f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica/*
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica * CDDL HEADER START
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica *
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica * The contents of this file are subject to the terms of the
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica * Common Development and Distribution License (the "License").
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica * You may not use this file except in compliance with the License.
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica *
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica * or http://www.opensolaris.org/os/licensing.
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica * See the License for the specific language governing permissions
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica * and limitations under the License.
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica *
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica * When distributing Covered Code, include this CDDL HEADER in each
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica * If applicable, add the following below this CDDL HEADER, with the
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica * fields enclosed by brackets "[]" replaced with your own identifying
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica * information: Portions Copyright [yyyy] [name of copyright owner]
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica *
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica * CDDL HEADER END
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica */
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica/*
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica * Copyright 2007 Sun Microsystems, Inc. All rights reserved.
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica * Use is subject to license terms.
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica */
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica#pragma ident "%Z%%M% %I% %E% SMI"
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica#include <libtsnet.h>
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica#include <stdlib.h>
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica#include <string.h>
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica#include <syslog.h>
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica#include <zone.h>
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica#include <security/pam_appl.h>
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica#include <security/pam_modules.h>
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica#include <security/pam_impl.h>
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica#include <tsol/label.h>
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica/*
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica * pam_tsol_account - Trusted Extensions account management.
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica * Validates that the user's label range contains
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica * the process label (label of the zone).
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica */
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01ricastatic void
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01ricafree_labels(m_range_t *r, m_label_t *l)
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica{
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica m_label_free(r->lower_bound);
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica m_label_free(r->upper_bound);
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica free(r);
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica m_label_free(l);
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica}
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica/* ARGSUSED */
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01ricaint
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01ricapam_sm_acct_mgmt(pam_handle_t *pamh, int flags, int argc, const char **argv)
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica{
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica int i;
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica int debug = 0;
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica int allow_unlabeled = 0;
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica char *user;
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica char *rhost;
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica m_range_t *range;
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica m_label_t *plabel;
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica for (i = 0; i < argc; i++) {
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica if (strcmp(argv[i], "debug") == 0) {
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica debug = 1;
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica } else if (strcmp(argv[i], "allow_unlabeled") == 0) {
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica allow_unlabeled = 1;
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica } else {
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica __pam_log(LOG_AUTH | LOG_ERR,
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica "pam_tsol_account: illegal option %s", argv[i]);
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica }
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica }
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica /* Trusted Extensions not enabled */
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica if (!is_system_labeled())
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica return (PAM_IGNORE);
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica (void) pam_get_item(pamh, PAM_USER, (void **)&user);
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica (void) pam_get_item(pamh, PAM_RHOST, (void **)&rhost);
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica if (debug) {
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica __pam_log(LOG_AUTH | LOG_DEBUG,
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica "pam_tsol_account: allowed_unlabeled = %d, user %s, "
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica "rhost %s",
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica allow_unlabeled,
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica (user == NULL) ? "NULL" : (user == '\0') ? "ZERO" :
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica user,
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica (rhost == NULL) ? "NULL" : (rhost == '\0') ? "ZERO" :
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica rhost);
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica }
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica if (user == NULL || *user == '\0') {
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica __pam_log(LOG_AUTH | LOG_ERR,
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica "pam_tsol_account: no user");
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica return (PAM_USER_UNKNOWN);
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica }
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica if ((range = getuserrange(user)) == NULL) {
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica __pam_log(LOG_AUTH | LOG_ERR,
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica "pam_tsol_account: getuserrange(%s) failure", user);
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica return (PAM_SYSTEM_ERR);
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica }
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica if ((plabel = m_label_alloc(MAC_LABEL)) == NULL) {
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica __pam_log(LOG_AUTH | LOG_ERR,
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica "pam_tsol_account: out of memory");
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica free_labels(range, NULL);
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica return (PAM_BUF_ERR);
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica }
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica if (getplabel(plabel) < 0) {
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica __pam_log(LOG_AUTH | LOG_CRIT,
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica "pam_tsol_account: Unable to get process label %m");
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica free_labels(range, plabel);
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica return (PAM_SYSTEM_ERR);
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica }
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica if (!blinrange(plabel, range)) {
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica free_labels(range, plabel);
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica return (PAM_PERM_DENIED);
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica }
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica free_labels(range, plabel);
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica /* Remote Host Type Policy Check */
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica if ((allow_unlabeled == 0) &&
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica (getzoneid() == GLOBAL_ZONEID) &&
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica (rhost != NULL && *rhost != '\0')) {
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica tsol_host_type_t host_type;
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica host_type = tsol_getrhtype(rhost);
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica switch (host_type) {
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica case SUN_CIPSO:
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica break;
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica case UNLABELED:
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica default:
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica return (PAM_PERM_DENIED);
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica }
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica }
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica return (PAM_SUCCESS);
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica}