Skip to content

Commit 6e798f7

Browse files
dtardonbluca
dtardon
authored and
bluca
committed
pam_systemd_home: suppress LOG_DEBUG msgs if debugging is off
This is a "sequel" to commit 2675747 . Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2210770 (cherry picked from commit f71b55b) (cherry picked from commit d6b23dd)
1 parent e7ff82f commit 6e798f7

File tree

1 file changed

+54
-28
lines changed

1 file changed

+54
-28
lines changed

‎src/home/pam_systemd_home.c‎

Lines changed: 54 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,7 @@ static int parse_env(
9191
static int acquire_user_record(
9292
pam_handle_t *handle,
9393
const char *username,
94+
bool debug,
9495
UserRecord **ret_record) {
9596

9697
_cleanup_(sd_bus_message_unrefp) sd_bus_message *reply = NULL;
@@ -147,12 +148,14 @@ static int acquire_user_record(
147148
r = bus_call_method(bus, bus_home_mgr, "GetUserRecordByName", &error, &reply, "s", username);
148149
if (r < 0) {
149150
if (bus_error_is_unknown_service(&error)) {
150-
pam_syslog(handle, LOG_DEBUG, "systemd-homed is not available: %s", bus_error_message(&error, r));
151+
if (debug)
152+
pam_syslog(handle, LOG_DEBUG, "systemd-homed is not available: %s", bus_error_message(&error, r));
151153
goto user_unknown;
152154
}
153155

154156
if (sd_bus_error_has_name(&error, BUS_ERROR_NO_SUCH_HOME)) {
155-
pam_syslog(handle, LOG_DEBUG, "Not a user managed by systemd-homed: %s", bus_error_message(&error, r));
157+
if (debug)
158+
pam_syslog(handle, LOG_DEBUG, "Not a user managed by systemd-homed: %s", bus_error_message(&error, r));
156159
goto user_unknown;
157160
}
158161

@@ -264,7 +267,8 @@ static int handle_generic_user_record_error(
264267
const char *user_name,
265268
UserRecord *secret,
266269
int ret,
267-
const sd_bus_error *error) {
270+
const sd_bus_error *error,
271+
bool debug) {
268272

269273
assert(user_name);
270274
assert(error);
@@ -300,9 +304,11 @@ static int handle_generic_user_record_error(
300304
if (r != PAM_SUCCESS)
301305
return PAM_CONV_ERR; /* no logging here */
302306

303-
if (isempty(newp))
304-
return pam_syslog_pam_error(handle, LOG_DEBUG, PAM_AUTHTOK_ERR,
305-
"Password request aborted.");
307+
if (isempty(newp)) {
308+
if (debug)
309+
pam_syslog(handle, LOG_DEBUG, "Password request aborted.");
310+
return PAM_AUTHTOK_ERR;
311+
}
306312

307313
r = user_record_set_password(secret, STRV_MAKE(newp), true);
308314
if (r < 0)
@@ -324,9 +330,11 @@ static int handle_generic_user_record_error(
324330
if (r != PAM_SUCCESS)
325331
return PAM_CONV_ERR; /* no logging here */
326332

327-
if (isempty(newp))
328-
return pam_syslog_pam_error(handle, LOG_DEBUG, PAM_AUTHTOK_ERR,
329-
"Recovery key request aborted.");
333+
if (isempty(newp)) {
334+
if (debug)
335+
pam_syslog(handle, LOG_DEBUG, "Recovery key request aborted.");
336+
return PAM_AUTHTOK_ERR;
337+
}
330338

331339
r = user_record_set_password(secret, STRV_MAKE(newp), true);
332340
if (r < 0)
@@ -347,9 +355,11 @@ static int handle_generic_user_record_error(
347355
if (r != PAM_SUCCESS)
348356
return PAM_CONV_ERR; /* no logging here */
349357

350-
if (isempty(newp))
351-
return pam_syslog_pam_error(handle, LOG_DEBUG, PAM_AUTHTOK_ERR,
352-
"Password request aborted.");
358+
if (isempty(newp)) {
359+
if (debug)
360+
pam_syslog(handle, LOG_DEBUG, "Password request aborted.");
361+
return PAM_AUTHTOK_ERR;
362+
}
353363

354364

355365
r = user_record_set_password(secret, STRV_MAKE(newp), true);
@@ -365,8 +375,11 @@ static int handle_generic_user_record_error(
365375
if (r != PAM_SUCCESS)
366376
return PAM_CONV_ERR; /* no logging here */
367377

368-
if (isempty(newp))
369-
return pam_syslog_pam_error(handle, LOG_DEBUG, PAM_AUTHTOK_ERR, "PIN request aborted.");
378+
if (isempty(newp)) {
379+
if (debug)
380+
pam_syslog(handle, LOG_DEBUG, "PIN request aborted.");
381+
return PAM_AUTHTOK_ERR;
382+
}
370383

371384
r = user_record_set_token_pin(secret, STRV_MAKE(newp), false);
372385
if (r < 0)
@@ -420,8 +433,11 @@ static int handle_generic_user_record_error(
420433
if (r != PAM_SUCCESS)
421434
return PAM_CONV_ERR; /* no logging here */
422435

423-
if (isempty(newp))
424-
return pam_syslog_pam_error(handle, LOG_DEBUG, PAM_AUTHTOK_ERR, "PIN request aborted.");
436+
if (isempty(newp)) {
437+
if (debug)
438+
pam_syslog(handle, LOG_DEBUG, "PIN request aborted.");
439+
return PAM_AUTHTOK_ERR;
440+
}
425441

426442
r = user_record_set_token_pin(secret, STRV_MAKE(newp), false);
427443
if (r < 0)
@@ -437,8 +453,11 @@ static int handle_generic_user_record_error(
437453
if (r != PAM_SUCCESS)
438454
return PAM_CONV_ERR; /* no logging here */
439455

440-
if (isempty(newp))
441-
return pam_syslog_pam_error(handle, LOG_DEBUG, PAM_AUTHTOK_ERR, "PIN request aborted.");
456+
if (isempty(newp)) {
457+
if (debug)
458+
pam_syslog(handle, LOG_DEBUG, "PIN request aborted.");
459+
return PAM_AUTHTOK_ERR;
460+
}
442461

443462
r = user_record_set_token_pin(secret, STRV_MAKE(newp), false);
444463
if (r < 0)
@@ -454,8 +473,11 @@ static int handle_generic_user_record_error(
454473
if (r != PAM_SUCCESS)
455474
return PAM_CONV_ERR; /* no logging here */
456475

457-
if (isempty(newp))
458-
return pam_syslog_pam_error(handle, LOG_DEBUG, PAM_AUTHTOK_ERR, "PIN request aborted.");
476+
if (isempty(newp)) {
477+
if (debug)
478+
pam_syslog(handle, LOG_DEBUG, "PIN request aborted.");
479+
return PAM_AUTHTOK_ERR;
480+
}
459481

460482
r = user_record_set_token_pin(secret, STRV_MAKE(newp), false);
461483
if (r < 0)
@@ -517,7 +539,7 @@ static int acquire_home(
517539
if (r != PAM_SUCCESS)
518540
return r;
519541

520-
r = acquire_user_record(handle, username, &ur);
542+
r = acquire_user_record(handle, username, debug, &ur);
521543
if (r != PAM_SUCCESS)
522544
return r;
523545

@@ -584,7 +606,7 @@ static int acquire_home(
584606
else if (sd_bus_error_has_name(&error, BUS_ERROR_HOME_LOCKED))
585607
home_locked = true; /* Similar */
586608
else {
587-
r = handle_generic_user_record_error(handle, ur->user_name, secret, r, &error);
609+
r = handle_generic_user_record_error(handle, ur->user_name, secret, r, &error, debug);
588610
if (r == PAM_CONV_ERR) {
589611
/* Password/PIN prompts will fail in certain environments, for example when
590612
* we are called from OpenSSH's account or session hooks, or in systemd's
@@ -596,7 +618,8 @@ static int acquire_home(
596618
if (home_locked)
597619
(void) pam_prompt(handle, PAM_ERROR_MSG, NULL, "Home of user %s is currently locked, please unlock locally first.", ur->user_name);
598620

599-
pam_syslog(handle, please_authenticate ? LOG_ERR : LOG_DEBUG, "Failed to prompt for password/prompt.");
621+
if (please_authenticate || debug)
622+
pam_syslog(handle, please_authenticate ? LOG_ERR : LOG_DEBUG, "Failed to prompt for password/prompt.");
600623

601624
return home_not_active || home_locked ? PAM_PERM_DENIED : PAM_CONV_ERR;
602625
}
@@ -836,7 +859,7 @@ _public_ PAM_EXTERN int pam_sm_acct_mgmt(
836859
if (r != PAM_SUCCESS)
837860
return r;
838861

839-
r = acquire_user_record(handle, NULL, &ur);
862+
r = acquire_user_record(handle, NULL, debug, &ur);
840863
if (r != PAM_SUCCESS)
841864
return r;
842865

@@ -948,7 +971,7 @@ _public_ PAM_EXTERN int pam_sm_chauthtok(
948971
if (r != PAM_SUCCESS)
949972
return r;
950973

951-
r = acquire_user_record(handle, NULL, &ur);
974+
r = acquire_user_record(handle, NULL, debug, &ur);
952975
if (r != PAM_SUCCESS)
953976
return r;
954977

@@ -969,8 +992,11 @@ _public_ PAM_EXTERN int pam_sm_chauthtok(
969992
if (r != PAM_SUCCESS)
970993
return pam_syslog_pam_error(handle, LOG_ERR, r, "Failed to get new password: @PAMERR@");
971994

972-
if (isempty(new_password))
973-
return pam_syslog_pam_error(handle, LOG_DEBUG, PAM_AUTHTOK_ERR, "Password request aborted.");
995+
if (isempty(new_password)) {
996+
if (debug)
997+
pam_syslog(handle, LOG_DEBUG, "Password request aborted.");
998+
return PAM_AUTHTOK_ERR;
999+
}
9741000

9751001
r = pam_get_authtok_verify(handle, &new_password, "new password: "); /* Lower case, since PAM prefixes 'Repeat' */
9761002
if (r != PAM_SUCCESS)
@@ -1025,7 +1051,7 @@ _public_ PAM_EXTERN int pam_sm_chauthtok(
10251051

10261052
r = sd_bus_call(bus, m, HOME_SLOW_BUS_CALL_TIMEOUT_USEC, &error, NULL);
10271053
if (r < 0) {
1028-
r = handle_generic_user_record_error(handle, ur->user_name, old_secret, r, &error);
1054+
r = handle_generic_user_record_error(handle, ur->user_name, old_secret, r, &error, debug);
10291055
if (r == PAM_CONV_ERR)
10301056
return pam_syslog_pam_error(handle, LOG_ERR, r,
10311057
"Failed to prompt for password/prompt.");

0 commit comments

Comments
 (0)