1 // SPDX-License-Identifier: BSD-3-Clause
2 /*
3 * Redistribution and use in source and binary forms, with or without
4 * modification, are permitted provided that the following conditions are met:
5 * * Redistributions of source code must retain the above copyright
6 * notice, this list of conditions and the following disclaimer.
7 * * Redistributions in binary form must reproduce the above copyright
8 * notice, this list of conditions and the following disclaimer in the
9 * documentation and/or other materials provided with the distribution.
10 * * Neither the name of the <organization> nor the
11 * names of its contributors may be used to endorse or promote products
12 * derived from this software without specific prior written permission.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
15 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED. IN NO EVENT SHALL <COPYRIGHT HOLDER> BE LIABLE FOR ANY
18 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
19 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
20 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
21 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
23 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24 *
25 * Copyright (c) 2020, Felix Dörre
26 * All rights reserved.
27 */
28
29 #include <sys/dsl_crypt.h>
30 #include <sys/byteorder.h>
31 #include <libzfs.h>
32
33 #include <syslog.h>
34
35 #include <sys/zio_crypt.h>
36 #include <openssl/evp.h>
37
38 #define PAM_SM_AUTH
39 #define PAM_SM_PASSWORD
40 #define PAM_SM_SESSION
41 #include <security/pam_modules.h>
42
43 #if defined(__linux__)
44 #include <security/pam_ext.h>
45 #define MAP_FLAGS MAP_PRIVATE | MAP_ANONYMOUS
46 #elif defined(__FreeBSD__)
47 #include <security/pam_appl.h>
48 static void
pam_syslog(pam_handle_t * pamh,int loglevel,const char * fmt,...)49 pam_syslog(pam_handle_t *pamh, int loglevel, const char *fmt, ...)
50 {
51 (void) pamh;
52 va_list args;
53 va_start(args, fmt);
54 vsyslog(loglevel, fmt, args);
55 va_end(args);
56 }
57 #define MAP_FLAGS MAP_PRIVATE | MAP_ANON | MAP_NOCORE
58 #endif
59
60 #include <string.h>
61 #include <unistd.h>
62 #include <fcntl.h>
63 #include <sys/stat.h>
64 #include <sys/file.h>
65 #include <sys/wait.h>
66 #include <pwd.h>
67 #include <lib/libzfs/libzfs_impl.h>
68
69 #include <sys/mman.h>
70
71 static const char PASSWORD_VAR_NAME[] = "pam_zfs_key_authtok";
72 static const char OLD_PASSWORD_VAR_NAME[] = "pam_zfs_key_oldauthtok";
73
74 static libzfs_handle_t *g_zfs;
75
76 static void destroy_pw(pam_handle_t *pamh, void *data, int errcode);
77
78 typedef int (*mlock_func_t) (const void *, size_t);
79
80 typedef struct {
81 size_t len;
82 char *value;
83 } pw_password_t;
84
85 /*
86 * Try to mlock(2) or munlock(2) addr while handling EAGAIN by retrying ten
87 * times and sleeping 10 milliseconds in between for a total of 0.1
88 * seconds. lock_func must point to either mlock(2) or munlock(2).
89 */
90 static int
try_lock(mlock_func_t lock_func,const void * addr,size_t len)91 try_lock(mlock_func_t lock_func, const void *addr, size_t len)
92 {
93 int err;
94 int retries = 10;
95 useconds_t sleep_dur = 10 * 1000;
96
97 if ((err = (*lock_func)(addr, len)) != EAGAIN) {
98 return (err);
99 }
100 for (int i = retries; i > 0; --i) {
101 (void) usleep(sleep_dur);
102 if ((err = (*lock_func)(addr, len)) != EAGAIN) {
103 break;
104 }
105 }
106 return (err);
107 }
108
109
110 static pw_password_t *
alloc_pw_size(size_t len)111 alloc_pw_size(size_t len)
112 {
113 pw_password_t *pw = malloc(sizeof (pw_password_t));
114 if (!pw) {
115 return (NULL);
116 }
117 pw->len = len;
118 /*
119 * We use mmap(2) rather than malloc(3) since later on we mlock(2) the
120 * memory region. Since mlock(2) and munlock(2) operate on whole memory
121 * pages we should allocate a whole page here as mmap(2) does. Further
122 * this ensures that the addresses passed to mlock(2) an munlock(2) are
123 * on a page boundary as suggested by FreeBSD and required by some
124 * other implementations. Finally we avoid inadvertently munlocking
125 * memory mlocked by an concurrently running instance of us.
126 */
127 pw->value = mmap(NULL, pw->len, PROT_READ | PROT_WRITE, MAP_FLAGS,
128 -1, 0);
129
130 if (pw->value == MAP_FAILED) {
131 free(pw);
132 return (NULL);
133 }
134 if (try_lock(mlock, pw->value, pw->len) != 0) {
135 (void) munmap(pw->value, pw->len);
136 free(pw);
137 return (NULL);
138 }
139 return (pw);
140 }
141
142 static pw_password_t *
alloc_pw_string(const char * source)143 alloc_pw_string(const char *source)
144 {
145 size_t len = strlen(source) + 1;
146 pw_password_t *pw = alloc_pw_size(len);
147
148 if (!pw) {
149 return (NULL);
150 }
151 memcpy(pw->value, source, pw->len);
152 return (pw);
153 }
154
155 static void
pw_free(pw_password_t * pw)156 pw_free(pw_password_t *pw)
157 {
158 memset(pw->value, 0, pw->len);
159 if (try_lock(munlock, pw->value, pw->len) == 0) {
160 (void) munmap(pw->value, pw->len);
161 }
162 free(pw);
163 }
164
165 static pw_password_t *
pw_fetch(pam_handle_t * pamh,int tok)166 pw_fetch(pam_handle_t *pamh, int tok)
167 {
168 const char *token;
169 if (pam_get_authtok(pamh, tok, &token, NULL) != PAM_SUCCESS) {
170 pam_syslog(pamh, LOG_ERR,
171 "couldn't get password from PAM stack");
172 return (NULL);
173 }
174 if (!token) {
175 pam_syslog(pamh, LOG_ERR,
176 "token from PAM stack is null");
177 return (NULL);
178 }
179 return (alloc_pw_string(token));
180 }
181
182 static const pw_password_t *
pw_fetch_lazy(pam_handle_t * pamh,int tok,const char * var_name)183 pw_fetch_lazy(pam_handle_t *pamh, int tok, const char *var_name)
184 {
185 pw_password_t *pw = pw_fetch(pamh, tok);
186 if (pw == NULL) {
187 return (NULL);
188 }
189 int ret = pam_set_data(pamh, var_name, pw, destroy_pw);
190 if (ret != PAM_SUCCESS) {
191 pw_free(pw);
192 pam_syslog(pamh, LOG_ERR, "pam_set_data failed");
193 return (NULL);
194 }
195 return (pw);
196 }
197
198 static const pw_password_t *
pw_get(pam_handle_t * pamh,int tok,const char * var_name)199 pw_get(pam_handle_t *pamh, int tok, const char *var_name)
200 {
201 const pw_password_t *authtok = NULL;
202 int ret = pam_get_data(pamh, var_name,
203 (const void**)(&authtok));
204 if (ret == PAM_SUCCESS)
205 return (authtok);
206 if (ret == PAM_NO_MODULE_DATA)
207 return (pw_fetch_lazy(pamh, tok, var_name));
208 pam_syslog(pamh, LOG_ERR, "password not available");
209 return (NULL);
210 }
211
212 static int
pw_clear(pam_handle_t * pamh,const char * var_name)213 pw_clear(pam_handle_t *pamh, const char *var_name)
214 {
215 int ret = pam_set_data(pamh, var_name, NULL, NULL);
216 if (ret != PAM_SUCCESS) {
217 pam_syslog(pamh, LOG_ERR, "clearing password failed");
218 return (-1);
219 }
220 return (0);
221 }
222
223 static void
destroy_pw(pam_handle_t * pamh,void * data,int errcode)224 destroy_pw(pam_handle_t *pamh, void *data, int errcode)
225 {
226 (void) pamh, (void) errcode;
227
228 if (data != NULL) {
229 pw_free((pw_password_t *)data);
230 }
231 }
232
233 static int
pam_zfs_init(pam_handle_t * pamh)234 pam_zfs_init(pam_handle_t *pamh)
235 {
236 int error = 0;
237 if ((g_zfs = libzfs_init()) == NULL) {
238 error = errno;
239 pam_syslog(pamh, LOG_ERR, "Zfs initialization error: %s",
240 libzfs_error_init(error));
241 }
242 return (error);
243 }
244
245 static void
pam_zfs_free(void)246 pam_zfs_free(void)
247 {
248 libzfs_fini(g_zfs);
249 }
250
251 static pw_password_t *
prepare_passphrase(pam_handle_t * pamh,zfs_handle_t * ds,const char * passphrase,nvlist_t * nvlist)252 prepare_passphrase(pam_handle_t *pamh, zfs_handle_t *ds,
253 const char *passphrase, nvlist_t *nvlist)
254 {
255 pw_password_t *key = alloc_pw_size(WRAPPING_KEY_LEN);
256 if (!key) {
257 return (NULL);
258 }
259 uint64_t salt;
260 uint64_t iters;
261 if (nvlist != NULL) {
262 int fd = open("/dev/urandom", O_RDONLY);
263 if (fd < 0) {
264 pw_free(key);
265 return (NULL);
266 }
267 int bytes_read = 0;
268 char *buf = (char *)&salt;
269 size_t bytes = sizeof (uint64_t);
270 while (bytes_read < bytes) {
271 ssize_t len = read(fd, buf + bytes_read, bytes
272 - bytes_read);
273 if (len < 0) {
274 close(fd);
275 pw_free(key);
276 return (NULL);
277 }
278 bytes_read += len;
279 }
280 close(fd);
281
282 if (nvlist_add_uint64(nvlist,
283 zfs_prop_to_name(ZFS_PROP_PBKDF2_SALT), salt)) {
284 pam_syslog(pamh, LOG_ERR,
285 "failed to add salt to nvlist");
286 pw_free(key);
287 return (NULL);
288 }
289 iters = DEFAULT_PBKDF2_ITERATIONS;
290 if (nvlist_add_uint64(nvlist, zfs_prop_to_name(
291 ZFS_PROP_PBKDF2_ITERS), iters)) {
292 pam_syslog(pamh, LOG_ERR,
293 "failed to add iters to nvlist");
294 pw_free(key);
295 return (NULL);
296 }
297 } else {
298 salt = zfs_prop_get_int(ds, ZFS_PROP_PBKDF2_SALT);
299 iters = zfs_prop_get_int(ds, ZFS_PROP_PBKDF2_ITERS);
300 }
301
302 salt = LE_64(salt);
303 if (!PKCS5_PBKDF2_HMAC_SHA1((char *)passphrase,
304 strlen(passphrase), (uint8_t *)&salt,
305 sizeof (uint64_t), iters, WRAPPING_KEY_LEN,
306 (uint8_t *)key->value)) {
307 pam_syslog(pamh, LOG_ERR, "pbkdf failed");
308 pw_free(key);
309 return (NULL);
310 }
311 return (key);
312 }
313
314 static int
is_key_loaded(pam_handle_t * pamh,const char * ds_name)315 is_key_loaded(pam_handle_t *pamh, const char *ds_name)
316 {
317 zfs_handle_t *ds = zfs_open(g_zfs, ds_name, ZFS_TYPE_FILESYSTEM);
318 if (ds == NULL) {
319 pam_syslog(pamh, LOG_ERR, "dataset %s not found", ds_name);
320 return (-1);
321 }
322 int keystatus = zfs_prop_get_int(ds, ZFS_PROP_KEYSTATUS);
323 zfs_close(ds);
324 return (keystatus != ZFS_KEYSTATUS_UNAVAILABLE);
325 }
326
327 static int
change_key(pam_handle_t * pamh,const char * ds_name,const char * passphrase)328 change_key(pam_handle_t *pamh, const char *ds_name,
329 const char *passphrase)
330 {
331 zfs_handle_t *ds = zfs_open(g_zfs, ds_name, ZFS_TYPE_FILESYSTEM);
332 if (ds == NULL) {
333 pam_syslog(pamh, LOG_ERR, "dataset %s not found", ds_name);
334 return (-1);
335 }
336 nvlist_t *nvlist = fnvlist_alloc();
337 pw_password_t *key = prepare_passphrase(pamh, ds, passphrase, nvlist);
338 if (key == NULL) {
339 nvlist_free(nvlist);
340 zfs_close(ds);
341 return (-1);
342 }
343 if (nvlist_add_string(nvlist,
344 zfs_prop_to_name(ZFS_PROP_KEYLOCATION),
345 "prompt")) {
346 pam_syslog(pamh, LOG_ERR, "nvlist_add failed for keylocation");
347 pw_free(key);
348 nvlist_free(nvlist);
349 zfs_close(ds);
350 return (-1);
351 }
352 if (nvlist_add_uint64(nvlist,
353 zfs_prop_to_name(ZFS_PROP_KEYFORMAT),
354 ZFS_KEYFORMAT_PASSPHRASE)) {
355 pam_syslog(pamh, LOG_ERR, "nvlist_add failed for keyformat");
356 pw_free(key);
357 nvlist_free(nvlist);
358 zfs_close(ds);
359 return (-1);
360 }
361 int ret = lzc_change_key(ds_name, DCP_CMD_NEW_KEY, nvlist,
362 (uint8_t *)key->value, WRAPPING_KEY_LEN);
363 pw_free(key);
364 if (ret) {
365 pam_syslog(pamh, LOG_ERR, "change_key failed: %d", ret);
366 nvlist_free(nvlist);
367 zfs_close(ds);
368 return (-1);
369 }
370 nvlist_free(nvlist);
371 zfs_close(ds);
372 return (0);
373 }
374
375 typedef struct {
376 char *homes_prefix;
377 char *runstatedir;
378 char *homedir;
379 char *dsname;
380 uid_t uid_min;
381 uid_t uid_max;
382 uid_t uid;
383 const char *username;
384 boolean_t unmount_and_unload;
385 boolean_t force_unmount;
386 boolean_t recursive_homes;
387 boolean_t mount_recursively;
388 } zfs_key_config_t;
389
390 static int
zfs_key_config_load(pam_handle_t * pamh,zfs_key_config_t * config,int argc,const char ** argv)391 zfs_key_config_load(pam_handle_t *pamh, zfs_key_config_t *config,
392 int argc, const char **argv)
393 {
394 #if defined(__FreeBSD__)
395 config->homes_prefix = strdup("zroot/home");
396 #else
397 config->homes_prefix = strdup("rpool/home");
398 #endif
399 if (config->homes_prefix == NULL) {
400 pam_syslog(pamh, LOG_ERR, "strdup failure");
401 return (PAM_SERVICE_ERR);
402 }
403 config->runstatedir = strdup(RUNSTATEDIR "/pam_zfs_key");
404 if (config->runstatedir == NULL) {
405 pam_syslog(pamh, LOG_ERR, "strdup failure");
406 free(config->homes_prefix);
407 return (PAM_SERVICE_ERR);
408 }
409 const char *name;
410 if (pam_get_user(pamh, &name, NULL) != PAM_SUCCESS) {
411 pam_syslog(pamh, LOG_ERR,
412 "couldn't get username from PAM stack");
413 free(config->runstatedir);
414 free(config->homes_prefix);
415 return (PAM_SERVICE_ERR);
416 }
417 struct passwd *entry = getpwnam(name);
418 if (!entry) {
419 free(config->runstatedir);
420 free(config->homes_prefix);
421 return (PAM_USER_UNKNOWN);
422 }
423 config->uid_min = 1000;
424 config->uid_max = MAXUID;
425 config->uid = entry->pw_uid;
426 config->username = name;
427 config->unmount_and_unload = B_TRUE;
428 config->force_unmount = B_FALSE;
429 config->recursive_homes = B_FALSE;
430 config->mount_recursively = B_FALSE;
431 config->dsname = NULL;
432 config->homedir = NULL;
433 for (int c = 0; c < argc; c++) {
434 if (strncmp(argv[c], "homes=", 6) == 0) {
435 free(config->homes_prefix);
436 config->homes_prefix = strdup(argv[c] + 6);
437 } else if (strncmp(argv[c], "runstatedir=", 12) == 0) {
438 free(config->runstatedir);
439 config->runstatedir = strdup(argv[c] + 12);
440 } else if (strncmp(argv[c], "uid_min=", 8) == 0) {
441 sscanf(argv[c] + 8, "%u", &config->uid_min);
442 } else if (strncmp(argv[c], "uid_max=", 8) == 0) {
443 sscanf(argv[c] + 8, "%u", &config->uid_max);
444 } else if (strcmp(argv[c], "nounmount") == 0) {
445 config->unmount_and_unload = B_FALSE;
446 } else if (strcmp(argv[c], "forceunmount") == 0) {
447 config->force_unmount = B_TRUE;
448 } else if (strcmp(argv[c], "recursive_homes") == 0) {
449 config->recursive_homes = B_TRUE;
450 } else if (strcmp(argv[c], "mount_recursively") == 0) {
451 config->mount_recursively = B_TRUE;
452 } else if (strcmp(argv[c], "prop_mountpoint") == 0) {
453 if (config->homedir == NULL)
454 config->homedir = strdup(entry->pw_dir);
455 }
456 }
457 return (PAM_SUCCESS);
458 }
459
460 typedef struct {
461 pam_handle_t *pamh;
462 zfs_key_config_t *target;
463 } mount_umount_dataset_data_t;
464
465 static int
mount_dataset(zfs_handle_t * zhp,void * data)466 mount_dataset(zfs_handle_t *zhp, void *data)
467 {
468 mount_umount_dataset_data_t *mount_umount_dataset_data = data;
469
470 zfs_key_config_t *target = mount_umount_dataset_data->target;
471 pam_handle_t *pamh = mount_umount_dataset_data->pamh;
472
473 /* Refresh properties to get the latest key status */
474 zfs_refresh_properties(zhp);
475
476 int ret = 0;
477
478 /* Check if dataset type is filesystem */
479 if (zhp->zfs_type != ZFS_TYPE_FILESYSTEM) {
480 pam_syslog(pamh, LOG_DEBUG,
481 "dataset is not filesystem: %s, skipping.",
482 zfs_get_name(zhp));
483 return (0);
484 }
485
486 /* Check if encryption key is available */
487 if (zfs_prop_get_int(zhp, ZFS_PROP_KEYSTATUS) ==
488 ZFS_KEYSTATUS_UNAVAILABLE) {
489 pam_syslog(pamh, LOG_WARNING,
490 "key unavailable for: %s, skipping",
491 zfs_get_name(zhp));
492 return (0);
493 }
494
495 /* Check if prop canmount is on */
496 if (zfs_prop_get_int(zhp, ZFS_PROP_CANMOUNT) != ZFS_CANMOUNT_ON) {
497 pam_syslog(pamh, LOG_INFO,
498 "canmount is not on for: %s, skipping",
499 zfs_get_name(zhp));
500 return (0);
501 }
502
503 /* Get mountpoint prop for check */
504 char mountpoint[ZFS_MAXPROPLEN];
505 if ((ret = zfs_prop_get(zhp, ZFS_PROP_MOUNTPOINT, mountpoint,
506 sizeof (mountpoint), NULL, NULL, 0, 1)) != 0) {
507 pam_syslog(pamh, LOG_ERR,
508 "failed to get mountpoint prop: %d", ret);
509 return (-1);
510 }
511
512 /* Check if mountpoint isn't none or legacy */
513 if (strcmp(mountpoint, ZFS_MOUNTPOINT_NONE) == 0 ||
514 strcmp(mountpoint, ZFS_MOUNTPOINT_LEGACY) == 0) {
515 pam_syslog(pamh, LOG_INFO,
516 "mountpoint is none or legacy for: %s, skipping",
517 zfs_get_name(zhp));
518 return (0);
519 }
520
521 /* Don't mount the dataset if already mounted */
522 if (zfs_is_mounted(zhp, NULL)) {
523 pam_syslog(pamh, LOG_INFO, "already mounted: %s",
524 zfs_get_name(zhp));
525 return (0);
526 }
527
528 /* Mount the dataset */
529 ret = zfs_mount(zhp, NULL, 0);
530 if (ret) {
531 pam_syslog(pamh, LOG_ERR,
532 "zfs_mount failed for %s with: %d", zfs_get_name(zhp),
533 ret);
534 return (ret);
535 }
536
537 /* Recursively mount children if the recursive flag is set */
538 if (target->mount_recursively) {
539 ret = zfs_iter_filesystems_v2(zhp, 0, mount_dataset, data);
540 if (ret != 0) {
541 pam_syslog(pamh, LOG_ERR,
542 "child iteration failed: %d", ret);
543 return (-1);
544 }
545 }
546
547 return (ret);
548 }
549
550 static int
umount_dataset(zfs_handle_t * zhp,void * data)551 umount_dataset(zfs_handle_t *zhp, void *data)
552 {
553 mount_umount_dataset_data_t *mount_umount_dataset_data = data;
554
555 zfs_key_config_t *target = mount_umount_dataset_data->target;
556 pam_handle_t *pamh = mount_umount_dataset_data->pamh;
557
558 int ret = 0;
559 /* Recursively umount children if the recursive flag is set */
560 if (target->mount_recursively) {
561 ret = zfs_iter_filesystems_v2(zhp, 0, umount_dataset, data);
562 if (ret != 0) {
563 pam_syslog(pamh, LOG_ERR,
564 "child iteration failed: %d", ret);
565 return (-1);
566 }
567 }
568
569 /* Check if dataset type is filesystem */
570 if (zhp->zfs_type != ZFS_TYPE_FILESYSTEM) {
571 pam_syslog(pamh, LOG_DEBUG,
572 "dataset is not filesystem: %s, skipping",
573 zfs_get_name(zhp));
574 return (0);
575 }
576
577 /* Don't umount the dataset if already unmounted */
578 if (zfs_is_mounted(zhp, NULL) == 0) {
579 pam_syslog(pamh, LOG_INFO, "already unmounted: %s",
580 zfs_get_name(zhp));
581 return (0);
582 }
583
584 /* Unmount the dataset */
585 ret = zfs_unmount(zhp, NULL, target->force_unmount ? MS_FORCE : 0);
586 if (ret) {
587 pam_syslog(pamh, LOG_ERR,
588 "zfs_unmount failed for %s with: %d", zfs_get_name(zhp),
589 ret);
590 return (ret);
591 }
592
593 return (ret);
594 }
595
596 static int
decrypt_mount(pam_handle_t * pamh,zfs_key_config_t * config,const char * ds_name,const char * passphrase,boolean_t noop)597 decrypt_mount(pam_handle_t *pamh, zfs_key_config_t *config, const char *ds_name,
598 const char *passphrase, boolean_t noop)
599 {
600 zfs_handle_t *ds = zfs_open(g_zfs, ds_name, ZFS_TYPE_FILESYSTEM);
601 if (ds == NULL) {
602 pam_syslog(pamh, LOG_ERR, "dataset %s not found", ds_name);
603 return (-1);
604 }
605 pw_password_t *key = prepare_passphrase(pamh, ds, passphrase, NULL);
606 if (key == NULL) {
607 zfs_close(ds);
608 return (-1);
609 }
610 int ret = lzc_load_key(ds_name, noop, (uint8_t *)key->value,
611 WRAPPING_KEY_LEN);
612 pw_free(key);
613 if (ret && ret != EEXIST) {
614 pam_syslog(pamh, LOG_ERR, "load_key failed: %d", ret);
615 zfs_close(ds);
616 return (-1);
617 }
618
619 if (noop) {
620 zfs_close(ds);
621 return (0);
622 }
623
624 mount_umount_dataset_data_t data;
625 data.pamh = pamh;
626 data.target = config;
627
628 ret = mount_dataset(ds, &data);
629 if (ret != 0) {
630 pam_syslog(pamh, LOG_ERR, "mount failed: %d", ret);
631 zfs_close(ds);
632 return (-1);
633 }
634
635 zfs_close(ds);
636 return (0);
637 }
638
639 static int
unmount_unload(pam_handle_t * pamh,const char * ds_name,zfs_key_config_t * target)640 unmount_unload(pam_handle_t *pamh, const char *ds_name,
641 zfs_key_config_t *target)
642 {
643 zfs_handle_t *ds = zfs_open(g_zfs, ds_name, ZFS_TYPE_FILESYSTEM);
644 if (ds == NULL) {
645 pam_syslog(pamh, LOG_ERR, "dataset %s not found", ds_name);
646 return (-1);
647 }
648
649 mount_umount_dataset_data_t data;
650 data.pamh = pamh;
651 data.target = target;
652
653 int ret = umount_dataset(ds, &data);
654 if (ret) {
655 pam_syslog(pamh, LOG_ERR,
656 "unmount_dataset failed with: %d", ret);
657 zfs_close(ds);
658 return (-1);
659 }
660
661 ret = lzc_unload_key(ds_name);
662 if (ret) {
663 pam_syslog(pamh, LOG_ERR, "unload_key failed with: %d", ret);
664 zfs_close(ds);
665 return (-1);
666 }
667 zfs_close(ds);
668 return (0);
669 }
670
671 static void
zfs_key_config_free(zfs_key_config_t * config)672 zfs_key_config_free(zfs_key_config_t *config)
673 {
674 free(config->homes_prefix);
675 free(config->runstatedir);
676 free(config->homedir);
677 free(config->dsname);
678 }
679
680 static int
find_dsname_by_prop_value(zfs_handle_t * zhp,void * data)681 find_dsname_by_prop_value(zfs_handle_t *zhp, void *data)
682 {
683 zfs_type_t type = zfs_get_type(zhp);
684 zfs_key_config_t *target = data;
685 char mountpoint[ZFS_MAXPROPLEN];
686
687 /* Skip any datasets whose type does not match */
688 if ((type & ZFS_TYPE_FILESYSTEM) == 0) {
689 zfs_close(zhp);
690 return (0);
691 }
692
693 /* Skip any datasets whose mountpoint does not match */
694 (void) zfs_prop_get(zhp, ZFS_PROP_MOUNTPOINT, mountpoint,
695 sizeof (mountpoint), NULL, NULL, 0, B_FALSE);
696 if (strcmp(target->homedir, mountpoint) != 0) {
697 if (target->recursive_homes) {
698 (void) zfs_iter_filesystems_v2(zhp, 0,
699 find_dsname_by_prop_value, target);
700 }
701 zfs_close(zhp);
702 return (target->dsname != NULL);
703 }
704
705 target->dsname = strdup(zfs_get_name(zhp));
706 zfs_close(zhp);
707 return (1);
708 }
709
710 static char *
zfs_key_config_get_dataset(pam_handle_t * pamh,zfs_key_config_t * config)711 zfs_key_config_get_dataset(pam_handle_t *pamh, zfs_key_config_t *config)
712 {
713 if (config->homedir != NULL &&
714 config->homes_prefix != NULL) {
715 if (strcmp(config->homes_prefix, "*") == 0) {
716 (void) zfs_iter_root(g_zfs,
717 find_dsname_by_prop_value, config);
718 } else {
719 zfs_handle_t *zhp = zfs_open(g_zfs,
720 config->homes_prefix, ZFS_TYPE_FILESYSTEM);
721 if (zhp == NULL) {
722 pam_syslog(pamh, LOG_ERR,
723 "dataset %s not found",
724 config->homes_prefix);
725 return (NULL);
726 }
727
728 (void) zfs_iter_filesystems_v2(zhp, 0,
729 find_dsname_by_prop_value, config);
730 zfs_close(zhp);
731 }
732 char *dsname = config->dsname;
733 config->dsname = NULL;
734 return (dsname);
735 }
736
737 if (config->homes_prefix == NULL) {
738 return (NULL);
739 }
740
741 size_t len = ZFS_MAX_DATASET_NAME_LEN;
742 size_t total_len = strlen(config->homes_prefix) + 1
743 + strlen(config->username);
744 if (total_len > len) {
745 return (NULL);
746 }
747 char *ret = malloc(len + 1);
748 if (!ret) {
749 return (NULL);
750 }
751 ret[0] = 0;
752 (void) snprintf(ret, len + 1, "%s/%s", config->homes_prefix,
753 config->username);
754 return (ret);
755 }
756
757 static int
zfs_key_config_modify_session_counter(pam_handle_t * pamh,zfs_key_config_t * config,int delta)758 zfs_key_config_modify_session_counter(pam_handle_t *pamh,
759 zfs_key_config_t *config, int delta)
760 {
761 const char *runtime_path = config->runstatedir;
762 if (mkdir(runtime_path, S_IRWXU) != 0 && errno != EEXIST) {
763 pam_syslog(pamh, LOG_ERR, "Can't create runtime path: %d",
764 errno);
765 return (-1);
766 }
767 if (chown(runtime_path, 0, 0) != 0) {
768 pam_syslog(pamh, LOG_ERR, "Can't chown runtime path: %d",
769 errno);
770 return (-1);
771 }
772 if (chmod(runtime_path, S_IRWXU) != 0) {
773 pam_syslog(pamh, LOG_ERR, "Can't chmod runtime path: %d",
774 errno);
775 return (-1);
776 }
777
778 char *counter_path;
779 if (asprintf(&counter_path, "%s/%u", runtime_path, config->uid) == -1)
780 return (-1);
781
782 const int fd = open(counter_path,
783 O_RDWR | O_CLOEXEC | O_CREAT | O_NOFOLLOW,
784 S_IRUSR | S_IWUSR);
785 free(counter_path);
786 if (fd < 0) {
787 pam_syslog(pamh, LOG_ERR, "Can't open counter file: %d", errno);
788 return (-1);
789 }
790 if (flock(fd, LOCK_EX) != 0) {
791 pam_syslog(pamh, LOG_ERR, "Can't lock counter file: %d", errno);
792 close(fd);
793 return (-1);
794 }
795 char counter[20];
796 char *pos = counter;
797 int remaining = sizeof (counter) - 1;
798 int ret;
799 counter[sizeof (counter) - 1] = 0;
800 while (remaining > 0 && (ret = read(fd, pos, remaining)) > 0) {
801 remaining -= ret;
802 pos += ret;
803 }
804 *pos = 0;
805 long int counter_value = strtol(counter, NULL, 10);
806 counter_value += delta;
807 if (counter_value < 0) {
808 counter_value = 0;
809 }
810 lseek(fd, 0, SEEK_SET);
811 if (ftruncate(fd, 0) != 0) {
812 pam_syslog(pamh, LOG_ERR, "Can't truncate counter file: %d",
813 errno);
814 close(fd);
815 return (-1);
816 }
817 snprintf(counter, sizeof (counter), "%ld", counter_value);
818 remaining = strlen(counter);
819 pos = counter;
820 while (remaining > 0 && (ret = write(fd, pos, remaining)) > 0) {
821 remaining -= ret;
822 pos += ret;
823 }
824 close(fd);
825 return (counter_value);
826 }
827
828 __attribute__((visibility("default")))
829 PAM_EXTERN int
pam_sm_authenticate(pam_handle_t * pamh,int flags,int argc,const char ** argv)830 pam_sm_authenticate(pam_handle_t *pamh, int flags,
831 int argc, const char **argv)
832 {
833 (void) flags;
834
835 if (geteuid() != 0) {
836 pam_syslog(pamh, LOG_ERR,
837 "Cannot zfs_mount when not being root.");
838 return (PAM_SERVICE_ERR);
839 }
840 zfs_key_config_t config;
841 int config_err = zfs_key_config_load(pamh, &config, argc, argv);
842 if (config_err != PAM_SUCCESS) {
843 return (config_err);
844 }
845 if (config.uid < config.uid_min || config.uid > config.uid_max) {
846 zfs_key_config_free(&config);
847 return (PAM_SERVICE_ERR);
848 }
849
850 const pw_password_t *token = pw_fetch_lazy(pamh,
851 PAM_AUTHTOK, PASSWORD_VAR_NAME);
852 if (token == NULL) {
853 zfs_key_config_free(&config);
854 return (PAM_AUTH_ERR);
855 }
856 if (pam_zfs_init(pamh) != 0) {
857 zfs_key_config_free(&config);
858 return (PAM_SERVICE_ERR);
859 }
860 char *dataset = zfs_key_config_get_dataset(pamh, &config);
861 if (!dataset) {
862 pam_zfs_free();
863 zfs_key_config_free(&config);
864 return (PAM_SERVICE_ERR);
865 }
866 if (decrypt_mount(pamh, &config, dataset, token->value, B_TRUE) == -1) {
867 free(dataset);
868 pam_zfs_free();
869 zfs_key_config_free(&config);
870 return (PAM_AUTH_ERR);
871 }
872 free(dataset);
873 pam_zfs_free();
874 zfs_key_config_free(&config);
875 return (PAM_SUCCESS);
876 }
877
878 __attribute__((visibility("default")))
879 PAM_EXTERN int
pam_sm_setcred(pam_handle_t * pamh,int flags,int argc,const char ** argv)880 pam_sm_setcred(pam_handle_t *pamh, int flags,
881 int argc, const char **argv)
882 {
883 (void) pamh, (void) flags, (void) argc, (void) argv;
884 return (PAM_SUCCESS);
885 }
886
887 __attribute__((visibility("default")))
888 PAM_EXTERN int
pam_sm_chauthtok(pam_handle_t * pamh,int flags,int argc,const char ** argv)889 pam_sm_chauthtok(pam_handle_t *pamh, int flags,
890 int argc, const char **argv)
891 {
892 if (geteuid() != 0) {
893 pam_syslog(pamh, LOG_ERR,
894 "Cannot zfs_mount when not being root.");
895 return (PAM_PERM_DENIED);
896 }
897 zfs_key_config_t config;
898 if (zfs_key_config_load(pamh, &config, argc, argv) != PAM_SUCCESS) {
899 return (PAM_SERVICE_ERR);
900 }
901 if (config.uid < config.uid_min || config.uid > config.uid_max) {
902 zfs_key_config_free(&config);
903 return (PAM_SERVICE_ERR);
904 }
905 const pw_password_t *old_token = pw_get(pamh,
906 PAM_OLDAUTHTOK, OLD_PASSWORD_VAR_NAME);
907 {
908 if (pam_zfs_init(pamh) != 0) {
909 zfs_key_config_free(&config);
910 return (PAM_SERVICE_ERR);
911 }
912 char *dataset = zfs_key_config_get_dataset(pamh, &config);
913 if (!dataset) {
914 pam_zfs_free();
915 zfs_key_config_free(&config);
916 return (PAM_SERVICE_ERR);
917 }
918 if (!old_token) {
919 pam_syslog(pamh, LOG_ERR,
920 "old password from PAM stack is null");
921 free(dataset);
922 pam_zfs_free();
923 zfs_key_config_free(&config);
924 return (PAM_SERVICE_ERR);
925 }
926 if (decrypt_mount(pamh, &config, dataset,
927 old_token->value, B_TRUE) == -1) {
928 pam_syslog(pamh, LOG_ERR,
929 "old token mismatch");
930 free(dataset);
931 pam_zfs_free();
932 zfs_key_config_free(&config);
933 return (PAM_PERM_DENIED);
934 }
935 }
936
937 if ((flags & PAM_UPDATE_AUTHTOK) != 0) {
938 const pw_password_t *token = pw_get(pamh, PAM_AUTHTOK,
939 PASSWORD_VAR_NAME);
940 if (token == NULL) {
941 pam_syslog(pamh, LOG_ERR, "new password unavailable");
942 pam_zfs_free();
943 zfs_key_config_free(&config);
944 pw_clear(pamh, OLD_PASSWORD_VAR_NAME);
945 return (PAM_SERVICE_ERR);
946 }
947 char *dataset = zfs_key_config_get_dataset(pamh, &config);
948 if (!dataset) {
949 pam_zfs_free();
950 zfs_key_config_free(&config);
951 pw_clear(pamh, OLD_PASSWORD_VAR_NAME);
952 pw_clear(pamh, PASSWORD_VAR_NAME);
953 return (PAM_SERVICE_ERR);
954 }
955 int was_loaded = is_key_loaded(pamh, dataset);
956 if (!was_loaded && decrypt_mount(pamh, &config, dataset,
957 old_token->value, B_FALSE) == -1) {
958 free(dataset);
959 pam_zfs_free();
960 zfs_key_config_free(&config);
961 pw_clear(pamh, OLD_PASSWORD_VAR_NAME);
962 pw_clear(pamh, PASSWORD_VAR_NAME);
963 return (PAM_SERVICE_ERR);
964 }
965 int changed = change_key(pamh, dataset, token->value);
966 if (!was_loaded) {
967 unmount_unload(pamh, dataset, &config);
968 }
969 free(dataset);
970 pam_zfs_free();
971 zfs_key_config_free(&config);
972 if (pw_clear(pamh, OLD_PASSWORD_VAR_NAME) == -1 ||
973 pw_clear(pamh, PASSWORD_VAR_NAME) == -1 || changed == -1) {
974 return (PAM_SERVICE_ERR);
975 }
976 } else {
977 zfs_key_config_free(&config);
978 }
979 return (PAM_SUCCESS);
980 }
981
982 PAM_EXTERN int
pam_sm_open_session(pam_handle_t * pamh,int flags,int argc,const char ** argv)983 pam_sm_open_session(pam_handle_t *pamh, int flags,
984 int argc, const char **argv)
985 {
986 (void) flags;
987
988 if (geteuid() != 0) {
989 pam_syslog(pamh, LOG_ERR,
990 "Cannot zfs_mount when not being root.");
991 return (PAM_SUCCESS);
992 }
993 zfs_key_config_t config;
994 if (zfs_key_config_load(pamh, &config, argc, argv) != PAM_SUCCESS) {
995 return (PAM_SESSION_ERR);
996 }
997
998 if (config.uid < config.uid_min || config.uid > config.uid_max) {
999 zfs_key_config_free(&config);
1000 return (PAM_SUCCESS);
1001 }
1002
1003 int counter = zfs_key_config_modify_session_counter(pamh, &config, 1);
1004 if (counter != 1) {
1005 zfs_key_config_free(&config);
1006 return (PAM_SUCCESS);
1007 }
1008
1009 const pw_password_t *token = pw_get(pamh,
1010 PAM_AUTHTOK, PASSWORD_VAR_NAME);
1011 if (token == NULL) {
1012 zfs_key_config_free(&config);
1013 return (PAM_SESSION_ERR);
1014 }
1015 if (pam_zfs_init(pamh) != 0) {
1016 zfs_key_config_free(&config);
1017 return (PAM_SERVICE_ERR);
1018 }
1019 char *dataset = zfs_key_config_get_dataset(pamh, &config);
1020 if (!dataset) {
1021 pam_zfs_free();
1022 zfs_key_config_free(&config);
1023 return (PAM_SERVICE_ERR);
1024 }
1025 if (decrypt_mount(pamh, &config, dataset,
1026 token->value, B_FALSE) == -1) {
1027 free(dataset);
1028 pam_zfs_free();
1029 zfs_key_config_free(&config);
1030 return (PAM_SERVICE_ERR);
1031 }
1032 free(dataset);
1033 pam_zfs_free();
1034 zfs_key_config_free(&config);
1035 if (pw_clear(pamh, PASSWORD_VAR_NAME) == -1) {
1036 return (PAM_SERVICE_ERR);
1037 }
1038 return (PAM_SUCCESS);
1039
1040 }
1041
1042 __attribute__((visibility("default")))
1043 PAM_EXTERN int
pam_sm_close_session(pam_handle_t * pamh,int flags,int argc,const char ** argv)1044 pam_sm_close_session(pam_handle_t *pamh, int flags,
1045 int argc, const char **argv)
1046 {
1047 (void) flags;
1048
1049 if (geteuid() != 0) {
1050 pam_syslog(pamh, LOG_ERR,
1051 "Cannot zfs_mount when not being root.");
1052 return (PAM_SUCCESS);
1053 }
1054 zfs_key_config_t config;
1055 if (zfs_key_config_load(pamh, &config, argc, argv) != PAM_SUCCESS) {
1056 return (PAM_SESSION_ERR);
1057 }
1058 if (config.uid < config.uid_min || config.uid > config.uid_max) {
1059 zfs_key_config_free(&config);
1060 return (PAM_SUCCESS);
1061 }
1062
1063 int counter = zfs_key_config_modify_session_counter(pamh, &config, -1);
1064 if (counter != 0) {
1065 zfs_key_config_free(&config);
1066 return (PAM_SUCCESS);
1067 }
1068
1069 if (config.unmount_and_unload) {
1070 if (pam_zfs_init(pamh) != 0) {
1071 zfs_key_config_free(&config);
1072 return (PAM_SERVICE_ERR);
1073 }
1074 char *dataset = zfs_key_config_get_dataset(pamh, &config);
1075 if (!dataset) {
1076 pam_zfs_free();
1077 zfs_key_config_free(&config);
1078 return (PAM_SESSION_ERR);
1079 }
1080 if (unmount_unload(pamh, dataset, &config) == -1) {
1081 free(dataset);
1082 pam_zfs_free();
1083 zfs_key_config_free(&config);
1084 return (PAM_SESSION_ERR);
1085 }
1086 free(dataset);
1087 pam_zfs_free();
1088 }
1089
1090 zfs_key_config_free(&config);
1091 return (PAM_SUCCESS);
1092 }
1093