File s = new File("/etc/shadow");
if(s.exists() && !s.canRead()) {
// it looks like shadow password is in use, but we don't have read access
LOGGER.fine("/etc/shadow exists but not readable");
POSIX api = PosixAPI.get();
FileStat st = api.stat("/etc/shadow");
if(st==null)
return FormValidation.error(Messages.PAMSecurityRealm_ReadPermission());
Passwd pwd = api.getpwuid(api.geteuid());
String user;
if(pwd!=null) user=Messages.PAMSecurityRealm_User(pwd.getLoginName());
else user=Messages.PAMSecurityRealm_CurrentUser();
String group;
Group g = api.getgrgid(st.gid());
if(g!=null) group=g.getName();
else group=String.valueOf(st.gid());
if ((st.mode()&FileStat.S_IRGRP)!=0) {
// the file is readable to group. Jenkins should be in the right group, then
return FormValidation.error(Messages.PAMSecurityRealm_BelongToGroup(user, group));
} else {
Passwd opwd = api.getpwuid(st.uid());
String owner;
if(opwd!=null) owner=opwd.getLoginName();
else owner=Messages.PAMSecurityRealm_Uid(st.uid());
return FormValidation.error(Messages.PAMSecurityRealm_RunAsUserOrBelongToGroupAndChmod(owner, user, group));
}
}
return FormValidation.ok(Messages.PAMSecurityRealm_Success());