1f875b4ebSrica /*
2f875b4ebSrica * CDDL HEADER START
3f875b4ebSrica *
4f875b4ebSrica * The contents of this file are subject to the terms of the
5f875b4ebSrica * Common Development and Distribution License (the "License").
6f875b4ebSrica * You may not use this file except in compliance with the License.
7f875b4ebSrica *
8f875b4ebSrica * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9f875b4ebSrica * or http://www.opensolaris.org/os/licensing.
10f875b4ebSrica * See the License for the specific language governing permissions
11f875b4ebSrica * and limitations under the License.
12f875b4ebSrica *
13f875b4ebSrica * When distributing Covered Code, include this CDDL HEADER in each
14f875b4ebSrica * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15f875b4ebSrica * If applicable, add the following below this CDDL HEADER, with the
16f875b4ebSrica * fields enclosed by brackets "[]" replaced with your own identifying
17f875b4ebSrica * information: Portions Copyright [yyyy] [name of copyright owner]
18f875b4ebSrica *
19f875b4ebSrica * CDDL HEADER END
20f875b4ebSrica */
21f875b4ebSrica /*
22f875b4ebSrica * Copyright 2007 Sun Microsystems, Inc. All rights reserved.
23f875b4ebSrica * Use is subject to license terms.
24f875b4ebSrica */
25f875b4ebSrica
26f875b4ebSrica #include <libtsnet.h>
27f875b4ebSrica #include <stdlib.h>
28f875b4ebSrica #include <string.h>
29f875b4ebSrica #include <syslog.h>
30f875b4ebSrica #include <zone.h>
31f875b4ebSrica
32f875b4ebSrica #include <security/pam_appl.h>
33f875b4ebSrica #include <security/pam_modules.h>
34f875b4ebSrica #include <security/pam_impl.h>
35f875b4ebSrica
36f875b4ebSrica #include <tsol/label.h>
37f875b4ebSrica
38f875b4ebSrica /*
39f875b4ebSrica * pam_tsol_account - Trusted Extensions account management.
40f875b4ebSrica * Validates that the user's label range contains
41f875b4ebSrica * the process label (label of the zone).
42f875b4ebSrica */
43f875b4ebSrica
44f875b4ebSrica static void
free_labels(m_range_t * r,m_label_t * l)45f875b4ebSrica free_labels(m_range_t *r, m_label_t *l)
46f875b4ebSrica {
47f875b4ebSrica m_label_free(r->lower_bound);
48f875b4ebSrica m_label_free(r->upper_bound);
49f875b4ebSrica free(r);
50f875b4ebSrica m_label_free(l);
51f875b4ebSrica }
52f875b4ebSrica
53f875b4ebSrica /* ARGSUSED */
54f875b4ebSrica int
pam_sm_acct_mgmt(pam_handle_t * pamh,int flags,int argc,const char ** argv)55f875b4ebSrica pam_sm_acct_mgmt(pam_handle_t *pamh, int flags, int argc, const char **argv)
56f875b4ebSrica {
57f875b4ebSrica int i;
58f875b4ebSrica int debug = 0;
59f875b4ebSrica int allow_unlabeled = 0;
60f875b4ebSrica char *user;
61f875b4ebSrica char *rhost;
62f875b4ebSrica m_range_t *range;
63f875b4ebSrica m_label_t *plabel;
64f875b4ebSrica
65f875b4ebSrica for (i = 0; i < argc; i++) {
66f875b4ebSrica if (strcmp(argv[i], "debug") == 0) {
67f875b4ebSrica debug = 1;
68f875b4ebSrica } else if (strcmp(argv[i], "allow_unlabeled") == 0) {
69f875b4ebSrica allow_unlabeled = 1;
70f875b4ebSrica } else {
71f875b4ebSrica __pam_log(LOG_AUTH | LOG_ERR,
72f875b4ebSrica "pam_tsol_account: illegal option %s", argv[i]);
73f875b4ebSrica }
74f875b4ebSrica }
75f875b4ebSrica
76f875b4ebSrica /* Trusted Extensions not enabled */
77f875b4ebSrica
78f875b4ebSrica if (!is_system_labeled())
79f875b4ebSrica return (PAM_IGNORE);
80f875b4ebSrica
81f875b4ebSrica (void) pam_get_item(pamh, PAM_USER, (void **)&user);
82f875b4ebSrica
83f875b4ebSrica (void) pam_get_item(pamh, PAM_RHOST, (void **)&rhost);
84f875b4ebSrica
85f875b4ebSrica if (debug) {
86f875b4ebSrica __pam_log(LOG_AUTH | LOG_DEBUG,
87f875b4ebSrica "pam_tsol_account: allowed_unlabeled = %d, user %s, "
88f875b4ebSrica "rhost %s",
89f875b4ebSrica allow_unlabeled,
90*3a05eee7SToomas Soome (user == NULL) ? "NULL" : (*user == '\0') ? "ZERO" :
91f875b4ebSrica user,
92*3a05eee7SToomas Soome (rhost == NULL) ? "NULL" : (*rhost == '\0') ? "ZERO" :
93f875b4ebSrica rhost);
94f875b4ebSrica }
95f875b4ebSrica if (user == NULL || *user == '\0') {
96f875b4ebSrica __pam_log(LOG_AUTH | LOG_ERR,
97f875b4ebSrica "pam_tsol_account: no user");
98f875b4ebSrica return (PAM_USER_UNKNOWN);
99f875b4ebSrica }
100f875b4ebSrica
101f875b4ebSrica if ((range = getuserrange(user)) == NULL) {
102f875b4ebSrica __pam_log(LOG_AUTH | LOG_ERR,
103f875b4ebSrica "pam_tsol_account: getuserrange(%s) failure", user);
104f875b4ebSrica return (PAM_SYSTEM_ERR);
105f875b4ebSrica }
106f875b4ebSrica if ((plabel = m_label_alloc(MAC_LABEL)) == NULL) {
107f875b4ebSrica __pam_log(LOG_AUTH | LOG_ERR,
108f875b4ebSrica "pam_tsol_account: out of memory");
109f875b4ebSrica free_labels(range, NULL);
110f875b4ebSrica return (PAM_BUF_ERR);
111f875b4ebSrica }
112f875b4ebSrica if (getplabel(plabel) < 0) {
113f875b4ebSrica __pam_log(LOG_AUTH | LOG_CRIT,
114f875b4ebSrica "pam_tsol_account: Unable to get process label %m");
115f875b4ebSrica free_labels(range, plabel);
116f875b4ebSrica return (PAM_SYSTEM_ERR);
117f875b4ebSrica }
118f875b4ebSrica if (!blinrange(plabel, range)) {
119f875b4ebSrica free_labels(range, plabel);
120f875b4ebSrica return (PAM_PERM_DENIED);
121f875b4ebSrica }
122f875b4ebSrica
123f875b4ebSrica free_labels(range, plabel);
124f875b4ebSrica
125f875b4ebSrica /* Remote Host Type Policy Check */
126f875b4ebSrica
127f875b4ebSrica if ((allow_unlabeled == 0) &&
128f875b4ebSrica (getzoneid() == GLOBAL_ZONEID) &&
129f875b4ebSrica (rhost != NULL && *rhost != '\0')) {
130f875b4ebSrica tsol_host_type_t host_type;
131f875b4ebSrica
132f875b4ebSrica host_type = tsol_getrhtype(rhost);
133f875b4ebSrica switch (host_type) {
134f875b4ebSrica case SUN_CIPSO:
135f875b4ebSrica break;
136f875b4ebSrica
137f875b4ebSrica case UNLABELED:
138f875b4ebSrica default:
139f875b4ebSrica return (PAM_PERM_DENIED);
140f875b4ebSrica }
141f875b4ebSrica }
142f875b4ebSrica return (PAM_SUCCESS);
143f875b4ebSrica }
144