6894506 pam_krb5 is not lint clean

3 files changed, 122 insertions, 117 deletions

diff --git a/usr/src/lib/pam_modules/krb5/krb5_authenticate.c b/usr/src/lib/pam_modules/krb5/krb5_authenticate.c
index 77f97c9d54..ce56893697 100644
--- a/usr/src/lib/pam_modules/krb5/krb5_authenticate.c
+++ b/usr/src/lib/pam_modules/krb5/krb5_authenticate.c
@@ -228,8 +228,8 @@ pam_sm_authenticate(
 		char buffer[512];
 
 		if (snprintf(buffer, sizeof (buffer),
-			    "%s=FILE:/tmp/krb5cc_%d",
-			    KRB5_ENV_CCNAME, (int)pw_uid) >= sizeof (buffer)) {
+		    "%s=FILE:/tmp/krb5cc_%d",
+		    KRB5_ENV_CCNAME, (int)pw_uid) >= sizeof (buffer)) {
 			result = PAM_SYSTEM_ERR;
 			goto out;
 		}
@@ -279,23 +279,23 @@ pam_sm_authenticate(
 		if (strcmp(rep_data->type, KRB5_REPOSITORY_NAME) != 0) {
 			if (debug)
 				__pam_log(LOG_AUTH | LOG_DEBUG,
-					"PAM-KRB5 (auth): wrong"
-					"repository found (%s), returning "
-					"PAM_IGNORE", rep_data->type);
+				    "PAM-KRB5 (auth): wrong"
+				    "repository found (%s), returning "
+				    "PAM_IGNORE", rep_data->type);
 			return (PAM_IGNORE);
 		}
 		if (rep_data->scope_len == sizeof (krb5_repository_data_t)) {
 			krb5_data = (krb5_repository_data_t *)rep_data->scope;
 
 			if (krb5_data->flags ==
-				SUNW_PAM_KRB5_ALREADY_AUTHENTICATED &&
-				krb5_data->principal != NULL &&
-				strlen(krb5_data->principal)) {
+			    SUNW_PAM_KRB5_ALREADY_AUTHENTICATED &&
+			    krb5_data->principal != NULL &&
+			    strlen(krb5_data->principal)) {
 				if (debug)
 					__pam_log(LOG_AUTH | LOG_DEBUG,
-						"PAM-KRB5 (auth): Principal "
-						"%s already authenticated",
-						krb5_data->principal);
+					    "PAM-KRB5 (auth): Principal "
+					    "%s already authenticated",
+					    krb5_data->principal);
 				kmd->auth_status = PAM_SUCCESS;
 				return (PAM_SUCCESS);
 			}
@@ -335,7 +335,7 @@ out:
 
 		if (kmd->env &&
 		    !(kmd->age_status == PAM_NEW_AUTHTOK_REQD &&
-			    kmd->auth_status == PAM_SUCCESS)) {
+		    kmd->auth_status == PAM_SUCCESS)) {
 
 
 			if (result == PAM_SUCCESS) {
@@ -520,14 +520,14 @@ attempt_krb5_auth(
 	/* need to free context with krb5_free_context */
 	if (code = krb5_init_secure_context(&kmd->kcontext)) {
 		__pam_log(LOG_AUTH | LOG_ERR,
-			"PAM-KRB5 (auth): Error initializing "
-			"krb5: %s",
-			error_message(code));
+		    "PAM-KRB5 (auth): Error initializing "
+		    "krb5: %s",
+		    error_message(code));
 		return (PAM_SYSTEM_ERR);
 	}
 
 	if ((code = get_kmd_kuser(kmd->kcontext, (const char *)user, kuser,
-		2*MAXHOSTNAMELEN)) != 0) {
+	    2*MAXHOSTNAMELEN)) != 0) {
 		/* get_kmd_kuser returns proper PAM error statuses */
 		return (code);
 	}
@@ -549,21 +549,21 @@ attempt_krb5_auth(
 	clientp = my_creds->client;
 
 	if (code = krb5_build_principal_ext(kmd->kcontext, &server,
-			    krb5_princ_realm(kmd->kcontext, me)->length,
-			    krb5_princ_realm(kmd->kcontext, me)->data,
-			    tgtname.length, tgtname.data,
-			    krb5_princ_realm(kmd->kcontext, me)->length,
-			    krb5_princ_realm(kmd->kcontext, me)->data, 0)) {
+	    krb5_princ_realm(kmd->kcontext, me)->length,
+	    krb5_princ_realm(kmd->kcontext, me)->data,
+	    tgtname.length, tgtname.data,
+	    krb5_princ_realm(kmd->kcontext, me)->length,
+	    krb5_princ_realm(kmd->kcontext, me)->data, 0)) {
 		__pam_log(LOG_AUTH | LOG_ERR,
-			"PAM-KRB5 (auth): attempt_krb5_auth: "
-			"krb5_build_princ_ext failed: %s",
-			error_message(code));
+		    "PAM-KRB5 (auth): attempt_krb5_auth: "
+		    "krb5_build_princ_ext failed: %s",
+		    error_message(code));
 		result = PAM_SYSTEM_ERR;
 		goto out;
 	}
 
 	if (code = krb5_copy_principal(kmd->kcontext, server,
-				&my_creds->server)) {
+	    &my_creds->server)) {
 		result = PAM_SYSTEM_ERR;
 		goto out_err;
 	}
@@ -571,9 +571,9 @@ attempt_krb5_auth(
 
 	if (code = krb5_timeofday(kmd->kcontext, &now)) {
 		__pam_log(LOG_AUTH | LOG_ERR,
-			"PAM-KRB5 (auth): attempt_krb5_auth: "
-			"krb5_timeofday failed: %s",
-			error_message(code));
+		    "PAM-KRB5 (auth): attempt_krb5_auth: "
+		    "krb5_timeofday failed: %s",
+		    error_message(code));
 		result = PAM_SYSTEM_ERR;
 		goto out;
 	}
@@ -593,20 +593,20 @@ attempt_krb5_auth(
 
 	krb_realm = krb5_princ_realm(kmd->kcontext, me)->data;
 	profile_get_options_boolean(kmd->kcontext->profile,
-				    realmdef, config_option);
+	    realmdef, config_option);
 	profile_get_options_boolean(kmd->kcontext->profile,
-				    appdef, config_option);
+	    appdef, config_option);
 	profile_get_options_string(kmd->kcontext->profile,
-				realmdef, config_times);
+	    realmdef, config_times);
 	profile_get_options_string(kmd->kcontext->profile,
-				appdef, config_times);
+	    appdef, config_times);
 
 	if (renew_timeval) {
 		code = krb5_string_to_deltat(renew_timeval, &rlife);
 		if (code != 0 || rlife == 0 || rlife > krb5_max_duration) {
 			__pam_log(LOG_AUTH | LOG_ERR,
-				    "PAM-KRB5 (auth): Bad max_renewable_life "
-				    " value '%s' in Kerberos config file",
+			    "PAM-KRB5 (auth): Bad max_renewable_life "
+			    " value '%s' in Kerberos config file",
 			    renew_timeval);
 			result = PAM_SYSTEM_ERR;
 			goto out;
@@ -617,7 +617,7 @@ attempt_krb5_auth(
 		if (code != 0 || lifetime == 0 ||
 		    lifetime > krb5_max_duration) {
 			__pam_log(LOG_AUTH | LOG_ERR,
-				"lifetime value '%s' in Kerberos config file",
+			    "lifetime value '%s' in Kerberos config file",
 			    life_timeval);
 			result = PAM_SYSTEM_ERR;
 			goto out;
@@ -637,29 +637,29 @@ attempt_krb5_auth(
 	if (proxiable_flag) { 		/* Set in config file */
 		if (kmd->debug)
 			__pam_log(LOG_AUTH | LOG_DEBUG,
-				"PAM-KRB5 (auth): Proxiable tickets "
-				"requested");
+			    "PAM-KRB5 (auth): Proxiable tickets "
+			    "requested");
 		krb5_get_init_creds_opt_set_proxiable(&opts, TRUE);
 	}
 	if (forwardable_flag) {
 		if (kmd->debug)
 			__pam_log(LOG_AUTH | LOG_DEBUG,
-				"PAM-KRB5 (auth): Forwardable tickets "
-				"requested");
+			    "PAM-KRB5 (auth): Forwardable tickets "
+			    "requested");
 		krb5_get_init_creds_opt_set_forwardable(&opts, TRUE);
 	}
 	if (renewable_flag) {
 		if (kmd->debug)
 			__pam_log(LOG_AUTH | LOG_DEBUG,
-				"PAM-KRB5 (auth): Renewable tickets "
-				"requested");
+			    "PAM-KRB5 (auth): Renewable tickets "
+			    "requested");
 		krb5_get_init_creds_opt_set_renew_life(&opts, rlife);
 	}
 	if (no_address_flag) {
 		if (kmd->debug)
 			__pam_log(LOG_AUTH | LOG_DEBUG,
-				"PAM-KRB5 (auth): Addressless tickets "
-				"requested");
+			    "PAM-KRB5 (auth): Addressless tickets "
+			    "requested");
 		krb5_get_init_creds_opt_set_address_list(&opts, NULL);
 	}
 
@@ -767,11 +767,11 @@ attempt_krb5_auth(
 			krb5_verify_init_creds_opt_init(&vopts);
 
 			code = krb5_verify_init_creds(kmd->kcontext,
-				my_creds,
-				NULL,	/* defaults to host/localhost@REALM */
-				NULL,
-				NULL,
-				&vopts);
+			    my_creds,
+			    NULL,	/* defaults to host/localhost@REALM */
+			    NULL,
+			    NULL,
+			    &vopts);
 
 			if (code) {
 				result = PAM_SYSTEM_ERR;
@@ -782,40 +782,40 @@ attempt_krb5_auth(
 				 * file cannot be found.
 				 */
 				if (krb5_sname_to_principal(kmd->kcontext, NULL,
-						NULL, KRB5_NT_SRV_HST, &sp))
+				    NULL, KRB5_NT_SRV_HST, &sp))
 					fqdn = "<fqdn>";
 				else
 					fqdn = sp->data[1].data;
 
 				if (krb5_kt_default_name(kmd->kcontext, kt_name,
-							sizeof (kt_name)))
-					(void) strncpy(kt_name,
-						"default keytab",
-						sizeof (kt_name));
+				    sizeof (kt_name)))
+					(void) strlcpy(kt_name,
+					    "default keytab",
+					    sizeof (kt_name));
 
 				switch (code) {
 				case KRB5_KT_NOTFOUND:
 					__pam_log(LOG_AUTH | LOG_ERR,
-						"PAM-KRB5 (auth): "
-						"krb5_verify_init_creds failed:"
-						" Key table entry \"host/%s\""
-						" not found in %s",
-						fqdn, kt_name);
+					    "PAM-KRB5 (auth): "
+					    "krb5_verify_init_creds failed:"
+					    " Key table entry \"host/%s\""
+					    " not found in %s",
+					    fqdn, kt_name);
 					break;
 				case ENOENT:
 					__pam_log(LOG_AUTH | LOG_ERR,
-						"PAM-KRB5 (auth): "
-						"krb5_verify_init_creds failed:"
-						" Keytab file \"%s\""
-						" does not exist.\n",
-						kt_name);
+					    "PAM-KRB5 (auth): "
+					    "krb5_verify_init_creds failed:"
+					    " Keytab file \"%s\""
+					    " does not exist.\n",
+					    kt_name);
 					break;
 				default:
 					__pam_log(LOG_AUTH | LOG_ERR,
-						"PAM-KRB5 (auth): "
-						"krb5_verify_init_creds failed:"
-						" %s",
-						error_message(code));
+					    "PAM-KRB5 (auth): "
+					    "krb5_verify_init_creds failed:"
+					    " %s",
+					    error_message(code));
 					break;
 				}
 
@@ -838,9 +838,9 @@ attempt_krb5_auth(
 
 		if (kmd->debug)
 			__pam_log(LOG_AUTH | LOG_DEBUG,
-				"PAM-KRB5 (auth): attempt_krb5_auth:"
-				" User is not part of the local Kerberos"
-				" realm: %s", error_message(code));
+			    "PAM-KRB5 (auth): attempt_krb5_auth:"
+			    " User is not part of the local Kerberos"
+			    " realm: %s", error_message(code));
 		break;
 
 	case KRB5KDC_ERR_PREAUTH_FAILED:
@@ -887,8 +887,8 @@ attempt_krb5_auth(
 		result = PAM_SYSTEM_ERR;
 		if (kmd->debug)
 			__pam_log(LOG_AUTH | LOG_DEBUG,
-				"PAM-KRB5 (auth): error %d - %s",
-				code, error_message(code));
+			    "PAM-KRB5 (auth): error %d - %s",
+			    code, error_message(code));
 		break;
 	}
 
@@ -905,7 +905,7 @@ attempt_krb5_auth(
 		if (*krb5_pass != NULL &&
 		    !(kmd->password = strdup(*krb5_pass))) {
 			__pam_log(LOG_AUTH | LOG_ERR,
-				  "Cannot strdup password");
+			    "Cannot strdup password");
 			result = PAM_BUF_ERR;
 			goto out_err;
 		}
@@ -971,7 +971,7 @@ krb5_cleanup(pam_handle_t *pamh, void *data, int pam_status)
 
 	if (kmd->debug) {
 		__pam_log(LOG_AUTH | LOG_DEBUG,
-			    "PAM-KRB5 (auth): krb5_cleanup auth_status = %d",
+		    "PAM-KRB5 (auth): krb5_cleanup auth_status = %d",
 		    kmd->auth_status);
 	}
 
diff --git a/usr/src/lib/pam_modules/krb5/krb5_password.c b/usr/src/lib/pam_modules/krb5/krb5_password.c
index a8129ec012..0a33a72f78 100644
--- a/usr/src/lib/pam_modules/krb5/krb5_password.c
+++ b/usr/src/lib/pam_modules/krb5/krb5_password.c
@@ -81,8 +81,8 @@ set_ccname(
 			    != PAM_SUCCESS) {
 				/* should not happen but... */
 				__pam_log(LOG_AUTH | LOG_ERR,
-					    "PAM-KRB5 (password):"
-					    " pam_putenv failed: result: %d",
+				    "PAM-KRB5 (password):"
+				    " pam_putenv failed: result: %d",
 				    result);
 				goto cleanupccname;
 			}
@@ -132,11 +132,11 @@ get_set_creds(
 	 */
 	if (login_result != PAM_SUCCESS) {
 		display_msg(pamh, PAM_TEXT_INFO,
-			    dgettext(TEXT_DOMAIN,
-				    "Warning: "
-				    "Could not cache Kerberos"
-				    " credentials, please run "
-				    "kinit(1) or re-login\n"));
+		    dgettext(TEXT_DOMAIN,
+		    "Warning: "
+		    "Could not cache Kerberos"
+		    " credentials, please run "
+		    "kinit(1) or re-login\n"));
 	}
 	set_ccname(pamh, kmd, login_result, debug);
 }
@@ -168,7 +168,7 @@ pam_sm_chauthtok(
 			debug = 1;
 		else
 			__pam_log(LOG_AUTH | LOG_ERR,
-				    "PAM-KRB5 (password): illegal option %s",
+			    "PAM-KRB5 (password): illegal option %s",
 			    argv[i]);
 	}
 
@@ -183,9 +183,9 @@ pam_sm_chauthtok(
 		if (strcmp(rep_data->type, KRB5_REPOSITORY_NAME) != 0) {
 			if (debug)
 				__pam_log(LOG_AUTH | LOG_DEBUG,
-					"PAM-KRB5 (auth): wrong"
-					"repository found (%s), returning "
-					"PAM_IGNORE", rep_data->type);
+				    "PAM-KRB5 (auth): wrong"
+				    "repository found (%s), returning "
+				    "PAM_IGNORE", rep_data->type);
 			return (PAM_IGNORE);
 		}
 	}
@@ -201,8 +201,8 @@ pam_sm_chauthtok(
 	/* make sure PAM framework is telling us to update passwords */
 	if (!(flags & PAM_UPDATE_AUTHTOK)) {
 		__pam_log(LOG_AUTH | LOG_ERR,
-			"PAM-KRB5 (password): bad flags: %d",
-			flags);
+		    "PAM-KRB5 (password): bad flags: %d",
+		    flags);
 		return (PAM_SYSTEM_ERR);
 	}
 
@@ -232,7 +232,7 @@ pam_sm_chauthtok(
 
 	if (user == NULL || *user == '\0') {
 		__pam_log(LOG_AUTH | LOG_ERR,
-			"PAM-KRB5 (password): username is empty");
+		    "PAM-KRB5 (password): username is empty");
 		return (PAM_USER_UNKNOWN);
 	}
 
@@ -278,7 +278,7 @@ pam_sm_chauthtok(
 	result = krb5_verifypw(user, oldpass, debug);
 	if (debug)
 		__pam_log(LOG_AUTH | LOG_DEBUG,
-			"PAM-KRB5 (password): verifypw %d", result);
+		    "PAM-KRB5 (password): verifypw %d", result);
 
 	/*
 	 * If it's a bad password or general failure, we are done.
@@ -293,7 +293,7 @@ pam_sm_chauthtok(
 
 		if (result == 2)
 			display_msg(pamh, PAM_ERROR_MSG, dgettext(TEXT_DOMAIN,
-				"Old Kerberos password incorrect\n"));
+			    "Old Kerberos password incorrect\n"));
 		return (PAM_AUTHTOK_ERR);
 	}
 
@@ -312,7 +312,7 @@ pam_sm_chauthtok(
 out:
 	if (debug)
 		__pam_log(LOG_AUTH | LOG_DEBUG,
-			"PAM-KRB5 (password): out: returns %d",
+		    "PAM-KRB5 (password): out: returns %d",
 		    result);
 
 	return (result);
@@ -340,7 +340,7 @@ krb5_verifypw(
 	}
 
 	if ((code = get_kmd_kuser(context, (const char *)princ_str, kprinc,
-		2*MAXHOSTNAMELEN)) != 0) {
+	    2*MAXHOSTNAMELEN)) != 0) {
 		return (code);
 	}
 
@@ -357,8 +357,8 @@ krb5_verifypw(
 	}
 
 	(void) strlcpy(admin_realm,
-		    krb5_princ_realm(context, princ)->data,
-		    sizeof (admin_realm));
+	    krb5_princ_realm(context, princ)->data,
+	    sizeof (admin_realm));
 
 	params.mask |= KADM5_CONFIG_REALM;
 	params.realm = admin_realm;
@@ -366,17 +366,17 @@ krb5_verifypw(
 
 	if (kadm5_get_cpw_host_srv_name(context, admin_realm, &cpw_service)) {
 		__pam_log(LOG_AUTH | LOG_ERR,
-			"PAM-KRB5 (password): unable to get host based "
-			"service name for realm %s\n",
-			admin_realm);
+		    "PAM-KRB5 (password): unable to get host based "
+		    "service name for realm %s\n",
+		    admin_realm);
 		krb5_free_principal(context, princ);
 		return (3);
 	}
 
 	code = kadm5_init_with_password(kprinc, old_password, cpw_service,
-					&params, KADM5_STRUCT_VERSION,
-					KADM5_API_VERSION_2, NULL,
-					&server_handle);
+	    &params, KADM5_STRUCT_VERSION,
+	    KADM5_API_VERSION_2, NULL,
+	    &server_handle);
 	if (code != 0) {
 		if (debug)
 			__pam_log(LOG_AUTH | LOG_DEBUG,
@@ -439,7 +439,7 @@ krb5_changepw(
 		return (PAM_SYSTEM_ERR);
 
 	if ((code = get_kmd_kuser(context, (const char *)princ_str, kprinc,
-		2*MAXHOSTNAMELEN)) != 0) {
+	    2*MAXHOSTNAMELEN)) != 0) {
 		return (code);
 	}
 
@@ -455,23 +455,23 @@ krb5_changepw(
 	}
 
 	(void) snprintf(admin_realm, sizeof (admin_realm), "%s",
-		krb5_princ_realm(context, princ)->data);
+	    krb5_princ_realm(context, princ)->data);
 	params.mask |= KADM5_CONFIG_REALM;
 	params.realm = admin_realm;
 
 
 	if (kadm5_get_cpw_host_srv_name(context, admin_realm, &cpw_service)) {
 		__pam_log(LOG_AUTH | LOG_ERR,
-				"PAM-KRB5 (password):unable to get host based "
-				"service name for realm %s\n",
-			admin_realm);
+		    "PAM-KRB5 (password):unable to get host based "
+		    "service name for realm %s\n",
+		    admin_realm);
 		return (PAM_SYSTEM_ERR);
 	}
 
 	code = kadm5_init_with_password(kprinc, old_password, cpw_service,
-					&params, KADM5_STRUCT_VERSION,
-					KADM5_API_VERSION_2, NULL,
-					&server_handle);
+	    &params, KADM5_STRUCT_VERSION,
+	    KADM5_API_VERSION_2, NULL,
+	    &server_handle);
 	free(cpw_service);
 	if (code != 0) {
 		if (debug)
@@ -480,21 +480,21 @@ krb5_changepw(
 			    "init_with_pw failed:  (%s)", error_message(code));
 		krb5_free_principal(context, princ);
 		return ((code == KADM5_BAD_PASSWORD) ?
-			PAM_AUTHTOK_ERR : PAM_SYSTEM_ERR);
+		    PAM_AUTHTOK_ERR : PAM_SYSTEM_ERR);
 	}
 
 	code = kadm5_chpass_principal_util(server_handle, princ,
-					new_password,
-					NULL /* don't need pw back */,
-					msg_ret,
-					sizeof (msg_ret));
+	    new_password,
+	    NULL /* don't need pw back */,
+	    msg_ret,
+	    sizeof (msg_ret));
 
 	if (code) {
 		char msgs[2][PAM_MAX_MSG_SIZE];
 
 		(void) snprintf(msgs[0], PAM_MAX_MSG_SIZE, "%s",
-			dgettext(TEXT_DOMAIN,
-				"Kerberos password not changed: "));
+		    dgettext(TEXT_DOMAIN,
+		    "Kerberos password not changed: "));
 		(void) snprintf(msgs[1], PAM_MAX_MSG_SIZE, "%s", msg_ret);
 
 		display_msgs(pamh, PAM_ERROR_MSG, 2, msgs);
diff --git a/usr/src/lib/pam_modules/krb5/krb5_setcred.c b/usr/src/lib/pam_modules/krb5/krb5_setcred.c
index c4c1bf736e..743cda3297 100644
--- a/usr/src/lib/pam_modules/krb5/krb5_setcred.c
+++ b/usr/src/lib/pam_modules/krb5/krb5_setcred.c
@@ -20,7 +20,7 @@
  */
 
 /*
- * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -565,7 +565,12 @@ error:
 			__pam_log(LOG_AUTH | LOG_DEBUG,
 			    "PAM-KRB5 (setcred): delete/add warning");
 
-		(void) kwarn_del_warning(client_name);
+		if (kwarn_del_warning(client_name) != 0) {
+			__pam_log(LOG_AUTH | LOG_NOTICE,
+			    "PAM-KRB5 (setcred): kwarn_del_warning"
+			    " failed: ktkt_warnd(1M) down?");
+		}
+
 		if (kwarn_add_warning(client_name, endtime) != 0) {
 			__pam_log(LOG_AUTH | LOG_NOTICE,
 			    "PAM-KRB5 (setcred): kwarn_add_warning"