upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-06-09 08:43:19 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add the "auth_as_self" option to the pam_unix module (there is no

Browse source 
reason not to add it to others later). This causes the pam_unix
module to check the user's _own_ password, not the password of the
account that the user is authenticating into. This will allow eg:
WHEELSU type behaviour from su(1).
This commit is contained in:
Mark Murray 2001-05-24 18:35:52 +00:00
parent 03c0300c01
commit 4448b21cc6
4 changed files with 11 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
lib/libpam/libpam/pam_mod_misc.h
View file

@ -38,6 +38,7 @@
#define PAM_OPT_TRY_FIRST_PASS 0x08
#define PAM_OPT_USE_MAPPED_PASS 0x10
#define PAM_OPT_ECHO_PASS 0x20
#define PAM_OPT_AUTH_AS_SELF 0x40
__BEGIN_DECLS
int pam_get_pass(pam_handle_t *, const char **, const char *, int);

1
lib/libpam/libpam/pam_std_option.c
View file

@ -48,6 +48,7 @@ pam_std_option(int *options, const char *name)
{ "try_first_pass", PAM_OPT_TRY_FIRST_PASS },
{ "use_mapped_pass", PAM_OPT_USE_MAPPED_PASS },
{ "echo_pass", PAM_OPT_ECHO_PASS },
{ "auth_as_self", PAM_OPT_AUTH_AS_SELF },
{ NULL, 0 }
};
struct opttab *p;

1
lib/libpam/libpam/security/pam_mod_misc.h
View file

@ -38,6 +38,7 @@
#define PAM_OPT_TRY_FIRST_PASS 0x08
#define PAM_OPT_USE_MAPPED_PASS 0x10
#define PAM_OPT_ECHO_PASS 0x20
#define PAM_OPT_AUTH_AS_SELF 0x40
__BEGIN_DECLS
int pam_get_pass(pam_handle_t *, const char **, const char *, int);

11
lib/libpam/modules/pam_unix/pam_unix.c
View file

@ -62,12 +62,17 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc,
options = 0;
for (i = 0; i < argc; i++)
pam_std_option(&options, argv[i]);
if ((retval = pam_get_user(pamh, &user, NULL)) != PAM_SUCCESS)
return retval;
if (options & PAM_OPT_AUTH_AS_SELF)
pwd = getpwuid(getuid());
else {
if ((retval = pam_get_user(pamh, &user, NULL)) != PAM_SUCCESS)
return retval;
pwd = getpwnam(user);
}
if ((retval = pam_get_pass(pamh, &password, PASSWORD_PROMPT,
options)) != PAM_SUCCESS)
return retval;
if ((pwd = getpwnam(user)) != NULL) {
if (pwd != NULL) {
encrypted = crypt(password, pwd->pw_passwd);
if (password[0] == '\0' && pwd->pw_passwd[0] != '\0')
encrypted = ":";