pam/pam-1.2.1-faillock-admin-group.patch

134 lines
4.6 KiB
Diff

diff -up Linux-PAM-1.3.0/modules/pam_faillock/pam_faillock.c.admin-group Linux-PAM-1.3.0/modules/pam_faillock/pam_faillock.c
--- Linux-PAM-1.3.0/modules/pam_faillock/pam_faillock.c.admin-group 2016-04-04 16:37:38.696260359 +0200
+++ Linux-PAM-1.3.0/modules/pam_faillock/pam_faillock.c 2017-08-21 16:40:01.624706864 +0200
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2010 Tomas Mraz <tmraz@redhat.com>
+ * Copyright (c) 2010, 2017 Tomas Mraz <tmraz@redhat.com>
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
@@ -78,9 +78,11 @@ struct options {
unsigned int root_unlock_time;
const char *dir;
const char *user;
+ const char *admin_group;
int failures;
uint64_t latest_time;
uid_t uid;
+ int is_admin;
uint64_t now;
};
@@ -152,6 +154,9 @@ args_parse(pam_handle_t *pamh, int argc,
opts->root_unlock_time = temp;
}
}
+ else if (strncmp(argv[i], "admin_group=", 12) == 0) {
+ opts->admin_group = argv[i] + 12;
+ }
else if (strcmp(argv[i], "preauth") == 0) {
opts->action = FAILLOCK_ACTION_PREAUTH;
}
@@ -209,6 +214,17 @@ static int get_pam_user(pam_handle_t *pa
}
opts->user = user;
opts->uid = pwd->pw_uid;
+
+ if (pwd->pw_uid == 0) {
+ opts->is_admin = 1;
+ return PAM_SUCCESS;
+ }
+
+ if (opts->admin_group && *opts->admin_group) {
+ opts->is_admin = pam_modutil_user_in_group_uid_nam(pamh,
+ pwd->pw_uid, opts->admin_group);
+ }
+
return PAM_SUCCESS;
}
@@ -239,7 +255,7 @@ check_tally(pam_handle_t *pamh, struct o
return PAM_SYSTEM_ERR;
}
- if (opts->uid == 0 && !(opts->flags & FAILLOCK_FLAG_DENY_ROOT)) {
+ if (opts->is_admin && !(opts->flags & FAILLOCK_FLAG_DENY_ROOT)) {
return PAM_SUCCESS;
}
@@ -262,13 +278,9 @@ check_tally(pam_handle_t *pamh, struct o
opts->failures = failures;
- if (opts->uid == 0 && !(opts->flags & FAILLOCK_FLAG_DENY_ROOT)) {
- return PAM_SUCCESS;
- }
-
if (opts->deny && failures >= opts->deny) {
- if ((opts->uid && opts->unlock_time && latest_time + opts->unlock_time < opts->now) ||
- (!opts->uid && opts->root_unlock_time && latest_time + opts->root_unlock_time < opts->now)) {
+ if ((!opts->is_admin && opts->unlock_time && latest_time + opts->unlock_time < opts->now) ||
+ (opts->is_admin && opts->root_unlock_time && latest_time + opts->root_unlock_time < opts->now)) {
#ifdef HAVE_LIBAUDIT
if (opts->action != FAILLOCK_ACTION_PREAUTH) { /* do not audit in preauth */
char buf[64];
@@ -401,7 +413,7 @@ write_tally(pam_handle_t *pamh, struct o
audit_log_user_message(audit_fd, AUDIT_ANOM_LOGIN_FAILURES, buf,
NULL, NULL, NULL, 1);
- if (opts->uid != 0 || (opts->flags & FAILLOCK_FLAG_DENY_ROOT)) {
+ if (!opts->is_admin || (opts->flags & FAILLOCK_FLAG_DENY_ROOT)) {
audit_log_user_message(audit_fd, AUDIT_RESP_ACCT_LOCK, buf,
NULL, NULL, NULL, 1);
}
@@ -425,11 +437,11 @@ faillock_message(pam_handle_t *pamh, str
int64_t left;
if (!(opts->flags & FAILLOCK_FLAG_SILENT)) {
- if (opts->uid) {
- left = opts->latest_time + opts->unlock_time - opts->now;
+ if (opts->is_admin) {
+ left = opts->latest_time + opts->root_unlock_time - opts->now;
}
else {
- left = opts->latest_time + opts->root_unlock_time - opts->now;
+ left = opts->latest_time + opts->unlock_time - opts->now;
}
if (left > 0) {
diff -up Linux-PAM-1.3.0/modules/pam_faillock/pam_faillock.8.xml.admin-group Linux-PAM-1.3.0/modules/pam_faillock/pam_faillock.8.xml
--- Linux-PAM-1.3.0/modules/pam_faillock/pam_faillock.8.xml.admin-group 2016-05-06 15:24:10.328281818 +0200
+++ Linux-PAM-1.3.0/modules/pam_faillock/pam_faillock.8.xml 2017-08-21 16:16:09.448033843 +0200
@@ -40,6 +40,9 @@
root_unlock_time=<replaceable>n</replaceable>
</arg>
<arg choice="opt">
+ admin_group=<replaceable>name</replaceable>
+ </arg>
+ <arg choice="opt">
audit
</arg>
<arg choice="opt">
@@ -243,6 +246,20 @@
</para>
</listitem>
</varlistentry>
+ <varlistentry>
+ <term>
+ <option>admin_group=<replaceable>name</replaceable></option>
+ </term>
+ <listitem>
+ <para>
+ If a group name is specified with this option, members
+ of the group will be handled by this module the same as
+ the root account (the options <option>even_deny_root></option>
+ and <option>root_unlock_time</option> will apply to them.
+ By default the option is not set.
+ </para>
+ </listitem>
+ </varlistentry>
</variablelist>
</refsect1>