.h>
2N/A
2N/A#include "pam_impl.h"
2N/A
2N/Astatic char *pam_snames [PAM_NUM_MODULE_TYPES] = {
2N/A PAM_ACCOUNT_NAME,
2N/A PAM_AUTH_NAME,
2N/A PAM_PASSWORD_NAME,
2N/A PAM_SESSION_NAME
2N/A};
2N/A
2N/Astatic char *pam_inames [PAM_MAX_ITEMS] = {
2N/A/* NONE */ NULL,
2N/A/* PAM_SERVICE */ "service",
2N/A/* PAM_USER */ "user",
2N/A/* PAM_TTY */ "tty",
2N/A/* PAM_RHOST */ "rhost",
2N/A/* PAM_CONV */ "conv",
2N/A/* PAM_AUTHTOK */ "authtok",
2N/A/* PAM_OLDAUTHTOK */ "oldauthtok",
2N/A/* PAM_RUSER */ "ruser",
2N/A/* PAM_USER_PROMPT */ "user_prompt",
2N/A/* PAM_REPOSITORY */ "repository",
2N/A/* PAM_RESOURCE */ "resource",
2N/A/* PAM_AUSER */ "auser",
2N/A/* Undefined Items */
2N/A};
2N/A
2N/A/*
2N/A * This extra definition is needed in order to build this library
2N/A * on pre-64-bit-aware systems.
2N/A */
2N/A#if !defined(_LFS64_LARGEFILE)
2N/A#define stat64 stat
2N/A#endif /* !defined(_LFS64_LARGEFILE) */
2N/A
2N/A/* functions to dynamically load modules */
2N/Astatic int load_modules(pam_handle_t *, int, char *, pamtab_t *);
2N/Astatic void *open_module(pam_handle_t *, char *);
2N/Astatic int load_function(void *, char *, int (**func)());
2N/A
2N/A/* functions to read and store the pam.conf configuration file */
2N/Astatic int open_pam_conf(struct pam_fh **, pam_handle_t *, const char *,
2N/A char *, boolean_t);
2N/Astatic void close_pam_conf(struct pam_fh *);
2N/Astatic int read_pam_entries(pam_handle_t *, const char *, char *, int);
2N/Astatic int read_pam_conf(pam_handle_t *, const char *, char *, int,
2N/A boolean_t);
2N/Astatic int get_pam_conf_entry(struct pam_fh *, pam_handle_t *,
2N/A pamtab_t **, char *, boolean_t, int);
2N/Astatic char *read_next_token(char **);
2N/Astatic char *nextline(struct pam_fh *, pam_handle_t *, int *);
2N/Astatic int verify_pam_conf(pamtab_t *, char *);
2N/A
2N/A/* functions to clean up and free memory */
2N/Astatic void clean_up(pam_handle_t *);
2N/Astatic void free_pamconf(pamtab_t *);
2N/Astatic void free_pam_conf_info(pam_handle_t *);
2N/Astatic void free_env(env_list *);
2N/A
2N/A/* convenience functions for I18N/L10N communication */
2N/A
2N/Astatic void free_resp(int, struct pam_response *);
2N/Astatic int do_conv(pam_handle_t *, int, int,
2N/A char messages[PAM_MAX_NUM_MSG][PAM_MAX_MSG_SIZE], void *,
2N/A struct pam_response **);
2N/A
2N/Astatic int log_priority; /* pam_trace syslog priority & facility */
2N/Astatic int pam_debug = 0;
2N/A
2N/Astatic char *
2N/Apam_trace_iname(int item_type, char *iname_buf)
2N/A{
2N/A char *name;
2N/A
2N/A if (item_type <= 0 ||
2N/A item_type >= PAM_MAX_ITEMS ||
2N/A (name = pam_inames[item_type]) == NULL) {
2N/A (void) sprintf(iname_buf, "%d", item_type);
2N/A return (iname_buf);
2N/A }
2N/A return (name);
2N/A}
2N/A
2N/Astatic char *
2N/Apam_trace_fname(int flag)
2N/A{
2N/A if (flag & PAM_BINDING)
2N/A return (PAM_BINDING_NAME);
2N/A if (flag & PAM_DEFINITIVE)
2N/A return (PAM_DEFINITIVE_NAME);
2N/A if (flag & PAM_INCLUDE)
2N/A return (PAM_INCLUDE_NAME);
2N/A if (flag & PAM_OPTIONAL)
2N/A return (PAM_OPTIONAL_NAME);
2N/A if (flag & PAM_REQUIRED)
2N/A return (PAM_REQUIRED_NAME);
2N/A if (flag & PAM_REQUISITE)
2N/A return (PAM_REQUISITE_NAME);
2N/A if (flag & PAM_SUFFICIENT)
2N/A return (PAM_SUFFICIENT_NAME);
2N/A return ("bad flag name");
2N/A}
2N/A
2N/Astatic char *
2N/Apam_trace_cname(pam_handle_t *pamh)
2N/A{
2N/A if (pamh->pam_conf_name[pamh->include_depth] == NULL)
2N/A return ("NULL");
2N/A return (pamh->pam_conf_name[pamh->include_depth]);
2N/A}
2N/A
2N/A#include <deflt.h>
2N/A#include <stdarg.h>
2N/A/*
2N/A * pam_settrace - setup configuration for pam tracing
2N/A *
2N/A * turn on PAM debug if "magic" file exists
2N/A * if exists (original), pam_debug = PAM_DEBUG_DEFAULT,
2N/A * log_priority = LOG_DEBUG(7) and log_facility = LOG_AUTH(4).
2N/A *
2N/A * if has contents, keywork=value pairs:
2N/A *
2N/A * "log_priority=" 0-7, the pam_trace syslog priority to use
2N/A * (see sys/syslog.h)
2N/A * "log_facility=" 0-23, the pam_trace syslog facility to use
2N/A * (see sys/syslog.h)
2N/A * "debug_flags=" PAM_DEBUG_DEFAULT (0x0001), log traditional
2N/A * (original) debugging.
2N/A * Plus the logical or of:
2N/A * PAM_DEBUG_ITEM (0x0002), log item values and
2N/A * pam_get_item.
2N/A * PAM_DEBUG_MODULE (0x0004), log module return status.
2N/A * PAM_DEBUG_CONF (0x0008), log pam.conf parsing.
2N/A * PAM_DEBUG_DATA (0x0010), get/set_data.
2N/A * PAM_DEBUG_CONV (0x0020), conversation/response.
2N/A *
2N/A * If compiled with DEBUG:
2N/A * PAM_DEBUG_AUTHTOK (0x8000), display AUTHTOK value if
2N/A * PAM_DEBUG_ITEM is set and results from
2N/A * PAM_PROMPT_ECHO_OFF responses.
2N/A * USE CAREFULLY, THIS EXPOSES THE USER'S PASSWORDS.
2N/A *
2N/A * or set to 0 and off even if PAM_DEBUG file exists.
2N/A *
2N/A * Output has the general form:
2N/A * <whatever was set syslog> PAM[<pid>]: <interface>(<handle> and other info)
2N/A * <whatever was set syslog> PAM[<pid>]: details requested for <interface> call
2N/A * Where: <pid> is the process ID of the calling process.
2N/A * <handle> is the Hex value of the pam_handle associated with the
2N/A * call.
2N/A */
2N/A
2N/Astatic void
2N/Apam_settrace()
2N/A{
2N/A void *defp;
2N/A
2N/A if ((defp = defopen_r(PAM_DEBUG)) != NULL) {
2N/A char *arg;
2N/A int code;
2N/A int facility = LOG_AUTH;
2N/A
2N/A pam_debug = PAM_DEBUG_DEFAULT;
2N/A log_priority = LOG_DEBUG;
2N/A
2N/A (void) defcntl_r(DC_SETFLAGS, DC_CASE, defp);
2N/A if ((arg = defread_r(LOG_PRIORITY, defp)) != NULL) {
2N/A code = (int)strtol(arg, NULL, 10);
2N/A if ((code & ~LOG_PRIMASK) == 0) {
2N/A log_priority = code;
2N/A }
2N/A }
2N/A if ((arg = defread_r(LOG_FACILITY, defp)) != NULL) {
2N/A code = (int)strtol(arg, NULL, 10);
2N/A if (code < LOG_NFACILITIES) {
2N/A facility = code << 3;
2N/A }
2N/A }
2N/A if ((arg = defread_r(DEBUG_FLAGS, defp)) != NULL) {
2N/A pam_debug = (int)strtol(arg, NULL, 0);
2N/A }
2N/A defclose_r(defp);
2N/A
2N/A log_priority |= facility;
2N/A }
2N/A}
2N/A
2N/A/*
2N/A * pam_trace - logs tracing messages
2N/A *
2N/A * flag = debug_flags from /etc/pam_debug
2N/A * format and args = message to print (PAM[<pid>]: is prepended).
2N/A *
2N/A * global log_priority = pam_trace syslog (log_priority | log_facility)
2N/A * from /etc/pam_debug
2N/A */
2N/A/*PRINTFLIKE2*/
2N/Astatic void
2N/Apam_trace(int flag, char *format, ...)
2N/A{
2N/A va_list args;
2N/A char message[1024];
2N/A int savemask;
2N/A
2N/A if ((pam_debug & flag) == 0)
2N/A return;
2N/A
2N/A savemask = setlogmask(LOG_MASK(log_priority & LOG_PRIMASK));
2N/A (void) snprintf(message, sizeof (message), "PAM[%ld]: %s",
2N/A (long)getpid(), format);
2N/A va_start(args, format);
2N/A (void) vsyslog(log_priority, message, args);
2N/A va_end(args);
2N/A (void) setlogmask(savemask);
2N/A}
2N/A
2N/A/*
2N/A * __pam_log - logs PAM syslog messages
2N/A *
2N/A * priority = message priority
2N/A * format and args = message to log
2N/A */
2N/A/*PRINTFLIKE2*/
2N/Avoid
2N/A__pam_log(int priority, const char *format, ...)
2N/A{
2N/A va_list args;
2N/A int savemask = setlogmask(LOG_MASK(priority & LOG_PRIMASK));
2N/A
2N/A va_start(args, format);
2N/A (void) vsyslog(priority, format, args);
2N/A va_end(args);
2N/A (void) setlogmask(savemask);
2N/A}
2N/A
2N/A
2N/A/*
2N/A * pam_XXXXX routines
2N/A *
2N/A * These are the entry points to the authentication switch
2N/A */
2N/A
2N/A/*
2N/A * pam_start - initiate an authentication transaction and
2N/A * set parameter values to be used during the
2N/A * transaction
2N/A */
2N/A
2N/Aint
2N/Apam_start(const char *service, const char *user,
2N/A const struct pam_conv *pam_conv, pam_handle_t **pamh)
2N/A{
2N/A int err;
2N/A
2N/A *pamh = calloc(1, sizeof (struct pam_handle));
2N/A
2N/A pam_settrace();
2N/A pam_trace(PAM_DEBUG_DEFAULT,
2N/A "pam_start(%s,%s,%p:%p) - debug = %x",
2N/A service ? service : "NULL", user ? user : "NULL", (void *)pam_conv,
2N/A (void *)*pamh, pam_debug);
2N/A
2N/A if (*pamh == NULL)
2N/A return (PAM_BUF_ERR);
2N/A
2N/A (*pamh)->pam_inmodule = RO_OK; /* OK to set RO items */
2N/A if ((err = pam_set_item(*pamh, PAM_SERVICE, (void *)service))
2N/A != PAM_SUCCESS) {
2N/A clean_up(*pamh);
2N/A *pamh = NULL;
2N/A return (err);
2N/A }
2N/A
2N/A if ((err = pam_set_item(*pamh, PAM_USER, (void *)user))
2N/A != PAM_SUCCESS) {
2N/A clean_up(*pamh);
2N/A *pamh = NULL;
2N/A return (err);
2N/A }
2N/A
2N/A if ((err = pam_set_item(*pamh, PAM_CONV, (void *)pam_conv))
2N/A != PAM_SUCCESS) {
2N/A clean_up(*pamh);
2N/A *pamh = NULL;
2N/A return (err);
2N/A }
2N/A
2N/A (*pamh)->pam_inmodule = RW_OK;
2N/A return (PAM_SUCCESS);
2N/A}
2N/A
2N/A/*
2N/A * pam_end - terminate an authentication transaction
2N/A */
2N/A
2N/Aint
2N/Apam_end(pam_handle_t *pamh, int pam_status)
2N/A{
2N/A struct pam_module_data *psd, *p;
2N/A fd_list *expired;
2N/A fd_list *traverse;
2N/A env_list *env_expired;
2N/A env_list *env_traverse;
2N/A
2N/A pam_trace(PAM_DEBUG_DEFAULT,
2N/A "pam_end(%p): status = %s", (void *)pamh,
2N/A pam_strerror(pamh, pam_status));
2N/A
2N/A if (pamh == NULL)
2N/A return (PAM_SYSTEM_ERR);
2N/A
2N/A /* call the cleanup routines for module specific data */
2N/A
2N/A psd = pamh->ssd;
2N/A while (psd) {
2N/A if (psd->cleanup) {
2N/A psd->cleanup(pamh, psd->data, pam_status);
2N/A }
2N/A p = psd;
2N/A psd = p->next;
2N/A free(p->module_data_name);
2N/A free(p);
2N/A }
2N/A pamh->ssd = NULL;
2N/A
2N/A /* dlclose all module fds */
2N/A traverse = pamh->fd;
2N/A while (traverse) {
2N/A expired = traverse;
2N/A traverse = traverse->next;
2N/A (void) dlclose(expired->mh);
2N/A free(expired);
2N/A }
2N/A pamh->fd = 0;
2N/A
2N/A /* remove all environment variables */
2N/A env_traverse = pamh->pam_env;
2N/A while (env_traverse) {
2N/A env_expired = env_traverse;
2N/A env_traverse = env_traverse->next;
2N/A free_env(env_expired);
2N/A }
2N/A
2N/A clean_up(pamh);
2N/A return (PAM_SUCCESS);
2N/A}
2N/A
2N/A/*
2N/A * pam_set_item - set the value of a parameter that can be
2N/A * retrieved via a call to pam_get_item()
2N/A */
2N/A
2N/Aint
2N/Apam_set_item(pam_handle_t *pamh, int item_type, const void *item)
2N/A{
2N/A struct pam_item *pip;
2N/A int size;
2N/A char iname_buf[PAM_MAX_MSG_SIZE];
2N/A
2N/A if (((pam_debug & PAM_DEBUG_ITEM) == 0) || (pamh == NULL)) {
2N/A pam_trace(PAM_DEBUG_DEFAULT,
2N/A "pam_set_item(%p:%s)", (void *)pamh,
2N/A pam_trace_iname(item_type, iname_buf));
2N/A }
2N/A
2N/A if (pamh == NULL)
2N/A return (PAM_SYSTEM_ERR);
2N/A
2N/A /* check read only items */
2N/A if ((item_type == PAM_SERVICE) && (pamh->pam_inmodule != RO_OK))
2N/A return (PAM_PERM_DENIED);
2N/A
2N/A /*
2N/A * Check that item_type is within valid range
2N/A */
2N/A
2N/A if (item_type <= 0 || item_type >= PAM_MAX_ITEMS)
2N/A return (PAM_SYMBOL_ERR);
2N/A
2N/A pip = &(pamh->ps_item[item_type]);
2N/A
2N/A switch (item_type) {
2N/A case PAM_AUTHTOK:
2N/A case PAM_OLDAUTHTOK:
2N/A if (pip->pi_addr != NULL)
2N/A (void) memset(pip->pi_addr, 0, pip->pi_size);
2N/A /*FALLTHROUGH*/
2N/A case PAM_SERVICE:
2N/A case PAM_USER:
2N/A case PAM_TTY:
2N/A case PAM_RHOST:
2N/A case PAM_RUSER:
2N/A case PAM_USER_PROMPT:
2N/A case PAM_RESOURCE:
2N/A case PAM_AUSER:
2N/A if (pip->pi_addr != NULL) {
2N/A free(pip->pi_addr);
2N/A }
2N/A
2N/A if (item == NULL) {
2N/A pip->pi_addr = NULL;
2N/A pip->pi_size = 0;
2N/A } else {
2N/A pip->pi_addr = strdup((char *)item);
2N/A if (pip->pi_addr == NULL) {
2N/A pip->pi_size = 0;
2N/A return (PAM_BUF_ERR);
2N/A }
2N/A pip->pi_size = strlen(pip->pi_addr);
2N/A }
2N/A break;
2N/A case PAM_CONV:
2N/A if (pip->pi_addr != NULL)
2N/A free(pip->pi_addr);
2N/A size = sizeof (struct pam_conv);
2N/A if ((pip->pi_addr = calloc(1, size)) == NULL)
2N/A return (PAM_BUF_ERR);
2N/A if (item != NULL)
2N/A (void) memcpy(pip->pi_addr, item, (unsigned int) size);
2N/A else
2N/A (void) memset(pip->pi_addr, 0, size);
2N/A pip->pi_size = size;
2N/A break;
2N/A case PAM_REPOSITORY:
2N/A if (pip->pi_addr != NULL) {
2N/A pam_repository_t *auth_rep;
2N/A
2N/A auth_rep = (pam_repository_t *)pip->pi_addr;
2N/A if (auth_rep->type != NULL)
2N/A free(auth_rep->type);
2N/A if (auth_rep->scope != NULL)
2N/A free(auth_rep->scope);
2N/A free(auth_rep);
2N/A }
2N/A if (item != NULL) {
2N/A pam_repository_t *s, *d;
2N/A
2N/A size = sizeof (struct pam_repository);
2N/A pip->pi_addr = calloc(1, size);
2N/A if (pip->pi_addr == NULL)
2N/A return (PAM_BUF_ERR);
2N/A
2N/A s = (struct pam_repository *)item;
2N/A d = (struct pam_repository *)pip->pi_addr;
2N/A
2N/A d->type = strdup(s->type);
2N/A if (d->type == NULL)
2N/A return (PAM_BUF_ERR);
2N/A d->scope = malloc(s->scope_len);
2N/A if (d->scope == NULL)
2N/A return (PAM_BUF_ERR);
2N/A (void) memcpy(d->scope, s->scope, s->scope_len);
2N/A d->scope_len = s->scope_len;
2N/A }
2N/A pip->pi_size = size;
2N/A break;
2N/A default:
2N/A return (PAM_SYMBOL_ERR);
2N/A }
2N/A switch (item_type) {
2N/A case PAM_CONV:
2N/A pam_trace(PAM_DEBUG_ITEM, "pam_set_item(%p:%s)=%p",
2N/A (void *)pamh,
2N/A pam_trace_iname(item_type, iname_buf),
2N/A item ? (void *)((struct pam_conv *)item)->conv :
2N/A (void *)0);
2N/A break;
2N/A case PAM_REPOSITORY:
2N/A pam_trace(PAM_DEBUG_ITEM, "pam_set_item(%p:%s)=%s",
2N/A (void *)pamh,
2N/A pam_trace_iname(item_type, iname_buf),
2N/A item ? (((struct pam_repository *)item)->type ?
2N/A ((struct pam_repository *)item)->type : "NULL") :
2N/A "NULL");
2N/A break;
2N/A case PAM_AUTHTOK:
2N/A case PAM_OLDAUTHTOK:
2N/A#ifdef DEBUG
2N/A if (pam_debug & PAM_DEBUG_AUTHTOK)
2N/A pam_trace(PAM_DEBUG_ITEM,
2N/A "pam_set_item(%p:%s)=%s", (void *)pamh,
2N/A pam_trace_iname(item_type, iname_buf),
2N/A item ? (char *)item : "NULL");
2N/A else
2N/A#endif /* DEBUG */
2N/A pam_trace(PAM_DEBUG_ITEM,
2N/A "pam_set_item(%p:%s)=%s", (void *)pamh,
2N/A pam_trace_iname(item_type, iname_buf),
2N/A item ? "********" : "NULL");
2N/A break;
2N/A default:
2N/A pam_trace(PAM_DEBUG_ITEM, "pam_set_item(%p:%s)=%s",
2N/A (void *)pamh,
2N/A pam_trace_iname(item_type, iname_buf),
2N/A item ? (char *)item : "NULL");
2N/A }
2N/A
2N/A return (PAM_SUCCESS);
2N/A}
2N/A
2N/A/*
2N/A * pam_get_item - read the value of a parameter specified in
2N/A * the call to pam_set_item()
2N/A */
2N/A
2N/Aint
2N/Apam_get_item(const pam_handle_t *pamh, int item_type, void **item)
2N/A{
2N/A struct pam_item *pip;
2N/A char iname_buf[PAM_MAX_MSG_SIZE];
2N/A
2N/A if (((pam_debug & PAM_DEBUG_ITEM) == 0) || (pamh == NULL)) {
2N/A pam_trace(PAM_DEBUG_ITEM, "pam_get_item(%p:%s)",
2N/A (void *)pamh, pam_trace_iname(item_type, iname_buf));
2N/A }
2N/A
2N/A if (pamh == NULL)
2N/A return (PAM_SYSTEM_ERR);
2N/A
2N/A if (item_type <= 0 || item_type >= PAM_MAX_ITEMS)
2N/A return (PAM_SYMBOL_ERR);
2N/A
2N/A if ((pamh->pam_inmodule != WO_OK) &&
2N/A ((item_type == PAM_AUTHTOK || item_type == PAM_OLDAUTHTOK))) {
2N/A __pam_log(LOG_AUTH | LOG_NOTICE, "pam_get_item(%s) called from "
2N/A "a non module context",
2N/A pam_trace_iname(item_type, iname_buf));
2N/A return (PAM_PERM_DENIED);
2N/A }
2N/A
2N/A pip = (struct pam_item *)&(pamh->ps_item[item_type]);
2N/A
2N/A *item = pip->pi_addr;
2N/A switch (item_type) {
2N/A case PAM_CONV:
2N/A pam_trace(PAM_DEBUG_ITEM, "pam_get_item(%p:%s)=%p",
2N/A (void *)pamh,
2N/A pam_trace_iname(item_type, iname_buf),
2N/A (void *)((struct pam_conv *)*item)->conv);
2N/A break;
2N/A case PAM_REPOSITORY:
2N/A pam_trace(PAM_DEBUG_ITEM, "pam_get_item(%p:%s)=%s",
2N/A (void *)pamh,
2N/A pam_trace_iname(item_type, iname_buf),
2N/A *item ? (((struct pam_repository *)*item)->type ?
2N/A ((struct pam_repository *)*item)->type : "NULL") :
2N/A "NULL");
2N/A break;
2N/A case PAM_AUTHTOK:
2N/A case PAM_OLDAUTHTOK:
2N/A#ifdef DEBUG
2N/A if (pam_debug & PAM_DEBUG_AUTHTOK)
2N/A pam_trace(PAM_DEBUG_ITEM,
2N/A "pam_get_item(%p:%s)=%s", (void *)pamh,
2N/A pam_trace_iname(item_type, iname_buf),
2N/A *item ? *(char **)item : "NULL");
2N/A else
2N/A#endif /* DEBUG */
2N/A pam_trace(PAM_DEBUG_ITEM,
2N/A "pam_get_item(%p:%s)=%s", (void *)pamh,
2N/A pam_trace_iname(item_type, iname_buf),
2N/A *item ? "********" : "NULL");
2N/A break;
2N/A default:
2N/A pam_trace(PAM_DEBUG_ITEM, "pam_get_item(%p:%s)=%s",
2N/A (void *)pamh,
2N/A pam_trace_iname(item_type, iname_buf),
2N/A *item ? *(char **)item : "NULL");
2N/A }
2N/A
2N/A return (PAM_SUCCESS);
2N/A}
2N/A
2N/A/*
2N/A * parse_user_name - process the user response: ignore
2N/A * '\t' or ' ' before or after a user name.
2N/A * user_input is a null terminated string.
2N/A * *ret_username will be the user name.
2N/A */
2N/A
2N/Astatic int
2N/Aparse_user_name(char *user_input, char **ret_username)
2N/A{
2N/A register char *ptr;
2N/A register int index = 0;
2N/A char username[PAM_MAX_RESP_SIZE];
2N/A
2N/A /* Set the default value for *ret_username */
2N/A *ret_username = NULL;
2N/A
2N/A /*
2N/A * Set the initial value for username - this is a buffer holds
2N/A * the user name.
2N/A */
2N/A bzero((void *)username, PAM_MAX_RESP_SIZE);
2N/A
2N/A /*
2N/A * The user_input is guaranteed to be terminated by a null character.
2N/A */
2N/A ptr = user_input;
2N/A
2N/A /* Skip all the leading whitespaces if there are any. */
2N/A while ((*ptr == ' ') || (*ptr == '\t'))
2N/A ptr++;
2N/A
2N/A if (*ptr == '\0') {
2N/A /*
2N/A * We should never get here since the user_input we got
2N/A * in pam_get_user() is not all whitespaces nor just "\0".
2N/A */
2N/A return (PAM_BUF_ERR);
2N/A }
2N/A
2N/A /*
2N/A * username will be the first string we get from user_input
2N/A * - we skip leading whitespaces and ignore trailing whitespaces
2N/A */
2N/A while (*ptr != '\0') {
2N/A if ((*ptr == ' ') || (*ptr == '\t'))
2N/A break;
2N/A else {
2N/A username[index] = *ptr;
2N/A index++;
2N/A ptr++;
2N/A }
2N/A }
2N/A
2N/A /* ret_username will be freed in pam_get_user(). */
2N/A if ((*ret_username = malloc(index + 1)) == NULL)
2N/A return (PAM_BUF_ERR);
2N/A (void) strcpy(*ret_username, username);
2N/A return (PAM_SUCCESS);
2N/A}
2N/A
2N/A/*
2N/A * Get the value of PAM_USER. If not set, then use the convenience function
2N/A * to prompt for the user. Use prompt if specified, else use PAM_USER_PROMPT
2N/A * if it is set, else use default.
2N/A */
2N/A#define WHITESPACE 0
2N/A#define USERNAME 1
2N/A
2N/Aint
2N/Apam_get_user(pam_handle_t *pamh, char **user, const char *prompt_override)
2N/A{
2N/A int status;
2N/A char *prompt = NULL;
2N/A char *real_username;
2N/A struct pam_response *ret_resp = NULL;
2N/A char messages[PAM_MAX_NUM_MSG][PAM_MAX_MSG_SIZE];
2N/A
2N/A pam_trace(PAM_DEBUG_DEFAULT,
2N/A "pam_get_user(%p, %p, %s)", (void *)pamh, (void *)*user,
2N/A prompt_override ? prompt_override : "NULL");
2N/A if (pamh == NULL)
2N/A return (PAM_SYSTEM_ERR);
2N/A
2N/A if ((status = pam_get_item(pamh, PAM_USER, (void **)user))
2N/A != PAM_SUCCESS) {
2N/A return (status);
2N/A }
2N/A
2N/A /* if the user is set, return it */
2N/A
2N/A if (*user != NULL && *user[0] != '\0') {
2N/A return (PAM_SUCCESS);
2N/A }
2N/A
2N/A /*
2N/A * if the module is requesting a special prompt, use it.
2N/A * else use PAM_USER_PROMPT.
2N/A */
2N/A
2N/A if (prompt_override != NULL) {
2N/A prompt = (char *)prompt_override;
2N/A } else {
2N/A status = pam_get_item(pamh, PAM_USER_PROMPT, (void**)&prompt);
2N/A if (status != PAM_SUCCESS) {
2N/A return (status);
2N/A }
2N/A }
2N/A
2N/A /* if the prompt is not set, use default */
2N/A
2N/A if (prompt == NULL || prompt[0] == '\0') {
2N/A prompt = dgettext(TEXT_DOMAIN, "Please enter user name: ");
2N/A }
2N/A
2N/A /* prompt for the user */
2N/A
2N/A (void) strncpy(messages[0], prompt, sizeof (messages[0]));
2N/A
2N/A for (;;) {
2N/A int state = WHITESPACE;
2N/A
2N/A status = do_conv(pamh, PAM_PROMPT_ECHO_ON, 1, messages,
2N/A NULL, &ret_resp);
2N/A
2N/A if (status != PAM_SUCCESS) {
2N/A return (status);
2N/A }
2N/A
2N/A if (ret_resp->resp && ret_resp->resp[0] != '\0') {
2N/A int len = strlen(ret_resp->resp);
2N/A int i;
2N/A
2N/A for (i = 0; i < len; i++) {
2N/A if ((ret_resp->resp[i] != ' ') &&
2N/A (ret_resp->resp[i] != '\t')) {
2N/A state = USERNAME;
2N/A break;
2N/A }
2N/A }
2N/A
2N/A if (state == USERNAME)
2N/A break;
2N/A }
2N/A /* essentially empty response, try again */
2N/A free_resp(1, ret_resp);
2N/A ret_resp = NULL;
2N/A }
2N/A
2N/A /* set PAM_USER */
2N/A /* Parse the user input to get the user name. */
2N/A status = parse_user_name(ret_resp->resp, &real_username);
2N/A
2N/A if (status != PAM_SUCCESS) {
2N/A if (real_username != NULL)
2N/A free(real_username);
2N/A free_resp(1, ret_resp);
2N/A return (status);
2N/A }
2N/A
2N/A status = pam_set_item(pamh, PAM_USER, real_username);
2N/A
2N/A free(real_username);
2N/A
2N/A free_resp(1, ret_resp);
2N/A if (status != PAM_SUCCESS) {
2N/A return (status);
2N/A }
2N/A
2N/A /*
2N/A * finally, get PAM_USER. We have to call pam_get_item to get
2N/A * the value of user because pam_set_item mallocs the memory.
2N/A */
2N/A
2N/A status = pam_get_item(pamh, PAM_USER, (void**)user);
2N/A return (status);
2N/A}
2N/A
2N/A/*
2N/A * Set module specific data
2N/A */
2N/A
2N/Aint
2N/Apam_set_data(pam_handle_t *pamh, const char *module_data_name, void *data,
2N/A void (*cleanup)(pam_handle_t *pamh, void *data, int pam_end_status))
2N/A{
2N/A struct pam_module_data *psd;
2N/A
2N/A pam_trace(PAM_DEBUG_DATA,
2N/A "pam_set_data(%p:%s:%d)=%p", (void *)pamh,
2N/A module_data_name ? module_data_name : "NULL", pamh->pam_inmodule,
2N/A data);
2N/A if (pamh == NULL || (pamh->pam_inmodule != WO_OK) ||
2N/A module_data_name == NULL) {
2N/A return (PAM_SYSTEM_ERR);
2N/A }
2N/A
2N/A /* check if module data already exists */
2N/A
2N/A for (psd = pamh->ssd; psd; psd = psd->next) {
2N/A if (strcmp(psd->module_data_name, module_data_name) == 0) {
2N/A /* clean up original data before setting the new data */
2N/A if (psd->cleanup) {
2N/A psd->cleanup(pamh, psd->data, PAM_SUCCESS);
2N/A }
2N/A psd->data = (void *)data;
2N/A psd->cleanup = cleanup;
2N/A return (PAM_SUCCESS);
2N/A }
2N/A }
2N/A
2N/A psd = malloc(sizeof (struct pam_module_data));
2N/A if (psd == NULL)
2N/A return (PAM_BUF_ERR);
2N/A
2N/A psd->module_data_name = strdup(module_data_name);
2N/A if (psd->module_data_name == NULL) {
2N/A free(psd);
2N/A return (PAM_BUF_ERR);
2N/A }
2N/A
2N/A psd->data = (void *)data;
2N/A psd->cleanup = cleanup;
2N/A psd->next = pamh->ssd;
2N/A pamh->ssd = psd;
2N/A return (PAM_SUCCESS);
2N/A}
2N/A
2N/A/*
2N/A * get module specific data
2N/A */
2N/A
2N/Aint
2N/Apam_get_data(const pam_handle_t *pamh, const char *module_data_name,
2N/A const void **data)
2N/A{
2N/A struct pam_module_data *psd;
2N/A
2N/A if (pamh == NULL || (pamh->pam_inmodule != WO_OK) ||
2N/A module_data_name == NULL) {
2N/A pam_trace(PAM_DEBUG_DATA,
2N/A "pam_get_data(%p:%s:%d)=%p", (void *)pamh,
2N/A module_data_name ? module_data_name : "NULL",
2N/A pamh->pam_inmodule, *data);
2N/A return (PAM_SYSTEM_ERR);
2N/A }
2N/A
2N/A for (psd = pamh->ssd; psd; psd = psd->next) {
2N/A if (strcmp(psd->module_data_name, module_data_name) == 0) {
2N/A *data = psd->data;
2N/A pam_trace(PAM_DEBUG_DATA,
2N/A "pam_get_data(%p:%s)=%p", (void *)pamh,
2N/A module_data_name, *data);
2N/A return (PAM_SUCCESS);
2N/A }
2N/A }
2N/A pam_trace(PAM_DEBUG_DATA,
2N/A "pam_get_data(%p:%s)=%s", (void *)pamh, module_data_name,
2N/A "PAM_NO_MODULE_DATA");
2N/A
2N/A return (PAM_NO_MODULE_DATA);
2N/A}
2N/A
2N/A/*
2N/A * PAM equivalent to strerror()
2N/A */
2N/A/* ARGSUSED */
2N/Aconst char *
2N/Apam_strerror(pam_handle_t *pamh, int errnum)
2N/A{
2N/A switch (errnum) {
2N/A case PAM_SUCCESS:
2N/A return (dgettext(TEXT_DOMAIN, "Success"));
2N/A case PAM_OPEN_ERR:
2N/A return (dgettext(TEXT_DOMAIN, "Dlopen failure"));
2N/A case PAM_SYMBOL_ERR:
2N/A return (dgettext(TEXT_DOMAIN, "Symbol not found"));
2N/A case PAM_SERVICE_ERR:
2N/A return (dgettext(TEXT_DOMAIN,
2N/A "Error in underlying service module"));
2N/A case PAM_SYSTEM_ERR:
2N/A return (dgettext(TEXT_DOMAIN, "System error"));
2N/A case PAM_BUF_ERR:
2N/A return (dgettext(TEXT_DOMAIN, "Memory buffer error"));
2N/A case PAM_CONV_ERR:
2N/A return (dgettext(TEXT_DOMAIN, "Conversation failure"));
2N/A case PAM_PERM_DENIED:
2N/A return (dgettext(TEXT_DOMAIN, "Permission denied"));
2N/A case PAM_MAXTRIES:
2N/A return (dgettext(TEXT_DOMAIN,
2N/A "Maximum number of attempts exceeded"));
2N/A case PAM_AUTH_ERR:
2N/A return (dgettext(TEXT_DOMAIN, "Authentication failed"));
2N/A case PAM_NEW_AUTHTOK_REQD:
2N/A return (dgettext(TEXT_DOMAIN, "Get new authentication token"));
2N/A case PAM_CRED_INSUFFICIENT:
2N/A return (dgettext(TEXT_DOMAIN, "Insufficient credentials"));
2N/A case PAM_AUTHINFO_UNAVAIL:
2N/A return (dgettext(TEXT_DOMAIN,
2N/A "Can not retrieve authentication info"));
2N/A case PAM_USER_UNKNOWN:
2N/A return (dgettext(TEXT_DOMAIN, "No account present for user"));
2N/A case PAM_CRED_UNAVAIL:
2N/A return (dgettext(TEXT_DOMAIN,
2N/A "Can not retrieve user credentials"));
2N/A case PAM_CRED_EXPIRED:
2N/A return (dgettext(TEXT_DOMAIN,
2N/A "User credentials have expired"));
2N/A case PAM_CRED_ERR:
2N/A return (dgettext(TEXT_DOMAIN,
2N/A "Failure setting user credentials"));
2N/A case PAM_ACCT_EXPIRED:
2N/A return (dgettext(TEXT_DOMAIN, "User account has expired"));
2N/A case PAM_AUTHTOK_EXPIRED:
2N/A return (dgettext(TEXT_DOMAIN, "User password has expired"));
2N/A case PAM_SESSION_ERR:
2N/A return (dgettext(TEXT_DOMAIN,
2N/A "Can not make/remove entry for session"));
2N/A case PAM_AUTHTOK_ERR:
2N/A return (dgettext(TEXT_DOMAIN,
2N/A "Authentication token manipulation error"));
2N/A case PAM_AUTHTOK_RECOVERY_ERR:
2N/A return (dgettext(TEXT_DOMAIN,
2N/A "Authentication token can not be recovered"));
2N/A case PAM_AUTHTOK_LOCK_BUSY:
2N/A return (dgettext(TEXT_DOMAIN,
2N/A "Authentication token lock busy"));
2N/A case PAM_AUTHTOK_DISABLE_AGING:
2N/A return (dgettext(TEXT_DOMAIN,
2N/A "Authentication token aging disabled"));
2N/A case PAM_NO_MODULE_DATA:
2N/A return (dgettext(TEXT_DOMAIN,
2N/A "Module specific data not found"));
2N/A case PAM_IGNORE:
2N/A return (dgettext(TEXT_DOMAIN, "Ignore module"));
2N/A case PAM_ABORT:
2N/A return (dgettext(TEXT_DOMAIN, "General PAM failure "));
2N/A case PAM_TRY_AGAIN:
2N/A return (dgettext(TEXT_DOMAIN,
2N/A "Unable to complete operation. Try again"));
2N/A default:
2N/A return (dgettext(TEXT_DOMAIN, "Unknown error"));
2N/A }
2N/A}
2N/A
2N/Astatic void *
2N/Asm_name(int ind)
2N/A{
2N/A switch (ind) {
2N/A case PAM_AUTHENTICATE:
2N/A return (PAM_SM_AUTHENTICATE);
2N/A case PAM_SETCRED:
2N/A return (PAM_SM_SETCRED);
2N/A case PAM_ACCT_MGMT:
2N/A return (PAM_SM_ACCT_MGMT);
2N/A case PAM_OPEN_SESSION:
2N/A return (PAM_SM_OPEN_SESSION);
2N/A case PAM_CLOSE_SESSION:
2N/A return (PAM_SM_CLOSE_SESSION);
2N/A case PAM_CHAUTHTOK:
2N/A return (PAM_SM_CHAUTHTOK);
2N/A }
2N/A return (NULL);
2N/A}
2N/A
2N/Astatic int
2N/A(*func(pamtab_t *modulep, int ind))()
2N/A{
2N/A void *funcp;
2N/A
2N/A if ((funcp = modulep->function_ptr) == NULL)
2N/A return (NULL);
2N/A
2N/A switch (ind) {
2N/A case PAM_AUTHENTICATE:
2N/A return (((struct auth_module *)funcp)->pam_sm_authenticate);
2N/A case PAM_SETCRED:
2N/A return (((struct auth_module *)funcp)->pam_sm_setcred);
2N/A case PAM_ACCT_MGMT:
2N/A return (((struct account_module *)funcp)->pam_sm_acct_mgmt);
2N/A case PAM_OPEN_SESSION:
2N/A return (((struct session_module *)funcp)->pam_sm_open_session);
2N/A case PAM_CLOSE_SESSION:
2N/A return (((struct session_module *)funcp)->pam_sm_close_session);
2N/A case PAM_CHAUTHTOK:
2N/A return (((struct password_module *)funcp)->pam_sm_chauthtok);
2N/A }
2N/A return (NULL);
2N/A}
2N/A
2N/A/*
2N/A * Run through the PAM service module stack for the given module type.
2N/A */
2N/Astatic int
2N/Arun_stack(pam_handle_t *pamh, const char *pam_config, int flags, int type,
2N/A int def_err, int ind, char *function_name)
2N/A{
2N/A int err = PAM_SYSTEM_ERR; /* preset */
2N/A int optional_error = 0;
2N/A int required_error = 0;
2N/A int success = 0;
2N/A pamtab_t *modulep;
2N/A int (*sm_func)();
2N/A char *service;
2N/A
2N/A if (pamh == NULL)
2N/A return (PAM_SYSTEM_ERR);
2N/A
2N/A /*
2N/A * pam_eval(3PAM) calls run_stack() to evaluate a supplied PAM
2N/A * configuration file if pam_user_policy(5) is configured. On the
2N/A * first pass through run_stack() we stash away the passed in
2N/A * arguments so we can pass the same ones to run_stack() if called
2N/A * by pam_eval(3PAM) later.
2N/A */
2N/A if (!pamh->pam_eval_called) {
2N/A pamh->flags = flags;
2N/A pamh->type = type;
2N/A pamh->def_err = def_err;
2N/A pamh->ind = ind;
2N/A pamh->function_name = function_name;
2N/A }
2N/A
2N/A
2N/A (void) pam_get_item(pamh, PAM_SERVICE, (void **)&service);
2N/A if (service == NULL || *service == '\0') {
2N/A __pam_log(LOG_AUTH | LOG_ERR, "No service name");
2N/A return (PAM_SYSTEM_ERR);
2N/A }
2N/A
2N/A /*
2N/A * Read PAM entries from either /etc/pam.conf and/or
2N/A * /etc/pam.d/<service> or an included PAM configuration file
2N/A * from pam_eval(3PAM) which is invoked by pam_user_policy(5).
2N/A * pam_config will be the path to a PAM configuration file if called
2N/A * from pam_eval(3PAM), otherwise it is NULL.
2N/A */
2N/A if ((err = read_pam_entries(pamh, pam_config, service,
2N/A type)) != PAM_SUCCESS) {
2N/A if (pam_config == NULL) {
2N/A __pam_log(LOG_AUTH | LOG_ERR,
2N/A "no valid PAM configuration entries found in %s, "
2N/A "%s/%s, or %s/other", PAM_CONFIG, PAM_D_CONFIG,
2N/A service, PAM_D_CONFIG);
2N/A } else if (err != PAM_IGNORE) {
2N/A __pam_log(LOG_AUTH | LOG_ERR,
2N/A "no valid PAM configuration entries found in %s",
2N/A pam_config);
2N/A }
2N/A goto exit_return;
2N/A }
2N/A
2N/A modulep = pamh->pam_conf_info[pamh->include_depth][type];
2N/A
2N/A if (!pamh->pam_eval_called) {
2N/A pamh->pam_inmodule = WO_OK; /* OK to get AUTHTOK */
2N/A }
2N/Ainclude:
2N/A pam_trace(PAM_DEBUG_MODULE,
2N/A "[%d:%s]:run_stack:%s(%p, %x): %s", pamh->include_depth,
2N/A pam_trace_cname(pamh), function_name, (void *)pamh, flags,
2N/A modulep ? modulep->module_path : "NULL");
2N/A
2N/A while (modulep != NULL) {
2N/A if (modulep->pam_flag & PAM_INCLUDE) {
2N/A /* save the return location */
2N/A pamh->pam_conf_modulep[pamh->include_depth] =
2N/A modulep->next;
2N/A pam_trace(PAM_DEBUG_MODULE,
2N/A "setting for include[%d:%p]",
2N/A pamh->include_depth, (void *)modulep->next);
2N/A if (pamh->include_depth++ >= PAM_MAX_INCLUDE) {
2N/A err = PAM_SYSTEM_ERR;
2N/A __pam_log(LOG_AUTH | LOG_ERR,
2N/A "run_stack: includes too deep %d "
2N/A "found trying to include %s from %s, %d "
2N/A "allowed", pamh->include_depth,
2N/A modulep->module_path, pamh->pam_conf_name
2N/A [PAM_MAX_INCLUDE] == NULL ? "NULL" :
2N/A pamh->pam_conf_name[PAM_MAX_INCLUDE],
2N/A PAM_MAX_INCLUDE);
2N/A goto exit_return;
2N/A }
2N/A if ((err = read_pam_entries(pamh, modulep->module_path,
2N/A service, type)) != PAM_SUCCESS) {
2N/A __pam_log(LOG_AUTH | LOG_ERR,
2N/A "run_stack[%d:%s]: can't open included "
2N/A "conf %s or no valid PAM configuration "
2N/A "entries for %s were found in %s",
2N/A pamh->include_depth, modulep->module_path,
2N/A modulep->module_path, function_name,
2N/A modulep->module_path);
2N/A goto exit_return;
2N/A }
2N/A modulep = pamh->pam_conf_info
2N/A [pamh->include_depth][type];
2N/A if (modulep->pam_flag & PAM_INCLUDE) {
2N/A /* first line another include */
2N/A goto include;
2N/A }
2N/A pam_trace(PAM_DEBUG_DEFAULT, "include[%d:%s]"
2N/A "(%p, %s)=%s", pamh->include_depth,
2N/A pam_trace_cname(pamh), (void *)pamh,
2N/A function_name, modulep->module_path);
2N/A if ((err = load_modules(pamh, type, sm_name(ind),
2N/A pamh->pam_conf_info
2N/A [pamh->include_depth][type])) != PAM_SUCCESS) {
2N/A pam_trace(PAM_DEBUG_DEFAULT,
2N/A "[%d:%s]:%s(%p, %x): load_modules failed",
2N/A pamh->include_depth, pam_trace_cname(pamh),
2N/A function_name, (void *)pamh, flags);
2N/A goto exit_return;
2N/A }
2N/A } else if ((err = load_modules(pamh, type, sm_name(ind),
2N/A modulep)) != PAM_SUCCESS) {
2N/A pam_trace(PAM_DEBUG_DEFAULT,
2N/A "[%d:%s]:%s(%p, %x): load_modules failed",
2N/A pamh->include_depth, pam_trace_cname(pamh),
2N/A function_name, (void *)pamh, flags);
2N/A goto exit_return;
2N/A } /* PAM_INCLUDE */
2N/A sm_func = func(modulep, ind);
2N/A if (sm_func) {
2N/A err = sm_func(pamh, flags, modulep->module_argc,
2N/A (const char **)modulep->module_argv);
2N/A
2N/A pam_trace(PAM_DEBUG_MODULE,
2N/A "[%d:%s]:%s(%p, %x): %s returned %s",
2N/A pamh->include_depth, pam_trace_cname(pamh),
2N/A function_name, (void *)pamh, flags,
2N/A modulep->module_path, pam_strerror(pamh, err));
2N/A
2N/A switch (err) {
2N/A case PAM_IGNORE:
2N/A /* do nothing */
2N/A break;
2N/A case PAM_SUCCESS:
2N/A if ((modulep->pam_flag & PAM_SUF_BIND_DEF) &&
2N/A !required_error) {
2N/A pam_trace(PAM_DEBUG_MODULE,
2N/A "[%d:%s]:%s(%p, %x): %s: success",
2N/A pamh->include_depth,
2N/A pam_trace_cname(pamh),
2N/A function_name, (void *)pamh, flags,
2N/A pam_trace_fname(modulep->pam_flag));
2N/A goto exit_return;
2N/A }
2N/A success = 1;
2N/A break;
2N/A case PAM_TRY_AGAIN:
2N/A /*
2N/A * We need to return immediately, and
2N/A * we shouldn't reset the AUTHTOK item
2N/A * since it is not an error per-se.
2N/A */
2N/A pam_trace(PAM_DEBUG_MODULE,
2N/A "[%d:%s]:%s(%p, %x): TRY_AGAIN: %s",
2N/A pamh->include_depth, pam_trace_cname(pamh),
2N/A function_name, (void *)pamh, flags,
2N/A pam_strerror(pamh, required_error ?
2N/A required_error : err));
2N/A err = required_error ? required_error : err;
2N/A goto exit_return;
2N/A default:
2N/A if (modulep->pam_flag & PAM_REQUS_DEF) {
2N/A pam_trace(PAM_DEBUG_MODULE,
2N/A "[%d:%s]:%s(%p, %x): %s: %s",
2N/A pamh->include_depth,
2N/A pam_trace_cname(pamh),
2N/A function_name, (void *)pamh, flags,
2N/A pam_trace_fname(modulep->pam_flag),
2N/A pam_strerror(pamh,
2N/A required_error ? required_error :
2N/A err));
2N/A err = required_error ?
2N/A required_error : err;
2N/A goto exit_return;
2N/A } else if (modulep->pam_flag & PAM_REQRD_BIND) {
2N/A if (!required_error)
2N/A required_error = err;
2N/A } else {
2N/A if (!optional_error)
2N/A optional_error = err;
2N/A }
2N/A pam_trace(PAM_DEBUG_DEFAULT,
2N/A "[%d:%s]:%s(%p, %x): error %s",
2N/A pamh->include_depth, pam_trace_cname(pamh),
2N/A function_name, (void *)pamh, flags,
2N/A pam_strerror(pamh, err));
2N/A break;
2N/A }
2N/A }
2N/A modulep = modulep->next;
2N/A }
2N/A
2N/A pam_trace(PAM_DEBUG_MODULE, "[%d:%s]:stack_end:%s(%p, %x): %s %s: %s",
2N/A pamh->include_depth, pam_trace_cname(pamh), function_name,
2N/A (void *)pamh, flags, pamh->include_depth ? "included" : "final",
2N/A required_error ? "required" : success ? "success" :
2N/A optional_error ? "optional" : "default",
2N/A pam_strerror(pamh, required_error ? required_error :
2N/A success ? PAM_SUCCESS : optional_error ? optional_error : def_err));
2N/A
2N/A if ((pamh->pam_eval_called &&
2N/A pamh->include_depth > pamh->saved_include_depth) ||
2N/A (!pamh->pam_eval_called && pamh->include_depth > 0)) {
2N/A free_pam_conf_info(pamh);
2N/A pamh->include_depth--;
2N/A /* continue at next entry */
2N/A modulep = pamh->pam_conf_modulep[pamh->include_depth];
2N/A pam_trace(PAM_DEBUG_MODULE, "looping for include[%d:%p]",
2N/A pamh->include_depth, (void *)modulep);
2N/A goto include;
2N/A }
2N/A free_pam_conf_info(pamh);
2N/A if (!pamh->pam_eval_called) {
2N/A pamh->pam_inmodule = RW_OK;
2N/A }
2N/A if (required_error != 0)
2N/A return (required_error);
2N/A else if (success != 0)
2N/A return (PAM_SUCCESS);
2N/A else if (optional_error != 0)
2N/A return (optional_error);
2N/A else
2N/A return (def_err);
2N/A
2N/Aexit_return:
2N/A /*
2N/A * All done at whatever depth we're at.
2N/A * Go back to not having read /etc/pam.conf
2N/A */
2N/A while ((pamh->pam_eval_called &&
2N/A pamh->include_depth > pamh->saved_include_depth) ||
2N/A (!pamh->pam_eval_called && pamh->include_depth > 0)) {
2N/A free_pam_conf_info(pamh);
2N/A pamh->include_depth--;
2N/A }
2N/A free_pam_conf_info(pamh);
2N/A if (!pamh->pam_eval_called) {
2N/A pamh->pam_inmodule = RW_OK;
2N/A }
2N/A return (err);
2N/A}
2N/A
2N/A/*
2N/A * pam_authenticate - authenticate a user
2N/A */
2N/A
2N/Aint
2N/Apam_authenticate(pam_handle_t *pamh, int flags)
2N/A{
2N/A int retval;
2N/A
2N/A retval = run_stack(pamh, NULL, flags, PAM_AUTH_MODULE,
2N/A PAM_AUTH_ERR, PAM_AUTHENTICATE, "pam_authenticate");
2N/A
2N/A if (retval != PAM_SUCCESS)
2N/A (void) pam_set_item(pamh, PAM_AUTHTOK, NULL);
2N/A return (retval);
2N/A}
2N/A
2N/A/*
2N/A * pam_setcred - modify or retrieve user credentials
2N/A */
2N/A
2N/Aint
2N/Apam_setcred(pam_handle_t *pamh, int flags)
2N/A{
2N/A int retval;
2N/A
2N/A retval = run_stack(pamh, NULL, flags, PAM_AUTH_MODULE,
2N/A PAM_CRED_ERR, PAM_SETCRED, "pam_setcred");
2N/A
2N/A if (retval != PAM_SUCCESS)
2N/A (void) pam_set_item(pamh, PAM_AUTHTOK, NULL);
2N/A return (retval);
2N/A}
2N/A
2N/A/*
2N/A * pam_acct_mgmt - check password aging, account expiration
2N/A */
2N/A
2N/Aint
2N/Apam_acct_mgmt(pam_handle_t *pamh, int flags)
2N/A{
2N/A int retval;
2N/A
2N/A retval = run_stack(pamh, NULL, flags, PAM_ACCOUNT_MODULE,
2N/A PAM_ACCT_EXPIRED, PAM_ACCT_MGMT, "pam_acct_mgmt");
2N/A
2N/A if (retval != PAM_SUCCESS &&
2N/A retval != PAM_NEW_AUTHTOK_REQD) {
2N/A (void) pam_set_item(pamh, PAM_AUTHTOK, NULL);
2N/A }
2N/A return (retval);
2N/A}
2N/A
2N/A/*
2N/A * pam_open_session - begin session management
2N/A */
2N/A
2N/Aint
2N/Apam_open_session(pam_handle_t *pamh, int flags)
2N/A{
2N/A int retval;
2N/A
2N/A retval = run_stack(pamh, NULL, flags, PAM_SESSION_MODULE,
2N/A PAM_SESSION_ERR, PAM_OPEN_SESSION, "pam_open_session");
2N/A
2N/A if (retval != PAM_SUCCESS)
2N/A (void) pam_set_item(pamh, PAM_AUTHTOK, NULL);
2N/A return (retval);
2N/A}
2N/A
2N/A/*
2N/A * pam_close_session - terminate session management
2N/A */
2N/A
2N/Aint
2N/Apam_close_session(pam_handle_t *pamh, int flags)
2N/A{
2N/A int retval;
2N/A
2N/A retval = run_stack(pamh, NULL, flags, PAM_SESSION_MODULE,
2N/A PAM_SESSION_ERR, PAM_CLOSE_SESSION, "pam_close_session");
2N/A
2N/A if (retval != PAM_SUCCESS)
2N/A (void) pam_set_item(pamh, PAM_AUTHTOK, NULL);
2N/A return (retval);
2N/A}
2N/A
2N/A/*
2N/A * pam_chauthtok - change user authentication token
2N/A */
2N/A
2N/Aint
2N/Apam_chauthtok(pam_handle_t *pamh, int flags)
2N/A{
2N/A int retval;
2N/A
2N/A /* do not let apps use PAM_PRELIM_CHECK or PAM_UPDATE_AUTHTOK */
2N/A if (flags & (PAM_PRELIM_CHECK | PAM_UPDATE_AUTHTOK)) {
2N/A pam_trace(PAM_DEBUG_DEFAULT,
2N/A "pam_chauthtok(%p, %x): %s", (void *)pamh, flags,
2N/A pam_strerror(pamh, PAM_SYMBOL_ERR));
2N/A return (PAM_SYMBOL_ERR);
2N/A }
2N/A
2N/A /* 1st pass: PRELIM CHECK */
2N/A retval = run_stack(pamh, NULL, flags | PAM_PRELIM_CHECK,
2N/A PAM_PASSWORD_MODULE, PAM_AUTHTOK_ERR, PAM_CHAUTHTOK,
2N/A "pam_chauthtok-prelim");
2N/A
2N/A if (retval == PAM_TRY_AGAIN)
2N/A return (retval);
2N/A
2N/A if (retval != PAM_SUCCESS) {
2N/A (void) pam_set_item(pamh, PAM_AUTHTOK, NULL);
2N/A return (retval);
2N/A }
2N/A
2N/A /* 2nd pass: UPDATE AUTHTOK */
2N/A retval = run_stack(pamh, NULL, flags | PAM_UPDATE_AUTHTOK,
2N/A PAM_PASSWORD_MODULE, PAM_AUTHTOK_ERR, PAM_CHAUTHTOK,
2N/A "pam_chauthtok-update");
2N/A
2N/A if (retval != PAM_SUCCESS)
2N/A (void) pam_set_item(pamh, PAM_AUTHTOK, NULL);
2N/A
2N/A return (retval);
2N/A}
2N/A
2N/A/*
2N/A * pam_putenv - add an environment variable to the PAM handle
2N/A * if name_value == 'NAME=VALUE' then set variable to the value
2N/A * if name_value == 'NAME=' then set variable to an empty value
2N/A * if name_value == 'NAME' then delete the variable
2N/A */
2N/A
2N/Aint
2N/Apam_putenv(pam_handle_t *pamh, const char *name_value)
2N/A{
2N/A int error = PAM_SYSTEM_ERR;
2N/A char *equal_sign = 0;
2N/A char *name = NULL, *value = NULL, *tmp_value = NULL;
2N/A env_list *traverse, *trail;
2N/A
2N/A pam_trace(PAM_DEBUG_DEFAULT,
2N/A "pam_putenv(%p, %s)", (void *)pamh,
2N/A name_value ? name_value : "NULL");
2N/A
2N/A if (pamh == NULL || name_value == NULL)
2N/A goto out;
2N/A
2N/A /* see if we were passed 'NAME=VALUE', 'NAME=', or 'NAME' */
2N/A if ((equal_sign = strchr(name_value, '=')) != 0) {
2N/A if ((name = calloc(equal_sign - name_value + 1,
2N/A sizeof (char))) == 0) {
2N/A error = PAM_BUF_ERR;
2N/A goto out;
2N/A }
2N/A (void) strncpy(name, name_value, equal_sign - name_value);
2N/A if ((value = strdup(++equal_sign)) == 0) {
2N/A error = PAM_BUF_ERR;
2N/A goto out;
2N/A }
2N/A } else {
2N/A if ((name = strdup(name_value)) == 0) {
2N/A error = PAM_BUF_ERR;
2N/A goto out;
2N/A }
2N/A }
2N/A
2N/A /* check to see if we already have this variable in the PAM handle */
2N/A traverse = pamh->pam_env;
2N/A trail = traverse;
2N/A while (traverse && strncmp(traverse->name, name, strlen(name))) {
2N/A trail = traverse;
2N/A traverse = traverse->next;
2N/A }
2N/A
2N/A if (traverse) {
2N/A /* found a match */
2N/A if (value == 0) {
2N/A /* remove the env variable */
2N/A if (pamh->pam_env == traverse)
2N/A pamh->pam_env = traverse->next;
2N/A else
2N/A trail->next = traverse->next;
2N/A free_env(traverse);
2N/A } else if (strlen(value) == 0) {
2N/A /* set env variable to empty value */
2N/A if ((tmp_value = strdup("")) == 0) {
2N/A error = PAM_SYSTEM_ERR;
2N/A goto out;
2N/A }
2N/A free(traverse->value);
2N/A traverse->value = tmp_value;
2N/A } else {
2N/A /* set the new value */
2N/A if ((tmp_value = strdup(value)) == 0) {
2N/A error = PAM_SYSTEM_ERR;
2N/A goto out;
2N/A }
2N/A free(traverse->value);
2N/A traverse->value = tmp_value;
2N/A }
2N/A
2N/A } else if (traverse == 0 && value) {
2N/A /*
2N/A * could not find a match in the PAM handle.
2N/A * add the new value if there is one
2N/A */
2N/A if ((traverse = calloc(1, sizeof (env_list))) == 0) {
2N/A error = PAM_BUF_ERR;
2N/A goto out;
2N/A }
2N/A if ((traverse->name = strdup(name)) == 0) {
2N/A free_env(traverse);
2N/A error = PAM_BUF_ERR;
2N/A goto out;
2N/A }
2N/A if ((traverse->value = strdup(value)) == 0) {
2N/A free_env(traverse);
2N/A error = PAM_BUF_ERR;
2N/A goto out;
2N/A }
2N/A if (trail == 0) {
2N/A /* new head of list */
2N/A pamh->pam_env = traverse;
2N/A } else {
2N/A /* adding to end of list */
2N/A trail->next = traverse;
2N/A }
2N/A }
2N/A
2N/A error = PAM_SUCCESS;
2N/Aout:
2N/A if (error != PAM_SUCCESS) {
2N/A if (traverse) {
2N/A if (traverse->name)
2N/A free(traverse->name);
2N/A if (traverse->value)
2N/A free(traverse->value);
2N/A free(traverse);
2N/A }
2N/A }
2N/A if (name)
2N/A free(name);
2N/A if (value)
2N/A free(value);
2N/A return (error);
2N/A}
2N/A
2N/A/*
2N/A * pam_getenv - retrieve an environment variable from the PAM handle
2N/A */
2N/Achar *
2N/Apam_getenv(pam_handle_t *pamh, const char *name)
2N/A{
2N/A int error = PAM_SYSTEM_ERR;
2N/A env_list *traverse;
2N/A
2N/A pam_trace(PAM_DEBUG_DEFAULT,
2N/A "pam_getenv(%p, %p)", (void *)pamh, (void *)name);
2N/A
2N/A if (pamh == NULL || name == NULL)
2N/A goto out;
2N/A
2N/A /* check to see if we already have this variable in the PAM handle */
2N/A traverse = pamh->pam_env;
2N/A while (traverse && strncmp(traverse->name, name, strlen(name))) {
2N/A traverse = traverse->next;
2N/A }
2N/A error = (traverse ? PAM_SUCCESS : PAM_SYSTEM_ERR);
2N/A pam_trace(PAM_DEBUG_DEFAULT,
2N/A "pam_getenv(%p, %s)=%s", (void *)pamh, name,
2N/A traverse ? traverse->value : "NULL");
2N/Aout:
2N/A return (error ? NULL : strdup(traverse->value));
2N/A}
2N/A
2N/A/*
2N/A * pam_getenvlist - retrieve all environment variables from the PAM handle
2N/A * in a NULL terminated array. On error, return NULL.
2N/A */
2N/Achar **
2N/Apam_getenvlist(pam_handle_t *pamh)
2N/A{
2N/A int error = PAM_SYSTEM_ERR;
2N/A char **list = 0;
2N/A int length = 0;
2N/A env_list *traverse;
2N/A char *tenv;
2N/A size_t tenv_size;
2N/A
2N/A pam_trace(PAM_DEBUG_DEFAULT,
2N/A "pam_getenvlist(%p)", (void *)pamh);
2N/A
2N/A if (pamh == NULL)
2N/A goto out;
2N/A
2N/A /* find out how many environment variables we have */
2N/A traverse = pamh->pam_env;
2N/A while (traverse) {
2N/A length++;
2N/A traverse = traverse->next;
2N/A }
2N/A
2N/A /* allocate the array we will return to the caller */
2N/A if ((list = calloc(length + 1, sizeof (char *))) == NULL) {
2N/A error = PAM_BUF_ERR;
2N/A goto out;
2N/A }
2N/A
2N/A /* add the variables one by one */
2N/A length = 0;
2N/A traverse = pamh->pam_env;
2N/A while (traverse != NULL) {
2N/A tenv_size = strlen(traverse->name) +
2N/A strlen(traverse->value) + 2; /* name=val\0 */
2N/A if ((tenv = malloc(tenv_size)) == NULL) {
2N/A error = PAM_BUF_ERR;
2N/A goto out;
2N/A }
2N/A /*LINTED*/
2N/A (void) sprintf(tenv, "%s=%s", traverse->name, traverse->value);
2N/A list[length++] = tenv;
2N/A traverse = traverse->next;
2N/A }
2N/A list[length] = NULL;
2N/A
2N/A error = PAM_SUCCESS;
2N/Aout:
2N/A if (error != PAM_SUCCESS) {
2N/A /* free the partially constructed list */
2N/A if (list) {
2N/A length = 0;
2N/A while (list[length] != NULL) {
2N/A free(list[length]);
2N/A length++;
2N/A }
2N/A free(list);
2N/A }
2N/A }
2N/A return (error ? NULL : list);
2N/A}
2N/A
2N/Aint
2N/Apam_eval(pam_handle_t *pamh, const char *conf_path)
2N/A{
2N/A int retval;
2N/A int fd;
2N/A
2N/A /* a missing pam.conf-formatted file or an empty path is an error */
2N/A if (conf_path == NULL || *conf_path == '\0') {
2N/A __pam_log(LOG_AUTH | LOG_ERR, "pam_eval() called with "
2N/A "an empty or missing path");
2N/A return (PAM_SYSTEM_ERR);
2N/A }
2N/A
2N/A /*
2N/A * pam_eval() can only be called by PAM service provider (pam_sm_*)
2N/A * routines (viz. from a module context).
2N/A */
2N/A if (pamh->pam_inmodule != WO_OK) {
2N/A __pam_log(LOG_AUTH | LOG_ERR, "pam_eval() called from "
2N/A "a non module context");
2N/A return (PAM_PERM_DENIED);
2N/A }
2N/A
2N/A /*
2N/A * It doesn't make sense for pam_eval() to be called more than
2N/A * once in a single transaction so any attempts to do so are denied.
2N/A */
2N/A if (pamh->pam_eval_called) {
2N/A __pam_log(LOG_AUTH | LOG_ERR,
2N/A "pam_eval(): nested pam_user_policy(5) modules aren't "
2N/A "valid. pam_user_policy(5) referenced a second time in: "
2N/A "%s", conf_path);
2N/A return (PAM_SYSTEM_ERR);
2N/A }
2N/A
2N/A /*
2N/A * The pathname argument to pam_eval(3PAM), which points to a
2N/A * pam.conf(4)-formatted 'pam_policy' file, must be an absolute
2N/A * pathname. pam_user_policy(5) qualifies the pathnames it
2N/A * processes by prepending PAM_POLICY_DIR
2N/A * (/etc/security/pam_policy) to regular filenames.
2N/A */
2N/A if (*conf_path != '/') {
2N/A __pam_log(LOG_AUTH | LOG_ERR,
2N/A "pam_eval() invalid path supplied: %s", conf_path);
2N/A return (PAM_SYSTEM_ERR);
2N/A }
2N/A
2N/A /*
2N/A * Verify the PAM configuration file exists. Further stringency
2N/A * checks such as permissions, ownership, size, and contents happen
2N/A * later on. We check that the filename exists here so we can
2N/A * report the precise root cause since open(2) failures in
2N/A * open_pam_conf() aren't syslogged since this is a common
2N/A * occurrence in the /etc/pam.d world where /etc/pam.d/<service>
2N/A * is frequently missing.
2N/A */
2N/A if ((fd = open(conf_path, O_RDONLY)) == -1) {
2N/A __pam_log(LOG_AUTH | LOG_ERR,
2N/A "pam_eval() PAM configuration file '%s' does not exist",
2N/A conf_path);
2N/A return (PAM_SYSTEM_ERR);
2N/A }
2N/A (void) close(fd);
2N/A
2N/A pamh->include_depth++;
2N/A /*
2N/A * Inside run_stack() further include directives may be processed
2N/A * so set a marker here so that we only "pop" includes added after
2N/A * this call to pam_eval() and not any includes added before.
2N/A */
2N/A pamh->saved_include_depth = pamh->include_depth;
2N/A pamh->pam_eval_called = B_TRUE;
2N/A retval = run_stack(pamh, conf_path, pamh->flags, pamh->type,
2N/A pamh->def_err, pamh->ind, pamh->function_name);
2N/A pamh->pam_eval_called = B_FALSE;
2N/A pamh->include_depth--;
2N/A
2N/A return (retval);
2N/A}
2N/A
2N/A/*
2N/A * Routines to load a requested module on demand
2N/A */
2N/A
2N/A/*
2N/A * load_modules - load the requested module.
2N/A * if the dlopen or dlsym fail, then
2N/A * the module is ignored.
2N/A */
2N/A
2N/Astatic int
2N/Aload_modules(pam_handle_t *pamh, int type, char *function_name,
2N/A pamtab_t *pam_entry)
2N/A{
2N/A void *mh;
2N/A struct auth_module *authp;
2N/A struct account_module *accountp;
2N/A struct session_module *sessionp;
2N/A struct password_module *passwdp;
2N/A int loading_functions = 0; /* are we currently loading functions? */
2N/A
2N/A pam_trace(PAM_DEBUG_MODULE, "load_modules[%d:%s](%p, %s)=%s:%s",
2N/A pamh->include_depth, pam_trace_cname(pamh), (void *)pamh,
2N/A function_name, pam_trace_fname(pam_entry->pam_flag),
2N/A pam_entry->module_path);
2N/A
2N/A while (pam_entry != NULL) {
2N/A pam_trace(PAM_DEBUG_DEFAULT,
2N/A "while load_modules[%d:%s](%p, %s)=%s",
2N/A pamh->include_depth, pam_trace_cname(pamh), (void *)pamh,
2N/A function_name, pam_entry->module_path);
2N/A
2N/A if (pam_entry->pam_flag & PAM_INCLUDE) {
2N/A pam_trace(PAM_DEBUG_DEFAULT,
2N/A "done load_modules[%d:%s](%p, %s)=%s",
2N/A pamh->include_depth, pam_trace_cname(pamh),
2N/A (void *)pamh, function_name,
2N/A pam_entry->module_path);
2N/A return (PAM_SUCCESS);
2N/A }
2N/A switch (type) {
2N/A case PAM_AUTH_MODULE:
2N/A
2N/A /* if the function has already been loaded, return */
2N/A authp = pam_entry->function_ptr;
2N/A if (!loading_functions &&
2N/A (((strcmp(function_name, PAM_SM_AUTHENTICATE)
2N/A == 0) && authp && authp->pam_sm_authenticate) ||
2N/A ((strcmp(function_name, PAM_SM_SETCRED) == 0) &&
2N/A authp && authp->pam_sm_setcred))) {
2N/A return (PAM_SUCCESS);
2N/A }
2N/A
2N/A /* function has not been loaded yet */
2N/A loading_functions = 1;
2N/A if (authp == NULL) {
2N/A authp = calloc(1, sizeof (struct auth_module));
2N/A if (authp == NULL)
2N/A return (PAM_BUF_ERR);
2N/A }
2N/A
2N/A /* if open_module fails, return error */
2N/A if ((mh = open_module(pamh,
2N/A pam_entry->module_path)) == NULL) {
2N/A __pam_log(LOG_AUTH | LOG_ERR,
2N/A "load_modules[%d:%s]: can not open module "
2N/A "%s", pamh->include_depth,
2N/A pam_trace_cname(pamh),
2N/A pam_entry->module_path);
2N/A free(authp);
2N/A return (PAM_OPEN_ERR);
2N/A }
2N/A
2N/A /* load the authentication function */
2N/A if (strcmp(function_name, PAM_SM_AUTHENTICATE) == 0) {
2N/A if (load_function(mh, PAM_SM_AUTHENTICATE,
2N/A &authp->pam_sm_authenticate)
2N/A != PAM_SUCCESS) {
2N/A /* return error if dlsym fails */
2N/A free(authp);
2N/A return (PAM_SYMBOL_ERR);
2N/A }
2N/A
2N/A /* load the setcred function */
2N/A } else if (strcmp(function_name, PAM_SM_SETCRED) == 0) {
2N/A if (load_function(mh, PAM_SM_SETCRED,
2N/A &authp->pam_sm_setcred) != PAM_SUCCESS) {
2N/A /* return error if dlsym fails */
2N/A free(authp);
2N/A return (PAM_SYMBOL_ERR);
2N/A }
2N/A }
2N/A pam_entry->function_ptr = authp;
2N/A break;
2N/A case PAM_ACCOUNT_MODULE:
2N/A accountp = pam_entry->function_ptr;
2N/A if (!loading_functions &&
2N/A (strcmp(function_name, PAM_SM_ACCT_MGMT) == 0) &&
2N/A accountp && accountp->pam_sm_acct_mgmt) {
2N/A return (PAM_SUCCESS);
2N/A }
2N/A
2N/A /*
2N/A * If functions are added to the account module,
2N/A * verify that one of the other functions hasn't
2N/A * already loaded it. See PAM_AUTH_MODULE code.
2N/A */
2N/A loading_functions = 1;
2N/A accountp = calloc(1, sizeof (struct account_module));
2N/A if (accountp == NULL)
2N/A return (PAM_BUF_ERR);
2N/A
2N/A /* if open_module fails, return error */
2N/A if ((mh = open_module(pamh,
2N/A pam_entry->module_path)) == NULL) {
2N/A __pam_log(LOG_AUTH | LOG_ERR,
2N/A "load_modules[%d:%s]: can not open module "
2N/A "%s", pamh->include_depth,
2N/A pam_trace_cname(pamh),
2N/A pam_entry->module_path);
2N/A free(accountp);
2N/A return (PAM_OPEN_ERR);
2N/A }
2N/A
2N/A if (load_function(mh, PAM_SM_ACCT_MGMT,
2N/A &accountp->pam_sm_acct_mgmt) != PAM_SUCCESS) {
2N/A __pam_log(LOG_AUTH | LOG_ERR,
2N/A "load_modules[%d:%s]: pam_sm_acct_mgmt() "
2N/A "missing", pamh->include_depth,
2N/A pam_trace_cname(pamh));
2N/A free(accountp);
2N/A return (PAM_SYMBOL_ERR);
2N/A }
2N/A pam_entry->function_ptr = accountp;
2N/A break;
2N/A case PAM_SESSION_MODULE:
2N/A sessionp = pam_entry->function_ptr;
2N/A if (!loading_functions &&
2N/A (((strcmp(function_name,
2N/A PAM_SM_OPEN_SESSION) == 0) &&
2N/A sessionp && sessionp->pam_sm_open_session) ||
2N/A ((strcmp(function_name,
2N/A PAM_SM_CLOSE_SESSION) == 0) &&
2N/A sessionp && sessionp->pam_sm_close_session))) {
2N/A return (PAM_SUCCESS);
2N/A }
2N/A
2N/A loading_functions = 1;
2N/A if (sessionp == NULL) {
2N/A sessionp = calloc(1,
2N/A sizeof (struct session_module));
2N/A if (sessionp == NULL)
2N/A return (PAM_BUF_ERR);
2N/A }
2N/A
2N/A /* if open_module fails, return error */
2N/A if ((mh = open_module(pamh,
2N/A pam_entry->module_path)) == NULL) {
2N/A __pam_log(LOG_AUTH | LOG_ERR,
2N/A "load_modules[%d:%s]: can not open module "
2N/A "%s", pamh->include_depth,
2N/A pam_trace_cname(pamh),
2N/A pam_entry->module_path);
2N/A free(sessionp);
2N/A return (PAM_OPEN_ERR);
2N/A }
2N/A
2N/A if ((strcmp(function_name, PAM_SM_OPEN_SESSION) == 0) &&
2N/A load_function(mh, PAM_SM_OPEN_SESSION,
2N/A &sessionp->pam_sm_open_session) != PAM_SUCCESS) {
2N/A free(sessionp);
2N/A return (PAM_SYMBOL_ERR);
2N/A } else if ((strcmp(function_name,
2N/A PAM_SM_CLOSE_SESSION) == 0) &&
2N/A load_function(mh, PAM_SM_CLOSE_SESSION,
2N/A &sessionp->pam_sm_close_session) != PAM_SUCCESS) {
2N/A free(sessionp);
2N/A return (PAM_SYMBOL_ERR);
2N/A }
2N/A pam_entry->function_ptr = sessionp;
2N/A break;
2N/A case PAM_PASSWORD_MODULE:
2N/A passwdp = pam_entry->function_ptr;
2N/A if (!loading_functions &&
2N/A (strcmp(function_name, PAM_SM_CHAUTHTOK) == 0) &&
2N/A passwdp && passwdp->pam_sm_chauthtok) {
2N/A return (PAM_SUCCESS);
2N/A }
2N/A
2N/A /*
2N/A * If functions are added to the password module,
2N/A * verify that one of the other functions hasn't
2N/A * already loaded it. See PAM_AUTH_MODULE code.
2N/A */
2N/A loading_functions = 1;
2N/A passwdp = calloc(1, sizeof (struct password_module));
2N/A if (passwdp == NULL)
2N/A return (PAM_BUF_ERR);
2N/A
2N/A /* if open_module fails, continue */
2N/A if ((mh = open_module(pamh,
2N/A pam_entry->module_path)) == NULL) {
2N/A __pam_log(LOG_AUTH | LOG_ERR,
2N/A "load_modules[%d:%s]: can not open module "
2N/A "%s", pamh->include_depth,
2N/A pam_trace_cname(pamh),
2N/A pam_entry->module_path);
2N/A free(passwdp);
2N/A return (PAM_OPEN_ERR);
2N/A }
2N/A
2N/A if (load_function(mh, PAM_SM_CHAUTHTOK,
2N/A &passwdp->pam_sm_chauthtok) != PAM_SUCCESS) {
2N/A free(passwdp);
2N/A return (PAM_SYMBOL_ERR);
2N/A }
2N/A pam_entry->function_ptr = passwdp;
2N/A break;
2N/A default:
2N/A pam_trace(PAM_DEBUG_DEFAULT,
2N/A "load_modules[%d:%s](%p, %s): unsupported type %d",
2N/A pamh->include_depth, pam_trace_cname(pamh),
2N/A (void *)pamh, function_name, type);
2N/A break;
2N/A }
2N/A
2N/A pam_entry = pam_entry->next;
2N/A } /* while */
2N/A
2N/A pam_trace(PAM_DEBUG_MODULE, "load_modules[%d:%s](%p, %s)=done",
2N/A pamh->include_depth, pam_trace_cname(pamh), (void *)pamh,
2N/A function_name);
2N/A
2N/A return (PAM_SUCCESS);
2N/A}
2N/A
2N/A/*
2N/A * open_module - Open the module first checking for
2N/A * propers modes and ownerships on the file.
2N/A */
2N/A
2N/Astatic void *
2N/Aopen_module(pam_handle_t *pamh, char *module_so)
2N/A{
2N/A struct stat64 stb;
2N/A char *errmsg;
2N/A void *lfd;
2N/A fd_list *module_fds = 0;
2N/A fd_list *trail = 0;
2N/A fd_list *traverse = 0;
2N/A
2N/A /* Check the ownership and file modes */
2N/A if (stat64(module_so, &stb) < 0) {
2N/A __pam_log(LOG_AUTH | LOG_ERR,
2N/A "open_module[%d:%s]: stat(%s) failed: %s",
2N/A pamh->include_depth, pam_trace_cname(pamh), module_so,
2N/A strerror(errno));
2N/A return (NULL);
2N/A }
2N/A if (stb.st_uid != (uid_t)0) {
2N/A __pam_log(LOG_AUTH | LOG_ALERT,
2N/A "open_module[%d:%s]: Owner of the module %s is not root",
2N/A pamh->include_depth, pam_trace_cname(pamh), module_so);
2N/A return (NULL);
2N/A }
2N/A if (stb.st_mode & S_IWGRP) {
2N/A __pam_log(LOG_AUTH | LOG_ALERT,
2N/A "open_module[%d:%s]: module %s writable by group",
2N/A pamh->include_depth, pam_trace_cname(pamh), module_so);
2N/A return (NULL);
2N/A }
2N/A if (stb.st_mode & S_IWOTH) {
2N/A __pam_log(LOG_AUTH | LOG_ALERT,
2N/A "open_module[%d:%s]: module %s writable by world",
2N/A pamh->include_depth, pam_trace_cname(pamh), module_so);
2N/A return (NULL);
2N/A }
2N/A
2N/A /*
2N/A * Perform the dlopen()
2N/A */
2N/A lfd = (void *)dlopen(module_so, RTLD_LAZY);
2N/A
2N/A if (lfd == NULL) {
2N/A errmsg = dlerror();
2N/A __pam_log(LOG_AUTH | LOG_ERR, "open_module[%d:%s]: %s "
2N/A "failed: %s", pamh->include_depth, pam_trace_cname(pamh),
2N/A module_so, errmsg != NULL ? errmsg : "Unknown error");
2N/A return (NULL);
2N/A } else {
2N/A /* add this fd to the pam handle */
2N/A if ((module_fds = calloc(1, sizeof (fd_list))) == 0) {
2N/A (void) dlclose(lfd);
2N/A lfd = 0;
2N/A return (NULL);
2N/A }
2N/A module_fds->mh = lfd;
2N/A
2N/A if (pamh->fd == 0) {
2N/A /* adding new head of list */
2N/A pamh->fd = module_fds;
2N/A } else {
2N/A /* appending to end of list */
2N/A traverse = pamh->fd;
2N/A while (traverse) {
2N/A trail = traverse;
2N/A traverse = traverse->next;
2N/A }
2N/A trail->next = module_fds;
2N/A }
2N/A }
2N/A
2N/A return (lfd);
2N/A}
2N/A
2N/A/*
2N/A * load_function - call dlsym() to resolve the function address
2N/A */
2N/Astatic int
2N/Aload_function(void *lfd, char *name, int (**func)())
2N/A{
2N/A char *errmsg = NULL;
2N/A
2N/A if (lfd == NULL)
2N/A return (PAM_SYMBOL_ERR);
2N/A
2N/A *func = (int (*)())dlsym(lfd, name);
2N/A if (*func == NULL) {
2N/A errmsg = dlerror();
2N/A __pam_log(LOG_AUTH | LOG_ERR, "dlsym failed %s: error %s",
2N/A name, errmsg != NULL ? errmsg : "Unknown error");
2N/A return (PAM_SYMBOL_ERR);
2N/A }
2N/A
2N/A pam_trace(PAM_DEBUG_DEFAULT,
2N/A "load_function: successful load of %s", name);
2N/A return (PAM_SUCCESS);
2N/A}
2N/A
2N/A/*
2N/A * Routines to read the pam.conf configuration file
2N/A */
2N/A
2N/A/*
2N/A * open_pam_conf - open the PAM configuration file which may be in
2N/A * either the traditional pam.conf(4) syntax or the per-service
2N/A * /etc/pam.d syntax which is the same as pam.conf(4) except the first
2N/A * field for the 'service' isn't pressent.
2N/A */
2N/A
2N/Astatic int
2N/Aopen_pam_conf(struct pam_fh **pam_fh, pam_handle_t *pamh, const char *config,
2N/A char *service, boolean_t pamdotd)
2N/A{
2N/A struct stat64 stb;
2N/A int fd;
2N/A char pam_config[MAXPATHLEN];
2N/A
2N/A /*
2N/A * When looking up a per-service PAM policy file in /etc/pam.d the
2N/A * 'config' argument to read_pam_conf() is NULL. In such cases, we
2N/A * walk through the /etc/pam.d directory using readdir(3C) to find a
2N/A * case-insensitive match of a pam.d/<service> file to the current
2N/A * service name (the named service is passed in first and if no match
2N/A * is found "other" is passed in as the service name). This is to
2N/A * maintain the same behaviour of pam.conf(4) where service names are
2N/A * case-insensitive.
2N/A */
2N/A if (pamdotd && (config == NULL)) {
2N/A DIR *dirp;
2N/A struct dirent *dp;
2N/A
2N/A if ((dirp = opendir(PAM_D_CONFIG)) == NULL) {
2N/A __pam_log(LOG_AUTH | LOG_ALERT,
2N/A "open_pam_conf[%d:%s/%s]: "
2N/A "couldn't open directory %s: %s",
2N/A pamh->include_depth, PAM_D_CONFIG, service,
2N/A PAM_D_CONFIG, strerror(errno));
2N/A return (0);
2N/A }
2N/A
2N/A while ((dp = readdir(dirp)) != NULL) {
2N/A if (dp->d_name[0] == '.') {
2N/A continue;
2N/A }
2N/A if (strcasecmp(dp->d_name, service) == 0) {
2N/A (void) snprintf(pam_config, MAXPATHLEN,
2N/A "%s/%s", PAM_D_CONFIG, dp->d_name);
2N/A config = pam_config;
2N/A break;
2N/A }
2N/A }
2N/A (void) closedir(dirp);
2N/A
2N/A if (config == NULL) {
2N/A pam_trace(PAM_DEBUG_CONF,
2N/A "open_pam_conf[%d:%s/%s]: failed to find: "
2N/A "%s in %s", pamh->include_depth, PAM_D_CONFIG,
2N/A service, service, PAM_D_CONFIG);
2N/A return (0);
2N/A }
2N/A }
2N/A
2N/A pamh->pam_conf_name[pamh->include_depth] = strdup(config);
2N/A
2N/A if ((fd = open(config, O_RDONLY)) == -1) {
2N/A pam_trace(PAM_DEBUG_CONF,
2N/A "open_pam_conf[%d:%s]: open(%s) failed: %s",
2N/A pamh->include_depth, pam_trace_cname(pamh), config,
2N/A strerror(errno));
2N/A return (0);
2N/A }
2N/A /* Check the ownership and file modes; confirm it's a regular file */
2N/A if (fstat64(fd, &stb) < 0) {
2N/A __pam_log(LOG_AUTH | LOG_ALERT,
2N/A "open_pam_conf[%d:%s]: stat(%s) failed: %s",
2N/A pamh->include_depth, pam_trace_cname(pamh), config,
2N/A strerror(errno));
2N/A (void) close(fd);
2N/A return (0);
2N/A }
2N/A if (!S_ISREG(stb.st_mode)) {
2N/A __pam_log(LOG_AUTH | LOG_ALERT,
2N/A "open_pam_conf[%d:%s]: %s is not a regular file",
2N/A pamh->include_depth, pam_trace_cname(pamh), config);
2N/A (void) close(fd);
2N/A return (0);
2N/A }
2N/A if (stb.st_size == 0) {
2N/A __pam_log(LOG_AUTH | LOG_ALERT,
2N/A "open_pam_conf[%d:%s]: %s has a size of zero",
2N/A pamh->include_depth, pam_trace_cname(pamh), config);
2N/A (void) close(fd);
2N/A return (0);
2N/A }
2N/A if (stb.st_uid != (uid_t)0) {
2N/A __pam_log(LOG_AUTH | LOG_ALERT,
2N/A "open_pam_conf[%d:%s]: Owner of %s is not root",
2N/A pamh->include_depth, pam_trace_cname(pamh), config);
2N/A (void) close(fd);
2N/A return (0);
2N/A }
2N/A if (stb.st_mode & S_IWGRP) {
2N/A __pam_log(LOG_AUTH | LOG_ALERT,
2N/A "open_pam_conf[%d:%s]: %s writable by group",
2N/A pamh->include_depth, pam_trace_cname(pamh), config);
2N/A (void) close(fd);
2N/A return (0);
2N/A }
2N/A if (stb.st_mode & S_IWOTH) {
2N/A __pam_log(LOG_AUTH | LOG_ALERT,
2N/A "open_pam_conf[%d:%s]: %s writable by world",
2N/A pamh->include_depth, pam_trace_cname(pamh), config);
2N/A (void) close(fd);
2N/A return (0);
2N/A }
2N/A if ((*pam_fh = calloc(1, sizeof (struct pam_fh))) == NULL) {
2N/A (void) close(fd);
2N/A return (0);
2N/A }
2N/A (*pam_fh)->fconfig = fd;
2N/A (*pam_fh)->bufsize = (size_t)stb.st_size;
2N/A if (((*pam_fh)->data = mmap(0, (*pam_fh)->bufsize, PROT_READ,
2N/A MAP_PRIVATE, (*pam_fh)->fconfig, 0)) == MAP_FAILED) {
2N/A (void) close(fd);
2N/A free (*pam_fh);
2N/A return (0);
2N/A }
2N/A (*pam_fh)->bufferp = (*pam_fh)->data;
2N/A
2N/A return (1);
2N/A}
2N/A
2N/A/*
2N/A * close_pam_conf - close pam.conf
2N/A */
2N/A
2N/Astatic void
2N/Aclose_pam_conf(struct pam_fh *pam_fh)
2N/A{
2N/A (void) munmap(pam_fh->data, pam_fh->bufsize);
2N/A (void) close(pam_fh->fconfig);
2N/A free(pam_fh);
2N/A}
2N/A
2N/A/*
2N/A * read_pam_entries - read PAM entries from either pam.conf(4) and/or the
2N/A * per-service files in /etc/pam.d.
2N/A */
2N/Astatic int
2N/Aread_pam_entries(pam_handle_t *pamh, const char *pam_config, char *service,
2N/A int type)
2N/A{
2N/A /*
2N/A * default run_stack() scenario, no pam_eval(3PAM) or 'include'
2N/A * directives involved. The search order is as follows:
2N/A * /etc/pam.conf for the named PAM service
2N/A * /etc/pam.d/<service> for the named PAM service
2N/A * /etc/pam.conf for the "other" service
2N/A * /etc/pam.d/other
2N/A * which retains backwards compatbility with pam.conf(4) and
2N/A * also allows per-service /etc/pam.d/ files to work as well.
2N/A */
2N/A if (pam_config == NULL) {
2N/A if (read_pam_conf(pamh, PAM_CONFIG, service, type,
2N/A B_FALSE) != PAM_SUCCESS) {
2N/A if (read_pam_conf(pamh, NULL, service, type,
2N/A B_TRUE) != PAM_SUCCESS) {
2N/A if (read_pam_conf(pamh, PAM_CONFIG, "other",
2N/A type, B_FALSE) != PAM_SUCCESS) {
2N/A return (read_pam_conf(pamh, NULL,
2N/A "other", type, B_TRUE));
2N/A }
2N/A }
2N/A }
2N/A } else {
2N/A /*
2N/A * A specific PAM configuration file is being processed due to
2N/A * either pam_eval(3PAM) or an 'include' directive. The
2N/A * included file could have either the pam.conf(4) syntax with
2N/A * the 'service' name present or the per-service /etc/pam.d
2N/A * syntax with the 'service' name omitted. Thus we look for
2N/A * PAM entries for the specified service and the 'other'
2N/A * service using both formats.
2N/A */
2N/A if (read_pam_conf(pamh, pam_config, service, type,
2N/A B_FALSE) != PAM_SUCCESS) {
2N/A if (read_pam_conf(pamh, pam_config, "other", type,
2N/A B_FALSE) != PAM_SUCCESS) {
2N/A if (read_pam_conf(pamh, pam_config, service,
2N/A type, B_TRUE) != PAM_SUCCESS) {
2N/A return (read_pam_conf(pamh, pam_config,
2N/A "other", type, B_TRUE));
2N/A }
2N/A }
2N/A }
2N/A }
2N/A
2N/A return (PAM_SUCCESS);
2N/A}
2N/A
2N/A/*
2N/A * read_pam_conf - read in each entry in pam.conf and store info
2N/A * under the pam handle.
2N/A */
2N/Astatic int
2N/Aread_pam_conf(pam_handle_t *pamh, const char *config, char *service, int type,
2N/A boolean_t pamdotd)
2N/A{
2N/A struct pam_fh *pam_fh;
2N/A pamtab_t *pamentp;
2N/A pamtab_t *tpament;
2N/A int error;
2N/A int i = pamh->include_depth; /* include depth */
2N/A /*
2N/A * service types:
2N/A * error (-1), "auth" (0), "account" (1), "session" (2), "password" (3)
2N/A */
2N/A int service_found[PAM_NUM_MODULE_TYPES+1] = {0, 0, 0, 0, 0};
2N/A
2N/A pam_trace(PAM_DEBUG_CONF, "read_pam_conf[%d:%s](%p) entry open(%s) "
2N/A "service = %s pam.d = %d", i, pam_trace_cname(pamh), (void *)pamh,
2N/A config ? config : "/etc/pam.d/<service>", service, pamdotd);
2N/A if (open_pam_conf(&pam_fh, pamh, config, service, pamdotd) == 0) {
2N/A free(pamh->pam_conf_name[i]);
2N/A pamh->pam_conf_name[i] = NULL;
2N/A return (PAM_SYSTEM_ERR);
2N/A }
2N/A
2N/A while ((error = get_pam_conf_entry(pam_fh, pamh, &pamentp, service,
2N/A pamdotd, i)) == PAM_SUCCESS &&
2N/A pamentp) {
2N/A
2N/A /* See if entry is this service and valid */
2N/A if (verify_pam_conf(pamentp, service)) {
2N/A pam_trace(PAM_DEBUG_CONF,
2N/A "read_pam_conf[%d:%s](%p): bad entry error %s",
2N/A i, pam_trace_cname(pamh), (void *)pamh, service);
2N/A
2N/A error = PAM_SYSTEM_ERR;
2N/A free_pamconf(pamentp);
2N/A goto out;
2N/A }
2N/A if (strcasecmp(pamentp->pam_service, service) == 0) {
2N/A pam_trace(PAM_DEBUG_CONF,
2N/A "read_pam_conf[%d:%s](%p): processing %s",
2N/A i, pam_trace_cname(pamh), (void *)pamh, service);
2N/A /* process first service entry */
2N/A if (service_found[pamentp->pam_type + 1] == 0) {
2N/A /* purge "other" entries */
2N/A while ((tpament = pamh->pam_conf_info[i]
2N/A [pamentp->pam_type]) != NULL) {
2N/A pam_trace(PAM_DEBUG_CONF,
2N/A "read_pam_conf(%p): purging "
2N/A "\"other\"[%d:%s][%s]",
2N/A (void *)pamh, i,
2N/A pam_trace_cname(pamh),
2N/A pam_snames[pamentp->pam_type]);
2N/A pamh->pam_conf_info[i]
2N/A [pamentp->pam_type] = tpament->next;
2N/A free_pamconf(tpament);
2N/A }
2N/A /* add first service entry */
2N/A pam_trace(PAM_DEBUG_CONF,
2N/A "read_pam_conf(%p): adding 1st "
2N/A "%s[%d:%s][%s]",
2N/A (void *)pamh, service, i,
2N/A pam_trace_cname(pamh),
2N/A pam_snames[pamentp->pam_type]);
2N/A pamh->pam_conf_info[i][pamentp->pam_type] =
2N/A pamentp;
2N/A service_found[pamentp->pam_type + 1] = 1;
2N/A } else {
2N/A /* append more service entries */
2N/A pam_trace(PAM_DEBUG_CONF,
2N/A "read_pam_conf(%p): adding more "
2N/A "%s[%d:%s][%s]",
2N/A (void *)pamh, service, i,
2N/A pam_trace_cname(pamh),
2N/A pam_snames[pamentp->pam_type]);
2N/A tpament =
2N/A pamh->pam_conf_info[i][pamentp->pam_type];
2N/A while (tpament->next != NULL) {
2N/A tpament = tpament->next;
2N/A }
2N/A tpament->next = pamentp;
2N/A }
2N/A } else {
2N/A /* irrelevant entry */
2N/A free_pamconf(pamentp);
2N/A }
2N/A }
2N/A
2N/Aout:
2N/A /* no entry found for the specified service module type */
2N/A if (pamh->pam_conf_info[i][type] == NULL) {
2N/A error = pamh->pam_eval_called ? PAM_IGNORE : PAM_SYSTEM_ERR;
2N/A }
2N/A
2N/A pam_trace(PAM_DEBUG_CONF, "read_pam_conf[%d:%s](%p) return open(%s) "
2N/A "service = %s type = %d pam.d = %d error = %d", i,
2N/A pam_trace_cname(pamh), (void *)pamh, config ? config :
2N/A "/etc/pam.d/<service>", service, type, pamdotd, error);
2N/A
2N/A (void) close_pam_conf(pam_fh);
2N/A if (error != PAM_SUCCESS)
2N/A free_pam_conf_info(pamh);
2N/A return (error);
2N/A}
2N/A
2N/A/*
2N/A * get_pam_conf_entry - get a pam.conf entry
2N/A */
2N/A
2N/Astatic int
2N/Aget_pam_conf_entry(struct pam_fh *pam_fh, pam_handle_t *pamh, pamtab_t **pam,
2N/A char *service, boolean_t skip_service, int include_depth)
2N/A{
2N/A char *cp, *arg;
2N/A int argc;
2N/A char *tmp, *tmp_free;
2N/A int i;
2N/A char *current_line = NULL;
2N/A int error = PAM_SYSTEM_ERR; /* preset to error */
2N/A int err;
2N/A
2N/A /* get the next line from pam.conf */
2N/A if ((cp = nextline(pam_fh, pamh, &err)) == NULL) {
2N/A /* no more lines in pam.conf ==> return */
2N/A error = PAM_SUCCESS;
2N/A *pam = NULL;
2N/A goto out;
2N/A }
2N/A
2N/A if ((*pam = calloc(1, sizeof (pamtab_t))) == NULL) {
2N/A __pam_log(LOG_AUTH | LOG_ERR, "strdup: out of memory");
2N/A goto out;
2N/A }
2N/A
2N/A /* copy full line for error reporting */
2N/A if ((current_line = strdup(cp)) == NULL) {
2N/A __pam_log(LOG_AUTH | LOG_ERR, "strdup: out of memory");
2N/A goto out;
2N/A }
2N/A
2N/A pam_trace(PAM_DEBUG_CONF,
2N/A "pam.conf[%s] entry:\t%s", pam_trace_cname(pamh), current_line);
2N/A
2N/A /* get service name (e.g. login, su, passwd) */
2N/A if (!skip_service) {
2N/A if ((arg = read_next_token(&cp)) == 0) {
2N/A __pam_log(LOG_AUTH | LOG_CRIT,
2N/A "illegal pam.conf[%s] entry: %s: "
2N/A "missing SERVICE NAME", pam_trace_cname(pamh),
2N/A current_line);
2N/A goto out;
2N/A }
2N/A
2N/A /*
2N/A * pam_eval(3PAM) and the 'include' directive may reference
2N/A * PAM policy files in either pam.conf(4) format or the
2N/A * per-service format of /etc/pam.d files so both are checked.
2N/A * The pam.conf(4) format is checked first so when looking for
2N/A * pam.conf(4) syntax and no service entry is present stop
2N/A * searching using pam.conf(4) syntax. This avoids syslog'ing
2N/A * lots of errors about invalid/illegal PAM syntax as well.
2N/A */
2N/A if ((include_depth > 0) &&
2N/A ((strcasecmp(arg, PAM_AUTH_NAME) == 0) ||
2N/A (strcasecmp(arg, PAM_ACCOUNT_NAME) == 0) ||
2N/A (strcasecmp(arg, PAM_SESSION_NAME) == 0) ||
2N/A (strcasecmp(arg, PAM_PASSWORD_NAME) == 0))) {
2N/A pam_trace(PAM_DEBUG_CONF,
2N/A "pam.conf[%s] entry: %s: missing SERVICE name",
2N/A pam_trace_cname(pamh), current_line);
2N/A goto out;
2N/A }
2N/A
2N/A if (((*pam)->pam_service = strdup(arg)) == 0) {
2N/A __pam_log(LOG_AUTH | LOG_ERR, "strdup: out of memory");
2N/A goto out;
2N/A }
2N/A } else {
2N/A if (((*pam)->pam_service = strdup(service)) == 0) {
2N/A __pam_log(LOG_AUTH | LOG_ERR, "strdup: out of memory");
2N/A goto out;
2N/A }
2N/A }
2N/A
2N/Agetmodule_type:
2N/A /* get module type (e.g. authentication, acct mgmt) */
2N/A if ((arg = read_next_token(&cp)) == 0) {
2N/A __pam_log(LOG_AUTH | LOG_CRIT,
2N/A "illegal pam.conf[%s] entry: %s: missing MODULE TYPE",
2N/A pam_trace_cname(pamh), current_line);
2N/A (*pam)->pam_type = -1; /* 0 is a valid value */
2N/A goto getflag;
2N/A }
2N/A if (strcasecmp(arg, PAM_AUTH_NAME) == 0) {
2N/A (*pam)->pam_type = PAM_AUTH_MODULE;
2N/A } else if (strcasecmp(arg, PAM_ACCOUNT_NAME) == 0) {
2N/A (*pam)->pam_type = PAM_ACCOUNT_MODULE;
2N/A } else if (strcasecmp(arg, PAM_SESSION_NAME) == 0) {
2N/A (*pam)->pam_type = PAM_SESSION_MODULE;
2N/A } else if (strcasecmp(arg, PAM_PASSWORD_NAME) == 0) {
2N/A (*pam)->pam_type = PAM_PASSWORD_MODULE;
2N/A } else {
2N/A /*
2N/A * If the token read isn't a PAM service module type then it is
2N/A * an error. However since we support both the pam.conf(4)
2N/A * format and the pam.d format for included PAM configs and PAM
2N/A * policy files specified for pam_eval() we handle the case of
2N/A * a partial PAM policy file here in pam.conf syntax but
2N/A * searching using pam.d syntax by skipping the first token
2N/A * which should be the PAM_SERVICE and then continuing with the
2N/A * format verification of the rest of the line.
2N/A */
2N/A if (skip_service && (include_depth > 0)) {
2N/A skip_service = B_FALSE;
2N/A goto getmodule_type;
2N/A } else {
2N/A __pam_log(LOG_AUTH | LOG_CRIT,
2N/A "illegal pam.conf[%s] entry: %s: invalid module "
2N/A "type: %s", pam_trace_cname(pamh), current_line,
2N/A arg);
2N/A (*pam)->pam_type = -1; /* 0 is a valid value */
2N/A }
2N/A }
2N/A
2N/Agetflag:
2N/A /* get pam flag (e.g., requisite, required, sufficient, optional) */
2N/A if ((arg = read_next_token(&cp)) == 0) {
2N/A __pam_log(LOG_AUTH | LOG_CRIT,
2N/A "illegal pam.conf[%s] entry: %s: missing CONTROL FLAG",
2N/A pam_trace_cname(pamh), current_line);
2N/A goto getpath;
2N/A }
2N/A if (strcasecmp(arg, PAM_BINDING_NAME) == 0) {
2N/A (*pam)->pam_flag = PAM_BINDING;
2N/A } else if (strcasecmp(arg, PAM_DEFINITIVE_NAME) == 0) {
2N/A (*pam)->pam_flag = PAM_DEFINITIVE;
2N/A } else if (strcasecmp(arg, PAM_INCLUDE_NAME) == 0) {
2N/A (*pam)->pam_flag = PAM_INCLUDE;
2N/A } else if (strcasecmp(arg, PAM_OPTIONAL_NAME) == 0) {
2N/A (*pam)->pam_flag = PAM_OPTIONAL;
2N/A } else if (strcasecmp(arg, PAM_REQUIRED_NAME) == 0) {
2N/A (*pam)->pam_flag = PAM_REQUIRED;
2N/A } else if (strcasecmp(arg, PAM_REQUISITE_NAME) == 0) {
2N/A (*pam)->pam_flag = PAM_REQUISITE;
2N/A } else if (strcasecmp(arg, PAM_SUFFICIENT_NAME) == 0) {
2N/A (*pam)->pam_flag = PAM_SUFFICIENT;
2N/A } else {
2N/A /* error */
2N/A __pam_log(LOG_AUTH | LOG_CRIT,
2N/A "illegal pam.conf[%s] entry: %s",
2N/A pam_trace_cname(pamh), current_line);
2N/A __pam_log(LOG_AUTH | LOG_CRIT,
2N/A "\tinvalid control flag: %s", arg);
2N/A }
2N/A
2N/Agetpath:
2N/A /* get module path (e.g. /usr/lib/security/pam_unix_auth.so.1) */
2N/A if ((arg = read_next_token(&cp)) == 0) {
2N/A __pam_log(LOG_AUTH | LOG_CRIT,
2N/A "illegal pam.conf[%s] entry: %s: missing MODULE PATH",
2N/A pam_trace_cname(pamh), current_line);
2N/A error = PAM_SUCCESS; /* success */
2N/A goto out;
2N/A }
2N/A if (arg[0] != '/') {
2N/A size_t len;
2N/A /*
2N/A * If module path does not start with "/", then
2N/A * prepend PAM_LIB_DIR (/usr/lib/security/).
2N/A */
2N/A /* sizeof (PAM_LIB_DIR) has room for '\0' */
2N/A len = sizeof (PAM_LIB_DIR) + sizeof (PAM_ISA_DIR) + strlen(arg);
2N/A if (((*pam)->module_path = malloc(len)) == NULL) {
2N/A __pam_log(LOG_AUTH | LOG_ERR, "strdup: out of memory");
2N/A goto out;
2N/A }
2N/A if ((*pam)->pam_flag & PAM_INCLUDE) {
2N/A (void) snprintf((*pam)->module_path, len, "%s%s",
2N/A PAM_LIB_DIR, arg);
2N/A } else {
2N/A (void) snprintf((*pam)->module_path, len, "%s%s%s",
2N/A PAM_LIB_DIR, PAM_ISA_DIR, arg);
2N/A }
2N/A } else {
2N/A /* Full path provided for module */
2N/A char *isa;
2N/A
2N/A /* Check for Instruction Set Architecture indicator */
2N/A if ((isa = strstr(arg, PAM_ISA)) != NULL) {
2N/A size_t len;
2N/A len = strlen(arg) - (sizeof (PAM_ISA)-1) +
2N/A sizeof (PAM_ISA_DIR);
2N/A
2N/A /* substitute the architecture dependent path */
2N/A if (((*pam)->module_path = malloc(len)) == NULL) {
2N/A __pam_log(LOG_AUTH | LOG_ERR,
2N/A "strdup: out of memory");
2N/A goto out;
2N/A }
2N/A *isa = '\000';
2N/A isa += strlen(PAM_ISA);
2N/A (void) snprintf((*pam)->module_path, len, "%s%s%s",
2N/A arg, PAM_ISA_DIR, isa);
2N/A } else if (((*pam)->module_path = strdup(arg)) == 0) {
2N/A __pam_log(LOG_AUTH | LOG_ERR, "strdup: out of memory");
2N/A goto out;
2N/A }
2N/A }
2N/A
2N/A /* count the number of module-specific options first */
2N/A argc = 0;
2N/A if ((tmp = strdup(cp)) == NULL) {
2N/A __pam_log(LOG_AUTH | LOG_ERR, "strdup: out of memory");
2N/A goto out;
2N/A }
2N/A tmp_free = tmp;
2N/A for (arg = read_next_token(&tmp); arg; arg = read_next_token(&tmp))
2N/A argc++;
2N/A free(tmp_free);
2N/A
2N/A /* allocate array for the module-specific options */
2N/A if (argc > 0) {
2N/A if (((*pam)->module_argv =
2N/A calloc(argc+1, sizeof (char *))) == 0) {
2N/A __pam_log(LOG_AUTH | LOG_ERR, "calloc: out of memory");
2N/A goto out;
2N/A }
2N/A i = 0;
2N/A for (arg = read_next_token(&cp); arg;
2N/A arg = read_next_token(&cp)) {
2N/A (*pam)->module_argv[i] = strdup(arg);
2N/A if ((*pam)->module_argv[i] == NULL) {
2N/A __pam_log(LOG_AUTH | LOG_ERR, "strdup failed");
2N/A goto out;
2N/A }
2N/A i++;
2N/A }
2N/A (*pam)->module_argv[argc] = NULL;
2N/A }
2N/A (*pam)->module_argc = argc;
2N/A
2N/A error = PAM_SUCCESS; /* success */
2N/A (*pam)->pam_err = err; /* was the line truncated */
2N/A
2N/Aout:
2N/A if (current_line)
2N/A free(current_line);
2N/A if (error != PAM_SUCCESS) {
2N/A /* on error free this */
2N/A if (*pam)
2N/A free_pamconf(*pam);
2N/A }
2N/A return (error);
2N/A}
2N/A
2N/A
2N/A/*
2N/A * read_next_token - skip tab and space characters and return the next token
2N/A */
2N/A
2N/Astatic char *
2N/Aread_next_token(char **cpp)
2N/A{
2N/A register char *cp = *cpp;
2N/A char *start;
2N/A
2N/A if (cp == (char *)0) {
2N/A *cpp = (char *)0;
2N/A return ((char *)0);
2N/A }
2N/A while (*cp == ' ' || *cp == '\t')
2N/A cp++;
2N/A if (*cp == '\0') {
2N/A *cpp = (char *)0;
2N/A return ((char *)0);
2N/A }
2N/A start = cp;
2N/A while (*cp && *cp != ' ' && *cp != '\t')
2N/A cp++;
2N/A if (*cp != '\0')
2N/A *cp++ = '\0';
2N/A *cpp = cp;
2N/A return (start);
2N/A}
2N/A
2N/Astatic char *
2N/Apam_conf_strnchr(char *sp, int c, intptr_t count)
2N/A{
2N/A while (count) {
2N/A if (*sp == (char)c)
2N/A return ((char *)sp);
2N/A else {
2N/A sp++;
2N/A count--;
2N/A }
2N/A };
2N/A return (NULL);
2N/A}
2N/A
2N/A/*
2N/A * nextline - skip all blank lines and comments
2N/A */
2N/A
2N/Astatic char *
2N/Anextline(struct pam_fh *pam_fh, pam_handle_t *pamh, int *err)
2N/A{
2N/A char *ll;
2N/A int find_a_line = 0;
2N/A char *data = pam_fh->data;
2N/A char *bufferp = pam_fh->bufferp;
2N/A char *bufferendp = &data[pam_fh->bufsize];
2N/A size_t input_len;
2N/A
2N/A /*
2N/A * Skip the blank line, comment line
2N/A */
2N/A while (!find_a_line) {
2N/A /* if we are at the end of the buffer, there is no next line */
2N/A if (bufferp == bufferendp)
2N/A return (NULL);
2N/A
2N/A /* skip blank line */
2N/A while (*bufferp == '\n') {
2N/A /*
2N/A * If we are at the end of the buffer, there is
2N/A * no next line.
2N/A */
2N/A if (++bufferp == bufferendp) {
2N/A return (NULL);
2N/A }
2N/A /* else we check *bufferp again */
2N/A }
2N/A
2N/A /* skip comment line */
2N/A while (*bufferp == '#') {
2N/A if ((ll = pam_conf_strnchr(bufferp, '\n',
2N/A bufferendp - bufferp)) != NULL) {
2N/A bufferp = ll;
2N/A } else {
2N/A /*
2N/A * this comment line the last line.
2N/A * no next line
2N/A */
2N/A return (NULL);
2N/A }
2N/A
2N/A /*
2N/A * If we are at the end of the buffer, there is
2N/A * no next line.
2N/A */
2N/A if (bufferp == bufferendp) {
2N/A return (NULL);
2N/A }
2N/A }
2N/A
2N/A if ((*bufferp != '\n') && (*bufferp != '#')) {
2N/A find_a_line = 1;
2N/A }
2N/A }
2N/A
2N/A *err = PAM_SUCCESS;
2N/A /* now we find one line */
2N/A if ((ll = pam_conf_strnchr(bufferp, '\n', bufferendp - bufferp))
2N/A != NULL) {
2N/A if ((input_len = ll - bufferp) >= sizeof (pam_fh->line)) {
2N/A __pam_log(LOG_AUTH | LOG_ERR,
2N/A "nextline[%d:%s]: pam.conf line too long %.256s",
2N/A pamh->include_depth, pam_trace_cname(pamh),
2N/A bufferp);
2N/A input_len = sizeof (pam_fh->line) - 1;
2N/A *err = PAM_SERVICE_ERR;
2N/A }
2N/A (void) strncpy(pam_fh->line, bufferp, input_len);
2N/A pam_fh->line[input_len] = '\0';
2N/A pam_fh->bufferp = ll++;
2N/A } else {
2N/A ll = bufferendp;
2N/A if ((input_len = ll - bufferp) >= sizeof (pam_fh->line)) {
2N/A __pam_log(LOG_AUTH | LOG_ERR,
2N/A "nextline[%d:%s]: pam.conf line too long %.256s",
2N/A pamh->include_depth, pam_trace_cname(pamh),
2N/A bufferp);
2N/A input_len = sizeof (pam_fh->line) - 1;
2N/A *err = PAM_SERVICE_ERR;
2N/A }
2N/A (void) strncpy(pam_fh->line, bufferp, input_len);
2N/A pam_fh->line[input_len] = '\0';
2N/A pam_fh->bufferp = ll;
2N/A }
2N/A
2N/A return (pam_fh->line);
2N/A}
2N/A
2N/A/*
2N/A * verify_pam_conf - verify that the pam_conf entry is filled in.
2N/A *
2N/A * True = Error if there is no service.
2N/A * True = Error if there is a service and it matches the requested service
2N/A * but, the type, flag, line overflow, or path is in error.
2N/A */
2N/A
2N/Astatic int
2N/Averify_pam_conf(pamtab_t *pam, char *service)
2N/A{
2N/A return ((pam->pam_service == (char *)NULL) ||
2N/A ((strcasecmp(pam->pam_service, service) == 0) &&
2N/A ((pam->pam_type == -1) ||
2N/A (pam->pam_flag == 0) ||
2N/A (pam->pam_err != PAM_SUCCESS) ||
2N/A (pam->module_path == (char *)NULL))));
2N/A}
2N/A
2N/A/*
2N/A * Routines to free allocated storage
2N/A */
2N/A
2N/A/*
2N/A * clean_up - free allocated storage in the pam handle
2N/A */
2N/A
2N/Astatic void
2N/Aclean_up(pam_handle_t *pamh)
2N/A{
2N/A int i;
2N/A pam_repository_t *auth_rep;
2N/A
2N/A if (pamh) {
2N/A while (pamh->include_depth >= 0) {
2N/A free_pam_conf_info(pamh);
2N/A pamh->include_depth--;
2N/A }
2N/A
2N/A /* Cleanup PAM_REPOSITORY structure */
2N/A auth_rep = pamh->ps_item[PAM_REPOSITORY].pi_addr;
2N/A if (auth_rep != NULL) {
2N/A if (auth_rep->type != NULL)
2N/A free(auth_rep->type);
2N/A if (auth_rep->scope != NULL)
2N/A free(auth_rep->scope);
2N/A }
2N/A
2N/A for (i = 0; i < PAM_MAX_ITEMS; i++) {
2N/A if (pamh->ps_item[i].pi_addr != NULL) {
2N/A if (i == PAM_AUTHTOK || i == PAM_OLDAUTHTOK) {
2N/A (void) memset(pamh->ps_item[i].pi_addr,
2N/A 0, pamh->ps_item[i].pi_size);
2N/A }
2N/A free(pamh->ps_item[i].pi_addr);
2N/A }
2N/A }
2N/A free(pamh);
2N/A }
2N/A}
2N/A
2N/A/*
2N/A * free_pamconf - free memory used to store pam.conf entry
2N/A */
2N/A
2N/Astatic void
2N/Afree_pamconf(pamtab_t *cp)
2N/A{
2N/A int i;
2N/A
2N/A if (cp) {
2N/A if (cp->pam_service)
2N/A free(cp->pam_service);
2N/A if (cp->module_path)
2N/A free(cp->module_path);
2N/A for (i = 0; i < cp->module_argc; i++) {
2N/A if (cp->module_argv[i])
2N/A free(cp->module_argv[i]);
2N/A }
2N/A if (cp->module_argc > 0)
2N/A free(cp->module_argv);
2N/A if (cp->function_ptr)
2N/A free(cp->function_ptr);
2N/A
2N/A free(cp);
2N/A }
2N/A}
2N/A
2N/A/*
2N/A * free_pam_conf_info - free memory used to store all pam.conf info
2N/A * under the pam handle
2N/A */
2N/A
2N/Astatic void
2N/Afree_pam_conf_info(pam_handle_t *pamh)
2N/A{
2N/A pamtab_t *pamentp;
2N/A pamtab_t *pament_trail;
2N/A int i = pamh->include_depth;
2N/A int j;
2N/A
2N/A for (j = 0; j < PAM_NUM_MODULE_TYPES; j++) {
2N/A pamentp = pamh->pam_conf_info[i][j];
2N/A pamh->pam_conf_info[i][j] = NULL;
2N/A pament_trail = pamentp;
2N/A while (pamentp) {
2N/A pamentp = pamentp->next;
2N/A free_pamconf(pament_trail);
2N/A pament_trail = pamentp;
2N/A }
2N/A }
2N/A if (pamh->pam_conf_name[i] != NULL) {
2N/A free(pamh->pam_conf_name[i]);
2N/A pamh->pam_conf_name[i] = NULL;
2N/A }
2N/A}
2N/A
2N/Astatic void
2N/Afree_env(env_list *pam_env)
2N/A{
2N/A if (pam_env) {
2N/A if (pam_env->name)
2N/A free(pam_env->name);
2N/A if (pam_env->value)
2N/A free(pam_env->value);
2N/A free(pam_env);
2N/A }
2N/A}
2N/A
2N/A/*
2N/A * Internal convenience functions for Solaris PAM service modules.
2N/A */
2N/A
2N/A#include <libintl.h>
2N/A#include <nl_types.h>
2N/A#include <synch.h>
2N/A#include <locale.h>
2N/A#include <thread.h>
2N/A
2N/Atypedef struct pam_msg_data {
2N/A nl_catd fd;
2N/A} pam_msg_data_t;
2N/A
2N/A/*
2N/A * free_resp():
2N/A * free storage for responses used in the call back "pam_conv" functions
2N/A */
2N/A
2N/Avoid
2N/Afree_resp(int num_msg, struct pam_response *resp)
2N/A{
2N/A int i;
2N/A struct pam_response *r;
2N/A
2N/A if (resp) {
2N/A r = resp;
2N/A for (i = 0; i < num_msg; i++, r++) {
2N/A if (r->resp) {
2N/A /* clear before freeing -- may be a password */
2N/A bzero(r->resp, strlen(r->resp));
2N/A free(r->resp);
2N/A r->resp = NULL;
2N/A }
2N/A }
2N/A free(resp);
2N/A }
2N/A}
2N/A
2N/Astatic int
2N/Ado_conv(pam_handle_t *pamh, int msg_style, int num_msg,
2N/A char messages[PAM_MAX_NUM_MSG][PAM_MAX_MSG_SIZE], void *conv_apdp,
2N/A struct pam_response *ret_respp[])
2N/A{
2N/A struct pam_message *msg;
2N/A struct pam_message *m;
2N/A int i;
2N/A int k;
2N/A int retcode;
2N/A struct pam_conv *pam_convp;
2N/A
2N/A if ((retcode = pam_get_item(pamh, PAM_CONV,
2N/A (void **)&pam_convp)) != PAM_SUCCESS) {
2N/A return (retcode);
2N/A }
2N/A
2N/A /*
2N/A * When pam_set_item() is called to set PAM_CONV and the
2N/A * item is NULL, memset(pip->pi_addr, 0, size) is called.
2N/A * So at this point, we should check whether pam_convp->conv
2N/A * is NULL or not.
2N/A */
2N/A if ((pam_convp == NULL) || (pam_convp->conv == NULL))
2N/A return (PAM_SYSTEM_ERR);
2N/A
2N/A i = 0;
2N/A k = num_msg;
2N/A
2N/A msg = calloc(num_msg, sizeof (struct pam_message));
2N/A if (msg == NULL) {
2N/A return (PAM_BUF_ERR);
2N/A }
2N/A m = msg;
2N/A
2N/A while (k--) {
2N/A /*
2N/A * fill out the message structure to display prompt message
2N/A */
2N/A m->msg_style = msg_style;
2N/A m->msg = messages[i];
2N/A pam_trace(PAM_DEBUG_CONV,
2N/A "pam_conv_msg(%p:%d[%d]=%s)",
2N/A (void *)pamh, msg_style, i, messages[i]);
2N/A m++;
2N/A i++;
2N/A }
2N/A
2N/A /*
2N/A * The UNIX pam modules always calls __pam_get_authtok() and
2N/A * __pam_display_msg() with a NULL pointer as the conv_apdp.
2N/A * In case the conv_apdp is NULL and the pam_convp->appdata_ptr
2N/A * is not NULL, we should pass the pam_convp->appdata_ptr
2N/A * to the conversation function.
2N/A */
2N/A if (conv_apdp == NULL && pam_convp->appdata_ptr != NULL)
2N/A conv_apdp = pam_convp->appdata_ptr;
2N/A
2N/A /*
2N/A * Call conv function to display the prompt.
2N/A */
2N/A retcode = (pam_convp->conv)(num_msg, &msg, ret_respp, conv_apdp);
2N/A pam_trace(PAM_DEBUG_CONV,
2N/A "pam_conv_resp(%p pam_conv = %s) ret_respp = %p",
2N/A (void *)pamh, pam_strerror(pamh, retcode), (void *)ret_respp);
2N/A if (*ret_respp == NULL) {
2N/A pam_trace(PAM_DEBUG_CONV,
2N/A "pam_conv_resp(%p No response requested)", (void *)pamh);
2N/A } else {
2N/A struct pam_response *r = *ret_respp;
2N/A
2N/A for (i = 0; i < num_msg; i++, r++) {
2N/A if (r->resp == NULL) {
2N/A pam_trace(PAM_DEBUG_CONV,
2N/A "pam_conv_resp(%p:"
2N/A "[%d] NULL response string)",
2N/A (void *)pamh, i);
2N/A } else {
2N/A if (strlen(r->resp) >= PAM_MAX_RESP_SIZE) {
2N/A pam_trace(PAM_DEBUG_CONV,
2N/A "pam_conv_resp(%p:[%d] len=%lu, "
2N/A "code=%d too long)",
2N/A (void *)pamh, i,
2N/A (ulong_t)strlen(r->resp),
2N/A r->resp_retcode);
2N/A retcode = PAM_CONV_ERR;
2N/A break;
2N/A }
2N/A if (msg_style == PAM_PROMPT_ECHO_OFF) {
2N/A#ifdef DEBUG
2N/A pam_trace(PAM_DEBUG_AUTHTOK,
2N/A "pam_conv_resp(%p:[%d]=%s, "
2N/A "code=%d)",
2N/A (void *)pamh, i, r->resp,
2N/A r->resp_retcode);
2N/A#endif /* DEBUG */
2N/A pam_trace(PAM_DEBUG_CONV,
2N/A "pam_conv_resp(%p:[%d] len=%lu, "
2N/A "code=%d)",
2N/A (void *)pamh, i,
2N/A (ulong_t)strlen(r->resp),
2N/A r->resp_retcode);
2N/A } else {
2N/A pam_trace(PAM_DEBUG_CONV,
2N/A "pam_conv_resp(%p:[%d]=%s, "
2N/A "code=%d)",
2N/A (void *)pamh, i, r->resp,
2N/A r->resp_retcode);
2N/A }
2N/A }
2N/A }
2N/A }
2N/A
2N/A if (msg)
2N/A free(msg);
2N/A return (retcode);
2N/A}
2N/A
2N/A/*
2N/A * __pam_display_msg():
2N/A * display message by calling the call back functions
2N/A * provided by the application through "pam_conv" structure
2N/A */
2N/A
2N/Aint
2N/A__pam_display_msg(pam_handle_t *pamh, int msg_style, int num_msg,
2N/A char messages[PAM_MAX_NUM_MSG][PAM_MAX_MSG_SIZE], void *conv_apdp)
2N/A{
2N/A struct pam_response *ret_respp = NULL;
2N/A int ret;
2N/A
2N/A ret = do_conv(pamh, msg_style, num_msg, messages,
2N/A conv_apdp, &ret_respp);
2N/A
2N/A if (ret_respp != NULL)
2N/A free_resp(num_msg, ret_respp);
2N/A
2N/A return (ret);
2N/A}
2N/A
2N/A/*
2N/A * __pam_get_authtok()
2N/A * retrieves a password of at most PASS_MAX length from the pam
2N/A * handle (pam_get_item) or from the input stream (do_conv).
2N/A *
2N/A * This function allocates memory for the new authtok.
2N/A * Applications calling this function are responsible for
2N/A * freeing this memory.
2N/A *
2N/A * If "source" is
2N/A * PAM_HANDLE
2N/A * and "type" is:
2N/A * PAM_AUTHTOK - password is taken from pam handle (PAM_AUTHTOK)
2N/A * PAM_OLDAUTHTOK - password is taken from pam handle (PAM_OLDAUTHTOK)
2N/A *
2N/A * If "source" is
2N/A * PAM_PROMPT
2N/A * and "type" is:
2N/A * 0: Prompt for new passwd, do not even attempt
2N/A * to store it in the pam handle.
2N/A * PAM_AUTHTOK: Prompt for new passwd, store in pam handle as
2N/A * PAM_AUTHTOK item if this value is not already set.
2N/A * PAM_OLDAUTHTOK: Prompt for new passwd, store in pam handle as
2N/A * PAM_OLDAUTHTOK item if this value is not
2N/A * already set.
2N/A */
2N/Aint
2N/A__pam_get_authtok(pam_handle_t *pamh, int source, int type, char *prompt,
2N/A char **authtok)
2N/A{
2N/A int error = PAM_SYSTEM_ERR;
2N/A char *new_password = NULL;
2N/A struct pam_response *ret_resp = NULL;
2N/A char messages[PAM_MAX_NUM_MSG][PAM_MAX_MSG_SIZE];
2N/A
2N/A if ((*authtok = calloc(PASS_MAX+1, sizeof (char))) == NULL)
2N/A return (PAM_BUF_ERR);
2N/A
2N/A if (prompt == NULL)
2N/A prompt = dgettext(TEXT_DOMAIN, "password: ");
2N/A
2N/A switch (source) {
2N/A case PAM_HANDLE:
2N/A
2N/A /* get password from pam handle item list */
2N/A
2N/A switch (type) {
2N/A case PAM_AUTHTOK:
2N/A case PAM_OLDAUTHTOK:
2N/A
2N/A if ((error = pam_get_item(pamh, type,
2N/A (void **)&new_password)) != PAM_SUCCESS)
2N/A goto err_ret;
2N/A
2N/A if (new_password == NULL || new_password[0] == '\0') {
2N/A free(*authtok);
2N/A *authtok = NULL;
2N/A } else {
2N/A (void) strlcpy(*authtok, new_password,
2N/A PASS_MAX+1);
2N/A }
2N/A break;
2N/A default:
2N/A __pam_log(LOG_AUTH | LOG_ERR,
2N/A "__pam_get_authtok() invalid type: %d", type);
2N/A error = PAM_SYMBOL_ERR;
2N/A goto err_ret;
2N/A }
2N/A break;
2N/A case PAM_PROMPT:
2N/A
2N/A /*
2N/A * Prompt for new password and save in pam handle item list
2N/A * if the that item is not already set.
2N/A */
2N/A
2N/A (void) strncpy(messages[0], prompt, sizeof (messages[0]));
2N/A if ((error = do_conv(pamh, PAM_PROMPT_ECHO_OFF, 1, messages,
2N/A NULL, &ret_resp)) != PAM_SUCCESS)
2N/A goto err_ret;
2N/A
2N/A if (ret_resp->resp == NULL) {
2N/A /* getpass didn't return anything */
2N/A error = PAM_SYSTEM_ERR;
2N/A goto err_ret;
2N/A }
2N/A
2N/A /* save the new password if this item was NULL */
2N/A if (type) {
2N/A if ((error = pam_get_item(pamh, type,
2N/A (void **)&new_password)) != PAM_SUCCESS) {
2N/A free_resp(1, ret_resp);
2N/A goto err_ret;
2N/A }
2N/A if (new_password == NULL)
2N/A (void) pam_set_item(pamh, type, ret_resp->resp);
2N/A }
2N/A
2N/A (void) strlcpy(*authtok, ret_resp->resp, PASS_MAX+1);
2N/A free_resp(1, ret_resp);
2N/A break;
2N/A default:
2N/A __pam_log(LOG_AUTH | LOG_ERR,
2N/A "__pam_get_authtok() invalid source: %d", source);
2N/A error = PAM_SYMBOL_ERR;
2N/A goto err_ret;
2N/A }
2N/A
2N/A return (PAM_SUCCESS);
2N/A
2N/Aerr_ret:
2N/A bzero(*authtok, PASS_MAX+1);
2N/A free(*authtok);
2N/A *authtok = NULL;
2N/A return (error);
2N/A}