pam_systemd: use F_DUPFD_CLOEXEC when dupping session fds

[elogind.git] / src / login / pam-module.c

diff --git a/src/login/pam-module.c b/src/login/pam-module.c
index 9f0f7d186657f52f200c4cea736c6b3a06b8515c..1259457efc5f43351a6cf2f826e8a228cdeb91cf 100644 (file)
--- a/src/login/pam-module.c
+++ b/src/login/pam-module.c
@@ -212,7 +212,7 @@ _public_ PAM_EXTERN int pam_sm_open_session(
                 *remote_user = NULL, *remote_host = NULL,
                 *seat = NULL,
                 *type = NULL, *class = NULL,
-                *class_pam = NULL, *type_pam = NULL, *cvtnr = NULL;
+                *class_pam = NULL, *type_pam = NULL, *cvtnr = NULL, *desktop = NULL;
         _cleanup_bus_unref_ sd_bus *bus = NULL;
         int session_fd = -1, existing, r;
         bool debug = false, remote;
@@ -234,7 +234,7 @@ _public_ PAM_EXTERN int pam_sm_open_session(
                 return PAM_SESSION_ERR;
 
         if (debug)
-                pam_syslog(handle, LOG_INFO, "pam-systemd initializing");
+                pam_syslog(handle, LOG_DEBUG, "pam-systemd initializing");
 
         r = get_user_data(handle, &username, &pw);
         if (r != PAM_SUCCESS) {
@@ -303,8 +303,11 @@ _public_ PAM_EXTERN int pam_sm_open_session(
         if (isempty(class))
                 class = class_pam;
 
+        desktop = pam_getenv(handle, "XDG_SESSION_DESKTOP");
+        if (isempty(desktop))
+                desktop = getenv("XDG_SESSION_DESKTOP");
+
         tty = strempty(tty);
-        display = strempty(display);
 
         if (strchr(tty, ':')) {
                 /* A tty with a colon is usually an X11 display,
@@ -314,21 +317,21 @@ _public_ PAM_EXTERN int pam_sm_open_session(
 
                 if (isempty(display))
                         display = tty;
-                tty = "";
+                tty = NULL;
         } else if (streq(tty, "cron")) {
                 /* cron has been setting PAM_TTY to "cron" for a very
                  * long time and it probably shouldn't stop doing that
                  * for compatibility reasons. */
                 type = "unspecified";
                 class = "background";
-                tty = "";
+                tty = NULL;
         } else if (streq(tty, "ssh")) {
                 /* ssh has been setting PAM_TTY to "ssh" for a very
                  * long time and probably shouldn't stop doing that
                  * for compatibility reasons. */
                 type ="tty";
                 class = "user";
-                tty = "";
+                tty = NULL;
         }
 
         /* If this fails vtnr will be 0, that's intended */
@@ -368,11 +371,11 @@ _public_ PAM_EXTERN int pam_sm_open_session(
 
         if (debug)
                 pam_syslog(handle, LOG_DEBUG, "Asking logind to create session: "
-                           "uid=%u pid=%u service=%s type=%s class=%s seat=%s vtnr=%u tty=%s display=%s remote=%s remote_user=%s remote_host=%s",
+                           "uid=%u pid=%u service=%s type=%s class=%s desktop=%s seat=%s vtnr=%u tty=%s display=%s remote=%s remote_user=%s remote_host=%s",
                            pw->pw_uid, getpid(),
                            strempty(service),
-                           type, class,
-                           strempty(seat), vtnr, tty, strempty(display),
+                           type, class, strempty(desktop),
+                           strempty(seat), vtnr, strempty(tty), strempty(display),
                            yes_no(remote), strempty(remote_user), strempty(remote_host));
 
         r = sd_bus_call_method(bus,
@@ -382,19 +385,20 @@ _public_ PAM_EXTERN int pam_sm_open_session(
                                "CreateSession",
                                &error,
                                &reply,
-                               "uussssussbssa(sv)",
+                               "uusssssussbssa(sv)",
                                (uint32_t) pw->pw_uid,
                                (uint32_t) getpid(),
-                               strempty(service),
+                               service,
                                type,
                                class,
-                               strempty(seat),
+                               desktop,
+                               seat,
                                vtnr,
                                tty,
-                               strempty(display),
+                               display,
                                remote,
-                               strempty(remote_user),
-                               strempty(remote_host),
+                               remote_user,
+                               remote_host,
                                0);
         if (r < 0) {
                 pam_syslog(handle, LOG_ERR, "Failed to create session: %s", bus_error_message(&error, r));
@@ -471,7 +475,7 @@ _public_ PAM_EXTERN int pam_sm_open_session(
         }
 
         if (session_fd >= 0) {
-                session_fd = dup(session_fd);
+                session_fd = fcntl(session_fd, F_DUPFD_CLOEXEC, 3);
                 if (session_fd < 0) {
                         pam_syslog(handle, LOG_ERR, "Failed to dup session fd: %m");
                         return PAM_SESSION_ERR;
@@ -480,7 +484,7 @@ _public_ PAM_EXTERN int pam_sm_open_session(
                 r = pam_set_data(handle, "systemd.session-fd", INT_TO_PTR(session_fd+1), NULL);
                 if (r != PAM_SUCCESS) {
                         pam_syslog(handle, LOG_ERR, "Failed to install session fd.");
-                        close_nointr_nofail(session_fd);
+                        safe_close(session_fd);
                         return r;
                 }
         }
@@ -495,7 +499,7 @@ _public_ PAM_EXTERN int pam_sm_close_session(
 
         _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
         _cleanup_bus_unref_ sd_bus *bus = NULL;
-        const void *p = NULL, *existing = NULL;
+        const void *existing = NULL;
         const char *id;
         int r;
 
@@ -515,10 +519,8 @@ _public_ PAM_EXTERN int pam_sm_close_session(
 
                 r = sd_bus_open_system(&bus);
                 if (r < 0) {
-                        pam_syslog(handle, LOG_ERR,
-                                  "Failed to connect to system bus: %s", strerror(-r));
-                        r = PAM_SESSION_ERR;
-                        goto finish;
+                        pam_syslog(handle, LOG_ERR, "Failed to connect to system bus: %s", strerror(-r));
+                        return PAM_SESSION_ERR;
                 }
 
                 r = sd_bus_call_method(bus,
@@ -531,20 +533,16 @@ _public_ PAM_EXTERN int pam_sm_close_session(
                                        "s",
                                        id);
                 if (r < 0) {
-                        pam_syslog(handle, LOG_ERR,
-                                   "Failed to release session: %s", bus_error_message(&error, r));
-
-                        r = PAM_SESSION_ERR;
-                        goto finish;
+                        pam_syslog(handle, LOG_ERR, "Failed to release session: %s", bus_error_message(&error, r));
+                        return PAM_SESSION_ERR;
                 }
         }
 
-        r = PAM_SUCCESS;
-
-finish:
-        pam_get_data(handle, "systemd.session-fd", &p);
-        if (p)
-                close_nointr(PTR_TO_INT(p) - 1);
+        /* Note that we are knowingly leaking the FIFO fd here. This
+         * way, logind can watch us die. If we closed it here it would
+         * not have any clue when that is completed. Given that one
+         * cannot really have multiple PAM sessions open from the same
+         * process this means we will leak one FD at max. */
 
-        return r;
+        return PAM_SUCCESS;
 }