Initial import of the CDE 2.1.30 sources from the Open Group.

cde/lib/pam/pam_modules/sample/Imakefile

@@ -0,0 +1,46 @@
+/* $XConsortium: Imakefile /main/2 1996/04/21 19:14:34 drk $
+ *
+ * (c) Copyright 1996 Digital Equipment Corporation.
+ * (c) Copyright 1996 Hewlett-Packard Company.
+ * (c) Copyright 1996 International Business Machines Corp.
+ * (c) Copyright 1995,1996 Sun Microsystems, Inc.
+ * (c) Copyright 1996 Novell, Inc. 
+ * (c) Copyright 1996 FUJITSU LIMITED.
+ * (c) Copyright 1996 Hitachi.
+ */
+
+#define DoNormalLib	NormalLibPam
+#define DoSharedLib	SharedLibPam
+#define DoDebugLib	DebugLibPam
+#define DoProfileLib	ProfileLibPam
+#define LibName		pam_sample
+#define SoRev		SOPAMREV
+#define LibHeaders	NO
+
+#include <Threads.tmpl>
+
+SRCS = \
+	sample_acct_mgmt.c \
+	sample_authenticate.c \
+	sample_close_session.c \
+	sample_open_session.c \
+	sample_password.c \
+	sample_setcred.c \
+	sample_utils.c
+
+OBJS = \
+	sample_acct_mgmt.o \
+	sample_authenticate.o \
+	sample_close_session.o \
+	sample_open_session.o \
+	sample_password.o \
+	sample_setcred.o \
+	sample_utils.o
+
+#ifdef SharedPamSampleReqs
+REQUIREDLIBS = SharedPamSampleReqs
+#endif
+
+#include <Library.tmpl>
+
+DependTarget()

cde/lib/pam/pam_modules/sample/libpam_sample.elist

@@ -0,0 +1,28 @@
+/****************************************************************************
+ * Export list for libpam_sample. 
+ * This list *must* be updated whenever a change is made to the libpam_sample
+ * API.
+ *
+ * The syntax for the symbol declarations in this list is as follows:
+ *       public       sym => Public   C   symbol, i.e., publicised API
+ *       private      sym => Private  C   symbol, i.e., unpublicised API
+ *       internal     sym => Internal C   symbol, i.e., not part of API
+ *       publicC++    sym => Public   C++ symbol, i.e., publicised API
+ *       privateC++   sym => Private  C++ symbol, i.e., unpublicised API
+ *       internalC++  sym => Internal C++ symbol, i.e., not part of API
+ * 
+ * $TOG: libpam_sample.elist /main/1 1999/09/08 15:59:30 mgreess $
+ *****************************************************************************/
+
+public pam_sm_authenticate
+public pam_sm_setcred
+public pam_sm_acct_mgmt
+public pam_sm_open_session
+public pam_sm_close_session
+public pam_sm_chauthtok
+
+internal display_errmsg
+internal get_authtok
+internal free_msg
+internal free_resp
+

cde/lib/pam/pam_modules/sample/sample_acct_mgmt.c

@@ -0,0 +1,127 @@
+/* $XConsortium: sample_acct_mgmt.c /main/2 1996/05/09 04:29:37 drk $ */
+
+/*
+ * Copyright (c) 1992-1995, by Sun Microsystems, Inc.
+ * All rights reserved.
+ */
+
+#ident  "@(#)sample_acct_mgmt.c 1.12     96/02/02 SMI"
+
+#include <syslog.h>
+#include <security/pam_appl.h>
+#include <security/pam_modules.h>
+#include <libintl.h>
+
+static parse_allow_name(char *, char *);
+
+/*
+ * pam_sm_acct_mgmt	main account managment routine.
+ *			It only checks the flag passed from pam_sm_auth_user().
+ *			XXX: The routine just prints out a warning message.
+ *			     It may need to force the user to change his/her
+ *			     passwd.
+ */
+
+#include <security/pam_appl.h>
+#define	PAMTXD	"SUNW_OST_SYSOSPAM"
+
+int
+pam_sm_acct_mgmt(
+	pam_handle_t *pamh,
+	int	flags,
+	int	argc,
+	const char **argv)
+{
+	char	*user;
+	char	*pg;
+	int	i;
+	int	debug = 0;
+	int	nowarn = 0;
+	int	error = 0;
+
+	if (argc == 0)
+		return (PAM_SUCCESS);
+
+	if (pam_get_item(pamh, PAM_USER, (void **)&user) != PAM_SUCCESS)
+		return (PAM_SERVICE_ERR);
+
+	if (pam_get_item(pamh, PAM_SERVICE, (void **)&pg) != PAM_SUCCESS)
+		return (PAM_SERVICE_ERR);
+
+	/*
+	 * kludge alert. su needs to be handled specially for allow policy.
+	 * we want to use the policy of the current user not the "destination"
+	 * user. This will enable us to prevent su to root but not to rlogin,
+	 * telnet, rsh, ftp to root.
+	 *
+	 * description of problem: user name is the "destination" name. not
+	 * the current name. The allow policy needs to be applied to the
+	 * current name in the case of su. user is "root" in this case and
+	 * we will be getting the root policy instead of the user policy.
+	 */
+	if (strcmp(pg, "su") == 0) {
+		struct passwd *pw;
+		uid_t uid;
+		uid = getuid();
+		pw = getpwuid(uid);
+		if (pw == NULL)
+			return (PAM_SYSTEM_ERR);
+		user = pw->pw_name;
+	}
+
+	if (user == 0 || *user == '\0' || (strcmp(user, "root") == 0))
+		return (PAM_SUCCESS);
+
+	for (i = 0; i < argc; i++) {
+		if (strcasecmp(argv[i], "debug") == 0)
+			debug = 1;
+		else if (strcasecmp(argv[i], "nowarn") == 0) {
+			nowarn = 1;
+			flags = flags | PAM_SILENT;
+		} else if (strncmp(argv[i], "allow=", 6) == 0)
+			error |= parse_allow_name(user, (char *)(argv[i]+6));
+		else
+			syslog(LOG_DEBUG, "illegal option %s", argv[i]);
+	}
+	return (error?PAM_SUCCESS:PAM_AUTH_ERR);
+}
+
+static
+parse_allow_name(char *who, char *cp)
+{
+	char name[256];
+	static char *getname();
+
+	/* catch "allow=" */
+	if (*cp == '\0')
+		return (0);
+	while (cp) {
+		cp = getname(cp, name);
+		/* catch things such as =, and ,, */
+		if (*name == '\0')
+			continue;
+		if (strcmp(who, name) == 0)
+			return (1);
+	}
+	return (0);
+} 
+
+static char *
+getname(char *cp, char *name)
+{
+	/* force name to be initially null string */
+	*name = '\0';
+
+	/* end of string? */
+	if (*cp == '\0')
+		return ((char *)0);
+	while (*cp) {
+		/* end of name? */
+		if (*cp == ',' || *cp == '\0')
+			break;
+		*name++ = *cp++;
+	}
+	/* make name into string */
+	*name++ = '\0';
+	return ((*cp == '\0')? (char *)0 : ++cp);
+}

cde/lib/pam/pam_modules/sample/sample_authenticate.c

@@ -0,0 +1,168 @@
+/* $XConsortium: sample_authenticate.c /main/2 1996/05/09 04:29:50 drk $ */
+/*
+ * Copyright (c) 1995, by Sun Microsystems, Inc.
+ * All rights reserved.
+ */
+
+#ident  "@(#)sample_authenticate.c 1.14     96/01/15 SMI"
+
+#include <security/pam_appl.h>
+#include <security/pam_modules.h>
+#include <string.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <pwd.h>
+#include <syslog.h>
+#include <libintl.h>
+
+#include "sample_utils.h"
+
+#define	SLEEPTIME	4
+
+/*
+ *
+ * Sample module for pam_sm_authenticate.
+ *
+ * options -
+ *
+ *	debug
+ *	use_first_pass
+ *	try_first_pass
+ *	first_pass_good  (first password is always good when used with use/try)
+ *	first_pass_bad   (first password is always bad when used with use/try)
+ *	pass=foobar	 (set good password to "foobar". default good password
+ *			 is test)
+ *	always_fail	 always return PAM_AUTH_ERR
+ *	always_succeed   always return PAM_SUCCESS
+ *	always_ignore
+ *
+ *
+ */
+
+/*
+ * pam_sm_authenticate		- Authenticate user
+ */
+
+int
+pam_sm_authenticate(
+	pam_handle_t		*pamh,
+	int 			flags,
+	int			argc,
+	const char		**argv)
+{
+	char			*user;
+	struct pam_conv 	*pam_convp;
+	int			err, result = PAM_AUTH_ERR;
+	struct pam_response 	*ret_resp = (struct pam_response *)0;
+	char 			messages[PAM_MAX_NUM_MSG][PAM_MAX_MSG_SIZE];
+	int			debug = 0;
+	int			try_first_pass = 0;
+	int			use_first_pass = 0;
+	int			first_pass_good = 0;
+	int			first_pass_bad = 0;
+	int			i, num_msg;
+	char			*firstpass, *password;
+	char			the_password[64];
+
+	if (debug)
+		syslog(LOG_DEBUG, "Sample Authentication\n");
+
+	strcpy(the_password, "test");
+
+	for (i = 0; i < argc; i++) {
+		if (strcmp(argv[i], "debug") == 0)
+			debug = 1;
+		else if (strcmp(argv[i], "try_first_pass") == 0)
+			try_first_pass = 1;
+		else if (strcmp(argv[i], "first_pass_good") == 0)
+			first_pass_good = 1;
+		else if (strcmp(argv[i], "first_pass_bad") == 0)
+			first_pass_bad = 1;
+		else if (strcmp(argv[i], "use_first_pass") == 0)
+			use_first_pass = 1;
+		else if (strcmp(argv[i], "always_fail") == 0)
+			return (PAM_AUTH_ERR);
+		else if (strcmp(argv[i], "always_succeed") == 0)
+			return (PAM_SUCCESS);
+		else if (strcmp(argv[i], "always_ignore") == 0)
+			return (PAM_IGNORE);
+		else if (sscanf(argv[i], "pass=%s", the_password) == 1) {
+			/* nothing */;
+		}
+		else
+			syslog(LOG_DEBUG, "illegal scheme option %s", argv[i]);
+	}
+
+	err = pam_get_item(pamh, PAM_USER, (void**) &user);
+	if (err != PAM_SUCCESS)
+		return (err);
+
+	err = pam_get_item(pamh, PAM_CONV, (void**) &pam_convp);
+	if (err != PAM_SUCCESS)
+		return (err);
+
+	(void) pam_get_item(pamh, PAM_AUTHTOK, (void **) &firstpass);
+
+	if (firstpass && (use_first_pass || try_first_pass)) {
+
+		if ((first_pass_good ||
+			strcmp(firstpass, the_password) == 0) &&
+				!first_pass_bad) {
+					result = PAM_SUCCESS;
+					goto out;
+		}
+		if (use_first_pass) goto out;
+	}
+
+	/*
+	 * Get the password from the user
+	 */
+	if (firstpass) {
+		(void) sprintf(messages[0], (const char *) PAM_MSG(pamh, 1,
+			"TEST Password: "));
+	} else {
+		(void) sprintf(messages[0], (const char *) PAM_MSG(pamh, 2,
+			"Password: "));
+	}
+	num_msg = 1;
+	err = get_authtok(pam_convp->conv,
+				num_msg, messages, NULL, &ret_resp);
+
+	if (err != PAM_SUCCESS) {
+		result = err;
+		goto out;
+	}
+
+	password = ret_resp->resp;
+
+	if (password == NULL) {
+		result = PAM_AUTH_ERR;
+		goto out;
+	}
+
+	/* one last ditch attempt to "login" to TEST */
+
+	if (strcmp(password, the_password) == 0) {
+		result = PAM_SUCCESS;
+		if (firstpass == NULL) {
+		/* this is the first password, stash it away */
+		pam_set_item(pamh, PAM_AUTHTOK, password);
+		}
+	}
+
+out:
+	if (num_msg > 0) {
+		if (ret_resp != 0) {
+			if (ret_resp->resp != 0) {
+				/* avoid leaving password cleartext around */
+				memset(ret_resp->resp, 0,
+					strlen(ret_resp->resp));
+			}
+			free_resp(num_msg, ret_resp);
+			ret_resp = 0;
+		}
+	}
+
+	return (result);
+}

cde/lib/pam/pam_modules/sample/sample_close_session.c

@@ -0,0 +1,21 @@
+/* $XConsortium: sample_close_session.c /main/2 1996/05/09 04:30:08 drk $ */
+/*
+ * Copyright (c) 1995, by Sun Microsystems, Inc.
+ * All rights reserved.
+ */
+
+#ident  "@(#)sample_close_session.c 1.8     96/01/12 SMI"
+
+#include <security/pam_appl.h>
+#include <security/pam_modules.h>
+#include <syslog.h>
+
+int
+pam_sm_close_session(
+	pam_handle_t *pamh,
+	int	flags,
+	int	argc,
+	const char **argv)
+{
+	return (PAM_SUCCESS);
+}

cde/lib/pam/pam_modules/sample/sample_open_session.c

@@ -0,0 +1,21 @@
+/* $XConsortium: sample_open_session.c /main/2 1996/05/09 04:30:22 drk $ */
+/*
+ * Copyright (c) 1995, by Sun Microsystems, Inc.
+ * All rights reserved.
+ */
+
+#ident  "@(#)sample_open_session.c 1.8     96/01/12 SMI"
+
+#include <security/pam_appl.h>
+#include <security/pam_modules.h>
+#include <syslog.h>
+
+int
+pam_sm_open_session(
+	pam_handle_t *pamh,
+	int	flags,
+	int	argc,
+	const char **argv)
+{
+	return (PAM_SUCCESS);
+}

cde/lib/pam/pam_modules/sample/sample_password.c

@@ -0,0 +1,27 @@
+/* $XConsortium: sample_password.c /main/2 1996/05/09 04:30:43 drk $ */
+/*
+ * Copyright (c) 1995, by Sun Microsystems, Inc.
+ * All rights reserved.
+ */
+
+#ident  "@(#)sample_password.c 1.10     96/01/15 SMI"
+
+#include <security/pam_appl.h>
+#include <security/pam_modules.h>
+#include <syslog.h>
+#include <string.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <pwd.h>
+
+int
+pam_sm_chauthtok(
+	pam_handle_t	*pamh,
+	int		flags,
+	int		argc,
+	const char	**argv)
+
+{
+	return (PAM_SUCCESS);
+}

cde/lib/pam/pam_modules/sample/sample_setcred.c

@@ -0,0 +1,32 @@
+/* $XConsortium: sample_setcred.c /main/2 1996/05/09 04:31:02 drk $ */
+
+/*
+ * Copyright (c) 1992-1995, by Sun Microsystems, Inc.
+ * All rights reserved.
+ */
+
+#ident  "@(#)sample_setcred.c 1.9     96/01/12 SMI"
+
+#include <libintl.h>
+#include <security/pam_appl.h>
+#include <security/pam_modules.h>
+
+#define	PAMTXD	"SUNW_OST_SYSOSPAM"
+
+/*
+ * pam_sm_setcred
+ */
+int
+pam_sm_setcred(
+	pam_handle_t *pamh,
+	int   flags,
+	int	argc,
+	const char **argv)
+{
+
+	/*
+	 * Set the credentials
+	 */
+
+	return (PAM_SUCCESS);
+}

cde/lib/pam/pam_modules/sample/sample_utils.c

@@ -0,0 +1,174 @@
+/* $XConsortium: sample_utils.c /main/2 1996/05/09 04:31:21 drk $ */
+
+/*
+ * Copyright (c) 1992-1995, by Sun Microsystems, Inc.
+ * All rights reserved.
+ */
+
+#ident  "@(#)sample_utils.c 1.8     96/01/12 SMI"
+
+#include <security/pam_appl.h>
+#include <string.h>
+#include <stdlib.h>
+#include <malloc.h>
+
+#include "sample_utils.h"
+
+/* ******************************************************************** */
+/*									*/
+/* 		Utilities Functions					*/
+/*									*/
+/* ******************************************************************** */
+
+/*
+ * free_msg():
+ *	free storage for messages used in the call back "pam_conv" functions
+ */
+
+void
+free_msg(num_msg, msg)
+	int num_msg;
+	struct pam_message *msg;
+{
+	int 			i;
+	struct pam_message 	*m;
+
+	if (msg) {
+		m = msg;
+		for (i = 0; i < num_msg; i++, m++) {
+			if (m->msg)
+				free(m->msg);
+		}
+		free(msg);
+	}
+}
+
+/*
+ * free_resp():
+ *	free storage for responses used in the call back "pam_conv" functions
+ */
+
+void
+free_resp(num_msg, resp)
+	int num_msg;
+	struct pam_response *resp;
+{
+	int			i;
+	struct pam_response	*r;
+
+	if (resp) {
+		r = resp;
+		for (i = 0; i < num_msg; i++, r++) {
+			if (r->resp)
+				free(r->resp);
+		}
+		free(resp);
+	}
+}
+
+/*
+ * display_errmsg():
+ *	display error message by calling the call back functions
+ *	provided by the application through "pam_conv" structure
+ */
+
+int
+display_errmsg(conv_funp, num_msg, messages, conv_apdp)
+	int (*conv_funp)();
+	int num_msg;
+	char messages[PAM_MAX_NUM_MSG][PAM_MAX_MSG_SIZE];
+	void *conv_apdp;
+{
+	struct pam_message	*msg;
+	struct pam_message	*m;
+	struct pam_response	*resp;
+	int			i;
+	int			k;
+	int			retcode;
+
+	msg = (struct pam_message *)calloc(num_msg,
+					sizeof (struct pam_message));
+	if (msg == NULL) {
+		return (PAM_CONV_ERR);
+	}
+	m = msg;
+
+	i = 0;
+	k = num_msg;
+	resp = NULL;
+	while (k--) {
+		/*
+		 * fill out the pam_message structure to display error message
+		 */
+		m->msg_style = PAM_ERROR_MSG;
+		m->msg = (char *)malloc(PAM_MAX_MSG_SIZE);
+		if (m->msg != NULL)
+			(void) strcpy(m->msg, (const char *)messages[i]);
+		else
+			continue;
+		m++;
+		i++;
+	}
+
+	/*
+	 * Call conv function to display the message,
+	 * ignoring return value for now
+	 */
+	retcode = conv_funp(num_msg, &msg, &resp, conv_apdp);
+	free_msg(num_msg, msg);
+	free_resp(num_msg, resp);
+	return (retcode);
+}
+
+/*
+ * get_authtok():
+ *	get authentication token by calling the call back functions
+ *	provided by the application through "pam_conv" structure
+ */
+
+int
+get_authtok(conv_funp, num_msg, messages, conv_apdp, ret_respp)
+	int (*conv_funp)();
+	int num_msg;
+	char messages[PAM_MAX_NUM_MSG][PAM_MAX_MSG_SIZE];
+	void *conv_apdp;
+	struct pam_response	**ret_respp;
+{
+	struct pam_message	*msg;
+	struct pam_message	*m;
+	int			i;
+	int			k;
+	int			retcode;
+
+	i = 0;
+	k = num_msg;
+
+	msg = (struct pam_message *)calloc(num_msg,
+						sizeof (struct pam_message));
+	if (msg == NULL) {
+		return (PAM_CONV_ERR);
+	}
+	m = msg;
+
+	while (k--) {
+		/*
+		 * fill out the message structure to display error message
+		 */
+		m->msg_style = PAM_PROMPT_ECHO_OFF;
+		m->msg = (char *)malloc(PAM_MAX_MSG_SIZE);
+		if (m->msg != NULL)
+			(void) strcpy(m->msg, (char *)messages[i]);
+		else
+			continue;
+		m++;
+		i++;
+	}
+
+	/*
+	 * Call conv function to display the prompt,
+	 * ignoring return value for now
+	 */
+	retcode = conv_funp(num_msg, &msg, ret_respp, conv_apdp);
+	free_msg(num_msg, msg);
+	return (retcode);
+}

cde/lib/pam/pam_modules/sample/sample_utils.h

@@ -0,0 +1,51 @@
+/* $XConsortium: sample_utils.h /main/2 1996/05/09 04:31:40 drk $ */
+
+/*
+ * Copyright (c) 1992-1995, by Sun Microsystems, Inc.
+ * All rights reserved.
+ */
+
+#ifndef _TEST_UTILS_H
+#define	_TEST_UTILS_H
+
+#pragma ident	"@(#)sample_utils.h	1.7	96/02/02 SMI"	/* PAM 2.6 */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+void
+free_msg(int num_msg, struct pam_message *msg);
+
+void
+free_resp(int num_msg, struct pam_response *resp);
+
+int
+display_errmsg(
+	int (*conv_funp)(),
+	int num_msg,
+	char messages[PAM_MAX_NUM_MSG][PAM_MAX_MSG_SIZE],
+	void *conv_apdp
+);
+
+int
+get_authtok(
+	int (*conv_funp)(),
+	int num_msg,
+	char messages[PAM_MAX_NUM_MSG][PAM_MAX_MSG_SIZE],
+	void *conv_apdp,
+	struct pam_response	**ret_respp
+);
+
+/*
+ * PAM_MSG macro for return of internationalized text
+ */
+
+#define	PAM_MSG(pamh, number, string)\
+	(char *) __pam_get_i18n_msg(pamh, "pam_unix", 3, number, string)
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _TEST_UTILS_H */