Relevant BUGIDs:

Purpose of commit: new feature

Commit summary:
---------------
Moved functions from pammodutil to libpam.

13 files changed, 1102 insertions, 2 deletions

diff --git a/libpam/Makefile.am b/libpam/Makefile.am
index 7c837b55..2d06e416 100644
--- a/libpam/Makefile.am
+++ b/libpam/Makefile.am
@@ -25,5 +25,7 @@ libpam_la_SOURCES = pam_account.c pam_auth.c pam_data.c pam_delay.c \
 	pam_dispatch.c pam_end.c pam_env.c pam_handlers.c pam_item.c \
 	pam_malloc.c pam_misc.c pam_password.c pam_prelude.c \
 	pam_session.c pam_start.c pam_static.c pam_strerror.c \
-	pam_vprompt.c pam_syslog.c
-
+	pam_vprompt.c pam_syslog.c \
+	pam_modutil_cleanup.c pam_modutil_getpwnam.c pam_modutil_ioloop.c \
+	pam_modutil_getgrgid.c pam_modutil_getpwuid.c pam_modutil_getgrnam.c \
+	pam_modutil_getspnam.c pam_modutil_getlogin.c  pam_modutil_ingroup.c
diff --git a/libpam/include/security/pam_modutil.h b/libpam/include/security/pam_modutil.h
new file mode 100644
index 00000000..5d03f58f
--- /dev/null
+++ b/libpam/include/security/pam_modutil.h
@@ -0,0 +1,65 @@
+#ifndef _SECURITY__PAM_MODUTIL_H
+#define _SECURITY__PAM_MODUTIL_H
+
+/*
+ * $Id$
+ *
+ * This file is a list of handy libc wrappers that attempt to provide some
+ * thread-safe and other convenient functionality to modules in a common form.
+ *
+ * A number of these functions reserve space in a pam_[sg]et_data item.
+ * In all cases, the name of the item is prefixed with "_pammodutil_*".
+ *
+ * On systems that simply can't support thread safe programming, these
+ * functions don't support it either - sorry.
+ *
+ * Copyright (c) 2001-2002 Andrew Morgan <morgan@kernel.org>
+ */
+
+#include <security/_pam_types.h>
+
+extern struct passwd * PAM_NONNULL((1,2))
+pam_modutil_getpwnam(pam_handle_t *pamh, const char *user);
+
+extern struct passwd * PAM_NONNULL((1))
+pam_modutil_getpwuid(pam_handle_t *pamh, uid_t uid);
+
+extern struct group  * PAM_NONNULL((1,2))
+pam_modutil_getgrnam(pam_handle_t *pamh, const char *group);
+ 
+extern struct group  * PAM_NONNULL((1))
+pam_modutil_getgrgid(pam_handle_t *pamh, gid_t gid);
+ 
+extern struct spwd   * PAM_NONNULL((1,2))
+pam_modutil_getspnam(pam_handle_t *pamh, const char *user);
+
+extern int PAM_NONNULL((1,2,3))
+pam_modutil_user_in_group_nam_nam(pam_handle_t *pamh,
+                                  const char *user,
+                                  const char *group);
+ 
+extern int PAM_NONNULL((1,2))
+pam_modutil_user_in_group_nam_gid(pam_handle_t *pamh,
+                                  const char *user,
+                                  gid_t group);
+ 
+extern int PAM_NONNULL((1,3))
+pam_modutil_user_in_group_uid_nam(pam_handle_t *pamh,
+                                  uid_t user,
+                                  const char *group);
+ 
+extern int PAM_NONNULL((1))
+pam_modutil_user_in_group_uid_gid(pam_handle_t *pamh,
+                                  uid_t user,
+                                  gid_t group);
+
+extern const char * PAM_NONNULL((1))
+pam_modutil_getlogin(pam_handle_t *pamh);
+
+extern int
+pam_modutil_read(int fd, char *buffer, int count);
+
+extern int
+pam_modutil_write(int fd, const char *buffer, int count);
+
+#endif /* _SECURITY__PAM_MODUTIL_H */
diff --git a/libpam/libpam.map b/libpam/libpam.map
index 515842ae..596754a8 100644
--- a/libpam/libpam.map
+++ b/libpam/libpam.map
@@ -39,3 +39,18 @@ LIBPAM_EXTENSION_1.0 {
     pam_vsyslog;
 };
 
+LIBPAM_MODUTIL_1.0 {
+  global:
+    pam_modutil_getpwnam;
+    pam_modutil_getpwuid;
+    pam_modutil_getgrnam;
+    pam_modutil_getgrgid;
+    pam_modutil_getspnam;
+    pam_modutil_user_in_group_nam_nam;
+    pam_modutil_user_in_group_nam_gid;
+    pam_modutil_user_in_group_uid_nam;
+    pam_modutil_user_in_group_uid_gid;
+    pam_modutil_getlogin;
+    pam_modutil_read;
+    pam_modutil_write;
+};
diff --git a/libpam/pam_modutil_cleanup.c b/libpam/pam_modutil_cleanup.c
new file mode 100644
index 00000000..8224ce67
--- /dev/null
+++ b/libpam/pam_modutil_cleanup.c
@@ -0,0 +1,19 @@
+/*
+ * $Id$
+ *
+ * This function provides a common pam_set_data() friendly version of free().
+ */
+
+#include "pam_modutil_private.h"
+
+#include <stdlib.h>
+
+void
+pam_modutil_cleanup (pam_handle_t *pamh UNUSED, void *data,
+		     int error_status UNUSED)
+{
+    if (data) {
+	/* junk it */
+	(void) free(data);
+    }
+}
diff --git a/libpam/pam_modutil_getgrgid.c b/libpam/pam_modutil_getgrgid.c
new file mode 100644
index 00000000..07503a38
--- /dev/null
+++ b/libpam/pam_modutil_getgrgid.c
@@ -0,0 +1,151 @@
+/*
+ * $Id$
+ *
+ * This function provides a thread safer version of getgrgid() for use
+ * with PAM modules that care about this sort of thing.
+ *
+ * XXX - or at least it should provide a thread-safe alternative.
+ */
+
+#include "pam_modutil_private.h"
+
+#include <errno.h>
+#include <limits.h>
+#include <grp.h>
+#include <pthread.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+static pthread_mutex_t _pammodutil_mutex = PTHREAD_MUTEX_INITIALIZER;
+static void _pammodutil_lock(void)
+{
+	pthread_mutex_lock(&_pammodutil_mutex);
+}
+static void _pammodutil_unlock(void)
+{
+	pthread_mutex_unlock(&_pammodutil_mutex);
+}
+
+static int intlen(int number)
+{ 
+    int len = 2;
+    while (number != 0) {
+        number /= 10;
+	len++;
+    }
+    return len;
+}
+
+static int longlen(long number)
+{ 
+    int len = 2;
+    while (number != 0) {
+        number /= 10;
+	len++;
+    }
+    return len;
+}
+
+struct group *
+pam_modutil_getgrgid(pam_handle_t *pamh, gid_t gid)
+{
+#ifdef HAVE_GETGRGID_R
+
+    void *buffer=NULL;
+    size_t length = PWD_INITIAL_LENGTH;
+
+    do {
+	int status;
+	void *new_buffer;
+	struct group *result = NULL;
+
+	new_buffer = realloc(buffer, sizeof(struct group) + length);
+	if (new_buffer == NULL) {
+
+	    D(("out of memory"));
+
+	    /* no memory for the user - so delete the memory */
+	    if (buffer) {
+		free(buffer);
+	    }
+	    return NULL;
+	}
+	buffer = new_buffer;
+
+	/* make the re-entrant call to get the grp structure */
+	errno = 0;
+	status = getgrgid_r(gid, buffer,
+			    sizeof(struct group) + (char *) buffer,
+			    length, &result);
+	if (!status && (result == buffer)) {
+	    char *data_name;
+	    const void *ignore;
+	    int i;
+
+	    data_name = malloc(strlen("_pammodutil_getgrgid") + 1 +
+	    		       longlen((long)gid) + 1 + intlen(INT_MAX) + 1);
+	    if ((pamh != NULL) && (data_name == NULL)) {
+	        D(("was unable to register the data item [%s]",
+	           pam_strerror(pamh, status)));
+		free(buffer);
+		return NULL;
+	    }
+
+	    if (pamh != NULL) {
+	        for (i = 0; i < INT_MAX; i++) {
+	            sprintf(data_name, "_pammodutil_getgrgid_%ld_%d",
+		   	    (long) gid, i);
+	            _pammodutil_lock();
+		    status = PAM_NO_MODULE_DATA;
+	            if (pam_get_data(pamh, data_name, &ignore) != PAM_SUCCESS) {
+		        status = pam_set_data(pamh, data_name,
+					      result, pam_modutil_cleanup);
+		    }
+	            _pammodutil_unlock();
+		    if (status == PAM_SUCCESS) {
+		        break;
+		    }
+		}
+	    } else {
+	        status = PAM_SUCCESS;
+	    }
+
+	    free(data_name);
+
+	    if (status == PAM_SUCCESS) {
+		D(("success"));
+		return result;
+	    }
+
+	    D(("was unable to register the data item [%s]",
+	       pam_strerror(pamh, status)));
+
+	    free(buffer);
+	    return NULL;
+
+	} else if (errno != ERANGE && errno != EINTR) {
+		/* no sense in repeating the call */
+		break;
+	}
+	
+	length <<= 2;
+
+    } while (length < PWD_ABSURD_PWD_LENGTH);
+
+    D(("grp structure took %u bytes or so of memory",
+       length+sizeof(struct group)));
+
+    free(buffer);
+    return NULL;
+
+#else /* ie. ifndef HAVE_GETGRGID_R */
+
+    /*
+     * Sorry, there does not appear to be a reentrant version of
+     * getgrgid(). So, we use the standard libc function.
+     */
+    
+    return getgrgid(gid);
+
+#endif /* def HAVE_GETGRGID_R */
+}
diff --git a/libpam/pam_modutil_getgrnam.c b/libpam/pam_modutil_getgrnam.c
new file mode 100644
index 00000000..11df353f
--- /dev/null
+++ b/libpam/pam_modutil_getgrnam.c
@@ -0,0 +1,140 @@
+/*
+ * $Id$
+ *
+ * This function provides a thread safer version of getgrnam() for use
+ * with PAM modules that care about this sort of thing.
+ *
+ * XXX - or at least it should provide a thread-safe alternative.
+ */
+
+#include "pam_modutil_private.h"
+
+#include <errno.h>
+#include <limits.h>
+#include <grp.h>
+#include <pthread.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+static pthread_mutex_t _pammodutil_mutex = PTHREAD_MUTEX_INITIALIZER;
+static void _pammodutil_lock(void)
+{
+	pthread_mutex_lock(&_pammodutil_mutex);
+}
+static void _pammodutil_unlock(void)
+{
+	pthread_mutex_unlock(&_pammodutil_mutex);
+}
+
+static int intlen(int number)
+{ 
+    int len = 2;
+    while (number != 0) {
+        number /= 10;
+	len++;
+    }
+    return len;
+}
+
+struct group *
+pam_modutil_getgrnam(pam_handle_t *pamh, const char *group)
+{
+#ifdef HAVE_GETGRNAM_R
+
+    void *buffer=NULL;
+    size_t length = PWD_INITIAL_LENGTH;
+
+    do {
+	int status;
+	void *new_buffer;
+	struct group *result = NULL;
+
+	new_buffer = realloc(buffer, sizeof(struct group) + length);
+	if (new_buffer == NULL) {
+
+	    D(("out of memory"));
+
+	    /* no memory for the group - so delete the memory */
+	    if (buffer) {
+		free(buffer);
+	    }
+	    return NULL;
+	}
+	buffer = new_buffer;
+
+	/* make the re-entrant call to get the grp structure */
+	errno = 0;
+	status = getgrnam_r(group, buffer,
+			    sizeof(struct group) + (char *) buffer,
+			    length, &result);
+	if (!status && (result == buffer)) {
+	    char *data_name;
+	    const void *ignore;
+	    int i;
+
+	    data_name = malloc(strlen("_pammodutil_getgrnam") + 1 +
+	    		       strlen(group) + 1 + intlen(INT_MAX) + 1);
+	    if ((pamh != NULL) && (data_name == NULL)) {
+	        D(("was unable to register the data item [%s]",
+	           pam_strerror(pamh, status)));
+		free(buffer);
+		return NULL;
+	    }
+
+	    if (pamh != NULL) {
+	        for (i = 0; i < INT_MAX; i++) {
+	            sprintf(data_name, "_pammodutil_getgrnam_%s_%d", group, i);
+	            _pammodutil_lock();
+		    status = PAM_NO_MODULE_DATA;
+	            if (pam_get_data(pamh, data_name, &ignore) != PAM_SUCCESS) {
+		        status = pam_set_data(pamh, data_name,
+					      result, pam_modutil_cleanup);
+		    }
+	            _pammodutil_unlock();
+		    if (status == PAM_SUCCESS) {
+		        break;
+		    }
+		}
+	    } else {
+	        status = PAM_SUCCESS;
+	    }
+
+	    free(data_name);
+
+	    if (status == PAM_SUCCESS) {
+		D(("success"));
+		return result;
+	    }
+
+	    D(("was unable to register the data item [%s]",
+	       pam_strerror(pamh, status)));
+
+	    free(buffer);
+	    return NULL;
+
+	} else if (errno != ERANGE && errno != EINTR) {
+                /* no sense in repeating the call */
+                break;
+        }
+	
+	length <<= 2;
+
+    } while (length < PWD_ABSURD_PWD_LENGTH);
+
+    D(("grp structure took %u bytes or so of memory",
+       length+sizeof(struct group)));
+
+    free(buffer);
+    return NULL;
+
+#else /* ie. ifndef HAVE_GETGRNAM_R */
+
+    /*
+     * Sorry, there does not appear to be a reentrant version of
+     * getgrnam(). So, we use the standard libc function.
+     */
+    
+    return getgrnam(group);
+
+#endif /* def HAVE_GETGRNAM_R */
+}
diff --git a/libpam/pam_modutil_getlogin.c b/libpam/pam_modutil_getlogin.c
new file mode 100644
index 00000000..d30f1dfa
--- /dev/null
+++ b/libpam/pam_modutil_getlogin.c
@@ -0,0 +1,74 @@
+/*
+ * $Id$
+ *
+ * A central point for invoking getlogin(). Hopefully, this is a
+ * little harder to spoof than all the other versions that are out
+ * there.
+ */
+
+#include "pam_modutil_private.h"
+
+#include <stdlib.h>
+#include <unistd.h>
+#include <utmp.h>
+
+#define _PAMMODUTIL_GETLOGIN "_pammodutil_getlogin"
+
+const char *
+pam_modutil_getlogin(pam_handle_t *pamh)
+{
+    int status;
+    const void *logname;
+    const void *void_curr_tty;
+    const char *curr_tty;
+    char *curr_user;
+    struct utmp *ut, line;
+
+    status = pam_get_data(pamh, _PAMMODUTIL_GETLOGIN, &logname);
+    if (status == PAM_SUCCESS) {
+	return logname;
+    }
+
+    status = pam_get_item(pamh, PAM_TTY, &void_curr_tty);
+    if ((status != PAM_SUCCESS) || (void_curr_tty == NULL))
+      curr_tty = ttyname(0);
+    else
+      curr_tty = (const char*)void_curr_tty;
+
+    if ((curr_tty == NULL) || memcmp(curr_tty, "/dev/", 5)) {
+	return NULL;
+    }
+
+    curr_tty += 5;  /* strlen("/dev/") */
+    logname = NULL;
+
+    setutent();
+    strncpy(line.ut_line, curr_tty, sizeof(line.ut_line));
+
+    if ((ut = getutline(&line)) == NULL) {
+	goto clean_up_and_go_home;
+    }
+
+    curr_user = calloc(sizeof(line.ut_user)+1, 1);
+    if (curr_user == NULL) {
+	goto clean_up_and_go_home;
+    }
+
+    strncpy(curr_user, ut->ut_user, sizeof(ut->ut_user));
+    /* calloc already zeroed the memory */
+
+    status = pam_set_data(pamh, _PAMMODUTIL_GETLOGIN, curr_user,
+			  pam_modutil_cleanup);
+    if (status != PAM_SUCCESS) {
+	free(curr_user);
+	goto clean_up_and_go_home;
+    }
+
+    logname = curr_user;
+
+clean_up_and_go_home:
+
+    endutent();
+
+    return logname;
+}
diff --git a/libpam/pam_modutil_getpwnam.c b/libpam/pam_modutil_getpwnam.c
new file mode 100644
index 00000000..026e61a7
--- /dev/null
+++ b/libpam/pam_modutil_getpwnam.c
@@ -0,0 +1,140 @@
+/*
+ * $Id$
+ *
+ * This function provides a thread safer version of getpwnam() for use
+ * with PAM modules that care about this sort of thing.
+ *
+ * XXX - or at least it should provide a thread-safe alternative.
+ */
+
+#include "pam_modutil_private.h"
+
+#include <errno.h>
+#include <limits.h>
+#include <pthread.h>
+#include <pwd.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+static pthread_mutex_t _pammodutil_mutex = PTHREAD_MUTEX_INITIALIZER;
+static void _pammodutil_lock(void)
+{
+	pthread_mutex_lock(&_pammodutil_mutex);
+}
+static void _pammodutil_unlock(void)
+{
+	pthread_mutex_unlock(&_pammodutil_mutex);
+}
+
+static int intlen(int number)
+{ 
+    int len = 2;
+    while (number != 0) {
+        number /= 10;
+	len++;
+    }
+    return len;
+}
+
+struct passwd *
+pam_modutil_getpwnam(pam_handle_t *pamh, const char *user)
+{
+#ifdef HAVE_GETPWNAM_R
+
+    void *buffer=NULL;
+    size_t length = PWD_INITIAL_LENGTH;
+
+    do {
+	int status;
+	void *new_buffer;
+	struct passwd *result = NULL;
+
+	new_buffer = realloc(buffer, sizeof(struct passwd) + length);
+	if (new_buffer == NULL) {
+
+	    D(("out of memory"));
+
+	    /* no memory for the user - so delete the memory */
+	    if (buffer) {
+		free(buffer);
+	    }
+	    return NULL;
+	}
+	buffer = new_buffer;
+
+	/* make the re-entrant call to get the pwd structure */
+	errno = 0;
+	status = getpwnam_r(user, buffer,
+			    sizeof(struct passwd) + (char *) buffer,
+			    length, &result);
+	if (!status && (result == buffer)) {
+	    char *data_name;
+	    const void *ignore;
+	    int i;
+
+	    data_name = malloc(strlen("_pammodutil_getpwnam") + 1 +
+	    		       strlen(user) + 1 + intlen(INT_MAX) + 1);
+	    if ((pamh != NULL) && (data_name == NULL)) {
+	        D(("was unable to register the data item [%s]",
+	           pam_strerror(pamh, status)));
+		free(buffer);
+		return NULL;
+	    }
+
+	    if (pamh != NULL) {
+	        for (i = 0; i < INT_MAX; i++) {
+	            sprintf(data_name, "_pammodutil_getpwnam_%s_%d", user, i);
+	            _pammodutil_lock();
+		    status = PAM_NO_MODULE_DATA;
+	            if (pam_get_data(pamh, data_name, &ignore) != PAM_SUCCESS) {
+		        status = pam_set_data(pamh, data_name,
+					      result, pam_modutil_cleanup);
+		    }
+	            _pammodutil_unlock();
+		    if (status == PAM_SUCCESS) {
+		        break;
+		    }
+		}
+	    } else {
+	        status = PAM_SUCCESS;
+	    }
+
+	    free(data_name);
+
+	    if (status == PAM_SUCCESS) {
+		D(("success"));
+		return result;
+	    }
+
+	    D(("was unable to register the data item [%s]",
+	       pam_strerror(pamh, status)));
+
+	    free(buffer);
+	    return NULL;
+
+	} else if (errno != ERANGE && errno != EINTR) {
+                /* no sense in repeating the call */
+                break;
+        }
+	
+	length <<= 2;
+
+    } while (length < PWD_ABSURD_PWD_LENGTH);
+
+    D(("pwd structure took %u bytes or so of memory",
+       length+sizeof(struct passwd)));
+
+    free(buffer);
+    return NULL;
+
+#else /* ie. ifndef HAVE_GETPWNAM_R */
+
+    /*
+     * Sorry, there does not appear to be a reentrant version of
+     * getpwnam(). So, we use the standard libc function.
+     */
+    
+    return getpwnam(user);
+
+#endif /* def HAVE_GETPWNAM_R */
+}
diff --git a/libpam/pam_modutil_getpwuid.c b/libpam/pam_modutil_getpwuid.c
new file mode 100644
index 00000000..732771d2
--- /dev/null
+++ b/libpam/pam_modutil_getpwuid.c
@@ -0,0 +1,151 @@
+/*
+ * $Id$
+ *
+ * This function provides a thread safer version of getpwuid() for use
+ * with PAM modules that care about this sort of thing.
+ *
+ * XXX - or at least it should provide a thread-safe alternative.
+ */
+
+#include "pam_modutil_private.h"
+
+#include <errno.h>
+#include <limits.h>
+#include <pthread.h>
+#include <pwd.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+static pthread_mutex_t _pammodutil_mutex = PTHREAD_MUTEX_INITIALIZER;
+static void _pammodutil_lock(void)
+{
+	pthread_mutex_lock(&_pammodutil_mutex);
+}
+static void _pammodutil_unlock(void)
+{
+	pthread_mutex_unlock(&_pammodutil_mutex);
+}
+
+static int intlen(int number)
+{ 
+    int len = 2;
+    while (number != 0) {
+        number /= 10;
+	len++;
+    }
+    return len;
+}
+
+static int longlen(long number)
+{ 
+    int len = 2;
+    while (number != 0) {
+        number /= 10;
+	len++;
+    }
+    return len;
+}
+
+struct passwd *
+pam_modutil_getpwuid(pam_handle_t *pamh, uid_t uid)
+{
+#ifdef HAVE_GETPWUID_R
+
+    void *buffer=NULL;
+    size_t length = PWD_INITIAL_LENGTH;
+
+    do {
+	int status;
+	void *new_buffer;
+	struct passwd *result = NULL;
+
+	new_buffer = realloc(buffer, sizeof(struct passwd) + length);
+	if (new_buffer == NULL) {
+
+	    D(("out of memory"));
+
+	    /* no memory for the user - so delete the memory */
+	    if (buffer) {
+		free(buffer);
+	    }
+	    return NULL;
+	}
+	buffer = new_buffer;
+
+	/* make the re-entrant call to get the pwd structure */
+        errno = 0;
+	status = getpwuid_r(uid, buffer,
+			    sizeof(struct passwd) + (char *) buffer,
+			    length, &result);
+	if (!status && (result == buffer)) {
+	    char *data_name;
+	    const void *ignore;
+	    int i;
+
+	    data_name = malloc(strlen("_pammodutil_getpwuid") + 1 +
+	    		       longlen((long) uid) + 1 + intlen(INT_MAX) + 1);
+	    if ((pamh != NULL) && (data_name == NULL)) {
+	        D(("was unable to register the data item [%s]",
+	           pam_strerror(pamh, status)));
+		free(buffer);
+		return NULL;
+	    }
+
+	    if (pamh != NULL) {
+	        for (i = 0; i < INT_MAX; i++) {
+	            sprintf(data_name, "_pammodutil_getpwuid_%ld_%d",
+		   	    (long) uid, i);
+	            _pammodutil_lock();
+		    status = PAM_NO_MODULE_DATA;
+	            if (pam_get_data(pamh, data_name, &ignore) != PAM_SUCCESS) {
+		        status = pam_set_data(pamh, data_name,
+					      result, pam_modutil_cleanup);
+		    }
+	            _pammodutil_unlock();
+		    if (status == PAM_SUCCESS) {
+		        break;
+		    }
+		}
+	    } else {
+	        status = PAM_SUCCESS;
+	    }
+
+	    free(data_name);
+
+	    if (status == PAM_SUCCESS) {
+		D(("success"));
+		return result;
+	    }
+
+	    D(("was unable to register the data item [%s]",
+	       pam_strerror(pamh, status)));
+
+	    free(buffer);
+	    return NULL;
+
+	} else if (errno != ERANGE && errno != EINTR) {
+                /* no sense in repeating the call */
+                break;
+        }
+	
+	length <<= 2;
+
+    } while (length < PWD_ABSURD_PWD_LENGTH);
+
+    D(("pwd structure took %u bytes or so of memory",
+       length+sizeof(struct passwd)));
+
+    free(buffer);
+    return NULL;
+
+#else /* ie. ifndef HAVE_GETPWUID_R */
+
+    /*
+     * Sorry, there does not appear to be a reentrant version of
+     * getpwuid(). So, we use the standard libc function.
+     */
+    
+    return getpwuid(uid);
+
+#endif /* def HAVE_GETPWUID_R */
+}
diff --git a/libpam/pam_modutil_getspnam.c b/libpam/pam_modutil_getspnam.c
new file mode 100644
index 00000000..7fc696e2
--- /dev/null
+++ b/libpam/pam_modutil_getspnam.c
@@ -0,0 +1,140 @@
+/*
+ * $Id$
+ *
+ * This function provides a thread safer version of getspnam() for use
+ * with PAM modules that care about this sort of thing.
+ *
+ * XXX - or at least it should provide a thread-safe alternative.
+ */
+
+#include "pam_modutil_private.h"
+
+#include <errno.h>
+#include <limits.h>
+#include <pthread.h>
+#include <shadow.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+static pthread_mutex_t _pammodutil_mutex = PTHREAD_MUTEX_INITIALIZER;
+static void _pammodutil_lock(void)
+{
+	pthread_mutex_lock(&_pammodutil_mutex);
+}
+static void _pammodutil_unlock(void)
+{
+	pthread_mutex_unlock(&_pammodutil_mutex);
+}
+
+static int intlen(int number)
+{ 
+    int len = 2;
+    while (number != 0) {
+        number /= 10;
+	len++;
+    }
+    return len;
+}
+
+struct spwd *
+pam_modutil_getspnam(pam_handle_t *pamh, const char *user)
+{
+#ifdef HAVE_GETSPNAM_R
+
+    void *buffer=NULL;
+    size_t length = PWD_INITIAL_LENGTH;
+
+    do {
+	int status;
+	void *new_buffer;
+	struct spwd *result = NULL;
+
+	new_buffer = realloc(buffer, sizeof(struct spwd) + length);
+	if (new_buffer == NULL) {
+
+	    D(("out of memory"));
+
+	    /* no memory for the user - so delete the memory */
+	    if (buffer) {
+		free(buffer);
+	    }
+	    return NULL;
+	}
+	buffer = new_buffer;
+
+	/* make the re-entrant call to get the spwd structure */
+        errno = 0;
+	status = getspnam_r(user, buffer,
+			    sizeof(struct spwd) + (char *) buffer,
+			    length, &result);
+	if (!status && (result == buffer)) {
+	    char *data_name;
+	    const void *ignore;
+	    int i;
+
+	    data_name = malloc(strlen("_pammodutil_getspnam") + 1 +
+	    		       strlen(user) + 1 + intlen(INT_MAX) + 1);
+	    if ((pamh != NULL) && (data_name == NULL)) {
+	        D(("was unable to register the data item [%s]",
+	           pam_strerror(pamh, status)));
+		free(buffer);
+		return NULL;
+	    }
+
+	    if (pamh != NULL) {
+	        for (i = 0; i < INT_MAX; i++) {
+	            sprintf(data_name, "_pammodutil_getspnam_%s_%d", user, i);
+	            _pammodutil_lock();
+		    status = PAM_NO_MODULE_DATA;
+	            if (pam_get_data(pamh, data_name, &ignore) != PAM_SUCCESS) {
+		        status = pam_set_data(pamh, data_name,
+					      result, pam_modutil_cleanup);
+		    }
+	            _pammodutil_unlock();
+		    if (status == PAM_SUCCESS) {
+		        break;
+		    }
+		}
+	    } else {
+	        status = PAM_SUCCESS;
+	    }
+
+	    free(data_name);
+
+	    if (status == PAM_SUCCESS) {
+		D(("success"));
+		return result;
+	    }
+
+	    D(("was unable to register the data item [%s]",
+	       pam_strerror(pamh, status)));
+
+	    free(buffer);
+	    return NULL;
+
+	} else if (errno != ERANGE && errno != EINTR) {
+                /* no sense in repeating the call */
+                break;
+        }
+	
+	length <<= 2;
+
+    } while (length < PWD_ABSURD_PWD_LENGTH);
+
+    D(("spwd structure took %u bytes or so of memory",
+       length+sizeof(struct spwd)));
+
+    free(buffer);
+    return NULL;
+
+#else /* ie. ifndef HAVE_GETSPNAM_R */
+
+    /*
+     * Sorry, there does not appear to be a reentrant version of
+     * getspnam(). So, we use the standard libc function.
+     */
+    
+    return getspnam(user);
+
+#endif /* def HAVE_GETSPNAM_R */
+}
diff --git a/libpam/pam_modutil_ingroup.c b/libpam/pam_modutil_ingroup.c
new file mode 100644
index 00000000..7a15f712
--- /dev/null
+++ b/libpam/pam_modutil_ingroup.c
@@ -0,0 +1,127 @@
+/*
+ * $Id$
+ *
+ * This function provides common methods for checking if a user is in a
+ * specified group.
+ */
+
+#include "pam_modutil_private.h"
+
+#include <stdlib.h>
+#include <pwd.h>
+#include <grp.h>
+
+#ifdef HAVE_GETGROUPLIST
+static int checkgrouplist(const char *user, gid_t primary, gid_t target)
+{
+	gid_t *grouplist = NULL;
+	int agroups, ngroups, i;
+	ngroups = agroups = 3;
+	do {
+		grouplist = malloc(sizeof(gid_t) * agroups);
+		if (grouplist == NULL) {
+			return 0;
+		}
+		ngroups = agroups;
+		i = getgrouplist(user, primary, grouplist, &ngroups);
+		if ((i < 0) || (ngroups < 1)) {
+			agroups *= 2;
+			free(grouplist);
+		} else {
+			for (i = 0; i < ngroups; i++) {
+				if (grouplist[i] == target) {
+					free(grouplist);
+					return 1;
+				}
+			}
+			free(grouplist);
+		}
+	} while (((i < 0) || (ngroups < 1)) && (agroups < 10000));
+	return 0;
+}
+#endif
+
+static int
+pam_modutil_user_in_group_common(pam_handle_t *pamh UNUSED,
+				 struct passwd *pwd,
+				 struct group *grp)
+{
+	int i;
+
+	if (pwd == NULL) {
+		return 0;
+	}
+	if (grp == NULL) {
+		return 0;
+	}
+
+	if (pwd->pw_gid == grp->gr_gid) {
+		return 1;
+	}
+
+	for (i = 0; (grp->gr_mem != NULL) && (grp->gr_mem[i] != NULL); i++) {
+		if (strcmp(pwd->pw_name, grp->gr_mem[i]) == 0) {
+			return 1;
+		}
+	}
+
+#ifdef HAVE_GETGROUPLIST
+	if (checkgrouplist(pwd->pw_name, pwd->pw_gid, grp->gr_gid)) {
+		return 1;
+	}
+#endif
+
+	return 0;
+}
+
+int 
+pam_modutil_user_in_group_nam_nam(pam_handle_t *pamh,
+				 const char *user, const char *group)
+{
+	struct passwd *pwd;
+	struct group *grp;
+
+	pwd = pam_modutil_getpwnam(pamh, user);
+	grp = pam_modutil_getgrnam(pamh, group);
+
+	return pam_modutil_user_in_group_common(pamh, pwd, grp);
+}
+
+int
+pam_modutil_user_in_group_nam_gid(pam_handle_t *pamh,
+				  const char *user, gid_t group)
+{
+	struct passwd *pwd;
+	struct group *grp;
+
+	pwd = pam_modutil_getpwnam(pamh, user);
+	grp = pam_modutil_getgrgid(pamh, group);
+
+	return pam_modutil_user_in_group_common(pamh, pwd, grp);
+}
+
+int
+pam_modutil_user_in_group_uid_nam(pam_handle_t *pamh,
+				  uid_t user, const char *group)
+{
+	struct passwd *pwd;
+	struct group *grp;
+
+	pwd = pam_modutil_getpwuid(pamh, user);
+	grp = pam_modutil_getgrnam(pamh, group);
+
+	return pam_modutil_user_in_group_common(pamh, pwd, grp);
+}
+
+int
+pam_modutil_user_in_group_uid_gid(pam_handle_t *pamh,
+				  uid_t user, gid_t group)
+{
+	struct passwd *pwd;
+	struct group *grp;
+
+	pwd = pam_modutil_getpwuid(pamh, user);
+	grp = pam_modutil_getgrgid(pamh, group);
+
+	return pam_modutil_user_in_group_common(pamh, pwd, grp);
+}
diff --git a/libpam/pam_modutil_ioloop.c b/libpam/pam_modutil_ioloop.c
new file mode 100644
index 00000000..54ab0e55
--- /dev/null
+++ b/libpam/pam_modutil_ioloop.c
@@ -0,0 +1,53 @@
+/*
+ * $Id$
+ *
+ * These functions provides common methods for ensure a complete read or
+ * write occurs. It handles EINTR and partial read/write returns.
+ */
+
+#include "pam_modutil_private.h"
+
+#include <unistd.h>
+#include <errno.h>
+
+int
+pam_modutil_read(int fd, char *buffer, int count)
+{
+       int block, offset = 0;
+
+       while (count > 0) {
+               block = read(fd, &buffer[offset], count);
+
+               if (block < 0) {
+                       if (errno == EINTR) continue;
+                       return block;
+               }
+               if (block == 0) return offset;
+
+               offset += block;
+               count -= block;
+       }
+
+       return offset;
+}
+
+int
+pam_modutil_write(int fd, const char *buffer, int count)
+{
+       int block, offset = 0;
+
+       while (count > 0) {
+               block = write(fd, &buffer[offset], count);
+
+               if (block < 0) {
+                       if (errno == EINTR) continue;
+                       return block;
+               }
+               if (block == 0) return offset;
+
+               offset += block;
+               count -= block;
+       }
+
+       return offset;
+}
diff --git a/libpam/pam_modutil_private.h b/libpam/pam_modutil_private.h
new file mode 100644
index 00000000..f242fdfe
--- /dev/null
+++ b/libpam/pam_modutil_private.h
@@ -0,0 +1,23 @@
+#ifndef PAMMODUTIL_PRIVATE_H
+#define PAMMODUTIL_PRIVATE_H
+
+/*
+ * $Id$
+ *
+ * Copyright (c) 2001 Andrew Morgan <morgan@kernel.org>
+ */
+
+#include "config.h"
+
+#include <security/_pam_macros.h>
+#include <security/pam_modules.h>
+#include <security/pam_modutil.h>
+
+#define PWD_INITIAL_LENGTH     0x100
+#define PWD_ABSURD_PWD_LENGTH  0x8000
+
+extern void
+pam_modutil_cleanup(pam_handle_t *pamh, void *data,
+                    int error_status);
+
+#endif /* PAMMODUTIL_PRIVATE_H */