1 /* passwd-pam.c --- verifying typed passwords with PAM
2 * (Pluggable Authentication Modules.)
3 * written by Bill Nottingham <notting@redhat.com> (and jwz) for
4 * xscreensaver, Copyright (c) 1993-2003 Jamie Zawinski <jwz@jwz.org>
6 * Permission to use, copy, modify, distribute, and sell this software and its
7 * documentation for any purpose is hereby granted without fee, provided that
8 * the above copyright notice appear in all copies and that both that
9 * copyright notice and this permission notice appear in supporting
10 * documentation. No representations are made about the suitability of this
11 * software for any purpose. It is provided "as is" without express or
17 * http://www.us.kernel.org/pub/linux/libs/pam/
20 * http://www.us.kernel.org/pub/linux/libs/pam/FAQ
22 * PAM Application Developers' Guide:
23 * http://www.us.kernel.org/pub/linux/libs/pam/Linux-PAM-html/pam_appl.html
25 * PAM Mailing list archives:
26 * http://www.linuxhq.com/lnxlists/linux-pam/
28 * Compatibility notes, especially between Linux and Solaris:
29 * http://www.contrib.andrew.cmu.edu/u/shadow/pam.html
31 * The Open Group's PAM API documentation:
32 * http://www.opengroup.org/onlinepubs/8329799/pam_start.htm
39 #ifndef NO_LOCKING /* whole file */
46 extern char *blurb(void);
51 #include <sys/types.h>
54 #include <security/pam_appl.h>
60 extern sigset_t block_sigchld (void);
61 extern void unblock_sigchld (void);
72 #define countof(x) (sizeof((x))/sizeof(*(x)))
74 /* Some time between Red Hat 4.2 and 7.0, the words were transposed
75 in the various PAM_x_CRED macro names. Yay!
77 #ifndef PAM_REFRESH_CRED
78 # define PAM_REFRESH_CRED PAM_CRED_REFRESH
81 static int pam_conversation (int nmsgs,
82 const struct pam_message **msg,
83 struct pam_response **resp,
88 const char *typed_passwd;
92 Bool pam_passwd_valid_p (const char *typed_passwd, Bool verbose_p);
93 Bool pam_priv_init (int argc, char **argv, Bool verbose_p);
95 #ifdef HAVE_PAM_FAIL_DELAY
96 /* We handle delays ourself.*/
97 /* Don't set this to 0 (Linux bug workaround.) */
98 # define PAM_NO_DELAY(pamh) pam_fail_delay ((pamh), 1)
99 #else /* !HAVE_PAM_FAIL_DELAY */
100 # define PAM_NO_DELAY(pamh) /* */
101 #endif /* !HAVE_PAM_FAIL_DELAY */
104 /* On SunOS 5.6, and on Linux with PAM 0.64, pam_strerror() takes two args.
105 On some other Linux systems with some other version of PAM (e.g.,
106 whichever Debian release comes with a 2.2.5 kernel) it takes one arg.
107 I can't tell which is more "recent" or "correct" behavior, so configure
108 figures out which is in use for us. Shoot me!
110 #ifdef PAM_STRERROR_TWO_ARGS
111 # define PAM_STRERROR(pamh, status) pam_strerror((pamh), (status))
112 #else /* !PAM_STRERROR_TWO_ARGS */
113 # define PAM_STRERROR(pamh, status) pam_strerror((status))
114 #endif /* !PAM_STRERROR_TWO_ARGS */
117 /* PAM sucks in that there is no way to tell whether a particular service
118 is configured at all. That is, there is no way to tell the difference
119 between "authentication of the FOO service is not allowed" and "the
120 user typed the wrong password."
122 On RedHat 5.1 systems, if a service name is not known, it defaults to
123 being not allowed (because the fallback service, /etc/pam.d/other, is
126 On Solaris 2.6 systems, unknown services default to authenticating normally.
128 So, we could simply require that the person who installs xscreensaver
129 set up an "xscreensaver" PAM service. However, if we went that route,
130 it would have a really awful failure mode: the failure mode would be that
131 xscreensaver was willing to *lock* the screen, but would be unwilling to
132 *unlock* the screen. (With the non-PAM password code, the analagous
133 situation -- security not being configured properly, for example do to the
134 executable not being installed as setuid root -- the failure mode is much
135 more palettable, in that xscreensaver will refuse to *lock* the screen,
136 because it can know up front that there is no password that will work.)
138 Another route would be to have the service name to consult be computed at
139 compile-time (perhaps with a configure option.) However, that doesn't
140 really solve the problem, because it means that the same executable might
141 work fine on one machine, but refuse to unlock when run on another
144 Another alternative would be to look in /etc/pam.conf or /etc/pam.d/ at
145 runtime to see what services actually exist. But I think that's no good,
146 because who is to say that the PAM info is actually specified in those
147 files? Opening and reading those files is not a part of the PAM client
148 API, so it's not guarenteed to work on any given system.
150 An alternative I tried was to specify a list of services to try, and to
151 try them all in turn ("xscreensaver", "xlock", "xdm", and "login").
152 This worked, but it was slow (and I also had to do some contortions to
153 work around bugs in Linux PAM 0.64-3.)
155 So what we do today is, try PAM once, and if that fails, try the usual
156 getpwent() method. So if PAM doesn't work, it will at least make an
157 attempt at looking up passwords in /etc/passwd or /etc/shadow instead.
159 This all kind of blows. I'm not sure what else to do.
163 /* On SunOS 5.6, the `pam_conv.appdata_ptr' slot seems to be ignored, and
164 the `closure' argument to pc.conv always comes in as random garbage.
165 So we get around this by using a global variable instead. Shoot me!
167 (I've been told this is bug 4092227, and is fixed in Solaris 7.)
168 (I've also been told that it's fixed in Solaris 2.6 by patch 106257-05.)
170 static void *suns_pam_implementation_blows = 0;
173 /* This can be called at any time, and says whether the typed password
174 belongs to either the logged in user (real uid, not effective); or
178 pam_passwd_valid_p (const char *typed_passwd, Bool verbose_p)
180 const char *service = PAM_SERVICE_NAME;
181 pam_handle_t *pamh = 0;
184 struct pam_closure c;
187 struct timespec timeout;
189 struct passwd *p = getpwuid (getuid ());
190 if (!p) return False;
192 user = strdup (p->pw_name);
195 c.typed_passwd = typed_passwd;
196 c.verbose_p = verbose_p;
198 pc.conv = &pam_conversation;
199 pc.appdata_ptr = (void *) &c;
201 /* On SunOS 5.6, the `appdata_ptr' slot seems to be ignored, and the
202 `closure' argument to pc.conv always comes in as random garbage. */
203 suns_pam_implementation_blows = (void *) &c;
208 status = pam_start (service, c.user, &pc, &pamh);
210 fprintf (stderr, "%s: pam_start (\"%s\", \"%s\", ...) ==> %d (%s)\n",
211 blurb(), service, c.user,
212 status, PAM_STRERROR (pamh, status));
213 if (status != PAM_SUCCESS) goto DONE;
215 /* #### We should set PAM_TTY to the display we're using, but we
216 don't have that handy from here. So set it to :0.0, which is a
217 good guess (and has the bonus of counting as a "secure tty" as
218 far as PAM is concerned...)
221 char *tty = strdup (":0.0");
222 status = pam_set_item (pamh, PAM_TTY, tty);
224 fprintf (stderr, "%s: pam_set_item (p, PAM_TTY, \"%s\") ==> %d (%s)\n",
225 blurb(), tty, status, PAM_STRERROR(pamh, status));
229 /* Try to authenticate as the current user.
230 We must turn off our SIGCHLD handler for the duration of the call to
231 pam_authenticate(), because in some cases, the underlying PAM code
234 1: fork a setuid subprocess to do some dirty work;
235 2: read a response from that subprocess;
236 3: waitpid(pid, ...) on that subprocess.
238 If we (the ignorant parent process) have a SIGCHLD handler, then there's
239 a race condition between steps 2 and 3: if the subprocess exits before
240 waitpid() was called, then our SIGCHLD handler fires, and gets notified
241 of the subprocess death; then PAM's call to waitpid() fails, because the
242 process has already been reaped.
244 I consider this a bug in PAM, since the caller should be able to have
245 whatever signal handlers it wants -- the PAM documentation doesn't say
246 "oh by the way, if you use PAM, you can't use SIGCHLD."
253 set = block_sigchld();
254 status = pam_authenticate (pamh, 0);
255 sigtimedwait (&set, NULL, &timeout);
259 fprintf (stderr, "%s: pam_authenticate (...) ==> %d (%s)\n",
260 blurb(), status, PAM_STRERROR(pamh, status));
261 if (status == PAM_SUCCESS) /* Win! */
265 /* We don't actually care if the account modules fail or succeed,
266 * but we need to run them anyway because certain pam modules
267 * depend on side effects of the account modules getting run.
269 status2 = pam_acct_mgmt (pamh, 0);
272 fprintf (stderr, "%s: pam_acct_mgmt (...) ==> %d (%s)\n",
273 blurb(), status2, PAM_STRERROR(pamh, status2));
275 /* Each time we successfully authenticate, refresh credentials,
276 for Kerberos/AFS/DCE/etc. If this fails, just ignore that
277 failure and blunder along; it shouldn't matter.
279 Note: this used to be PAM_REFRESH_CRED instead of
280 PAM_REINITIALIZE_CRED, but Jason Heiss <jheiss@ee.washington.edu>
281 says that the Linux PAM library ignores that one, and only refreshes
282 credentials when using PAM_REINITIALIZE_CRED.
284 status2 = pam_setcred (pamh, PAM_REINITIALIZE_CRED);
286 fprintf (stderr, "%s: pam_setcred (...) ==> %d (%s)\n",
287 blurb(), status2, PAM_STRERROR(pamh, status2));
291 /* If that didn't work, set the user to root, and try to authenticate again.
293 if (user) free (user);
294 user = strdup ("root");
296 status = pam_set_item (pamh, PAM_USER, c.user);
298 fprintf (stderr, "%s: pam_set_item(p, PAM_USER, \"%s\") ==> %d (%s)\n",
299 blurb(), c.user, status, PAM_STRERROR(pamh, status));
300 if (status != PAM_SUCCESS) goto DONE;
304 set = block_sigchld();
305 status = pam_authenticate (pamh, 0);
306 sigtimedwait(&set, NULL, &timeout);
310 fprintf (stderr, "%s: pam_authenticate (...) ==> %d (%s)\n",
311 blurb(), status, PAM_STRERROR(pamh, status));
314 if (user) free (user);
317 int status2 = pam_end (pamh, status);
320 fprintf (stderr, "%s: pam_end (...) ==> %d (%s)\n",
322 (status2 == PAM_SUCCESS ? "Success" : "Failure"));
324 return (status == PAM_SUCCESS ? True : False);
329 pam_priv_init (int argc, char **argv, Bool verbose_p)
331 /* We have nothing to do at init-time.
332 However, we might as well do some error checking.
333 If "/etc/pam.d" exists and is a directory, but "/etc/pam.d/xlock"
334 does not exist, warn that PAM probably isn't going to work.
336 This is a priv-init instead of a non-priv init in case the directory
337 is unreadable or something (don't know if that actually happens.)
339 const char dir[] = "/etc/pam.d";
340 const char file[] = "/etc/pam.d/" PAM_SERVICE_NAME;
341 const char file2[] = "/etc/pam.conf";
345 # define S_ISDIR(mode) (((mode) & S_IFMT) == S_IFDIR)
348 if (stat (dir, &st) == 0 && S_ISDIR(st.st_mode))
350 if (stat (file, &st) != 0)
352 "%s: warning: %s does not exist.\n"
353 "%s: password authentication via PAM is unlikely to work.\n",
354 blurb(), file, blurb());
356 else if (stat (file2, &st) == 0)
358 FILE *f = fopen (file2, "r");
363 while (fgets (buf, sizeof(buf), f))
364 if (strstr (buf, PAM_SERVICE_NAME))
373 "%s: warning: %s does not list the `%s' service.\n"
374 "%s: password authentication via PAM is unlikely to work.\n",
375 blurb(), file2, PAM_SERVICE_NAME, blurb());
378 /* else warn about file2 existing but being unreadable? */
383 "%s: warning: neither %s nor %s exist.\n"
384 "%s: password authentication via PAM is unlikely to work.\n",
385 blurb(), file2, file, blurb());
388 /* Return true anyway, just in case. */
393 /* This is the function PAM calls to have a conversation with the user.
394 Really, this function should be the thing that pops up dialog boxes
395 as needed, and prompts for various strings.
397 But, for now, xscreensaver uses its normal password-prompting dialog
398 first, and then this function simply returns the result that has been
401 This means that if PAM was using a retina scanner for auth, xscreensaver
402 would prompt for a password; then pam_conversation() would be called
403 with a string like "Please look into the retina scanner". The user
404 would never see this string, and the prompted-for password would be
408 pam_conversation (int nmsgs,
409 const struct pam_message **msg,
410 struct pam_response **resp,
414 struct pam_response *reply = 0;
415 struct pam_closure *c = (struct pam_closure *) closure;
417 /* On SunOS 5.6, the `closure' argument always comes in as random garbage. */
418 c = (struct pam_closure *) suns_pam_implementation_blows;
421 reply = (struct pam_response *) calloc (nmsgs, sizeof (*reply));
422 if (!reply) return PAM_CONV_ERR;
424 for (replies = 0; replies < nmsgs; replies++)
426 switch (msg[replies]->msg_style)
428 case PAM_PROMPT_ECHO_ON:
429 reply[replies].resp_retcode = PAM_SUCCESS;
430 reply[replies].resp = strdup (c->user); /* freed by PAM */
432 fprintf (stderr, "%s: PAM ECHO_ON(\"%s\") ==> \"%s\"\n",
433 blurb(), msg[replies]->msg,
434 reply[replies].resp);
436 case PAM_PROMPT_ECHO_OFF:
437 reply[replies].resp_retcode = PAM_SUCCESS;
438 reply[replies].resp = strdup (c->typed_passwd); /* freed by PAM */
440 fprintf (stderr, "%s: PAM ECHO_OFF(\"%s\") ==> password\n",
441 blurb(), msg[replies]->msg);
445 reply[replies].resp_retcode = PAM_SUCCESS;
446 reply[replies].resp = 0;
448 fprintf (stderr, "%s: PAM TEXT_INFO(\"%s\") ==> ignored\n",
449 blurb(), msg[replies]->msg);
453 reply[replies].resp_retcode = PAM_SUCCESS;
454 reply[replies].resp = 0;
456 fprintf (stderr, "%s: PAM ERROR_MSG(\"%s\") ==> ignored\n",
457 blurb(), msg[replies]->msg);
460 /* Must be an error of some sort... */
463 fprintf (stderr, "%s: PAM unknown %d(\"%s\") ==> ignored\n",
464 blurb(), msg[replies]->msg_style, msg[replies]->msg);
472 #endif /* NO_LOCKING -- whole file */