X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=src%2Flogin%2Fpam-module.c;h=45428a090f40e767bbd500350cc20f50efeab309;hb=d9e34bfda3d34dcde00a876cb052e7de0655e1cb;hp=3b6b163a47fdd026e2c0140397dc7c4dde389106;hpb=05a049cc44d1c7eadfab104eea15b13f0207ab40;p=elogind.git diff --git a/src/login/pam-module.c b/src/login/pam-module.c index 3b6b163a4..45428a090 100644 --- a/src/login/pam-module.c +++ b/src/login/pam-module.c @@ -36,15 +36,17 @@ #include "audit.h" #include "macro.h" #include "strv.h" -#include "dbus-common.h" +#include "bus-util.h" #include "def.h" #include "socket-util.h" #include "fileio.h" +#include "bus-error.h" -static int parse_argv(pam_handle_t *handle, - int argc, const char **argv, - const char **class, - bool *debug) { +static int parse_argv( + pam_handle_t *handle, + int argc, const char **argv, + const char **class, + bool *debug) { unsigned i; @@ -82,31 +84,24 @@ static int get_user_data( const char *username = NULL; struct passwd *pw = NULL; - uid_t uid; int r; assert(handle); assert(ret_username); assert(ret_pw); - r = audit_loginuid_from_pid(0, &uid); - if (r >= 0) - pw = pam_modutil_getpwuid(handle, uid); - else { - r = pam_get_user(handle, &username, NULL); - if (r != PAM_SUCCESS) { - pam_syslog(handle, LOG_ERR, "Failed to get user name."); - return r; - } - - if (isempty(username)) { - pam_syslog(handle, LOG_ERR, "User name not valid."); - return PAM_AUTH_ERR; - } + r = pam_get_user(handle, &username, NULL); + if (r != PAM_SUCCESS) { + pam_syslog(handle, LOG_ERR, "Failed to get user name."); + return r; + } - pw = pam_modutil_getpwnam(handle, username); + if (isempty(username)) { + pam_syslog(handle, LOG_ERR, "User name not valid."); + return PAM_AUTH_ERR; } + pw = pam_modutil_getpwnam(handle, username); if (!pw) { pam_syslog(handle, LOG_ERR, "Failed to get user data."); return PAM_USER_UNKNOWN; @@ -119,16 +114,14 @@ static int get_user_data( } static int get_seat_from_display(const char *display, const char **seat, uint32_t *vtnr) { - _cleanup_free_ char *p = NULL; - int r; - _cleanup_close_ int fd = -1; union sockaddr_union sa = { .un.sun_family = AF_UNIX, }; + _cleanup_free_ char *p = NULL, *tty = NULL; + _cleanup_close_ int fd = -1; struct ucred ucred; socklen_t l; - _cleanup_free_ char *tty = NULL; - int v; + int v, r; assert(display); assert(vtnr); @@ -178,26 +171,25 @@ _public_ PAM_EXTERN int pam_sm_open_session( int flags, int argc, const char **argv) { + _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL; + _cleanup_bus_message_unref_ sd_bus_message *reply = NULL; + const char + *username, *id, *object_path, *runtime_path, + *service = NULL, + *tty = NULL, *display = NULL, + *remote_user = NULL, *remote_host = NULL, + *seat = NULL, + *type = NULL, *class = NULL, + *class_pam = NULL, *cvtnr = NULL; + _cleanup_bus_unref_ sd_bus *bus = NULL; + int session_fd = -1, existing, r; + bool debug = false, remote; struct passwd *pw; - bool debug = false; - const char *username, *id, *object_path, *runtime_path, *service = NULL, *tty = NULL, *display = NULL, *remote_user = NULL, *remote_host = NULL, *seat = NULL, *type = NULL, *class = NULL, *class_pam = NULL, *cvtnr = NULL; - DBusError error; - uint32_t uid, pid; - DBusMessageIter iter, sub; - int session_fd = -1; - DBusConnection *bus = NULL; - DBusMessage *m = NULL, *reply = NULL; - dbus_bool_t remote, existing; - int r; uint32_t vtnr = 0; + uid_t original_uid; assert(handle); - dbus_error_init(&error); - - if (debug) - pam_syslog(handle, LOG_INFO, "pam-systemd initializing"); - /* Make this a NOP on non-logind systems */ if (!logind_running()) return PAM_SUCCESS; @@ -205,14 +197,17 @@ _public_ PAM_EXTERN int pam_sm_open_session( if (parse_argv(handle, argc, argv, &class_pam, - &debug) < 0) { - r = PAM_SESSION_ERR; - goto finish; - } + &debug) < 0) + return PAM_SESSION_ERR; + + if (debug) + pam_syslog(handle, LOG_INFO, "pam-systemd initializing"); r = get_user_data(handle, &username, &pw); - if (r != PAM_SUCCESS) - goto finish; + if (r != PAM_SUCCESS) { + pam_syslog(handle, LOG_ERR, "Failed to get user data."); + return r; + } /* Make sure we don't enter a loop by talking to * systemd-logind when it is actually waiting for the @@ -224,53 +219,27 @@ _public_ PAM_EXTERN int pam_sm_open_session( if (streq_ptr(service, "systemd-user")) { _cleanup_free_ char *p = NULL, *rt = NULL; - if (asprintf(&p, "/run/systemd/users/%lu", (unsigned long) pw->pw_uid) < 0) { - r = PAM_BUF_ERR; - goto finish; - } + if (asprintf(&p, "/run/systemd/users/%lu", (unsigned long) pw->pw_uid) < 0) + return PAM_BUF_ERR; r = parse_env_file(p, NEWLINE, "RUNTIME", &rt, NULL); - if (r < 0 && r != -ENOENT) { - r = PAM_SESSION_ERR; - goto finish; - } + if (r < 0 && r != -ENOENT) + return PAM_SESSION_ERR; if (rt) { r = pam_misc_setenv(handle, "XDG_RUNTIME_DIR", rt, 0); if (r != PAM_SUCCESS) { pam_syslog(handle, LOG_ERR, "Failed to set runtime dir."); - goto finish; + return r; } } - r = PAM_SUCCESS; - goto finish; - } - - dbus_connection_set_change_sigpipe(FALSE); - - bus = dbus_bus_get_private(DBUS_BUS_SYSTEM, &error); - if (!bus) { - pam_syslog(handle, LOG_ERR, "Failed to connect to system bus: %s", bus_error_message(&error)); - r = PAM_SESSION_ERR; - goto finish; - } - - m = dbus_message_new_method_call( - "org.freedesktop.login1", - "/org/freedesktop/login1", - "org.freedesktop.login1.Manager", - "CreateSession"); - if (!m) { - pam_syslog(handle, LOG_ERR, "Could not allocate create session message."); - r = PAM_BUF_ERR; - goto finish; + return PAM_SUCCESS; } - uid = pw->pw_uid; - pid = getpid(); + /* Otherwise, we ask logind to create a session for us */ pam_get_item(handle, PAM_XDISPLAY, (const void**) &display); pam_get_item(handle, PAM_TTY, (const void**) &tty); @@ -285,12 +254,8 @@ _public_ PAM_EXTERN int pam_sm_open_session( if (isempty(cvtnr)) cvtnr = getenv("XDG_VTNR"); - service = strempty(service); tty = strempty(tty); display = strempty(display); - remote_user = strempty(remote_user); - remote_host = strempty(remote_host); - seat = strempty(seat); if (strchr(tty, ':')) { /* A tty with a colon is usually an X11 display, @@ -319,7 +284,7 @@ _public_ PAM_EXTERN int pam_sm_open_session( if (!isempty(cvtnr)) safe_atou32(cvtnr, &vtnr); - if (!isempty(display) && vtnr <= 0) { + if (!isempty(display) && !vtnr) { if (isempty(seat)) get_seat_from_display(display, &seat, &vtnr); else if (streq(seat, "seat0")) @@ -339,97 +304,108 @@ _public_ PAM_EXTERN int pam_sm_open_session( class = streq(type, "unspecified") ? "background" : "user"; remote = !isempty(remote_host) && - !streq(remote_host, "localhost") && - !streq(remote_host, "localhost.localdomain"); - - if (!dbus_message_append_args(m, - DBUS_TYPE_UINT32, &uid, - DBUS_TYPE_UINT32, &pid, - DBUS_TYPE_STRING, &service, - DBUS_TYPE_STRING, &type, - DBUS_TYPE_STRING, &class, - DBUS_TYPE_STRING, &seat, - DBUS_TYPE_UINT32, &vtnr, - DBUS_TYPE_STRING, &tty, - DBUS_TYPE_STRING, &display, - DBUS_TYPE_BOOLEAN, &remote, - DBUS_TYPE_STRING, &remote_user, - DBUS_TYPE_STRING, &remote_host, - DBUS_TYPE_INVALID)) { - pam_syslog(handle, LOG_ERR, "Could not attach parameters to message."); - r = PAM_BUF_ERR; - goto finish; - } + !streq_ptr(remote_host, "localhost") && + !streq_ptr(remote_host, "localhost.localdomain"); - dbus_message_iter_init_append(m, &iter); + /* Talk to logind over the message bus */ - if (!dbus_message_iter_open_container(&iter, DBUS_TYPE_ARRAY, "(sv)", &sub) || - !dbus_message_iter_close_container(&iter, &sub)) { - pam_syslog(handle, LOG_ERR, "Could not attach parameters to message."); - r = PAM_BUF_ERR; - goto finish; + r = sd_bus_open_system(&bus); + if (r < 0) { + pam_syslog(handle, LOG_ERR, "Failed to connect to system bus: %s", strerror(-r)); + return PAM_SESSION_ERR; } if (debug) pam_syslog(handle, LOG_DEBUG, "Asking logind to create session: " "uid=%u pid=%u service=%s type=%s class=%s seat=%s vtnr=%u tty=%s display=%s remote=%s remote_user=%s remote_host=%s", - uid, pid, service, type, class, seat, vtnr, tty, display, yes_no(remote), remote_user, remote_host); - - reply = dbus_connection_send_with_reply_and_block(bus, m, -1, &error); - if (!reply) { - pam_syslog(handle, LOG_ERR, "Failed to create session: %s", bus_error_message(&error)); - r = PAM_SESSION_ERR; - goto finish; + pw->pw_uid, getpid(), + strempty(service), + type, class, + strempty(seat), vtnr, tty, strempty(display), + yes_no(remote), strempty(remote_user), strempty(remote_host)); + + r = sd_bus_call_method(bus, + "org.freedesktop.login1", + "/org/freedesktop/login1", + "org.freedesktop.login1.Manager", + "CreateSession", + &error, + &reply, + "uussssussbssa(sv)", + (uint32_t) pw->pw_uid, + (uint32_t) getpid(), + strempty(service), + type, + class, + strempty(seat), + vtnr, + tty, + strempty(display), + remote, + strempty(remote_user), + strempty(remote_host), + 0); + if (r < 0) { + pam_syslog(handle, LOG_ERR, "Failed to create session: %s", bus_error_message(&error, r)); + return PAM_SYSTEM_ERR; } - if (!dbus_message_get_args(reply, &error, - DBUS_TYPE_STRING, &id, - DBUS_TYPE_OBJECT_PATH, &object_path, - DBUS_TYPE_STRING, &runtime_path, - DBUS_TYPE_UNIX_FD, &session_fd, - DBUS_TYPE_STRING, &seat, - DBUS_TYPE_UINT32, &vtnr, - DBUS_TYPE_BOOLEAN, &existing, - DBUS_TYPE_INVALID)) { - pam_syslog(handle, LOG_ERR, "Failed to parse message: %s", bus_error_message(&error)); - r = PAM_SESSION_ERR; - goto finish; + r = sd_bus_message_read(reply, + "soshusub", + &id, + &object_path, + &runtime_path, + &session_fd, + &original_uid, + &seat, + &vtnr, + &existing); + if (r < 0) { + pam_syslog(handle, LOG_ERR, "Failed to parse message: %s", strerror(-r)); + return PAM_SESSION_ERR; } if (debug) pam_syslog(handle, LOG_DEBUG, "Reply from logind: " - "id=%s object_path=%s runtime_path=%s session_fd=%d seat=%s vtnr=%u", - id, object_path, runtime_path, session_fd, seat, vtnr); + "id=%s object_path=%s runtime_path=%s session_fd=%d seat=%s vtnr=%u original_uid=%u", + id, object_path, runtime_path, session_fd, seat, vtnr, original_uid); r = pam_misc_setenv(handle, "XDG_SESSION_ID", id, 0); if (r != PAM_SUCCESS) { pam_syslog(handle, LOG_ERR, "Failed to set session id."); - goto finish; + return r; } - r = pam_misc_setenv(handle, "XDG_RUNTIME_DIR", runtime_path, 0); - if (r != PAM_SUCCESS) { - pam_syslog(handle, LOG_ERR, "Failed to set runtime dir."); - goto finish; + if (original_uid == pw->pw_uid) { + /* Don't set $XDG_RUNTIME_DIR if the user we now + * authenticated for does not match the original user + * of the session. We do this in order not to result + * in privileged apps clobbering the runtime directory + * unnecessarily. */ + + r = pam_misc_setenv(handle, "XDG_RUNTIME_DIR", runtime_path, 0); + if (r != PAM_SUCCESS) { + pam_syslog(handle, LOG_ERR, "Failed to set runtime dir."); + return r; + } } if (!isempty(seat)) { r = pam_misc_setenv(handle, "XDG_SEAT", seat, 0); if (r != PAM_SUCCESS) { pam_syslog(handle, LOG_ERR, "Failed to set seat."); - goto finish; + return r; } } if (vtnr > 0) { - char buf[11]; - snprintf(buf, sizeof(buf), "%u", vtnr); - char_array_0(buf); + char buf[DECIMAL_STR_MAX(vtnr)]; + sprintf(buf, "%u", vtnr); r = pam_misc_setenv(handle, "XDG_VTNR", buf, 0); if (r != PAM_SUCCESS) { pam_syslog(handle, LOG_ERR, "Failed to set virtual terminal number."); - goto finish; + return r; } } @@ -440,35 +416,21 @@ _public_ PAM_EXTERN int pam_sm_open_session( } if (session_fd >= 0) { + session_fd = dup(session_fd); + if (session_fd < 0) { + pam_syslog(handle, LOG_ERR, "Failed to dup session fd: %m"); + return PAM_SESSION_ERR; + } + r = pam_set_data(handle, "systemd.session-fd", INT_TO_PTR(session_fd+1), NULL); if (r != PAM_SUCCESS) { pam_syslog(handle, LOG_ERR, "Failed to install session fd."); + close_nointr_nofail(session_fd); return r; } } - session_fd = -1; - - r = PAM_SUCCESS; - -finish: - dbus_error_free(&error); - - if (bus) { - dbus_connection_close(bus); - dbus_connection_unref(bus); - } - - if (m) - dbus_message_unref(m); - - if (reply) - dbus_message_unref(reply); - - if (session_fd >= 0) - close_nointr_nofail(session_fd); - - return r; + return PAM_SUCCESS; } _public_ PAM_EXTERN int pam_sm_close_session( @@ -476,17 +438,14 @@ _public_ PAM_EXTERN int pam_sm_close_session( int flags, int argc, const char **argv) { + _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL; + _cleanup_bus_unref_ sd_bus *bus = NULL; const void *p = NULL, *existing = NULL; const char *id; - DBusConnection *bus = NULL; - DBusMessage *m = NULL, *reply = NULL; - DBusError error; int r; assert(handle); - dbus_error_init(&error); - /* Only release session if it wasn't pre-existing when we * tried to create it */ pam_get_data(handle, "systemd.existing", &existing); @@ -499,35 +458,27 @@ _public_ PAM_EXTERN int pam_sm_close_session( * that it doesn't just go and slaughter us * immediately after closing the fd */ - bus = dbus_bus_get_private(DBUS_BUS_SYSTEM, &error); - if (!bus) { - pam_syslog(handle, LOG_ERR, "Failed to connect to system bus: %s", bus_error_message(&error)); + r = sd_bus_open_system(&bus); + if (r < 0) { + pam_syslog(handle, LOG_ERR, + "Failed to connect to system bus: %s", strerror(-r)); r = PAM_SESSION_ERR; goto finish; } - m = dbus_message_new_method_call( - "org.freedesktop.login1", - "/org/freedesktop/login1", - "org.freedesktop.login1.Manager", - "ReleaseSession"); - if (!m) { - pam_syslog(handle, LOG_ERR, "Could not allocate release session message."); - r = PAM_BUF_ERR; - goto finish; - } - - if (!dbus_message_append_args(m, - DBUS_TYPE_STRING, &id, - DBUS_TYPE_INVALID)) { - pam_syslog(handle, LOG_ERR, "Could not attach parameters to message."); - r = PAM_BUF_ERR; - goto finish; - } + r = sd_bus_call_method(bus, + "org.freedesktop.login1", + "/org/freedesktop/login1", + "org.freedesktop.login1.Manager", + "ReleaseSession", + &error, + NULL, + "s", + id); + if (r < 0) { + pam_syslog(handle, LOG_ERR, + "Failed to release session: %s", bus_error_message(&error, r)); - reply = dbus_connection_send_with_reply_and_block(bus, m, -1, &error); - if (!reply) { - pam_syslog(handle, LOG_ERR, "Failed to release session: %s", bus_error_message(&error)); r = PAM_SESSION_ERR; goto finish; } @@ -540,18 +491,5 @@ finish: if (p) close_nointr(PTR_TO_INT(p) - 1); - dbus_error_free(&error); - - if (bus) { - dbus_connection_close(bus); - dbus_connection_unref(bus); - } - - if (m) - dbus_message_unref(m); - - if (reply) - dbus_message_unref(reply); - return r; }