Changeset 862 in openpam

Timestamp:

Jul 30, 2015, 11:42:38 PM (5 years ago)

Author:

Dag-Erling Smørgrav

Message:

Add a feature flag to control whether to fall back to the "other" policy
for chains that are still empty after the requested policy was loaded.

Location:

trunk

Files:

• include/security/openpam.h (modified) (1 diff)
• lib/libpam/openpam_configure.c (modified) (1 diff)
• lib/libpam/openpam_features.c (modified) (1 diff)

trunk/include/security/openpam.h

@@ -187 +187 @@
         OPENPAM_RESTRICT_MODULE_NAME,
         OPENPAM_VERIFY_MODULE_FILE,
+        OPENPAM_FALLBACK_TO_OTHER,
         OPENPAM_NUM_FEATURES
 };

trunk/lib/libpam/openpam_configure.c

@@ -468 +468 @@
                 if (pamh->chains[fclt] != NULL)
                         continue;
-                if (openpam_load_chain(pamh, PAM_OTHER, fclt) < 0)
-                        goto load_err;
+                if (OPENPAM_FEATURE(FALLBACK_TO_OTHER)) {
+                        if (openpam_load_chain(pamh, PAM_OTHER, fclt) < 0)
+                                goto load_err;
+                }
         }
         RETURNC(PAM_SUCCESS);

trunk/lib/libpam/openpam_features.c

@@ -66 +66 @@
             1
         ),
+        STRUCT_OPENPAM_FEATURE(
+            FALLBACK_TO_OTHER,
+            "Fall back to \"other\" policy for empty chains",
+            1
+        ),
 };