Attachment 66977 Details for Bug 149021

[patch] let pam_winbind not only rely on getpwnam

diff (text/plain), 1.78 KB, created by Guenther Deschner on 2006-02-08 13:15:06 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Guenther Deschner

Created: 2006-02-08 13:15:06 UTC

Size: 1.78 KB

patch

obsolete

>Index: source/nsswitch/pam_winbind.c
>===================================================================
>--- source/nsswitch/pam_winbind.c	(revision 13391)
>+++ source/nsswitch/pam_winbind.c	(working copy)
>@@ -566,10 +569,36 @@
>  *	 0  = OK
>  * 	-1  = System error
>  */
>-static int valid_user(const char *user)
>+static int valid_user(const char *user, pam_handle_t *pamh, int ctrl)
> {
>-	if (getpwnam(user)) return 0;
>-	return 1;
>+	/* check not only if the user is available over NSS calls, also make
>+	 * sure it's really a winbind user, this is important when stacking PAM
>+	 * modules in the 'account' or 'password' facility. */
>+
>+	struct winbindd_request request;
>+	struct winbindd_response response;
>+	struct passwd *pwd = NULL;
>+	int ret;
>+
>+	ZERO_STRUCT(request);
>+	ZERO_STRUCT(response);
>+
>+	pwd = getpwnam(user);
>+	if (pwd == NULL) {
>+		return 1;
>+	}
>+
>+	fstrcpy(request.data.name.name, user);
>+	
>+	ret = pam_winbind_request_log(pamh, ctrl, WINBINDD_LOOKUPNAME, &request, &response, user);
>+	switch (ret) {
>+		case PAM_USER_UNKNOWN:
>+			return 1;
>+		case PAM_SUCCESS:
>+			return 0;
>+		default:
>+			return -1;
>+	}
> }
> 
> static char *_pam_delete(register char *xx)
>@@ -897,7 +960,7 @@
> 	}
> 
> 	/* Verify the username */
>-	retval = valid_user(username);
>+	retval = valid_user(username, pamh, ctrl);
> 	switch (retval) {
> 	case -1:
> 		/* some sort of system error. The log was already printed */
>@@ -1130,6 +1193,17 @@
> 
> 	if (flags & PAM_PRELIM_CHECK) {
> 		
>+		/* check if this is really a user in winbindd, not only in NSS */
>+		retval = valid_user(user, pamh, ctrl);
>+		switch (retval) {
>+			case 1:
>+				return PAM_USER_UNKNOWN;
>+			case -1:
>+				return PAM_SYSTEM_ERR;
>+			default:
>+				break;
>+		}
>+		
> 		/* instruct user what is happening */
> #define greeting "Changing password for "
> 		fstrcpy(Announce, greeting);

Actions: View | Diff

Attachments on bug 149021: 66977 | 67208 | 67689 | 67690