Sync with P4. Most of this is debugging code; the only substantial changes

are improvements to openpam_{borrow,restore}_cred() (#24779 and #24780).

10 files changed, 77 insertions, 29 deletions

diff --git a/contrib/openpam/lib/openpam_borrow_cred.c b/contrib/openpam/lib/openpam_borrow_cred.c
index ef1a85079ec9..8a8c4580db0d 100644
--- a/contrib/openpam/lib/openpam_borrow_cred.c
+++ b/contrib/openpam/lib/openpam_borrow_cred.c
@@ -31,7 +31,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $P4: //depot/projects/openpam/lib/openpam_borrow_cred.c#3 $
+ * $P4: //depot/projects/openpam/lib/openpam_borrow_cred.c#4 $
  */
 
 #include <sys/param.h>
@@ -57,9 +57,18 @@ openpam_borrow_cred(pam_handle_t *pamh,
 	struct pam_saved_cred *scred;
 	int r;
 
-	ENTER();
-	if (geteuid() != 0)
+	ENTERI(pwd->pw_uid);
+	r = pam_get_data(pamh, PAM_SAVED_CRED, (const void **)&scred);
+	if (r == PAM_SUCCESS && scred != NULL) {
+		openpam_log(PAM_LOG_DEBUG,
+		    "already operating under borrowed credentials");
+		RETURNC(PAM_SYSTEM_ERR);
+	}
+	if (geteuid() != 0 && geteuid() != pwd->pw_uid) {
+		openpam_log(PAM_LOG_DEBUG, "called with non-zero euid: %d",
+		    (int)geteuid());
 		RETURNC(PAM_PERM_DENIED);
+	}
 	scred = calloc(1, sizeof *scred);
 	if (scred == NULL)
 		RETURNC(PAM_BUF_ERR);
@@ -76,6 +85,8 @@ openpam_borrow_cred(pam_handle_t *pamh,
 		free(scred);
 		RETURNC(r);
 	}
+	if (geteuid() == pwd->pw_uid)
+		RETURNC(PAM_SUCCESS);
 	if (initgroups(pwd->pw_name, pwd->pw_gid) == -1 ||
 	      setegid(pwd->pw_gid) == -1 || seteuid(pwd->pw_uid) == -1) {
 		openpam_restore_cred(pamh);
diff --git a/contrib/openpam/lib/openpam_findenv.c b/contrib/openpam/lib/openpam_findenv.c
index 2dba88a5b393..63d81dd2ca96 100644
--- a/contrib/openpam/lib/openpam_findenv.c
+++ b/contrib/openpam/lib/openpam_findenv.c
@@ -31,7 +31,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $P4: //depot/projects/openpam/lib/openpam_findenv.c#9 $
+ * $P4: //depot/projects/openpam/lib/openpam_findenv.c#10 $
  */
 
 #include <string.h>
@@ -55,12 +55,12 @@ openpam_findenv(pam_handle_t *pamh,
 
 	ENTER();
 	if (pamh == NULL)
-		RETURNI(-1);
+		RETURNN(-1);
 	for (i = 0; i < pamh->env_count; ++i)
 		if (strncmp(pamh->env[i], name, len) == 0 &&
 		    pamh->env[i][len] == '=')
-			RETURNI(i);
-	RETURNI(-1);
+			RETURNN(i);
+	RETURNN(-1);
 }
 
 /*
diff --git a/contrib/openpam/lib/openpam_get_option.c b/contrib/openpam/lib/openpam_get_option.c
index d3993eadee31..90020d269069 100644
--- a/contrib/openpam/lib/openpam_get_option.c
+++ b/contrib/openpam/lib/openpam_get_option.c
@@ -31,7 +31,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $P4: //depot/projects/openpam/lib/openpam_get_option.c#5 $
+ * $P4: //depot/projects/openpam/lib/openpam_get_option.c#6 $
  */
 
 #include <sys/param.h>
@@ -57,7 +57,7 @@ openpam_get_option(pam_handle_t *pamh,
 	size_t len;
 	int i;
 
-	ENTER();
+	ENTERS(option);
 	if (pamh == NULL || pamh->current == NULL || option == NULL)
 		RETURNS(NULL);
 	cur = pamh->current;
diff --git a/contrib/openpam/lib/openpam_impl.h b/contrib/openpam/lib/openpam_impl.h
index 87818b660aa9..0ab2811fe3b8 100644
--- a/contrib/openpam/lib/openpam_impl.h
+++ b/contrib/openpam/lib/openpam_impl.h
@@ -31,7 +31,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $P4: //depot/projects/openpam/lib/openpam_impl.h#19 $
+ * $P4: //depot/projects/openpam/lib/openpam_impl.h#20 $
  */
 
 #ifndef _OPENPAM_IMPL_H_INCLUDED
@@ -42,6 +42,7 @@
 extern const char *_pam_func_name[PAM_NUM_PRIMITIVES];
 extern const char *_pam_sm_func_name[PAM_NUM_PRIMITIVES];
 extern const char *_pam_err_name[PAM_NUM_ERRORS];
+extern const char *_pam_item_name[PAM_NUM_ITEMS];
 
 /*
  * Control flags
@@ -123,6 +124,21 @@ pam_module_t   *openpam_dynamic(const char *);
 
 #ifdef DEBUG
 #define ENTER() openpam_log(PAM_LOG_DEBUG, "entering")
+#define ENTERI(i) do { \
+	if ((i) > 0 && (i) < PAM_NUM_ITEMS) \
+		openpam_log(PAM_LOG_DEBUG, "entering: %s", _pam_item_name[i]); \
+	else \
+		openpam_log(PAM_LOG_DEBUG, "entering: %d", (i)); \
+} while (0);
+#define ENTERN(n) do { \
+	openpam_log(PAM_LOG_DEBUG, "entering: %d", (n)); \
+} while (0);
+#define ENTERS(s) do { \
+	if ((s) == NULL) \
+		openpam_log(PAM_LOG_DEBUG, "entering: NULL"); \
+	else \
+		openpam_log(PAM_LOG_DEBUG, "entering: '%s'", (s)); \
+} while (0);
 #define	RETURNV() openpam_log(PAM_LOG_DEBUG, "returning")
 #define RETURNC(c) do { \
 	if ((c) >= 0 && (c) < PAM_NUM_ERRORS) \
@@ -131,9 +147,9 @@ pam_module_t   *openpam_dynamic(const char *);
 		openpam_log(PAM_LOG_DEBUG, "returning %d!", (c)); \
 	return (c); \
 } while (0)
-#define	RETURNI(i) do { \
-	openpam_log(PAM_LOG_DEBUG, "returning %d", (i)); \
-	return (i); \
+#define	RETURNN(n) do { \
+	openpam_log(PAM_LOG_DEBUG, "returning %d", (n)); \
+	return (n); \
 } while (0)
 #define	RETURNP(p) do { \
 	if ((p) == NULL) \
@@ -151,9 +167,12 @@ pam_module_t   *openpam_dynamic(const char *);
 } while (0)
 #else
 #define ENTER()
+#define ENTERI(i)
+#define ENTERN(n)
+#define ENTERS(s)
 #define RETURNV() return
 #define RETURNC(c) return (c)
-#define RETURNI(i) return (i)
+#define RETURNN(n) return (n)
 #define RETURNP(p) return (p)
 #define RETURNS(s) return (s)
 #endif
diff --git a/contrib/openpam/lib/openpam_restore_cred.c b/contrib/openpam/lib/openpam_restore_cred.c
index 75ebe5efc7e3..d18f78f59aab 100644
--- a/contrib/openpam/lib/openpam_restore_cred.c
+++ b/contrib/openpam/lib/openpam_restore_cred.c
@@ -31,7 +31,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $P4: //depot/projects/openpam/lib/openpam_restore_cred.c#3 $
+ * $P4: //depot/projects/openpam/lib/openpam_restore_cred.c#4 $
  */
 
 #include <sys/param.h>
@@ -62,10 +62,12 @@ openpam_restore_cred(pam_handle_t *pamh)
 		RETURNC(r);
 	if (scred == NULL)
 		RETURNC(PAM_SYSTEM_ERR);
-	if (seteuid(scred->euid) == -1 ||
-	    setgroups(scred->ngroups, scred->groups) == -1 ||
-	    setegid(scred->egid) == -1)
-		RETURNC(PAM_SYSTEM_ERR);
+	if (scred->euid != geteuid()) {
+		if (seteuid(scred->euid) == -1 ||
+		    setgroups(scred->ngroups, scred->groups) == -1 ||
+		    setegid(scred->egid) == -1)
+			RETURNC(PAM_SYSTEM_ERR);
+	}
 	pam_set_data(pamh, PAM_SAVED_CRED, NULL, NULL);
 	RETURNC(PAM_SUCCESS);
 }
diff --git a/contrib/openpam/lib/openpam_set_option.c b/contrib/openpam/lib/openpam_set_option.c
index f65733b7fc64..d981398b5b6b 100644
--- a/contrib/openpam/lib/openpam_set_option.c
+++ b/contrib/openpam/lib/openpam_set_option.c
@@ -31,7 +31,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $P4: //depot/projects/openpam/lib/openpam_set_option.c#6 $
+ * $P4: //depot/projects/openpam/lib/openpam_set_option.c#7 $
  */
 
 #include <sys/param.h>
@@ -61,7 +61,7 @@ openpam_set_option(pam_handle_t *pamh,
 	size_t len;
 	int i;
 
-	ENTER();
+	ENTERS(option);
 	if (pamh == NULL || pamh->current == NULL || option == NULL)
 		RETURNC(PAM_SYSTEM_ERR);
 	cur = pamh->current;
diff --git a/contrib/openpam/lib/pam_get_data.c b/contrib/openpam/lib/pam_get_data.c
index 96038ca82560..63de926a7467 100644
--- a/contrib/openpam/lib/pam_get_data.c
+++ b/contrib/openpam/lib/pam_get_data.c
@@ -31,7 +31,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $P4: //depot/projects/openpam/lib/pam_get_data.c#9 $
+ * $P4: //depot/projects/openpam/lib/pam_get_data.c#10 $
  */
 
 #include <string.h>
@@ -54,7 +54,7 @@ pam_get_data(pam_handle_t *pamh,
 {
 	pam_data_t *dp;
 
-	ENTER();
+	ENTERS(module_data_name);
 	if (pamh == NULL)
 		RETURNC(PAM_SYSTEM_ERR);
 	for (dp = pamh->module_data; dp != NULL; dp = dp->next)
diff --git a/contrib/openpam/lib/pam_get_item.c b/contrib/openpam/lib/pam_get_item.c
index f3e8c9b4144e..fa63d3e526a7 100644
--- a/contrib/openpam/lib/pam_get_item.c
+++ b/contrib/openpam/lib/pam_get_item.c
@@ -31,7 +31,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $P4: //depot/projects/openpam/lib/pam_get_item.c#14 $
+ * $P4: //depot/projects/openpam/lib/pam_get_item.c#15 $
  */
 
 #include <sys/param.h>
@@ -40,6 +40,22 @@
 
 #include "openpam_impl.h"
 
+const char *_pam_item_name[PAM_NUM_ITEMS] = {
+	"(NO ITEM)",
+	"PAM_SERVICE",
+	"PAM_USER",
+	"PAM_TTY",
+	"PAM_RHOST",
+	"PAM_CONV",
+	"PAM_AUTHTOK",
+	"PAM_OLDAUTHTOK",
+	"PAM_RUSER",
+	"PAM_USER_PROMPT",
+	"PAM_REPOSITORY",
+	"PAM_AUTHTOK_PROMPT",
+	"PAM_OLDAUTHTOK_PROMPT"
+};
+
 /*
  * XSSO 4.2.1
  * XSSO 6 page 46
@@ -53,7 +69,7 @@ pam_get_item(pam_handle_t *pamh,
 	const void **item)
 {
 
-	ENTER();
+	ENTERI(item_type);
 	if (pamh == NULL)
 		RETURNC(PAM_SYSTEM_ERR);
 	switch (item_type) {
diff --git a/contrib/openpam/lib/pam_set_data.c b/contrib/openpam/lib/pam_set_data.c
index c944e0f46378..5428bb120c47 100644
--- a/contrib/openpam/lib/pam_set_data.c
+++ b/contrib/openpam/lib/pam_set_data.c
@@ -31,7 +31,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $P4: //depot/projects/openpam/lib/pam_set_data.c#11 $
+ * $P4: //depot/projects/openpam/lib/pam_set_data.c#12 $
  */
 
 #include <stdlib.h>
@@ -58,7 +58,7 @@ pam_set_data(pam_handle_t *pamh,
 {
 	pam_data_t *dp;
 
-	ENTER();
+	ENTERS(module_data_name);
 	if (pamh == NULL)
 		RETURNC(PAM_SYSTEM_ERR);
 	for (dp = pamh->module_data; dp != NULL; dp = dp->next) {
diff --git a/contrib/openpam/lib/pam_set_item.c b/contrib/openpam/lib/pam_set_item.c
index 42653b165245..250d287b6412 100644
--- a/contrib/openpam/lib/pam_set_item.c
+++ b/contrib/openpam/lib/pam_set_item.c
@@ -31,7 +31,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $P4: //depot/projects/openpam/lib/pam_set_item.c#16 $
+ * $P4: //depot/projects/openpam/lib/pam_set_item.c#17 $
  */
 
 #include <sys/param.h>
@@ -58,7 +58,7 @@ pam_set_item(pam_handle_t *pamh,
 	void **slot, *tmp;
 	size_t nsize, osize;
 
-	ENTER();
+	ENTERI(item_type);
 	if (pamh == NULL)
 		RETURNC(PAM_SYSTEM_ERR);
 	slot = &pamh->item[item_type];