pam_modules/unix_cred/unix_cred.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright (c) 2002, 2010, Oracle and/or its affiliates. All rights reserved.
 * Copyright 2023 OmniOS Community Edition (OmniOSce) Association.
 */

#include <nss_dbdefs.h>
#include <pwd.h>
#include <stdlib.h>
#include <string.h>
#include <syslog.h>
#include <unistd.h>
#include <auth_attr.h>
#include <deflt.h>
#include <priv.h>
#include <secdb.h>
#include <user_attr.h>
#include <sys/task.h>
#include <libintl.h>
#include <project.h>
#include <errno.h>
#include <alloca.h>

#include <bsm/adt.h>
#include <bsm/adt_event.h>	/* adt_get_auid() */

#include <security/pam_appl.h>
#include <security/pam_modules.h>
#include <security/pam_impl.h>

#define	PROJECT		"project="
#define	PROJSZ		(sizeof (PROJECT) - 1)

/*
 *	unix_cred - PAM auth modules must contain both pam_sm_authenticate
 *		and pam_sm_setcred.  Some other auth module is responsible
 *		for authentication (e.g., pam_unix_auth.so), this module
 *		only implements pam_sm_setcred so that the authentication
 *		can be separated without knowledge of the Solaris Unix style
 *		credential setting.
 *		Solaris Unix style credential setting includes initializing
 *		the audit characteristics if not already initialized and
 *		setting the user's default and limit privileges.
 */

/*
 *	unix_cred - pam_sm_authenticate
 *
 *	Returns	PAM_IGNORE.
 */

/*ARGSUSED*/
int
pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, const char **argv)
{
	return (PAM_IGNORE);
}

/*
 * Set the privilege set.  The attributes are enumerated by _enum_attrs,
 * including the attribues user_attr, prof_attr and policy.conf
 */
static int
getset(char *str, priv_set_t **res)
{
	priv_set_t *tmp;
	char *badp;
	int len;

	if (str == NULL)
		return (0);

	len = strlen(str) + 1;
	badp = alloca(len);
	(void) memset(badp, '\0', len);
	do {
		const char *q, *endp;
		tmp = priv_str_to_set(str, ",", &endp);
		if (tmp == NULL) {
			if (endp == NULL)
				break;

			/* Now remove the bad privilege endp points to */
			q = strchr(endp, ',');
			if (q == NULL)
				q = endp + strlen(endp);

			if (*badp != '\0')
				(void) strlcat(badp, ",", len);
			/* Memset above guarantees NUL termination */
			/* LINTED */
			(void) strncat(badp, endp, q - endp);
			/* excise bad privilege; strtok ignores 2x sep */
			(void) memmove((void *)endp, q, strlen(q) + 1);
		}
	} while (tmp == NULL && *str != '\0');

	if (tmp == NULL) {
		syslog(LOG_AUTH|LOG_ERR,
		    "pam_setcred: can't parse privilege specification: %m\n");
		return (-1);
	} else if (*badp != '\0') {
		syslog(LOG_AUTH|LOG_DEBUG,
		    "pam_setcred: unrecognized privilege(s): %s\n", badp);
	}
	*res = tmp;
	return (0);
}

typedef struct deflim {
	char *def;
	char *lim;
} deflim_t;

/*ARGSUSED*/
static int
finddeflim(const char *name, kva_t *kva, void *ctxt, void *pres)
{
	deflim_t *pdef = pres;
	char *val;

	if (pdef->def == NULL) {
		val = kva_match(kva, USERATTR_DFLTPRIV_KW);
		if (val != NULL)
			pdef->def = strdup(val);
	}
	if (pdef->lim == NULL) {
		val = kva_match(kva, USERATTR_LIMPRIV_KW);
		if (val != NULL)
			pdef->lim = strdup(val);
	}
	return (pdef->lim != NULL && pdef->def != NULL);
}

/*
 *	unix_cred - pam_sm_setcred
 *
 *	Entry flags = 	PAM_ESTABLISH_CRED, set up Solaris Unix cred.
 *			PAM_DELETE_CRED, NOP, return PAM_SUCCESS.
 *			PAM_REINITIALIZE_CRED, set up Solaris Unix cred,
 *				or merge the current context with the new
 *				user.
 *			PAM_REFRESH_CRED, set up Solaris Unix cred.
 *			PAM_SILENT, print no messages to user.
 *
 *	Returns	PAM_SUCCESS, if all successful.
 *		PAM_CRED_ERR, if unable to set credentials.
 *		PAM_USER_UNKNOWN, if PAM_USER not set, or unable to find
 *			user in databases.
 *		PAM_SYSTEM_ERR, if no valid flag, or unable to get/set
 *			user's audit state.
 */

int
pam_sm_setcred(pam_handle_t *pamh, int flags, int argc, const char **argv)
{
	int i;
	int debug = 0;
	uint_t nowarn = flags & PAM_SILENT;
	int ret = PAM_SUCCESS;
	const char *user;
	const char *auser;
	const char *rhost;
	const char *tty;
	au_id_t	auid;
	adt_session_data_t *ah;
	adt_termid_t *termid = NULL;
	priv_set_t *lim, *def, *tset;
	char messages[PAM_MAX_NUM_MSG][PAM_MAX_MSG_SIZE];
	char buf[PROJECT_BUFSZ];
	struct project proj, *pproj;
	int error;
	char *projname;
	const char *kvs;
	char *nckvs = NULL;
	struct passwd pwd;
	char pwbuf[NSS_BUFLEN_PASSWD];
	deflim_t deflim;

	for (i = 0; i < argc; i++) {
		if (strcmp(argv[i], "debug") == 0)
			debug = 1;
		else if (strcmp(argv[i], "nowarn") == 0)
			nowarn |= 1;
	}

	if (debug)
		syslog(LOG_AUTH | LOG_DEBUG,
		    "pam_unix_cred: pam_sm_setcred(flags = %x, argc= %d)",
		    flags, argc);

	(void) pam_get_item(pamh, PAM_USER, (const void **)&user);

	if (user == NULL || *user == '\0') {
		syslog(LOG_AUTH | LOG_ERR,
		    "pam_unix_cred: USER NULL or empty!\n");
		return (PAM_USER_UNKNOWN);
	}
	(void) pam_get_item(pamh, PAM_AUSER, (const void **)&auser);
	(void) pam_get_item(pamh, PAM_RHOST, (const void **)&rhost);
	(void) pam_get_item(pamh, PAM_TTY, (const void **)&tty);
	if (debug)
		syslog(LOG_AUTH | LOG_DEBUG,
		    "pam_unix_cred: user = %s, auser = %s, rhost = %s, "
		    "tty = %s", user,
		    (auser == NULL) ? "NULL" : (*auser == '\0') ? "ZERO" :
		    auser,
		    (rhost == NULL) ? "NULL" : (*rhost == '\0') ? "ZERO" :
		    rhost,
		    (tty == NULL) ? "NULL" : (*tty == '\0') ? "ZERO" :
		    tty);

	/* validate flags */
	switch (flags & (PAM_ESTABLISH_CRED | PAM_DELETE_CRED |
	    PAM_REINITIALIZE_CRED | PAM_REFRESH_CRED)) {
	case 0:
		/* set default flag */
		flags |= PAM_ESTABLISH_CRED;
		break;
	case PAM_ESTABLISH_CRED:
	case PAM_REINITIALIZE_CRED:
	case PAM_REFRESH_CRED:
		break;
	case PAM_DELETE_CRED:
		return (PAM_SUCCESS);
	default:
		syslog(LOG_AUTH | LOG_ERR,
		    "pam_unix_cred: invalid flags %x", flags);
		return (PAM_SYSTEM_ERR);
	}

	/*
	 * if auditing on and process audit state not set,
	 * setup audit context for process.
	 */
	if (adt_start_session(&ah, NULL, ADT_USE_PROC_DATA) != 0) {
		syslog(LOG_AUTH | LOG_ERR,
		    "pam_unix_cred: cannot create start audit session %m");
		return (PAM_SYSTEM_ERR);
	}
	adt_get_auid(ah, &auid);
	if (debug) {
		int	auditstate;

		if (auditon(A_GETCOND, (caddr_t)&auditstate,
		    sizeof (auditstate)) != 0) {
			auditstate = AUC_DISABLED;
		}
		syslog(LOG_AUTH | LOG_DEBUG,
		    "pam_unix_cred: state = %d, auid = %d", auditstate,
		    auid);
	}
	if (getpwnam_r(user, &pwd, pwbuf, sizeof (pwbuf)) == NULL) {
		syslog(LOG_AUTH | LOG_ERR,
		    "pam_unix_cred: cannot get passwd entry for user = %s",
		    user);
		ret = PAM_USER_UNKNOWN;
		goto adt_done;
	}

	if ((auid == AU_NOAUDITID) &&
	    (flags & PAM_ESTABLISH_CRED)) {
		struct passwd	apwd;
		char	apwbuf[NSS_BUFLEN_PASSWD];

		errno = 0;
		if ((rhost == NULL || *rhost == '\0')) {
			if (adt_load_ttyname(tty, &termid) != 0) {
				if (errno == ENETDOWN) {
					/*
					 * tolerate not being able to
					 * translate local hostname
					 * to a termid -- it will be
					 * "loopback".
					 */
					syslog(LOG_AUTH | LOG_ERR,
					    "pam_unix_cred: cannot load "
					    "ttyname: %m, continuing.");
					goto adt_setuser;
				} else if (errno != 0) {
					syslog(LOG_AUTH | LOG_ERR,
					    "pam_unix_cred: cannot load "
					    "ttyname: %m.");
				} else {
					syslog(LOG_AUTH | LOG_ERR,
					    "pam_unix_cred: cannot load "
					    "ttyname.");
				}
				ret = PAM_SYSTEM_ERR;
				goto adt_done;
			}
		} else {
			if (adt_load_hostname(rhost, &termid) != 0) {
				if (errno != 0) {
					syslog(LOG_AUTH | LOG_ERR,
					    "pam_unix_cred: cannot load "
					    "hostname: %m.");
				} else {
					syslog(LOG_AUTH | LOG_ERR,
					    "pam_unix_cred: cannot load "
					    "hostname.");
				}
				ret = PAM_SYSTEM_ERR;
				goto adt_done;
			}
		}
adt_setuser:
		if ((auser != NULL) && (*auser != '\0') &&
		    (getpwnam_r(auser, &apwd, apwbuf,
		    sizeof (apwbuf)) != NULL)) {
			/*
			 * set up the initial audit for user coming
			 * from another user
			 */
			if (adt_set_user(ah, apwd.pw_uid, apwd.pw_gid,
			    apwd.pw_uid, apwd.pw_gid, termid, ADT_NEW) != 0) {
				syslog(LOG_AUTH | LOG_ERR,
				    "pam_unix_cred: cannot set auser audit "
				    "%m");
				ret = PAM_SYSTEM_ERR;
				goto adt_done;
			}
			if (adt_set_user(ah, pwd.pw_uid, pwd.pw_gid,
			    pwd.pw_uid, pwd.pw_gid, NULL,
			    ADT_UPDATE) != 0) {
				syslog(LOG_AUTH | LOG_ERR,
				    "pam_unix_cred: cannot merge user audit "
				    "%m");
				ret = PAM_SYSTEM_ERR;
				goto adt_done;
			}
			if (debug) {
				syslog(LOG_AUTH | LOG_DEBUG,
				    "pam_unix_cred: new audit set for %d:%d",
				    apwd.pw_uid, pwd.pw_uid);
			}
		} else {
			/*
			 * No authenticated user or authenticated user is
			 * not a local user, no remote attribution, set
			 * up the initial audit as for direct user login
			 */
			if (adt_set_user(ah, pwd.pw_uid, pwd.pw_gid,
			    pwd.pw_uid, pwd.pw_gid, termid, ADT_NEW) != 0) {
				syslog(LOG_AUTH | LOG_ERR,
				    "pam_unix_cred: cannot set user audit %m");
				ret = PAM_SYSTEM_ERR;
				goto adt_done;
			}
		}
		if (adt_set_proc(ah) != 0) {
			syslog(LOG_AUTH | LOG_ERR,
			    "pam_unix_cred: cannot set process audit %m");
			ret = PAM_CRED_ERR;
			goto adt_done;
		}
		if (debug) {
			syslog(LOG_AUTH | LOG_DEBUG,
			    "pam_unix_cred: new audit set for %d",
			    pwd.pw_uid);
		}
	} else if ((auid != AU_NOAUDITID) &&
	    (flags & PAM_REINITIALIZE_CRED)) {
		if (adt_set_user(ah, pwd.pw_uid, pwd.pw_gid, pwd.pw_uid,
		    pwd.pw_gid, NULL, ADT_UPDATE) != 0) {
			syslog(LOG_AUTH | LOG_ERR,
			    "pam_unix_cred: cannot set user audit %m");
			ret = PAM_SYSTEM_ERR;
			goto adt_done;
		}
		if (adt_set_proc(ah) != 0) {
			syslog(LOG_AUTH | LOG_ERR,
			    "pam_unix_cred: cannot set process audit %m");
			ret = PAM_CRED_ERR;
			goto adt_done;
		}
		if (debug) {
			syslog(LOG_AUTH | LOG_DEBUG,
			    "pam_unix_cred: audit merged for %d:%d",
			    auid, pwd.pw_uid);
		}
	} else if (debug) {
		syslog(LOG_AUTH | LOG_DEBUG,
		    "pam_unix_cred: audit already set for %d", auid);
	}
adt_done:
	if (termid != NULL)
		free(termid);
	if (adt_end_session(ah) != 0) {
		syslog(LOG_AUTH | LOG_ERR,
		    "pam_unix_cred: unable to end audit session");
	}

	if (ret != PAM_SUCCESS)
		return (ret);

	/* Initialize the user's project */
	(void) pam_get_item(pamh, PAM_RESOURCE, (const void **)&kvs);
	if (kvs != NULL) {
		char *tmp, *lasts, *tok;

		nckvs = tmp = strdup(kvs);
		if (nckvs == NULL)
			return (PAM_BUF_ERR);

		while ((tok = strtok_r(tmp, ";", &lasts)) != NULL) {
			if (strncmp(tok, PROJECT, PROJSZ) == 0) {
				projname = tok + PROJSZ;
				break;
			}
			tmp = NULL;
		}
	} else {
		projname = NULL;
	}

	if (projname == NULL || *projname == '\0') {
		pproj = getdefaultproj(user, &proj, (void *)&buf,
		    PROJECT_BUFSZ);
	} else {
		pproj = getprojbyname(projname, &proj, (void *)&buf,
		    PROJECT_BUFSZ);
	}
	/* projname points into nckvs; this is the first opportunity to free */
	free(nckvs);
	if (pproj == NULL) {
		syslog(LOG_AUTH | LOG_ERR,
		    "pam_unix_cred: no default project for user %s", user);
		if (!nowarn) {
			(void) snprintf(messages[0], sizeof (messages[0]),
			    dgettext(TEXT_DOMAIN, "No default project!"));
			(void) __pam_display_msg(pamh, PAM_ERROR_MSG,
			    1, messages, NULL);
		}
		return (PAM_SYSTEM_ERR);
	}
	if ((error = setproject(proj.pj_name, user, TASK_NORMAL)) != 0) {
		kva_t *kv_array;

		switch (error) {
		case SETPROJ_ERR_TASK:
			if (errno == EAGAIN) {
				syslog(LOG_AUTH | LOG_ERR,
				    "pam_unix_cred: project \"%s\" resource "
				    "control limit has been reached",
				    proj.pj_name);
				(void) snprintf(messages[0],
				    sizeof (messages[0]), dgettext(
				    TEXT_DOMAIN,
				    "Resource control limit has been "
				    "reached"));
			} else {
				syslog(LOG_AUTH | LOG_ERR,
				    "pam_unix_cred: user %s could not join "
				    "project \"%s\": %m", user, proj.pj_name);
				(void) snprintf(messages[0],
				    sizeof (messages[0]), dgettext(
				    TEXT_DOMAIN,
				    "Could not join default project"));
			}
			if (!nowarn)
				(void) __pam_display_msg(pamh, PAM_ERROR_MSG, 1,
				    messages, NULL);
			break;
		case SETPROJ_ERR_POOL:
			(void) snprintf(messages[0], sizeof (messages[0]),
			    dgettext(TEXT_DOMAIN,
			    "Could not bind to resource pool"));
			switch (errno) {
			case EACCES:
				syslog(LOG_AUTH | LOG_ERR,
				    "pam_unix_cred: project \"%s\" could not "
				    "bind to resource pool: No resource pool "
				    "accepting default bindings exists",
				    proj.pj_name);
				(void) snprintf(messages[1],
				    sizeof (messages[1]),
				    dgettext(TEXT_DOMAIN,
				    "No resource pool accepting "
				    "default bindings exists"));
				break;
			case ESRCH:
				syslog(LOG_AUTH | LOG_ERR,
				    "pam_unix_cred: project \"%s\" could not "
				    "bind to resource pool: The resource pool "
				    "is unknown", proj.pj_name);
				(void) snprintf(messages[1],
				    sizeof (messages[1]),
				    dgettext(TEXT_DOMAIN,
				    "The specified resource pool "
				    "is unknown"));
				break;
			default:
				(void) snprintf(messages[1],
				    sizeof (messages[1]),
				    dgettext(TEXT_DOMAIN,
				    "Failure during pool binding"));
				syslog(LOG_AUTH | LOG_ERR,
				    "pam_unix_cred: project \"%s\" could not "
				    "bind to resource pool: %m", proj.pj_name);
			}
			if (!nowarn)
				(void) __pam_display_msg(pamh, PAM_ERROR_MSG,
				    2, messages, NULL);
			break;
		default:
			/*
			 * Resource control assignment failed.  Unlike
			 * newtask(1), we treat this as an error.
			 */
			if (error < 0) {
				/*
				 * This isn't supposed to happen, but in
				 * case it does, this error message
				 * doesn't use error as an index, like
				 * the others might.
				 */
				syslog(LOG_AUTH | LOG_ERR,
				    "pam_unix_cred: unkwown error joining "
				    "project \"%s\" (%d)", proj.pj_name, error);
				(void) snprintf(messages[0],
				    sizeof (messages[0]),
				    dgettext(TEXT_DOMAIN,
				    "unkwown error joining project \"%s\""
				    " (%d)"), proj.pj_name, error);
			} else if ((kv_array = _str2kva(proj.pj_attr, KV_ASSIGN,
			    KV_DELIMITER)) != NULL) {
				syslog(LOG_AUTH | LOG_ERR,
				    "pam_unix_cred: %s resource control "
				    "assignment failed for project \"%s\"",
				    kv_array->data[error - 1].key,
				    proj.pj_name);
				(void) snprintf(messages[0],
				    sizeof (messages[0]),
				    dgettext(TEXT_DOMAIN,
				    "%s resource control assignment failed for "
				    "project \"%s\""),
				    kv_array->data[error - 1].key,
				    proj.pj_name);
				_kva_free(kv_array);
			} else {
				syslog(LOG_AUTH | LOG_ERR,
				    "pam_unix_cred: resource control "
				    "assignment failed for project \"%s\""
				    "attribute %d", proj.pj_name, error);
				(void) snprintf(messages[0],
				    sizeof (messages[0]),
				    dgettext(TEXT_DOMAIN,
				    "resource control assignment failed for "
				    "project \"%s\" attribute %d"),
				    proj.pj_name, error);
			}
			if (!nowarn)
				(void) __pam_display_msg(pamh, PAM_ERROR_MSG,
				    1, messages, NULL);
		}
		return (PAM_SYSTEM_ERR);
	}

	tset = def = lim = NULL;
	deflim.def = deflim.lim = NULL;

	(void) _enum_attrs(user, finddeflim, NULL, &deflim);

	if (getset(deflim.lim, &lim) != 0 || getset(deflim.def, &def) != 0) {
		ret = PAM_SYSTEM_ERR;
		goto out;
	}

	if (def == NULL) {
		def = priv_allocset();
		if (def == NULL) {
			ret = PAM_SYSTEM_ERR;
			goto out;
		}
		priv_basicset(def);
		errno = 0;
		if ((pathconf("/", _PC_CHOWN_RESTRICTED) == -1) && (errno == 0))
			(void) priv_addset(def, PRIV_FILE_CHOWN_SELF);
	}
	/*
	 * Silently limit the privileges to those actually available
	 * in the current zone.
	 */
	tset = priv_allocset();
	if (tset == NULL) {
		ret = PAM_SYSTEM_ERR;
		goto out;
	}
	if (getppriv(PRIV_PERMITTED, tset) != 0) {
		ret = PAM_SYSTEM_ERR;
		goto out;
	}
	if (!priv_issubset(def, tset))
		priv_intersect(tset, def);
	/*
	 * We set privilege awareness here so that I gets copied to
	 * P & E when the final setuid(uid) happens.
	 */
	(void) setpflags(PRIV_AWARE, 1);
	if (setppriv(PRIV_SET, PRIV_INHERITABLE, def) != 0) {
		syslog(LOG_AUTH | LOG_ERR,
		    "pam_setcred: setppriv(defaultpriv) failed: %m");
		ret = PAM_CRED_ERR;
	}

	if (lim != NULL) {
		/*
		 * Silently limit the privileges to the limit set available.
		 */
		if (getppriv(PRIV_LIMIT, tset) != 0) {
			ret = PAM_SYSTEM_ERR;
			goto out;
		}
		if (!priv_issubset(lim, tset))
			priv_intersect(tset, lim);
		if (setppriv(PRIV_SET, PRIV_LIMIT, lim) != 0) {
			syslog(LOG_AUTH | LOG_ERR,
			    "pam_setcred: setppriv(limitpriv) failed: %m");
			ret = PAM_CRED_ERR;
			goto out;
		}
		/*
		 * In order not to surprise certain applications, we
		 * need to get rid of privilege awareness and thus we must
		 * set this flag which will cause a reset on set*uid().
		 */
		(void) setpflags(PRIV_AWARE_RESET, 1);
	}
	/*
	 * This may fail but we do not care as this will be reset later
	 * when the uids are set to their final values.
	 */
	(void) setpflags(PRIV_AWARE, 0);
	/*
	 * Remove PRIV_PFEXEC; stop running as if we are under a profile
	 * shell.  A user with a profile shell will set PRIV_PFEXEC.
	 */
	(void) setpflags(PRIV_PFEXEC, 0);

out:
	free(deflim.lim);
	free(deflim.def);

	if (lim != NULL)
		priv_freeset(lim);
	if (def != NULL)
		priv_freeset(def);
	if (tset != NULL)
		priv_freeset(tset);

	return (ret);
}