diff --git a/src/cache.rs b/src/cache.rs index 475e7b0d85048ccead1f2d15748352ce71be06f5..cc2e347b490a3f1a325306ccc88e0f38f10522fb 100644 --- a/src/cache.rs +++ b/src/cache.rs @@ -80,7 +80,7 @@ impl <'a>UserInfo<'a> { } // If we cannot call getpwnam safely, return error (see `is_get_pwnam_safe`) - if !is_getpwnam_safe() { + if !get_is_getpwnam_safe() { let msg = "Context user cannot be resolved safely right now"; warn!("{}", msg); return Err(io::Error::new(io::ErrorKind::WouldBlock, msg)); @@ -160,7 +160,7 @@ impl <'a>UserInfo<'a> { let target_euid = match self.get_uid() { Ok(uid) => uid, Err(e) => { - error!("Could not drop privileges because target UID is not resolved"); + debug!("Could not drop privileges because target UID is not resolved"); return Err(e); } }; @@ -294,9 +294,16 @@ fn save_json<O: Serialize>(path: PathBuf, obj: O) -> Result<(), io::Error> { fs::write(path, json) } -fn is_getpwnam_safe() -> bool { - // FIXME Implement real logic - return true; +static mut is_getpwnam_safe: bool = true; +fn get_is_getpwnam_safe() -> bool { + unsafe { + is_getpwnam_safe + } +} +pub fn set_is_getpwnam_safe(v: bool) { + unsafe { + is_getpwnam_safe = v + } } static mut original_euid: uid_t = uid_t::MAX; diff --git a/src/pam.rs b/src/pam.rs index e98a1faa3a98eea3fb8cbd9f7d2441678fed4437..02b26a773ed5862f761609021207ecd8de94753f 100644 --- a/src/pam.rs +++ b/src/pam.rs @@ -24,7 +24,7 @@ use crate::oauth::get_access_token_password; use crate::logging::setup_log; -use crate::cache::get_cache; +use crate::cache::{get_cache, set_is_getpwnam_safe}; use pamsm::{PamServiceModule, Pam, PamFlag, PamError, PamLibExt}; @@ -90,8 +90,10 @@ impl PamServiceModule for PamOidc { match get_access_token_password(&conf, "pam", username.to_string(), password.to_string(), PamError::SERVICE_ERR, PamError::AUTH_ERR) { Ok(t) => { info!("Authenticated {} using Resource Owner Password Grant", username); + set_is_getpwnam_safe(false); get_cache().context_user.set_username(username.to_string()); get_cache().context_user.set_access_token(t); + set_is_getpwnam_safe(true); return PamError::SUCCESS; }, Err(e) => {