| /* |
| * Originally based on an implementation of `su' by |
| * |
| * Peter Orbaek <[email protected]> |
| * |
| * obtained circa 1997 from ftp://ftp.daimi.aau.dk/pub/linux/poe/ |
| * |
| * Rewritten for Linux-PAM by Andrew G. Morgan <[email protected]> |
| * Modified by Andrey V. Savochkin <[email protected]> |
| * Modified for use with libcap by Andrew G. Morgan <[email protected]> |
| */ |
| |
| /* #define PAM_DEBUG */ |
| |
| #include <sys/prctl.h> |
| |
| /* non-root user of convenience to block signals */ |
| #define TEMP_UID 1 |
| |
| #ifndef PAM_APP_NAME |
| #define PAM_APP_NAME "su" |
| #endif /* ndef PAM_APP_NAME */ |
| |
| #define DEFAULT_HOME "/" |
| #define DEFAULT_SHELL "/bin/bash" |
| #define SLEEP_TO_KILL_CHILDREN 3 /* seconds to wait after SIGTERM before |
| SIGKILL */ |
| #define SU_FAIL_DELAY 2000000 /* usec on authentication failure */ |
| |
| #define RHOST_UNKNOWN_NAME "" /* perhaps "[from.where?]" */ |
| #define DEVICE_FILE_PREFIX "/dev/" |
| #define WTMP_LOCK_TIMEOUT 3 /* in seconds */ |
| |
| #ifndef UT_IDSIZE |
| #define UT_IDSIZE 4 /* XXX - this is sizeof(struct utmp.ut_id) */ |
| #endif |
| |
| #include <stdlib.h> |
| #include <signal.h> |
| #include <stdio.h> |
| #include <sys/stat.h> |
| #include <sys/types.h> |
| #include <unistd.h> |
| #include <pwd.h> |
| #include <grp.h> |
| #include <string.h> |
| #include <syslog.h> |
| #include <errno.h> |
| #include <fcntl.h> |
| #include <termios.h> |
| #include <sys/wait.h> |
| #include <utmp.h> |
| #include <ctype.h> |
| #include <stdarg.h> |
| #include <netdb.h> |
| #include <unistd.h> |
| |
| #include <security/pam_appl.h> |
| #include <security/pam_misc.h> |
| #include <sys/capability.h> |
| |
| #include <security/_pam_macros.h> |
| |
| /* -------------------------------------------- */ |
| /* ------ declarations ------------------------ */ |
| /* -------------------------------------------- */ |
| |
| extern char **environ; |
| static pam_handle_t *pamh = NULL; |
| static int state; |
| |
| static int wait_for_child_caught=0; |
| static int need_job_control=0; |
| static int is_terminal = 0; |
| static struct termios stored_mode; /* initial terminal mode settings */ |
| static uid_t terminal_uid = (uid_t) -1; |
| static uid_t invoked_uid = (uid_t) -1; |
| |
| /* -------------------------------------------- */ |
| /* ------ some local (static) functions ------- */ |
| /* -------------------------------------------- */ |
| |
| /* |
| * We will attempt to transcribe the following env variables |
| * independent of whether we keep the whole environment. Others will |
| * be set elsewhere: either in modules; or after the identity of the |
| * user is known. |
| */ |
| |
| static const char *posix_env[] = { |
| "LANG", |
| "LC_COLLATE", |
| "LC_CTYPE", |
| "LC_MONETARY", |
| "LC_NUMERIC", |
| "TZ", |
| NULL |
| }; |
| |
| /* |
| * make_environment transcribes a selection of environment variables |
| * from the invoking user. |
| */ |
| static int make_environment(pam_handle_t *pamh, int keep_env) |
| { |
| const char *tmpe; |
| int i; |
| int retval; |
| |
| if (keep_env) { |
| /* preserve the original environment */ |
| return pam_misc_paste_env(pamh, (const char * const *)environ); |
| } |
| |
| /* we always transcribe some variables anyway */ |
| tmpe = getenv("TERM"); |
| if (tmpe == NULL) { |
| tmpe = "dumb"; |
| } |
| retval = pam_misc_setenv(pamh, "TERM", tmpe, 0); |
| if (retval == PAM_SUCCESS) { |
| retval = pam_misc_setenv(pamh, "PATH", "/bin:/usr/bin", 0); |
| } |
| if (retval != PAM_SUCCESS) { |
| tmpe = NULL; |
| D(("error setting environment variables")); |
| return retval; |
| } |
| |
| /* also propagate the POSIX specific ones */ |
| for (i=0; retval == PAM_SUCCESS && posix_env[i]; ++i) { |
| tmpe = getenv(posix_env[i]); |
| if (tmpe != NULL) { |
| retval = pam_misc_setenv(pamh, posix_env[i], tmpe, 0); |
| } |
| } |
| tmpe = NULL; |
| |
| return retval; |
| } |
| |
| /* |
| * checkfds ensures that stdout and stderr filedescriptors are |
| * defined. If all else fails, it directs them to /dev/null. |
| */ |
| static void checkfds(void) |
| { |
| struct stat st; |
| int fd; |
| |
| if (fstat(1, &st) == -1) { |
| fd = open("/dev/null", O_WRONLY); |
| if (fd == -1) exit(1); |
| if (fd != 1) { |
| if (dup2(fd, 1) == -1) exit(1); |
| if (close(fd) == -1) exit(1); |
| } |
| } |
| if (fstat(2, &st) == -1) { |
| fd = open("/dev/null", O_WRONLY); |
| if (fd == -1) exit(1); |
| if (fd != 2) { |
| if (dup2(fd, 2) == -1) exit(1); |
| if (close(fd) == -1) exit(1); |
| } |
| } |
| } |
| |
| /* |
| * store_terminal_modes captures the current state of the input |
| * terminal. Calling this at the start of the program, we ensure we |
| * can restore these default settings when su exits. |
| */ |
| static void store_terminal_modes(void) |
| { |
| if (isatty(STDIN_FILENO)) { |
| is_terminal = 1; |
| if (tcgetattr(STDIN_FILENO, &stored_mode) != 0) { |
| fprintf(stderr, PAM_APP_NAME ": couldn't copy terminal mode"); |
| exit(1); |
| } |
| return; |
| } |
| fprintf(stderr, PAM_APP_NAME ": must be run from a terminal\n"); |
| exit(1); |
| } |
| |
| /* |
| * restore_terminal_modes resets the terminal to the state it was in |
| * when the program started. |
| * |
| * Returns: |
| * 0 ok |
| * 1 error |
| */ |
| static int restore_terminal_modes(void) |
| { |
| if (is_terminal && tcsetattr(STDIN_FILENO, TCSAFLUSH, &stored_mode) != 0) { |
| fprintf(stderr, PAM_APP_NAME ": cannot restore terminal mode: %s\n", |
| strerror(errno)); |
| return 1; |
| } else { |
| return 0; |
| } |
| } |
| |
| /* ------ unexpected signals ------------------ */ |
| |
| struct sigaction old_int_act, old_quit_act, old_tstp_act, old_pipe_act; |
| |
| /* |
| * disable_terminal_signals attempts to make the process resistant to |
| * being stopped - it helps ensure that the PAM stack can complete |
| * session and auth failure logging etc. |
| */ |
| static void disable_terminal_signals(void) |
| { |
| /* |
| * Protect the process from dangerous terminal signals. |
| * The protection is implemented via sigaction() because |
| * the signals are sent regardless of the process' uid. |
| */ |
| struct sigaction act; |
| |
| act.sa_handler = SIG_IGN; /* ignore the signal */ |
| sigemptyset(&act.sa_mask); /* no signal blocking on handler |
| call needed */ |
| act.sa_flags = SA_RESTART; /* do not reset after first signal |
| arriving, restart interrupted |
| system calls if possible */ |
| sigaction(SIGINT, &act, &old_int_act); |
| sigaction(SIGQUIT, &act, &old_quit_act); |
| /* |
| * Ignore SIGTSTP signals. Why? attacker could otherwise stop |
| * a process and a. kill it, or b. wait for the system to |
| * shutdown - either way, nothing appears in syslogs. |
| */ |
| sigaction(SIGTSTP, &act, &old_tstp_act); |
| /* |
| * Ignore SIGPIPE. The parent `su' process may print something |
| * on stderr. Killing of the process would be undesired. |
| */ |
| sigaction(SIGPIPE, &act, &old_pipe_act); |
| } |
| |
| static void enable_terminal_signals(void) |
| { |
| sigaction(SIGINT, &old_int_act, NULL); |
| sigaction(SIGQUIT, &old_quit_act, NULL); |
| sigaction(SIGTSTP, &old_tstp_act, NULL); |
| sigaction(SIGPIPE, &old_pipe_act, NULL); |
| } |
| |
| /* ------ terminal ownership ------------------ */ |
| |
| /* |
| * change_terminal_owner changes the ownership of STDIN if needed. |
| * Returns: |
| * 0 ok, |
| * -1 fatal error (continuing is impossible), |
| * 1 non-fatal error. |
| * In the case of an error "err_descr" is set to the error message |
| * and "callname" to the name of the failed call. |
| */ |
| static int change_terminal_owner(uid_t uid, int is_login, |
| const char **callname, const char **err_descr) |
| { |
| /* determine who owns the terminal line */ |
| if (is_terminal && is_login) { |
| struct stat stat_buf; |
| cap_t current, working; |
| int status; |
| cap_value_t cchown = CAP_CHOWN; |
| |
| if (fstat(STDIN_FILENO, &stat_buf) != 0) { |
| *callname = "fstat to STDIN"; |
| *err_descr = strerror(errno); |
| return -1; |
| } |
| |
| current = cap_get_proc(); |
| working = cap_dup(current); |
| cap_set_flag(working, CAP_EFFECTIVE, 1, &cchown, CAP_SET); |
| status = cap_set_proc(working); |
| cap_free(working); |
| |
| if (status != 0) { |
| *callname = "capset CHOWN"; |
| } else if ((status = fchown(STDIN_FILENO, uid, -1)) != 0) { |
| *callname = "fchown of STDIN"; |
| } else { |
| cap_set_proc(current); |
| } |
| cap_free(current); |
| |
| if (status != 0) { |
| *err_descr = strerror(errno); |
| return 1; |
| } |
| |
| terminal_uid = stat_buf.st_uid; |
| } |
| return 0; |
| } |
| |
| /* |
| * restore_terminal_owner changes the terminal owner back to the value |
| * it had when su was started. |
| */ |
| static void restore_terminal_owner(void) |
| { |
| if (terminal_uid != (uid_t) -1) { |
| cap_t current, working; |
| int status; |
| cap_value_t cchown = CAP_CHOWN; |
| |
| current = cap_get_proc(); |
| working = cap_dup(current); |
| cap_set_flag(working, CAP_EFFECTIVE, 1, &cchown, CAP_SET); |
| status = cap_set_proc(working); |
| cap_free(working); |
| |
| if (status == 0) { |
| status = fchown(STDIN_FILENO, terminal_uid, -1); |
| cap_set_proc(current); |
| } |
| cap_free(current); |
| |
| if (status != 0) { |
| openlog(PAM_APP_NAME, LOG_CONS|LOG_PERROR|LOG_PID, LOG_AUTHPRIV); |
| syslog(LOG_ALERT, "Terminal owner hasn\'t been restored: %s", |
| strerror(errno)); |
| closelog(); |
| } |
| terminal_uid = (uid_t) -1; |
| } |
| } |
| |
| /* |
| * make_process_unkillable changes the uid of the process. TEMP_UID is |
| * used for this temporary state. |
| * |
| * Returns: |
| * 0 ok, |
| * -1 fatal error (continue of the work is impossible), |
| * 1 non-fatal error. |
| * In the case of an error "err_descr" is set to the error message |
| * and "callname" to the name of the failed call. |
| */ |
| int make_process_unkillable(const char **callname, const char **err_descr) |
| { |
| invoked_uid = getuid(); |
| if (invoked_uid == TEMP_UID) { |
| /* no change needed */ |
| return 0; |
| } |
| |
| if (cap_setuid(TEMP_UID) != 0) { |
| *callname = "setuid"; |
| *err_descr = strerror(errno); |
| return -1; |
| } |
| return 0; |
| } |
| |
| /* |
| * make_process_killable restores the invoking uid to the current |
| * process. |
| */ |
| void make_process_killable() |
| { |
| (void) cap_setuid(invoked_uid); |
| } |
| |
| /* ------ command line parser ----------------- */ |
| |
| void usage(int exit_val) |
| { |
| fprintf(stderr,"usage: su [-] [-h] [-c \"command\"] [username]\n"); |
| exit(exit_val); |
| } |
| |
| /* |
| * parse_command_line extracts the options from the command line |
| * arguments. |
| */ |
| void parse_command_line(int argc, char *argv[], |
| int *is_login, const char **user, const char **command) |
| { |
| int username_present, command_present; |
| |
| *is_login = 0; |
| *user = NULL; |
| *command = NULL; |
| username_present = command_present = 0; |
| |
| while ( --argc > 0 ) { |
| const char *token; |
| |
| token = *++argv; |
| if (*token == '-') { |
| switch (*++token) { |
| case '\0': /* su as a login shell for the user */ |
| if (*is_login) |
| usage(1); |
| *is_login = 1; |
| break; |
| case 'c': |
| if (command_present) { |
| usage(1); |
| } else { /* indicate we are running commands */ |
| if (*++token != '\0') { |
| command_present = 1; |
| *command = token; |
| } else if (--argc > 0) { |
| command_present = 1; |
| *command = *++argv; |
| } else |
| usage(1); |
| } |
| break; |
| case 'h': |
| usage(0); |
| default: |
| usage(1); |
| } |
| } else { /* must be username */ |
| if (username_present) { |
| usage(1); |
| } |
| username_present = 1; |
| *user = *argv; |
| } |
| } |
| |
| if (!username_present) { |
| fprintf(stderr, PAM_APP_NAME ": requires a username\n"); |
| usage(1); |
| } |
| } |
| |
| /* |
| * This following contains code that waits for a child process to die. |
| * It also chooses to intercept a couple of signals that it will |
| * kindly pass on a SIGTERM to the child ;^). Waiting again for the |
| * child to exit. If the child resists dying, it will SIGKILL it! |
| */ |
| |
| static void wait_for_child_catch_sig(int ignore) |
| { |
| wait_for_child_caught = 1; |
| } |
| |
| static void prepare_for_job_control(int need_it) |
| { |
| sigset_t ourset; |
| |
| (void) sigfillset(&ourset); |
| if (sigprocmask(SIG_BLOCK, &ourset, NULL) != 0) { |
| fprintf(stderr,"[trouble blocking signals]\n"); |
| wait_for_child_caught = 1; |
| return; |
| } |
| need_job_control = need_it; |
| } |
| |
| int wait_for_child(pid_t child) |
| { |
| int retval, status, exit_code; |
| sigset_t ourset; |
| |
| exit_code = -1; /* no exit code yet, exit codes could be from 0 to 255 */ |
| if (child == -1) { |
| return exit_code; |
| } |
| |
| /* |
| * set up signal handling |
| */ |
| |
| if (!wait_for_child_caught) { |
| struct sigaction action, defaction; |
| |
| action.sa_handler = wait_for_child_catch_sig; |
| sigemptyset(&action.sa_mask); |
| action.sa_flags = 0; |
| |
| defaction.sa_handler = SIG_DFL; |
| sigemptyset(&defaction.sa_mask); |
| defaction.sa_flags = 0; |
| |
| sigemptyset(&ourset); |
| |
| if ( sigaddset(&ourset, SIGTERM) |
| || sigaction(SIGTERM, &action, NULL) |
| || sigaddset(&ourset, SIGHUP) |
| || sigaction(SIGHUP, &action, NULL) |
| || sigaddset(&ourset, SIGALRM) /* required by sleep(3) */ |
| || (need_job_control && sigaddset(&ourset, SIGTSTP)) |
| || (need_job_control && sigaction(SIGTSTP, &defaction, NULL)) |
| || (need_job_control && sigaddset(&ourset, SIGTTIN)) |
| || (need_job_control && sigaction(SIGTTIN, &defaction, NULL)) |
| || (need_job_control && sigaddset(&ourset, SIGTTOU)) |
| || (need_job_control && sigaction(SIGTTOU, &defaction, NULL)) |
| || (need_job_control && sigaddset(&ourset, SIGCONT)) |
| || (need_job_control && sigaction(SIGCONT, &defaction, NULL)) |
| || sigprocmask(SIG_UNBLOCK, &ourset, NULL) |
| ) { |
| fprintf(stderr,"[trouble setting signal intercept]\n"); |
| wait_for_child_caught = 1; |
| } |
| |
| /* application should be ready for receiving a SIGTERM/HUP now */ |
| } |
| |
| /* |
| * This code waits for the process to actually die. If it stops, |
| * then the parent attempts to mimic the behavior of the |
| * child.. There is a slight bug in the code when the 'su'd user |
| * attempts to restart the child independently of the parent -- |
| * the child dies. |
| */ |
| while (!wait_for_child_caught) { |
| /* parent waits for child */ |
| if ((retval = waitpid(child, &status, 0)) <= 0) { |
| if (errno == EINTR) { |
| continue; /* recovering from a 'fg' */ |
| } |
| fprintf(stderr, "[error waiting child: %s]\n", strerror(errno)); |
| /* |
| * Break the loop keeping exit_code undefined. |
| * Do we have a chance for a successful wait() call |
| * after kill()? (SAW) |
| */ |
| wait_for_child_caught = 1; |
| break; |
| } else { |
| /* the child is terminated via exit() or a fatal signal */ |
| if (WIFEXITED(status)) { |
| exit_code = WEXITSTATUS(status); |
| } else { |
| exit_code = 1; |
| } |
| break; |
| } |
| } |
| |
| if (wait_for_child_caught) { |
| fprintf(stderr,"\nKilling shell..."); |
| kill(child, SIGTERM); |
| } |
| |
| /* |
| * do we need to wait for the child to catch up? |
| */ |
| if (wait_for_child_caught) { |
| sleep(SLEEP_TO_KILL_CHILDREN); |
| kill(child, SIGKILL); |
| fprintf(stderr, "killed\n"); |
| } |
| |
| /* |
| * collect the zombie the shell was killed by ourself |
| */ |
| if (exit_code == -1) { |
| do { |
| retval = waitpid(child, &status, 0); |
| } while (retval == -1 && errno == EINTR); |
| if (retval == -1) { |
| fprintf(stderr, PAM_APP_NAME ": the final wait failed: %s\n", |
| strerror(errno)); |
| } |
| if (WIFEXITED(status)) { |
| exit_code = WEXITSTATUS(status); |
| } else { |
| exit_code = 1; |
| } |
| } |
| |
| return exit_code; |
| } |
| |
| |
| /* |
| * Next some code that parses the spawned shell command line. |
| */ |
| |
| static char * const *build_shell_args(const char *pw_shell, int login, |
| const char *command) |
| { |
| int use_default = 1; /* flag to signal we should use the default shell */ |
| const char **args=NULL; /* array of PATH+ARGS+NULL pointers */ |
| |
| D(("called.")); |
| if (login) { |
| command = NULL; /* command always ignored for login */ |
| } |
| |
| if (pw_shell && *pw_shell != '\0') { |
| char *line; |
| const char *tmp, *tmpb=NULL; |
| int arg_no=0,i; |
| |
| /* first find the number of arguments */ |
| D(("non-null shell")); |
| for (tmp=pw_shell; *tmp; ++arg_no) { |
| |
| /* skip leading spaces */ |
| while (isspace(*tmp)) |
| ++tmp; |
| |
| if (tmpb == NULL) /* mark beginning token */ |
| tmpb = tmp; |
| if (*tmp == '\0') /* end of line with no token */ |
| break; |
| |
| /* skip token */ |
| while (*tmp && !isspace(*tmp)) |
| ++tmp; |
| } |
| |
| /* |
| * We disallow shells: |
| * - without a full specified path; |
| * - when we are not logging in and the #args != 1 |
| * (unlikely a simple shell) |
| */ |
| |
| D(("shell so far = %s, arg_no = %d", tmpb, arg_no)); |
| if (tmpb != NULL && tmpb[0] == '/' /* something (full path) */ |
| && ( login || arg_no == 1 ) /* login, or single arg shells */ |
| ) { |
| |
| use_default = 0; /* we will use this shell */ |
| D(("committed to using user's shell")); |
| if (command) { |
| arg_no += 2; /* will append "-c" "command" */ |
| } |
| |
| /* allocate an array of pointers long enough */ |
| |
| D(("building array of size %d", 2+arg_no)); |
| args = (const char **) calloc(2+arg_no, sizeof(const char *)); |
| if (args == NULL) |
| return NULL; |
| /* get a string long enough for all the arguments */ |
| |
| D(("an array of size %d chars", 2+strlen(tmpb) |
| + ( command ? 4:0 ))); |
| line = (char *) malloc(2+strlen(tmpb) |
| + ( command ? 4:0 )); |
| if (line == NULL) { |
| free(args); |
| return NULL; |
| } |
| |
| /* fill array - tmpb points to start of first non-space char */ |
| |
| line[0] = '-'; |
| strcpy(line+1, tmpb); |
| |
| /* append " -c" to line? */ |
| if (command) { |
| strcat(line, " -c"); |
| } |
| |
| D(("complete command: %s [+] %s", line, command)); |
| |
| tmp = strtok(line, " \t"); |
| D(("command path=%s", line+1)); |
| args[0] = line+1; |
| |
| if (login) { /* standard procedure for login shell */ |
| D(("argv[0]=%s", line)); |
| args[i=1] = line; |
| } else { /* not a login shell -- for use with su */ |
| D(("argv[0]=%s", line+1)); |
| args[i=1] = line+1; |
| } |
| |
| while ((tmp = strtok(NULL, " \t"))) { |
| D(("adding argument %d: %s",i,tmp)); |
| args[++i] = tmp; |
| } |
| if (command) { |
| D(("appending command [%s]", command)); |
| args[++i] = command; |
| } |
| D(("terminating args with NULL")); |
| args[++i] = NULL; |
| D(("list completed.")); |
| } |
| } |
| |
| /* should we use the default shell instead of specific one? */ |
| |
| if (use_default && !login) { |
| int last_arg; |
| |
| D(("selecting default shell")); |
| last_arg = command ? 5:3; |
| |
| args = (const char **) calloc(last_arg--, sizeof(const char *)); |
| if (args == NULL) { |
| return NULL; |
| } |
| args[1] = DEFAULT_SHELL; /* mapped to argv[0] (NOT login shell) */ |
| args[0] = args[1]; /* path to program */ |
| if (command) { |
| args[2] = "-c"; /* should perform command and exit */ |
| args[3] = command; /* the desired command */ |
| } |
| args[last_arg] = NULL; /* terminate list of args */ |
| } |
| |
| D(("returning arg list")); |
| return (char * const *) args; |
| } |
| |
| |
| /* ------ abnormal termination ---------------- */ |
| |
| static void exit_now(int exit_code, const char *format, ...) |
| { |
| va_list args; |
| |
| va_start(args, format); |
| vfprintf(stderr, format, args); |
| va_end(args); |
| |
| if (pamh != NULL) |
| pam_end(pamh, exit_code ? PAM_ABORT:PAM_SUCCESS); |
| |
| /* USER's shell may have completely broken terminal settings |
| restore the sane(?) initial conditions */ |
| restore_terminal_modes(); |
| |
| exit(exit_code); |
| } |
| |
| static void exit_child_now(int exit_code, const char *format, ...) |
| { |
| va_list args; |
| |
| va_start(args,format); |
| vfprintf(stderr, format, args); |
| va_end(args); |
| |
| if (pamh != NULL) |
| pam_end(pamh, (exit_code ? PAM_ABORT:PAM_SUCCESS) | PAM_DATA_SILENT); |
| |
| exit(exit_code); |
| } |
| |
| /* ------ PAM setup --------------------------- */ |
| |
| static struct pam_conv conv = { |
| misc_conv, /* defined in <pam_misc/libmisc.h> */ |
| NULL |
| }; |
| |
| static void do_pam_init(const char *user, int is_login) |
| { |
| int retval; |
| |
| retval = pam_start(PAM_APP_NAME, user, &conv, &pamh); |
| if (retval != PAM_SUCCESS) { |
| /* |
| * From my point of view failing of pam_start() means that |
| * pamh isn't a valid handler. Without a handler |
| * we couldn't call pam_strerror :-( 1998/03/29 (SAW) |
| */ |
| fprintf(stderr, PAM_APP_NAME ": pam_start failed with code %d\n", |
| retval); |
| exit(1); |
| } |
| |
| /* |
| * Fill in some blanks |
| */ |
| |
| retval = make_environment(pamh, !is_login); |
| D(("made_environment returned: %s", pam_strerror(pamh,retval))); |
| |
| if (retval == PAM_SUCCESS && is_terminal) { |
| const char *terminal = ttyname(STDIN_FILENO); |
| if (terminal) { |
| retval = pam_set_item(pamh, PAM_TTY, (const void *)terminal); |
| } else { |
| retval = PAM_PERM_DENIED; /* how did we get here? */ |
| } |
| terminal = NULL; |
| } |
| |
| if (retval == PAM_SUCCESS && is_terminal) { |
| const char *ruser = getlogin(); /* Who is running this program? */ |
| if (ruser) { |
| retval = pam_set_item(pamh, PAM_RUSER, (const void *)ruser); |
| } else { |
| retval = PAM_PERM_DENIED; /* must be known to system */ |
| } |
| ruser = NULL; |
| } |
| |
| if (retval == PAM_SUCCESS) { |
| retval = pam_set_item(pamh, PAM_RHOST, (const void *)"localhost"); |
| } |
| |
| if (retval != PAM_SUCCESS) { |
| exit_now(1, PAM_APP_NAME ": problem establishing environment\n"); |
| } |
| |
| /* have to pause on failure. At least this long (doubles..) */ |
| retval = pam_fail_delay(pamh, SU_FAIL_DELAY); |
| if (retval != PAM_SUCCESS) { |
| exit_now(1, PAM_APP_NAME ": problem initializing failure delay\n"); |
| } |
| } |
| |
| /* |
| * authenticate_user arranges for the PAM authentication stack to run. |
| */ |
| static int authenticate_user(pam_handle_t *pamh, cap_t all, |
| int *retval, const char **place, |
| const char **err_descr) |
| { |
| *place = "pre-auth cap_set_proc"; |
| if (cap_set_proc(all)) { |
| D(("failed to raise all capabilities")); |
| *err_descr = "cap_set_proc() failed"; |
| *retval = PAM_SUCCESS; |
| return 1; |
| } |
| |
| D(("attempt to authenticate user")); |
| *place = "pam_authenticate"; |
| *retval = pam_authenticate(pamh, 0); |
| return (*retval != PAM_SUCCESS); |
| } |
| |
| /* |
| * user_accounting confirms an authenticated user is permitted service. |
| */ |
| static int user_accounting(pam_handle_t *pamh, cap_t all, |
| int *retval, const char **place, |
| const char **err_descr) { |
| *place = "user_accounting"; |
| if (cap_set_proc(all)) { |
| D(("failed to raise all capabilities")); |
| *err_descr = "cap_set_proc() failed"; |
| return 1; |
| } |
| *place = "pam_acct_mgmt"; |
| *retval = pam_acct_mgmt(pamh, 0); |
| return (*retval != PAM_SUCCESS); |
| } |
| |
| /* |
| * Find entry for this terminal (if there is one). |
| * Utmp file should have been opened and rewinded for the call. |
| * |
| * XXX: the search should be more or less compatible with libc one. |
| * The caller expects that pututline with the same arguments |
| * will replace the found entry. |
| */ |
| static const struct utmp *find_utmp_entry(const char *ut_line, |
| const char *ut_id) |
| { |
| struct utmp *u_tmp_p; |
| |
| while ((u_tmp_p = getutent()) != NULL) |
| if ((u_tmp_p->ut_type == INIT_PROCESS || |
| u_tmp_p->ut_type == LOGIN_PROCESS || |
| u_tmp_p->ut_type == USER_PROCESS || |
| u_tmp_p->ut_type == DEAD_PROCESS) && |
| !strncmp(u_tmp_p->ut_id, ut_id, UT_IDSIZE) && |
| !strncmp(u_tmp_p->ut_line, ut_line, UT_LINESIZE)) |
| break; |
| |
| return u_tmp_p; |
| } |
| |
| /* |
| * Identify the terminal name and the abbreviation we will use. |
| */ |
| static void set_terminal_name(const char *terminal, char *ut_line, char *ut_id) |
| { |
| memset(ut_line, 0, UT_LINESIZE); |
| memset(ut_id, 0, UT_IDSIZE); |
| |
| /* set the terminal entry */ |
| if ( *terminal == '/' ) { /* now deal with filenames */ |
| int o1, o2; |
| |
| o1 = strncmp(DEVICE_FILE_PREFIX, terminal, 5) ? 0 : 5; |
| if (!strncmp("/dev/tty", terminal, 8)) { |
| o2 = 8; |
| } else { |
| o2 = strlen(terminal) - sizeof(UT_IDSIZE); |
| if (o2 < 0) |
| o2 = 0; |
| } |
| |
| strncpy(ut_line, terminal + o1, UT_LINESIZE); |
| strncpy(ut_id, terminal + o2, UT_IDSIZE); |
| } else if (strchr(terminal, ':')) { /* deal with X-based session */ |
| const char *suffix; |
| |
| suffix = strrchr(terminal,':'); |
| strncpy(ut_line, terminal, UT_LINESIZE); |
| strncpy(ut_id, suffix, UT_IDSIZE); |
| } else { /* finally deal with weird terminals */ |
| strncpy(ut_line, terminal, UT_LINESIZE); |
| ut_id[0] = '?'; |
| strncpy(ut_id + 1, terminal, UT_IDSIZE - 1); |
| } |
| } |
| |
| /* |
| * Append an entry to wtmp. See utmp_open_session for the return convention. |
| * Be careful: the function uses alarm(). |
| */ |
| |
| #define WWTMP_STATE_BEGINNING 0 |
| #define WWTMP_STATE_FILE_OPENED 1 |
| #define WWTMP_STATE_SIGACTION_SET 2 |
| #define WWTMP_STATE_LOCK_TAKEN 3 |
| |
| static int write_wtmp(struct utmp *u_tmp_p, const char **callname, |
| const char **err_descr) |
| { |
| int w_tmp_fd; |
| struct flock w_lock; |
| struct sigaction act1, act2; |
| int state; |
| int retval; |
| |
| state = WWTMP_STATE_BEGINNING; |
| retval = 1; |
| |
| do { |
| D(("writing to wtmp")); |
| w_tmp_fd = open(_PATH_WTMP, O_APPEND|O_WRONLY); |
| if (w_tmp_fd == -1) { |
| *callname = "wtmp open"; |
| *err_descr = strerror(errno); |
| break; |
| } |
| state = WWTMP_STATE_FILE_OPENED; |
| |
| /* prepare for blocking operation... */ |
| act1.sa_handler = SIG_DFL; |
| sigemptyset(&act1.sa_mask); |
| act1.sa_flags = 0; |
| if (sigaction(SIGALRM, &act1, &act2) == -1) { |
| *callname = "sigaction"; |
| *err_descr = strerror(errno); |
| break; |
| } |
| alarm(WTMP_LOCK_TIMEOUT); |
| state = WWTMP_STATE_SIGACTION_SET; |
| |
| /* now we try to lock this file-rcord exclusively; non-blocking */ |
| memset(&w_lock, 0, sizeof(w_lock)); |
| w_lock.l_type = F_WRLCK; |
| w_lock.l_whence = SEEK_END; |
| if (fcntl(w_tmp_fd, F_SETLK, &w_lock) < 0) { |
| D(("locking %s failed.", _PATH_WTMP)); |
| *callname = "fcntl(F_SETLK)"; |
| *err_descr = strerror(errno); |
| break; |
| } |
| alarm(0); |
| sigaction(SIGALRM, &act2, NULL); |
| state = WWTMP_STATE_LOCK_TAKEN; |
| |
| if (write(w_tmp_fd, u_tmp_p, sizeof(struct utmp)) != -1) { |
| retval = 0; |
| } |
| } while(0); /* it's not a loop! */ |
| |
| if (state >= WWTMP_STATE_LOCK_TAKEN) { |
| w_lock.l_type = F_UNLCK; /* unlock wtmp file */ |
| fcntl(w_tmp_fd, F_SETLK, &w_lock); |
| }else if (state >= WWTMP_STATE_SIGACTION_SET) { |
| alarm(0); |
| sigaction(SIGALRM, &act2, NULL); |
| } |
| |
| if (state >= WWTMP_STATE_FILE_OPENED) { |
| close(w_tmp_fd); /* close wtmp file */ |
| D(("wtmp written")); |
| } |
| |
| return retval; |
| } |
| |
| /* |
| * XXX - if this gets turned into a module, make this a |
| * pam_data item. You should put the pid in the name so we can |
| * "probably" nest calls more safely... |
| */ |
| struct utmp *login_stored_utmp=NULL; |
| |
| /* |
| * Returns: |
| * 0 ok, |
| * 1 non-fatal error |
| * -1 fatal error |
| * callname and err_descr will be set |
| * Be careful: the function indirectly uses alarm(). |
| */ |
| static int utmp_do_open_session(const char *user, const char *terminal, |
| const char *rhost, pid_t pid, |
| const char **place, const char **err_descr) |
| { |
| struct utmp u_tmp; |
| const struct utmp *u_tmp_p; |
| char ut_line[UT_LINESIZE], ut_id[UT_IDSIZE]; |
| int retval; |
| |
| set_terminal_name(terminal, ut_line, ut_id); |
| |
| utmpname(_PATH_UTMP); |
| setutent(); /* rewind file */ |
| u_tmp_p = find_utmp_entry(ut_line, ut_id); |
| |
| /* reset new entry */ |
| memset(&u_tmp, 0, sizeof(u_tmp)); /* reset new entry */ |
| if (u_tmp_p == NULL) { |
| D(("[NEW utmp]")); |
| } else { |
| D(("[OLD utmp]")); |
| |
| /* |
| * here, we make a record of the former entry. If the |
| * utmp_close_session code is attached to the same process, |
| * the wtmp will be replaced, otherwise we leave init to pick |
| * up the pieces. |
| */ |
| if (login_stored_utmp == NULL) { |
| login_stored_utmp = malloc(sizeof(struct utmp)); |
| if (login_stored_utmp == NULL) { |
| *place = "malloc"; |
| *err_descr = "fail"; |
| endutent(); |
| return -1; |
| } |
| } |
| memcpy(login_stored_utmp, u_tmp_p, sizeof(struct utmp)); |
| } |
| |
| /* we adjust the entry to reflect the current session */ |
| { |
| strncpy(u_tmp.ut_line, ut_line, UT_LINESIZE); |
| memset(ut_line, 0, UT_LINESIZE); |
| strncpy(u_tmp.ut_id, ut_id, UT_IDSIZE); |
| memset(ut_id, 0, UT_IDSIZE); |
| strncpy(u_tmp.ut_user, user |
| , sizeof(u_tmp.ut_user)); |
| strncpy(u_tmp.ut_host, rhost ? rhost : RHOST_UNKNOWN_NAME |
| , sizeof(u_tmp.ut_host)); |
| |
| /* try to fill the host address entry */ |
| if (rhost != NULL) { |
| struct hostent *hptr; |
| |
| /* XXX: it isn't good to do DNS lookup here... 1998/05/29 SAW */ |
| hptr = gethostbyname(rhost); |
| if (hptr != NULL && hptr->h_addr_list) { |
| memcpy(&u_tmp.ut_addr, hptr->h_addr_list[0] |
| , sizeof(u_tmp.ut_addr)); |
| } |
| } |
| |
| /* we fill in the remaining info */ |
| u_tmp.ut_type = USER_PROCESS; /* a user process starting */ |
| u_tmp.ut_pid = pid; /* session identifier */ |
| u_tmp.ut_time = time(NULL); |
| } |
| |
| setutent(); /* rewind file (replace old) */ |
| pututline(&u_tmp); /* write it to utmp */ |
| endutent(); /* close the file */ |
| |
| retval = write_wtmp(&u_tmp, place, err_descr); /* write to wtmp file */ |
| memset(&u_tmp, 0, sizeof(u_tmp)); /* reset entry */ |
| |
| return retval; |
| } |
| |
| static int utmp_do_close_session(const char *terminal, |
| const char **place, const char **err_descr) |
| { |
| int retval; |
| struct utmp u_tmp; |
| const struct utmp *u_tmp_p; |
| char ut_line[UT_LINESIZE], ut_id[UT_IDSIZE]; |
| |
| retval = 0; |
| |
| set_terminal_name(terminal, ut_line, ut_id); |
| |
| utmpname(_PATH_UTMP); |
| setutent(); /* rewind file */ |
| |
| /* |
| * if there was a stored entry, return it to the utmp file, else |
| * if there is a session to close, we close that |
| */ |
| if (login_stored_utmp) { |
| pututline(login_stored_utmp); |
| |
| memcpy(&u_tmp, login_stored_utmp, sizeof(u_tmp)); |
| u_tmp.ut_time = time(NULL); /* a new time to restart */ |
| |
| retval = write_wtmp(&u_tmp, place, err_descr); |
| |
| memset(login_stored_utmp, 0, sizeof(u_tmp)); /* reset entry */ |
| free(login_stored_utmp); |
| } else { |
| u_tmp_p = find_utmp_entry(ut_line, ut_id); |
| if (u_tmp_p != NULL) { |
| memset(&u_tmp, 0, sizeof(u_tmp)); |
| strncpy(u_tmp.ut_line, ut_line, UT_LINESIZE); |
| strncpy(u_tmp.ut_id, ut_id, UT_IDSIZE); |
| memset(&u_tmp.ut_user, 0, sizeof(u_tmp.ut_user)); |
| memset(&u_tmp.ut_host, 0, sizeof(u_tmp.ut_host)); |
| u_tmp.ut_addr = 0; |
| u_tmp.ut_type = DEAD_PROCESS; /* `old' login process */ |
| u_tmp.ut_pid = 0; |
| u_tmp.ut_time = time(NULL); |
| setutent(); /* rewind file (replace old) */ |
| pututline(&u_tmp); /* mark as dead */ |
| |
| retval = write_wtmp(&u_tmp, place, err_descr); |
| } |
| } |
| |
| /* clean up */ |
| memset(ut_line, 0, UT_LINESIZE); |
| memset(ut_id, 0, UT_IDSIZE); |
| |
| endutent(); /* close utmp file */ |
| memset(&u_tmp, 0, sizeof(u_tmp)); /* reset entry */ |
| |
| return 0; |
| } |
| |
| /* |
| * Returns: |
| * 0 ok, |
| * 1 non-fatal error |
| * -1 fatal error |
| * place and err_descr will be set |
| * Be careful: the function indirectly uses alarm(). |
| */ |
| static int utmp_open_session(pam_handle_t *pamh, pid_t pid, |
| int *retval, |
| const char **place, const char **err_descr) |
| { |
| const char *user, *terminal, *rhost; |
| |
| *retval = pam_get_item(pamh, PAM_USER, (const void **)&user); |
| if (*retval != PAM_SUCCESS) { |
| return -1; |
| } |
| *retval = pam_get_item(pamh, PAM_TTY, (const void **)&terminal); |
| if (retval != PAM_SUCCESS) { |
| return -1; |
| } |
| *retval = pam_get_item(pamh, PAM_RHOST, (const void **)&rhost); |
| if (retval != PAM_SUCCESS) { |
| rhost = NULL; |
| } |
| |
| return utmp_do_open_session(user, terminal, rhost, pid, place, err_descr); |
| } |
| |
| static int utmp_close_session(pam_handle_t *pamh |
| , const char **place, const char **err_descr) |
| { |
| int retval; |
| const char *terminal; |
| |
| retval = pam_get_item(pamh, PAM_TTY, (const void **)&terminal); |
| if (retval != PAM_SUCCESS) { |
| *place = "pam_get_item(PAM_TTY)"; |
| *err_descr = pam_strerror(pamh, retval); |
| return -1; |
| } |
| |
| return utmp_do_close_session(terminal, place, err_descr); |
| } |
| |
| /* |
| * set_credentials raises all of the process and PAM credentials. |
| */ |
| static int set_credentials(pam_handle_t *pamh, cap_t all, int login, |
| const char **pw_shell, |
| int *retval, const char **place, |
| const char **err_descr) |
| { |
| const char *user; |
| char *shell; |
| cap_value_t csetgid = CAP_SETGID; |
| cap_t current; |
| int status; |
| struct passwd *pw; |
| uid_t uid; |
| |
| D(("get user from pam")); |
| *place = "set_credentials"; |
| *retval = pam_get_item(pamh, PAM_USER, (const void **)&user); |
| if (*retval != PAM_SUCCESS || user == NULL || *user == '\0') { |
| D(("error identifying user from PAM.")); |
| *retval = PAM_USER_UNKNOWN; |
| return 1; |
| } |
| |
| /* |
| * Add the LOGNAME and HOME environment variables. |
| */ |
| |
| pw = getpwnam(user); |
| if (pw == NULL || (user = x_strdup(pw->pw_name)) == NULL) { |
| D(("failed to identify user")); |
| *retval = PAM_USER_UNKNOWN; |
| return 1; |
| } |
| |
| uid = pw->pw_uid; |
| shell = x_strdup(pw->pw_shell); |
| if (shell == NULL) { |
| D(("user %s has no shell", user)); |
| *retval = PAM_CRED_ERR; |
| return 1; |
| } |
| |
| if (login) { |
| /* set LOGNAME, HOME */ |
| if (pam_misc_setenv(pamh, "LOGNAME", user, 0) != PAM_SUCCESS) { |
| D(("failed to set LOGNAME")); |
| *retval = PAM_CRED_ERR; |
| return 1; |
| } |
| if (pam_misc_setenv(pamh, "HOME", pw->pw_dir, 0) != PAM_SUCCESS) { |
| D(("failed to set HOME")); |
| *retval = PAM_CRED_ERR; |
| return 1; |
| } |
| } |
| |
| current = cap_get_proc(); |
| cap_set_flag(current, CAP_EFFECTIVE, 1, &csetgid, CAP_SET); |
| status = cap_set_proc(current); |
| cap_free(current); |
| if (status != 0) { |
| *err_descr = "unable to raise CAP_SETGID"; |
| return 1; |
| } |
| |
| /* initialize groups */ |
| if (initgroups(pw->pw_name, pw->pw_gid) != 0 || setgid(pw->pw_gid) != 0) { |
| D(("failed to setgid etc")); |
| *retval = PAM_PERM_DENIED; |
| return 1; |
| } |
| *pw_shell = shell; |
| |
| pw = NULL; /* be tidy */ |
| |
| D(("desired uid=%d", uid)); |
| |
| /* assume user's identity - but preserve the permitted set */ |
| if (cap_setuid(uid) != 0) { |
| D(("failed to setuid: %v", strerror(errno))); |
| *retval = PAM_PERM_DENIED; |
| return 1; |
| } |
| |
| /* |
| * Next, we call the PAM framework to add/enhance the credentials |
| * of this user [it may change the user's home directory in the |
| * pam_env, and add supplemental group memberships...]. |
| */ |
| D(("setting credentials")); |
| if (cap_set_proc(all)) { |
| D(("failed to raise all capabilities")); |
| *retval = PAM_PERM_DENIED; |
| return 1; |
| } |
| |
| D(("calling pam_setcred to establish credentials")); |
| *retval = pam_setcred(pamh, PAM_ESTABLISH_CRED); |
| |
| return (*retval != PAM_SUCCESS); |
| } |
| |
| /* |
| * open_session invokes the open session PAM stack. |
| */ |
| static int open_session(pam_handle_t *pamh, cap_t all, |
| int *retval, const char **place, const char **err_descr) |
| { |
| /* Open the su-session */ |
| *place = "pam_open_session"; |
| if (cap_set_proc(all)) { |
| D(("failed to raise t_caps capabilities")); |
| *err_descr = "capability setting failed"; |
| return 1; |
| } |
| *retval = pam_open_session(pamh, 0); /* Must take care to close */ |
| if (*retval != PAM_SUCCESS) { |
| return 1; |
| } |
| return 0; |
| } |
| |
| /* ------ shell invoker ----------------------- */ |
| |
| static int launch_callback_fn(void *h) |
| { |
| pam_handle_t *pamh = h; |
| int retval; |
| |
| D(("pam_end")); |
| retval = pam_end(pamh, PAM_SUCCESS | PAM_DATA_SILENT); |
| pamh = NULL; |
| if (retval != PAM_SUCCESS) { |
| return -1; |
| } |
| |
| /* |
| * Restore a signal status: information if the signal is ignored |
| * is inherited across exec() call. (SAW) |
| */ |
| enable_terminal_signals(); |
| |
| D(("about to launch")); |
| return 0; |
| } |
| |
| /* Returns PAM_<STATUS>. */ |
| static int perform_launch_and_cleanup(cap_t all, int is_login, |
| const char *shell, const char *command) |
| { |
| int retval, status; |
| const char *user, *home; |
| uid_t uid; |
| char * const * shell_args; |
| char * const * shell_env; |
| cap_launch_t launcher; |
| pid_t child; |
| |
| |
| /* |
| * Break up the shell command into a command and arguments |
| */ |
| shell_args = build_shell_args(shell, is_login, command); |
| if (shell_args == NULL) { |
| D(("failed to compute shell arguments")); |
| return PAM_SYSTEM_ERR; |
| } |
| |
| home = pam_getenv(pamh, "HOME"); |
| if ( !home || home[0] == '\0' ) { |
| fprintf(stderr, "setting home directory for %s to %s\n", |
| user, DEFAULT_HOME); |
| home = DEFAULT_HOME; |
| if (pam_misc_setenv(pamh, "HOME", home, 0) != PAM_SUCCESS) { |
| D(("unable to set $HOME")); |
| fprintf(stderr, |
| "Warning: unable to set HOME environment variable\n"); |
| } |
| } |
| if (is_login) { |
| if (chdir(home) && chdir(DEFAULT_HOME)) { |
| D(("failed to change directory")); |
| return PAM_SYSTEM_ERR; |
| } |
| } |
| |
| shell_env = pam_getenvlist(pamh); |
| if (shell_env == NULL) { |
| D(("failed to obtain environment for child")); |
| return PAM_SYSTEM_ERR; |
| } |
| |
| launcher = cap_new_launcher(shell_args[0], |
| (const char * const *) &shell_args[1], |
| (const char * const *) shell_env); |
| if (launcher == NULL) { |
| D(("failed to initialize launcher")); |
| return PAM_SYSTEM_ERR; |
| } |
| cap_launcher_set_iab(launcher, cap_iab_get_proc()); |
| cap_launcher_callback(launcher, launch_callback_fn); |
| |
| child = cap_launch(launcher, pamh); |
| cap_free(launcher); |
| |
| /* job control is off for login sessions */ |
| prepare_for_job_control(!is_login && command != NULL); |
| |
| if (cap_setuid(TEMP_UID) != 0) { |
| fprintf(stderr, "[failed to change monitor UID=%d]\n", TEMP_UID); |
| } |
| |
| /* wait for child to terminate */ |
| status = wait_for_child(child); |
| if (status != 0) { |
| D(("shell returned %d", status)); |
| } |
| return status; |
| } |
| |
| static void close_session(pam_handle_t *pamh, cap_t all) |
| { |
| int retval; |
| |
| D(("session %p closing", pamh)); |
| if (cap_set_proc(all)) { |
| fprintf(stderr, "WARNING: could not raise all caps\n"); |
| } |
| retval = pam_close_session(pamh, 0); |
| if (retval != PAM_SUCCESS) { |
| fprintf(stderr, "WARNING: could not close session\n\t%s\n", |
| pam_strerror(pamh,retval)); |
| } |
| } |
| |
| /* -------------------------------------------- */ |
| /* ------ the application itself -------------- */ |
| /* -------------------------------------------- */ |
| |
| int main(int argc, char *argv[]) |
| { |
| int retcode, is_login, status; |
| int retval, final_retval; /* PAM_xxx return values */ |
| const char *command, *shell; |
| pid_t child; |
| uid_t uid; |
| const char *place = NULL, *err_descr = NULL; |
| cap_t all, t_caps; |
| |
| all = cap_get_proc(); |
| cap_fill(all, CAP_EFFECTIVE, CAP_PERMITTED); |
| |
| checkfds(); |
| |
| /* |
| * Check whether stdin is a terminal and store terminal modes for later. |
| */ |
| store_terminal_modes(); |
| |
| /* ---------- parse the argument list and --------- */ |
| /* ------ initialize the Linux-PAM interface ------ */ |
| { |
| const char *user; /* transient until PAM_USER defined */ |
| parse_command_line(argc, argv, &is_login, &user, &command); |
| place = "do_pam_init"; |
| do_pam_init(user, is_login); /* call pam_start and set PAM items */ |
| } |
| |
| /* |
| * Turn off terminal signals - this is to be sure that su gets a |
| * chance to call pam_end() and restore the terminal modes in |
| * spite of the frustrated user pressing Ctrl-C. |
| */ |
| disable_terminal_signals(); |
| |
| /* |
| * Random exits from here are strictly prohibited :-) (SAW) AGM |
| * achieves this with goto's and a single exit at the end of main. |
| */ |
| status = 1; /* fake exit status of a child */ |
| err_descr = NULL; /* errors haven't happened */ |
| |
| if (make_process_unkillable(&place, &err_descr) != 0) { |
| goto su_exit; |
| } |
| |
| if (authenticate_user(pamh, all, &retval, &place, &err_descr) != 0) { |
| goto auth_exit; |
| } |
| |
| /* |
| * The user is valid, but should they have access at this |
| * time? |
| */ |
| if (user_accounting(pamh, all, &retval, &place, &err_descr) != 0) { |
| goto auth_exit; |
| } |
| |
| D(("su attempt is confirmed as authorized")); |
| |
| /* |
| * ... setup terminal, ... |
| */ |
| retcode = change_terminal_owner(uid, is_login, &place, &err_descr); |
| if (retcode > 0) { |
| fprintf(stderr, PAM_APP_NAME ": %s: %s\n", place, err_descr); |
| err_descr = NULL; /* forget about the problem */ |
| } else if (retcode < 0) { |
| D(("terminal owner to uid=%d change failed", uid)); |
| goto auth_exit; |
| } |
| |
| if (set_credentials(pamh, all, is_login, |
| &shell, &retval, &place, &err_descr) != 0) { |
| D(("failed to set credentials")); |
| goto auth_exit; |
| } |
| |
| /* |
| * Here the IAB value is fixed and may differ from all's |
| * Inheritable value. So synthesize what we need to proceed in the |
| * child, for now, in this current process. |
| */ |
| place = "preserving inheritable parts"; |
| t_caps = cap_get_proc(); |
| if (t_caps == NULL) { |
| D(("failed to read capabilities")); |
| err_descr = "capability read failed"; |
| goto delete_cred; |
| } |
| if (cap_fill(t_caps, CAP_EFFECTIVE, CAP_PERMITTED)) { |
| D(("failed to fill effective bits")); |
| err_descr = "capability fill failed"; |
| goto delete_cred; |
| } |
| |
| /* |
| * ... make [uw]tmp entries. |
| */ |
| if (is_login) { |
| /* |
| * Note: we use the parent pid as a session identifier for |
| * the logging. |
| */ |
| retcode = utmp_open_session(pamh, getpid(), |
| &retval, &place, &err_descr); |
| if (retcode > 0) { |
| fprintf(stderr, PAM_APP_NAME ": %s: %s\n", place, err_descr); |
| err_descr = NULL; /* forget about this non-critical problem */ |
| } else if (retcode < 0) { |
| goto delete_cred; |
| } |
| } |
| |
| if (open_session(pamh, t_caps, &retval, &place, &err_descr) != 0) { |
| goto utmp_closer; |
| } |
| |
| status = perform_launch_and_cleanup(t_caps, is_login, shell, command); |
| close_session(pamh, all); |
| |
| utmp_closer: |
| if (is_login) { |
| /* do [uw]tmp cleanup */ |
| retcode = utmp_close_session(pamh, &place, &err_descr); |
| if (retcode) { |
| fprintf(stderr, PAM_APP_NAME ": %s: %s\n", place, err_descr); |
| } |
| } |
| |
| delete_cred: |
| D(("delete credentials")); |
| if (cap_set_proc(all)) { |
| D(("failed to raise all capabilities")); |
| } |
| retcode = pam_setcred(pamh, PAM_DELETE_CRED); |
| if (retcode != PAM_SUCCESS) { |
| fprintf(stderr, "WARNING: could not delete credentials\n\t%s\n", |
| pam_strerror(pamh, retcode)); |
| } |
| |
| old_owner: |
| D(("return terminal to local control")); |
| restore_terminal_owner(); |
| |
| auth_exit: |
| D(("for clean up we restore the launching user")); |
| make_process_killable(); |
| |
| D(("all done - closing down pam")); |
| if (retval != PAM_SUCCESS) { /* PAM has failed */ |
| fprintf(stderr, PAM_APP_NAME ": %s\n", pam_strerror(pamh, retval)); |
| final_retval = PAM_ABORT; |
| } else if (err_descr != NULL) { /* a system error has happened */ |
| fprintf(stderr, PAM_APP_NAME ": %s: %s\n", place, err_descr); |
| final_retval = PAM_ABORT; |
| } else { |
| final_retval = PAM_SUCCESS; |
| } |
| (void) pam_end(pamh, final_retval); |
| pamh = NULL; |
| |
| if (restore_terminal_modes() != 0 && !status) { |
| status = 1; |
| } |
| |
| su_exit: |
| exit(status); /* transparent exit */ |
| } |
