/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License (the "License").
* You may not use this file except in compliance with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* or http://www.opensolaris.org/os/licensing.
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*/
/*
* Copyright 2009 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
#include <syslog.h>
#include <pwd.h>
#include <unistd.h>
#include <strings.h>
#include <security/pam_appl.h>
#include <security/pam_modules.h>
#include <libintl.h>
#include <pwd.h>
#include <user_attr.h>
#include <secdb.h>
#include <nss_dbdefs.h>
#include <security/pam_impl.h>
static int roleinlist();
/*
* pam_sm_acct_mgmt():
* Account management module
* This module disallows roles for primary logins and adds special
* checks to allow roles for secondary logins.
*/
/*ARGSUSED*/
int
pam_sm_acct_mgmt(pam_handle_t *pamh, int flags, int argc, const char **argv)
{
uid_t uid;
userattr_t *user_entry;
char *kva_value;
char *username;
char *auser;
char *rhost;
char messages[PAM_MAX_NUM_MSG][PAM_MAX_MSG_SIZE];
struct passwd *pw_entry, pwd;
char buf[NSS_BUFLEN_PASSWD];
int i;
int debug = 0;
int allow_remote = 0;
(void) pam_get_item(pamh, PAM_USER, (void **)&username);
(void) pam_get_item(pamh, PAM_AUSER, (void **)&auser);
(void) pam_get_item(pamh, PAM_RHOST, (void **)&rhost);
for (i = 0; i < argc; i++) {
if (strcmp(argv[i], "allow_remote") == 0) {
allow_remote = 1;
} else if (strcmp(argv[i], "debug") == 0) {
debug = 1;
} else {
__pam_log(LOG_AUTH | LOG_ERR,
"pam_roles:pam_sm_acct_mgmt: illegal module "
"option %s", argv[i]);
}
}
if (debug) {
char *ruser;
char *service;
(void) pam_get_item(pamh, PAM_RUSER, (void **)&ruser);
(void) pam_get_item(pamh, PAM_SERVICE, (void **)&service);
__pam_log(LOG_AUTH | LOG_DEBUG, "pam_roles:pam_sm_acct_mgmt: "
"service = %s, allow_remote = %d, user = %s auser = %s "
"ruser = %s rhost = %s\n", (service) ? service : "not set",
allow_remote, (username) ? username : "not set",
(auser) ? auser: "not set", (ruser) ? ruser: "not set",
(rhost) ? rhost: "not set");
}
if (username == NULL)
return (PAM_USER_UNKNOWN);
/* stop masquerades by mapping username to uid to username */
if ((pw_entry = getpwnam_r(username, &pwd, buf, sizeof (buf))) == NULL)
return (PAM_USER_UNKNOWN);
if ((pw_entry = getpwuid_r(pw_entry->pw_uid, &pwd, buf,
sizeof (buf))) == NULL)
return (PAM_USER_UNKNOWN);
/*
* If there's no user_attr entry for the primary user or it's not a
* role, no further checks are needed.
*/
if (((user_entry = getusernam(pw_entry->pw_name)) == NULL) ||
((kva_value = kva_match((kva_t *)user_entry->attr,
USERATTR_TYPE_KW)) == NULL) ||
((strcmp(kva_value, USERATTR_TYPE_NONADMIN_KW) != 0) &&
(strcmp(kva_value, USERATTR_TYPE_ADMIN_KW) != 0))) {
free_userattr(user_entry);
return (PAM_IGNORE);
}
free_userattr(user_entry);
/* username is a role */
if (strcmp(username, pw_entry->pw_name) != 0) {
__pam_log(LOG_AUTH | LOG_ALERT,
"pam_roles:pam_sm_acct_mgmt: user name %s "
"maps to user id %d which is user name %s",
username, pw_entry->pw_uid, pw_entry->pw_name);
}
/* Who's the user requesting the role? */
if (auser != NULL && *auser != '\0') {
/* authenticated requesting user */
user_entry = getusernam(auser);
} else {
/* user is implied by real UID */
if ((uid = getuid()) == 0) {
/*
* Root user_attr entry cannot have roles.
* Force error and deny access.
*/
user_entry = NULL;
} else {
if ((pw_entry = getpwuid_r(uid, &pwd, buf,
sizeof (buf))) == NULL) {
return (PAM_USER_UNKNOWN);
}
user_entry = getusernam(pw_entry->pw_name);
}
}
if ((rhost != NULL && *rhost != '\0') &&
allow_remote == 0) {
/* don't allow remote roles for this service */
free_userattr(user_entry);
return (PAM_PERM_DENIED);
}
/*
* If the original user does not have a user_attr entry or isn't
* assigned the role being assumed, fail.
*/
if ((user_entry == NULL) ||
((kva_value = kva_match((kva_t *)user_entry->attr,
USERATTR_ROLES_KW)) == NULL) ||
(roleinlist(kva_value, username) == 0)) {
free_userattr(user_entry);
(void) strlcpy(messages[0], dgettext(TEXT_DOMAIN,
"Roles can only be assumed by authorized users"),
sizeof (messages[0]));
(void) __pam_display_msg(pamh, PAM_ERROR_MSG, 1, messages,
NULL);
return (PAM_PERM_DENIED);
}
free_userattr(user_entry);
return (PAM_IGNORE);
}
int
roleinlist(char *list, char *role)
{
char *lasts = (char *)NULL;
char *rolename = (char *)strtok_r(list, ",", &lasts);
while (rolename) {
if (strcmp(rolename, role) == 0)
return (1);
else
rolename = (char *)strtok_r(NULL, ",", &lasts);
}
return (0);
}