pam/pam-1.2.1-faillock-admin-group.patch

diff -up Linux-PAM-1.3.0/modules/pam_faillock/pam_faillock.c.admin-group Linux-PAM-1.3.0/modules/pam_faillock/pam_faillock.c
--- Linux-PAM-1.3.0/modules/pam_faillock/pam_faillock.c.admin-group	2016-04-04 16:37:38.696260359 +0200
+++ Linux-PAM-1.3.0/modules/pam_faillock/pam_faillock.c	2017-08-21 16:40:01.624706864 +0200
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2010 Tomas Mraz <tmraz@redhat.com>
+ * Copyright (c) 2010, 2017 Tomas Mraz <tmraz@redhat.com>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -78,9 +78,11 @@ struct options {
 	unsigned int root_unlock_time;
 	const char *dir;
 	const char *user;
+	const char *admin_group;
 	int failures;
 	uint64_t latest_time;
 	uid_t uid;
+	int is_admin;
 	uint64_t now;
 };
 
@@ -152,6 +154,9 @@ args_parse(pam_handle_t *pamh, int argc,
 				opts->root_unlock_time = temp;
 			}
 		}
+		else if (strncmp(argv[i], "admin_group=", 12) == 0) {
+			opts->admin_group = argv[i] + 12;
+		}
  		else if (strcmp(argv[i], "preauth") == 0) {
 			opts->action = FAILLOCK_ACTION_PREAUTH;
 		}
@@ -209,6 +214,17 @@ static int get_pam_user(pam_handle_t *pa
 	}
 	opts->user = user;
 	opts->uid = pwd->pw_uid;
+
+	if (pwd->pw_uid == 0) {
+		opts->is_admin = 1;
+		return PAM_SUCCESS;
+	}
+
+	if (opts->admin_group && *opts->admin_group) {
+		opts->is_admin = pam_modutil_user_in_group_uid_nam(pamh,
+			pwd->pw_uid, opts->admin_group);
+	}
+
 	return PAM_SUCCESS;
 }
 
@@ -239,7 +255,7 @@ check_tally(pam_handle_t *pamh, struct o
 		return PAM_SYSTEM_ERR;
 	}
 
-	if (opts->uid == 0 && !(opts->flags & FAILLOCK_FLAG_DENY_ROOT)) {
+	if (opts->is_admin && !(opts->flags & FAILLOCK_FLAG_DENY_ROOT)) {
 		return PAM_SUCCESS;
 	}
 
@@ -262,13 +278,9 @@ check_tally(pam_handle_t *pamh, struct o
 
 	opts->failures = failures;
 
-	if (opts->uid == 0 && !(opts->flags & FAILLOCK_FLAG_DENY_ROOT)) {
-		return PAM_SUCCESS;
-	}
-
 	if (opts->deny && failures >= opts->deny) {
-		if ((opts->uid && opts->unlock_time && latest_time + opts->unlock_time < opts->now) ||
-			(!opts->uid && opts->root_unlock_time && latest_time + opts->root_unlock_time < opts->now)) {
+		if ((!opts->is_admin && opts->unlock_time && latest_time + opts->unlock_time < opts->now) ||
+			(opts->is_admin && opts->root_unlock_time && latest_time + opts->root_unlock_time < opts->now)) {
 #ifdef HAVE_LIBAUDIT
 			if (opts->action != FAILLOCK_ACTION_PREAUTH) { /* do not audit in preauth */
 				char buf[64];
@@ -401,7 +413,7 @@ write_tally(pam_handle_t *pamh, struct o
 		audit_log_user_message(audit_fd, AUDIT_ANOM_LOGIN_FAILURES, buf,
 			NULL, NULL, NULL, 1);
 
-		if (opts->uid != 0 || (opts->flags & FAILLOCK_FLAG_DENY_ROOT)) {
+		if (!opts->is_admin || (opts->flags & FAILLOCK_FLAG_DENY_ROOT)) {
 			audit_log_user_message(audit_fd, AUDIT_RESP_ACCT_LOCK, buf,
 				NULL, NULL, NULL, 1);
 		}
@@ -425,11 +437,11 @@ faillock_message(pam_handle_t *pamh, str
 	int64_t left;
 
 	if (!(opts->flags & FAILLOCK_FLAG_SILENT)) {
-		if (opts->uid) {
-			left = opts->latest_time + opts->unlock_time - opts->now;
+		if (opts->is_admin) {
+			left = opts->latest_time + opts->root_unlock_time - opts->now;
 		}
 		else {
-			left = opts->latest_time + opts->root_unlock_time - opts->now;
+			left = opts->latest_time + opts->unlock_time - opts->now;
 		}
 
 		if (left > 0) {
diff -up Linux-PAM-1.3.0/modules/pam_faillock/pam_faillock.8.xml.admin-group Linux-PAM-1.3.0/modules/pam_faillock/pam_faillock.8.xml
--- Linux-PAM-1.3.0/modules/pam_faillock/pam_faillock.8.xml.admin-group	2016-05-06 15:24:10.328281818 +0200
+++ Linux-PAM-1.3.0/modules/pam_faillock/pam_faillock.8.xml	2017-08-21 16:16:09.448033843 +0200
@@ -40,6 +40,9 @@
         root_unlock_time=<replaceable>n</replaceable>
       </arg>
       <arg choice="opt">
+        admin_group=<replaceable>name</replaceable>
+      </arg>
+      <arg choice="opt">
         audit
       </arg>
       <arg choice="opt">
@@ -243,6 +246,20 @@
                 </para>
               </listitem>
             </varlistentry>
+            <varlistentry>
+              <term>
+                <option>admin_group=<replaceable>name</replaceable></option>
+              </term>
+              <listitem>
+                <para>
+                  If a group name is specified with this option, members
+                  of the group will be handled by this module the same as
+                  the root account (the options <option>even_deny_root></option>
+                  and <option>root_unlock_time</option> will apply to them.
+                  By default the option is not set.
+                </para>
+              </listitem>
+            </varlistentry>
         </variablelist>
   </refsect1>