1*242be47eSzrj /*- 2*242be47eSzrj * Copyright (c) 2001 Mark R V Murray 3*242be47eSzrj * All rights reserved. 4*242be47eSzrj * Copyright (c) 2001,2002 Networks Associates Technology, Inc. 5*242be47eSzrj * All rights reserved. 6*242be47eSzrj * 7*242be47eSzrj * Portions of this software were developed for the FreeBSD Project by 8*242be47eSzrj * ThinkSec AS and NAI Labs, the Security Research Division of Network 9*242be47eSzrj * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 10*242be47eSzrj * ("CBOSS"), as part of the DARPA CHATS research program. 11*242be47eSzrj * 12*242be47eSzrj * Redistribution and use in source and binary forms, with or without 13*242be47eSzrj * modification, are permitted provided that the following conditions 14*242be47eSzrj * are met: 15*242be47eSzrj * 1. Redistributions of source code must retain the above copyright 16*242be47eSzrj * notice, this list of conditions and the following disclaimer. 17*242be47eSzrj * 2. Redistributions in binary form must reproduce the above copyright 18*242be47eSzrj * notice, this list of conditions and the following disclaimer in the 19*242be47eSzrj * documentation and/or other materials provided with the distribution. 20*242be47eSzrj * 3. The name of the author may not be used to endorse or promote 21*242be47eSzrj * products derived from this software without specific prior written 22*242be47eSzrj * permission. 23*242be47eSzrj * 24*242be47eSzrj * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 25*242be47eSzrj * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26*242be47eSzrj * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27*242be47eSzrj * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 28*242be47eSzrj * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 29*242be47eSzrj * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 30*242be47eSzrj * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 31*242be47eSzrj * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 32*242be47eSzrj * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 33*242be47eSzrj * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 34*242be47eSzrj * SUCH DAMAGE. 35*242be47eSzrj * 36*242be47eSzrj * $FreeBSD: src/lib/libpam/modules/pam_self/pam_self.c,v 1.9 2002/04/12 22:27:24 des Exp $ 37*242be47eSzrj */ 38*242be47eSzrj 39*242be47eSzrj #define _BSD_SOURCE 40*242be47eSzrj 41*242be47eSzrj #include <pwd.h> 42*242be47eSzrj #include <unistd.h> 43*242be47eSzrj #include <syslog.h> 44*242be47eSzrj 45*242be47eSzrj #define PAM_SM_AUTH 46*242be47eSzrj 47*242be47eSzrj #include <security/pam_appl.h> 48*242be47eSzrj #include <security/pam_modules.h> 49*242be47eSzrj #include <security/pam_mod_misc.h> 50*242be47eSzrj 51*242be47eSzrj #define OPT_ALLOW_ROOT "allow_root" 52*242be47eSzrj 53*242be47eSzrj PAM_EXTERN int 54*242be47eSzrj pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, 55*242be47eSzrj int argc __unused, const char *argv[] __unused) 56*242be47eSzrj { 57*242be47eSzrj struct passwd *pwd; 58*242be47eSzrj const char *luser; 59*242be47eSzrj int pam_err; 60*242be47eSzrj uid_t uid; 61*242be47eSzrj 62*242be47eSzrj pam_err = pam_get_user(pamh, &luser, NULL); 63*242be47eSzrj if (pam_err != PAM_SUCCESS) 64*242be47eSzrj return (pam_err); 65*242be47eSzrj if (luser == NULL || (pwd = getpwnam(luser)) == NULL) 66*242be47eSzrj return (PAM_AUTH_ERR); 67*242be47eSzrj 68*242be47eSzrj uid = getuid(); 69*242be47eSzrj if (uid == 0 && !openpam_get_option(pamh, OPT_ALLOW_ROOT)) 70*242be47eSzrj return (PAM_AUTH_ERR); 71*242be47eSzrj 72*242be47eSzrj if (uid == (uid_t)pwd->pw_uid) 73*242be47eSzrj return (PAM_SUCCESS); 74*242be47eSzrj 75*242be47eSzrj PAM_VERBOSE_ERROR("Refused; source and target users differ"); 76*242be47eSzrj 77*242be47eSzrj return (PAM_AUTH_ERR); 78*242be47eSzrj } 79*242be47eSzrj 80*242be47eSzrj PAM_EXTERN int 81*242be47eSzrj pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused, 82*242be47eSzrj int argc __unused, const char *argv[] __unused) 83*242be47eSzrj { 84*242be47eSzrj 85*242be47eSzrj return (PAM_SUCCESS); 86*242be47eSzrj } 87*242be47eSzrj 88*242be47eSzrj PAM_MODULE_ENTRY("pam_self"); 89