[PATCH 6/4] pam_echo: add a test for return values
by Dmitry V. Levin
* modules/pam_echo/tst-pam_echo-retval.c: New file.
* modules/pam_echo/Makefile.am (TESTS): Add $(check_PROGRAMS).
(check_PROGRAMS, tst_pam_echo_retval_LDADD): New variables.
---
modules/pam_echo/Makefile.am | 5 +-
modules/pam_echo/tst-pam_echo-retval.c | 101 +++++++++++++++++++++++++
2 files changed, 105 insertions(+), 1 deletion(-)
create mode 100644 modules/pam_echo/tst-pam_echo-retval.c
diff --git a/modules/pam_echo/Makefile.am b/modules/pam_echo/Makefile.am
index 944b0cb8..b855e622 100644
--- a/modules/pam_echo/Makefile.am
+++ b/modules/pam_echo/Makefile.am
@@ -12,7 +12,7 @@ dist_man_MANS = pam_echo.8
endif
XMLS = README.xml pam_echo.8.xml
dist_check_SCRIPTS = tst-pam_echo
-TESTS = $(dist_check_SCRIPTS)
+TESTS = $(dist_check_SCRIPTS) $(check_PROGRAMS)
securelibdir = $(SECUREDIR)
secureconfdir = $(SCONFIGDIR)
@@ -27,6 +27,9 @@ endif
securelib_LTLIBRARIES = pam_echo.la
pam_echo_la_LIBADD = $(top_builddir)/libpam/libpam.la
+check_PROGRAMS = tst-pam_echo-retval
+tst_pam_echo_retval_LDADD = $(top_builddir)/libpam/libpam.la
+
if ENABLE_REGENERATE_MAN
dist_noinst_DATA = README
-include $(top_srcdir)/Make.xml.rules
diff --git a/modules/pam_echo/tst-pam_echo-retval.c b/modules/pam_echo/tst-pam_echo-retval.c
new file mode 100644
index 00000000..2374b71a
--- /dev/null
+++ b/modules/pam_echo/tst-pam_echo-retval.c
@@ -0,0 +1,101 @@
+/*
+ * Check pam_echo return values.
+ *
+ * Copyright (c) 2020 Dmitry V. Levin <ldv(a)altlinux.org>
+ */
+
+#include "test_assert.h"
+
+#include <limits.h>
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+#include <security/pam_appl.h>
+
+#define MODULE_NAME "pam_echo"
+#define TEST_NAME "tst-" MODULE_NAME "-retval"
+
+static const char service_file[] = TEST_NAME ".service";
+static const char user_name[] = "";
+static struct pam_conv conv;
+
+int
+main(void)
+{
+ pam_handle_t *pamh = NULL;
+ FILE *fp;
+ char cwd[PATH_MAX];
+
+ ASSERT_NE(NULL, getcwd(cwd, sizeof(cwd)));
+
+ /* PAM_SUCCESS -> PAM_SUCCESS, PAM_IGNORE -> PAM_PERM_DENIED */
+ ASSERT_NE(NULL, fp = fopen(service_file, "w"));
+ ASSERT_LT(0, fprintf(fp, "#%%PAM-1.0\n"
+ "auth required %s/.libs/%s.so\n"
+ "account required %s/.libs/%s.so\n"
+ "password required %s/.libs/%s.so\n"
+ "session required %s/.libs/%s.so\n",
+ cwd, MODULE_NAME,
+ cwd, MODULE_NAME,
+ cwd, MODULE_NAME,
+ cwd, MODULE_NAME));
+ ASSERT_EQ(0, fclose(fp));
+
+ ASSERT_EQ(PAM_SUCCESS,
+ pam_start_confdir(service_file, user_name, &conv, ".", &pamh));
+ ASSERT_NE(NULL, pamh);
+ ASSERT_EQ(PAM_SUCCESS, pam_authenticate(pamh, 0));
+ ASSERT_EQ(PAM_PERM_DENIED, pam_setcred(pamh, 0));
+ ASSERT_EQ(PAM_SUCCESS, pam_acct_mgmt(pamh, 0));
+ ASSERT_EQ(PAM_PERM_DENIED, pam_chauthtok(pamh, 0));
+ ASSERT_EQ(PAM_SUCCESS, pam_open_session(pamh, 0));
+ ASSERT_EQ(PAM_PERM_DENIED, pam_close_session(pamh, 0));
+ ASSERT_EQ(PAM_SUCCESS, pam_end(pamh, 0));
+ pamh = NULL;
+
+ /* PAM_SILENT: PAM_IGNORE -> PAM_PERM_DENIED */
+ ASSERT_EQ(PAM_SUCCESS,
+ pam_start_confdir(service_file, user_name, &conv, ".", &pamh));
+ ASSERT_NE(NULL, pamh);
+ ASSERT_EQ(PAM_PERM_DENIED, pam_authenticate(pamh, PAM_SILENT));
+ ASSERT_EQ(PAM_PERM_DENIED, pam_setcred(pamh, PAM_SILENT));
+ ASSERT_EQ(PAM_PERM_DENIED, pam_acct_mgmt(pamh, PAM_SILENT));
+ ASSERT_EQ(PAM_PERM_DENIED, pam_chauthtok(pamh, PAM_SILENT));
+ ASSERT_EQ(PAM_PERM_DENIED, pam_open_session(pamh, PAM_SILENT));
+ ASSERT_EQ(PAM_PERM_DENIED, pam_close_session(pamh, PAM_SILENT));
+ ASSERT_EQ(PAM_SUCCESS, pam_end(pamh, 0));
+ pamh = NULL;
+
+ /* PAM_IGNORE -> PAM_SUCCESS */
+ ASSERT_NE(NULL, fp = fopen(service_file, "w"));
+ ASSERT_LT(0, fprintf(fp, "#%%PAM-1.0\n"
+ "auth required %s/.libs/%s.so\n"
+ "auth required %s/../pam_permit/.libs/pam_permit.so\n"
+ "account required %s/.libs/%s.so\n"
+ "account required %s/../pam_permit/.libs/pam_permit.so\n"
+ "password required %s/.libs/%s.so\n"
+ "password required %s/../pam_permit/.libs/pam_permit.so\n"
+ "session required %s/.libs/%s.so\n"
+ "session required %s/../pam_permit/.libs/pam_permit.so\n",
+ cwd, MODULE_NAME, cwd,
+ cwd, MODULE_NAME, cwd,
+ cwd, MODULE_NAME, cwd,
+ cwd, MODULE_NAME, cwd));
+ ASSERT_EQ(0, fclose(fp));
+
+ ASSERT_EQ(PAM_SUCCESS,
+ pam_start_confdir(service_file, user_name, &conv, ".", &pamh));
+ ASSERT_NE(NULL, pamh);
+ ASSERT_EQ(PAM_SUCCESS, pam_authenticate(pamh, PAM_SILENT));
+ ASSERT_EQ(PAM_SUCCESS, pam_setcred(pamh, PAM_SILENT));
+ ASSERT_EQ(PAM_SUCCESS, pam_acct_mgmt(pamh, PAM_SILENT));
+ ASSERT_EQ(PAM_SUCCESS, pam_chauthtok(pamh, PAM_SILENT));
+ ASSERT_EQ(PAM_SUCCESS, pam_open_session(pamh, PAM_SILENT));
+ ASSERT_EQ(PAM_SUCCESS, pam_close_session(pamh, PAM_SILENT));
+ ASSERT_EQ(PAM_SUCCESS, pam_end(pamh, 0));
+ pamh = NULL;
+
+ ASSERT_EQ(0, unlink(service_file));
+
+ return 0;
+}
--
ldv
4 years, 1 month
[PATCH 5/4] pam_warn: add a test for return values
by Dmitry V. Levin
* modules/pam_warn/tst-pam_warn-retval.c: New file.
* modules/pam_warn/Makefile.am (TESTS): Add $(check_PROGRAMS).
(check_PROGRAMS, tst_pam_warn_retval_LDADD): New variables.
---
modules/pam_warn/Makefile.am | 5 +-
modules/pam_warn/tst-pam_warn-retval.c | 88 ++++++++++++++++++++++++++
2 files changed, 92 insertions(+), 1 deletion(-)
create mode 100644 modules/pam_warn/tst-pam_warn-retval.c
diff --git a/modules/pam_warn/Makefile.am b/modules/pam_warn/Makefile.am
index 0a5b54ff..d0f021fe 100644
--- a/modules/pam_warn/Makefile.am
+++ b/modules/pam_warn/Makefile.am
@@ -12,7 +12,7 @@ dist_man_MANS = pam_warn.8
endif
XMLS = README.xml pam_warn.8.xml
dist_check_SCRIPTS = tst-pam_warn
-TESTS = $(dist_check_SCRIPTS)
+TESTS = $(dist_check_SCRIPTS) $(check_PROGRAMS)
securelibdir = $(SECUREDIR)
secureconfdir = $(SCONFIGDIR)
@@ -27,6 +27,9 @@ endif
securelib_LTLIBRARIES = pam_warn.la
pam_warn_la_LIBADD = $(top_builddir)/libpam/libpam.la
+check_PROGRAMS = tst-pam_warn-retval
+tst_pam_warn_retval_LDADD = $(top_builddir)/libpam/libpam.la
+
if ENABLE_REGENERATE_MAN
dist_noinst_DATA = README
-include $(top_srcdir)/Make.xml.rules
diff --git a/modules/pam_warn/tst-pam_warn-retval.c b/modules/pam_warn/tst-pam_warn-retval.c
new file mode 100644
index 00000000..49d6524e
--- /dev/null
+++ b/modules/pam_warn/tst-pam_warn-retval.c
@@ -0,0 +1,88 @@
+/*
+ * Check pam_warn return values.
+ *
+ * Copyright (c) 2020 Dmitry V. Levin <ldv(a)altlinux.org>
+ */
+
+#include "test_assert.h"
+
+#include <limits.h>
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+#include <security/pam_appl.h>
+
+#define MODULE_NAME "pam_warn"
+#define TEST_NAME "tst-" MODULE_NAME "-retval"
+
+static const char service_file[] = TEST_NAME ".service";
+static const char user_name[] = "";
+static struct pam_conv conv;
+
+int
+main(void)
+{
+ pam_handle_t *pamh = NULL;
+ FILE *fp;
+ char cwd[PATH_MAX];
+
+ ASSERT_NE(NULL, getcwd(cwd, sizeof(cwd)));
+
+ /* PAM_IGNORE -> PAM_PERM_DENIED */
+ ASSERT_NE(NULL, fp = fopen(service_file, "w"));
+ ASSERT_LT(0, fprintf(fp, "#%%PAM-1.0\n"
+ "auth required %s/.libs/%s.so\n"
+ "account required %s/.libs/%s.so\n"
+ "password required %s/.libs/%s.so\n"
+ "session required %s/.libs/%s.so\n",
+ cwd, MODULE_NAME,
+ cwd, MODULE_NAME,
+ cwd, MODULE_NAME,
+ cwd, MODULE_NAME));
+ ASSERT_EQ(0, fclose(fp));
+
+ ASSERT_EQ(PAM_SUCCESS,
+ pam_start_confdir(service_file, user_name, &conv, ".", &pamh));
+ ASSERT_NE(NULL, pamh);
+ ASSERT_EQ(PAM_PERM_DENIED, pam_authenticate(pamh, 0));
+ ASSERT_EQ(PAM_PERM_DENIED, pam_setcred(pamh, 0));
+ ASSERT_EQ(PAM_PERM_DENIED, pam_acct_mgmt(pamh, 0));
+ ASSERT_EQ(PAM_PERM_DENIED, pam_chauthtok(pamh, 0));
+ ASSERT_EQ(PAM_PERM_DENIED, pam_open_session(pamh, 0));
+ ASSERT_EQ(PAM_PERM_DENIED, pam_close_session(pamh, 0));
+ ASSERT_EQ(PAM_SUCCESS, pam_end(pamh, 0));
+ pamh = NULL;
+
+ /* PAM_IGNORE -> PAM_SUCCESS */
+ ASSERT_NE(NULL, fp = fopen(service_file, "w"));
+ ASSERT_LT(0, fprintf(fp, "#%%PAM-1.0\n"
+ "auth required %s/.libs/%s.so\n"
+ "auth required %s/../pam_permit/.libs/pam_permit.so\n"
+ "account required %s/.libs/%s.so\n"
+ "account required %s/../pam_permit/.libs/pam_permit.so\n"
+ "password required %s/.libs/%s.so\n"
+ "password required %s/../pam_permit/.libs/pam_permit.so\n"
+ "session required %s/.libs/%s.so\n"
+ "session required %s/../pam_permit/.libs/pam_permit.so\n",
+ cwd, MODULE_NAME, cwd,
+ cwd, MODULE_NAME, cwd,
+ cwd, MODULE_NAME, cwd,
+ cwd, MODULE_NAME, cwd));
+ ASSERT_EQ(0, fclose(fp));
+
+ ASSERT_EQ(PAM_SUCCESS,
+ pam_start_confdir(service_file, user_name, &conv, ".", &pamh));
+ ASSERT_NE(NULL, pamh);
+ ASSERT_EQ(PAM_SUCCESS, pam_authenticate(pamh, 0));
+ ASSERT_EQ(PAM_SUCCESS, pam_setcred(pamh, 0));
+ ASSERT_EQ(PAM_SUCCESS, pam_acct_mgmt(pamh, 0));
+ ASSERT_EQ(PAM_SUCCESS, pam_chauthtok(pamh, 0));
+ ASSERT_EQ(PAM_SUCCESS, pam_open_session(pamh, 0));
+ ASSERT_EQ(PAM_SUCCESS, pam_close_session(pamh, 0));
+ ASSERT_EQ(PAM_SUCCESS, pam_end(pamh, 0));
+ pamh = NULL;
+
+ ASSERT_EQ(0, unlink(service_file));
+
+ return 0;
+}
--
ldv
4 years, 1 month
[PATCH 0/4] pam_get_user: fix return values
by Dmitry V. Levin
Our modules are very inconsistent in the way they use the value returned
by pam_get_user. They have to be fixed, but pam_get_user has to be fixed
first.
I've also pushed the series to ldv/pam_get_user branch.
Dmitry V. Levin (4):
pam_get_user: consistently return PAM_SYSTEM_ERR if user specified a NULL pointer
man: document other valid pam_get_user return values
pam_get_user: filter conversation function return values
pam_get_user: do not override valid values returned by the conversation function
doc/man/pam_get_user.3.xml | 25 +++++++++++++++
libpam/pam_item.c | 62 +++++++++++++++++++++++---------------
2 files changed, 63 insertions(+), 24 deletions(-)
--
ldv
4 years, 1 month
Q: remove PAM_SM_*
by Dmitry V. Levin
Hi,
Starting with commit Linux-PAM-1.3.0~14 (Remove "--enable-static-modules"
option and support from Linux-PAM) PAM_SM_* macros have no effect.
I don't see why we still describe them in docs and define them in modules.
Shouldn't PAM_SM_* just be removed altogether?
--
ldv
4 years, 1 month
[PATCH 2/2] pam_usertype: do not override the default prompt
by Dmitry V. Levin
Following the bad example in pam_succeed_if module, from the very
beginning pam_usertype used to override the default prompt used by
pam_get_user() with "login: ". Fix this now.
* modules/pam_usertype/pam_usertype.c (pam_sm_authenticate): Do not
request PAM_USER_PROMPT item, invoke pam_get_user() with the default
prompt.
---
modules/pam_usertype/pam_usertype.c | 8 +-------
1 file changed, 1 insertion(+), 7 deletions(-)
diff --git a/modules/pam_usertype/pam_usertype.c b/modules/pam_usertype/pam_usertype.c
index a15599e3..820cf693 100644
--- a/modules/pam_usertype/pam_usertype.c
+++ b/modules/pam_usertype/pam_usertype.c
@@ -112,7 +112,6 @@ pam_usertype_get_uid(struct pam_usertype_opts *opts,
uid_t *_uid)
{
struct passwd *pwd;
- const void *prompt;
const char *username;
int ret;
@@ -131,12 +130,7 @@ pam_usertype_get_uid(struct pam_usertype_opts *opts,
}
/* Get uid of user that is being authenticated. */
- ret = pam_get_item(pamh, PAM_USER_PROMPT, &prompt);
- if (ret != PAM_SUCCESS || prompt == NULL || strlen(prompt) == 0) {
- prompt = "login: ";
- }
-
- ret = pam_get_user(pamh, &username, prompt);
+ ret = pam_get_user(pamh, &username, NULL);
if (ret != PAM_SUCCESS || username == NULL) {
pam_syslog(pamh, LOG_ERR, "error retrieving user name: %s",
pam_strerror(pamh, ret));
--
ldv
4 years, 1 month
[PATCH 1/2] pam_succeed_if: do not override the default prompt
by Dmitry V. Levin
From the very beginning pam_succeed_if used to override the default
prompt used by pam_get_user() with "login: ". Fix this now.
* modules/pam_succeed_if/pam_succeed_if.c (pam_sm_authenticate): Do not
request PAM_USER_PROMPT item, invoke pam_get_user() with the default
prompt.
---
modules/pam_succeed_if/pam_succeed_if.c | 9 +--------
1 file changed, 1 insertion(+), 8 deletions(-)
diff --git a/modules/pam_succeed_if/pam_succeed_if.c b/modules/pam_succeed_if/pam_succeed_if.c
index f33e6097..82de4f33 100644
--- a/modules/pam_succeed_if/pam_succeed_if.c
+++ b/modules/pam_succeed_if/pam_succeed_if.c
@@ -463,19 +463,12 @@ int
pam_sm_authenticate (pam_handle_t *pamh, int flags UNUSED,
int argc, const char **argv)
{
- const void *prompt;
const char *user;
struct passwd *pwd = NULL;
int ret, i, count, use_uid, debug;
const char *left, *right, *qual;
int quiet_fail, quiet_succ, audit;
- /* Get the user prompt. */
- ret = pam_get_item(pamh, PAM_USER_PROMPT, &prompt);
- if ((ret != PAM_SUCCESS) || (prompt == NULL) || (strlen(prompt) == 0)) {
- prompt = "login: ";
- }
-
quiet_fail = 0;
quiet_succ = 0;
audit = 0;
@@ -513,7 +506,7 @@ pam_sm_authenticate (pam_handle_t *pamh, int flags UNUSED,
user = pwd->pw_name;
} else {
/* Get the user's name. */
- ret = pam_get_user(pamh, &user, prompt);
+ ret = pam_get_user(pamh, &user, NULL);
if ((ret != PAM_SUCCESS) || (user == NULL)) {
pam_syslog(pamh, LOG_ERR,
"error retrieving user name: %s",
--
ldv
4 years, 1 month
[PATCH 4/4] pam_get_user: do not override valid values returned by the conversation function
by Dmitry V. Levin
When the conversation function returned a value different from
PAM_CONV_AGAIN and provided no response, pam_get_user used to replace
the return value with PAM_CONV_ERR. Fix this and replace the return
value only if it was PAM_SUCCESS.
* libpam/pam_item.c (pam_get_user): Do not override valid values
returned by the conversation function.
---
libpam/pam_item.c | 48 +++++++++++++++++++++++++----------------------
1 file changed, 26 insertions(+), 22 deletions(-)
diff --git a/libpam/pam_item.c b/libpam/pam_item.c
index 4cca6d9b..d6af710b 100644
--- a/libpam/pam_item.c
+++ b/libpam/pam_item.c
@@ -353,28 +353,32 @@ int pam_get_user(pam_handle_t *pamh, const char **user, const char *prompt)
retval = PAM_CONV_ERR;
}
- if (retval == PAM_CONV_AGAIN) {
- /* conversation function is waiting for an event - save state */
- D(("conversation function is not ready yet"));
- pamh->former.want_user = PAM_TRUE;
- pamh->former.prompt = _pam_strdup(use_prompt);
- } else if (resp == NULL || resp->resp == NULL) {
- /*
- * conversation should have given a response
- */
- D(("pam_get_user: no response provided"));
- retval = PAM_CONV_ERR;
- pamh->former.fail_user = retval;
- } else if (retval == PAM_SUCCESS) { /* copy the username */
- /*
- * now we set the PAM_USER item -- this was missing from pre.53
- * releases. However, reading the Sun manual, it is part of
- * the standard API.
- */
- retval = pam_set_item(pamh, PAM_USER, resp->resp);
- *user = pamh->user;
- } else
- pamh->former.fail_user = retval;
+ switch (retval) {
+ case PAM_CONV_AGAIN:
+ /* conversation function is waiting for an event - save state */
+ D(("conversation function is not ready yet"));
+ pamh->former.want_user = PAM_TRUE;
+ pamh->former.prompt = _pam_strdup(use_prompt);
+ break;
+ case PAM_SUCCESS:
+ if (resp != NULL && resp->resp != NULL) {
+ /*
+ * now we set the PAM_USER item -- this was missing from pre.53
+ * releases. However, reading the Sun manual, it is part of
+ * the standard API.
+ */
+ retval = pam_set_item(pamh, PAM_USER, resp->resp);
+ *user = pamh->user;
+ break;
+ } else {
+ /* conversation should have given a response */
+ D(("pam_get_user: no response provided"));
+ retval = PAM_CONV_ERR;
+ }
+ /* fallthrough */
+ default:
+ pamh->former.fail_user = retval;
+ }
if (resp) {
if (retval != PAM_SUCCESS)
--
ldv
4 years, 1 month
[PATCH 3/4] pam_get_user: filter conversation function return values
by Dmitry V. Levin
Do not assume that the conversation function provided by the application
strictly follows the return values guidelines, replace undocumented
return values with PAM_CONV_ERR.
* libpam/pam_item.c (pam_get_user): If the value returned by the
conversation function is not one of PAM_SUCCESS, PAM_BUF_ERR,
PAM_CONV_AGAIN, or PAM_CONV_ERR, replace it with PAM_CONV_ERR.
---
libpam/pam_item.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/libpam/pam_item.c b/libpam/pam_item.c
index 36298ce0..4cca6d9b 100644
--- a/libpam/pam_item.c
+++ b/libpam/pam_item.c
@@ -343,6 +343,16 @@ int pam_get_user(pam_handle_t *pamh, const char **user, const char *prompt)
retval = pamh->pam_conversation->
conv(1, &pmsg, &resp, pamh->pam_conversation->appdata_ptr);
+ switch (retval) {
+ case PAM_SUCCESS:
+ case PAM_BUF_ERR:
+ case PAM_CONV_AGAIN:
+ case PAM_CONV_ERR:
+ break;
+ default:
+ retval = PAM_CONV_ERR;
+ }
+
if (retval == PAM_CONV_AGAIN) {
/* conversation function is waiting for an event - save state */
D(("conversation function is not ready yet"));
--
ldv
4 years, 1 month
[PATCH 2/4] man: document other valid pam_get_user return values
by Dmitry V. Levin
* doc/man/pam_get_user.3.xml (pam_get_user-return_values): Add
PAM_BUF_ERR, PAM_ABORT, and PAM_CONV_AGAIN.
---
doc/man/pam_get_user.3.xml | 25 +++++++++++++++++++++++++
1 file changed, 25 insertions(+)
diff --git a/doc/man/pam_get_user.3.xml b/doc/man/pam_get_user.3.xml
index 16ef5483..8bb176e4 100644
--- a/doc/man/pam_get_user.3.xml
+++ b/doc/man/pam_get_user.3.xml
@@ -115,6 +115,31 @@
</para>
</listitem>
</varlistentry>
+ <varlistentry>
+ <term>PAM_BUF_ERR</term>
+ <listitem>
+ <para>
+ Memory buffer error.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>PAM_ABORT</term>
+ <listitem>
+ <para>
+ Error resuming an old conversation.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>PAM_CONV_AGAIN</term>
+ <listitem>
+ <para>
+ The conversation method supplied by the application
+ is waiting for an event.
+ </para>
+ </listitem>
+ </varlistentry>
</variablelist>
</refsect1>
--
ldv
4 years, 1 month
[PATCH 1/4] pam_get_user: consistently return PAM_SYSTEM_ERR if user specified a NULL pointer
by Dmitry V. Levin
pam_get_user returns PAM_SYSTEM_ERR in case of pamh == NULL.
In case of user == NULL, however, it used to return PAM_PERM_DENIED,
and in case of NULL conversation function it used to return
PAM_SERVICE_ERR.
According to the documentation, PAM_SYSTEM_ERR shall be returned
if a NULL pointer was submitted.
Fix this inconsistency and return PAM_SYSTEM_ERR in each of these
programming error cases.
* libpam/pam_item.c (pam_get_user): Return PAM_SYSTEM_ERR instead of
PAM_PERM_DENIED if user == NULL. Return PAM_SYSTEM_ERR instead of
PAM_SERVICE_ERR if pamh->pam_conversation == NULL.
---
libpam/pam_item.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libpam/pam_item.c b/libpam/pam_item.c
index 8148fd57..36298ce0 100644
--- a/libpam/pam_item.c
+++ b/libpam/pam_item.c
@@ -285,13 +285,13 @@ int pam_get_user(pam_handle_t *pamh, const char **user, const char *prompt)
if (user == NULL) {
/* ensure that the module has supplied a destination */
pam_syslog(pamh, LOG_ERR, "pam_get_user: nowhere to record username");
- return PAM_PERM_DENIED;
+ return PAM_SYSTEM_ERR;
} else
*user = NULL;
if (pamh->pam_conversation == NULL) {
pam_syslog(pamh, LOG_ERR, "pam_get_user: no conv element in pamh");
- return PAM_SERVICE_ERR;
+ return PAM_SYSTEM_ERR;
}
if (pamh->user) { /* have one so return it */
--
ldv
4 years, 1 month