From c9593778a6133bf29eb2f47c24cc6d2f5d729fc8 Mon Sep 17 00:00:00 2001
From: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Date: Thu, 11 Jun 2020 17:39:03 +0200
Subject: Move check_user_in_passwd from pam_localuser.c to pam_modutil

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>

* modules/pam_localuser/pam_localuser.c: Include
<security/pam_modutil.h>.
(pam_sm_authenticate): Replace check_user_in_passwd with
pam_modutil_check_user_in_passwd.
(check_user_in_passwd): Rename to pam_modutil_check_user_in_passwd,
move to ...
* libpam/pam_modutil_check_user.c: ... new file.
* libpam/Makefile.am (libpam_la_SOURCES): Add pam_modutil_check_user.c.
* libpam/include/security/pam_modutil.h
(pam_modutil_check_user_in_passwd): New function declaration.
* libpam/libpam.map (LIBPAM_MODUTIL_1.4.1): New interface.

Co-authored-by: Dmitry V. Levin <ldv@altlinux.org>
---
 modules/pam_localuser/pam_localuser.c | 86 +----------------------------------
 1 file changed, 2 insertions(+), 84 deletions(-)

(limited to 'modules/pam_localuser')

diff --git a/modules/pam_localuser/pam_localuser.c b/modules/pam_localuser/pam_localuser.c
index cb507524..a9f2233c 100644
--- a/modules/pam_localuser/pam_localuser.c
+++ b/modules/pam_localuser/pam_localuser.c
@@ -45,92 +45,10 @@
 #include <unistd.h>
 
 #include <security/pam_modules.h>
+#include <security/pam_modutil.h>
 #include <security/pam_ext.h>
 #include "pam_inline.h"
 
-static int
-check_user_in_passwd(pam_handle_t *pamh, const char *user_name,
-		     const char *file_name)
-{
-	int rc;
-	size_t user_len;
-	FILE *fp;
-	char line[BUFSIZ];
-
-	/* Validate the user name.  */
-	if ((user_len = strlen(user_name)) == 0) {
-		pam_syslog(pamh, LOG_NOTICE, "user name is not valid");
-		return PAM_SERVICE_ERR;
-	}
-
-	if (user_len > sizeof(line) - sizeof(":")) {
-		pam_syslog(pamh, LOG_NOTICE, "user name is too long");
-		return PAM_SERVICE_ERR;
-	}
-
-	if (strchr(user_name, ':') != NULL) {
-		/*
-		 * "root:x" is not a local user name even if the passwd file
-		 * contains a line starting with "root:x:".
-		 */
-		return PAM_PERM_DENIED;
-	}
-
-	/* Open the passwd file.  */
-	if (file_name == NULL) {
-		file_name = "/etc/passwd";
-	}
-	if ((fp = fopen(file_name, "r")) == NULL) {
-		pam_syslog(pamh, LOG_ERR, "error opening %s: %m", file_name);
-		return PAM_SERVICE_ERR;
-	}
-
-	/*
-	 * Scan the file using fgets() instead of fgetpwent_r() because
-	 * the latter is not flexible enough in handling long lines
-	 * in passwd files.
-	 */
-	rc = PAM_PERM_DENIED;
-	while (fgets(line, sizeof(line), fp) != NULL) {
-		size_t line_len;
-		const char *str;
-
-		/*
-		 * Does this line start with the user name
-		 * followed by a colon?
-		 */
-		if (strncmp(user_name, line, user_len) == 0 &&
-		    line[user_len] == ':') {
-			rc = PAM_SUCCESS;
-			break;
-		}
-		/* Has a newline been read?  */
-		line_len = strlen(line);
-		if (line_len < sizeof(line) - 1 ||
-		    line[line_len - 1] == '\n') {
-			/* Yes, continue with the next line.  */
-			continue;
-		}
-
-		/* No, read till the end of this line first.  */
-		while ((str = fgets(line, sizeof(line), fp)) != NULL) {
-			line_len = strlen(line);
-			if (line_len == 0 ||
-			    line[line_len - 1] == '\n') {
-				break;
-			}
-		}
-		if (str == NULL) {
-			/* fgets returned NULL, we are done.  */
-			break;
-		}
-		/* Continue with the next line.  */
-	}
-
-	fclose(fp);
-	return rc;
-}
-
 int
 pam_sm_authenticate(pam_handle_t *pamh, int flags UNUSED,
 		    int argc, const char **argv)
@@ -173,7 +91,7 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags UNUSED,
 		return rc == PAM_CONV_AGAIN ? PAM_INCOMPLETE : rc;
 	}
 
-	return check_user_in_passwd(pamh, user_name, file_name);
+	return pam_modutil_check_user_in_passwd(pamh, user_name, file_name);
 }
 
 int
-- 
cgit v1.2.1