openbmc/build/tmp/deploy/sdk/witherspoon-2019-08-08/sysroots/armv6-openbmc-linux-gnueabi/usr/src/debug/shadow/4.6-r0/shadow-4.6/src/chsh.c
static void check_perms(const struct passwd* pw)
{
#ifdef USE_PAM
    pam_handle_t* pamh = NULL;
    int retval;
    struct passwd* pampw;
#endif

    /*
     * Non-privileged users are only allowed to change the shell if the
     * UID of the user matches the current real UID.
     */
    if (!amroot && pw->pw_uid != getuid())
    {
        SYSLOG((LOG_WARN, "can't change shell for '%s'", pw->pw_name));
        fprintf(stderr, _("You may not change the shell for '%s'.\n"),
                pw->pw_name);
        fail_exit(1);
    }

    /*
     * Non-privileged users are only allowed to change the shell if it
     * is not a restricted one.
     */
    if (!amroot && is_restricted_shell(pw->pw_shell))
    {
        SYSLOG((LOG_WARN, "can't change shell for '%s'", pw->pw_name));
        fprintf(stderr, _("You may not change the shell for '%s'.\n"),
                pw->pw_name);
        fail_exit(1);
    }
#ifdef WITH_SELINUX
    /*
     * If the UID of the user does not match the current real UID,
     * check if the change is allowed by SELinux policy.
     */
    if ((pw->pw_uid != getuid()) && (is_selinux_enabled() > 0) &&
        (selinux_check_passwd_access(PASSWD__CHSH) != 0))
    {
        SYSLOG((LOG_WARN, "can't change shell for '%s'", pw->pw_name));
        fprintf(stderr, _("You may not change the shell for '%s'.\n"),
                pw->pw_name);
        fail_exit(1);
    }
#endif

#ifndef USE_PAM
    /*
     * Non-privileged users are optionally authenticated (must enter
     * the password of the user whose information is being changed)
     * before any changes can be made. Idea from util-linux
     * chfn/chsh.  --marekm
     */
    if (!amroot && getdef_bool("CHSH_AUTH"))
    {
        passwd_check(pw->pw_name, pw->pw_passwd, "chsh");
    }

#else  /* !USE_PAM */
    pampw = getpwuid(getuid()); /* local, no need for xgetpwuid */
    if (NULL == pampw)
    {
        fprintf(stderr, _("%s: Cannot determine your user name.\n"), Prog);
        exit(E_NOPERM);
    }

    retval = pam_start("chsh", pampw->pw_name, &conv, &pamh);

    if (PAM_SUCCESS == retval)
    {
        retval = pam_authenticate(pamh, 0);
    }

    if (PAM_SUCCESS == retval)
    {
        retval = pam_acct_mgmt(pamh, 0);
    }

    if (PAM_SUCCESS != retval)
    {
        fprintf(stderr, _("%s: PAM: %s\n"), Prog, pam_strerror(pamh, retval));
        SYSLOG((LOG_ERR, "%s", pam_strerror(pamh, retval)));
        if (NULL != pamh)
        {
            (void)pam_end(pamh, retval);
        }
        exit(E_NOPERM);
    }
    (void)pam_end(pamh, retval);
#endif /* USE_PAM */
}
/*
 * check_perms - check if the caller is allowed to add a group
 *
 *	Non-root users are only allowed to change their shell, if their current
 *	shell is not a restricted shell.
 *
 *	Non-root users must be authenticated.
 *
 *	It will not return if the user is not allowed.
 */
check if the caller is allowed to add a group
Non-root users are only allowed to change their shell, if their current
shell is not a restricted shell.

Non-root users must be authenticated.

It will not return if the user is not allowed.
check if the caller is allowed to add a group Non - root users are only allowed to change their shell if their current shell is not a restricted shell . Non - root users must be authenticated . It will not return if the user is not allowed .
static void check_perms(const struct passwd* pw)
{
#ifdef USE_PAM
    pam_handle_t* pamh = NULL;
    int retval;
    struct passwd* pampw;
#endif
    if (!amroot && pw->pw_uid != getuid())
    {
        SYSLOG((LOG_WARN, "can't change shell for '%s'", pw->pw_name));
        fprintf(stderr, _("You may not change the shell for '%s'.\n"),
                pw->pw_name);
        fail_exit(1);
    }
    if (!amroot && is_restricted_shell(pw->pw_shell))
    {
        SYSLOG((LOG_WARN, "can't change shell for '%s'", pw->pw_name));
        fprintf(stderr, _("You may not change the shell for '%s'.\n"),
                pw->pw_name);
        fail_exit(1);
    }
#ifdef WITH_SELINUX
    if ((pw->pw_uid != getuid()) && (is_selinux_enabled() > 0) &&
        (selinux_check_passwd_access(PASSWD__CHSH) != 0))
    {
        SYSLOG((LOG_WARN, "can't change shell for '%s'", pw->pw_name));
        fprintf(stderr, _("You may not change the shell for '%s'.\n"),
                pw->pw_name);
        fail_exit(1);
    }
#endif
#ifndef USE_PAM
    if (!amroot && getdef_bool("CHSH_AUTH"))
    {
        passwd_check(pw->pw_name, pw->pw_passwd, "chsh");
    }
#else  
    pampw = getpwuid(getuid()); 
    if (NULL == pampw)
    {
        fprintf(stderr, _("%s: Cannot determine your user name.\n"), Prog);
        exit(E_NOPERM);
    }
    retval = pam_start("chsh", pampw->pw_name, &conv, &pamh);
    if (PAM_SUCCESS == retval)
    {
        retval = pam_authenticate(pamh, 0);
    }
    if (PAM_SUCCESS == retval)
    {
        retval = pam_acct_mgmt(pamh, 0);
    }
    if (PAM_SUCCESS != retval)
    {
        fprintf(stderr, _("%s: PAM: %s\n"), Prog, pam_strerror(pamh, retval));
        SYSLOG((LOG_ERR, "%s", pam_strerror(pamh, retval)));
        if (NULL != pamh)
        {
            (void)pam_end(pamh, retval);
        }
        exit(E_NOPERM);
    }
    (void)pam_end(pamh, retval);
#endif 
}
static void check_perms ( const struct passwd * pw ) { #ifdef USE_PAM pam_handle_t * pamh = NULL ; int retval ; struct passwd * pampw ; #endif if ( ! amroot && pw -> pw_uid != getuid ( ) ) { SYSLOG ( ( LOG_WARN , " " , pw -> pw_name ) ) ; fprintf ( stderr , _ ( " \n " ) , pw -> pw_name ) ; fail_exit ( 1 ) ; } if ( ! amroot && is_restricted_shell ( pw -> pw_shell ) ) { SYSLOG ( ( LOG_WARN , " " , pw -> pw_name ) ) ; fprintf ( stderr , _ ( " \n " ) , pw -> pw_name ) ; fail_exit ( 1 ) ; } #ifdef WITH_SELINUX if ( ( pw -> pw_uid != getuid ( ) ) && ( is_selinux_enabled ( ) > 0 ) && ( selinux_check_passwd_access ( PASSWD__CHSH ) != 0 ) ) { SYSLOG ( ( LOG_WARN , " " , pw -> pw_name ) ) ; fprintf ( stderr , _ ( " \n " ) , pw -> pw_name ) ; fail_exit ( 1 ) ; } #endif #ifndef USE_PAM if ( ! amroot && getdef_bool ( " " ) ) { passwd_check ( pw -> pw_name , pw -> pw_passwd , " " ) ; } #else pampw = getpwuid ( getuid ( ) ) ; if ( NULL == pampw ) { fprintf ( stderr , _ ( " \n " ) , Prog ) ; exit ( E_NOPERM ) ; } retval = pam_start ( " " , pampw -> pw_name , & conv , & pamh ) ; if ( PAM_SUCCESS == retval ) { retval = pam_authenticate ( pamh , 0 ) ; } if ( PAM_SUCCESS == retval ) { retval = pam_acct_mgmt ( pamh , 0 ) ; } if ( PAM_SUCCESS != retval ) { fprintf ( stderr , _ ( " \n " ) , Prog , pam_strerror ( pamh , retval ) ) ; SYSLOG ( ( LOG_ERR , " " , pam_strerror ( pamh , retval ) ) ) ; if ( NULL != pamh ) { ( void ) pam_end ( pamh , retval ) ; } exit ( E_NOPERM ) ; } ( void ) pam_end ( pamh , retval ) ; #endif }
check_perms - check if the caller is allowed to add a group
      Non-root users are only allowed to change their shell, if their current
      shell is not a restricted shell.
check_perms - check if the caller is allowed to add a group Non - root users are only allowed to change their shell if their current shell is not a restricted shell .
/*
     * Non-privileged users are only allowed to change the shell if the
     * UID of the user matches the current real UID.
     */ /*
     * Non-privileged users are only allowed to change the shell if it
     * is not a restricted one.
     */ /*
     * If the UID of the user does not match the current real UID,
     * check if the change is allowed by SELinux policy.
     */ /*
     * Non-privileged users are optionally authenticated (must enter
     * the password of the user whose information is being changed)
     * before any changes can be made. Idea from util-linux
     * chfn/chsh.  --marekm
     */ /* !USE_PAM */ /* local, no need for xgetpwuid */ /* USE_PAM */