rooty/yubico-pam
1
0
Fork 0
mirror of https://github.com/Yubico/yubico-pam.git synced 2025-02-22 09:54:17 +01:00
Code Issues Projects Releases Wiki Activity

authorize_user_token: Don't drop privs for system-wide file.

Browse Source
This commit is contained in:
Fredrik Thulin 2011-12-13 16:56:04 +01:00
parent 29f8a00713
commit 263012f725
1 changed files with 24 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

45
pam_yubico.c
View File

@ -206,6 +206,18 @@ authorize_user_token (struct cfg *cfg,
pam_handle_t *pamh) pam_handle_t *pamh)
{ {
int retval; int retval;
if (cfg->auth_file)
{
/* Administrator had configured the file and specified is name
as an argument for this module.
*/
DBG (("Using system-wide auth_file %s", cfg->auth_file));
retval = check_user_token (cfg, cfg->auth_file, username, otp_id);
}
else
{
char *userfile = NULL;
struct passwd *p; struct passwd *p;
p = getpwnam (username); p = getpwnam (username);
@ -214,39 +226,32 @@ authorize_user_token (struct cfg *cfg,
return 0; return 0;
} }
/* Getting file from user home directory
..... i.e. ~/.yubico/authorized_yubikeys
*/
if (! get_user_cfgfile_path (NULL, "authorized_yubikeys", username, &userfile)) {
D (("Failed figuring out per-user cfgfile"));
return 0;
}
DBG (("Dropping privileges"));
if (drop_privileges(p, pamh) < 0) { if (drop_privileges(p, pamh) < 0) {
D (("could not drop privileges")); D (("could not drop privileges"));
return 0; return 0;
} }
if (cfg->auth_file)
{
/* Administrator had configured the file and specified is name
as an argument for this module.
*/
retval = check_user_token (cfg, cfg->auth_file, username, otp_id);
}
else
{
char *userfile = NULL;
/* Getting file from user home directory
..... i.e. ~/.yubico/authorized_yubikeys
*/
if (! get_user_cfgfile_path (NULL, "authorized_yubikeys", username, &userfile))
return 0;
retval = check_user_token (cfg, userfile, username, otp_id); retval = check_user_token (cfg, userfile, username, otp_id);
free (userfile);
}
if (restore_privileges(pamh) < 0) if (restore_privileges(pamh) < 0)
{ {
DBG (("could not restore privileges")); DBG (("could not restore privileges"));
return 0; return 0;
} }
free (userfile);
}
return retval; return retval;
} }