Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 30 Apr 2012 13:37:08 +0000 (UTC)
From:      Jean-Sebastien Pedron <dumbbell@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-8@freebsd.org
Subject:   svn commit: r234843 - stable/8/lib/libpam/modules/pam_exec
Message-ID:  <201204301337.q3UDb81V068111@svn.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: dumbbell
Date: Mon Apr 30 13:37:07 2012
New Revision: 234843
URL: http://svn.freebsd.org/changeset/base/234843

Log:
  MFC r233507:
  Use program exit status as pam_exec return code (optional)
  
  pam_exec(8) now accepts a new option "return_prog_exit_status". When
  set, the program exit status is used as the pam_exec return code. It
  allows the program to tell why the step failed (eg. user unknown).
  However, if it exits with a code not allowed by the calling PAM service
  module function (see $PAM_SM_FUNC below), a warning is logged and
  PAM_SERVICE_ERR is returned.
  
  The following changes are related to this new feature but they apply no
  matter if the "return_prog_exit_status" option is set or not.
  
  The environment passed to the program is extended:
      o  $PAM_SM_FUNC contains the name of the PAM service module function
         (eg. pam_sm_authenticate).
      o  All valid PAM return codes' numerical values are available
         through variables named after the return code name. For instance,
         $PAM_SUCCESS, $PAM_USER_UNKNOWN or $PAM_PERM_DENIED.
  
  pam_exec return code better reflects what went on:
      o  If the program exits with !0, the return code is now
         PAM_PERM_DENIED, not PAM_SYSTEM_ERR.
      o  If the program fails because of a signal (WIFSIGNALED) or doesn't
         terminate normally (!WIFEXITED), the return code is now
         PAM_SERVICE_ERR, not PAM_SYSTEM_ERR.
      o  If a syscall in pam_exec fails, the return code remains
         PAM_SYSTEM_ERR.
  
  waitpid(2) is called in a loop. If it returns because of EINTR, do it
  again. Before, it would return PAM_SYSTEM_ERR without waiting for the
  child to exit.
  
  Several log messages now include the PAM service module function name.
  
  The man page is updated accordingly.
  
  Reviewed by:	des@
  Sponsored by:	Yakaz (http://www.yakaz.com)
  
  MFC r234184:
  Fix error messages containing the executed command name
  
  Before, we took the first argument to pam_exec(8). With the addition of
  options in front of the command, this could be wrong.
  
  Now, options are parsed before calling _pam_exec() and messages contain
  the proper command name.
  
  While here, fix a warning.

Modified:
  stable/8/lib/libpam/modules/pam_exec/pam_exec.8
  stable/8/lib/libpam/modules/pam_exec/pam_exec.c
Directory Properties:
  stable/8/lib/libpam/   (props changed)

Modified: stable/8/lib/libpam/modules/pam_exec/pam_exec.8
==============================================================================
--- stable/8/lib/libpam/modules/pam_exec/pam_exec.8	Mon Apr 30 13:34:15 2012	(r234842)
+++ stable/8/lib/libpam/modules/pam_exec/pam_exec.8	Mon Apr 30 13:37:07 2012	(r234843)
@@ -32,7 +32,7 @@
 .\"
 .\" $FreeBSD$
 .\"
-.Dd February 1, 2005
+.Dd February 8, 2012
 .Dt PAM_EXEC 8
 .Os
 .Sh NAME
@@ -45,9 +45,25 @@
 .Pa pam_exec
 .Op Ar arguments
 .Sh DESCRIPTION
-The exec service module for PAM executes the program designated by its
-first argument, with its remaining arguments as command-line
-arguments.
+The exec service module for PAM executes the program designated by
+its first argument if no options are specified, with its remaining
+arguments as command-line arguments.
+If options are specified, the program and its arguments follow the last
+option or
+.Cm --
+if the program name conflicts with an option name.
+.Pp
+The following options may be passed before the program and its
+arguments:
+.Bl -tag -width ".Cm return_prog_exit_status"
+.It Cm return_prog_exit_status
+Use the program exit status as the return code of the pam_sm_* function.
+It must be a valid return value for this function.
+.It Cm --
+Stop options parsing;
+program and its arguments follow.
+.El
+.Pp
 The child's environment is set to the current PAM environment list,
 as returned by
 .Xr pam_getenvlist 3 .
@@ -56,13 +72,69 @@ variables:
 .Ev PAM_RHOST ,
 .Ev PAM_RUSER ,
 .Ev PAM_SERVICE ,
-.Ev PAM_TTY ,
+.Ev PAM_SM_FUNC ,
+.Ev PAM_TTY
 and
 .Ev PAM_USER .
+.Pp
+The
+.Ev PAM_SM_FUNC
+variable contains the name of the PAM service module function being
+called.
+It may be:
+.Bl -dash -offset indent -compact
+.It
+pam_sm_acct_mgmt
+.It
+pam_sm_authenticate
+.It
+pam_sm_chauthtok
+.It
+pam_sm_close_session
+.It
+pam_sm_open_session
+.It
+pam_sm_setcred
+.El
+.Pp
+If
+.Cm return_prog_exit_status
+is not set (default), the
+.Ev PAM_SM_FUNC
+function returns
+.Er PAM_SUCCESS
+if the program exit status is 0,
+.Er PAM_PERM_DENIED
+otherwise.
+.Pp
+If
+.Cm return_prog_exit_status
+is set, the program exit status is used.
+It should be
+.Er PAM_SUCCESS
+or one of the error codes allowed by the calling
+.Ev PAM_SM_FUNC
+function.
+The valid codes are documented in each function man page.
+If the exit status is not a valid return code,
+.Er PAM_SERVICE_ERR
+is returned.
+Each valid codes numerical value is available as an environment variable
+(eg.\&
+.Ev PAM_SUCESS ,
+.Ev PAM_USER_UNKNOWN ,
+etc).
+This is useful in shell scripts for instance.
 .Sh SEE ALSO
 .Xr pam_get_item 3 ,
 .Xr pam.conf 5 ,
-.Xr pam 8
+.Xr pam 8 ,
+.Xr pam_sm_acct_mgmt 8 ,
+.Xr pam_sm_authenticate 8 ,
+.Xr pam_sm_chauthtok 8,
+.Xr pam_sm_close_session 8 ,
+.Xr pam_sm_open_session 8 ,
+.Xr pam_sm_setcred 8 .
 .Sh AUTHORS
 The
 .Nm

Modified: stable/8/lib/libpam/modules/pam_exec/pam_exec.c
==============================================================================
--- stable/8/lib/libpam/modules/pam_exec/pam_exec.c	Mon Apr 30 13:34:15 2012	(r234842)
+++ stable/8/lib/libpam/modules/pam_exec/pam_exec.c	Mon Apr 30 13:37:07 2012	(r234843)
@@ -60,32 +60,86 @@ static struct {
 	ENV_ITEM(PAM_RUSER),
 };
 
+struct pe_opts {
+	int	return_prog_exit_status;
+};
+
+#define	PAM_RV_COUNT 24
+
 static int
-_pam_exec(pam_handle_t *pamh __unused, int flags __unused,
-    int argc, const char *argv[])
+parse_options(const char *func, int *argc, const char **argv[],
+    struct pe_opts *options)
+{
+	int i;
+
+	/*
+	 * Parse options:
+	 *   return_prog_exit_status:
+	 *     use the program exit status as the return code of pam_exec
+	 *   --:
+	 *     stop options parsing; what follows is the command to execute
+	 */
+	options->return_prog_exit_status = 0;
+
+	for (i = 0; i < *argc; ++i) {
+		if (strcmp((*argv)[i], "return_prog_exit_status") == 0) {
+			openpam_log(PAM_LOG_DEBUG,
+			    "%s: Option \"return_prog_exit_status\" enabled",
+			    func);
+			options->return_prog_exit_status = 1;
+		} else {
+			if (strcmp((*argv)[i], "--") == 0) {
+				(*argc)--;
+				(*argv)++;
+			}
+
+			break;
+		}
+	}
+
+	(*argc) -= i;
+	(*argv) += i;
+
+	return (0);
+}
+
+static int
+_pam_exec(pam_handle_t *pamh __unused,
+    const char *func, int flags __unused, int argc, const char *argv[],
+    struct pe_opts *options)
 {
 	int envlen, i, nitems, pam_err, status;
-	char *env, **envlist, **tmp;
+	int nitems_rv;
+	char **envlist, **tmp, *envstr;
 	volatile int childerr;
 	pid_t pid;
 
-	if (argc < 1)
-		return (PAM_SERVICE_ERR);
-
 	/*
 	 * XXX For additional credit, divert child's stdin/stdout/stderr
 	 * to the conversation function.
 	 */
 
+	/* Check there's a program name left after parsing options. */
+	if (argc < 1) {
+		openpam_log(PAM_LOG_ERROR, "%s: No program specified: aborting",
+		    func);
+		return (PAM_SERVICE_ERR);
+	}
+
 	/*
-	 * Set up the child's environment list.  It consists of the PAM
-	 * environment, plus a few hand-picked PAM items.
+	 * Set up the child's environment list. It consists of the PAM
+	 * environment, plus a few hand-picked PAM items, the pam_sm_*
+	 * function name calling it and, if return_prog_exit_status is
+	 * set, the valid return codes numerical values.
 	 */
 	envlist = pam_getenvlist(pamh);
 	for (envlen = 0; envlist[envlen] != NULL; ++envlen)
 		/* nothing */ ;
 	nitems = sizeof(env_items) / sizeof(*env_items);
-	tmp = realloc(envlist, (envlen + nitems + 1) * sizeof(*envlist));
+	/* Count PAM return values put in the environment. */
+	nitems_rv = options->return_prog_exit_status ? PAM_RV_COUNT : 0;
+	tmp = realloc(envlist, (envlen + nitems + 1 + nitems_rv + 1) *
+	    sizeof(*envlist));
 	if (tmp == NULL) {
 		openpam_free_envlist(envlist);
 		return (PAM_BUF_ERR);
@@ -93,12 +147,12 @@ _pam_exec(pam_handle_t *pamh __unused, i
 	envlist = tmp;
 	for (i = 0; i < nitems; ++i) {
 		const void *item;
-		char *envstr;
 
 		pam_err = pam_get_item(pamh, env_items[i].item, &item);
 		if (pam_err != PAM_SUCCESS || item == NULL)
 			continue;
-		asprintf(&envstr, "%s=%s", env_items[i].name, item);
+		asprintf(&envstr, "%s=%s", env_items[i].name,
+		    (const char *)item);
 		if (envstr == NULL) {
 			openpam_free_envlist(envlist);
 			return (PAM_BUF_ERR);
@@ -107,10 +161,59 @@ _pam_exec(pam_handle_t *pamh __unused, i
 		envlist[envlen] = NULL;
 	}
 
+	/* Add the pam_sm_* function name to the environment. */
+	asprintf(&envstr, "PAM_SM_FUNC=%s", func);
+	if (envstr == NULL) {
+		openpam_free_envlist(envlist);
+		return (PAM_BUF_ERR);
+	}
+	envlist[envlen++] = envstr;
+
+	/* Add the PAM return values to the environment. */
+	if (options->return_prog_exit_status) {
+#define	ADD_PAM_RV_TO_ENV(name)						\
+		asprintf(&envstr, #name "=%d", name);			\
+		if (envstr == NULL) {					\
+			openpam_free_envlist(envlist);			\
+			return (PAM_BUF_ERR);				\
+		}							\
+		envlist[envlen++] = envstr
+		/*
+		 * CAUTION: When adding/removing an item in the list
+		 * below, be sure to update the value of PAM_RV_COUNT.
+		 */
+		ADD_PAM_RV_TO_ENV(PAM_ABORT);
+		ADD_PAM_RV_TO_ENV(PAM_ACCT_EXPIRED);
+		ADD_PAM_RV_TO_ENV(PAM_AUTHINFO_UNAVAIL);
+		ADD_PAM_RV_TO_ENV(PAM_AUTHTOK_DISABLE_AGING);
+		ADD_PAM_RV_TO_ENV(PAM_AUTHTOK_ERR);
+		ADD_PAM_RV_TO_ENV(PAM_AUTHTOK_LOCK_BUSY);
+		ADD_PAM_RV_TO_ENV(PAM_AUTHTOK_RECOVERY_ERR);
+		ADD_PAM_RV_TO_ENV(PAM_AUTH_ERR);
+		ADD_PAM_RV_TO_ENV(PAM_BUF_ERR);
+		ADD_PAM_RV_TO_ENV(PAM_CONV_ERR);
+		ADD_PAM_RV_TO_ENV(PAM_CRED_ERR);
+		ADD_PAM_RV_TO_ENV(PAM_CRED_EXPIRED);
+		ADD_PAM_RV_TO_ENV(PAM_CRED_INSUFFICIENT);
+		ADD_PAM_RV_TO_ENV(PAM_CRED_UNAVAIL);
+		ADD_PAM_RV_TO_ENV(PAM_IGNORE);
+		ADD_PAM_RV_TO_ENV(PAM_MAXTRIES);
+		ADD_PAM_RV_TO_ENV(PAM_NEW_AUTHTOK_REQD);
+		ADD_PAM_RV_TO_ENV(PAM_PERM_DENIED);
+		ADD_PAM_RV_TO_ENV(PAM_SERVICE_ERR);
+		ADD_PAM_RV_TO_ENV(PAM_SESSION_ERR);
+		ADD_PAM_RV_TO_ENV(PAM_SUCCESS);
+		ADD_PAM_RV_TO_ENV(PAM_SYSTEM_ERR);
+		ADD_PAM_RV_TO_ENV(PAM_TRY_AGAIN);
+		ADD_PAM_RV_TO_ENV(PAM_USER_UNKNOWN);
+	}
+
+	envlist[envlen] = NULL;
+
 	/*
 	 * Fork and run the command.  By using vfork() instead of fork(),
 	 * we can distinguish between an execve() failure and a non-zero
-	 * exit code from the command.
+	 * exit status from the command.
 	 */
 	childerr = 0;
 	if ((pid = vfork()) == 0) {
@@ -120,81 +223,276 @@ _pam_exec(pam_handle_t *pamh __unused, i
 	}
 	openpam_free_envlist(envlist);
 	if (pid == -1) {
-		openpam_log(PAM_LOG_ERROR, "vfork(): %m");
+		openpam_log(PAM_LOG_ERROR, "%s: vfork(): %m", func);
 		return (PAM_SYSTEM_ERR);
 	}
-	if (waitpid(pid, &status, 0) == -1) {
-		openpam_log(PAM_LOG_ERROR, "waitpid(): %m");
+	while (waitpid(pid, &status, 0) == -1) {
+		if (errno == EINTR)
+			continue;
+		openpam_log(PAM_LOG_ERROR, "%s: waitpid(): %m", func);
 		return (PAM_SYSTEM_ERR);
 	}
 	if (childerr != 0) {
-		openpam_log(PAM_LOG_ERROR, "execve(): %m");
+		openpam_log(PAM_LOG_ERROR, "%s: execve(): %m", func);
 		return (PAM_SYSTEM_ERR);
 	}
 	if (WIFSIGNALED(status)) {
-		openpam_log(PAM_LOG_ERROR, "%s caught signal %d%s",
-		    argv[0], WTERMSIG(status),
+		openpam_log(PAM_LOG_ERROR, "%s: %s caught signal %d%s",
+		    func, argv[0], WTERMSIG(status),
 		    WCOREDUMP(status) ? " (core dumped)" : "");
-		return (PAM_SYSTEM_ERR);
+		return (PAM_SERVICE_ERR);
 	}
 	if (!WIFEXITED(status)) {
-		openpam_log(PAM_LOG_ERROR, "unknown status 0x%x", status);
-		return (PAM_SYSTEM_ERR);
+		openpam_log(PAM_LOG_ERROR, "%s: unknown status 0x%x",
+		    func, status);
+		return (PAM_SERVICE_ERR);
 	}
-	if (WEXITSTATUS(status) != 0) {
-		openpam_log(PAM_LOG_ERROR, "%s returned code %d",
-		    argv[0], WEXITSTATUS(status));
-		return (PAM_SYSTEM_ERR);
+
+	if (options->return_prog_exit_status) {
+		openpam_log(PAM_LOG_DEBUG,
+		    "%s: Use program exit status as return value: %d",
+		    func, WEXITSTATUS(status));
+		return (WEXITSTATUS(status));
+	} else {
+		return (WEXITSTATUS(status) == 0 ?
+		    PAM_SUCCESS : PAM_PERM_DENIED);
 	}
-	return (PAM_SUCCESS);
 }
 
 PAM_EXTERN int
 pam_sm_authenticate(pam_handle_t *pamh, int flags,
     int argc, const char *argv[])
 {
+	int ret;
+	struct pe_opts options;
+
+	ret = parse_options(__func__, &argc, &argv, &options);
+	if (ret != 0)
+		return (PAM_SERVICE_ERR);
+
+	ret = _pam_exec(pamh, __func__, flags, argc, argv, &options);
 
-	return (_pam_exec(pamh, flags, argc, argv));
+	/*
+	 * We must check that the program returned a valid code for this
+	 * function.
+	 */
+	switch (ret) {
+	case PAM_SUCCESS:
+	case PAM_ABORT:
+	case PAM_AUTHINFO_UNAVAIL:
+	case PAM_AUTH_ERR:
+	case PAM_BUF_ERR:
+	case PAM_CONV_ERR:
+	case PAM_CRED_INSUFFICIENT:
+	case PAM_IGNORE:
+	case PAM_MAXTRIES:
+	case PAM_PERM_DENIED:
+	case PAM_SERVICE_ERR:
+	case PAM_SYSTEM_ERR:
+	case PAM_USER_UNKNOWN:
+		break;
+	default:
+		openpam_log(PAM_LOG_ERROR, "%s returned invalid code %d",
+		    argv[0], ret);
+		ret = PAM_SERVICE_ERR;
+	}
+
+	return (ret);
 }
 
 PAM_EXTERN int
 pam_sm_setcred(pam_handle_t *pamh, int flags,
     int argc, const char *argv[])
 {
+	int ret;
+	struct pe_opts options;
+
+	ret = parse_options(__func__, &argc, &argv, &options);
+	if (ret != 0)
+		return (PAM_SERVICE_ERR);
+
+	ret = _pam_exec(pamh, __func__, flags, argc, argv, &options);
+
+	/*
+	 * We must check that the program returned a valid code for this
+	 * function.
+	 */
+	switch (ret) {
+	case PAM_SUCCESS:
+	case PAM_ABORT:
+	case PAM_BUF_ERR:
+	case PAM_CONV_ERR:
+	case PAM_CRED_ERR:
+	case PAM_CRED_EXPIRED:
+	case PAM_CRED_UNAVAIL:
+	case PAM_IGNORE:
+	case PAM_PERM_DENIED:
+	case PAM_SERVICE_ERR:
+	case PAM_SYSTEM_ERR:
+	case PAM_USER_UNKNOWN:
+		break;
+	default:
+		openpam_log(PAM_LOG_ERROR, "%s returned invalid code %d",
+		    argv[0], ret);
+		ret = PAM_SERVICE_ERR;
+	}
 
-	return (_pam_exec(pamh, flags, argc, argv));
+	return (ret);
 }
 
 PAM_EXTERN int
 pam_sm_acct_mgmt(pam_handle_t *pamh, int flags,
     int argc, const char *argv[])
 {
+	int ret;
+	struct pe_opts options;
+
+	ret = parse_options(__func__, &argc, &argv, &options);
+	if (ret != 0)
+		return (PAM_SERVICE_ERR);
+
+	ret = _pam_exec(pamh, __func__, flags, argc, argv, &options);
+
+	/*
+	 * We must check that the program returned a valid code for this
+	 * function.
+	 */
+	switch (ret) {
+	case PAM_SUCCESS:
+	case PAM_ABORT:
+	case PAM_ACCT_EXPIRED:
+	case PAM_AUTH_ERR:
+	case PAM_BUF_ERR:
+	case PAM_CONV_ERR:
+	case PAM_IGNORE:
+	case PAM_NEW_AUTHTOK_REQD:
+	case PAM_PERM_DENIED:
+	case PAM_SERVICE_ERR:
+	case PAM_SYSTEM_ERR:
+	case PAM_USER_UNKNOWN:
+		break;
+	default:
+		openpam_log(PAM_LOG_ERROR, "%s returned invalid code %d",
+		    argv[0], ret);
+		ret = PAM_SERVICE_ERR;
+	}
 
-	return (_pam_exec(pamh, flags, argc, argv));
+	return (ret);
 }
 
 PAM_EXTERN int
 pam_sm_open_session(pam_handle_t *pamh, int flags,
     int argc, const char *argv[])
 {
+	int ret;
+	struct pe_opts options;
+
+	ret = parse_options(__func__, &argc, &argv, &options);
+	if (ret != 0)
+		return (PAM_SERVICE_ERR);
 
-	return (_pam_exec(pamh, flags, argc, argv));
+	ret = _pam_exec(pamh, __func__, flags, argc, argv, &options);
+
+	/*
+	 * We must check that the program returned a valid code for this
+	 * function.
+	 */
+	switch (ret) {
+	case PAM_SUCCESS:
+	case PAM_ABORT:
+	case PAM_BUF_ERR:
+	case PAM_CONV_ERR:
+	case PAM_IGNORE:
+	case PAM_PERM_DENIED:
+	case PAM_SERVICE_ERR:
+	case PAM_SESSION_ERR:
+	case PAM_SYSTEM_ERR:
+		break;
+	default:
+		openpam_log(PAM_LOG_ERROR, "%s returned invalid code %d",
+		    argv[0], ret);
+		ret = PAM_SERVICE_ERR;
+	}
+
+	return (ret);
 }
 
 PAM_EXTERN int
 pam_sm_close_session(pam_handle_t *pamh, int flags,
     int argc, const char *argv[])
 {
+	int ret;
+	struct pe_opts options;
 
-	return (_pam_exec(pamh, flags, argc, argv));
+	ret = parse_options(__func__, &argc, &argv, &options);
+	if (ret != 0)
+		return (PAM_SERVICE_ERR);
+
+	ret = _pam_exec(pamh, __func__, flags, argc, argv, &options);
+
+	/*
+	 * We must check that the program returned a valid code for this
+	 * function.
+	 */
+	switch (ret) {
+	case PAM_SUCCESS:
+	case PAM_ABORT:
+	case PAM_BUF_ERR:
+	case PAM_CONV_ERR:
+	case PAM_IGNORE:
+	case PAM_PERM_DENIED:
+	case PAM_SERVICE_ERR:
+	case PAM_SESSION_ERR:
+	case PAM_SYSTEM_ERR:
+		break;
+	default:
+		openpam_log(PAM_LOG_ERROR, "%s returned invalid code %d",
+		    argv[0], ret);
+		ret = PAM_SERVICE_ERR;
+	}
+
+	return (ret);
 }
 
 PAM_EXTERN int
 pam_sm_chauthtok(pam_handle_t *pamh, int flags,
     int argc, const char *argv[])
 {
+	int ret;
+	struct pe_opts options;
+
+	ret = parse_options(__func__, &argc, &argv, &options);
+	if (ret != 0)
+		return (PAM_SERVICE_ERR);
+
+	ret = _pam_exec(pamh, __func__, flags, argc, argv, &options);
+
+	/*
+	 * We must check that the program returned a valid code for this
+	 * function.
+	 */
+	switch (ret) {
+	case PAM_SUCCESS:
+	case PAM_ABORT:
+	case PAM_AUTHTOK_DISABLE_AGING:
+	case PAM_AUTHTOK_ERR:
+	case PAM_AUTHTOK_LOCK_BUSY:
+	case PAM_AUTHTOK_RECOVERY_ERR:
+	case PAM_BUF_ERR:
+	case PAM_CONV_ERR:
+	case PAM_IGNORE:
+	case PAM_PERM_DENIED:
+	case PAM_SERVICE_ERR:
+	case PAM_SYSTEM_ERR:
+	case PAM_TRY_AGAIN:
+		break;
+	default:
+		openpam_log(PAM_LOG_ERROR, "%s returned invalid code %d",
+		    argv[0], ret);
+		ret = PAM_SERVICE_ERR;
+	}
 
-	return (_pam_exec(pamh, flags, argc, argv));
+	return (ret);
 }
 
 PAM_MODULE_ENTRY("pam_exec");



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201204301337.q3UDb81V068111>