pam_vbox.c revision ef2e81aab6712f2f5c7f01cbae89dd664c8d769c
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync * pam_vbox - PAM module for auto logons.
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync * Copyright (C) 2008-2010 Oracle Corporation
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync * This file is part of VirtualBox Open Source Edition (OSE), as
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync * available from http://www.virtualbox.org. This file is free software;
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync * you can redistribute it and/or modify it under the terms of the GNU
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync * General Public License (GPL) as published by the Free Software
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync * Foundation, in version 2 as it comes in the "COPYING" file of the
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync/*******************************************************************************
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync* Header Files *
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync*******************************************************************************/
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync# define PAM_EXTERN extern
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync/** For debugging. */
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync static int g_verbosity = 0;
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync * Write to system log.
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync * @param pszBuf Buffer to write to the log (NULL-terminated)
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync * Displays an error message.
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync * @param pszFormat The message text.
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync * @param ... Format arguments.
4328e87247f4a96449677e199c7e99ef516fc1cevboxsyncstatic void pam_vbox_error(pam_handle_t *h, const char *pszFormat, ...)
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync /** @todo is this NULL terminated? */
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync if (RT_SUCCESS(RTStrAPrintfV(&buf, pszFormat, va)))
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync * Displays a debug message.
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync * @param pszFormat The message text.
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync * @param ... Format arguments.
4328e87247f4a96449677e199c7e99ef516fc1cevboxsyncstatic void pam_vbox_log(pam_handle_t *h, const char *pszFormat, ...)
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync /** @todo is this NULL terminated? */
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync if (RT_SUCCESS(RTStrAPrintfV(&buf, pszFormat, va)))
6e12ccc60ac657fb87e27b7a2b26e0a63bebe024vboxsync /* Only do normal logging in debug mode; could contain
6e12ccc60ac657fb87e27b7a2b26e0a63bebe024vboxsync * sensitive data! */
6e12ccc60ac657fb87e27b7a2b26e0a63bebe024vboxsync /* Log to syslog */
6e12ccc60ac657fb87e27b7a2b26e0a63bebe024vboxsync g_pam_handle = h; /* hack for getting assertion text */
6e12ccc60ac657fb87e27b7a2b26e0a63bebe024vboxsync /* Don't make assertions panic because the PAM stack +
6e12ccc60ac657fb87e27b7a2b26e0a63bebe024vboxsync * the current logon module won't work anymore (or just restart).
6e12ccc60ac657fb87e27b7a2b26e0a63bebe024vboxsync * This could result in not able to log into the system anymore. */
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync pam_vbox_error(h, "pam_vbox_do_check: could not init runtime! rc=%Rrc. Aborting.\n", rc);
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync return PAM_SUCCESS; /* Jump out as early as we can to not mess around. */
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync pam_vbox_log(h, "pam_vbox_do_check: runtime initialized.\n");
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync pam_vbox_error(h, "pam_vbox_do_check: access is denied to guest driver! Please make sure you run with sufficient rights. Aborting.\n");
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync pam_vbox_error(h, "pam_vbox_do_check: guest driver not found! Guest Additions installed? Aborting.\n");
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync pam_vbox_error(h, "pam_vbox_do_check: could not init VbglR3 library! rc=%Rrc. Aborting.\n", rc);
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync return PAM_SUCCESS; /* Jump out as early as we can to not mess around. */
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync pam_vbox_log(h, "pam_vbox_do_check: guest lib initialized.\n");
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync int pamrc = PAM_OPEN_ERR; /* The PAM return code; intentionally not used as an exit value below. */
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync pam_get_item(h, PAM_USER_PROMPT, (void**) &prompt);
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync pam_get_item(h, PAM_USER_PROMPT, (const void**) &prompt);
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync pam_vbox_log(h, "pam_vbox_do_check: rhost=%s, tty=%s, prompt=%s\n",
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync rhost ? rhost : "<none>", tty ? tty : "<none>", prompt ? prompt : "<none>");
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync pam_vbox_log(h, "pam_vbox_do_check: no credentials available.\n");
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync pam_vbox_error(h, "pam_vbox_do_check: could not query for credentials! rc=%Rrc. Aborting.\n", rc);
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync rc = VbglR3CredentialsRetrieve(&pszUsername, &pszPassword, &pszDomain);
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync pam_vbox_error(h, "pam_vbox_do_check: could not retrieve credentials! rc=%Rrc. Aborting.\n", rc);
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync pam_vbox_log(h, "pam_vbox_do_check: credentials retrieved: user=%s, password=%s, domain=%s\n",
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync /* Fill credentials into PAM. */
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync pam_vbox_error(h, "pam_vbox_do_check: could not set user name! pamrc=%d. Aborting.\n", pamrc);
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync pam_vbox_error(h, "pam_vbox_do_check: could not set password! pamrc=%d. Aborting.\n", pamrc);
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync /** @todo Add handling domains as well. */
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync VbglR3CredentialsDestroy(pszUsername, pszPassword, pszDomain,
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync } /* VbglR3 init okay */
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync#if 0 /** @todo implement RTR3Term, or create some hack to force anything containing RTR3Init to stay loaded. */
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync pam_vbox_log(h, "pam_vbox_do_check: returned with pamrc=%d, msg=%s\n",
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync /* Never report an error here because if no credentials from the host are available or something
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync * went wrong we then let do the authentication by the next module in the stack. */
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync /* We report success here because this is all we can do right now -- we passed the credentials
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync * to the next PAM module in the block above which then might do a shadow (like pam_unix/pam_unix2)
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync * password verification to "really" authenticate the user. */
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync * Performs authentication within the PAM framework.
4328e87247f4a96449677e199c7e99ef516fc1cevboxsyncPAM_EXTERN int pam_sm_authenticate(pam_handle_t *h, int flags,
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync /* Parse arguments. */
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync for (int i=0; i<argc; i++)
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync pam_vbox_error(h, "pam_sm_authenticate: unknown command line argument \"%s\"\n", argv[i]);
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync pam_vbox_log(h, "pam_vbox_authenticate called.\n");
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync /* Do the actual check. */
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync * Modifies / deletes user credentials
4328e87247f4a96449677e199c7e99ef516fc1cevboxsyncPAM_EXTERN int pam_sm_setcred(pam_handle_t *h, int flags, int argc, const char **argv)
4328e87247f4a96449677e199c7e99ef516fc1cevboxsyncPAM_EXTERN int pam_sm_acct_mgmt(pam_handle_t *h, int flags, int argc, const char **argv)
4328e87247f4a96449677e199c7e99ef516fc1cevboxsyncPAM_EXTERN int pam_sm_open_session(pam_handle_t *h, int flags, int argc, const char **argv)
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync pam_vbox_log(h, "pam_vbox_open_session called.\n");
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync RTPrintf("This session was provided by VirtualBox Guest Additions. Have a lot of fun!\n");
4328e87247f4a96449677e199c7e99ef516fc1cevboxsyncPAM_EXTERN int pam_sm_close_session(pam_handle_t *h, int flags, int argc, const char **argv)
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync pam_vbox_log(h, "pam_vbox_close_session called.\n");
4328e87247f4a96449677e199c7e99ef516fc1cevboxsyncPAM_EXTERN int pam_sm_chauthtok(pam_handle_t *h, int flags, int argc, const char **argv)
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync pam_vbox_log(h, "pam_vbox_sm_chauthtok called.\n");
4328e87247f4a96449677e199c7e99ef516fc1cevboxsyncDECLEXPORT(void) RTAssertMsg1Weak(const char *pszExpr, unsigned uLine, const char *pszFile, const char *pszFunction)
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync "\n!!Assertion Failed!!\n"
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync "Expression: %s\n"
4328e87247f4a96449677e199c7e99ef516fc1cevboxsync "Location : %s(%d) %s\n",