Relevant BUGIDs:

[linux-pam] / modules / pam_unix / unix_update.c

diff --git a/modules/pam_unix/unix_update.c b/modules/pam_unix/unix_update.c
index 6dc8ace4a0df6450b0111ae20e12d6e86ebd6de0..f54a59cee9138dc03aec38d5d8f87032ce7f503d 100644 (file)
--- a/modules/pam_unix/unix_update.c
+++ b/modules/pam_unix/unix_update.c
@@ -1,11 +1,12 @@
 /*
- * This program is designed to run setuid(root) or with sufficient
- * privilege to read all of the unix password databases. It is designed
- * to provide a mechanism for the current user (defined by this
- * process' uid) to verify their own password.
+ * This program is designed to run with sufficient privilege
+ * to read and write all of the unix password databases.
+ * Its purpose is to allow updating the databases when
+ * SELinux confinement of the caller domain prevents them to
+ * do that themselves.
  *
  * The password is read from the standard input. The exit status of
- * this program indicates whether the user is authenticated or not.
+ * this program indicates whether the password was updated or not.
  *
  * Copyright information is located at the end of the file.
  *
@@ -26,13 +27,6 @@
 #include <signal.h>
 #include <time.h>
 #include <sys/time.h>
-#ifdef WITH_SELINUX
-#include <selinux/selinux.h>
-#define SELINUX_ENABLED (selinux_enabled!=-1 ? selinux_enabled : (selinux_enabled=is_selinux_enabled()>0))
-static int selinux_enabled=-1;
-#else
-#define SELINUX_ENABLED 0
-#endif
 
 #include <security/_pam_types.h>
 #include <security/_pam_macros.h>
@@ -71,13 +65,13 @@ set_password(const char *forwho, const char *shadow, const char *remember)
        return PAM_AUTHTOK_LOCK_BUSY;
 
     pwd = getpwnam(forwho);
-    
+
     if (pwd == NULL) {
         retval = PAM_USER_UNKNOWN;
         goto done;
     }
 
-    /* does pass agree with the official one? 
+    /* does pass agree with the official one?
        we always allow change from null pass */
     retval = helper_verify_password(forwho, pass, 1);
     if (retval != PAM_SUCCESS) {
@@ -146,7 +140,7 @@ int main(int argc, char *argv[])
        if (geteuid() != 0) {
            return PAM_CRED_INSUFFICIENT;
        }
-       
+
        option = argv[2];
 
        if (strcmp(option, "update") == 0) {