pam_nologin.c revision 94564
179476Smarkm/*- 279476Smarkm * Copyright 2001 Mark R V Murray 379476Smarkm * All rights reserved. 492297Sdes * Copyright (c) 2001 Networks Associates Technology, Inc. 587398Sdes * All rights reserved. 679476Smarkm * 787398Sdes * Portions of this software were developed for the FreeBSD Project by 887398Sdes * ThinkSec AS and NAI Labs, the Security Research Division of Network 987398Sdes * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 1087398Sdes * ("CBOSS"), as part of the DARPA CHATS research program. 1187398Sdes * 1279476Smarkm * Redistribution and use in source and binary forms, with or without 1379476Smarkm * modification, are permitted provided that the following conditions 1479476Smarkm * are met: 1579476Smarkm * 1. Redistributions of source code must retain the above copyright 1679476Smarkm * notice, this list of conditions and the following disclaimer. 1779476Smarkm * 2. Redistributions in binary form must reproduce the above copyright 1879476Smarkm * notice, this list of conditions and the following disclaimer in the 1979476Smarkm * documentation and/or other materials provided with the distribution. 2087398Sdes * 3. The name of the author may not be used to endorse or promote 2187398Sdes * products derived from this software without specific prior written 2287398Sdes * permission. 2379476Smarkm * 2479476Smarkm * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 2579476Smarkm * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 2679476Smarkm * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 2779476Smarkm * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 2879476Smarkm * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 2979476Smarkm * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 3079476Smarkm * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 3179476Smarkm * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 3279476Smarkm * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 3379476Smarkm * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 3479476Smarkm * SUCH DAMAGE. 3579476Smarkm */ 3679476Smarkm 3784218Sdillon#include <sys/cdefs.h> 3884218Sdillon__FBSDID("$FreeBSD: head/lib/libpam/modules/pam_nologin/pam_nologin.c 94564 2002-04-12 22:27:25Z des $"); 3984218Sdillon 4082359Smarkm#include <sys/types.h> 4182359Smarkm#include <sys/stat.h> 4282359Smarkm#include <fcntl.h> 4382359Smarkm#include <login_cap.h> 4482359Smarkm#include <pwd.h> 4579476Smarkm#include <stdio.h> 4679476Smarkm#include <stdlib.h> 4779476Smarkm#include <unistd.h> 4879476Smarkm 4987398Sdes#define PAM_SM_AUTH 5087398Sdes 5190229Sdes#include <security/pam_appl.h> 5279476Smarkm#include <security/pam_modules.h> 5390229Sdes#include <security/pam_mod_misc.h> 5479476Smarkm 5579476Smarkm#define NOLOGIN "/var/run/nologin" 5679476Smarkm 5789760Smarkmstatic char nologin_def[] = NOLOGIN; 5889760Smarkm 5979476SmarkmPAM_EXTERN int 6094564Sdespam_sm_authenticate(pam_handle_t *pamh, int flags __unused, 6194564Sdes int argc __unused, const char *argv[] __unused) 6279476Smarkm{ 6382359Smarkm login_cap_t *lc; 6481472Smarkm struct passwd *pwd; 6579476Smarkm struct stat st; 6679476Smarkm int retval, fd; 6782359Smarkm const char *user, *nologin; 6879476Smarkm char *mtmp; 6979476Smarkm 7079476Smarkm retval = pam_get_user(pamh, &user, NULL); 7179476Smarkm if (retval != PAM_SUCCESS) 7294564Sdes return (retval); 7379476Smarkm 7479476Smarkm PAM_LOG("Got user: %s", user); 7579476Smarkm 7682359Smarkm lc = login_getclass(NULL); 7789760Smarkm nologin = login_getcapstr(lc, "nologin", nologin_def, nologin_def); 7882359Smarkm login_close(lc); 7982359Smarkm lc = NULL; 8082359Smarkm 8182359Smarkm fd = open(nologin, O_RDONLY, 0); 8279476Smarkm if (fd < 0) 8394564Sdes return (PAM_SUCCESS); 8479476Smarkm 8579476Smarkm PAM_LOG("Opened %s file", NOLOGIN); 8679476Smarkm 8781472Smarkm pwd = getpwnam(user); 8881472Smarkm if (pwd && pwd->pw_uid == 0) 8979476Smarkm retval = PAM_SUCCESS; 9079476Smarkm else { 9181472Smarkm if (!pwd) 9279476Smarkm retval = PAM_USER_UNKNOWN; 9379476Smarkm else 9479476Smarkm retval = PAM_AUTH_ERR; 9579476Smarkm } 9694564Sdes 9779476Smarkm if (fstat(fd, &st) < 0) 9894564Sdes return (retval); 9979476Smarkm 10081472Smarkm mtmp = malloc(st.st_size + 1); 10181472Smarkm if (mtmp != NULL) { 10281472Smarkm read(fd, mtmp, st.st_size); 10381472Smarkm mtmp[st.st_size] = '\0'; 10491714Sdes pam_error(pamh, "%s", mtmp, NULL); 10581472Smarkm free(mtmp); 10681472Smarkm } 10794564Sdes 10881472Smarkm if (retval != PAM_SUCCESS) 10981472Smarkm PAM_VERBOSE_ERROR("Administrator refusing you: %s", NOLOGIN); 11079476Smarkm 11194564Sdes return (retval); 11279476Smarkm} 11379476Smarkm 11479476SmarkmPAM_EXTERN int 11594564Sdespam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused, 11694564Sdes int argc __unused, const char *argv[] __unused) 11779476Smarkm{ 11881472Smarkm 11994564Sdes return (PAM_SUCCESS); 12079476Smarkm} 12179476Smarkm 12279476SmarkmPAM_MODULE_ENTRY("pam_nologin"); 123