xref: /netbsd-src/lib/libpam/modules/pam_group/pam_group.c (revision e5548b402ae4c44fb816de42c7bba9581ce23ef5)
1 /*	$NetBSD: pam_group.c,v 1.9 2005/04/19 13:04:19 christos Exp $	*/
2 
3 /*-
4  * Copyright (c) 2003 Networks Associates Technology, Inc.
5  * All rights reserved.
6  *
7  * Portions of this software were developed for the FreeBSD Project by
8  * ThinkSec AS and NAI Labs, the Security Research Division of Network
9  * Associates, Inc.  under DARPA/SPAWAR contract N66001-01-C-8035
10  * ("CBOSS"), as part of the DARPA CHATS research program.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  * 3. The name of the author may not be used to endorse or promote
21  *    products derived from this software without specific prior written
22  *    permission.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34  * SUCH DAMAGE.
35  */
36 
37 #include <sys/cdefs.h>
38 #ifdef __FreeBSD__
39 __FBSDID("$FreeBSD: src/lib/libpam/modules/pam_group/pam_group.c,v 1.4 2003/12/11 13:55:15 des Exp $");
40 #else
41 __RCSID("$NetBSD: pam_group.c,v 1.9 2005/04/19 13:04:19 christos Exp $");
42 #endif
43 
44 #include <sys/types.h>
45 
46 #include <grp.h>
47 #include <pwd.h>
48 #include <stdarg.h>
49 #include <stdio.h>
50 #include <string.h>
51 #include <stdlib.h>
52 #include <syslog.h>
53 #include <unistd.h>
54 #include <login_cap.h>
55 
56 #define PAM_SM_AUTH
57 
58 #include <security/pam_appl.h>
59 #include <security/pam_modules.h>
60 #include <security/pam_mod_misc.h>
61 #include <security/openpam.h>
62 
63 static int authenticate(pam_handle_t *, struct passwd *, int);
64 
65 PAM_EXTERN int
66 pam_sm_authenticate(pam_handle_t *pamh, int flags __unused,
67     int argc __unused, const char *argv[] __unused)
68 {
69 	const char *group, *user;
70 	const void *ruser;
71 	char *const *list;
72 	struct passwd *pwd, pwres;
73 	struct group *grp, grres;
74 	int pam_err, auth;
75 	char *promptresp = NULL;
76 	char pwbuf[1024];
77 	char grbuf[1024];
78 
79 	/* get target account */
80 	if (pam_get_user(pamh, &user, NULL) != PAM_SUCCESS ||
81 	    user == NULL ||
82 	    getpwnam_r(user, &pwres, pwbuf, sizeof(pwbuf), &pwd) != 0 ||
83 	    pwd == NULL)
84 		return (PAM_AUTH_ERR);
85 	if (pwd->pw_uid != 0 && openpam_get_option(pamh, "root_only"))
86 		return (PAM_IGNORE);
87 
88 	/* get applicant */
89 	if (pam_get_item(pamh, PAM_RUSER, &ruser) != PAM_SUCCESS ||
90 	    ruser == NULL ||
91 	    getpwnam_r(ruser, &pwres, pwbuf, sizeof(pwbuf), &pwd) != 0 ||
92 	    pwd == NULL)
93 		return (PAM_AUTH_ERR);
94 
95 	auth = openpam_get_option(pamh, "authenticate") != NULL;
96 
97 	/* get regulating group */
98 	if ((group = openpam_get_option(pamh, "group")) == NULL)
99 		group = "wheel";
100 	if (getgrnam_r(group, &grres, grbuf, sizeof(grbuf), &grp) != 0 ||
101 	    grp == NULL || grp->gr_mem == NULL)
102 		goto failed;
103 
104 	/* check if the group is empty */
105 	if (*grp->gr_mem == NULL)
106 		goto failed;
107 
108 	/* check membership */
109 	if (pwd->pw_gid == grp->gr_gid)
110 		goto found;
111 	for (list = grp->gr_mem; *list != NULL; ++list)
112 		if (strcmp(*list, pwd->pw_name) == 0)
113 			goto found;
114 
115  not_found:
116 	if (openpam_get_option(pamh, "deny"))
117 		return (PAM_SUCCESS);
118 	if (!auth) {
119 		pam_err = pam_prompt(pamh, PAM_ERROR_MSG, &promptresp,
120 		    "%s: You are not listed in the correct secondary group"
121 		    " (%s) to %s %s.", getprogname(), group, getprogname(),
122 		    user);
123 		if (pam_err == PAM_SUCCESS && promptresp)
124 			free(promptresp);
125 	}
126 	return (PAM_AUTH_ERR);
127  found:
128 	if (auth)
129 		if ((pam_err = authenticate(pamh, pwd, flags)) != PAM_SUCCESS)
130 			return pam_err;
131 
132 	if (openpam_get_option(pamh, "deny"))
133 		return (PAM_AUTH_ERR);
134 	return (PAM_SUCCESS);
135  failed:
136 	if (openpam_get_option(pamh, "fail_safe"))
137 		goto found;
138 	else
139 		goto not_found;
140 }
141 
142 PAM_EXTERN int
143 pam_sm_setcred(pam_handle_t * pamh __unused, int flags __unused,
144     int argc __unused, const char *argv[] __unused)
145 {
146 
147 	return (PAM_SUCCESS);
148 }
149 
150 static int
151 authenticate(pam_handle_t *pamh, struct passwd *pwd, int flags)
152 {
153 	int retval;
154 	login_cap_t *lc;
155 	const char *pass;
156 
157 	lc = login_getpwclass(pwd);
158 	retval = pam_get_authtok(pamh, PAM_AUTHTOK, &pass, NULL);
159 	login_close(lc);
160 
161 	if (retval != PAM_SUCCESS)
162 		return retval;
163         PAM_LOG("Got password");
164         if (strcmp(crypt(pass, pwd->pw_passwd), pwd->pw_passwd) == 0)
165                 return PAM_SUCCESS;
166 
167         PAM_VERBOSE_ERROR("UNIX authentication refused");
168         return PAM_AUTH_ERR;
169 }
170 
171 
172 PAM_MODULE_ENTRY("pam_group");
173