2N/A/*
2N/A * CDDL HEADER START
2N/A *
2N/A * The contents of this file are subject to the terms of the
2N/A * Common Development and Distribution License (the "License").
2N/A * You may not use this file except in compliance with the License.
2N/A *
2N/A * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
2N/A * or http://www.opensolaris.org/os/licensing.
2N/A * See the License for the specific language governing permissions
2N/A * and limitations under the License.
2N/A *
2N/A * When distributing Covered Code, include this CDDL HEADER in each
2N/A * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
2N/A * If applicable, add the following below this CDDL HEADER, with the
2N/A * fields enclosed by brackets "[]" replaced with your own identifying
2N/A * information: Portions Copyright [yyyy] [name of copyright owner]
2N/A *
2N/A * CDDL HEADER END
2N/A */
2N/A/*
2N/A * Copyright (c) 1999, 2010, Oracle and/or its affiliates. All rights reserved.
2N/A */
2N/A
2N/A#include <syslog.h>
2N/A#include <pwd.h>
2N/A#include <unistd.h>
2N/A#include <strings.h>
2N/A#include <security/pam_appl.h>
2N/A#include <security/pam_modules.h>
2N/A#include <libintl.h>
2N/A#include <pwd.h>
2N/A#include <user_attr.h>
2N/A#include <secdb.h>
2N/A#include <nss_dbdefs.h>
2N/A#include <security/pam_impl.h>
2N/A
2N/Astatic int roleinlist();
2N/A
2N/A/*
2N/A * pam_sm_acct_mgmt():
2N/A * Account management module
2N/A * This module disallows roles for primary logins and adds special
2N/A * checks to allow roles for secondary logins.
2N/A */
2N/A
2N/A/*ARGSUSED*/
2N/Aint
2N/Apam_sm_acct_mgmt(pam_handle_t *pamh, int flags, int argc, const char **argv)
2N/A{
2N/A uid_t uid;
2N/A userattr_t *user_entry;
2N/A char *kva_value;
2N/A char *username;
2N/A char *auser;
2N/A char *rhost;
2N/A char messages[PAM_MAX_NUM_MSG][PAM_MAX_MSG_SIZE];
2N/A struct passwd *pw_entry, pwd;
2N/A char buf[NSS_BUFLEN_PASSWD];
2N/A
2N/A int i;
2N/A int debug = 0;
2N/A int allow_remote = 0;
2N/A
2N/A (void) pam_get_item(pamh, PAM_USER, (void **)&username);
2N/A (void) pam_get_item(pamh, PAM_AUSER, (void **)&auser);
2N/A (void) pam_get_item(pamh, PAM_RHOST, (void **)&rhost);
2N/A
2N/A for (i = 0; i < argc; i++) {
2N/A if (strcmp(argv[i], "allow_remote") == 0) {
2N/A allow_remote = 1;
2N/A } else if (strcmp(argv[i], "debug") == 0) {
2N/A debug = 1;
2N/A } else {
2N/A __pam_log(LOG_AUTH | LOG_ERR,
2N/A "pam_roles:pam_sm_acct_mgmt: illegal module "
2N/A "option %s", argv[i]);
2N/A }
2N/A }
2N/A
2N/A if (debug) {
2N/A char *ruser;
2N/A char *service;
2N/A
2N/A (void) pam_get_item(pamh, PAM_RUSER, (void **)&ruser);
2N/A (void) pam_get_item(pamh, PAM_SERVICE, (void **)&service);
2N/A __pam_log(LOG_AUTH | LOG_DEBUG, "pam_roles:pam_sm_acct_mgmt: "
2N/A "service = %s, allow_remote = %d, user = %s auser = %s "
2N/A "ruser = %s rhost = %s\n", (service) ? service : "not set",
2N/A allow_remote, (username) ? username : "not set",
2N/A (auser) ? auser: "not set", (ruser) ? ruser: "not set",
2N/A (rhost) ? rhost: "not set");
2N/A }
2N/A
2N/A if (username == NULL)
2N/A return (PAM_USER_UNKNOWN);
2N/A
2N/A /* stop masquerades by mapping username to uid to username */
2N/A
2N/A if ((pw_entry = getpwnam_r(username, &pwd, buf, sizeof (buf))) == NULL)
2N/A return (PAM_USER_UNKNOWN);
2N/A if ((pw_entry = getpwuid_r(pw_entry->pw_uid, &pwd, buf,
2N/A sizeof (buf))) == NULL)
2N/A return (PAM_USER_UNKNOWN);
2N/A /*
2N/A * If there's no user_attr entry for the primary user or it's not a
2N/A * role, no further checks are needed.
2N/A */
2N/A
2N/A if (((user_entry = getusernam(pw_entry->pw_name)) == NULL) ||
2N/A ((kva_value = kva_match((kva_t *)user_entry->attr,
2N/A USERATTR_TYPE_KW)) == NULL) ||
2N/A ((strcmp(kva_value, USERATTR_TYPE_NONADMIN_KW) != 0) &&
2N/A (strcmp(kva_value, USERATTR_TYPE_ADMIN_KW) != 0))) {
2N/A free_userattr(user_entry);
2N/A return (PAM_IGNORE);
2N/A }
2N/A free_userattr(user_entry);
2N/A
2N/A /* username is a role */
2N/A
2N/A if (strcmp(username, pw_entry->pw_name) != 0) {
2N/A __pam_log(LOG_AUTH | LOG_ALERT,
2N/A "pam_roles:pam_sm_acct_mgmt: user name %s "
2N/A "maps to user id %d which is user name %s",
2N/A username, pw_entry->pw_uid, pw_entry->pw_name);
2N/A
2N/A }
2N/A
2N/A /* Who's the user requesting the role? */
2N/A
2N/A if (auser != NULL && *auser != '\0') {
2N/A /* authenticated requesting user */
2N/A
2N/A user_entry = getusernam(auser);
2N/A } else {
2N/A /* user is implied by real UID */
2N/A
2N/A if ((uid = getuid()) == 0) {
2N/A /*
2N/A * Root user_attr entry cannot have roles.
2N/A * Force error and deny access.
2N/A */
2N/A user_entry = NULL;
2N/A } else {
2N/A if ((pw_entry = getpwuid_r(uid, &pwd, buf,
2N/A sizeof (buf))) == NULL) {
2N/A return (PAM_USER_UNKNOWN);
2N/A }
2N/A user_entry = getusernam(pw_entry->pw_name);
2N/A }
2N/A }
2N/A
2N/A if ((rhost != NULL && *rhost != '\0') &&
2N/A allow_remote == 0) {
2N/A /* don't allow remote roles for this service */
2N/A
2N/A free_userattr(user_entry);
2N/A return (PAM_PERM_DENIED);
2N/A }
2N/A
2N/A /*
2N/A * If the original user does not have a user_attr entry or isn't
2N/A * assigned the role being assumed, fail.
2N/A */
2N/A
2N/A if ((user_entry == NULL) ||
2N/A ((kva_value = kva_match((kva_t *)user_entry->attr,
2N/A USERATTR_ROLES_KW)) == NULL) ||
2N/A (roleinlist(kva_value, username) == 0)) {
2N/A free_userattr(user_entry);
2N/A if (auser != NULL && *auser != '\0') {
2N/A (void) strlcpy(messages[0], dgettext(TEXT_DOMAIN,
2N/A "Roles can only be assumed by authorized users"),
2N/A sizeof (messages[0]));
2N/A } else {
2N/A (void) strlcpy(messages[0], dgettext(TEXT_DOMAIN,
2N/A "Roles can not login directly"),
2N/A sizeof (messages[0]));
2N/A }
2N/A (void) __pam_display_msg(pamh, PAM_ERROR_MSG, 1, messages,
2N/A NULL);
2N/A return (PAM_PERM_DENIED);
2N/A }
2N/A
2N/A free_userattr(user_entry);
2N/A return (PAM_IGNORE);
2N/A}
2N/A
2N/Aint
2N/Aroleinlist(char *list, char *role)
2N/A{
2N/A char *lasts = (char *)NULL;
2N/A char *rolename = (char *)strtok_r(list, ",", &lasts);
2N/A
2N/A while (rolename) {
2N/A if (strcmp(rolename, role) == 0)
2N/A return (1);
2N/A else
2N/A rolename = (char *)strtok_r(NULL, ",", &lasts);
2N/A }
2N/A return (0);
2N/A}