um_data_structures.c

Go to the documentation of this file.

/*************************************************** */
/* Rule Set Based Access Control                     */
/* Implementation of User Management data structures */
/* Author and (c) 1999-2005: Amon Ott <ao@rsbac.org> */
/*                                                   */
/* Last modified: 21/Sep/2005                        */
/*************************************************** */

#include <linux/types.h>
#include <linux/sched.h>
#include <linux/mm.h>
#include <linux/init.h>
#include <linux/random.h>
#include <asm/uaccess.h>
#include <rsbac/types.h>
#include <rsbac/aci_data_structures.h>
#include <rsbac/um_types.h>
#include <rsbac/error.h>
#include <rsbac/helpers.h>
#include <rsbac/adf.h>
#include <rsbac/aci.h>
#include <rsbac/um.h>
#include <rsbac/lists.h>
#include <rsbac/proc_fs.h>
#include <rsbac/rkmem.h>
#include <rsbac/getname.h>
#include <linux/string.h>
#include <linux/smp_lock.h>
#include <linux/delay.h>
#ifdef CONFIG_RSBAC_UM_DIGEST
#include <linux/crypto.h>
#include <asm/scatterlist.h>
#endif
/************************************************************************** */
/*                          Global Variables                                */
/************************************************************************** */

static rsbac_list_handle_t user_handle[RSBAC_UM_NR_USER_LISTS];
static rsbac_list_handle_t group_handle[RSBAC_UM_NR_GROUP_LISTS];

#define EXTRA_ROOM 20

/**************************************************/
/*       Declarations of external functions       */
/**************************************************/

/**************************************************/
/*       Declarations of internal functions       */
/**************************************************/

/************************************************* */
/*               Internal Help functions           */
/************************************************* */

static inline int user_hash(rsbac_uid_t user)
  {
    return(user % RSBAC_UM_NR_USER_LISTS);
  }

static inline int group_hash(rsbac_gid_t group)
  {
    return(group % RSBAC_UM_NR_GROUP_LISTS);
  }

#if defined(CONFIG_RSBAC_PROC) && defined(CONFIG_PROC_FS)
#if 0
static int
um_users_proc_info(char *buffer, char **start, off_t offset, int length)
{
  int len = 0;
  off_t pos   = 0;
  off_t begin = 0;
  struct rsbac_mac_device_list_item_t   * device_p;
  u_long dflags;

  if (!rsbac_is_initialized()) return (-ENOSYS);

  len += sprintf(buffer, "%u RSBAC MAC Devices\n-------------------\n",
                 device_list_head.count);

  /* wait for read access to device_list_head */
  rsbac_read_lock(&device_list_head.lock, &dflags);
  /* OK, go on */
  for (device_p = device_list_head.head; device_p; device_p = device_p->next)
    {
      len += sprintf(buffer + len, "%02u:%02u with mount_count = %u\n",
                     RSBAC_MAJOR(device_p->id), RSBAC_MINOR(device_p->id),
                     device_p->mount_count);
      pos = begin + len;
      if (pos < offset)
        {
          len = 0;
          begin = pos;
        }
      if (pos > offset+length)
        break;
    }
  
  /* free access to device_list_head */
  rsbac_read_unlock(&device_list_head.lock, &dflags);

  *start = buffer + (offset - begin);
  len -= (offset - begin);
  
  if (len > length)
    len = length;
  return len;
}
#endif /* 0 */

static int
stats_um_proc_info(char *buffer, char **start, off_t offset, int length)
  {
    u_int len = 0;
    off_t pos   = 0;
    off_t begin = 0;

    u_long user_count = 0;
    u_long group_count = 0;
    u_long member_count = 0;
    int i;

    union rsbac_target_id_t       rsbac_target_id;
    union rsbac_attribute_value_t rsbac_attribute_value;

    if (!rsbac_is_initialized())
      {
        rsbac_printk(KERN_WARNING "stats_um_proc_info(): RSBAC not initialized\n");
        return(-RSBAC_ENOTINITIALIZED);
      }
#ifdef CONFIG_RSBAC_DEBUG
    if (rsbac_debug_aef_um)
      {
        rsbac_printk(KERN_DEBUG "stats_um_proc_info(): calling ADF\n");
      }
#endif
    rsbac_target_id.scd = ST_rsbac;
    rsbac_attribute_value.dummy = 0;
    if (!rsbac_adf_request(R_GET_STATUS_DATA,
                           current->pid,
                           T_SCD,
                           rsbac_target_id,
                           A_none,
                           rsbac_attribute_value))
      {
        return -EPERM;
      }

    for(i=0; i < RSBAC_UM_NR_USER_LISTS; i++)
      {
        user_count += rsbac_list_lol_count(user_handle[i]);
        member_count += rsbac_list_lol_all_subcount(user_handle[i]);
      }
    for(i=0; i < RSBAC_UM_NR_GROUP_LISTS; i++)
      {
        group_count += rsbac_list_count(group_handle[i]);
      }

    len += sprintf(buffer, "UM Status\n---------\n");

    len += sprintf(buffer + len, "%lu user items with sum of %lu group memberships, %lu group items\n",
                   user_count,
                   member_count,
                   group_count);
    pos = begin + len;
    if (pos < offset)
      {
        len = 0;
        begin = pos;
      }
    *start = buffer + (offset - begin);
    len -= (offset - begin);
  
    if (len > length)
      len = length;
    return len;
  }

#endif /* CONFIG_PROC_FS && CONFIG_RSBAC_PROC */

static int name_compare(void * data1, void * data2)
  {
    struct rsbac_um_user_entry_t * entry_p = data1;
    char * name = data2;

    if(!entry_p || !name)
      return 1;

    return strcmp(entry_p->name,name);
  }

static int group_name_compare(void * data1, void * data2)
  {
    struct rsbac_um_group_entry_t * entry_p = data1;
    char * name = data2;

    if(!entry_p || !name)
      return 1;

    return strcmp(entry_p->name,name);
  }

/************************************************* */
/*               Init functions                    */
/************************************************* */

/* All functions return 0, if no error occurred, and a negative error code  */
/* otherwise. The error codes are defined in rsbac/error.h.                 */

/************************************************************************** */
/* Initialization of all MAC data structures. After this call, all MAC    */
/* data is kept in memory for performance reasons, but is written to disk   */
/* on every change. */

/* Because there can be no access to aci data structures before init,       */
/* rsbac_init_mac() will initialize all rw-spinlocks to unlocked.          */

#ifdef CONFIG_RSBAC_INIT_DELAY
int rsbac_init_um(void)
#else
int __init rsbac_init_um(void)
#endif
  {
    int  err = 0;
    struct proc_dir_entry * tmp_entry_p;
    struct rsbac_list_info_t     * list_info_p;
    struct rsbac_list_lol_info_t * lol_info_p;
    char name[20];
    int i;

    if (rsbac_is_initialized())
      {
        rsbac_printk(KERN_WARNING "rsbac_init_um(): RSBAC already initialized\n");
        return(-RSBAC_EREINIT);
      }

    /* set rw-spinlocks to unlocked status and init data structures */
    rsbac_printk(KERN_INFO "rsbac_init_um(): Initializing RSBAC: User Management subsystem\n");

    list_info_p = kmalloc(sizeof(*list_info_p), GFP_KERNEL);
    if(!list_info_p)
      {
        return -ENOMEM;
      }
    lol_info_p = kmalloc(sizeof(*lol_info_p), GFP_KERNEL);
    if(!lol_info_p)
      {
        kfree(list_info_p);
        return -ENOMEM;
      }

    lol_info_p->version = RSBAC_UM_USER_LIST_VERSION;
    lol_info_p->key = RSBAC_UM_USER_LIST_KEY;
    lol_info_p->desc_size = sizeof(rsbac_uid_t);
    lol_info_p->data_size = sizeof(struct rsbac_um_user_entry_t);
    lol_info_p->subdesc_size = sizeof(rsbac_gid_t);
    lol_info_p->subdata_size = 0;
    lol_info_p->max_age = 0;
    for(i=0; i < RSBAC_UM_NR_USER_LISTS; i++)
      {
        sprintf(name, "%s%u", RSBAC_UM_USER_LIST_NAME, i);
        err = rsbac_list_lol_register(RSBAC_LIST_VERSION,
                                  &user_handle[i],
                                  lol_info_p,
                                  #ifdef CONFIG_RSBAC_DEV_USER_BACKUP
                                  RSBAC_LIST_BACKUP |
                                  #endif
                                  RSBAC_LIST_PERSIST,
                                  NULL,
                                  NULL,
                                  NULL,
                                  NULL,
                                  NULL,
                                  NULL,
                                  name,
                                  RSBAC_AUTO_DEV);
        if(err)
          {
            char * tmp = rsbac_kmalloc(RSBAC_MAXNAMELEN);

            if(tmp)
              {
                rsbac_printk(KERN_WARNING
                       "rsbac_init_um(): Registering user list of lists %u failed with error %s\n",
                       i,
                       get_error_name(tmp, err));
              }
          }
      }

    list_info_p->version = RSBAC_UM_GROUP_LIST_VERSION;
    list_info_p->key = RSBAC_UM_GROUP_LIST_KEY;
    list_info_p->desc_size = sizeof(rsbac_gid_t);
    list_info_p->data_size = sizeof(struct rsbac_um_group_entry_t);
    list_info_p->max_age = 0;
    for(i=0; i < RSBAC_UM_NR_GROUP_LISTS; i++)
      {
        sprintf(name, "%s%u", RSBAC_UM_GROUP_LIST_NAME, i);
        err = rsbac_list_register(RSBAC_LIST_VERSION,
                                  &group_handle[i],
                                  list_info_p,
                                  #ifdef CONFIG_RSBAC_DEV_USER_BACKUP
                                  RSBAC_LIST_BACKUP |
                                  #endif
                                  RSBAC_LIST_PERSIST,
                                  NULL,
                                  NULL,
                                  NULL,
                                  name,
                                  RSBAC_AUTO_DEV);
        if(err)
          {
            char * tmp = rsbac_kmalloc(RSBAC_MAXNAMELEN);

            if(tmp)
              {
                rsbac_printk(KERN_WARNING
                       "rsbac_init_um(): Registering group list %u failed with error %s\n",
                       i,
                       get_error_name(tmp, err));
              }
          }
      }

    #if defined(CONFIG_RSBAC_PROC) && defined(CONFIG_PROC_FS)
    tmp_entry_p = create_proc_entry("stats_um",
                                    S_IFREG | S_IRUGO,
                                    proc_rsbac_root_p);
    if(tmp_entry_p)
      {
        tmp_entry_p->get_info = stats_um_proc_info;
      }
    #endif

#ifdef CONFIG_RSBAC_DEBUG
    if (rsbac_debug_ds_um)
      {
        rsbac_printk(KERN_DEBUG "rsbac_init_um(): Ready.\n");
      }
#endif

    kfree(list_info_p);
    kfree(lol_info_p);
    return(err);
  };

/***************************************************/
/* We also need some status information...         */

int rsbac_stats_um(void)
  {
    u_long user_count = 0;
    u_long group_count = 0;
    u_long member_count = 0;
    int i;
  
    union rsbac_target_id_t       rsbac_target_id;
    union rsbac_attribute_value_t rsbac_attribute_value;

    if (!rsbac_is_initialized())
      {
        rsbac_printk(KERN_WARNING "rsbac_stats_um(): RSBAC not initialized\n");
        return(-RSBAC_ENOTINITIALIZED);
      }
#ifdef CONFIG_RSBAC_DEBUG
    if (rsbac_debug_aef_um)
      {
        rsbac_printk(KERN_DEBUG "rsbac_stats_um(): calling ADF\n");
      }
#endif
    rsbac_target_id.scd = ST_rsbac;
    rsbac_attribute_value.dummy = 0;
    if (!rsbac_adf_request(R_GET_STATUS_DATA,
                           current->pid,
                           T_SCD,
                           rsbac_target_id,
                           A_none,
                           rsbac_attribute_value))
      {
        return -EPERM;
      }

    for(i=0; i < RSBAC_UM_NR_USER_LISTS; i++)
      {
        user_count += rsbac_list_lol_count(user_handle[i]);
        member_count += rsbac_list_lol_all_subcount(user_handle[i]);
      }
    for(i=0; i < RSBAC_UM_NR_GROUP_LISTS; i++)
      {
        group_count += rsbac_list_count(group_handle[i]);
      }
    rsbac_printk(KERN_INFO "UM Status\n---------\n");

    rsbac_printk(KERN_INFO "%lu user items with sum of %lu group memberships, %lu group items\n",
                   user_count,
                   member_count,
                   group_count);
    return(0);
  };

/************************************************* */
/*               Access functions                  */
/************************************************* */

/* Trying to access a never created or removed user entry returns an error! */
#ifndef offset_in_page
#define offset_in_page(p) ((unsigned long)(p) & ~PAGE_MASK)
#endif

static inline void new_salt(__u32 * salt_p)
  {
    *salt_p = 0;
    while(!*salt_p)
      get_random_bytes(salt_p, sizeof(*salt_p));
  }

int rsbac_um_hash(char * pass, __u32 salt)
  {
#ifdef CONFIG_RSBAC_UM_DIGEST
    char * buffer;
    struct scatterlist sg[1];
    struct crypto_tfm *tfm;
    u_int len;
    u_int plen;

    plen = strlen(pass);
    len = rsbac_max(plen + sizeof(salt), RSBAC_UM_PASS_LEN);
    buffer = rsbac_kmalloc(len);
    if(!buffer)
      return -RSBAC_ENOMEM;

    if(!crypto_alg_available("sha1",0))
      {
        rsbac_printk(KERN_WARNING
                     "rsbac_um_hash(): User management configured for crypto API with SHA1, but SHA1 is not available!\n");
        rsbac_kfree(buffer);
        return -RSBAC_ENOTFOUND;
      }
    tfm = crypto_alloc_tfm("sha1", 0);
    if(!tfm)
      {
        rsbac_printk(KERN_WARNING
                     "rsbac_um_hash(): Could not allocate tfm for SHA1!\n");
        rsbac_kfree(buffer);
        return -RSBAC_ENOMEM;
      }
    memset(buffer, 0, len);
    memcpy(buffer, &salt, sizeof(salt));
    strcpy(buffer + sizeof(salt), pass);
    sg[0].page = virt_to_page(buffer);
    sg[0].offset = offset_in_page(buffer);
    sg[0].length = plen + sizeof(salt);
    
    crypto_digest_init(tfm);
    crypto_digest_update(tfm, sg, 1);
    crypto_digest_final(tfm, buffer);
    crypto_free_tfm(tfm);

    memcpy(pass, buffer, RSBAC_UM_PASS_LEN);
    rsbac_kfree(buffer);
    return 0;
#else
    /* no crypto: just zero rest of string to allow comparizon */
    u_int len;

    len=strlen(pass);
    if(len < RSBAC_UM_PASS_LEN)
      memset(pass + len, 0, RSBAC_UM_PASS_LEN - len);
    return 0;
#endif
  }

int rsbac_um_get_uid(
  rsbac_list_ta_number_t ta_number,
  char * name,
  rsbac_uid_t * uid_p)
  {
    int i;

    if(!name || !uid_p)
      return -RSBAC_EINVALIDPOINTER;
    for(i=0; i<RSBAC_UM_NR_USER_LISTS; i++)
      {
        if(!rsbac_ta_list_lol_get_desc(ta_number,
                                       user_handle[i],
                                       uid_p,
                                       name,
                                       name_compare))
          return 0;
      }
    return -RSBAC_ENOTFOUND;
  }

int rsbac_um_get_gid(
  rsbac_list_ta_number_t ta_number,
  char * name,
  rsbac_gid_t * gid_p)
  {
    int i;

    if(!name || !gid_p)
      return -RSBAC_EINVALIDPOINTER;
    for(i=0; i<RSBAC_UM_NR_GROUP_LISTS; i++)
      {
        if(!rsbac_ta_list_get_desc(ta_number,
                                   group_handle[i],
                                   gid_p,
                                   name,
                                   group_name_compare))
          return 0;
      }
    return -RSBAC_ENOTFOUND;
  }

int rsbac_um_add_user(
  rsbac_list_ta_number_t ta_number,
  rsbac_uid_t * user_p,
  struct rsbac_um_user_entry_t * entry_p,
  char * pass,
  rsbac_time_t ttl)
  {
    int err;
    rsbac_uid_t user;

    if (!rsbac_is_initialized())
      {
        rsbac_printk(KERN_WARNING "rsbac_um_add_user(): RSBAC not initialized\n");
        return(-RSBAC_ENOTINITIALIZED);
      }
    if(!entry_p)
      return -RSBAC_EINVALIDPOINTER;
    user = *user_p;
    if(!rsbac_um_get_uid(ta_number, entry_p->name, &user))
      return -RSBAC_EEXISTS;
#ifdef CONFIG_RSBAC_UM_EXCL
    if(!rsbac_um_no_excl && !rsbac_ta_list_exist(ta_number, group_handle[group_hash(entry_p->group)], &entry_p->group))
      {
        rsbac_printk(KERN_INFO
                     "rsbac_um_add_user(): gid %u not known to RSBAC User Management!\n",
                     entry_p->group);
        return -RSBAC_EINVALIDVALUE;
      }
#endif
    if(user == RSBAC_NO_USER)
      {
        user = CONFIG_RSBAC_UM_USER_MIN;
        while(rsbac_ta_list_lol_exist(ta_number, user_handle[user_hash(user)], &user))
          user++;
      }
    else
      if(rsbac_ta_list_lol_exist(ta_number, user_handle[user_hash(user)], &user))
        return -RSBAC_EEXISTS;
#ifdef CONFIG_RSBAC_DEBUG
    if (rsbac_debug_aef_um)
      {
        rsbac_printk(KERN_DEBUG "rsbac_um_add_user(): adding user %u\n",
                     user);
      }
#endif
    if(pass)
      {
        __u32 salt;

        new_salt(&salt);
        err = rsbac_um_hash(pass, salt);
        if(err)
          return err;
        memcpy(entry_p->pass, &salt, sizeof(salt));
        memcpy(entry_p->pass + sizeof(salt), pass, RSBAC_UM_PASS_LEN - sizeof(salt));
      }
    else
      memset(entry_p->pass, 0, RSBAC_UM_PASS_LEN);
    err = rsbac_ta_list_lol_add_ttl(ta_number, user_handle[user_hash(user)],
                                    ttl, &user, entry_p);
    if(!err)
      *user_p = user;
    return err;
  }

int rsbac_um_add_group(
  rsbac_list_ta_number_t ta_number,
  rsbac_gid_t * group_p,
  struct rsbac_um_group_entry_t * entry_p,
  char * pass,
  rsbac_time_t ttl)
  {
    int err;

    if (!rsbac_is_initialized())
      {
        rsbac_printk(KERN_WARNING "rsbac_um_add_group(): RSBAC not initialized\n");
        return(-RSBAC_ENOTINITIALIZED);
      }
    if(!entry_p)
      return -RSBAC_EINVALIDPOINTER;
    if(!rsbac_um_get_gid(ta_number, entry_p->name, group_p))
      return -RSBAC_EEXISTS;
    if(*group_p == RSBAC_NO_USER)
      {
        *group_p = CONFIG_RSBAC_UM_GROUP_MIN;
        while(rsbac_ta_list_exist(ta_number, group_handle[group_hash(*group_p)], group_p))
          *group_p++;
      }
    else
      if(rsbac_ta_list_exist(ta_number, group_handle[group_hash(*group_p)], group_p))
        return -RSBAC_EEXISTS;
#ifdef CONFIG_RSBAC_DEBUG
      if (rsbac_debug_aef_um)
        {
          rsbac_printk(KERN_DEBUG "rsbac_um_add_group(): adding group %u\n",
                       *group_p);
      }
#endif
    if(pass)
      {
        __u32 salt;

        new_salt(&salt);
        err = rsbac_um_hash(pass, salt);
        if(err)
          return err;
        memcpy(entry_p->pass, &salt, sizeof(salt));
        memcpy(entry_p->pass + sizeof(salt), pass, RSBAC_UM_PASS_LEN - sizeof(salt));
      }
    else
      memset(entry_p->pass, 0, RSBAC_UM_PASS_LEN);
    return rsbac_ta_list_add_ttl(ta_number, group_handle[group_hash(*group_p)], ttl, group_p, entry_p);
  }

int rsbac_um_add_gm(
  rsbac_list_ta_number_t ta_number,
  rsbac_uid_t user,
  rsbac_gid_t group,
  rsbac_time_t ttl)
  {
    if (!rsbac_is_initialized())
      {
        rsbac_printk(KERN_WARNING "rsbac_um_add_gm(): RSBAC not initialized\n");
        return(-RSBAC_ENOTINITIALIZED);
      }
#ifdef CONFIG_RSBAC_UM_EXCL
    if(!rsbac_um_no_excl)
      {
        if(!rsbac_ta_list_exist(ta_number, user_handle[user_hash(user)], &user))
          {
            rsbac_printk(KERN_INFO
                         "rsbac_um_add_gm(): uid %u not known to RSBAC User Management!\n",
                         user);
            return -RSBAC_ENOTFOUND;
          }
        if(!rsbac_ta_list_exist(ta_number, group_handle[group_hash(group)], &group))
          {
            rsbac_printk(KERN_INFO
                         "rsbac_um_add_gm(): gid %u not known to RSBAC User Management!\n",
                         group);
            return -RSBAC_ENOTFOUND;
          }
      }
#endif
#ifdef CONFIG_RSBAC_DEBUG
      if (rsbac_debug_aef_um)
        {
          rsbac_printk(KERN_DEBUG "rsbac_um_add_gm(): adding user %u group %u\n",
                       user,
                       group);
      }
#endif
    return rsbac_ta_list_lol_subadd_ttl(ta_number, user_handle[user_hash(user)],
                                        ttl, &user, &group, NULL);
  }

int rsbac_um_mod_user(
  rsbac_list_ta_number_t ta_number,
  rsbac_uid_t user,
  enum rsbac_um_mod_t mod,
  union rsbac_um_mod_data_t * data_p)
  {
    int err;
    struct rsbac_um_user_entry_t * entry_p;

    if (!rsbac_is_initialized())
      {
        rsbac_printk(KERN_WARNING "rsbac_um_mod_user(): RSBAC not initialized\n");
        return(-RSBAC_ENOTINITIALIZED);
      }
    if(   !data_p
       && (mod != UM_pass)
      )
      return -RSBAC_EINVALIDPOINTER;
    if(!rsbac_ta_list_lol_exist(ta_number, user_handle[user_hash(user)], &user))
      return -RSBAC_ENOTFOUND;

    entry_p = rsbac_kmalloc(sizeof(*entry_p));
    if(!entry_p)
      return -RSBAC_ENOMEM;
    err = rsbac_ta_list_lol_get_data_ttl(ta_number, user_handle[user_hash(user)],
                                         NULL, &user, entry_p);
    if(err)
      {
        rsbac_kfree(entry_p);
        return err;
      }
#ifdef CONFIG_RSBAC_DEBUG
      if (rsbac_debug_aef_um)
        {
          rsbac_printk(KERN_DEBUG "rsbac_um_mod_user(): modifying user %u\n",
                       user);
      }
#endif
    switch(mod)
      {
        case UM_name:
          {
            rsbac_uid_t tmp_user;

            if(   !rsbac_um_get_uid(ta_number, data_p->string, &tmp_user)
               && (tmp_user != user)
              )
              return -RSBAC_EEXISTS;
            strncpy(entry_p->name, data_p->string, RSBAC_UM_NAME_LEN);
            entry_p->name[RSBAC_UM_NAME_LEN - 1] = 0;
          }
          break;

        case UM_pass:
          if(data_p)
            {
              __u32 salt;

              new_salt(&salt);
              err = rsbac_um_hash(data_p->string, salt);
              if(err)
                {
                  rsbac_kfree(entry_p);
                  return err;
                }
              memcpy(entry_p->pass, &salt, sizeof(salt));
              memcpy(entry_p->pass + sizeof(salt), data_p->string, RSBAC_UM_PASS_LEN - sizeof(salt));
            }
          else
            memset(entry_p->pass, 0, RSBAC_UM_PASS_LEN);
          entry_p->lastchange = RSBAC_CURRENT_TIME / 86400;
          break;

        case UM_cryptpass:
          memcpy(entry_p->pass, data_p->string, RSBAC_UM_PASS_LEN);
          break;

        case UM_fullname:
          strncpy(entry_p->fullname, data_p->string, RSBAC_UM_FULLNAME_LEN);
          entry_p->fullname[RSBAC_UM_FULLNAME_LEN - 1] = 0;
          break;

        case UM_homedir:
          strncpy(entry_p->homedir, data_p->string, RSBAC_UM_HOMEDIR_LEN);
          entry_p->homedir[RSBAC_UM_HOMEDIR_LEN - 1] = 0;
          break;

        case UM_shell:
          strncpy(entry_p->shell, data_p->string, RSBAC_UM_SHELL_LEN);
          entry_p->shell[RSBAC_UM_SHELL_LEN - 1] = 0;
          break;

        case UM_group:
#ifdef CONFIG_RSBAC_UM_EXCL
          if(!rsbac_um_no_excl && !rsbac_ta_list_exist(ta_number, group_handle[group_hash(data_p->group)], &data_p->group))
            {
              rsbac_printk(KERN_INFO
                     "rsbac_um_mod_user(): gid %u not known to RSBAC User Management!\n",
                     data_p->group);
              rsbac_kfree(entry_p);
              return -RSBAC_EINVALIDVALUE;
            }
#endif
          entry_p->group = data_p->group;
          break;

        case UM_lastchange:
          entry_p->lastchange = data_p->days;
          break;

        case UM_minchange:
          entry_p->minchange = data_p->days;
          break;

        case UM_maxchange:
          entry_p->maxchange = data_p->days;
          break;

        case UM_warnchange:
          entry_p->warnchange = data_p->days;
          break;

        case UM_inactive:
          entry_p->inactive = data_p->days;
          break;

        case UM_expire:
          entry_p->expire = data_p->days;
          break;

        case UM_ttl:
          err = rsbac_ta_list_lol_add_ttl(ta_number, user_handle[user_hash(user)],
                                          data_p->ttl, &user, entry_p);
          rsbac_kfree(entry_p);
          return err;

        default:
          rsbac_kfree(entry_p);
          return -RSBAC_EINVALIDREQUEST;
      }

    err = rsbac_ta_list_lol_add_ttl(ta_number, user_handle[user_hash(user)],
                                    RSBAC_LIST_TTL_KEEP, &user, entry_p);
    rsbac_kfree(entry_p);
    return err;
  }

int rsbac_um_mod_group(
  rsbac_list_ta_number_t ta_number,
  rsbac_uid_t group,
  enum rsbac_um_mod_t mod,
  union rsbac_um_mod_data_t * data_p)
  {
    int err;
    struct rsbac_um_group_entry_t * entry_p;

    if (!rsbac_is_initialized())
      {
        rsbac_printk(KERN_WARNING "rsbac_um_mod_group(): RSBAC not initialized\n");
        return(-RSBAC_ENOTINITIALIZED);
      }
    if(   !data_p
       && (mod != UM_pass)
      )
      return -RSBAC_EINVALIDPOINTER;
    if(!rsbac_ta_list_exist(ta_number, group_handle[group_hash(group)], &group))
      return -RSBAC_ENOTFOUND;

    entry_p = rsbac_kmalloc(sizeof(*entry_p));
    if(!entry_p)
      return -RSBAC_ENOMEM;
    err = rsbac_ta_list_get_data_ttl(ta_number, group_handle[group_hash(group)],
                                     NULL, &group, entry_p);
    if(err)
      {
        rsbac_kfree(entry_p);
        return err;
      }
#ifdef CONFIG_RSBAC_DEBUG
      if (rsbac_debug_aef_um)
        {
          rsbac_printk(KERN_DEBUG "rsbac_um_mod_group(): modifying group %u\n",
                       group);
      }
#endif
    switch(mod)
      {
        case UM_name:
          {
            rsbac_gid_t tmp_group;

            if(   !rsbac_um_get_gid(ta_number, data_p->string, &tmp_group)
               && (tmp_group != group)
              )
              return -RSBAC_EEXISTS;
            strncpy(entry_p->name, data_p->string, RSBAC_UM_NAME_LEN);
            entry_p->name[RSBAC_UM_NAME_LEN - 1] = 0;
          }
          break;

        case UM_pass:
          if(data_p)
            {
              __u32 salt;

              new_salt(&salt);
              err = rsbac_um_hash(data_p->string, salt);
              if(err)
                {
                  rsbac_kfree(entry_p);
                  return err;
                }
              memcpy(entry_p->pass, &salt, sizeof(salt));
              memcpy(entry_p->pass + sizeof(salt), data_p->string, RSBAC_UM_PASS_LEN - sizeof(salt));
            }
          else
            memset(entry_p->pass, 0, RSBAC_UM_PASS_LEN);
          break;

        case UM_cryptpass:
          memcpy(entry_p->pass, data_p->string, RSBAC_UM_PASS_LEN);
          break;

        case UM_ttl:
          err = rsbac_ta_list_add_ttl(ta_number, group_handle[group_hash(group)],
                                      data_p->ttl, &group, entry_p);
          rsbac_kfree(entry_p);
          return err;

        default:
          rsbac_kfree(entry_p);
          return -RSBAC_EINVALIDREQUEST;
      }

    err = rsbac_ta_list_add_ttl(ta_number, group_handle[group_hash(group)],
                                RSBAC_LIST_TTL_KEEP, &group, entry_p);
    rsbac_kfree(entry_p);
    return err;
  }

int rsbac_um_get_user_item(
  rsbac_list_ta_number_t ta_number,
  rsbac_uid_t user,
  enum rsbac_um_mod_t mod,
  union rsbac_um_mod_data_t * data_p)
  {
    int err;
    struct rsbac_um_user_entry_t * entry_p;

    if (!rsbac_is_initialized())
      {
        rsbac_printk(KERN_WARNING "rsbac_um_get_user_item(): RSBAC not initialized\n");
        return(-RSBAC_ENOTINITIALIZED);
      }
    if(!data_p)
      return -RSBAC_EINVALIDPOINTER;
    if(!rsbac_ta_list_lol_exist(ta_number, user_handle[user_hash(user)], &user))
      return -RSBAC_ENOTFOUND;
    if(mod == UM_ttl)
      return rsbac_ta_list_lol_get_data_ttl(ta_number, user_handle[user_hash(user)], &data_p->ttl, &user, NULL);

    entry_p = rsbac_kmalloc(sizeof(*entry_p));
    if(!entry_p)
      return -RSBAC_ENOMEM;
    err = rsbac_ta_list_lol_get_data_ttl(ta_number, user_handle[user_hash(user)],
                                         NULL, &user, entry_p);
    if(err)
      {
        rsbac_kfree(entry_p);
        return err;
      }
    switch(mod)
      {
        case UM_name:
          strcpy(data_p->string, entry_p->name);
          break;

        case UM_pass:
          memcpy(data_p->string, entry_p->pass, RSBAC_UM_PASS_LEN);
          break;

        case UM_fullname:
          strcpy(data_p->string, entry_p->fullname);
          break;

        case UM_homedir:
          strcpy(data_p->string, entry_p->homedir);
          break;

        case UM_shell:
          strcpy(data_p->string, entry_p->shell);
          break;

        case UM_group:
          data_p->group = entry_p->group;
          break;

        case UM_lastchange:
          data_p->days = entry_p->lastchange;
          break;

        case UM_minchange:
          data_p->days = entry_p->minchange;
          break;

        case UM_maxchange:
          data_p->days = entry_p->maxchange;
          break;

        case UM_warnchange:
          data_p->days = entry_p->warnchange;
          break;

        case UM_inactive:
          data_p->days = entry_p->inactive;
          break;

        case UM_expire:
          data_p->days = entry_p->expire;
          break;

        default:
          rsbac_kfree(entry_p);
          return -RSBAC_EINVALIDREQUEST;
      }

    rsbac_kfree(entry_p);
    return 0;
  }

int rsbac_um_get_group_item(
  rsbac_list_ta_number_t ta_number,
  rsbac_gid_t group,
  enum rsbac_um_mod_t mod,
  union rsbac_um_mod_data_t * data_p)
  {
    int err;
    struct rsbac_um_group_entry_t * entry_p;

    if (!rsbac_is_initialized())
      {
        rsbac_printk(KERN_WARNING "rsbac_um_get_group_item(): RSBAC not initialized\n");
        return(-RSBAC_ENOTINITIALIZED);
      }
    if(!data_p)
      return -RSBAC_EINVALIDPOINTER;
    if(!rsbac_ta_list_exist(ta_number, group_handle[group_hash(group)], &group))
      return -RSBAC_ENOTFOUND;
    if(mod == UM_ttl)
      return rsbac_ta_list_get_data_ttl(ta_number, group_handle[group_hash(group)], &data_p->ttl, &group, NULL);

    entry_p = rsbac_kmalloc(sizeof(*entry_p));
    if(!entry_p)
      return -RSBAC_ENOMEM;
    err = rsbac_ta_list_get_data_ttl(ta_number, group_handle[group_hash(group)],
                                     NULL, &group, entry_p);
    if(err)
      {
        rsbac_kfree(entry_p);
        return err;
      }
    switch(mod)
      {
        case UM_name:
          strcpy(data_p->string, entry_p->name);
          break;

        case UM_pass:
          memcpy(data_p->string, entry_p->pass, RSBAC_UM_PASS_LEN);
          break;

        default:
          rsbac_kfree(entry_p);
          return -RSBAC_EINVALIDREQUEST;
      }

    rsbac_kfree(entry_p);
    return 0;
  }

int rsbac_um_user_exists(
  rsbac_list_ta_number_t ta_number,
  rsbac_uid_t user)
  {
    return rsbac_ta_list_lol_exist(ta_number, user_handle[user_hash(user)], &user);
  }

int rsbac_um_group_exists(
  rsbac_list_ta_number_t ta_number,
  rsbac_gid_t group)
  {
    return rsbac_ta_list_exist(ta_number, group_handle[group_hash(group)], &group);
  }

int rsbac_um_remove_user(
  rsbac_list_ta_number_t ta_number,
  rsbac_uid_t user)
  {
    if(!rsbac_ta_list_lol_exist(ta_number,user_handle[user_hash(user)], &user))
      return -RSBAC_ENOTFOUND;
    return rsbac_ta_list_lol_remove(ta_number, user_handle[user_hash(user)], &user);
  }

int rsbac_um_remove_group(
  rsbac_list_ta_number_t ta_number,
  rsbac_gid_t group)
  {
    int i;

    if(!rsbac_ta_list_exist(ta_number, group_handle[group_hash(group)], &group))
      return -RSBAC_ENOTFOUND;
    for(i=0; i<RSBAC_UM_NR_USER_LISTS; i++)
      rsbac_ta_list_lol_subremove_from_all(ta_number, user_handle[i], &group);
    return rsbac_ta_list_remove(ta_number, group_handle[group_hash(group)], &group);
  }

int rsbac_um_remove_gm(
  rsbac_list_ta_number_t ta_number,
  rsbac_uid_t user,
  rsbac_gid_t group)
  {
    if (!rsbac_is_initialized())
      {
        rsbac_printk(KERN_WARNING "rsbac_um_remove_gm(): RSBAC not initialized\n");
        return(-RSBAC_ENOTINITIALIZED);
      }
#ifdef CONFIG_RSBAC_DEBUG
      if (rsbac_debug_aef_um)
        {
          rsbac_printk(KERN_DEBUG "rsbac_um_remove_gm(): removing user %u group %u\n",
                       user,
                       group);
      }
#endif
    return rsbac_ta_list_lol_subremove(ta_number, user_handle[user_hash(user)], &user, &group);
  }

int rsbac_um_get_user_entry(
  rsbac_list_ta_number_t ta_number,
  rsbac_uid_t user,
  struct rsbac_um_user_entry_t * entry_p,
  rsbac_time_t * ttl_p)
  {
    return rsbac_ta_list_lol_get_data_ttl(ta_number, user_handle[user_hash(user)], ttl_p, &user, entry_p);
  }

int rsbac_um_get_next_user(
  rsbac_list_ta_number_t ta_number,
  rsbac_uid_t old_user,
  rsbac_uid_t * next_user_p)
  {
    rsbac_uid_t * old_user_p;
    int i;
    int err;

    if(old_user == RSBAC_NO_USER)
      old_user_p = NULL;
    else
      old_user_p = &old_user;

    for(i=0; i<RSBAC_UM_NR_USER_LISTS; i++)
      {
        err = rsbac_ta_list_lol_get_next_desc(ta_number, user_handle[i], old_user_p, next_user_p);
        if(err != -RSBAC_ENOTFOUND)
          return err;
      }
    return -RSBAC_ENOTFOUND;
  }

int rsbac_um_get_user_list(
  rsbac_list_ta_number_t ta_number,
  rsbac_uid_t ** list_pp)
  {
    int i;
    long all_count = 0;
    long copy_count = 0;
    long tmp_count;
    rsbac_uid_t * tmp_list_p;
    rsbac_uid_t * collect_list_p;
    rsbac_uid_t * p;

    for(i=0; i<RSBAC_UM_NR_USER_LISTS; i++)
      {
        tmp_count = rsbac_ta_list_lol_count(ta_number, user_handle[i]);
        if(tmp_count > 0)
          all_count += tmp_count;
      }
    if(!list_pp || !all_count)
      return all_count;

    /* provide some extra room in case new users have been added during this function run */
    all_count += EXTRA_ROOM;
    collect_list_p = rsbac_vmalloc(all_count * sizeof(rsbac_uid_t));
    if(!collect_list_p)
      return -RSBAC_ENOMEM;
    p = collect_list_p;
    for(i=0; i<RSBAC_UM_NR_USER_LISTS; i++)
      {
        tmp_count = rsbac_ta_list_lol_get_all_desc(ta_number, user_handle[i], (void *) &tmp_list_p);
        if(tmp_count > 0)
          {
            tmp_count = rsbac_min(tmp_count, all_count - copy_count);
            if(tmp_count)
              memcpy(p, tmp_list_p, tmp_count * sizeof(rsbac_uid_t));
            rsbac_vfree(tmp_list_p);
            p += tmp_count;
            copy_count += tmp_count;
            if(copy_count >= all_count)
              break;
          }
      }
    if(!copy_count)
      rsbac_vfree(collect_list_p);
    else
      *list_pp = collect_list_p;
    return copy_count;
  }

int rsbac_um_get_gm_list(
  rsbac_list_ta_number_t ta_number,
  rsbac_uid_t user,
  rsbac_gid_t ** list_pp)
  {
    if(!list_pp)
      return rsbac_ta_list_lol_subcount(ta_number, user_handle[user_hash(user)], &user);
    else
      return rsbac_ta_list_lol_get_all_subdesc_ttl(ta_number, user_handle[user_hash(user)],
                                                   &user, (void **) list_pp, NULL);
  }

int rsbac_um_get_gm_user_list(
  rsbac_list_ta_number_t ta_number,
  rsbac_gid_t group,
  rsbac_uid_t ** list_pp)
  {
    int i;
    int j;
    long all_count = 0;
    long copy_count = 0;
    long tmp_count;
    rsbac_uid_t * tmp_list_p;
    rsbac_uid_t * collect_list_p;
    rsbac_uid_t * p;

#ifdef CONFIG_RSBAC_UM_EXCL
    if(!rsbac_um_no_excl && !rsbac_ta_list_exist(ta_number, group_handle[group_hash(group)], &group))
      {
        return -RSBAC_ENOTFOUND;
      }
#endif
    for(i=0; i<RSBAC_UM_NR_USER_LISTS; i++)
      {
        tmp_count = rsbac_ta_list_lol_count(ta_number, user_handle[i]);
        if(tmp_count > 0)
          all_count += tmp_count;
      }
    if(!list_pp || !all_count)
      return all_count;

    /* provide some extra room in case new groups have been added during this function run */
    all_count += EXTRA_ROOM;
    collect_list_p = rsbac_vmalloc(all_count * sizeof(rsbac_uid_t));
    if(!collect_list_p)
      return -RSBAC_ENOMEM;
    p = collect_list_p;
    for(i=0; i<RSBAC_UM_NR_USER_LISTS; i++)
      {
        tmp_count = rsbac_ta_list_lol_get_all_desc(ta_number, user_handle[i], (void *) &tmp_list_p);
        if(tmp_count > 0)
          {
            tmp_count = rsbac_min(tmp_count, all_count - copy_count);
            for(j=0; j<tmp_count; j++)
              {
                if(rsbac_ta_list_lol_subexist(ta_number, user_handle[i], &tmp_list_p[j], &group))
                  {
                    *p = tmp_list_p[j];
                    p++;
                    copy_count++;
                  }
              }
            rsbac_vfree(tmp_list_p);
            if(copy_count >= all_count)
              break;
          }
      }
    if(!copy_count)
      rsbac_vfree(collect_list_p);
    else
      *list_pp = collect_list_p;
    return copy_count;
  }

int rsbac_um_get_group_list(
  rsbac_list_ta_number_t ta_number,
  rsbac_gid_t ** list_pp)
  {
    int i;
    long all_count = 0;
    long copy_count = 0;
    long tmp_count;
    rsbac_gid_t * tmp_list_p;
    rsbac_gid_t * collect_list_p;
    rsbac_gid_t * p;

    for(i=0; i<RSBAC_UM_NR_GROUP_LISTS; i++)
      {
        tmp_count = rsbac_ta_list_count(ta_number, group_handle[i]);
        if(tmp_count > 0)
          all_count += tmp_count;
      }
    if(!list_pp || !all_count)
      return all_count;

    /* provide some extra room in case new groups have been added during this function run */
    all_count += EXTRA_ROOM;
    collect_list_p = rsbac_vmalloc(all_count * sizeof(rsbac_gid_t));
    if(!collect_list_p)
      return -RSBAC_ENOMEM;
    p = collect_list_p;
    for(i=0; i<RSBAC_UM_NR_GROUP_LISTS; i++)
      {
        tmp_count = rsbac_ta_list_get_all_desc(ta_number, group_handle[i], (void *) &tmp_list_p);
        if(tmp_count > 0)
          {
            tmp_count = rsbac_min(tmp_count, all_count - copy_count);
            if(tmp_count)
              memcpy(p, tmp_list_p, tmp_count * sizeof(rsbac_gid_t));
            rsbac_vfree(tmp_list_p);
            p += tmp_count;
            copy_count += tmp_count;
            if(copy_count >= all_count)
              break;
          }
      }
    if(!copy_count)
      rsbac_vfree(collect_list_p);
    else
      *list_pp = collect_list_p;
    return copy_count;
  }

int rsbac_um_check_pass(rsbac_uid_t uid,
                        char * pass)
  {
      int err;
      struct rsbac_um_user_entry_t * entry_p;
      __u32 salt;
      u_long curdays;

      if(!pass)
        return -RSBAC_EINVALIDPOINTER;
      entry_p = rsbac_kmalloc(sizeof(*entry_p));
      if(!entry_p)
        return -RSBAC_ENOMEM;
      err = rsbac_ta_list_lol_get_data_ttl(0, user_handle[user_hash(uid)],
                                           NULL, &uid, entry_p);
      if(err)
        goto out_free;

#ifdef CONFIG_RSBAC_DEBUG
      if (rsbac_debug_aef_um)
        {
          rsbac_printk(KERN_DEBUG "rsbac_um_check_pass(): checking password for user %u\n",
                       uid);
      }
#endif
      /* check whether account or password has expired */
      curdays = RSBAC_CURRENT_TIME / 86400;
      if ((curdays > entry_p->expire) && (entry_p->expire != -1)
            && (entry_p->expire != 0) && (entry_p->lastchange != 0))
        {
          err = -RSBAC_EEXPIRED;
#ifdef CONFIG_RSBAC_DEBUG
          if (rsbac_debug_aef_um)
            {
              rsbac_printk(KERN_DEBUG "rsbac_um_check_pass(): account for user %u has expired\n",
                           uid);
      }
#endif
          goto out_free;
        }
      if(   (curdays > (entry_p->lastchange + entry_p->maxchange + entry_p->inactive))
         && (entry_p->maxchange != -1)
         && (entry_p->maxchange)
         && (entry_p->inactive != -1)
         && (entry_p->inactive)
         && (entry_p->lastchange)
        )
        {
          err = -RSBAC_EEXPIRED;
#ifdef CONFIG_RSBAC_DEBUG
          if (rsbac_debug_aef_um)
            {
              rsbac_printk(KERN_DEBUG "rsbac_um_check_pass(): password for user %u has expired\n",
                           uid);
      }
#endif
          goto out_free;
        }

      salt = *((__u32*) entry_p->pass);
      if(!salt)
        {
          err = -EPERM;
          goto out_free;
        }
      err = rsbac_um_hash(pass, salt);
      if(err)
        return err;
      if(memcmp(pass, entry_p->pass + sizeof(salt), RSBAC_UM_PASS_LEN - sizeof(salt)))
        err = -EPERM;
      else
        err = 0;

out_free:
      rsbac_kfree(entry_p);
      if(err)
        ssleep(1);
      return err;
  }

int rsbac_um_good_pass(char * pass)
  {
    #ifdef CONFIG_RSBAC_UM_NON_ALPHA
    char * p;
    #endif

    if(!pass)
      return -RSBAC_EINVALIDPOINTER;
    if(strlen(pass) < CONFIG_RSBAC_UM_MIN_PASS_LEN)
      return -RSBAC_EWEAKPASSWORD;

    #ifdef CONFIG_RSBAC_UM_NON_ALPHA
    p = pass;
    while(   *p
          && (   (   (*p >= 'a')
                  && (*p <= 'z')
                 )
              || (   (*p >= 'A')
                  && (*p <= 'Z')
                 )
             )
         )
      p++;
    if(!(*p))
      return -RSBAC_EWEAKPASSWORD;
    #endif

    return 0;
  }

int rsbac_um_set_pass(rsbac_uid_t uid,
                      char * pass)
  {
      int err;
      struct rsbac_um_user_entry_t * entry_p;
      __u32 salt;

      entry_p = rsbac_kmalloc(sizeof(*entry_p));
      if(!entry_p)
        return -RSBAC_ENOMEM;
      err = rsbac_ta_list_lol_get_data_ttl(0, user_handle[user_hash(uid)],
                                           NULL, &uid, entry_p);
      if(err)
        goto out_free;

#ifdef CONFIG_RSBAC_DEBUG
      if (rsbac_debug_aef_um)
        {
          rsbac_printk(KERN_DEBUG "rsbac_um_set_pass(): setting password for user %u\n",
                       uid);
      }
#endif
      if(pass)
        {
          new_salt(&salt);
          err = rsbac_um_hash(pass, salt);
          if(err)
            goto out_free;
          memcpy(entry_p->pass, &salt, sizeof(salt));
          memcpy(entry_p->pass + sizeof(salt), pass, RSBAC_UM_PASS_LEN - sizeof(salt));
        }
      else
        memset(entry_p->pass, 0, RSBAC_UM_PASS_LEN);
      entry_p->lastchange = RSBAC_CURRENT_TIME / 86400;
      err = rsbac_ta_list_lol_add_ttl(0, user_handle[user_hash(uid)],
                                      0, &uid, entry_p);

out_free:
      rsbac_kfree(entry_p);
      return err;
  }

int rsbac_um_set_group_pass(rsbac_gid_t gid,
                            char * pass)
  {
      int err;
      struct rsbac_um_group_entry_t * entry_p;
      __u32 salt;

      entry_p = rsbac_kmalloc(sizeof(*entry_p));
      if(!entry_p)
        return -RSBAC_ENOMEM;
      err = rsbac_ta_list_get_data_ttl(0, group_handle[group_hash(gid)],
                                       NULL, &gid, entry_p);
      if(err)
        goto out_free;

#ifdef CONFIG_RSBAC_DEBUG
      if (rsbac_debug_aef_um)
        {
          rsbac_printk(KERN_DEBUG "rsbac_um_set_group_pass(): setting password for group %u\n",
                       gid);
      }
#endif
      if(pass)
        {
          new_salt(&salt);
          err = rsbac_um_hash(pass, salt);
          if(err)
            goto out_free;
          memcpy(entry_p->pass, &salt, sizeof(salt));
          memcpy(entry_p->pass + sizeof(salt), pass, RSBAC_UM_PASS_LEN - sizeof(salt));
        }
      else
        memset(entry_p->pass, 0, RSBAC_UM_PASS_LEN);
      err = rsbac_ta_list_add_ttl(0, group_handle[group_hash(gid)], 0, &gid, entry_p);

out_free:
      rsbac_kfree(entry_p);
      return err;
  }

int rsbac_um_check_account(rsbac_uid_t uid)
  {
      int err;
      struct rsbac_um_user_entry_t * entry_p;
      u_long curdays;

      entry_p = rsbac_kmalloc(sizeof(*entry_p));
      if(!entry_p)
        return -RSBAC_ENOMEM;
      err = rsbac_ta_list_lol_get_data_ttl(0, user_handle[user_hash(uid)],
                                           NULL, &uid, entry_p);
      if(err)
        goto out_free;

#ifdef CONFIG_RSBAC_DEBUG
      if (rsbac_debug_aef_um)
        rsbac_printk(KERN_DEBUG "rsbac_um_check_account(): checking account for user %u\n",
                     uid);
#endif
      /* check whether account or password has expired */
      curdays = RSBAC_CURRENT_TIME / 86400;
      if(   *((__u32*) entry_p->pass)
         && !entry_p->lastchange
        )
        {
          err = -RSBAC_EMUSTCHANGE;
#ifdef CONFIG_RSBAC_DEBUG
          if (rsbac_debug_aef_um)
            rsbac_printk(KERN_DEBUG "rsbac_um_check_account(): user %u must change password, lastchange = 0\n",
                         uid);
#endif
          goto out_free;
        }
      if(  (curdays > entry_p->expire)
         && (entry_p->expire != -1)
         && (entry_p->expire)
        )
        {
          err = -RSBAC_EEXPIRED;
#ifdef CONFIG_RSBAC_DEBUG
          if (rsbac_debug_aef_um)
            {
              rsbac_printk(KERN_DEBUG "rsbac_um_check_account(): account for user %u has expired\n",
                           uid);
            }
#endif
          goto out_free;
        }
      if(   (curdays > (entry_p->lastchange + entry_p->maxchange + entry_p->inactive))
         && (entry_p->maxchange != -1)
         && (entry_p->maxchange)
         && (entry_p->inactive != -1)
         && (entry_p->inactive)
        )
        {
          err = -RSBAC_EEXPIRED;
#ifdef CONFIG_RSBAC_DEBUG
          if (rsbac_debug_aef_um)
            rsbac_printk(KERN_DEBUG "rsbac_um_check_account(): password for user %u has expired\n",
                         uid);
#endif
          goto out_free;
        }
      if(   ((entry_p->lastchange + entry_p->maxchange) < curdays)
         && entry_p->maxchange
         && (entry_p->maxchange != -1)
        )
        {
          err = -RSBAC_EMUSTCHANGE;
#ifdef CONFIG_RSBAC_DEBUG
          if (rsbac_debug_aef_um)
            {
              rsbac_printk(KERN_DEBUG "rsbac_um_check_account(): user %u must change password, lastchange too old\n",
                           uid);
            }
#endif
          goto out_free;
        }
      if(   (curdays > (entry_p->lastchange + entry_p->maxchange - entry_p->warnchange))
         && (entry_p->maxchange != -1)
         && (entry_p->warnchange != -1)
         && entry_p->maxchange
         && entry_p->warnchange
        )
        {
          err = (entry_p->lastchange + entry_p->maxchange) - curdays;
        }
      else
        err = 0;

out_free:
      rsbac_kfree(entry_p);
      return err;
  }


/* end of um_data_structures.c */

---