0007-Check-if-innetgr-is-available-at-compile-time.patch 3.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106
  1. From c681bd104627139eac2f40fe303e1f67676233e8 Mon Sep 17 00:00:00 2001
  2. From: Yousong Zhou <yszhou4tech@gmail.com>
  3. Date: Wed, 17 Jun 2015 15:33:43 +0800
  4. Subject: [PATCH 7/7] Check if innetgr is available at compile time.
  5. innetgr may not be there so make sure that when innetgr is not present
  6. then we inform about it and not use it.
  7. * modules/pam_group/pam_group.c: ditto
  8. * modules/pam_succeed_if/pam_succeed_if.c: ditto
  9. * modules/pam_time/pam_time.c: ditto
  10. Signed-off-by: Khem Raj <raj.khem at gmail.com>
  11. Signed-off-by: Yousong Zhou <yszhou4tech at gmail.com>
  12. ---
  13. modules/pam_group/pam_group.c | 4 ++++
  14. modules/pam_succeed_if/pam_succeed_if.c | 17 +++++++++++++----
  15. modules/pam_time/pam_time.c | 4 ++++
  16. 3 files changed, 21 insertions(+), 4 deletions(-)
  17. diff --git a/modules/pam_group/pam_group.c b/modules/pam_group/pam_group.c
  18. index be5f20f..6a065ca 100644
  19. --- a/modules/pam_group/pam_group.c
  20. +++ b/modules/pam_group/pam_group.c
  21. @@ -656,7 +656,11 @@ static int check_account(pam_handle_t *pamh, const char *service,
  22. }
  23. /* If buffer starts with @, we are using netgroups */
  24. if (buffer[0] == '@')
  25. +#ifdef HAVE_INNETGR
  26. good &= innetgr (&buffer[1], NULL, user, NULL);
  27. +#else
  28. + pam_syslog (pamh, LOG_ERR, "pam_group does not have netgroup support");
  29. +#endif
  30. /* otherwise, if the buffer starts with %, it's a UNIX group */
  31. else if (buffer[0] == '%')
  32. good &= pam_modutil_user_in_group_nam_nam(pamh, user, &buffer[1]);
  33. diff --git a/modules/pam_succeed_if/pam_succeed_if.c b/modules/pam_succeed_if/pam_succeed_if.c
  34. index aa828fc..c0c68a0 100644
  35. --- a/modules/pam_succeed_if/pam_succeed_if.c
  36. +++ b/modules/pam_succeed_if/pam_succeed_if.c
  37. @@ -231,18 +231,27 @@ evaluate_notingroup(pam_handle_t *pamh, const char *user, const char *group)
  38. }
  39. /* Return PAM_SUCCESS if the (host,user) is in the netgroup. */
  40. static int
  41. -evaluate_innetgr(const char *host, const char *user, const char *group)
  42. +evaluate_innetgr(const pam_handle_t* pamh, const char *host, const char *user, const char *group)
  43. {
  44. +#ifdef HAVE_INNETGR
  45. if (innetgr(group, host, user, NULL) == 1)
  46. return PAM_SUCCESS;
  47. +#else
  48. + pam_syslog (pamh, LOG_ERR, "pam_succeed_if does not have netgroup support");
  49. +#endif
  50. +
  51. return PAM_AUTH_ERR;
  52. }
  53. /* Return PAM_SUCCESS if the (host,user) is NOT in the netgroup. */
  54. static int
  55. -evaluate_notinnetgr(const char *host, const char *user, const char *group)
  56. +evaluate_notinnetgr(const pam_handle_t* pamh, const char *host, const char *user, const char *group)
  57. {
  58. +#ifdef HAVE_INNETGR
  59. if (innetgr(group, host, user, NULL) == 0)
  60. return PAM_SUCCESS;
  61. +#else
  62. + pam_syslog (pamh, LOG_ERR, "pam_succeed_if does not have netgroup support");
  63. +#endif
  64. return PAM_AUTH_ERR;
  65. }
  66. @@ -387,14 +396,14 @@ evaluate(pam_handle_t *pamh, int debug,
  67. const void *rhost;
  68. if (pam_get_item(pamh, PAM_RHOST, &rhost) != PAM_SUCCESS)
  69. rhost = NULL;
  70. - return evaluate_innetgr(rhost, user, right);
  71. + return evaluate_innetgr(pamh, rhost, user, right);
  72. }
  73. /* (Rhost, user) is not in this group. */
  74. if (strcasecmp(qual, "notinnetgr") == 0) {
  75. const void *rhost;
  76. if (pam_get_item(pamh, PAM_RHOST, &rhost) != PAM_SUCCESS)
  77. rhost = NULL;
  78. - return evaluate_notinnetgr(rhost, user, right);
  79. + return evaluate_notinnetgr(pamh, rhost, user, right);
  80. }
  81. /* Fail closed. */
  82. return PAM_SERVICE_ERR;
  83. diff --git a/modules/pam_time/pam_time.c b/modules/pam_time/pam_time.c
  84. index c94737c..0b34a14 100644
  85. --- a/modules/pam_time/pam_time.c
  86. +++ b/modules/pam_time/pam_time.c
  87. @@ -555,7 +555,11 @@ check_account(pam_handle_t *pamh, const char *service,
  88. }
  89. /* If buffer starts with @, we are using netgroups */
  90. if (buffer[0] == '@')
  91. +#ifdef HAVE_INNETGR
  92. good &= innetgr (&buffer[1], NULL, user, NULL);
  93. +#else
  94. + pam_syslog (pamh, LOG_ERR, "pam_time does not have netgroup support");
  95. +#endif
  96. else
  97. good &= logic_field(pamh, user, buffer, count, is_same);
  98. D(("with user: %s", good ? "passes":"fails" ));
  99. --
  100. 1.7.10.4