On Wed, 2020-05-06 at 17:40 +0300, Dmitry V. Levin wrote:
On Mon, May 04, 2020 at 01:46:55AM +0300, Dmitry V. Levin wrote:
This started as small fixes here and there, and ended up as a major cleanup of the module. Now pam_localuser is the first module that has a decent "make distcheck" coverage.
I've also pushed the series to ldv/pam_localuser branch.
Dmitry V. Levin (13): pam_localuser: reject user names containing a colon pam_localuser: reject user names that are too long pam_localuser: return PAM_SERVICE_ERR instead of PAM_SYSTEM_ERR pam_localuser: log unrecognized options pam_localuser: get rid of a temporary buffer pam_localuser: handle long lines in passwd files properly pam_localuser: use BUFSIZ as the line buffer size pam_localuser: open the passwd file after user name validation pam_localuser: return PAM_INCOMPLETE when pam_get_user returns PAM_CONV_AGAIN pam_localuser: remove unused includes pam_localuser: re-format pam_sm_* function declarations pam_localuser: refactor pam_sm_authenticate pam_localuser: add a test for file= option
modules/pam_localuser/Makefile.am | 5 +- modules/pam_localuser/pam_localuser.c | 182 +++++++++++---
.../pam_localuser/tst-pam_localuser-file.c | 173 +++++++++++++++++ 3 files changed, 292 insertions(+), 68 deletions(-) create mode 100644 modules/pam_localuser/tst-pam_localuser-file.c
Any comments so far?
Just a few nits:
1. syslog log levels - in general if some error is coming not from misconfiguration or system error but from the user input, it should be logged with LOG_NOTICE and not LOG_ERR.
2. Also when PAM_CONV_AGAIN is returned the syslog message should not be logged with LOG_ERR but LOG_DEBUG or LOG_NOTICE. To not complicate the code for this I'd just use LOG_NOTICE for all errors returned from pam_get_users.
OK to commit, with the syslog nits fixed.