2 * Copyright (c) 2015 Nathan Holstein <nathan.holstein@gmail.com>
4 * Permission to use, copy, modify, and distribute this software for any
5 * purpose with or without fee is hereby granted, provided that the above
6 * copyright notice and this permission notice appear in all copies.
8 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 #include <sys/types.h>
26 #ifdef HAVE_READPASSPHRASE
27 # include <readpassphrase.h>
29 # include "sys-readpassphrase.h"
38 #include <security/pam_appl.h>
43 #define HOST_NAME_MAX _POSIX_HOST_NAME_MAX
46 #define PAM_SERVICE_NAME "doas"
48 static pam_handle_t *pamh = NULL;
49 static char doas_prompt[128];
50 static sig_atomic_t volatile caught_signal = 0;
59 pamprompt(const char *msg, int echo_on, int *ret)
62 char *pass, buf[PAM_MAX_RESP_SIZE];
63 int flags = RPP_REQUIRE_TTY | (echo_on ? RPP_ECHO_ON : RPP_ECHO_OFF);
65 /* overwrite default prompt if it matches "Password:[ ]" */
66 if (strncmp(msg,"Password:", 9) == 0 &&
67 (msg[9] == '\0' || (msg[9] == ' ' && msg[10] == '\0')))
72 pass = readpassphrase(prompt, buf, sizeof(buf), flags);
75 else if (!(pass = strdup(pass)))
80 explicit_bzero(buf, sizeof(buf));
85 pamconv(int nmsgs, const struct pam_message **msgs,
86 struct pam_response **rsps, __UNUSED void *ptr)
88 struct pam_response *rsp;
92 if (!(rsp = calloc(nmsgs, sizeof(struct pam_response))))
93 err(1, "could not allocate pam_response");
95 for (i = 0; i < nmsgs; i++) {
96 switch (style = msgs[i]->msg_style) {
97 case PAM_PROMPT_ECHO_OFF:
98 case PAM_PROMPT_ECHO_ON:
99 rsp[i].resp = pamprompt(msgs[i]->msg, style == PAM_PROMPT_ECHO_ON, &ret);
100 if (ret != PAM_SUCCESS)
106 if (fprintf(style == PAM_ERROR_MSG ? stderr : stdout,
107 "%s\n", msgs[i]->msg) < 0)
112 errx(1, "invalid PAM msg_style %d", style);
122 /* overwrite and free response buffers */
123 for (i = 0; i < nmsgs; i++) {
124 if (rsp[i].resp == NULL)
126 switch (style = msgs[i]->msg_style) {
127 case PAM_PROMPT_ECHO_OFF:
128 case PAM_PROMPT_ECHO_ON:
129 explicit_bzero(rsp[i].resp, strlen(rsp[i].resp));
139 pamcleanup(int ret, int sess, int cred)
142 ret = pam_close_session(pamh, 0);
143 if (ret != PAM_SUCCESS)
144 errx(1, "pam_close_session: %s", pam_strerror(pamh, ret));
147 ret = pam_setcred(pamh, PAM_DELETE_CRED | PAM_SILENT);
148 if (ret != PAM_SUCCESS)
149 warn("pam_setcred(?, PAM_DELETE_CRED | PAM_SILENT): %s",
150 pam_strerror(pamh, ret));
156 watchsession(pid_t child, int sess, int cred)
159 struct sigaction act, oldact;
164 if (sigprocmask(SIG_BLOCK, &sigs, NULL)) {
165 warn("failed to block signals");
170 /* setup signal handler */
171 act.sa_handler = catchsig;
172 sigemptyset(&act.sa_mask);
175 /* unblock SIGTERM and SIGALRM to catch them */
177 if (sigaddset(&sigs, SIGTERM) ||
178 sigaddset(&sigs, SIGALRM) ||
179 sigaddset(&sigs, SIGTSTP) ||
180 sigaction(SIGTERM, &act, &oldact) ||
181 sigprocmask(SIG_UNBLOCK, &sigs, NULL)) {
182 warn("failed to set signal handler");
187 /* wait for child to be terminated */
188 if (waitpid(child, &status, 0) != -1) {
189 if (WIFSIGNALED(status)) {
190 fprintf(stderr, "%s%s\n", strsignal(WTERMSIG(status)),
191 WCOREDUMP(status) ? " (core dumped)" : "");
192 status = WTERMSIG(status) + 128;
194 status = WEXITSTATUS(status);
196 else if (caught_signal)
197 status = caught_signal + 128;
202 if (caught_signal && child != (pid_t)-1) {
203 fprintf(stderr, "\nSession terminated, killing shell\n");
204 kill(child, SIGTERM);
207 pamcleanup(PAM_SUCCESS, sess, cred);
210 if (child != (pid_t)-1) {
213 kill(child, SIGKILL);
214 fprintf(stderr, " ...killed.\n");
217 /* unblock cached signal and resend */
218 sigaction(SIGTERM, &oldact, NULL);
219 if (caught_signal != SIGTERM)
220 caught_signal = SIGKILL;
221 kill(getpid(), caught_signal);
228 pamauth(const char *user, const char *myname, int interactive, int nopass, int persist)
230 static const struct pam_conv conv = {
236 int ret, sess = 0, cred = 0;
245 if (!user || !myname)
246 errx(1, "Authorization failed");
248 ret = pam_start(PAM_SERVICE_NAME, myname, &conv, &pamh);
249 if (ret != PAM_SUCCESS)
250 errx(1, "pam_start(\"%s\", \"%s\", ?, ?): failed",
251 PAM_SERVICE_NAME, myname);
253 ret = pam_set_item(pamh, PAM_RUSER, myname);
254 if (ret != PAM_SUCCESS)
255 warn("pam_set_item(?, PAM_RUSER, \"%s\"): %s",
256 pam_strerror(pamh, ret), myname);
258 if (isatty(0) && (ttydev = ttyname(0)) != NULL) {
259 if (strncmp(ttydev, "/dev/", 5) == 0)
262 ret = pam_set_item(pamh, PAM_TTY, ttydev);
263 if (ret != PAM_SUCCESS)
264 warn("pam_set_item(?, PAM_TTY, \"%s\"): %s",
265 ttydev, pam_strerror(pamh, ret));
271 fd = timestamp_open(&valid, 5 * 60);
272 if (fd != -1 && valid == 1)
278 errx(1, "Authorization required");
280 /* doas style prompt for pam */
281 char host[HOST_NAME_MAX + 1];
282 if (gethostname(host, sizeof(host)))
283 snprintf(host, sizeof(host), "?");
284 snprintf(doas_prompt, sizeof(doas_prompt),
285 "\rdoas (%.32s@%.32s) password: ", myname, host);
288 ret = pam_authenticate(pamh, 0);
289 if (ret != PAM_SUCCESS) {
290 pamcleanup(ret, sess, cred);
291 syslog(LOG_AUTHPRIV | LOG_NOTICE, "failed auth for %s", myname);
292 errx(1, "Authorization failed");
297 ret = pam_acct_mgmt(pamh, 0);
298 if (ret == PAM_NEW_AUTHTOK_REQD)
299 ret = pam_chauthtok(pamh, PAM_CHANGE_EXPIRED_AUTHTOK);
301 /* account not vaild or changing the auth token failed */
302 if (ret != PAM_SUCCESS) {
303 pamcleanup(ret, sess, cred);
304 syslog(LOG_AUTHPRIV | LOG_NOTICE, "failed auth for %s", myname);
305 errx(1, "Authorization failed");
308 /* set PAM_USER to the user we want to be */
309 ret = pam_set_item(pamh, PAM_USER, user);
310 if (ret != PAM_SUCCESS)
311 warn("pam_set_item(?, PAM_USER, \"%s\"): %s", user,
312 pam_strerror(pamh, ret));
314 ret = pam_setcred(pamh, PAM_ESTABLISH_CRED);
315 if (ret != PAM_SUCCESS)
316 warn("pam_setcred(?, PAM_ESTABLISH_CRED): %s", pam_strerror(pamh, ret));
321 ret = pam_open_session(pamh, 0);
322 if (ret != PAM_SUCCESS)
323 errx(1, "pam_open_session: %s", pam_strerror(pamh, ret));
326 if ((child = fork()) == -1) {
327 pamcleanup(PAM_ABORT, sess, cred);
331 /* return as child */
342 timestamp_set(fd, 5 * 60);
346 watchsession(child, sess, cred);