]> git.proxmox.com Git - systemd.git/blame - src/shared/ask-password-api.c
Merge tag 'upstream/229'
[systemd.git] / src / shared / ask-password-api.c
CommitLineData
663996b3
MS
1/***
2 This file is part of systemd.
3
4 Copyright 2010 Lennart Poettering
5
6 systemd is free software; you can redistribute it and/or modify it
7 under the terms of the GNU Lesser General Public License as published by
8 the Free Software Foundation; either version 2.1 of the License, or
9 (at your option) any later version.
10
11 systemd is distributed in the hope that it will be useful, but
12 WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 Lesser General Public License for more details.
15
16 You should have received a copy of the GNU Lesser General Public License
17 along with systemd; If not, see <http://www.gnu.org/licenses/>.
18***/
6300502b 19
663996b3
MS
20#include <errno.h>
21#include <fcntl.h>
4c89c718
MP
22#include <inttypes.h>
23#include <limits.h>
6300502b 24#include <poll.h>
4c89c718 25#include <signal.h>
6300502b 26#include <stdbool.h>
663996b3 27#include <stddef.h>
4c89c718
MP
28#include <stdint.h>
29#include <stdio.h>
30#include <stdlib.h>
6300502b
MP
31#include <string.h>
32#include <sys/inotify.h>
663996b3 33#include <sys/signalfd.h>
6300502b 34#include <sys/socket.h>
4c89c718
MP
35#include <sys/stat.h>
36#include <sys/time.h>
37#include <sys/uio.h>
6300502b
MP
38#include <sys/un.h>
39#include <termios.h>
40#include <unistd.h>
663996b3 41
db2df898
MP
42#include "alloc-util.h"
43#include "ask-password-api.h"
44#include "fd-util.h"
45#include "fileio.h"
e3bff60a 46#include "formats-util.h"
db2df898 47#include "io-util.h"
4c89c718
MP
48#include "log.h"
49#include "macro.h"
6300502b 50#include "missing.h"
663996b3 51#include "mkdir.h"
e3bff60a 52#include "random-util.h"
86f210e9 53#include "signal-util.h"
6300502b 54#include "socket-util.h"
db2df898 55#include "string-util.h"
6300502b
MP
56#include "strv.h"
57#include "terminal-util.h"
4c89c718 58#include "time-util.h"
db2df898 59#include "umask-util.h"
4c89c718 60#include "utf8.h"
6300502b 61#include "util.h"
663996b3 62
6300502b
MP
63#define KEYRING_TIMEOUT_USEC ((5 * USEC_PER_MINUTE) / 2)
64
65static int lookup_key(const char *keyname, key_serial_t *ret) {
66 key_serial_t serial;
67
68 assert(keyname);
69 assert(ret);
70
71 serial = request_key("user", keyname, NULL, 0);
72 if (serial == -1)
4c89c718 73 return negative_errno();
6300502b
MP
74
75 *ret = serial;
76 return 0;
77}
78
79static int retrieve_key(key_serial_t serial, char ***ret) {
80 _cleanup_free_ char *p = NULL;
81 long m = 100, n;
82 char **l;
83
84 assert(ret);
85
86 for (;;) {
87 p = new(char, m);
88 if (!p)
89 return -ENOMEM;
90
91 n = keyctl(KEYCTL_READ, (unsigned long) serial, (unsigned long) p, (unsigned long) m, 0);
92 if (n < 0)
93 return -errno;
94
95 if (n < m)
96 break;
97
db2df898 98 memory_erase(p, n);
6300502b
MP
99 free(p);
100 m *= 2;
101 }
102
103 l = strv_parse_nulstr(p, n);
104 if (!l)
105 return -ENOMEM;
106
db2df898
MP
107 memory_erase(p, n);
108
6300502b
MP
109 *ret = l;
110 return 0;
111}
112
113static int add_to_keyring(const char *keyname, AskPasswordFlags flags, char **passwords) {
db2df898 114 _cleanup_strv_free_erase_ char **l = NULL;
6300502b
MP
115 _cleanup_free_ char *p = NULL;
116 key_serial_t serial;
117 size_t n;
118 int r;
119
120 assert(keyname);
121 assert(passwords);
122
123 if (!(flags & ASK_PASSWORD_PUSH_CACHE))
124 return 0;
125
126 r = lookup_key(keyname, &serial);
127 if (r >= 0) {
128 r = retrieve_key(serial, &l);
129 if (r < 0)
130 return r;
131 } else if (r != -ENOKEY)
132 return r;
133
134 r = strv_extend_strv(&l, passwords, true);
135 if (r <= 0)
136 return r;
137
138 r = strv_make_nulstr(l, &p, &n);
139 if (r < 0)
140 return r;
141
142 /* Truncate trailing NUL */
143 assert(n > 0);
144 assert(p[n-1] == 0);
145
146 serial = add_key("user", keyname, p, n-1, KEY_SPEC_USER_KEYRING);
db2df898 147 memory_erase(p, n);
6300502b
MP
148 if (serial == -1)
149 return -errno;
150
151 if (keyctl(KEYCTL_SET_TIMEOUT,
152 (unsigned long) serial,
153 (unsigned long) DIV_ROUND_UP(KEYRING_TIMEOUT_USEC, USEC_PER_SEC), 0, 0) < 0)
154 log_debug_errno(errno, "Failed to adjust timeout: %m");
155
156 log_debug("Added key to keyring as %" PRIi32 ".", serial);
157
158 return 1;
159}
160
161static int add_to_keyring_and_log(const char *keyname, AskPasswordFlags flags, char **passwords) {
162 int r;
163
164 assert(keyname);
165 assert(passwords);
166
167 r = add_to_keyring(keyname, flags, passwords);
168 if (r < 0)
169 return log_debug_errno(r, "Failed to add password to keyring: %m");
170
171 return 0;
172}
173
174int ask_password_keyring(const char *keyname, AskPasswordFlags flags, char ***ret) {
175
176 key_serial_t serial;
177 int r;
178
179 assert(keyname);
180 assert(ret);
181
182 if (!(flags & ASK_PASSWORD_ACCEPT_CACHED))
183 return -EUNATCH;
184
185 r = lookup_key(keyname, &serial);
186 if (r == -ENOSYS) /* when retrieving the distinction doesn't matter */
187 return -ENOKEY;
188 if (r < 0)
189 return r;
190
191 return retrieve_key(serial, ret);
192}
193
663996b3
MS
194static void backspace_chars(int ttyfd, size_t p) {
195
196 if (ttyfd < 0)
197 return;
198
199 while (p > 0) {
200 p--;
201
202 loop_write(ttyfd, "\b \b", 3, false);
203 }
204}
205
206int ask_password_tty(
207 const char *message,
6300502b 208 const char *keyname,
663996b3 209 usec_t until,
6300502b 210 AskPasswordFlags flags,
663996b3 211 const char *flag_file,
6300502b 212 char **ret) {
663996b3
MS
213
214 struct termios old_termios, new_termios;
4c89c718
MP
215 char passphrase[LINE_MAX + 1] = {}, *x;
216 size_t p = 0, codepoint = 0;
60f067b4
JS
217 int r;
218 _cleanup_close_ int ttyfd = -1, notify = -1;
663996b3
MS
219 struct pollfd pollfd[2];
220 bool reset_tty = false;
663996b3
MS
221 bool dirty = false;
222 enum {
223 POLL_TTY,
224 POLL_INOTIFY
225 };
226
6300502b
MP
227 assert(ret);
228
229 if (flags & ASK_PASSWORD_NO_TTY)
230 return -EUNATCH;
231
232 if (!message)
233 message = "Password:";
663996b3
MS
234
235 if (flag_file) {
60f067b4
JS
236 notify = inotify_init1(IN_CLOEXEC|IN_NONBLOCK);
237 if (notify < 0) {
663996b3
MS
238 r = -errno;
239 goto finish;
240 }
241
242 if (inotify_add_watch(notify, flag_file, IN_ATTRIB /* for the link count */) < 0) {
243 r = -errno;
244 goto finish;
245 }
246 }
247
60f067b4
JS
248 ttyfd = open("/dev/tty", O_RDWR|O_NOCTTY|O_CLOEXEC);
249 if (ttyfd >= 0) {
663996b3
MS
250
251 if (tcgetattr(ttyfd, &old_termios) < 0) {
252 r = -errno;
253 goto finish;
254 }
255
6300502b 256 loop_write(ttyfd, ANSI_HIGHLIGHT, strlen(ANSI_HIGHLIGHT), false);
663996b3
MS
257 loop_write(ttyfd, message, strlen(message), false);
258 loop_write(ttyfd, " ", 1, false);
6300502b 259 loop_write(ttyfd, ANSI_NORMAL, strlen(ANSI_NORMAL), false);
663996b3
MS
260
261 new_termios = old_termios;
262 new_termios.c_lflag &= ~(ICANON|ECHO);
263 new_termios.c_cc[VMIN] = 1;
264 new_termios.c_cc[VTIME] = 0;
265
266 if (tcsetattr(ttyfd, TCSADRAIN, &new_termios) < 0) {
267 r = -errno;
268 goto finish;
269 }
270
271 reset_tty = true;
272 }
273
274 zero(pollfd);
275 pollfd[POLL_TTY].fd = ttyfd >= 0 ? ttyfd : STDIN_FILENO;
276 pollfd[POLL_TTY].events = POLLIN;
277 pollfd[POLL_INOTIFY].fd = notify;
278 pollfd[POLL_INOTIFY].events = POLLIN;
279
280 for (;;) {
281 char c;
282 int sleep_for = -1, k;
283 ssize_t n;
284
285 if (until > 0) {
286 usec_t y;
287
288 y = now(CLOCK_MONOTONIC);
289
290 if (y > until) {
291 r = -ETIME;
292 goto finish;
293 }
294
295 sleep_for = (int) ((until - y) / USEC_PER_MSEC);
296 }
297
298 if (flag_file)
299 if (access(flag_file, F_OK) < 0) {
300 r = -errno;
301 goto finish;
302 }
303
6300502b 304 k = poll(pollfd, notify >= 0 ? 2 : 1, sleep_for);
60f067b4 305 if (k < 0) {
663996b3
MS
306 if (errno == EINTR)
307 continue;
308
309 r = -errno;
310 goto finish;
311 } else if (k == 0) {
312 r = -ETIME;
313 goto finish;
314 }
315
6300502b 316 if (notify >= 0 && pollfd[POLL_INOTIFY].revents != 0)
663996b3
MS
317 flush_fd(notify);
318
319 if (pollfd[POLL_TTY].revents == 0)
320 continue;
321
60f067b4
JS
322 n = read(ttyfd >= 0 ? ttyfd : STDIN_FILENO, &c, 1);
323 if (n < 0) {
663996b3
MS
324 if (errno == EINTR || errno == EAGAIN)
325 continue;
326
327 r = -errno;
328 goto finish;
329
330 } else if (n == 0)
331 break;
332
333 if (c == '\n')
334 break;
335 else if (c == 21) { /* C-u */
336
6300502b 337 if (!(flags & ASK_PASSWORD_SILENT))
663996b3
MS
338 backspace_chars(ttyfd, p);
339 p = 0;
340
341 } else if (c == '\b' || c == 127) {
342
343 if (p > 0) {
344
6300502b 345 if (!(flags & ASK_PASSWORD_SILENT))
663996b3
MS
346 backspace_chars(ttyfd, 1);
347
348 p--;
6300502b 349 } else if (!dirty && !(flags & ASK_PASSWORD_SILENT)) {
663996b3 350
6300502b 351 flags |= ASK_PASSWORD_SILENT;
663996b3
MS
352
353 /* There are two ways to enter silent
354 * mode. Either by pressing backspace
6300502b
MP
355 * as first key (and only as first
356 * key), or ... */
663996b3
MS
357 if (ttyfd >= 0)
358 loop_write(ttyfd, "(no echo) ", 10, false);
359
360 } else if (ttyfd >= 0)
361 loop_write(ttyfd, "\a", 1, false);
362
6300502b 363 } else if (c == '\t' && !(flags & ASK_PASSWORD_SILENT)) {
663996b3
MS
364
365 backspace_chars(ttyfd, p);
6300502b 366 flags |= ASK_PASSWORD_SILENT;
663996b3
MS
367
368 /* ... or by pressing TAB at any time. */
369
370 if (ttyfd >= 0)
371 loop_write(ttyfd, "(no echo) ", 10, false);
372 } else {
60f067b4
JS
373 if (p >= sizeof(passphrase)-1) {
374 loop_write(ttyfd, "\a", 1, false);
375 continue;
376 }
377
663996b3
MS
378 passphrase[p++] = c;
379
4c89c718
MP
380 if (!(flags & ASK_PASSWORD_SILENT) && ttyfd >= 0) {
381 n = utf8_encoded_valid_unichar(passphrase + codepoint);
382 if (n >= 0) {
383 codepoint = p;
384 loop_write(ttyfd, (flags & ASK_PASSWORD_ECHO) ? &c : "*", 1, false);
385 }
386 }
663996b3
MS
387
388 dirty = true;
389 }
db2df898
MP
390
391 c = 'x';
663996b3
MS
392 }
393
60f067b4 394 x = strndup(passphrase, p);
db2df898 395 memory_erase(passphrase, p);
60f067b4 396 if (!x) {
663996b3
MS
397 r = -ENOMEM;
398 goto finish;
399 }
400
6300502b
MP
401 if (keyname)
402 (void) add_to_keyring_and_log(keyname, flags, STRV_MAKE(x));
403
404 *ret = x;
663996b3
MS
405 r = 0;
406
407finish:
60f067b4
JS
408 if (ttyfd >= 0 && reset_tty) {
409 loop_write(ttyfd, "\n", 1, false);
410 tcsetattr(ttyfd, TCSADRAIN, &old_termios);
663996b3
MS
411 }
412
413 return r;
414}
415
416static int create_socket(char **name) {
6300502b 417 union sockaddr_union sa = {
663996b3
MS
418 .un.sun_family = AF_UNIX,
419 };
6300502b
MP
420 _cleanup_close_ int fd = -1;
421 static const int one = 1;
663996b3 422 char *c;
6300502b 423 int r;
663996b3
MS
424
425 assert(name);
426
427 fd = socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
f47781d8 428 if (fd < 0)
6300502b 429 return -errno;
663996b3 430
60f067b4 431 snprintf(sa.un.sun_path, sizeof(sa.un.sun_path)-1, "/run/systemd/ask-password/sck.%" PRIx64, random_u64());
663996b3
MS
432
433 RUN_WITH_UMASK(0177) {
6300502b
MP
434 if (bind(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(sa.un.sun_path)) < 0)
435 return -errno;
663996b3
MS
436 }
437
6300502b
MP
438 if (setsockopt(fd, SOL_SOCKET, SO_PASSCRED, &one, sizeof(one)) < 0)
439 return -errno;
663996b3
MS
440
441 c = strdup(sa.un.sun_path);
6300502b
MP
442 if (!c)
443 return -ENOMEM;
663996b3
MS
444
445 *name = c;
663996b3 446
6300502b
MP
447 r = fd;
448 fd = -1;
663996b3
MS
449
450 return r;
451}
452
453int ask_password_agent(
454 const char *message,
455 const char *icon,
60f067b4 456 const char *id,
6300502b 457 const char *keyname,
663996b3 458 usec_t until,
6300502b
MP
459 AskPasswordFlags flags,
460 char ***ret) {
663996b3
MS
461
462 enum {
463 FD_SOCKET,
464 FD_SIGNAL,
465 _FD_MAX
466 };
467
6300502b 468 _cleanup_close_ int socket_fd = -1, signal_fd = -1, fd = -1;
663996b3
MS
469 char temp[] = "/run/systemd/ask-password/tmp.XXXXXX";
470 char final[sizeof(temp)] = "";
60f067b4 471 _cleanup_free_ char *socket_name = NULL;
6300502b
MP
472 _cleanup_strv_free_ char **l = NULL;
473 _cleanup_fclose_ FILE *f = NULL;
663996b3 474 struct pollfd pollfd[_FD_MAX];
6300502b 475 sigset_t mask, oldmask;
60f067b4 476 int r;
663996b3 477
6300502b
MP
478 assert(ret);
479
480 if (flags & ASK_PASSWORD_NO_AGENT)
481 return -EUNATCH;
663996b3 482
86f210e9
MP
483 assert_se(sigemptyset(&mask) >= 0);
484 assert_se(sigset_add_many(&mask, SIGINT, SIGTERM, -1) >= 0);
485 assert_se(sigprocmask(SIG_BLOCK, &mask, &oldmask) >= 0);
663996b3 486
6300502b 487 (void) mkdir_p_label("/run/systemd/ask-password", 0755);
663996b3 488
60f067b4 489 fd = mkostemp_safe(temp, O_WRONLY|O_CLOEXEC);
663996b3 490 if (fd < 0) {
db2df898 491 r = fd;
663996b3
MS
492 goto finish;
493 }
494
6300502b 495 (void) fchmod(fd, 0644);
663996b3 496
60f067b4
JS
497 f = fdopen(fd, "w");
498 if (!f) {
663996b3
MS
499 r = -errno;
500 goto finish;
501 }
502
503 fd = -1;
504
60f067b4
JS
505 signal_fd = signalfd(-1, &mask, SFD_NONBLOCK|SFD_CLOEXEC);
506 if (signal_fd < 0) {
663996b3
MS
507 r = -errno;
508 goto finish;
509 }
510
60f067b4
JS
511 socket_fd = create_socket(&socket_name);
512 if (socket_fd < 0) {
663996b3
MS
513 r = socket_fd;
514 goto finish;
515 }
516
517 fprintf(f,
518 "[Ask]\n"
60f067b4 519 "PID="PID_FMT"\n"
663996b3
MS
520 "Socket=%s\n"
521 "AcceptCached=%i\n"
5eef597e 522 "Echo=%i\n"
60f067b4
JS
523 "NotAfter="USEC_FMT"\n",
524 getpid(),
663996b3 525 socket_name,
6300502b
MP
526 (flags & ASK_PASSWORD_ACCEPT_CACHED) ? 1 : 0,
527 (flags & ASK_PASSWORD_ECHO) ? 1 : 0,
60f067b4 528 until);
663996b3
MS
529
530 if (message)
531 fprintf(f, "Message=%s\n", message);
532
533 if (icon)
534 fprintf(f, "Icon=%s\n", icon);
535
60f067b4
JS
536 if (id)
537 fprintf(f, "Id=%s\n", id);
538
5fd56512 539 r = fflush_and_check(f);
6300502b 540 if (r < 0)
663996b3 541 goto finish;
663996b3
MS
542
543 memcpy(final, temp, sizeof(temp));
544
545 final[sizeof(final)-11] = 'a';
546 final[sizeof(final)-10] = 's';
547 final[sizeof(final)-9] = 'k';
548
549 if (rename(temp, final) < 0) {
663996b3
MS
550 r = -errno;
551 goto finish;
552 }
553
554 zero(pollfd);
555 pollfd[FD_SOCKET].fd = socket_fd;
556 pollfd[FD_SOCKET].events = POLLIN;
557 pollfd[FD_SIGNAL].fd = signal_fd;
558 pollfd[FD_SIGNAL].events = POLLIN;
559
560 for (;;) {
561 char passphrase[LINE_MAX+1];
562 struct msghdr msghdr;
563 struct iovec iovec;
564 struct ucred *ucred;
565 union {
566 struct cmsghdr cmsghdr;
567 uint8_t buf[CMSG_SPACE(sizeof(struct ucred))];
568 } control;
569 ssize_t n;
570 int k;
571 usec_t t;
572
573 t = now(CLOCK_MONOTONIC);
574
575 if (until > 0 && until <= t) {
663996b3
MS
576 r = -ETIME;
577 goto finish;
578 }
579
60f067b4
JS
580 k = poll(pollfd, _FD_MAX, until > 0 ? (int) ((until-t)/USEC_PER_MSEC) : -1);
581 if (k < 0) {
663996b3
MS
582 if (errno == EINTR)
583 continue;
584
663996b3
MS
585 r = -errno;
586 goto finish;
587 }
588
589 if (k <= 0) {
663996b3
MS
590 r = -ETIME;
591 goto finish;
592 }
593
594 if (pollfd[FD_SIGNAL].revents & POLLIN) {
595 r = -EINTR;
596 goto finish;
597 }
598
599 if (pollfd[FD_SOCKET].revents != POLLIN) {
663996b3
MS
600 r = -EIO;
601 goto finish;
602 }
603
604 zero(iovec);
605 iovec.iov_base = passphrase;
606 iovec.iov_len = sizeof(passphrase);
607
608 zero(control);
609 zero(msghdr);
610 msghdr.msg_iov = &iovec;
611 msghdr.msg_iovlen = 1;
612 msghdr.msg_control = &control;
613 msghdr.msg_controllen = sizeof(control);
614
60f067b4
JS
615 n = recvmsg(socket_fd, &msghdr, 0);
616 if (n < 0) {
663996b3
MS
617 if (errno == EAGAIN ||
618 errno == EINTR)
619 continue;
620
663996b3
MS
621 r = -errno;
622 goto finish;
623 }
624
e3bff60a
MP
625 cmsg_close_all(&msghdr);
626
663996b3 627 if (n <= 0) {
6300502b 628 log_debug("Message too short");
663996b3
MS
629 continue;
630 }
631
632 if (msghdr.msg_controllen < CMSG_LEN(sizeof(struct ucred)) ||
633 control.cmsghdr.cmsg_level != SOL_SOCKET ||
634 control.cmsghdr.cmsg_type != SCM_CREDENTIALS ||
635 control.cmsghdr.cmsg_len != CMSG_LEN(sizeof(struct ucred))) {
6300502b 636 log_debug("Received message without credentials. Ignoring.");
663996b3
MS
637 continue;
638 }
639
640 ucred = (struct ucred*) CMSG_DATA(&control.cmsghdr);
641 if (ucred->uid != 0) {
6300502b 642 log_debug("Got request from unprivileged user. Ignoring.");
663996b3
MS
643 continue;
644 }
645
646 if (passphrase[0] == '+') {
6300502b 647 /* An empty message refers to the empty password */
663996b3
MS
648 if (n == 1)
649 l = strv_new("", NULL);
650 else
651 l = strv_parse_nulstr(passphrase+1, n-1);
db2df898 652 memory_erase(passphrase, n);
663996b3
MS
653 if (!l) {
654 r = -ENOMEM;
655 goto finish;
656 }
657
658 if (strv_length(l) <= 0) {
6300502b
MP
659 l = strv_free(l);
660 log_debug("Invalid packet");
663996b3
MS
661 continue;
662 }
663
6300502b
MP
664 break;
665 }
663996b3 666
6300502b 667 if (passphrase[0] == '-') {
663996b3
MS
668 r = -ECANCELED;
669 goto finish;
663996b3
MS
670 }
671
6300502b 672 log_debug("Invalid packet");
663996b3
MS
673 }
674
6300502b
MP
675 if (keyname)
676 (void) add_to_keyring_and_log(keyname, flags, l);
677
678 *ret = l;
679 l = NULL;
663996b3
MS
680 r = 0;
681
682finish:
60f067b4 683 if (socket_name)
6300502b 684 (void) unlink(socket_name);
663996b3 685
6300502b 686 (void) unlink(temp);
663996b3
MS
687
688 if (final[0])
6300502b 689 (void) unlink(final);
663996b3
MS
690
691 assert_se(sigprocmask(SIG_SETMASK, &oldmask, NULL) == 0);
663996b3
MS
692 return r;
693}
694
6300502b
MP
695int ask_password_auto(
696 const char *message,
697 const char *icon,
698 const char *id,
699 const char *keyname,
700 usec_t until,
701 AskPasswordFlags flags,
702 char ***ret) {
703
704 int r;
705
706 assert(ret);
707
708 if ((flags & ASK_PASSWORD_ACCEPT_CACHED) && keyname) {
709 r = ask_password_keyring(keyname, flags, ret);
710 if (r != -ENOKEY)
711 return r;
712 }
663996b3 713
6300502b 714 if (!(flags & ASK_PASSWORD_NO_TTY) && isatty(STDIN_FILENO)) {
663996b3
MS
715 char *s = NULL, **l = NULL;
716
6300502b 717 r = ask_password_tty(message, keyname, until, flags, NULL, &s);
60f067b4 718 if (r < 0)
663996b3
MS
719 return r;
720
db2df898
MP
721 r = strv_push(&l, s);
722 if (r < 0) {
723 string_erase(s);
724 free(s);
6300502b 725 return -ENOMEM;
db2df898 726 }
663996b3 727
6300502b
MP
728 *ret = l;
729 return 0;
730 }
731
732 if (!(flags & ASK_PASSWORD_NO_AGENT))
733 return ask_password_agent(message, icon, id, keyname, until, flags, ret);
734
735 return -EUNATCH;
663996b3 736}