>From cd04ed98af669a07f0b6c6a2e9c2b845781493fd Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Wed, 10 Dec 2014 12:02:47 +0100 Subject: [PATCH 2/4] PAM: Missing argument to domains= should fail auth --- src/sss_client/pam_sss.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/sss_client/pam_sss.c b/src/sss_client/pam_sss.c index d64e826daeb80be8998ef3b410047e3a44051b07..fdf6c9e6da75c9f7eaa7c00d9a5792fbdd97eabc 100644 --- a/src/sss_client/pam_sss.c +++ b/src/sss_client/pam_sss.c @@ -1487,6 +1487,12 @@ static int pam_sss(enum sss_cli_command task, pam_handle_t *pamh, eval_argv(pamh, argc, argv, &flags, &retries, &quiet_mode, &domains); + /* Fail all authentication on misconfigured domains= parameter. The admin + * probably wanted to restrict authentication, so it's safer to fail */ + if (domains && strcmp(domains, "") == 0) { + return PAM_SYSTEM_ERR; + } + pi.requested_domains = domains; ret = get_pam_items(pamh, &pi); -- 1.9.3