You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
110 lines
2.7 KiB
110 lines
2.7 KiB
--- a/modules/pam_faillock/pam_faillock.c
|
|
+++ b/modules/pam_faillock/pam_faillock.c
|
|
@@ -348,42 +348,81 @@ set_conf_opt(pam_handle_t *pamh, struct options *opts, const char *name, const c
|
|
static int
|
|
check_local_user (pam_handle_t *pamh, const char *user)
|
|
{
|
|
- struct passwd pw, *pwp;
|
|
- char buf[16384];
|
|
- int found = 0;
|
|
+ int rc;
|
|
+ size_t user_len;
|
|
FILE *fp;
|
|
- int errn;
|
|
+ char line[BUFSIZ];
|
|
|
|
- fp = fopen(PATH_PASSWD, "r");
|
|
- if (fp == NULL) {
|
|
- pam_syslog(pamh, LOG_ERR, "unable to open %s: %m",
|
|
- PATH_PASSWD);
|
|
- return -1;
|
|
+ /* Validate the user name. */
|
|
+ if ((user_len = strlen(user)) == 0) {
|
|
+ pam_syslog(pamh, LOG_NOTICE, "user name is not valid");
|
|
+ return PAM_SERVICE_ERR;
|
|
+ }
|
|
+
|
|
+ if (user_len > sizeof(line) - sizeof(":")) {
|
|
+ pam_syslog(pamh, LOG_NOTICE, "user name is too long");
|
|
+ return PAM_SERVICE_ERR;
|
|
+ }
|
|
+
|
|
+ if (strchr(user, ':') != NULL) {
|
|
+ /*
|
|
+ * "root:x" is not a local user name even if the passwd file
|
|
+ * contains a line starting with "root:x:".
|
|
+ */
|
|
+ return PAM_PERM_DENIED;
|
|
}
|
|
|
|
- for (;;) {
|
|
- errn = fgetpwent_r(fp, &pw, buf, sizeof (buf), &pwp);
|
|
- if (errn == ERANGE) {
|
|
- pam_syslog(pamh, LOG_WARNING, "%s contains very long lines; corrupted?",
|
|
- PATH_PASSWD);
|
|
+ /* Open the passwd file. */
|
|
+ FILE *file_name = "/etc/passwd";
|
|
+ if ((fp = fopen(file_name, "r")) == NULL) {
|
|
+ pam_syslog(pamh, LOG_ERR, "error opening %s: %m", file_name);
|
|
+ return PAM_SERVICE_ERR;
|
|
+ }
|
|
+
|
|
+ /*
|
|
+ * Scan the file using fgets() instead of fgetpwent_r() because
|
|
+ * the latter is not flexible enough in handling long lines
|
|
+ * in passwd files.
|
|
+ */
|
|
+ rc = PAM_PERM_DENIED;
|
|
+ while (fgets(line, sizeof(line), fp) != NULL) {
|
|
+ size_t line_len;
|
|
+ const char *str;
|
|
+
|
|
+ /*
|
|
+ * Does this line start with the user name
|
|
+ * followed by a colon?
|
|
+ */
|
|
+ if (strncmp(user, line, user_len) == 0 &&
|
|
+ line[user_len] == ':') {
|
|
+ rc = PAM_SUCCESS;
|
|
break;
|
|
}
|
|
- if (errn != 0)
|
|
- break;
|
|
- if (strcmp(pwp->pw_name, user) == 0) {
|
|
- found = 1;
|
|
+ /* Has a newline been read? */
|
|
+ line_len = strlen(line);
|
|
+ if (line_len < sizeof(line) - 1 ||
|
|
+ line[line_len - 1] == '\n') {
|
|
+ /* Yes, continue with the next line. */
|
|
+ continue;
|
|
+ }
|
|
+
|
|
+ /* No, read till the end of this line first. */
|
|
+ while ((str = fgets(line, sizeof(line), fp)) != NULL) {
|
|
+ line_len = strlen(line);
|
|
+ if (line_len == 0 ||
|
|
+ line[line_len - 1] == '\n') {
|
|
+ break;
|
|
+ }
|
|
+ }
|
|
+ if (str == NULL) {
|
|
+ /* fgets returned NULL, we are done. */
|
|
break;
|
|
}
|
|
+ /* Continue with the next line. */
|
|
}
|
|
|
|
- fclose (fp);
|
|
-
|
|
- if (errn != 0 && errn != ENOENT) {
|
|
- pam_syslog(pamh, LOG_ERR, "unable to enumerate local accounts: %m");
|
|
- return -1;
|
|
- } else {
|
|
- return found;
|
|
- }
|
|
+ fclose(fp);
|
|
+ return rc;
|
|
}
|
|
|
|
static int
|