[SSSD] [PATCH] Fix wrong return value

Sumit Bose sbose at redhat.com
Tue Apr 27 11:57:09 UTC 2010


On Tue, Apr 27, 2010 at 07:44:24AM -0400, Stephen Gallagher wrote:
> On 04/27/2010 07:18 AM, Sumit Bose wrote:
> > Hi,
> >
> > the patch which removes the authentication tokens from the PAM stack
> > didn't return the right status code if a password change fails. To make
> > it easier to read I introduced a new variable.
> >
> > bye,
> > Sumit
> >
> 
> Nack.
> 
> Under SSS_PAM_AUTHENTICATE:
> exp_data = malloc(sizeof(int));
> if (exp_data == NULL) {
>      D(("malloc failed."));
>      ret = PAM_BUF_ERR;
>      break;
> }
> 
> You're still using ret here, which means that instead of returning 
> PAM_BUF_ERR from the function, you're returning whatever came back from 
> send_and_receive() above.
> 

Ah, thanks for catching this.

New version attached,

bye,
Sumit

> 
> 
> -- 
> Stephen Gallagher
> RHCE 804006346421761
> 
> Delivering value year after year.
> Red Hat ranks #1 in value among software vendors.
> http://www.redhat.com/promo/vendor/
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel
-------------- next part --------------
From 94f84fc90e8aea24ccf712f6b1b8c4e1edcb6422 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Tue, 27 Apr 2010 12:45:20 +0200
Subject: [PATCH] Fix wrong return value

If there was a failure during a password change a wrong return value was
send back to the PAM stack.
---
 src/sss_client/pam_sss.c |   29 ++++++++++++++---------------
 1 files changed, 14 insertions(+), 15 deletions(-)

diff --git a/src/sss_client/pam_sss.c b/src/sss_client/pam_sss.c
index 3f88d68..8bd3c9e 100644
--- a/src/sss_client/pam_sss.c
+++ b/src/sss_client/pam_sss.c
@@ -1330,6 +1330,7 @@ static int pam_sss(enum sss_cli_command task, pam_handle_t *pamh,
                    int pam_flags, int argc, const char **argv)
 {
     int ret;
+    int pam_status;
     struct pam_items pi;
     uint32_t flags = 0;
     int *exp_data;
@@ -1376,34 +1377,32 @@ static int pam_sss(enum sss_cli_command task, pam_handle_t *pamh,
             return PAM_SYSTEM_ERR;
     }
 
-    ret = send_and_receive(pamh, &pi, task);
+    pam_status = send_and_receive(pamh, &pi, task);
 
     switch (task) {
         case SSS_PAM_AUTHENTICATE:
             /* We allow sssd to send the return code PAM_NEW_AUTHTOK_REQD during
              * authentication, see sss_cli.h for details */
-            if (ret == PAM_NEW_AUTHTOK_REQD) {
+            if (pam_status == PAM_NEW_AUTHTOK_REQD) {
                 D(("Authtoken expired, trying to change it"));
 
                 exp_data = malloc(sizeof(int));
                 if (exp_data == NULL) {
                     D(("malloc failed."));
-                    ret = PAM_BUF_ERR;
+                    pam_status = PAM_BUF_ERR;
                     break;
                 }
                 *exp_data = 1;
-                ret = pam_set_data(pamh, PWEXP_FLAG, exp_data, free_exp_data);
-                if (ret != PAM_SUCCESS) {
+
+                pam_status = pam_set_data(pamh, PWEXP_FLAG, exp_data,
+                                          free_exp_data);
+                if (pam_status != PAM_SUCCESS) {
                     D(("pam_set_data failed."));
-                    ret = ret;
-                    break;
                 }
-
-                ret = PAM_SUCCESS;
             }
             break;
         case SSS_PAM_ACCT_MGMT:
-            if (ret == PAM_SUCCESS &&
+            if (pam_status == PAM_SUCCESS &&
                 pam_get_data(pamh, PWEXP_FLAG, (const void **) &exp_data) ==
                                                                   PAM_SUCCESS) {
                 ret = do_pam_conversation(pamh, PAM_TEXT_INFO,
@@ -1412,11 +1411,11 @@ static int pam_sss(enum sss_cli_command task, pam_handle_t *pamh,
                 if (ret != PAM_SUCCESS) {
                     D(("do_pam_conversation failed."));
                 }
-                ret = PAM_NEW_AUTHTOK_REQD;
+                pam_status = PAM_NEW_AUTHTOK_REQD;
             }
             break;
         case SSS_PAM_CHAUTHTOK:
-            if (ret != PAM_SUCCESS && ret != PAM_USER_UNKNOWN) {
+            if (pam_status != PAM_SUCCESS && pam_status != PAM_USER_UNKNOWN) {
                 ret = pam_set_item(pamh, PAM_AUTHTOK, NULL);
                 if (ret != PAM_SUCCESS) {
                     D(("Failed to unset PAM_AUTHTOK [%s]",
@@ -1430,15 +1429,15 @@ static int pam_sss(enum sss_cli_command task, pam_handle_t *pamh,
             }
             break;
         case SSS_PAM_CHAUTHTOK_PRELIM:
-            if (ret == PAM_PERM_DENIED && pi.pam_authtok_size == 0 &&
+            if (pam_status == PAM_PERM_DENIED && pi.pam_authtok_size == 0 &&
                 getuid() == 0 &&
                 pam_get_data(pamh, PWEXP_FLAG, (const void **) &exp_data) !=
                                                                   PAM_SUCCESS) {
 
                 ret = select_pw_reset_message(pamh, &pi);
                 if (ret != 0) {
+                    D(("select_pw_reset_message failed.\n"));
                 }
-                ret = PAM_PERM_DENIED;
             }
         default:
             /* nothing to do */
@@ -1449,7 +1448,7 @@ static int pam_sss(enum sss_cli_command task, pam_handle_t *pamh,
 
     overwrite_and_free_pam_items(&pi);
 
-    return ret;
+    return pam_status;
 }
 
 PAM_EXTERN int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc,
-- 
1.6.6.1



More information about the sssd-devel mailing list