summaryrefslogtreecommitdiff
path: root/doc/mwg
diff options
context:
space:
mode:
Diffstat (limited to 'doc/mwg')
-rw-r--r--doc/mwg/.cvsignore4
-rw-r--r--doc/mwg/Linux-PAM_MWG.xml397
-rw-r--r--doc/mwg/Makefile.am48
-rw-r--r--doc/mwg/pam_conv.xml35
-rw-r--r--doc/mwg/pam_fail_delay.xml18
-rw-r--r--doc/mwg/pam_get_data.xml18
-rw-r--r--doc/mwg/pam_get_item.xml18
-rw-r--r--doc/mwg/pam_get_user.xml18
-rw-r--r--doc/mwg/pam_getenv.xml18
-rw-r--r--doc/mwg/pam_getenvlist.xml18
-rw-r--r--doc/mwg/pam_putenv.xml18
-rw-r--r--doc/mwg/pam_set_data.xml18
-rw-r--r--doc/mwg/pam_set_item.xml18
-rw-r--r--doc/mwg/pam_sm_acct_mgmt.xml18
-rw-r--r--doc/mwg/pam_sm_authenticate.xml18
-rw-r--r--doc/mwg/pam_sm_chauthtok.xml18
-rw-r--r--doc/mwg/pam_sm_close_session.xml18
-rw-r--r--doc/mwg/pam_sm_open_session.xml18
-rw-r--r--doc/mwg/pam_sm_setcred.xml18
-rw-r--r--doc/mwg/pam_strerror.xml18
20 files changed, 772 insertions, 0 deletions
diff --git a/doc/mwg/.cvsignore b/doc/mwg/.cvsignore
new file mode 100644
index 00000000..b1fe2134
--- /dev/null
+++ b/doc/mwg/.cvsignore
@@ -0,0 +1,4 @@
+Makefile
+Makefile.in
+*~
+html
diff --git a/doc/mwg/Linux-PAM_MWG.xml b/doc/mwg/Linux-PAM_MWG.xml
new file mode 100644
index 00000000..fc4831a2
--- /dev/null
+++ b/doc/mwg/Linux-PAM_MWG.xml
@@ -0,0 +1,397 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+ "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<book>
+ <bookinfo>
+ <title>The Linux-PAM Module Writers' Guide</title>
+ <authorgroup>
+ <author>
+ <firstname>Andrew G.</firstname>
+ <surname>Morgan</surname>
+ <email>morgan@kernel.org</email>
+ </author>
+ <author>
+ <firstname>Thorsten</firstname>
+ <surname>Kukuk</surname>
+ <email>kukuk@thkukuk.de</email>
+ </author>
+ </authorgroup>
+ <releaseinfo>Version 0.99, 26. June 2006</releaseinfo>
+ <abstract>
+ <para>
+ This manual documents what a programmer needs to know in order
+ to write a module that conforms to the
+ <emphasis remap='B'>Linux-PAM</emphasis> standard.It also
+ discusses some security issues from the point of view of the
+ module programmer.
+ </para>
+ </abstract>
+ </bookinfo>
+
+ <chapter id="mwg-introduction">
+ <title>Introduction</title>
+ <section id="mwg-introduction-description">
+ <title>Description</title>
+ <para>
+ <emphasis remap='B'>Linux-PAM</emphasis> (Pluggable Authentication
+ Modules for Linux) is a library that enables the local system
+ administrator to choose how individual applications authenticate
+ users. For an overview of the
+ <emphasis remap='B'>Linux-PAM</emphasis> library see the
+ <emphasis>Linux-PAM System Administrators' Guide</emphasis>.
+ </para>
+ <para>
+ A <emphasis remap='B'>Linux-PAM</emphasis> module is a single
+ executable binary file that can be loaded by the
+ <emphasis remap='B'>Linux-PAM</emphasis> interface library.
+ This PAM library is configured locally with a system file,
+ <filename>/etc/pam.conf</filename>, to authenticate a user
+ request via the locally available authentication modules. The
+ modules themselves will usually be located in the directory
+ <filename>/lib/security</filename> (or
+ <filename>/lib64/security</filename>, depending on the architecture)
+ and take the form of dynamically loadable object files (see
+ <citerefentry>
+ <refentrytitle>dlopen</refentrytitle><manvolnum>3</manvolnum>
+ </citerefentry>. Alternatively, the modules can be statically
+ linked into the <emphasis remap='B'>Linux-PAM</emphasis> library;
+ this is mostly to allow <emphasis remap='B'>Linux-PAM</emphasis> to
+ be used on platforms without dynamic linking available, but this is
+ a <emphasis>deprecated</emphasis> functionality. It is the
+ <emphasis remap='B'>Linux-PAM</emphasis> interface that is called
+ by an application and it is the responsibility of the library to
+ locate, load and call the appropriate functions in a
+ <emphasis remap='B'>Linux-PAM</emphasis>-module.
+ </para>
+ <para>
+ Except for the immediate purpose of interacting with the user
+ (entering a password etc..) the module should never call the
+ application directly. This exception requires a "conversation
+ mechanism" which is documented below.
+ </para>
+ </section>
+
+ <section id="mwg-introducton-synopsis">
+ <title>Synopsis</title>
+ <programlisting>
+#include &lt;security/pam_modules.h&gt;
+
+gcc -fPIC -c pam_module.c
+gcc -shared -o pam_module.so pam_module.o -lpam
+ </programlisting>
+ </section>
+ </chapter>
+
+ <chapter id="mwg-expected-by-module">
+ <title>What can be expected by the module</title>
+ <para>
+ Here we list the interface that the conventions that all
+ <emphasis remap='B'>Linux-PAM</emphasis> modules must adhere to.
+ </para>
+ <section id="mwg-expected-by-module-item">
+ <title>
+ Getting and setting <emphasis>PAM_ITEM</emphasis>s and
+ <emphasis>data</emphasis>
+ </title>
+ <para>
+ First, we cover what the module should expect from the
+ <emphasis remap='B'>Linux-PAM</emphasis> library and a
+ <emphasis remap='B'>Linux-PAM</emphasis> aware application.
+ Essesntially this is the <filename>libpam.*</filename> library.
+ </para>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="pam_set_data.xml"/>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="pam_get_data.xml"/>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="pam_set_item.xml"/>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="pam_get_item.xml"/>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="pam_get_user.xml"/>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="pam_conv.xml"/>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="pam_putenv.xml"/>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="pam_getenv.xml"/>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="pam_getenvlist.xml"/>
+ </section>
+ <section id="mwg-expected-by-module-other">
+ <title>
+ Other functions provided by <filename>libpam</filename>
+ </title>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="pam_strerror.xml"/>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="pam_fail_delay.xml"/>
+ </section>
+ </chapter>
+
+ <chapter id="mwg-expected-of-module">
+ <title>What is expected of a module</title>
+ <para>
+ The module must supply a sub-set of the six functions listed
+ below. Together they define the function of a
+ <emphasis remap='B'>Linux-PAM module</emphasis>. Module developers
+ are strongly urged to read the comments on security that follow
+ this list.
+ </para>
+ <section id="mwg-expected-of-module-overview">
+ <title>Overview</title>
+ <para>
+ The six module functions are grouped into four independent
+ management groups. These groups are as follows:
+ <emphasis>authentication</emphasis>, <emphasis>account</emphasis>,
+ <emphasis>session</emphasis> and <emphasis>password</emphasis>.
+ To be properly defined, a module must define all functions within
+ at least one of these groups. A single module may contain the
+ necessary functions for <emphasis>all</emphasis> four groups.
+ </para>
+ <section id="mwg-expected-of-module-overview-1">
+ <title>Functional independence</title>
+ <para>
+ The independence of the four groups of service a module can
+ offer means that the module should allow for the possibility
+ that any one of these four services may legitimately be called
+ in any order. Thus, the module writer should consider the
+ appropriateness of performing a service without the prior
+ success of some other part of the module.
+ </para>
+ <para>
+ As an informative example, consider the possibility that an
+ application applies to change a user's authentication token,
+ without having first requested that
+ <emphasis remap='B'>Linux-PAM</emphasis> authenticate the
+ user. In some cases this may be deemed appropriate: when
+ <command>root</command> wants to change the authentication
+ token of some lesser user. In other cases it may not be
+ appropriate: when <command>joe</command> maliciously wants
+ to reset <command>alice</command>'s password; or when anyone
+ other than the user themself wishes to reset their
+ <emphasis>KERBEROS</emphasis> authentication token. A policy
+ for this action should be defined by any reasonable
+ authentication scheme, the module writer should consider
+ this when implementing a given module.
+ </para>
+ </section>
+ <section id="mwg-expected-of-module-overview-2">
+ <title>Minimizing administration problems</title>
+ <para>
+ To avoid system administration problems and the poor
+ construction of a <filename>/etc/pam.conf</filename> file,
+ the module developer may define all six of the following
+ functions. For those functions that would not be called,
+ the module should return <errorname>PAM_SERVICE_ERR</errorname>
+ and write an appropriate message to the system log. When
+ this action is deemed inappropriate, the function would
+ simply return <errorname>PAM_IGNORE</errorname>.
+ </para>
+ </section>
+ <section id="mwg-expected-of-module-overview-3">
+ <title>Arguments supplied to the module</title>
+ <para>
+ The <parameter>flags</parameter> argument of each of
+ the following functions can be logically OR'd with
+ <parameter>PAM_SILENT</parameter>, which is used to inform the
+ module to not pass any <emphasis>text</emphasis> (errors or
+ warnings) application.
+ </para>
+ <para>
+ The <parameter>argc</parameter> and <parameter>argv</parameter>
+ arguments are taken from the line appropriate to this
+ module---that is, with the <emphasis>service_name</emphasis>
+ matching that of the application---in the configuration file
+ (see the <emphasis remap='B'>Linux-PAM</emphasis>
+ System Administrators' Guide). Together these two parameters
+ provide the number of arguments and an array of pointers to
+ the individual argument tokens. This will be familiar to C
+ programmers as the ubiquitous method of passing command arguments
+ to the function <function>main()</function>. Note, however, that
+ the first argument (<parameter>argv[0]</parameter>) is a true
+ argument and <emphasis>not</emphasis> the name of the module.
+ </para>
+ </section>
+ </section>
+ <section id="mwg-expected-of-module-auth">
+ <title>Authentication management</title>
+ <para>
+ To be correctly initialized, <parameter>PAM_SM_AUTH</parameter>
+ must be <command>#define</command>'d prior to including
+ <function>&lt;security/pam_modules.h&gt;</function>. This will
+ ensure that the prototypes for static modules are properly declared.
+ </para>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="pam_sm_authenticate.xml"/>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="pam_sm_setcred.xml"/>
+ </section>
+ <section id="mwg-expected-of-module-acct">
+ <title>Account management</title>
+ <para>
+ To be correctly initialized, <parameter>PAM_SM_ACCOUNT</parameter>
+ must be <command>#define</command>'d prior to including
+ <function>&lt;security/pam_modules.h&gt;</function>. This will
+ ensure that the prototypes for static modules are properly declared.
+ </para>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="pam_sm_acct_mgmt.xml"/>
+ </section>
+ <section id="mwg-expected-of-module-session">
+ <title>Session management</title>
+ <para>
+ To be correctly initialized, <parameter>PAM_SM_SESSION</parameter>
+ must be <command>#define</command>'d prior to including
+ <function>&lt;security/pam_modules.h&gt;</function>. This will
+ ensure that the prototypes for static modules are properly declared.
+ </para>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="pam_sm_open_session.xml"/>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="pam_sm_close_session.xml"/>
+ </section>
+ <section id="mwg-expected-of-module-chauthtok">
+ <title>Authentication token management</title>
+ <para>
+ To be correctly initialized, <parameter>PAM_SM_PASSWORD</parameter>
+ must be <command>#define</command>'d prior to including
+ <function>&lt;security/pam_modules.h&gt;</function>. This will
+ ensure that the prototypes for static modules are properly declared.
+ </para>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="pam_sm_chauthtok.xml"/>
+ </section>
+ </chapter>
+
+ <chapter id="mwg-see-options">
+ <title>Generic optional arguments</title>
+ <para>
+ Here we list the generic arguments that all modules can expect to
+ be passed. They are not mandatory, and their absence should be
+ accepted without comment by the module.
+ </para>
+ <variablelist>
+ <varlistentry>
+ <term>debug</term>
+ <listitem>
+ <para>
+ Use the <citerefentry>
+ <refentrytitle>pam_syslog</refentrytitle><manvolnum>3</manvolnum>
+ </citerefentry> call to log debugging information to the system
+ log files.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>use_first_pass</term>
+ <listitem>
+ <para>
+ The module should not prompt the user for a password.
+ Instead, it should obtain the previously typed password
+ (by a call to <function>pam_get_item()</function> for the
+ <parameter>PAM_AUTHTOK</parameter> item), and use that. If
+ that doesn't work, then the user will not be authenticated.
+ (This option is intended for <command>auth</command> and
+ <command>passwd</command> modules only).
+ </para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+ </chapter>
+
+ <chapter id="mwg-see-also">
+ <title>See also</title>
+ <itemizedlist>
+ <listitem>
+ <para>
+ The Linux-PAM System Administrators' Guide.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ The Linux-PAM Application Developers' Guide.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ The V. Samar and R. Schemers (SunSoft), ``UNIFIED LOGIN WITH
+ PLUGGABLE AUTHENTICATION MODULES'', Open Software Foundation
+ Request For Comments 86.0, October 1995.
+ </para>
+ </listitem>
+ </itemizedlist>
+ </chapter>
+
+ <chapter id='mwg-author'>
+ <title>Author/acknowledgments</title>
+ <para>
+ This document was written by Andrew G. Morgan (morgan@kernel.org)
+ with many contributions from
+ Chris Adams, Peter Allgeyer, Tim Baverstock, Tim Berger, Craig S. Bell,
+ Derrick J. Brashear, Ben Buxton, Seth Chaiklin, Oliver Crow, Chris Dent,
+ Marc Ewing, Cristian Gafton, Emmanuel Galanos, Brad M. Garcia,
+ Eric Hester, Roger Hu, Eric Jacksch, Michael K. Johnson, David Kinchlea,
+ Olaf Kirch, Marcin Korzonek, Thorsten Kukuk, Stephen Langasek,
+ Nicolai Langfeldt, Elliot Lee, Luke Kenneth Casson Leighton,
+ Al Longyear, Ingo Luetkebohle, Marek Michalkiewicz, Robert Milkowski,
+ Aleph One, Martin Pool, Sean Reifschneider, Jan Rekorajski, Erik Troan,
+ Theodore Ts'o, Jeff Uphoff, Myles Uyema, Savochkin Andrey Vladimirovich,
+ Ronald Wahl, David Wood, John Wilmes, Joseph S. D. Yao
+ and Alex O. Yuriev.
+ </para>
+ <para>
+ Thanks are also due to Sun Microsystems, especially to Vipin Samar and
+ Charlie Lai for their advice. At an early stage in the development of
+ <emphasis remap='B'>Linux-PAM</emphasis>, Sun graciously made the
+ documentation for their implementation of PAM available. This act
+ greatly accelerated the development of
+ <emphasis remap='B'>Linux-PAM</emphasis>.
+ </para>
+ </chapter>
+
+ <chapter id='mwg-copyright'>
+ <title>Copyright information for this document</title>
+ <programlisting>
+Copyright (c) 2006 Thorsten Kukuk &lt;kukuk@thkukuk.de&gt;
+Copyright (c) 1996-2002 Andrew G. Morgan &lt;morgan@kernel.org&gt;
+ </programlisting>
+ <para>
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions are
+ met:
+ </para>
+ <programlisting>
+1. Redistributions of source code must retain the above copyright
+ notice, and the entire permission notice in its entirety,
+ including the disclaimer of warranties.
+
+2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
+
+3. The name of the author may not be used to endorse or promote
+ products derived from this software without specific prior
+ written permission.
+ </programlisting>
+ <para>
+ Alternatively, this product may be distributed under the terms of
+ the GNU General Public License (GPL), in which case the provisions
+ of the GNU GPL are required instead of the above restrictions.
+ (This clause is necessary due to a potential bad interaction between
+ the GNU GPL and the restrictions contained in a BSD-style copyright.)
+ </para>
+ <programlisting>
+THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
+TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
+USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ </programlisting>
+ </chapter>
+</book>
diff --git a/doc/mwg/Makefile.am b/doc/mwg/Makefile.am
new file mode 100644
index 00000000..249dfbb7
--- /dev/null
+++ b/doc/mwg/Makefile.am
@@ -0,0 +1,48 @@
+#
+# Copyright (c) 2006 Thorsten Kukuk <kukuk@thkukuk.de>
+#
+
+CLEANFILES = Linux-PAM_MWG.fo *~
+
+EXTRA_DIST = $(XMLS)
+
+XMLS = Linux-PAM_MWG.xml $(shell ls pam_*.xml)
+
+if ENABLE_REGENERATE_MAN
+MAINTAINERCLEANFILES = Linux-PAM_MWG.txt Linux-PAM_MWG.pdf html/*.html
+
+all: Linux-PAM_MWG.txt html/Linux-PAM_MWG.html Linux-PAM_MWG.pdf
+
+Linux-PAM_MWG.pdf: $(XMLS)
+if ENABLE_GENERATE_PDF
+ $(XMLLINT) --nonet --xinclude --postvalid --noent --noout $<
+ $(XSLTPROC) --stringparam generate.toc "book toc" \
+ --stringparam section.autolabel 1 \
+ --stringparam section.label.includes.component.label 1 \
+ --stringparam toc.max.depth 3 --xinclude --nonet \
+ http://docbook.sourceforge.net/release/xsl/current/fo/docbook.xsl $< > Linux-PAM_MWG.fo
+ $(FO2PDF) Linux-PAM_MWG.fo $(srcdir)/$@
+else
+ echo "No fo2pdf processor installed, skip PDF generation"
+endif
+
+Linux-PAM_MWG.txt: $(XMLS)
+ $(XMLLINT) --nonet --xinclude --postvalid --noent --noout $<
+ $(XSLTPROC) --stringparam generate.toc "book toc" \
+ --stringparam section.autolabel 1 \
+ --stringparam section.label.includes.component.label 1 \
+ --stringparam toc.max.depth 3 --xinclude --nonet \
+ http://docbook.sourceforge.net/release/xsl/current/html/docbook.xsl $< | $(BROWSER) > $(srcdir)/$@
+
+html/Linux-PAM_MWG.html: $(XMLS)
+ @test -d $(srcdir)/html || mkdir -p $(srcdir)/html
+ $(XMLLINT) --nonet --xinclude --postvalid --noent --noout $<
+ $(XSLTPROC) --stringparam base.dir html/ \
+ --stringparam root.filename Linux-PAM_MWG \
+ --stringparam use.id.as.filename 1 \
+ --stringparam chunk.first.sections 1 \
+ --stringparam section.autolabel 1 \
+ --stringparam section.label.includes.component.label 1 \
+ --stringparam toc.max.depth 3 --xinclude --nonet \
+ http://docbook.sourceforge.net/release/xsl/current/html/chunk.xsl $<
+endif
diff --git a/doc/mwg/pam_conv.xml b/doc/mwg/pam_conv.xml
new file mode 100644
index 00000000..a2b470af
--- /dev/null
+++ b/doc/mwg/pam_conv.xml
@@ -0,0 +1,35 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+ "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='mwg-pam_conv'>
+ <title>The conversation function</title>
+ <funcsynopsis>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_conv.3.xml" xpointer='xpointer(//funcsynopsis[@id = "pam_conv-synopsis"]/*)'/>
+ </funcsynopsis>
+ <programlisting>
+struct pam_message {
+ int msg_style;
+ const char *msg;
+};
+
+struct pam_response {
+ char *resp;
+ int resp_retcode;
+};
+
+struct pam_conv {
+ int (*conv)(int num_msg, const struct pam_message **msg,
+ struct pam_response **resp, void *appdata_ptr);
+ void *appdata_ptr;
+};
+ </programlisting>
+ <section id='mwg-pam_conv-description'>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_conv.3.xml" xpointer='xpointer(//refsect1[@id = "pam_conv-description"]/*)'/>
+ </section>
+ <section id='mwg-pam_conv-return_values'>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_conv.3.xml" xpointer='xpointer(//refsect1[@id = "pam_conv-return_values"]/*)'/>
+ </section>
+</section>
diff --git a/doc/mwg/pam_fail_delay.xml b/doc/mwg/pam_fail_delay.xml
new file mode 100644
index 00000000..589e1148
--- /dev/null
+++ b/doc/mwg/pam_fail_delay.xml
@@ -0,0 +1,18 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+ "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='adg-pam_fail_delay'>
+ <title>Request a delay on failure</title>
+ <funcsynopsis>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_fail_delay.3.xml" xpointer='xpointer(//funcsynopsis[@id = "pam_fail_delay-synopsis"]/*)'/>
+ </funcsynopsis>
+ <section id='adg-pam_fail_delay-description'>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_fail_delay.3.xml" xpointer='xpointer(//refsect1[@id = "pam_fail_delay-description"]/*)'/>
+ </section>
+ <section id='adg-pam_fail_delay-return_values'>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_fail_delay.3.xml" xpointer='xpointer(//refsect1[@id = "pam_fail_delay-return_values"]/*)'/>
+ </section>
+</section>
diff --git a/doc/mwg/pam_get_data.xml b/doc/mwg/pam_get_data.xml
new file mode 100644
index 00000000..b1afdb3f
--- /dev/null
+++ b/doc/mwg/pam_get_data.xml
@@ -0,0 +1,18 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+ "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='mwg-pam_get_data'>
+ <title>Get module internal data</title>
+ <funcsynopsis>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_get_data.3.xml" xpointer='xpointer(//funcsynopsis[@id = "pam_get_data-synopsis"]/*)'/>
+ </funcsynopsis>
+ <section id='mwg-pam_get_data-description'>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_get_data.3.xml" xpointer='xpointer(//refsect1[@id = "pam_get_data-description"]/*)'/>
+ </section>
+ <section id='mwg-pam_get_data-return_values'>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_get_data.3.xml" xpointer='xpointer(//refsect1[@id = "pam_get_data-return_values"]/*)'/>
+ </section>
+</section>
diff --git a/doc/mwg/pam_get_item.xml b/doc/mwg/pam_get_item.xml
new file mode 100644
index 00000000..370a10a1
--- /dev/null
+++ b/doc/mwg/pam_get_item.xml
@@ -0,0 +1,18 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+ "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='mwg-pam_get_item'>
+ <title>Getting PAM items</title>
+ <funcsynopsis>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_get_item.3.xml" xpointer='xpointer(//funcsynopsis[@id = "pam_get_item-synopsis"]/*)'/>
+ </funcsynopsis>
+ <section id='mwg-pam_get_item-description'>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_get_item.3.xml" xpointer='xpointer(//refsect1[@id = "pam_get_item-description"]/*)'/>
+ </section>
+ <section id='mwg-pam_get_item-return_values'>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_get_item.3.xml" xpointer='xpointer(//refsect1[@id = "pam_get_item-return_values"]/*)'/>
+ </section>
+</section>
diff --git a/doc/mwg/pam_get_user.xml b/doc/mwg/pam_get_user.xml
new file mode 100644
index 00000000..1cb7fdf3
--- /dev/null
+++ b/doc/mwg/pam_get_user.xml
@@ -0,0 +1,18 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+ "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='mwg-pam_get_user'>
+ <title>Get user name</title>
+ <funcsynopsis>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_get_user.3.xml" xpointer='xpointer(//funcsynopsis[@id = "pam_get_user-synopsis"]/*)'/>
+ </funcsynopsis>
+ <section id='mwg-pam_get_user-description'>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_get_user.3.xml" xpointer='xpointer(//refsect1[@id = "pam_get_user-description"]/*)'/>
+ </section>
+ <section id='mwg-pam_get_user-return_values'>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_get_user.3.xml" xpointer='xpointer(//refsect1[@id = "pam_get_user-return_values"]/*)'/>
+ </section>
+</section>
diff --git a/doc/mwg/pam_getenv.xml b/doc/mwg/pam_getenv.xml
new file mode 100644
index 00000000..61d69c33
--- /dev/null
+++ b/doc/mwg/pam_getenv.xml
@@ -0,0 +1,18 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+ "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='adg-pam_getenv'>
+ <title>Get a PAM environment variable</title>
+ <funcsynopsis>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_getenv.3.xml" xpointer='xpointer(//funcsynopsis[@id = "pam_getenv-synopsis"]/*)'/>
+ </funcsynopsis>
+ <section id='adg-pam_getenv-description'>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_getenv.3.xml" xpointer='xpointer(//refsect1[@id = "pam_getenv-description"]/*)'/>
+ </section>
+ <section id='adg-pam_getenv-return_values'>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_getenv.3.xml" xpointer='xpointer(//refsect1[@id = "pam_getenv-return_values"]/*)'/>
+ </section>
+</section>
diff --git a/doc/mwg/pam_getenvlist.xml b/doc/mwg/pam_getenvlist.xml
new file mode 100644
index 00000000..d3c2fcd3
--- /dev/null
+++ b/doc/mwg/pam_getenvlist.xml
@@ -0,0 +1,18 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+ "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='adg-pam_getenvlist'>
+ <title>Getting the PAM environment</title>
+ <funcsynopsis>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_getenvlist.3.xml" xpointer='xpointer(//funcsynopsis[@id = "pam_getenvlist-synopsis"]/*)'/>
+ </funcsynopsis>
+ <section id='adg-pam_getenvlist-description'>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_getenvlist.3.xml" xpointer='xpointer(//refsect1[@id = "pam_getenvlist-description"]/*)'/>
+ </section>
+ <section id='adg-pam_getenvlist-return_values'>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_getenvlist.3.xml" xpointer='xpointer(//refsect1[@id = "pam_getenvlist-return_values"]/*)'/>
+ </section>
+</section>
diff --git a/doc/mwg/pam_putenv.xml b/doc/mwg/pam_putenv.xml
new file mode 100644
index 00000000..e55f1a42
--- /dev/null
+++ b/doc/mwg/pam_putenv.xml
@@ -0,0 +1,18 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+ "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='adg-pam_putenv'>
+ <title>Set or change PAM environment variable</title>
+ <funcsynopsis>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_putenv.3.xml" xpointer='xpointer(//funcsynopsis[@id = "pam_putenv-synopsis"]/*)'/>
+ </funcsynopsis>
+ <section id='adg-pam_putenv-description'>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_putenv.3.xml" xpointer='xpointer(//refsect1[@id = "pam_putenv-description"]/*)'/>
+ </section>
+ <section id='adg-pam_putenv-return_values'>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_putenv.3.xml" xpointer='xpointer(//refsect1[@id = "pam_putenv-return_values"]/*)'/>
+ </section>
+</section>
diff --git a/doc/mwg/pam_set_data.xml b/doc/mwg/pam_set_data.xml
new file mode 100644
index 00000000..18b2711b
--- /dev/null
+++ b/doc/mwg/pam_set_data.xml
@@ -0,0 +1,18 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+ "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='mwg-pam_set_data'>
+ <title>Set module internal data</title>
+ <funcsynopsis>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_set_data.3.xml" xpointer='xpointer(//funcsynopsis[@id = "pam_set_data-synopsis"]/*)'/>
+ </funcsynopsis>
+ <section id='mwg-pam_set_data-description'>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_set_data.3.xml" xpointer='xpointer(//refsect1[@id = "pam_set_data-description"]/*)'/>
+ </section>
+ <section id='mwg-pam_set_data-return_values'>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_set_data.3.xml" xpointer='xpointer(//refsect1[@id = "pam_set_data-return_values"]/*)'/>
+ </section>
+</section>
diff --git a/doc/mwg/pam_set_item.xml b/doc/mwg/pam_set_item.xml
new file mode 100644
index 00000000..7d19925e
--- /dev/null
+++ b/doc/mwg/pam_set_item.xml
@@ -0,0 +1,18 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+ "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='mwg-pam_set_item'>
+ <title>Setting PAM items</title>
+ <funcsynopsis>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_set_item.3.xml" xpointer='xpointer(//funcsynopsis[@id = "pam_set_item-synopsis"]/*)'/>
+ </funcsynopsis>
+ <section id='mwg-pam_set_item-description'>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_set_item.3.xml" xpointer='xpointer(//refsect1[@id = "pam_set_item-description"]/*)'/>
+ </section>
+ <section id='mwg-pam_set_item-return_values'>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_set_item.3.xml" xpointer='xpointer(//refsect1[@id = "pam_set_item-return_values"]/*)'/>
+ </section>
+</section>
diff --git a/doc/mwg/pam_sm_acct_mgmt.xml b/doc/mwg/pam_sm_acct_mgmt.xml
new file mode 100644
index 00000000..10b3c9e9
--- /dev/null
+++ b/doc/mwg/pam_sm_acct_mgmt.xml
@@ -0,0 +1,18 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+ "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='mwg-pam_sm_acct_mgmt'>
+ <title>Service function for account management</title>
+ <funcsynopsis>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_sm_acct_mgmt.3.xml" xpointer='xpointer(//funcsynopsis[@id = "pam_sm_acct_mgmt-synopsis"]/*)'/>
+ </funcsynopsis>
+ <section id='mwg-pam_sm_acct_mgmt-description'>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_sm_acct_mgmt.3.xml" xpointer='xpointer(//refsect1[@id = "pam_sm_acct_mgmt-description"]/*)'/>
+ </section>
+ <section id='mwg-pam_sm_acct_mgmt-return_values'>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_sm_acct_mgmt.3.xml" xpointer='xpointer(//refsect1[@id = "pam_sm_acct_mgmt-return_values"]/*)'/>
+ </section>
+</section>
diff --git a/doc/mwg/pam_sm_authenticate.xml b/doc/mwg/pam_sm_authenticate.xml
new file mode 100644
index 00000000..54c79af6
--- /dev/null
+++ b/doc/mwg/pam_sm_authenticate.xml
@@ -0,0 +1,18 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+ "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='mwg-pam_sm_authenticate'>
+ <title>Service function for user authentication</title>
+ <funcsynopsis>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_sm_authenticate.3.xml" xpointer='xpointer(//funcsynopsis[@id = "pam_sm_authenticate-synopsis"]/*)'/>
+ </funcsynopsis>
+ <section id='mwg-pam_sm_authenticate-description'>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_sm_authenticate.3.xml" xpointer='xpointer(//refsect1[@id = "pam_sm_authenticate-description"]/*)'/>
+ </section>
+ <section id='mwg-pam_sm_authenticate-return_values'>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_sm_authenticate.3.xml" xpointer='xpointer(//refsect1[@id = "pam_sm_authenticate-return_values"]/*)'/>
+ </section>
+</section>
diff --git a/doc/mwg/pam_sm_chauthtok.xml b/doc/mwg/pam_sm_chauthtok.xml
new file mode 100644
index 00000000..a1364315
--- /dev/null
+++ b/doc/mwg/pam_sm_chauthtok.xml
@@ -0,0 +1,18 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+ "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='mwg-pam_sm_chauthtok'>
+ <title>Service function to alter authentication token</title>
+ <funcsynopsis>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_sm_chauthtok.3.xml" xpointer='xpointer(//funcsynopsis[@id = "pam_sm_chauthtok-synopsis"]/*)'/>
+ </funcsynopsis>
+ <section id='mwg-pam_sm_chauthtok-description'>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_sm_chauthtok.3.xml" xpointer='xpointer(//refsect1[@id = "pam_sm_chauthtok-description"]/*)'/>
+ </section>
+ <section id='mwg-pam_sm_chauthtok-return_values'>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_sm_chauthtok.3.xml" xpointer='xpointer(//refsect1[@id = "pam_sm_chauthtok-return_values"]/*)'/>
+ </section>
+</section>
diff --git a/doc/mwg/pam_sm_close_session.xml b/doc/mwg/pam_sm_close_session.xml
new file mode 100644
index 00000000..9346c506
--- /dev/null
+++ b/doc/mwg/pam_sm_close_session.xml
@@ -0,0 +1,18 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+ "http://www.oasis-close.org/docbook/xml/4.4/docbookx.dtd">
+<section id='mwg-pam_sm_close_session'>
+ <title>Service function to terminate session management</title>
+ <funcsynopsis>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_sm_close_session.3.xml" xpointer='xpointer(//funcsynopsis[@id = "pam_sm_close_session-synopsis"]/*)'/>
+ </funcsynopsis>
+ <section id='mwg-pam_sm_close_session-description'>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_sm_close_session.3.xml" xpointer='xpointer(//refsect1[@id = "pam_sm_close_session-description"]/*)'/>
+ </section>
+ <section id='mwg-pam_sm_close_session-return_values'>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_sm_close_session.3.xml" xpointer='xpointer(//refsect1[@id = "pam_sm_close_session-return_values"]/*)'/>
+ </section>
+</section>
diff --git a/doc/mwg/pam_sm_open_session.xml b/doc/mwg/pam_sm_open_session.xml
new file mode 100644
index 00000000..b8e3fa90
--- /dev/null
+++ b/doc/mwg/pam_sm_open_session.xml
@@ -0,0 +1,18 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+ "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='mwg-pam_sm_open_session'>
+ <title>Service function to start session management</title>
+ <funcsynopsis>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_sm_open_session.3.xml" xpointer='xpointer(//funcsynopsis[@id = "pam_sm_open_session-synopsis"]/*)'/>
+ </funcsynopsis>
+ <section id='mwg-pam_sm_open_session-description'>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_sm_open_session.3.xml" xpointer='xpointer(//refsect1[@id = "pam_sm_open_session-description"]/*)'/>
+ </section>
+ <section id='mwg-pam_sm_open_session-return_values'>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_sm_open_session.3.xml" xpointer='xpointer(//refsect1[@id = "pam_sm_open_session-return_values"]/*)'/>
+ </section>
+</section>
diff --git a/doc/mwg/pam_sm_setcred.xml b/doc/mwg/pam_sm_setcred.xml
new file mode 100644
index 00000000..eee8e1d6
--- /dev/null
+++ b/doc/mwg/pam_sm_setcred.xml
@@ -0,0 +1,18 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+ "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='mwg-pam_sm_setcred'>
+ <title>Service function to alter credentials</title>
+ <funcsynopsis>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_sm_setcred.3.xml" xpointer='xpointer(//funcsynopsis[@id = "pam_sm_setcred-synopsis"]/*)'/>
+ </funcsynopsis>
+ <section id='mwg-pam_sm_setcred-description'>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_sm_setcred.3.xml" xpointer='xpointer(//refsect1[@id = "pam_sm_setcred-description"]/*)'/>
+ </section>
+ <section id='mwg-pam_sm_setcred-return_values'>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_sm_setcred.3.xml" xpointer='xpointer(//refsect1[@id = "pam_sm_setcred-return_values"]/*)'/>
+ </section>
+</section>
diff --git a/doc/mwg/pam_strerror.xml b/doc/mwg/pam_strerror.xml
new file mode 100644
index 00000000..35b08a27
--- /dev/null
+++ b/doc/mwg/pam_strerror.xml
@@ -0,0 +1,18 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+ "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<section id='adg-pam_strerror'>
+ <title>Strings describing PAM error codes</title>
+ <funcsynopsis>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_strerror.3.xml" xpointer='xpointer(//funcsynopsis[@id = "pam_strerror-synopsis"]/*)'/>
+ </funcsynopsis>
+ <section id='adg-pam_strerror-description'>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_strerror.3.xml" xpointer='xpointer(//refsect1[@id = "pam_strerror-description"]/*)'/>
+ </section>
+ <section id='adg-pam_strerror-return_values'>
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+ href="../man/pam_strerror.3.xml" xpointer='xpointer(//refsect1[@id = "pam_strerror-return_values"]/*)'/>
+ </section>
+</section>
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-20 00:36:02 +0000