d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Use the current user's login class for the decisions about where

Browse Source 
the nologin(5) file is located and whether the user may bypass its
restriction.

Add some error checks.

Approved by:	des
PR:		bin/107612
This commit is contained in:
Yaroslav Tykhiy 2007-06-14 13:07:06 +00:00
parent 9b33b1ab38
commit 58d6bdcbe0
2 changed files with 58 additions and 44 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
lib/libpam/modules/pam_nologin/pam_nologin.8
View File

@ -49,23 +49,24 @@ feature.
.Ss NoLogin Account Management Module .Ss NoLogin Account Management Module
The NoLogin account management component, The NoLogin account management component,
.Fn pam_sm_acct_mgmt , .Fn pam_sm_acct_mgmt ,
always returns success for the superuser, verifies whether logins are administratively disabled via
and returns success for all other users .Xr nologin 5 .
if the file It returns success if the user's login class has an "ignorenologin"
.Pa /var/run/nologin capability specified in
does not exist. .Xr login.conf 5
If or the
.Pa /var/run/nologin .Xr nologin 5
does exist, file does not exist.
then its contents are echoed If neither condition is met,
to non-superusers then the contents of
.Xr nologin 5
are echoed
before failure is returned. before failure is returned.
If a "nologin" capability The location of
is specified in .Xr nologin 5
is specified by a "nologin" capability in
.Xr login.conf 5 , .Xr login.conf 5 ,
then the file thus specified which defaults to
is used instead.
This usually defaults to
.Pa /var/run/nologin . .Pa /var/run/nologin .
.Pp .Pp
The following options may be passed to the module: The following options may be passed to the module:

71
lib/libpam/modules/pam_nologin/pam_nologin.c
View File

@ -52,18 +52,19 @@ __FBSDID("$FreeBSD$");
#include <security/pam_modules.h> #include <security/pam_modules.h>
#include <security/pam_mod_misc.h> #include <security/pam_mod_misc.h>
#define NOLOGIN "/var/run/nologin" #define _PATH_NOLOGIN "/var/run/nologin"
static char nologin_def[] = NOLOGIN; static char nologin_def[] = _PATH_NOLOGIN;
PAM_EXTERN int PAM_EXTERN int
pam_sm_acct_mgmt(pam_handle_t *pamh, int flags __unused, pam_sm_acct_mgmt(pam_handle_t *pamh, int flags,
int argc __unused, const char *argv[] __unused) int argc __unused, const char *argv[] __unused)
{ {
login_cap_t *lc; login_cap_t *lc;
struct passwd *pwd; struct passwd *pwd;
struct stat st; struct stat st;
int retval, fd; int retval, fd;
ssize_t ss;
const char *user, *nologin; const char *user, *nologin;
char *mtmp; char *mtmp;
@ -73,42 +74,54 @@ pam_sm_acct_mgmt(pam_handle_t *pamh, int flags __unused,
PAM_LOG("Got user: %s", user); PAM_LOG("Got user: %s", user);
lc = login_getclass(NULL); pwd = getpwnam(user);
if (pwd == NULL)
return (PAM_USER_UNKNOWN);
/*
* login_getpwclass(3) will select the "root" class by default
* if pwd->pw_uid is 0. That class should have "ignorenologin"
* capability so that super-user can bypass nologin.
*/
lc = login_getpwclass(pwd);
if (lc == NULL) {
PAM_LOG("Unable to get login class for user %s", user);
return (PAM_SERVICE_ERR);
}
if (login_getcapbool(lc, "ignorenologin", 0)) {
login_close(lc);
return (PAM_SUCCESS);
}
nologin = login_getcapstr(lc, "nologin", nologin_def, nologin_def); nologin = login_getcapstr(lc, "nologin", nologin_def, nologin_def);
login_close(lc);
lc = NULL;
fd = open(nologin, O_RDONLY, 0); fd = open(nologin, O_RDONLY, 0);
if (fd < 0) if (fd < 0) {
login_close(lc);
return (PAM_SUCCESS); return (PAM_SUCCESS);
PAM_LOG("Opened %s file", NOLOGIN);
pwd = getpwnam(user);
if (pwd && pwd->pw_uid == 0)
retval = PAM_SUCCESS;
else {
if (!pwd)
retval = PAM_USER_UNKNOWN;
else
retval = PAM_AUTH_ERR;
} }
if (fstat(fd, &st) < 0) PAM_LOG("Opened %s file", nologin);
return (retval);
mtmp = malloc(st.st_size + 1); if (fstat(fd, &st) == 0) {
if (mtmp != NULL) { mtmp = malloc(st.st_size + 1);
read(fd, mtmp, st.st_size); if (mtmp != NULL) {
mtmp[st.st_size] = '\0'; ss = read(fd, mtmp, st.st_size);
pam_error(pamh, "%s", mtmp); if (ss > 0) {
free(mtmp); mtmp[ss] = '\0';
pam_error(pamh, "%s", mtmp);
}
free(mtmp);
}
} }
if (retval != PAM_SUCCESS) PAM_VERBOSE_ERROR("Administrator refusing you: %s", nologin);
PAM_VERBOSE_ERROR("Administrator refusing you: %s", NOLOGIN);
return (retval); close(fd);
login_close(lc);
return (PAM_AUTH_ERR);
} }
PAM_MODULE_ENTRY("pam_nologin"); PAM_MODULE_ENTRY("pam_nologin");