Initial patch from Will.

src/platform/pam_offline/pam_offline.cc

 // Copyright (c) 2009-2010 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This is supposed to be defined before the pam includes.
 #define PAM_SM_AUTH
 
-#include <sys/types.h>
-#include <sys/stat.h>
+#include "pam_offline/pam_prompt_wrapper.h"
+#include "pam_offline/username_password_fetcher.h"
+#include "pam_offline/utils.h"
+
+#include <dbus/dbus-glib.h>
 #include <fcntl.h>
-
-#include <base/command_line.h>
-#include <base/logging.h>
+#include <glib-object.h>
 #include <security/_pam_macros.h>
+#include <security/pam_ext.h>
 #include <security/pam_modules.h>
-#include <security/pam_ext.h>
 #include <stdio.h>
 #include <stdlib.h>
+#include <sys/stat.h>
+#include <sys/types.h>
 
-#include "pam_offline/credentials.h"
-#include "pam_offline/authenticator.h"
-#include "pam_offline/pam_prompt_wrapper.h"
-#include "pam_offline/username_password_fetcher.h"
+#include "base/command_line.h"
+#include "base/logging.h"
+#include "cros/chromeos_cros_api.h"
+#include "cros/chromeos_cryptohome.h"
 
 const char kUserName[] = "chronos";
 
 static void setcred_free(pam_handle_t *pamh /*unused*/,
                          void *ptr,
                          int err /*unused*/) {
   if (ptr) {
     int *intptr = reinterpret_cast<int*>(ptr);
     delete intptr;
   }
 }
 
+static bool pam_offline_libcros_loaded = false;
+static bool ensure_libcros() {
+  if(!pam_offline_libcros_loaded) {
+    ::g_type_init();
+    std::string load_error;
+    pam_offline_libcros_loaded =
+        chromeos::LoadLibcros(chromeos::kCrosDefaultPath, load_error);
+  }
+  return pam_offline_libcros_loaded;
+}
+
 // PAM framework looks for these entry-points to pass control to the
 // authentication module.
 
 // pam_sm_authenticate() will decrypt something using the given creds
 // and return success if the something decrypts successfully, failure
 // otherwise.
 PAM_EXTERN int pam_sm_authenticate(pam_handle_t * pamh, int flags,
                                    int argc, const char **argv) {
   // "flags" can contain PAM_SILENT, which means we shouldn't emit
   // any messages, and PAM_DISALLOW_NULL_AUTHTOK, which means that
   // unknown users should NOT be silently logged in.
   //
   // TODO(cmasone): support PAM_SILENT
   // TODO(cmasone): Should we behave as though DISALLOW_NULL_AUTHTOK
   // is always set?  I think so...
 
   // ret_data points to some space that we use to store our return
   // value for later use in pam_sm_setcred
   int retval = PAM_AUTH_ERR;
   int *ret_data = new int;
 
   pam_offline::PamPromptWrapper pam;
   pam_offline::UsernamePasswordFetcher fetcher(&pam);
   pam_offline::Credentials *credentials = fetcher.FetchCredentials(pamh);
 
   // If fetcher.FetchCredentials times out you get NULL credentials
   if (credentials) {
-    pam_offline::Authenticator auth;
 
-    if (auth.Init()) {
-      if (auth.TestAllMasterKeys(*credentials)) {
-        retval = PAM_SUCCESS;
-        pam_set_item(pamh, PAM_USER,
-                     reinterpret_cast<const void*>(kUserName));
+    if (ensure_libcros()) {
+      char username[pam_offline::kMaxUsernameLength];
+      memset(username, 0, sizeof(username));
+      credentials->GetFullUsername(username, sizeof(username));
+      pam_offline::Blob salt = chromeos::CryptohomeGetSystemSalt();
+      if(salt.size() != 0) {
+        if(chromeos::CryptohomeCheckKey(username,
+                                        credentials->GetPasswordWeakHash(salt).c_str())) {
+          retval = PAM_SUCCESS;
+          pam_set_item(pamh, PAM_USER,
+                       reinterpret_cast<const void*>(kUserName));
+        } else {
+          LOG(INFO) << "Invalid credentials.";
+        }
       } else {
-        LOG(INFO) << "Invalid credentials.";
+        LOG(INFO) << "Unable to get system salt.";
       }
     } else {
-      LOG(ERROR) << "Authenticator failed to Init().";
+      LOG(ERROR) << "libcros load failed.";
     }
 
     delete credentials;
   } else {
     LOG(INFO) << "FetchCredentials returned NULL.";
   }
 
   *ret_data = retval;
   pam_set_data(pamh, "unix_setcred_return",
                reinterpret_cast<void *>(ret_data), setcred_free);
@@ skipping 32 matching lines @@
 struct pam_module _pam_offline_modstruct = {
   "pam_offline",
   pam_sm_authenticate,
   pam_sm_setcred,
   NULL,
   NULL,
   NULL,
   NULL,
 };
 #endif