On Fri, May 15, 2020 at 05:11:01AM +0300, Dmitry V. Levin wrote:
Give the application a chance to handle PAM_INCOMPLETE.
* modules/pam_faillock/pam_faillock.c (get_pam_user): Return
PAM_INCOMPLETE instead of PAM_CONV_AGAIN when pam_get_user returns
PAM_CONV_AGAIN.
* modules/pam_faillock/pam_faillock.8.xml (RETURN VALUES): Document it.
---
modules/pam_faillock/pam_faillock.8.xml | 9 +++++++++
modules/pam_faillock/pam_faillock.c | 2 +-
2 files changed, 10 insertions(+), 1 deletion(-)
diff --git a/modules/pam_faillock/pam_faillock.8.xml
b/modules/pam_faillock/pam_faillock.8.xml
index d7f2a3ce..c734c28c 100644
--- a/modules/pam_faillock/pam_faillock.8.xml
+++ b/modules/pam_faillock/pam_faillock.8.xml
@@ -170,6 +170,15 @@
</para>
</listitem>
</varlistentry>
+ <varlistentry>
+ <term>PAM_INCOMPLETE</term>
+ <listitem>
+ <para>
+ The conversation method supplied by the application
+ returned PAM_CONV_AGAIN.
+ </para>
+ </listitem>
+ </varlistentry>
<varlistentry>
<term>PAM_SUCCESS</term>
<listitem>
diff --git a/modules/pam_faillock/pam_faillock.c b/modules/pam_faillock/pam_faillock.c
index e340a83c..142cf7e3 100644
--- a/modules/pam_faillock/pam_faillock.c
+++ b/modules/pam_faillock/pam_faillock.c
@@ -394,7 +394,7 @@ get_pam_user(pam_handle_t *pamh, struct options *opts)
struct passwd *pwd;
if ((rv=pam_get_user(pamh, &user, NULL)) != PAM_SUCCESS) {
- return rv;
+ return rv == PAM_CONV_AGAIN ? PAM_INCOMPLETE : rv;
}
if (*user == '\0') {
Like most of our modules, this one is OK if called again,
so I've pushed the change as obvious.
--
ldv