C++ pam_get_user函数代码示例

PAM_EXTERN
int pam_sm_authenticate(pam_handle_t *pamh, int flags UNUSED,
			int argc, const char **argv)
{
    int retval;
    const char *user=NULL;

    /*
     * authentication requires we know who the user wants to be
     */
    retval = pam_get_user(pamh, &user, NULL);
    if (retval != PAM_SUCCESS) {
	D(("get user returned error: %s", pam_strerror(pamh,retval)));
	return retval;
    }
    if (user == NULL || *user == '\0') {
	D(("username not known"));
	retval = pam_set_item(pamh, PAM_USER, (const void *) DEFAULT_USER);
	if (retval != PAM_SUCCESS)
	    return retval;
    }
    user = NULL;                                            /* clean up */

    retval = parse_args(PAM_SUCCESS, "auth", pamh, argc, argv);

    return retval;
}

PAM_EXTERN
int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc
			, const char **argv)
{
     const char *service=NULL, *user=NULL, *terminal=NULL
	 , *rhost=NULL, *ruser=NULL;

     (void) pam_get_item(pamh, PAM_SERVICE, (const void **)&service);
     (void) pam_get_item(pamh, PAM_TTY, (const void **)&terminal);
     _pam_log(LOG_NOTICE, "service: %s [on terminal: %s]"
	      , service ? service : "<unknown>"
	      , terminal ? terminal : "<unknown>"
	 );
     (void) pam_get_user(pamh, &user, "Who are you? ");
     (void) pam_get_item(pamh, PAM_RUSER, (const void **)&ruser);
     (void) pam_get_item(pamh, PAM_RHOST, (const void **)&rhost);
     _pam_log(LOG_NOTICE, "user: (uid=%d) -> %s [remote: %[email protected]%s]"
	      , getuid()
	      , user ? user : "<unknown>"
	      , ruser ? ruser : "?nobody"
	      , rhost ? rhost : "?nowhere"
	      );

     /* we are just a fly on the wall */

     return PAM_IGNORE;
}

int _whawty_ctx_init(whawty_ctx_t* ctx, pam_handle_t *pamh, int flags, int argc, const char **argv)
{
  ctx->flags_ = 0;
  ctx->pamh_ = pamh;
  ctx->username_ = NULL;
  ctx->password_ = NULL;
  ctx->sockpath_ = NULL;
  ctx->sock_ = -1;
  ctx->timeout_ = 3;

  if(flags & PAM_SILENT)
    ctx->flags_ |= WHAWTY_CONF_SILENT;
  // flag PAM_DISALLOW_NULL_AUTHTOK is not applicable and will therefore be ignored

  int ret = _whawty_parse_args(ctx, argc, argv);
  if(ret != PAM_SUCCESS)
    return ret;

  ret = pam_get_user(pamh, &(ctx->username_), NULL);
  if(ret == PAM_SUCCESS) {
    _whawty_logf(ctx, LOG_DEBUG, "successfully initialized [sock=%s]", ctx->sockpath_);
  } else {
    _whawty_logf(ctx, LOG_ERR, "pam_get_user() failed [%s]", pam_strerror(ctx->pamh_, ret));
  }
  return ret;
}

PAM_EXTERN int
pam_sm_chauthtok (pam_handle_t *ph, int flags, int argc, const char **argv)
{
	const char *user;
	struct passwd *pwd;
	uint args;
	int ret;
	
	args = parse_args (ph, argc, argv);

	if (args & ARG_IGNORE_SERVICE)
		return PAM_SUCCESS;

	/* Figure out and/or prompt for the user name */
	ret = pam_get_user (ph, &user, NULL);
	if (ret != PAM_SUCCESS) {
		syslog (GKR_LOG_ERR, "gkr-pam: couldn't get the user name: %s", 
		        pam_strerror (ph, ret));
		return PAM_SERVICE_ERR;
	}
	
	pwd = getpwnam (user);
	if (!pwd) {
		syslog (GKR_LOG_ERR, "gkr-pam: error looking up user information for: %s", user);
		return PAM_SERVICE_ERR;
	}

	if (flags & PAM_PRELIM_CHECK) 
		return pam_chauthtok_preliminary (ph, pwd);
	else if (flags & PAM_UPDATE_AUTHTOK)
		return pam_chauthtok_update (ph, pwd, args);
	else 
		return PAM_IGNORE;
}

PAM_EXTERN int
pam_sm_authenticate ( pam_handle_t *pamh, int flags, int argc,
			const char *argv[] )
{
	int retval;
	const char *user, *prompt;
	char *data,*data2,*flag;
	char * pwdt,*pwds;
	retval = pam_get_user ( pamh, &user, NULL );
	if (retval != PAM_SUCCESS)
		return retval;
 
	D(("Got user: %s", user));

	D(("cenas"));
	pam_prompt(pamh, PAM_PROMPT_ECHO_OFF, &data,"attempt");
	if(data == NULL)
		return PAM_AUTH_ERR;
	Base64Decode(data,&pwdt);
	D(("Attempted Password: %s \n", pwdt));

	pam_prompt(pamh, PAM_PROMPT_ECHO_OFF, &data2,"storedpassword");
	Base64Decode(data2,&pwds);
	if(strlen(data2) == 0)
		return PAM_AUTH_ERR;
	D(("Stored Password: %s \n", pwds));

	if(strcmp(pwdt,pwds) == 0){
		D(("PTEID CC authentication: success!"));
		return PAM_SUCCESS;
	}

	return PAM_AUTH_ERR;
}

static int pam_get_uid( pam_handle_t *pamh, uid_t *uid, const char **userp ) 
  {
    const char *user;
    struct passwd *pw;

#ifdef MAIN
    user = cline_user;
#else
    pam_get_user( pamh, &user, NULL );
#endif

    if ( !user || !*user ) {
      _pam_log(LOG_ERR, MODULE_NAME ": pam_get_uid; user?");
      return PAM_AUTH_ERR;
    }

    if ( ! ( pw = getpwnam( user ) ) ) {
      _pam_log(LOG_ERR,MODULE_NAME ": pam_get_uid; no such user %s",user);
      return PAM_USER_UNKNOWN;
    }
    
    if ( uid )   *uid   = pw->pw_uid;
    if ( userp ) *userp = user;
    return PAM_SUCCESS;
  }

int pam_sm_open_session(pam_handle_t *pamh, int flags, int argc,
		const char **argv)
{
	const char *PAM_user = NULL;
	int ret;

	if (!cgm_dbus_connect()) {
		mysyslog(LOG_ERR, "Failed to connect to cgmanager\n");
		return PAM_SESSION_ERR;
	}
	if (argc > 1 && strcmp(argv[0], "-c") == 0)
		ctrl_list = validate_and_dup(argv[1]);
	if (!ctrl_list) 
		get_active_controllers();
	cgm_escape();

	ret = pam_get_user(pamh, &PAM_user, NULL);
	if (ret != PAM_SUCCESS) {
		cgm_dbus_disconnect();
		mysyslog(LOG_ERR, "PAM-CGM: couldn't get user\n");
		return PAM_SESSION_ERR;
	}

	ret = handle_login(PAM_user);
	cgm_dbus_disconnect();
	return ret;
}

PAM_EXTERN int
pam_sm_open_session(pam_handle_t *pamh, int flags,
		    int argc, const char **argv)
{
	const struct passwd *pwent;
	const char *user;
	struct stat di;
	void (*sh)(int);
	pid_t child;
	int res;

	/* Who are we talking about anyway? */
	res = pam_get_user(pamh, &user, NULL);
	if (res != PAM_SUCCESS)
		return res;

	/* Fetch passwd entry */
	pwent = getpwnam(user);
	if (!pwent)
	{
		pam_error(pamh, "User not found in passwd?");
		return PAM_CRED_INSUFFICIENT;
	}

	openlog("pam_mkhomedir", LOG_PID, LOG_AUTH);
	if (stat(pwent->pw_dir, &di))
		return pam_mkhd_copy(pamh, pwent, "/etc/skel", pwent->pw_dir);

	return PAM_SUCCESS;
}

PAM_VISIBLE int
pam_sm_close_session(pam_handle_t *pamh, int flags,
            int argc, const char *argv[])
{
	modopt_t *options = NULL;
	const char *user, *rhost;
	int rc;
	PGresult *res;
	PGconn *conn;

	user = NULL; rhost = NULL;

	if ((options = mod_options(argc, argv)) != NULL) {

		if (options->query_session_close) {

			if ((rc = pam_get_item(pamh, PAM_RHOST, (const void **)&rhost)) == PAM_SUCCESS) {

				if ((rc = pam_get_user(pamh, &user, NULL)) == PAM_SUCCESS) {
					DBGLOG("Session opened for user: %s", user);
					if ((conn = db_connect(options))) {
                          pg_execParam(conn, &res, options->query_session_close, pam_get_service(pamh), user, NULL, rhost);
                          PQclear(res);
                          PQfinish(conn);
					}
				}
			}
		}
	//free_module_options(options);
	}

	return (PAM_SUCCESS);

}

/* Create and populate a context based on a given PAM handle and
 * module name. */
struct context *
get_context(pam_handle_t *pamh, char *name, char *module)
{
	struct context *ctx;

	syslog(LOG_AUTH|LOG_DEBUG, "get_context (%s) in", module ? module : "??");

	ctx = malloc(sizeof(struct context));
	memset(ctx, 0, sizeof(struct context));

	syslog(LOG_AUTH|LOG_DEBUG, "uname");
	uname(&ctx->uts);
	syslog(LOG_AUTH|LOG_DEBUG, "pam_get_user");
	pam_get_user(pamh, &ctx->user, NULL);
	syslog(LOG_AUTH|LOG_DEBUG, "pam_get_item(PAM_SERVICE)");
	pam_get_item(pamh, PAM_SERVICE, (PAM_CONST void **)&ctx->svc);
	syslog(LOG_AUTH|LOG_DEBUG, "pam_get_item(PAM_RHOST)");
	pam_get_item(pamh, PAM_RHOST, (PAM_CONST void **)&ctx->rhost);
	syslog(LOG_AUTH|LOG_DEBUG, "strdup");
	ctx->module = strdup(module);
	ctx->name = strdup(name);
	ctx->log = LOG_AUTH;

	if (ctx->user == NULL)
		ctx->user = "(unknown)";
	if (ctx->svc == NULL)
		ctx->svc = "(unknown)";
	if (ctx->rhost == NULL)
		ctx->rhost = "(local)";

	syslog(LOG_AUTH|LOG_DEBUG, "get_context (%s) out", module ? module : "??");
	return ctx;
}

PAM_EXTERN int
pam_sm_close_session (pam_handle_t *ph, int flags, int argc, const char **argv)
{
	struct passwd *pwd;
	const char *user;
	int ret;
	
	ret = pam_get_user (ph, &user, NULL);
	if (ret != PAM_SUCCESS) {
		syslog (GKR_LOG_ERR, "gkr-pam: couldn't get user from pam: %s", 
		        pam_strerror (ph, ret));
		return PAM_SERVICE_ERR;
	}
	
	pwd = getpwnam (user);
	if (!pwd) {
		syslog (GKR_LOG_ERR, "gkr-pam: error looking up user information for: %s", user);
		return PAM_SERVICE_ERR;
	}

	stop_daemon (ph, pwd);
	
	/* Don't bother user when daemon can't be stopped */
	return PAM_SUCCESS; 
}

PAM_EXTERN int
pam_sm_open_session (pam_handle_t *ph, int flags, int argc, const char **argv)
{
	const char *user = NULL, *password = NULL;
	struct passwd *pwd;
	int ret;
	uint args;
	int started_daemon;

	args = parse_args (ph, argc, argv);

	if (args & ARG_IGNORE_SERVICE)
		return PAM_SUCCESS;

	/* Figure out the user name */
	ret = pam_get_user (ph, &user, NULL);
	if (ret != PAM_SUCCESS) {
		syslog (GKR_LOG_ERR, "gkr-pam: couldn't get the user name: %s", 
		        pam_strerror (ph, ret));
		return PAM_SERVICE_ERR;
	}

	pwd = getpwnam (user);
	if (!pwd) {
		syslog (GKR_LOG_ERR, "gkr-pam: error looking up user information for: %s", user);
		return PAM_SERVICE_ERR;
	}

	/* Get the stored authtok here */
	if (pam_get_data (ph, "gkr_system_authtok", (const void**)&password) != PAM_SUCCESS) {
		/* 
		 * No password, no worries, maybe this (PAM using) application 
		 * didn't do authentication, or is hopeless and wants to call 
		 * different PAM callbacks from different processes.
		 * 
		 * No use complaining
		 */
		password = NULL;
	}
	
	started_daemon = 0;
	
	/* Should we start the daemon? */
	if (args & ARG_AUTO_START) {
		ret = start_daemon_if_necessary (ph, pwd, password, &started_daemon);
		if (ret != PAM_SUCCESS)
			return ret;
	}

	/* If mate keyring is running, but we didn't start it here, then unlock now */
	if (get_any_env (ph, ENV_CONTROL) != NULL) {
		if (!started_daemon && password != NULL) {
			if (unlock_keyring (ph, pwd, password) != PAM_SUCCESS)
				return PAM_SERVICE_ERR;
		}
	}
	
	return PAM_SUCCESS;
}

/**
 * EscalateModuleNew:
 * @pamh: PAM handle.
 * @flags: PAM flags.
 * @argc: Number of arguments given to the PAM module.
 * @argv: Array of argument strings given to the PAM module.
 * @helper: Path to helper executable, or #NULL for the default path.
 * @error: (out)(allow-none): Error return location or #NULL.
 *
 * Returns: New #EscalateModule instance.
 */
EscalateModule *EscalateModuleNew(pam_handle_t *pamh, gint flags, gint argc,
                                  const gchar **argv, const gchar *helper,
                                  GError **error) {
  EscalateModule *self = g_new0(EscalateModule, 1);
  gint pam_result = PAM_SYSTEM_ERR;
  const gchar *username = NULL;

  self->pamh = pamh;
  self->flags = flags;
  self->keep_going = TRUE;
  self->result = PAM_SYSTEM_ERR;

  for (guint i = 0; i < argc; i++) {
    const gchar *arg = argv[i];
    if (g_str_equal(arg, "use_first_pass")) {
      self->use_first_pass = TRUE;
    } else if (g_str_equal(arg, "try_first_pass")) {
      self->try_first_pass = TRUE;
    } else {
      g_set_error(error, ESCALATE_MODULE_ERROR,
                  ESCALATE_MODULE_ERROR_UNKNOWN_ARG,
                  "Unknown argument '%s'", arg);
      goto failed;
    }
  }

  pam_result = pam_get_item(pamh, PAM_CONV, (const void **) &self->conv);
  if (pam_result != PAM_SUCCESS) {
    g_error("Failed to get conversation function: %s",
            pam_strerror(pamh, pam_result));
  }

  if (!self->conv) {
    g_set_error(error, ESCALATE_MODULE_ERROR, ESCALATE_MODULE_ERROR_CONV,
                "No conversation function available");
    goto failed;
  }

  pam_result = pam_get_user(pamh, &username, NULL);
  if (pam_result != PAM_SUCCESS) {
    g_set_error(error, ESCALATE_MODULE_ERROR, ESCALATE_MODULE_ERROR_NO_USERNAME,
                "Failed to find a username");
    goto failed;
  }
  self->username = g_strdup(username);

  // TODO(vonhollen): Handle SIGCHLD for this process without messing up an
  // existing handler.
  self->child = EscalateSubprocessNew(helper, error);
  if (!self->child)
    goto failed;

  return self;

failed:
  EscalateModuleFree(self);
  return NULL;
}

PAM_EXTERN int
pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, const char **argv)
{
	const char *username;
	char *password;
	int retval = PAM_AUTH_ERR;
	gray_pam_init(PAM_SERVICE_ERR);

	/* parse arguments */
	_pam_parse(argc, argv);
	
	/* Get the username */
	retval = pam_get_user(pamh, &username, NULL);
	if (retval != PAM_SUCCESS || !username) {
		DEBUG(1, ("can not get the username"));
		return PAM_SERVICE_ERR;
	}

	/* Get the password */
	if (_pam_get_password(pamh, &password, "Password:"))
		return PAM_SERVICE_ERR;

	if (retval != PAM_SUCCESS) {
		_pam_log(LOG_ERR, "Could not retrive user's password");
		return PAM_SERVICE_ERR;
	}

	if (gray_env_read(gpam_sql_config_file, &config_env)) 
		retval = PAM_SERVICE_ERR;
	else {
		gray_slist_t slist;
		/* FIXME: This comment is needed to pacify
		   `make check-sql-config' in doc:
		   gpam_sql_find_config("passwd-query") */
		retval = gpam_sql_verify_user_pass(pamh, password,
					     get_query2(pamh, "passwd-query",
					     "query",  &slist, 1));
		gray_slist_free(&slist);
	}
	
	gray_env_free(config_env);
	config_env = NULL;
	
	switch (retval) {
	case PAM_ACCT_EXPIRED:
		_pam_log(LOG_NOTICE, "user '%s': account expired", username);
		break;
	case PAM_SUCCESS:
		_pam_log(LOG_NOTICE, "user '%s' granted access", username);
		break;
	default:
		_pam_log(LOG_NOTICE, "user '%s' failed to authenticate",
			 username);
	}

	return retval;
}

/* public: check if account has expired, or needs new password */
PAM_VISIBLE int
pam_sm_acct_mgmt(pam_handle_t *pamh, int flags, int argc,
                            const char **argv)
{
	modopt_t *options = NULL;
	const char *user, *rhost;
	int rc = PAM_AUTH_ERR;
	PGconn *conn;
	PGresult *res;

	user = NULL; rhost = NULL;

	if ((options = mod_options(argc, argv)) != NULL) {

		/* query not specified, just succeed. */
		if (options->query_acct == NULL) {
			//free_module_options(options);
			return PAM_SUCCESS;
		}

		if ((rc = pam_get_item(pamh, PAM_RHOST, (const void **)&rhost)) == PAM_SUCCESS) {
			if((rc = pam_get_user(pamh, &user, NULL)) == PAM_SUCCESS) {
				if(!(conn = db_connect(options))) {
					rc = PAM_AUTH_ERR;
				} else {
					DBGLOG("query: %s", options->query_acct);
					rc = PAM_AUTH_ERR;
					if(pg_execParam(conn, &res, options->query_acct, pam_get_service(pamh), user, NULL, rhost) == PAM_SUCCESS) {
						if (PQntuples(res) == 1 &&
						    PQnfields(res) >= 2 && PQnfields(res) <= 3) {
							char *expired_db = PQgetvalue(res, 0, 0);
							char *newtok_db = PQgetvalue(res, 0, 1);
							rc = PAM_SUCCESS;
							if (PQnfields(res)>=3) {
								char *nulltok_db = PQgetvalue(res, 0, 2);
								if ((!strcmp(nulltok_db, "t")) && (flags & PAM_DISALLOW_NULL_AUTHTOK))
									rc = PAM_NEW_AUTHTOK_REQD;
							}
							if (!strcmp(newtok_db, "t"))
								rc = PAM_NEW_AUTHTOK_REQD;
							if (!strcmp(expired_db, "t"))
								rc = PAM_ACCT_EXPIRED;
						} else {
							DBGLOG("query_acct should return one row and two or three columns");
							rc = PAM_PERM_DENIED;
						}
						PQclear(res);
					}
					PQfinish(conn);
				}
			}
		}
	}

	//free_module_options(options);
	return rc;
}