2 * Copyright (c) 2015 Nathan Holstein <nathan.holstein@gmail.com>
4 * Permission to use, copy, modify, and distribute this software for any
5 * purpose with or without fee is hereby granted, provided that the above
6 * copyright notice and this permission notice appear in all copies.
8 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17 #include <sys/types.h>
31 #include <security/pam_appl.h>
36 #define PAM_SERVICE_NAME "doas"
38 static pam_handle_t *pamh = NULL;
39 static sig_atomic_t volatile caught_signal = 0;
40 static char doas_prompt[128];
43 prompt(const char *msg, int echo_on, int *pam)
46 char *ret, buf[PAM_MAX_RESP_SIZE];
47 int flags = RPP_REQUIRE_TTY | (echo_on ? RPP_ECHO_ON : RPP_ECHO_OFF);
49 /* overwrite default prompt if it matches "Password:[ ]" */
50 if (strncmp(msg,"Password:", 9) == 0 &&
51 (msg[9] == '\0' || (msg[9] == ' ' && msg[10] == '\0')))
56 ret = readpassphrase(prompt, buf, sizeof(buf), flags);
59 else if (!(ret = strdup(ret)))
62 explicit_bzero(buf, sizeof(buf));
67 doas_pam_conv(int nmsgs, const struct pam_message **msgs,
68 struct pam_response **rsps, __UNUSED void *ptr)
70 struct pam_response *rsp;
72 int ret = PAM_SUCCESS;
74 if (!(rsp = calloc(nmsgs, sizeof(struct pam_response))))
75 errx(1, "couldn't malloc pam_response");
77 for (i = 0; i < nmsgs; i++) {
78 switch (style = msgs[i]->msg_style) {
79 case PAM_PROMPT_ECHO_OFF:
80 case PAM_PROMPT_ECHO_ON:
81 rsp[i].resp = prompt(msgs[i]->msg, style == PAM_PROMPT_ECHO_ON, &ret);
82 if (ret != PAM_SUCCESS)
88 if (fprintf(style == PAM_ERROR_MSG ? stderr : stdout,
89 "%s\n", msgs[i]->msg) < 0)
94 errx(1, "invalid PAM msg_style %d", style);
104 /* overwrite and free response buffers */
105 for (i = 0; i < nmsgs; i++) {
106 if (rsp[i].resp == NULL)
108 switch (style = msgs[i]->msg_style) {
109 case PAM_PROMPT_ECHO_OFF:
110 case PAM_PROMPT_ECHO_ON:
111 explicit_bzero(rsp[i].resp, strlen(rsp[i].resp));
127 doas_pam(char *name, int interactive, int nopass)
129 static const struct pam_conv conv = {
130 .conv = doas_pam_conv,
133 const char *ttydev, *tty;
140 ret = pam_start(PAM_SERVICE_NAME, name, &conv, &pamh);
141 if (ret != PAM_SUCCESS)
142 errx(1, "pam_start(\"%s\", \"%s\", ?, ?): failed\n",
143 PAM_SERVICE_NAME, name);
145 ret = pam_set_item(pamh, PAM_USER, name);
146 if (ret != PAM_SUCCESS)
147 errx(1, "pam_set_item(?, PAM_USER, \"%s\"): %s\n",
148 name, pam_strerror(pamh, ret));
150 ret = pam_set_item(pamh, PAM_RUSER, name);
151 if (ret != PAM_SUCCESS)
152 errx(1, "pam_set_item(?, PAM_RUSER, \"%s\"): %s\n",
153 name, pam_strerror(pamh, ret));
155 if (isatty(0) && (ttydev = ttyname(0)) != NULL) {
156 if (strncmp(ttydev, "/dev/", 5))
161 ret = pam_set_item(pamh, PAM_TTY, tty);
162 if (ret != PAM_SUCCESS)
163 errx(1, "pam_set_item(?, PAM_TTY, \"%s\"): %s\n",
164 tty, pam_strerror(pamh, ret));
169 errx(1, "Authorization required");
171 /* doas style prompt for pam */
172 char host[HOST_NAME_MAX + 1];
173 if (gethostname(host, sizeof(host)))
174 snprintf(host, sizeof(host), "?");
175 snprintf(doas_prompt, sizeof(doas_prompt),
176 "\rdoas (%.32s@%.32s) password: ", name, host);
179 ret = pam_authenticate(pamh, 0);
180 if (ret != PAM_SUCCESS) {
181 ret = pam_end(pamh, ret);
182 if (ret != PAM_SUCCESS)
183 errx(1, "pam_end(): %s\n", pam_strerror(pamh, ret));
188 ret = pam_acct_mgmt(pamh, 0);
189 if (ret == PAM_NEW_AUTHTOK_REQD)
190 ret = pam_chauthtok(pamh, PAM_CHANGE_EXPIRED_AUTHTOK);
192 /* account not vaild or changing the auth token failed */
193 if (ret != PAM_SUCCESS)
196 ret = pam_setcred(pamh, PAM_ESTABLISH_CRED);
197 if (ret != PAM_SUCCESS)
198 errx(1, "pam_setcred(?, PAM_ESTABLISH_CRED): %s\n",
199 pam_strerror(pamh, ret));
202 ret = pam_open_session(pamh, 0);
203 if (ret != PAM_SUCCESS)
204 errx(1, "pam_open_session(): %s\n", pam_strerror(pamh, ret));
206 if ((child = fork()) == -1) {
207 pam_close_session(pamh, 0);
208 pam_end(pamh, PAM_ABORT);
212 /* return as child */
217 /* parent watches for signals and closes session */
219 struct sigaction act, oldact;
224 if (sigprocmask(SIG_BLOCK, &sigs, NULL)) {
225 warn("failed to block signals");
229 /* setup signal handler */
230 act.sa_handler = catchsig;
231 sigemptyset(&act.sa_mask);
234 /* unblock SIGTERM and SIGALRM to catch them */
236 if(sigaddset(&sigs, SIGTERM) ||
237 sigaddset(&sigs, SIGALRM) ||
238 sigaction(SIGTERM, &act, &oldact) ||
239 sigprocmask(SIG_UNBLOCK, &sigs, NULL)) {
240 warn("failed to set signal handler");
244 if (!caught_signal) {
245 /* wait for child to be terminated */
246 if (waitpid(child, &status, 0) != -1) {
247 if (WIFSIGNALED(status)) {
248 fprintf(stderr, "%s%s\n", strsignal(WTERMSIG(status)),
249 WCOREDUMP(status) ? " (core dumped)" : "");
250 status = WTERMSIG(status) + 128;
252 status = WEXITSTATUS(status);
255 else if (caught_signal)
256 status = caught_signal + 128;
262 fprintf(stderr, "\nSession terminated, killing shell\n");
263 kill(child, SIGTERM);
267 ret = pam_close_session(pamh, 0);
268 if (ret != PAM_SUCCESS)
269 errx(1, "pam_close_session(): %s\n", pam_strerror(pamh, ret));
271 pam_end(pamh, PAM_SUCCESS);
276 kill(child, SIGKILL);
277 fprintf(stderr, " ...killed.\n");
279 /* unblock cached signal and resend */
280 sigaction(SIGTERM, &oldact, NULL);
281 if (caught_signal != SIGTERM)
282 caught_signal = SIGKILL;
283 kill(getpid(), caught_signal);