cookiez/pam-fprint-grosshack
1
0
Fork 0
mirror of https://gitlab.com/mishakmak/pam-fprint-grosshack.git synced 2026-04-08 20:03:34 +02:00
Code Issues Packages Projects Releases Wiki Activity

pam: Pick the device with more enrolled finger prints

Browse Source 
When multiple devices are available PAM module will just pick the first
one, even if it has not enrolled fingers.

Since this can't be user configured (yet) we can be a bit smarter and
select the device that has more fingerprints configured for the user.
This commit is contained in:
Marco Trevisan (Treviño)
2020-12-11 20:06:18 +01:00
committed by Benjamin Berg
parent 195f7eaf5f
commit fd02922608
2 changed files with 57 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

55
pam/pam_fprintd.c
View File

@ -60,6 +60,11 @@ static unsigned timeout = DEFAULT_TIMEOUT;
#define USEC_PER_SEC ((uint64_t) 1000000ULL)
#define NSEC_PER_USEC ((uint64_t) 1000ULL)
static size_t user_enrolled_prints_num (pam_handle_t *pamh,
sd_bus *bus,
const char *dev,
const char *username);
static uint64_t
now (void)
{
@ -112,11 +117,13 @@ send_err_msg (pam_handle_t *pamh, const char *msg)
static char *
open_device (pam_handle_t *pamh,
sd_bus *bus,
const char *username,
bool *has_multiple_devices)
{
pf_auto (sd_bus_error) error = SD_BUS_ERROR_NULL;
pf_autoptr (sd_bus_message) m = NULL;
size_t num_devices;
size_t max_prints;
const char *path = NULL;
const char *s;
int r;
@ -143,12 +150,23 @@ open_device (pam_handle_t *pamh,
return NULL;
}
if (sd_bus_message_read_basic (m, 'o', &path) < 0)
return NULL;
num_devices = 1;
num_devices = 0;
max_prints = 0;
while ((r = sd_bus_message_read_basic (m, 'o', &s)) > 0)
num_devices++;
{
size_t enrolled_prints = user_enrolled_prints_num (pamh, bus, s, username);
if (debug)
pam_syslog (pamh, LOG_DEBUG, "%s prints registered: %" PRIu64, s, enrolled_prints);
if (enrolled_prints > max_prints)
{
max_prints = enrolled_prints;
path = s;
}
num_devices++;
}
*has_multiple_devices = (num_devices > 1);
if (debug)
pam_syslog (pamh, LOG_DEBUG, "Using device %s (out of %ld devices)", path, num_devices);
@ -528,11 +546,11 @@ do_verify (sd_bus *bus,
return PAM_AUTH_ERR;
}
static bool
user_has_prints (pam_handle_t *pamh,
sd_bus *bus,
const char *dev,
const char *username)
static size_t
user_enrolled_prints_num (pam_handle_t *pamh,
sd_bus *bus,
const char *dev,
const char *username)
{
pf_auto (sd_bus_error) error = SD_BUS_ERROR_NULL;
pf_autoptr (sd_bus_message) m = NULL;
@ -557,21 +575,21 @@ user_has_prints (pam_handle_t *pamh,
if (debug)
pam_syslog (pamh, LOG_DEBUG, "ListEnrolledFingers failed for %s: %s",
username, error.message);
return false;
return 0;
}
r = sd_bus_message_enter_container (m, 'a', "s");
if (r < 0)
{
pam_syslog (pamh, LOG_ERR, "Failed to parse answer from ListEnrolledFingers(): %d", r);
return false;
return 0;
}
while ((r = sd_bus_message_read_basic (m, 's', &s)) > 0)
num_fingers++;
sd_bus_message_exit_container (m);
return num_fingers > 0;
return num_fingers;
}
static void
@ -651,8 +669,6 @@ name_owner_changed (sd_bus_message *m,
static int
do_auth (pam_handle_t *pamh, const char *username)
{
bool have_prints;
pf_autoptr (verify_data) data = NULL;
pf_autoptr (sd_bus) bus = NULL;
pf_autoptr (sd_bus_slot) name_owner_changed_slot = NULL;
@ -667,17 +683,10 @@ do_auth (pam_handle_t *pamh, const char *username)
return PAM_AUTHINFO_UNAVAIL;
}
data->dev = open_device (pamh, bus, &data->has_multiple_devices);
data->dev = open_device (pamh, bus, username, &data->has_multiple_devices);
if (data->dev == NULL)
return PAM_AUTHINFO_UNAVAIL;
have_prints = user_has_prints (pamh, bus, data->dev, username);
if (debug)
pam_syslog (pamh, LOG_DEBUG, "prints registered: %s\n", have_prints ? "yes" : "no");
if (!have_prints)
return PAM_AUTHINFO_UNAVAIL;
/* Only connect to NameOwnerChanged when needed. In case of automatic startup
* we rely on the fact that we never see those signals.
*/