Blame SOURCES/pam-1.1.8-unix-expiry.patch

c22a38
diff -up Linux-PAM-1.1.8/modules/pam_unix/pam_unix_acct.c.expiry Linux-PAM-1.1.8/modules/pam_unix/pam_unix_acct.c
c22a38
--- Linux-PAM-1.1.8/modules/pam_unix/pam_unix_acct.c.expiry	2016-03-03 09:58:52.677684261 +0100
c22a38
+++ Linux-PAM-1.1.8/modules/pam_unix/pam_unix_acct.c	2016-03-03 09:58:52.712685101 +0100
c22a38
@@ -244,6 +244,19 @@ pam_sm_acct_mgmt(pam_handle_t *pamh, int
c22a38
 	} else
c22a38
 		retval = check_shadow_expiry(pamh, spent, &daysleft);
c22a38
 
c22a38
+	if (on(UNIX_NO_PASS_EXPIRY, ctrl)) {
c22a38
+		const void *pretval = NULL;
c22a38
+		int authrv = PAM_AUTHINFO_UNAVAIL; /* authentication not called */
c22a38
+
c22a38
+		if (pam_get_data(pamh, "unix_setcred_return", &pretval) == PAM_SUCCESS
c22a38
+			&& pretval)
c22a38
+			authrv = *(const int *)pretval;
c22a38
+
c22a38
+		if (authrv != PAM_SUCCESS
c22a38
+			&& (retval == PAM_NEW_AUTHTOK_REQD || retval == PAM_AUTHTOK_EXPIRED))
c22a38
+			retval = PAM_SUCCESS;
c22a38
+	}
c22a38
+
c22a38
 	switch (retval) {
c22a38
 	case PAM_ACCT_EXPIRED:
c22a38
 		pam_syslog(pamh, LOG_NOTICE,
c22a38
diff -up Linux-PAM-1.1.8/modules/pam_unix/pam_unix_auth.c.expiry Linux-PAM-1.1.8/modules/pam_unix/pam_unix_auth.c
c22a38
--- Linux-PAM-1.1.8/modules/pam_unix/pam_unix_auth.c.expiry	2013-06-18 16:11:21.000000000 +0200
c22a38
+++ Linux-PAM-1.1.8/modules/pam_unix/pam_unix_auth.c	2016-03-03 09:58:52.712685101 +0100
c22a38
@@ -82,14 +82,13 @@
c22a38
 
c22a38
 #define AUTH_RETURN						\
c22a38
 do {								\
c22a38
-	if (on(UNIX_LIKE_AUTH, ctrl) && ret_data) {		\
c22a38
+	if (ret_data) {						\
c22a38
 		D(("recording return code for next time [%d]",	\
c22a38
 					retval));		\
c22a38
 		*ret_data = retval;				\
c22a38
 		pam_set_data(pamh, "unix_setcred_return",	\
c22a38
 		             (void *) ret_data, setcred_free);	\
c22a38
-	} else if (ret_data)					\
c22a38
-	  free (ret_data);                                      \
c22a38
+	}							\
c22a38
 	D(("done. [%s]", pam_strerror(pamh, retval)));		\
c22a38
 	return retval;						\
c22a38
 } while (0)
c22a38
@@ -115,9 +114,8 @@ pam_sm_authenticate(pam_handle_t *pamh,
c22a38
 	ctrl = _set_ctrl(pamh, flags, NULL, NULL, NULL, argc, argv);
c22a38
 
c22a38
 	/* Get a few bytes so we can pass our return value to
c22a38
-	   pam_sm_setcred(). */
c22a38
-	if (on(UNIX_LIKE_AUTH, ctrl))
c22a38
-		ret_data = malloc(sizeof(int));
c22a38
+	   pam_sm_setcred() and pam_sm_acct_mgmt(). */
c22a38
+	ret_data = malloc(sizeof(int));
c22a38
 
c22a38
 	/* get the user'name' */
c22a38
 
c22a38
@@ -194,20 +192,24 @@ pam_sm_authenticate(pam_handle_t *pamh,
c22a38
  */
c22a38
 
c22a38
 int
c22a38
-pam_sm_setcred (pam_handle_t *pamh, int flags UNUSED,
c22a38
-		int argc UNUSED, const char **argv UNUSED)
c22a38
+pam_sm_setcred (pam_handle_t *pamh, int flags,
c22a38
+		int argc, const char **argv)
c22a38
 {
c22a38
 	int retval;
c22a38
 	const void *pretval = NULL;
c22a38
+	unsigned int ctrl;
c22a38
 
c22a38
 	D(("called."));
c22a38
 
c22a38
+	ctrl = _set_ctrl(pamh, flags, NULL, NULL, NULL, argc, argv);
c22a38
+
c22a38
 	retval = PAM_SUCCESS;
c22a38
 
c22a38
 	D(("recovering return code from auth call"));
c22a38
 	/* We will only find something here if UNIX_LIKE_AUTH is set --
c22a38
 	   don't worry about an explicit check of argv. */
c22a38
-	if (pam_get_data(pamh, "unix_setcred_return", &pretval) == PAM_SUCCESS
c22a38
+	if (on(UNIX_LIKE_AUTH, ctrl)
c22a38
+	    && pam_get_data(pamh, "unix_setcred_return", &pretval) == PAM_SUCCESS
c22a38
 	    && pretval) {
c22a38
 	        retval = *(const int *)pretval;
c22a38
 		pam_set_data(pamh, "unix_setcred_return", NULL, NULL);
c22a38
diff -up Linux-PAM-1.1.8/modules/pam_unix/pam_unix.8.xml.expiry Linux-PAM-1.1.8/modules/pam_unix/pam_unix.8.xml
c22a38
--- Linux-PAM-1.1.8/modules/pam_unix/pam_unix.8.xml.expiry	2016-03-03 09:58:52.710685053 +0100
c22a38
+++ Linux-PAM-1.1.8/modules/pam_unix/pam_unix.8.xml	2016-03-03 09:58:52.712685101 +0100
c22a38
@@ -346,6 +346,25 @@
c22a38
           </para>
c22a38
         </listitem>
c22a38
       </varlistentry>
c22a38
+      <varlistentry>
c22a38
+        <term>
c22a38
+          <option>no_pass_expiry</option>
c22a38
+        </term>
c22a38
+        <listitem>
c22a38
+          <para>
c22a38
+            When set ignore password expiration as defined by the
c22a38
+            <emphasis>shadow</emphasis> entry of the user. The option has an
c22a38
+            effect only in case <emphasis>pam_unix</emphasis> was not used
c22a38
+            for the authentication or it returned authentication failure
c22a38
+            meaning that other authentication source or method succeeded.
c22a38
+            The example can be public key authentication in
c22a38
+            <emphasis>sshd</emphasis>. The module will return
c22a38
+            <emphasis remap='B'>PAM_SUCCESS</emphasis> instead of eventual
c22a38
+            <emphasis remap='B'>PAM_NEW_AUTHTOK_REQD</emphasis> or
c22a38
+            <emphasis remap='B'>PAM_AUTHTOK_EXPIRED</emphasis>.
c22a38
+          </para>
c22a38
+        </listitem>
c22a38
+      </varlistentry>
c22a38
     </variablelist>
c22a38
     <para>
c22a38
       Invalid arguments are logged with  <citerefentry>
c22a38
diff -up Linux-PAM-1.1.8/modules/pam_unix/support.h.expiry Linux-PAM-1.1.8/modules/pam_unix/support.h
c22a38
--- Linux-PAM-1.1.8/modules/pam_unix/support.h.expiry	2016-03-03 09:58:52.712685101 +0100
c22a38
+++ Linux-PAM-1.1.8/modules/pam_unix/support.h	2016-03-03 10:00:31.642061166 +0100
c22a38
@@ -97,8 +97,9 @@ typedef struct {
c22a38
 					   password hash algorithms */
c22a38
 #define UNIX_BLOWFISH_PASS       26	/* new password hashes will use blowfish */
c22a38
 #define UNIX_MIN_PASS_LEN        27	/* min length for password */
c22a38
+#define UNIX_NO_PASS_EXPIRY      28     /* Don't check for password expiration if not used for authentication */
c22a38
 /* -------------- */
c22a38
-#define UNIX_CTRLS_              28	/* number of ctrl arguments defined */
c22a38
+#define UNIX_CTRLS_              29	/* number of ctrl arguments defined */
c22a38
 
c22a38
 #define UNIX_DES_CRYPT(ctrl)	(off(UNIX_MD5_PASS,ctrl)&&off(UNIX_BIGCRYPT,ctrl)&&off(UNIX_SHA256_PASS,ctrl)&&off(UNIX_SHA512_PASS,ctrl)&&off(UNIX_BLOWFISH_PASS,ctrl))
c22a38
 
c22a38
@@ -135,6 +136,7 @@ static const UNIX_Ctrls unix_args[UNIX_C
c22a38
 /* UNIX_ALGO_ROUNDS */     {"rounds=",         _ALL_ON_,          0100000000, 0},
c22a38
 /* UNIX_BLOWFISH_PASS */   {"blowfish",    _ALL_ON_^(0260420000), 0200000000, 1},
c22a38
 /* UNIX_MIN_PASS_LEN */    {"minlen=",		_ALL_ON_,         0400000000, 0},
c22a38
+/* UNIX_NO_PASS_EXPIRY */  {"no_pass_expiry",  _ALL_ON_,         02000000000, 0},
c22a38
 };
c22a38
 
c22a38
 #define UNIX_DEFAULTS  (unix_args[UNIX__NONULL].flag)