From 76f95f4dc26720671d2c099f7d9e16924ba7b062 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Dag-Erling=20Sm=C3=B8rgrav?= Date: Thu, 24 Jan 2002 12:47:42 +0000 Subject: [PATCH] Don't let root through unless the "even_root" option was specified. Sponsored by: DARPA, NAI Labs --- lib/libpam/modules/pam_self/pam_self.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/lib/libpam/modules/pam_self/pam_self.c b/lib/libpam/modules/pam_self/pam_self.c index 1cbc8324b53..5b6ff31a417 100644 --- a/lib/libpam/modules/pam_self/pam_self.c +++ b/lib/libpam/modules/pam_self/pam_self.c @@ -51,6 +51,15 @@ __FBSDID("$FreeBSD$"); #include #include +enum { + PAM_OPT_EVEN_ROOT = PAM_OPT_STD_MAX, +}; + +static struct opttab other_options[] = { + { "even_root", PAM_OPT_EVEN_ROOT }, + { NULL, 0 } +}; + PAM_EXTERN int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, const char **argv) { @@ -58,8 +67,9 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, const char **argv) struct passwd *pwd; const char *luser; int pam_err; + uid_t uid; - pam_std_option(&options, NULL, argc, argv); + pam_std_option(&options, other_options, argc, argv); PAM_LOG("Options processed"); @@ -69,7 +79,11 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, const char **argv) if (luser == NULL || (pwd = getpwnam(luser)) == NULL) PAM_RETURN(PAM_AUTH_ERR); - if (getuid() == (uid_t)pwd->pw_uid) + uid = getuid(); + if (uid == 0 && !pam_test_option(&options, PAM_OPT_EVEN_ROOT, NULL)) + PAM_RETURN(PAM_AUTH_ERR); + + if (uid == (uid_t)pwd->pw_uid) PAM_RETURN(PAM_SUCCESS); PAM_VERBOSE_ERROR("Refused; source and target users differ");