65 lines
2.3 KiB
Diff
65 lines
2.3 KiB
Diff
diff -up Linux-PAM-0.99.8.1/modules/pam_unix/unix_chkpwd.c.blankpass Linux-PAM-0.99.8.1/modules/pam_unix/unix_chkpwd.c
|
|
--- Linux-PAM-0.99.8.1/modules/pam_unix/unix_chkpwd.c.blankpass 2007-09-18 13:50:40.000000000 +0200
|
|
+++ Linux-PAM-0.99.8.1/modules/pam_unix/unix_chkpwd.c 2007-09-18 13:50:40.000000000 +0200
|
|
@@ -50,7 +50,7 @@ int main(int argc, char *argv[])
|
|
char pass[MAXPASS + 1];
|
|
char *option;
|
|
int npass, nullok;
|
|
- int force_failure = 0;
|
|
+ int blankpass = 0;
|
|
int retval = PAM_AUTH_ERR;
|
|
char *user;
|
|
char *passwords[] = { pass };
|
|
@@ -115,6 +115,10 @@ int main(int argc, char *argv[])
|
|
if (npass != 1) { /* is it a valid password? */
|
|
_log_err(LOG_DEBUG, "no valid password supplied");
|
|
}
|
|
+
|
|
+ if (*pass == '\0') {
|
|
+ blankpass = 1;
|
|
+ }
|
|
|
|
retval = _unix_verify_password(user, pass, nullok);
|
|
|
|
@@ -122,8 +126,11 @@ int main(int argc, char *argv[])
|
|
|
|
/* return pass or fail */
|
|
|
|
- if ((retval != PAM_SUCCESS) || force_failure) {
|
|
- _log_err(LOG_NOTICE, "password check failed for user (%s)", user);
|
|
+ if (retval != PAM_SUCCESS) {
|
|
+ /* don't log if it is a test for blank password */
|
|
+ if (!blankpass) {
|
|
+ _log_err(LOG_NOTICE, "password check failed for user (%s)", user);
|
|
+ }
|
|
return PAM_AUTH_ERR;
|
|
} else {
|
|
return PAM_SUCCESS;
|
|
diff -up Linux-PAM-0.99.8.1/modules/pam_unix/support.c.blankpass Linux-PAM-0.99.8.1/modules/pam_unix/support.c
|
|
--- Linux-PAM-0.99.8.1/modules/pam_unix/support.c.blankpass 2007-09-18 13:50:40.000000000 +0200
|
|
+++ Linux-PAM-0.99.8.1/modules/pam_unix/support.c 2007-09-18 17:56:57.000000000 +0200
|
|
@@ -38,6 +38,9 @@
|
|
|
|
const char app_name[]="pam_unix";
|
|
|
|
+static int _unix_run_helper_binary(pam_handle_t *pamh, const char *passwd,
|
|
+ unsigned int ctrl, const char *user);
|
|
+
|
|
/* this is a front-end for module-application conversations */
|
|
|
|
int _make_remark(pam_handle_t * pamh, unsigned int ctrl,
|
|
@@ -442,6 +445,13 @@ _unix_blankpasswd (pam_handle_t *pamh, u
|
|
* ...and shadow password file entry for this user,
|
|
* if shadowing is enabled
|
|
*/
|
|
+ if (geteuid() || SELINUX_ENABLED) {
|
|
+ /* We do not have direct access to shadow. Run helper. */
|
|
+ D(("running helper binary"));
|
|
+ if (_unix_run_helper_binary(pamh, "", ctrl, name) == PAM_SUCCESS)
|
|
+ return 1;
|
|
+ return 0;
|
|
+ }
|
|
spwdent = pam_modutil_getspnam(pamh, name);
|
|
}
|
|
if (spwdent)
|