dynconfig: Fix deps, no talloc required

[samba.git] / source3 / pam_smbpass / pam_smb_auth.c

diff --git a/source3/pam_smbpass/pam_smb_auth.c b/source3/pam_smbpass/pam_smb_auth.c
index 79856a111d2946b5f7c911e47f7aca5b19e969a5..06ab8455d5daa73aeceec5758b456ebd2f639f1f 100644 (file)
--- a/source3/pam_smbpass/pam_smb_auth.c
+++ b/source3/pam_smbpass/pam_smb_auth.c
@@ -18,7 +18,7 @@
 #define PAM_SM_AUTH
 
 #include "includes.h"
-#include "debug.h"
+#include "lib/util/debug.h"
 
 #ifndef LINUX
 
@@ -41,15 +41,23 @@
 
 #include "support.h"
 
+static void ret_data_cleanup(pam_handle_t *pamh, void *data, int error_status)
+{
+       free(data);
+}
+
 #define AUTH_RETURN                                            \
 do {                                                           \
        /* Restore application signal handler */                \
-       CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler);       \
+       CatchSignal(SIGPIPE, oldsig_handler);                   \
        if(ret_data) {                                          \
                *ret_data = retval;                             \
-               pam_set_data( pamh, "smb_setcred_return"        \
-                             , (void *) ret_data, NULL );      \
+               pam_set_data(pamh,                              \
+                       "smb_setcred_return",                   \
+                       (void *)ret_data,                       \
+                       ret_data_cleanup);                      \
        }                                                       \
+       TALLOC_FREE(frame);                                     \
        return retval;                                          \
 } while (0)
 
@@ -72,20 +80,17 @@ int pam_sm_authenticate(pam_handle_t *pamh, int flags,
        unsigned int ctrl;
        int retval, *ret_data = NULL;
        struct samu *sampass = NULL;
-       extern bool in_client;
        const char *name;
        void (*oldsig_handler)(int) = NULL;
        bool found;
+       TALLOC_CTX *frame = talloc_stackframe();
 
        /* Points to memory managed by the PAM library. Do not free. */
        char *p = NULL;
 
        /* Samba initialization. */
-       load_case_tables();
-       setup_logging("pam_smbpass",False);
-       in_client = True;
 
-       ctrl = set_ctrl(flags, argc, argv);
+       ctrl = set_ctrl(pamh, flags, argc, argv);
 
        /* Get a few bytes so we can pass our return value to
                pam_sm_setcred(). */
@@ -94,29 +99,35 @@ int pam_sm_authenticate(pam_handle_t *pamh, int flags,
        /* we need to do this before we call AUTH_RETURN */
        /* Getting into places that might use LDAP -- protect the app
        from a SIGPIPE it's not expecting */
-       oldsig_handler = CatchSignal(SIGPIPE, SIGNAL_CAST SIG_IGN);
+       oldsig_handler = CatchSignal(SIGPIPE, SIG_IGN);
 
        /* get the username */
        retval = pam_get_user( pamh, &name, "Username: " );
        if ( retval != PAM_SUCCESS ) {
                if (on( SMB_DEBUG, ctrl )) {
-                       _log_err(LOG_DEBUG, "auth: could not identify user");
+                       _log_err(pamh, LOG_DEBUG, "auth: could not identify user");
                }
                AUTH_RETURN;
        }
        if (on( SMB_DEBUG, ctrl )) {
-               _log_err( LOG_DEBUG, "username [%s] obtained", name );
+               _log_err(pamh, LOG_DEBUG, "username [%s] obtained", name );
+       }
+
+       if (geteuid() != 0) {
+               _log_err(pamh, LOG_DEBUG, "Cannot access samba password database, not running as root.");
+               retval = PAM_AUTHINFO_UNAVAIL;
+               AUTH_RETURN;
        }
 
        if (!initialize_password_db(True, NULL)) {
-               _log_err( LOG_ALERT, "Cannot access samba password database" );
+               _log_err(pamh, LOG_ALERT, "Cannot access samba password database" );
                retval = PAM_AUTHINFO_UNAVAIL;
                AUTH_RETURN;
        }
 
        sampass = samu_new( NULL );
        if (!sampass) {
-               _log_err( LOG_ALERT, "Cannot talloc a samu struct" );
+               _log_err(pamh, LOG_ALERT, "Cannot talloc a samu struct" );
                retval = nt_status_to_pam(NT_STATUS_NO_MEMORY);
                AUTH_RETURN;
        }
@@ -130,13 +141,13 @@ int pam_sm_authenticate(pam_handle_t *pamh, int flags,
        }
 
        if (!found) {
-               _log_err(LOG_ALERT, "Failed to find entry for user %s.", name);
+               _log_err(pamh, LOG_ALERT, "Failed to find entry for user %s.", name);
                retval = PAM_USER_UNKNOWN;
                TALLOC_FREE(sampass);
                sampass = NULL;
                AUTH_RETURN;
        }
-   
+
        /* if this user does not have a password... */
 
        if (_smb_blankpasswd( ctrl, sampass )) {
@@ -149,7 +160,7 @@ int pam_sm_authenticate(pam_handle_t *pamh, int flags,
 
        retval = _smb_read_password(pamh, ctrl, NULL, "Password: ", NULL, _SMB_AUTHTOK, &p);
        if (retval != PAM_SUCCESS ) {
-               _log_err(LOG_CRIT, "auth: no password provided for [%s]", name);
+               _log_err(pamh,LOG_CRIT, "auth: no password provided for [%s]", name);
                TALLOC_FREE(sampass);
                AUTH_RETURN;
        }
@@ -174,7 +185,7 @@ int pam_sm_setcred(pam_handle_t *pamh, int flags,
 
        retval = PAM_SUCCESS;
 
-       pam_get_data(pamh, "smb_setcred_return", (const void **) &pretval);
+       _pam_get_data(pamh, "smb_setcred_return", &pretval);
        if(pretval) {
                retval = *pretval;
                SAFE_FREE(pretval);
@@ -192,15 +203,15 @@ static int _smb_add_user(pam_handle_t *pamh, unsigned int ctrl,
        char *msg_str = NULL;
        const char *pass = NULL;
        int retval;
+       TALLOC_CTX *frame = talloc_stackframe();
 
        /* Get the authtok; if we don't have one, silently fail. */
-       retval = pam_get_item( pamh, PAM_AUTHTOK, (const void **) &pass );
+       retval = _pam_get_item( pamh, PAM_AUTHTOK, &pass );
 
        if (retval != PAM_SUCCESS) {
-               _log_err( LOG_ALERT
+               _log_err(pamh, LOG_ALERT
                        , "pam_get_item returned error to pam_sm_authenticate" );
-               return PAM_AUTHTOK_RECOVER_ERR;
-       } else if (pass == NULL) {
+               TALLOC_FREE(frame);
                return PAM_AUTHTOK_RECOVER_ERR;
        }
 
@@ -217,6 +228,7 @@ static int _smb_add_user(pam_handle_t *pamh, unsigned int ctrl,
 
                SAFE_FREE(err_str);
                SAFE_FREE(msg_str);
+               TALLOC_FREE(frame);
                return PAM_IGNORE;
        } else {
                /* mimick 'update encrypted' as long as the 'no pw req' flag is not set */
@@ -234,6 +246,7 @@ static int _smb_add_user(pam_handle_t *pamh, unsigned int ctrl,
        SAFE_FREE(err_str);
        SAFE_FREE(msg_str);
        pass = NULL;
+       TALLOC_FREE(frame);
        return PAM_IGNORE;
 }