From 65e2c78fcbd638c95f5c84c4a83f576623cb1e3a Mon Sep 17 00:00:00 2001 From: Ralf Haferkamp Date: Fri, 12 Mar 2010 14:37:33 +0100 Subject: Prompt for old password even when running as root When changing an expired password (during e.g. login) the PAM module needs to prompt for the old password even when running as root. --- src/sss_client/pam_sss.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/sss_client/pam_sss.c b/src/sss_client/pam_sss.c index d62e9485c..2ba6f158e 100644 --- a/src/sss_client/pam_sss.c +++ b/src/sss_client/pam_sss.c @@ -979,11 +979,13 @@ static int get_authtok_for_password_change(pam_handle_t *pamh, int pam_flags) { int ret; - + int *exp_data = NULL; + pam_get_data(pamh, PWEXP_FLAG, (const void **) &exp_data); + /* we query for the old password during PAM_PRELIM_CHECK to make * pam_sss work e.g. with pam_cracklib */ if (pam_flags & PAM_PRELIM_CHECK) { - if (getuid() != 0 && !(flags & FLAGS_USE_FIRST_PASS)) { + if ( (getuid() != 0 || exp_data ) && !(flags & FLAGS_USE_FIRST_PASS)) { ret = prompt_password(pamh, pi, _("Current Password: ")); if (ret != PAM_SUCCESS) { D(("failed to get password from user")); -- cgit