granicus.if.org Git - linux-pam/blob - modules/pam_unix/pam_unix_passwd.c

   1 /*
   2  * Main coding by Elliot Lee <sopwith@redhat.com>, Red Hat Software.
   3  * Copyright (C) 1996.
   4  * Copyright (c) Jan Rêkorajski, 1999.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  * 1. Redistributions of source code must retain the above copyright
  10  *    notice, and the entire permission notice in its entirety,
  11  *    including the disclaimer of warranties.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  * 3. The name of the author may not be used to endorse or promote
  16  *    products derived from this software without specific prior
  17  *    written permission.
  18  *
  19  * ALTERNATIVELY, this product may be distributed under the terms of
  20  * the GNU Public License, in which case the provisions of the GPL are
  21  * required INSTEAD OF the above restrictions.  (This clause is
  22  * necessary due to a potential bad interaction between the GPL and
  23  * the restrictions contained in a BSD-style copyright.)
  24  *
  25  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  26  * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  27  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  28  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
  29  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  30  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  31  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  32  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  33  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  34  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  35  * OF THE POSSIBILITY OF SUCH DAMAGE.
  36  */
  37
  38 #include "config.h"
  39
  40 #include <stdio.h>
  41 #include <stdlib.h>
  42 #include <stdarg.h>
  43 #include <string.h>
  44 #include <malloc.h>
  45 #include <unistd.h>
  46 #include <errno.h>
  47 #include <sys/types.h>
  48 #include <pwd.h>
  49 #include <syslog.h>
  50 #include <shadow.h>
  51 #include <time.h>               /* for time() */
  52 #include <fcntl.h>
  53 #include <ctype.h>
  54 #include <sys/time.h>
  55 #include <sys/stat.h>
  56 #include <rpc/rpc.h>
  57 #include <rpcsvc/yp_prot.h>
  58 #include <rpcsvc/ypclnt.h>
  59
  60 #include <signal.h>
  61 #include <errno.h>
  62 #include <sys/wait.h>
  63 #ifdef WITH_SELINUX
  64 static int selinux_enabled=-1;
  65 #include <selinux/selinux.h>
  66 static security_context_t prev_context=NULL;
  67 #define SELINUX_ENABLED (selinux_enabled!=-1 ? selinux_enabled : (selinux_enabled=is_selinux_enabled()>0))
  68 #endif
  69
  70 #ifdef USE_CRACKLIB
  71 #include <crack.h>
  72 #endif
  73
  74 #include <security/_pam_macros.h>
  75
  76 /* indicate the following groups are defined */
  77
  78 #define PAM_SM_PASSWORD
  79
  80 #include <security/pam_modules.h>
  81 #include <security/pam_ext.h>
  82 #include <security/pam_modutil.h>
  83
  84 #include "yppasswd.h"
  85 #include "md5.h"
  86 #include "support.h"
  87
  88 #if !((__GLIBC__ == 2) && (__GLIBC_MINOR__ >= 1))
  89 extern int getrpcport(const char *host, unsigned long prognum,
  90                       unsigned long versnum, unsigned int proto);
  91 #endif                          /* GNU libc 2.1 */
  92
  93 /*
  94  * PAM framework looks for these entry-points to pass control to the
  95  * password changing module.
  96  */
  97
  98 #if defined(USE_LCKPWDF) && !defined(HAVE_LCKPWDF)
  99 # include "./lckpwdf.-c"
 100 #endif
 101
 102 extern char *bigcrypt(const char *key, const char *salt);
 103
 104 /*
 105    How it works:
 106    Gets in username (has to be done) from the calling program
 107    Does authentication of user (only if we are not running as root)
 108    Gets new password/checks for sanity
 109    Sets it.
 110  */
 111
 112 /* passwd/salt conversion macros */
 113
 114 #define ascii_to_bin(c) ((c)>='a'?(c-59):(c)>='A'?((c)-53):(c)-'.')
 115 #define bin_to_ascii(c) ((c)>=38?((c)-38+'a'):(c)>=12?((c)-12+'A'):(c)+'.')
 116
 117 /* data tokens */
 118
 119 #define _UNIX_OLD_AUTHTOK       "-UN*X-OLD-PASS"
 120 #define _UNIX_NEW_AUTHTOK       "-UN*X-NEW-PASS"
 121
 122 #define MAX_PASSWD_TRIES        3
 123 #define PW_TMPFILE              "/etc/npasswd"
 124 #define SH_TMPFILE              "/etc/nshadow"
 125 #ifndef CRACKLIB_DICTS
 126 #define CRACKLIB_DICTS          NULL
 127 #endif
 128 #define OPW_TMPFILE             "/etc/security/nopasswd"
 129 #define OLD_PASSWORDS_FILE      "/etc/security/opasswd"
 130
 131 /*
 132  * i64c - convert an integer to a radix 64 character
 133  */
 134 static int i64c(int i)
 135 {
 136         if (i < 0)
 137                 return ('.');
 138         else if (i > 63)
 139                 return ('z');
 140         if (i == 0)
 141                 return ('.');
 142         if (i == 1)
 143                 return ('/');
 144         if (i >= 2 && i <= 11)
 145                 return ('0' - 2 + i);
 146         if (i >= 12 && i <= 37)
 147                 return ('A' - 12 + i);
 148         if (i >= 38 && i <= 63)
 149                 return ('a' - 38 + i);
 150         return ('\0');
 151 }
 152
 153 static char *crypt_md5_wrapper(const char *pass_new)
 154 {
 155         /*
 156          * Code lifted from Marek Michalkiewicz's shadow suite. (CG)
 157          * removed use of static variables (AGM)
 158          */
 159
 160         struct timeval tv;
 161         MD5_CTX ctx;
 162         unsigned char result[16];
 163         char *cp = (char *) result;
 164         unsigned char tmp[16];
 165         int i;
 166         char *x = NULL;
 167
 168         GoodMD5Init(&ctx);
 169         gettimeofday(&tv, (struct timezone *) 0);
 170         GoodMD5Update(&ctx, (void *) &tv, sizeof tv);
 171         i = getpid();
 172         GoodMD5Update(&ctx, (void *) &i, sizeof i);
 173         i = clock();
 174         GoodMD5Update(&ctx, (void *) &i, sizeof i);
 175         GoodMD5Update(&ctx, result, sizeof result);
 176         GoodMD5Final(tmp, &ctx);
 177         strcpy(cp, "$1$");      /* magic for the MD5 */
 178         cp += strlen(cp);
 179         for (i = 0; i < 8; i++)
 180                 *cp++ = i64c(tmp[i] & 077);
 181         *cp = '\0';
 182
 183         /* no longer need cleartext */
 184         x = Goodcrypt_md5(pass_new, (const char *) result);
 185
 186         return x;
 187 }
 188
 189 static char *getNISserver(pam_handle_t *pamh)
 190 {
 191         char *master;
 192         char *domainname;
 193         int port, err;
 194
 195         if ((err = yp_get_default_domain(&domainname)) != 0) {
 196                 pam_syslog(pamh, LOG_WARNING, "can't get local yp domain: %s",
 197                          yperr_string(err));
 198                 return NULL;
 199         }
 200         if ((err = yp_master(domainname, "passwd.byname", &master)) != 0) {
 201                 pam_syslog(pamh, LOG_WARNING, "can't find the master ypserver: %s",
 202                          yperr_string(err));
 203                 return NULL;
 204         }
 205         port = getrpcport(master, YPPASSWDPROG, YPPASSWDPROC_UPDATE, IPPROTO_UDP);
 206         if (port == 0) {
 207                 pam_syslog(pamh, LOG_WARNING,
 208                          "yppasswdd not running on NIS master host");
 209                 return NULL;
 210         }
 211         if (port >= IPPORT_RESERVED) {
 212                 pam_syslog(pamh, LOG_WARNING,
 213                          "yppasswd daemon running on illegal port");
 214                 return NULL;
 215         }
 216         return master;
 217 }
 218
 219 #ifdef WITH_SELINUX
 220
 221 static int _unix_run_shadow_binary(pam_handle_t *pamh, unsigned int ctrl, const char *user, const char *fromwhat, const char *towhat)
 222 {
 223     int retval, child, fds[2];
 224     void (*sighandler)(int) = NULL;
 225
 226     D(("called."));
 227     /* create a pipe for the password */
 228     if (pipe(fds) != 0) {
 229         D(("could not make pipe"));
 230         return PAM_AUTH_ERR;
 231     }
 232
 233     if (off(UNIX_NOREAP, ctrl)) {
 234         /*
 235          * This code arranges that the demise of the child does not cause
 236          * the application to receive a signal it is not expecting - which
 237          * may kill the application or worse.
 238          *
 239          * The "noreap" module argument is provided so that the admin can
 240          * override this behavior.
 241          */
 242         sighandler = signal(SIGCHLD, SIG_DFL);
 243     }
 244
 245     /* fork */
 246     child = fork();
 247     if (child == 0) {
 248         size_t i=0;
 249         struct rlimit rlim;
 250         static char *envp[] = { NULL };
 251         char *args[] = { NULL, NULL, NULL, NULL };
 252
 253         /* XXX - should really tidy up PAM here too */
 254
 255         close(0); close(1);
 256         /* reopen stdin as pipe */
 257         close(fds[1]);
 258         dup2(fds[0], STDIN_FILENO);
 259
 260         if (getrlimit(RLIMIT_NOFILE,&rlim)==0) {
 261           for (i=2; i < rlim.rlim_max; i++) {
 262             if ((unsigned int)fds[0] != i)
 263                    close(i);
 264           }
 265         }
 266
 267         if (SELINUX_ENABLED && geteuid() == 0) {
 268           /* must set the real uid to 0 so the helper will not error
 269              out if pam is called from setuid binary (su, sudo...) */
 270           setuid(0);
 271         }
 272
 273         /* exec binary helper */
 274         args[0] = x_strdup(CHKPWD_HELPER);
 275         args[1] = x_strdup(user);
 276         args[2] = x_strdup("shadow");
 277
 278         execve(CHKPWD_HELPER, args, envp);
 279
 280         /* should not get here: exit with error */
 281         D(("helper binary is not available"));
 282         exit(PAM_AUTHINFO_UNAVAIL);
 283     } else if (child > 0) {
 284         /* wait for child */
 285         /* if the stored password is NULL */
 286         int rc=0;
 287         if (fromwhat)
 288           pam_modutil_write(fds[1], fromwhat, strlen(fromwhat)+1);
 289         else
 290           pam_modutil_write(fds[1], "", 1);
 291         if (towhat) {
 292           pam_modutil_write(fds[1], towhat, strlen(towhat)+1);
 293         }
 294         else
 295           pam_modutil_write(fds[1], "", 1);
 296
 297         close(fds[0]);       /* close here to avoid possible SIGPIPE above */
 298         close(fds[1]);
 299         rc=waitpid(child, &retval, 0);  /* wait for helper to complete */
 300         if (rc<0) {
 301           pam_syslog(pamh, LOG_ERR, "unix_chkpwd waitpid returned %d: %m", rc);
 302           retval = PAM_AUTH_ERR;
 303         } else {
 304           retval = WEXITSTATUS(retval);
 305         }
 306     } else {
 307         D(("fork failed"));
 308         close(fds[0]);
 309         close(fds[1]);
 310         retval = PAM_AUTH_ERR;
 311     }
 312
 313     if (sighandler != NULL) {
 314         (void) signal(SIGCHLD, sighandler);   /* restore old signal handler */
 315     }
 316
 317     return retval;
 318 }
 319 #endif
 320
 321 static int check_old_password(const char *forwho, const char *newpass)
 322 {
 323         static char buf[16384];
 324         char *s_luser, *s_uid, *s_npas, *s_pas;
 325         int retval = PAM_SUCCESS;
 326         FILE *opwfile;
 327
 328         opwfile = fopen(OLD_PASSWORDS_FILE, "r");
 329         if (opwfile == NULL)
 330                 return PAM_ABORT;
 331
 332         while (fgets(buf, 16380, opwfile)) {
 333                 if (!strncmp(buf, forwho, strlen(forwho))) {
 334                         buf[strlen(buf) - 1] = '\0';
 335                         s_luser = strtok(buf, ":,");
 336                         s_uid = strtok(NULL, ":,");
 337                         s_npas = strtok(NULL, ":,");
 338                         s_pas = strtok(NULL, ":,");
 339                         while (s_pas != NULL) {
 340                                 char *md5pass = Goodcrypt_md5(newpass, s_pas);
 341                                 if (!strcmp(md5pass, s_pas)) {
 342                                         _pam_delete(md5pass);
 343                                         retval = PAM_AUTHTOK_ERR;
 344                                         break;
 345                                 }
 346                                 s_pas = strtok(NULL, ":,");
 347                                 _pam_delete(md5pass);
 348                         }
 349                         break;
 350                 }
 351         }
 352         fclose(opwfile);
 353
 354         return retval;
 355 }
 356
 357 static int save_old_password(pam_handle_t *pamh,
 358                              const char *forwho, const char *oldpass,
 359                              int howmany)
 360 {
 361     static char buf[16384];
 362     static char nbuf[16384];
 363     char *s_luser, *s_uid, *s_npas, *s_pas, *pass;
 364     int npas;
 365     FILE *pwfile, *opwfile;
 366     int err = 0;
 367     int oldmask;
 368     int found = 0;
 369     struct passwd *pwd = NULL;
 370     struct stat st;
 371
 372     if (howmany < 0) {
 373         return PAM_SUCCESS;
 374     }
 375
 376     if (oldpass == NULL) {
 377         return PAM_SUCCESS;
 378     }
 379
 380     oldmask = umask(077);
 381
 382 #ifdef WITH_SELINUX
 383     if (SELINUX_ENABLED) {
 384       security_context_t passwd_context=NULL;
 385       if (getfilecon("/etc/passwd",&passwd_context)<0) {
 386         return PAM_AUTHTOK_ERR;
 387       };
 388       if (getfscreatecon(&prev_context)<0) {
 389         freecon(passwd_context);
 390         return PAM_AUTHTOK_ERR;
 391       }
 392       if (setfscreatecon(passwd_context)) {
 393         freecon(passwd_context);
 394         freecon(prev_context);
 395         return PAM_AUTHTOK_ERR;
 396       }
 397       freecon(passwd_context);
 398     }
 399 #endif
 400     pwfile = fopen(OPW_TMPFILE, "w");
 401     umask(oldmask);
 402     if (pwfile == NULL) {
 403       err = 1;
 404       goto done;
 405     }
 406
 407     opwfile = fopen(OLD_PASSWORDS_FILE, "r");
 408     if (opwfile == NULL) {
 409         fclose(pwfile);
 410       err = 1;
 411       goto done;
 412     }
 413
 414     if (fstat(fileno(opwfile), &st) == -1) {
 415         fclose(opwfile);
 416         fclose(pwfile);
 417         err = 1;
 418         goto done;
 419     }
 420
 421     if (fchown(fileno(pwfile), st.st_uid, st.st_gid) == -1) {
 422         fclose(opwfile);
 423         fclose(pwfile);
 424         err = 1;
 425         goto done;
 426     }
 427     if (fchmod(fileno(pwfile), st.st_mode) == -1) {
 428         fclose(opwfile);
 429         fclose(pwfile);
 430         err = 1;
 431         goto done;
 432     }
 433
 434     while (fgets(buf, 16380, opwfile)) {
 435         if (!strncmp(buf, forwho, strlen(forwho))) {
 436             buf[strlen(buf) - 1] = '\0';
 437             s_luser = strtok(buf, ":");
 438             s_uid = strtok(NULL, ":");
 439             s_npas = strtok(NULL, ":");
 440             s_pas = strtok(NULL, ":");
 441             npas = strtol(s_npas, NULL, 10) + 1;
 442             while (npas > howmany) {
 443                 s_pas = strpbrk(s_pas, ",");
 444                 if (s_pas != NULL)
 445                     s_pas++;
 446                 npas--;
 447             }
 448             pass = crypt_md5_wrapper(oldpass);
 449             if (s_pas == NULL)
 450                 snprintf(nbuf, sizeof(nbuf), "%s:%s:%d:%s\n",
 451                          s_luser, s_uid, npas, pass);
 452             else
 453                 snprintf(nbuf, sizeof(nbuf),"%s:%s:%d:%s,%s\n",
 454                          s_luser, s_uid, npas, s_pas, pass);
 455             _pam_delete(pass);
 456             if (fputs(nbuf, pwfile) < 0) {
 457                 err = 1;
 458                 break;
 459             }
 460             found = 1;
 461         } else if (fputs(buf, pwfile) < 0) {
 462             err = 1;
 463             break;
 464         }
 465     }
 466     fclose(opwfile);
 467
 468     if (!found) {
 469         pwd = pam_modutil_getpwnam(pamh, forwho);
 470         if (pwd == NULL) {
 471             err = 1;
 472         } else {
 473             pass = crypt_md5_wrapper(oldpass);
 474             snprintf(nbuf, sizeof(nbuf), "%s:%d:1:%s\n",
 475                      forwho, pwd->pw_uid, pass);
 476             _pam_delete(pass);
 477             if (fputs(nbuf, pwfile) < 0) {
 478                 err = 1;
 479             }
 480         }
 481     }
 482
 483     if (fclose(pwfile)) {
 484         D(("error writing entries to old passwords file: %s\n",
 485            strerror(errno)));
 486         err = 1;
 487     }
 488
 489 done:
 490     if (!err) {
 491         if (rename(OPW_TMPFILE, OLD_PASSWORDS_FILE))
 492             err = 1;
 493     }
 494 #ifdef WITH_SELINUX
 495     if (SELINUX_ENABLED) {
 496       if (setfscreatecon(prev_context)) {
 497         err = 1;
 498       }
 499       if (prev_context)
 500         freecon(prev_context);
 501       prev_context=NULL;
 502     }
 503 #endif
 504     if (!err) {
 505         return PAM_SUCCESS;
 506     } else {
 507         unlink(OPW_TMPFILE);
 508         return PAM_AUTHTOK_ERR;
 509     }
 510 }
 511
 512 static int _update_passwd(pam_handle_t *pamh,
 513                           const char *forwho, const char *towhat)
 514 {
 515     struct passwd *tmpent = NULL;
 516     struct stat st;
 517     FILE *pwfile, *opwfile;
 518     int err = 1;
 519     int oldmask;
 520
 521     oldmask = umask(077);
 522 #ifdef WITH_SELINUX
 523     if (SELINUX_ENABLED) {
 524       security_context_t passwd_context=NULL;
 525       if (getfilecon("/etc/passwd",&passwd_context)<0) {
 526         return PAM_AUTHTOK_ERR;
 527       };
 528       if (getfscreatecon(&prev_context)<0) {
 529         freecon(passwd_context);
 530         return PAM_AUTHTOK_ERR;
 531       }
 532       if (setfscreatecon(passwd_context)) {
 533         freecon(passwd_context);
 534         freecon(prev_context);
 535         return PAM_AUTHTOK_ERR;
 536       }
 537       freecon(passwd_context);
 538     }
 539 #endif
 540     pwfile = fopen(PW_TMPFILE, "w");
 541     umask(oldmask);
 542     if (pwfile == NULL) {
 543       err = 1;
 544       goto done;
 545     }
 546
 547     opwfile = fopen("/etc/passwd", "r");
 548     if (opwfile == NULL) {
 549         fclose(pwfile);
 550         err = 1;
 551         goto done;
 552     }
 553
 554     if (fstat(fileno(opwfile), &st) == -1) {
 555         fclose(opwfile);
 556         fclose(pwfile);
 557         err = 1;
 558         goto done;
 559     }
 560
 561     if (fchown(fileno(pwfile), st.st_uid, st.st_gid) == -1) {
 562         fclose(opwfile);
 563         fclose(pwfile);
 564         err = 1;
 565         goto done;
 566     }
 567     if (fchmod(fileno(pwfile), st.st_mode) == -1) {
 568         fclose(opwfile);
 569         fclose(pwfile);
 570         err = 1;
 571         goto done;
 572     }
 573
 574     tmpent = fgetpwent(opwfile);
 575     while (tmpent) {
 576         if (!strcmp(tmpent->pw_name, forwho)) {
 577             /* To shut gcc up */
 578             union {
 579                 const char *const_charp;
 580                 char *charp;
 581             } assigned_passwd;
 582             assigned_passwd.const_charp = towhat;
 583
 584             tmpent->pw_passwd = assigned_passwd.charp;
 585             err = 0;
 586         }
 587         if (putpwent(tmpent, pwfile)) {
 588             D(("error writing entry to password file: %s\n", strerror(errno)));
 589             err = 1;
 590             break;
 591         }
 592         tmpent = fgetpwent(opwfile);
 593     }
 594     fclose(opwfile);
 595
 596     if (fclose(pwfile)) {
 597         D(("error writing entries to password file: %s\n", strerror(errno)));
 598         err = 1;
 599     }
 600
 601 done:
 602     if (!err) {
 603         if (!rename(PW_TMPFILE, "/etc/passwd"))
 604             pam_syslog(pamh, LOG_NOTICE, "password changed for %s", forwho);
 605         else
 606             err = 1;
 607     }
 608 #ifdef WITH_SELINUX
 609     if (SELINUX_ENABLED) {
 610       if (setfscreatecon(prev_context)) {
 611         err = 1;
 612       }
 613       if (prev_context)
 614         freecon(prev_context);
 615       prev_context=NULL;
 616     }
 617 #endif
 618     if (!err) {
 619         return PAM_SUCCESS;
 620     } else {
 621         unlink(PW_TMPFILE);
 622         return PAM_AUTHTOK_ERR;
 623     }
 624 }
 625
 626 static int _update_shadow(pam_handle_t *pamh, const char *forwho, char *towhat)
 627 {
 628     struct spwd *spwdent = NULL, *stmpent = NULL;
 629     struct stat st;
 630     FILE *pwfile, *opwfile;
 631     int err = 1;
 632     int oldmask;
 633
 634     spwdent = getspnam(forwho);
 635     if (spwdent == NULL) {
 636         return PAM_USER_UNKNOWN;
 637     }
 638     oldmask = umask(077);
 639
 640 #ifdef WITH_SELINUX
 641     if (SELINUX_ENABLED) {
 642       security_context_t shadow_context=NULL;
 643       if (getfilecon("/etc/shadow",&shadow_context)<0) {
 644         return PAM_AUTHTOK_ERR;
 645       };
 646       if (getfscreatecon(&prev_context)<0) {
 647         freecon(shadow_context);
 648         return PAM_AUTHTOK_ERR;
 649       }
 650       if (setfscreatecon(shadow_context)) {
 651         freecon(shadow_context);
 652         freecon(prev_context);
 653         return PAM_AUTHTOK_ERR;
 654       }
 655       freecon(shadow_context);
 656     }
 657 #endif
 658     pwfile = fopen(SH_TMPFILE, "w");
 659     umask(oldmask);
 660     if (pwfile == NULL) {
 661         err = 1;
 662         goto done;
 663     }
 664
 665     opwfile = fopen("/etc/shadow", "r");
 666     if (opwfile == NULL) {
 667         fclose(pwfile);
 668         err = 1;
 669         goto done;
 670     }
 671
 672     if (fstat(fileno(opwfile), &st) == -1) {
 673         fclose(opwfile);
 674         fclose(pwfile);
 675         err = 1;
 676         goto done;
 677     }
 678
 679     if (fchown(fileno(pwfile), st.st_uid, st.st_gid) == -1) {
 680         fclose(opwfile);
 681         fclose(pwfile);
 682         err = 1;
 683         goto done;
 684     }
 685     if (fchmod(fileno(pwfile), st.st_mode) == -1) {
 686         fclose(opwfile);
 687         fclose(pwfile);
 688         err = 1;
 689         goto done;
 690     }
 691
 692     stmpent = fgetspent(opwfile);
 693     while (stmpent) {
 694
 695         if (!strcmp(stmpent->sp_namp, forwho)) {
 696             stmpent->sp_pwdp = towhat;
 697             stmpent->sp_lstchg = time(NULL) / (60 * 60 * 24);
 698             err = 0;
 699             D(("Set password %s for %s", stmpent->sp_pwdp, forwho));
 700         }
 701
 702         if (putspent(stmpent, pwfile)) {
 703             D(("error writing entry to shadow file: %s\n", strerror(errno)));
 704             err = 1;
 705             break;
 706         }
 707
 708         stmpent = fgetspent(opwfile);
 709     }
 710     fclose(opwfile);
 711
 712     if (fclose(pwfile)) {
 713         D(("error writing entries to shadow file: %s\n", strerror(errno)));
 714         err = 1;
 715     }
 716
 717  done:
 718     if (!err) {
 719         if (!rename(SH_TMPFILE, "/etc/shadow"))
 720             pam_syslog(pamh, LOG_NOTICE, "password changed for %s", forwho);
 721         else
 722             err = 1;
 723     }
 724
 725 #ifdef WITH_SELINUX
 726     if (SELINUX_ENABLED) {
 727       if (setfscreatecon(prev_context)) {
 728         err = 1;
 729       }
 730       if (prev_context)
 731         freecon(prev_context);
 732       prev_context=NULL;
 733     }
 734 #endif
 735
 736     if (!err) {
 737         return PAM_SUCCESS;
 738     } else {
 739         unlink(SH_TMPFILE);
 740         return PAM_AUTHTOK_ERR;
 741     }
 742 }
 743
 744 static int _do_setpass(pam_handle_t* pamh, const char *forwho,
 745                        const char *fromwhat,
 746                        char *towhat, unsigned int ctrl, int remember)
 747 {
 748         struct passwd *pwd = NULL;
 749         int retval = 0;
 750         int unlocked = 0;
 751         char *master = NULL;
 752
 753         D(("called"));
 754
 755         pwd = getpwnam(forwho);
 756
 757         if (pwd == NULL) {
 758                 retval = PAM_AUTHTOK_ERR;
 759                 goto done;
 760         }
 761
 762         if (on(UNIX_NIS, ctrl) && _unix_comesfromsource(pamh, forwho, 0, 1)) {
 763             if ((master=getNISserver(pamh)) != NULL) {
 764                 struct timeval timeout;
 765                 struct yppasswd yppwd;
 766                 CLIENT *clnt;
 767                 int status;
 768                 int err = 0;
 769
 770                 /* Unlock passwd file to avoid deadlock */
 771 #ifdef USE_LCKPWDF
 772                 ulckpwdf();
 773 #endif
 774                 unlocked = 1;
 775
 776                 /* Initialize password information */
 777                 yppwd.newpw.pw_passwd = pwd->pw_passwd;
 778                 yppwd.newpw.pw_name = pwd->pw_name;
 779                 yppwd.newpw.pw_uid = pwd->pw_uid;
 780                 yppwd.newpw.pw_gid = pwd->pw_gid;
 781                 yppwd.newpw.pw_gecos = pwd->pw_gecos;
 782                 yppwd.newpw.pw_dir = pwd->pw_dir;
 783                 yppwd.newpw.pw_shell = pwd->pw_shell;
 784                 yppwd.oldpass = fromwhat ? strdup (fromwhat) : strdup ("");
 785                 yppwd.newpw.pw_passwd = towhat;
 786
 787                 D(("Set password %s for %s", yppwd.newpw.pw_passwd, forwho));
 788
 789                 /* The yppasswd.x file said `unix authentication required',
 790                  * so I added it. This is the only reason it is in here.
 791                  * My yppasswdd doesn't use it, but maybe some others out there
 792                  * do.                                        --okir
 793                  */
 794                 clnt = clnt_create(master, YPPASSWDPROG, YPPASSWDVERS, "udp");
 795                 clnt->cl_auth = authunix_create_default();
 796                 memset((char *) &status, '\0', sizeof(status));
 797                 timeout.tv_sec = 25;
 798                 timeout.tv_usec = 0;
 799                 err = clnt_call(clnt, YPPASSWDPROC_UPDATE,
 800                                 (xdrproc_t) xdr_yppasswd, (char *) &yppwd,
 801                                 (xdrproc_t) xdr_int, (char *) &status,
 802                                 timeout);
 803
 804                 free (yppwd.oldpass);
 805
 806                 if (err) {
 807                         _make_remark(pamh, ctrl, PAM_TEXT_INFO,
 808                                 clnt_sperrno(err));
 809                 } else if (status) {
 810                         D(("Error while changing NIS password.\n"));
 811                 }
 812                 D(("The password has%s been changed on %s.",
 813                    (err || status) ? " not" : "", master));
 814                 pam_syslog(pamh, LOG_NOTICE, "password%s changed for %s on %s",
 815                          (err || status) ? " not" : "", pwd->pw_name, master);
 816
 817                 auth_destroy(clnt->cl_auth);
 818                 clnt_destroy(clnt);
 819                 if (err || status) {
 820                         _make_remark(pamh, ctrl, PAM_TEXT_INFO,
 821                                 _("NIS password could not be changed."));
 822                         retval = PAM_TRY_AGAIN;
 823                 }
 824 #ifdef DEBUG
 825                 sleep(5);
 826 #endif
 827             } else {
 828                     retval = PAM_TRY_AGAIN;
 829             }
 830         }
 831
 832         if (_unix_comesfromsource(pamh, forwho, 1, 0)) {
 833 #ifdef USE_LCKPWDF
 834                 if(unlocked) {
 835                         int i = 0;
 836                         /* These values for the number of attempts and the sleep time
 837                            are, of course, completely arbitrary.
 838                            My reading of the PAM docs is that, once pam_chauthtok() has been
 839                            called with PAM_UPDATE_AUTHTOK, we are obliged to take any
 840                            reasonable steps to make sure the token is updated; so retrying
 841                            for 1/10 sec. isn't overdoing it. */
 842                         while((retval = lckpwdf()) != 0 && i < 100) {
 843                                 usleep(1000);
 844                                 i++;
 845                         }
 846                         if(retval != 0) {
 847                                 return PAM_AUTHTOK_LOCK_BUSY;
 848                         }
 849                 }
 850 #endif
 851                 /* first, save old password */
 852                 if (save_old_password(pamh, forwho, fromwhat, remember)) {
 853                         retval = PAM_AUTHTOK_ERR;
 854                         goto done;
 855                 }
 856                 if (on(UNIX_SHADOW, ctrl) || _unix_shadowed(pwd)) {
 857                         retval = _update_shadow(pamh, forwho, towhat);
 858 #ifdef WITH_SELINUX
 859                         if (retval != PAM_SUCCESS && SELINUX_ENABLED)
 860                           retval = _unix_run_shadow_binary(pamh, ctrl, forwho, fromwhat, towhat);
 861 #endif
 862                         if (retval == PAM_SUCCESS)
 863                                 if (!_unix_shadowed(pwd))
 864                                         retval = _update_passwd(pamh, forwho, "x");
 865                 } else {
 866                         retval = _update_passwd(pamh, forwho, towhat);
 867                 }
 868         }
 869
 870
 871 done:
 872 #ifdef USE_LCKPWDF
 873         ulckpwdf();
 874 #endif
 875
 876         return retval;
 877 }
 878
 879 static int _unix_verify_shadow(pam_handle_t *pamh, const char *user, unsigned int ctrl)
 880 {
 881         struct passwd *pwd = NULL;      /* Password and shadow password */
 882         struct spwd *spwdent = NULL;    /* file entries for the user */
 883         time_t curdays;
 884         int retval = PAM_SUCCESS;
 885
 886         /* UNIX passwords area */
 887         pwd = getpwnam(user);   /* Get password file entry... */
 888         if (pwd == NULL)
 889                 return PAM_AUTHINFO_UNAVAIL;    /* We don't need to do the rest... */
 890
 891         if (_unix_shadowed(pwd)) {
 892                 /* ...and shadow password file entry for this user, if shadowing
 893                    is enabled */
 894                 setspent();
 895                 spwdent = getspnam(user);
 896                 endspent();
 897
 898 #ifdef WITH_SELINUX
 899                 if (spwdent == NULL && SELINUX_ENABLED )
 900                     spwdent = _unix_run_verify_binary(pamh, ctrl, user);
 901 #endif
 902                 if (spwdent == NULL)
 903                         return PAM_AUTHINFO_UNAVAIL;
 904         } else {
 905                 if (strcmp(pwd->pw_passwd,"*NP*") == 0) { /* NIS+ */
 906                         uid_t save_uid;
 907
 908                         save_uid = geteuid();
 909                         seteuid (pwd->pw_uid);
 910                         spwdent = getspnam( user );
 911                         seteuid (save_uid);
 912
 913                         if (spwdent == NULL)
 914                                 return PAM_AUTHINFO_UNAVAIL;
 915                 } else
 916                         spwdent = NULL;
 917         }
 918
 919         if (spwdent != NULL) {
 920                 /* We have the user's information, now let's check if their account
 921                    has expired (60 * 60 * 24 = number of seconds in a day) */
 922
 923                 if (off(UNIX__IAMROOT, ctrl)) {
 924                         /* Get the current number of days since 1970 */
 925                         curdays = time(NULL) / (60 * 60 * 24);
 926                         if ((curdays < (spwdent->sp_lstchg + spwdent->sp_min))
 927                             && (spwdent->sp_min != -1))
 928                                 retval = PAM_AUTHTOK_ERR;
 929                         else if ((curdays > (spwdent->sp_lstchg + spwdent->sp_max + spwdent->sp_inact))
 930                                  && (spwdent->sp_max != -1) && (spwdent->sp_inact != -1)
 931                                  && (spwdent->sp_lstchg != 0))
 932                                 /*
 933                                  * Their password change has been put off too long,
 934                                  */
 935                                 retval = PAM_ACCT_EXPIRED;
 936                         else if ((curdays > spwdent->sp_expire) && (spwdent->sp_expire != -1)
 937                                  && (spwdent->sp_lstchg != 0))
 938                                 /*
 939                                  * OR their account has just plain expired
 940                                  */
 941                                 retval = PAM_ACCT_EXPIRED;
 942                 }
 943         }
 944         return retval;
 945 }
 946
 947 static int _pam_unix_approve_pass(pam_handle_t * pamh
 948                                   ,unsigned int ctrl
 949                                   ,const char *pass_old
 950                                   ,const char *pass_new)
 951 {
 952         const void *user;
 953         const char *remark = NULL;
 954         int retval = PAM_SUCCESS;
 955
 956         D(("&new=%p, &old=%p", pass_old, pass_new));
 957         D(("new=[%s]", pass_new));
 958         D(("old=[%s]", pass_old));
 959
 960         if (pass_new == NULL || (pass_old && !strcmp(pass_old, pass_new))) {
 961                 if (on(UNIX_DEBUG, ctrl)) {
 962                         pam_syslog(pamh, LOG_DEBUG, "bad authentication token");
 963                 }
 964                 _make_remark(pamh, ctrl, PAM_ERROR_MSG, pass_new == NULL ?
 965                         _("No password supplied") : _("Password unchanged"));
 966                 return PAM_AUTHTOK_ERR;
 967         }
 968         /*
 969          * if one wanted to hardwire authentication token strength
 970          * checking this would be the place - AGM
 971          */
 972
 973         retval = pam_get_item(pamh, PAM_USER, &user);
 974         if (retval != PAM_SUCCESS) {
 975                 if (on(UNIX_DEBUG, ctrl)) {
 976                         pam_syslog(pamh, LOG_ERR, "Can not get username");
 977                         return PAM_AUTHTOK_ERR;
 978                 }
 979         }
 980         if (off(UNIX__IAMROOT, ctrl)) {
 981 #ifdef USE_CRACKLIB
 982                 remark = FascistCheck (pass_new, CRACKLIB_DICTS);
 983                 D(("called cracklib [%s]", remark));
 984 #else
 985                 if (strlen(pass_new) < 6)
 986                   remark = _("You must choose a longer password");
 987                 D(("length check [%s]", remark));
 988 #endif
 989                 if (on(UNIX_REMEMBER_PASSWD, ctrl)) {
 990                         if ((retval = check_old_password(user, pass_new)) == PAM_AUTHTOK_ERR)
 991                           remark = _("Password has been already used. Choose another.");
 992                         if (retval == PAM_ABORT) {
 993                                 pam_syslog(pamh, LOG_ERR, "can't open %s file to check old passwords",
 994                                         OLD_PASSWORDS_FILE);
 995                                 return retval;
 996                         }
 997                 }
 998         }
 999         if (remark) {
1000                 _make_remark(pamh, ctrl, PAM_ERROR_MSG, remark);
1001                 retval = PAM_AUTHTOK_ERR;
1002         }
1003         return retval;
1004 }
1005
1006
1007 PAM_EXTERN int pam_sm_chauthtok(pam_handle_t * pamh, int flags,
1008                                 int argc, const char **argv)
1009 {
1010         unsigned int ctrl, lctrl;
1011         int retval, i;
1012         int remember = -1;
1013
1014         /* <DO NOT free() THESE> */
1015         const char *user;
1016         const void *pass_old, *pass_new;
1017         /* </DO NOT free() THESE> */
1018
1019         D(("called."));
1020
1021         ctrl = _set_ctrl(pamh, flags, &remember, argc, argv);
1022
1023         /*
1024          * First get the name of a user
1025          */
1026         retval = pam_get_user(pamh, &user, NULL);
1027         if (retval == PAM_SUCCESS) {
1028                 /*
1029                  * Various libraries at various times have had bugs related to
1030                  * '+' or '-' as the first character of a user name. Don't take
1031                  * any chances here. Require that the username starts with an
1032                  * alphanumeric character.
1033                  */
1034                 if (user == NULL || !isalnum(*user)) {
1035                         pam_syslog(pamh, LOG_ERR, "bad username [%s]", user);
1036                         return PAM_USER_UNKNOWN;
1037                 }
1038                 if (retval == PAM_SUCCESS && on(UNIX_DEBUG, ctrl))
1039                         pam_syslog(pamh, LOG_DEBUG, "username [%s] obtained",
1040                                  user);
1041         } else {
1042                 if (on(UNIX_DEBUG, ctrl))
1043                         pam_syslog(pamh, LOG_DEBUG,
1044                                  "password - could not identify user");
1045                 return retval;
1046         }
1047
1048         D(("Got username of %s", user));
1049
1050         /*
1051          * Before we do anything else, check to make sure that the user's
1052          * info is in one of the databases we can modify from this module,
1053          * which currently is 'files' and 'nis'.  We have to do this because
1054          * getpwnam() doesn't tell you *where* the information it gives you
1055          * came from, nor should it.  That's our job.
1056          */
1057         if (_unix_comesfromsource(pamh, user, 1, on(UNIX_NIS, ctrl)) == 0) {
1058                 pam_syslog(pamh, LOG_DEBUG,
1059                          "user \"%s\" does not exist in /etc/passwd%s",
1060                          user, on(UNIX_NIS, ctrl) ? " or NIS" : "");
1061                 return PAM_USER_UNKNOWN;
1062         } else {
1063                 struct passwd *pwd;
1064                 _unix_getpwnam(pamh, user, 1, 1, &pwd);
1065                 if (pwd == NULL) {
1066                         pam_syslog(pamh, LOG_DEBUG,
1067                                 "user \"%s\" has corrupted passwd entry",
1068                                 user);
1069                         return PAM_USER_UNKNOWN;
1070                 }
1071                 if (!_unix_shadowed(pwd) &&
1072                     (strchr(pwd->pw_passwd, '*') != NULL)) {
1073                         pam_syslog(pamh, LOG_DEBUG,
1074                                 "user \"%s\" does not have modifiable password",
1075                                 user);
1076                         return PAM_USER_UNKNOWN;
1077                 }
1078         }
1079
1080         /*
1081          * This is not an AUTH module!
1082          */
1083         if (on(UNIX__NONULL, ctrl))
1084                 set(UNIX__NULLOK, ctrl);
1085
1086         if (on(UNIX__PRELIM, ctrl)) {
1087                 /*
1088                  * obtain and verify the current password (OLDAUTHTOK) for
1089                  * the user.
1090                  */
1091                 char *Announce;
1092
1093                 D(("prelim check"));
1094
1095                 if (_unix_blankpasswd(pamh, ctrl, user)) {
1096                         return PAM_SUCCESS;
1097                 } else if (off(UNIX__IAMROOT, ctrl)) {
1098
1099                         /* instruct user what is happening */
1100 #define greeting "Changing password for "
1101                         Announce = (char *) malloc(sizeof(greeting) + strlen(user));
1102                         if (Announce == NULL) {
1103                                 pam_syslog(pamh, LOG_CRIT,
1104                                          "password - out of memory");
1105                                 return PAM_BUF_ERR;
1106                         }
1107                         (void) strcpy(Announce, greeting);
1108                         (void) strcpy(Announce + sizeof(greeting) - 1, user);
1109 #undef greeting
1110
1111                         lctrl = ctrl;
1112                         set(UNIX__OLD_PASSWD, lctrl);
1113                         retval = _unix_read_password(pamh, lctrl
1114                                                      ,Announce
1115                                              ,_("(current) UNIX password: ")
1116                                                      ,NULL
1117                                                      ,_UNIX_OLD_AUTHTOK
1118                                              ,&pass_old);
1119                         free(Announce);
1120
1121                         if (retval != PAM_SUCCESS) {
1122                                 pam_syslog(pamh, LOG_NOTICE,
1123                                     "password - (old) token not obtained");
1124                                 return retval;
1125                         }
1126                         /* verify that this is the password for this user */
1127
1128                         retval = _unix_verify_password(pamh, user, pass_old, ctrl);
1129                 } else {
1130                         D(("process run by root so do nothing this time around"));
1131                         pass_old = NULL;
1132                         retval = PAM_SUCCESS;   /* root doesn't have too */
1133                 }
1134
1135                 if (retval != PAM_SUCCESS) {
1136                         D(("Authentication failed"));
1137                         pass_old = NULL;
1138                         return retval;
1139                 }
1140                 retval = pam_set_item(pamh, PAM_OLDAUTHTOK, (const void *) pass_old);
1141                 pass_old = NULL;
1142                 if (retval != PAM_SUCCESS) {
1143                         pam_syslog(pamh, LOG_CRIT,
1144                                  "failed to set PAM_OLDAUTHTOK");
1145                 }
1146                 retval = _unix_verify_shadow(pamh,user, ctrl);
1147                 if (retval == PAM_AUTHTOK_ERR) {
1148                         if (off(UNIX__IAMROOT, ctrl))
1149                                 _make_remark(pamh, ctrl, PAM_ERROR_MSG,
1150                                              _("You must wait longer to change your password"));
1151                         else
1152                                 retval = PAM_SUCCESS;
1153                 }
1154         } else if (on(UNIX__UPDATE, ctrl)) {
1155                 /*
1156                  * tpass is used below to store the _pam_md() return; it
1157                  * should be _pam_delete()'d.
1158                  */
1159
1160                 char *tpass = NULL;
1161                 int retry = 0;
1162
1163                 /*
1164                  * obtain the proposed password
1165                  */
1166
1167                 D(("do update"));
1168
1169                 /*
1170                  * get the old token back. NULL was ok only if root [at this
1171                  * point we assume that this has already been enforced on a
1172                  * previous call to this function].
1173                  */
1174
1175                 if (off(UNIX_NOT_SET_PASS, ctrl)) {
1176                         retval = pam_get_item(pamh, PAM_OLDAUTHTOK
1177                                               ,&pass_old);
1178                 } else {
1179                         retval = pam_get_data(pamh, _UNIX_OLD_AUTHTOK
1180                                               ,&pass_old);
1181                         if (retval == PAM_NO_MODULE_DATA) {
1182                                 retval = PAM_SUCCESS;
1183                                 pass_old = NULL;
1184                         }
1185                 }
1186                 D(("pass_old [%s]", pass_old));
1187
1188                 if (retval != PAM_SUCCESS) {
1189                         pam_syslog(pamh, LOG_NOTICE, "user not authenticated");
1190                         return retval;
1191                 }
1192
1193                 D(("get new password now"));
1194
1195                 lctrl = ctrl;
1196
1197                 if (on(UNIX_USE_AUTHTOK, lctrl)) {
1198                         set(UNIX_USE_FIRST_PASS, lctrl);
1199                 }
1200                 retry = 0;
1201                 retval = PAM_AUTHTOK_ERR;
1202                 while ((retval != PAM_SUCCESS) && (retry++ < MAX_PASSWD_TRIES)) {
1203                         /*
1204                          * use_authtok is to force the use of a previously entered
1205                          * password -- needed for pluggable password strength checking
1206                          */
1207
1208                         retval = _unix_read_password(pamh, lctrl
1209                                                      ,NULL
1210                                              ,_("Enter new UNIX password: ")
1211                                             ,_("Retype new UNIX password: ")
1212                                                      ,_UNIX_NEW_AUTHTOK
1213                                              ,&pass_new);
1214
1215                         if (retval != PAM_SUCCESS) {
1216                                 if (on(UNIX_DEBUG, ctrl)) {
1217                                         pam_syslog(pamh, LOG_ALERT,
1218                                                  "password - new password not obtained");
1219                                 }
1220                                 pass_old = NULL;        /* tidy up */
1221                                 return retval;
1222                         }
1223                         D(("returned to _unix_chauthtok"));
1224
1225                         /*
1226                          * At this point we know who the user is and what they
1227                          * propose as their new password. Verify that the new
1228                          * password is acceptable.
1229                          */
1230
1231                         if (*(const char *)pass_new == '\0') {  /* "\0" password = NULL */
1232                                 pass_new = NULL;
1233                         }
1234                         retval = _pam_unix_approve_pass(pamh, ctrl, pass_old, pass_new);
1235                 }
1236
1237                 if (retval != PAM_SUCCESS) {
1238                         pam_syslog(pamh, LOG_NOTICE,
1239                                  "new password not acceptable");
1240                         pass_new = pass_old = NULL;     /* tidy up */
1241                         return retval;
1242                 }
1243 #ifdef USE_LCKPWDF
1244                 /* These values for the number of attempts and the sleep time
1245                    are, of course, completely arbitrary.
1246                    My reading of the PAM docs is that, once pam_chauthtok() has been
1247                    called with PAM_UPDATE_AUTHTOK, we are obliged to take any
1248                    reasonable steps to make sure the token is updated; so retrying
1249                    for 1/10 sec. isn't overdoing it. */
1250                 i=0;
1251                 while((retval = lckpwdf()) != 0 && i < 100) {
1252                         usleep(1000);
1253                         i++;
1254                 }
1255                 if(retval != 0) {
1256                         return PAM_AUTHTOK_LOCK_BUSY;
1257                 }
1258 #endif
1259
1260                 if (pass_old) {
1261                         retval = _unix_verify_password(pamh, user, pass_old, ctrl);
1262                         if (retval != PAM_SUCCESS) {
1263                                 pam_syslog(pamh, LOG_NOTICE, "user password changed by another process");
1264 #ifdef USE_LCKPWDF
1265                                 ulckpwdf();
1266 #endif
1267                                 return retval;
1268                         }
1269                 }
1270
1271                 retval = _unix_verify_shadow(pamh, user, ctrl);
1272                 if (retval != PAM_SUCCESS) {
1273                         pam_syslog(pamh, LOG_NOTICE, "user not authenticated 2");
1274 #ifdef USE_LCKPWDF
1275                         ulckpwdf();
1276 #endif
1277                         return retval;
1278                 }
1279
1280                 retval = _pam_unix_approve_pass(pamh, ctrl, pass_old, pass_new);
1281                 if (retval != PAM_SUCCESS) {
1282                         pam_syslog(pamh, LOG_NOTICE,
1283                                  "new password not acceptable 2");
1284                         pass_new = pass_old = NULL;     /* tidy up */
1285 #ifdef USE_LCKPWDF
1286                         ulckpwdf();
1287 #endif
1288                         return retval;
1289                 }
1290
1291                 /*
1292                  * By reaching here we have approved the passwords and must now
1293                  * rebuild the password database file.
1294                  */
1295
1296                 /*
1297                  * First we encrypt the new password.
1298                  */
1299
1300                 if (on(UNIX_MD5_PASS, ctrl)) {
1301                         tpass = crypt_md5_wrapper(pass_new);
1302                 } else {
1303                         /*
1304                          * Salt manipulation is stolen from Rick Faith's passwd
1305                          * program.  Sorry Rick :) -- alex
1306                          */
1307
1308                         time_t tm;
1309                         char salt[3];
1310
1311                         time(&tm);
1312                         salt[0] = bin_to_ascii(tm & 0x3f);
1313                         salt[1] = bin_to_ascii((tm >> 6) & 0x3f);
1314                         salt[2] = '\0';
1315
1316                         if (off(UNIX_BIGCRYPT, ctrl) && strlen(pass_new) > 8) {
1317                                 /*
1318                                  * to avoid using the _extensions_ of the bigcrypt()
1319                                  * function we truncate the newly entered password
1320                                  * [Problems that followed from this are fixed as per
1321                                  *  Bug 521314.]
1322                                  */
1323                                 char *temp = malloc(9);
1324
1325                                 if (temp == NULL) {
1326                                         pam_syslog(pamh, LOG_CRIT,
1327                                                  "out of memory for password");
1328                                         pass_new = pass_old = NULL;     /* tidy up */
1329 #ifdef USE_LCKPWDF
1330                                         ulckpwdf();
1331 #endif
1332                                         return PAM_BUF_ERR;
1333                                 }
1334                                 /* copy first 8 bytes of password */
1335                                 strncpy(temp, pass_new, 8);
1336                                 temp[8] = '\0';
1337
1338                                 /* no longer need cleartext */
1339                                 tpass = bigcrypt(temp, salt);
1340
1341                                 _pam_delete(temp);      /* tidy up */
1342                         } else {
1343                                 tpass = bigcrypt(pass_new, salt);
1344                         }
1345                 }
1346
1347                 D(("password processed"));
1348
1349                 /* update the password database(s) -- race conditions..? */
1350
1351                 retval = _do_setpass(pamh, user, pass_old, tpass, ctrl,
1352                                      remember);
1353                 /* _do_setpass has called ulckpwdf for us */
1354
1355                 _pam_delete(tpass);
1356                 pass_old = pass_new = NULL;
1357         } else {                /* something has broken with the module */
1358                 pam_syslog(pamh, LOG_ALERT,
1359                          "password received unknown request");
1360                 retval = PAM_ABORT;
1361         }
1362
1363         D(("retval was %d", retval));
1364
1365         return retval;
1366 }
1367
1368
1369 /* static module data */
1370 #ifdef PAM_STATIC
1371 struct pam_module _pam_unix_passwd_modstruct = {
1372     "pam_unix_passwd",
1373     NULL,
1374     NULL,
1375     NULL,
1376     NULL,
1377     NULL,
1378     pam_sm_chauthtok,
1379 };
1380 #endif