pam: Do not prevent root from changing auth token

arrowd · arrowd · commit 8602f82a78de · 2024-12-12T10:19:48.000+03:00
diff --git a/src/sss_client/pam_sss.c b/src/sss_client/pam_sss.c
@@ -2756,9 +2756,6 @@ static int get_authtok_for_password_change(pam_handle_t *pamh,
     }
 
     if (pam_flags & PAM_PRELIM_CHECK) {
-        if (getuid() == 0 && !exp_data )
-            return PAM_SUCCESS;
-
         if (flags & PAM_CLI_FLAGS_USE_2FA
                 || (pi->otp_vendor != NULL && pi->otp_token_id != NULL
                         && pi->otp_challenge != NULL)) {

Original file line number	Diff line number	Diff line change
`@@ -2756,9 +2756,6 @@ static int get_authtok_for_password_change(pam_handle_t *pamh,`
`2756`	`2756`	`}`
`2757`	`2757`
`2758`	`2758`	`if (pam_flags & PAM_PRELIM_CHECK) {`
`2759`		`- if (getuid() == 0 && !exp_data )`
`2760`		`- return PAM_SUCCESS;`
`2761`		`-`
`2762`	`2759`	`if (flags & PAM_CLI_FLAGS_USE_2FA`
`2763`	`2760`	`\|\| (pi->otp_vendor != NULL && pi->otp_token_id != NULL`
`2764`	`2761`	`&& pi->otp_challenge != NULL)) {`