Page MenuHomeFreeBSD
Files F167132173

D4981.id12417.diff
No OneTemporary
Actions

D4981.id12417.diff
View Options

Index: usr.bin/lock/Makefile
===================================================================
--- usr.bin/lock/Makefile
+++ usr.bin/lock/Makefile
@@ -5,6 +5,8 @@
BINOWN= root
BINMODE=4555
-LIBADD= crypt
+LIBADD= crypt pam
+
+CFLAGS+= -DUSE_PAM
.include <bsd.prog.mk>
Index: usr.bin/lock/lock.c
===================================================================
--- usr.bin/lock/lock.c
+++ usr.bin/lock/lock.c
@@ -71,6 +71,11 @@
#include <time.h>
#include <unistd.h>
+#ifdef USE_PAM
+#include <security/pam_appl.h>
+#include <security/openpam.h> /* for openpam_ttyconv() */
+#endif
+
#define TIMEOUT 15
static void quit(int);
@@ -96,6 +101,11 @@
int ch, failures, sectimeout, usemine, vtylock;
char *ap, *cryptpw, *mypw, *ttynam, *tzn;
char hostname[MAXHOSTNAMELEN], s[BUFSIZ], s1[BUFSIZ];
+#ifdef USE_PAM
+ pam_handle_t *pamh = NULL;
+ static const struct pam_conv pamc = { &openpam_ttyconv, NULL };
+ int pam_err;
+#endif
openlog("lock", 0, LOG_AUTH);
@@ -115,7 +125,9 @@
usemine = 1;
if (!(pw = getpwuid(getuid())))
errx(1, "unknown uid %d", getuid());
+#ifndef USE_PAM
mypw = strdup(pw->pw_passwd);
+#endif
break;
case 'n':
no_timeout = 1;
@@ -129,9 +141,15 @@
}
timeout.tv_sec = sectimeout * 60;
+#if defined(USE_PAM) || defined(SKEY)
+ if (! usemine) { /* -p with PAM or S/key needs privs */
+#endif
/* discard privs */
if (setuid(getuid()) != 0)
errx(1, "setuid failed");
+#if defined(USE_PAM) || defined(SKEY)
+ }
+#endif
if (tcgetattr(0, &tty)) /* get information for header */
exit(1);
@@ -151,7 +169,7 @@
ntty = tty; ntty.c_lflag &= ~ECHO;
(void)tcsetattr(0, TCSADRAIN|TCSASOFT, &ntty);
- if (!mypw) {
+ if (!usemine) {
/* get key and check again */
(void)printf("Key: ");
if (!fgets(s, sizeof(s), stdin) || *s == '\n')
@@ -171,6 +189,13 @@
s[0] = '\0';
mypw = s1;
}
+#ifdef USE_PAM
+ if (usemine) {
+ pam_err = pam_start("lock", pw->pw_name, &pamc, &pamh);
+ if (pam_err != PAM_SUCCESS)
+ err(1, "pam_start: %s", pam_strerror(NULL, pam_err));
+ }
+#endif
/* set signal handlers */
(void)signal(SIGINT, hi);
@@ -214,6 +239,22 @@
failures = 0;
for (;;) {
+#ifdef USE_PAM
+ if (usemine) {
+ pam_err = pam_authenticate(pamh, 0);
+ if (pam_err == PAM_SUCCESS)
+ break;
+
+ if (pam_err != PAM_AUTH_ERR &&
+ pam_err != PAM_USER_UNKNOWN &&
+ pam_err != PAM_MAXTRIES) {
+ syslog(LOG_ERR, "pam_authenticate: %s",
+ pam_strerror(pamh, pam_err));
+ }
+
+ goto tryagain;
+ }
+#endif
(void)printf("Key: ");
if (!fgets(s, sizeof(s), stdin)) {
clearerr(stdin);
@@ -241,6 +282,11 @@
if (getuid() == 0)
syslog(LOG_NOTICE, "ROOT UNLOCK ON hostname %s port %s",
hostname, ttynam);
+#ifdef USE_PAM
+ if (usemine) {
+ (void)pam_end(pamh, pam_err);
+ }
+#endif
quit(0);
return(0); /* not reached */
}

File Metadata

Mime Type
text/plain
Expires
Thu, Aug 20, 8:58 AM (39 m, 7 s)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
36986659
Default Alt Text
D4981.id12417.diff (2 KB)

Event Timeline