d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Use the current user's login class for the decisions about where

Browse Source 
the nologin(5) file is located and whether the user may bypass its
restriction.

Add some error checks.

Approved by:	des
PR:		bin/107612
This commit is contained in:
Yaroslav Tykhiy 2007-06-14 13:07:06 +00:00
parent 9b33b1ab38
commit 58d6bdcbe0
2 changed files with 58 additions and 44 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
lib/libpam/modules/pam_nologin/pam_nologin.8
View File

@ -49,23 +49,24 @@ feature.
.Ss NoLogin Account Management Module
The NoLogin account management component,
.Fn pam_sm_acct_mgmt ,
always returns success for the superuser,
and returns success for all other users
if the file
.Pa /var/run/nologin
does not exist.
If
.Pa /var/run/nologin
does exist,
then its contents are echoed
to non-superusers
verifies whether logins are administratively disabled via
.Xr nologin 5 .
It returns success if the user's login class has an "ignorenologin"
capability specified in
.Xr login.conf 5
or the
.Xr nologin 5
file does not exist.
If neither condition is met,
then the contents of
.Xr nologin 5
are echoed
before failure is returned.
If a "nologin" capability
is specified in
The location of
.Xr nologin 5
is specified by a "nologin" capability in
.Xr login.conf 5 ,
then the file thus specified
is used instead.
This usually defaults to
which defaults to
.Pa /var/run/nologin .
.Pp
The following options may be passed to the module:

71
lib/libpam/modules/pam_nologin/pam_nologin.c
View File

@ -52,18 +52,19 @@ __FBSDID("$FreeBSD$");
#include <security/pam_modules.h>
#include <security/pam_mod_misc.h>
#define NOLOGIN "/var/run/nologin"
#define _PATH_NOLOGIN "/var/run/nologin"
static char nologin_def[] = NOLOGIN;
static char nologin_def[] = _PATH_NOLOGIN;
PAM_EXTERN int
pam_sm_acct_mgmt(pam_handle_t *pamh, int flags __unused,
pam_sm_acct_mgmt(pam_handle_t *pamh, int flags,
int argc __unused, const char *argv[] __unused)
{
login_cap_t *lc;
struct passwd *pwd;
struct stat st;
int retval, fd;
ssize_t ss;
const char *user, *nologin;
char *mtmp;
@ -73,42 +74,54 @@ pam_sm_acct_mgmt(pam_handle_t *pamh, int flags __unused,
PAM_LOG("Got user: %s", user);
lc = login_getclass(NULL);
pwd = getpwnam(user);
if (pwd == NULL)
return (PAM_USER_UNKNOWN);
/*
* login_getpwclass(3) will select the "root" class by default
* if pwd->pw_uid is 0. That class should have "ignorenologin"
* capability so that super-user can bypass nologin.
*/
lc = login_getpwclass(pwd);
if (lc == NULL) {
PAM_LOG("Unable to get login class for user %s", user);
return (PAM_SERVICE_ERR);
}
if (login_getcapbool(lc, "ignorenologin", 0)) {
login_close(lc);
return (PAM_SUCCESS);
}
nologin = login_getcapstr(lc, "nologin", nologin_def, nologin_def);
login_close(lc);
lc = NULL;
fd = open(nologin, O_RDONLY, 0);
if (fd < 0)
if (fd < 0) {
login_close(lc);
return (PAM_SUCCESS);
PAM_LOG("Opened %s file", NOLOGIN);
pwd = getpwnam(user);
if (pwd && pwd->pw_uid == 0)
retval = PAM_SUCCESS;
else {
if (!pwd)
retval = PAM_USER_UNKNOWN;
else
retval = PAM_AUTH_ERR;
}
if (fstat(fd, &st) < 0)
return (retval);
PAM_LOG("Opened %s file", nologin);
mtmp = malloc(st.st_size + 1);
if (mtmp != NULL) {
read(fd, mtmp, st.st_size);
mtmp[st.st_size] = '\0';
pam_error(pamh, "%s", mtmp);
free(mtmp);
if (fstat(fd, &st) == 0) {
mtmp = malloc(st.st_size + 1);
if (mtmp != NULL) {
ss = read(fd, mtmp, st.st_size);
if (ss > 0) {
mtmp[ss] = '\0';
pam_error(pamh, "%s", mtmp);
}
free(mtmp);
}
}
if (retval != PAM_SUCCESS)
PAM_VERBOSE_ERROR("Administrator refusing you: %s", NOLOGIN);
PAM_VERBOSE_ERROR("Administrator refusing you: %s", nologin);
return (retval);
close(fd);
login_close(lc);
return (PAM_AUTH_ERR);
}
PAM_MODULE_ENTRY("pam_nologin");