/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 *
 * Copyright 2023 OmniOS Community Edition (OmniOSce) Association.
 */

#include <libtsnet.h>
#include <stdlib.h>
#include <string.h>
#include <syslog.h>
#include <zone.h>

#include <security/pam_appl.h>
#include <security/pam_modules.h>
#include <security/pam_impl.h>

#include <tsol/label.h>

/*
 *	pam_tsol_account - Trusted Extensions account management.
 *		Validates that the user's label range contains
 *		the process label (label of the zone).
 */

static void
free_labels(m_range_t *r, m_label_t *l)
{
	m_label_free(r->lower_bound);
	m_label_free(r->upper_bound);
	free(r);
	m_label_free(l);
}

int
pam_sm_acct_mgmt(pam_handle_t *pamh, int flags, int argc, const char **argv)
{
	int i;
	int debug = 0;
	int allow_unlabeled = 0;
	const char *user;
	char *rhost;
	m_range_t *range;
	m_label_t *plabel;

	for (i = 0; i < argc; i++) {
		if (strcmp(argv[i], "debug") == 0) {
			debug = 1;
		} else if (strcmp(argv[i], "allow_unlabeled") == 0) {
			allow_unlabeled = 1;
		} else {
			__pam_log(LOG_AUTH | LOG_ERR,
			    "pam_tsol_account: illegal option %s", argv[i]);
		}
	}

	/* Trusted Extensions not enabled */

	if (!is_system_labeled())
		return (PAM_IGNORE);

	(void) pam_get_item(pamh, PAM_USER, (const void **)&user);

	(void) pam_get_item(pamh, PAM_RHOST, (const void **)&rhost);

	if (debug) {
		__pam_log(LOG_AUTH | LOG_DEBUG,
		    "pam_tsol_account: allowed_unlabeled = %d, user %s, "
		    "rhost %s",
		    allow_unlabeled,
		    (user == NULL) ? "NULL" : (*user == '\0') ? "ZERO" :
		    user,
		    (rhost == NULL) ? "NULL" : (*rhost == '\0') ? "ZERO" :
		    rhost);
	}
	if (user == NULL || *user == '\0') {
		__pam_log(LOG_AUTH | LOG_ERR,
		    "pam_tsol_account: no user");
		return (PAM_USER_UNKNOWN);
	}

	if ((range = getuserrange(user)) == NULL) {
		__pam_log(LOG_AUTH | LOG_ERR,
		    "pam_tsol_account: getuserrange(%s) failure", user);
		return (PAM_SYSTEM_ERR);
	}
	if ((plabel = m_label_alloc(MAC_LABEL)) == NULL) {
		__pam_log(LOG_AUTH | LOG_ERR,
		    "pam_tsol_account: out of memory");
		free_labels(range, NULL);
		return (PAM_BUF_ERR);
	}
	if (getplabel(plabel) < 0) {
		__pam_log(LOG_AUTH | LOG_CRIT,
		    "pam_tsol_account: Unable to get process label %m");
		free_labels(range, plabel);
		return (PAM_SYSTEM_ERR);
	}
	if (!blinrange(plabel, range)) {
		free_labels(range, plabel);
		return (PAM_PERM_DENIED);
	}

	free_labels(range, plabel);

	/* Remote Host Type Policy Check */

	if ((allow_unlabeled == 0) &&
	    (getzoneid() == GLOBAL_ZONEID) &&
	    (rhost != NULL && *rhost != '\0')) {
		tsol_host_type_t host_type;

		host_type = tsol_getrhtype(rhost);
		switch (host_type) {
		case SUN_CIPSO:
			break;

		case UNLABELED:
		default:
			return (PAM_PERM_DENIED);
		}
	}
	return (PAM_SUCCESS);
}