Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove some abstraction layers in the PAM handling #1002

Open
wants to merge 5 commits into
base: main
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Hard code CLIConverser in PamContext
  • Loading branch information
bjorn3 committed Mar 3, 2025
commit 5084fa5795ce798041fa640acd8ceba9b663293e
24 changes: 7 additions & 17 deletions src/pam/mod.rs
Original file line number Diff line number Diff line change
Expand Up @@ -24,18 +24,18 @@ pub mod sys;
#[cfg(target_os = "freebsd")]
const PAM_DATA_SILENT: std::ffi::c_int = 0;

pub use converse::{CLIConverser, Converser};
pub use converse::CLIConverser;

pub struct PamContext<C: Converser> {
data_ptr: *mut ConverserData<C>,
pub struct PamContext {
data_ptr: *mut ConverserData<CLIConverser>,
pamh: *mut pam_handle_t,
silent: bool,
allow_null_auth_token: bool,
last_pam_status: Option<libc::c_int>,
session_started: bool,
}

impl PamContext<CLIConverser> {
impl PamContext {
/// Build the PamContext with the CLI conversation function.
///
/// The target user is optional and may also be set after the context was
Expand All @@ -50,24 +50,14 @@ impl PamContext<CLIConverser> {
no_interact: bool,
password_feedback: bool,
target_user: Option<&str>,
) -> PamResult<PamContext<CLIConverser>> {
) -> PamResult<PamContext> {
let converser = CLIConverser {
name: converser_name.to_owned(),
use_stdin,
no_interact,
password_feedback,
};

Self::new(converser, service_name, target_user)
}
}

impl<C: Converser> PamContext<C> {
fn new(
converser: C,
service_name: &str,
target_user: Option<&str>,
) -> PamResult<PamContext<C>> {
let c_service_name = CString::new(service_name)?;
let c_user = target_user.map(CString::new).transpose()?;
let c_user_ptr = match c_user {
Expand All @@ -89,7 +79,7 @@ impl<C: Converser> PamContext<C> {
c_service_name.as_ptr(),
c_user_ptr,
&pam_conv {
conv: Some(converse::converse::<C>),
conv: Some(converse::converse::<CLIConverser>),
appdata_ptr: data_ptr as *mut libc::c_void,
},
&mut pamh,
Expand Down Expand Up @@ -351,7 +341,7 @@ impl<C: Converser> PamContext<C> {
}
}

impl<C: Converser> Drop for PamContext<C> {
impl Drop for PamContext {
fn drop(&mut self) {
// data_ptr's pointee is de-allocated in this scope
// SAFETY: self.data_ptr was created by Box::into_raw
Expand Down
10 changes: 3 additions & 7 deletions src/su/mod.rs
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
use crate::common::error::Error;
use crate::exec::{ExecOutput, ExitReason, RunOptions};
use crate::log::user_warn;
use crate::pam::{CLIConverser, PamContext, PamError, PamErrorType};
use crate::pam::{PamContext, PamError, PamErrorType};
use crate::system::term::current_tty_name;

use std::{env, process};
Expand All @@ -21,11 +21,7 @@ mod help;
const DEFAULT_USER: &str = "root";
const VERSION: &str = env!("CARGO_PKG_VERSION");

fn authenticate(
requesting_user: &str,
user: &str,
login: bool,
) -> Result<PamContext<CLIConverser>, Error> {
fn authenticate(requesting_user: &str, user: &str, login: bool) -> Result<PamContext, Error> {
// FIXME make it configurable by the packager
let context = if login && cfg!(target_os = "linux") {
"su-l"
Expand Down Expand Up @@ -88,7 +84,7 @@ fn run(options: SuRunOptions) -> Result<(), Error> {
let context = SuContext::from_env(options)?;

// authenticate the target user
let mut pam: PamContext<CLIConverser> = authenticate(
let mut pam: PamContext = authenticate(
&context.requesting_user.name,
&context.user().name,
context.is_login(),
Expand Down
10 changes: 5 additions & 5 deletions src/sudo/pam.rs
Original file line number Diff line number Diff line change
Expand Up @@ -4,11 +4,11 @@ use crate::common::context::LaunchType;
use crate::common::resolve::AuthUser;
use crate::common::{error::Error, Context};
use crate::log::{dev_info, user_warn};
use crate::pam::{CLIConverser, Converser, PamContext, PamError, PamErrorType, PamResult};
use crate::pam::{PamContext, PamError, PamErrorType, PamResult};
use crate::system::term::current_tty_name;

pub(super) struct PamAuthenticator {
pam: Option<PamContext<CLIConverser>>,
pam: Option<PamContext>,
}

impl PamAuthenticator {
Expand Down Expand Up @@ -92,7 +92,7 @@ fn init_pam(
password_feedback: bool,
auth_user: &str,
requesting_user: &str,
) -> PamResult<PamContext<CLIConverser>> {
) -> PamResult<PamContext> {
let service_name = if is_login_shell && cfg!(feature = "pam-login") {
"sudo-i"
} else {
Expand All @@ -119,8 +119,8 @@ fn init_pam(
Ok(pam)
}

fn attempt_authenticate<C: Converser>(
pam: &mut PamContext<C>,
fn attempt_authenticate(
pam: &mut PamContext,
non_interactive: bool,
mut max_tries: u16,
) -> Result<(), Error> {
Expand Down