17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * CDDL HEADER START 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the 54ef27277Sgww * Common Development and Distribution License (the "License"). 64ef27277Sgww * You may not use this file except in compliance with the License. 77c478bd9Sstevel@tonic-gate * 87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions 117c478bd9Sstevel@tonic-gate * and limitations under the License. 127c478bd9Sstevel@tonic-gate * 137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 187c478bd9Sstevel@tonic-gate * 197c478bd9Sstevel@tonic-gate * CDDL HEADER END 207c478bd9Sstevel@tonic-gate */ 217c478bd9Sstevel@tonic-gate /* 22b9175c69SKenjiro Tsuji * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 237c478bd9Sstevel@tonic-gate * Use is subject to license terms. 247c478bd9Sstevel@tonic-gate */ 257c478bd9Sstevel@tonic-gate 26*edd669a7SJohn Levon /* 27*edd669a7SJohn Levon * Copyright (c) 2019, Joyent, Inc. 28*edd669a7SJohn Levon */ 29*edd669a7SJohn Levon 307c478bd9Sstevel@tonic-gate #include <syslog.h> 317c478bd9Sstevel@tonic-gate #include <dlfcn.h> 327c478bd9Sstevel@tonic-gate #include <sys/types.h> 337c478bd9Sstevel@tonic-gate #include <sys/stat.h> 347c478bd9Sstevel@tonic-gate #include <stdlib.h> 357c478bd9Sstevel@tonic-gate #include <strings.h> 367c478bd9Sstevel@tonic-gate #include <malloc.h> 377c478bd9Sstevel@tonic-gate #include <unistd.h> 387c478bd9Sstevel@tonic-gate #include <fcntl.h> 397c478bd9Sstevel@tonic-gate #include <errno.h> 407c478bd9Sstevel@tonic-gate 417c478bd9Sstevel@tonic-gate #include <security/pam_appl.h> 427c478bd9Sstevel@tonic-gate #include <security/pam_modules.h> 437c478bd9Sstevel@tonic-gate #include <sys/mman.h> 447c478bd9Sstevel@tonic-gate 457c478bd9Sstevel@tonic-gate #include <libintl.h> 467c478bd9Sstevel@tonic-gate 477c478bd9Sstevel@tonic-gate #include "pam_impl.h" 487c478bd9Sstevel@tonic-gate 497c478bd9Sstevel@tonic-gate static char *pam_snames [PAM_NUM_MODULE_TYPES] = { 507c478bd9Sstevel@tonic-gate PAM_ACCOUNT_NAME, 517c478bd9Sstevel@tonic-gate PAM_AUTH_NAME, 527c478bd9Sstevel@tonic-gate PAM_PASSWORD_NAME, 537c478bd9Sstevel@tonic-gate PAM_SESSION_NAME 547c478bd9Sstevel@tonic-gate }; 557c478bd9Sstevel@tonic-gate 567c478bd9Sstevel@tonic-gate static char *pam_inames [PAM_MAX_ITEMS] = { 577c478bd9Sstevel@tonic-gate /* NONE */ NULL, 587c478bd9Sstevel@tonic-gate /* PAM_SERVICE */ "service", 597c478bd9Sstevel@tonic-gate /* PAM_USER */ "user", 607c478bd9Sstevel@tonic-gate /* PAM_TTY */ "tty", 61*edd669a7SJohn Levon /* PAM_RHOST */ "rhost", 627c478bd9Sstevel@tonic-gate /* PAM_CONV */ "conv", 637c478bd9Sstevel@tonic-gate /* PAM_AUTHTOK */ "authtok", 647c478bd9Sstevel@tonic-gate /* PAM_OLDAUTHTOK */ "oldauthtok", 65*edd669a7SJohn Levon /* PAM_RUSER */ "ruser", 667c478bd9Sstevel@tonic-gate /* PAM_USER_PROMPT */ "user_prompt", 677c478bd9Sstevel@tonic-gate /* PAM_REPOSITORY */ "repository", 687c478bd9Sstevel@tonic-gate /* PAM_RESOURCE */ "resource", 69*edd669a7SJohn Levon /* PAM_AUSER */ "auser", 707c478bd9Sstevel@tonic-gate /* Undefined Items */ 717c478bd9Sstevel@tonic-gate }; 727c478bd9Sstevel@tonic-gate 737c478bd9Sstevel@tonic-gate /* 747c478bd9Sstevel@tonic-gate * This extra definition is needed in order to build this library 757c478bd9Sstevel@tonic-gate * on pre-64-bit-aware systems. 767c478bd9Sstevel@tonic-gate */ 777c478bd9Sstevel@tonic-gate #if !defined(_LFS64_LARGEFILE) 787c478bd9Sstevel@tonic-gate #define stat64 stat 797c478bd9Sstevel@tonic-gate #endif /* !defined(_LFS64_LARGEFILE) */ 807c478bd9Sstevel@tonic-gate 817c478bd9Sstevel@tonic-gate /* functions to dynamically load modules */ 827c478bd9Sstevel@tonic-gate static int load_modules(pam_handle_t *, int, char *, pamtab_t *); 83*edd669a7SJohn Levon static void *open_module(pam_handle_t *, char *); 847c478bd9Sstevel@tonic-gate static int load_function(void *, char *, int (**func)()); 857c478bd9Sstevel@tonic-gate 867c478bd9Sstevel@tonic-gate /* functions to read and store the pam.conf configuration file */ 877c478bd9Sstevel@tonic-gate static int open_pam_conf(struct pam_fh **, pam_handle_t *, char *); 887c478bd9Sstevel@tonic-gate static void close_pam_conf(struct pam_fh *); 897c478bd9Sstevel@tonic-gate static int read_pam_conf(pam_handle_t *, char *); 90*edd669a7SJohn Levon static int get_pam_conf_entry(struct pam_fh *, pam_handle_t *, 917c478bd9Sstevel@tonic-gate pamtab_t **); 927c478bd9Sstevel@tonic-gate static char *read_next_token(char **); 934ef27277Sgww static char *nextline(struct pam_fh *, pam_handle_t *, int *); 947c478bd9Sstevel@tonic-gate static int verify_pam_conf(pamtab_t *, char *); 957c478bd9Sstevel@tonic-gate 967c478bd9Sstevel@tonic-gate /* functions to clean up and free memory */ 977c478bd9Sstevel@tonic-gate static void clean_up(pam_handle_t *); 987c478bd9Sstevel@tonic-gate static void free_pamconf(pamtab_t *); 997c478bd9Sstevel@tonic-gate static void free_pam_conf_info(pam_handle_t *); 1007c478bd9Sstevel@tonic-gate static void free_env(env_list *); 1017c478bd9Sstevel@tonic-gate 1027c478bd9Sstevel@tonic-gate /* convenience functions for I18N/L10N communication */ 1037c478bd9Sstevel@tonic-gate 1047c478bd9Sstevel@tonic-gate static void free_resp(int, struct pam_response *); 1057c478bd9Sstevel@tonic-gate static int do_conv(pam_handle_t *, int, int, 1067c478bd9Sstevel@tonic-gate char messages[PAM_MAX_NUM_MSG][PAM_MAX_MSG_SIZE], void *, 1077c478bd9Sstevel@tonic-gate struct pam_response **); 1087c478bd9Sstevel@tonic-gate 1097c478bd9Sstevel@tonic-gate static int log_priority; /* pam_trace syslog priority & facility */ 1107c478bd9Sstevel@tonic-gate static int pam_debug = 0; 1117c478bd9Sstevel@tonic-gate 1127c478bd9Sstevel@tonic-gate static char * 1137c478bd9Sstevel@tonic-gate pam_trace_iname(int item_type, char *iname_buf) 1147c478bd9Sstevel@tonic-gate { 1157c478bd9Sstevel@tonic-gate char *name; 1167c478bd9Sstevel@tonic-gate 1177c478bd9Sstevel@tonic-gate if (item_type <= 0 || 1187c478bd9Sstevel@tonic-gate item_type >= PAM_MAX_ITEMS || 1197c478bd9Sstevel@tonic-gate (name = pam_inames[item_type]) == NULL) { 1207c478bd9Sstevel@tonic-gate (void) sprintf(iname_buf, "%d", item_type); 1217c478bd9Sstevel@tonic-gate return (iname_buf); 1227c478bd9Sstevel@tonic-gate } 1237c478bd9Sstevel@tonic-gate return (name); 1247c478bd9Sstevel@tonic-gate } 1257c478bd9Sstevel@tonic-gate 1267c478bd9Sstevel@tonic-gate static char * 1277c478bd9Sstevel@tonic-gate pam_trace_fname(int flag) 1287c478bd9Sstevel@tonic-gate { 1297c478bd9Sstevel@tonic-gate if (flag & PAM_BINDING) 1307c478bd9Sstevel@tonic-gate return (PAM_BINDING_NAME); 1317c478bd9Sstevel@tonic-gate if (flag & PAM_INCLUDE) 1327c478bd9Sstevel@tonic-gate return (PAM_INCLUDE_NAME); 1337c478bd9Sstevel@tonic-gate if (flag & PAM_OPTIONAL) 1347c478bd9Sstevel@tonic-gate return (PAM_OPTIONAL_NAME); 1357c478bd9Sstevel@tonic-gate if (flag & PAM_REQUIRED) 1367c478bd9Sstevel@tonic-gate return (PAM_REQUIRED_NAME); 1377c478bd9Sstevel@tonic-gate if (flag & PAM_REQUISITE) 1387c478bd9Sstevel@tonic-gate return (PAM_REQUISITE_NAME); 1397c478bd9Sstevel@tonic-gate if (flag & PAM_SUFFICIENT) 1407c478bd9Sstevel@tonic-gate return (PAM_SUFFICIENT_NAME); 1417c478bd9Sstevel@tonic-gate return ("bad flag name"); 1427c478bd9Sstevel@tonic-gate } 1437c478bd9Sstevel@tonic-gate 1447c478bd9Sstevel@tonic-gate static char * 1457c478bd9Sstevel@tonic-gate pam_trace_cname(pam_handle_t *pamh) 1467c478bd9Sstevel@tonic-gate { 1477c478bd9Sstevel@tonic-gate if (pamh->pam_conf_name[pamh->include_depth] == NULL) 1487c478bd9Sstevel@tonic-gate return ("NULL"); 1497c478bd9Sstevel@tonic-gate return (pamh->pam_conf_name[pamh->include_depth]); 1507c478bd9Sstevel@tonic-gate } 1517c478bd9Sstevel@tonic-gate 1527c478bd9Sstevel@tonic-gate #include <deflt.h> 1537c478bd9Sstevel@tonic-gate #include <stdarg.h> 1547c478bd9Sstevel@tonic-gate /* 1557c478bd9Sstevel@tonic-gate * pam_settrace - setup configuration for pam tracing 1567c478bd9Sstevel@tonic-gate * 1577c478bd9Sstevel@tonic-gate * turn on PAM debug if "magic" file exists 1587c478bd9Sstevel@tonic-gate * if exists (original), pam_debug = PAM_DEBUG_DEFAULT, 1597c478bd9Sstevel@tonic-gate * log_priority = LOG_DEBUG(7) and log_facility = LOG_AUTH(4). 1607c478bd9Sstevel@tonic-gate * 1617c478bd9Sstevel@tonic-gate * if has contents, keywork=value pairs: 1627c478bd9Sstevel@tonic-gate * 1637c478bd9Sstevel@tonic-gate * "log_priority=" 0-7, the pam_trace syslog priority to use 1647c478bd9Sstevel@tonic-gate * (see sys/syslog.h) 1657c478bd9Sstevel@tonic-gate * "log_facility=" 0-23, the pam_trace syslog facility to use 1667c478bd9Sstevel@tonic-gate * (see sys/syslog.h) 1677c478bd9Sstevel@tonic-gate * "debug_flags=" PAM_DEBUG_DEFAULT (0x0001), log traditional 1687c478bd9Sstevel@tonic-gate * (original) debugging. 1697c478bd9Sstevel@tonic-gate * Plus the logical or of: 1707c478bd9Sstevel@tonic-gate * PAM_DEBUG_ITEM (0x0002), log item values and 1717c478bd9Sstevel@tonic-gate * pam_get_item. 1727c478bd9Sstevel@tonic-gate * PAM_DEBUG_MODULE (0x0004), log module return status. 1737c478bd9Sstevel@tonic-gate * PAM_DEBUG_CONF (0x0008), log pam.conf parsing. 1747c478bd9Sstevel@tonic-gate * PAM_DEBUG_DATA (0x0010), get/set_data. 1757c478bd9Sstevel@tonic-gate * PAM_DEBUG_CONV (0x0020), conversation/response. 1767c478bd9Sstevel@tonic-gate * 1777c478bd9Sstevel@tonic-gate * If compiled with DEBUG: 1787c478bd9Sstevel@tonic-gate * PAM_DEBUG_AUTHTOK (0x8000), display AUTHTOK value if 1797c478bd9Sstevel@tonic-gate * PAM_DEBUG_ITEM is set and results from 1807c478bd9Sstevel@tonic-gate * PAM_PROMPT_ECHO_OFF responses. 1817c478bd9Sstevel@tonic-gate * USE CAREFULLY, THIS EXPOSES THE USER'S PASSWORDS. 1827c478bd9Sstevel@tonic-gate * 1837c478bd9Sstevel@tonic-gate * or set to 0 and off even if PAM_DEBUG file exists. 1847c478bd9Sstevel@tonic-gate * 1857c478bd9Sstevel@tonic-gate * Output has the general form: 1867c478bd9Sstevel@tonic-gate * <whatever was set syslog> PAM[<pid>]: <interface>(<handle> and other info) 1877c478bd9Sstevel@tonic-gate * <whatever was set syslog> PAM[<pid>]: details requested for <interface> call 1887c478bd9Sstevel@tonic-gate * Where: <pid> is the process ID of the calling process. 1897c478bd9Sstevel@tonic-gate * <handle> is the Hex value of the pam_handle associated with the 1907c478bd9Sstevel@tonic-gate * call. 1917c478bd9Sstevel@tonic-gate */ 1927c478bd9Sstevel@tonic-gate 1937c478bd9Sstevel@tonic-gate static void 1947c478bd9Sstevel@tonic-gate pam_settrace() 1957c478bd9Sstevel@tonic-gate { 196b9175c69SKenjiro Tsuji void *defp; 197b9175c69SKenjiro Tsuji 198b9175c69SKenjiro Tsuji if ((defp = defopen_r(PAM_DEBUG)) != NULL) { 1997c478bd9Sstevel@tonic-gate char *arg; 2007c478bd9Sstevel@tonic-gate int code; 2017c478bd9Sstevel@tonic-gate int facility = LOG_AUTH; 2027c478bd9Sstevel@tonic-gate 2037c478bd9Sstevel@tonic-gate pam_debug = PAM_DEBUG_DEFAULT; 2047c478bd9Sstevel@tonic-gate log_priority = LOG_DEBUG; 2057c478bd9Sstevel@tonic-gate 206b9175c69SKenjiro Tsuji (void) defcntl_r(DC_SETFLAGS, DC_CASE, defp); 207b9175c69SKenjiro Tsuji if ((arg = defread_r(LOG_PRIORITY, defp)) != NULL) { 2087c478bd9Sstevel@tonic-gate code = (int)strtol(arg, NULL, 10); 2097c478bd9Sstevel@tonic-gate if ((code & ~LOG_PRIMASK) == 0) { 2107c478bd9Sstevel@tonic-gate log_priority = code; 2117c478bd9Sstevel@tonic-gate } 2127c478bd9Sstevel@tonic-gate } 213b9175c69SKenjiro Tsuji if ((arg = defread_r(LOG_FACILITY, defp)) != NULL) { 2147c478bd9Sstevel@tonic-gate code = (int)strtol(arg, NULL, 10); 2157c478bd9Sstevel@tonic-gate if (code < LOG_NFACILITIES) { 2167c478bd9Sstevel@tonic-gate facility = code << 3; 2177c478bd9Sstevel@tonic-gate } 2187c478bd9Sstevel@tonic-gate } 219b9175c69SKenjiro Tsuji if ((arg = defread_r(DEBUG_FLAGS, defp)) != NULL) { 2207c478bd9Sstevel@tonic-gate pam_debug = (int)strtol(arg, NULL, 0); 2217c478bd9Sstevel@tonic-gate } 222b9175c69SKenjiro Tsuji defclose_r(defp); 2237c478bd9Sstevel@tonic-gate 2247c478bd9Sstevel@tonic-gate log_priority |= facility; 2257c478bd9Sstevel@tonic-gate } 2267c478bd9Sstevel@tonic-gate } 2277c478bd9Sstevel@tonic-gate 2287c478bd9Sstevel@tonic-gate /* 2297c478bd9Sstevel@tonic-gate * pam_trace - logs tracing messages 2307c478bd9Sstevel@tonic-gate * 2317c478bd9Sstevel@tonic-gate * flag = debug_flags from /etc/pam_debug 2327c478bd9Sstevel@tonic-gate * format and args = message to print (PAM[<pid>]: is prepended). 2337c478bd9Sstevel@tonic-gate * 2347c478bd9Sstevel@tonic-gate * global log_priority = pam_trace syslog (log_priority | log_facility) 2357c478bd9Sstevel@tonic-gate * from /etc/pam_debug 2367c478bd9Sstevel@tonic-gate */ 2377c478bd9Sstevel@tonic-gate /*PRINTFLIKE2*/ 2387c478bd9Sstevel@tonic-gate static void 2397c478bd9Sstevel@tonic-gate pam_trace(int flag, char *format, ...) 2407c478bd9Sstevel@tonic-gate { 2417c478bd9Sstevel@tonic-gate va_list args; 2427c478bd9Sstevel@tonic-gate char message[1024]; 2437c478bd9Sstevel@tonic-gate int savemask; 2447c478bd9Sstevel@tonic-gate 2457c478bd9Sstevel@tonic-gate if ((pam_debug & flag) == 0) 2467c478bd9Sstevel@tonic-gate return; 2477c478bd9Sstevel@tonic-gate 2487c478bd9Sstevel@tonic-gate savemask = setlogmask(LOG_MASK(log_priority & LOG_PRIMASK)); 2497c478bd9Sstevel@tonic-gate (void) snprintf(message, sizeof (message), "PAM[%ld]: %s", 2507c478bd9Sstevel@tonic-gate (long)getpid(), format); 2517c478bd9Sstevel@tonic-gate va_start(args, format); 2527c478bd9Sstevel@tonic-gate (void) vsyslog(log_priority, message, args); 2537c478bd9Sstevel@tonic-gate va_end(args); 2547c478bd9Sstevel@tonic-gate (void) setlogmask(savemask); 2557c478bd9Sstevel@tonic-gate } 2567c478bd9Sstevel@tonic-gate 2577c478bd9Sstevel@tonic-gate /* 2587c478bd9Sstevel@tonic-gate * __pam_log - logs PAM syslog messages 2597c478bd9Sstevel@tonic-gate * 2607c478bd9Sstevel@tonic-gate * priority = message priority 2617c478bd9Sstevel@tonic-gate * format and args = message to log 2627c478bd9Sstevel@tonic-gate */ 2637c478bd9Sstevel@tonic-gate /*PRINTFLIKE2*/ 2647c478bd9Sstevel@tonic-gate void 2657c478bd9Sstevel@tonic-gate __pam_log(int priority, const char *format, ...) 2667c478bd9Sstevel@tonic-gate { 2677c478bd9Sstevel@tonic-gate va_list args; 2687c478bd9Sstevel@tonic-gate int savemask = setlogmask(LOG_MASK(priority & LOG_PRIMASK)); 2697c478bd9Sstevel@tonic-gate 2707c478bd9Sstevel@tonic-gate va_start(args, format); 2717c478bd9Sstevel@tonic-gate (void) vsyslog(priority, format, args); 2727c478bd9Sstevel@tonic-gate va_end(args); 2737c478bd9Sstevel@tonic-gate (void) setlogmask(savemask); 2747c478bd9Sstevel@tonic-gate } 2757c478bd9Sstevel@tonic-gate 2767c478bd9Sstevel@tonic-gate 2777c478bd9Sstevel@tonic-gate /* 2787c478bd9Sstevel@tonic-gate * pam_XXXXX routines 2797c478bd9Sstevel@tonic-gate * 2807c478bd9Sstevel@tonic-gate * These are the entry points to the authentication switch 2817c478bd9Sstevel@tonic-gate */ 2827c478bd9Sstevel@tonic-gate 2837c478bd9Sstevel@tonic-gate /* 2847c478bd9Sstevel@tonic-gate * pam_start - initiate an authentication transaction and 2857c478bd9Sstevel@tonic-gate * set parameter values to be used during the 2867c478bd9Sstevel@tonic-gate * transaction 2877c478bd9Sstevel@tonic-gate */ 2887c478bd9Sstevel@tonic-gate 2897c478bd9Sstevel@tonic-gate int 2907c478bd9Sstevel@tonic-gate pam_start(const char *service, const char *user, 2917c478bd9Sstevel@tonic-gate const struct pam_conv *pam_conv, pam_handle_t **pamh) 2927c478bd9Sstevel@tonic-gate { 2937c478bd9Sstevel@tonic-gate int err; 2947c478bd9Sstevel@tonic-gate 2951e08f0b8Sgww *pamh = calloc(1, sizeof (struct pam_handle)); 2967c478bd9Sstevel@tonic-gate 2977c478bd9Sstevel@tonic-gate pam_settrace(); 2987c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_DEFAULT, 2997c478bd9Sstevel@tonic-gate "pam_start(%s,%s,%p:%p) - debug = %x", 3007c478bd9Sstevel@tonic-gate service ? service : "NULL", user ? user : "NULL", (void *)pam_conv, 3017c478bd9Sstevel@tonic-gate (void *)*pamh, pam_debug); 3027c478bd9Sstevel@tonic-gate 3037c478bd9Sstevel@tonic-gate if (*pamh == NULL) 3047c478bd9Sstevel@tonic-gate return (PAM_BUF_ERR); 3057c478bd9Sstevel@tonic-gate 3067c478bd9Sstevel@tonic-gate (*pamh)->pam_inmodule = RO_OK; /* OK to set RO items */ 3077c478bd9Sstevel@tonic-gate if ((err = pam_set_item(*pamh, PAM_SERVICE, (void *)service)) 3087c478bd9Sstevel@tonic-gate != PAM_SUCCESS) { 3097c478bd9Sstevel@tonic-gate clean_up(*pamh); 3107c478bd9Sstevel@tonic-gate *pamh = NULL; 3117c478bd9Sstevel@tonic-gate return (err); 3127c478bd9Sstevel@tonic-gate } 3137c478bd9Sstevel@tonic-gate 3147c478bd9Sstevel@tonic-gate if ((err = pam_set_item(*pamh, PAM_USER, (void *)user)) 3157c478bd9Sstevel@tonic-gate != PAM_SUCCESS) { 3167c478bd9Sstevel@tonic-gate clean_up(*pamh); 3177c478bd9Sstevel@tonic-gate *pamh = NULL; 3187c478bd9Sstevel@tonic-gate return (err); 3197c478bd9Sstevel@tonic-gate } 3207c478bd9Sstevel@tonic-gate 3217c478bd9Sstevel@tonic-gate if ((err = pam_set_item(*pamh, PAM_CONV, (void *)pam_conv)) 3227c478bd9Sstevel@tonic-gate != PAM_SUCCESS) { 3237c478bd9Sstevel@tonic-gate clean_up(*pamh); 3247c478bd9Sstevel@tonic-gate *pamh = NULL; 3257c478bd9Sstevel@tonic-gate return (err); 3267c478bd9Sstevel@tonic-gate } 3277c478bd9Sstevel@tonic-gate 3287c478bd9Sstevel@tonic-gate (*pamh)->pam_inmodule = RW_OK; 3297c478bd9Sstevel@tonic-gate return (PAM_SUCCESS); 3307c478bd9Sstevel@tonic-gate } 3317c478bd9Sstevel@tonic-gate 3327c478bd9Sstevel@tonic-gate /* 3337c478bd9Sstevel@tonic-gate * pam_end - terminate an authentication transaction 3347c478bd9Sstevel@tonic-gate */ 3357c478bd9Sstevel@tonic-gate 3367c478bd9Sstevel@tonic-gate int 3377c478bd9Sstevel@tonic-gate pam_end(pam_handle_t *pamh, int pam_status) 3387c478bd9Sstevel@tonic-gate { 3397c478bd9Sstevel@tonic-gate struct pam_module_data *psd, *p; 3407c478bd9Sstevel@tonic-gate fd_list *expired; 3417c478bd9Sstevel@tonic-gate fd_list *traverse; 3427c478bd9Sstevel@tonic-gate env_list *env_expired; 3437c478bd9Sstevel@tonic-gate env_list *env_traverse; 3447c478bd9Sstevel@tonic-gate 3457c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_DEFAULT, 3467c478bd9Sstevel@tonic-gate "pam_end(%p): status = %s", (void *)pamh, 3477c478bd9Sstevel@tonic-gate pam_strerror(pamh, pam_status)); 3487c478bd9Sstevel@tonic-gate 3497c478bd9Sstevel@tonic-gate if (pamh == NULL) 3507c478bd9Sstevel@tonic-gate return (PAM_SYSTEM_ERR); 3517c478bd9Sstevel@tonic-gate 3527c478bd9Sstevel@tonic-gate /* call the cleanup routines for module specific data */ 3537c478bd9Sstevel@tonic-gate 3547c478bd9Sstevel@tonic-gate psd = pamh->ssd; 3557c478bd9Sstevel@tonic-gate while (psd) { 3567c478bd9Sstevel@tonic-gate if (psd->cleanup) { 3577c478bd9Sstevel@tonic-gate psd->cleanup(pamh, psd->data, pam_status); 3587c478bd9Sstevel@tonic-gate } 3597c478bd9Sstevel@tonic-gate p = psd; 3607c478bd9Sstevel@tonic-gate psd = p->next; 3617c478bd9Sstevel@tonic-gate free(p->module_data_name); 3627c478bd9Sstevel@tonic-gate free(p); 3637c478bd9Sstevel@tonic-gate } 3647c478bd9Sstevel@tonic-gate pamh->ssd = NULL; 3657c478bd9Sstevel@tonic-gate 3667c478bd9Sstevel@tonic-gate /* dlclose all module fds */ 3677c478bd9Sstevel@tonic-gate traverse = pamh->fd; 3687c478bd9Sstevel@tonic-gate while (traverse) { 3697c478bd9Sstevel@tonic-gate expired = traverse; 3707c478bd9Sstevel@tonic-gate traverse = traverse->next; 3717c478bd9Sstevel@tonic-gate (void) dlclose(expired->mh); 3727c478bd9Sstevel@tonic-gate free(expired); 3737c478bd9Sstevel@tonic-gate } 3747c478bd9Sstevel@tonic-gate pamh->fd = 0; 3757c478bd9Sstevel@tonic-gate 3767c478bd9Sstevel@tonic-gate /* remove all environment variables */ 3777c478bd9Sstevel@tonic-gate env_traverse = pamh->pam_env; 3787c478bd9Sstevel@tonic-gate while (env_traverse) { 3797c478bd9Sstevel@tonic-gate env_expired = env_traverse; 3807c478bd9Sstevel@tonic-gate env_traverse = env_traverse->next; 3817c478bd9Sstevel@tonic-gate free_env(env_expired); 3827c478bd9Sstevel@tonic-gate } 3837c478bd9Sstevel@tonic-gate 3847c478bd9Sstevel@tonic-gate clean_up(pamh); 3857c478bd9Sstevel@tonic-gate return (PAM_SUCCESS); 3867c478bd9Sstevel@tonic-gate } 3877c478bd9Sstevel@tonic-gate 3887c478bd9Sstevel@tonic-gate /* 3897c478bd9Sstevel@tonic-gate * pam_set_item - set the value of a parameter that can be 3907c478bd9Sstevel@tonic-gate * retrieved via a call to pam_get_item() 3917c478bd9Sstevel@tonic-gate */ 3927c478bd9Sstevel@tonic-gate 3937c478bd9Sstevel@tonic-gate int 3947c478bd9Sstevel@tonic-gate pam_set_item(pam_handle_t *pamh, int item_type, const void *item) 3957c478bd9Sstevel@tonic-gate { 3967c478bd9Sstevel@tonic-gate struct pam_item *pip; 3977c478bd9Sstevel@tonic-gate int size; 3987c478bd9Sstevel@tonic-gate char iname_buf[PAM_MAX_MSG_SIZE]; 3997c478bd9Sstevel@tonic-gate 4007c478bd9Sstevel@tonic-gate if (((pam_debug & PAM_DEBUG_ITEM) == 0) || (pamh == NULL)) { 4017c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_DEFAULT, 4027c478bd9Sstevel@tonic-gate "pam_set_item(%p:%s)", (void *)pamh, 4037c478bd9Sstevel@tonic-gate pam_trace_iname(item_type, iname_buf)); 4047c478bd9Sstevel@tonic-gate } 4057c478bd9Sstevel@tonic-gate 4067c478bd9Sstevel@tonic-gate if (pamh == NULL) 4077c478bd9Sstevel@tonic-gate return (PAM_SYSTEM_ERR); 4087c478bd9Sstevel@tonic-gate 4097c478bd9Sstevel@tonic-gate /* check read only items */ 4107c478bd9Sstevel@tonic-gate if ((item_type == PAM_SERVICE) && (pamh->pam_inmodule != RO_OK)) 4117c478bd9Sstevel@tonic-gate return (PAM_PERM_DENIED); 4127c478bd9Sstevel@tonic-gate 4137c478bd9Sstevel@tonic-gate /* 4147c478bd9Sstevel@tonic-gate * Check that item_type is within valid range 4157c478bd9Sstevel@tonic-gate */ 4167c478bd9Sstevel@tonic-gate 4177c478bd9Sstevel@tonic-gate if (item_type <= 0 || item_type >= PAM_MAX_ITEMS) 4187c478bd9Sstevel@tonic-gate return (PAM_SYMBOL_ERR); 4197c478bd9Sstevel@tonic-gate 4207c478bd9Sstevel@tonic-gate pip = &(pamh->ps_item[item_type]); 4217c478bd9Sstevel@tonic-gate 4227c478bd9Sstevel@tonic-gate switch (item_type) { 4237c478bd9Sstevel@tonic-gate case PAM_AUTHTOK: 4247c478bd9Sstevel@tonic-gate case PAM_OLDAUTHTOK: 4257c478bd9Sstevel@tonic-gate if (pip->pi_addr != NULL) 4267c478bd9Sstevel@tonic-gate (void) memset(pip->pi_addr, 0, pip->pi_size); 4277c478bd9Sstevel@tonic-gate /*FALLTHROUGH*/ 4287c478bd9Sstevel@tonic-gate case PAM_SERVICE: 4297c478bd9Sstevel@tonic-gate case PAM_USER: 4307c478bd9Sstevel@tonic-gate case PAM_TTY: 4317c478bd9Sstevel@tonic-gate case PAM_RHOST: 4327c478bd9Sstevel@tonic-gate case PAM_RUSER: 4337c478bd9Sstevel@tonic-gate case PAM_USER_PROMPT: 4347c478bd9Sstevel@tonic-gate case PAM_RESOURCE: 435bf430c99Sgww case PAM_AUSER: 4367c478bd9Sstevel@tonic-gate if (pip->pi_addr != NULL) { 4377c478bd9Sstevel@tonic-gate free(pip->pi_addr); 4387c478bd9Sstevel@tonic-gate } 4397c478bd9Sstevel@tonic-gate 4407c478bd9Sstevel@tonic-gate if (item == NULL) { 4417c478bd9Sstevel@tonic-gate pip->pi_addr = NULL; 4427c478bd9Sstevel@tonic-gate pip->pi_size = 0; 4437c478bd9Sstevel@tonic-gate } else { 4447c478bd9Sstevel@tonic-gate pip->pi_addr = strdup((char *)item); 4457c478bd9Sstevel@tonic-gate if (pip->pi_addr == NULL) { 4467c478bd9Sstevel@tonic-gate pip->pi_size = 0; 4477c478bd9Sstevel@tonic-gate return (PAM_BUF_ERR); 4487c478bd9Sstevel@tonic-gate } 4497c478bd9Sstevel@tonic-gate pip->pi_size = strlen(pip->pi_addr); 4507c478bd9Sstevel@tonic-gate } 4517c478bd9Sstevel@tonic-gate break; 4527c478bd9Sstevel@tonic-gate case PAM_CONV: 4537c478bd9Sstevel@tonic-gate if (pip->pi_addr != NULL) 4547c478bd9Sstevel@tonic-gate free(pip->pi_addr); 4557c478bd9Sstevel@tonic-gate size = sizeof (struct pam_conv); 4561e08f0b8Sgww if ((pip->pi_addr = calloc(1, size)) == NULL) 4577c478bd9Sstevel@tonic-gate return (PAM_BUF_ERR); 4587c478bd9Sstevel@tonic-gate if (item != NULL) 4597c478bd9Sstevel@tonic-gate (void) memcpy(pip->pi_addr, item, (unsigned int) size); 4607c478bd9Sstevel@tonic-gate else 4617c478bd9Sstevel@tonic-gate (void) memset(pip->pi_addr, 0, size); 4627c478bd9Sstevel@tonic-gate pip->pi_size = size; 4637c478bd9Sstevel@tonic-gate break; 4647c478bd9Sstevel@tonic-gate case PAM_REPOSITORY: 4657c478bd9Sstevel@tonic-gate if (pip->pi_addr != NULL) { 4667c478bd9Sstevel@tonic-gate pam_repository_t *auth_rep; 4677c478bd9Sstevel@tonic-gate 4687c478bd9Sstevel@tonic-gate auth_rep = (pam_repository_t *)pip->pi_addr; 4697c478bd9Sstevel@tonic-gate if (auth_rep->type != NULL) 4707c478bd9Sstevel@tonic-gate free(auth_rep->type); 4717c478bd9Sstevel@tonic-gate if (auth_rep->scope != NULL) 4727c478bd9Sstevel@tonic-gate free(auth_rep->scope); 4737c478bd9Sstevel@tonic-gate free(auth_rep); 4747c478bd9Sstevel@tonic-gate } 4757c478bd9Sstevel@tonic-gate if (item != NULL) { 4767c478bd9Sstevel@tonic-gate pam_repository_t *s, *d; 4777c478bd9Sstevel@tonic-gate 4787c478bd9Sstevel@tonic-gate size = sizeof (struct pam_repository); 4791e08f0b8Sgww pip->pi_addr = calloc(1, size); 4807c478bd9Sstevel@tonic-gate if (pip->pi_addr == NULL) 4817c478bd9Sstevel@tonic-gate return (PAM_BUF_ERR); 4827c478bd9Sstevel@tonic-gate 4837c478bd9Sstevel@tonic-gate s = (struct pam_repository *)item; 4847c478bd9Sstevel@tonic-gate d = (struct pam_repository *)pip->pi_addr; 4857c478bd9Sstevel@tonic-gate 4867c478bd9Sstevel@tonic-gate d->type = strdup(s->type); 4877c478bd9Sstevel@tonic-gate if (d->type == NULL) 4887c478bd9Sstevel@tonic-gate return (PAM_BUF_ERR); 4897c478bd9Sstevel@tonic-gate d->scope = malloc(s->scope_len); 4907c478bd9Sstevel@tonic-gate if (d->scope == NULL) 4917c478bd9Sstevel@tonic-gate return (PAM_BUF_ERR); 4927c478bd9Sstevel@tonic-gate (void) memcpy(d->scope, s->scope, s->scope_len); 4937c478bd9Sstevel@tonic-gate d->scope_len = s->scope_len; 4947c478bd9Sstevel@tonic-gate } 4957c478bd9Sstevel@tonic-gate pip->pi_size = size; 4967c478bd9Sstevel@tonic-gate break; 4977c478bd9Sstevel@tonic-gate default: 4987c478bd9Sstevel@tonic-gate return (PAM_SYMBOL_ERR); 4997c478bd9Sstevel@tonic-gate } 5007c478bd9Sstevel@tonic-gate switch (item_type) { 5017c478bd9Sstevel@tonic-gate case PAM_CONV: 5027c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_ITEM, "pam_set_item(%p:%s)=%p", 5037c478bd9Sstevel@tonic-gate (void *)pamh, 5047c478bd9Sstevel@tonic-gate pam_trace_iname(item_type, iname_buf), 5057c478bd9Sstevel@tonic-gate item ? (void *)((struct pam_conv *)item)->conv : 5067c478bd9Sstevel@tonic-gate (void *)0); 5077c478bd9Sstevel@tonic-gate break; 5087c478bd9Sstevel@tonic-gate case PAM_REPOSITORY: 5097c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_ITEM, "pam_set_item(%p:%s)=%s", 5107c478bd9Sstevel@tonic-gate (void *)pamh, 5117c478bd9Sstevel@tonic-gate pam_trace_iname(item_type, iname_buf), 5127c478bd9Sstevel@tonic-gate item ? (((struct pam_repository *)item)->type ? 5137c478bd9Sstevel@tonic-gate ((struct pam_repository *)item)->type : "NULL") : 5147c478bd9Sstevel@tonic-gate "NULL"); 5157c478bd9Sstevel@tonic-gate break; 5167c478bd9Sstevel@tonic-gate case PAM_AUTHTOK: 5177c478bd9Sstevel@tonic-gate case PAM_OLDAUTHTOK: 5187c478bd9Sstevel@tonic-gate #ifdef DEBUG 5197c478bd9Sstevel@tonic-gate if (pam_debug & PAM_DEBUG_AUTHTOK) 5207c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_ITEM, 5217c478bd9Sstevel@tonic-gate "pam_set_item(%p:%s)=%s", (void *)pamh, 5227c478bd9Sstevel@tonic-gate pam_trace_iname(item_type, iname_buf), 5237c478bd9Sstevel@tonic-gate item ? (char *)item : "NULL"); 5247c478bd9Sstevel@tonic-gate else 5257c478bd9Sstevel@tonic-gate #endif /* DEBUG */ 5267c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_ITEM, 5277c478bd9Sstevel@tonic-gate "pam_set_item(%p:%s)=%s", (void *)pamh, 5287c478bd9Sstevel@tonic-gate pam_trace_iname(item_type, iname_buf), 5297c478bd9Sstevel@tonic-gate item ? "********" : "NULL"); 5307c478bd9Sstevel@tonic-gate break; 5317c478bd9Sstevel@tonic-gate default: 5327c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_ITEM, "pam_set_item(%p:%s)=%s", 5337c478bd9Sstevel@tonic-gate (void *)pamh, 5347c478bd9Sstevel@tonic-gate pam_trace_iname(item_type, iname_buf), 5357c478bd9Sstevel@tonic-gate item ? (char *)item : "NULL"); 5367c478bd9Sstevel@tonic-gate } 5377c478bd9Sstevel@tonic-gate 5387c478bd9Sstevel@tonic-gate return (PAM_SUCCESS); 5397c478bd9Sstevel@tonic-gate } 5407c478bd9Sstevel@tonic-gate 5417c478bd9Sstevel@tonic-gate /* 5427c478bd9Sstevel@tonic-gate * pam_get_item - read the value of a parameter specified in 5437c478bd9Sstevel@tonic-gate * the call to pam_set_item() 5447c478bd9Sstevel@tonic-gate */ 5457c478bd9Sstevel@tonic-gate 5467c478bd9Sstevel@tonic-gate int 5477c478bd9Sstevel@tonic-gate pam_get_item(const pam_handle_t *pamh, int item_type, void **item) 5487c478bd9Sstevel@tonic-gate { 5497c478bd9Sstevel@tonic-gate struct pam_item *pip; 5507c478bd9Sstevel@tonic-gate char iname_buf[PAM_MAX_MSG_SIZE]; 5517c478bd9Sstevel@tonic-gate 5527c478bd9Sstevel@tonic-gate if (((pam_debug & PAM_DEBUG_ITEM) == 0) || (pamh == NULL)) { 5537c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_ITEM, "pam_get_item(%p:%s)", 5547c478bd9Sstevel@tonic-gate (void *)pamh, pam_trace_iname(item_type, iname_buf)); 5557c478bd9Sstevel@tonic-gate } 5567c478bd9Sstevel@tonic-gate 5577c478bd9Sstevel@tonic-gate if (pamh == NULL) 5587c478bd9Sstevel@tonic-gate return (PAM_SYSTEM_ERR); 5597c478bd9Sstevel@tonic-gate 5607c478bd9Sstevel@tonic-gate if (item_type <= 0 || item_type >= PAM_MAX_ITEMS) 5617c478bd9Sstevel@tonic-gate return (PAM_SYMBOL_ERR); 5627c478bd9Sstevel@tonic-gate 5637c478bd9Sstevel@tonic-gate if ((pamh->pam_inmodule != WO_OK) && 5647c478bd9Sstevel@tonic-gate ((item_type == PAM_AUTHTOK || item_type == PAM_OLDAUTHTOK))) { 5657c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_NOTICE, "pam_get_item(%s) called from " 5667c478bd9Sstevel@tonic-gate "a non module context", 5677c478bd9Sstevel@tonic-gate pam_trace_iname(item_type, iname_buf)); 5687c478bd9Sstevel@tonic-gate return (PAM_PERM_DENIED); 5697c478bd9Sstevel@tonic-gate } 5707c478bd9Sstevel@tonic-gate 5717c478bd9Sstevel@tonic-gate pip = (struct pam_item *)&(pamh->ps_item[item_type]); 5727c478bd9Sstevel@tonic-gate 5737c478bd9Sstevel@tonic-gate *item = pip->pi_addr; 5747c478bd9Sstevel@tonic-gate switch (item_type) { 5757c478bd9Sstevel@tonic-gate case PAM_CONV: 5767c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_ITEM, "pam_get_item(%p:%s)=%p", 5777c478bd9Sstevel@tonic-gate (void *)pamh, 5787c478bd9Sstevel@tonic-gate pam_trace_iname(item_type, iname_buf), 5797c478bd9Sstevel@tonic-gate (void *)((struct pam_conv *)*item)->conv); 5807c478bd9Sstevel@tonic-gate break; 5817c478bd9Sstevel@tonic-gate case PAM_REPOSITORY: 5827c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_ITEM, "pam_get_item(%p:%s)=%s", 5837c478bd9Sstevel@tonic-gate (void *)pamh, 5847c478bd9Sstevel@tonic-gate pam_trace_iname(item_type, iname_buf), 5857c478bd9Sstevel@tonic-gate *item ? (((struct pam_repository *)*item)->type ? 5867c478bd9Sstevel@tonic-gate ((struct pam_repository *)*item)->type : "NULL") : 5877c478bd9Sstevel@tonic-gate "NULL"); 5887c478bd9Sstevel@tonic-gate break; 5897c478bd9Sstevel@tonic-gate case PAM_AUTHTOK: 5907c478bd9Sstevel@tonic-gate case PAM_OLDAUTHTOK: 5917c478bd9Sstevel@tonic-gate #ifdef DEBUG 5927c478bd9Sstevel@tonic-gate if (pam_debug & PAM_DEBUG_AUTHTOK) 5937c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_ITEM, 5947c478bd9Sstevel@tonic-gate "pam_get_item(%p:%s)=%s", (void *)pamh, 5957c478bd9Sstevel@tonic-gate pam_trace_iname(item_type, iname_buf), 5967c478bd9Sstevel@tonic-gate *item ? *(char **)item : "NULL"); 5977c478bd9Sstevel@tonic-gate else 5987c478bd9Sstevel@tonic-gate #endif /* DEBUG */ 5997c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_ITEM, 6007c478bd9Sstevel@tonic-gate "pam_get_item(%p:%s)=%s", (void *)pamh, 6017c478bd9Sstevel@tonic-gate pam_trace_iname(item_type, iname_buf), 6027c478bd9Sstevel@tonic-gate *item ? "********" : "NULL"); 6037c478bd9Sstevel@tonic-gate break; 6047c478bd9Sstevel@tonic-gate default: 6057c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_ITEM, "pam_get_item(%p:%s)=%s", 6067c478bd9Sstevel@tonic-gate (void *)pamh, 6077c478bd9Sstevel@tonic-gate pam_trace_iname(item_type, iname_buf), 6087c478bd9Sstevel@tonic-gate *item ? *(char **)item : "NULL"); 6097c478bd9Sstevel@tonic-gate } 6107c478bd9Sstevel@tonic-gate 6117c478bd9Sstevel@tonic-gate return (PAM_SUCCESS); 6127c478bd9Sstevel@tonic-gate } 6137c478bd9Sstevel@tonic-gate 6147c478bd9Sstevel@tonic-gate /* 6157c478bd9Sstevel@tonic-gate * parse_user_name - process the user response: ignore 6167c478bd9Sstevel@tonic-gate * '\t' or ' ' before or after a user name. 6177c478bd9Sstevel@tonic-gate * user_input is a null terminated string. 6187c478bd9Sstevel@tonic-gate * *ret_username will be the user name. 6197c478bd9Sstevel@tonic-gate */ 6207c478bd9Sstevel@tonic-gate 6217c478bd9Sstevel@tonic-gate static int 6227c478bd9Sstevel@tonic-gate parse_user_name(char *user_input, char **ret_username) 6237c478bd9Sstevel@tonic-gate { 6247c478bd9Sstevel@tonic-gate register char *ptr; 6257c478bd9Sstevel@tonic-gate register int index = 0; 6267c478bd9Sstevel@tonic-gate char username[PAM_MAX_RESP_SIZE]; 6277c478bd9Sstevel@tonic-gate 6287c478bd9Sstevel@tonic-gate /* Set the default value for *ret_username */ 6297c478bd9Sstevel@tonic-gate *ret_username = NULL; 6307c478bd9Sstevel@tonic-gate 6317c478bd9Sstevel@tonic-gate /* 6327c478bd9Sstevel@tonic-gate * Set the initial value for username - this is a buffer holds 6337c478bd9Sstevel@tonic-gate * the user name. 6347c478bd9Sstevel@tonic-gate */ 6357c478bd9Sstevel@tonic-gate bzero((void *)username, PAM_MAX_RESP_SIZE); 6367c478bd9Sstevel@tonic-gate 6377c478bd9Sstevel@tonic-gate /* 6387c478bd9Sstevel@tonic-gate * The user_input is guaranteed to be terminated by a null character. 6397c478bd9Sstevel@tonic-gate */ 6407c478bd9Sstevel@tonic-gate ptr = user_input; 6417c478bd9Sstevel@tonic-gate 6427c478bd9Sstevel@tonic-gate /* Skip all the leading whitespaces if there are any. */ 6437c478bd9Sstevel@tonic-gate while ((*ptr == ' ') || (*ptr == '\t')) 6447c478bd9Sstevel@tonic-gate ptr++; 6457c478bd9Sstevel@tonic-gate 6467c478bd9Sstevel@tonic-gate if (*ptr == '\0') { 6477c478bd9Sstevel@tonic-gate /* 6487c478bd9Sstevel@tonic-gate * We should never get here since the user_input we got 6497c478bd9Sstevel@tonic-gate * in pam_get_user() is not all whitespaces nor just "\0". 6507c478bd9Sstevel@tonic-gate */ 6517c478bd9Sstevel@tonic-gate return (PAM_BUF_ERR); 6527c478bd9Sstevel@tonic-gate } 6537c478bd9Sstevel@tonic-gate 6547c478bd9Sstevel@tonic-gate /* 6557c478bd9Sstevel@tonic-gate * username will be the first string we get from user_input 6567c478bd9Sstevel@tonic-gate * - we skip leading whitespaces and ignore trailing whitespaces 6577c478bd9Sstevel@tonic-gate */ 6587c478bd9Sstevel@tonic-gate while (*ptr != '\0') { 6597c478bd9Sstevel@tonic-gate if ((*ptr == ' ') || (*ptr == '\t')) 6607c478bd9Sstevel@tonic-gate break; 6617c478bd9Sstevel@tonic-gate else { 6627c478bd9Sstevel@tonic-gate username[index] = *ptr; 6637c478bd9Sstevel@tonic-gate index++; 6647c478bd9Sstevel@tonic-gate ptr++; 6657c478bd9Sstevel@tonic-gate } 6667c478bd9Sstevel@tonic-gate } 6677c478bd9Sstevel@tonic-gate 6687c478bd9Sstevel@tonic-gate /* ret_username will be freed in pam_get_user(). */ 6691e08f0b8Sgww if ((*ret_username = malloc(index + 1)) == NULL) 6707c478bd9Sstevel@tonic-gate return (PAM_BUF_ERR); 6717c478bd9Sstevel@tonic-gate (void) strcpy(*ret_username, username); 6727c478bd9Sstevel@tonic-gate return (PAM_SUCCESS); 6737c478bd9Sstevel@tonic-gate } 6747c478bd9Sstevel@tonic-gate 6757c478bd9Sstevel@tonic-gate /* 6767c478bd9Sstevel@tonic-gate * Get the value of PAM_USER. If not set, then use the convenience function 6777c478bd9Sstevel@tonic-gate * to prompt for the user. Use prompt if specified, else use PAM_USER_PROMPT 6787c478bd9Sstevel@tonic-gate * if it is set, else use default. 6797c478bd9Sstevel@tonic-gate */ 6807c478bd9Sstevel@tonic-gate #define WHITESPACE 0 6817c478bd9Sstevel@tonic-gate #define USERNAME 1 6827c478bd9Sstevel@tonic-gate 6837c478bd9Sstevel@tonic-gate int 6847c478bd9Sstevel@tonic-gate pam_get_user(pam_handle_t *pamh, char **user, const char *prompt_override) 6857c478bd9Sstevel@tonic-gate { 6867c478bd9Sstevel@tonic-gate int status; 6877c478bd9Sstevel@tonic-gate char *prompt = NULL; 6887c478bd9Sstevel@tonic-gate char *real_username; 6897c478bd9Sstevel@tonic-gate struct pam_response *ret_resp = NULL; 6907c478bd9Sstevel@tonic-gate char messages[PAM_MAX_NUM_MSG][PAM_MAX_MSG_SIZE]; 6917c478bd9Sstevel@tonic-gate 6927c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_DEFAULT, 6937c478bd9Sstevel@tonic-gate "pam_get_user(%p, %p, %s)", (void *)pamh, (void *)*user, 6947c478bd9Sstevel@tonic-gate prompt_override ? prompt_override : "NULL"); 6957c478bd9Sstevel@tonic-gate if (pamh == NULL) 6967c478bd9Sstevel@tonic-gate return (PAM_SYSTEM_ERR); 6977c478bd9Sstevel@tonic-gate 6987c478bd9Sstevel@tonic-gate if ((status = pam_get_item(pamh, PAM_USER, (void **)user)) 6997c478bd9Sstevel@tonic-gate != PAM_SUCCESS) { 7007c478bd9Sstevel@tonic-gate return (status); 7017c478bd9Sstevel@tonic-gate } 7027c478bd9Sstevel@tonic-gate 7037c478bd9Sstevel@tonic-gate /* if the user is set, return it */ 7047c478bd9Sstevel@tonic-gate 7057c478bd9Sstevel@tonic-gate if (*user != NULL && *user[0] != '\0') { 7067c478bd9Sstevel@tonic-gate return (PAM_SUCCESS); 7077c478bd9Sstevel@tonic-gate } 7087c478bd9Sstevel@tonic-gate 7097c478bd9Sstevel@tonic-gate /* 7107c478bd9Sstevel@tonic-gate * if the module is requesting a special prompt, use it. 7117c478bd9Sstevel@tonic-gate * else use PAM_USER_PROMPT. 7127c478bd9Sstevel@tonic-gate */ 7137c478bd9Sstevel@tonic-gate 7147c478bd9Sstevel@tonic-gate if (prompt_override != NULL) { 7157c478bd9Sstevel@tonic-gate prompt = (char *)prompt_override; 7167c478bd9Sstevel@tonic-gate } else { 7177c478bd9Sstevel@tonic-gate status = pam_get_item(pamh, PAM_USER_PROMPT, (void**)&prompt); 7187c478bd9Sstevel@tonic-gate if (status != PAM_SUCCESS) { 7197c478bd9Sstevel@tonic-gate return (status); 7207c478bd9Sstevel@tonic-gate } 7217c478bd9Sstevel@tonic-gate } 7227c478bd9Sstevel@tonic-gate 7237c478bd9Sstevel@tonic-gate /* if the prompt is not set, use default */ 7247c478bd9Sstevel@tonic-gate 7257c478bd9Sstevel@tonic-gate if (prompt == NULL || prompt[0] == '\0') { 7267c478bd9Sstevel@tonic-gate prompt = dgettext(TEXT_DOMAIN, "Please enter user name: "); 7277c478bd9Sstevel@tonic-gate } 7287c478bd9Sstevel@tonic-gate 7297c478bd9Sstevel@tonic-gate /* prompt for the user */ 7307c478bd9Sstevel@tonic-gate 7317c478bd9Sstevel@tonic-gate (void) strncpy(messages[0], prompt, sizeof (messages[0])); 7327c478bd9Sstevel@tonic-gate 7337c478bd9Sstevel@tonic-gate for (;;) { 7347c478bd9Sstevel@tonic-gate int state = WHITESPACE; 7357c478bd9Sstevel@tonic-gate 7367c478bd9Sstevel@tonic-gate status = do_conv(pamh, PAM_PROMPT_ECHO_ON, 1, messages, 7377c478bd9Sstevel@tonic-gate NULL, &ret_resp); 7387c478bd9Sstevel@tonic-gate 7397c478bd9Sstevel@tonic-gate if (status != PAM_SUCCESS) { 7407c478bd9Sstevel@tonic-gate return (status); 7417c478bd9Sstevel@tonic-gate } 7427c478bd9Sstevel@tonic-gate 7437c478bd9Sstevel@tonic-gate if (ret_resp->resp && ret_resp->resp[0] != '\0') { 7447c478bd9Sstevel@tonic-gate int len = strlen(ret_resp->resp); 7457c478bd9Sstevel@tonic-gate int i; 7467c478bd9Sstevel@tonic-gate 7477c478bd9Sstevel@tonic-gate for (i = 0; i < len; i++) { 7487c478bd9Sstevel@tonic-gate if ((ret_resp->resp[i] != ' ') && 7491e08f0b8Sgww (ret_resp->resp[i] != '\t')) { 7507c478bd9Sstevel@tonic-gate state = USERNAME; 7517c478bd9Sstevel@tonic-gate break; 7527c478bd9Sstevel@tonic-gate } 7537c478bd9Sstevel@tonic-gate } 7547c478bd9Sstevel@tonic-gate 7557c478bd9Sstevel@tonic-gate if (state == USERNAME) 7567c478bd9Sstevel@tonic-gate break; 7577c478bd9Sstevel@tonic-gate } 7581e08f0b8Sgww /* essentially empty response, try again */ 7591e08f0b8Sgww free_resp(1, ret_resp); 7601e08f0b8Sgww ret_resp = NULL; 7617c478bd9Sstevel@tonic-gate } 7627c478bd9Sstevel@tonic-gate 7637c478bd9Sstevel@tonic-gate /* set PAM_USER */ 7647c478bd9Sstevel@tonic-gate /* Parse the user input to get the user name. */ 7657c478bd9Sstevel@tonic-gate status = parse_user_name(ret_resp->resp, &real_username); 7667c478bd9Sstevel@tonic-gate 7677c478bd9Sstevel@tonic-gate if (status != PAM_SUCCESS) { 7687c478bd9Sstevel@tonic-gate if (real_username != NULL) 7697c478bd9Sstevel@tonic-gate free(real_username); 7707c478bd9Sstevel@tonic-gate free_resp(1, ret_resp); 7717c478bd9Sstevel@tonic-gate return (status); 7727c478bd9Sstevel@tonic-gate } 7737c478bd9Sstevel@tonic-gate 7747c478bd9Sstevel@tonic-gate status = pam_set_item(pamh, PAM_USER, real_username); 7757c478bd9Sstevel@tonic-gate 7767c478bd9Sstevel@tonic-gate free(real_username); 7777c478bd9Sstevel@tonic-gate 7787c478bd9Sstevel@tonic-gate free_resp(1, ret_resp); 7797c478bd9Sstevel@tonic-gate if (status != PAM_SUCCESS) { 7807c478bd9Sstevel@tonic-gate return (status); 7817c478bd9Sstevel@tonic-gate } 7827c478bd9Sstevel@tonic-gate 7837c478bd9Sstevel@tonic-gate /* 7847c478bd9Sstevel@tonic-gate * finally, get PAM_USER. We have to call pam_get_item to get 7857c478bd9Sstevel@tonic-gate * the value of user because pam_set_item mallocs the memory. 7867c478bd9Sstevel@tonic-gate */ 7877c478bd9Sstevel@tonic-gate 7887c478bd9Sstevel@tonic-gate status = pam_get_item(pamh, PAM_USER, (void**)user); 7897c478bd9Sstevel@tonic-gate return (status); 7907c478bd9Sstevel@tonic-gate } 7917c478bd9Sstevel@tonic-gate 7927c478bd9Sstevel@tonic-gate /* 7937c478bd9Sstevel@tonic-gate * Set module specific data 7947c478bd9Sstevel@tonic-gate */ 7957c478bd9Sstevel@tonic-gate 7967c478bd9Sstevel@tonic-gate int 7977c478bd9Sstevel@tonic-gate pam_set_data(pam_handle_t *pamh, const char *module_data_name, void *data, 7987c478bd9Sstevel@tonic-gate void (*cleanup)(pam_handle_t *pamh, void *data, int pam_end_status)) 7997c478bd9Sstevel@tonic-gate { 8007c478bd9Sstevel@tonic-gate struct pam_module_data *psd; 8017c478bd9Sstevel@tonic-gate 8027c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_DATA, 8037c478bd9Sstevel@tonic-gate "pam_set_data(%p:%s:%d)=%p", (void *)pamh, 804*edd669a7SJohn Levon (module_data_name != NULL) ? module_data_name : "NULL", 805*edd669a7SJohn Levon (pamh != NULL) ? pamh->pam_inmodule : -1, data); 8067c478bd9Sstevel@tonic-gate if (pamh == NULL || (pamh->pam_inmodule != WO_OK) || 8077c478bd9Sstevel@tonic-gate module_data_name == NULL) { 8087c478bd9Sstevel@tonic-gate return (PAM_SYSTEM_ERR); 8097c478bd9Sstevel@tonic-gate } 8107c478bd9Sstevel@tonic-gate 8117c478bd9Sstevel@tonic-gate /* check if module data already exists */ 8127c478bd9Sstevel@tonic-gate 8137c478bd9Sstevel@tonic-gate for (psd = pamh->ssd; psd; psd = psd->next) { 8147c478bd9Sstevel@tonic-gate if (strcmp(psd->module_data_name, module_data_name) == 0) { 8157c478bd9Sstevel@tonic-gate /* clean up original data before setting the new data */ 8167c478bd9Sstevel@tonic-gate if (psd->cleanup) { 8177c478bd9Sstevel@tonic-gate psd->cleanup(pamh, psd->data, PAM_SUCCESS); 8187c478bd9Sstevel@tonic-gate } 8197c478bd9Sstevel@tonic-gate psd->data = (void *)data; 8207c478bd9Sstevel@tonic-gate psd->cleanup = cleanup; 8217c478bd9Sstevel@tonic-gate return (PAM_SUCCESS); 8227c478bd9Sstevel@tonic-gate } 8237c478bd9Sstevel@tonic-gate } 8247c478bd9Sstevel@tonic-gate 8257c478bd9Sstevel@tonic-gate psd = malloc(sizeof (struct pam_module_data)); 8267c478bd9Sstevel@tonic-gate if (psd == NULL) 8277c478bd9Sstevel@tonic-gate return (PAM_BUF_ERR); 8287c478bd9Sstevel@tonic-gate 8297c478bd9Sstevel@tonic-gate psd->module_data_name = strdup(module_data_name); 8307c478bd9Sstevel@tonic-gate if (psd->module_data_name == NULL) { 8317c478bd9Sstevel@tonic-gate free(psd); 8327c478bd9Sstevel@tonic-gate return (PAM_BUF_ERR); 8337c478bd9Sstevel@tonic-gate } 8347c478bd9Sstevel@tonic-gate 8357c478bd9Sstevel@tonic-gate psd->data = (void *)data; 8367c478bd9Sstevel@tonic-gate psd->cleanup = cleanup; 8377c478bd9Sstevel@tonic-gate psd->next = pamh->ssd; 8387c478bd9Sstevel@tonic-gate pamh->ssd = psd; 8397c478bd9Sstevel@tonic-gate return (PAM_SUCCESS); 8407c478bd9Sstevel@tonic-gate } 8417c478bd9Sstevel@tonic-gate 8427c478bd9Sstevel@tonic-gate /* 8437c478bd9Sstevel@tonic-gate * get module specific data 8447c478bd9Sstevel@tonic-gate */ 8457c478bd9Sstevel@tonic-gate 8467c478bd9Sstevel@tonic-gate int 8477c478bd9Sstevel@tonic-gate pam_get_data(const pam_handle_t *pamh, const char *module_data_name, 8487c478bd9Sstevel@tonic-gate const void **data) 8497c478bd9Sstevel@tonic-gate { 8507c478bd9Sstevel@tonic-gate struct pam_module_data *psd; 8517c478bd9Sstevel@tonic-gate 8527c478bd9Sstevel@tonic-gate if (pamh == NULL || (pamh->pam_inmodule != WO_OK) || 8537c478bd9Sstevel@tonic-gate module_data_name == NULL) { 8547c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_DATA, 8557c478bd9Sstevel@tonic-gate "pam_get_data(%p:%s:%d)=%p", (void *)pamh, 8567c478bd9Sstevel@tonic-gate module_data_name ? module_data_name : "NULL", 8577c478bd9Sstevel@tonic-gate pamh->pam_inmodule, *data); 8587c478bd9Sstevel@tonic-gate return (PAM_SYSTEM_ERR); 8597c478bd9Sstevel@tonic-gate } 8607c478bd9Sstevel@tonic-gate 8617c478bd9Sstevel@tonic-gate for (psd = pamh->ssd; psd; psd = psd->next) { 8627c478bd9Sstevel@tonic-gate if (strcmp(psd->module_data_name, module_data_name) == 0) { 8637c478bd9Sstevel@tonic-gate *data = psd->data; 8647c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_DATA, 8657c478bd9Sstevel@tonic-gate "pam_get_data(%p:%s)=%p", (void *)pamh, 8667c478bd9Sstevel@tonic-gate module_data_name, *data); 8677c478bd9Sstevel@tonic-gate return (PAM_SUCCESS); 8687c478bd9Sstevel@tonic-gate } 8697c478bd9Sstevel@tonic-gate } 8707c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_DATA, 8717c478bd9Sstevel@tonic-gate "pam_get_data(%p:%s)=%s", (void *)pamh, module_data_name, 8727c478bd9Sstevel@tonic-gate "PAM_NO_MODULE_DATA"); 8737c478bd9Sstevel@tonic-gate 8747c478bd9Sstevel@tonic-gate return (PAM_NO_MODULE_DATA); 8757c478bd9Sstevel@tonic-gate } 8767c478bd9Sstevel@tonic-gate 8777c478bd9Sstevel@tonic-gate /* 8787c478bd9Sstevel@tonic-gate * PAM equivalent to strerror() 8797c478bd9Sstevel@tonic-gate */ 8807c478bd9Sstevel@tonic-gate /* ARGSUSED */ 8817c478bd9Sstevel@tonic-gate const char * 8827c478bd9Sstevel@tonic-gate pam_strerror(pam_handle_t *pamh, int errnum) 8837c478bd9Sstevel@tonic-gate { 8847c478bd9Sstevel@tonic-gate switch (errnum) { 8857c478bd9Sstevel@tonic-gate case PAM_SUCCESS: 8867c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "Success")); 8877c478bd9Sstevel@tonic-gate case PAM_OPEN_ERR: 8887c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "Dlopen failure")); 8897c478bd9Sstevel@tonic-gate case PAM_SYMBOL_ERR: 8907c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "Symbol not found")); 8917c478bd9Sstevel@tonic-gate case PAM_SERVICE_ERR: 8927c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, 8937c478bd9Sstevel@tonic-gate "Error in underlying service module")); 8947c478bd9Sstevel@tonic-gate case PAM_SYSTEM_ERR: 8957c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "System error")); 8967c478bd9Sstevel@tonic-gate case PAM_BUF_ERR: 8977c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "Memory buffer error")); 8987c478bd9Sstevel@tonic-gate case PAM_CONV_ERR: 8997c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "Conversation failure")); 9007c478bd9Sstevel@tonic-gate case PAM_PERM_DENIED: 9017c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "Permission denied")); 9027c478bd9Sstevel@tonic-gate case PAM_MAXTRIES: 9037c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, 9047c478bd9Sstevel@tonic-gate "Maximum number of attempts exceeded")); 9057c478bd9Sstevel@tonic-gate case PAM_AUTH_ERR: 9067c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "Authentication failed")); 9077c478bd9Sstevel@tonic-gate case PAM_NEW_AUTHTOK_REQD: 9087c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "Get new authentication token")); 9097c478bd9Sstevel@tonic-gate case PAM_CRED_INSUFFICIENT: 9107c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "Insufficient credentials")); 9117c478bd9Sstevel@tonic-gate case PAM_AUTHINFO_UNAVAIL: 9127c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, 9137c478bd9Sstevel@tonic-gate "Can not retrieve authentication info")); 9147c478bd9Sstevel@tonic-gate case PAM_USER_UNKNOWN: 9157c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "No account present for user")); 9167c478bd9Sstevel@tonic-gate case PAM_CRED_UNAVAIL: 9177c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, 9187c478bd9Sstevel@tonic-gate "Can not retrieve user credentials")); 9197c478bd9Sstevel@tonic-gate case PAM_CRED_EXPIRED: 9207c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, 9217c478bd9Sstevel@tonic-gate "User credentials have expired")); 9227c478bd9Sstevel@tonic-gate case PAM_CRED_ERR: 9237c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, 9247c478bd9Sstevel@tonic-gate "Failure setting user credentials")); 9257c478bd9Sstevel@tonic-gate case PAM_ACCT_EXPIRED: 9267c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "User account has expired")); 9277c478bd9Sstevel@tonic-gate case PAM_AUTHTOK_EXPIRED: 9287c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "User password has expired")); 9297c478bd9Sstevel@tonic-gate case PAM_SESSION_ERR: 9307c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, 9317c478bd9Sstevel@tonic-gate "Can not make/remove entry for session")); 9327c478bd9Sstevel@tonic-gate case PAM_AUTHTOK_ERR: 9337c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, 9347c478bd9Sstevel@tonic-gate "Authentication token manipulation error")); 9357c478bd9Sstevel@tonic-gate case PAM_AUTHTOK_RECOVERY_ERR: 9367c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, 9377c478bd9Sstevel@tonic-gate "Authentication token can not be recovered")); 9387c478bd9Sstevel@tonic-gate case PAM_AUTHTOK_LOCK_BUSY: 9397c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, 9407c478bd9Sstevel@tonic-gate "Authentication token lock busy")); 9417c478bd9Sstevel@tonic-gate case PAM_AUTHTOK_DISABLE_AGING: 9427c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, 9437c478bd9Sstevel@tonic-gate "Authentication token aging disabled")); 9447c478bd9Sstevel@tonic-gate case PAM_NO_MODULE_DATA: 9457c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, 9467c478bd9Sstevel@tonic-gate "Module specific data not found")); 9477c478bd9Sstevel@tonic-gate case PAM_IGNORE: 9487c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "Ignore module")); 9497c478bd9Sstevel@tonic-gate case PAM_ABORT: 9507c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "General PAM failure ")); 9517c478bd9Sstevel@tonic-gate case PAM_TRY_AGAIN: 9527c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, 9537c478bd9Sstevel@tonic-gate "Unable to complete operation. Try again")); 9547c478bd9Sstevel@tonic-gate default: 9557c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "Unknown error")); 9567c478bd9Sstevel@tonic-gate } 9577c478bd9Sstevel@tonic-gate } 9587c478bd9Sstevel@tonic-gate 9597c478bd9Sstevel@tonic-gate static void * 9607c478bd9Sstevel@tonic-gate sm_name(int ind) 9617c478bd9Sstevel@tonic-gate { 9627c478bd9Sstevel@tonic-gate switch (ind) { 9637c478bd9Sstevel@tonic-gate case PAM_AUTHENTICATE: 9647c478bd9Sstevel@tonic-gate return (PAM_SM_AUTHENTICATE); 9657c478bd9Sstevel@tonic-gate case PAM_SETCRED: 9667c478bd9Sstevel@tonic-gate return (PAM_SM_SETCRED); 9677c478bd9Sstevel@tonic-gate case PAM_ACCT_MGMT: 9687c478bd9Sstevel@tonic-gate return (PAM_SM_ACCT_MGMT); 9697c478bd9Sstevel@tonic-gate case PAM_OPEN_SESSION: 9707c478bd9Sstevel@tonic-gate return (PAM_SM_OPEN_SESSION); 9717c478bd9Sstevel@tonic-gate case PAM_CLOSE_SESSION: 9727c478bd9Sstevel@tonic-gate return (PAM_SM_CLOSE_SESSION); 9737c478bd9Sstevel@tonic-gate case PAM_CHAUTHTOK: 9747c478bd9Sstevel@tonic-gate return (PAM_SM_CHAUTHTOK); 9757c478bd9Sstevel@tonic-gate } 9767c478bd9Sstevel@tonic-gate return (NULL); 9777c478bd9Sstevel@tonic-gate } 9787c478bd9Sstevel@tonic-gate 9797c478bd9Sstevel@tonic-gate static int 9807c478bd9Sstevel@tonic-gate (*func(pamtab_t *modulep, int ind))() 9817c478bd9Sstevel@tonic-gate { 9827c478bd9Sstevel@tonic-gate void *funcp; 9837c478bd9Sstevel@tonic-gate 9847c478bd9Sstevel@tonic-gate if ((funcp = modulep->function_ptr) == NULL) 9857c478bd9Sstevel@tonic-gate return (NULL); 9867c478bd9Sstevel@tonic-gate 9877c478bd9Sstevel@tonic-gate switch (ind) { 9887c478bd9Sstevel@tonic-gate case PAM_AUTHENTICATE: 9897c478bd9Sstevel@tonic-gate return (((struct auth_module *)funcp)->pam_sm_authenticate); 9907c478bd9Sstevel@tonic-gate case PAM_SETCRED: 9917c478bd9Sstevel@tonic-gate return (((struct auth_module *)funcp)->pam_sm_setcred); 9927c478bd9Sstevel@tonic-gate case PAM_ACCT_MGMT: 9937c478bd9Sstevel@tonic-gate return (((struct account_module *)funcp)->pam_sm_acct_mgmt); 9947c478bd9Sstevel@tonic-gate case PAM_OPEN_SESSION: 9957c478bd9Sstevel@tonic-gate return (((struct session_module *)funcp)->pam_sm_open_session); 9967c478bd9Sstevel@tonic-gate case PAM_CLOSE_SESSION: 9977c478bd9Sstevel@tonic-gate return (((struct session_module *)funcp)->pam_sm_close_session); 9987c478bd9Sstevel@tonic-gate case PAM_CHAUTHTOK: 9997c478bd9Sstevel@tonic-gate return (((struct password_module *)funcp)->pam_sm_chauthtok); 10007c478bd9Sstevel@tonic-gate } 10017c478bd9Sstevel@tonic-gate return (NULL); 10027c478bd9Sstevel@tonic-gate } 10037c478bd9Sstevel@tonic-gate 10047c478bd9Sstevel@tonic-gate /* 10057c478bd9Sstevel@tonic-gate * Run through the PAM service module stack for the given module type. 10067c478bd9Sstevel@tonic-gate */ 10077c478bd9Sstevel@tonic-gate static int 10087c478bd9Sstevel@tonic-gate run_stack(pam_handle_t *pamh, int flags, int type, int def_err, int ind, 10097c478bd9Sstevel@tonic-gate char *function_name) 10107c478bd9Sstevel@tonic-gate { 10117c478bd9Sstevel@tonic-gate int err = PAM_SYSTEM_ERR; /* preset */ 10127c478bd9Sstevel@tonic-gate int optional_error = 0; 10137c478bd9Sstevel@tonic-gate int required_error = 0; 10147c478bd9Sstevel@tonic-gate int success = 0; 10157c478bd9Sstevel@tonic-gate pamtab_t *modulep; 10167c478bd9Sstevel@tonic-gate int (*sm_func)(); 10177c478bd9Sstevel@tonic-gate 10187c478bd9Sstevel@tonic-gate if (pamh == NULL) 10197c478bd9Sstevel@tonic-gate return (PAM_SYSTEM_ERR); 10207c478bd9Sstevel@tonic-gate 10217c478bd9Sstevel@tonic-gate /* read initial entries from pam.conf */ 10227c478bd9Sstevel@tonic-gate if ((err = read_pam_conf(pamh, PAM_CONFIG)) != PAM_SUCCESS) { 10237c478bd9Sstevel@tonic-gate return (err); 10247c478bd9Sstevel@tonic-gate } 10257c478bd9Sstevel@tonic-gate 10267c478bd9Sstevel@tonic-gate if ((modulep = 10277c478bd9Sstevel@tonic-gate pamh->pam_conf_info[pamh->include_depth][type]) == NULL) { 10287c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_ERR, "%s no initial module present", 10297c478bd9Sstevel@tonic-gate pam_trace_cname(pamh)); 10307c478bd9Sstevel@tonic-gate goto exit_return; 10317c478bd9Sstevel@tonic-gate } 10327c478bd9Sstevel@tonic-gate 10337c478bd9Sstevel@tonic-gate pamh->pam_inmodule = WO_OK; /* OK to get AUTHTOK */ 10347c478bd9Sstevel@tonic-gate include: 10357c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_MODULE, 10367c478bd9Sstevel@tonic-gate "[%d:%s]:run_stack:%s(%p, %x): %s", pamh->include_depth, 10377c478bd9Sstevel@tonic-gate pam_trace_cname(pamh), function_name, (void *)pamh, flags, 10387c478bd9Sstevel@tonic-gate modulep ? modulep->module_path : "NULL"); 10397c478bd9Sstevel@tonic-gate 10407c478bd9Sstevel@tonic-gate while (modulep != NULL) { 10417c478bd9Sstevel@tonic-gate if (modulep->pam_flag & PAM_INCLUDE) { 10427c478bd9Sstevel@tonic-gate /* save the return location */ 10437c478bd9Sstevel@tonic-gate pamh->pam_conf_modulep[pamh->include_depth] = 10447c478bd9Sstevel@tonic-gate modulep->next; 10457c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_MODULE, 10467c478bd9Sstevel@tonic-gate "setting for include[%d:%p]", 10477c478bd9Sstevel@tonic-gate pamh->include_depth, (void *)modulep->next); 10487c478bd9Sstevel@tonic-gate if (pamh->include_depth++ >= PAM_MAX_INCLUDE) { 10497c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_ERR, 10507c478bd9Sstevel@tonic-gate "run_stack: includes too deep %d " 10517c478bd9Sstevel@tonic-gate "found trying to include %s from %s, %d " 10527c478bd9Sstevel@tonic-gate "allowed", pamh->include_depth, 10537c478bd9Sstevel@tonic-gate modulep->module_path, pamh->pam_conf_name 10547c478bd9Sstevel@tonic-gate [PAM_MAX_INCLUDE] == NULL ? "NULL" : 10557c478bd9Sstevel@tonic-gate pamh->pam_conf_name[PAM_MAX_INCLUDE], 10567c478bd9Sstevel@tonic-gate PAM_MAX_INCLUDE); 10577c478bd9Sstevel@tonic-gate goto exit_return; 10587c478bd9Sstevel@tonic-gate } 10597c478bd9Sstevel@tonic-gate if ((err = read_pam_conf(pamh, 10607c478bd9Sstevel@tonic-gate modulep->module_path)) != PAM_SUCCESS) { 10617c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_ERR, 10627c478bd9Sstevel@tonic-gate "run_stack[%d:%s]: can't read included " 10637c478bd9Sstevel@tonic-gate "conf %s", pamh->include_depth, 10647c478bd9Sstevel@tonic-gate pam_trace_cname(pamh), 10657c478bd9Sstevel@tonic-gate modulep->module_path); 10667c478bd9Sstevel@tonic-gate goto exit_return; 10677c478bd9Sstevel@tonic-gate } 10687c478bd9Sstevel@tonic-gate if ((modulep = pamh->pam_conf_info 10697c478bd9Sstevel@tonic-gate [pamh->include_depth][type]) == NULL) { 10707c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_ERR, 10717c478bd9Sstevel@tonic-gate "run_stack[%d:%s]: no include module " 10727c478bd9Sstevel@tonic-gate "present %s", pamh->include_depth, 10737c478bd9Sstevel@tonic-gate pam_trace_cname(pamh), function_name); 10747c478bd9Sstevel@tonic-gate goto exit_return; 10757c478bd9Sstevel@tonic-gate } 10767c478bd9Sstevel@tonic-gate if (modulep->pam_flag & PAM_INCLUDE) { 10777c478bd9Sstevel@tonic-gate /* first line another include */ 10787c478bd9Sstevel@tonic-gate goto include; 10797c478bd9Sstevel@tonic-gate } 10807c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_DEFAULT, "include[%d:%s]" 10817c478bd9Sstevel@tonic-gate "(%p, %s)=%s", pamh->include_depth, 10827c478bd9Sstevel@tonic-gate pam_trace_cname(pamh), (void *)pamh, 10837c478bd9Sstevel@tonic-gate function_name, modulep->module_path); 10847c478bd9Sstevel@tonic-gate if ((err = load_modules(pamh, type, sm_name(ind), 10857c478bd9Sstevel@tonic-gate pamh->pam_conf_info 10867c478bd9Sstevel@tonic-gate [pamh->include_depth][type])) != PAM_SUCCESS) { 10877c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_DEFAULT, 10887c478bd9Sstevel@tonic-gate "[%d:%s]:%s(%p, %x): load_modules failed", 10897c478bd9Sstevel@tonic-gate pamh->include_depth, pam_trace_cname(pamh), 10907c478bd9Sstevel@tonic-gate function_name, (void *)pamh, flags); 10917c478bd9Sstevel@tonic-gate goto exit_return; 10927c478bd9Sstevel@tonic-gate } 10937c478bd9Sstevel@tonic-gate if ((modulep = pamh->pam_conf_info 10947c478bd9Sstevel@tonic-gate [pamh->include_depth][type]) == NULL) { 10957c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_ERR, 10967c478bd9Sstevel@tonic-gate "%s no initial module present", 10977c478bd9Sstevel@tonic-gate pam_trace_cname(pamh)); 10987c478bd9Sstevel@tonic-gate goto exit_return; 10997c478bd9Sstevel@tonic-gate } 11007c478bd9Sstevel@tonic-gate } else if ((err = load_modules(pamh, type, sm_name(ind), 11017c478bd9Sstevel@tonic-gate modulep)) != PAM_SUCCESS) { 11027c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_DEFAULT, 11037c478bd9Sstevel@tonic-gate "[%d:%s]:%s(%p, %x): load_modules failed", 11047c478bd9Sstevel@tonic-gate pamh->include_depth, pam_trace_cname(pamh), 11057c478bd9Sstevel@tonic-gate function_name, (void *)pamh, flags); 11067c478bd9Sstevel@tonic-gate goto exit_return; 11077c478bd9Sstevel@tonic-gate } /* PAM_INCLUDE */ 11087c478bd9Sstevel@tonic-gate sm_func = func(modulep, ind); 11097c478bd9Sstevel@tonic-gate if (sm_func) { 11107c478bd9Sstevel@tonic-gate err = sm_func(pamh, flags, modulep->module_argc, 11117c478bd9Sstevel@tonic-gate (const char **)modulep->module_argv); 11127c478bd9Sstevel@tonic-gate 11137c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_MODULE, 11147c478bd9Sstevel@tonic-gate "[%d:%s]:%s(%p, %x): %s returned %s", 11157c478bd9Sstevel@tonic-gate pamh->include_depth, pam_trace_cname(pamh), 11167c478bd9Sstevel@tonic-gate function_name, (void *)pamh, flags, 11177c478bd9Sstevel@tonic-gate modulep->module_path, pam_strerror(pamh, err)); 11187c478bd9Sstevel@tonic-gate 11197c478bd9Sstevel@tonic-gate switch (err) { 11207c478bd9Sstevel@tonic-gate case PAM_IGNORE: 11217c478bd9Sstevel@tonic-gate /* do nothing */ 11227c478bd9Sstevel@tonic-gate break; 11237c478bd9Sstevel@tonic-gate case PAM_SUCCESS: 11247c478bd9Sstevel@tonic-gate if ((modulep->pam_flag & PAM_SUFFI_BIND) && 11257c478bd9Sstevel@tonic-gate !required_error) { 11267c478bd9Sstevel@tonic-gate pamh->pam_inmodule = RW_OK; 11277c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_MODULE, 11287c478bd9Sstevel@tonic-gate "[%d:%s]:%s(%p, %x): %s: success", 11297c478bd9Sstevel@tonic-gate pamh->include_depth, 11307c478bd9Sstevel@tonic-gate pam_trace_cname(pamh), 11317c478bd9Sstevel@tonic-gate function_name, (void *)pamh, flags, 11327c478bd9Sstevel@tonic-gate (modulep->pam_flag & PAM_BINDING) ? 11337c478bd9Sstevel@tonic-gate PAM_BINDING_NAME : 11347c478bd9Sstevel@tonic-gate PAM_SUFFICIENT_NAME); 11357c478bd9Sstevel@tonic-gate goto exit_return; 11367c478bd9Sstevel@tonic-gate } 11377c478bd9Sstevel@tonic-gate success = 1; 11387c478bd9Sstevel@tonic-gate break; 11397c478bd9Sstevel@tonic-gate case PAM_TRY_AGAIN: 11407c478bd9Sstevel@tonic-gate /* 11417c478bd9Sstevel@tonic-gate * We need to return immediately, and 11427c478bd9Sstevel@tonic-gate * we shouldn't reset the AUTHTOK item 11437c478bd9Sstevel@tonic-gate * since it is not an error per-se. 11447c478bd9Sstevel@tonic-gate */ 11457c478bd9Sstevel@tonic-gate pamh->pam_inmodule = RW_OK; 11467c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_MODULE, 11477c478bd9Sstevel@tonic-gate "[%d:%s]:%s(%p, %x): TRY_AGAIN: %s", 11487c478bd9Sstevel@tonic-gate pamh->include_depth, pam_trace_cname(pamh), 11497c478bd9Sstevel@tonic-gate function_name, (void *)pamh, flags, 11507c478bd9Sstevel@tonic-gate pam_strerror(pamh, required_error ? 11517c478bd9Sstevel@tonic-gate required_error : err)); 11527c478bd9Sstevel@tonic-gate err = required_error ? required_error : err; 11537c478bd9Sstevel@tonic-gate goto exit_return; 11547c478bd9Sstevel@tonic-gate default: 11557c478bd9Sstevel@tonic-gate if (modulep->pam_flag & PAM_REQUISITE) { 11567c478bd9Sstevel@tonic-gate pamh->pam_inmodule = RW_OK; 11577c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_MODULE, 11587c478bd9Sstevel@tonic-gate "[%d:%s]:%s(%p, %x): requisite: %s", 11597c478bd9Sstevel@tonic-gate pamh->include_depth, 11607c478bd9Sstevel@tonic-gate pam_trace_cname(pamh), 11617c478bd9Sstevel@tonic-gate function_name, (void *)pamh, flags, 11627c478bd9Sstevel@tonic-gate pam_strerror(pamh, 11637c478bd9Sstevel@tonic-gate required_error ? required_error : 11647c478bd9Sstevel@tonic-gate err)); 11657c478bd9Sstevel@tonic-gate err = required_error ? 11667c478bd9Sstevel@tonic-gate required_error : err; 11677c478bd9Sstevel@tonic-gate goto exit_return; 11687c478bd9Sstevel@tonic-gate } else if (modulep->pam_flag & PAM_REQRD_BIND) { 11697c478bd9Sstevel@tonic-gate if (!required_error) 11707c478bd9Sstevel@tonic-gate required_error = err; 11717c478bd9Sstevel@tonic-gate } else { 11727c478bd9Sstevel@tonic-gate if (!optional_error) 11737c478bd9Sstevel@tonic-gate optional_error = err; 11747c478bd9Sstevel@tonic-gate } 11757c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_DEFAULT, 11767c478bd9Sstevel@tonic-gate "[%d:%s]:%s(%p, %x): error %s", 11777c478bd9Sstevel@tonic-gate pamh->include_depth, pam_trace_cname(pamh), 11787c478bd9Sstevel@tonic-gate function_name, (void *)pamh, flags, 11797c478bd9Sstevel@tonic-gate pam_strerror(pamh, err)); 11807c478bd9Sstevel@tonic-gate break; 11817c478bd9Sstevel@tonic-gate } 11827c478bd9Sstevel@tonic-gate } 11837c478bd9Sstevel@tonic-gate modulep = modulep->next; 11847c478bd9Sstevel@tonic-gate } 11857c478bd9Sstevel@tonic-gate 11867c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_MODULE, "[%d:%s]:stack_end:%s(%p, %x): %s %s: %s", 11877c478bd9Sstevel@tonic-gate pamh->include_depth, pam_trace_cname(pamh), function_name, 11887c478bd9Sstevel@tonic-gate (void *)pamh, flags, pamh->include_depth ? "included" : "final", 11897c478bd9Sstevel@tonic-gate required_error ? "required" : success ? "success" : 11907c478bd9Sstevel@tonic-gate optional_error ? "optional" : "default", 11917c478bd9Sstevel@tonic-gate pam_strerror(pamh, required_error ? required_error : 11927c478bd9Sstevel@tonic-gate success ? PAM_SUCCESS : optional_error ? optional_error : def_err)); 11937c478bd9Sstevel@tonic-gate if (pamh->include_depth > 0) { 11947c478bd9Sstevel@tonic-gate free_pam_conf_info(pamh); 11957c478bd9Sstevel@tonic-gate pamh->include_depth--; 11967c478bd9Sstevel@tonic-gate /* continue at next entry */ 11977c478bd9Sstevel@tonic-gate modulep = pamh->pam_conf_modulep[pamh->include_depth]; 11987c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_MODULE, "looping for include[%d:%p]", 11997c478bd9Sstevel@tonic-gate pamh->include_depth, (void *)modulep); 12007c478bd9Sstevel@tonic-gate goto include; 12017c478bd9Sstevel@tonic-gate } 12027c478bd9Sstevel@tonic-gate free_pam_conf_info(pamh); 12037c478bd9Sstevel@tonic-gate pamh->pam_inmodule = RW_OK; 12047c478bd9Sstevel@tonic-gate if (required_error != 0) 12057c478bd9Sstevel@tonic-gate return (required_error); 12067c478bd9Sstevel@tonic-gate else if (success != 0) 12077c478bd9Sstevel@tonic-gate return (PAM_SUCCESS); 12087c478bd9Sstevel@tonic-gate else if (optional_error != 0) 12097c478bd9Sstevel@tonic-gate return (optional_error); 12107c478bd9Sstevel@tonic-gate else 12117c478bd9Sstevel@tonic-gate return (def_err); 12127c478bd9Sstevel@tonic-gate 12137c478bd9Sstevel@tonic-gate exit_return: 12147c478bd9Sstevel@tonic-gate /* 12157c478bd9Sstevel@tonic-gate * All done at whatever depth we're at. 12167c478bd9Sstevel@tonic-gate * Go back to not having read /etc/pam.conf 12177c478bd9Sstevel@tonic-gate */ 12187c478bd9Sstevel@tonic-gate while (pamh->include_depth > 0) { 12197c478bd9Sstevel@tonic-gate free_pam_conf_info(pamh); 12207c478bd9Sstevel@tonic-gate pamh->include_depth--; 12217c478bd9Sstevel@tonic-gate } 12227c478bd9Sstevel@tonic-gate free_pam_conf_info(pamh); 12237c478bd9Sstevel@tonic-gate pamh->pam_inmodule = RW_OK; 12247c478bd9Sstevel@tonic-gate return (err); 12257c478bd9Sstevel@tonic-gate } 12267c478bd9Sstevel@tonic-gate 12277c478bd9Sstevel@tonic-gate /* 12287c478bd9Sstevel@tonic-gate * pam_authenticate - authenticate a user 12297c478bd9Sstevel@tonic-gate */ 12307c478bd9Sstevel@tonic-gate 12317c478bd9Sstevel@tonic-gate int 12327c478bd9Sstevel@tonic-gate pam_authenticate(pam_handle_t *pamh, int flags) 12337c478bd9Sstevel@tonic-gate { 12347c478bd9Sstevel@tonic-gate int retval; 12357c478bd9Sstevel@tonic-gate 12367c478bd9Sstevel@tonic-gate retval = run_stack(pamh, flags, PAM_AUTH_MODULE, PAM_AUTH_ERR, 12377c478bd9Sstevel@tonic-gate PAM_AUTHENTICATE, "pam_authenticate"); 12387c478bd9Sstevel@tonic-gate 12397c478bd9Sstevel@tonic-gate if (retval != PAM_SUCCESS) 12407c478bd9Sstevel@tonic-gate (void) pam_set_item(pamh, PAM_AUTHTOK, NULL); 12417c478bd9Sstevel@tonic-gate return (retval); 12427c478bd9Sstevel@tonic-gate } 12437c478bd9Sstevel@tonic-gate 12447c478bd9Sstevel@tonic-gate /* 12457c478bd9Sstevel@tonic-gate * pam_setcred - modify or retrieve user credentials 12467c478bd9Sstevel@tonic-gate */ 12477c478bd9Sstevel@tonic-gate 12487c478bd9Sstevel@tonic-gate int 12497c478bd9Sstevel@tonic-gate pam_setcred(pam_handle_t *pamh, int flags) 12507c478bd9Sstevel@tonic-gate { 12517c478bd9Sstevel@tonic-gate int retval; 12527c478bd9Sstevel@tonic-gate 12537c478bd9Sstevel@tonic-gate retval = run_stack(pamh, flags, PAM_AUTH_MODULE, PAM_CRED_ERR, 12547c478bd9Sstevel@tonic-gate PAM_SETCRED, "pam_setcred"); 12557c478bd9Sstevel@tonic-gate 12567c478bd9Sstevel@tonic-gate if (retval != PAM_SUCCESS) 12577c478bd9Sstevel@tonic-gate (void) pam_set_item(pamh, PAM_AUTHTOK, NULL); 12587c478bd9Sstevel@tonic-gate return (retval); 12597c478bd9Sstevel@tonic-gate } 12607c478bd9Sstevel@tonic-gate 12617c478bd9Sstevel@tonic-gate /* 12627c478bd9Sstevel@tonic-gate * pam_acct_mgmt - check password aging, account expiration 12637c478bd9Sstevel@tonic-gate */ 12647c478bd9Sstevel@tonic-gate 12657c478bd9Sstevel@tonic-gate int 12667c478bd9Sstevel@tonic-gate pam_acct_mgmt(pam_handle_t *pamh, int flags) 12677c478bd9Sstevel@tonic-gate { 12687c478bd9Sstevel@tonic-gate int retval; 12697c478bd9Sstevel@tonic-gate 12707c478bd9Sstevel@tonic-gate retval = run_stack(pamh, flags, PAM_ACCOUNT_MODULE, PAM_ACCT_EXPIRED, 12717c478bd9Sstevel@tonic-gate PAM_ACCT_MGMT, "pam_acct_mgmt"); 12727c478bd9Sstevel@tonic-gate 12737c478bd9Sstevel@tonic-gate if (retval != PAM_SUCCESS && 12747c478bd9Sstevel@tonic-gate retval != PAM_NEW_AUTHTOK_REQD) { 12757c478bd9Sstevel@tonic-gate (void) pam_set_item(pamh, PAM_AUTHTOK, NULL); 12767c478bd9Sstevel@tonic-gate } 12777c478bd9Sstevel@tonic-gate return (retval); 12787c478bd9Sstevel@tonic-gate } 12797c478bd9Sstevel@tonic-gate 12807c478bd9Sstevel@tonic-gate /* 12817c478bd9Sstevel@tonic-gate * pam_open_session - begin session management 12827c478bd9Sstevel@tonic-gate */ 12837c478bd9Sstevel@tonic-gate 12847c478bd9Sstevel@tonic-gate int 12857c478bd9Sstevel@tonic-gate pam_open_session(pam_handle_t *pamh, int flags) 12867c478bd9Sstevel@tonic-gate { 12877c478bd9Sstevel@tonic-gate int retval; 12887c478bd9Sstevel@tonic-gate 12897c478bd9Sstevel@tonic-gate retval = run_stack(pamh, flags, PAM_SESSION_MODULE, PAM_SESSION_ERR, 12907c478bd9Sstevel@tonic-gate PAM_OPEN_SESSION, "pam_open_session"); 12917c478bd9Sstevel@tonic-gate 12927c478bd9Sstevel@tonic-gate if (retval != PAM_SUCCESS) 12937c478bd9Sstevel@tonic-gate (void) pam_set_item(pamh, PAM_AUTHTOK, NULL); 12947c478bd9Sstevel@tonic-gate return (retval); 12957c478bd9Sstevel@tonic-gate } 12967c478bd9Sstevel@tonic-gate 12977c478bd9Sstevel@tonic-gate /* 12987c478bd9Sstevel@tonic-gate * pam_close_session - terminate session management 12997c478bd9Sstevel@tonic-gate */ 13007c478bd9Sstevel@tonic-gate 13017c478bd9Sstevel@tonic-gate int 13027c478bd9Sstevel@tonic-gate pam_close_session(pam_handle_t *pamh, int flags) 13037c478bd9Sstevel@tonic-gate { 13047c478bd9Sstevel@tonic-gate int retval; 13057c478bd9Sstevel@tonic-gate 13067c478bd9Sstevel@tonic-gate retval = run_stack(pamh, flags, PAM_SESSION_MODULE, PAM_SESSION_ERR, 13077c478bd9Sstevel@tonic-gate PAM_CLOSE_SESSION, "pam_close_session"); 13087c478bd9Sstevel@tonic-gate 13097c478bd9Sstevel@tonic-gate if (retval != PAM_SUCCESS) 13107c478bd9Sstevel@tonic-gate (void) pam_set_item(pamh, PAM_AUTHTOK, NULL); 13117c478bd9Sstevel@tonic-gate return (retval); 13127c478bd9Sstevel@tonic-gate } 13137c478bd9Sstevel@tonic-gate 13147c478bd9Sstevel@tonic-gate /* 13157c478bd9Sstevel@tonic-gate * pam_chauthtok - change user authentication token 13167c478bd9Sstevel@tonic-gate */ 13177c478bd9Sstevel@tonic-gate 13187c478bd9Sstevel@tonic-gate int 13197c478bd9Sstevel@tonic-gate pam_chauthtok(pam_handle_t *pamh, int flags) 13207c478bd9Sstevel@tonic-gate { 13217c478bd9Sstevel@tonic-gate int retval; 13227c478bd9Sstevel@tonic-gate 13237c478bd9Sstevel@tonic-gate /* do not let apps use PAM_PRELIM_CHECK or PAM_UPDATE_AUTHTOK */ 13247c478bd9Sstevel@tonic-gate if (flags & (PAM_PRELIM_CHECK | PAM_UPDATE_AUTHTOK)) { 13257c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_DEFAULT, 13267c478bd9Sstevel@tonic-gate "pam_chauthtok(%p, %x): %s", (void *)pamh, flags, 13277c478bd9Sstevel@tonic-gate pam_strerror(pamh, PAM_SYMBOL_ERR)); 13287c478bd9Sstevel@tonic-gate return (PAM_SYMBOL_ERR); 13297c478bd9Sstevel@tonic-gate } 13307c478bd9Sstevel@tonic-gate 13317c478bd9Sstevel@tonic-gate /* 1st pass: PRELIM CHECK */ 13327c478bd9Sstevel@tonic-gate retval = run_stack(pamh, flags | PAM_PRELIM_CHECK, PAM_PASSWORD_MODULE, 13337c478bd9Sstevel@tonic-gate PAM_AUTHTOK_ERR, PAM_CHAUTHTOK, "pam_chauthtok-prelim"); 13347c478bd9Sstevel@tonic-gate 13357c478bd9Sstevel@tonic-gate if (retval == PAM_TRY_AGAIN) 13367c478bd9Sstevel@tonic-gate return (retval); 13377c478bd9Sstevel@tonic-gate 13387c478bd9Sstevel@tonic-gate if (retval != PAM_SUCCESS) { 13397c478bd9Sstevel@tonic-gate (void) pam_set_item(pamh, PAM_AUTHTOK, NULL); 13407c478bd9Sstevel@tonic-gate return (retval); 13417c478bd9Sstevel@tonic-gate } 13427c478bd9Sstevel@tonic-gate 13437c478bd9Sstevel@tonic-gate /* 2nd pass: UPDATE AUTHTOK */ 13447c478bd9Sstevel@tonic-gate retval = run_stack(pamh, flags | PAM_UPDATE_AUTHTOK, 13457c478bd9Sstevel@tonic-gate PAM_PASSWORD_MODULE, PAM_AUTHTOK_ERR, PAM_CHAUTHTOK, 13467c478bd9Sstevel@tonic-gate "pam_chauthtok-update"); 13477c478bd9Sstevel@tonic-gate 13487c478bd9Sstevel@tonic-gate if (retval != PAM_SUCCESS) 13497c478bd9Sstevel@tonic-gate (void) pam_set_item(pamh, PAM_AUTHTOK, NULL); 13507c478bd9Sstevel@tonic-gate 13517c478bd9Sstevel@tonic-gate return (retval); 13527c478bd9Sstevel@tonic-gate } 13537c478bd9Sstevel@tonic-gate 13547c478bd9Sstevel@tonic-gate /* 13557c478bd9Sstevel@tonic-gate * pam_putenv - add an environment variable to the PAM handle 13567c478bd9Sstevel@tonic-gate * if name_value == 'NAME=VALUE' then set variable to the value 13577c478bd9Sstevel@tonic-gate * if name_value == 'NAME=' then set variable to an empty value 13587c478bd9Sstevel@tonic-gate * if name_value == 'NAME' then delete the variable 13597c478bd9Sstevel@tonic-gate */ 13607c478bd9Sstevel@tonic-gate 13617c478bd9Sstevel@tonic-gate int 13627c478bd9Sstevel@tonic-gate pam_putenv(pam_handle_t *pamh, const char *name_value) 13637c478bd9Sstevel@tonic-gate { 13647c478bd9Sstevel@tonic-gate int error = PAM_SYSTEM_ERR; 13657c478bd9Sstevel@tonic-gate char *equal_sign = 0; 13667c478bd9Sstevel@tonic-gate char *name = NULL, *value = NULL, *tmp_value = NULL; 13677c478bd9Sstevel@tonic-gate env_list *traverse, *trail; 13687c478bd9Sstevel@tonic-gate 13697c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_DEFAULT, 13707c478bd9Sstevel@tonic-gate "pam_putenv(%p, %s)", (void *)pamh, 13717c478bd9Sstevel@tonic-gate name_value ? name_value : "NULL"); 13727c478bd9Sstevel@tonic-gate 13737c478bd9Sstevel@tonic-gate if (pamh == NULL || name_value == NULL) 13747c478bd9Sstevel@tonic-gate goto out; 13757c478bd9Sstevel@tonic-gate 13767c478bd9Sstevel@tonic-gate /* see if we were passed 'NAME=VALUE', 'NAME=', or 'NAME' */ 13777c478bd9Sstevel@tonic-gate if ((equal_sign = strchr(name_value, '=')) != 0) { 13781e08f0b8Sgww if ((name = calloc(equal_sign - name_value + 1, 13797c478bd9Sstevel@tonic-gate sizeof (char))) == 0) { 13807c478bd9Sstevel@tonic-gate error = PAM_BUF_ERR; 13817c478bd9Sstevel@tonic-gate goto out; 13827c478bd9Sstevel@tonic-gate } 13837c478bd9Sstevel@tonic-gate (void) strncpy(name, name_value, equal_sign - name_value); 13847c478bd9Sstevel@tonic-gate if ((value = strdup(++equal_sign)) == 0) { 13857c478bd9Sstevel@tonic-gate error = PAM_BUF_ERR; 13867c478bd9Sstevel@tonic-gate goto out; 13877c478bd9Sstevel@tonic-gate } 13887c478bd9Sstevel@tonic-gate } else { 13897c478bd9Sstevel@tonic-gate if ((name = strdup(name_value)) == 0) { 13907c478bd9Sstevel@tonic-gate error = PAM_BUF_ERR; 13917c478bd9Sstevel@tonic-gate goto out; 13927c478bd9Sstevel@tonic-gate } 13937c478bd9Sstevel@tonic-gate } 13947c478bd9Sstevel@tonic-gate 13957c478bd9Sstevel@tonic-gate /* check to see if we already have this variable in the PAM handle */ 13967c478bd9Sstevel@tonic-gate traverse = pamh->pam_env; 13977c478bd9Sstevel@tonic-gate trail = traverse; 13987c478bd9Sstevel@tonic-gate while (traverse && strncmp(traverse->name, name, strlen(name))) { 13997c478bd9Sstevel@tonic-gate trail = traverse; 14007c478bd9Sstevel@tonic-gate traverse = traverse->next; 14017c478bd9Sstevel@tonic-gate } 14027c478bd9Sstevel@tonic-gate 14037c478bd9Sstevel@tonic-gate if (traverse) { 14047c478bd9Sstevel@tonic-gate /* found a match */ 14057c478bd9Sstevel@tonic-gate if (value == 0) { 14067c478bd9Sstevel@tonic-gate /* remove the env variable */ 14077c478bd9Sstevel@tonic-gate if (pamh->pam_env == traverse) 14087c478bd9Sstevel@tonic-gate pamh->pam_env = traverse->next; 14097c478bd9Sstevel@tonic-gate else 14107c478bd9Sstevel@tonic-gate trail->next = traverse->next; 14117c478bd9Sstevel@tonic-gate free_env(traverse); 14127c478bd9Sstevel@tonic-gate } else if (strlen(value) == 0) { 14137c478bd9Sstevel@tonic-gate /* set env variable to empty value */ 14147c478bd9Sstevel@tonic-gate if ((tmp_value = strdup("")) == 0) { 14157c478bd9Sstevel@tonic-gate error = PAM_SYSTEM_ERR; 14167c478bd9Sstevel@tonic-gate goto out; 14177c478bd9Sstevel@tonic-gate } 14187c478bd9Sstevel@tonic-gate free(traverse->value); 14197c478bd9Sstevel@tonic-gate traverse->value = tmp_value; 14207c478bd9Sstevel@tonic-gate } else { 14217c478bd9Sstevel@tonic-gate /* set the new value */ 14227c478bd9Sstevel@tonic-gate if ((tmp_value = strdup(value)) == 0) { 14237c478bd9Sstevel@tonic-gate error = PAM_SYSTEM_ERR; 14247c478bd9Sstevel@tonic-gate goto out; 14257c478bd9Sstevel@tonic-gate } 14267c478bd9Sstevel@tonic-gate free(traverse->value); 14277c478bd9Sstevel@tonic-gate traverse->value = tmp_value; 14287c478bd9Sstevel@tonic-gate } 14297c478bd9Sstevel@tonic-gate 14307c478bd9Sstevel@tonic-gate } else if (traverse == 0 && value) { 14317c478bd9Sstevel@tonic-gate /* 14327c478bd9Sstevel@tonic-gate * could not find a match in the PAM handle. 14337c478bd9Sstevel@tonic-gate * add the new value if there is one 14347c478bd9Sstevel@tonic-gate */ 14351e08f0b8Sgww if ((traverse = calloc(1, sizeof (env_list))) == 0) { 14367c478bd9Sstevel@tonic-gate error = PAM_BUF_ERR; 14377c478bd9Sstevel@tonic-gate goto out; 14387c478bd9Sstevel@tonic-gate } 14397c478bd9Sstevel@tonic-gate if ((traverse->name = strdup(name)) == 0) { 14407c478bd9Sstevel@tonic-gate free_env(traverse); 14417c478bd9Sstevel@tonic-gate error = PAM_BUF_ERR; 14427c478bd9Sstevel@tonic-gate goto out; 14437c478bd9Sstevel@tonic-gate } 14447c478bd9Sstevel@tonic-gate if ((traverse->value = strdup(value)) == 0) { 14457c478bd9Sstevel@tonic-gate free_env(traverse); 14467c478bd9Sstevel@tonic-gate error = PAM_BUF_ERR; 14477c478bd9Sstevel@tonic-gate goto out; 14487c478bd9Sstevel@tonic-gate } 14497c478bd9Sstevel@tonic-gate if (trail == 0) { 14507c478bd9Sstevel@tonic-gate /* new head of list */ 14517c478bd9Sstevel@tonic-gate pamh->pam_env = traverse; 14527c478bd9Sstevel@tonic-gate } else { 14537c478bd9Sstevel@tonic-gate /* adding to end of list */ 14547c478bd9Sstevel@tonic-gate trail->next = traverse; 14557c478bd9Sstevel@tonic-gate } 14567c478bd9Sstevel@tonic-gate } 14577c478bd9Sstevel@tonic-gate 14587c478bd9Sstevel@tonic-gate error = PAM_SUCCESS; 14597c478bd9Sstevel@tonic-gate out: 14607c478bd9Sstevel@tonic-gate if (error != PAM_SUCCESS) { 14617c478bd9Sstevel@tonic-gate if (traverse) { 14627c478bd9Sstevel@tonic-gate if (traverse->name) 14637c478bd9Sstevel@tonic-gate free(traverse->name); 14647c478bd9Sstevel@tonic-gate if (traverse->value) 14657c478bd9Sstevel@tonic-gate free(traverse->value); 14667c478bd9Sstevel@tonic-gate free(traverse); 14677c478bd9Sstevel@tonic-gate } 14687c478bd9Sstevel@tonic-gate } 14697c478bd9Sstevel@tonic-gate if (name) 14707c478bd9Sstevel@tonic-gate free(name); 14717c478bd9Sstevel@tonic-gate if (value) 14727c478bd9Sstevel@tonic-gate free(value); 14737c478bd9Sstevel@tonic-gate return (error); 14747c478bd9Sstevel@tonic-gate } 14757c478bd9Sstevel@tonic-gate 14767c478bd9Sstevel@tonic-gate /* 14777c478bd9Sstevel@tonic-gate * pam_getenv - retrieve an environment variable from the PAM handle 14787c478bd9Sstevel@tonic-gate */ 14797c478bd9Sstevel@tonic-gate char * 14807c478bd9Sstevel@tonic-gate pam_getenv(pam_handle_t *pamh, const char *name) 14817c478bd9Sstevel@tonic-gate { 14827c478bd9Sstevel@tonic-gate int error = PAM_SYSTEM_ERR; 14837c478bd9Sstevel@tonic-gate env_list *traverse; 14847c478bd9Sstevel@tonic-gate 14857c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_DEFAULT, 14867c478bd9Sstevel@tonic-gate "pam_getenv(%p, %p)", (void *)pamh, (void *)name); 14877c478bd9Sstevel@tonic-gate 14887c478bd9Sstevel@tonic-gate if (pamh == NULL || name == NULL) 14897c478bd9Sstevel@tonic-gate goto out; 14907c478bd9Sstevel@tonic-gate 14917c478bd9Sstevel@tonic-gate /* check to see if we already have this variable in the PAM handle */ 14927c478bd9Sstevel@tonic-gate traverse = pamh->pam_env; 14937c478bd9Sstevel@tonic-gate while (traverse && strncmp(traverse->name, name, strlen(name))) { 14947c478bd9Sstevel@tonic-gate traverse = traverse->next; 14957c478bd9Sstevel@tonic-gate } 14967c478bd9Sstevel@tonic-gate error = (traverse ? PAM_SUCCESS : PAM_SYSTEM_ERR); 14977c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_DEFAULT, 14987c478bd9Sstevel@tonic-gate "pam_getenv(%p, %s)=%s", (void *)pamh, name, 14997c478bd9Sstevel@tonic-gate traverse ? traverse->value : "NULL"); 15007c478bd9Sstevel@tonic-gate out: 15017c478bd9Sstevel@tonic-gate return (error ? NULL : strdup(traverse->value)); 15027c478bd9Sstevel@tonic-gate } 15037c478bd9Sstevel@tonic-gate 15047c478bd9Sstevel@tonic-gate /* 15057c478bd9Sstevel@tonic-gate * pam_getenvlist - retrieve all environment variables from the PAM handle 1506ace0ce48Sjjj * in a NULL terminated array. On error, return NULL. 15077c478bd9Sstevel@tonic-gate */ 15087c478bd9Sstevel@tonic-gate char ** 15097c478bd9Sstevel@tonic-gate pam_getenvlist(pam_handle_t *pamh) 15107c478bd9Sstevel@tonic-gate { 15117c478bd9Sstevel@tonic-gate int error = PAM_SYSTEM_ERR; 15127c478bd9Sstevel@tonic-gate char **list = 0; 15137c478bd9Sstevel@tonic-gate int length = 0; 15147c478bd9Sstevel@tonic-gate env_list *traverse; 1515ace0ce48Sjjj char *tenv; 1516ace0ce48Sjjj size_t tenv_size; 15177c478bd9Sstevel@tonic-gate 15187c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_DEFAULT, 15197c478bd9Sstevel@tonic-gate "pam_getenvlist(%p)", (void *)pamh); 15207c478bd9Sstevel@tonic-gate 15217c478bd9Sstevel@tonic-gate if (pamh == NULL) 15227c478bd9Sstevel@tonic-gate goto out; 15237c478bd9Sstevel@tonic-gate 15247c478bd9Sstevel@tonic-gate /* find out how many environment variables we have */ 15257c478bd9Sstevel@tonic-gate traverse = pamh->pam_env; 15267c478bd9Sstevel@tonic-gate while (traverse) { 15277c478bd9Sstevel@tonic-gate length++; 15287c478bd9Sstevel@tonic-gate traverse = traverse->next; 15297c478bd9Sstevel@tonic-gate } 15307c478bd9Sstevel@tonic-gate 15317c478bd9Sstevel@tonic-gate /* allocate the array we will return to the caller */ 15321e08f0b8Sgww if ((list = calloc(length + 1, sizeof (char *))) == NULL) { 15337c478bd9Sstevel@tonic-gate error = PAM_BUF_ERR; 15347c478bd9Sstevel@tonic-gate goto out; 15357c478bd9Sstevel@tonic-gate } 15367c478bd9Sstevel@tonic-gate 15377c478bd9Sstevel@tonic-gate /* add the variables one by one */ 15387c478bd9Sstevel@tonic-gate length = 0; 15397c478bd9Sstevel@tonic-gate traverse = pamh->pam_env; 1540ace0ce48Sjjj while (traverse != NULL) { 1541ace0ce48Sjjj tenv_size = strlen(traverse->name) + 1542ace0ce48Sjjj strlen(traverse->value) + 2; /* name=val\0 */ 1543ace0ce48Sjjj if ((tenv = malloc(tenv_size)) == NULL) { 15447c478bd9Sstevel@tonic-gate error = PAM_BUF_ERR; 15457c478bd9Sstevel@tonic-gate goto out; 15467c478bd9Sstevel@tonic-gate } 1547ace0ce48Sjjj /*LINTED*/ 1548ace0ce48Sjjj (void) sprintf(tenv, "%s=%s", traverse->name, traverse->value); 1549ace0ce48Sjjj list[length++] = tenv; 15507c478bd9Sstevel@tonic-gate traverse = traverse->next; 15517c478bd9Sstevel@tonic-gate } 1552ace0ce48Sjjj list[length] = NULL; 15537c478bd9Sstevel@tonic-gate 15547c478bd9Sstevel@tonic-gate error = PAM_SUCCESS; 15557c478bd9Sstevel@tonic-gate out: 15567c478bd9Sstevel@tonic-gate if (error != PAM_SUCCESS) { 15577c478bd9Sstevel@tonic-gate /* free the partially constructed list */ 15587c478bd9Sstevel@tonic-gate if (list) { 15597c478bd9Sstevel@tonic-gate length = 0; 15607c478bd9Sstevel@tonic-gate while (list[length] != NULL) { 15617c478bd9Sstevel@tonic-gate free(list[length]); 15627c478bd9Sstevel@tonic-gate length++; 15637c478bd9Sstevel@tonic-gate } 15647c478bd9Sstevel@tonic-gate free(list); 15657c478bd9Sstevel@tonic-gate } 15667c478bd9Sstevel@tonic-gate } 15677c478bd9Sstevel@tonic-gate return (error ? NULL : list); 15687c478bd9Sstevel@tonic-gate } 15697c478bd9Sstevel@tonic-gate 15707c478bd9Sstevel@tonic-gate /* 15717c478bd9Sstevel@tonic-gate * Routines to load a requested module on demand 15727c478bd9Sstevel@tonic-gate */ 15737c478bd9Sstevel@tonic-gate 15747c478bd9Sstevel@tonic-gate /* 15757c478bd9Sstevel@tonic-gate * load_modules - load the requested module. 15767c478bd9Sstevel@tonic-gate * if the dlopen or dlsym fail, then 15777c478bd9Sstevel@tonic-gate * the module is ignored. 15787c478bd9Sstevel@tonic-gate */ 15797c478bd9Sstevel@tonic-gate 15807c478bd9Sstevel@tonic-gate static int 15817c478bd9Sstevel@tonic-gate load_modules(pam_handle_t *pamh, int type, char *function_name, 15827c478bd9Sstevel@tonic-gate pamtab_t *pam_entry) 15837c478bd9Sstevel@tonic-gate { 15847c478bd9Sstevel@tonic-gate void *mh; 15857c478bd9Sstevel@tonic-gate struct auth_module *authp; 15867c478bd9Sstevel@tonic-gate struct account_module *accountp; 15877c478bd9Sstevel@tonic-gate struct session_module *sessionp; 15887c478bd9Sstevel@tonic-gate struct password_module *passwdp; 15897c478bd9Sstevel@tonic-gate int loading_functions = 0; /* are we currently loading functions? */ 15907c478bd9Sstevel@tonic-gate 15917c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_MODULE, "load_modules[%d:%s](%p, %s)=%s:%s", 15921e08f0b8Sgww pamh->include_depth, pam_trace_cname(pamh), (void *)pamh, 15931e08f0b8Sgww function_name, pam_trace_fname(pam_entry->pam_flag), 15941e08f0b8Sgww pam_entry->module_path); 15957c478bd9Sstevel@tonic-gate 15967c478bd9Sstevel@tonic-gate while (pam_entry != NULL) { 15977c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_DEFAULT, 15987c478bd9Sstevel@tonic-gate "while load_modules[%d:%s](%p, %s)=%s", 15997c478bd9Sstevel@tonic-gate pamh->include_depth, pam_trace_cname(pamh), (void *)pamh, 16007c478bd9Sstevel@tonic-gate function_name, pam_entry->module_path); 16017c478bd9Sstevel@tonic-gate 16027c478bd9Sstevel@tonic-gate if (pam_entry->pam_flag & PAM_INCLUDE) { 16037c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_DEFAULT, 16047c478bd9Sstevel@tonic-gate "done load_modules[%d:%s](%p, %s)=%s", 16057c478bd9Sstevel@tonic-gate pamh->include_depth, pam_trace_cname(pamh), 16067c478bd9Sstevel@tonic-gate (void *)pamh, function_name, 16077c478bd9Sstevel@tonic-gate pam_entry->module_path); 16087c478bd9Sstevel@tonic-gate return (PAM_SUCCESS); 16097c478bd9Sstevel@tonic-gate } 16107c478bd9Sstevel@tonic-gate switch (type) { 16117c478bd9Sstevel@tonic-gate case PAM_AUTH_MODULE: 16127c478bd9Sstevel@tonic-gate 16137c478bd9Sstevel@tonic-gate /* if the function has already been loaded, return */ 16147c478bd9Sstevel@tonic-gate authp = pam_entry->function_ptr; 16157c478bd9Sstevel@tonic-gate if (!loading_functions && 16161e08f0b8Sgww (((strcmp(function_name, PAM_SM_AUTHENTICATE) 16171e08f0b8Sgww == 0) && authp && authp->pam_sm_authenticate) || 16181e08f0b8Sgww ((strcmp(function_name, PAM_SM_SETCRED) == 0) && 16191e08f0b8Sgww authp && authp->pam_sm_setcred))) { 16207c478bd9Sstevel@tonic-gate return (PAM_SUCCESS); 16217c478bd9Sstevel@tonic-gate } 16227c478bd9Sstevel@tonic-gate 16237c478bd9Sstevel@tonic-gate /* function has not been loaded yet */ 16247c478bd9Sstevel@tonic-gate loading_functions = 1; 16257c478bd9Sstevel@tonic-gate if (authp == NULL) { 16261e08f0b8Sgww authp = calloc(1, sizeof (struct auth_module)); 16277c478bd9Sstevel@tonic-gate if (authp == NULL) 16287c478bd9Sstevel@tonic-gate return (PAM_BUF_ERR); 16297c478bd9Sstevel@tonic-gate } 16307c478bd9Sstevel@tonic-gate 16317c478bd9Sstevel@tonic-gate /* if open_module fails, return error */ 16327c478bd9Sstevel@tonic-gate if ((mh = open_module(pamh, 16337c478bd9Sstevel@tonic-gate pam_entry->module_path)) == NULL) { 16347c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_ERR, 16357c478bd9Sstevel@tonic-gate "load_modules[%d:%s]: can not open module " 16367c478bd9Sstevel@tonic-gate "%s", pamh->include_depth, 16377c478bd9Sstevel@tonic-gate pam_trace_cname(pamh), 16387c478bd9Sstevel@tonic-gate pam_entry->module_path); 16397c478bd9Sstevel@tonic-gate free(authp); 16407c478bd9Sstevel@tonic-gate return (PAM_OPEN_ERR); 16417c478bd9Sstevel@tonic-gate } 16427c478bd9Sstevel@tonic-gate 16437c478bd9Sstevel@tonic-gate /* load the authentication function */ 16447c478bd9Sstevel@tonic-gate if (strcmp(function_name, PAM_SM_AUTHENTICATE) == 0) { 16457c478bd9Sstevel@tonic-gate if (load_function(mh, PAM_SM_AUTHENTICATE, 16467c478bd9Sstevel@tonic-gate &authp->pam_sm_authenticate) 16477c478bd9Sstevel@tonic-gate != PAM_SUCCESS) { 16487c478bd9Sstevel@tonic-gate /* return error if dlsym fails */ 16497c478bd9Sstevel@tonic-gate free(authp); 16507c478bd9Sstevel@tonic-gate return (PAM_SYMBOL_ERR); 16517c478bd9Sstevel@tonic-gate } 16527c478bd9Sstevel@tonic-gate 16537c478bd9Sstevel@tonic-gate /* load the setcred function */ 16547c478bd9Sstevel@tonic-gate } else if (strcmp(function_name, PAM_SM_SETCRED) == 0) { 16557c478bd9Sstevel@tonic-gate if (load_function(mh, PAM_SM_SETCRED, 16567c478bd9Sstevel@tonic-gate &authp->pam_sm_setcred) != PAM_SUCCESS) { 16577c478bd9Sstevel@tonic-gate /* return error if dlsym fails */ 16587c478bd9Sstevel@tonic-gate free(authp); 16597c478bd9Sstevel@tonic-gate return (PAM_SYMBOL_ERR); 16607c478bd9Sstevel@tonic-gate } 16617c478bd9Sstevel@tonic-gate } 16627c478bd9Sstevel@tonic-gate pam_entry->function_ptr = authp; 16637c478bd9Sstevel@tonic-gate break; 16647c478bd9Sstevel@tonic-gate case PAM_ACCOUNT_MODULE: 16657c478bd9Sstevel@tonic-gate accountp = pam_entry->function_ptr; 16667c478bd9Sstevel@tonic-gate if (!loading_functions && 16677c478bd9Sstevel@tonic-gate (strcmp(function_name, PAM_SM_ACCT_MGMT) == 0) && 16687c478bd9Sstevel@tonic-gate accountp && accountp->pam_sm_acct_mgmt) { 16697c478bd9Sstevel@tonic-gate return (PAM_SUCCESS); 16707c478bd9Sstevel@tonic-gate } 16717c478bd9Sstevel@tonic-gate 16727c478bd9Sstevel@tonic-gate /* 16737c478bd9Sstevel@tonic-gate * If functions are added to the account module, 16747c478bd9Sstevel@tonic-gate * verify that one of the other functions hasn't 16757c478bd9Sstevel@tonic-gate * already loaded it. See PAM_AUTH_MODULE code. 16767c478bd9Sstevel@tonic-gate */ 16777c478bd9Sstevel@tonic-gate loading_functions = 1; 16781e08f0b8Sgww accountp = calloc(1, sizeof (struct account_module)); 16797c478bd9Sstevel@tonic-gate if (accountp == NULL) 16807c478bd9Sstevel@tonic-gate return (PAM_BUF_ERR); 16817c478bd9Sstevel@tonic-gate 16827c478bd9Sstevel@tonic-gate /* if open_module fails, return error */ 16837c478bd9Sstevel@tonic-gate if ((mh = open_module(pamh, 16847c478bd9Sstevel@tonic-gate pam_entry->module_path)) == NULL) { 16857c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_ERR, 16867c478bd9Sstevel@tonic-gate "load_modules[%d:%s]: can not open module " 16877c478bd9Sstevel@tonic-gate "%s", pamh->include_depth, 16887c478bd9Sstevel@tonic-gate pam_trace_cname(pamh), 16897c478bd9Sstevel@tonic-gate pam_entry->module_path); 16907c478bd9Sstevel@tonic-gate free(accountp); 16917c478bd9Sstevel@tonic-gate return (PAM_OPEN_ERR); 16927c478bd9Sstevel@tonic-gate } 16937c478bd9Sstevel@tonic-gate 16947c478bd9Sstevel@tonic-gate if (load_function(mh, PAM_SM_ACCT_MGMT, 16957c478bd9Sstevel@tonic-gate &accountp->pam_sm_acct_mgmt) != PAM_SUCCESS) { 16967c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_ERR, 16977c478bd9Sstevel@tonic-gate "load_modules[%d:%s]: pam_sm_acct_mgmt() " 16987c478bd9Sstevel@tonic-gate "missing", pamh->include_depth, 16997c478bd9Sstevel@tonic-gate pam_trace_cname(pamh)); 17007c478bd9Sstevel@tonic-gate free(accountp); 17017c478bd9Sstevel@tonic-gate return (PAM_SYMBOL_ERR); 17027c478bd9Sstevel@tonic-gate } 17037c478bd9Sstevel@tonic-gate pam_entry->function_ptr = accountp; 17047c478bd9Sstevel@tonic-gate break; 17057c478bd9Sstevel@tonic-gate case PAM_SESSION_MODULE: 17067c478bd9Sstevel@tonic-gate sessionp = pam_entry->function_ptr; 17077c478bd9Sstevel@tonic-gate if (!loading_functions && 17087c478bd9Sstevel@tonic-gate (((strcmp(function_name, 17097c478bd9Sstevel@tonic-gate PAM_SM_OPEN_SESSION) == 0) && 17107c478bd9Sstevel@tonic-gate sessionp && sessionp->pam_sm_open_session) || 17117c478bd9Sstevel@tonic-gate ((strcmp(function_name, 17127c478bd9Sstevel@tonic-gate PAM_SM_CLOSE_SESSION) == 0) && 17137c478bd9Sstevel@tonic-gate sessionp && sessionp->pam_sm_close_session))) { 17147c478bd9Sstevel@tonic-gate return (PAM_SUCCESS); 17157c478bd9Sstevel@tonic-gate } 17167c478bd9Sstevel@tonic-gate 17177c478bd9Sstevel@tonic-gate loading_functions = 1; 17187c478bd9Sstevel@tonic-gate if (sessionp == NULL) { 17191e08f0b8Sgww sessionp = calloc(1, 17201e08f0b8Sgww sizeof (struct session_module)); 17217c478bd9Sstevel@tonic-gate if (sessionp == NULL) 17227c478bd9Sstevel@tonic-gate return (PAM_BUF_ERR); 17237c478bd9Sstevel@tonic-gate } 17247c478bd9Sstevel@tonic-gate 17257c478bd9Sstevel@tonic-gate /* if open_module fails, return error */ 17267c478bd9Sstevel@tonic-gate if ((mh = open_module(pamh, 17277c478bd9Sstevel@tonic-gate pam_entry->module_path)) == NULL) { 17287c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_ERR, 17297c478bd9Sstevel@tonic-gate "load_modules[%d:%s]: can not open module " 17307c478bd9Sstevel@tonic-gate "%s", pamh->include_depth, 17317c478bd9Sstevel@tonic-gate pam_trace_cname(pamh), 17327c478bd9Sstevel@tonic-gate pam_entry->module_path); 17337c478bd9Sstevel@tonic-gate free(sessionp); 17347c478bd9Sstevel@tonic-gate return (PAM_OPEN_ERR); 17357c478bd9Sstevel@tonic-gate } 17367c478bd9Sstevel@tonic-gate 17377c478bd9Sstevel@tonic-gate if ((strcmp(function_name, PAM_SM_OPEN_SESSION) == 0) && 17387c478bd9Sstevel@tonic-gate load_function(mh, PAM_SM_OPEN_SESSION, 17391e08f0b8Sgww &sessionp->pam_sm_open_session) != PAM_SUCCESS) { 17407c478bd9Sstevel@tonic-gate free(sessionp); 17417c478bd9Sstevel@tonic-gate return (PAM_SYMBOL_ERR); 17427c478bd9Sstevel@tonic-gate } else if ((strcmp(function_name, 17431e08f0b8Sgww PAM_SM_CLOSE_SESSION) == 0) && 17441e08f0b8Sgww load_function(mh, PAM_SM_CLOSE_SESSION, 17451e08f0b8Sgww &sessionp->pam_sm_close_session) != PAM_SUCCESS) { 17467c478bd9Sstevel@tonic-gate free(sessionp); 17477c478bd9Sstevel@tonic-gate return (PAM_SYMBOL_ERR); 17487c478bd9Sstevel@tonic-gate } 17497c478bd9Sstevel@tonic-gate pam_entry->function_ptr = sessionp; 17507c478bd9Sstevel@tonic-gate break; 17517c478bd9Sstevel@tonic-gate case PAM_PASSWORD_MODULE: 17527c478bd9Sstevel@tonic-gate passwdp = pam_entry->function_ptr; 17537c478bd9Sstevel@tonic-gate if (!loading_functions && 17547c478bd9Sstevel@tonic-gate (strcmp(function_name, PAM_SM_CHAUTHTOK) == 0) && 17557c478bd9Sstevel@tonic-gate passwdp && passwdp->pam_sm_chauthtok) { 17567c478bd9Sstevel@tonic-gate return (PAM_SUCCESS); 17577c478bd9Sstevel@tonic-gate } 17587c478bd9Sstevel@tonic-gate 17597c478bd9Sstevel@tonic-gate /* 17607c478bd9Sstevel@tonic-gate * If functions are added to the password module, 17617c478bd9Sstevel@tonic-gate * verify that one of the other functions hasn't 17627c478bd9Sstevel@tonic-gate * already loaded it. See PAM_AUTH_MODULE code. 17637c478bd9Sstevel@tonic-gate */ 17647c478bd9Sstevel@tonic-gate loading_functions = 1; 17651e08f0b8Sgww passwdp = calloc(1, sizeof (struct password_module)); 17667c478bd9Sstevel@tonic-gate if (passwdp == NULL) 17677c478bd9Sstevel@tonic-gate return (PAM_BUF_ERR); 17687c478bd9Sstevel@tonic-gate 17697c478bd9Sstevel@tonic-gate /* if open_module fails, continue */ 17707c478bd9Sstevel@tonic-gate if ((mh = open_module(pamh, 17717c478bd9Sstevel@tonic-gate pam_entry->module_path)) == NULL) { 17727c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_ERR, 17737c478bd9Sstevel@tonic-gate "load_modules[%d:%s]: can not open module " 17747c478bd9Sstevel@tonic-gate "%s", pamh->include_depth, 17757c478bd9Sstevel@tonic-gate pam_trace_cname(pamh), 17767c478bd9Sstevel@tonic-gate pam_entry->module_path); 17777c478bd9Sstevel@tonic-gate free(passwdp); 17787c478bd9Sstevel@tonic-gate return (PAM_OPEN_ERR); 17797c478bd9Sstevel@tonic-gate } 17807c478bd9Sstevel@tonic-gate 17817c478bd9Sstevel@tonic-gate if (load_function(mh, PAM_SM_CHAUTHTOK, 17827c478bd9Sstevel@tonic-gate &passwdp->pam_sm_chauthtok) != PAM_SUCCESS) { 17837c478bd9Sstevel@tonic-gate free(passwdp); 17847c478bd9Sstevel@tonic-gate return (PAM_SYMBOL_ERR); 17857c478bd9Sstevel@tonic-gate } 17867c478bd9Sstevel@tonic-gate pam_entry->function_ptr = passwdp; 17877c478bd9Sstevel@tonic-gate break; 17887c478bd9Sstevel@tonic-gate default: 17897c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_DEFAULT, 17907c478bd9Sstevel@tonic-gate "load_modules[%d:%s](%p, %s): unsupported type %d", 17917c478bd9Sstevel@tonic-gate pamh->include_depth, pam_trace_cname(pamh), 17927c478bd9Sstevel@tonic-gate (void *)pamh, function_name, type); 17937c478bd9Sstevel@tonic-gate break; 17947c478bd9Sstevel@tonic-gate } 17957c478bd9Sstevel@tonic-gate 17967c478bd9Sstevel@tonic-gate pam_entry = pam_entry->next; 17977c478bd9Sstevel@tonic-gate } /* while */ 17987c478bd9Sstevel@tonic-gate 17997c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_MODULE, "load_modules[%d:%s](%p, %s)=done", 18007c478bd9Sstevel@tonic-gate pamh->include_depth, pam_trace_cname(pamh), (void *)pamh, 18017c478bd9Sstevel@tonic-gate function_name); 18027c478bd9Sstevel@tonic-gate 18037c478bd9Sstevel@tonic-gate return (PAM_SUCCESS); 18047c478bd9Sstevel@tonic-gate } 18057c478bd9Sstevel@tonic-gate 18067c478bd9Sstevel@tonic-gate /* 18077c478bd9Sstevel@tonic-gate * open_module - Open the module first checking for 18087c478bd9Sstevel@tonic-gate * propers modes and ownerships on the file. 18097c478bd9Sstevel@tonic-gate */ 18107c478bd9Sstevel@tonic-gate 18117c478bd9Sstevel@tonic-gate static void * 18127c478bd9Sstevel@tonic-gate open_module(pam_handle_t *pamh, char *module_so) 18137c478bd9Sstevel@tonic-gate { 18147c478bd9Sstevel@tonic-gate struct stat64 stb; 18157c478bd9Sstevel@tonic-gate char *errmsg; 18167c478bd9Sstevel@tonic-gate void *lfd; 18177c478bd9Sstevel@tonic-gate fd_list *module_fds = 0; 18187c478bd9Sstevel@tonic-gate fd_list *trail = 0; 18197c478bd9Sstevel@tonic-gate fd_list *traverse = 0; 18207c478bd9Sstevel@tonic-gate 18217c478bd9Sstevel@tonic-gate /* Check the ownership and file modes */ 18227c478bd9Sstevel@tonic-gate if (stat64(module_so, &stb) < 0) { 18237c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_ERR, 18247c478bd9Sstevel@tonic-gate "open_module[%d:%s]: stat(%s) failed: %s", 18257c478bd9Sstevel@tonic-gate pamh->include_depth, pam_trace_cname(pamh), module_so, 18267c478bd9Sstevel@tonic-gate strerror(errno)); 18277c478bd9Sstevel@tonic-gate return (NULL); 18287c478bd9Sstevel@tonic-gate } 18297c478bd9Sstevel@tonic-gate if (stb.st_uid != (uid_t)0) { 18307c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_ALERT, 18317c478bd9Sstevel@tonic-gate "open_module[%d:%s]: Owner of the module %s is not root", 18327c478bd9Sstevel@tonic-gate pamh->include_depth, pam_trace_cname(pamh), module_so); 18337c478bd9Sstevel@tonic-gate return (NULL); 18347c478bd9Sstevel@tonic-gate } 18357c478bd9Sstevel@tonic-gate if (stb.st_mode & S_IWGRP) { 18367c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_ALERT, 18377c478bd9Sstevel@tonic-gate "open_module[%d:%s]: module %s writable by group", 18387c478bd9Sstevel@tonic-gate pamh->include_depth, pam_trace_cname(pamh), module_so); 18397c478bd9Sstevel@tonic-gate return (NULL); 18407c478bd9Sstevel@tonic-gate } 18417c478bd9Sstevel@tonic-gate if (stb.st_mode & S_IWOTH) { 18427c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_ALERT, 18437c478bd9Sstevel@tonic-gate "open_module[%d:%s]: module %s writable by world", 18447c478bd9Sstevel@tonic-gate pamh->include_depth, pam_trace_cname(pamh), module_so); 18457c478bd9Sstevel@tonic-gate return (NULL); 18467c478bd9Sstevel@tonic-gate } 18477c478bd9Sstevel@tonic-gate 18487c478bd9Sstevel@tonic-gate /* 18497c478bd9Sstevel@tonic-gate * Perform the dlopen() 18507c478bd9Sstevel@tonic-gate */ 18517c478bd9Sstevel@tonic-gate lfd = (void *)dlopen(module_so, RTLD_LAZY); 18527c478bd9Sstevel@tonic-gate 18537c478bd9Sstevel@tonic-gate if (lfd == NULL) { 18547c478bd9Sstevel@tonic-gate errmsg = dlerror(); 18557c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_ERR, "open_module[%d:%s]: %s " 18567c478bd9Sstevel@tonic-gate "failed: %s", pamh->include_depth, pam_trace_cname(pamh), 18577c478bd9Sstevel@tonic-gate module_so, errmsg != NULL ? errmsg : "Unknown error"); 18587c478bd9Sstevel@tonic-gate return (NULL); 18597c478bd9Sstevel@tonic-gate } else { 18607c478bd9Sstevel@tonic-gate /* add this fd to the pam handle */ 18611e08f0b8Sgww if ((module_fds = calloc(1, sizeof (fd_list))) == 0) { 18627c478bd9Sstevel@tonic-gate (void) dlclose(lfd); 18637c478bd9Sstevel@tonic-gate lfd = 0; 18647c478bd9Sstevel@tonic-gate return (NULL); 18657c478bd9Sstevel@tonic-gate } 18667c478bd9Sstevel@tonic-gate module_fds->mh = lfd; 18677c478bd9Sstevel@tonic-gate 18687c478bd9Sstevel@tonic-gate if (pamh->fd == 0) { 18697c478bd9Sstevel@tonic-gate /* adding new head of list */ 18707c478bd9Sstevel@tonic-gate pamh->fd = module_fds; 18717c478bd9Sstevel@tonic-gate } else { 18727c478bd9Sstevel@tonic-gate /* appending to end of list */ 18737c478bd9Sstevel@tonic-gate traverse = pamh->fd; 18747c478bd9Sstevel@tonic-gate while (traverse) { 18757c478bd9Sstevel@tonic-gate trail = traverse; 18767c478bd9Sstevel@tonic-gate traverse = traverse->next; 18777c478bd9Sstevel@tonic-gate } 18787c478bd9Sstevel@tonic-gate trail->next = module_fds; 18797c478bd9Sstevel@tonic-gate } 18807c478bd9Sstevel@tonic-gate } 18817c478bd9Sstevel@tonic-gate 18827c478bd9Sstevel@tonic-gate return (lfd); 18837c478bd9Sstevel@tonic-gate } 18847c478bd9Sstevel@tonic-gate 18857c478bd9Sstevel@tonic-gate /* 18867c478bd9Sstevel@tonic-gate * load_function - call dlsym() to resolve the function address 18877c478bd9Sstevel@tonic-gate */ 18887c478bd9Sstevel@tonic-gate static int 18897c478bd9Sstevel@tonic-gate load_function(void *lfd, char *name, int (**func)()) 18907c478bd9Sstevel@tonic-gate { 18917c478bd9Sstevel@tonic-gate char *errmsg = NULL; 18927c478bd9Sstevel@tonic-gate 18937c478bd9Sstevel@tonic-gate if (lfd == NULL) 18947c478bd9Sstevel@tonic-gate return (PAM_SYMBOL_ERR); 18957c478bd9Sstevel@tonic-gate 18967c478bd9Sstevel@tonic-gate *func = (int (*)())dlsym(lfd, name); 18977c478bd9Sstevel@tonic-gate if (*func == NULL) { 18987c478bd9Sstevel@tonic-gate errmsg = dlerror(); 18997c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_ERR, "dlsym failed %s: error %s", 19007c478bd9Sstevel@tonic-gate name, errmsg != NULL ? errmsg : "Unknown error"); 19017c478bd9Sstevel@tonic-gate return (PAM_SYMBOL_ERR); 19027c478bd9Sstevel@tonic-gate } 19037c478bd9Sstevel@tonic-gate 19047c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_DEFAULT, 19057c478bd9Sstevel@tonic-gate "load_function: successful load of %s", name); 19067c478bd9Sstevel@tonic-gate return (PAM_SUCCESS); 19077c478bd9Sstevel@tonic-gate } 19087c478bd9Sstevel@tonic-gate 19097c478bd9Sstevel@tonic-gate /* 19107c478bd9Sstevel@tonic-gate * Routines to read the pam.conf configuration file 19117c478bd9Sstevel@tonic-gate */ 19127c478bd9Sstevel@tonic-gate 19137c478bd9Sstevel@tonic-gate /* 19147c478bd9Sstevel@tonic-gate * open_pam_conf - open the pam.conf config file 19157c478bd9Sstevel@tonic-gate */ 19167c478bd9Sstevel@tonic-gate 19177c478bd9Sstevel@tonic-gate static int 19187c478bd9Sstevel@tonic-gate open_pam_conf(struct pam_fh **pam_fh, pam_handle_t *pamh, char *config) 19197c478bd9Sstevel@tonic-gate { 19207c478bd9Sstevel@tonic-gate struct stat64 stb; 19217c478bd9Sstevel@tonic-gate int fd; 19227c478bd9Sstevel@tonic-gate 19237c478bd9Sstevel@tonic-gate if ((fd = open(config, O_RDONLY)) == -1) { 19247c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_ALERT, 19257c478bd9Sstevel@tonic-gate "open_pam_conf[%d:%s]: open(%s) failed: %s", 19267c478bd9Sstevel@tonic-gate pamh->include_depth, pam_trace_cname(pamh), config, 19277c478bd9Sstevel@tonic-gate strerror(errno)); 19287c478bd9Sstevel@tonic-gate return (0); 19297c478bd9Sstevel@tonic-gate } 19307c478bd9Sstevel@tonic-gate /* Check the ownership and file modes */ 19317c478bd9Sstevel@tonic-gate if (fstat64(fd, &stb) < 0) { 19327c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_ALERT, 19337c478bd9Sstevel@tonic-gate "open_pam_conf[%d:%s]: stat(%s) failed: %s", 19347c478bd9Sstevel@tonic-gate pamh->include_depth, pam_trace_cname(pamh), config, 19357c478bd9Sstevel@tonic-gate strerror(errno)); 19367c478bd9Sstevel@tonic-gate (void) close(fd); 19377c478bd9Sstevel@tonic-gate return (0); 19387c478bd9Sstevel@tonic-gate } 19397c478bd9Sstevel@tonic-gate if (stb.st_uid != (uid_t)0) { 19407c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_ALERT, 19417c478bd9Sstevel@tonic-gate "open_pam_conf[%d:%s]: Owner of %s is not root", 19427c478bd9Sstevel@tonic-gate pamh->include_depth, pam_trace_cname(pamh), config); 19437c478bd9Sstevel@tonic-gate (void) close(fd); 19447c478bd9Sstevel@tonic-gate return (0); 19457c478bd9Sstevel@tonic-gate } 19467c478bd9Sstevel@tonic-gate if (stb.st_mode & S_IWGRP) { 19477c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_ALERT, 19487c478bd9Sstevel@tonic-gate "open_pam_conf[%d:%s]: %s writable by group", 19497c478bd9Sstevel@tonic-gate pamh->include_depth, pam_trace_cname(pamh), config); 19507c478bd9Sstevel@tonic-gate (void) close(fd); 19517c478bd9Sstevel@tonic-gate return (0); 19527c478bd9Sstevel@tonic-gate } 19537c478bd9Sstevel@tonic-gate if (stb.st_mode & S_IWOTH) { 19547c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_ALERT, 19557c478bd9Sstevel@tonic-gate "open_pam_conf[%d:%s]: %s writable by world", 19567c478bd9Sstevel@tonic-gate pamh->include_depth, pam_trace_cname(pamh), config); 19577c478bd9Sstevel@tonic-gate (void) close(fd); 19587c478bd9Sstevel@tonic-gate return (0); 19597c478bd9Sstevel@tonic-gate } 19607c478bd9Sstevel@tonic-gate if ((*pam_fh = calloc(1, sizeof (struct pam_fh))) == NULL) { 19617c478bd9Sstevel@tonic-gate (void) close(fd); 19627c478bd9Sstevel@tonic-gate return (0); 19637c478bd9Sstevel@tonic-gate } 19647c478bd9Sstevel@tonic-gate (*pam_fh)->fconfig = fd; 19657c478bd9Sstevel@tonic-gate (*pam_fh)->bufsize = (size_t)stb.st_size; 19667c478bd9Sstevel@tonic-gate if (((*pam_fh)->data = mmap(0, (*pam_fh)->bufsize, PROT_READ, 19677c478bd9Sstevel@tonic-gate MAP_PRIVATE, (*pam_fh)->fconfig, 0)) == MAP_FAILED) { 19687c478bd9Sstevel@tonic-gate (void) close(fd); 19697c478bd9Sstevel@tonic-gate free (*pam_fh); 19707c478bd9Sstevel@tonic-gate return (0); 19717c478bd9Sstevel@tonic-gate } 19727c478bd9Sstevel@tonic-gate (*pam_fh)->bufferp = (*pam_fh)->data; 19737c478bd9Sstevel@tonic-gate 19747c478bd9Sstevel@tonic-gate return (1); 19757c478bd9Sstevel@tonic-gate } 19767c478bd9Sstevel@tonic-gate 19777c478bd9Sstevel@tonic-gate /* 19787c478bd9Sstevel@tonic-gate * close_pam_conf - close pam.conf 19797c478bd9Sstevel@tonic-gate */ 19807c478bd9Sstevel@tonic-gate 19817c478bd9Sstevel@tonic-gate static void 19827c478bd9Sstevel@tonic-gate close_pam_conf(struct pam_fh *pam_fh) 19837c478bd9Sstevel@tonic-gate { 19847c478bd9Sstevel@tonic-gate (void) munmap(pam_fh->data, pam_fh->bufsize); 19857c478bd9Sstevel@tonic-gate (void) close(pam_fh->fconfig); 19867c478bd9Sstevel@tonic-gate free(pam_fh); 19877c478bd9Sstevel@tonic-gate } 19887c478bd9Sstevel@tonic-gate 19897c478bd9Sstevel@tonic-gate /* 19907c478bd9Sstevel@tonic-gate * read_pam_conf - read in each entry in pam.conf and store info 19917c478bd9Sstevel@tonic-gate * under the pam handle. 19927c478bd9Sstevel@tonic-gate */ 19937c478bd9Sstevel@tonic-gate 19947c478bd9Sstevel@tonic-gate static int 19957c478bd9Sstevel@tonic-gate read_pam_conf(pam_handle_t *pamh, char *config) 19967c478bd9Sstevel@tonic-gate { 19977c478bd9Sstevel@tonic-gate struct pam_fh *pam_fh; 19987c478bd9Sstevel@tonic-gate pamtab_t *pamentp; 19997c478bd9Sstevel@tonic-gate pamtab_t *tpament; 20007c478bd9Sstevel@tonic-gate char *service; 20017c478bd9Sstevel@tonic-gate int error; 20027c478bd9Sstevel@tonic-gate int i = pamh->include_depth; /* include depth */ 20037c478bd9Sstevel@tonic-gate /* 20047c478bd9Sstevel@tonic-gate * service types: 20057c478bd9Sstevel@tonic-gate * error (-1), "auth" (0), "account" (1), "session" (2), "password" (3) 20067c478bd9Sstevel@tonic-gate */ 20077c478bd9Sstevel@tonic-gate int service_found[PAM_NUM_MODULE_TYPES+1] = {0, 0, 0, 0, 0}; 20087c478bd9Sstevel@tonic-gate 20097c478bd9Sstevel@tonic-gate (void) pam_get_item(pamh, PAM_SERVICE, (void **)&service); 20107c478bd9Sstevel@tonic-gate if (service == NULL || *service == '\0') { 20117c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_ERR, "No service name"); 20127c478bd9Sstevel@tonic-gate return (PAM_SYSTEM_ERR); 20137c478bd9Sstevel@tonic-gate } 20147c478bd9Sstevel@tonic-gate 20157c478bd9Sstevel@tonic-gate pamh->pam_conf_name[i] = strdup(config); 20167c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_CONF, "read_pam_conf[%d:%s](%p) open(%s)", 20177c478bd9Sstevel@tonic-gate i, pam_trace_cname(pamh), (void *)pamh, config); 20184ef27277Sgww if (open_pam_conf(&pam_fh, pamh, config) == 0) { 20197c478bd9Sstevel@tonic-gate return (PAM_SYSTEM_ERR); 20204ef27277Sgww } 20217c478bd9Sstevel@tonic-gate 20227c478bd9Sstevel@tonic-gate while ((error = 20237c478bd9Sstevel@tonic-gate get_pam_conf_entry(pam_fh, pamh, &pamentp)) == PAM_SUCCESS && 20247c478bd9Sstevel@tonic-gate pamentp) { 20257c478bd9Sstevel@tonic-gate 20267c478bd9Sstevel@tonic-gate /* See if entry is this service and valid */ 20277c478bd9Sstevel@tonic-gate if (verify_pam_conf(pamentp, service)) { 20287c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_CONF, 20297c478bd9Sstevel@tonic-gate "read_pam_conf[%d:%s](%p): bad entry error %s", 20307c478bd9Sstevel@tonic-gate i, pam_trace_cname(pamh), (void *)pamh, service); 20317c478bd9Sstevel@tonic-gate 20327c478bd9Sstevel@tonic-gate error = PAM_SYSTEM_ERR; 20337c478bd9Sstevel@tonic-gate free_pamconf(pamentp); 20347c478bd9Sstevel@tonic-gate goto out; 20357c478bd9Sstevel@tonic-gate } 20367c478bd9Sstevel@tonic-gate if (strcasecmp(pamentp->pam_service, service) == 0) { 20377c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_CONF, 20387c478bd9Sstevel@tonic-gate "read_pam_conf[%d:%s](%p): processing %s", 20397c478bd9Sstevel@tonic-gate i, pam_trace_cname(pamh), (void *)pamh, service); 20407c478bd9Sstevel@tonic-gate /* process first service entry */ 20417c478bd9Sstevel@tonic-gate if (service_found[pamentp->pam_type + 1] == 0) { 20427c478bd9Sstevel@tonic-gate /* purge "other" entries */ 20437c478bd9Sstevel@tonic-gate while ((tpament = pamh->pam_conf_info[i] 20447c478bd9Sstevel@tonic-gate [pamentp->pam_type]) != NULL) { 20457c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_CONF, 20467c478bd9Sstevel@tonic-gate "read_pam_conf(%p): purging " 20477c478bd9Sstevel@tonic-gate "\"other\"[%d:%s][%s]", 20487c478bd9Sstevel@tonic-gate (void *)pamh, i, 20497c478bd9Sstevel@tonic-gate pam_trace_cname(pamh), 20507c478bd9Sstevel@tonic-gate pam_snames[pamentp->pam_type]); 20517c478bd9Sstevel@tonic-gate pamh->pam_conf_info[i] 20527c478bd9Sstevel@tonic-gate [pamentp->pam_type] = tpament->next; 20537c478bd9Sstevel@tonic-gate free_pamconf(tpament); 20547c478bd9Sstevel@tonic-gate } 20557c478bd9Sstevel@tonic-gate /* add first service entry */ 20567c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_CONF, 20577c478bd9Sstevel@tonic-gate "read_pam_conf(%p): adding 1st " 20587c478bd9Sstevel@tonic-gate "%s[%d:%s][%s]", 20597c478bd9Sstevel@tonic-gate (void *)pamh, service, i, 20607c478bd9Sstevel@tonic-gate pam_trace_cname(pamh), 20617c478bd9Sstevel@tonic-gate pam_snames[pamentp->pam_type]); 20627c478bd9Sstevel@tonic-gate pamh->pam_conf_info[i][pamentp->pam_type] = 20637c478bd9Sstevel@tonic-gate pamentp; 20647c478bd9Sstevel@tonic-gate service_found[pamentp->pam_type + 1] = 1; 20657c478bd9Sstevel@tonic-gate } else { 20667c478bd9Sstevel@tonic-gate /* append more service entries */ 20677c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_CONF, 20687c478bd9Sstevel@tonic-gate "read_pam_conf(%p): adding more " 20697c478bd9Sstevel@tonic-gate "%s[%d:%s][%s]", 20707c478bd9Sstevel@tonic-gate (void *)pamh, service, i, 20717c478bd9Sstevel@tonic-gate pam_trace_cname(pamh), 20727c478bd9Sstevel@tonic-gate pam_snames[pamentp->pam_type]); 20737c478bd9Sstevel@tonic-gate tpament = 20747c478bd9Sstevel@tonic-gate pamh->pam_conf_info[i][pamentp->pam_type]; 20757c478bd9Sstevel@tonic-gate while (tpament->next != NULL) { 20767c478bd9Sstevel@tonic-gate tpament = tpament->next; 20777c478bd9Sstevel@tonic-gate } 20787c478bd9Sstevel@tonic-gate tpament->next = pamentp; 20797c478bd9Sstevel@tonic-gate } 20807c478bd9Sstevel@tonic-gate } else if (service_found[pamentp->pam_type + 1] == 0) { 20817c478bd9Sstevel@tonic-gate /* See if "other" entry available and valid */ 20827c478bd9Sstevel@tonic-gate if (verify_pam_conf(pamentp, "other")) { 20837c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_CONF, 20847c478bd9Sstevel@tonic-gate "read_pam_conf(%p): bad entry error %s " 20857c478bd9Sstevel@tonic-gate "\"other\"[%d:%s]", 20867c478bd9Sstevel@tonic-gate (void *)pamh, service, i, 20877c478bd9Sstevel@tonic-gate pam_trace_cname(pamh)); 20887c478bd9Sstevel@tonic-gate error = PAM_SYSTEM_ERR; 20897c478bd9Sstevel@tonic-gate free_pamconf(pamentp); 20907c478bd9Sstevel@tonic-gate goto out; 20917c478bd9Sstevel@tonic-gate } 20927c478bd9Sstevel@tonic-gate if (strcasecmp(pamentp->pam_service, "other") == 0) { 20937c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_CONF, 20947c478bd9Sstevel@tonic-gate "read_pam_conf(%p): processing " 20957c478bd9Sstevel@tonic-gate "\"other\"[%d:%s]", (void *)pamh, i, 20967c478bd9Sstevel@tonic-gate pam_trace_cname(pamh)); 20977c478bd9Sstevel@tonic-gate if ((tpament = pamh->pam_conf_info[i] 20987c478bd9Sstevel@tonic-gate [pamentp->pam_type]) == NULL) { 20997c478bd9Sstevel@tonic-gate /* add first "other" entry */ 21007c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_CONF, 21017c478bd9Sstevel@tonic-gate "read_pam_conf(%p): adding 1st " 21027c478bd9Sstevel@tonic-gate "other[%d:%s][%s]", (void *)pamh, i, 21037c478bd9Sstevel@tonic-gate pam_trace_cname(pamh), 21047c478bd9Sstevel@tonic-gate pam_snames[pamentp->pam_type]); 21057c478bd9Sstevel@tonic-gate pamh->pam_conf_info[i] 21067c478bd9Sstevel@tonic-gate [pamentp->pam_type] = pamentp; 21077c478bd9Sstevel@tonic-gate } else { 21087c478bd9Sstevel@tonic-gate /* append more "other" entries */ 21097c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_CONF, 21107c478bd9Sstevel@tonic-gate "read_pam_conf(%p): adding more " 21117c478bd9Sstevel@tonic-gate "other[%d:%s][%s]", (void *)pamh, i, 21127c478bd9Sstevel@tonic-gate pam_trace_cname(pamh), 21137c478bd9Sstevel@tonic-gate pam_snames[pamentp->pam_type]); 21147c478bd9Sstevel@tonic-gate while (tpament->next != NULL) { 21157c478bd9Sstevel@tonic-gate tpament = tpament->next; 21167c478bd9Sstevel@tonic-gate } 21177c478bd9Sstevel@tonic-gate tpament->next = pamentp; 21187c478bd9Sstevel@tonic-gate } 21197c478bd9Sstevel@tonic-gate } else { 212063360950Smp /* irrelevant entry */ 21217c478bd9Sstevel@tonic-gate free_pamconf(pamentp); 21227c478bd9Sstevel@tonic-gate } 21237c478bd9Sstevel@tonic-gate } else { 212463360950Smp /* irrelevant entry */ 21257c478bd9Sstevel@tonic-gate free_pamconf(pamentp); 21267c478bd9Sstevel@tonic-gate } 21277c478bd9Sstevel@tonic-gate } 21287c478bd9Sstevel@tonic-gate out: 21297c478bd9Sstevel@tonic-gate (void) close_pam_conf(pam_fh); 21307c478bd9Sstevel@tonic-gate if (error != PAM_SUCCESS) 21317c478bd9Sstevel@tonic-gate free_pam_conf_info(pamh); 21327c478bd9Sstevel@tonic-gate return (error); 21337c478bd9Sstevel@tonic-gate } 21347c478bd9Sstevel@tonic-gate 21357c478bd9Sstevel@tonic-gate /* 21367c478bd9Sstevel@tonic-gate * get_pam_conf_entry - get a pam.conf entry 21377c478bd9Sstevel@tonic-gate */ 21387c478bd9Sstevel@tonic-gate 21397c478bd9Sstevel@tonic-gate static int 21407c478bd9Sstevel@tonic-gate get_pam_conf_entry(struct pam_fh *pam_fh, pam_handle_t *pamh, pamtab_t **pam) 21417c478bd9Sstevel@tonic-gate { 21427c478bd9Sstevel@tonic-gate char *cp, *arg; 21437c478bd9Sstevel@tonic-gate int argc; 21447c478bd9Sstevel@tonic-gate char *tmp, *tmp_free; 21457c478bd9Sstevel@tonic-gate int i; 21467c478bd9Sstevel@tonic-gate char *current_line = NULL; 21477c478bd9Sstevel@tonic-gate int error = PAM_SYSTEM_ERR; /* preset to error */ 21484ef27277Sgww int err; 21497c478bd9Sstevel@tonic-gate 21507c478bd9Sstevel@tonic-gate /* get the next line from pam.conf */ 21514ef27277Sgww if ((cp = nextline(pam_fh, pamh, &err)) == NULL) { 21527c478bd9Sstevel@tonic-gate /* no more lines in pam.conf ==> return */ 21537c478bd9Sstevel@tonic-gate error = PAM_SUCCESS; 21547c478bd9Sstevel@tonic-gate *pam = NULL; 21557c478bd9Sstevel@tonic-gate goto out; 21567c478bd9Sstevel@tonic-gate } 21577c478bd9Sstevel@tonic-gate 21581e08f0b8Sgww if ((*pam = calloc(1, sizeof (pamtab_t))) == NULL) { 21597c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_ERR, "strdup: out of memory"); 21607c478bd9Sstevel@tonic-gate goto out; 21617c478bd9Sstevel@tonic-gate } 21627c478bd9Sstevel@tonic-gate 21637c478bd9Sstevel@tonic-gate /* copy full line for error reporting */ 21647c478bd9Sstevel@tonic-gate if ((current_line = strdup(cp)) == NULL) { 21657c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_ERR, "strdup: out of memory"); 21667c478bd9Sstevel@tonic-gate goto out; 21677c478bd9Sstevel@tonic-gate } 21687c478bd9Sstevel@tonic-gate 21697c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_CONF, 21707c478bd9Sstevel@tonic-gate "pam.conf[%s] entry:\t%s", pam_trace_cname(pamh), current_line); 21717c478bd9Sstevel@tonic-gate 21727c478bd9Sstevel@tonic-gate /* get service name (e.g. login, su, passwd) */ 21737c478bd9Sstevel@tonic-gate if ((arg = read_next_token(&cp)) == 0) { 21747c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_CRIT, 21757c478bd9Sstevel@tonic-gate "illegal pam.conf[%s] entry: %s: missing SERVICE NAME", 21767c478bd9Sstevel@tonic-gate pam_trace_cname(pamh), current_line); 21777c478bd9Sstevel@tonic-gate goto out; 21787c478bd9Sstevel@tonic-gate } 21797c478bd9Sstevel@tonic-gate if (((*pam)->pam_service = strdup(arg)) == 0) { 21807c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_ERR, "strdup: out of memory"); 21817c478bd9Sstevel@tonic-gate goto out; 21827c478bd9Sstevel@tonic-gate } 21837c478bd9Sstevel@tonic-gate 21847c478bd9Sstevel@tonic-gate /* get module type (e.g. authentication, acct mgmt) */ 21857c478bd9Sstevel@tonic-gate if ((arg = read_next_token(&cp)) == 0) { 21867c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_CRIT, 21877c478bd9Sstevel@tonic-gate "illegal pam.conf[%s] entry: %s: missing MODULE TYPE", 21887c478bd9Sstevel@tonic-gate pam_trace_cname(pamh), current_line); 21897c478bd9Sstevel@tonic-gate (*pam)->pam_type = -1; /* 0 is a valid value */ 21907c478bd9Sstevel@tonic-gate goto getflag; 21917c478bd9Sstevel@tonic-gate } 21927c478bd9Sstevel@tonic-gate if (strcasecmp(arg, PAM_AUTH_NAME) == 0) { 21937c478bd9Sstevel@tonic-gate (*pam)->pam_type = PAM_AUTH_MODULE; 21947c478bd9Sstevel@tonic-gate } else if (strcasecmp(arg, PAM_ACCOUNT_NAME) == 0) { 21957c478bd9Sstevel@tonic-gate (*pam)->pam_type = PAM_ACCOUNT_MODULE; 21967c478bd9Sstevel@tonic-gate } else if (strcasecmp(arg, PAM_SESSION_NAME) == 0) { 21977c478bd9Sstevel@tonic-gate (*pam)->pam_type = PAM_SESSION_MODULE; 21987c478bd9Sstevel@tonic-gate } else if (strcasecmp(arg, PAM_PASSWORD_NAME) == 0) { 21997c478bd9Sstevel@tonic-gate (*pam)->pam_type = PAM_PASSWORD_MODULE; 22007c478bd9Sstevel@tonic-gate } else { 22017c478bd9Sstevel@tonic-gate /* error */ 22027c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_CRIT, 22037c478bd9Sstevel@tonic-gate "illegal pam.conf[%s] entry: %s: invalid module " 22047c478bd9Sstevel@tonic-gate "type: %s", pam_trace_cname(pamh), current_line, arg); 22057c478bd9Sstevel@tonic-gate (*pam)->pam_type = -1; /* 0 is a valid value */ 22067c478bd9Sstevel@tonic-gate } 22077c478bd9Sstevel@tonic-gate 22087c478bd9Sstevel@tonic-gate getflag: 22097c478bd9Sstevel@tonic-gate /* get pam flag (e.g., requisite, required, sufficient, optional) */ 22107c478bd9Sstevel@tonic-gate if ((arg = read_next_token(&cp)) == 0) { 22117c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_CRIT, 22127c478bd9Sstevel@tonic-gate "illegal pam.conf[%s] entry: %s: missing CONTROL FLAG", 22137c478bd9Sstevel@tonic-gate pam_trace_cname(pamh), current_line); 22147c478bd9Sstevel@tonic-gate goto getpath; 22157c478bd9Sstevel@tonic-gate } 22167c478bd9Sstevel@tonic-gate if (strcasecmp(arg, PAM_BINDING_NAME) == 0) { 22177c478bd9Sstevel@tonic-gate (*pam)->pam_flag = PAM_BINDING; 22187c478bd9Sstevel@tonic-gate } else if (strcasecmp(arg, PAM_INCLUDE_NAME) == 0) { 22197c478bd9Sstevel@tonic-gate (*pam)->pam_flag = PAM_INCLUDE; 22207c478bd9Sstevel@tonic-gate } else if (strcasecmp(arg, PAM_OPTIONAL_NAME) == 0) { 22217c478bd9Sstevel@tonic-gate (*pam)->pam_flag = PAM_OPTIONAL; 22227c478bd9Sstevel@tonic-gate } else if (strcasecmp(arg, PAM_REQUIRED_NAME) == 0) { 22237c478bd9Sstevel@tonic-gate (*pam)->pam_flag = PAM_REQUIRED; 22247c478bd9Sstevel@tonic-gate } else if (strcasecmp(arg, PAM_REQUISITE_NAME) == 0) { 22257c478bd9Sstevel@tonic-gate (*pam)->pam_flag = PAM_REQUISITE; 22267c478bd9Sstevel@tonic-gate } else if (strcasecmp(arg, PAM_SUFFICIENT_NAME) == 0) { 22277c478bd9Sstevel@tonic-gate (*pam)->pam_flag = PAM_SUFFICIENT; 22287c478bd9Sstevel@tonic-gate } else { 22297c478bd9Sstevel@tonic-gate /* error */ 22307c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_CRIT, 22317c478bd9Sstevel@tonic-gate "illegal pam.conf[%s] entry: %s", 22327c478bd9Sstevel@tonic-gate pam_trace_cname(pamh), current_line); 22337c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_CRIT, 22347c478bd9Sstevel@tonic-gate "\tinvalid control flag: %s", arg); 22357c478bd9Sstevel@tonic-gate } 22367c478bd9Sstevel@tonic-gate 22377c478bd9Sstevel@tonic-gate getpath: 22387c478bd9Sstevel@tonic-gate /* get module path (e.g. /usr/lib/security/pam_unix_auth.so.1) */ 22397c478bd9Sstevel@tonic-gate if ((arg = read_next_token(&cp)) == 0) { 22407c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_CRIT, 22417c478bd9Sstevel@tonic-gate "illegal pam.conf[%s] entry: %s: missing MODULE PATH", 22427c478bd9Sstevel@tonic-gate pam_trace_cname(pamh), current_line); 22437c478bd9Sstevel@tonic-gate error = PAM_SUCCESS; /* success */ 22447c478bd9Sstevel@tonic-gate goto out; 22457c478bd9Sstevel@tonic-gate } 22467c478bd9Sstevel@tonic-gate if (arg[0] != '/') { 22477c478bd9Sstevel@tonic-gate size_t len; 22487c478bd9Sstevel@tonic-gate /* 22497c478bd9Sstevel@tonic-gate * If module path does not start with "/", then 22507c478bd9Sstevel@tonic-gate * prepend PAM_LIB_DIR (/usr/lib/security/). 22517c478bd9Sstevel@tonic-gate */ 22527c478bd9Sstevel@tonic-gate /* sizeof (PAM_LIB_DIR) has room for '\0' */ 22537c478bd9Sstevel@tonic-gate len = sizeof (PAM_LIB_DIR) + sizeof (PAM_ISA_DIR) + strlen(arg); 22547c478bd9Sstevel@tonic-gate if (((*pam)->module_path = malloc(len)) == NULL) { 22557c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_ERR, "strdup: out of memory"); 22567c478bd9Sstevel@tonic-gate goto out; 22577c478bd9Sstevel@tonic-gate } 22587c478bd9Sstevel@tonic-gate if ((*pam)->pam_flag & PAM_INCLUDE) { 22597c478bd9Sstevel@tonic-gate (void) snprintf((*pam)->module_path, len, "%s%s", 22607c478bd9Sstevel@tonic-gate PAM_LIB_DIR, arg); 22617c478bd9Sstevel@tonic-gate } else { 22627c478bd9Sstevel@tonic-gate (void) snprintf((*pam)->module_path, len, "%s%s%s", 22637c478bd9Sstevel@tonic-gate PAM_LIB_DIR, PAM_ISA_DIR, arg); 22647c478bd9Sstevel@tonic-gate } 22657c478bd9Sstevel@tonic-gate } else { 22667c478bd9Sstevel@tonic-gate /* Full path provided for module */ 22677c478bd9Sstevel@tonic-gate char *isa; 22687c478bd9Sstevel@tonic-gate 22697c478bd9Sstevel@tonic-gate /* Check for Instruction Set Architecture indicator */ 22707c478bd9Sstevel@tonic-gate if ((isa = strstr(arg, PAM_ISA)) != NULL) { 22717c478bd9Sstevel@tonic-gate size_t len; 22727c478bd9Sstevel@tonic-gate len = strlen(arg) - (sizeof (PAM_ISA)-1) + 22737c478bd9Sstevel@tonic-gate sizeof (PAM_ISA_DIR); 22747c478bd9Sstevel@tonic-gate 22757c478bd9Sstevel@tonic-gate /* substitute the architecture dependent path */ 22767c478bd9Sstevel@tonic-gate if (((*pam)->module_path = malloc(len)) == NULL) { 22777c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_ERR, 22787c478bd9Sstevel@tonic-gate "strdup: out of memory"); 22797c478bd9Sstevel@tonic-gate goto out; 22807c478bd9Sstevel@tonic-gate } 22817c478bd9Sstevel@tonic-gate *isa = '\000'; 22827c478bd9Sstevel@tonic-gate isa += strlen(PAM_ISA); 22837c478bd9Sstevel@tonic-gate (void) snprintf((*pam)->module_path, len, "%s%s%s", 22847c478bd9Sstevel@tonic-gate arg, PAM_ISA_DIR, isa); 22857c478bd9Sstevel@tonic-gate } else if (((*pam)->module_path = strdup(arg)) == 0) { 22867c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_ERR, "strdup: out of memory"); 22877c478bd9Sstevel@tonic-gate goto out; 22887c478bd9Sstevel@tonic-gate } 22897c478bd9Sstevel@tonic-gate } 22907c478bd9Sstevel@tonic-gate 22917c478bd9Sstevel@tonic-gate /* count the number of module-specific options first */ 22927c478bd9Sstevel@tonic-gate argc = 0; 22937c478bd9Sstevel@tonic-gate if ((tmp = strdup(cp)) == NULL) { 22947c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_ERR, "strdup: out of memory"); 22957c478bd9Sstevel@tonic-gate goto out; 22967c478bd9Sstevel@tonic-gate } 22977c478bd9Sstevel@tonic-gate tmp_free = tmp; 22987c478bd9Sstevel@tonic-gate for (arg = read_next_token(&tmp); arg; arg = read_next_token(&tmp)) 22997c478bd9Sstevel@tonic-gate argc++; 23007c478bd9Sstevel@tonic-gate free(tmp_free); 23017c478bd9Sstevel@tonic-gate 23027c478bd9Sstevel@tonic-gate /* allocate array for the module-specific options */ 23037c478bd9Sstevel@tonic-gate if (argc > 0) { 23041e08f0b8Sgww if (((*pam)->module_argv = 23051e08f0b8Sgww calloc(argc+1, sizeof (char *))) == 0) { 23067c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_ERR, "calloc: out of memory"); 23077c478bd9Sstevel@tonic-gate goto out; 23087c478bd9Sstevel@tonic-gate } 23097c478bd9Sstevel@tonic-gate i = 0; 23107c478bd9Sstevel@tonic-gate for (arg = read_next_token(&cp); arg; 23111e08f0b8Sgww arg = read_next_token(&cp)) { 23127c478bd9Sstevel@tonic-gate (*pam)->module_argv[i] = strdup(arg); 23137c478bd9Sstevel@tonic-gate if ((*pam)->module_argv[i] == NULL) { 23147c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_ERR, "strdup failed"); 23157c478bd9Sstevel@tonic-gate goto out; 23167c478bd9Sstevel@tonic-gate } 23177c478bd9Sstevel@tonic-gate i++; 23187c478bd9Sstevel@tonic-gate } 23197c478bd9Sstevel@tonic-gate (*pam)->module_argv[argc] = NULL; 23207c478bd9Sstevel@tonic-gate } 23217c478bd9Sstevel@tonic-gate (*pam)->module_argc = argc; 23227c478bd9Sstevel@tonic-gate 23237c478bd9Sstevel@tonic-gate error = PAM_SUCCESS; /* success */ 23244ef27277Sgww (*pam)->pam_err = err; /* was the line truncated */ 23257c478bd9Sstevel@tonic-gate 23267c478bd9Sstevel@tonic-gate out: 23277c478bd9Sstevel@tonic-gate if (current_line) 23287c478bd9Sstevel@tonic-gate free(current_line); 23297c478bd9Sstevel@tonic-gate if (error != PAM_SUCCESS) { 23307c478bd9Sstevel@tonic-gate /* on error free this */ 23317c478bd9Sstevel@tonic-gate if (*pam) 23327c478bd9Sstevel@tonic-gate free_pamconf(*pam); 23337c478bd9Sstevel@tonic-gate } 23347c478bd9Sstevel@tonic-gate return (error); 23357c478bd9Sstevel@tonic-gate } 23367c478bd9Sstevel@tonic-gate 23377c478bd9Sstevel@tonic-gate 23387c478bd9Sstevel@tonic-gate /* 23397c478bd9Sstevel@tonic-gate * read_next_token - skip tab and space characters and return the next token 23407c478bd9Sstevel@tonic-gate */ 23417c478bd9Sstevel@tonic-gate 23427c478bd9Sstevel@tonic-gate static char * 23437c478bd9Sstevel@tonic-gate read_next_token(char **cpp) 23447c478bd9Sstevel@tonic-gate { 23457c478bd9Sstevel@tonic-gate register char *cp = *cpp; 23467c478bd9Sstevel@tonic-gate char *start; 23477c478bd9Sstevel@tonic-gate 23487c478bd9Sstevel@tonic-gate if (cp == (char *)0) { 23497c478bd9Sstevel@tonic-gate *cpp = (char *)0; 23507c478bd9Sstevel@tonic-gate return ((char *)0); 23517c478bd9Sstevel@tonic-gate } 23527c478bd9Sstevel@tonic-gate while (*cp == ' ' || *cp == '\t') 23537c478bd9Sstevel@tonic-gate cp++; 23547c478bd9Sstevel@tonic-gate if (*cp == '\0') { 23557c478bd9Sstevel@tonic-gate *cpp = (char *)0; 23567c478bd9Sstevel@tonic-gate return ((char *)0); 23577c478bd9Sstevel@tonic-gate } 23587c478bd9Sstevel@tonic-gate start = cp; 23597c478bd9Sstevel@tonic-gate while (*cp && *cp != ' ' && *cp != '\t') 23607c478bd9Sstevel@tonic-gate cp++; 23617c478bd9Sstevel@tonic-gate if (*cp != '\0') 23627c478bd9Sstevel@tonic-gate *cp++ = '\0'; 23637c478bd9Sstevel@tonic-gate *cpp = cp; 23647c478bd9Sstevel@tonic-gate return (start); 23657c478bd9Sstevel@tonic-gate } 23667c478bd9Sstevel@tonic-gate 23677c478bd9Sstevel@tonic-gate static char * 23687c478bd9Sstevel@tonic-gate pam_conf_strnchr(char *sp, int c, intptr_t count) 23697c478bd9Sstevel@tonic-gate { 23707c478bd9Sstevel@tonic-gate while (count) { 23717c478bd9Sstevel@tonic-gate if (*sp == (char)c) 23727c478bd9Sstevel@tonic-gate return ((char *)sp); 23737c478bd9Sstevel@tonic-gate else { 23747c478bd9Sstevel@tonic-gate sp++; 23757c478bd9Sstevel@tonic-gate count--; 23767c478bd9Sstevel@tonic-gate } 23777c478bd9Sstevel@tonic-gate }; 23787c478bd9Sstevel@tonic-gate return (NULL); 23797c478bd9Sstevel@tonic-gate } 23807c478bd9Sstevel@tonic-gate 23817c478bd9Sstevel@tonic-gate /* 23827c478bd9Sstevel@tonic-gate * nextline - skip all blank lines and comments 23837c478bd9Sstevel@tonic-gate */ 23847c478bd9Sstevel@tonic-gate 23857c478bd9Sstevel@tonic-gate static char * 23864ef27277Sgww nextline(struct pam_fh *pam_fh, pam_handle_t *pamh, int *err) 23877c478bd9Sstevel@tonic-gate { 23887c478bd9Sstevel@tonic-gate char *ll; 23897c478bd9Sstevel@tonic-gate int find_a_line = 0; 23907c478bd9Sstevel@tonic-gate char *data = pam_fh->data; 23917c478bd9Sstevel@tonic-gate char *bufferp = pam_fh->bufferp; 23927c478bd9Sstevel@tonic-gate char *bufferendp = &data[pam_fh->bufsize]; 23934ef27277Sgww size_t input_len; 23947c478bd9Sstevel@tonic-gate 23957c478bd9Sstevel@tonic-gate /* 23967c478bd9Sstevel@tonic-gate * Skip the blank line, comment line 23977c478bd9Sstevel@tonic-gate */ 23987c478bd9Sstevel@tonic-gate while (!find_a_line) { 23997c478bd9Sstevel@tonic-gate /* if we are at the end of the buffer, there is no next line */ 24007c478bd9Sstevel@tonic-gate if (bufferp == bufferendp) 24017c478bd9Sstevel@tonic-gate return (NULL); 24027c478bd9Sstevel@tonic-gate 24037c478bd9Sstevel@tonic-gate /* skip blank line */ 24047c478bd9Sstevel@tonic-gate while (*bufferp == '\n') { 24057c478bd9Sstevel@tonic-gate /* 24067c478bd9Sstevel@tonic-gate * If we are at the end of the buffer, there is 24077c478bd9Sstevel@tonic-gate * no next line. 24087c478bd9Sstevel@tonic-gate */ 24094ef27277Sgww if (++bufferp == bufferendp) { 24107c478bd9Sstevel@tonic-gate return (NULL); 24114ef27277Sgww } 24127c478bd9Sstevel@tonic-gate /* else we check *bufferp again */ 24137c478bd9Sstevel@tonic-gate } 24147c478bd9Sstevel@tonic-gate 24157c478bd9Sstevel@tonic-gate /* skip comment line */ 24167c478bd9Sstevel@tonic-gate while (*bufferp == '#') { 24177c478bd9Sstevel@tonic-gate if ((ll = pam_conf_strnchr(bufferp, '\n', 24181e08f0b8Sgww bufferendp - bufferp)) != NULL) { 24197c478bd9Sstevel@tonic-gate bufferp = ll; 24204ef27277Sgww } else { 24214ef27277Sgww /* 24224ef27277Sgww * this comment line the last line. 24234ef27277Sgww * no next line 24244ef27277Sgww */ 24257c478bd9Sstevel@tonic-gate return (NULL); 24264ef27277Sgww } 24277c478bd9Sstevel@tonic-gate 24287c478bd9Sstevel@tonic-gate /* 24297c478bd9Sstevel@tonic-gate * If we are at the end of the buffer, there is 24307c478bd9Sstevel@tonic-gate * no next line. 24317c478bd9Sstevel@tonic-gate */ 24324ef27277Sgww if (bufferp == bufferendp) { 24337c478bd9Sstevel@tonic-gate return (NULL); 24344ef27277Sgww } 24357c478bd9Sstevel@tonic-gate } 24367c478bd9Sstevel@tonic-gate 24374ef27277Sgww if ((*bufferp != '\n') && (*bufferp != '#')) { 24387c478bd9Sstevel@tonic-gate find_a_line = 1; 24394ef27277Sgww } 24407c478bd9Sstevel@tonic-gate } 24417c478bd9Sstevel@tonic-gate 24424ef27277Sgww *err = PAM_SUCCESS; 24437c478bd9Sstevel@tonic-gate /* now we find one line */ 24447c478bd9Sstevel@tonic-gate if ((ll = pam_conf_strnchr(bufferp, '\n', bufferendp - bufferp)) 24454ef27277Sgww != NULL) { 24464ef27277Sgww if ((input_len = ll - bufferp) >= sizeof (pam_fh->line)) { 24474ef27277Sgww __pam_log(LOG_AUTH | LOG_ERR, 24484ef27277Sgww "nextline[%d:%s]: pam.conf line too long %.256s", 24494ef27277Sgww pamh->include_depth, pam_trace_cname(pamh), 24504ef27277Sgww bufferp); 24514ef27277Sgww input_len = sizeof (pam_fh->line) - 1; 24524ef27277Sgww *err = PAM_SERVICE_ERR; 24534ef27277Sgww } 24544ef27277Sgww (void) strncpy(pam_fh->line, bufferp, input_len); 24554ef27277Sgww pam_fh->line[input_len] = '\0'; 24567c478bd9Sstevel@tonic-gate pam_fh->bufferp = ll++; 24577c478bd9Sstevel@tonic-gate } else { 24587c478bd9Sstevel@tonic-gate ll = bufferendp; 24594ef27277Sgww if ((input_len = ll - bufferp) >= sizeof (pam_fh->line)) { 24604ef27277Sgww __pam_log(LOG_AUTH | LOG_ERR, 24614ef27277Sgww "nextline[%d:%s]: pam.conf line too long %.256s", 24624ef27277Sgww pamh->include_depth, pam_trace_cname(pamh), 24634ef27277Sgww bufferp); 24644ef27277Sgww input_len = sizeof (pam_fh->line) - 1; 24654ef27277Sgww *err = PAM_SERVICE_ERR; 24664ef27277Sgww } 24674ef27277Sgww (void) strncpy(pam_fh->line, bufferp, input_len); 24684ef27277Sgww pam_fh->line[input_len] = '\0'; 24697c478bd9Sstevel@tonic-gate pam_fh->bufferp = ll; 24707c478bd9Sstevel@tonic-gate } 24717c478bd9Sstevel@tonic-gate 24727c478bd9Sstevel@tonic-gate return (pam_fh->line); 24737c478bd9Sstevel@tonic-gate } 24747c478bd9Sstevel@tonic-gate 24757c478bd9Sstevel@tonic-gate /* 24767c478bd9Sstevel@tonic-gate * verify_pam_conf - verify that the pam_conf entry is filled in. 24777c478bd9Sstevel@tonic-gate * 24784ef27277Sgww * True = Error if there is no service. 24794ef27277Sgww * True = Error if there is a service and it matches the requested service 24804ef27277Sgww * but, the type, flag, line overflow, or path is in error. 24817c478bd9Sstevel@tonic-gate */ 24827c478bd9Sstevel@tonic-gate 24837c478bd9Sstevel@tonic-gate static int 24847c478bd9Sstevel@tonic-gate verify_pam_conf(pamtab_t *pam, char *service) 24857c478bd9Sstevel@tonic-gate { 24867c478bd9Sstevel@tonic-gate return ((pam->pam_service == (char *)NULL) || 24877c478bd9Sstevel@tonic-gate ((strcasecmp(pam->pam_service, service) == 0) && 24887c478bd9Sstevel@tonic-gate ((pam->pam_type == -1) || 24897c478bd9Sstevel@tonic-gate (pam->pam_flag == 0) || 24904ef27277Sgww (pam->pam_err != PAM_SUCCESS) || 24917c478bd9Sstevel@tonic-gate (pam->module_path == (char *)NULL)))); 24927c478bd9Sstevel@tonic-gate } 24937c478bd9Sstevel@tonic-gate 24947c478bd9Sstevel@tonic-gate /* 24957c478bd9Sstevel@tonic-gate * Routines to free allocated storage 24967c478bd9Sstevel@tonic-gate */ 24977c478bd9Sstevel@tonic-gate 24987c478bd9Sstevel@tonic-gate /* 24997c478bd9Sstevel@tonic-gate * clean_up - free allocated storage in the pam handle 25007c478bd9Sstevel@tonic-gate */ 25017c478bd9Sstevel@tonic-gate 25027c478bd9Sstevel@tonic-gate static void 25037c478bd9Sstevel@tonic-gate clean_up(pam_handle_t *pamh) 25047c478bd9Sstevel@tonic-gate { 25057c478bd9Sstevel@tonic-gate int i; 25067c478bd9Sstevel@tonic-gate pam_repository_t *auth_rep; 25077c478bd9Sstevel@tonic-gate 25087c478bd9Sstevel@tonic-gate if (pamh) { 25097c478bd9Sstevel@tonic-gate while (pamh->include_depth >= 0) { 25107c478bd9Sstevel@tonic-gate free_pam_conf_info(pamh); 25117c478bd9Sstevel@tonic-gate pamh->include_depth--; 25127c478bd9Sstevel@tonic-gate } 25137c478bd9Sstevel@tonic-gate 25147c478bd9Sstevel@tonic-gate /* Cleanup PAM_REPOSITORY structure */ 25157c478bd9Sstevel@tonic-gate auth_rep = pamh->ps_item[PAM_REPOSITORY].pi_addr; 25167c478bd9Sstevel@tonic-gate if (auth_rep != NULL) { 25177c478bd9Sstevel@tonic-gate if (auth_rep->type != NULL) 25187c478bd9Sstevel@tonic-gate free(auth_rep->type); 25197c478bd9Sstevel@tonic-gate if (auth_rep->scope != NULL) 25207c478bd9Sstevel@tonic-gate free(auth_rep->scope); 25217c478bd9Sstevel@tonic-gate } 25227c478bd9Sstevel@tonic-gate 25237c478bd9Sstevel@tonic-gate for (i = 0; i < PAM_MAX_ITEMS; i++) { 25247c478bd9Sstevel@tonic-gate if (pamh->ps_item[i].pi_addr != NULL) { 25257c478bd9Sstevel@tonic-gate if (i == PAM_AUTHTOK || i == PAM_OLDAUTHTOK) { 25267c478bd9Sstevel@tonic-gate (void) memset(pamh->ps_item[i].pi_addr, 25277c478bd9Sstevel@tonic-gate 0, pamh->ps_item[i].pi_size); 25287c478bd9Sstevel@tonic-gate } 25297c478bd9Sstevel@tonic-gate free(pamh->ps_item[i].pi_addr); 25307c478bd9Sstevel@tonic-gate } 25317c478bd9Sstevel@tonic-gate } 25327c478bd9Sstevel@tonic-gate free(pamh); 25337c478bd9Sstevel@tonic-gate } 25347c478bd9Sstevel@tonic-gate } 25357c478bd9Sstevel@tonic-gate 25367c478bd9Sstevel@tonic-gate /* 25377c478bd9Sstevel@tonic-gate * free_pamconf - free memory used to store pam.conf entry 25387c478bd9Sstevel@tonic-gate */ 25397c478bd9Sstevel@tonic-gate 25407c478bd9Sstevel@tonic-gate static void 25417c478bd9Sstevel@tonic-gate free_pamconf(pamtab_t *cp) 25427c478bd9Sstevel@tonic-gate { 25437c478bd9Sstevel@tonic-gate int i; 25447c478bd9Sstevel@tonic-gate 25457c478bd9Sstevel@tonic-gate if (cp) { 25467c478bd9Sstevel@tonic-gate if (cp->pam_service) 25477c478bd9Sstevel@tonic-gate free(cp->pam_service); 25487c478bd9Sstevel@tonic-gate if (cp->module_path) 25497c478bd9Sstevel@tonic-gate free(cp->module_path); 25507c478bd9Sstevel@tonic-gate for (i = 0; i < cp->module_argc; i++) { 25517c478bd9Sstevel@tonic-gate if (cp->module_argv[i]) 25527c478bd9Sstevel@tonic-gate free(cp->module_argv[i]); 25537c478bd9Sstevel@tonic-gate } 25547c478bd9Sstevel@tonic-gate if (cp->module_argc > 0) 25557c478bd9Sstevel@tonic-gate free(cp->module_argv); 25567c478bd9Sstevel@tonic-gate if (cp->function_ptr) 25577c478bd9Sstevel@tonic-gate free(cp->function_ptr); 25587c478bd9Sstevel@tonic-gate 25597c478bd9Sstevel@tonic-gate free(cp); 25607c478bd9Sstevel@tonic-gate } 25617c478bd9Sstevel@tonic-gate } 25627c478bd9Sstevel@tonic-gate 25637c478bd9Sstevel@tonic-gate /* 25647c478bd9Sstevel@tonic-gate * free_pam_conf_info - free memory used to store all pam.conf info 25657c478bd9Sstevel@tonic-gate * under the pam handle 25667c478bd9Sstevel@tonic-gate */ 25677c478bd9Sstevel@tonic-gate 25687c478bd9Sstevel@tonic-gate static void 25697c478bd9Sstevel@tonic-gate free_pam_conf_info(pam_handle_t *pamh) 25707c478bd9Sstevel@tonic-gate { 25717c478bd9Sstevel@tonic-gate pamtab_t *pamentp; 25727c478bd9Sstevel@tonic-gate pamtab_t *pament_trail; 25737c478bd9Sstevel@tonic-gate int i = pamh->include_depth; 25747c478bd9Sstevel@tonic-gate int j; 25757c478bd9Sstevel@tonic-gate 25767c478bd9Sstevel@tonic-gate for (j = 0; j < PAM_NUM_MODULE_TYPES; j++) { 25777c478bd9Sstevel@tonic-gate pamentp = pamh->pam_conf_info[i][j]; 25787c478bd9Sstevel@tonic-gate pamh->pam_conf_info[i][j] = NULL; 25797c478bd9Sstevel@tonic-gate pament_trail = pamentp; 25807c478bd9Sstevel@tonic-gate while (pamentp) { 25817c478bd9Sstevel@tonic-gate pamentp = pamentp->next; 25827c478bd9Sstevel@tonic-gate free_pamconf(pament_trail); 25837c478bd9Sstevel@tonic-gate pament_trail = pamentp; 25847c478bd9Sstevel@tonic-gate } 25857c478bd9Sstevel@tonic-gate } 25867c478bd9Sstevel@tonic-gate if (pamh->pam_conf_name[i] != NULL) { 25877c478bd9Sstevel@tonic-gate free(pamh->pam_conf_name[i]); 25887c478bd9Sstevel@tonic-gate pamh->pam_conf_name[i] = NULL; 25897c478bd9Sstevel@tonic-gate } 25907c478bd9Sstevel@tonic-gate } 25917c478bd9Sstevel@tonic-gate 25927c478bd9Sstevel@tonic-gate static void 25937c478bd9Sstevel@tonic-gate free_env(env_list *pam_env) 25947c478bd9Sstevel@tonic-gate { 25957c478bd9Sstevel@tonic-gate if (pam_env) { 25967c478bd9Sstevel@tonic-gate if (pam_env->name) 25977c478bd9Sstevel@tonic-gate free(pam_env->name); 25987c478bd9Sstevel@tonic-gate if (pam_env->value) 25997c478bd9Sstevel@tonic-gate free(pam_env->value); 26007c478bd9Sstevel@tonic-gate free(pam_env); 26017c478bd9Sstevel@tonic-gate } 26027c478bd9Sstevel@tonic-gate } 26037c478bd9Sstevel@tonic-gate 26047c478bd9Sstevel@tonic-gate /* 26057c478bd9Sstevel@tonic-gate * Internal convenience functions for Solaris PAM service modules. 26067c478bd9Sstevel@tonic-gate */ 26077c478bd9Sstevel@tonic-gate 26087c478bd9Sstevel@tonic-gate #include <libintl.h> 26097c478bd9Sstevel@tonic-gate #include <nl_types.h> 26107c478bd9Sstevel@tonic-gate #include <synch.h> 26117c478bd9Sstevel@tonic-gate #include <locale.h> 26127c478bd9Sstevel@tonic-gate #include <thread.h> 26137c478bd9Sstevel@tonic-gate 26147c478bd9Sstevel@tonic-gate typedef struct pam_msg_data { 26157c478bd9Sstevel@tonic-gate nl_catd fd; 26167c478bd9Sstevel@tonic-gate } pam_msg_data_t; 26177c478bd9Sstevel@tonic-gate 26187c478bd9Sstevel@tonic-gate /* 26197c478bd9Sstevel@tonic-gate * free_resp(): 26207c478bd9Sstevel@tonic-gate * free storage for responses used in the call back "pam_conv" functions 26217c478bd9Sstevel@tonic-gate */ 26227c478bd9Sstevel@tonic-gate 26237c478bd9Sstevel@tonic-gate void 26247c478bd9Sstevel@tonic-gate free_resp(int num_msg, struct pam_response *resp) 26257c478bd9Sstevel@tonic-gate { 26267c478bd9Sstevel@tonic-gate int i; 26277c478bd9Sstevel@tonic-gate struct pam_response *r; 26287c478bd9Sstevel@tonic-gate 26297c478bd9Sstevel@tonic-gate if (resp) { 26307c478bd9Sstevel@tonic-gate r = resp; 26317c478bd9Sstevel@tonic-gate for (i = 0; i < num_msg; i++, r++) { 26327c478bd9Sstevel@tonic-gate if (r->resp) { 26337c478bd9Sstevel@tonic-gate /* clear before freeing -- may be a password */ 26347c478bd9Sstevel@tonic-gate bzero(r->resp, strlen(r->resp)); 26357c478bd9Sstevel@tonic-gate free(r->resp); 26367c478bd9Sstevel@tonic-gate r->resp = NULL; 26377c478bd9Sstevel@tonic-gate } 26387c478bd9Sstevel@tonic-gate } 26397c478bd9Sstevel@tonic-gate free(resp); 26407c478bd9Sstevel@tonic-gate } 26417c478bd9Sstevel@tonic-gate } 26427c478bd9Sstevel@tonic-gate 26437c478bd9Sstevel@tonic-gate static int 26447c478bd9Sstevel@tonic-gate do_conv(pam_handle_t *pamh, int msg_style, int num_msg, 26457c478bd9Sstevel@tonic-gate char messages[PAM_MAX_NUM_MSG][PAM_MAX_MSG_SIZE], void *conv_apdp, 26467c478bd9Sstevel@tonic-gate struct pam_response *ret_respp[]) 26477c478bd9Sstevel@tonic-gate { 26487c478bd9Sstevel@tonic-gate struct pam_message *msg; 26497c478bd9Sstevel@tonic-gate struct pam_message *m; 26507c478bd9Sstevel@tonic-gate int i; 26517c478bd9Sstevel@tonic-gate int k; 26527c478bd9Sstevel@tonic-gate int retcode; 26537c478bd9Sstevel@tonic-gate struct pam_conv *pam_convp; 26547c478bd9Sstevel@tonic-gate 26557c478bd9Sstevel@tonic-gate if ((retcode = pam_get_item(pamh, PAM_CONV, 26567c478bd9Sstevel@tonic-gate (void **)&pam_convp)) != PAM_SUCCESS) { 26577c478bd9Sstevel@tonic-gate return (retcode); 26587c478bd9Sstevel@tonic-gate } 26597c478bd9Sstevel@tonic-gate 26607c478bd9Sstevel@tonic-gate /* 26617c478bd9Sstevel@tonic-gate * When pam_set_item() is called to set PAM_CONV and the 26627c478bd9Sstevel@tonic-gate * item is NULL, memset(pip->pi_addr, 0, size) is called. 26637c478bd9Sstevel@tonic-gate * So at this point, we should check whether pam_convp->conv 26647c478bd9Sstevel@tonic-gate * is NULL or not. 26657c478bd9Sstevel@tonic-gate */ 26667c478bd9Sstevel@tonic-gate if ((pam_convp == NULL) || (pam_convp->conv == NULL)) 26677c478bd9Sstevel@tonic-gate return (PAM_SYSTEM_ERR); 26687c478bd9Sstevel@tonic-gate 26697c478bd9Sstevel@tonic-gate i = 0; 26707c478bd9Sstevel@tonic-gate k = num_msg; 26717c478bd9Sstevel@tonic-gate 26721e08f0b8Sgww msg = calloc(num_msg, sizeof (struct pam_message)); 26737c478bd9Sstevel@tonic-gate if (msg == NULL) { 26747c478bd9Sstevel@tonic-gate return (PAM_BUF_ERR); 26757c478bd9Sstevel@tonic-gate } 26767c478bd9Sstevel@tonic-gate m = msg; 26777c478bd9Sstevel@tonic-gate 26787c478bd9Sstevel@tonic-gate while (k--) { 26797c478bd9Sstevel@tonic-gate /* 26807c478bd9Sstevel@tonic-gate * fill out the message structure to display prompt message 26817c478bd9Sstevel@tonic-gate */ 26827c478bd9Sstevel@tonic-gate m->msg_style = msg_style; 26837c478bd9Sstevel@tonic-gate m->msg = messages[i]; 26847c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_CONV, 26857c478bd9Sstevel@tonic-gate "pam_conv_msg(%p:%d[%d]=%s)", 26867c478bd9Sstevel@tonic-gate (void *)pamh, msg_style, i, messages[i]); 26877c478bd9Sstevel@tonic-gate m++; 26887c478bd9Sstevel@tonic-gate i++; 26897c478bd9Sstevel@tonic-gate } 26907c478bd9Sstevel@tonic-gate 26917c478bd9Sstevel@tonic-gate /* 26927c478bd9Sstevel@tonic-gate * The UNIX pam modules always calls __pam_get_authtok() and 26937c478bd9Sstevel@tonic-gate * __pam_display_msg() with a NULL pointer as the conv_apdp. 26947c478bd9Sstevel@tonic-gate * In case the conv_apdp is NULL and the pam_convp->appdata_ptr 26957c478bd9Sstevel@tonic-gate * is not NULL, we should pass the pam_convp->appdata_ptr 26967c478bd9Sstevel@tonic-gate * to the conversation function. 26977c478bd9Sstevel@tonic-gate */ 26987c478bd9Sstevel@tonic-gate if (conv_apdp == NULL && pam_convp->appdata_ptr != NULL) 26997c478bd9Sstevel@tonic-gate conv_apdp = pam_convp->appdata_ptr; 27007c478bd9Sstevel@tonic-gate 27017c478bd9Sstevel@tonic-gate /* 27027c478bd9Sstevel@tonic-gate * Call conv function to display the prompt. 27037c478bd9Sstevel@tonic-gate */ 27047c478bd9Sstevel@tonic-gate retcode = (pam_convp->conv)(num_msg, &msg, ret_respp, conv_apdp); 27057c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_CONV, 27067c478bd9Sstevel@tonic-gate "pam_conv_resp(%p pam_conv = %s) ret_respp = %p", 27077c478bd9Sstevel@tonic-gate (void *)pamh, pam_strerror(pamh, retcode), (void *)ret_respp); 27087c478bd9Sstevel@tonic-gate if (*ret_respp == NULL) { 27097c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_CONV, 27107c478bd9Sstevel@tonic-gate "pam_conv_resp(%p No response requested)", (void *)pamh); 27117c478bd9Sstevel@tonic-gate } else if ((pam_debug & (PAM_DEBUG_CONV | PAM_DEBUG_AUTHTOK)) != 0) { 27127c478bd9Sstevel@tonic-gate struct pam_response *r = *ret_respp; 27137c478bd9Sstevel@tonic-gate 27147c478bd9Sstevel@tonic-gate for (i = 0; i < num_msg; i++, r++) { 27157c478bd9Sstevel@tonic-gate if (r->resp == NULL) { 27167c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_CONV, 27177c478bd9Sstevel@tonic-gate "pam_conv_resp(%p:" 27187c478bd9Sstevel@tonic-gate "[%d] NULL response string)", 27197c478bd9Sstevel@tonic-gate (void *)pamh, i); 27207c478bd9Sstevel@tonic-gate } else { 27217c478bd9Sstevel@tonic-gate if (msg_style == PAM_PROMPT_ECHO_OFF) { 27227c478bd9Sstevel@tonic-gate #ifdef DEBUG 27237c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_AUTHTOK, 27247c478bd9Sstevel@tonic-gate "pam_conv_resp(%p:[%d]=%s, " 27257c478bd9Sstevel@tonic-gate "code=%d)", 27267c478bd9Sstevel@tonic-gate (void *)pamh, i, r->resp, 27277c478bd9Sstevel@tonic-gate r->resp_retcode); 27287c478bd9Sstevel@tonic-gate #endif /* DEBUG */ 27297c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_CONV, 27307c478bd9Sstevel@tonic-gate "pam_conv_resp(%p:[%d] len=%lu, " 27317c478bd9Sstevel@tonic-gate "code=%d)", 27327c478bd9Sstevel@tonic-gate (void *)pamh, i, 27337c478bd9Sstevel@tonic-gate (ulong_t)strlen(r->resp), 27347c478bd9Sstevel@tonic-gate r->resp_retcode); 27357c478bd9Sstevel@tonic-gate } else { 27367c478bd9Sstevel@tonic-gate pam_trace(PAM_DEBUG_CONV, 27377c478bd9Sstevel@tonic-gate "pam_conv_resp(%p:[%d]=%s, " 27387c478bd9Sstevel@tonic-gate "code=%d)", 27397c478bd9Sstevel@tonic-gate (void *)pamh, i, r->resp, 27407c478bd9Sstevel@tonic-gate r->resp_retcode); 27417c478bd9Sstevel@tonic-gate } 27427c478bd9Sstevel@tonic-gate } 27437c478bd9Sstevel@tonic-gate } 27447c478bd9Sstevel@tonic-gate } 27457c478bd9Sstevel@tonic-gate 27467c478bd9Sstevel@tonic-gate if (msg) 27477c478bd9Sstevel@tonic-gate free(msg); 27487c478bd9Sstevel@tonic-gate return (retcode); 27497c478bd9Sstevel@tonic-gate } 27507c478bd9Sstevel@tonic-gate 27517c478bd9Sstevel@tonic-gate /* 27527c478bd9Sstevel@tonic-gate * __pam_display_msg(): 27537c478bd9Sstevel@tonic-gate * display message by calling the call back functions 27547c478bd9Sstevel@tonic-gate * provided by the application through "pam_conv" structure 27557c478bd9Sstevel@tonic-gate */ 27567c478bd9Sstevel@tonic-gate 27577c478bd9Sstevel@tonic-gate int 27587c478bd9Sstevel@tonic-gate __pam_display_msg(pam_handle_t *pamh, int msg_style, int num_msg, 27597c478bd9Sstevel@tonic-gate char messages[PAM_MAX_NUM_MSG][PAM_MAX_MSG_SIZE], void *conv_apdp) 27607c478bd9Sstevel@tonic-gate { 27617c478bd9Sstevel@tonic-gate struct pam_response *ret_respp = NULL; 2762cdf5ca0aSPeter Shoults int ret; 2763cdf5ca0aSPeter Shoults 2764cdf5ca0aSPeter Shoults ret = do_conv(pamh, msg_style, num_msg, messages, 2765cdf5ca0aSPeter Shoults conv_apdp, &ret_respp); 2766cdf5ca0aSPeter Shoults 2767cdf5ca0aSPeter Shoults if (ret_respp != NULL) 2768cdf5ca0aSPeter Shoults free_resp(num_msg, ret_respp); 27697c478bd9Sstevel@tonic-gate 2770cdf5ca0aSPeter Shoults return (ret); 27717c478bd9Sstevel@tonic-gate } 27727c478bd9Sstevel@tonic-gate 27737c478bd9Sstevel@tonic-gate /* 27747c478bd9Sstevel@tonic-gate * __pam_get_authtok() 27757c478bd9Sstevel@tonic-gate * retrieves a password of at most PASS_MAX length from the pam 27767c478bd9Sstevel@tonic-gate * handle (pam_get_item) or from the input stream (do_conv). 27777c478bd9Sstevel@tonic-gate * 27787c478bd9Sstevel@tonic-gate * This function allocates memory for the new authtok. 27797c478bd9Sstevel@tonic-gate * Applications calling this function are responsible for 27807c478bd9Sstevel@tonic-gate * freeing this memory. 27817c478bd9Sstevel@tonic-gate * 27827c478bd9Sstevel@tonic-gate * If "source" is 27837c478bd9Sstevel@tonic-gate * PAM_HANDLE 27847c478bd9Sstevel@tonic-gate * and "type" is: 27857c478bd9Sstevel@tonic-gate * PAM_AUTHTOK - password is taken from pam handle (PAM_AUTHTOK) 27867c478bd9Sstevel@tonic-gate * PAM_OLDAUTHTOK - password is taken from pam handle (PAM_OLDAUTHTOK) 27877c478bd9Sstevel@tonic-gate * 27887c478bd9Sstevel@tonic-gate * If "source" is 27897c478bd9Sstevel@tonic-gate * PAM_PROMPT 27907c478bd9Sstevel@tonic-gate * and "type" is: 27917c478bd9Sstevel@tonic-gate * 0: Prompt for new passwd, do not even attempt 27927c478bd9Sstevel@tonic-gate * to store it in the pam handle. 27937c478bd9Sstevel@tonic-gate * PAM_AUTHTOK: Prompt for new passwd, store in pam handle as 27947c478bd9Sstevel@tonic-gate * PAM_AUTHTOK item if this value is not already set. 27957c478bd9Sstevel@tonic-gate * PAM_OLDAUTHTOK: Prompt for new passwd, store in pam handle as 27967c478bd9Sstevel@tonic-gate * PAM_OLDAUTHTOK item if this value is not 27977c478bd9Sstevel@tonic-gate * already set. 27987c478bd9Sstevel@tonic-gate */ 27997c478bd9Sstevel@tonic-gate int 28007c478bd9Sstevel@tonic-gate __pam_get_authtok(pam_handle_t *pamh, int source, int type, char *prompt, 28017c478bd9Sstevel@tonic-gate char **authtok) 28027c478bd9Sstevel@tonic-gate { 28037c478bd9Sstevel@tonic-gate int error = PAM_SYSTEM_ERR; 28047c478bd9Sstevel@tonic-gate char *new_password = NULL; 28057c478bd9Sstevel@tonic-gate struct pam_response *ret_resp = NULL; 28067c478bd9Sstevel@tonic-gate char messages[PAM_MAX_NUM_MSG][PAM_MAX_MSG_SIZE]; 28077c478bd9Sstevel@tonic-gate 28087c478bd9Sstevel@tonic-gate if ((*authtok = calloc(PASS_MAX+1, sizeof (char))) == NULL) 28097c478bd9Sstevel@tonic-gate return (PAM_BUF_ERR); 28107c478bd9Sstevel@tonic-gate 28117c478bd9Sstevel@tonic-gate if (prompt == NULL) 28127c478bd9Sstevel@tonic-gate prompt = dgettext(TEXT_DOMAIN, "password: "); 28137c478bd9Sstevel@tonic-gate 28147c478bd9Sstevel@tonic-gate switch (source) { 28157c478bd9Sstevel@tonic-gate case PAM_HANDLE: 28167c478bd9Sstevel@tonic-gate 28177c478bd9Sstevel@tonic-gate /* get password from pam handle item list */ 28187c478bd9Sstevel@tonic-gate 28197c478bd9Sstevel@tonic-gate switch (type) { 28207c478bd9Sstevel@tonic-gate case PAM_AUTHTOK: 28217c478bd9Sstevel@tonic-gate case PAM_OLDAUTHTOK: 28227c478bd9Sstevel@tonic-gate 28237c478bd9Sstevel@tonic-gate if ((error = pam_get_item(pamh, type, 28247c478bd9Sstevel@tonic-gate (void **)&new_password)) != PAM_SUCCESS) 28257c478bd9Sstevel@tonic-gate goto err_ret; 28267c478bd9Sstevel@tonic-gate 28277c478bd9Sstevel@tonic-gate if (new_password == NULL || new_password[0] == '\0') { 28287c478bd9Sstevel@tonic-gate free(*authtok); 28297c478bd9Sstevel@tonic-gate *authtok = NULL; 28307c478bd9Sstevel@tonic-gate } else { 28317c478bd9Sstevel@tonic-gate (void) strlcpy(*authtok, new_password, 28327c478bd9Sstevel@tonic-gate PASS_MAX+1); 28337c478bd9Sstevel@tonic-gate } 28347c478bd9Sstevel@tonic-gate break; 28357c478bd9Sstevel@tonic-gate default: 28367c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_ERR, 28377c478bd9Sstevel@tonic-gate "__pam_get_authtok() invalid type: %d", type); 28387c478bd9Sstevel@tonic-gate error = PAM_SYMBOL_ERR; 28397c478bd9Sstevel@tonic-gate goto err_ret; 28407c478bd9Sstevel@tonic-gate } 28417c478bd9Sstevel@tonic-gate break; 28427c478bd9Sstevel@tonic-gate case PAM_PROMPT: 28437c478bd9Sstevel@tonic-gate 28447c478bd9Sstevel@tonic-gate /* 28457c478bd9Sstevel@tonic-gate * Prompt for new password and save in pam handle item list 28467c478bd9Sstevel@tonic-gate * if the that item is not already set. 28477c478bd9Sstevel@tonic-gate */ 28487c478bd9Sstevel@tonic-gate 28497c478bd9Sstevel@tonic-gate (void) strncpy(messages[0], prompt, sizeof (messages[0])); 28507c478bd9Sstevel@tonic-gate if ((error = do_conv(pamh, PAM_PROMPT_ECHO_OFF, 1, messages, 28517c478bd9Sstevel@tonic-gate NULL, &ret_resp)) != PAM_SUCCESS) 28527c478bd9Sstevel@tonic-gate goto err_ret; 28537c478bd9Sstevel@tonic-gate 28547c478bd9Sstevel@tonic-gate if (ret_resp->resp == NULL) { 28557c478bd9Sstevel@tonic-gate /* getpass didn't return anything */ 28567c478bd9Sstevel@tonic-gate error = PAM_SYSTEM_ERR; 28577c478bd9Sstevel@tonic-gate goto err_ret; 28587c478bd9Sstevel@tonic-gate } 28597c478bd9Sstevel@tonic-gate 28607c478bd9Sstevel@tonic-gate /* save the new password if this item was NULL */ 28617c478bd9Sstevel@tonic-gate if (type) { 28627c478bd9Sstevel@tonic-gate if ((error = pam_get_item(pamh, type, 28637c478bd9Sstevel@tonic-gate (void **)&new_password)) != PAM_SUCCESS) { 28647c478bd9Sstevel@tonic-gate free_resp(1, ret_resp); 28657c478bd9Sstevel@tonic-gate goto err_ret; 28667c478bd9Sstevel@tonic-gate } 28677c478bd9Sstevel@tonic-gate if (new_password == NULL) 28687c478bd9Sstevel@tonic-gate (void) pam_set_item(pamh, type, ret_resp->resp); 28697c478bd9Sstevel@tonic-gate } 28707c478bd9Sstevel@tonic-gate 28717c478bd9Sstevel@tonic-gate (void) strlcpy(*authtok, ret_resp->resp, PASS_MAX+1); 28727c478bd9Sstevel@tonic-gate free_resp(1, ret_resp); 28737c478bd9Sstevel@tonic-gate break; 28747c478bd9Sstevel@tonic-gate default: 28757c478bd9Sstevel@tonic-gate __pam_log(LOG_AUTH | LOG_ERR, 28767c478bd9Sstevel@tonic-gate "__pam_get_authtok() invalid source: %d", source); 28777c478bd9Sstevel@tonic-gate error = PAM_SYMBOL_ERR; 28787c478bd9Sstevel@tonic-gate goto err_ret; 28797c478bd9Sstevel@tonic-gate } 28807c478bd9Sstevel@tonic-gate 28817c478bd9Sstevel@tonic-gate return (PAM_SUCCESS); 28827c478bd9Sstevel@tonic-gate 28837c478bd9Sstevel@tonic-gate err_ret: 28847c478bd9Sstevel@tonic-gate bzero(*authtok, PASS_MAX+1); 28857c478bd9Sstevel@tonic-gate free(*authtok); 28867c478bd9Sstevel@tonic-gate *authtok = NULL; 28877c478bd9Sstevel@tonic-gate return (error); 28887c478bd9Sstevel@tonic-gate } 2889