1 /* passwd-pam.c --- verifying typed passwords with PAM
2 * (Pluggable Authentication Modules.)
3 * written by Bill Nottingham <notting@redhat.com> (and jwz) for
4 * xscreensaver, Copyright (c) 1993-2008 Jamie Zawinski <jwz@jwz.org>
6 * Permission to use, copy, modify, distribute, and sell this software and its
7 * documentation for any purpose is hereby granted without fee, provided that
8 * the above copyright notice appear in all copies and that both that
9 * copyright notice and this permission notice appear in supporting
10 * documentation. No representations are made about the suitability of this
11 * software for any purpose. It is provided "as is" without express or
17 * http://www.us.kernel.org/pub/linux/libs/pam/
20 * http://www.us.kernel.org/pub/linux/libs/pam/FAQ
22 * PAM Application Developers' Guide:
23 * http://www.us.kernel.org/pub/linux/libs/pam/Linux-PAM-html/Linux-PAM_ADG.html
25 * PAM Mailing list archives:
26 * http://www.linuxhq.com/lnxlists/linux-pam/
28 * Compatibility notes, especially between Linux and Solaris:
29 * http://www.contrib.andrew.cmu.edu/u/shadow/pam.html
31 * The Open Group's PAM API documentation:
32 * http://www.opengroup.org/onlinepubs/8329799/pam_start.htm
39 #ifndef NO_LOCKING /* whole file */
46 extern char *blurb(void);
51 #include <sys/types.h>
54 #include <security/pam_appl.h>
57 #include <X11/Intrinsic.h>
63 extern sigset_t block_sigchld (void);
64 extern void unblock_sigchld (void);
75 #define countof(x) (sizeof((x))/sizeof(*(x)))
77 /* Some time between Red Hat 4.2 and 7.0, the words were transposed
78 in the various PAM_x_CRED macro names. Yay!
80 #ifndef PAM_REFRESH_CRED
81 # define PAM_REFRESH_CRED PAM_CRED_REFRESH
84 static int pam_conversation (int nmsgs,
85 const struct pam_message **msg,
86 struct pam_response **resp,
89 void pam_try_unlock(saver_info *si, Bool verbose_p,
90 Bool (*valid_p)(const char *typed_passwd, Bool verbose_p));
92 Bool pam_priv_init (int argc, char **argv, Bool verbose_p);
94 #ifdef HAVE_PAM_FAIL_DELAY
95 /* We handle delays ourself.*/
96 /* Don't set this to 0 (Linux bug workaround.) */
97 # define PAM_NO_DELAY(pamh) pam_fail_delay ((pamh), 1)
98 #else /* !HAVE_PAM_FAIL_DELAY */
99 # define PAM_NO_DELAY(pamh) /* */
100 #endif /* !HAVE_PAM_FAIL_DELAY */
103 /* On SunOS 5.6, and on Linux with PAM 0.64, pam_strerror() takes two args.
104 On some other Linux systems with some other version of PAM (e.g.,
105 whichever Debian release comes with a 2.2.5 kernel) it takes one arg.
106 I can't tell which is more "recent" or "correct" behavior, so configure
107 figures out which is in use for us. Shoot me!
109 #ifdef PAM_STRERROR_TWO_ARGS
110 # define PAM_STRERROR(pamh, status) pam_strerror((pamh), (status))
111 #else /* !PAM_STRERROR_TWO_ARGS */
112 # define PAM_STRERROR(pamh, status) pam_strerror((status))
113 #endif /* !PAM_STRERROR_TWO_ARGS */
116 /* PAM sucks in that there is no way to tell whether a particular service
117 is configured at all. That is, there is no way to tell the difference
118 between "authentication of the FOO service is not allowed" and "the
119 user typed the wrong password."
121 On RedHat 5.1 systems, if a service name is not known, it defaults to
122 being not allowed (because the fallback service, /etc/pam.d/other, is
125 On Solaris 2.6 systems, unknown services default to authenticating normally.
127 So, we could simply require that the person who installs xscreensaver
128 set up an "xscreensaver" PAM service. However, if we went that route,
129 it would have a really awful failure mode: the failure mode would be that
130 xscreensaver was willing to *lock* the screen, but would be unwilling to
131 *unlock* the screen. (With the non-PAM password code, the analagous
132 situation -- security not being configured properly, for example do to the
133 executable not being installed as setuid root -- the failure mode is much
134 more palettable, in that xscreensaver will refuse to *lock* the screen,
135 because it can know up front that there is no password that will work.)
137 Another route would be to have the service name to consult be computed at
138 compile-time (perhaps with a configure option.) However, that doesn't
139 really solve the problem, because it means that the same executable might
140 work fine on one machine, but refuse to unlock when run on another
143 Another alternative would be to look in /etc/pam.conf or /etc/pam.d/ at
144 runtime to see what services actually exist. But I think that's no good,
145 because who is to say that the PAM info is actually specified in those
146 files? Opening and reading those files is not a part of the PAM client
147 API, so it's not guarenteed to work on any given system.
149 An alternative I tried was to specify a list of services to try, and to
150 try them all in turn ("xscreensaver", "xlock", "xdm", and "login").
151 This worked, but it was slow (and I also had to do some contortions to
152 work around bugs in Linux PAM 0.64-3.)
154 So what we do today is, try PAM once, and if that fails, try the usual
155 getpwent() method. So if PAM doesn't work, it will at least make an
156 attempt at looking up passwords in /etc/passwd or /etc/shadow instead.
158 This all kind of blows. I'm not sure what else to do.
162 /* On SunOS 5.6, the `pam_conv.appdata_ptr' slot seems to be ignored, and
163 the `closure' argument to pc.conv always comes in as random garbage.
164 So we get around this by using a global variable instead. Shoot me!
166 (I've been told this is bug 4092227, and is fixed in Solaris 7.)
167 (I've also been told that it's fixed in Solaris 2.6 by patch 106257-05.)
169 static void *suns_pam_implementation_blows = 0;
173 * This function is the PAM conversation driver. It conducts a full
174 * authentication round by invoking the GUI with various prompts.
177 pam_try_unlock(saver_info *si, Bool verbose_p,
178 Bool (*valid_p)(const char *typed_passwd, Bool verbose_p))
180 const char *service = PAM_SERVICE_NAME;
181 pam_handle_t *pamh = 0;
185 struct timespec timeout;
187 pc.conv = &pam_conversation;
188 pc.appdata_ptr = (void *) si;
190 /* On SunOS 5.6, the `appdata_ptr' slot seems to be ignored, and the
191 `closure' argument to pc.conv always comes in as random garbage. */
192 suns_pam_implementation_blows = (void *) si;
197 status = pam_start (service, si->user, &pc, &pamh);
199 fprintf (stderr, "%s: pam_start (\"%s\", \"%s\", ...) ==> %d (%s)\n",
200 blurb(), service, si->user,
201 status, PAM_STRERROR (pamh, status));
202 if (status != PAM_SUCCESS) goto DONE;
204 /* #### We should set PAM_TTY to the display we're using, but we
205 don't have that handy from here. So set it to :0.0, which is a
206 good guess (and has the bonus of counting as a "secure tty" as
207 far as PAM is concerned...)
210 char *tty = strdup (":0.0");
211 status = pam_set_item (pamh, PAM_TTY, tty);
213 fprintf (stderr, "%s: pam_set_item (p, PAM_TTY, \"%s\") ==> %d (%s)\n",
214 blurb(), tty, status, PAM_STRERROR(pamh, status));
218 /* Try to authenticate as the current user.
219 We must turn off our SIGCHLD handler for the duration of the call to
220 pam_authenticate(), because in some cases, the underlying PAM code
223 1: fork a setuid subprocess to do some dirty work;
224 2: read a response from that subprocess;
225 3: waitpid(pid, ...) on that subprocess.
227 If we (the ignorant parent process) have a SIGCHLD handler, then there's
228 a race condition between steps 2 and 3: if the subprocess exits before
229 waitpid() was called, then our SIGCHLD handler fires, and gets notified
230 of the subprocess death; then PAM's call to waitpid() fails, because the
231 process has already been reaped.
233 I consider this a bug in PAM, since the caller should be able to have
234 whatever signal handlers it wants -- the PAM documentation doesn't say
235 "oh by the way, if you use PAM, you can't use SIGCHLD."
241 fprintf (stderr, "%s: pam_authenticate (...) ...\n", blurb());
245 set = block_sigchld();
246 status = pam_authenticate (pamh, 0);
247 # ifdef HAVE_SIGTIMEDWAIT
248 sigtimedwait (&set, NULL, &timeout);
249 /* #### What is the portable thing to do if we don't have it? */
250 # endif /* HAVE_SIGTIMEDWAIT */
254 fprintf (stderr, "%s: pam_authenticate (...) ==> %d (%s)\n",
255 blurb(), status, PAM_STRERROR(pamh, status));
257 if (status == PAM_SUCCESS) /* Win! */
261 /* We don't actually care if the account modules fail or succeed,
262 * but we need to run them anyway because certain pam modules
263 * depend on side effects of the account modules getting run.
265 status2 = pam_acct_mgmt (pamh, 0);
268 fprintf (stderr, "%s: pam_acct_mgmt (...) ==> %d (%s)\n",
269 blurb(), status2, PAM_STRERROR(pamh, status2));
271 /* HPUX for some reason likes to make PAM defines different from
272 * everyone else's. */
273 #ifdef PAM_AUTHTOKEN_REQD
274 if (status2 == PAM_AUTHTOKEN_REQD)
276 if (status2 == PAM_NEW_AUTHTOK_REQD)
279 status2 = pam_chauthtok (pamh, PAM_CHANGE_EXPIRED_AUTHTOK);
281 fprintf (stderr, "%s: pam_chauthtok (...) ==> %d (%s)\n",
282 blurb(), status2, PAM_STRERROR(pamh, status2));
285 /* Each time we successfully authenticate, refresh credentials,
286 for Kerberos/AFS/DCE/etc. If this fails, just ignore that
287 failure and blunder along; it shouldn't matter.
289 Note: this used to be PAM_REFRESH_CRED instead of
290 PAM_REINITIALIZE_CRED, but Jason Heiss <jheiss@ee.washington.edu>
291 says that the Linux PAM library ignores that one, and only refreshes
292 credentials when using PAM_REINITIALIZE_CRED.
294 status2 = pam_setcred (pamh, PAM_REINITIALIZE_CRED);
296 fprintf (stderr, "%s: pam_setcred (...) ==> %d (%s)\n",
297 blurb(), status2, PAM_STRERROR(pamh, status2));
303 int status2 = pam_end (pamh, status);
306 fprintf (stderr, "%s: pam_end (...) ==> %d (%s)\n",
308 (status2 == PAM_SUCCESS ? "Success" : "Failure"));
311 if (status == PAM_SUCCESS)
312 si->unlock_state = ul_success; /* yay */
313 else if (si->unlock_state == ul_cancel ||
314 si->unlock_state == ul_time)
315 ; /* more specific failures ok */
317 si->unlock_state = ul_fail; /* generic failure */
322 pam_priv_init (int argc, char **argv, Bool verbose_p)
324 /* We have nothing to do at init-time.
325 However, we might as well do some error checking.
326 If "/etc/pam.d" exists and is a directory, but "/etc/pam.d/xlock"
327 does not exist, warn that PAM probably isn't going to work.
329 This is a priv-init instead of a non-priv init in case the directory
330 is unreadable or something (don't know if that actually happens.)
332 const char dir[] = "/etc/pam.d";
333 const char file[] = "/etc/pam.d/" PAM_SERVICE_NAME;
334 const char file2[] = "/etc/pam.conf";
338 # define S_ISDIR(mode) (((mode) & S_IFMT) == S_IFDIR)
341 if (stat (dir, &st) == 0 && S_ISDIR(st.st_mode))
343 if (stat (file, &st) != 0)
345 "%s: warning: %s does not exist.\n"
346 "%s: password authentication via PAM is unlikely to work.\n",
347 blurb(), file, blurb());
349 else if (stat (file2, &st) == 0)
351 FILE *f = fopen (file2, "r");
356 while (fgets (buf, sizeof(buf), f))
357 if (strstr (buf, PAM_SERVICE_NAME))
366 "%s: warning: %s does not list the `%s' service.\n"
367 "%s: password authentication via PAM is unlikely to work.\n",
368 blurb(), file2, PAM_SERVICE_NAME, blurb());
371 /* else warn about file2 existing but being unreadable? */
376 "%s: warning: neither %s nor %s exist.\n"
377 "%s: password authentication via PAM is unlikely to work.\n",
378 blurb(), file2, file, blurb());
381 /* Return true anyway, just in case. */
387 pam_conversation (int nmsgs,
388 const struct pam_message **msg,
389 struct pam_response **resp,
393 struct auth_message *messages = 0;
394 struct auth_response *authresp = 0;
395 struct pam_response *pam_responses;
396 saver_info *si = (saver_info *) vsaver_info;
399 /* On SunOS 5.6, the `closure' argument always comes in as random garbage. */
400 si = (saver_info *) suns_pam_implementation_blows;
402 verbose_p = si->prefs.verbose_p;
404 /* Converting the PAM prompts into the XScreenSaver native format.
405 * It was a design goal to collapse (INFO,PROMPT) pairs from PAM
406 * into a single call to the unlock_cb function. The unlock_cb function
407 * does that, but only if it is passed several prompts at a time. Most PAM
408 * modules only send a single prompt at a time, but because there is no way
409 * of telling whether there will be more prompts to follow, we can only ever
410 * pass along whatever was passed in here.
413 messages = calloc(nmsgs, sizeof(struct auth_message));
414 pam_responses = calloc(nmsgs, sizeof(*pam_responses));
416 if (!pam_responses || !messages)
420 fprintf (stderr, "%s: pam_conversation (", blurb());
422 for (i = 0; i < nmsgs; ++i)
424 if (verbose_p && i > 0) fprintf (stderr, ", ");
426 messages[i].msg = msg[i]->msg;
428 switch (msg[i]->msg_style) {
429 case PAM_PROMPT_ECHO_OFF: messages[i].type = AUTH_MSGTYPE_PROMPT_NOECHO;
430 if (verbose_p) fprintf (stderr, "ECHO_OFF");
432 case PAM_PROMPT_ECHO_ON: messages[i].type = AUTH_MSGTYPE_PROMPT_ECHO;
433 if (verbose_p) fprintf (stderr, "ECHO_ON");
435 case PAM_ERROR_MSG: messages[i].type = AUTH_MSGTYPE_ERROR;
436 if (verbose_p) fprintf (stderr, "ERROR_MSG");
438 case PAM_TEXT_INFO: messages[i].type = AUTH_MSGTYPE_INFO;
439 if (verbose_p) fprintf (stderr, "TEXT_INFO");
441 default: messages[i].type = AUTH_MSGTYPE_PROMPT_ECHO;
442 if (verbose_p) fprintf (stderr, "PROMPT_ECHO");
447 fprintf (stderr, "=\"%s\"", msg[i]->msg ? msg[i]->msg : "(null)");
451 fprintf (stderr, ") ...\n");
453 ret = si->unlock_cb(nmsgs, messages, &authresp, si);
457 for (i = 0; i < nmsgs; ++i)
458 pam_responses[i].resp = authresp[i].response;
469 fprintf (stderr, "%s: pam_conversation (...) ==> %s\n", blurb(),
470 (ret == 0 ? "PAM_SUCCESS" : "PAM_CONV_ERR"));
474 *resp = pam_responses;
485 #endif /* NO_LOCKING -- whole file */