2N/A/*
2N/A * CDDL HEADER START
2N/A *
2N/A * The contents of this file are subject to the terms of the
2N/A * Common Development and Distribution License (the "License").
2N/A * You may not use this file except in compliance with the License.
2N/A *
2N/A * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
2N/A * or http://www.opensolaris.org/os/licensing.
2N/A * See the License for the specific language governing permissions
2N/A * and limitations under the License.
2N/A *
2N/A * When distributing Covered Code, include this CDDL HEADER in each
2N/A * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
2N/A * If applicable, add the following below this CDDL HEADER, with the
2N/A * fields enclosed by brackets "[]" replaced with your own identifying
2N/A * information: Portions Copyright [yyyy] [name of copyright owner]
2N/A *
2N/A * CDDL HEADER END
2N/A */
2N/A/*
2N/A * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
2N/A * Use is subject to license terms.
2N/A */
2N/A
2N/A#include <syslog.h>
2N/A#include <pwd.h>
2N/A#include <unistd.h>
2N/A#include <strings.h>
2N/A#include <security/pam_appl.h>
2N/A#include <security/pam_modules.h>
2N/A#include <libintl.h>
2N/A
2N/Astatic int parse_allow_name(char *, char *);
2N/A
2N/A/*
2N/A * pam_sm_acct_mgmt main account managment routine.
2N/A * XXX: The routine just prints out a warning message.
2N/A * It may need to force the user to change his/her
2N/A * passwd.
2N/A */
2N/A
2N/Aint
2N/Apam_sm_acct_mgmt(
2N/A pam_handle_t *pamh,
2N/A int flags,
2N/A int argc,
2N/A const char **argv)
2N/A{
2N/A char *user;
2N/A char *pg;
2N/A int i;
2N/A /*LINTED - set but not used. Would be used in a real module. */
2N/A int debug = 0;
2N/A /*LINTED - set but not used. Would be used in a real module. */
2N/A int nowarn = 0;
2N/A int error = 0;
2N/A
2N/A if (argc == 0)
2N/A return (PAM_SUCCESS);
2N/A
2N/A if (pam_get_item(pamh, PAM_USER, (void **)&user) != PAM_SUCCESS)
2N/A return (PAM_SERVICE_ERR);
2N/A
2N/A if (pam_get_item(pamh, PAM_SERVICE, (void **)&pg) != PAM_SUCCESS)
2N/A return (PAM_SERVICE_ERR);
2N/A
2N/A /*
2N/A * kludge alert. su needs to be handled specially for allow policy.
2N/A * we want to use the policy of the current user not the "destination"
2N/A * user. This will enable us to prevent su to root but not to rlogin,
2N/A * telnet, rsh, ftp to root.
2N/A *
2N/A * description of problem: user name is the "destination" name. not
2N/A * the current name. The allow policy needs to be applied to the
2N/A * current name in the case of su. user is "root" in this case and
2N/A * we will be getting the root policy instead of the user policy.
2N/A */
2N/A if (strcmp(pg, "su") == 0) {
2N/A struct passwd *pw;
2N/A uid_t uid;
2N/A uid = getuid();
2N/A pw = getpwuid(uid);
2N/A if (pw == NULL)
2N/A return (PAM_SYSTEM_ERR);
2N/A user = pw->pw_name;
2N/A }
2N/A
2N/A if (user == 0 || *user == '\0' || (strcmp(user, "root") == 0))
2N/A return (PAM_SUCCESS);
2N/A
2N/A for (i = 0; i < argc; i++) {
2N/A if (strcasecmp(argv[i], "debug") == 0)
2N/A debug = 1;
2N/A else if (strcasecmp(argv[i], "nowarn") == 0) {
2N/A nowarn = 1;
2N/A flags = flags | PAM_SILENT;
2N/A } else if (strncmp(argv[i], "allow=", 6) == 0)
2N/A error |= parse_allow_name(user, (char *)(argv[i]+6));
2N/A else
2N/A syslog(LOG_DEBUG, "illegal option %s", argv[i]);
2N/A }
2N/A return (error?PAM_SUCCESS:PAM_AUTH_ERR);
2N/A}
2N/A
2N/Astatic char *getname();
2N/A
2N/Astatic int
2N/Aparse_allow_name(char *who, char *cp)
2N/A{
2N/A char name[256];
2N/A
2N/A /* catch "allow=" */
2N/A if (*cp == '\0')
2N/A return (0);
2N/A while (cp) {
2N/A cp = getname(cp, name);
2N/A /* catch things such as =, and ,, */
2N/A if (*name == '\0')
2N/A continue;
2N/A if (strcmp(who, name) == 0)
2N/A return (1);
2N/A }
2N/A return (0);
2N/A}
2N/A
2N/Astatic char *
2N/Agetname(char *cp, char *name)
2N/A{
2N/A /* force name to be initially null string */
2N/A *name = '\0';
2N/A
2N/A /* end of string? */
2N/A if (*cp == '\0')
2N/A return ((char *)0);
2N/A while (*cp) {
2N/A /* end of name? */
2N/A if (*cp == ',' || *cp == '\0')
2N/A break;
2N/A *name++ = *cp++;
2N/A }
2N/A /* make name into string */
2N/A *name++ = '\0';
2N/A return ((*cp == '\0')? (char *)0 : ++cp);
2N/A}