[FEAT] Add experimental support for writing PAM modules

CHANGELOG.md

@@ -16,6 +16,7 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 - Add Cargo features for `auth` (default) and `module`
 - Add internal `pam-macros` crate (experimental for now)
 - Reexport `pam_sys` at crate root
+- Add experimental support for modules via `PamModule` trait and `impl_pam_module` macro
 
 ### Changed
 - Change `Authenticator::get_handler` to `Authenticator::handler_mut` and add `Authenticator::handler` for immutable access to the handler

Cargo.toml

@@ -23,10 +23,16 @@ auth = ["users"]
 module = []
 
 [dependencies]
-pam-macros = "=0.0.1"
+pam-macros = "=0.0.2"
 libc    = "^0.2"
 pam-sys = "1.0.0-alpha2"
 users   = { version = "^0.9", optional = true }
 
 [dev-dependencies]
 rpassword = "2.0"
+
+[workspace]
+members = [
+    ".",
+    "macros"
+]

src/auth.rs

@@ -47,7 +47,7 @@ impl<'a> Authenticator<'a, conv::PasswordConv> {
 }
 
 impl<'a, C: conv::Conversation> Authenticator<'a, C> {
-    /// Creates a new Authenticator with a given service name and conversation callback
+    /// Create a new Authenticator with a given service name and conversation callback
     pub fn with_handler(service: &str, conversation: C) -> PamResult<Authenticator<'a, C>> {
         let mut conversation = Box::new(conversation);
         let conv = conv::into_pam_conv(&mut *conversation);

src/enums.rs

@@ -86,7 +86,7 @@ pub enum PamReturnCode {
     Try_Again,
 
     /// Ignore underlying account module regardless of whether
-    /// the control flag is required as isize, optional as isize, or sufficient
+    /// the control flag is required, optional, or sufficient
     Ignore,
 
     /// Critical error (?module fail now request)

src/module.rs

@@ -1 +1,124 @@
 //! Functions and structures that can be used to implement a PAM module
+//!
+//! Inspired by anowell/pam-rs
+
+use crate::{PamHandle, PamReturnCode};
+use std::ffi::CStr;
+use std::os::raw::c_uint;
+
+// FIXME: Find a solution for the flags containing ORed integers
+#[allow(unused_variables)]
+/// Trait representing a PAM module.
+///
+/// Modules should override the desired functions and call the macro `impl_pam_module`.
+/// This exports the respective functions at the expected symbols prefixed with `pam_sm_`.
+pub trait PamModule {
+    fn account_management(handle: &PamHandle, args: Vec<&CStr>, flags: c_uint) -> PamReturnCode {
+        PamReturnCode::Ignore
+    }
+    fn authenticate(handle: &PamHandle, args: Vec<&CStr>, flags: c_uint) -> PamReturnCode {
+        PamReturnCode::Ignore
+    }
+    fn change_auth_token(handle: &PamHandle, args: Vec<&CStr>, flags: c_uint) -> PamReturnCode {
+        PamReturnCode::Ignore
+    }
+    fn close_session(handle: &PamHandle, args: Vec<&CStr>, flags: c_uint) -> PamReturnCode {
+        PamReturnCode::Ignore
+    }
+    fn open_session(handle: &PamHandle, args: Vec<&CStr>, flags: c_uint) -> PamReturnCode {
+        PamReturnCode::Ignore
+    }
+    fn set_credentials(handle: &PamHandle, args: Vec<&CStr>, flags: c_uint) -> PamReturnCode {
+        PamReturnCode::Ignore
+    }
+}
+
+#[macro_export]
+macro_rules! impl_pam_module {
+    ($struct:ident) => {
+        pub use _pam_module_::*;
+        mod _pam_module_ {
+            use crate::{module::PamModule, PamHandle, PamReturnCode};
+            use std::ffi::CStr;
+            use std::os::raw::{c_char, c_int, c_uint};
+
+            fn convert_args<'a>(argc: c_int, argv: *const *const c_char) -> Vec<&'a CStr> {
+                (0..argc)
+                    .map(|i| unsafe { CStr::from_ptr(*argv.offset(i as isize)) })
+                    .collect()
+            }
+
+            #[no_mangle]
+            pub extern "C" fn pam_sm_acct_mgmt(
+                handle: &PamHandle,
+                flags: c_uint,
+                argc: c_int,
+                argv: *const *const c_char,
+            ) -> PamReturnCode {
+                let args = convert_args(argc, argv);
+                super::$struct::account_management(handle, args, flags)
+            }
+            #[no_mangle]
+            pub extern "C" fn pam_sm_authenticate(
+                handle: &PamHandle,
+                flags: c_uint,
+                argc: c_int,
+                argv: *const *const c_char,
+            ) -> PamReturnCode {
+                let args = convert_args(argc, argv);
+                super::$struct::authenticate(handle, args, flags)
+            }
+            #[no_mangle]
+            pub extern "C" fn pam_sm_chauthtok(
+                handle: &PamHandle,
+                flags: c_uint,
+                argc: c_int,
+                argv: *const *const c_char,
+            ) -> PamReturnCode {
+                let args = convert_args(argc, argv);
+                super::$struct::change_auth_token(handle, args, flags)
+            }
+            #[no_mangle]
+            pub extern "C" fn pam_sm_close_session(
+                handle: &PamHandle,
+                flags: c_uint,
+                argc: c_int,
+                argv: *const *const c_char,
+            ) -> PamReturnCode {
+                let args = convert_args(argc, argv);
+                super::$struct::close_session(handle, args, flags)
+            }
+            #[no_mangle]
+            pub extern "C" fn pam_sm_open_session(
+                handle: &PamHandle,
+                flags: c_uint,
+                argc: c_int,
+                argv: *const *const c_char,
+            ) -> PamReturnCode {
+                let args = convert_args(argc, argv);
+                super::$struct::open_session(handle, args, flags)
+            }
+            #[no_mangle]
+            pub extern "C" fn pam_sm_setcred(
+                handle: &PamHandle,
+                flags: c_uint,
+                argc: c_int,
+                argv: *const *const c_char,
+            ) -> PamReturnCode {
+                let args = convert_args(argc, argv);
+                super::$struct::set_credentials(handle, args, flags)
+            }
+        }
+    };
+}
+
+#[cfg(test)]
+pub mod test {
+    use super::PamModule;
+    use crate::impl_pam_module;
+
+    pub struct TestModule;
+    impl PamModule for TestModule {}
+
+    impl_pam_module!(TestModule);
+}