pam_gdm: Use the last cryptsetup password instead of the first

1 files changed, 26 insertions, 6 deletions

diff --git a/pam_gdm/pam_gdm.c b/pam_gdm/pam_gdm.c
index 767a6c8c..ef77f161 100644
--- a/pam_gdm/pam_gdm.c
+++ b/pam_gdm/pam_gdm.c
@@ -38,21 +38,41 @@ pam_sm_authenticate (pam_handle_t  *pamh,
                      const char   **argv)
 {
 #ifdef HAVE_KEYUTILS
-        int r;
-        void *cached_password = NULL;
+        long r;
+        size_t cached_passwords_length;
+        char *cached_passwords = NULL;
+        char *last_cached_password = NULL;
         key_serial_t serial;
+        size_t i;
 
         serial = find_key_by_type_and_desc ("user", "cryptsetup", 0);
         if (serial == 0)
                 return PAM_AUTHINFO_UNAVAIL;
 
-        r = keyctl_read_alloc (serial, &cached_password);
-        if (r < 0 || r != strlen (cached_password))
+        r = keyctl_read_alloc (serial, &cached_passwords);
+        if (r < 0)
                 return PAM_AUTHINFO_UNAVAIL;
+        
+        cached_passwords_length = r;
+
+        /*
+            Find the last password in the NUL-separated list of passwords.
+            Multiple passwords are returned either when the user enters an
+            incorrect password or there are multiple encrypted drives.
+            In the case of an incorrect password the last one is correct.
+            In the case of multiple drives, choosing the last drive is as
+            arbitrary a choice as any other, but choosing the last password at
+            least supports multiple attempts on the last drive.
+        */
+        last_cached_password = cached_passwords;
+        for (i = 0; i < cached_passwords_length; i++) {
+                last_cached_password = cached_passwords + i;
+                i += strlen (last_cached_password);
+        }
 
-        r = pam_set_item (pamh, PAM_AUTHTOK, cached_password);
+        r = pam_set_item (pamh, PAM_AUTHTOK, last_cached_password);
 
-        free (cached_password);
+        free (cached_passwords);
 
         if (r < 0)
                 return PAM_AUTH_ERR;