wk-pam 0.1.0
“Minimal Linux-PAM password check without bindgen/libclang”
Package first published within seven daysPackage under two months old
SHA-2562c6b728f5c4f2656b1487c4dde6b5af36fb53dbcb47d7ce50241997cb56bb958
MaleculeMd₂(In₄Pa)
Evidence
1:14… inux-PAM password check.
2//!
3//! Five functions and a conversation callback, hand-written FFI against
4//! `libpam.so` (present everywhere PAM is). The `pam` crate was deliberately
5//! not used: it builds through `bindgen`, which needs `libclang` on every
6//! contributor's machine, for an API surface this small.
7//!
8//! The only entry point is [`verify`]: synchronous and blocking (PAM may
9//! converse with `unix_chkpwd`), so call it off the UI thread. It wipes its
10//! copy of the secret before returning.
11
12use std::ffi::CString;
13use std::os::raw::{c_char, c_int, c_void};
14
15// PAM return codes, from <security/pam_appl.h>. Named to keep the mapping in
16// [`classify`] readable and auditable.
17const SUCCESS: c_int …
94:16… backend could not answer — a directory socket that is down, a
95 // name service timeout. Distinct from a rejected credential.
96 AUTHIN …
285 None => Ok(()),
286 Some(err) => Err(err),
287 }
288}
289
290#[cfg(test)]
291mod tests {
292 use super::*;
293
294 // These tests never call PAM: a real `pam_authenticate` failure would feed
295 // `pam_faillock` and slowly lock the developer's own account.
296
297 #[test]
298 fn status_mapping() {
299 assert_eq!(classify(SUCCESS), None);
300 assert_eq!(classify(AUTH_ERR), Some(AuthError::WrongPassword) …
No evidence locations were recorded for this file. Raw result