src/pam-module.c

   1 /*-*- Mode: C; c-basic-offset: 8 -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2010 Lennart Poettering
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU General Public License as published by
  10   the Free Software Foundation; either version 2 of the License, or
  11   (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   General Public License for more details.
  17
  18   You should have received a copy of the GNU General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20 ***/
  21
  22 #include <errno.h>
  23 #include <fcntl.h>
  24 #include <sys/file.h>
  25 #include <pwd.h>
  26 #include <endian.h>
  27
  28 #include <security/pam_modules.h>
  29 #include <security/_pam_macros.h>
  30 #include <security/pam_modutil.h>
  31 #include <security/pam_ext.h>
  32 #include <security/pam_misc.h>
  33
  34 #include <libcgroup.h>
  35
  36 #include "util.h"
  37 #include "cgroup-util.h"
  38 #include "macro.h"
  39 #include "sd-daemon.h"
  40
  41 static int parse_argv(pam_handle_t *handle,
  42                       int argc, const char **argv,
  43                       bool *create_session,
  44                       bool *kill_session,
  45                       bool *kill_user) {
  46
  47         unsigned i;
  48
  49         assert(argc >= 0);
  50         assert(argc == 0 || argv);
  51
  52         for (i = 0; i < (unsigned) argc; i++) {
  53                 int k;
  54
  55                 if (startswith(argv[i], "create-session=")) {
  56                         if ((k = parse_boolean(argv[i] + 15)) < 0) {
  57                                 pam_syslog(handle, LOG_ERR, "Failed to parse create-session= argument.");
  58                                 return k;
  59                         }
  60
  61                         if (create_session)
  62                                 *create_session = k;
  63                 } else if (startswith(argv[i], "kill-session=")) {
  64                         if ((k = parse_boolean(argv[i] + 13)) < 0) {
  65                                 pam_syslog(handle, LOG_ERR, "Failed to parse kill-session= argument.");
  66                                 return k;
  67                         }
  68
  69                         if (kill_session)
  70                                 *kill_session = k;
  71
  72                 } else if (startswith(argv[i], "kill-user=")) {
  73                         if ((k = parse_boolean(argv[i] + 10)) < 0) {
  74                                 pam_syslog(handle, LOG_ERR, "Failed to parse kill-user= argument.");
  75                                 return k;
  76                         }
  77
  78                         if (kill_user)
  79                                 *kill_user = k;
  80                 } else {
  81                         pam_syslog(handle, LOG_ERR, "Unknown parameter '%s'.", argv[i]);
  82                         return -EINVAL;
  83                 }
  84         }
  85
  86         if (kill_session && *kill_session && kill_user)
  87                 *kill_user = true;
  88
  89         return 0;
  90 }
  91
  92 static int open_file_and_lock(const char *fn) {
  93         int fd;
  94
  95         assert(fn);
  96
  97         if ((fd = open(fn, O_RDWR|O_CLOEXEC|O_NOCTTY|O_NOFOLLOW|O_CREAT, 0600)) < 0)
  98                 return -errno;
  99
 100         /* The BSD socket semantics are a lot nicer than those of
 101          * POSIX locks. Which is why we use flock() here. BSD locking
 102          * does not work across NFS which however is not needed here
 103          * as the filesystems in question should be local, and only
 104          * locally accessible, and most likely even tmpfs. */
 105
 106         if (flock(fd, LOCK_EX) < 0)
 107                 return -errno;
 108
 109         return fd;
 110 }
 111
 112 enum {
 113         SESSION_ID_AUDIT = 'a',
 114         SESSION_ID_COUNTER = 'c',
 115         SESSION_ID_RANDOM = 'r'
 116 };
 117
 118 static uint64_t get_session_id(int *mode) {
 119         char *s;
 120         int fd;
 121
 122         assert(mode);
 123
 124         /* First attempt: let's use the session ID of the audit
 125          * system, if it is available. */
 126         if (read_one_line_file("/proc/self/sessionid", &s) >= 0) {
 127                 uint32_t u;
 128                 int r;
 129
 130                 r = safe_atou32(s, &u);
 131                 free(s);
 132
 133                 if (r >= 0 && u != (uint32_t) -1) {
 134                         *mode = SESSION_ID_AUDIT;
 135                         return (uint64_t) u;
 136                 }
 137         }
 138
 139         /* Second attempt, use our own counter. */
 140         if ((fd = open_file_and_lock(RUNTIME_DIR "/user/.pam-systemd-session")) >= 0) {
 141                 uint64_t counter;
 142                 ssize_t r;
 143
 144                 /* We do a bit of endianess swapping here, just to be
 145                  * sure. /var should be machine specific anyway, and
 146                  * /var/run even mounted from tmpfs, so this
 147                  * byteswapping should really not be necessary. But
 148                  * then again, you never know, so let's avoid any
 149                  * risk. */
 150
 151                 if (loop_read(fd, &counter, sizeof(counter), false) != sizeof(counter))
 152                         counter = 1;
 153                 else
 154                         counter = le64toh(counter) + 1;
 155
 156                 if (lseek(fd, 0, SEEK_SET) == 0) {
 157                         uint64_t swapped = htole64(counter);
 158
 159                         r = loop_write(fd, &swapped, sizeof(swapped), false);
 160
 161                         if (r != sizeof(swapped))
 162                                 r = -EIO;
 163                 } else
 164                         r = -errno;
 165
 166                 close_nointr_nofail(fd);
 167
 168                 if (r >= 0) {
 169                         *mode = SESSION_ID_COUNTER;
 170                         return counter;
 171                 }
 172         }
 173
 174         *mode = SESSION_ID_RANDOM;
 175
 176         /* Last attempt, pick a random value */
 177         return (uint64_t) random_ull();
 178 }
 179 static int get_user_data(
 180                 pam_handle_t *handle,
 181                 const char **ret_username,
 182                 struct passwd **ret_pw) {
 183
 184         const char *username;
 185         struct passwd *pw;
 186         int r;
 187
 188         assert(handle);
 189         assert(ret_username);
 190         assert(ret_pw);
 191
 192         if ((r = pam_get_user(handle, &username, NULL)) != PAM_SUCCESS) {
 193                 pam_syslog(handle, LOG_ERR, "Failed to get user name.");
 194                 return r;
 195         }
 196
 197         if (!username || !*username) {
 198                 pam_syslog(handle, LOG_ERR, "User name not valid.");
 199                 return PAM_AUTH_ERR;
 200         }
 201
 202         if (!(pw = pam_modutil_getpwnam(handle, username))) {
 203                 pam_syslog(handle, LOG_ERR, "Failed to get user data.");
 204                 return PAM_USER_UNKNOWN;
 205         }
 206
 207         *ret_pw = pw;
 208         *ret_username = username;
 209
 210         return PAM_SUCCESS;
 211 }
 212
 213 static int create_user_group(pam_handle_t *handle, const char *group, struct passwd *pw, bool attach) {
 214         int r;
 215
 216         assert(handle);
 217         assert(group);
 218
 219         if (attach)
 220                 r = cg_create_and_attach(SYSTEMD_CGROUP_CONTROLLER, group, 0);
 221         else
 222                 r = cg_create(SYSTEMD_CGROUP_CONTROLLER, group);
 223
 224         if (r < 0) {
 225                 pam_syslog(handle, LOG_ERR, "Failed to create cgroup: %s", strerror(-r));
 226                 return PAM_SESSION_ERR;
 227         }
 228
 229         if ((r = cg_set_task_access(SYSTEMD_CGROUP_CONTROLLER, group, 0755, pw->pw_uid, pw->pw_gid)) < 0 ||
 230             (r = cg_set_group_access(SYSTEMD_CGROUP_CONTROLLER, group, 0755, pw->pw_uid, pw->pw_gid)) < 0) {
 231                 pam_syslog(handle, LOG_ERR, "Failed to change access modes: %s", strerror(-r));
 232                 return PAM_SESSION_ERR;
 233         }
 234
 235         return PAM_SUCCESS;
 236 }
 237
 238 _public_ PAM_EXTERN int pam_sm_open_session(
 239                 pam_handle_t *handle,
 240                 int flags,
 241                 int argc, const char **argv) {
 242
 243         const char *username = NULL;
 244         struct passwd *pw;
 245         int r;
 246         char *buf = NULL;
 247         int lock_fd = -1;
 248         bool create_session = true;
 249
 250         assert(handle);
 251
 252         pam_syslog(handle, LOG_INFO, "pam-systemd initializing");
 253
 254         if (parse_argv(handle, argc, argv, &create_session, NULL, NULL) < 0)
 255                 return PAM_SESSION_ERR;
 256
 257         /* Make this a NOP on non-systemd systems */
 258         if (sd_booted() <= 0)
 259                 return PAM_SUCCESS;
 260
 261         if ((r = get_user_data(handle, &username, &pw)) != PAM_SUCCESS)
 262                 goto finish;
 263
 264         if (safe_mkdir(RUNTIME_DIR "/user", 0755, 0, 0) < 0) {
 265                 pam_syslog(handle, LOG_ERR, "Failed to create runtime directory: %m");
 266                 r = PAM_SYSTEM_ERR;
 267                 goto finish;
 268         }
 269
 270         if ((lock_fd = open_file_and_lock(RUNTIME_DIR "/user/.pam-systemd-lock")) < 0) {
 271                 pam_syslog(handle, LOG_ERR, "Failed to lock runtime directory: %m");
 272                 r = PAM_SYSTEM_ERR;
 273                 goto finish;
 274         }
 275
 276         /* Create /var/run/$USER */
 277         free(buf);
 278         if (asprintf(&buf, RUNTIME_DIR "/user/%s", username) < 0) {
 279                 r = PAM_BUF_ERR;
 280                 goto finish;
 281         }
 282
 283         if (safe_mkdir(buf, 0700, pw->pw_uid, pw->pw_gid) < 0) {
 284                 pam_syslog(handle, LOG_WARNING, "Failed to create runtime directory: %m");
 285                 r = PAM_SYSTEM_ERR;
 286                 goto finish;
 287         } else if ((r = pam_misc_setenv(handle, "XDG_RUNTIME_DIR", buf, 0)) != PAM_SUCCESS) {
 288                 pam_syslog(handle, LOG_ERR, "Failed to set runtime dir.");
 289                 goto finish;
 290         }
 291
 292         free(buf);
 293         buf = NULL;
 294
 295         if (create_session) {
 296                 const char *id;
 297
 298                 /* Reuse or create XDG session ID */
 299                 if (!(id = pam_getenv(handle, "XDG_SESSION_ID"))) {
 300                         int mode;
 301
 302                         if (asprintf(&buf, "%llux", (unsigned long long) get_session_id(&mode)) < 0) {
 303                                 r = PAM_BUF_ERR;
 304                                 goto finish;
 305                         }
 306
 307                         /* To avoid id clashes we add the session id
 308                          * source to our session ids. Note that the
 309                          * session id source might change during
 310                          * runtime, because a filesystem became
 311                          * writable or the system reconfigured. */
 312                         buf[strlen(buf)-1] =
 313                                 mode != SESSION_ID_AUDIT ? (char) mode : 0;
 314
 315                         if ((r = pam_misc_setenv(handle, "XDG_SESSION_ID", buf, 0)) != PAM_SUCCESS) {
 316                                 pam_syslog(handle, LOG_ERR, "Failed to set session id.");
 317                                 goto finish;
 318                         }
 319
 320                         if (!(id = pam_getenv(handle, "XDG_SESSION_ID"))) {
 321                                 pam_syslog(handle, LOG_ERR, "Failed to get session id.");
 322                                 r = PAM_SESSION_ERR;
 323                                 goto finish;
 324                         }
 325                 }
 326
 327                 r = asprintf(&buf, "/user/%s/%s", username, id);
 328         } else
 329                 r = asprintf(&buf, "/user/%s/no-session", username);
 330
 331         if (r < 0) {
 332                 r = PAM_BUF_ERR;
 333                 goto finish;
 334         }
 335
 336         if ((r = create_user_group(handle, buf, pw, true)) != PAM_SUCCESS)
 337                 goto finish;
 338
 339         r = PAM_SUCCESS;
 340
 341 finish:
 342         free(buf);
 343
 344         if (lock_fd >= 0)
 345                 close_nointr_nofail(lock_fd);
 346
 347         return r;
 348 }
 349
 350 static int session_remains(pam_handle_t *handle, const char *user_path) {
 351         int r;
 352         bool remains = false;
 353         DIR *d;
 354         char *subgroup;
 355
 356         if ((r = cg_enumerate_subgroups(SYSTEMD_CGROUP_CONTROLLER, user_path, &d)) < 0)
 357                 return r;
 358
 359         while ((r = cg_read_subgroup(d, &subgroup)) > 0) {
 360
 361                 remains = !streq(subgroup, "no-session");
 362                 free(subgroup);
 363
 364                 if (remains)
 365                         break;
 366         }
 367
 368         closedir(d);
 369
 370         if (r < 0)
 371                 return r;
 372
 373         return !!remains;
 374 }
 375
 376 _public_ PAM_EXTERN int pam_sm_close_session(
 377                 pam_handle_t *handle,
 378                 int flags,
 379                 int argc, const char **argv) {
 380
 381         const char *username = NULL;
 382         bool kill_session = false;
 383         bool kill_user = false;
 384         int lock_fd = -1, r;
 385         char *session_path = NULL, *nosession_path = NULL, *user_path = NULL;
 386         const char *id;
 387         struct passwd *pw;
 388
 389         assert(handle);
 390
 391         if (parse_argv(handle, argc, argv, NULL, &kill_session, &kill_user) < 0)
 392                 return PAM_SESSION_ERR;
 393
 394         /* Make this a NOP on non-systemd systems */
 395         if (sd_booted() <= 0)
 396                 return PAM_SUCCESS;
 397
 398         if ((r = get_user_data(handle, &username, &pw)) != PAM_SUCCESS)
 399                 goto finish;
 400
 401         if ((lock_fd = open_file_and_lock(RUNTIME_DIR "/user/.pam-systemd-lock")) < 0) {
 402                 pam_syslog(handle, LOG_ERR, "Failed to lock runtime directory: %m");
 403                 r = PAM_SYSTEM_ERR;
 404                 goto finish;
 405         }
 406
 407         /* We are probably still in some session/no-session dir. Move ourselves out of the way as first step */
 408         if ((r = cg_attach(SYSTEMD_CGROUP_CONTROLLER, "/user", 0)) < 0)
 409                 pam_syslog(handle, LOG_ERR, "Failed to move us away: %s", strerror(-r));
 410
 411         if (asprintf(&user_path, "/user/%s", username) < 0) {
 412                 r = PAM_BUF_ERR;
 413                 goto finish;
 414         }
 415
 416         if ((id = pam_getenv(handle, "XDG_SESSION_ID"))) {
 417
 418                 if (asprintf(&session_path, "/user/%s/%s", username, id) < 0 ||
 419                     asprintf(&nosession_path, "/user/%s/no-session", username) < 0) {
 420                         r = PAM_BUF_ERR;
 421                         goto finish;
 422                 }
 423
 424                 if (kill_session)  {
 425                         /* Kill processes in session cgroup, and delete it */
 426                         if ((r = cg_kill_recursive_and_wait(SYSTEMD_CGROUP_CONTROLLER, session_path, true)) < 0)
 427                                 pam_syslog(handle, LOG_ERR, "Failed to kill session cgroup: %s", strerror(-r));
 428                 } else {
 429                         /* Migrate processes from session to
 430                          * no-session cgroup. First, try to create the
 431                          * no-session group in case it doesn't exist
 432                          * yet. Also, delete the session group. */
 433                         create_user_group(handle, nosession_path, pw, 0);
 434
 435                         if ((r = cg_migrate_recursive(SYSTEMD_CGROUP_CONTROLLER, session_path, nosession_path, false, true)) < 0)
 436                                 pam_syslog(handle, LOG_ERR, "Failed to migrate session cgroup: %s", strerror(-r));
 437                 }
 438         }
 439
 440         /* GC user tree */
 441         cg_trim(SYSTEMD_CGROUP_CONTROLLER, user_path, false);
 442
 443         if ((r = session_remains(handle, user_path)) < 0)
 444                 pam_syslog(handle, LOG_ERR, "Failed to determine whether a session remains: %s", strerror(-r));
 445
 446         /* Kill user processes not attached to any session */
 447         if (kill_user && r == 0) {
 448
 449                 /* Kill no-session cgroup */
 450                 if ((r = cg_kill_recursive_and_wait(SYSTEMD_CGROUP_CONTROLLER, user_path, true)) < 0)
 451                         pam_syslog(handle, LOG_ERR, "Failed to kill user cgroup: %s", strerror(-r));
 452         } else {
 453
 454                 if ((r = cg_is_empty_recursive(SYSTEMD_CGROUP_CONTROLLER, user_path, true)) < 0)
 455                         pam_syslog(handle, LOG_ERR, "Failed to check user cgroup: %s", strerror(-r));
 456
 457                 /* Remove user cgroup */
 458                 if (r > 0) {
 459                         if ((r = cg_delete(SYSTEMD_CGROUP_CONTROLLER, user_path)) < 0)
 460                                 pam_syslog(handle, LOG_ERR, "Failed to delete user cgroup: %s", strerror(-r));
 461
 462                 /* If we managed to find somebody, don't cleanup the cgroup. */
 463                 } else if (r == 0)
 464                         r = -EBUSY;
 465         }
 466
 467         if (r >= 0) {
 468                 const char *runtime_dir;
 469
 470                 /* This will migrate us to the /user cgroup. */
 471
 472                 if ((runtime_dir = pam_getenv(handle, "XDG_RUNTIME_DIR")))
 473                         if ((r = rm_rf(runtime_dir, false, true)) < 0)
 474                                 pam_syslog(handle, LOG_ERR, "Failed to remove runtime directory: %s", strerror(-r));
 475         }
 476
 477         r = PAM_SUCCESS;
 478
 479 finish:
 480         if (lock_fd >= 0)
 481                 close_nointr_nofail(lock_fd);
 482
 483         free(session_path);
 484         free(nosession_path);
 485         free(user_path);
 486
 487         return r;
 488 }