1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
|
innetgr may not be there so make sure that when innetgr is not present
then we inform about it and not use it.
-Khem
Upstream-Status: Pending
Signed-off-by: Scott Garman <scott.a.garman@intel.com>
Index: Linux-PAM-1.1.3/modules/pam_group/pam_group.c
===================================================================
--- Linux-PAM-1.1.3.orig/modules/pam_group/pam_group.c
+++ Linux-PAM-1.1.3/modules/pam_group/pam_group.c
@@ -659,7 +659,11 @@ static int check_account(pam_handle_t *p
}
/* If buffer starts with @, we are using netgroups */
if (buffer[0] == '@')
- good &= innetgr (&buffer[1], NULL, user, NULL);
+#ifdef HAVE_INNETGR
+ good &= innetgr (&buffer[1], NULL, user, NULL);
+#else
+ pam_syslog (pamh, LOG_ERR, "pam_group does not have netgroup support");
+#endif
/* otherwise, if the buffer starts with %, it's a UNIX group */
else if (buffer[0] == '%')
good &= pam_modutil_user_in_group_nam_nam(pamh, user, &buffer[1]);
Index: Linux-PAM-1.1.3/modules/pam_time/pam_time.c
===================================================================
--- Linux-PAM-1.1.3.orig/modules/pam_time/pam_time.c
+++ Linux-PAM-1.1.3/modules/pam_time/pam_time.c
@@ -555,9 +555,13 @@ check_account(pam_handle_t *pamh, const
}
/* If buffer starts with @, we are using netgroups */
if (buffer[0] == '@')
- good &= innetgr (&buffer[1], NULL, user, NULL);
+#ifdef HAVE_INNETGR
+ good &= innetgr (&buffer[1], NULL, user, NULL);
+#else
+ pam_syslog (pamh, LOG_ERR, "pam_time does not have netgroup support");
+#endif
else
- good &= logic_field(pamh, user, buffer, count, is_same);
+ good &= logic_field(pamh, user, buffer, count, is_same);
D(("with user: %s", good ? "passes":"fails" ));
/* here we get the time field */
Index: Linux-PAM-1.1.3/modules/pam_succeed_if/pam_succeed_if.c
===================================================================
--- Linux-PAM-1.1.3.orig/modules/pam_succeed_if/pam_succeed_if.c
+++ Linux-PAM-1.1.3/modules/pam_succeed_if/pam_succeed_if.c
@@ -231,18 +231,27 @@ evaluate_notingroup(pam_handle_t *pamh,
}
/* Return PAM_SUCCESS if the (host,user) is in the netgroup. */
static int
-evaluate_innetgr(const char *host, const char *user, const char *group)
+evaluate_innetgr(const pam_handle_t* pamh, const char *host, const char *user, const char *group)
{
+#ifdef HAVE_INNETGR
if (innetgr(group, host, user, NULL) == 1)
return PAM_SUCCESS;
+#else
+ pam_syslog (pamh, LOG_ERR, "pam_succeed_if does not have netgroup support");
+#endif
+
return PAM_AUTH_ERR;
}
/* Return PAM_SUCCESS if the (host,user) is NOT in the netgroup. */
static int
-evaluate_notinnetgr(const char *host, const char *user, const char *group)
+evaluate_notinnetgr(const pam_handle_t* pamh, const char *host, const char *user, const char *group)
{
+#ifdef HAVE_INNETGR
if (innetgr(group, host, user, NULL) == 0)
return PAM_SUCCESS;
+#else
+ pam_syslog (pamh, LOG_ERR, "pam_succeed_if does not have netgroup support");
+#endif
return PAM_AUTH_ERR;
}
@@ -361,14 +370,14 @@ evaluate(pam_handle_t *pamh, int debug,
const void *rhost;
if (pam_get_item(pamh, PAM_RHOST, &rhost) != PAM_SUCCESS)
rhost = NULL;
- return evaluate_innetgr(rhost, user, right);
+ return evaluate_innetgr(pamh, rhost, user, right);
}
/* (Rhost, user) is not in this group. */
if (strcasecmp(qual, "notinnetgr") == 0) {
const void *rhost;
if (pam_get_item(pamh, PAM_RHOST, &rhost) != PAM_SUCCESS)
rhost = NULL;
- return evaluate_notinnetgr(rhost, user, right);
+ return evaluate_notinnetgr(pamh, rhost, user, right);
}
/* Fail closed. */
return PAM_SERVICE_ERR;
|
