From 0f303a2de843c31afb03b558dfb7287be79e6e17 Mon Sep 17 00:00:00 2001 From: "Todd C. Miller" Date: Thu, 26 Jul 2018 12:31:29 -0600 Subject: [PATCH] Ignore PAM_NEW_AUTHTOK_REQD and PAM_AUTHTOK_EXPIRED errors from pam_acct_mgmt() if authentication is disabled for the user. Bug #843 --- plugins/sudoers/auth/bsdauth.c | 2 +- plugins/sudoers/auth/pam.c | 10 +++++++++- plugins/sudoers/auth/sudo_auth.c | 4 ++-- plugins/sudoers/auth/sudo_auth.h | 6 +++--- plugins/sudoers/check.c | 4 +++- plugins/sudoers/sudoers.h | 2 +- 6 files changed, 19 insertions(+), 9 deletions(-) diff --git a/plugins/sudoers/auth/bsdauth.c b/plugins/sudoers/auth/bsdauth.c index 444cd337..390263d3 100644 --- a/plugins/sudoers/auth/bsdauth.c +++ b/plugins/sudoers/auth/bsdauth.c @@ -168,7 +168,7 @@ bsdauth_verify(struct passwd *pw, char *prompt, sudo_auth *auth, struct sudo_con } int -bsdauth_approval(struct passwd *pw, sudo_auth *auth) +bsdauth_approval(struct passwd *pw, sudo_auth *auth, bool exempt) { struct bsdauth_state *state = auth->data; debug_decl(bsdauth_approval, SUDOERS_DEBUG_AUTH) diff --git a/plugins/sudoers/auth/pam.c b/plugins/sudoers/auth/pam.c index 347289da..a4749448 100644 --- a/plugins/sudoers/auth/pam.c +++ b/plugins/sudoers/auth/pam.c @@ -202,7 +202,7 @@ sudo_pam_verify(struct passwd *pw, char *prompt, sudo_auth *auth, struct sudo_co } int -sudo_pam_approval(struct passwd *pw, sudo_auth *auth) +sudo_pam_approval(struct passwd *pw, sudo_auth *auth, bool exempt) { const char *s; int *pam_status = (int *) auth->data; @@ -217,6 +217,10 @@ sudo_pam_approval(struct passwd *pw, sudo_auth *auth) "is your account locked?")); debug_return_int(AUTH_FATAL); case PAM_NEW_AUTHTOK_REQD: + /* Ignore if user is exempt from password restrictions. */ + if (exempt) + debug_return_int(AUTH_SUCCESS); + /* New password required, try to change it. */ log_warningx(0, N_("Account or password is " "expired, reset your password and try again")); *pam_status = pam_chauthtok(pamh, @@ -229,6 +233,10 @@ sudo_pam_approval(struct passwd *pw, sudo_auth *auth) N_("unable to change expired password: %s"), s); debug_return_int(AUTH_FAILURE); case PAM_AUTHTOK_EXPIRED: + /* Ignore if user is exempt from password restrictions. */ + if (exempt) + debug_return_int(AUTH_SUCCESS); + /* Password expired, cannot be updated by user. */ log_warningx(0, N_("Password expired, contact your system administrator")); debug_return_int(AUTH_FATAL); diff --git a/plugins/sudoers/auth/sudo_auth.c b/plugins/sudoers/auth/sudo_auth.c index 6ef9bd72..5d9382dc 100644 --- a/plugins/sudoers/auth/sudo_auth.c +++ b/plugins/sudoers/auth/sudo_auth.c @@ -163,7 +163,7 @@ sudo_auth_init(struct passwd *pw) * Returns true on success, false on failure and -1 on error. */ int -sudo_auth_approval(struct passwd *pw, int validated) +sudo_auth_approval(struct passwd *pw, int validated, bool exempt) { sudo_auth *auth; debug_decl(sudo_auth_approval, SUDOERS_DEBUG_AUTH) @@ -171,7 +171,7 @@ sudo_auth_approval(struct passwd *pw, int validated) /* Call approval routines. */ for (auth = auth_switch; auth->name; auth++) { if (auth->approval && !IS_DISABLED(auth)) { - int status = (auth->approval)(pw, auth); + int status = (auth->approval)(pw, auth, exempt); if (status != AUTH_SUCCESS) { /* Assume error msg already printed. */ log_auth_failure(validated, 0); diff --git a/plugins/sudoers/auth/sudo_auth.h b/plugins/sudoers/auth/sudo_auth.h index ea5ed9cd..9ae69cd5 100644 --- a/plugins/sudoers/auth/sudo_auth.h +++ b/plugins/sudoers/auth/sudo_auth.h @@ -31,7 +31,7 @@ typedef struct sudo_auth { int (*init)(struct passwd *pw, struct sudo_auth *auth); int (*setup)(struct passwd *pw, char **prompt, struct sudo_auth *auth); int (*verify)(struct passwd *pw, char *p, struct sudo_auth *auth, struct sudo_conv_callback *callback); - int (*approval)(struct passwd *pw, struct sudo_auth *auth); + int (*approval)(struct passwd *pw, struct sudo_auth *auth, bool exempt); int (*cleanup)(struct passwd *pw, struct sudo_auth *auth); int (*begin_session)(struct passwd *pw, char **user_env[], struct sudo_auth *auth); int (*end_session)(struct passwd *pw, struct sudo_auth *auth); @@ -56,7 +56,7 @@ extern sudo_conv_t sudo_conv; /* Prototypes for standalone methods */ int bsdauth_init(struct passwd *pw, sudo_auth *auth); int bsdauth_verify(struct passwd *pw, char *prompt, sudo_auth *auth, struct sudo_conv_callback *callback); -int bsdauth_approval(struct passwd *pw, sudo_auth *auth); +int bsdauth_approval(struct passwd *pw, sudo_auth *auth, bool exempt); int bsdauth_cleanup(struct passwd *pw, sudo_auth *auth); int sudo_aix_init(struct passwd *pw, sudo_auth *auth); int sudo_aix_verify(struct passwd *pw, char *pass, sudo_auth *auth, struct sudo_conv_callback *callback); @@ -67,7 +67,7 @@ int sudo_fwtk_cleanup(struct passwd *pw, sudo_auth *auth); int sudo_pam_init(struct passwd *pw, sudo_auth *auth); int sudo_pam_init_quiet(struct passwd *pw, sudo_auth *auth); int sudo_pam_verify(struct passwd *pw, char *prompt, sudo_auth *auth, struct sudo_conv_callback *callback); -int sudo_pam_approval(struct passwd *pw, sudo_auth *auth); +int sudo_pam_approval(struct passwd *pw, sudo_auth *auth, bool exempt); int sudo_pam_cleanup(struct passwd *pw, sudo_auth *auth); int sudo_pam_begin_session(struct passwd *pw, char **user_env[], sudo_auth *auth); int sudo_pam_end_session(struct passwd *pw, sudo_auth *auth); diff --git a/plugins/sudoers/check.c b/plugins/sudoers/check.c index ed49d63a..486a80d8 100644 --- a/plugins/sudoers/check.c +++ b/plugins/sudoers/check.c @@ -175,6 +175,7 @@ check_user(int validated, int mode) { struct passwd *auth_pw; int ret = -1; + bool exempt = false; debug_decl(check_user, SUDOERS_DEBUG_AUTH) /* @@ -194,6 +195,7 @@ check_user(int validated, int mode) sudo_debug_printf(SUDO_DEBUG_INFO, "%s: %s", __func__, !def_authenticate ? "authentication disabled" : "user exempt from authentication"); + exempt = true; ret = true; goto done; } @@ -218,7 +220,7 @@ check_user(int validated, int mode) done: if (ret == true) { /* The approval function may disallow a user post-authentication. */ - ret = sudo_auth_approval(auth_pw, validated); + ret = sudo_auth_approval(auth_pw, validated, exempt); } sudo_auth_cleanup(auth_pw); sudo_pw_delref(auth_pw); diff --git a/plugins/sudoers/sudoers.h b/plugins/sudoers/sudoers.h index 57db74c1..956cb084 100644 --- a/plugins/sudoers/sudoers.h +++ b/plugins/sudoers/sudoers.h @@ -265,7 +265,7 @@ int verify_user(struct passwd *pw, char *prompt, int validated, struct sudo_conv int sudo_auth_begin_session(struct passwd *pw, char **user_env[]); int sudo_auth_end_session(struct passwd *pw); int sudo_auth_init(struct passwd *pw); -int sudo_auth_approval(struct passwd *pw, int validated); +int sudo_auth_approval(struct passwd *pw, int validated, bool exempt); int sudo_auth_cleanup(struct passwd *pw); /* set_perms.c */ -- 2.13.6