1 /* passwd-pam.c --- verifying typed passwords with PAM
2 * (Pluggable Authentication Modules.)
3 * written by Bill Nottingham <notting@redhat.com> (and jwz) for
4 * xscreensaver, Copyright (c) 1993-1998, 2000 Jamie Zawinski <jwz@jwz.org>
6 * Permission to use, copy, modify, distribute, and sell this software and its
7 * documentation for any purpose is hereby granted without fee, provided that
8 * the above copyright notice appear in all copies and that both that
9 * copyright notice and this permission notice appear in supporting
10 * documentation. No representations are made about the suitability of this
11 * software for any purpose. It is provided "as is" without express or
17 * http://www.us.kernel.org/pub/linux/libs/pam/
20 * http://www.us.kernel.org/pub/linux/libs/pam/FAQ
22 * PAM Application Developers' Guide:
23 * http://www.us.kernel.org/pub/linux/libs/pam/Linux-PAM-html/pam_appl.html
25 * PAM Mailing list archives:
26 * http://www.linuxhq.com/lnxlists/linux-pam/
28 * Compatibility notes, especially between Linux and Solaris:
29 * http://www.contrib.andrew.cmu.edu/u/shadow/pam.html
31 * The Open Group's PAM API documentation:
32 * http://www.opengroup.org/onlinepubs/8329799/pam_start.htm
39 #ifndef NO_LOCKING /* whole file */
46 extern char *blurb(void);
51 #include <sys/types.h>
54 #include <security/pam_appl.h>
68 #define countof(x) (sizeof((x))/sizeof(*(x)))
70 static int pam_conversation (int nmsgs,
71 const struct pam_message **msg,
72 struct pam_response **resp,
77 const char *typed_passwd;
82 #ifdef HAVE_PAM_FAIL_DELAY
83 /* We handle delays ourself.*/
84 /* Don't set this to 0 (Linux bug workaround.) */
85 # define PAM_NO_DELAY(pamh) pam_fail_delay ((pamh), 1)
86 #else /* !HAVE_PAM_FAIL_DELAY */
87 # define PAM_NO_DELAY(pamh) /* */
88 #endif /* !HAVE_PAM_FAIL_DELAY */
91 /* On SunOS 5.6, and on Linux with PAM 0.64, pam_strerror() takes two args.
92 On some other Linux systems with some other version of PAM (e.g.,
93 whichever Debian release comes with a 2.2.5 kernel) it takes one arg.
94 I can't tell which is more "recent" or "correct" behavior, so configure
95 figures out which is in use for us. Shoot me!
97 #ifdef PAM_STRERROR_TWO_ARGS
98 # define PAM_STRERROR(pamh, status) pam_strerror((pamh), (status))
99 #else /* !PAM_STRERROR_TWO_ARGS */
100 # define PAM_STRERROR(pamh, status) pam_strerror((status))
101 #endif /* !PAM_STRERROR_TWO_ARGS */
104 /* PAM sucks in that there is no way to tell whether a particular service
105 is configured at all. That is, there is no way to tell the difference
106 between "authentication of the FOO service is not allowed" and "the
107 user typed the wrong password."
109 On RedHat 5.1 systems, if a service name is not known, it defaults to
110 being not allowed (because the fallback service, /etc/pam.d/other, is
113 On Solaris 2.6 systems, unknown services default to authenticating normally.
115 So, we could simply require that the person who installs xscreensaver
116 set up an "xscreensaver" PAM service. However, if we went that route,
117 it would have a really awful failure mode: the failure mode would be that
118 xscreensaver was willing to *lock* the screen, but would be unwilling to
119 *unlock* the screen. (With the non-PAM password code, the analagous
120 situation -- security not being configured properly, for example do to the
121 executable not being installed as setuid root -- the failure mode is much
122 more palettable, in that xscreensaver will refuse to *lock* the screen,
123 because it can know up front that there is no password that will work.)
125 Another route would be to have the service name to consult be computed at
126 compile-time (perhaps with a configure option.) However, that doesn't
127 really solve the problem, because it means that the same executable might
128 work fine on one machine, but refuse to unlock when run on another
131 Another alternative would be to look in /etc/pam.conf or /etc/pam.d/ at
132 runtime to see what services actually exist. But I think that's no good,
133 because who is to say that the PAM info is actually specified in those
134 files? Opening and reading those files is not a part of the PAM client
135 API, so it's not guarenteed to work on any given system.
137 An alternative I tried was to specify a list of services to try, and to
138 try them all in turn ("xscreensaver", "xlock", "xdm", and "login").
139 This worked, but it was slow (and I also had to do some contortions to
140 work around bugs in Linux PAM 0.64-3.)
142 So what we do today is, try PAM once, and if that fails, try the usual
143 getpwent() method. So if PAM doesn't work, it will at least make an
144 attempt at looking up passwords in /etc/passwd or /etc/shadow instead.
146 This all kind of blows. I'm not sure what else to do.
150 /* On SunOS 5.6, the `pam_conv.appdata_ptr' slot seems to be ignored, and
151 the `closure' argument to pc.conv always comes in as random garbage.
152 So we get around this by using a global variable instead. Shoot me!
154 (I've been told this is bug 4092227, and is fixed in Solaris 7.)
155 (I've also been told that it's fixed in Solaris 2.6 by patch 106257-05.)
157 static void *suns_pam_implementation_blows = 0;
160 /* This can be called at any time, and says whether the typed password
161 belongs to either the logged in user (real uid, not effective); or
165 pam_passwd_valid_p (const char *typed_passwd, Bool verbose_p)
167 const char *service = PAM_SERVICE_NAME;
168 pam_handle_t *pamh = 0;
171 struct pam_closure c;
174 struct passwd *p = getpwuid (getuid ());
175 if (!p) return False;
177 user = strdup (p->pw_name);
180 c.typed_passwd = typed_passwd;
181 c.verbose_p = verbose_p;
183 pc.conv = &pam_conversation;
184 pc.appdata_ptr = (void *) &c;
186 /* On SunOS 5.6, the `appdata_ptr' slot seems to be ignored, and the
187 `closure' argument to pc.conv always comes in as random garbage. */
188 suns_pam_implementation_blows = (void *) &c;
193 status = pam_start (service, c.user, &pc, &pamh);
195 fprintf (stderr, "%s: pam_start (\"%s\", \"%s\", ...) ==> %d (%s)\n",
196 blurb(), service, c.user,
197 status, PAM_STRERROR (pamh, status));
198 if (status != PAM_SUCCESS) goto DONE;
200 /* #### We should set PAM_TTY to the display we're using, but we
201 don't have that handy from here. So set it to :0.0, which is a
202 good guess (and has the bonus of counting as a "secure tty" as
203 far as PAM is concerned...)
206 const char *tty = ":0.0";
207 status = pam_set_item (pamh, PAM_TTY, strdup(tty));
209 fprintf (stderr, "%s: pam_set_item (p, PAM_TTY, \"%s\") ==> %d (%s)\n",
210 blurb(), tty, status, PAM_STRERROR(pamh, status));
213 /* Try to authenticate as the current user.
216 status = pam_authenticate (pamh, 0);
218 fprintf (stderr, "%s: pam_authenticate (...) ==> %d (%s)\n",
219 blurb(), status, PAM_STRERROR(pamh, status));
220 if (status == PAM_SUCCESS) /* Win! */
222 /* Each time we successfully authenticate, refresh credentials,
223 for Kerberos/AFS/DCE/etc. If this fails, just ignore that
224 failure and blunder along; it shouldn't matter.
226 int status2 = pam_setcred (pamh, PAM_REFRESH_CRED);
228 fprintf (stderr, "%s: pam_setcred (...) ==> %d (%s)\n",
229 blurb(), status2, PAM_STRERROR(pamh, status2));
233 /* If that didn't work, set the user to root, and try to authenticate again.
236 status = pam_set_item (pamh, PAM_USER, strdup(c.user));
238 fprintf (stderr, "%s: pam_set_item(p, PAM_USER, \"%s\") ==> %d (%s)\n",
239 blurb(), c.user, status, PAM_STRERROR(pamh, status));
240 if (status != PAM_SUCCESS) goto DONE;
243 status = pam_authenticate (pamh, 0);
245 fprintf (stderr, "%s: pam_authenticate (...) ==> %d (%s)\n",
246 blurb(), status, PAM_STRERROR(pamh, status));
249 if (user) free (user);
252 int status2 = pam_end (pamh, status);
255 fprintf (stderr, "%s: pam_end (...) ==> %d (%s)\n",
257 (status2 == PAM_SUCCESS ? "Success" : "Failure"));
259 return (status == PAM_SUCCESS ? True : False);
264 pam_priv_init (int argc, char **argv, Bool verbose_p)
266 /* We have nothing to do at init-time.
267 However, we might as well do some error checking.
268 If "/etc/pam.d" exists and is a directory, but "/etc/pam.d/xlock"
269 does not exist, warn that PAM probably isn't going to work.
271 This is a priv-init instead of a non-priv init in case the directory
272 is unreadable or something (don't know if that actually happens.)
274 const char dir[] = "/etc/pam.d";
275 const char file[] = "/etc/pam.d/" PAM_SERVICE_NAME;
276 const char file2[] = "/etc/pam.conf";
279 if (stat (dir, &st) == 0 && st.st_mode & S_IFDIR)
281 if (stat (file, &st) != 0)
283 "%s: warning: %s does not exist.\n"
284 "%s: password authentication via PAM is unlikely to work.\n",
285 blurb(), file, blurb());
287 else if (stat (file2, &st) == 0)
289 FILE *f = fopen (file2, "r");
294 while (fgets (buf, sizeof(buf), f))
295 if (strstr (buf, PAM_SERVICE_NAME))
304 "%s: warning: %s does not list the `%s' service.\n"
305 "%s: password authentication via PAM is unlikely to work.\n",
306 blurb(), file2, PAM_SERVICE_NAME, blurb());
309 /* else warn about file2 existing but being unreadable? */
314 "%s: warning: neither %s nor %s exist.\n"
315 "%s: password authentication via PAM is unlikely to work.\n",
316 blurb(), file2, file, blurb());
319 /* Return true anyway, just in case. */
324 /* This is the function PAM calls to have a conversation with the user.
325 Really, this function should be the thing that pops up dialog boxes
326 as needed, and prompts for various strings.
328 But, for now, xscreensaver uses its normal password-prompting dialog
329 first, and then this function simply returns the result that has been
332 This means that if PAM was using a retina scanner for auth, xscreensaver
333 would prompt for a password; then pam_conversation() would be called
334 with a string like "Please look into the retina scanner". The user
335 would never see this string, and the prompted-for password would be
339 pam_conversation (int nmsgs,
340 const struct pam_message **msg,
341 struct pam_response **resp,
345 struct pam_response *reply = 0;
346 struct pam_closure *c = (struct pam_closure *) closure;
348 /* On SunOS 5.6, the `closure' argument always comes in as random garbage. */
349 c = (struct pam_closure *) suns_pam_implementation_blows;
352 reply = (struct pam_response *) calloc (nmsgs, sizeof (*reply));
353 if (!reply) return PAM_CONV_ERR;
355 for (replies = 0; replies < nmsgs; replies++)
357 switch (msg[replies]->msg_style)
359 case PAM_PROMPT_ECHO_ON:
360 reply[replies].resp_retcode = PAM_SUCCESS;
361 reply[replies].resp = strdup (c->user); /* freed by PAM */
363 fprintf (stderr, "%s: PAM ECHO_ON(\"%s\") ==> \"%s\"\n",
364 blurb(), msg[replies]->msg,
365 reply[replies].resp);
367 case PAM_PROMPT_ECHO_OFF:
368 reply[replies].resp_retcode = PAM_SUCCESS;
369 reply[replies].resp = strdup (c->typed_passwd); /* freed by PAM */
371 fprintf (stderr, "%s: PAM ECHO_OFF(\"%s\") ==> password\n",
372 blurb(), msg[replies]->msg);
376 reply[replies].resp_retcode = PAM_SUCCESS;
377 reply[replies].resp = 0;
379 fprintf (stderr, "%s: PAM TEXT_INFO(\"%s\") ==> ignored\n",
380 blurb(), msg[replies]->msg);
384 reply[replies].resp_retcode = PAM_SUCCESS;
385 reply[replies].resp = 0;
387 fprintf (stderr, "%s: PAM ERROR_MSG(\"%s\") ==> ignored\n",
388 blurb(), msg[replies]->msg);
391 /* Must be an error of some sort... */
394 fprintf (stderr, "%s: PAM unknown %d(\"%s\") ==> ignored\n",
395 blurb(), msg[replies]->msg_style, msg[replies]->msg);
403 #endif /* NO_LOCKING -- whole file */