Changeset 41

Timestamp:

05/05/08 11:12:03 (7 months ago)

Author:

ludovic.rousseau

Message:

- Use pam_syslog() instead of syslog() if available
- Do not call openlog()/closelog()

Correct Debian bug #472986.

Patch adapted from the one provided by Eric Dorland because
security/pam_ext.h is not available in "old" versions of libpam0g-dev
http://www.opensc-project.org/pipermail/opensc-devel/2008-April/011109.html

Location:

trunk

Files:

• configure.ac (modified) (1 diff)
• src/pam_p11.c (modified) (21 diffs)

trunk/configure.ac

@@ -21 +21 @@
 # Checks for header files.
 AC_HEADER_STDC
-AC_CHECK_HEADERS([string.h syslog.h fcntl.h unistd.h])
+AC_CHECK_HEADERS([string.h syslog.h fcntl.h unistd.h security/pam_ext.h])
 
 # Checks for typedefs, structures, and compiler characteristics.

trunk/src/pam_p11.c

@@ -32 +32 @@
 #include <security/pam_appl.h>
 #include <security/pam_modules.h>
+#ifdef HAVE_SECURITY_PAM_EXT_H
+#include <security/pam_ext.h>
+#else
+#define pam_syslog(handle, level, msg...) syslog(level, ## msg)
+#endif
 
 #ifndef PAM_EXTERN
@@ -88 +93 @@
         unsigned siglen;
 
-        /* open log */
-        openlog(LOGNAME, LOG_CONS | LOG_PID, LOG_AUTHPRIV);
-
         /* check parameters */
         if (argc != 1) {
-                syslog(LOG_ERR, "need pkcs11 module as argument");
+                pam_syslog(pamh, LOG_ERR, "need pkcs11 module as argument");
                 return PAM_ABORT;
         }
@@ -106 +108 @@
         rv = pam_get_user(pamh, &user, NULL);
         if (rv != PAM_SUCCESS) {
-                syslog(LOG_ERR, "pam_get_user() failed %s",
+                pam_syslog(pamh, LOG_ERR, "pam_get_user() failed %s",
                        pam_strerror(pamh, rv));
                 return PAM_USER_UNKNOWN;
@@ -114 +116 @@
         rv = PKCS11_CTX_load(ctx, argv[0]);
         if (rv) {
-                syslog(LOG_ERR, "loading pkcs11 engine failed");
+                pam_syslog(pamh, LOG_ERR, "loading pkcs11 engine failed");
                 return PAM_AUTHINFO_UNAVAIL;
         }
@@ -121 +123 @@
         rv = PKCS11_enumerate_slots(ctx, &slots, &nslots);
         if (rv) {
-                syslog(LOG_ERR, "listing slots failed");
+                pam_syslog(pamh, LOG_ERR, "listing slots failed");
                 return PAM_AUTHINFO_UNAVAIL;
         }
@@ -128 +130 @@
         slot = PKCS11_find_token(ctx, slots, nslots);
         if (!slot || !slot->token) {
-                syslog(LOG_ERR, "no token available");
+                pam_syslog(pamh, LOG_ERR, "no token available");
                 rv = PAM_AUTHINFO_UNAVAIL;
                 goto out;
@@ -136 +138 @@
         rv = PKCS11_enumerate_certs(slot->token, &certs, &ncerts);
         if (rv) {
-                syslog(LOG_ERR, "PKCS11_enumerate_certs failed");
+                pam_syslog(pamh, LOG_ERR, "PKCS11_enumerate_certs failed");
                 rv = PAM_AUTHINFO_UNAVAIL;
                 goto out;
         }
         if (ncerts <= 0) {
-                syslog(LOG_ERR, "no certificates found");
+                pam_syslog(pamh, LOG_ERR, "no certificates found");
                 rv = PAM_AUTHINFO_UNAVAIL;
                 goto out;
@@ -153 +155 @@
                         rv = match_user(authcert->x509, user);
                         if (rv < 0) {
-                                syslog(LOG_ERR, "match_user() failed");
+                                pam_syslog(pamh, LOG_ERR, "match_user() failed");
                                 rv = PAM_AUTHINFO_UNAVAIL;
                                 goto out;
@@ -166 +168 @@
 
         if (!authcert) {
-                syslog(LOG_ERR, "not matching certificate found");
+                pam_syslog(pamh, LOG_ERR, "not matching certificate found");
                 rv = PAM_AUTHINFO_UNAVAIL;
                 goto out;
@@ -219 +221 @@
         free(password);
         if (rv != 0) {
-                syslog(LOG_ERR, "PKCS11_login failed");
+                pam_syslog(pamh, LOG_ERR, "PKCS11_login failed");
                 rv = PAM_AUTHINFO_UNAVAIL;
                 goto out;
@@ -228 +230 @@
         fd = open(RANDOM_SOURCE, O_RDONLY);
         if (fd < 0) {
-                syslog(LOG_ERR, "fatal: cannot open RANDOM_SOURCE: ");
+                pam_syslog(pamh, LOG_ERR, "fatal: cannot open RANDOM_SOURCE: ");
                 rv = PAM_AUTHINFO_UNAVAIL;
                 goto out;
@@ -235 +237 @@
         rv = read(fd, rand_bytes, RANDOM_SIZE);
         if (rv < 0) {
-                syslog(LOG_ERR, "fatal: read from random source failed: ");
+                pam_syslog(pamh, LOG_ERR, "fatal: read from random source failed: ");
                 close(fd);
                 rv = PAM_AUTHINFO_UNAVAIL;
@@ -242 +244 @@
 
         if (rv < RANDOM_SIZE) {
-                syslog(LOG_ERR, "fatal: read returned less than %d<%d bytes\n",
+                pam_syslog(pamh, LOG_ERR, "fatal: read returned less than %d<%d bytes\n",
                        rv, RANDOM_SIZE);
                 close(fd);
@@ -253 +255 @@
         authkey = PKCS11_find_key(authcert);
         if (!authkey) {
-                syslog(LOG_ERR, "no key matching certificate available");
+                pam_syslog(pamh, LOG_ERR, "no key matching certificate available");
                 rv = PAM_AUTHINFO_UNAVAIL;
                 goto out;
@@ -263 +265 @@
                          authkey);
         if (rv != 1) {
-                syslog(LOG_ERR, "fatal: pkcs11_sign failed\n");
+                pam_syslog(pamh, LOG_ERR, "fatal: pkcs11_sign failed\n");
                 rv = PAM_AUTHINFO_UNAVAIL;
                 goto out;
@@ -271 +273 @@
         pubkey = X509_get_pubkey(authcert->x509);
         if (pubkey == NULL) {
-                syslog(LOG_ERR, "could not extract public key");
+                pam_syslog(pamh, LOG_ERR, "could not extract public key");
                 rv = PAM_AUTHINFO_UNAVAIL;
                 goto out;
@@ -280 +282 @@
                         signature, siglen, pubkey->pkey.rsa);
         if (rv != 1) {
-                syslog(LOG_ERR, "fatal: RSA_verify failed\n");
+                pam_syslog(pamh, LOG_ERR, "fatal: RSA_verify failed\n");
                 rv = PAM_AUTHINFO_UNAVAIL;
                 goto out;
@@ -304 +306 @@
                                 const char **argv)
 {
-        openlog(LOGNAME, LOG_CONS | LOG_PID, LOG_AUTHPRIV);
-        syslog(LOG_WARNING,
+        pam_syslog(pamh, LOG_WARNING,
                "Function pam_sm_acct_mgmt() is not implemented in this module");
-        closelog();
         return PAM_SERVICE_ERR;
 }
@@ -314 +314 @@
                                    const char **argv)
 {
-        openlog(LOGNAME, LOG_CONS | LOG_PID, LOG_AUTHPRIV);
-        syslog(LOG_WARNING,
+        pam_syslog(pamh, LOG_WARNING,
                "Function pam_sm_open_session() is not implemented in this module");
-        closelog();
         return PAM_SERVICE_ERR;
 }
@@ -324 +322 @@
                                     const char **argv)
 {
-        openlog(LOGNAME, LOG_CONS | LOG_PID, LOG_AUTHPRIV);
-        syslog(LOG_WARNING,
+        pam_syslog(pamh, LOG_WARNING,
                "Function pam_sm_close_session() is not implemented in this module");
-        closelog();
         return PAM_SERVICE_ERR;
 }
@@ -334 +330 @@
                                 const char **argv)
 {
-        openlog(LOGNAME, LOG_CONS | LOG_PID, LOG_AUTHPRIV);
-        syslog(LOG_WARNING,
+        pam_syslog(pamh, LOG_WARNING,
                "Function pam_sm_chauthtok() is not implemented in this module");
-        closelog();
         return PAM_SERVICE_ERR;
 }