On Fri, May 15, 2020 at 02:02:32AM +0300, Dmitry V. Levin wrote:
Starting with commit c2c601f5340a59c5c62193d55b555d384380ea38,
pam_get_user is guaranteed to return one of the following values:
PAM_SUCCESS, PAM_BUF_ERR, PAM_CONV_AGAIN, or PAM_CONV_ERR.
If pam_get_user returned PAM_SUCCESS, the user name is guaranteed
to be non-NULL.
* modules/pam_securetty/pam_securetty.c (pam_sm_authenticate): Do not
replace non-PAM_CONV_AGAIN error values returned by pam_get_user with
PAM_SERVICE_ERR. Do not check the user name returned by pam_get_user
when the latter returned PAM_SUCCESS.
* modules/pam_securetty/pam_securetty.8.xml (RETURN VALUES): Document
new return values.
---
modules/pam_securetty/pam_securetty.8.xml | 22 +++++++++++++++++++---
modules/pam_securetty/pam_securetty.c | 4 ++--
2 files changed, 21 insertions(+), 5 deletions(-)
diff --git a/modules/pam_securetty/pam_securetty.8.xml
b/modules/pam_securetty/pam_securetty.8.xml
index b5e83691..e49d572b 100644
--- a/modules/pam_securetty/pam_securetty.8.xml
+++ b/modules/pam_securetty/pam_securetty.8.xml
@@ -114,13 +114,29 @@
</para>
</listitem>
</varlistentry>
+ <varlistentry>
+ <term>PAM_BUF_ERR</term>
+ <listitem>
+ <para>
+ Memory buffer error.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>PAM_CONV_ERR</term>
+ <listitem>
+ <para>
+ The conversation method supplied by the application
+ failed to obtain the username.
+ </para>
+ </listitem>
+ </varlistentry>
<varlistentry>
<term>PAM_INCOMPLETE</term>
<listitem>
<para>
- An application error occurred. pam_securetty was not able
- to get information it required from the application that
- called it.
+ The conversation method supplied by the application
+ returned PAM_CONV_AGAIN.
</para>
</listitem>
</varlistentry>
diff --git a/modules/pam_securetty/pam_securetty.c
b/modules/pam_securetty/pam_securetty.c
index 9a2835ef..5f52d3a9 100644
--- a/modules/pam_securetty/pam_securetty.c
+++ b/modules/pam_securetty/pam_securetty.c
@@ -83,9 +83,9 @@ securetty_perform_check (pam_handle_t *pamh, int ctrl,
}
retval = pam_get_user(pamh, &username, NULL);
- if (retval != PAM_SUCCESS || username == NULL) {
+ if (retval != PAM_SUCCESS) {
pam_syslog(pamh, LOG_WARNING, "cannot determine username");
- return (retval == PAM_CONV_AGAIN ? PAM_INCOMPLETE:PAM_SERVICE_ERR);
+ return (retval == PAM_CONV_AGAIN ? PAM_INCOMPLETE : retval);
}
user_pwd = pam_modutil_getpwnam(pamh, username);
This is actually two different but obvious changes, pushed them
in separate commits.
--
ldv