On (29/10/15 15:32), Pavel Reichl wrote:
Hello,
while I worked on tests for PAM responder Sumit proposed to use attached patch. QA have
already kindly run their tests (successfully).
I'll do the review myself (But all opinions are welcomed for sure).
Thanks
From 55e487ac403f39e8b65e9373b06059399e74b792 Mon Sep 17 00:00:00
2001
From: Sumit Bose <sbose(a)redhat.com>
Date: Mon, 19 Oct 2015 13:10:51 -0400
Subject: [PATCH] PAM: successful authentication sets explicitly PAM_SUCCESSS
Set PAM_SYSTEM_ERR as default pam_status to ensure that we always must
set PAM_SUCCESSS explicitly for a successful authentication and will
really return an error in all other cases.
---
src/providers/dp_pam_data_util.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/src/providers/dp_pam_data_util.c b/src/providers/dp_pam_data_util.c
index 10e91f5f7286db5e76ad98b6c7519f2482d006db..f471c7d02f5c86d1b1a45dd152c048de0e0bbb44
100644
--- a/src/providers/dp_pam_data_util.c
+++ b/src/providers/dp_pam_data_util.c
@@ -22,6 +22,8 @@
along with this program. If not, see <
http://www.gnu.org/licenses/>.
*/
+#include <security/_pam_types.h>
+
We try to avoid including non-standar pam header files.
Prefix "_" is Linux PAM specific.
sh$ git grep pam_types | wc -l
0
sh$ git grep pam_modules .
src/external/pam.m4:AC_CHECK_HEADERS([security/pam_appl.h security/pam_modules.h],
src/providers/ad/ad_access.c:#include <security/pam_modules.h>
src/providers/ad/ad_gpo.c:#include <security/pam_modules.h>
src/providers/ad/ad_gpo_child.c:#include <security/pam_modules.h>
src/providers/data_provider_be.c:#include <security/pam_modules.h>
src/providers/ipa/ipa_access.c:#include <security/pam_modules.h>
src/providers/ipa/ipa_auth.c:#include <security/pam_modules.h>
src/providers/ipa/ipa_selinux.c:#include <security/pam_modules.h>
src/providers/krb5/krb5_auth.c:#include <security/pam_modules.h>
src/providers/krb5/krb5_child.c:#include <security/pam_modules.h>
src/providers/krb5/krb5_delayed_online_authentication.c:#include
<security/pam_modules.h>
src/providers/krb5/krb5_renew_tgt.c:#include <security/pam_modules.h>
src/providers/krb5/krb5_wait_queue.c:#include <security/pam_modules.h>
src/providers/ldap/ldap_access.c:#include <security/pam_modules.h>
src/providers/ldap/ldap_auth.c:#include <security/pam_modules.h>
src/providers/ldap/sdap_access.c:#include <security/pam_modules.h>
src/providers/proxy/proxy.h:#include <security/pam_modules.h>
src/providers/proxy/proxy_child.c:#include <security/pam_modules.h>
src/providers/simple/simple_access.c:#include <security/pam_modules.h>
src/responder/pam/pam_LOCAL_domain.c:#include <security/pam_modules.h>
src/responder/pam/pamsrv_dp.c:#include <security/pam_modules.h>
src/sss_client/common.c:#include <security/pam_modules.h>
src/sss_client/pam_message.c:#include <security/pam_modules.h>
src/sss_client/pam_sss.c:#include <security/pam_modules.h>
src/tests/cmocka/test_krb5_wait_queue.c:#include <security/pam_modules.h>
src/tests/cmocka/test_pam_srv.c:#include <security/pam_modules.h>
LS