src/tty-ask-password-agent.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2010 Lennart Poettering
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU General Public License as published by
  10   the Free Software Foundation; either version 2 of the License, or
  11   (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   General Public License for more details.
  17
  18   You should have received a copy of the GNU General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20 ***/
  21
  22 #include <stdbool.h>
  23 #include <errno.h>
  24 #include <string.h>
  25 #include <sys/socket.h>
  26 #include <sys/un.h>
  27 #include <stddef.h>
  28 #include <sys/poll.h>
  29 #include <sys/inotify.h>
  30 #include <unistd.h>
  31 #include <getopt.h>
  32
  33 #include "util.h"
  34 #include "conf-parser.h"
  35 #include "utmp-wtmp.h"
  36 #include "socket-util.h"
  37
  38 static enum {
  39         ACTION_LIST,
  40         ACTION_QUERY,
  41         ACTION_WATCH,
  42         ACTION_WALL
  43 } arg_action = ACTION_QUERY;
  44
  45 static bool arg_plymouth = false;
  46
  47 static int ask_password_plymouth(const char *message, usec_t until, const char *flag_file, char **_passphrase) {
  48         int fd = -1, notify = -1;
  49         union sockaddr_union sa;
  50         char *packet = NULL;
  51         ssize_t k;
  52         int r, n;
  53         struct pollfd pollfd[2];
  54         char buffer[LINE_MAX];
  55         size_t p = 0;
  56         enum {
  57                 POLL_SOCKET,
  58                 POLL_INOTIFY
  59         };
  60
  61         if (flag_file) {
  62                 if ((notify = inotify_init1(IN_CLOEXEC|IN_NONBLOCK)) < 0) {
  63                         r = -errno;
  64                         goto finish;
  65                 }
  66
  67                 if (inotify_add_watch(notify, flag_file, IN_ATTRIB /* for the link count */) < 0) {
  68                         r = -errno;
  69                         goto finish;
  70                 }
  71         }
  72
  73         if ((fd = socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0)) < 0) {
  74                 r = -errno;
  75                 goto finish;
  76         }
  77
  78         zero(sa);
  79         sa.sa.sa_family = AF_UNIX;
  80         strncpy(sa.un.sun_path+1, "/ply-boot-protocol", sizeof(sa.un.sun_path)-1);
  81
  82         if (connect(fd, &sa.sa, sizeof(sa.un)) < 0) {
  83                 r = -errno;
  84                 goto finish;
  85         }
  86
  87         if (asprintf(&packet, "*\002%c%s%n", (int) (strlen(message) + 1), message, &n) < 0) {
  88                 r = -ENOMEM;
  89                 goto finish;
  90         }
  91
  92         if ((k = loop_write(fd, packet, n+1, true)) != n+1) {
  93                 r = k < 0 ? (int) k : -EIO;
  94                 goto finish;
  95         }
  96
  97         zero(pollfd);
  98         pollfd[POLL_SOCKET].fd = fd;
  99         pollfd[POLL_SOCKET].events = POLLIN;
 100         pollfd[POLL_INOTIFY].fd = notify;
 101         pollfd[POLL_INOTIFY].events = POLLIN;
 102
 103         for (;;) {
 104                 int sleep_for = -1, j;
 105
 106                 if (until > 0) {
 107                         usec_t y;
 108
 109                         y = now(CLOCK_MONOTONIC);
 110
 111                         if (y > until) {
 112                                 r = -ETIMEDOUT;
 113                                 goto finish;
 114                         }
 115
 116                         sleep_for = (int) ((until - y) / USEC_PER_MSEC);
 117                 }
 118
 119                 if (flag_file)
 120                         if (access(flag_file, F_OK) < 0) {
 121                                 r = -errno;
 122                                 goto finish;
 123                         }
 124
 125                 if ((j = poll(pollfd, notify > 0 ? 2 : 1, sleep_for)) < 0) {
 126
 127                         if (errno == EINTR)
 128                                 continue;
 129
 130                         r = -errno;
 131                         goto finish;
 132                 } else if (j == 0) {
 133                         r = -ETIMEDOUT;
 134                         goto finish;
 135                 }
 136
 137                 if (notify > 0 && pollfd[POLL_INOTIFY].revents != 0)
 138                         flush_fd(notify);
 139
 140                 if (pollfd[POLL_SOCKET].revents == 0)
 141                         continue;
 142
 143                 if ((k = read(fd, buffer + p, sizeof(buffer) - p)) <= 0) {
 144                         r = k < 0 ? -errno : -EIO;
 145                         goto finish;
 146                 }
 147
 148                 p += k;
 149
 150                 if (p < 1)
 151                         continue;
 152
 153                 if (buffer[0] == 5) {
 154                         /* No password, because UI not shown */
 155                         r = -ENOENT;
 156                         goto finish;
 157
 158                 } else if (buffer[0] == 2) {
 159                         uint32_t size;
 160                         char *s;
 161
 162                         /* One answer */
 163                         if (p < 5)
 164                                 continue;
 165
 166                         memcpy(&size, buffer+1, sizeof(size));
 167                         if (size+5 > sizeof(buffer)) {
 168                                 r = -EIO;
 169                                 goto finish;
 170                         }
 171
 172                         if (p-5 < size)
 173                                 continue;
 174
 175                         if (!(s = strndup(buffer + 5, size))) {
 176                                 r = -ENOMEM;
 177                                 goto finish;
 178                         }
 179
 180                         *_passphrase = s;
 181                         break;
 182                 } else {
 183                         /* Unknown packet */
 184                         r = -EIO;
 185                         goto finish;
 186                 }
 187         }
 188
 189         r = 0;
 190
 191 finish:
 192         if (notify >= 0)
 193                 close_nointr_nofail(notify);
 194
 195         if (fd >= 0)
 196                 close_nointr_nofail(fd);
 197
 198         free(packet);
 199
 200         return r;
 201 }
 202
 203 static int parse_password(const char *filename, char **wall) {
 204         char *socket_name = NULL, *message = NULL, *packet = NULL;
 205         uint64_t not_after = 0;
 206         unsigned pid = 0;
 207         int socket_fd = -1;
 208
 209         const ConfigItem items[] = {
 210                 { "Socket",   config_parse_string,   &socket_name, "Ask" },
 211                 { "NotAfter", config_parse_uint64,   &not_after,   "Ask" },
 212                 { "Message",  config_parse_string,   &message,     "Ask" },
 213                 { "PID",      config_parse_unsigned, &pid,         "Ask" },
 214         };
 215
 216         FILE *f;
 217         int r;
 218         usec_t n;
 219
 220         assert(filename);
 221
 222         if (!(f = fopen(filename, "re"))) {
 223
 224                 if (errno == ENOENT)
 225                         return 0;
 226
 227                 log_error("open(%s): %m", filename);
 228                 return -errno;
 229         }
 230
 231         if ((r = config_parse(filename, f, NULL, items, false, NULL)) < 0) {
 232                 log_error("Failed to parse password file %s: %s", filename, strerror(-r));
 233                 goto finish;
 234         }
 235
 236         if (!socket_name || not_after <= 0) {
 237                 log_error("Invalid password file %s", filename);
 238                 r = -EBADMSG;
 239                 goto finish;
 240         }
 241
 242         n = now(CLOCK_MONOTONIC);
 243         if (n > not_after) {
 244                 r = 0;
 245                 goto finish;
 246         }
 247
 248         if (arg_action == ACTION_LIST)
 249                 printf("'%s' (PID %u)\n", message, pid);
 250         else if (arg_action == ACTION_WALL) {
 251                 char *_wall;
 252
 253                 if (asprintf(&_wall,
 254                              "%s%sPassword entry required for \'%s\' (PID %u).\r\n"
 255                              "Please enter password with the systemd-tty-password-agent tool!",
 256                              *wall ? *wall : "",
 257                              *wall ? "\r\n\r\n" : "",
 258                              message,
 259                              pid) < 0) {
 260                         log_error("Out of memory");
 261                         r = -ENOMEM;
 262                         goto finish;
 263                 }
 264
 265                 free(*wall);
 266                 *wall = _wall;
 267         } else {
 268                 union {
 269                         struct sockaddr sa;
 270                         struct sockaddr_un un;
 271                 } sa;
 272                 char *password;
 273
 274                 assert(arg_action == ACTION_QUERY ||
 275                        arg_action == ACTION_WATCH);
 276
 277                 if (access(socket_name, W_OK) < 0) {
 278
 279                         if (arg_action == ACTION_QUERY)
 280                                 log_info("Not querying '%s' (PID %u), lacking privileges.", message, pid);
 281
 282                         r = 0;
 283                         goto finish;
 284                 }
 285
 286                 if (arg_plymouth)
 287                         r = ask_password_plymouth(message, not_after, filename, &password);
 288                 else
 289                         r = ask_password_tty(message, not_after, filename, &password);
 290
 291                 if (r < 0) {
 292                         log_error("Failed to query password: %s", strerror(-r));
 293                         goto finish;
 294                 }
 295
 296                 asprintf(&packet, "+%s", password);
 297                 free(password);
 298
 299                 if (!packet) {
 300                         log_error("Out of memory");
 301                         r = -ENOMEM;
 302                         goto finish;
 303                 }
 304
 305                 if ((socket_fd = socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0)) < 0) {
 306                         log_error("socket(): %m");
 307                         r = -errno;
 308                         goto finish;
 309                 }
 310
 311                 zero(sa);
 312                 sa.un.sun_family = AF_UNIX;
 313                 strncpy(sa.un.sun_path, socket_name, sizeof(sa.un.sun_path));
 314
 315                 if (sendto(socket_fd, packet, strlen(packet), MSG_NOSIGNAL, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(socket_name)) < 0) {
 316                         log_error("Failed to send: %m");
 317                         r = -errno;
 318                         goto finish;
 319                 }
 320         }
 321
 322 finish:
 323         fclose(f);
 324
 325         if (socket_fd >= 0)
 326                 close_nointr_nofail(socket_fd);
 327
 328         free(packet);
 329         free(socket_name);
 330         free(message);
 331
 332         return r;
 333 }
 334
 335 static int show_passwords(void) {
 336         DIR *d;
 337         struct dirent *de;
 338         int r = 0;
 339
 340         if (!(d = opendir("/dev/.systemd/ask-password"))) {
 341                 if (errno == ENOENT)
 342                         return 0;
 343
 344                 log_error("opendir(): %m");
 345                 return -errno;
 346         }
 347
 348         while ((de = readdir(d))) {
 349                 char *p;
 350                 int q;
 351                 char *wall;
 352
 353                 if (de->d_type != DT_REG)
 354                         continue;
 355
 356                 if (ignore_file(de->d_name))
 357                         continue;
 358
 359                 if (!startswith(de->d_name, "ask."))
 360                         continue;
 361
 362                 if (!(p = strappend("/dev/.systemd/ask-password/", de->d_name))) {
 363                         log_error("Out of memory");
 364                         r = -ENOMEM;
 365                         goto finish;
 366                 }
 367
 368                 wall = NULL;
 369                 if ((q = parse_password(p, &wall)) < 0)
 370                         r = q;
 371
 372                 free(p);
 373
 374                 if (wall) {
 375                         utmp_wall(wall);
 376                         free(wall);
 377                 }
 378         }
 379
 380 finish:
 381         if (d)
 382                 closedir(d);
 383
 384         return r;
 385 }
 386
 387 static int watch_passwords(void) {
 388         int notify;
 389         struct pollfd pollfd;
 390         int r;
 391
 392         mkdir_p("/dev/.systemd/ask-password", 0755);
 393
 394         if ((notify = inotify_init1(IN_CLOEXEC)) < 0) {
 395                 r = -errno;
 396                 goto finish;
 397         }
 398
 399         if (inotify_add_watch(notify, "/dev/.systemd/ask-password", IN_CLOSE_WRITE|IN_MOVED_TO) < 0) {
 400                 r = -errno;
 401                 goto finish;
 402         }
 403
 404         zero(pollfd);
 405         pollfd.fd = notify;
 406         pollfd.events = POLLIN;
 407
 408         for (;;) {
 409                 if ((r = show_passwords()) < 0)
 410                         break;
 411
 412                 if (poll(&pollfd, 1, -1) < 0) {
 413
 414                         if (errno == EINTR)
 415                                 continue;
 416
 417                         r = -errno;
 418                         goto finish;
 419                 }
 420
 421                 if (pollfd.revents != 0)
 422                         flush_fd(notify);
 423         }
 424
 425         r = 0;
 426
 427 finish:
 428         if (notify >= 0)
 429                 close_nointr_nofail(notify);
 430
 431         return r;
 432 }
 433
 434 static int help(void) {
 435
 436         printf("%s [OPTIONS...]\n\n"
 437                "Process system password requests.\n\n"
 438                "  -h --help     Show this help\n"
 439                "     --list     Show pending password requests\n"
 440                "     --query    Process pending password requests\n"
 441                "     --watch    Continously process password requests\n"
 442                "     --wall     Continously forward password requests to wall\n"
 443                "     --plymouth Ask question with Plymouth instead of on TTY\n",
 444                program_invocation_short_name);
 445
 446         return 0;
 447 }
 448
 449 static int parse_argv(int argc, char *argv[]) {
 450
 451         enum {
 452                 ARG_LIST = 0x100,
 453                 ARG_QUERY,
 454                 ARG_WATCH,
 455                 ARG_WALL,
 456                 ARG_PLYMOUTH
 457         };
 458
 459         static const struct option options[] = {
 460                 { "help",     no_argument, NULL, 'h'          },
 461                 { "list",     no_argument, NULL, ARG_LIST     },
 462                 { "query",    no_argument, NULL, ARG_QUERY    },
 463                 { "watch",    no_argument, NULL, ARG_WATCH    },
 464                 { "wall",     no_argument, NULL, ARG_WALL     },
 465                 { "plymouth", no_argument, NULL, ARG_PLYMOUTH },
 466                 { NULL,    0,           NULL, 0               }
 467         };
 468
 469         int c;
 470
 471         assert(argc >= 0);
 472         assert(argv);
 473
 474         while ((c = getopt_long(argc, argv, "h", options, NULL)) >= 0) {
 475
 476                 switch (c) {
 477
 478                 case 'h':
 479                         help();
 480                         return 0;
 481
 482                 case ARG_LIST:
 483                         arg_action = ACTION_LIST;
 484                         break;
 485
 486                 case ARG_QUERY:
 487                         arg_action = ACTION_QUERY;
 488                         break;
 489
 490                 case ARG_WATCH:
 491                         arg_action = ACTION_WATCH;
 492                         break;
 493
 494                 case ARG_WALL:
 495                         arg_action = ACTION_WALL;
 496                         break;
 497
 498                 case ARG_PLYMOUTH:
 499                         arg_plymouth = true;
 500                         break;
 501
 502                 case '?':
 503                         return -EINVAL;
 504
 505                 default:
 506                         log_error("Unknown option code %c", c);
 507                         return -EINVAL;
 508                 }
 509         }
 510
 511         if (optind != argc) {
 512                 help();
 513                 return -EINVAL;
 514         }
 515
 516         return 1;
 517 }
 518
 519 int main(int argc, char *argv[]) {
 520         int r;
 521
 522         log_parse_environment();
 523         log_open();
 524
 525         if ((r = parse_argv(argc, argv)) <= 0)
 526                 goto finish;
 527
 528         if (arg_action == ACTION_WATCH ||
 529             arg_action == ACTION_WALL)
 530                 r = watch_passwords();
 531         else
 532                 r = show_passwords();
 533
 534 finish:
 535         return r < 0 ? EXIT_FAILURE : EXIT_SUCCESS;
 536 }