Annotation of embedaddon/sudo/plugins/sudoers/auth/pam.c, revision 1.1
1.1 ! misho 1: /*
! 2: * Copyright (c) 1999-2005, 2007-2011 Todd C. Miller <Todd.Miller@courtesan.com>
! 3: *
! 4: * Permission to use, copy, modify, and distribute this software for any
! 5: * purpose with or without fee is hereby granted, provided that the above
! 6: * copyright notice and this permission notice appear in all copies.
! 7: *
! 8: * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
! 9: * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
! 10: * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
! 11: * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
! 12: * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
! 13: * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
! 14: * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
! 15: *
! 16: * Sponsored in part by the Defense Advanced Research Projects
! 17: * Agency (DARPA) and Air Force Research Laboratory, Air Force
! 18: * Materiel Command, USAF, under agreement number F39502-99-1-0512.
! 19: */
! 20:
! 21: #include <config.h>
! 22:
! 23: #include <sys/types.h>
! 24: #include <sys/param.h>
! 25: #include <stdio.h>
! 26: #ifdef STDC_HEADERS
! 27: # include <stdlib.h>
! 28: # include <stddef.h>
! 29: #else
! 30: # ifdef HAVE_STDLIB_H
! 31: # include <stdlib.h>
! 32: # endif
! 33: #endif /* STDC_HEADERS */
! 34: #ifdef HAVE_STRING_H
! 35: # include <string.h>
! 36: #endif /* HAVE_STRING_H */
! 37: #ifdef HAVE_STRINGS_H
! 38: # include <strings.h>
! 39: #endif /* HAVE_STRINGS_H */
! 40: #ifdef HAVE_UNISTD_H
! 41: # include <unistd.h>
! 42: #endif /* HAVE_UNISTD_H */
! 43: #include <pwd.h>
! 44: #include <errno.h>
! 45:
! 46: #ifdef HAVE_PAM_PAM_APPL_H
! 47: # include <pam/pam_appl.h>
! 48: #else
! 49: # include <security/pam_appl.h>
! 50: #endif
! 51:
! 52: #ifdef HAVE_LIBINTL_H
! 53: # if defined(__LINUX_PAM__)
! 54: # define PAM_TEXT_DOMAIN "Linux-PAM"
! 55: # elif defined(__sun__)
! 56: # define PAM_TEXT_DOMAIN "SUNW_OST_SYSOSPAM"
! 57: # endif
! 58: #endif
! 59:
! 60: #include "sudoers.h"
! 61: #include "sudo_auth.h"
! 62:
! 63: /* Only OpenPAM and Linux PAM use const qualifiers. */
! 64: #if defined(_OPENPAM) || defined(OPENPAM_VERSION) || \
! 65: defined(__LIBPAM_VERSION) || defined(__LINUX_PAM__)
! 66: # define PAM_CONST const
! 67: #else
! 68: # define PAM_CONST
! 69: #endif
! 70:
! 71: static int converse(int, PAM_CONST struct pam_message **,
! 72: struct pam_response **, void *);
! 73: static char *def_prompt = "Password:";
! 74: static int gotintr;
! 75:
! 76: #ifndef PAM_DATA_SILENT
! 77: #define PAM_DATA_SILENT 0
! 78: #endif
! 79:
! 80: static pam_handle_t *pamh;
! 81:
! 82: int
! 83: pam_init(struct passwd *pw, sudo_auth *auth)
! 84: {
! 85: static struct pam_conv pam_conv;
! 86: static int pam_status;
! 87:
! 88: /* Initial PAM setup */
! 89: if (auth != NULL)
! 90: auth->data = (void *) &pam_status;
! 91: pam_conv.conv = converse;
! 92: #ifdef HAVE_PAM_LOGIN
! 93: if (ISSET(sudo_mode, MODE_LOGIN_SHELL))
! 94: pam_status = pam_start("sudo-i", pw->pw_name, &pam_conv, &pamh);
! 95: else
! 96: #endif
! 97: pam_status = pam_start("sudo", pw->pw_name, &pam_conv, &pamh);
! 98: if (pam_status != PAM_SUCCESS) {
! 99: log_error(USE_ERRNO|NO_EXIT|NO_MAIL, _("unable to initialize PAM"));
! 100: return AUTH_FATAL;
! 101: }
! 102:
! 103: /*
! 104: * Set PAM_RUSER to the invoking user (the "from" user).
! 105: * We set PAM_RHOST to avoid a bug in Solaris 7 and below.
! 106: */
! 107: (void) pam_set_item(pamh, PAM_RUSER, user_name);
! 108: #ifdef __sun__
! 109: (void) pam_set_item(pamh, PAM_RHOST, user_host);
! 110: #endif
! 111:
! 112: /*
! 113: * Some versions of pam_lastlog have a bug that
! 114: * will cause a crash if PAM_TTY is not set so if
! 115: * there is no tty, set PAM_TTY to the empty string.
! 116: */
! 117: if (user_ttypath == NULL)
! 118: (void) pam_set_item(pamh, PAM_TTY, "");
! 119: else
! 120: (void) pam_set_item(pamh, PAM_TTY, user_ttypath);
! 121:
! 122: return AUTH_SUCCESS;
! 123: }
! 124:
! 125: int
! 126: pam_verify(struct passwd *pw, char *prompt, sudo_auth *auth)
! 127: {
! 128: const char *s;
! 129: int *pam_status = (int *) auth->data;
! 130:
! 131: def_prompt = prompt; /* for converse */
! 132:
! 133: /* PAM_SILENT prevents the authentication service from generating output. */
! 134: *pam_status = pam_authenticate(pamh, PAM_SILENT);
! 135: switch (*pam_status) {
! 136: case PAM_SUCCESS:
! 137: *pam_status = pam_acct_mgmt(pamh, PAM_SILENT);
! 138: switch (*pam_status) {
! 139: case PAM_SUCCESS:
! 140: return AUTH_SUCCESS;
! 141: case PAM_AUTH_ERR:
! 142: log_error(NO_EXIT|NO_MAIL, _("account validation failure, "
! 143: "is your account locked?"));
! 144: return AUTH_FATAL;
! 145: case PAM_NEW_AUTHTOK_REQD:
! 146: log_error(NO_EXIT|NO_MAIL, _("Account or password is "
! 147: "expired, reset your password and try again"));
! 148: *pam_status = pam_chauthtok(pamh,
! 149: PAM_CHANGE_EXPIRED_AUTHTOK);
! 150: if (*pam_status == PAM_SUCCESS)
! 151: return AUTH_SUCCESS;
! 152: if ((s = pam_strerror(pamh, *pam_status)))
! 153: log_error(NO_EXIT|NO_MAIL, _("pam_chauthtok: %s"), s);
! 154: return AUTH_FAILURE;
! 155: case PAM_AUTHTOK_EXPIRED:
! 156: log_error(NO_EXIT|NO_MAIL,
! 157: _("Password expired, contact your system administrator"));
! 158: return AUTH_FATAL;
! 159: case PAM_ACCT_EXPIRED:
! 160: log_error(NO_EXIT|NO_MAIL,
! 161: _("Account expired or PAM config lacks an \"account\" "
! 162: "section for sudo, contact your system administrator"));
! 163: return AUTH_FATAL;
! 164: }
! 165: /* FALLTHROUGH */
! 166: case PAM_AUTH_ERR:
! 167: if (gotintr) {
! 168: /* error or ^C from tgetpass() */
! 169: return AUTH_INTR;
! 170: }
! 171: case PAM_MAXTRIES:
! 172: case PAM_PERM_DENIED:
! 173: return AUTH_FAILURE;
! 174: default:
! 175: if ((s = pam_strerror(pamh, *pam_status)))
! 176: log_error(NO_EXIT|NO_MAIL, _("pam_authenticate: %s"), s);
! 177: return AUTH_FATAL;
! 178: }
! 179: }
! 180:
! 181: int
! 182: pam_cleanup(struct passwd *pw, sudo_auth *auth)
! 183: {
! 184: int *pam_status = (int *) auth->data;
! 185:
! 186: /* If successful, we can't close the session until pam_end_session() */
! 187: if (*pam_status == AUTH_SUCCESS)
! 188: return AUTH_SUCCESS;
! 189:
! 190: *pam_status = pam_end(pamh, *pam_status | PAM_DATA_SILENT);
! 191: pamh = NULL;
! 192: return *pam_status == PAM_SUCCESS ? AUTH_SUCCESS : AUTH_FAILURE;
! 193: }
! 194:
! 195: int
! 196: pam_begin_session(struct passwd *pw, sudo_auth *auth)
! 197: {
! 198: int status = PAM_SUCCESS;
! 199:
! 200: /*
! 201: * If there is no valid user we cannot open a PAM session.
! 202: * This is not an error as sudo can run commands with arbitrary
! 203: * uids, it just means we are done from a session management standpoint.
! 204: */
! 205: if (pw == NULL) {
! 206: if (pamh != NULL) {
! 207: (void) pam_end(pamh, PAM_SUCCESS | PAM_DATA_SILENT);
! 208: pamh = NULL;
! 209: }
! 210: goto done;
! 211: }
! 212:
! 213: /*
! 214: * Update PAM_USER to reference the user we are running the command
! 215: * as, as opposed to the user we authenticated as.
! 216: */
! 217: (void) pam_set_item(pamh, PAM_USER, pw->pw_name);
! 218:
! 219: /*
! 220: * Set credentials (may include resource limits, device ownership, etc).
! 221: * We don't check the return value here because in Linux-PAM 0.75
! 222: * it returns the last saved return code, not the return code
! 223: * for the setcred module. Because we haven't called pam_authenticate(),
! 224: * this is not set and so pam_setcred() returns PAM_PERM_DENIED.
! 225: * We can't call pam_acct_mgmt() with Linux-PAM for a similar reason.
! 226: */
! 227: (void) pam_setcred(pamh, PAM_ESTABLISH_CRED);
! 228:
! 229: #ifndef NO_PAM_SESSION
! 230: status = pam_open_session(pamh, 0);
! 231: if (status != PAM_SUCCESS) {
! 232: (void) pam_end(pamh, status | PAM_DATA_SILENT);
! 233: pamh = NULL;
! 234: }
! 235: #endif
! 236:
! 237: done:
! 238: return status == PAM_SUCCESS ? AUTH_SUCCESS : AUTH_FAILURE;
! 239: }
! 240:
! 241: int
! 242: pam_end_session(struct passwd *pw, sudo_auth *auth)
! 243: {
! 244: int status = PAM_SUCCESS;
! 245:
! 246: if (pamh != NULL) {
! 247: #ifndef NO_PAM_SESSION
! 248: /*
! 249: * Update PAM_USER to reference the user we are running the command
! 250: * as to match the call to pam_open_session().
! 251: */
! 252: (void) pam_set_item(pamh, PAM_USER, pw->pw_name);
! 253: (void) pam_close_session(pamh, PAM_SILENT);
! 254: #endif
! 255: status = pam_end(pamh, PAM_SUCCESS | PAM_DATA_SILENT);
! 256: pamh = NULL;
! 257: }
! 258:
! 259: return status == PAM_SUCCESS ? AUTH_SUCCESS : AUTH_FAILURE;
! 260: }
! 261:
! 262: /*
! 263: * ``Conversation function'' for PAM.
! 264: * XXX - does not handle PAM_BINARY_PROMPT
! 265: */
! 266: static int
! 267: converse(int num_msg, PAM_CONST struct pam_message **msg,
! 268: struct pam_response **response, void *appdata_ptr)
! 269: {
! 270: struct pam_response *pr;
! 271: PAM_CONST struct pam_message *pm;
! 272: const char *prompt;
! 273: char *pass;
! 274: int n, type, std_prompt;
! 275:
! 276: if ((*response = malloc(num_msg * sizeof(struct pam_response))) == NULL)
! 277: return PAM_SYSTEM_ERR;
! 278: zero_bytes(*response, num_msg * sizeof(struct pam_response));
! 279:
! 280: for (pr = *response, pm = *msg, n = num_msg; n--; pr++, pm++) {
! 281: type = SUDO_CONV_PROMPT_ECHO_OFF;
! 282: switch (pm->msg_style) {
! 283: case PAM_PROMPT_ECHO_ON:
! 284: type = SUDO_CONV_PROMPT_ECHO_ON;
! 285: case PAM_PROMPT_ECHO_OFF:
! 286: prompt = def_prompt;
! 287:
! 288: /* Error out if the last password read was interrupted. */
! 289: if (gotintr)
! 290: goto err;
! 291:
! 292: /* Is the sudo prompt standard? (If so, we'l just use PAM's) */
! 293: std_prompt = strncmp(def_prompt, "Password:", 9) == 0 &&
! 294: (def_prompt[9] == '\0' ||
! 295: (def_prompt[9] == ' ' && def_prompt[10] == '\0'));
! 296:
! 297: /* Only override PAM prompt if it matches /^Password: ?/ */
! 298: #if defined(PAM_TEXT_DOMAIN) && defined(HAVE_LIBINTL_H)
! 299: if (!def_passprompt_override && (std_prompt ||
! 300: (strcmp(pm->msg, dgettext(PAM_TEXT_DOMAIN, "Password: ")) &&
! 301: strcmp(pm->msg, dgettext(PAM_TEXT_DOMAIN, "Password:")))))
! 302: prompt = pm->msg;
! 303: #else
! 304: if (!def_passprompt_override && (std_prompt ||
! 305: strncmp(pm->msg, "Password:", 9) || (pm->msg[9] != '\0'
! 306: && (pm->msg[9] != ' ' || pm->msg[10] != '\0'))))
! 307: prompt = pm->msg;
! 308: #endif
! 309: /* Read the password unless interrupted. */
! 310: pass = auth_getpass(prompt, def_passwd_timeout * 60, type);
! 311: if (pass == NULL) {
! 312: /* We got ^C instead of a password; abort quickly. */
! 313: if (errno == EINTR)
! 314: gotintr = 1;
! 315: #if defined(__darwin__) || defined(__APPLE__)
! 316: pass = "";
! 317: #else
! 318: goto err;
! 319: #endif
! 320: }
! 321: pr->resp = estrdup(pass);
! 322: zero_bytes(pass, strlen(pass));
! 323: break;
! 324: case PAM_TEXT_INFO:
! 325: if (pm->msg)
! 326: (void) puts(pm->msg);
! 327: break;
! 328: case PAM_ERROR_MSG:
! 329: if (pm->msg) {
! 330: (void) fputs(pm->msg, stderr);
! 331: (void) fputc('\n', stderr);
! 332: }
! 333: break;
! 334: default:
! 335: goto err;
! 336: }
! 337: }
! 338:
! 339: return PAM_SUCCESS;
! 340:
! 341: err:
! 342: /* Zero and free allocated memory and return an error. */
! 343: for (pr = *response, n = num_msg; n--; pr++) {
! 344: if (pr->resp != NULL) {
! 345: zero_bytes(pr->resp, strlen(pr->resp));
! 346: free(pr->resp);
! 347: pr->resp = NULL;
! 348: }
! 349: }
! 350: zero_bytes(*response, num_msg * sizeof(struct pam_response));
! 351: free(*response);
! 352: *response = NULL;
! 353: return gotintr ? PAM_AUTH_ERR : PAM_CONV_ERR;
! 354: }
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to pam.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / sudo / plugins / sudoers / auth