summaryrefslogtreecommitdiff
path: root/modules/pam_access/pam_access.c
diff options
context:
space:
mode:
Diffstat (limited to 'modules/pam_access/pam_access.c')
-rw-r--r--modules/pam_access/pam_access.c66
1 files changed, 35 insertions, 31 deletions
diff --git a/modules/pam_access/pam_access.c b/modules/pam_access/pam_access.c
index 80d885dd..98848c54 100644
--- a/modules/pam_access/pam_access.c
+++ b/modules/pam_access/pam_access.c
@@ -1,6 +1,6 @@
-/* pam_access module */
-
/*
+ * pam_access module
+ *
* Written by Alexei Nogin <alexei@nogin.dnttm.ru> 1997/06/15
* (I took login_access from logdaemon-5.6 and converted it to PAM
* using parts of pam_time code.)
@@ -21,7 +21,7 @@
*
* This software is provided "as is" and without any expressed or implied
* warranties, including, without limitation, the implied warranties of
- * merchantibility and fitness for any particular purpose.
+ * merchantability and fitness for any particular purpose.
*************************************************************************
*/
@@ -49,22 +49,12 @@
#include <libaudit.h>
#endif
-/*
- * here, we make definitions for the externally accessible functions
- * in this file (these definitions are required for static modules
- * but strongly encouraged generally) they are used to instruct the
- * modules include file to define their prototypes.
- */
-
-#define PAM_SM_AUTH
-#define PAM_SM_ACCOUNT
-#define PAM_SM_SESSION
-#define PAM_SM_PASSWORD
-
#include <security/_pam_macros.h>
#include <security/pam_modules.h>
#include <security/pam_modutil.h>
#include <security/pam_ext.h>
+#include "pam_cc_compat.h"
+#include "pam_inline.h"
/* login_access.c from logdaemon-5.6 with several changes by A.Nogin: */
@@ -123,25 +113,27 @@ parse_args(pam_handle_t *pamh, struct login_info *loginfo,
loginfo->fs = ":";
loginfo->sep = ", \t";
for (i=0; i<argc; ++i) {
- if (!strncmp("fieldsep=", argv[i], 9)) {
+ const char *str;
+
+ if ((str = pam_str_skip_prefix(argv[i], "fieldsep=")) != NULL) {
/* the admin wants to override the default field separators */
- loginfo->fs = argv[i]+9;
+ loginfo->fs = str;
- } else if (!strncmp("listsep=", argv[i], 8)) {
+ } else if ((str = pam_str_skip_prefix(argv[i], "listsep=")) != NULL) {
/* the admin wants to override the default list separators */
- loginfo->sep = argv[i]+8;
+ loginfo->sep = str;
- } else if (!strncmp("accessfile=", argv[i], 11)) {
- FILE *fp = fopen(11 + argv[i], "r");
+ } else if ((str = pam_str_skip_prefix(argv[i], "accessfile=")) != NULL) {
+ FILE *fp = fopen(str, "r");
if (fp) {
- loginfo->config_file = 11 + argv[i];
+ loginfo->config_file = str;
fclose(fp);
} else {
pam_syslog(pamh, LOG_ERR,
- "failed to open accessfile=[%s]: %m", 11 + argv[i]);
+ "failed to open accessfile=[%s]: %m", str);
return 0;
}
@@ -216,7 +208,7 @@ isipaddr (const char *string, int *addr_type,
/* are_addresses_equal - translate IP address strings to real IP
* addresses and compare them to find out if they are equal.
- * If netmask was provided it will be used to focus comparation to
+ * If netmask was provided it will be used to focus comparison to
* relevant bits.
*/
static int
@@ -335,7 +327,9 @@ login_access (pam_handle_t *pamh, struct login_info *item)
char *users; /* becomes list of login names */
char *froms; /* becomes list of terminals or hosts */
int match = NO;
+#ifdef HAVE_LIBAUDIT
int nonall_match = NO;
+#endif
int end;
int lineno = 0; /* for diagnostics */
char *sptr;
@@ -371,7 +365,7 @@ login_access (pam_handle_t *pamh, struct login_info *item)
if (line[0] == 0) /* skip blank lines */
continue;
- /* Allow field seperator in last field of froms */
+ /* Allow field separator in last field of froms */
if (!(perm = strtok_r(line, item->fs, &sptr))
|| !(users = strtok_r(NULL, item->fs, &sptr))
|| !(froms = strtok_r(NULL, "\n", &sptr))) {
@@ -393,9 +387,11 @@ login_access (pam_handle_t *pamh, struct login_info *item)
match, item->user->pw_name);
if (match) {
match = list_match(pamh, froms, NULL, item, from_match);
+#ifdef HAVE_LIBAUDIT
if (!match && perm[0] == '+') {
nonall_match = YES;
}
+#endif
if (item->debug)
pam_syslog (pamh, LOG_DEBUG,
"from_match=%d, \"%s\"", match, item->from);
@@ -473,6 +469,8 @@ netgroup_match (pam_handle_t *pamh, const char *netgroup,
{
int retval;
char *mydomain = NULL;
+
+#ifdef HAVE_GETDOMAINNAME
char domainname_res[256];
if (getdomainname (domainname_res, sizeof (domainname_res)) == 0)
@@ -482,6 +480,7 @@ netgroup_match (pam_handle_t *pamh, const char *netgroup,
mydomain = domainname_res;
}
}
+#endif
#ifdef HAVE_INNETGR
retval = innetgr (netgroup, machine, user, mydomain);
@@ -576,7 +575,7 @@ group_match (pam_handle_t *pamh, const char *tok, const char* usr,
if (strlen(tok) < 3)
return NO;
- /* token is recieved under the format '(...)' */
+ /* token is received under the format '(...)' */
memset(grptok, 0, BUFSIZ);
strncpy(grptok, tok + 1, strlen(tok) - 2);
@@ -646,9 +645,11 @@ from_match (pam_handle_t *pamh UNUSED, char *tok, struct login_info *item)
if (runp->ai_family == AF_INET)
{
+ DIAG_PUSH_IGNORE_CAST_ALIGN;
inet_ntop (runp->ai_family,
&((struct sockaddr_in *) runp->ai_addr)->sin_addr,
buf, sizeof (buf));
+ DIAG_POP_IGNORE_CAST_ALIGN;
strcat (buf, ".");
@@ -737,7 +738,9 @@ network_netmask_match (pam_handle_t *pamh,
{ /* invalid netmask value */
return NO;
}
- if ((netmask < 0) || (netmask >= 128))
+ if ((netmask < 0)
+ || (addr_type == AF_INET && netmask > 32)
+ || (addr_type == AF_INET6 && netmask > 128))
{ /* netmask value out of range */
return NO;
}
@@ -775,11 +778,13 @@ network_netmask_match (pam_handle_t *pamh,
{
char buf[INET6_ADDRSTRLEN];
+ DIAG_PUSH_IGNORE_CAST_ALIGN;
inet_ntop (runp->ai_family,
runp->ai_family == AF_INET
? (void *) &((struct sockaddr_in *) runp->ai_addr)->sin_addr
: (void *) &((struct sockaddr_in6 *) runp->ai_addr)->sin6_addr,
buf, sizeof (buf));
+ DIAG_POP_IGNORE_CAST_ALIGN;
if (are_addresses_equal(buf, tok, netmask_ptr))
{
@@ -806,7 +811,7 @@ pam_sm_authenticate (pam_handle_t *pamh, int flags UNUSED,
const char *user=NULL;
const void *void_from=NULL;
const char *from;
- const char const *default_config = PAM_ACCESS_CONFIG;
+ const char *default_config = PAM_ACCESS_CONFIG;
struct passwd *user_pw;
char hostname[MAXHOSTNAMELEN + 1];
int rv;
@@ -814,9 +819,8 @@ pam_sm_authenticate (pam_handle_t *pamh, int flags UNUSED,
/* set username */
- if (pam_get_user(pamh, &user, NULL) != PAM_SUCCESS || user == NULL
- || *user == '\0') {
- pam_syslog(pamh, LOG_ERR, "cannot determine the user's name");
+ if (pam_get_user(pamh, &user, NULL) != PAM_SUCCESS) {
+ pam_syslog(pamh, LOG_NOTICE, "cannot determine user name");
return PAM_USER_UNKNOWN;
}
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-22 02:05:21 +0000