2 * Copyright (c) 2015 Nathan Holstein <nathan.holstein@gmail.com>
4 * Permission to use, copy, modify, and distribute this software for any
5 * purpose with or without fee is hereby granted, provided that the above
6 * copyright notice and this permission notice appear in all copies.
8 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17 #include <sys/types.h>
28 #include <security/pam_appl.h>
33 #define PAM_SERVICE_NAME "doas"
35 static pam_handle_t *pamh = NULL;
36 static sig_atomic_t volatile caught_signal = 0;
39 prompt(const char *msg, int echo_on, int *pam)
41 char buf[PAM_MAX_RESP_SIZE];
42 int flags = RPP_REQUIRE_TTY | (echo_on ? RPP_ECHO_ON : RPP_ECHO_OFF);
43 char *ret = readpassphrase(msg, buf, sizeof(buf), flags);
46 else if (!(ret = strdup(ret)))
48 explicit_bzero(buf, sizeof(buf));
53 doas_pam_conv(int nmsgs, const struct pam_message **msgs,
54 struct pam_response **rsps, __UNUSED void *ptr)
56 struct pam_response *rsp;
58 int ret = PAM_SUCCESS;
60 if (!(rsp = calloc(nmsgs, sizeof(struct pam_response))))
61 errx(1, "couldn't malloc pam_response");
63 for (i = 0; i < nmsgs; i++) {
64 switch (style = msgs[i]->msg_style) {
65 case PAM_PROMPT_ECHO_OFF:
66 case PAM_PROMPT_ECHO_ON:
67 rsp[i].resp = prompt(msgs[i]->msg, style == PAM_PROMPT_ECHO_ON, &ret);
68 if (ret != PAM_SUCCESS)
74 if (fprintf(style == PAM_ERROR_MSG ? stderr : stdout,
75 "%s\n", msgs[i]->msg) < 0)
80 errx(1, "invalid PAM msg_style %d", style);
90 /* overwrite and free response buffers */
91 for (i = 0; i < nmsgs; i++) {
92 if (rsp[i].resp == NULL)
94 switch (style = msgs[i]->msg_style) {
95 case PAM_PROMPT_ECHO_OFF:
96 case PAM_PROMPT_ECHO_ON:
97 explicit_bzero(rsp[i].resp, strlen(rsp[i].resp));
113 doas_pam(char *name, int interactive, int nopass)
115 static const struct pam_conv conv = {
116 .conv = doas_pam_conv,
125 ret = pam_start(PAM_SERVICE_NAME, name, &conv, &pamh);
126 if (ret != PAM_SUCCESS)
127 errx(1, "pam_start(\"%s\", \"%s\", ?, ?): failed\n",
128 PAM_SERVICE_NAME, name);
132 errx(1, "Authorization required");
134 ret = pam_authenticate(pamh, 0);
135 if (ret != PAM_SUCCESS) {
136 ret = pam_end(pamh, ret);
137 if (ret != PAM_SUCCESS)
138 errx(1, "pam_end(): %s\n", pam_strerror(pamh, ret));
143 ret = pam_setcred(pamh, PAM_ESTABLISH_CRED);
144 if (ret != PAM_SUCCESS)
145 errx(1, "pam_setcred(?, PAM_ESTABLISH_CRED): %s\n",
146 pam_strerror(pamh, ret));
148 ret = pam_acct_mgmt(pamh, 0);
149 if (ret != PAM_SUCCESS)
150 errx(1, "pam_setcred(): %s\n", pam_strerror(pamh, ret));
153 ret = pam_open_session(pamh, 0);
154 if (ret != PAM_SUCCESS)
155 errx(1, "pam_open_session(): %s\n", pam_strerror(pamh, ret));
157 if ((child = fork()) == -1) {
158 ret = pam_close_session(pamh, 0);
159 if (ret != PAM_SUCCESS)
160 errx(1, "pam_close_session(): %s\n", pam_strerror(pamh, ret));
162 ret = pam_end(pamh, PAM_ABORT);
163 if (ret != PAM_SUCCESS)
164 errx(1, "pam_end(): %s\n", pam_strerror(pamh, ret));
169 /* return as child */
174 /* parent watches for signals and closes session */
176 struct sigaction act, oldact;
181 if (sigprocmask(SIG_BLOCK, &sigs, NULL)) {
182 errx(1, "sigprocmask()");
185 /* setup signal handler */
186 act.sa_handler = catchsig;
187 sigemptyset(&act.sa_mask);
191 /* unblock SIGTERM and SIGALRM to catch them */
192 if(sigaddset(&sigs, SIGTERM) ||
193 sigaddset(&sigs, SIGALRM) ||
194 sigaction(SIGTERM, &act, &oldact) ||
195 sigprocmask(SIG_UNBLOCK, &sigs, NULL)) {
196 errx(1, "failed to set signal handler");
199 /* wait for child to be terminated */
200 if (waitpid(child, &status, 0) != -1) {
201 if (WIFSIGNALED(status)) {
202 fprintf(stderr, "%s%s\n", strsignal(WTERMSIG(status)),
203 WCOREDUMP(status) ? " (core dumped)" : "");
204 status = WTERMSIG(status) + 128;
206 status = WEXITSTATUS(status);
209 else if (caught_signal)
210 status = caught_signal + 128;
215 fprintf(stderr, "\nSession terminated, killing shell\n");
216 kill(child, SIGTERM);
220 ret = pam_close_session(pamh, 0);
221 if (ret != PAM_SUCCESS)
222 errx(1, "pam_close_session(): %s\n", pam_strerror(pamh, ret));
224 ret = pam_end(pamh, PAM_SUCCESS);
225 if (ret != PAM_SUCCESS)
226 errx(1, "pam_end(): %s\n", pam_strerror(pamh, ret));
231 kill(child, SIGKILL);
232 fprintf(stderr, " ...killed.\n");
234 /* unblock cached signal and resend */
235 sigaction(SIGTERM, &oldact, NULL);
236 if (caught_signal != SIGTERM)
237 caught_signal = SIGKILL;
238 kill(getpid(), caught_signal);