X-Git-Url: https://git.librecmc.org/?a=blobdiff_plain;f=loginutils%2Flogin.c;h=7a6f246adbf2b882ce6fc40bfd7ec9e4968fd394;hb=9f5a577a3241597cb5e7ba9f6df33c2e3c440e44;hp=b633a7feb5f66e38928b3008482087ce2f8924dc;hpb=d6e81c7762e20e3df4d12c5515354e4da3a451a8;p=oweals%2Fbusybox.git diff --git a/loginutils/login.c b/loginutils/login.c index b633a7feb..7a6f246ad 100644 --- a/loginutils/login.c +++ b/loginutils/login.c @@ -4,9 +4,9 @@ */ #include "libbb.h" +#include #include #include -#include #if ENABLE_SELINUX #include /* for is_selinux_enabled() */ @@ -15,8 +15,12 @@ #endif #if ENABLE_PAM -#include -#include +/* PAM may include . We may need to undefine bbox's stub define: */ +#undef setlocale +/* For some obscure reason, PAM is not in pam/xxx, but in security/xxx. + * Apparently they like to confuse people. */ +#include +#include static const struct pam_conv conv = { misc_conv, NULL @@ -48,7 +52,7 @@ static char* short_tty; * command line flags. */ -static void read_or_build_utent(struct utmp *utptr, int picky) +static void read_or_build_utent(struct utmp *utptr, int run_by_root) { struct utmp *ut; pid_t pid = getpid(); @@ -56,30 +60,33 @@ static void read_or_build_utent(struct utmp *utptr, int picky) setutent(); /* First, try to find a valid utmp entry for this process. */ - while ((ut = getutent())) - if (ut->ut_pid == pid && ut->ut_line[0] && ut->ut_id[0] && - (ut->ut_type == LOGIN_PROCESS || ut->ut_type == USER_PROCESS)) - break; + /* If there is one, just use it. */ + while ((ut = getutent()) != NULL) + if (ut->ut_pid == pid && ut->ut_line[0] && ut->ut_id[0] + && (ut->ut_type == LOGIN_PROCESS || ut->ut_type == USER_PROCESS) + ) { + *utptr = *ut; /* struct copy */ + if (run_by_root) /* why only for root? */ + memset(utptr->ut_host, 0, sizeof(utptr->ut_host)); + return; + } - /* If there is one, just use it, otherwise create a new one. */ - if (ut) { - *utptr = *ut; - } else { - if (picky) - bb_error_msg_and_die("no utmp entry found"); - - memset(utptr, 0, sizeof(*utptr)); - utptr->ut_type = LOGIN_PROCESS; - utptr->ut_pid = pid; - strncpy(utptr->ut_line, short_tty, sizeof(utptr->ut_line)); - /* This one is only 4 chars wide. Try to fit something - * remotely meaningful by skipping "tty"... */ - strncpy(utptr->ut_id, short_tty + 3, sizeof(utptr->ut_id)); - strncpy(utptr->ut_user, "LOGIN", sizeof(utptr->ut_user)); - utptr->ut_time = time(NULL); - } - if (!picky) /* root login */ - memset(utptr->ut_host, 0, sizeof(utptr->ut_host)); +// Why? Do we require non-root to exec login from another +// former login process (e.g. login shell)? Some login's have +// login shells as children, so it won't work... +// if (!run_by_root) +// bb_error_msg_and_die("no utmp entry found"); + + /* Otherwise create a new one. */ + memset(utptr, 0, sizeof(*utptr)); + utptr->ut_type = LOGIN_PROCESS; + utptr->ut_pid = pid; + strncpy(utptr->ut_line, short_tty, sizeof(utptr->ut_line)); + /* This one is only 4 chars wide. Try to fit something + * remotely meaningful by skipping "tty"... */ + strncpy(utptr->ut_id, short_tty + 3, sizeof(utptr->ut_id)); + strncpy(utptr->ut_user, "LOGIN", sizeof(utptr->ut_user)); + utptr->ut_tv.tv_sec = time(NULL); } /* @@ -92,7 +99,7 @@ static void write_utent(struct utmp *utptr, const char *username) { utptr->ut_type = USER_PROCESS; strncpy(utptr->ut_user, username, sizeof(utptr->ut_user)); - utptr->ut_time = time(NULL); + utptr->ut_tv.tv_sec = time(NULL); /* other fields already filled in by read_or_build_utent above */ setutent(); pututline(utptr); @@ -105,65 +112,107 @@ static void write_utent(struct utmp *utptr, const char *username) #endif } #else /* !ENABLE_FEATURE_UTMP */ -#define read_or_build_utent(utptr, picky) ((void)0) +#define read_or_build_utent(utptr, run_by_root) ((void)0) #define write_utent(utptr, username) ((void)0) #endif /* !ENABLE_FEATURE_UTMP */ #if ENABLE_FEATURE_NOLOGIN -static void die_if_nologin_and_non_root(int amroot) +static void die_if_nologin(void) { FILE *fp; int c; + int empty = 1; - if (access("/etc/nologin", F_OK)) + fp = fopen_for_read("/etc/nologin"); + if (!fp) /* assuming it does not exist */ return; - fp = fopen("/etc/nologin", "r"); - if (fp) { - while ((c = getc(fp)) != EOF) - putchar((c=='\n') ? '\r' : c); - fflush(stdout); - fclose(fp); - } else + while ((c = getc(fp)) != EOF) { + if (c == '\n') + bb_putchar('\r'); + bb_putchar(c); + empty = 0; + } + if (empty) puts("\r\nSystem closed for routine maintenance\r"); - if (!amroot) - exit(1); - puts("\r\n[Disconnect bypassed -- root login allowed]\r"); + + fclose(fp); + fflush_all(); + /* Users say that they do need this prior to exit: */ + tcdrain(STDOUT_FILENO); + exit(EXIT_FAILURE); } #else -static ALWAYS_INLINE void die_if_nologin_and_non_root(int amroot) {} +static ALWAYS_INLINE void die_if_nologin(void) {} #endif #if ENABLE_FEATURE_SECURETTY && !ENABLE_PAM static int check_securetty(void) { - FILE *fp; - int i; - char buf[256]; + char *buf = (char*)"/etc/securetty"; /* any non-NULL is ok */ + parser_t *parser = config_open2("/etc/securetty", fopen_for_read); + while (config_read(parser, &buf, 1, 1, "# \t", PARSE_NORMAL)) { + if (strcmp(buf, short_tty) == 0) + break; + buf = NULL; + } + config_close(parser); + /* buf != NULL here if config file was not found, empty + * or line was found which equals short_tty */ + return buf != NULL; +} +#else +static ALWAYS_INLINE int check_securetty(void) { return 1; } +#endif + +#if ENABLE_SELINUX +static void initselinux(char *username, char *full_tty, + security_context_t *user_sid) +{ + security_context_t old_tty_sid, new_tty_sid; - fp = fopen("/etc/securetty", "r"); - if (!fp) { - /* A missing securetty file is not an error. */ - return 1; + if (!is_selinux_enabled()) + return; + + if (get_default_context(username, NULL, user_sid)) { + bb_error_msg_and_die("can't get SID for %s", username); } - while (fgets(buf, sizeof(buf)-1, fp)) { - for (i = strlen(buf)-1; i >= 0; --i) { - if (!isspace(buf[i])) - break; - } - buf[++i] = '\0'; - if (!buf[0] || (buf[0] == '#')) - continue; - if (strcmp(buf, short_tty) == 0) { - fclose(fp); - return 1; - } + if (getfilecon(full_tty, &old_tty_sid) < 0) { + bb_perror_msg_and_die("getfilecon(%s) failed", full_tty); + } + if (security_compute_relabel(*user_sid, old_tty_sid, + SECCLASS_CHR_FILE, &new_tty_sid) != 0) { + bb_perror_msg_and_die("security_change_sid(%s) failed", full_tty); + } + if (setfilecon(full_tty, new_tty_sid) != 0) { + bb_perror_msg_and_die("chsid(%s, %s) failed", full_tty, new_tty_sid); + } +} +#endif + +#if ENABLE_LOGIN_SCRIPTS +static void run_login_script(struct passwd *pw, char *full_tty) +{ + char *t_argv[2]; + + t_argv[0] = getenv("LOGIN_PRE_SUID_SCRIPT"); + if (t_argv[0]) { + t_argv[1] = NULL; + xsetenv("LOGIN_TTY", full_tty); + xsetenv("LOGIN_USER", pw->pw_name); + xsetenv("LOGIN_UID", utoa(pw->pw_uid)); + xsetenv("LOGIN_GID", utoa(pw->pw_gid)); + xsetenv("LOGIN_SHELL", pw->pw_shell); + spawn_and_wait(t_argv); /* NOMMU-friendly */ + unsetenv("LOGIN_TTY"); + unsetenv("LOGIN_USER"); + unsetenv("LOGIN_UID"); + unsetenv("LOGIN_GID"); + unsetenv("LOGIN_SHELL"); } - fclose(fp); - return 0; } #else -static ALWAYS_INLINE int check_securetty(void) { return 1; } +void run_login_script(struct passwd *pw, char *full_tty); #endif static void get_username_or_die(char *buf, int size_buf) @@ -176,19 +225,22 @@ static void get_username_or_die(char *buf, int size_buf) /* skip whitespace */ do { c = getchar(); - if (c == EOF) exit(1); + if (c == EOF) + exit(EXIT_FAILURE); if (c == '\n') { - if (!--cntdown) exit(1); + if (!--cntdown) + exit(EXIT_FAILURE); goto prompt; } - } while (isspace(c)); + } while (isspace(c)); /* maybe isblank? */ *buf++ = c; if (!fgets(buf, size_buf-2, stdin)) - exit(1); + exit(EXIT_FAILURE); if (!strchr(buf, '\n')) - exit(1); - while (isgraph(*buf)) buf++; + exit(EXIT_FAILURE); + while ((unsigned char)*buf > ' ') + buf++; *buf = '\0'; } @@ -197,26 +249,29 @@ static void motd(void) int fd; fd = open(bb_path_motd_file, O_RDONLY); - if (fd) { - fflush(stdout); + if (fd >= 0) { + fflush_all(); bb_copyfd_eof(fd, STDOUT_FILENO); close(fd); } } -static void alarm_handler(int sig ATTRIBUTE_UNUSED) +static void alarm_handler(int sig UNUSED_PARAM) { /* This is the escape hatch! Poor serial line users and the like * arrive here when their connection is broken. * We don't want to block here */ ndelay_on(1); - ndelay_on(2); printf("\r\nLogin timed out after %d seconds\r\n", TIMEOUT); - exit(EXIT_SUCCESS); + fflush_all(); + /* unix API is brain damaged regarding O_NONBLOCK, + * we should undo it, or else we can affect other processes */ + ndelay_off(1); + _exit(EXIT_SUCCESS); } -int login_main(int argc, char **argv); -int login_main(int argc, char **argv) +int login_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE; +int login_main(int argc UNUSED_PARAM, char **argv) { enum { LOGIN_OPT_f = (1<<0), @@ -226,25 +281,32 @@ int login_main(int argc, char **argv) char *fromhost; char username[USERNAME_SIZE]; const char *tmp; - int amroot; + int run_by_root; unsigned opt; int count = 0; struct passwd *pw; - char *opt_host = NULL; - char *opt_user = NULL; - char full_tty[TTYNAME_SIZE]; - USE_SELINUX(security_context_t user_sid = NULL;) - USE_FEATURE_UTMP(struct utmp utent;) - USE_PAM(pam_handle_t *pamh;) - USE_PAM(int pamret;) - USE_PAM(const char *failed_msg;) + char *opt_host = opt_host; /* for compiler */ + char *opt_user = opt_user; /* for compiler */ + char *full_tty; + IF_SELINUX(security_context_t user_sid = NULL;) + IF_FEATURE_UTMP(struct utmp utent;) +#if ENABLE_PAM + int pamret; + pam_handle_t *pamh; + const char *pamuser; + const char *failed_msg; + struct passwd pwdstruct; + char pwdbuf[256]; +#endif - short_tty = full_tty; username[0] = '\0'; - amroot = (getuid() == 0); signal(SIGALRM, alarm_handler); alarm(TIMEOUT); + /* More of suid paranoia if called by non-root: */ + /* Clear dangerous stuff, set PATH */ + run_by_root = !sanitize_env_if_suid(); + /* Mandatory paranoia for suid applet: * ensure that fd# 0,1,2 are opened (at least to /dev/null) * and any extra open fd's are closed. @@ -253,81 +315,107 @@ int login_main(int argc, char **argv) opt = getopt32(argv, "f:h:p", &opt_user, &opt_host); if (opt & LOGIN_OPT_f) { - if (!amroot) + if (!run_by_root) bb_error_msg_and_die("-f is for root only"); safe_strncpy(username, opt_user, sizeof(username)); } - if (optind < argc) /* user from command line (getty) */ - safe_strncpy(username, argv[optind], sizeof(username)); + argv += optind; + if (argv[0]) /* user from command line (getty) */ + safe_strncpy(username, argv[0], sizeof(username)); /* Let's find out and memorize our tty */ - if (!isatty(0) || !isatty(1) || !isatty(2)) + if (!isatty(STDIN_FILENO) || !isatty(STDOUT_FILENO) || !isatty(STDERR_FILENO)) return EXIT_FAILURE; /* Must be a terminal */ - safe_strncpy(full_tty, "UNKNOWN", sizeof(full_tty)); - tmp = ttyname(0); - if (tmp) { - safe_strncpy(full_tty, tmp, sizeof(full_tty)); - if (strncmp(full_tty, "/dev/", 5) == 0) - short_tty = full_tty + 5; - } + full_tty = xmalloc_ttyname(STDIN_FILENO); + if (!full_tty) + full_tty = xstrdup("UNKNOWN"); + short_tty = full_tty; + if (strncmp(full_tty, "/dev/", 5) == 0) + short_tty += 5; - read_or_build_utent(&utent, !amroot); + read_or_build_utent(&utent, run_by_root); - if (opt_host) { - USE_FEATURE_UTMP( - safe_strncpy(utent.ut_host, opt_host, sizeof(utent.ut_host)); - ) + if (opt & LOGIN_OPT_h) { + IF_FEATURE_UTMP(safe_strncpy(utent.ut_host, opt_host, sizeof(utent.ut_host));) fromhost = xasprintf(" on '%s' from '%s'", short_tty, opt_host); - } else + } else { fromhost = xasprintf(" on '%s'", short_tty); + } /* Was breaking "login " from shell command line: */ /*bb_setpgrp();*/ - openlog(applet_name, LOG_PID | LOG_CONS | LOG_NOWAIT, LOG_AUTH); + openlog(applet_name, LOG_PID | LOG_CONS, LOG_AUTH); while (1) { + /* flush away any type-ahead (as getty does) */ + ioctl(0, TCFLSH, TCIFLUSH); + if (!username[0]) get_username_or_die(username, sizeof(username)); #if ENABLE_PAM pamret = pam_start("login", username, &conv, &pamh); if (pamret != PAM_SUCCESS) { - failed_msg = "pam_start"; + failed_msg = "start"; goto pam_auth_failed; } /* set TTY (so things like securetty work) */ pamret = pam_set_item(pamh, PAM_TTY, short_tty); if (pamret != PAM_SUCCESS) { - failed_msg = "pam_set_item(TTY)"; + failed_msg = "set_item(TTY)"; goto pam_auth_failed; } pamret = pam_authenticate(pamh, 0); - if (pamret == PAM_SUCCESS) { - char *pamuser; - /* check that the account is healthy. */ - pamret = pam_acct_mgmt(pamh, 0); - if (pamret != PAM_SUCCESS) { - failed_msg = "account setup"; - goto pam_auth_failed; - } - /* read user back */ - /* gcc: "dereferencing type-punned pointer breaks aliasing rules..." - * thus we use double cast */ - if (pam_get_item(pamh, PAM_USER, (const void **)(void*)&pamuser) != PAM_SUCCESS) { - failed_msg = "pam_get_item(USER)"; - goto pam_auth_failed; - } - safe_strncpy(username, pamuser, sizeof(username)); + if (pamret != PAM_SUCCESS) { + failed_msg = "authenticate"; + goto pam_auth_failed; + /* TODO: or just "goto auth_failed" + * since user seems to enter wrong password + * (in this case pamret == 7) + */ } - /* If we get here, the user was authenticated, and is - * granted access. */ - pw = getpwnam(username); - if (pw) - break; - goto auth_failed; + /* check that the account is healthy */ + pamret = pam_acct_mgmt(pamh, 0); + if (pamret != PAM_SUCCESS) { + failed_msg = "acct_mgmt"; + goto pam_auth_failed; + } + /* read user back */ + pamuser = NULL; + /* gcc: "dereferencing type-punned pointer breaks aliasing rules..." + * thus we cast to (void*) */ + if (pam_get_item(pamh, PAM_USER, (void*)&pamuser) != PAM_SUCCESS) { + failed_msg = "get_item(USER)"; + goto pam_auth_failed; + } + if (!pamuser || !pamuser[0]) + goto auth_failed; + safe_strncpy(username, pamuser, sizeof(username)); + /* Don't use "pw = getpwnam(username);", + * PAM is said to be capable of destroying static storage + * used by getpwnam(). We are using safe(r) function */ + pw = NULL; + getpwnam_r(username, &pwdstruct, pwdbuf, sizeof(pwdbuf), &pw); + if (!pw) + goto auth_failed; + pamret = pam_open_session(pamh, 0); + if (pamret != PAM_SUCCESS) { + failed_msg = "open_session"; + goto pam_auth_failed; + } + pamret = pam_setcred(pamh, PAM_ESTABLISH_CRED); + if (pamret != PAM_SUCCESS) { + failed_msg = "setcred"; + goto pam_auth_failed; + } + break; /* success, continue login process */ + pam_auth_failed: - bb_error_msg("%s failed: %s", failed_msg, pam_strerror(pamh, pamret)); + /* syslog, because we don't want potential attacker + * to know _why_ login failed */ + syslog(LOG_WARNING, "pam_%s call failed: %s (%d)", failed_msg, + pam_strerror(pamh, pamret), pamret); safe_strncpy(username, "UNKNOWN", sizeof(username)); #else /* not PAM */ pw = getpwnam(username); @@ -356,6 +444,7 @@ int login_main(int argc, char **argv) auth_failed: opt &= ~LOGIN_OPT_f; bb_do_delay(FAIL_DELAY); + /* TODO: doesn't sound like correct English phrase to me */ puts("Login incorrect"); if (++count == 3) { syslog(LOG_WARNING, "invalid password for '%s'%s", @@ -363,73 +452,42 @@ int login_main(int argc, char **argv) return EXIT_FAILURE; } username[0] = '\0'; - } + } /* while (1) */ alarm(0); - die_if_nologin_and_non_root(pw->pw_uid == 0); + /* We can ignore /etc/nologin if we are logging in as root, + * it doesn't matter whether we are run by root or not */ + if (pw->pw_uid != 0) + die_if_nologin(); write_utent(&utent, username); -#if ENABLE_SELINUX - if (is_selinux_enabled()) { - security_context_t old_tty_sid, new_tty_sid; + IF_SELINUX(initselinux(username, full_tty, &user_sid)); - if (get_default_context(username, NULL, &user_sid)) { - bb_error_msg_and_die("cannot get SID for %s", - username); - } - if (getfilecon(full_tty, &old_tty_sid) < 0) { - bb_perror_msg_and_die("getfilecon(%s) failed", - full_tty); - } - if (security_compute_relabel(user_sid, old_tty_sid, - SECCLASS_CHR_FILE, &new_tty_sid) != 0) { - bb_perror_msg_and_die("security_change_sid(%s) failed", - full_tty); - } - if (setfilecon(full_tty, new_tty_sid) != 0) { - bb_perror_msg_and_die("chsid(%s, %s) failed", - full_tty, new_tty_sid); - } - } -#endif /* Try these, but don't complain if they fail. * _f_chown is safe wrt race t=ttyname(0);...;chown(t); */ fchown(0, pw->pw_uid, pw->pw_gid); fchmod(0, 0600); - if (ENABLE_LOGIN_SCRIPTS) { - char *t_argv[2]; - - t_argv[0] = getenv("LOGIN_PRE_SUID_SCRIPT"); - if (t_argv[0]) { - t_argv[1] = NULL; - xsetenv("LOGIN_TTY", full_tty); - xsetenv("LOGIN_USER", pw->pw_name); - xsetenv("LOGIN_UID", utoa(pw->pw_uid)); - xsetenv("LOGIN_GID", utoa(pw->pw_gid)); - xsetenv("LOGIN_SHELL", pw->pw_shell); - xspawn(t_argv); /* NOMMU-friendly */ - /* All variables are unset by setup_environment */ - wait(NULL); - } - } + /* We trust environment only if we run by root */ + if (ENABLE_LOGIN_SCRIPTS && run_by_root) + run_login_script(pw, full_tty); change_identity(pw); tmp = pw->pw_shell; if (!tmp || !*tmp) tmp = DEFAULT_SHELL; - setup_environment(tmp, 1, !(opt & LOGIN_OPT_p), pw); + /* setup_environment params: shell, clear_env, change_env, pw */ + setup_environment(tmp, !(opt & LOGIN_OPT_p), 1, pw); motd(); if (pw->pw_uid == 0) syslog(LOG_INFO, "root login%s", fromhost); -#if ENABLE_SELINUX + /* well, a simple setexeccon() here would do the job as well, * but let's play the game for now */ - set_current_security_context(user_sid); -#endif + IF_SELINUX(set_current_security_context(user_sid);) // util-linux login also does: // /* start new session */ @@ -440,17 +498,20 @@ int login_main(int argc, char **argv) // bb_setpgrp(); // If this stuff is really needed, add it and explain why! - /* set signals to defaults */ - signal(SIGALRM, SIG_DFL); + /* Set signals to defaults */ + /* Non-ignored signals revert to SIG_DFL on exec anyway */ + /*signal(SIGALRM, SIG_DFL);*/ + /* Is this correct? This way user can ctrl-c out of /etc/profile, * potentially creating security breach (tested with bash 3.0). * But without this, bash 3.0 will not enable ctrl-c either. * Maybe bash is buggy? * Need to find out what standards say about /bin/login - - * should it leave SIGINT etc enabled or disabled? */ + * should we leave SIGINT etc enabled or disabled? */ signal(SIGINT, SIG_DFL); - run_shell(tmp, 1, 0, 0); /* exec the shell finally */ + /* Exec login shell with no additional parameters */ + run_shell(tmp, 1, NULL, NULL); - return EXIT_FAILURE; + /* return EXIT_FAILURE; - not reached */ }