1*4746Srica /*
2*4746Srica * CDDL HEADER START
3*4746Srica *
4*4746Srica * The contents of this file are subject to the terms of the
5*4746Srica * Common Development and Distribution License (the "License").
6*4746Srica * You may not use this file except in compliance with the License.
7*4746Srica *
8*4746Srica * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9*4746Srica * or http://www.opensolaris.org/os/licensing.
10*4746Srica * See the License for the specific language governing permissions
11*4746Srica * and limitations under the License.
12*4746Srica *
13*4746Srica * When distributing Covered Code, include this CDDL HEADER in each
14*4746Srica * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15*4746Srica * If applicable, add the following below this CDDL HEADER, with the
16*4746Srica * fields enclosed by brackets "[]" replaced with your own identifying
17*4746Srica * information: Portions Copyright [yyyy] [name of copyright owner]
18*4746Srica *
19*4746Srica * CDDL HEADER END
20*4746Srica */
21*4746Srica /*
22*4746Srica * Copyright 2007 Sun Microsystems, Inc. All rights reserved.
23*4746Srica * Use is subject to license terms.
24*4746Srica */
25*4746Srica
26*4746Srica #pragma ident "%Z%%M% %I% %E% SMI"
27*4746Srica
28*4746Srica #include <libtsnet.h>
29*4746Srica #include <stdlib.h>
30*4746Srica #include <string.h>
31*4746Srica #include <syslog.h>
32*4746Srica #include <zone.h>
33*4746Srica
34*4746Srica #include <security/pam_appl.h>
35*4746Srica #include <security/pam_modules.h>
36*4746Srica #include <security/pam_impl.h>
37*4746Srica
38*4746Srica #include <tsol/label.h>
39*4746Srica
40*4746Srica /*
41*4746Srica * pam_tsol_account - Trusted Extensions account management.
42*4746Srica * Validates that the user's label range contains
43*4746Srica * the process label (label of the zone).
44*4746Srica */
45*4746Srica
46*4746Srica static void
free_labels(m_range_t * r,m_label_t * l)47*4746Srica free_labels(m_range_t *r, m_label_t *l)
48*4746Srica {
49*4746Srica m_label_free(r->lower_bound);
50*4746Srica m_label_free(r->upper_bound);
51*4746Srica free(r);
52*4746Srica m_label_free(l);
53*4746Srica }
54*4746Srica
55*4746Srica /* ARGSUSED */
56*4746Srica int
pam_sm_acct_mgmt(pam_handle_t * pamh,int flags,int argc,const char ** argv)57*4746Srica pam_sm_acct_mgmt(pam_handle_t *pamh, int flags, int argc, const char **argv)
58*4746Srica {
59*4746Srica int i;
60*4746Srica int debug = 0;
61*4746Srica int allow_unlabeled = 0;
62*4746Srica char *user;
63*4746Srica char *rhost;
64*4746Srica m_range_t *range;
65*4746Srica m_label_t *plabel;
66*4746Srica
67*4746Srica for (i = 0; i < argc; i++) {
68*4746Srica if (strcmp(argv[i], "debug") == 0) {
69*4746Srica debug = 1;
70*4746Srica } else if (strcmp(argv[i], "allow_unlabeled") == 0) {
71*4746Srica allow_unlabeled = 1;
72*4746Srica } else {
73*4746Srica __pam_log(LOG_AUTH | LOG_ERR,
74*4746Srica "pam_tsol_account: illegal option %s", argv[i]);
75*4746Srica }
76*4746Srica }
77*4746Srica
78*4746Srica /* Trusted Extensions not enabled */
79*4746Srica
80*4746Srica if (!is_system_labeled())
81*4746Srica return (PAM_IGNORE);
82*4746Srica
83*4746Srica (void) pam_get_item(pamh, PAM_USER, (void **)&user);
84*4746Srica
85*4746Srica (void) pam_get_item(pamh, PAM_RHOST, (void **)&rhost);
86*4746Srica
87*4746Srica if (debug) {
88*4746Srica __pam_log(LOG_AUTH | LOG_DEBUG,
89*4746Srica "pam_tsol_account: allowed_unlabeled = %d, user %s, "
90*4746Srica "rhost %s",
91*4746Srica allow_unlabeled,
92*4746Srica (user == NULL) ? "NULL" : (user == '\0') ? "ZERO" :
93*4746Srica user,
94*4746Srica (rhost == NULL) ? "NULL" : (rhost == '\0') ? "ZERO" :
95*4746Srica rhost);
96*4746Srica }
97*4746Srica if (user == NULL || *user == '\0') {
98*4746Srica __pam_log(LOG_AUTH | LOG_ERR,
99*4746Srica "pam_tsol_account: no user");
100*4746Srica return (PAM_USER_UNKNOWN);
101*4746Srica }
102*4746Srica
103*4746Srica if ((range = getuserrange(user)) == NULL) {
104*4746Srica __pam_log(LOG_AUTH | LOG_ERR,
105*4746Srica "pam_tsol_account: getuserrange(%s) failure", user);
106*4746Srica return (PAM_SYSTEM_ERR);
107*4746Srica }
108*4746Srica if ((plabel = m_label_alloc(MAC_LABEL)) == NULL) {
109*4746Srica __pam_log(LOG_AUTH | LOG_ERR,
110*4746Srica "pam_tsol_account: out of memory");
111*4746Srica free_labels(range, NULL);
112*4746Srica return (PAM_BUF_ERR);
113*4746Srica }
114*4746Srica if (getplabel(plabel) < 0) {
115*4746Srica __pam_log(LOG_AUTH | LOG_CRIT,
116*4746Srica "pam_tsol_account: Unable to get process label %m");
117*4746Srica free_labels(range, plabel);
118*4746Srica return (PAM_SYSTEM_ERR);
119*4746Srica }
120*4746Srica if (!blinrange(plabel, range)) {
121*4746Srica free_labels(range, plabel);
122*4746Srica return (PAM_PERM_DENIED);
123*4746Srica }
124*4746Srica
125*4746Srica free_labels(range, plabel);
126*4746Srica
127*4746Srica /* Remote Host Type Policy Check */
128*4746Srica
129*4746Srica if ((allow_unlabeled == 0) &&
130*4746Srica (getzoneid() == GLOBAL_ZONEID) &&
131*4746Srica (rhost != NULL && *rhost != '\0')) {
132*4746Srica tsol_host_type_t host_type;
133*4746Srica
134*4746Srica host_type = tsol_getrhtype(rhost);
135*4746Srica switch (host_type) {
136*4746Srica case SUN_CIPSO:
137*4746Srica break;
138*4746Srica
139*4746Srica case UNLABELED:
140*4746Srica default:
141*4746Srica return (PAM_PERM_DENIED);
142*4746Srica }
143*4746Srica }
144*4746Srica return (PAM_SUCCESS);
145*4746Srica }
146