[SSSD] [PATCH] PAM: successful authentication sets explicitly PAM_SUCCESSS

Sumit Bose sbose at redhat.com
Mon Nov 2 12:02:53 UTC 2015


On Thu, Oct 29, 2015 at 03:59:40PM +0100, Lukas Slebodnik wrote:
> On (29/10/15 15:32), Pavel Reichl wrote:
> >Hello,
> >
> >while I worked on tests for PAM responder Sumit proposed to use attached patch. QA have already kindly run their tests (successfully).
> >
> >I'll do the review myself (But all opinions are welcomed for sure).
> >
> >Thanks
> 
> >From 55e487ac403f39e8b65e9373b06059399e74b792 Mon Sep 17 00:00:00 2001
> >From: Sumit Bose <sbose at redhat.com>
> >Date: Mon, 19 Oct 2015 13:10:51 -0400
> >Subject: [PATCH] PAM: successful authentication sets explicitly PAM_SUCCESSS
> >
> >Set PAM_SYSTEM_ERR as default pam_status to ensure that we always must
> >set PAM_SUCCESSS explicitly for a successful authentication and will
> >really return an error in all other cases.
> >---
> > src/providers/dp_pam_data_util.c | 4 ++++
> > 1 file changed, 4 insertions(+)
> >
> >diff --git a/src/providers/dp_pam_data_util.c b/src/providers/dp_pam_data_util.c
> >index 10e91f5f7286db5e76ad98b6c7519f2482d006db..f471c7d02f5c86d1b1a45dd152c048de0e0bbb44 100644
> >--- a/src/providers/dp_pam_data_util.c
> >+++ b/src/providers/dp_pam_data_util.c
> >@@ -22,6 +22,8 @@
> >     along with this program.  If not, see <http://www.gnu.org/licenses/>.
> > */
> > 
> >+#include <security/_pam_types.h>
> >+
> We try to avoid including non-standar pam header files.
> Prefix "_" is Linux PAM specific.
> 

Fixed, new version attached.

bye,
Sumit
-------------- next part --------------
From fe1fce0f767f07ce4568de3cb86fc8823e5d66ec Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Mon, 19 Oct 2015 13:10:51 -0400
Subject: [PATCH] PAM: successful authentication sets explicitly PAM_SUCCESSS

Set PAM_SYSTEM_ERR as default pam_status to ensure that we always must
set PAM_SUCCESSS explicitly for a successful authentication and will
really return an error in all other cases.
---
 src/providers/dp_pam_data_util.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/providers/dp_pam_data_util.c b/src/providers/dp_pam_data_util.c
index 10e91f5f7286db5e76ad98b6c7519f2482d006db..bed5db872d18e0c3ab13d7b7fd061749253cc72a 100644
--- a/src/providers/dp_pam_data_util.c
+++ b/src/providers/dp_pam_data_util.c
@@ -22,6 +22,8 @@
     along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
+#include <security/pam_modules.h>
+
 #include "providers/data_provider.h"
 #include "util/sss_cli_cmd.h"
 
@@ -48,6 +50,8 @@ struct pam_data *create_pam_data(TALLOC_CTX *mem_ctx)
         goto failed;
     }
 
+    pd->pam_status = PAM_SYSTEM_ERR;
+
     pd->authtok = sss_authtok_new(pd);
     if (pd->authtok == NULL) {
         DEBUG(SSSDBG_CRIT_FAILURE, "talloc_zero failed.\n");
-- 
2.1.0



More information about the sssd-devel mailing list