pam-afs-trust-root-login-20010210

add trust_root option which basically provides a bypass mechanism for root

diff --git a/src/pam/afs_auth.c b/src/pam/afs_auth.c
index f26020636b1a5a2575a11e5234651dd623316556..aad7939b3b6c6fd35c86138362ad95f63619925c 100644 (file)
--- a/src/pam/afs_auth.c
+++ b/src/pam/afs_auth.c
@@ -42,6 +42,8 @@ pam_sm_authenticate(
     int use_first_pass = 0;
     int try_first_pass = 0;
     int ignore_root = 0;
+    int trust_root = 0;
+    int catch_su = 0;
     int set_expires = 0;  /* This option is only used in pam_set_cred() */
     int got_authtok = 0;       /* got PAM_AUTHTOK upon entry */
     int nouser = 0;
@@ -80,6 +82,10 @@ pam_sm_authenticate(
            try_first_pass = 1;
        } else if (strcasecmp(argv[i], "ignore_root"   ) == 0) {
            ignore_root = 1;
+       } else if (strcasecmp(argv[i], "trust_root"   ) == 0) {
+           trust_root = 1;
+       } else if (strcasecmp(argv[i], "catch_su"   ) == 0) {
+           catch_su = 1;
        } else if (strcasecmp(argv[i], "setenv_password_expires") == 0) {
             set_expires = 1;
        } else {
@@ -107,6 +113,11 @@ pam_sm_authenticate(
        RET(PAM_USER_UNKNOWN);
     }
 
+    if ((!strncmp ("root", user, 4)) && trust_root) {
+       pam_afs_syslog(LOG_INFO, PAMAFS_TRUSTROOT, user);
+       RET(PAM_SUCCESS);
+    }
+
     pam_afs_syslog(LOG_DEBUG, PAMAFS_USERNAMEDEBUG, user);
 
     /*
@@ -132,9 +143,14 @@ pam_sm_authenticate(
 #else
     upwd = getpwnam_r(user, &unix_pwd, upwd_buf, sizeof(upwd_buf));
 #endif
-    if (ignore_root && upwd != NULL && upwd->pw_uid == 0) {
-       pam_afs_syslog(LOG_INFO, PAMAFS_IGNORINGROOT, user);
-       RET(PAM_AUTH_ERR);
+    if (upwd != NULL && upwd->pw_uid == 0) {
+       if (ignore_root) { 
+               pam_afs_syslog(LOG_INFO, PAMAFS_IGNORINGROOT, user);
+               RET(PAM_AUTH_ERR);
+       } else if (trust_root && !catch_su) {
+               pam_afs_syslog(LOG_INFO, PAMAFS_TRUSTROOT, user);
+               RET(PAM_SUCCESS);
+       }
     }
 #endif
     errcode = pam_get_item(pamh, PAM_AUTHTOK, (void **) &password);

diff --git a/src/pam/afs_message.c b/src/pam/afs_message.c
index 381054e663973dbbf5fafdf911c63a98124023a4..0845f9a1ba5afdf3cb9625f3e52b87a07098b90d 100644 (file)
--- a/src/pam/afs_message.c
+++ b/src/pam/afs_message.c
@@ -64,6 +64,12 @@ static char *fallback_messages[] = {
     "AFS ReInitializing creds for user %s\n",  /* 31: REINITCRED       */
     "AFS Failed to set PASSWORD_EXPIRES for user %s\n",
                                                /* 32: PASSEXPFAIL      */
+    "",
+                                               /* 33: */
+    "",
+                                               /* 34: */
+    "AFS blindly trusting user %s\n",
+                                               /* 35: TRUSTROOT        */
 };
 
 static int num_fallbacks = sizeof(fallback_messages)/sizeof(char *);

diff --git a/src/pam/afs_message.h b/src/pam/afs_message.h
index 46de2c502bd4cbb2e7f5594c49d59898ab903fe4..6b7ec9bac7bb0454fe64c724886ba1af3f3a0bb5 100644 (file)
--- a/src/pam/afs_message.h
+++ b/src/pam/afs_message.h
@@ -45,6 +45,7 @@
 #define PAMAFS_PASSEXPFAIL     32 /* "Failed to set PASSWORD_EXPIRES"  */
 #define PAMAFS_CHOWNKRB                33 /* "Failed to chown krb ticketfile"  */
 #define PAMAFS_KRBFAIL         34 /* "Failed to set KRBTKTFILE"        */
+#define PAMAFS_TRUSTROOT       35 /* "Ignoring superuser %s"           */
 
 
 char *pam_afs_message(int msgnum, int *freeit);

diff --git a/src/pam/afs_setcred.c b/src/pam/afs_setcred.c
index e7115c3b54b4e777e5228508a131a350b304ba1e..daf17817661c366c67cf3344589ad457c16a1355 100644 (file)
--- a/src/pam/afs_setcred.c
+++ b/src/pam/afs_setcred.c
@@ -44,6 +44,7 @@ pam_sm_setcred(
     int try_first_pass = 0;
     int got_authtok = 0;
     int ignore_root = 0;
+    int trust_root = 0;
     int set_expires = 0; /* the default is to not to set the env variable */
     int i;
     struct pam_conv *pam_convp = NULL;
@@ -79,6 +80,10 @@ pam_sm_setcred(
            try_first_pass = 1;
         } else if (strcasecmp(argv[i], "ignore_root"   ) == 0) {
             ignore_root = 1;
+        } else if (strcasecmp(argv[i], "trust_root"   ) == 0) {
+            trust_root = 1;
+        } else if (strcasecmp(argv[i], "catch_su"   ) == 0) {
+            use_first_pass = 0;
        } else if (strcasecmp(argv[i], "setenv_password_expires")==0) {
            set_expires = 1;
        } else {
@@ -124,9 +129,14 @@ pam_sm_setcred(
 #else
     upwd = getpwnam_r(user, &unix_pwd, upwd_buf, sizeof(upwd_buf));
 #endif
-    if (ignore_root && upwd != NULL && upwd->pw_uid == 0) {
-        pam_afs_syslog(LOG_INFO, PAMAFS_IGNORINGROOT, user);
-        RET(PAM_AUTH_ERR);
+    if (upwd != NULL && upwd->pw_uid == 0) {
+       if (ignore_root) { 
+               pam_afs_syslog(LOG_INFO, PAMAFS_IGNORINGROOT, user);
+               RET(PAM_AUTH_ERR);
+       } else if (trust_root) {
+               pam_afs_syslog(LOG_INFO, PAMAFS_TRUSTROOT, user);
+               RET(PAM_SUCCESS);
+       }
     }
 #endif