[PATCH 0/3 v2] PolicyKit - Add Shadow authorisation framework

[David Zeuthen]

Hi,

Sorry for the lag; I was busy hacking on gvfs all of last week,

On Fri, 2007-12-07 at 23:09 +0000, Carlos Corbacho wrote:
> David, Piter,
> 
> The following three patches will integrate Piter's Shadow work into PolicyKit.
> 
> Patch 1: PAM header cleanups - no change from last time
> 
> Patch 2:  Split out authentication framework from authorisation database
> 
> David, based on your suggestion, this splits the authentication framework from 
> the authorisation database, and handles the necessary magic for setting the 
> right framework for a given database (if no framework is specified), or 
> rejecting it and failing if you try to specify an invalid framework for a 
> given database.
> 
> Because I'm lazy, I've shortend --with-authentication-framework 
> to --with-authfw (less typing), but it's trivial for me to go to the longhand 
> if you prefer?
> 
> This also wraps any PAM specific bits in the code with POLKIT_AUTHFW_PAM.

These two are good; I've applied them with the only change being that
the I've changed the first line of the commit message (needs to start
with lower-case letter)

> Patch 3: Add Piter's Shadow authentication work (rebased against new patch #2)
> 
> This depends on the previous two patches.
> 
> For now, even if PAM is not installed, Shadow must still be explicitly 
> specified as the authentication framework. A trivial update to configure.in 
> at a later point (if the Shadow code is accepted) would be to have Shadow as 
> a fall back if PAM cannot be located.

This one needs a bit of work

 - Kindly change the license so it's MIT/X11 to fit with the
   rest of the project (I recently relicensed everything)

 - Please use the same coding standard as the other code (space
   between function and opening parenthesis; brace for function
   start on a separate line; parenthesis around operand for the
   sizeof operator etc.)

 - Really need to do a "sleep (2);" on the wrong password to discourage
   an attack where one is hammering the system with different passwords
   (polkit-grant-helper relies on the authentication framework (e.g.
   PAM) doing this) [1]

Apart from that it looks pretty good. Thanks! And sorry again for the
lag.

    David

[1] : see also
http://pam.cvs.sourceforge.net/pam/Linux-PAM/modules/pam_unix/unix_chkpwd.c?revision=1.22&view=markup