Changeset 137 in openpam

Timestamp:

May 2, 2002, 6:08:02 AM (18 years ago)

Author:

Dag-Erling Smørgrav

Message:

Fall in line with Solaris and Linux-PAM wrt use of the "other" policy:
use it to fill the gaps in incomplete policies as well as to replace
missing ones.

Sponsored by: DARPA, NAI Labs

Location:

trunk/lib

Files:

• openpam_configure.c (modified) (5 diffs)
• openpam_impl.h (modified) (2 diffs)
• openpam_load.c (modified) (4 diffs)
• pam_end.c (modified) (2 diffs)
• pam_start.c (modified) (2 diffs)

trunk/lib/openpam_configure.c

@@ -32 +32 @@
  * SUCH DAMAGE.
  *
- * $P4: //depot/projects/openpam/lib/openpam_configure.c#1 $
+ * $P4: //depot/projects/openpam/lib/openpam_configure.c#2 $
  */
 
@@ -51 +51 @@
 
 static int
-openpam_read_policy_file(pam_handle_t *pamh,
+openpam_read_policy_file(pam_chain_t *policy[],
         const char *service,
         const char *filename,
@@ -187 +187 @@
                  * appropriate chain and bump the counter.
                  */
-                r = openpam_add_module(pamh, chain, flag, p, optc, optv);
+                r = openpam_add_module(policy, chain, flag, p, optc, optv);
                 if (r != PAM_SUCCESS)
                         return (-r);
@@ -215 +215 @@
 };
 
-/*
- * OpenPAM internal
- *
- * Configure a service
- */
-
-int
-openpam_configure(pam_handle_t *pamh,
+static int
+openpam_load_policy(pam_chain_t *policy[],
         const char *service)
 {
@@ -236 +230 @@
                         if (filename == NULL) {
                                 openpam_log(PAM_LOG_ERROR, "malloc(): %m");
-                                return (PAM_BUF_ERR);
+                                return (-PAM_BUF_ERR);
                         }
                         strcpy(filename, *path);
                         strcat(filename, service);
-                        r = openpam_read_policy_file(pamh,
+                        r = openpam_read_policy_file(policy,
                             service, filename, PAM_D_STYLE);
                         free(filename);
                 } else {
-                        r = openpam_read_policy_file(pamh,
+                        r = openpam_read_policy_file(policy,
                             service, *path, PAM_CONF_STYLE);
                 }
-                if (r < 0)
-                        return (-r);
-                if (r > 0)
-                        return (PAM_SUCCESS);
-        }
-
-        return (PAM_SYSTEM_ERR);
+                if (r != 0)
+                        return (r);
+        }
+
+        return (0);
+}
+
+/*
+ * OpenPAM internal
+ *
+ * Configure a service
+ */
+
+int
+openpam_configure(pam_handle_t *pamh,
+        const char *service)
+{
+        pam_chain_t *other[PAM_NUM_CHAINS];
+        int i, n, r;
+
+        /* try own configuration first */
+        r = openpam_load_policy(pamh->chains, service);
+        if (r < 0)
+                return (-r);
+        for (i = n = 0; i < PAM_NUM_CHAINS; ++i) {
+                if (pamh->chains[i] != NULL)
+                        ++n;
+        }
+        if (n == PAM_NUM_CHAINS)
+                return (PAM_SUCCESS);
+
+        /* fill in the blanks with "other" */
+        openpam_load_policy(other, PAM_OTHER);
+        if (r < 0)
+                return (-r);
+        for (i = n = 0; i < PAM_NUM_CHAINS; ++i) {
+                if (pamh->chains[i] == NULL) {
+                        pamh->chains[i] = other[i];
+                        other[i] = NULL;
+                }
+                if (pamh->chains[i] != NULL)
+                        ++n;
+        }
+        openpam_clear_chains(other);
+        return (n > 0 ? PAM_SUCCESS : PAM_SYSTEM_ERR);
 }
 

trunk/lib/openpam_impl.h

@@ -32 +32 @@
  * SUCH DAMAGE.
  *
- * $P4: //depot/projects/openpam/lib/openpam_impl.h#13 $
+ * $P4: //depot/projects/openpam/lib/openpam_impl.h#14 $
  */
 
@@ -109 +109 @@
 int             openpam_dispatch(pam_handle_t *, int, int);
 int             openpam_findenv(pam_handle_t *, const char *, size_t);
-int             openpam_add_module(pam_handle_t *, int, int,
+int             openpam_add_module(pam_chain_t **, int, int,
                                    const char *, int, const char **);
-void            openpam_clear_chains(pam_handle_t *);
+void            openpam_clear_chains(pam_chain_t **);
 
 #ifdef OPENPAM_STATIC_MODULES

trunk/lib/openpam_load.c

@@ -32 +32 @@
  * SUCH DAMAGE.
  *
- * $P4: //depot/projects/openpam/lib/openpam_load.c#12 $
+ * $P4: //depot/projects/openpam/lib/openpam_load.c#13 $
  */
 
@@ -157 +157 @@
 
 int
-openpam_add_module(pam_handle_t *pamh,
+openpam_add_module(pam_chain_t *policy[],
         int chain,
         int flag,
@@ -179 +179 @@
                 return (PAM_OPEN_ERR);
         }
-        if ((iterator = pamh->chains[chain]) != NULL) {
+        if ((iterator = policy[chain]) != NULL) {
                 while (iterator->next != NULL)
                         iterator = iterator->next;
                 iterator->next = new;
         } else {
-                pamh->chains[chain] = new;
+                policy[chain] = new;
         }
         return (PAM_SUCCESS);
@@ -200 +200 @@
 
 void
-openpam_clear_chains(pam_handle_t *pamh)
+openpam_clear_chains(pam_chain_t *policy[])
 {
         int i;
 
         for (i = 0; i < PAM_NUM_CHAINS; ++i)
-                openpam_destroy_chain(pamh->chains[i]);
+                openpam_destroy_chain(policy[i]);
 }
 

trunk/lib/pam_end.c

@@ -32 +32 @@
  * SUCH DAMAGE.
  *
- * $P4: //depot/projects/openpam/lib/pam_end.c#8 $
+ * $P4: //depot/projects/openpam/lib/pam_end.c#9 $
  */
 
@@ -73 +73 @@
 
         /* clear chains */
-        openpam_clear_chains(pamh);
+        openpam_clear_chains(pamh->chains);
 
         /* clear items */

trunk/lib/pam_start.c

@@ -32 +32 @@
  * SUCH DAMAGE.
  *
- * $P4: //depot/projects/openpam/lib/pam_start.c#13 $
+ * $P4: //depot/projects/openpam/lib/pam_start.c#14 $
  */
 
@@ -67 +67 @@
 
         r = openpam_configure(ph, service);
-        if (r != PAM_SUCCESS && r != PAM_BUF_ERR)
-                r = openpam_configure(ph, PAM_OTHER);
         if (r != PAM_SUCCESS)
                 goto fail;