src/pam-module.c

   1 /*-*- Mode: C; c-basic-offset: 8 -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2010 Lennart Poettering
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU General Public License as published by
  10   the Free Software Foundation; either version 2 of the License, or
  11   (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   General Public License for more details.
  17
  18   You should have received a copy of the GNU General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20 ***/
  21
  22 #include <errno.h>
  23 #include <fcntl.h>
  24 #include <sys/file.h>
  25 #include <pwd.h>
  26 #include <endian.h>
  27
  28 #include <security/pam_modules.h>
  29 #include <security/_pam_macros.h>
  30 #include <security/pam_modutil.h>
  31 #include <security/pam_ext.h>
  32 #include <security/pam_misc.h>
  33
  34 #include <libcgroup.h>
  35
  36 #include "util.h"
  37 #include "cgroup-util.h"
  38 #include "macro.h"
  39 #include "sd-daemon.h"
  40
  41 static int parse_argv(pam_handle_t *handle,
  42                       int argc, const char **argv,
  43                       bool *create_session,
  44                       bool *kill_session,
  45                       bool *kill_user) {
  46
  47         unsigned i;
  48
  49         assert(argc >= 0);
  50         assert(argc == 0 || argv);
  51
  52         for (i = 0; i < (unsigned) argc; i++) {
  53                 int k;
  54
  55                 if (startswith(argv[i], "create-session=")) {
  56                         if ((k = parse_boolean(argv[i] + 15)) < 0) {
  57                                 pam_syslog(handle, LOG_ERR, "Failed to parse create-session= argument.");
  58                                 return k;
  59                         }
  60
  61                         if (create_session)
  62                                 *create_session = k;
  63                 } else if (startswith(argv[i], "kill-session=")) {
  64                         if ((k = parse_boolean(argv[i] + 13)) < 0) {
  65                                 pam_syslog(handle, LOG_ERR, "Failed to parse kill-session= argument.");
  66                                 return k;
  67                         }
  68
  69                         if (kill_session)
  70                                 *kill_session = k;
  71
  72                 } else if (startswith(argv[i], "kill-user=")) {
  73                         if ((k = parse_boolean(argv[i] + 10)) < 0) {
  74                                 pam_syslog(handle, LOG_ERR, "Failed to parse kill-user= argument.");
  75                                 return k;
  76                         }
  77
  78                         if (kill_user)
  79                                 *kill_user = k;
  80                 } else {
  81                         pam_syslog(handle, LOG_ERR, "Unknown parameter '%s'.", argv[i]);
  82                         return -EINVAL;
  83                 }
  84         }
  85
  86         if (kill_session && *kill_session && kill_user)
  87                 *kill_user = true;
  88
  89         return 0;
  90 }
  91
  92 static int open_file_and_lock(const char *fn) {
  93         int fd;
  94
  95         assert(fn);
  96
  97         if ((fd = open(fn, O_RDWR|O_CLOEXEC|O_NOCTTY|O_NOFOLLOW|O_CREAT, 0600)) < 0)
  98                 return -errno;
  99
 100         if (flock(fd, LOCK_EX) < 0)
 101                 return -errno;
 102
 103         return fd;
 104 }
 105
 106 static uint64_t get_session_id(void) {
 107         char *s;
 108         int fd;
 109
 110         /* First attempt: let's use the session ID of the audit
 111          * system, if it is available. */
 112         if (read_one_line_file("/proc/self/sessionid", &s) >= 0) {
 113                 uint32_t u;
 114                 int r;
 115
 116                 r = safe_atou32(s, &u);
 117                 free(s);
 118
 119                 if (r >= 0 && u != (uint32_t) -1)
 120                         return (uint64_t) u;
 121         }
 122
 123         /* Second attempt, use our own counter. */
 124         if ((fd = open_file_and_lock(RUNTIME_DIR "/user/.pam-systemd-session")) >= 0) {
 125                 uint64_t counter;
 126                 ssize_t r;
 127
 128                 /* We do a bit of endianess swapping here, just to be
 129                  * sure. /var should be machine specific anyway, and
 130                  * /var/run even mounted from tmpfs, so this
 131                  * byteswapping should really not be necessary. But
 132                  * then again, you never know, so let's avoid any
 133                  * risk. */
 134
 135                 if (loop_read(fd, &counter, sizeof(counter), false) != sizeof(counter))
 136                         counter = 1;
 137                 else
 138                         counter = le64toh(counter) + 1;
 139
 140                 if (lseek(fd, 0, SEEK_SET) == 0) {
 141                         uint64_t swapped = htole64(counter);
 142
 143                         r = loop_write(fd, &swapped, sizeof(swapped), false);
 144
 145                         if (r != sizeof(swapped))
 146                                 r = -EIO;
 147                 } else
 148                         r = -errno;
 149
 150                 close_nointr_nofail(fd);
 151
 152                 if (r >= 0)
 153                         return counter;
 154         }
 155
 156         /* Last attempt, pick a random value */
 157         return (uint64_t) random_ull();
 158 }
 159 static int get_user_data(
 160                 pam_handle_t *handle,
 161                 const char **ret_username,
 162                 struct passwd **ret_pw) {
 163
 164         const char *username;
 165         struct passwd *pw;
 166         int r;
 167
 168         assert(handle);
 169         assert(ret_username);
 170         assert(ret_pw);
 171
 172         if ((r = pam_get_user(handle, &username, NULL)) != PAM_SUCCESS) {
 173                 pam_syslog(handle, LOG_ERR, "Failed to get user name.");
 174                 return r;
 175         }
 176
 177         if (!username || !*username) {
 178                 pam_syslog(handle, LOG_ERR, "User name not valid.");
 179                 return PAM_AUTH_ERR;
 180         }
 181
 182         if (!(pw = pam_modutil_getpwnam(handle, username))) {
 183                 pam_syslog(handle, LOG_ERR, "Failed to get user data.");
 184                 return PAM_USER_UNKNOWN;
 185         }
 186
 187         *ret_pw = pw;
 188         *ret_username = username;
 189
 190         return PAM_SUCCESS;
 191 }
 192
 193 static int create_user_group(pam_handle_t *handle, const char *group, struct passwd *pw, bool attach) {
 194         int r;
 195
 196         assert(handle);
 197         assert(group);
 198
 199         if (attach)
 200                 r = cg_create_and_attach("name=systemd", group, 0);
 201         else
 202                 r = cg_create("name=systemd", group);
 203
 204         if (r < 0) {
 205                 pam_syslog(handle, LOG_ERR, "Failed to create cgroup: %s", strerror(-r));
 206                 return PAM_SESSION_ERR;
 207         }
 208
 209         if ((r = cg_set_task_access("name=systemd", group, 0755, pw->pw_uid, pw->pw_gid)) < 0 ||
 210             (r = cg_set_group_access("name=systemd", group, 0755, pw->pw_uid, pw->pw_gid)) < 0) {
 211                 pam_syslog(handle, LOG_ERR, "Failed to change access modes: %s", strerror(-r));
 212                 return PAM_SESSION_ERR;
 213         }
 214
 215         return PAM_SUCCESS;
 216 }
 217
 218 _public_ PAM_EXTERN int pam_sm_open_session(
 219                 pam_handle_t *handle,
 220                 int flags,
 221                 int argc, const char **argv) {
 222
 223         const char *username = NULL;
 224         struct passwd *pw;
 225         int r;
 226         char *buf = NULL;
 227         int lock_fd = -1;
 228         bool create_session = true;
 229
 230         assert(handle);
 231
 232         pam_syslog(handle, LOG_INFO, "pam-systemd initializing");
 233
 234         if (parse_argv(handle, argc, argv, &create_session, NULL, NULL) < 0)
 235                 return PAM_SESSION_ERR;
 236
 237         /* Make this a NOP on non-systemd systems */
 238         if (sd_booted() <= 0)
 239                 return PAM_SUCCESS;
 240
 241         if ((r = cgroup_init()) != 0) {
 242                 pam_syslog(handle, LOG_ERR, "libcgroup initialization failed: %s", cgroup_strerror(r));
 243                 r = PAM_SESSION_ERR;
 244                 goto finish;
 245         }
 246
 247         if ((r = get_user_data(handle, &username, &pw)) != PAM_SUCCESS)
 248                 goto finish;
 249
 250         if (safe_mkdir(RUNTIME_DIR "/user", 0755, 0, 0) < 0) {
 251                 pam_syslog(handle, LOG_ERR, "Failed to create runtime directory: %m");
 252                 r = PAM_SYSTEM_ERR;
 253                 goto finish;
 254         }
 255
 256         if ((lock_fd = open_file_and_lock(RUNTIME_DIR "/user/.pam-systemd-lock")) < 0) {
 257                 pam_syslog(handle, LOG_ERR, "Failed to lock runtime directory: %m");
 258                 r = PAM_SYSTEM_ERR;
 259                 goto finish;
 260         }
 261
 262         /* Create /var/run/$USER */
 263         free(buf);
 264         if (asprintf(&buf, RUNTIME_DIR "/user/%s", username) < 0) {
 265                 r = PAM_BUF_ERR;
 266                 goto finish;
 267         }
 268
 269         if (safe_mkdir(buf, 0700, pw->pw_uid, pw->pw_gid) < 0) {
 270                 pam_syslog(handle, LOG_WARNING, "Failed to create runtime directory: %m");
 271                 r = PAM_SYSTEM_ERR;
 272                 goto finish;
 273         } else if ((r = pam_misc_setenv(handle, "XDG_RUNTIME_DIR", buf, 0)) != PAM_SUCCESS) {
 274                 pam_syslog(handle, LOG_ERR, "Failed to set runtime dir.");
 275                 goto finish;
 276         }
 277
 278         free(buf);
 279         buf = NULL;
 280
 281         if (create_session) {
 282                 const char *id;
 283
 284                 /* Reuse or create XDG session ID */
 285                 if (!(id = pam_getenv(handle, "XDG_SESSION_ID"))) {
 286
 287                         if (asprintf(&buf, "%llu", (unsigned long long) get_session_id()) < 0) {
 288                                 r = PAM_BUF_ERR;
 289                                 goto finish;
 290                         }
 291
 292                         if ((r = pam_misc_setenv(handle, "XDG_SESSION_ID", buf, 0)) != PAM_SUCCESS) {
 293                                 pam_syslog(handle, LOG_ERR, "Failed to set session id.");
 294                                 goto finish;
 295                         }
 296
 297                         if (!(id = pam_getenv(handle, "XDG_SESSION_ID"))) {
 298                                 pam_syslog(handle, LOG_ERR, "Failed to get session id.");
 299                                 r = PAM_SESSION_ERR;
 300                                 goto finish;
 301                         }
 302                 }
 303
 304                 r = asprintf(&buf, "/user/%s/%s", username, id);
 305         } else
 306                 r = asprintf(&buf, "/user/%s/no-session", username);
 307
 308         if (r < 0) {
 309                 r = PAM_BUF_ERR;
 310                 goto finish;
 311         }
 312
 313         if ((r = create_user_group(handle, buf, pw, true)) != PAM_SUCCESS)
 314                 goto finish;
 315
 316         r = PAM_SUCCESS;
 317
 318 finish:
 319         free(buf);
 320
 321         if (lock_fd >= 0)
 322                 close_nointr_nofail(lock_fd);
 323
 324         return r;
 325 }
 326
 327 static int session_remains(pam_handle_t *handle, const char *user_path) {
 328         struct cgroup_file_info info;
 329         int level = 0, r;
 330         void *iterator = NULL;
 331         bool remains = false;
 332
 333         zero(info);
 334
 335         r = cgroup_walk_tree_begin("name=systemd", user_path, 0, &iterator, &info, &level);
 336         while (r == 0) {
 337
 338                 if (info.type != CGROUP_FILE_TYPE_DIR)
 339                         goto next;
 340
 341                 if (streq(info.path, ""))
 342                         goto next;
 343
 344                 if (streq(info.path, "no-session"))
 345                         goto next;
 346
 347                 remains = true;
 348                 break;
 349
 350         next:
 351
 352                 r = cgroup_walk_tree_next(0, &iterator, &info, level);
 353         }
 354
 355
 356         if (remains)
 357                 r = 1;
 358         else if (r == 0 || r == ECGEOF)
 359                 r = 0;
 360         else
 361                 r = cg_translate_error(r, errno);
 362
 363         assert_se(cgroup_walk_tree_end(&iterator) == 0);
 364
 365         return r;
 366 }
 367
 368 _public_ PAM_EXTERN int pam_sm_close_session(
 369                 pam_handle_t *handle,
 370                 int flags,
 371                 int argc, const char **argv) {
 372
 373         const char *username = NULL;
 374         bool kill_session = false;
 375         bool kill_user = false;
 376         int lock_fd = -1, r;
 377         char *session_path = NULL, *nosession_path = NULL, *user_path = NULL;
 378         const char *id;
 379         struct passwd *pw;
 380
 381         assert(handle);
 382
 383         if (parse_argv(handle, argc, argv, NULL, &kill_session, &kill_user) < 0)
 384                 return PAM_SESSION_ERR;
 385
 386         /* Make this a NOP on non-systemd systems */
 387         if (sd_booted() <= 0)
 388                 return PAM_SUCCESS;
 389
 390         if ((r = get_user_data(handle, &username, &pw)) != PAM_SUCCESS)
 391                 goto finish;
 392
 393         if ((lock_fd = open_file_and_lock(RUNTIME_DIR "/user/.pam-systemd-lock")) < 0) {
 394                 pam_syslog(handle, LOG_ERR, "Failed to lock runtime directory: %m");
 395                 r = PAM_SYSTEM_ERR;
 396                 goto finish;
 397         }
 398
 399         if (asprintf(&user_path, "/user/%s", username) < 0) {
 400                 r = PAM_BUF_ERR;
 401                 goto finish;
 402         }
 403
 404         if ((id = pam_getenv(handle, "XDG_SESSION_ID"))) {
 405
 406                 if (asprintf(&session_path, "/user/%s/%s", username, id) < 0 ||
 407                     asprintf(&nosession_path, "/user/%s/no-session", username) < 0) {
 408                         r = PAM_BUF_ERR;
 409                         goto finish;
 410                 }
 411
 412                 if (kill_session)  {
 413                         /* Kill processes in session cgroup */
 414                         if ((r = cg_kill_recursive_and_wait("name=systemd", session_path)) < 0)
 415                                 pam_syslog(handle, LOG_ERR, "Failed to kill session cgroup: %s", strerror(-r));
 416
 417                 } else  {
 418                         /* Migrate processes from session to
 419                          * no-session cgroup. First, try to create the
 420                          * no-session group in case it doesn't exist
 421                          * yet. */
 422                         create_user_group(handle, nosession_path, pw, 0);
 423
 424                         if ((r = cg_migrate_recursive("name=systemd", session_path, nosession_path, false)) < 0)
 425                                 pam_syslog(handle, LOG_ERR, "Failed to migrate session cgroup: %s", strerror(-r));
 426                 }
 427
 428                 /* Delete session cgroup */
 429                 if (r < 0)
 430                         pam_syslog(handle, LOG_INFO, "Couldn't empty session cgroup, not deleting.");
 431                 else {
 432                         if ((r = cg_delete("name=systemd", session_path)) < 0)
 433                                 pam_syslog(handle, LOG_ERR, "Failed to delete session cgroup: %s", strerror(-r));
 434                 }
 435         }
 436
 437         /* GC user tree */
 438         cg_trim("name=systemd", user_path, false);
 439
 440         if ((r = session_remains(handle, user_path)) < 0)
 441                 pam_syslog(handle, LOG_ERR, "Failed to determine whether a session remains: %s", strerror(-r));
 442
 443         /* Kill user processes not attached to any session */
 444         if (kill_user && r == 0) {
 445
 446                 /* Kill no-session cgroup */
 447                 if ((r = cg_kill_recursive_and_wait("name=systemd", user_path)) < 0)
 448                         pam_syslog(handle, LOG_ERR, "Failed to kill user cgroup: %s", strerror(-r));
 449         } else {
 450
 451                 if ((r = cg_is_empty_recursive("name=systemd", user_path, true)) < 0)
 452                         pam_syslog(handle, LOG_ERR, "Failed to check user cgroup: %s", strerror(-r));
 453
 454                 /* If we managed to kill somebody, don't cleanup the cgroup. */
 455                 if (r == 0)
 456                         r = -EBUSY;
 457         }
 458
 459         if (r >= 0) {
 460                 const char *runtime_dir;
 461
 462                 /* Remove user cgroup */
 463                 if ((r = cg_delete("name=systemd", user_path)) < 0)
 464                         pam_syslog(handle, LOG_ERR, "Failed to delete user cgroup: %s", strerror(-r));
 465
 466                 /* This will migrate us to the /user cgroup. */
 467
 468                 if ((runtime_dir = pam_getenv(handle, "XDG_RUNTIME_DIR")))
 469                         if ((r = rm_rf(runtime_dir, false, true)) < 0)
 470                                 pam_syslog(handle, LOG_ERR, "Failed to remove runtime directory: %s", strerror(-r));
 471         }
 472
 473         r = PAM_SUCCESS;
 474
 475 finish:
 476         if (lock_fd >= 0)
 477                 close_nointr_nofail(lock_fd);
 478
 479         free(session_path);
 480         free(nosession_path);
 481         free(user_path);
 482
 483         return r;
 484 }