Skip to content

Commit 52c73b8

Browse files
millertmillert
committed
Fix indentation
1 parent a68e821 commit 52c73b8

File tree

1 file changed

+123
-121
lines changed
  • plugins/sudoers/auth

1 file changed

+123
-121
lines changed

‎plugins/sudoers/auth/pam.c‎

Lines changed: 123 additions & 121 deletions
Original file line numberDiff line numberDiff line change
@@ -306,29 +306,31 @@ sudo_pam_verify(const struct sudoers_context *ctx, struct passwd *pw,
306306
getpass_error = false; /* set by converse if user presses ^C */
307307
pam_closure.callback = callback; /* passed to conversation function */
308308

309-
/* Set KRB5CCNAME from the user environment if not set to propagate this
310-
* information to PAM modules that may use it to authentication. */
311-
envccname = sudo_getenv("KRB5CCNAME");
312-
if (envccname == NULL && ctx->user.ccname != NULL) {
313-
if (sudo_setenv("KRB5CCNAME", ctx->user.ccname, true) != 0) {
314-
sudo_debug_printf(SUDO_DEBUG_WARN|SUDO_DEBUG_LINENO,
315-
"unable to set KRB5CCNAME");
316-
debug_return_int(AUTH_FAILURE);
317-
}
309+
/*
310+
* Set KRB5CCNAME from the user environment if not set to propagate this
311+
* information to PAM modules that may use it to authentication.
312+
*/
313+
envccname = sudo_getenv("KRB5CCNAME");
314+
if (envccname == NULL && ctx->user.ccname != NULL) {
315+
if (sudo_setenv("KRB5CCNAME", ctx->user.ccname, true) != 0) {
316+
sudo_debug_printf(SUDO_DEBUG_WARN|SUDO_DEBUG_LINENO,
317+
"unable to set KRB5CCNAME");
318+
debug_return_int(AUTH_FAILURE);
318319
}
320+
}
319321

320322
/* PAM_SILENT prevents the authentication service from generating output. */
321323
*pam_status = pam_authenticate(pamh, def_pam_silent ? PAM_SILENT : 0);
322324

323325
/* Restore def_prompt, the passed-in prompt may be freed later. */
324326
def_prompt = PASSPROMPT;
325327

326-
/* Restore KRB5CCNAME to its original value. */
327-
if (envccname == NULL && sudo_unsetenv("KRB5CCNAME") != 0) {
328-
sudo_debug_printf(SUDO_DEBUG_WARN|SUDO_DEBUG_LINENO,
329-
"unable to restore KRB5CCNAME");
330-
debug_return_int(AUTH_FAILURE);
331-
}
328+
/* Restore KRB5CCNAME to its original value. */
329+
if (envccname == NULL && sudo_unsetenv("KRB5CCNAME") != 0) {
330+
sudo_debug_printf(SUDO_DEBUG_WARN|SUDO_DEBUG_LINENO,
331+
"unable to restore KRB5CCNAME");
332+
debug_return_int(AUTH_FAILURE);
333+
}
332334

333335
if (*pam_status == PAM_SUCCESS) {
334336
const char *pam_user = NULL;
@@ -348,19 +350,19 @@ sudo_pam_verify(const struct sudoers_context *ctx, struct passwd *pw,
348350
debug_return_int(noninteractive ? AUTH_NONINTERACTIVE : AUTH_INTR);
349351
}
350352
switch (*pam_status) {
351-
case PAM_SUCCESS:
352-
debug_return_int(AUTH_SUCCESS);
353-
case PAM_AUTH_ERR:
354-
case PAM_AUTHINFO_UNAVAIL:
355-
case PAM_MAXTRIES:
356-
case PAM_PERM_DENIED:
357-
sudo_debug_printf(SUDO_DEBUG_WARN|SUDO_DEBUG_LINENO,
358-
"pam_authenticate: %d", *pam_status);
359-
debug_return_int(AUTH_FAILURE);
360-
default:
361-
s = sudo_pam_strerror(pamh, *pam_status);
362-
log_warningx(ctx, 0, N_("PAM authentication error: %s"), s);
363-
debug_return_int(AUTH_ERROR);
353+
case PAM_SUCCESS:
354+
debug_return_int(AUTH_SUCCESS);
355+
case PAM_AUTH_ERR:
356+
case PAM_AUTHINFO_UNAVAIL:
357+
case PAM_MAXTRIES:
358+
case PAM_PERM_DENIED:
359+
sudo_debug_printf(SUDO_DEBUG_WARN|SUDO_DEBUG_LINENO,
360+
"pam_authenticate: %d", *pam_status);
361+
debug_return_int(AUTH_FAILURE);
362+
default:
363+
s = sudo_pam_strerror(pamh, *pam_status);
364+
log_warningx(ctx, 0, N_("PAM authentication error: %s"), s);
365+
debug_return_int(AUTH_ERROR);
364366
}
365367
}
366368

@@ -376,59 +378,59 @@ sudo_pam_approval(const struct sudoers_context *ctx, struct passwd *pw,
376378
if (def_pam_acct_mgmt) {
377379
rc = pam_acct_mgmt(pamh, PAM_SILENT);
378380
switch (rc) {
379-
case PAM_SUCCESS:
380-
break;
381-
case PAM_AUTH_ERR:
382-
log_warningx(ctx, 0, N_("account validation failure, "
383-
"is your account locked?"));
384-
status = AUTH_ERROR;
385-
break;
386-
case PAM_NEW_AUTHTOK_REQD:
387-
/* Ignore if user is exempt from password restrictions. */
388-
if (exempt) {
389-
rc = *pam_status;
390-
break;
391-
}
392-
/* New password required, try to change it. */
393-
log_warningx(ctx, 0, N_("Account or password is "
394-
"expired, reset your password and try again"));
395-
rc = pam_chauthtok(pamh, PAM_CHANGE_EXPIRED_AUTHTOK);
396-
if (rc == PAM_SUCCESS)
397-
break;
398-
s = pam_strerror(pamh, rc);
399-
log_warningx(ctx, 0,
400-
N_("unable to change expired password: %s"), s);
401-
status = AUTH_FAILURE;
402-
break;
403-
case PAM_AUTHTOK_EXPIRED:
404-
/* Ignore if user is exempt from password restrictions. */
405-
if (exempt) {
406-
rc = *pam_status;
407-
break;
408-
}
409-
/* Password expired, cannot be updated by user. */
410-
log_warningx(ctx, 0,
411-
N_("Password expired, contact your system administrator"));
412-
status = AUTH_ERROR;
413-
break;
414-
case PAM_ACCT_EXPIRED:
415-
log_warningx(ctx, 0,
416-
N_("Account expired or PAM config lacks an \"account\" "
417-
"section for sudo, contact your system administrator"));
418-
status = AUTH_ERROR;
381+
case PAM_SUCCESS:
382+
break;
383+
case PAM_AUTH_ERR:
384+
log_warningx(ctx, 0, N_("account validation failure, "
385+
"is your account locked?"));
386+
status = AUTH_ERROR;
387+
break;
388+
case PAM_NEW_AUTHTOK_REQD:
389+
/* Ignore if user is exempt from password restrictions. */
390+
if (exempt) {
391+
rc = *pam_status;
419392
break;
420-
case PAM_AUTHINFO_UNAVAIL:
421-
case PAM_MAXTRIES:
422-
case PAM_PERM_DENIED:
423-
s = sudo_pam_strerror(pamh, rc);
424-
log_warningx(ctx, 0, N_("PAM account management error: %s"), s);
425-
status = AUTH_FAILURE;
393+
}
394+
/* New password required, try to change it. */
395+
log_warningx(ctx, 0, N_("Account or password is "
396+
"expired, reset your password and try again"));
397+
rc = pam_chauthtok(pamh, PAM_CHANGE_EXPIRED_AUTHTOK);
398+
if (rc == PAM_SUCCESS)
426399
break;
427-
default:
428-
s = sudo_pam_strerror(pamh, rc);
429-
log_warningx(ctx, 0, N_("PAM account management error: %s"), s);
430-
status = AUTH_ERROR;
400+
s = pam_strerror(pamh, rc);
401+
log_warningx(ctx, 0,
402+
N_("unable to change expired password: %s"), s);
403+
status = AUTH_FAILURE;
404+
break;
405+
case PAM_AUTHTOK_EXPIRED:
406+
/* Ignore if user is exempt from password restrictions. */
407+
if (exempt) {
408+
rc = *pam_status;
431409
break;
410+
}
411+
/* Password expired, cannot be updated by user. */
412+
log_warningx(ctx, 0,
413+
N_("Password expired, contact your system administrator"));
414+
status = AUTH_ERROR;
415+
break;
416+
case PAM_ACCT_EXPIRED:
417+
log_warningx(ctx, 0,
418+
N_("Account expired or PAM config lacks an \"account\" "
419+
"section for sudo, contact your system administrator"));
420+
status = AUTH_ERROR;
421+
break;
422+
case PAM_AUTHINFO_UNAVAIL:
423+
case PAM_MAXTRIES:
424+
case PAM_PERM_DENIED:
425+
s = sudo_pam_strerror(pamh, rc);
426+
log_warningx(ctx, 0, N_("PAM account management error: %s"), s);
427+
status = AUTH_FAILURE;
428+
break;
429+
default:
430+
s = sudo_pam_strerror(pamh, rc);
431+
log_warningx(ctx, 0, N_("PAM account management error: %s"), s);
432+
status = AUTH_ERROR;
433+
break;
432434
}
433435
*pam_status = rc;
434436
}
@@ -719,53 +721,53 @@ converse(int num_msg, PAM_CONST struct pam_message **msg,
719721

720722
type = SUDO_CONV_PROMPT_ECHO_OFF;
721723
switch (pm->msg_style) {
722-
case PAM_PROMPT_ECHO_ON:
723-
type = SUDO_CONV_PROMPT_ECHO_ON;
724-
FALLTHROUGH;
725-
case PAM_PROMPT_ECHO_OFF:
726-
/* Error out if the last password read was interrupted. */
727-
if (getpass_error)
728-
goto bad;
729-
730-
/* Treat non-interactive mode as a getpass error. */
731-
if (noninteractive) {
732-
getpass_error = true;
733-
goto bad;
734-
}
724+
case PAM_PROMPT_ECHO_ON:
725+
type = SUDO_CONV_PROMPT_ECHO_ON;
726+
FALLTHROUGH;
727+
case PAM_PROMPT_ECHO_OFF:
728+
/* Error out if the last password read was interrupted. */
729+
if (getpass_error)
730+
goto bad;
735731

736-
/* Choose either the sudo prompt or the PAM one. */
737-
prompt = use_pam_prompt(pm->msg) ? pm->msg : def_prompt;
732+
/* Treat non-interactive mode as a getpass error. */
733+
if (noninteractive) {
734+
getpass_error = true;
735+
goto bad;
736+
}
738737

739-
/* Read the password unless interrupted. */
740-
pass = auth_getpass(prompt, type, callback);
741-
if (pass == NULL) {
742-
/* Error (or ^C) reading password, don't try again. */
743-
getpass_error = true;
744-
goto bad;
745-
}
746-
if (strlen(pass) >= PAM_MAX_RESP_SIZE) {
747-
sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
748-
"password longer than %d", PAM_MAX_RESP_SIZE);
749-
freezero(pass, strlen(pass));
750-
pass = NULL;
751-
goto bad;
752-
}
753-
reply[n].resp = pass; /* auth_getpass() malloc's a copy */
754-
break;
755-
case PAM_TEXT_INFO:
756-
if (pm->msg != NULL && !is_filtered(pm->msg))
757-
sudo_printf(SUDO_CONV_INFO_MSG|SUDO_CONV_PREFER_TTY,
758-
"%s\n", pm->msg);
759-
break;
760-
case PAM_ERROR_MSG:
761-
if (pm->msg != NULL)
762-
sudo_printf(SUDO_CONV_ERROR_MSG|SUDO_CONV_PREFER_TTY,
763-
"%s\n", pm->msg);
764-
break;
765-
default:
738+
/* Choose either the sudo prompt or the PAM one. */
739+
prompt = use_pam_prompt(pm->msg) ? pm->msg : def_prompt;
740+
741+
/* Read the password unless interrupted. */
742+
pass = auth_getpass(prompt, type, callback);
743+
if (pass == NULL) {
744+
/* Error (or ^C) reading password, don't try again. */
745+
getpass_error = true;
746+
goto bad;
747+
}
748+
if (strlen(pass) >= PAM_MAX_RESP_SIZE) {
766749
sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
767-
"unsupported message style: %d", pm->msg_style);
750+
"password longer than %d", PAM_MAX_RESP_SIZE);
751+
freezero(pass, strlen(pass));
752+
pass = NULL;
768753
goto bad;
754+
}
755+
reply[n].resp = pass; /* auth_getpass() malloc's a copy */
756+
break;
757+
case PAM_TEXT_INFO:
758+
if (pm->msg != NULL && !is_filtered(pm->msg))
759+
sudo_printf(SUDO_CONV_INFO_MSG|SUDO_CONV_PREFER_TTY,
760+
"%s\n", pm->msg);
761+
break;
762+
case PAM_ERROR_MSG:
763+
if (pm->msg != NULL)
764+
sudo_printf(SUDO_CONV_ERROR_MSG|SUDO_CONV_PREFER_TTY,
765+
"%s\n", pm->msg);
766+
break;
767+
default:
768+
sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
769+
"unsupported message style: %d", pm->msg_style);
770+
goto bad;
769771
}
770772
}
771773

0 commit comments

Comments
 (0)