1 /* passwd-pam.c --- verifying typed passwords with PAM
2 * (Pluggable Authentication Modules.)
3 * written by Bill Nottingham <notting@redhat.com> (and jwz) for
4 * xscreensaver, Copyright (c) 1993-2017 Jamie Zawinski <jwz@jwz.org>
6 * Permission to use, copy, modify, distribute, and sell this software and its
7 * documentation for any purpose is hereby granted without fee, provided that
8 * the above copyright notice appear in all copies and that both that
9 * copyright notice and this permission notice appear in supporting
10 * documentation. No representations are made about the suitability of this
11 * software for any purpose. It is provided "as is" without express or
17 * http://www.us.kernel.org/pub/linux/libs/pam/
20 * http://www.us.kernel.org/pub/linux/libs/pam/FAQ
22 * PAM Application Developers' Guide:
23 * http://www.us.kernel.org/pub/linux/libs/pam/Linux-PAM-html/Linux-PAM_ADG.html
25 * PAM Mailing list archives:
26 * http://www.linuxhq.com/lnxlists/linux-pam/
28 * Compatibility notes, especially between Linux and Solaris:
29 * http://www.contrib.andrew.cmu.edu/u/shadow/pam.html
31 * The Open Group's PAM API documentation:
32 * http://www.opengroup.org/onlinepubs/8329799/pam_start.htm
39 #ifndef NO_LOCKING /* whole file */
46 extern char *blurb(void);
51 #include <sys/types.h>
54 #include <security/pam_appl.h>
57 #include <X11/Intrinsic.h>
63 extern sigset_t block_sigchld (void);
64 extern void unblock_sigchld (void);
75 #define countof(x) (sizeof((x))/sizeof(*(x)))
77 /* Some time between Red Hat 4.2 and 7.0, the words were transposed
78 in the various PAM_x_CRED macro names. Yay!
80 #if !defined(PAM_REFRESH_CRED) && defined(PAM_CRED_REFRESH)
81 # define PAM_REFRESH_CRED PAM_CRED_REFRESH
83 #if !defined(PAM_REINITIALIZE_CRED) && defined(PAM_CRED_REINITIALIZE)
84 # define PAM_REINITIALIZE_CRED PAM_CRED_REINITIALIZE
87 static int pam_conversation (int nmsgs,
88 const struct pam_message **msg,
89 struct pam_response **resp,
92 void pam_try_unlock(saver_info *si, Bool verbose_p,
93 Bool (*valid_p)(const char *typed_passwd, Bool verbose_p));
95 Bool pam_priv_init (int argc, char **argv, Bool verbose_p);
97 #ifdef HAVE_PAM_FAIL_DELAY
98 /* We handle delays ourself.*/
99 /* Don't set this to 0 (Linux bug workaround.) */
100 # define PAM_NO_DELAY(pamh) pam_fail_delay ((pamh), 1)
101 #else /* !HAVE_PAM_FAIL_DELAY */
102 # define PAM_NO_DELAY(pamh) /* */
103 #endif /* !HAVE_PAM_FAIL_DELAY */
106 /* On SunOS 5.6, and on Linux with PAM 0.64, pam_strerror() takes two args.
107 On some other Linux systems with some other version of PAM (e.g.,
108 whichever Debian release comes with a 2.2.5 kernel) it takes one arg.
109 I can't tell which is more "recent" or "correct" behavior, so configure
110 figures out which is in use for us. Shoot me!
112 #ifdef PAM_STRERROR_TWO_ARGS
113 # define PAM_STRERROR(pamh, status) pam_strerror((pamh), (status))
114 #else /* !PAM_STRERROR_TWO_ARGS */
115 # define PAM_STRERROR(pamh, status) pam_strerror((status))
116 #endif /* !PAM_STRERROR_TWO_ARGS */
119 /* PAM sucks in that there is no way to tell whether a particular service
120 is configured at all. That is, there is no way to tell the difference
121 between "authentication of the FOO service is not allowed" and "the
122 user typed the wrong password."
124 On RedHat 5.1 systems, if a service name is not known, it defaults to
125 being not allowed (because the fallback service, /etc/pam.d/other, is
128 On Solaris 2.6 systems, unknown services default to authenticating normally.
130 So, we could simply require that the person who installs xscreensaver
131 set up an "xscreensaver" PAM service. However, if we went that route,
132 it would have a really awful failure mode: the failure mode would be that
133 xscreensaver was willing to *lock* the screen, but would be unwilling to
134 *unlock* the screen. (With the non-PAM password code, the analagous
135 situation -- security not being configured properly, for example do to the
136 executable not being installed as setuid root -- the failure mode is much
137 more palettable, in that xscreensaver will refuse to *lock* the screen,
138 because it can know up front that there is no password that will work.)
140 Another route would be to have the service name to consult be computed at
141 compile-time (perhaps with a configure option.) However, that doesn't
142 really solve the problem, because it means that the same executable might
143 work fine on one machine, but refuse to unlock when run on another
146 Another alternative would be to look in /etc/pam.conf or /etc/pam.d/ at
147 runtime to see what services actually exist. But I think that's no good,
148 because who is to say that the PAM info is actually specified in those
149 files? Opening and reading those files is not a part of the PAM client
150 API, so it's not guarenteed to work on any given system.
152 An alternative I tried was to specify a list of services to try, and to
153 try them all in turn ("xscreensaver", "xlock", "xdm", and "login").
154 This worked, but it was slow (and I also had to do some contortions to
155 work around bugs in Linux PAM 0.64-3.)
157 So what we do today is, try PAM once, and if that fails, try the usual
158 getpwent() method. So if PAM doesn't work, it will at least make an
159 attempt at looking up passwords in /etc/passwd or /etc/shadow instead.
161 This all kind of blows. I'm not sure what else to do.
165 /* On SunOS 5.6, the `pam_conv.appdata_ptr' slot seems to be ignored, and
166 the `closure' argument to pc.conv always comes in as random garbage.
167 So we get around this by using a global variable instead. Shoot me!
169 (I've been told this is bug 4092227, and is fixed in Solaris 7.)
170 (I've also been told that it's fixed in Solaris 2.6 by patch 106257-05.)
172 static void *suns_pam_implementation_blows = 0;
176 * This function is the PAM conversation driver. It conducts a full
177 * authentication round by invoking the GUI with various prompts.
180 pam_try_unlock(saver_info *si, Bool verbose_p,
181 Bool (*valid_p)(const char *typed_passwd, Bool verbose_p))
183 const char *service = PAM_SERVICE_NAME;
184 pam_handle_t *pamh = 0;
187 # ifdef HAVE_SIGTIMEDWAIT
189 struct timespec timeout;
190 # endif /* HAVE_SIGTIMEDWAIT */
192 pc.conv = &pam_conversation;
193 pc.appdata_ptr = (void *) si;
195 /* On SunOS 5.6, the `appdata_ptr' slot seems to be ignored, and the
196 `closure' argument to pc.conv always comes in as random garbage. */
197 suns_pam_implementation_blows = (void *) si;
202 status = pam_start (service, si->user, &pc, &pamh);
204 fprintf (stderr, "%s: pam_start (\"%s\", \"%s\", ...) ==> %d (%s)\n",
205 blurb(), service, si->user,
206 status, PAM_STRERROR (pamh, status));
207 if (status != PAM_SUCCESS) goto DONE;
209 /* #### We should set PAM_TTY to the display we're using, but we
210 don't have that handy from here. So set it to :0.0, which is a
211 good guess (and has the bonus of counting as a "secure tty" as
212 far as PAM is concerned...)
215 char *tty = strdup (":0.0");
216 status = pam_set_item (pamh, PAM_TTY, tty);
218 fprintf (stderr, "%s: pam_set_item (p, PAM_TTY, \"%s\") ==> %d (%s)\n",
219 blurb(), tty, status, PAM_STRERROR(pamh, status));
223 /* Try to authenticate as the current user.
224 We must turn off our SIGCHLD handler for the duration of the call to
225 pam_authenticate(), because in some cases, the underlying PAM code
228 1: fork a setuid subprocess to do some dirty work;
229 2: read a response from that subprocess;
230 3: waitpid(pid, ...) on that subprocess.
232 If we (the ignorant parent process) have a SIGCHLD handler, then there's
233 a race condition between steps 2 and 3: if the subprocess exits before
234 waitpid() was called, then our SIGCHLD handler fires, and gets notified
235 of the subprocess death; then PAM's call to waitpid() fails, because the
236 process has already been reaped.
238 I consider this a bug in PAM, since the caller should be able to have
239 whatever signal handlers it wants -- the PAM documentation doesn't say
240 "oh by the way, if you use PAM, you can't use SIGCHLD."
246 fprintf (stderr, "%s: pam_authenticate (...) ...\n", blurb());
248 # ifdef HAVE_SIGTIMEDWAIT
252 # endif /* HAVE_SIGTIMEDWAIT */
254 status = pam_authenticate (pamh, 0);
255 # ifdef HAVE_SIGTIMEDWAIT
256 sigtimedwait (&set, NULL, &timeout);
257 /* #### What is the portable thing to do if we don't have it? */
258 # endif /* HAVE_SIGTIMEDWAIT */
262 fprintf (stderr, "%s: pam_authenticate (...) ==> %d (%s)\n",
263 blurb(), status, PAM_STRERROR(pamh, status));
265 if (status == PAM_SUCCESS) /* Win! */
269 /* On most systems, it doesn't matter whether the account modules
270 are run, or whether they fail or succeed.
272 On some systems, the account modules fail, because they were
273 never configured properly, but it's necessary to run them anyway
274 because certain PAM modules depend on side effects of the account
275 modules having been run.
277 And on still other systems, the account modules are actually
278 used, and failures in them should be considered to be true!
281 - We run the account modules on all systems.
282 - Whether we ignore them is a configure option.
284 It's all kind of a mess.
286 status2 = pam_acct_mgmt (pamh, 0);
289 fprintf (stderr, "%s: pam_acct_mgmt (...) ==> %d (%s)\n",
290 blurb(), status2, PAM_STRERROR(pamh, status2));
292 /* HPUX for some reason likes to make PAM defines different from
293 * everyone else's. */
294 #ifdef PAM_AUTHTOKEN_REQD
295 if (status2 == PAM_AUTHTOKEN_REQD)
297 if (status2 == PAM_NEW_AUTHTOK_REQD)
300 status2 = pam_chauthtok (pamh, PAM_CHANGE_EXPIRED_AUTHTOK);
302 fprintf (stderr, "%s: pam_chauthtok (...) ==> %d (%s)\n",
303 blurb(), status2, PAM_STRERROR(pamh, status2));
306 /* If 'configure' requested that we believe the results of PAM
307 account module failures, then obey that status code.
310 #ifdef PAM_CHECK_ACCOUNT_TYPE
314 /* Each time we successfully authenticate, refresh credentials,
315 for Kerberos/AFS/DCE/etc. If this fails, just ignore that
316 failure and blunder along; it shouldn't matter.
319 #if defined(__linux__)
320 /* Apparently the Linux PAM library ignores PAM_REFRESH_CRED and only
321 refreshes credentials when using PAM_REINITIALIZE_CRED. */
322 status2 = pam_setcred (pamh, PAM_REINITIALIZE_CRED);
324 /* But Solaris requires PAM_REFRESH_CRED or extra prompts appear. */
325 status2 = pam_setcred (pamh, PAM_REFRESH_CRED);
329 fprintf (stderr, "%s: pam_setcred (...) ==> %d (%s)\n",
330 blurb(), status2, PAM_STRERROR(pamh, status2));
336 int status2 = pam_end (pamh, status);
339 fprintf (stderr, "%s: pam_end (...) ==> %d (%s)\n",
341 (status2 == PAM_SUCCESS ? "Success" : "Failure"));
344 if (status == PAM_SUCCESS)
345 si->unlock_state = ul_success; /* yay */
346 else if (si->unlock_state == ul_cancel ||
347 si->unlock_state == ul_time)
348 ; /* more specific failures ok */
350 si->unlock_state = ul_fail; /* generic failure */
355 pam_priv_init (int argc, char **argv, Bool verbose_p)
357 /* We have nothing to do at init-time.
358 However, we might as well do some error checking.
359 If "/etc/pam.d" exists and is a directory, but "/etc/pam.d/xlock"
360 does not exist, warn that PAM probably isn't going to work.
362 This is a priv-init instead of a non-priv init in case the directory
363 is unreadable or something (don't know if that actually happens.)
365 const char dir[] = "/etc/pam.d";
366 const char file[] = "/etc/pam.d/" PAM_SERVICE_NAME;
367 const char file2[] = "/etc/pam.conf";
371 # define S_ISDIR(mode) (((mode) & S_IFMT) == S_IFDIR)
374 if (stat (dir, &st) == 0 && S_ISDIR(st.st_mode))
376 if (stat (file, &st) != 0)
378 "%s: warning: %s does not exist.\n"
379 "%s: password authentication via PAM is unlikely to work.\n",
380 blurb(), file, blurb());
382 else if (stat (file2, &st) == 0)
384 FILE *f = fopen (file2, "r");
389 while (fgets (buf, sizeof(buf), f))
390 if (strstr (buf, PAM_SERVICE_NAME))
399 "%s: warning: %s does not list the `%s' service.\n"
400 "%s: password authentication via PAM is unlikely to work.\n",
401 blurb(), file2, PAM_SERVICE_NAME, blurb());
404 /* else warn about file2 existing but being unreadable? */
409 "%s: warning: neither %s nor %s exist.\n"
410 "%s: password authentication via PAM is unlikely to work.\n",
411 blurb(), file2, file, blurb());
414 /* Return true anyway, just in case. */
420 pam_conversation (int nmsgs,
421 const struct pam_message **msg,
422 struct pam_response **resp,
426 struct auth_message *messages = 0;
427 struct auth_response *authresp = 0;
428 struct pam_response *pam_responses;
429 saver_info *si = (saver_info *) vsaver_info;
432 /* On SunOS 5.6, the `closure' argument always comes in as random garbage. */
433 si = (saver_info *) suns_pam_implementation_blows;
435 verbose_p = si->prefs.verbose_p;
437 /* Converting the PAM prompts into the XScreenSaver native format.
438 * It was a design goal to collapse (INFO,PROMPT) pairs from PAM
439 * into a single call to the unlock_cb function. The unlock_cb function
440 * does that, but only if it is passed several prompts at a time. Most PAM
441 * modules only send a single prompt at a time, but because there is no way
442 * of telling whether there will be more prompts to follow, we can only ever
443 * pass along whatever was passed in here.
446 messages = calloc(nmsgs, sizeof(struct auth_message));
447 pam_responses = calloc(nmsgs, sizeof(*pam_responses));
449 if (!pam_responses || !messages)
453 fprintf (stderr, "%s: pam_conversation (", blurb());
455 for (i = 0; i < nmsgs; ++i)
457 if (verbose_p && i > 0) fprintf (stderr, ", ");
459 messages[i].msg = msg[i]->msg;
461 switch (msg[i]->msg_style) {
462 case PAM_PROMPT_ECHO_OFF: messages[i].type = AUTH_MSGTYPE_PROMPT_NOECHO;
463 if (verbose_p) fprintf (stderr, "ECHO_OFF");
465 case PAM_PROMPT_ECHO_ON: messages[i].type = AUTH_MSGTYPE_PROMPT_ECHO;
466 if (verbose_p) fprintf (stderr, "ECHO_ON");
468 case PAM_ERROR_MSG: messages[i].type = AUTH_MSGTYPE_ERROR;
469 if (verbose_p) fprintf (stderr, "ERROR_MSG");
471 case PAM_TEXT_INFO: messages[i].type = AUTH_MSGTYPE_INFO;
472 if (verbose_p) fprintf (stderr, "TEXT_INFO");
474 default: messages[i].type = AUTH_MSGTYPE_PROMPT_ECHO;
475 if (verbose_p) fprintf (stderr, "PROMPT_ECHO");
480 fprintf (stderr, "=\"%s\"", msg[i]->msg ? msg[i]->msg : "(null)");
484 fprintf (stderr, ") ...\n");
486 ret = si->unlock_cb(nmsgs, messages, &authresp, si);
488 /* #### If the user times out, or hits ESC or Cancel, we return PAM_CONV_ERR,
489 and PAM logs this as an authentication failure. It would be nice if
490 there was some way to indicate that this was a "cancel" rather than
491 a "fail", so that it wouldn't show up in syslog, but I think the
492 only options are PAM_SUCCESS and PAM_CONV_ERR. (I think that
493 PAM_ABORT means "internal error", not "cancel".) Bleh.
498 for (i = 0; i < nmsgs; ++i)
499 pam_responses[i].resp = authresp[i].response;
510 fprintf (stderr, "%s: pam_conversation (...) ==> %s\n", blurb(),
511 (ret == 0 ? "PAM_SUCCESS" : "PAM_CONV_ERR"));
515 *resp = pam_responses;
526 #endif /* NO_LOCKING -- whole file */