1 /* passwd-pam.c --- verifying typed passwords with PAM
2 * (Pluggable Authentication Modules.)
3 * written by Bill Nottingham <notting@redhat.com> (and jwz) for
4 * xscreensaver, Copyright (c) 1993-2002 Jamie Zawinski <jwz@jwz.org>
6 * Permission to use, copy, modify, distribute, and sell this software and its
7 * documentation for any purpose is hereby granted without fee, provided that
8 * the above copyright notice appear in all copies and that both that
9 * copyright notice and this permission notice appear in supporting
10 * documentation. No representations are made about the suitability of this
11 * software for any purpose. It is provided "as is" without express or
17 * http://www.us.kernel.org/pub/linux/libs/pam/
20 * http://www.us.kernel.org/pub/linux/libs/pam/FAQ
22 * PAM Application Developers' Guide:
23 * http://www.us.kernel.org/pub/linux/libs/pam/Linux-PAM-html/pam_appl.html
25 * PAM Mailing list archives:
26 * http://www.linuxhq.com/lnxlists/linux-pam/
28 * Compatibility notes, especially between Linux and Solaris:
29 * http://www.contrib.andrew.cmu.edu/u/shadow/pam.html
31 * The Open Group's PAM API documentation:
32 * http://www.opengroup.org/onlinepubs/8329799/pam_start.htm
39 #ifndef NO_LOCKING /* whole file */
46 extern char *blurb(void);
51 #include <sys/types.h>
54 #include <security/pam_appl.h>
58 extern void block_sigchld (void);
59 extern void unblock_sigchld (void);
70 #define countof(x) (sizeof((x))/sizeof(*(x)))
72 /* Some time between Red Hat 4.2 and 7.0, the words were transposed
73 in the various PAM_x_CRED macro names. Yay!
75 #ifndef PAM_REFRESH_CRED
76 # define PAM_REFRESH_CRED PAM_CRED_REFRESH
79 static int pam_conversation (int nmsgs,
80 const struct pam_message **msg,
81 struct pam_response **resp,
86 const char *typed_passwd;
91 #ifdef HAVE_PAM_FAIL_DELAY
92 /* We handle delays ourself.*/
93 /* Don't set this to 0 (Linux bug workaround.) */
94 # define PAM_NO_DELAY(pamh) pam_fail_delay ((pamh), 1)
95 #else /* !HAVE_PAM_FAIL_DELAY */
96 # define PAM_NO_DELAY(pamh) /* */
97 #endif /* !HAVE_PAM_FAIL_DELAY */
100 /* On SunOS 5.6, and on Linux with PAM 0.64, pam_strerror() takes two args.
101 On some other Linux systems with some other version of PAM (e.g.,
102 whichever Debian release comes with a 2.2.5 kernel) it takes one arg.
103 I can't tell which is more "recent" or "correct" behavior, so configure
104 figures out which is in use for us. Shoot me!
106 #ifdef PAM_STRERROR_TWO_ARGS
107 # define PAM_STRERROR(pamh, status) pam_strerror((pamh), (status))
108 #else /* !PAM_STRERROR_TWO_ARGS */
109 # define PAM_STRERROR(pamh, status) pam_strerror((status))
110 #endif /* !PAM_STRERROR_TWO_ARGS */
113 /* PAM sucks in that there is no way to tell whether a particular service
114 is configured at all. That is, there is no way to tell the difference
115 between "authentication of the FOO service is not allowed" and "the
116 user typed the wrong password."
118 On RedHat 5.1 systems, if a service name is not known, it defaults to
119 being not allowed (because the fallback service, /etc/pam.d/other, is
122 On Solaris 2.6 systems, unknown services default to authenticating normally.
124 So, we could simply require that the person who installs xscreensaver
125 set up an "xscreensaver" PAM service. However, if we went that route,
126 it would have a really awful failure mode: the failure mode would be that
127 xscreensaver was willing to *lock* the screen, but would be unwilling to
128 *unlock* the screen. (With the non-PAM password code, the analagous
129 situation -- security not being configured properly, for example do to the
130 executable not being installed as setuid root -- the failure mode is much
131 more palettable, in that xscreensaver will refuse to *lock* the screen,
132 because it can know up front that there is no password that will work.)
134 Another route would be to have the service name to consult be computed at
135 compile-time (perhaps with a configure option.) However, that doesn't
136 really solve the problem, because it means that the same executable might
137 work fine on one machine, but refuse to unlock when run on another
140 Another alternative would be to look in /etc/pam.conf or /etc/pam.d/ at
141 runtime to see what services actually exist. But I think that's no good,
142 because who is to say that the PAM info is actually specified in those
143 files? Opening and reading those files is not a part of the PAM client
144 API, so it's not guarenteed to work on any given system.
146 An alternative I tried was to specify a list of services to try, and to
147 try them all in turn ("xscreensaver", "xlock", "xdm", and "login").
148 This worked, but it was slow (and I also had to do some contortions to
149 work around bugs in Linux PAM 0.64-3.)
151 So what we do today is, try PAM once, and if that fails, try the usual
152 getpwent() method. So if PAM doesn't work, it will at least make an
153 attempt at looking up passwords in /etc/passwd or /etc/shadow instead.
155 This all kind of blows. I'm not sure what else to do.
159 /* On SunOS 5.6, the `pam_conv.appdata_ptr' slot seems to be ignored, and
160 the `closure' argument to pc.conv always comes in as random garbage.
161 So we get around this by using a global variable instead. Shoot me!
163 (I've been told this is bug 4092227, and is fixed in Solaris 7.)
164 (I've also been told that it's fixed in Solaris 2.6 by patch 106257-05.)
166 static void *suns_pam_implementation_blows = 0;
169 /* This can be called at any time, and says whether the typed password
170 belongs to either the logged in user (real uid, not effective); or
174 pam_passwd_valid_p (const char *typed_passwd, Bool verbose_p)
176 const char *service = PAM_SERVICE_NAME;
177 pam_handle_t *pamh = 0;
180 struct pam_closure c;
183 struct passwd *p = getpwuid (getuid ());
184 if (!p) return False;
186 user = strdup (p->pw_name);
189 c.typed_passwd = typed_passwd;
190 c.verbose_p = verbose_p;
192 pc.conv = &pam_conversation;
193 pc.appdata_ptr = (void *) &c;
195 /* On SunOS 5.6, the `appdata_ptr' slot seems to be ignored, and the
196 `closure' argument to pc.conv always comes in as random garbage. */
197 suns_pam_implementation_blows = (void *) &c;
202 status = pam_start (service, c.user, &pc, &pamh);
204 fprintf (stderr, "%s: pam_start (\"%s\", \"%s\", ...) ==> %d (%s)\n",
205 blurb(), service, c.user,
206 status, PAM_STRERROR (pamh, status));
207 if (status != PAM_SUCCESS) goto DONE;
209 /* #### We should set PAM_TTY to the display we're using, but we
210 don't have that handy from here. So set it to :0.0, which is a
211 good guess (and has the bonus of counting as a "secure tty" as
212 far as PAM is concerned...)
215 char *tty = strdup (":0.0");
216 status = pam_set_item (pamh, PAM_TTY, tty);
218 fprintf (stderr, "%s: pam_set_item (p, PAM_TTY, \"%s\") ==> %d (%s)\n",
219 blurb(), tty, status, PAM_STRERROR(pamh, status));
223 /* Try to authenticate as the current user.
224 We must turn off our SIGCHLD handler for the duration of the call to
225 pam_authenticate(), because in some cases, the underlying PAM code
228 1: fork a setuid subprocess to do some dirty work;
229 2: read a response from that subprocess;
230 3: waitpid(pid, ...) on that subprocess.
232 If we (the ignorant parent process) have a SIGCHLD handler, then there's
233 a race condition between steps 2 and 3: if the subprocess exits before
234 waitpid() was called, then our SIGCHLD handler fires, and gets notified
235 of the subprocess death; then PAM's call to waitpid() fails, because the
236 process has already been reaped.
238 I consider this a bug in PAM, since the caller should be able to have
239 whatever signal handlers it wants -- the PAM documentation doesn't say
240 "oh by the way, if you use PAM, you can't use SIGCHLD."
246 status = pam_authenticate (pamh, 0);
250 fprintf (stderr, "%s: pam_authenticate (...) ==> %d (%s)\n",
251 blurb(), status, PAM_STRERROR(pamh, status));
252 if (status == PAM_SUCCESS) /* Win! */
254 /* Each time we successfully authenticate, refresh credentials,
255 for Kerberos/AFS/DCE/etc. If this fails, just ignore that
256 failure and blunder along; it shouldn't matter.
258 Note: this used to be PAM_REFRESH_CRED instead of
259 PAM_REINITIALIZE_CRED, but Jason Heiss <jheiss@ee.washington.edu>
260 says that the Linux PAM library ignores that one, and only refreshes
261 credentials when using PAM_REINITIALIZE_CRED.
263 int status2 = pam_setcred (pamh, PAM_REINITIALIZE_CRED);
265 fprintf (stderr, "%s: pam_setcred (...) ==> %d (%s)\n",
266 blurb(), status2, PAM_STRERROR(pamh, status2));
270 /* If that didn't work, set the user to root, and try to authenticate again.
272 if (user) free (user);
273 user = strdup ("root");
275 status = pam_set_item (pamh, PAM_USER, c.user);
277 fprintf (stderr, "%s: pam_set_item(p, PAM_USER, \"%s\") ==> %d (%s)\n",
278 blurb(), c.user, status, PAM_STRERROR(pamh, status));
279 if (status != PAM_SUCCESS) goto DONE;
282 status = pam_authenticate (pamh, 0);
284 fprintf (stderr, "%s: pam_authenticate (...) ==> %d (%s)\n",
285 blurb(), status, PAM_STRERROR(pamh, status));
288 if (user) free (user);
291 int status2 = pam_end (pamh, status);
294 fprintf (stderr, "%s: pam_end (...) ==> %d (%s)\n",
296 (status2 == PAM_SUCCESS ? "Success" : "Failure"));
298 return (status == PAM_SUCCESS ? True : False);
303 pam_priv_init (int argc, char **argv, Bool verbose_p)
305 /* We have nothing to do at init-time.
306 However, we might as well do some error checking.
307 If "/etc/pam.d" exists and is a directory, but "/etc/pam.d/xlock"
308 does not exist, warn that PAM probably isn't going to work.
310 This is a priv-init instead of a non-priv init in case the directory
311 is unreadable or something (don't know if that actually happens.)
313 const char dir[] = "/etc/pam.d";
314 const char file[] = "/etc/pam.d/" PAM_SERVICE_NAME;
315 const char file2[] = "/etc/pam.conf";
318 if (stat (dir, &st) == 0 && st.st_mode & S_IFDIR)
320 if (stat (file, &st) != 0)
322 "%s: warning: %s does not exist.\n"
323 "%s: password authentication via PAM is unlikely to work.\n",
324 blurb(), file, blurb());
326 else if (stat (file2, &st) == 0)
328 FILE *f = fopen (file2, "r");
333 while (fgets (buf, sizeof(buf), f))
334 if (strstr (buf, PAM_SERVICE_NAME))
343 "%s: warning: %s does not list the `%s' service.\n"
344 "%s: password authentication via PAM is unlikely to work.\n",
345 blurb(), file2, PAM_SERVICE_NAME, blurb());
348 /* else warn about file2 existing but being unreadable? */
353 "%s: warning: neither %s nor %s exist.\n"
354 "%s: password authentication via PAM is unlikely to work.\n",
355 blurb(), file2, file, blurb());
358 /* Return true anyway, just in case. */
363 /* This is the function PAM calls to have a conversation with the user.
364 Really, this function should be the thing that pops up dialog boxes
365 as needed, and prompts for various strings.
367 But, for now, xscreensaver uses its normal password-prompting dialog
368 first, and then this function simply returns the result that has been
371 This means that if PAM was using a retina scanner for auth, xscreensaver
372 would prompt for a password; then pam_conversation() would be called
373 with a string like "Please look into the retina scanner". The user
374 would never see this string, and the prompted-for password would be
378 pam_conversation (int nmsgs,
379 const struct pam_message **msg,
380 struct pam_response **resp,
384 struct pam_response *reply = 0;
385 struct pam_closure *c = (struct pam_closure *) closure;
387 /* On SunOS 5.6, the `closure' argument always comes in as random garbage. */
388 c = (struct pam_closure *) suns_pam_implementation_blows;
391 reply = (struct pam_response *) calloc (nmsgs, sizeof (*reply));
392 if (!reply) return PAM_CONV_ERR;
394 for (replies = 0; replies < nmsgs; replies++)
396 switch (msg[replies]->msg_style)
398 case PAM_PROMPT_ECHO_ON:
399 reply[replies].resp_retcode = PAM_SUCCESS;
400 reply[replies].resp = strdup (c->user); /* freed by PAM */
402 fprintf (stderr, "%s: PAM ECHO_ON(\"%s\") ==> \"%s\"\n",
403 blurb(), msg[replies]->msg,
404 reply[replies].resp);
406 case PAM_PROMPT_ECHO_OFF:
407 reply[replies].resp_retcode = PAM_SUCCESS;
408 reply[replies].resp = strdup (c->typed_passwd); /* freed by PAM */
410 fprintf (stderr, "%s: PAM ECHO_OFF(\"%s\") ==> password\n",
411 blurb(), msg[replies]->msg);
415 reply[replies].resp_retcode = PAM_SUCCESS;
416 reply[replies].resp = 0;
418 fprintf (stderr, "%s: PAM TEXT_INFO(\"%s\") ==> ignored\n",
419 blurb(), msg[replies]->msg);
423 reply[replies].resp_retcode = PAM_SUCCESS;
424 reply[replies].resp = 0;
426 fprintf (stderr, "%s: PAM ERROR_MSG(\"%s\") ==> ignored\n",
427 blurb(), msg[replies]->msg);
430 /* Must be an error of some sort... */
433 fprintf (stderr, "%s: PAM unknown %d(\"%s\") ==> ignored\n",
434 blurb(), msg[replies]->msg_style, msg[replies]->msg);
442 #endif /* NO_LOCKING -- whole file */