VirtualBox

source: vbox/trunk/src/VBox/Additions/common/pam/pam_vbox.cpp@ 63206

Last change on this file since 63206 was 62882, checked in by vboxsync, 8 years ago

Additions/common: gcc warnings.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 30.5 KB
Line 
1/* $Id: pam_vbox.cpp 62882 2016-08-02 15:31:02Z vboxsync $ */
2/** @file
3 * pam_vbox - PAM module for auto logons.
4 */
5
6/*
7 * Copyright (C) 2008-2016 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19/*********************************************************************************************************************************
20* Header Files *
21*********************************************************************************************************************************/
22#define PAM_SM_AUTH
23#define PAM_SM_ACCOUNT
24#define PAM_SM_PASSWORD
25#define PAM_SM_SESSION
26
27#ifdef DEBUG
28# define PAM_DEBUG
29#endif
30
31#include <security/pam_appl.h>
32#ifdef RT_OS_LINUX
33# include <security/_pam_macros.h>
34#endif
35
36#include <pwd.h>
37#include <syslog.h>
38#include <stdlib.h>
39
40#include <iprt/assert.h>
41#include <iprt/buildconfig.h>
42#include <iprt/env.h>
43#include <iprt/initterm.h>
44#include <iprt/mem.h>
45#include <iprt/stream.h>
46#include <iprt/string.h>
47#include <iprt/thread.h>
48#include <iprt/time.h>
49
50#include <VBox/VBoxGuestLib.h>
51
52#include <VBox/log.h>
53#ifdef VBOX_WITH_GUEST_PROPS
54# include <VBox/HostServices/GuestPropertySvc.h>
55 using namespace guestProp;
56#endif
57
58#define VBOX_MODULE_NAME "pam_vbox"
59
60#define VBOX_PAM_FLAG_SILENT "PAM_SILENT"
61#define VBOX_PAM_FLAG_DISALLOW_NULL_AUTHTOK "PAM_DISALLOW_NULL_AUTHTOK"
62#define VBOX_PAM_FLAG_ESTABLISH_CRED "PAM_ESTABLISH_CRED"
63#define VBOX_PAM_FLAG_DELETE_CRED "PAM_DELETE_CRED"
64#define VBOX_PAM_FLAG_REINITIALIZE_CRED "PAM_REINITIALIZE_CRED"
65#define VBOX_PAM_FLAG_REFRESH_CRED "PAM_REFRESH_CRED"
66
67RT_C_DECLS_BEGIN
68RTDECL(int) pam_sm_authenticate(pam_handle_t *hPAM, int iFlags, int argc, const char **argv);
69RTDECL(int) pam_sm_setcred(pam_handle_t *hPAM, int iFlags, int argc, const char **argv);
70RTDECL(int) pam_sm_acct_mgmt(pam_handle_t *hPAM, int iFlags, int argc, const char **argv);
71RTDECL(int) pam_sm_open_session(pam_handle_t *hPAM, int iFlags, int argc, const char **argv);
72RTDECL(int) pam_sm_close_session(pam_handle_t *hPAM, int iFlags, int argc, const char **argv);
73RTDECL(int) pam_sm_chauthtok(pam_handle_t *hPAM, int iFlags, int argc, const char **argv);
74RT_C_DECLS_END
75
76/** For debugging. */
77#ifdef DEBUG
78static pam_handle_t *g_pam_handle;
79static int g_verbosity = 99;
80#else
81static int g_verbosity = 0;
82#endif
83
84/**
85 * User-provided thread data for the credentials waiting thread.
86 */
87typedef struct PAMVBOXTHREAD
88{
89 /** The PAM handle. */
90 pam_handle_t *hPAM;
91 /** The timeout (in ms) to wait for credentials. */
92 uint32_t uTimeoutMS;
93 /** The overall result of the thread operation. */
94 int rc;
95} PAMVBOXTHREAD, *PPAMVBOXTHREAD;
96
97/**
98 * Write to system log.
99 *
100 * @param pszBuf Buffer to write to the log (NULL-terminated)
101 */
102static void pam_vbox_writesyslog(char *pszBuf)
103{
104#ifdef RT_OS_LINUX
105 openlog("pam_vbox", LOG_PID, LOG_AUTHPRIV);
106 syslog(LOG_ERR, "%s", pszBuf);
107 closelog();
108#elif defined(RT_OS_SOLARIS)
109 syslog(LOG_ERR, "pam_vbox: %s\n", pszBuf);
110#endif
111}
112
113
114/**
115 * Displays an error message.
116 *
117 * @param pszFormat The message text.
118 * @param ... Format arguments.
119 */
120static void pam_vbox_error(pam_handle_t *hPAM, const char *pszFormat, ...)
121{
122 RT_NOREF1(hPAM);
123 va_list va;
124 char *buf;
125 va_start(va, pszFormat);
126 if (RT_SUCCESS(RTStrAPrintfV(&buf, pszFormat, va)))
127 {
128 LogRel(("%s: Error: %s", VBOX_MODULE_NAME, buf));
129 pam_vbox_writesyslog(buf);
130 RTStrFree(buf);
131 }
132 va_end(va);
133}
134
135
136/**
137 * Displays a debug message.
138 *
139 * @param pszFormat The message text.
140 * @param ... Format arguments.
141 */
142static void pam_vbox_log(pam_handle_t *hPAM, const char *pszFormat, ...)
143{
144 RT_NOREF1(hPAM);
145 if (g_verbosity)
146 {
147 va_list va;
148 char *buf;
149 va_start(va, pszFormat);
150 if (RT_SUCCESS(RTStrAPrintfV(&buf, pszFormat, va)))
151 {
152 /* Only do normal logging in debug mode; could contain
153 * sensitive data! */
154 LogRel(("%s: %s", VBOX_MODULE_NAME, buf));
155 /* Log to syslog */
156 pam_vbox_writesyslog(buf);
157 RTStrFree(buf);
158 }
159 va_end(va);
160 }
161}
162
163
164/**
165 * Sets a message using PAM's conversation function.
166 *
167 * @return IPRT status code.
168 * @param hPAM PAM handle.
169 * @param iStyle Style of message (0 = Information, 1 = Prompt
170 * echo off, 2 = Prompt echo on, 3 = Error).
171 * @param pszText Message text to set.
172 */
173static int vbox_set_msg(pam_handle_t *hPAM, int iStyle, const char *pszText)
174{
175 AssertPtrReturn(hPAM, VERR_INVALID_POINTER);
176 AssertPtrReturn(pszText, VERR_INVALID_POINTER);
177
178 if (!iStyle)
179 iStyle = PAM_TEXT_INFO;
180
181 int rc = VINF_SUCCESS;
182
183 pam_message msg;
184 msg.msg_style = iStyle;
185#ifdef RT_OS_SOLARIS
186 msg.msg = (char*)pszText;
187#else
188 msg.msg = pszText;
189#endif
190
191#ifdef RT_OS_SOLARIS
192 pam_conv *conv = NULL;
193 int pamrc = pam_get_item(hPAM, PAM_CONV, (void **)&conv);
194#else
195 const pam_conv *conv = NULL;
196 int pamrc = pam_get_item(hPAM, PAM_CONV, (const void **)&conv);
197#endif
198 if ( pamrc == PAM_SUCCESS
199 && conv)
200 {
201 pam_response *resp = NULL;
202#ifdef RT_OS_SOLARIS
203 pam_message *msg_p = &msg;
204#else
205 const pam_message *msg_p = &msg;
206#endif
207 pam_vbox_log(hPAM, "Showing message \"%s\" (type %d)", pszText, iStyle);
208
209 pamrc = conv->conv(1 /* One message only */, &msg_p, &resp, conv->appdata_ptr);
210 if (resp != NULL) /* If we use PAM_TEXT_INFO we never will get something back! */
211 {
212 if (resp->resp)
213 {
214 pam_vbox_log(hPAM, "Response to message \"%s\" was \"%s\"",
215 pszText, resp->resp);
216 /** @todo Save response! */
217 free(resp->resp);
218 }
219 free(resp);
220 }
221 }
222 else
223 rc = VERR_NOT_FOUND;
224 return rc;
225}
226
227
228/**
229 * Initializes pam_vbox.
230 *
231 * @return IPRT status code.
232 * @param hPAM PAM handle.
233 */
234static int pam_vbox_init(pam_handle_t *hPAM)
235{
236#ifdef DEBUG
237 g_pam_handle = hPAM; /* hack for getting assertion text */
238#endif
239
240 /* Don't make assertions panic because the PAM stack +
241 * the current logon module won't work anymore (or just restart).
242 * This could result in not able to log into the system anymore. */
243 RTAssertSetMayPanic(false);
244
245 pam_vbox_log(hPAM, "pam_vbox: %sr%s, running on %s\n",
246 RTBldCfgVersion(), RTBldCfgRevisionStr(), RTBldCfgTargetArch());
247
248 int rc = RTR3InitDll(0);
249 if (RT_FAILURE(rc))
250 {
251 pam_vbox_error(hPAM, "pam_vbox_init: could not init runtime! rc=%Rrc. Aborting\n", rc);
252 return PAM_SUCCESS; /* Jump out as early as we can to not mess around. */
253 }
254
255 pam_vbox_log(hPAM, "pam_vbox_init: runtime initialized\n");
256 if (RT_SUCCESS(rc))
257 {
258 rc = VbglR3InitUser();
259 if (RT_FAILURE(rc))
260 {
261 switch(rc)
262 {
263 case VERR_ACCESS_DENIED:
264 pam_vbox_error(hPAM, "pam_vbox_init: access is denied to guest driver! Please make sure you run with sufficient rights. Aborting\n");
265 break;
266
267 case VERR_FILE_NOT_FOUND:
268 pam_vbox_error(hPAM, "pam_vbox_init: guest driver not found! Guest Additions installed? Aborting\n");
269 break;
270
271 default:
272 pam_vbox_error(hPAM, "pam_vbox_init: could not init VbglR3 library! rc=%Rrc. Aborting\n", rc);
273 break;
274 }
275 }
276 pam_vbox_log(hPAM, "pam_vbox_init: guest lib initialized\n");
277 }
278
279 if (RT_SUCCESS(rc))
280 {
281 char *rhost = NULL;
282 char *tty = NULL;
283 char *prompt = NULL;
284#ifdef RT_OS_SOLARIS
285 pam_get_item(hPAM, PAM_RHOST, (void**) &rhost);
286 pam_get_item(hPAM, PAM_TTY, (void**) &tty);
287 pam_get_item(hPAM, PAM_USER_PROMPT, (void**) &prompt);
288#else
289 pam_get_item(hPAM, PAM_RHOST, (const void**) &rhost);
290 pam_get_item(hPAM, PAM_TTY, (const void**) &tty);
291 pam_get_item(hPAM, PAM_USER_PROMPT, (const void**) &prompt);
292#endif
293 pam_vbox_log(hPAM, "pam_vbox_init: rhost=%s, tty=%s, prompt=%s\n",
294 rhost ? rhost : "<none>", tty ? tty : "<none>", prompt ? prompt : "<none>");
295 }
296
297 return rc;
298}
299
300
301/**
302 * Shuts down pam_vbox.
303 *
304 * @return IPRT status code.
305 * @param hPAM PAM handle.
306 */
307static void pam_vbox_shutdown(pam_handle_t *hPAM)
308{
309 RT_NOREF1(hPAM);
310 VbglR3Term();
311}
312
313
314/**
315 * Checks for credentials provided by the host / HGCM.
316 *
317 * @return IPRT status code. VERR_NOT_FOUND if no credentials are available,
318 * VINF_SUCCESS on successful retrieval or another IPRT error.
319 * @param hPAM PAM handle.
320 */
321static int pam_vbox_check_creds(pam_handle_t *hPAM)
322{
323 int rc = VbglR3CredentialsQueryAvailability();
324 if (RT_FAILURE(rc))
325 {
326 if (rc != VERR_NOT_FOUND)
327 pam_vbox_error(hPAM, "pam_vbox_check_creds: could not query for credentials! rc=%Rrc. Aborting\n", rc);
328#ifdef DEBUG
329 else
330 pam_vbox_log(hPAM, "pam_vbox_check_creds: no credentials available\n");
331#endif
332 }
333 else
334 {
335 char *pszUsername;
336 char *pszPassword;
337 char *pszDomain;
338
339 rc = VbglR3CredentialsRetrieve(&pszUsername, &pszPassword, &pszDomain);
340 if (RT_FAILURE(rc))
341 {
342 pam_vbox_error(hPAM, "pam_vbox_check_creds: could not retrieve credentials! rc=%Rrc. Aborting\n", rc);
343 }
344 else
345 {
346#ifdef DEBUG
347 pam_vbox_log(hPAM, "pam_vbox_check_creds: credentials retrieved: user=%s, password=%s, domain=%s\n",
348 pszUsername, pszPassword, pszDomain);
349#else
350 /* Don't log passwords in release mode! */
351 pam_vbox_log(hPAM, "pam_vbox_check_creds: credentials retrieved: user=%s, password=XXX, domain=%s\n",
352 pszUsername, pszDomain);
353#endif
354 /* Fill credentials into PAM. */
355 int pamrc = pam_set_item(hPAM, PAM_USER, pszUsername);
356 if (pamrc != PAM_SUCCESS)
357 {
358 pam_vbox_error(hPAM, "pam_vbox_check_creds: could not set user name! pamrc=%d, msg=%s. Aborting\n",
359 pamrc, pam_strerror(hPAM, pamrc));
360 }
361 else
362 {
363 pamrc = pam_set_item(hPAM, PAM_AUTHTOK, pszPassword);
364 if (pamrc != PAM_SUCCESS)
365 pam_vbox_error(hPAM, "pam_vbox_check_creds: could not set password! pamrc=%d, msg=%s. Aborting\n",
366 pamrc, pam_strerror(hPAM, pamrc));
367
368 }
369 /** @todo Add handling domains as well. */
370 VbglR3CredentialsDestroy(pszUsername, pszPassword, pszDomain,
371 3 /* Three wipe passes */);
372 pam_vbox_log(hPAM, "pam_vbox_check_creds: returned with pamrc=%d, msg=%s\n",
373 pamrc, pam_strerror(hPAM, pamrc));
374 }
375 }
376
377#ifdef DEBUG
378 pam_vbox_log(hPAM, "pam_vbox_check_creds: returned with rc=%Rrc\n", rc);
379#endif
380 return rc;
381}
382
383
384#ifdef VBOX_WITH_GUEST_PROPS
385/**
386 * Reads a guest property.
387 *
388 * @return IPRT status code.
389 * @param hPAM PAM handle.
390 * @param uClientID Guest property service client ID.
391 * @param pszKey Key (name) of guest property to read.
392 * @param fReadOnly Indicates whether this key needs to be
393 * checked if it only can be read (and *not* written)
394 * by the guest.
395 * @param pszValue Buffer where to store the key's value.
396 * @param cbValue Size of buffer (in bytes).
397 */
398static int pam_vbox_read_prop(pam_handle_t *hPAM, uint32_t uClientID,
399 const char *pszKey, bool fReadOnly,
400 char *pszValue, size_t cbValue)
401{
402 AssertPtrReturn(hPAM, VERR_INVALID_POINTER);
403 AssertReturn(uClientID, VERR_INVALID_PARAMETER);
404 AssertPtrReturn(pszKey, VERR_INVALID_POINTER);
405 AssertPtrReturn(pszValue, VERR_INVALID_POINTER);
406
407 int rc;
408
409 uint64_t u64Timestamp = 0;
410 char *pszValTemp;
411 char *pszFlags = NULL;
412 /* The buffer for storing the data and its initial size. We leave a bit
413 * of space here in case the maximum values are raised. */
414 void *pvBuf = NULL;
415 uint32_t cbBuf = MAX_VALUE_LEN + MAX_FLAGS_LEN + _1K;
416
417 /* Because there is a race condition between our reading the size of a
418 * property and the guest updating it, we loop a few times here and
419 * hope. Actually this should never go wrong, as we are generous
420 * enough with buffer space. */
421 for (unsigned i = 0; i < 10; i++)
422 {
423 void *pvTmpBuf = RTMemRealloc(pvBuf, cbBuf);
424 if (pvTmpBuf)
425 {
426 pvBuf = pvTmpBuf;
427 rc = VbglR3GuestPropRead(uClientID, pszKey, pvBuf, cbBuf,
428 &pszValTemp, &u64Timestamp, &pszFlags,
429 &cbBuf);
430 }
431 else
432 rc = VERR_NO_MEMORY;
433
434 switch (rc)
435 {
436 case VERR_BUFFER_OVERFLOW:
437 {
438 /* Buffer too small, try it with a bigger one next time. */
439 cbBuf += _1K;
440 continue; /* Try next round. */
441 }
442
443 default:
444 break;
445 }
446
447 /* Everything except VERR_BUFFER_OVERLOW makes us bail out ... */
448 break;
449 }
450
451 if (RT_SUCCESS(rc))
452 {
453 /* Check security bits. */
454 if (pszFlags)
455 {
456 if ( fReadOnly
457 && !RTStrStr(pszFlags, "RDONLYGUEST"))
458 {
459 /* If we want a property which is read-only on the guest
460 * and it is *not* marked as such, deny access! */
461 pam_vbox_error(hPAM, "pam_vbox_read_prop: key \"%s\" should be read-only on guest but it is not\n",
462 pszKey);
463 rc = VERR_ACCESS_DENIED;
464 }
465 }
466 else /* No flags, no access! */
467 {
468 pam_vbox_error(hPAM, "pam_vbox_read_prop: key \"%s\" contains no/wrong flags (%s)\n",
469 pszKey, pszFlags);
470 rc = VERR_ACCESS_DENIED;
471 }
472
473 if (RT_SUCCESS(rc))
474 {
475 /* If everything went well copy property value to our destination buffer. */
476 if (!RTStrPrintf(pszValue, cbValue, "%s", pszValTemp))
477 {
478 pam_vbox_error(hPAM, "pam_vbox_read_prop: could not store value of key \"%s\"\n",
479 pszKey);
480 rc = VERR_INVALID_PARAMETER;
481 }
482
483 if (RT_SUCCESS(rc))
484 pam_vbox_log(hPAM, "pam_vbox_read_prop: read key \"%s\"=\"%s\"\n",
485 pszKey, pszValue);
486 }
487 }
488
489 pam_vbox_log(hPAM, "pam_vbox_read_prop: read key \"%s\" with rc=%Rrc\n",
490 pszKey, rc);
491 return rc;
492}
493
494
495/**
496 * Waits for a guest property to be changed.
497 *
498 * @return IPRT status code.
499 * @param hPAM PAM handle.
500 * @param uClientID Guest property service client ID.
501 * @param pszKey Key (name) of guest property to wait for.
502 * @param uTimeoutMS Timeout (in ms) to wait for the change. Specify
503 * RT_INDEFINITE_WAIT to wait indefinitly.
504 */
505static int pam_vbox_wait_prop(pam_handle_t *hPAM, uint32_t uClientID,
506 const char *pszKey, uint32_t uTimeoutMS)
507{
508 AssertPtrReturn(hPAM, VERR_INVALID_POINTER);
509 AssertReturn(uClientID, VERR_INVALID_PARAMETER);
510 AssertPtrReturn(pszKey, VERR_INVALID_POINTER);
511
512 int rc;
513
514 /* The buffer for storing the data and its initial size. We leave a bit
515 * of space here in case the maximum values are raised. */
516 void *pvBuf = NULL;
517 uint32_t cbBuf = MAX_NAME_LEN + MAX_VALUE_LEN + MAX_FLAGS_LEN + _1K;
518
519 for (int i = 0; i < 10; i++)
520 {
521 void *pvTmpBuf = RTMemRealloc(pvBuf, cbBuf);
522 if (pvTmpBuf)
523 {
524 char *pszName = NULL;
525 char *pszValue = NULL;
526 uint64_t u64TimestampOut = 0;
527 char *pszFlags = NULL;
528
529 pvBuf = pvTmpBuf;
530 rc = VbglR3GuestPropWait(uClientID, pszKey, pvBuf, cbBuf,
531 0 /* Last timestamp; just wait for next event */, uTimeoutMS,
532 &pszName, &pszValue, &u64TimestampOut,
533 &pszFlags, &cbBuf);
534 }
535 else
536 rc = VERR_NO_MEMORY;
537
538 if (rc == VERR_BUFFER_OVERFLOW)
539 {
540 /* Buffer too small, try it with a bigger one next time. */
541 cbBuf += _1K;
542 continue; /* Try next round. */
543 }
544
545 /* Everything except VERR_BUFFER_OVERLOW makes us bail out ... */
546 break;
547 }
548
549 return rc;
550}
551#endif
552
553/**
554 * Thread function waiting for credentials to arrive.
555 *
556 * @return IPRT status code.
557 * @param hThreadSelf Thread handle.
558 * @param pvUser Pointer to a PAMVBOXTHREAD structure providing
559 * required data used / set by the thread.
560 */
561static DECLCALLBACK(int) pam_vbox_wait_thread(RTTHREAD hThreadSelf, void *pvUser)
562{
563 RT_NOREF1(hThreadSelf);
564 PPAMVBOXTHREAD pUserData = (PPAMVBOXTHREAD)pvUser;
565 AssertPtr(pUserData);
566
567 int rc = VINF_SUCCESS;
568 /* Get current time stamp to later calculate rest of timeout left. */
569 uint64_t u64StartMS = RTTimeMilliTS();
570
571#ifdef VBOX_WITH_GUEST_PROPS
572 uint32_t uClientID = 0;
573 rc = VbglR3GuestPropConnect(&uClientID);
574 if (RT_FAILURE(rc))
575 {
576 pam_vbox_error(pUserData->hPAM, "pam_vbox_wait_thread: Unable to connect to guest property service, rc=%Rrc\n", rc);
577 }
578 else
579 {
580 pam_vbox_log(pUserData->hPAM, "pam_vbox_wait_thread: clientID=%u\n", uClientID);
581#endif
582 for (;;)
583 {
584#ifdef VBOX_WITH_GUEST_PROPS
585 if (uClientID)
586 {
587 rc = pam_vbox_wait_prop(pUserData->hPAM, uClientID,
588 "/VirtualBox/GuestAdd/PAM/CredsWaitAbort",
589 500 /* Wait 500ms, same as VBoxGINA/VBoxCredProv. */);
590 switch (rc)
591 {
592 case VINF_SUCCESS:
593 /* Somebody (guest/host) wants to abort waiting for credentials. */
594 break;
595
596 case VERR_INTERRUPTED:
597 pam_vbox_error(pUserData->hPAM, "pam_vbox_wait_thread: The abort notification request timed out or was interrupted\n");
598 break;
599
600 case VERR_TIMEOUT:
601 /* We did not receive an abort message within time. */
602 break;
603
604 case VERR_TOO_MUCH_DATA:
605 pam_vbox_error(pUserData->hPAM, "pam_vbox_wait_thread: Temporarily unable to get abort notification\n");
606 break;
607
608 default:
609 pam_vbox_error(pUserData->hPAM, "pam_vbox_wait_thread: The abort notification request failed with rc=%Rrc\n", rc);
610 break;
611 }
612
613 if (RT_SUCCESS(rc)) /* Abort waiting. */
614 {
615 pam_vbox_log(pUserData->hPAM, "pam_vbox_wait_thread: Got notification to abort waiting\n");
616 rc = VERR_CANCELLED;
617 break;
618 }
619 }
620#endif
621 if ( RT_SUCCESS(rc)
622 || rc == VERR_TIMEOUT)
623 {
624 rc = pam_vbox_check_creds(pUserData->hPAM);
625 if (RT_SUCCESS(rc))
626 {
627 /* Credentials retrieved. */
628 break; /* Thread no longer is required, bail out. */
629 }
630 else if (rc == VERR_NOT_FOUND)
631 {
632 /* No credentials found, but try next round (if there's
633 * time left for) ... */
634#ifndef VBOX_WITH_GUEST_PROPS
635 RTThreadSleep(500); /* Wait 500 ms. */
636#endif
637 }
638 else
639 break; /* Something bad happend ... */
640 }
641 else
642 break;
643
644 /* Calculate timeout value left after process has been started. */
645 uint64_t u64Elapsed = RTTimeMilliTS() - u64StartMS;
646 /* Is it time to bail out? */
647 if (pUserData->uTimeoutMS < u64Elapsed)
648 {
649 pam_vbox_log(pUserData->hPAM, "pam_vbox_wait_thread: Waiting thread has reached timeout (%dms), exiting ...\n",
650 pUserData->uTimeoutMS);
651 rc = VERR_TIMEOUT;
652 break;
653 }
654 }
655#ifdef VBOX_WITH_GUEST_PROPS
656 }
657 VbglR3GuestPropDisconnect(uClientID);
658#endif
659
660 /* Save result. */
661 pUserData->rc = rc; /** @todo Use ASMAtomicXXX? */
662
663 int rc2 = RTThreadUserSignal(RTThreadSelf());
664 AssertRC(rc2);
665
666 pam_vbox_log(pUserData->hPAM, "pam_vbox_wait_thread: Waiting thread returned with rc=%Rrc\n", rc);
667 return rc;
668}
669
670
671/**
672 * Waits for credentials to arrive by creating and waiting for a thread.
673 *
674 * @return IPRT status code.
675 * @param hPAM PAM handle.
676 * @param uClientID Guest property service client ID.
677 * @param pszKey Key (name) of guest property to wait for.
678 * @param uTimeoutMS Timeout (in ms) to wait for the change. Specify
679 * RT_INDEFINITE_WAIT to wait indefinitly.
680 */
681static int pam_vbox_wait_for_creds(pam_handle_t *hPAM, uint32_t uClientID, uint32_t uTimeoutMS)
682{
683 RT_NOREF1(uClientID);
684 PAMVBOXTHREAD threadData;
685 threadData.hPAM = hPAM;
686 threadData.uTimeoutMS = uTimeoutMS;
687
688 RTTHREAD threadWait;
689 int rc = RTThreadCreate(&threadWait, pam_vbox_wait_thread,
690 (void *)&threadData, 0,
691 RTTHREADTYPE_DEFAULT, 0 /* Flags */, "pam_vbox");
692 if (RT_SUCCESS(rc))
693 {
694 pam_vbox_log(hPAM, "pam_vbox_wait_for_creds: Waiting for credentials (%dms) ...\n", uTimeoutMS);
695 /* Wait for thread to initialize. */
696 /** @todo We can do something else here in the meantime later. */
697 rc = RTThreadUserWait(threadWait, RT_INDEFINITE_WAIT);
698 if (RT_SUCCESS(rc))
699 rc = threadData.rc; /* Get back thread result to take further actions. */
700 }
701 else
702 pam_vbox_error(hPAM, "pam_vbox_wait_for_creds: Creating thread failed with rc=%Rrc\n", rc);
703
704 pam_vbox_log(hPAM, "pam_vbox_wait_for_creds: Waiting for credentials returned with rc=%Rrc\n", rc);
705 return rc;
706}
707
708
709DECLEXPORT(int) pam_sm_authenticate(pam_handle_t *hPAM, int iFlags, int argc, const char **argv)
710{
711 RT_NOREF1(iFlags);
712
713 /* Parse arguments. */
714 for (int i = 0; i < argc; i++)
715 {
716 if (!RTStrICmp(argv[i], "debug"))
717 g_verbosity = 1;
718 else
719 pam_vbox_error(hPAM, "pam_vbox_authenticate: unknown command line argument \"%s\"\n", argv[i]);
720 }
721 pam_vbox_log(hPAM, "pam_vbox_authenticate called\n");
722
723 int rc = pam_vbox_init(hPAM);
724 if (RT_FAILURE(rc))
725 return PAM_SUCCESS; /* Jump out as early as we can to not mess around. */
726
727 bool fFallback = true;
728
729#ifdef VBOX_WITH_GUEST_PROPS
730 uint32_t uClientId;
731 rc = VbglR3GuestPropConnect(&uClientId);
732 if (RT_SUCCESS(rc))
733 {
734 char szVal[256];
735 rc = pam_vbox_read_prop(hPAM, uClientId,
736 "/VirtualBox/GuestAdd/PAM/CredsWait",
737 true /* Read-only on guest */,
738 szVal, sizeof(szVal));
739 if (RT_SUCCESS(rc))
740 {
741 /* All calls which are checked against rc2 are not critical, e.g. it does
742 * not matter if they succeed or not. */
743 uint32_t uTimeoutMS = RT_INDEFINITE_WAIT; /* Wait infinite by default. */
744 int rc2 = pam_vbox_read_prop(hPAM, uClientId,
745 "/VirtualBox/GuestAdd/PAM/CredsWaitTimeout",
746 true /* Read-only on guest */,
747 szVal, sizeof(szVal));
748 if (RT_SUCCESS(rc2))
749 {
750 uTimeoutMS = RTStrToUInt32(szVal);
751 if (!uTimeoutMS)
752 {
753 pam_vbox_error(hPAM, "pam_vbox_authenticate: invalid waiting timeout value specified, defaulting to infinite timeout\n");
754 uTimeoutMS = RT_INDEFINITE_WAIT;
755 }
756 else
757 uTimeoutMS = uTimeoutMS * 1000; /* Make ms out of s. */
758 }
759
760 rc2 = pam_vbox_read_prop(hPAM, uClientId,
761 "/VirtualBox/GuestAdd/PAM/CredsMsgWaiting",
762 true /* Read-only on guest */,
763 szVal, sizeof(szVal));
764 const char *pszWaitMsg = NULL;
765 if (RT_SUCCESS(rc2))
766 pszWaitMsg = szVal;
767
768 rc2 = vbox_set_msg(hPAM, 0 /* Info message */,
769 pszWaitMsg ? pszWaitMsg : "Waiting for credentials ...");
770 if (RT_FAILURE(rc2)) /* Not critical. */
771 pam_vbox_error(hPAM, "pam_vbox_authenticate: error setting waiting information message, rc=%Rrc\n", rc2);
772
773 if (RT_SUCCESS(rc))
774 {
775 /* Before we actuall wait for credentials just make sure we didn't already get credentials
776 * set so that we can skip waiting for them ... */
777 rc = pam_vbox_check_creds(hPAM);
778 if (rc == VERR_NOT_FOUND)
779 {
780 rc = pam_vbox_wait_for_creds(hPAM, uClientId, uTimeoutMS);
781 if (rc == VERR_TIMEOUT)
782 {
783 pam_vbox_log(hPAM, "pam_vbox_authenticate: no credentials given within time\n");
784
785 rc2 = pam_vbox_read_prop(hPAM, uClientId,
786 "/VirtualBox/GuestAdd/PAM/CredsMsgWaitTimeout",
787 true /* Read-only on guest */,
788 szVal, sizeof(szVal));
789 if (RT_SUCCESS(rc2))
790 {
791 rc2 = vbox_set_msg(hPAM, 0 /* Info message */, szVal);
792 AssertRC(rc2);
793 }
794 }
795 else if (rc == VERR_CANCELLED)
796 {
797 pam_vbox_log(hPAM, "pam_vbox_authenticate: waiting aborted\n");
798
799 rc2 = pam_vbox_read_prop(hPAM, uClientId,
800 "/VirtualBox/GuestAdd/PAM/CredsMsgWaitAbort",
801 true /* Read-only on guest */,
802 szVal, sizeof(szVal));
803 if (RT_SUCCESS(rc2))
804 {
805 rc2 = vbox_set_msg(hPAM, 0 /* Info message */, szVal);
806 AssertRC(rc2);
807 }
808 }
809 }
810
811 /* If we got here we don't need the fallback, so just deactivate it. */
812 fFallback = false;
813 }
814 }
815
816 VbglR3GuestPropDisconnect(uClientId);
817 }
818#endif /* VBOX_WITH_GUEST_PROPS */
819
820 if (fFallback)
821 {
822 pam_vbox_log(hPAM, "pam_vbox_authenticate: falling back to old method\n");
823
824 /* If anything went wrong in the code above we just do a credentials
825 * check like it was before: Try retrieving the stuff and authenticating. */
826 int rc2 = pam_vbox_check_creds(hPAM);
827 if (RT_SUCCESS(rc))
828 rc = rc2;
829 }
830
831 pam_vbox_shutdown(hPAM);
832
833 pam_vbox_log(hPAM, "pam_vbox_authenticate: overall result rc=%Rrc\n", rc);
834
835 /* Never report an error here because if no credentials from the host are available or something
836 * went wrong we then let do the authentication by the next module in the stack. */
837
838 /* We report success here because this is all we can do right now -- we passed the credentials
839 * to the next PAM module in the block above which then might do a shadow (like pam_unix/pam_unix2)
840 * password verification to "really" authenticate the user. */
841 return PAM_SUCCESS;
842}
843
844
845DECLEXPORT(int) pam_sm_setcred(pam_handle_t *hPAM, int iFlags, int argc, const char **argv)
846{
847 pam_vbox_log(hPAM, "pam_vbox_setcred called, iFlags=0x%x\n", iFlags);
848 for (int i = 0; i < argc; i++)
849 pam_vbox_log(hPAM, "pam_vbox_setcred: argv[%d] = %s\n", i, argv[i]);
850 return PAM_SUCCESS;
851}
852
853
854DECLEXPORT(int) pam_sm_acct_mgmt(pam_handle_t *hPAM, int iFlags, int argc, const char **argv)
855{
856 RT_NOREF3(iFlags, argc, argv);
857 pam_vbox_log(hPAM, "pam_vbox_acct_mgmt called\n");
858 return PAM_SUCCESS;
859}
860
861
862DECLEXPORT(int) pam_sm_open_session(pam_handle_t *hPAM, int iFlags, int argc, const char **argv)
863{
864 RT_NOREF3(iFlags, argc, argv);
865 pam_vbox_log(hPAM, "pam_vbox_open_session called\n");
866 RTPrintf("This session was provided by VirtualBox Guest Additions. Have a lot of fun!\n");
867 return PAM_SUCCESS;
868}
869
870
871DECLEXPORT(int) pam_sm_close_session(pam_handle_t *hPAM, int iFlags, int argc, const char **argv)
872{
873 RT_NOREF3(iFlags, argc, argv);
874 pam_vbox_log(hPAM, "pam_vbox_close_session called\n");
875 return PAM_SUCCESS;
876}
877
878
879DECLEXPORT(int) pam_sm_chauthtok(pam_handle_t *hPAM, int iFlags, int argc, const char **argv)
880{
881 RT_NOREF3(iFlags, argc, argv);
882 pam_vbox_log(hPAM, "pam_vbox_sm_chauthtok called\n");
883 return PAM_SUCCESS;
884}
885
886
887#ifdef DEBUG
888DECLEXPORT(void) RTAssertMsg1Weak(const char *pszExpr, unsigned uLine, const char *pszFile, const char *pszFunction)
889{
890 pam_vbox_log(g_pam_handle,
891 "\n!!Assertion Failed!!\n"
892 "Expression: %s\n"
893 "Location : %s(%d) %s\n",
894 pszExpr, pszFile, uLine, pszFunction);
895 RTAssertMsg1(pszExpr, uLine, pszFile, pszFunction);
896}
897#endif
898
Note: See TracBrowser for help on using the repository browser.

© 2023 Oracle
Contact – Privacy policy – Terms of Use