xref: /titanic_41/usr/src/lib/libpam/pam_framework.c (revision f33c1cdb6d38eb0715f03cf492f31c3d4d395c98)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #include <syslog.h>
27 #include <dlfcn.h>
28 #include <sys/types.h>
29 #include <sys/stat.h>
30 #include <stdlib.h>
31 #include <strings.h>
32 #include <malloc.h>
33 #include <unistd.h>
34 #include <fcntl.h>
35 #include <errno.h>
36 
37 #include <security/pam_appl.h>
38 #include <security/pam_modules.h>
39 #include <sys/mman.h>
40 
41 #include <libintl.h>
42 
43 #include "pam_impl.h"
44 
45 static char *pam_snames [PAM_NUM_MODULE_TYPES] = {
46 	PAM_ACCOUNT_NAME,
47 	PAM_AUTH_NAME,
48 	PAM_PASSWORD_NAME,
49 	PAM_SESSION_NAME
50 };
51 
52 static char *pam_inames [PAM_MAX_ITEMS] = {
53 /* NONE */		NULL,
54 /* PAM_SERVICE */	"service",
55 /* PAM_USER */		"user",
56 /* PAM_TTY */		"tty",
57 /* PAM_RHOST */ 	"rhost",
58 /* PAM_CONV */		"conv",
59 /* PAM_AUTHTOK */	"authtok",
60 /* PAM_OLDAUTHTOK */	"oldauthtok",
61 /* PAM_RUSER */ 	"ruser",
62 /* PAM_USER_PROMPT */	"user_prompt",
63 /* PAM_REPOSITORY */	"repository",
64 /* PAM_RESOURCE */	"resource",
65 /* PAM_AUSER */ 	"auser",
66 /* Undefined Items */
67 };
68 
69 /*
70  * This extra definition is needed in order to build this library
71  * on pre-64-bit-aware systems.
72  */
73 #if !defined(_LFS64_LARGEFILE)
74 #define	stat64	stat
75 #endif	/* !defined(_LFS64_LARGEFILE) */
76 
77 /* functions to dynamically load modules */
78 static int	load_modules(pam_handle_t *, int, char *, pamtab_t *);
79 static void 	*open_module(pam_handle_t *, char *);
80 static int	load_function(void *, char *, int (**func)());
81 
82 /* functions to read and store the pam.conf configuration file */
83 static int	open_pam_conf(struct pam_fh **, pam_handle_t *, char *);
84 static void	close_pam_conf(struct pam_fh *);
85 static int	read_pam_conf(pam_handle_t *, char *);
86 static int 	get_pam_conf_entry(struct pam_fh *, pam_handle_t *,
87     pamtab_t **);
88 static char	*read_next_token(char **);
89 static char	*nextline(struct pam_fh *, pam_handle_t *, int *);
90 static int	verify_pam_conf(pamtab_t *, char *);
91 
92 /* functions to clean up and free memory */
93 static void	clean_up(pam_handle_t *);
94 static void	free_pamconf(pamtab_t *);
95 static void	free_pam_conf_info(pam_handle_t *);
96 static void	free_env(env_list *);
97 
98 /* convenience functions for I18N/L10N communication */
99 
100 static void	free_resp(int, struct pam_response *);
101 static int	do_conv(pam_handle_t *, int, int,
102     char messages[PAM_MAX_NUM_MSG][PAM_MAX_MSG_SIZE], void *,
103     struct pam_response **);
104 
105 static int	log_priority;	/* pam_trace syslog priority & facility */
106 static int	pam_debug = 0;
107 
108 static char *
109 pam_trace_iname(int item_type, char *iname_buf)
110 {
111 	char *name;
112 
113 	if (item_type <= 0 ||
114 	    item_type >= PAM_MAX_ITEMS ||
115 	    (name = pam_inames[item_type]) == NULL) {
116 		(void) sprintf(iname_buf, "%d", item_type);
117 		return (iname_buf);
118 	}
119 	return (name);
120 }
121 
122 static char *
123 pam_trace_fname(int flag)
124 {
125 	if (flag & PAM_BINDING)
126 		return (PAM_BINDING_NAME);
127 	if (flag & PAM_INCLUDE)
128 		return (PAM_INCLUDE_NAME);
129 	if (flag & PAM_OPTIONAL)
130 		return (PAM_OPTIONAL_NAME);
131 	if (flag & PAM_REQUIRED)
132 		return (PAM_REQUIRED_NAME);
133 	if (flag & PAM_REQUISITE)
134 		return (PAM_REQUISITE_NAME);
135 	if (flag & PAM_SUFFICIENT)
136 		return (PAM_SUFFICIENT_NAME);
137 	return ("bad flag name");
138 }
139 
140 static char *
141 pam_trace_cname(pam_handle_t *pamh)
142 {
143 	if (pamh->pam_conf_name[pamh->include_depth] == NULL)
144 		return ("NULL");
145 	return (pamh->pam_conf_name[pamh->include_depth]);
146 }
147 
148 #include <deflt.h>
149 #include <stdarg.h>
150 /*
151  * pam_settrace - setup configuration for pam tracing
152  *
153  * turn on PAM debug if "magic" file exists
154  * if exists (original), pam_debug = PAM_DEBUG_DEFAULT,
155  * log_priority = LOG_DEBUG(7) and log_facility = LOG_AUTH(4).
156  *
157  * if has contents, keywork=value pairs:
158  *
159  *	"log_priority=" 0-7, the pam_trace syslog priority to use
160  *		(see sys/syslog.h)
161  *	"log_facility=" 0-23, the pam_trace syslog facility to use
162  *		(see sys/syslog.h)
163  *	"debug_flags=" PAM_DEBUG_DEFAULT (0x0001), log traditional
164  *			(original) debugging.
165  *		Plus the logical or of:
166  *		    PAM_DEBUG_ITEM (0x0002), log item values and
167  *			pam_get_item.
168  *		    PAM_DEBUG_MODULE (0x0004), log module return status.
169  *		    PAM_DEBUG_CONF (0x0008), log pam.conf parsing.
170  *		    PAM_DEBUG_DATA (0x0010), get/set_data.
171  *		    PAM_DEBUG_CONV (0x0020), conversation/response.
172  *
173  *		    If compiled with DEBUG:
174  *		    PAM_DEBUG_AUTHTOK (0x8000), display AUTHTOK value if
175  *				PAM_DEBUG_ITEM is set and results from
176  *				PAM_PROMPT_ECHO_OFF responses.
177  *		    USE CAREFULLY, THIS EXPOSES THE USER'S PASSWORDS.
178  *
179  *		or set to 0 and off even if PAM_DEBUG file exists.
180  *
181  * Output has the general form:
182  * <whatever was set syslog> PAM[<pid>]: <interface>(<handle> and other info)
183  * <whatever was set syslog> PAM[<pid>]: details requested for <interface> call
184  *	Where:	<pid> is the process ID of the calling process.
185  *		<handle> is the Hex value of the pam_handle associated with the
186  *			call.
187  */
188 
189 static void
190 pam_settrace()
191 {
192 	void	*defp;
193 
194 	if ((defp = defopen_r(PAM_DEBUG)) != NULL) {
195 		char	*arg;
196 		int	code;
197 		int	facility = LOG_AUTH;
198 
199 		pam_debug = PAM_DEBUG_DEFAULT;
200 		log_priority = LOG_DEBUG;
201 
202 		(void) defcntl_r(DC_SETFLAGS, DC_CASE, defp);
203 		if ((arg = defread_r(LOG_PRIORITY, defp)) != NULL) {
204 			code = (int)strtol(arg, NULL, 10);
205 			if ((code & ~LOG_PRIMASK) == 0) {
206 				log_priority = code;
207 			}
208 		}
209 		if ((arg = defread_r(LOG_FACILITY, defp)) != NULL) {
210 			code = (int)strtol(arg, NULL, 10);
211 			if (code < LOG_NFACILITIES) {
212 				facility = code << 3;
213 			}
214 		}
215 		if ((arg = defread_r(DEBUG_FLAGS, defp)) != NULL) {
216 			pam_debug = (int)strtol(arg, NULL, 0);
217 		}
218 		defclose_r(defp);
219 
220 		log_priority |= facility;
221 	}
222 }
223 
224 /*
225  * pam_trace - logs tracing messages
226  *
227  *	flag = debug_flags from /etc/pam_debug
228  *	format and args = message to print (PAM[<pid>]: is prepended).
229  *
230  *	global log_priority = pam_trace syslog (log_priority | log_facility)
231  *		from /etc/pam_debug
232  */
233 /*PRINTFLIKE2*/
234 static void
235 pam_trace(int flag, char *format, ...)
236 {
237 	va_list args;
238 	char message[1024];
239 	int savemask;
240 
241 	if ((pam_debug & flag) == 0)
242 		return;
243 
244 	savemask = setlogmask(LOG_MASK(log_priority & LOG_PRIMASK));
245 	(void) snprintf(message, sizeof (message), "PAM[%ld]: %s",
246 	    (long)getpid(), format);
247 	va_start(args, format);
248 	(void) vsyslog(log_priority, message, args);
249 	va_end(args);
250 	(void) setlogmask(savemask);
251 }
252 
253 /*
254  * __pam_log - logs PAM syslog messages
255  *
256  *	priority = message priority
257  *	format and args = message to log
258  */
259 /*PRINTFLIKE2*/
260 void
261 __pam_log(int priority, const char *format, ...)
262 {
263 	va_list args;
264 	int savemask = setlogmask(LOG_MASK(priority & LOG_PRIMASK));
265 
266 	va_start(args, format);
267 	(void) vsyslog(priority, format, args);
268 	va_end(args);
269 	(void) setlogmask(savemask);
270 }
271 
272 
273 /*
274  *			pam_XXXXX routines
275  *
276  *	These are the entry points to the authentication switch
277  */
278 
279 /*
280  * pam_start		- initiate an authentication transaction and
281  *			  set parameter values to be used during the
282  *			  transaction
283  */
284 
285 int
286 pam_start(const char *service, const char *user,
287     const struct pam_conv *pam_conv, pam_handle_t **pamh)
288 {
289 	int	err;
290 
291 	*pamh = calloc(1, sizeof (struct pam_handle));
292 
293 	pam_settrace();
294 	pam_trace(PAM_DEBUG_DEFAULT,
295 	    "pam_start(%s,%s,%p:%p) - debug = %x",
296 	    service ? service : "NULL", user ? user : "NULL", (void *)pam_conv,
297 	    (void *)*pamh, pam_debug);
298 
299 	if (*pamh == NULL)
300 		return (PAM_BUF_ERR);
301 
302 	(*pamh)->pam_inmodule = RO_OK;		/* OK to set RO items */
303 	if ((err = pam_set_item(*pamh, PAM_SERVICE, (void *)service))
304 	    != PAM_SUCCESS) {
305 		clean_up(*pamh);
306 		*pamh = NULL;
307 		return (err);
308 	}
309 
310 	if ((err = pam_set_item(*pamh, PAM_USER, (void *)user))
311 	    != PAM_SUCCESS) {
312 		clean_up(*pamh);
313 		*pamh = NULL;
314 		return (err);
315 	}
316 
317 	if ((err = pam_set_item(*pamh, PAM_CONV, (void *)pam_conv))
318 	    != PAM_SUCCESS) {
319 		clean_up(*pamh);
320 		*pamh = NULL;
321 		return (err);
322 	}
323 
324 	(*pamh)->pam_inmodule = RW_OK;
325 	return (PAM_SUCCESS);
326 }
327 
328 /*
329  * pam_end - terminate an authentication transaction
330  */
331 
332 int
333 pam_end(pam_handle_t *pamh, int pam_status)
334 {
335 	struct pam_module_data *psd, *p;
336 	fd_list *expired;
337 	fd_list *traverse;
338 	env_list *env_expired;
339 	env_list *env_traverse;
340 
341 	pam_trace(PAM_DEBUG_DEFAULT,
342 	    "pam_end(%p): status = %s", (void *)pamh,
343 	    pam_strerror(pamh, pam_status));
344 
345 	if (pamh == NULL)
346 		return (PAM_SYSTEM_ERR);
347 
348 	/* call the cleanup routines for module specific data */
349 
350 	psd = pamh->ssd;
351 	while (psd) {
352 		if (psd->cleanup) {
353 			psd->cleanup(pamh, psd->data, pam_status);
354 		}
355 		p = psd;
356 		psd = p->next;
357 		free(p->module_data_name);
358 		free(p);
359 	}
360 	pamh->ssd = NULL;
361 
362 	/* dlclose all module fds */
363 	traverse = pamh->fd;
364 	while (traverse) {
365 		expired = traverse;
366 		traverse = traverse->next;
367 		(void) dlclose(expired->mh);
368 		free(expired);
369 	}
370 	pamh->fd = 0;
371 
372 	/* remove all environment variables */
373 	env_traverse = pamh->pam_env;
374 	while (env_traverse) {
375 		env_expired = env_traverse;
376 		env_traverse = env_traverse->next;
377 		free_env(env_expired);
378 	}
379 
380 	clean_up(pamh);
381 	return (PAM_SUCCESS);
382 }
383 
384 /*
385  * pam_set_item		- set the value of a parameter that can be
386  *			  retrieved via a call to pam_get_item()
387  */
388 
389 int
390 pam_set_item(pam_handle_t *pamh, int item_type, const void *item)
391 {
392 	struct pam_item *pip;
393 	int	size;
394 	char	iname_buf[PAM_MAX_MSG_SIZE];
395 
396 	if (((pam_debug & PAM_DEBUG_ITEM) == 0) || (pamh == NULL)) {
397 		pam_trace(PAM_DEBUG_DEFAULT,
398 		    "pam_set_item(%p:%s)", (void *)pamh,
399 		    pam_trace_iname(item_type, iname_buf));
400 	}
401 
402 	if (pamh == NULL)
403 		return (PAM_SYSTEM_ERR);
404 
405 	/* check read only items */
406 	if ((item_type == PAM_SERVICE) && (pamh->pam_inmodule != RO_OK))
407 		return (PAM_PERM_DENIED);
408 
409 	/*
410 	 * Check that item_type is within valid range
411 	 */
412 
413 	if (item_type <= 0 || item_type >= PAM_MAX_ITEMS)
414 		return (PAM_SYMBOL_ERR);
415 
416 	pip = &(pamh->ps_item[item_type]);
417 
418 	switch (item_type) {
419 	case PAM_AUTHTOK:
420 	case PAM_OLDAUTHTOK:
421 		if (pip->pi_addr != NULL)
422 			(void) memset(pip->pi_addr, 0, pip->pi_size);
423 		/*FALLTHROUGH*/
424 	case PAM_SERVICE:
425 	case PAM_USER:
426 	case PAM_TTY:
427 	case PAM_RHOST:
428 	case PAM_RUSER:
429 	case PAM_USER_PROMPT:
430 	case PAM_RESOURCE:
431 	case PAM_AUSER:
432 		if (pip->pi_addr != NULL) {
433 			free(pip->pi_addr);
434 		}
435 
436 		if (item == NULL) {
437 			pip->pi_addr = NULL;
438 			pip->pi_size = 0;
439 		} else {
440 			pip->pi_addr = strdup((char *)item);
441 			if (pip->pi_addr == NULL) {
442 				pip->pi_size = 0;
443 				return (PAM_BUF_ERR);
444 			}
445 			pip->pi_size = strlen(pip->pi_addr);
446 		}
447 		break;
448 	case PAM_CONV:
449 		if (pip->pi_addr != NULL)
450 			free(pip->pi_addr);
451 		size = sizeof (struct pam_conv);
452 		if ((pip->pi_addr = calloc(1, size)) == NULL)
453 			return (PAM_BUF_ERR);
454 		if (item != NULL)
455 			(void) memcpy(pip->pi_addr, item, (unsigned int) size);
456 		else
457 			(void) memset(pip->pi_addr, 0, size);
458 		pip->pi_size = size;
459 		break;
460 	case PAM_REPOSITORY:
461 		if (pip->pi_addr != NULL) {
462 			pam_repository_t *auth_rep;
463 
464 			auth_rep = (pam_repository_t *)pip->pi_addr;
465 			if (auth_rep->type != NULL)
466 				free(auth_rep->type);
467 			if (auth_rep->scope != NULL)
468 				free(auth_rep->scope);
469 			free(auth_rep);
470 		}
471 		if (item != NULL) {
472 			pam_repository_t *s, *d;
473 
474 			size = sizeof (struct pam_repository);
475 			pip->pi_addr = calloc(1, size);
476 			if (pip->pi_addr == NULL)
477 				return (PAM_BUF_ERR);
478 
479 			s = (struct pam_repository *)item;
480 			d = (struct pam_repository *)pip->pi_addr;
481 
482 			d->type = strdup(s->type);
483 			if (d->type == NULL)
484 				return (PAM_BUF_ERR);
485 			d->scope = malloc(s->scope_len);
486 			if (d->scope == NULL)
487 				return (PAM_BUF_ERR);
488 			(void) memcpy(d->scope, s->scope, s->scope_len);
489 			d->scope_len = s->scope_len;
490 		}
491 		pip->pi_size = size;
492 		break;
493 	default:
494 		return (PAM_SYMBOL_ERR);
495 	}
496 	switch (item_type) {
497 	case PAM_CONV:
498 		pam_trace(PAM_DEBUG_ITEM, "pam_set_item(%p:%s)=%p",
499 		    (void *)pamh,
500 		    pam_trace_iname(item_type, iname_buf),
501 		    item ? (void *)((struct pam_conv *)item)->conv :
502 		    (void *)0);
503 		break;
504 	case PAM_REPOSITORY:
505 		pam_trace(PAM_DEBUG_ITEM, "pam_set_item(%p:%s)=%s",
506 		    (void *)pamh,
507 		    pam_trace_iname(item_type, iname_buf),
508 		    item ? (((struct pam_repository *)item)->type ?
509 		    ((struct pam_repository *)item)->type : "NULL") :
510 		    "NULL");
511 		break;
512 	case PAM_AUTHTOK:
513 	case PAM_OLDAUTHTOK:
514 #ifdef	DEBUG
515 		if (pam_debug & PAM_DEBUG_AUTHTOK)
516 			pam_trace(PAM_DEBUG_ITEM,
517 			    "pam_set_item(%p:%s)=%s", (void *)pamh,
518 			    pam_trace_iname(item_type, iname_buf),
519 			    item ? (char *)item : "NULL");
520 		else
521 #endif	/* DEBUG */
522 			pam_trace(PAM_DEBUG_ITEM,
523 			    "pam_set_item(%p:%s)=%s", (void *)pamh,
524 			    pam_trace_iname(item_type, iname_buf),
525 			    item ? "********" : "NULL");
526 		break;
527 	default:
528 		pam_trace(PAM_DEBUG_ITEM, "pam_set_item(%p:%s)=%s",
529 		    (void *)pamh,
530 		    pam_trace_iname(item_type, iname_buf),
531 		    item ? (char *)item : "NULL");
532 	}
533 
534 	return (PAM_SUCCESS);
535 }
536 
537 /*
538  * pam_get_item		- read the value of a parameter specified in
539  *			  the call to pam_set_item()
540  */
541 
542 int
543 pam_get_item(const pam_handle_t *pamh, int item_type, void **item)
544 {
545 	struct pam_item *pip;
546 	char	iname_buf[PAM_MAX_MSG_SIZE];
547 
548 	if (((pam_debug & PAM_DEBUG_ITEM) == 0) || (pamh == NULL)) {
549 		pam_trace(PAM_DEBUG_ITEM, "pam_get_item(%p:%s)",
550 		    (void *)pamh, pam_trace_iname(item_type, iname_buf));
551 	}
552 
553 	if (pamh == NULL)
554 		return (PAM_SYSTEM_ERR);
555 
556 	if (item_type <= 0 || item_type >= PAM_MAX_ITEMS)
557 		return (PAM_SYMBOL_ERR);
558 
559 	if ((pamh->pam_inmodule != WO_OK) &&
560 	    ((item_type == PAM_AUTHTOK || item_type == PAM_OLDAUTHTOK))) {
561 		__pam_log(LOG_AUTH | LOG_NOTICE, "pam_get_item(%s) called from "
562 		    "a non module context",
563 		    pam_trace_iname(item_type, iname_buf));
564 		return (PAM_PERM_DENIED);
565 	}
566 
567 	pip = (struct pam_item *)&(pamh->ps_item[item_type]);
568 
569 	*item = pip->pi_addr;
570 	switch (item_type) {
571 	case PAM_CONV:
572 		pam_trace(PAM_DEBUG_ITEM, "pam_get_item(%p:%s)=%p",
573 		    (void *)pamh,
574 		    pam_trace_iname(item_type, iname_buf),
575 		    (void *)((struct pam_conv *)*item)->conv);
576 		break;
577 	case PAM_REPOSITORY:
578 		pam_trace(PAM_DEBUG_ITEM, "pam_get_item(%p:%s)=%s",
579 		    (void *)pamh,
580 		    pam_trace_iname(item_type, iname_buf),
581 		    *item ? (((struct pam_repository *)*item)->type ?
582 		    ((struct pam_repository *)*item)->type : "NULL") :
583 		    "NULL");
584 		break;
585 	case PAM_AUTHTOK:
586 	case PAM_OLDAUTHTOK:
587 #ifdef	DEBUG
588 		if (pam_debug & PAM_DEBUG_AUTHTOK)
589 			pam_trace(PAM_DEBUG_ITEM,
590 			    "pam_get_item(%p:%s)=%s", (void *)pamh,
591 			    pam_trace_iname(item_type, iname_buf),
592 			    *item ? *(char **)item : "NULL");
593 		else
594 #endif	/* DEBUG */
595 			pam_trace(PAM_DEBUG_ITEM,
596 			    "pam_get_item(%p:%s)=%s", (void *)pamh,
597 			    pam_trace_iname(item_type, iname_buf),
598 			    *item ? "********" : "NULL");
599 		break;
600 	default:
601 		pam_trace(PAM_DEBUG_ITEM, "pam_get_item(%p:%s)=%s",
602 		    (void *)pamh,
603 		    pam_trace_iname(item_type, iname_buf),
604 		    *item ? *(char **)item : "NULL");
605 	}
606 
607 	return (PAM_SUCCESS);
608 }
609 
610 /*
611  * parse_user_name         - process the user response: ignore
612  *                           '\t' or ' ' before or after a user name.
613  *                           user_input is a null terminated string.
614  *                           *ret_username will be the user name.
615  */
616 
617 static int
618 parse_user_name(char *user_input, char **ret_username)
619 {
620 	register char *ptr;
621 	register int index = 0;
622 	char username[PAM_MAX_RESP_SIZE];
623 
624 	/* Set the default value for *ret_username */
625 	*ret_username = NULL;
626 
627 	/*
628 	 * Set the initial value for username - this is a buffer holds
629 	 * the user name.
630 	 */
631 	bzero((void *)username, PAM_MAX_RESP_SIZE);
632 
633 	/*
634 	 * The user_input is guaranteed to be terminated by a null character.
635 	 */
636 	ptr = user_input;
637 
638 	/* Skip all the leading whitespaces if there are any. */
639 	while ((*ptr == ' ') || (*ptr == '\t'))
640 		ptr++;
641 
642 	if (*ptr == '\0') {
643 		/*
644 		 * We should never get here since the user_input we got
645 		 * in pam_get_user() is not all whitespaces nor just "\0".
646 		 */
647 		return (PAM_BUF_ERR);
648 	}
649 
650 	/*
651 	 * username will be the first string we get from user_input
652 	 * - we skip leading whitespaces and ignore trailing whitespaces
653 	 */
654 	while (*ptr != '\0') {
655 		if ((*ptr == ' ') || (*ptr == '\t'))
656 			break;
657 		else {
658 			username[index] = *ptr;
659 			index++;
660 			ptr++;
661 		}
662 	}
663 
664 	/* ret_username will be freed in pam_get_user(). */
665 	if ((*ret_username = malloc(index + 1)) == NULL)
666 		return (PAM_BUF_ERR);
667 	(void) strcpy(*ret_username, username);
668 	return (PAM_SUCCESS);
669 }
670 
671 /*
672  * Get the value of PAM_USER. If not set, then use the convenience function
673  * to prompt for the user. Use prompt if specified, else use PAM_USER_PROMPT
674  * if it is set, else use default.
675  */
676 #define	WHITESPACE	0
677 #define	USERNAME	1
678 
679 int
680 pam_get_user(pam_handle_t *pamh, char **user, const char *prompt_override)
681 {
682 	int	status;
683 	char	*prompt = NULL;
684 	char    *real_username;
685 	struct pam_response *ret_resp = NULL;
686 	char messages[PAM_MAX_NUM_MSG][PAM_MAX_MSG_SIZE];
687 
688 	pam_trace(PAM_DEBUG_DEFAULT,
689 	    "pam_get_user(%p, %p, %s)", (void *)pamh, (void *)*user,
690 	    prompt_override ? prompt_override : "NULL");
691 	if (pamh == NULL)
692 		return (PAM_SYSTEM_ERR);
693 
694 	if ((status = pam_get_item(pamh, PAM_USER, (void **)user))
695 	    != PAM_SUCCESS) {
696 		return (status);
697 	}
698 
699 	/* if the user is set, return it */
700 
701 	if (*user != NULL && *user[0] != '\0') {
702 		return (PAM_SUCCESS);
703 	}
704 
705 	/*
706 	 * if the module is requesting a special prompt, use it.
707 	 * else use PAM_USER_PROMPT.
708 	 */
709 
710 	if (prompt_override != NULL) {
711 		prompt = (char *)prompt_override;
712 	} else {
713 		status = pam_get_item(pamh, PAM_USER_PROMPT, (void**)&prompt);
714 		if (status != PAM_SUCCESS) {
715 			return (status);
716 		}
717 	}
718 
719 	/* if the prompt is not set, use default */
720 
721 	if (prompt == NULL || prompt[0] == '\0') {
722 		prompt = dgettext(TEXT_DOMAIN, "Please enter user name: ");
723 	}
724 
725 	/* prompt for the user */
726 
727 	(void) strncpy(messages[0], prompt, sizeof (messages[0]));
728 
729 	for (;;) {
730 		int state = WHITESPACE;
731 
732 		status = do_conv(pamh, PAM_PROMPT_ECHO_ON, 1, messages,
733 		    NULL, &ret_resp);
734 
735 		if (status != PAM_SUCCESS) {
736 			return (status);
737 		}
738 
739 		if (ret_resp->resp && ret_resp->resp[0] != '\0') {
740 			int len = strlen(ret_resp->resp);
741 			int i;
742 
743 			for (i = 0; i < len; i++) {
744 				if ((ret_resp->resp[i] != ' ') &&
745 				    (ret_resp->resp[i] != '\t')) {
746 					state = USERNAME;
747 					break;
748 				}
749 			}
750 
751 			if (state == USERNAME)
752 				break;
753 		}
754 		/* essentially empty response, try again */
755 		free_resp(1, ret_resp);
756 		ret_resp = NULL;
757 	}
758 
759 	/* set PAM_USER */
760 	/* Parse the user input to get the user name. */
761 	status = parse_user_name(ret_resp->resp, &real_username);
762 
763 	if (status != PAM_SUCCESS) {
764 		if (real_username != NULL)
765 			free(real_username);
766 		free_resp(1, ret_resp);
767 		return (status);
768 	}
769 
770 	status = pam_set_item(pamh, PAM_USER, real_username);
771 
772 	free(real_username);
773 
774 	free_resp(1, ret_resp);
775 	if (status != PAM_SUCCESS) {
776 		return (status);
777 	}
778 
779 	/*
780 	 * finally, get PAM_USER. We have to call pam_get_item to get
781 	 * the value of user because pam_set_item mallocs the memory.
782 	 */
783 
784 	status = pam_get_item(pamh, PAM_USER, (void**)user);
785 	return (status);
786 }
787 
788 /*
789  * Set module specific data
790  */
791 
792 int
793 pam_set_data(pam_handle_t *pamh, const char *module_data_name, void *data,
794     void (*cleanup)(pam_handle_t *pamh, void *data, int pam_end_status))
795 {
796 	struct pam_module_data *psd;
797 
798 	pam_trace(PAM_DEBUG_DATA,
799 	    "pam_set_data(%p:%s:%d)=%p", (void *)pamh,
800 	    module_data_name ? module_data_name : "NULL", pamh->pam_inmodule,
801 	    data);
802 	if (pamh == NULL || (pamh->pam_inmodule != WO_OK) ||
803 	    module_data_name == NULL) {
804 		return (PAM_SYSTEM_ERR);
805 	}
806 
807 	/* check if module data already exists */
808 
809 	for (psd = pamh->ssd; psd; psd = psd->next) {
810 		if (strcmp(psd->module_data_name, module_data_name) == 0) {
811 			/* clean up original data before setting the new data */
812 			if (psd->cleanup) {
813 				psd->cleanup(pamh, psd->data, PAM_SUCCESS);
814 			}
815 			psd->data = (void *)data;
816 			psd->cleanup = cleanup;
817 			return (PAM_SUCCESS);
818 		}
819 	}
820 
821 	psd = malloc(sizeof (struct pam_module_data));
822 	if (psd == NULL)
823 		return (PAM_BUF_ERR);
824 
825 	psd->module_data_name = strdup(module_data_name);
826 	if (psd->module_data_name == NULL) {
827 		free(psd);
828 		return (PAM_BUF_ERR);
829 	}
830 
831 	psd->data = (void *)data;
832 	psd->cleanup = cleanup;
833 	psd->next = pamh->ssd;
834 	pamh->ssd = psd;
835 	return (PAM_SUCCESS);
836 }
837 
838 /*
839  * get module specific data
840  */
841 
842 int
843 pam_get_data(const pam_handle_t *pamh, const char *module_data_name,
844     const void **data)
845 {
846 	struct pam_module_data *psd;
847 
848 	if (pamh == NULL || (pamh->pam_inmodule != WO_OK) ||
849 	    module_data_name == NULL) {
850 		pam_trace(PAM_DEBUG_DATA,
851 		    "pam_get_data(%p:%s:%d)=%p", (void *)pamh,
852 		    module_data_name ? module_data_name : "NULL",
853 		    pamh->pam_inmodule, *data);
854 		return (PAM_SYSTEM_ERR);
855 	}
856 
857 	for (psd = pamh->ssd; psd; psd = psd->next) {
858 		if (strcmp(psd->module_data_name, module_data_name) == 0) {
859 			*data = psd->data;
860 			pam_trace(PAM_DEBUG_DATA,
861 			    "pam_get_data(%p:%s)=%p", (void *)pamh,
862 			    module_data_name, *data);
863 			return (PAM_SUCCESS);
864 		}
865 	}
866 	pam_trace(PAM_DEBUG_DATA,
867 	    "pam_get_data(%p:%s)=%s", (void *)pamh, module_data_name,
868 	    "PAM_NO_MODULE_DATA");
869 
870 	return (PAM_NO_MODULE_DATA);
871 }
872 
873 /*
874  * PAM equivalent to strerror()
875  */
876 /* ARGSUSED */
877 const char *
878 pam_strerror(pam_handle_t *pamh, int errnum)
879 {
880 	switch (errnum) {
881 	case PAM_SUCCESS:
882 		return (dgettext(TEXT_DOMAIN, "Success"));
883 	case PAM_OPEN_ERR:
884 		return (dgettext(TEXT_DOMAIN, "Dlopen failure"));
885 	case PAM_SYMBOL_ERR:
886 		return (dgettext(TEXT_DOMAIN, "Symbol not found"));
887 	case PAM_SERVICE_ERR:
888 		return (dgettext(TEXT_DOMAIN,
889 		    "Error in underlying service module"));
890 	case PAM_SYSTEM_ERR:
891 		return (dgettext(TEXT_DOMAIN, "System error"));
892 	case PAM_BUF_ERR:
893 		return (dgettext(TEXT_DOMAIN, "Memory buffer error"));
894 	case PAM_CONV_ERR:
895 		return (dgettext(TEXT_DOMAIN, "Conversation failure"));
896 	case PAM_PERM_DENIED:
897 		return (dgettext(TEXT_DOMAIN, "Permission denied"));
898 	case PAM_MAXTRIES:
899 		return (dgettext(TEXT_DOMAIN,
900 		    "Maximum number of attempts exceeded"));
901 	case PAM_AUTH_ERR:
902 		return (dgettext(TEXT_DOMAIN, "Authentication failed"));
903 	case PAM_NEW_AUTHTOK_REQD:
904 		return (dgettext(TEXT_DOMAIN, "Get new authentication token"));
905 	case PAM_CRED_INSUFFICIENT:
906 		return (dgettext(TEXT_DOMAIN, "Insufficient credentials"));
907 	case PAM_AUTHINFO_UNAVAIL:
908 		return (dgettext(TEXT_DOMAIN,
909 		    "Can not retrieve authentication info"));
910 	case PAM_USER_UNKNOWN:
911 		return (dgettext(TEXT_DOMAIN, "No account present for user"));
912 	case PAM_CRED_UNAVAIL:
913 		return (dgettext(TEXT_DOMAIN,
914 		    "Can not retrieve user credentials"));
915 	case PAM_CRED_EXPIRED:
916 		return (dgettext(TEXT_DOMAIN,
917 		    "User credentials have expired"));
918 	case PAM_CRED_ERR:
919 		return (dgettext(TEXT_DOMAIN,
920 		    "Failure setting user credentials"));
921 	case PAM_ACCT_EXPIRED:
922 		return (dgettext(TEXT_DOMAIN, "User account has expired"));
923 	case PAM_AUTHTOK_EXPIRED:
924 		return (dgettext(TEXT_DOMAIN, "User password has expired"));
925 	case PAM_SESSION_ERR:
926 		return (dgettext(TEXT_DOMAIN,
927 		    "Can not make/remove entry for session"));
928 	case PAM_AUTHTOK_ERR:
929 		return (dgettext(TEXT_DOMAIN,
930 		    "Authentication token manipulation error"));
931 	case PAM_AUTHTOK_RECOVERY_ERR:
932 		return (dgettext(TEXT_DOMAIN,
933 		    "Authentication token can not be recovered"));
934 	case PAM_AUTHTOK_LOCK_BUSY:
935 		return (dgettext(TEXT_DOMAIN,
936 		    "Authentication token lock busy"));
937 	case PAM_AUTHTOK_DISABLE_AGING:
938 		return (dgettext(TEXT_DOMAIN,
939 		    "Authentication token aging disabled"));
940 	case PAM_NO_MODULE_DATA:
941 		return (dgettext(TEXT_DOMAIN,
942 		    "Module specific data not found"));
943 	case PAM_IGNORE:
944 		return (dgettext(TEXT_DOMAIN, "Ignore module"));
945 	case PAM_ABORT:
946 		return (dgettext(TEXT_DOMAIN, "General PAM failure "));
947 	case PAM_TRY_AGAIN:
948 		return (dgettext(TEXT_DOMAIN,
949 		    "Unable to complete operation. Try again"));
950 	default:
951 		return (dgettext(TEXT_DOMAIN, "Unknown error"));
952 	}
953 }
954 
955 static void *
956 sm_name(int ind)
957 {
958 	switch (ind) {
959 	case PAM_AUTHENTICATE:
960 		return (PAM_SM_AUTHENTICATE);
961 	case PAM_SETCRED:
962 		return (PAM_SM_SETCRED);
963 	case PAM_ACCT_MGMT:
964 		return (PAM_SM_ACCT_MGMT);
965 	case PAM_OPEN_SESSION:
966 		return (PAM_SM_OPEN_SESSION);
967 	case PAM_CLOSE_SESSION:
968 		return (PAM_SM_CLOSE_SESSION);
969 	case PAM_CHAUTHTOK:
970 		return (PAM_SM_CHAUTHTOK);
971 	}
972 	return (NULL);
973 }
974 
975 static int
976 (*func(pamtab_t *modulep, int ind))()
977 {
978 	void	*funcp;
979 
980 	if ((funcp = modulep->function_ptr) == NULL)
981 		return (NULL);
982 
983 	switch (ind) {
984 	case PAM_AUTHENTICATE:
985 		return (((struct auth_module *)funcp)->pam_sm_authenticate);
986 	case PAM_SETCRED:
987 		return (((struct auth_module *)funcp)->pam_sm_setcred);
988 	case PAM_ACCT_MGMT:
989 		return (((struct account_module *)funcp)->pam_sm_acct_mgmt);
990 	case PAM_OPEN_SESSION:
991 		return (((struct session_module *)funcp)->pam_sm_open_session);
992 	case PAM_CLOSE_SESSION:
993 		return (((struct session_module *)funcp)->pam_sm_close_session);
994 	case PAM_CHAUTHTOK:
995 		return (((struct password_module *)funcp)->pam_sm_chauthtok);
996 	}
997 	return (NULL);
998 }
999 
1000 /*
1001  * Run through the PAM service module stack for the given module type.
1002  */
1003 static int
1004 run_stack(pam_handle_t *pamh, int flags, int type, int def_err, int ind,
1005     char *function_name)
1006 {
1007 	int	err = PAM_SYSTEM_ERR;  /* preset */
1008 	int	optional_error = 0;
1009 	int	required_error = 0;
1010 	int	success = 0;
1011 	pamtab_t *modulep;
1012 	int	(*sm_func)();
1013 
1014 	if (pamh == NULL)
1015 		return (PAM_SYSTEM_ERR);
1016 
1017 	/* read initial entries from pam.conf */
1018 	if ((err = read_pam_conf(pamh, PAM_CONFIG)) != PAM_SUCCESS) {
1019 		return (err);
1020 	}
1021 
1022 	if ((modulep =
1023 	    pamh->pam_conf_info[pamh->include_depth][type]) == NULL) {
1024 		__pam_log(LOG_AUTH | LOG_ERR, "%s no initial module present",
1025 		    pam_trace_cname(pamh));
1026 		goto exit_return;
1027 	}
1028 
1029 	pamh->pam_inmodule = WO_OK;	/* OK to get AUTHTOK */
1030 include:
1031 	pam_trace(PAM_DEBUG_MODULE,
1032 	    "[%d:%s]:run_stack:%s(%p, %x): %s", pamh->include_depth,
1033 	    pam_trace_cname(pamh), function_name, (void *)pamh, flags,
1034 	    modulep ? modulep->module_path : "NULL");
1035 
1036 	while (modulep != NULL) {
1037 		if (modulep->pam_flag & PAM_INCLUDE) {
1038 			/* save the return location */
1039 			pamh->pam_conf_modulep[pamh->include_depth] =
1040 			    modulep->next;
1041 			pam_trace(PAM_DEBUG_MODULE,
1042 			    "setting for include[%d:%p]",
1043 			    pamh->include_depth, (void *)modulep->next);
1044 			if (pamh->include_depth++ >= PAM_MAX_INCLUDE) {
1045 				__pam_log(LOG_AUTH | LOG_ERR,
1046 				    "run_stack: includes too deep %d "
1047 				    "found trying to include %s from %s, %d "
1048 				    "allowed", pamh->include_depth,
1049 				    modulep->module_path, pamh->pam_conf_name
1050 				    [PAM_MAX_INCLUDE] == NULL ? "NULL" :
1051 				    pamh->pam_conf_name[PAM_MAX_INCLUDE],
1052 				    PAM_MAX_INCLUDE);
1053 				goto exit_return;
1054 			}
1055 			if ((err = read_pam_conf(pamh,
1056 			    modulep->module_path)) != PAM_SUCCESS) {
1057 				__pam_log(LOG_AUTH | LOG_ERR,
1058 				    "run_stack[%d:%s]: can't read included "
1059 				    "conf %s", pamh->include_depth,
1060 				    pam_trace_cname(pamh),
1061 				    modulep->module_path);
1062 				goto exit_return;
1063 			}
1064 			if ((modulep = pamh->pam_conf_info
1065 			    [pamh->include_depth][type]) == NULL) {
1066 				__pam_log(LOG_AUTH | LOG_ERR,
1067 				    "run_stack[%d:%s]: no include module "
1068 				    "present %s", pamh->include_depth,
1069 				    pam_trace_cname(pamh), function_name);
1070 				goto exit_return;
1071 			}
1072 			if (modulep->pam_flag & PAM_INCLUDE) {
1073 				/* first line another include */
1074 				goto include;
1075 			}
1076 			pam_trace(PAM_DEBUG_DEFAULT, "include[%d:%s]"
1077 			    "(%p, %s)=%s", pamh->include_depth,
1078 			    pam_trace_cname(pamh), (void *)pamh,
1079 			    function_name, modulep->module_path);
1080 			if ((err = load_modules(pamh, type, sm_name(ind),
1081 			    pamh->pam_conf_info
1082 			    [pamh->include_depth][type])) != PAM_SUCCESS) {
1083 				pam_trace(PAM_DEBUG_DEFAULT,
1084 				    "[%d:%s]:%s(%p, %x): load_modules failed",
1085 				    pamh->include_depth, pam_trace_cname(pamh),
1086 				    function_name, (void *)pamh, flags);
1087 				goto exit_return;
1088 			}
1089 			if ((modulep = pamh->pam_conf_info
1090 			    [pamh->include_depth][type]) == NULL) {
1091 				__pam_log(LOG_AUTH | LOG_ERR,
1092 				    "%s no initial module present",
1093 				    pam_trace_cname(pamh));
1094 				goto exit_return;
1095 			}
1096 		} else if ((err = load_modules(pamh, type, sm_name(ind),
1097 		    modulep)) != PAM_SUCCESS) {
1098 			pam_trace(PAM_DEBUG_DEFAULT,
1099 			    "[%d:%s]:%s(%p, %x): load_modules failed",
1100 			    pamh->include_depth, pam_trace_cname(pamh),
1101 			    function_name, (void *)pamh, flags);
1102 			goto exit_return;
1103 		}  /* PAM_INCLUDE */
1104 		sm_func = func(modulep, ind);
1105 		if (sm_func) {
1106 			err = sm_func(pamh, flags, modulep->module_argc,
1107 			    (const char **)modulep->module_argv);
1108 
1109 			pam_trace(PAM_DEBUG_MODULE,
1110 			    "[%d:%s]:%s(%p, %x): %s returned %s",
1111 			    pamh->include_depth, pam_trace_cname(pamh),
1112 			    function_name, (void *)pamh, flags,
1113 			    modulep->module_path, pam_strerror(pamh, err));
1114 
1115 			switch (err) {
1116 			case PAM_IGNORE:
1117 				/* do nothing */
1118 				break;
1119 			case PAM_SUCCESS:
1120 				if ((modulep->pam_flag & PAM_SUFFI_BIND) &&
1121 				    !required_error) {
1122 					pamh->pam_inmodule = RW_OK;
1123 					pam_trace(PAM_DEBUG_MODULE,
1124 					    "[%d:%s]:%s(%p, %x): %s: success",
1125 					    pamh->include_depth,
1126 					    pam_trace_cname(pamh),
1127 					    function_name, (void *)pamh, flags,
1128 					    (modulep->pam_flag & PAM_BINDING) ?
1129 					    PAM_BINDING_NAME :
1130 					    PAM_SUFFICIENT_NAME);
1131 					goto exit_return;
1132 				}
1133 				success = 1;
1134 				break;
1135 			case PAM_TRY_AGAIN:
1136 				/*
1137 				 * We need to return immediately, and
1138 				 * we shouldn't reset the AUTHTOK item
1139 				 * since it is not an error per-se.
1140 				 */
1141 				pamh->pam_inmodule = RW_OK;
1142 				pam_trace(PAM_DEBUG_MODULE,
1143 				    "[%d:%s]:%s(%p, %x): TRY_AGAIN: %s",
1144 				    pamh->include_depth, pam_trace_cname(pamh),
1145 				    function_name, (void *)pamh, flags,
1146 				    pam_strerror(pamh, required_error ?
1147 				    required_error : err));
1148 				err = required_error ? required_error : err;
1149 				goto exit_return;
1150 			default:
1151 				if (modulep->pam_flag & PAM_REQUISITE) {
1152 					pamh->pam_inmodule = RW_OK;
1153 					pam_trace(PAM_DEBUG_MODULE,
1154 					    "[%d:%s]:%s(%p, %x): requisite: %s",
1155 					    pamh->include_depth,
1156 					    pam_trace_cname(pamh),
1157 					    function_name, (void *)pamh, flags,
1158 					    pam_strerror(pamh,
1159 					    required_error ? required_error :
1160 					    err));
1161 					err = required_error ?
1162 					    required_error : err;
1163 					goto exit_return;
1164 				} else if (modulep->pam_flag & PAM_REQRD_BIND) {
1165 					if (!required_error)
1166 						required_error = err;
1167 				} else {
1168 					if (!optional_error)
1169 						optional_error = err;
1170 				}
1171 				pam_trace(PAM_DEBUG_DEFAULT,
1172 				    "[%d:%s]:%s(%p, %x): error %s",
1173 				    pamh->include_depth, pam_trace_cname(pamh),
1174 				    function_name, (void *)pamh, flags,
1175 				    pam_strerror(pamh, err));
1176 				break;
1177 			}
1178 		}
1179 		modulep = modulep->next;
1180 	}
1181 
1182 	pam_trace(PAM_DEBUG_MODULE, "[%d:%s]:stack_end:%s(%p, %x): %s %s: %s",
1183 	    pamh->include_depth, pam_trace_cname(pamh), function_name,
1184 	    (void *)pamh, flags, pamh->include_depth ? "included" : "final",
1185 	    required_error ? "required" : success ? "success" :
1186 	    optional_error ? "optional" : "default",
1187 	    pam_strerror(pamh, required_error ? required_error :
1188 	    success ? PAM_SUCCESS : optional_error ? optional_error : def_err));
1189 	if (pamh->include_depth > 0) {
1190 		free_pam_conf_info(pamh);
1191 		pamh->include_depth--;
1192 		/* continue at next entry */
1193 		modulep = pamh->pam_conf_modulep[pamh->include_depth];
1194 		pam_trace(PAM_DEBUG_MODULE, "looping for include[%d:%p]",
1195 		    pamh->include_depth, (void *)modulep);
1196 		goto include;
1197 	}
1198 	free_pam_conf_info(pamh);
1199 	pamh->pam_inmodule = RW_OK;
1200 	if (required_error != 0)
1201 		return (required_error);
1202 	else if (success != 0)
1203 		return (PAM_SUCCESS);
1204 	else if (optional_error != 0)
1205 		return (optional_error);
1206 	else
1207 		return (def_err);
1208 
1209 exit_return:
1210 	/*
1211 	 * All done at whatever depth we're at.
1212 	 * Go back to not having read /etc/pam.conf
1213 	 */
1214 	while (pamh->include_depth > 0) {
1215 		free_pam_conf_info(pamh);
1216 		pamh->include_depth--;
1217 	}
1218 	free_pam_conf_info(pamh);
1219 	pamh->pam_inmodule = RW_OK;
1220 	return (err);
1221 }
1222 
1223 /*
1224  * pam_authenticate - authenticate a user
1225  */
1226 
1227 int
1228 pam_authenticate(pam_handle_t *pamh, int flags)
1229 {
1230 	int	retval;
1231 
1232 	retval = run_stack(pamh, flags, PAM_AUTH_MODULE, PAM_AUTH_ERR,
1233 	    PAM_AUTHENTICATE, "pam_authenticate");
1234 
1235 	if (retval != PAM_SUCCESS)
1236 		(void) pam_set_item(pamh, PAM_AUTHTOK, NULL);
1237 	return (retval);
1238 }
1239 
1240 /*
1241  * pam_setcred - modify or retrieve user credentials
1242  */
1243 
1244 int
1245 pam_setcred(pam_handle_t *pamh, int flags)
1246 {
1247 	int	retval;
1248 
1249 	retval = run_stack(pamh, flags, PAM_AUTH_MODULE, PAM_CRED_ERR,
1250 	    PAM_SETCRED, "pam_setcred");
1251 
1252 	if (retval != PAM_SUCCESS)
1253 		(void) pam_set_item(pamh, PAM_AUTHTOK, NULL);
1254 	return (retval);
1255 }
1256 
1257 /*
1258  * pam_acct_mgmt - check password aging, account expiration
1259  */
1260 
1261 int
1262 pam_acct_mgmt(pam_handle_t *pamh, int flags)
1263 {
1264 	int	retval;
1265 
1266 	retval = run_stack(pamh, flags, PAM_ACCOUNT_MODULE, PAM_ACCT_EXPIRED,
1267 	    PAM_ACCT_MGMT, "pam_acct_mgmt");
1268 
1269 	if (retval != PAM_SUCCESS &&
1270 	    retval != PAM_NEW_AUTHTOK_REQD) {
1271 		(void) pam_set_item(pamh, PAM_AUTHTOK, NULL);
1272 	}
1273 	return (retval);
1274 }
1275 
1276 /*
1277  * pam_open_session - begin session management
1278  */
1279 
1280 int
1281 pam_open_session(pam_handle_t *pamh, int flags)
1282 {
1283 	int	retval;
1284 
1285 	retval = run_stack(pamh, flags, PAM_SESSION_MODULE, PAM_SESSION_ERR,
1286 	    PAM_OPEN_SESSION, "pam_open_session");
1287 
1288 	if (retval != PAM_SUCCESS)
1289 		(void) pam_set_item(pamh, PAM_AUTHTOK, NULL);
1290 	return (retval);
1291 }
1292 
1293 /*
1294  * pam_close_session - terminate session management
1295  */
1296 
1297 int
1298 pam_close_session(pam_handle_t *pamh, int flags)
1299 {
1300 	int	retval;
1301 
1302 	retval = run_stack(pamh, flags, PAM_SESSION_MODULE, PAM_SESSION_ERR,
1303 	    PAM_CLOSE_SESSION, "pam_close_session");
1304 
1305 	if (retval != PAM_SUCCESS)
1306 		(void) pam_set_item(pamh, PAM_AUTHTOK, NULL);
1307 	return (retval);
1308 }
1309 
1310 /*
1311  * pam_chauthtok - change user authentication token
1312  */
1313 
1314 int
1315 pam_chauthtok(pam_handle_t *pamh, int flags)
1316 {
1317 	int	retval;
1318 
1319 	/* do not let apps use PAM_PRELIM_CHECK or PAM_UPDATE_AUTHTOK */
1320 	if (flags & (PAM_PRELIM_CHECK | PAM_UPDATE_AUTHTOK)) {
1321 		pam_trace(PAM_DEBUG_DEFAULT,
1322 		    "pam_chauthtok(%p, %x): %s", (void *)pamh, flags,
1323 		    pam_strerror(pamh, PAM_SYMBOL_ERR));
1324 		return (PAM_SYMBOL_ERR);
1325 	}
1326 
1327 	/* 1st pass: PRELIM CHECK */
1328 	retval = run_stack(pamh, flags | PAM_PRELIM_CHECK, PAM_PASSWORD_MODULE,
1329 	    PAM_AUTHTOK_ERR, PAM_CHAUTHTOK, "pam_chauthtok-prelim");
1330 
1331 	if (retval == PAM_TRY_AGAIN)
1332 		return (retval);
1333 
1334 	if (retval != PAM_SUCCESS) {
1335 		(void) pam_set_item(pamh, PAM_AUTHTOK, NULL);
1336 		return (retval);
1337 	}
1338 
1339 	/* 2nd pass: UPDATE AUTHTOK */
1340 	retval = run_stack(pamh, flags | PAM_UPDATE_AUTHTOK,
1341 	    PAM_PASSWORD_MODULE, PAM_AUTHTOK_ERR, PAM_CHAUTHTOK,
1342 	    "pam_chauthtok-update");
1343 
1344 	if (retval != PAM_SUCCESS)
1345 		(void) pam_set_item(pamh, PAM_AUTHTOK, NULL);
1346 
1347 	return (retval);
1348 }
1349 
1350 /*
1351  * pam_putenv - add an environment variable to the PAM handle
1352  *	if name_value == 'NAME=VALUE'	then set variable to the value
1353  *	if name_value == 'NAME='	then set variable to an empty value
1354  *	if name_value == 'NAME'		then delete the variable
1355  */
1356 
1357 int
1358 pam_putenv(pam_handle_t *pamh, const char *name_value)
1359 {
1360 	int		error = PAM_SYSTEM_ERR;
1361 	char		*equal_sign = 0;
1362 	char		*name = NULL, *value = NULL, *tmp_value = NULL;
1363 	env_list	*traverse, *trail;
1364 
1365 	pam_trace(PAM_DEBUG_DEFAULT,
1366 	    "pam_putenv(%p, %s)", (void *)pamh,
1367 	    name_value ? name_value : "NULL");
1368 
1369 	if (pamh == NULL || name_value == NULL)
1370 		goto out;
1371 
1372 	/* see if we were passed 'NAME=VALUE', 'NAME=', or 'NAME' */
1373 	if ((equal_sign = strchr(name_value, '=')) != 0) {
1374 		if ((name = calloc(equal_sign - name_value + 1,
1375 		    sizeof (char))) == 0) {
1376 			error = PAM_BUF_ERR;
1377 			goto out;
1378 		}
1379 		(void) strncpy(name, name_value, equal_sign - name_value);
1380 		if ((value = strdup(++equal_sign)) == 0) {
1381 			error = PAM_BUF_ERR;
1382 			goto out;
1383 		}
1384 	} else {
1385 		if ((name = strdup(name_value)) == 0) {
1386 			error = PAM_BUF_ERR;
1387 			goto out;
1388 		}
1389 	}
1390 
1391 	/* check to see if we already have this variable in the PAM handle */
1392 	traverse = pamh->pam_env;
1393 	trail = traverse;
1394 	while (traverse && strncmp(traverse->name, name, strlen(name))) {
1395 		trail = traverse;
1396 		traverse = traverse->next;
1397 	}
1398 
1399 	if (traverse) {
1400 		/* found a match */
1401 		if (value == 0) {
1402 			/* remove the env variable */
1403 			if (pamh->pam_env == traverse)
1404 				pamh->pam_env = traverse->next;
1405 			else
1406 				trail->next = traverse->next;
1407 			free_env(traverse);
1408 		} else if (strlen(value) == 0) {
1409 			/* set env variable to empty value */
1410 			if ((tmp_value = strdup("")) == 0) {
1411 				error = PAM_SYSTEM_ERR;
1412 				goto out;
1413 			}
1414 			free(traverse->value);
1415 			traverse->value = tmp_value;
1416 		} else {
1417 			/* set the new value */
1418 			if ((tmp_value = strdup(value)) == 0) {
1419 				error = PAM_SYSTEM_ERR;
1420 				goto out;
1421 			}
1422 			free(traverse->value);
1423 			traverse->value = tmp_value;
1424 		}
1425 
1426 	} else if (traverse == 0 && value) {
1427 		/*
1428 		 * could not find a match in the PAM handle.
1429 		 * add the new value if there is one
1430 		 */
1431 		if ((traverse = calloc(1, sizeof (env_list))) == 0) {
1432 			error = PAM_BUF_ERR;
1433 			goto out;
1434 		}
1435 		if ((traverse->name = strdup(name)) == 0) {
1436 			free_env(traverse);
1437 			error = PAM_BUF_ERR;
1438 			goto out;
1439 		}
1440 		if ((traverse->value = strdup(value)) == 0) {
1441 			free_env(traverse);
1442 			error = PAM_BUF_ERR;
1443 			goto out;
1444 		}
1445 		if (trail == 0) {
1446 			/* new head of list */
1447 			pamh->pam_env = traverse;
1448 		} else {
1449 			/* adding to end of list */
1450 			trail->next = traverse;
1451 		}
1452 	}
1453 
1454 	error = PAM_SUCCESS;
1455 out:
1456 	if (error != PAM_SUCCESS) {
1457 		if (traverse) {
1458 			if (traverse->name)
1459 				free(traverse->name);
1460 			if (traverse->value)
1461 				free(traverse->value);
1462 			free(traverse);
1463 		}
1464 	}
1465 	if (name)
1466 		free(name);
1467 	if (value)
1468 		free(value);
1469 	return (error);
1470 }
1471 
1472 /*
1473  * pam_getenv - retrieve an environment variable from the PAM handle
1474  */
1475 char *
1476 pam_getenv(pam_handle_t *pamh, const char *name)
1477 {
1478 	int		error = PAM_SYSTEM_ERR;
1479 	env_list	*traverse;
1480 
1481 	pam_trace(PAM_DEBUG_DEFAULT,
1482 	    "pam_getenv(%p, %p)", (void *)pamh, (void *)name);
1483 
1484 	if (pamh == NULL || name == NULL)
1485 		goto out;
1486 
1487 	/* check to see if we already have this variable in the PAM handle */
1488 	traverse = pamh->pam_env;
1489 	while (traverse && strncmp(traverse->name, name, strlen(name))) {
1490 		traverse = traverse->next;
1491 	}
1492 	error = (traverse ? PAM_SUCCESS : PAM_SYSTEM_ERR);
1493 	pam_trace(PAM_DEBUG_DEFAULT,
1494 	    "pam_getenv(%p, %s)=%s", (void *)pamh, name,
1495 	    traverse ? traverse->value : "NULL");
1496 out:
1497 	return (error ? NULL : strdup(traverse->value));
1498 }
1499 
1500 /*
1501  * pam_getenvlist - retrieve all environment variables from the PAM handle
1502  *                  in a NULL terminated array. On error, return NULL.
1503  */
1504 char **
1505 pam_getenvlist(pam_handle_t *pamh)
1506 {
1507 	int		error = PAM_SYSTEM_ERR;
1508 	char		**list = 0;
1509 	int		length = 0;
1510 	env_list	*traverse;
1511 	char		*tenv;
1512 	size_t		tenv_size;
1513 
1514 	pam_trace(PAM_DEBUG_DEFAULT,
1515 	    "pam_getenvlist(%p)", (void *)pamh);
1516 
1517 	if (pamh == NULL)
1518 		goto out;
1519 
1520 	/* find out how many environment variables we have */
1521 	traverse = pamh->pam_env;
1522 	while (traverse) {
1523 		length++;
1524 		traverse = traverse->next;
1525 	}
1526 
1527 	/* allocate the array we will return to the caller */
1528 	if ((list = calloc(length + 1, sizeof (char *))) == NULL) {
1529 		error = PAM_BUF_ERR;
1530 		goto out;
1531 	}
1532 
1533 	/* add the variables one by one */
1534 	length = 0;
1535 	traverse = pamh->pam_env;
1536 	while (traverse != NULL) {
1537 		tenv_size = strlen(traverse->name) +
1538 		    strlen(traverse->value) + 2; /* name=val\0 */
1539 		if ((tenv = malloc(tenv_size)) == NULL) {
1540 			error = PAM_BUF_ERR;
1541 			goto out;
1542 		}
1543 		/*LINTED*/
1544 		(void) sprintf(tenv, "%s=%s", traverse->name, traverse->value);
1545 		list[length++] = tenv;
1546 		traverse = traverse->next;
1547 	}
1548 	list[length] = NULL;
1549 
1550 	error = PAM_SUCCESS;
1551 out:
1552 	if (error != PAM_SUCCESS) {
1553 		/* free the partially constructed list */
1554 		if (list) {
1555 			length = 0;
1556 			while (list[length] != NULL) {
1557 				free(list[length]);
1558 				length++;
1559 			}
1560 			free(list);
1561 		}
1562 	}
1563 	return (error ? NULL : list);
1564 }
1565 
1566 /*
1567  * Routines to load a requested module on demand
1568  */
1569 
1570 /*
1571  * load_modules - load the requested module.
1572  *		  if the dlopen or dlsym fail, then
1573  *		  the module is ignored.
1574  */
1575 
1576 static int
1577 load_modules(pam_handle_t *pamh, int type, char *function_name,
1578     pamtab_t *pam_entry)
1579 {
1580 	void	*mh;
1581 	struct	auth_module *authp;
1582 	struct	account_module *accountp;
1583 	struct	session_module *sessionp;
1584 	struct	password_module *passwdp;
1585 	int	loading_functions = 0; /* are we currently loading functions? */
1586 
1587 	pam_trace(PAM_DEBUG_MODULE, "load_modules[%d:%s](%p, %s)=%s:%s",
1588 	    pamh->include_depth, pam_trace_cname(pamh), (void *)pamh,
1589 	    function_name, pam_trace_fname(pam_entry->pam_flag),
1590 	    pam_entry->module_path);
1591 
1592 	while (pam_entry != NULL) {
1593 		pam_trace(PAM_DEBUG_DEFAULT,
1594 		    "while load_modules[%d:%s](%p, %s)=%s",
1595 		    pamh->include_depth, pam_trace_cname(pamh), (void *)pamh,
1596 		    function_name, pam_entry->module_path);
1597 
1598 		if (pam_entry->pam_flag & PAM_INCLUDE) {
1599 			pam_trace(PAM_DEBUG_DEFAULT,
1600 			    "done load_modules[%d:%s](%p, %s)=%s",
1601 			    pamh->include_depth, pam_trace_cname(pamh),
1602 			    (void *)pamh, function_name,
1603 			    pam_entry->module_path);
1604 			return (PAM_SUCCESS);
1605 		}
1606 		switch (type) {
1607 		case PAM_AUTH_MODULE:
1608 
1609 			/* if the function has already been loaded, return */
1610 			authp = pam_entry->function_ptr;
1611 			if (!loading_functions &&
1612 			    (((strcmp(function_name, PAM_SM_AUTHENTICATE)
1613 			    == 0) && authp && authp->pam_sm_authenticate) ||
1614 			    ((strcmp(function_name, PAM_SM_SETCRED) == 0) &&
1615 			    authp && authp->pam_sm_setcred))) {
1616 				return (PAM_SUCCESS);
1617 			}
1618 
1619 			/* function has not been loaded yet */
1620 			loading_functions = 1;
1621 			if (authp == NULL) {
1622 				authp = calloc(1, sizeof (struct auth_module));
1623 				if (authp == NULL)
1624 					return (PAM_BUF_ERR);
1625 			}
1626 
1627 			/* if open_module fails, return error */
1628 			if ((mh = open_module(pamh,
1629 			    pam_entry->module_path)) == NULL) {
1630 				__pam_log(LOG_AUTH | LOG_ERR,
1631 				    "load_modules[%d:%s]: can not open module "
1632 				    "%s", pamh->include_depth,
1633 				    pam_trace_cname(pamh),
1634 				    pam_entry->module_path);
1635 				free(authp);
1636 				return (PAM_OPEN_ERR);
1637 			}
1638 
1639 			/* load the authentication function */
1640 			if (strcmp(function_name, PAM_SM_AUTHENTICATE) == 0) {
1641 				if (load_function(mh, PAM_SM_AUTHENTICATE,
1642 				    &authp->pam_sm_authenticate)
1643 				    != PAM_SUCCESS) {
1644 					/* return error if dlsym fails */
1645 					free(authp);
1646 					return (PAM_SYMBOL_ERR);
1647 				}
1648 
1649 			/* load the setcred function */
1650 			} else if (strcmp(function_name, PAM_SM_SETCRED) == 0) {
1651 				if (load_function(mh, PAM_SM_SETCRED,
1652 				    &authp->pam_sm_setcred) != PAM_SUCCESS) {
1653 					/* return error if dlsym fails */
1654 					free(authp);
1655 					return (PAM_SYMBOL_ERR);
1656 				}
1657 			}
1658 			pam_entry->function_ptr = authp;
1659 			break;
1660 		case PAM_ACCOUNT_MODULE:
1661 			accountp = pam_entry->function_ptr;
1662 			if (!loading_functions &&
1663 			    (strcmp(function_name, PAM_SM_ACCT_MGMT) == 0) &&
1664 			    accountp && accountp->pam_sm_acct_mgmt) {
1665 				return (PAM_SUCCESS);
1666 			}
1667 
1668 			/*
1669 			 * If functions are added to the account module,
1670 			 * verify that one of the other functions hasn't
1671 			 * already loaded it.  See PAM_AUTH_MODULE code.
1672 			 */
1673 			loading_functions = 1;
1674 			accountp = calloc(1, sizeof (struct account_module));
1675 			if (accountp == NULL)
1676 				return (PAM_BUF_ERR);
1677 
1678 			/* if open_module fails, return error */
1679 			if ((mh = open_module(pamh,
1680 			    pam_entry->module_path)) == NULL) {
1681 				__pam_log(LOG_AUTH | LOG_ERR,
1682 				    "load_modules[%d:%s]: can not open module "
1683 				    "%s", pamh->include_depth,
1684 				    pam_trace_cname(pamh),
1685 				    pam_entry->module_path);
1686 				free(accountp);
1687 				return (PAM_OPEN_ERR);
1688 			}
1689 
1690 			if (load_function(mh, PAM_SM_ACCT_MGMT,
1691 			    &accountp->pam_sm_acct_mgmt) != PAM_SUCCESS) {
1692 				__pam_log(LOG_AUTH | LOG_ERR,
1693 				    "load_modules[%d:%s]: pam_sm_acct_mgmt() "
1694 				    "missing", pamh->include_depth,
1695 				    pam_trace_cname(pamh));
1696 				free(accountp);
1697 				return (PAM_SYMBOL_ERR);
1698 			}
1699 			pam_entry->function_ptr = accountp;
1700 			break;
1701 		case PAM_SESSION_MODULE:
1702 			sessionp = pam_entry->function_ptr;
1703 			if (!loading_functions &&
1704 			    (((strcmp(function_name,
1705 			    PAM_SM_OPEN_SESSION) == 0) &&
1706 			    sessionp && sessionp->pam_sm_open_session) ||
1707 			    ((strcmp(function_name,
1708 			    PAM_SM_CLOSE_SESSION) == 0) &&
1709 			    sessionp && sessionp->pam_sm_close_session))) {
1710 				return (PAM_SUCCESS);
1711 			}
1712 
1713 			loading_functions = 1;
1714 			if (sessionp == NULL) {
1715 				sessionp = calloc(1,
1716 				    sizeof (struct session_module));
1717 				if (sessionp == NULL)
1718 					return (PAM_BUF_ERR);
1719 			}
1720 
1721 			/* if open_module fails, return error */
1722 			if ((mh = open_module(pamh,
1723 			    pam_entry->module_path)) == NULL) {
1724 				__pam_log(LOG_AUTH | LOG_ERR,
1725 				    "load_modules[%d:%s]: can not open module "
1726 				    "%s", pamh->include_depth,
1727 				    pam_trace_cname(pamh),
1728 				    pam_entry->module_path);
1729 				free(sessionp);
1730 				return (PAM_OPEN_ERR);
1731 			}
1732 
1733 			if ((strcmp(function_name, PAM_SM_OPEN_SESSION) == 0) &&
1734 			    load_function(mh, PAM_SM_OPEN_SESSION,
1735 			    &sessionp->pam_sm_open_session) != PAM_SUCCESS) {
1736 				free(sessionp);
1737 				return (PAM_SYMBOL_ERR);
1738 			} else if ((strcmp(function_name,
1739 			    PAM_SM_CLOSE_SESSION) == 0) &&
1740 			    load_function(mh, PAM_SM_CLOSE_SESSION,
1741 			    &sessionp->pam_sm_close_session) != PAM_SUCCESS) {
1742 				free(sessionp);
1743 				return (PAM_SYMBOL_ERR);
1744 			}
1745 			pam_entry->function_ptr = sessionp;
1746 			break;
1747 		case PAM_PASSWORD_MODULE:
1748 			passwdp = pam_entry->function_ptr;
1749 			if (!loading_functions &&
1750 			    (strcmp(function_name, PAM_SM_CHAUTHTOK) == 0) &&
1751 			    passwdp && passwdp->pam_sm_chauthtok) {
1752 				return (PAM_SUCCESS);
1753 			}
1754 
1755 			/*
1756 			 * If functions are added to the password module,
1757 			 * verify that one of the other functions hasn't
1758 			 * already loaded it.  See PAM_AUTH_MODULE code.
1759 			 */
1760 			loading_functions = 1;
1761 			passwdp = calloc(1, sizeof (struct password_module));
1762 			if (passwdp == NULL)
1763 				return (PAM_BUF_ERR);
1764 
1765 			/* if open_module fails, continue */
1766 			if ((mh = open_module(pamh,
1767 			    pam_entry->module_path)) == NULL) {
1768 				__pam_log(LOG_AUTH | LOG_ERR,
1769 				    "load_modules[%d:%s]: can not open module "
1770 				    "%s", pamh->include_depth,
1771 				    pam_trace_cname(pamh),
1772 				    pam_entry->module_path);
1773 				free(passwdp);
1774 				return (PAM_OPEN_ERR);
1775 			}
1776 
1777 			if (load_function(mh, PAM_SM_CHAUTHTOK,
1778 			    &passwdp->pam_sm_chauthtok) != PAM_SUCCESS) {
1779 				free(passwdp);
1780 				return (PAM_SYMBOL_ERR);
1781 			}
1782 			pam_entry->function_ptr = passwdp;
1783 			break;
1784 		default:
1785 			pam_trace(PAM_DEBUG_DEFAULT,
1786 			    "load_modules[%d:%s](%p, %s): unsupported type %d",
1787 			    pamh->include_depth, pam_trace_cname(pamh),
1788 			    (void *)pamh, function_name, type);
1789 			break;
1790 		}
1791 
1792 		pam_entry = pam_entry->next;
1793 	} /* while */
1794 
1795 	pam_trace(PAM_DEBUG_MODULE, "load_modules[%d:%s](%p, %s)=done",
1796 	    pamh->include_depth, pam_trace_cname(pamh), (void *)pamh,
1797 	    function_name);
1798 
1799 	return (PAM_SUCCESS);
1800 }
1801 
1802 /*
1803  * open_module		- Open the module first checking for
1804  *			  propers modes and ownerships on the file.
1805  */
1806 
1807 static void *
1808 open_module(pam_handle_t *pamh, char *module_so)
1809 {
1810 	struct stat64	stb;
1811 	char		*errmsg;
1812 	void		*lfd;
1813 	fd_list		*module_fds = 0;
1814 	fd_list		*trail = 0;
1815 	fd_list		*traverse = 0;
1816 
1817 	/* Check the ownership and file modes */
1818 	if (stat64(module_so, &stb) < 0) {
1819 		__pam_log(LOG_AUTH | LOG_ERR,
1820 		    "open_module[%d:%s]: stat(%s) failed: %s",
1821 		    pamh->include_depth, pam_trace_cname(pamh), module_so,
1822 		    strerror(errno));
1823 		return (NULL);
1824 	}
1825 	if (stb.st_uid != (uid_t)0) {
1826 		__pam_log(LOG_AUTH | LOG_ALERT,
1827 		    "open_module[%d:%s]: Owner of the module %s is not root",
1828 		    pamh->include_depth, pam_trace_cname(pamh), module_so);
1829 		return (NULL);
1830 	}
1831 	if (stb.st_mode & S_IWGRP) {
1832 		__pam_log(LOG_AUTH | LOG_ALERT,
1833 		    "open_module[%d:%s]: module %s writable by group",
1834 		    pamh->include_depth, pam_trace_cname(pamh), module_so);
1835 		return (NULL);
1836 	}
1837 	if (stb.st_mode & S_IWOTH) {
1838 		__pam_log(LOG_AUTH | LOG_ALERT,
1839 		    "open_module[%d:%s]: module %s writable by world",
1840 		    pamh->include_depth, pam_trace_cname(pamh), module_so);
1841 		return (NULL);
1842 	}
1843 
1844 	/*
1845 	 * Perform the dlopen()
1846 	 */
1847 	lfd = (void *)dlopen(module_so, RTLD_LAZY);
1848 
1849 	if (lfd == NULL) {
1850 		errmsg = dlerror();
1851 		__pam_log(LOG_AUTH | LOG_ERR, "open_module[%d:%s]: %s "
1852 		    "failed: %s", pamh->include_depth, pam_trace_cname(pamh),
1853 		    module_so, errmsg != NULL ? errmsg : "Unknown error");
1854 		return (NULL);
1855 	} else {
1856 		/* add this fd to the pam handle */
1857 		if ((module_fds = calloc(1, sizeof (fd_list))) == 0) {
1858 			(void) dlclose(lfd);
1859 			lfd = 0;
1860 			return (NULL);
1861 		}
1862 		module_fds->mh = lfd;
1863 
1864 		if (pamh->fd == 0) {
1865 			/* adding new head of list */
1866 			pamh->fd = module_fds;
1867 		} else {
1868 			/* appending to end of list */
1869 			traverse = pamh->fd;
1870 			while (traverse) {
1871 				trail = traverse;
1872 				traverse = traverse->next;
1873 			}
1874 			trail->next = module_fds;
1875 		}
1876 	}
1877 
1878 	return (lfd);
1879 }
1880 
1881 /*
1882  * load_function - call dlsym() to resolve the function address
1883  */
1884 static int
1885 load_function(void *lfd, char *name, int (**func)())
1886 {
1887 	char *errmsg = NULL;
1888 
1889 	if (lfd == NULL)
1890 		return (PAM_SYMBOL_ERR);
1891 
1892 	*func = (int (*)())dlsym(lfd, name);
1893 	if (*func == NULL) {
1894 		errmsg = dlerror();
1895 		__pam_log(LOG_AUTH | LOG_ERR, "dlsym failed %s: error %s",
1896 		    name, errmsg != NULL ? errmsg : "Unknown error");
1897 		return (PAM_SYMBOL_ERR);
1898 	}
1899 
1900 	pam_trace(PAM_DEBUG_DEFAULT,
1901 	    "load_function: successful load of %s", name);
1902 	return (PAM_SUCCESS);
1903 }
1904 
1905 /*
1906  * Routines to read the pam.conf configuration file
1907  */
1908 
1909 /*
1910  * open_pam_conf - open the pam.conf config file
1911  */
1912 
1913 static int
1914 open_pam_conf(struct pam_fh **pam_fh, pam_handle_t *pamh, char *config)
1915 {
1916 	struct stat64	stb;
1917 	int		fd;
1918 
1919 	if ((fd = open(config, O_RDONLY)) == -1) {
1920 		__pam_log(LOG_AUTH | LOG_ALERT,
1921 		    "open_pam_conf[%d:%s]: open(%s) failed: %s",
1922 		    pamh->include_depth, pam_trace_cname(pamh), config,
1923 		    strerror(errno));
1924 		return (0);
1925 	}
1926 	/* Check the ownership and file modes */
1927 	if (fstat64(fd, &stb) < 0) {
1928 		__pam_log(LOG_AUTH | LOG_ALERT,
1929 		    "open_pam_conf[%d:%s]: stat(%s) failed: %s",
1930 		    pamh->include_depth, pam_trace_cname(pamh), config,
1931 		    strerror(errno));
1932 		(void) close(fd);
1933 		return (0);
1934 	}
1935 	if (stb.st_uid != (uid_t)0) {
1936 		__pam_log(LOG_AUTH | LOG_ALERT,
1937 		    "open_pam_conf[%d:%s]: Owner of %s is not root",
1938 		    pamh->include_depth, pam_trace_cname(pamh), config);
1939 		(void) close(fd);
1940 		return (0);
1941 	}
1942 	if (stb.st_mode & S_IWGRP) {
1943 		__pam_log(LOG_AUTH | LOG_ALERT,
1944 		    "open_pam_conf[%d:%s]: %s writable by group",
1945 		    pamh->include_depth, pam_trace_cname(pamh), config);
1946 		(void) close(fd);
1947 		return (0);
1948 	}
1949 	if (stb.st_mode & S_IWOTH) {
1950 		__pam_log(LOG_AUTH | LOG_ALERT,
1951 		    "open_pam_conf[%d:%s]: %s writable by world",
1952 		    pamh->include_depth, pam_trace_cname(pamh), config);
1953 		(void) close(fd);
1954 		return (0);
1955 	}
1956 	if ((*pam_fh = calloc(1, sizeof (struct pam_fh))) == NULL) {
1957 		(void) close(fd);
1958 		return (0);
1959 	}
1960 	(*pam_fh)->fconfig = fd;
1961 	(*pam_fh)->bufsize = (size_t)stb.st_size;
1962 	if (((*pam_fh)->data = mmap(0, (*pam_fh)->bufsize, PROT_READ,
1963 	    MAP_PRIVATE, (*pam_fh)->fconfig, 0)) == MAP_FAILED) {
1964 		(void) close(fd);
1965 		free (*pam_fh);
1966 		return (0);
1967 	}
1968 	(*pam_fh)->bufferp = (*pam_fh)->data;
1969 
1970 	return (1);
1971 }
1972 
1973 /*
1974  * close_pam_conf - close pam.conf
1975  */
1976 
1977 static void
1978 close_pam_conf(struct pam_fh *pam_fh)
1979 {
1980 	(void) munmap(pam_fh->data, pam_fh->bufsize);
1981 	(void) close(pam_fh->fconfig);
1982 	free(pam_fh);
1983 }
1984 
1985 /*
1986  * read_pam_conf - read in each entry in pam.conf and store info
1987  *		   under the pam handle.
1988  */
1989 
1990 static int
1991 read_pam_conf(pam_handle_t *pamh, char *config)
1992 {
1993 	struct pam_fh	*pam_fh;
1994 	pamtab_t	*pamentp;
1995 	pamtab_t	*tpament;
1996 	char		*service;
1997 	int		error;
1998 	int		i = pamh->include_depth;	/* include depth */
1999 	/*
2000 	 * service types:
2001 	 * error (-1), "auth" (0), "account" (1), "session" (2), "password" (3)
2002 	 */
2003 	int service_found[PAM_NUM_MODULE_TYPES+1] = {0, 0, 0, 0, 0};
2004 
2005 	(void) pam_get_item(pamh, PAM_SERVICE, (void **)&service);
2006 	if (service == NULL || *service == '\0') {
2007 		__pam_log(LOG_AUTH | LOG_ERR, "No service name");
2008 		return (PAM_SYSTEM_ERR);
2009 	}
2010 
2011 	pamh->pam_conf_name[i] = strdup(config);
2012 	pam_trace(PAM_DEBUG_CONF, "read_pam_conf[%d:%s](%p) open(%s)",
2013 	    i, pam_trace_cname(pamh), (void *)pamh, config);
2014 	if (open_pam_conf(&pam_fh, pamh, config) == 0) {
2015 		return (PAM_SYSTEM_ERR);
2016 	}
2017 
2018 	while ((error =
2019 	    get_pam_conf_entry(pam_fh, pamh, &pamentp)) == PAM_SUCCESS &&
2020 	    pamentp) {
2021 
2022 		/* See if entry is this service and valid */
2023 		if (verify_pam_conf(pamentp, service)) {
2024 			pam_trace(PAM_DEBUG_CONF,
2025 			    "read_pam_conf[%d:%s](%p): bad entry error %s",
2026 			    i, pam_trace_cname(pamh), (void *)pamh, service);
2027 
2028 			error = PAM_SYSTEM_ERR;
2029 			free_pamconf(pamentp);
2030 			goto out;
2031 		}
2032 		if (strcasecmp(pamentp->pam_service, service) == 0) {
2033 			pam_trace(PAM_DEBUG_CONF,
2034 			    "read_pam_conf[%d:%s](%p): processing %s",
2035 			    i, pam_trace_cname(pamh), (void *)pamh, service);
2036 			/* process first service entry */
2037 			if (service_found[pamentp->pam_type + 1] == 0) {
2038 				/* purge "other" entries */
2039 				while ((tpament = pamh->pam_conf_info[i]
2040 				    [pamentp->pam_type]) != NULL) {
2041 					pam_trace(PAM_DEBUG_CONF,
2042 					    "read_pam_conf(%p): purging "
2043 					    "\"other\"[%d:%s][%s]",
2044 					    (void *)pamh, i,
2045 					    pam_trace_cname(pamh),
2046 					    pam_snames[pamentp->pam_type]);
2047 					pamh->pam_conf_info[i]
2048 					    [pamentp->pam_type] = tpament->next;
2049 					free_pamconf(tpament);
2050 				}
2051 				/* add first service entry */
2052 				pam_trace(PAM_DEBUG_CONF,
2053 				    "read_pam_conf(%p): adding 1st "
2054 				    "%s[%d:%s][%s]",
2055 				    (void *)pamh, service, i,
2056 				    pam_trace_cname(pamh),
2057 				    pam_snames[pamentp->pam_type]);
2058 				pamh->pam_conf_info[i][pamentp->pam_type] =
2059 				    pamentp;
2060 				service_found[pamentp->pam_type + 1] = 1;
2061 			} else {
2062 				/* append more service entries */
2063 				pam_trace(PAM_DEBUG_CONF,
2064 				    "read_pam_conf(%p): adding more "
2065 				    "%s[%d:%s][%s]",
2066 				    (void *)pamh, service, i,
2067 				    pam_trace_cname(pamh),
2068 				    pam_snames[pamentp->pam_type]);
2069 				tpament =
2070 				    pamh->pam_conf_info[i][pamentp->pam_type];
2071 				while (tpament->next != NULL) {
2072 					tpament = tpament->next;
2073 				}
2074 				tpament->next = pamentp;
2075 			}
2076 		} else if (service_found[pamentp->pam_type + 1] == 0) {
2077 			/* See if "other" entry available and valid */
2078 			if (verify_pam_conf(pamentp, "other")) {
2079 				pam_trace(PAM_DEBUG_CONF,
2080 				    "read_pam_conf(%p): bad entry error %s "
2081 				    "\"other\"[%d:%s]",
2082 				    (void *)pamh, service, i,
2083 				    pam_trace_cname(pamh));
2084 				error = PAM_SYSTEM_ERR;
2085 				free_pamconf(pamentp);
2086 				goto out;
2087 			}
2088 			if (strcasecmp(pamentp->pam_service, "other") == 0) {
2089 				pam_trace(PAM_DEBUG_CONF,
2090 				    "read_pam_conf(%p): processing "
2091 				    "\"other\"[%d:%s]", (void *)pamh, i,
2092 				    pam_trace_cname(pamh));
2093 				if ((tpament = pamh->pam_conf_info[i]
2094 				    [pamentp->pam_type]) == NULL) {
2095 					/* add first "other" entry */
2096 					pam_trace(PAM_DEBUG_CONF,
2097 					    "read_pam_conf(%p): adding 1st "
2098 					    "other[%d:%s][%s]", (void *)pamh, i,
2099 					    pam_trace_cname(pamh),
2100 					    pam_snames[pamentp->pam_type]);
2101 					pamh->pam_conf_info[i]
2102 					    [pamentp->pam_type] = pamentp;
2103 				} else {
2104 					/* append more "other" entries */
2105 					pam_trace(PAM_DEBUG_CONF,
2106 					    "read_pam_conf(%p): adding more "
2107 					    "other[%d:%s][%s]", (void *)pamh, i,
2108 					    pam_trace_cname(pamh),
2109 					    pam_snames[pamentp->pam_type]);
2110 					while (tpament->next != NULL) {
2111 						tpament = tpament->next;
2112 					}
2113 					tpament->next = pamentp;
2114 				}
2115 			} else {
2116 				/* irrelevant entry */
2117 				free_pamconf(pamentp);
2118 			}
2119 		} else {
2120 			/* irrelevant entry */
2121 			free_pamconf(pamentp);
2122 		}
2123 	}
2124 out:
2125 	(void) close_pam_conf(pam_fh);
2126 	if (error != PAM_SUCCESS)
2127 		free_pam_conf_info(pamh);
2128 	return (error);
2129 }
2130 
2131 /*
2132  * get_pam_conf_entry - get a pam.conf entry
2133  */
2134 
2135 static int
2136 get_pam_conf_entry(struct pam_fh *pam_fh, pam_handle_t *pamh, pamtab_t **pam)
2137 {
2138 	char		*cp, *arg;
2139 	int		argc;
2140 	char		*tmp, *tmp_free;
2141 	int		i;
2142 	char		*current_line = NULL;
2143 	int		error = PAM_SYSTEM_ERR;	/* preset to error */
2144 	int		err;
2145 
2146 	/* get the next line from pam.conf */
2147 	if ((cp = nextline(pam_fh, pamh, &err)) == NULL) {
2148 		/* no more lines in pam.conf ==> return */
2149 		error = PAM_SUCCESS;
2150 		*pam = NULL;
2151 		goto out;
2152 	}
2153 
2154 	if ((*pam = calloc(1, sizeof (pamtab_t))) == NULL) {
2155 		__pam_log(LOG_AUTH | LOG_ERR, "strdup: out of memory");
2156 		goto out;
2157 	}
2158 
2159 	/* copy full line for error reporting */
2160 	if ((current_line = strdup(cp)) == NULL) {
2161 		__pam_log(LOG_AUTH | LOG_ERR, "strdup: out of memory");
2162 		goto out;
2163 	}
2164 
2165 	pam_trace(PAM_DEBUG_CONF,
2166 	    "pam.conf[%s] entry:\t%s", pam_trace_cname(pamh), current_line);
2167 
2168 	/* get service name (e.g. login, su, passwd) */
2169 	if ((arg = read_next_token(&cp)) == 0) {
2170 		__pam_log(LOG_AUTH | LOG_CRIT,
2171 		    "illegal pam.conf[%s] entry: %s: missing SERVICE NAME",
2172 		    pam_trace_cname(pamh), current_line);
2173 		goto out;
2174 	}
2175 	if (((*pam)->pam_service = strdup(arg)) == 0) {
2176 		__pam_log(LOG_AUTH | LOG_ERR, "strdup: out of memory");
2177 		goto out;
2178 	}
2179 
2180 	/* get module type (e.g. authentication, acct mgmt) */
2181 	if ((arg = read_next_token(&cp)) == 0) {
2182 		__pam_log(LOG_AUTH | LOG_CRIT,
2183 		    "illegal pam.conf[%s] entry: %s: missing MODULE TYPE",
2184 		    pam_trace_cname(pamh), current_line);
2185 		(*pam)->pam_type = -1;	/* 0 is a valid value */
2186 		goto getflag;
2187 	}
2188 	if (strcasecmp(arg, PAM_AUTH_NAME) == 0) {
2189 		(*pam)->pam_type = PAM_AUTH_MODULE;
2190 	} else if (strcasecmp(arg, PAM_ACCOUNT_NAME) == 0) {
2191 		(*pam)->pam_type = PAM_ACCOUNT_MODULE;
2192 	} else if (strcasecmp(arg, PAM_SESSION_NAME) == 0) {
2193 		(*pam)->pam_type = PAM_SESSION_MODULE;
2194 	} else if (strcasecmp(arg, PAM_PASSWORD_NAME) == 0) {
2195 		(*pam)->pam_type = PAM_PASSWORD_MODULE;
2196 	} else {
2197 		/* error */
2198 		__pam_log(LOG_AUTH | LOG_CRIT,
2199 		    "illegal pam.conf[%s] entry: %s: invalid module "
2200 		    "type: %s", pam_trace_cname(pamh), current_line, arg);
2201 		(*pam)->pam_type = -1;	/* 0 is a valid value */
2202 	}
2203 
2204 getflag:
2205 	/* get pam flag (e.g., requisite, required, sufficient, optional) */
2206 	if ((arg = read_next_token(&cp)) == 0) {
2207 		__pam_log(LOG_AUTH | LOG_CRIT,
2208 		    "illegal pam.conf[%s] entry: %s: missing CONTROL FLAG",
2209 		    pam_trace_cname(pamh), current_line);
2210 		goto getpath;
2211 	}
2212 	if (strcasecmp(arg, PAM_BINDING_NAME) == 0) {
2213 		(*pam)->pam_flag = PAM_BINDING;
2214 	} else if (strcasecmp(arg, PAM_INCLUDE_NAME) == 0) {
2215 		(*pam)->pam_flag = PAM_INCLUDE;
2216 	} else if (strcasecmp(arg, PAM_OPTIONAL_NAME) == 0) {
2217 		(*pam)->pam_flag = PAM_OPTIONAL;
2218 	} else if (strcasecmp(arg, PAM_REQUIRED_NAME) == 0) {
2219 		(*pam)->pam_flag = PAM_REQUIRED;
2220 	} else if (strcasecmp(arg, PAM_REQUISITE_NAME) == 0) {
2221 		(*pam)->pam_flag = PAM_REQUISITE;
2222 	} else if (strcasecmp(arg, PAM_SUFFICIENT_NAME) == 0) {
2223 		(*pam)->pam_flag = PAM_SUFFICIENT;
2224 	} else {
2225 		/* error */
2226 		__pam_log(LOG_AUTH | LOG_CRIT,
2227 		    "illegal pam.conf[%s] entry: %s",
2228 		    pam_trace_cname(pamh), current_line);
2229 		__pam_log(LOG_AUTH | LOG_CRIT,
2230 		    "\tinvalid control flag: %s", arg);
2231 	}
2232 
2233 getpath:
2234 	/* get module path (e.g. /usr/lib/security/pam_unix_auth.so.1) */
2235 	if ((arg = read_next_token(&cp)) == 0) {
2236 		__pam_log(LOG_AUTH | LOG_CRIT,
2237 		    "illegal pam.conf[%s] entry: %s: missing MODULE PATH",
2238 		    pam_trace_cname(pamh), current_line);
2239 		error = PAM_SUCCESS;	/* success */
2240 		goto out;
2241 	}
2242 	if (arg[0] != '/') {
2243 		size_t len;
2244 		/*
2245 		 * If module path does not start with "/", then
2246 		 * prepend PAM_LIB_DIR (/usr/lib/security/).
2247 		 */
2248 		/* sizeof (PAM_LIB_DIR) has room for '\0' */
2249 		len = sizeof (PAM_LIB_DIR) + sizeof (PAM_ISA_DIR) + strlen(arg);
2250 		if (((*pam)->module_path = malloc(len)) == NULL) {
2251 			__pam_log(LOG_AUTH | LOG_ERR, "strdup: out of memory");
2252 			goto out;
2253 		}
2254 		if ((*pam)->pam_flag & PAM_INCLUDE) {
2255 			(void) snprintf((*pam)->module_path, len, "%s%s",
2256 			    PAM_LIB_DIR, arg);
2257 		} else {
2258 			(void) snprintf((*pam)->module_path, len, "%s%s%s",
2259 			    PAM_LIB_DIR, PAM_ISA_DIR, arg);
2260 		}
2261 	} else {
2262 		/* Full path provided for module */
2263 		char *isa;
2264 
2265 		/* Check for Instruction Set Architecture indicator */
2266 		if ((isa = strstr(arg, PAM_ISA)) != NULL) {
2267 			size_t len;
2268 			len = strlen(arg) - (sizeof (PAM_ISA)-1) +
2269 			    sizeof (PAM_ISA_DIR);
2270 
2271 			/* substitute the architecture dependent path */
2272 			if (((*pam)->module_path = malloc(len)) == NULL) {
2273 				__pam_log(LOG_AUTH | LOG_ERR,
2274 				    "strdup: out of memory");
2275 				goto out;
2276 			}
2277 			*isa = '\000';
2278 			isa += strlen(PAM_ISA);
2279 			(void) snprintf((*pam)->module_path, len, "%s%s%s",
2280 			    arg, PAM_ISA_DIR, isa);
2281 		} else if (((*pam)->module_path = strdup(arg)) == 0) {
2282 			__pam_log(LOG_AUTH | LOG_ERR, "strdup: out of memory");
2283 			goto out;
2284 		}
2285 	}
2286 
2287 	/* count the number of module-specific options first */
2288 	argc = 0;
2289 	if ((tmp = strdup(cp)) == NULL) {
2290 		__pam_log(LOG_AUTH | LOG_ERR, "strdup: out of memory");
2291 		goto out;
2292 	}
2293 	tmp_free = tmp;
2294 	for (arg = read_next_token(&tmp); arg; arg = read_next_token(&tmp))
2295 		argc++;
2296 	free(tmp_free);
2297 
2298 	/* allocate array for the module-specific options */
2299 	if (argc > 0) {
2300 		if (((*pam)->module_argv =
2301 		    calloc(argc+1, sizeof (char *))) == 0) {
2302 			__pam_log(LOG_AUTH | LOG_ERR, "calloc: out of memory");
2303 			goto out;
2304 		}
2305 		i = 0;
2306 		for (arg = read_next_token(&cp); arg;
2307 		    arg = read_next_token(&cp)) {
2308 			(*pam)->module_argv[i] = strdup(arg);
2309 			if ((*pam)->module_argv[i] == NULL) {
2310 				__pam_log(LOG_AUTH | LOG_ERR, "strdup failed");
2311 				goto out;
2312 			}
2313 			i++;
2314 		}
2315 		(*pam)->module_argv[argc] = NULL;
2316 	}
2317 	(*pam)->module_argc = argc;
2318 
2319 	error = PAM_SUCCESS;	/* success */
2320 	(*pam)->pam_err = err;	/* was the line truncated */
2321 
2322 out:
2323 	if (current_line)
2324 		free(current_line);
2325 	if (error != PAM_SUCCESS) {
2326 		/* on error free this */
2327 		if (*pam)
2328 			free_pamconf(*pam);
2329 	}
2330 	return (error);
2331 }
2332 
2333 
2334 /*
2335  * read_next_token - skip tab and space characters and return the next token
2336  */
2337 
2338 static char *
2339 read_next_token(char **cpp)
2340 {
2341 	register char *cp = *cpp;
2342 	char *start;
2343 
2344 	if (cp == (char *)0) {
2345 		*cpp = (char *)0;
2346 		return ((char *)0);
2347 	}
2348 	while (*cp == ' ' || *cp == '\t')
2349 		cp++;
2350 	if (*cp == '\0') {
2351 		*cpp = (char *)0;
2352 		return ((char *)0);
2353 	}
2354 	start = cp;
2355 	while (*cp && *cp != ' ' && *cp != '\t')
2356 		cp++;
2357 	if (*cp != '\0')
2358 		*cp++ = '\0';
2359 	*cpp = cp;
2360 	return (start);
2361 }
2362 
2363 static char *
2364 pam_conf_strnchr(char *sp, int c, intptr_t count)
2365 {
2366 	while (count) {
2367 		if (*sp == (char)c)
2368 			return ((char *)sp);
2369 		else {
2370 			sp++;
2371 			count--;
2372 		}
2373 	};
2374 	return (NULL);
2375 }
2376 
2377 /*
2378  * nextline - skip all blank lines and comments
2379  */
2380 
2381 static char *
2382 nextline(struct pam_fh *pam_fh, pam_handle_t *pamh, int *err)
2383 {
2384 	char	*ll;
2385 	int	find_a_line = 0;
2386 	char	*data = pam_fh->data;
2387 	char	*bufferp = pam_fh->bufferp;
2388 	char	*bufferendp = &data[pam_fh->bufsize];
2389 	size_t	input_len;
2390 
2391 	/*
2392 	 * Skip the blank line, comment line
2393 	 */
2394 	while (!find_a_line) {
2395 		/* if we are at the end of the buffer, there is no next line */
2396 		if (bufferp == bufferendp)
2397 			return (NULL);
2398 
2399 		/* skip blank line */
2400 		while (*bufferp == '\n') {
2401 			/*
2402 			 * If we are at the end of the buffer, there is
2403 			 * no next line.
2404 			 */
2405 			if (++bufferp == bufferendp) {
2406 				return (NULL);
2407 			}
2408 			/* else we check *bufferp again */
2409 		}
2410 
2411 		/* skip comment line */
2412 		while (*bufferp == '#') {
2413 			if ((ll = pam_conf_strnchr(bufferp, '\n',
2414 			    bufferendp - bufferp)) != NULL) {
2415 				bufferp = ll;
2416 			} else {
2417 				/*
2418 				 * this comment line the last line.
2419 				 * no next line
2420 				 */
2421 				return (NULL);
2422 			}
2423 
2424 			/*
2425 			 * If we are at the end of the buffer, there is
2426 			 * no next line.
2427 			 */
2428 			if (bufferp == bufferendp) {
2429 				return (NULL);
2430 			}
2431 		}
2432 
2433 		if ((*bufferp != '\n') && (*bufferp != '#')) {
2434 			find_a_line = 1;
2435 		}
2436 	}
2437 
2438 	*err = PAM_SUCCESS;
2439 	/* now we find one line */
2440 	if ((ll = pam_conf_strnchr(bufferp, '\n', bufferendp - bufferp))
2441 	    != NULL) {
2442 		if ((input_len = ll - bufferp) >= sizeof (pam_fh->line)) {
2443 			__pam_log(LOG_AUTH | LOG_ERR,
2444 			    "nextline[%d:%s]: pam.conf line too long %.256s",
2445 			    pamh->include_depth, pam_trace_cname(pamh),
2446 			    bufferp);
2447 			input_len = sizeof (pam_fh->line) - 1;
2448 			*err = PAM_SERVICE_ERR;
2449 		}
2450 		(void) strncpy(pam_fh->line, bufferp, input_len);
2451 		pam_fh->line[input_len] = '\0';
2452 		pam_fh->bufferp = ll++;
2453 	} else {
2454 		ll = bufferendp;
2455 		if ((input_len = ll - bufferp) >= sizeof (pam_fh->line)) {
2456 			__pam_log(LOG_AUTH | LOG_ERR,
2457 			    "nextline[%d:%s]: pam.conf line too long %.256s",
2458 			    pamh->include_depth, pam_trace_cname(pamh),
2459 			    bufferp);
2460 			input_len = sizeof (pam_fh->line) - 1;
2461 			*err = PAM_SERVICE_ERR;
2462 		}
2463 		(void) strncpy(pam_fh->line, bufferp, input_len);
2464 		pam_fh->line[input_len] = '\0';
2465 		pam_fh->bufferp = ll;
2466 	}
2467 
2468 	return (pam_fh->line);
2469 }
2470 
2471 /*
2472  * verify_pam_conf - verify that the pam_conf entry is filled in.
2473  *
2474  *	True = Error if there is no service.
2475  *	True = Error if there is a service and it matches the requested service
2476  *		but, the type, flag, line overflow, or path is in error.
2477  */
2478 
2479 static int
2480 verify_pam_conf(pamtab_t *pam, char *service)
2481 {
2482 	return ((pam->pam_service == (char *)NULL) ||
2483 	    ((strcasecmp(pam->pam_service, service) == 0) &&
2484 	    ((pam->pam_type == -1) ||
2485 	    (pam->pam_flag == 0) ||
2486 	    (pam->pam_err != PAM_SUCCESS) ||
2487 	    (pam->module_path == (char *)NULL))));
2488 }
2489 
2490 /*
2491  * Routines to free allocated storage
2492  */
2493 
2494 /*
2495  * clean_up -  free allocated storage in the pam handle
2496  */
2497 
2498 static void
2499 clean_up(pam_handle_t *pamh)
2500 {
2501 	int i;
2502 	pam_repository_t *auth_rep;
2503 
2504 	if (pamh) {
2505 		while (pamh->include_depth >= 0) {
2506 			free_pam_conf_info(pamh);
2507 			pamh->include_depth--;
2508 		}
2509 
2510 		/* Cleanup PAM_REPOSITORY structure */
2511 		auth_rep = pamh->ps_item[PAM_REPOSITORY].pi_addr;
2512 		if (auth_rep != NULL) {
2513 			if (auth_rep->type != NULL)
2514 				free(auth_rep->type);
2515 			if (auth_rep->scope != NULL)
2516 				free(auth_rep->scope);
2517 		}
2518 
2519 		for (i = 0; i < PAM_MAX_ITEMS; i++) {
2520 			if (pamh->ps_item[i].pi_addr != NULL) {
2521 				if (i == PAM_AUTHTOK || i == PAM_OLDAUTHTOK) {
2522 					(void) memset(pamh->ps_item[i].pi_addr,
2523 					    0, pamh->ps_item[i].pi_size);
2524 				}
2525 				free(pamh->ps_item[i].pi_addr);
2526 			}
2527 		}
2528 		free(pamh);
2529 	}
2530 }
2531 
2532 /*
2533  * free_pamconf - free memory used to store pam.conf entry
2534  */
2535 
2536 static void
2537 free_pamconf(pamtab_t *cp)
2538 {
2539 	int i;
2540 
2541 	if (cp) {
2542 		if (cp->pam_service)
2543 			free(cp->pam_service);
2544 		if (cp->module_path)
2545 			free(cp->module_path);
2546 		for (i = 0; i < cp->module_argc; i++) {
2547 			if (cp->module_argv[i])
2548 				free(cp->module_argv[i]);
2549 		}
2550 		if (cp->module_argc > 0)
2551 			free(cp->module_argv);
2552 		if (cp->function_ptr)
2553 			free(cp->function_ptr);
2554 
2555 		free(cp);
2556 	}
2557 }
2558 
2559 /*
2560  * free_pam_conf_info - free memory used to store all pam.conf info
2561  *			under the pam handle
2562  */
2563 
2564 static void
2565 free_pam_conf_info(pam_handle_t *pamh)
2566 {
2567 	pamtab_t *pamentp;
2568 	pamtab_t *pament_trail;
2569 	int i = pamh->include_depth;
2570 	int j;
2571 
2572 	for (j = 0; j < PAM_NUM_MODULE_TYPES; j++) {
2573 		pamentp = pamh->pam_conf_info[i][j];
2574 		pamh->pam_conf_info[i][j] = NULL;
2575 		pament_trail = pamentp;
2576 		while (pamentp) {
2577 			pamentp = pamentp->next;
2578 			free_pamconf(pament_trail);
2579 			pament_trail = pamentp;
2580 		}
2581 	}
2582 	if (pamh->pam_conf_name[i] != NULL) {
2583 		free(pamh->pam_conf_name[i]);
2584 		pamh->pam_conf_name[i] = NULL;
2585 	}
2586 }
2587 
2588 static void
2589 free_env(env_list *pam_env)
2590 {
2591 	if (pam_env) {
2592 		if (pam_env->name)
2593 			free(pam_env->name);
2594 		if (pam_env->value)
2595 			free(pam_env->value);
2596 		free(pam_env);
2597 	}
2598 }
2599 
2600 /*
2601  *	Internal convenience functions for Solaris PAM service modules.
2602  */
2603 
2604 #include <libintl.h>
2605 #include <nl_types.h>
2606 #include <synch.h>
2607 #include <locale.h>
2608 #include <thread.h>
2609 
2610 typedef struct pam_msg_data {
2611 	nl_catd fd;
2612 } pam_msg_data_t;
2613 
2614 /*
2615  * free_resp():
2616  *	free storage for responses used in the call back "pam_conv" functions
2617  */
2618 
2619 void
2620 free_resp(int num_msg, struct pam_response *resp)
2621 {
2622 	int			i;
2623 	struct pam_response	*r;
2624 
2625 	if (resp) {
2626 		r = resp;
2627 		for (i = 0; i < num_msg; i++, r++) {
2628 			if (r->resp) {
2629 				/* clear before freeing -- may be a password */
2630 				bzero(r->resp, strlen(r->resp));
2631 				free(r->resp);
2632 				r->resp = NULL;
2633 			}
2634 		}
2635 		free(resp);
2636 	}
2637 }
2638 
2639 static int
2640 do_conv(pam_handle_t *pamh, int msg_style, int num_msg,
2641     char messages[PAM_MAX_NUM_MSG][PAM_MAX_MSG_SIZE], void *conv_apdp,
2642     struct pam_response *ret_respp[])
2643 {
2644 	struct pam_message	*msg;
2645 	struct pam_message	*m;
2646 	int			i;
2647 	int			k;
2648 	int			retcode;
2649 	struct pam_conv		*pam_convp;
2650 
2651 	if ((retcode = pam_get_item(pamh, PAM_CONV,
2652 	    (void **)&pam_convp)) != PAM_SUCCESS) {
2653 		return (retcode);
2654 	}
2655 
2656 	/*
2657 	 * When pam_set_item() is called to set PAM_CONV and the
2658 	 * item is NULL, memset(pip->pi_addr, 0, size) is called.
2659 	 * So at this point, we should check whether pam_convp->conv
2660 	 * is NULL or not.
2661 	 */
2662 	if ((pam_convp == NULL) || (pam_convp->conv == NULL))
2663 		return (PAM_SYSTEM_ERR);
2664 
2665 	i = 0;
2666 	k = num_msg;
2667 
2668 	msg = calloc(num_msg, sizeof (struct pam_message));
2669 	if (msg == NULL) {
2670 		return (PAM_BUF_ERR);
2671 	}
2672 	m = msg;
2673 
2674 	while (k--) {
2675 		/*
2676 		 * fill out the message structure to display prompt message
2677 		 */
2678 		m->msg_style = msg_style;
2679 		m->msg = messages[i];
2680 		pam_trace(PAM_DEBUG_CONV,
2681 		    "pam_conv_msg(%p:%d[%d]=%s)",
2682 		    (void *)pamh, msg_style, i, messages[i]);
2683 		m++;
2684 		i++;
2685 	}
2686 
2687 	/*
2688 	 * The UNIX pam modules always calls __pam_get_authtok() and
2689 	 * __pam_display_msg() with a NULL pointer as the conv_apdp.
2690 	 * In case the conv_apdp is NULL and the pam_convp->appdata_ptr
2691 	 * is not NULL, we should pass the pam_convp->appdata_ptr
2692 	 * to the conversation function.
2693 	 */
2694 	if (conv_apdp == NULL && pam_convp->appdata_ptr != NULL)
2695 		conv_apdp = pam_convp->appdata_ptr;
2696 
2697 	/*
2698 	 * Call conv function to display the prompt.
2699 	 */
2700 	retcode = (pam_convp->conv)(num_msg, &msg, ret_respp, conv_apdp);
2701 	pam_trace(PAM_DEBUG_CONV,
2702 	    "pam_conv_resp(%p pam_conv = %s) ret_respp = %p",
2703 	    (void *)pamh, pam_strerror(pamh, retcode), (void *)ret_respp);
2704 	if (*ret_respp == NULL) {
2705 		pam_trace(PAM_DEBUG_CONV,
2706 		    "pam_conv_resp(%p No response requested)", (void *)pamh);
2707 	} else if ((pam_debug & (PAM_DEBUG_CONV | PAM_DEBUG_AUTHTOK)) != 0) {
2708 		struct pam_response *r = *ret_respp;
2709 
2710 		for (i = 0; i < num_msg; i++, r++) {
2711 			if (r->resp == NULL) {
2712 				pam_trace(PAM_DEBUG_CONV,
2713 				    "pam_conv_resp(%p:"
2714 				    "[%d] NULL response string)",
2715 				    (void *)pamh, i);
2716 			} else {
2717 				if (msg_style == PAM_PROMPT_ECHO_OFF) {
2718 #ifdef	DEBUG
2719 					pam_trace(PAM_DEBUG_AUTHTOK,
2720 					    "pam_conv_resp(%p:[%d]=%s, "
2721 					    "code=%d)",
2722 					    (void *)pamh, i, r->resp,
2723 					    r->resp_retcode);
2724 #endif	/* DEBUG */
2725 					pam_trace(PAM_DEBUG_CONV,
2726 					    "pam_conv_resp(%p:[%d] len=%lu, "
2727 					    "code=%d)",
2728 					    (void *)pamh, i,
2729 					    (ulong_t)strlen(r->resp),
2730 					    r->resp_retcode);
2731 				} else {
2732 					pam_trace(PAM_DEBUG_CONV,
2733 					    "pam_conv_resp(%p:[%d]=%s, "
2734 					    "code=%d)",
2735 					    (void *)pamh, i, r->resp,
2736 					    r->resp_retcode);
2737 				}
2738 			}
2739 		}
2740 	}
2741 
2742 	if (msg)
2743 		free(msg);
2744 	return (retcode);
2745 }
2746 
2747 /*
2748  * __pam_display_msg():
2749  *	display message by calling the call back functions
2750  *	provided by the application through "pam_conv" structure
2751  */
2752 
2753 int
2754 __pam_display_msg(pam_handle_t *pamh, int msg_style, int num_msg,
2755     char messages[PAM_MAX_NUM_MSG][PAM_MAX_MSG_SIZE], void *conv_apdp)
2756 {
2757 	struct pam_response	*ret_respp = NULL;
2758 	int ret;
2759 
2760 	ret = do_conv(pamh, msg_style, num_msg, messages,
2761 	    conv_apdp, &ret_respp);
2762 
2763 	if (ret_respp != NULL)
2764 		free_resp(num_msg, ret_respp);
2765 
2766 	return (ret);
2767 }
2768 
2769 /*
2770  * __pam_get_authtok()
2771  *	retrieves a password of at most PASS_MAX length from the pam
2772  *	handle (pam_get_item) or from the input stream (do_conv).
2773  *
2774  * This function allocates memory for the new authtok.
2775  * Applications calling this function are responsible for
2776  * freeing this memory.
2777  *
2778  * If "source" is
2779  *	PAM_HANDLE
2780  * and "type" is:
2781  *	PAM_AUTHTOK - password is taken from pam handle (PAM_AUTHTOK)
2782  *	PAM_OLDAUTHTOK - password is taken from pam handle (PAM_OLDAUTHTOK)
2783  *
2784  * If "source" is
2785  *	PAM_PROMPT
2786  * and "type" is:
2787  *	0:		Prompt for new passwd, do not even attempt
2788  *			to store it in the pam handle.
2789  *	PAM_AUTHTOK:	Prompt for new passwd, store in pam handle as
2790  *			PAM_AUTHTOK item if this value is not already set.
2791  *	PAM_OLDAUTHTOK:	Prompt for new passwd, store in pam handle as
2792  *			PAM_OLDAUTHTOK item if this value is not
2793  *			already set.
2794  */
2795 int
2796 __pam_get_authtok(pam_handle_t *pamh, int source, int type, char *prompt,
2797     char **authtok)
2798 {
2799 	int error = PAM_SYSTEM_ERR;
2800 	char *new_password = NULL;
2801 	struct pam_response *ret_resp = NULL;
2802 	char messages[PAM_MAX_NUM_MSG][PAM_MAX_MSG_SIZE];
2803 
2804 	if ((*authtok = calloc(PASS_MAX+1, sizeof (char))) == NULL)
2805 		return (PAM_BUF_ERR);
2806 
2807 	if (prompt == NULL)
2808 		prompt = dgettext(TEXT_DOMAIN, "password: ");
2809 
2810 	switch (source) {
2811 	case PAM_HANDLE:
2812 
2813 		/* get password from pam handle item list */
2814 
2815 		switch (type) {
2816 		case PAM_AUTHTOK:
2817 		case PAM_OLDAUTHTOK:
2818 
2819 			if ((error = pam_get_item(pamh, type,
2820 			    (void **)&new_password)) != PAM_SUCCESS)
2821 				goto err_ret;
2822 
2823 			if (new_password == NULL || new_password[0] == '\0') {
2824 				free(*authtok);
2825 				*authtok = NULL;
2826 			} else {
2827 				(void) strlcpy(*authtok, new_password,
2828 				    PASS_MAX+1);
2829 			}
2830 			break;
2831 		default:
2832 			__pam_log(LOG_AUTH | LOG_ERR,
2833 			    "__pam_get_authtok() invalid type: %d", type);
2834 			error = PAM_SYMBOL_ERR;
2835 			goto err_ret;
2836 		}
2837 		break;
2838 	case PAM_PROMPT:
2839 
2840 		/*
2841 		 * Prompt for new password and save in pam handle item list
2842 		 * if the that item is not already set.
2843 		 */
2844 
2845 		(void) strncpy(messages[0], prompt, sizeof (messages[0]));
2846 		if ((error = do_conv(pamh, PAM_PROMPT_ECHO_OFF, 1, messages,
2847 		    NULL, &ret_resp)) != PAM_SUCCESS)
2848 			goto err_ret;
2849 
2850 		if (ret_resp->resp == NULL) {
2851 			/* getpass didn't return anything */
2852 			error = PAM_SYSTEM_ERR;
2853 			goto err_ret;
2854 		}
2855 
2856 		/* save the new password if this item was NULL */
2857 		if (type) {
2858 			if ((error = pam_get_item(pamh, type,
2859 			    (void **)&new_password)) != PAM_SUCCESS) {
2860 				free_resp(1, ret_resp);
2861 				goto err_ret;
2862 			}
2863 			if (new_password == NULL)
2864 				(void) pam_set_item(pamh, type, ret_resp->resp);
2865 		}
2866 
2867 		(void) strlcpy(*authtok, ret_resp->resp, PASS_MAX+1);
2868 		free_resp(1, ret_resp);
2869 		break;
2870 	default:
2871 		__pam_log(LOG_AUTH | LOG_ERR,
2872 		    "__pam_get_authtok() invalid source: %d", source);
2873 		error = PAM_SYMBOL_ERR;
2874 		goto err_ret;
2875 	}
2876 
2877 	return (PAM_SUCCESS);
2878 
2879 err_ret:
2880 	bzero(*authtok, PASS_MAX+1);
2881 	free(*authtok);
2882 	*authtok = NULL;
2883 	return (error);
2884 }
2885