usr/src/lib/pam_modules/roles/roles.c

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  23  * Use is subject to license terms.
  24  */
  25
  26 #include <syslog.h>
  27 #include <pwd.h>
  28 #include <unistd.h>
  29 #include <strings.h>
  30 #include <security/pam_appl.h>
  31 #include <security/pam_modules.h>
  32 #include <libintl.h>
  33 #include <pwd.h>
  34 #include <user_attr.h>
  35 #include <secdb.h>
  36 #include <nss_dbdefs.h>
  37 #include <security/pam_impl.h>
  38
  39 static int roleinlist();
  40
  41 /*
  42  * pam_sm_acct_mgmt():
  43  *      Account management module
  44  *      This module disallows roles for primary logins and adds special
  45  *      checks to allow roles for secondary logins.
  46  */
  47
  48 /*ARGSUSED*/
  49 int
  50 pam_sm_acct_mgmt(pam_handle_t *pamh, int flags, int argc, const char **argv)
  51 {
  52         uid_t uid;
  53         userattr_t *user_entry;
  54         char    *kva_value;
  55         char    *username;
  56         char    *auser;
  57         char    *rhost;
  58         char messages[PAM_MAX_NUM_MSG][PAM_MAX_MSG_SIZE];
  59         struct passwd *pw_entry, pwd;
  60         char buf[NSS_BUFLEN_PASSWD];
  61
  62         int i;
  63         int debug = 0;
  64         int allow_remote = 0;
  65
  66         (void) pam_get_item(pamh, PAM_USER, (void **)&username);
  67         (void) pam_get_item(pamh, PAM_AUSER, (void **)&auser);
  68         (void) pam_get_item(pamh, PAM_RHOST, (void **)&rhost);
  69
  70         for (i = 0; i < argc; i++) {
  71                 if (strcmp(argv[i], "allow_remote") == 0) {
  72                         allow_remote = 1;
  73                 } else if (strcmp(argv[i], "debug") == 0) {
  74                         debug = 1;
  75                 } else {
  76                         __pam_log(LOG_AUTH | LOG_ERR,
  77                             "pam_roles:pam_sm_acct_mgmt: illegal module "
  78                             "option %s", argv[i]);
  79                 }
  80         }
  81
  82         if (debug) {
  83                 char    *ruser;
  84                 char    *service;
  85
  86                 (void) pam_get_item(pamh, PAM_RUSER, (void **)&ruser);
  87                 (void) pam_get_item(pamh, PAM_SERVICE, (void **)&service);
  88                 __pam_log(LOG_AUTH | LOG_DEBUG, "pam_roles:pam_sm_acct_mgmt: "
  89                     "service = %s, allow_remote = %d, user = %s auser = %s "
  90                     "ruser = %s rhost = %s\n", (service) ? service : "not set",
  91                     allow_remote, (username) ? username : "not set",
  92                     (auser) ? auser: "not set", (ruser) ? ruser: "not set",
  93                     (rhost) ? rhost: "not set");
  94         }
  95
  96         if (username == NULL)
  97                 return (PAM_USER_UNKNOWN);
  98
  99         /* stop masquerades by mapping username to uid to username */
 100
 101         if ((pw_entry = getpwnam_r(username, &pwd, buf, sizeof (buf))) == NULL)
 102                 return (PAM_USER_UNKNOWN);
 103         if ((pw_entry = getpwuid_r(pw_entry->pw_uid, &pwd, buf,
 104             sizeof (buf))) == NULL)
 105                 return (PAM_USER_UNKNOWN);
 106         /*
 107          * If there's no user_attr entry for the primary user or it's not a
 108          * role, no further checks are needed.
 109          */
 110
 111         if (((user_entry = getusernam(pw_entry->pw_name)) == NULL) ||
 112             ((kva_value = kva_match((kva_t *)user_entry->attr,
 113             USERATTR_TYPE_KW)) == NULL) ||
 114             ((strcmp(kva_value, USERATTR_TYPE_NONADMIN_KW) != 0) &&
 115             (strcmp(kva_value, USERATTR_TYPE_ADMIN_KW) != 0))) {
 116                 free_userattr(user_entry);
 117                 return (PAM_IGNORE);
 118         }
 119         free_userattr(user_entry);
 120
 121         /* username is a role */
 122
 123         if (strcmp(username, pw_entry->pw_name) != 0) {
 124                 __pam_log(LOG_AUTH | LOG_ALERT,
 125                     "pam_roles:pam_sm_acct_mgmt: user name %s "
 126                     "maps to user id %d which is user name %s",
 127                     username, pw_entry->pw_uid, pw_entry->pw_name);
 128
 129         }
 130
 131         /* Who's the user requesting the role? */
 132
 133         if (auser != NULL && *auser != '\0') {
 134                 /* authenticated requesting user */
 135
 136                 user_entry = getusernam(auser);
 137         } else {
 138                 /* user is implied by real UID */
 139
 140                 if ((uid = getuid()) == 0) {
 141                         /*
 142                          * Root user_attr entry cannot have roles.
 143                          * Force error and deny access.
 144                          */
 145                         user_entry = NULL;
 146                 } else {
 147                         if ((pw_entry = getpwuid_r(uid, &pwd, buf,
 148                             sizeof (buf))) == NULL) {
 149                                 return (PAM_USER_UNKNOWN);
 150                         }
 151                         user_entry = getusernam(pw_entry->pw_name);
 152                 }
 153         }
 154
 155         if ((rhost != NULL && *rhost != '\0') &&
 156             allow_remote == 0) {
 157                 /* don't allow remote roles for this service */
 158
 159                 free_userattr(user_entry);
 160                 return (PAM_PERM_DENIED);
 161         }
 162
 163         /*
 164          * If the original user does not have a user_attr entry or isn't
 165          * assigned the role being assumed, fail.
 166          */
 167
 168         if ((user_entry == NULL) ||
 169             ((kva_value = kva_match((kva_t *)user_entry->attr,
 170             USERATTR_ROLES_KW)) == NULL) ||
 171             (roleinlist(kva_value, username) == 0)) {
 172                 free_userattr(user_entry);
 173                 (void) strlcpy(messages[0], dgettext(TEXT_DOMAIN,
 174                     "Roles can only be assumed by authorized users"),
 175                     sizeof (messages[0]));
 176                 (void) __pam_display_msg(pamh, PAM_ERROR_MSG, 1, messages,
 177                     NULL);
 178                 return (PAM_PERM_DENIED);
 179         }
 180
 181         free_userattr(user_entry);
 182         return (PAM_IGNORE);
 183 }
 184
 185 int
 186 roleinlist(char *list, char *role)
 187 {
 188         char *lasts = (char *)NULL;
 189         char *rolename = (char *)strtok_r(list, ",", &lasts);
 190
 191         while (rolename) {
 192                 if (strcmp(rolename, role) == 0)
 193                         return (1);
 194                 else
 195                         rolename = (char *)strtok_r(NULL, ",", &lasts);
 196         }
 197         return (0);
 198 }