[SSSD] [PATCH] Fix wrong return value

Sumit Bose sbose at redhat.com
Tue Apr 27 11:18:14 UTC 2010


Hi,

the patch which removes the authentication tokens from the PAM stack
didn't return the right status code if a password change fails. To make
it easier to read I introduced a new variable.

bye,
Sumit
-------------- next part --------------
From 5a17478b0cdee8309bd018be85dec62b33e92322 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Tue, 27 Apr 2010 12:45:20 +0200
Subject: [PATCH] Fix wrong return value

If there was a failure during a password change a wrong return value was
send back to the PAM stack.
---
 src/sss_client/pam_sss.c |   27 +++++++++++++--------------
 1 files changed, 13 insertions(+), 14 deletions(-)

diff --git a/src/sss_client/pam_sss.c b/src/sss_client/pam_sss.c
index 3f88d68..31a3de8 100644
--- a/src/sss_client/pam_sss.c
+++ b/src/sss_client/pam_sss.c
@@ -1330,6 +1330,7 @@ static int pam_sss(enum sss_cli_command task, pam_handle_t *pamh,
                    int pam_flags, int argc, const char **argv)
 {
     int ret;
+    int pam_status;
     struct pam_items pi;
     uint32_t flags = 0;
     int *exp_data;
@@ -1376,13 +1377,13 @@ static int pam_sss(enum sss_cli_command task, pam_handle_t *pamh,
             return PAM_SYSTEM_ERR;
     }
 
-    ret = send_and_receive(pamh, &pi, task);
+    pam_status = send_and_receive(pamh, &pi, task);
 
     switch (task) {
         case SSS_PAM_AUTHENTICATE:
             /* We allow sssd to send the return code PAM_NEW_AUTHTOK_REQD during
              * authentication, see sss_cli.h for details */
-            if (ret == PAM_NEW_AUTHTOK_REQD) {
+            if (pam_status == PAM_NEW_AUTHTOK_REQD) {
                 D(("Authtoken expired, trying to change it"));
 
                 exp_data = malloc(sizeof(int));
@@ -1392,18 +1393,16 @@ static int pam_sss(enum sss_cli_command task, pam_handle_t *pamh,
                     break;
                 }
                 *exp_data = 1;
-                ret = pam_set_data(pamh, PWEXP_FLAG, exp_data, free_exp_data);
-                if (ret != PAM_SUCCESS) {
+
+                pam_status = pam_set_data(pamh, PWEXP_FLAG, exp_data,
+                                          free_exp_data);
+                if (pam_status != PAM_SUCCESS) {
                     D(("pam_set_data failed."));
-                    ret = ret;
-                    break;
                 }
-
-                ret = PAM_SUCCESS;
             }
             break;
         case SSS_PAM_ACCT_MGMT:
-            if (ret == PAM_SUCCESS &&
+            if (pam_status == PAM_SUCCESS &&
                 pam_get_data(pamh, PWEXP_FLAG, (const void **) &exp_data) ==
                                                                   PAM_SUCCESS) {
                 ret = do_pam_conversation(pamh, PAM_TEXT_INFO,
@@ -1412,11 +1411,11 @@ static int pam_sss(enum sss_cli_command task, pam_handle_t *pamh,
                 if (ret != PAM_SUCCESS) {
                     D(("do_pam_conversation failed."));
                 }
-                ret = PAM_NEW_AUTHTOK_REQD;
+                pam_status = PAM_NEW_AUTHTOK_REQD;
             }
             break;
         case SSS_PAM_CHAUTHTOK:
-            if (ret != PAM_SUCCESS && ret != PAM_USER_UNKNOWN) {
+            if (pam_status != PAM_SUCCESS && pam_status != PAM_USER_UNKNOWN) {
                 ret = pam_set_item(pamh, PAM_AUTHTOK, NULL);
                 if (ret != PAM_SUCCESS) {
                     D(("Failed to unset PAM_AUTHTOK [%s]",
@@ -1430,15 +1429,15 @@ static int pam_sss(enum sss_cli_command task, pam_handle_t *pamh,
             }
             break;
         case SSS_PAM_CHAUTHTOK_PRELIM:
-            if (ret == PAM_PERM_DENIED && pi.pam_authtok_size == 0 &&
+            if (pam_status == PAM_PERM_DENIED && pi.pam_authtok_size == 0 &&
                 getuid() == 0 &&
                 pam_get_data(pamh, PWEXP_FLAG, (const void **) &exp_data) !=
                                                                   PAM_SUCCESS) {
 
                 ret = select_pw_reset_message(pamh, &pi);
                 if (ret != 0) {
+                    D(("select_pw_reset_message failed.\n"));
                 }
-                ret = PAM_PERM_DENIED;
             }
         default:
             /* nothing to do */
@@ -1449,7 +1448,7 @@ static int pam_sss(enum sss_cli_command task, pam_handle_t *pamh,
 
     overwrite_and_free_pam_items(&pi);
 
-    return ret;
+    return pam_status;
 }
 
 PAM_EXTERN int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc,
-- 
1.6.6.1



More information about the sssd-devel mailing list