Home | History | Annotate | Line # | Download | only in pam_chroot 
      1 /*	$NetBSD: pam_chroot.c,v 1.5 2012/01/03 19:02:54 christos Exp $	*/
      2 
      3 /*-
      4  * Copyright (c) 2003 Networks Associates Technology, Inc.
      5  * All rights reserved.
      6  *
      7  * This software was developed for the FreeBSD Project by ThinkSec AS and
      8  * NAI Labs, the Security Research Division of Network Associates, Inc.
      9  * under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
     10  * DARPA CHATS research program.
     11  *
     12  * Redistribution and use in source and binary forms, with or without
     13  * modification, are permitted provided that the following conditions
     14  * are met:
     15  * 1. Redistributions of source code must retain the above copyright
     16  *    notice, this list of conditions and the following disclaimer.
     17  * 2. Redistributions in binary form must reproduce the above copyright
     18  *    notice, this list of conditions and the following disclaimer in the
     19  *    documentation and/or other materials provided with the distribution.
     20  * 3. The name of the author may not be used to endorse or promote
     21  *    products derived from this software without specific prior written
     22  *    permission.
     23  *
     24  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
     25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
     28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     34  * SUCH DAMAGE.
     35  */
     36 
     37 #include <sys/cdefs.h>
     38 #ifdef __FreeBSD__
     39 __FBSDID("$FreeBSD: src/lib/libpam/modules/pam_chroot/pam_chroot.c,v 1.3 2003/04/30 00:40:24 des Exp $");
     40 #else
     41 __RCSID("$NetBSD: pam_chroot.c,v 1.5 2012/01/03 19:02:54 christos Exp $");
     42 #endif
     43 
     44 #include <sys/param.h>
     45 
     46 #include <pwd.h>
     47 #include <stdio.h>
     48 #include <string.h>
     49 #include <errno.h>
     50 #include <unistd.h>
     51 
     52 #define PAM_SM_SESSION
     53 
     54 #include <security/pam_appl.h>
     55 #include <security/pam_modules.h>
     56 #include <security/openpam.h>
     57 
     58 PAM_EXTERN int
     59 pam_sm_open_session(pam_handle_t *pamh, int flags __unused,
     60     int argc __unused, const char *argv[] __unused)
     61 {
     62 	const char *dir, *end, *cwd, *user;
     63 	struct passwd *pwd, pwres;
     64 	char buf[PATH_MAX];
     65 	char pwbuf[1024];
     66 
     67 	if (pam_get_user(pamh, &user, NULL) != PAM_SUCCESS ||
     68 	    user == NULL ||
     69 	    getpwnam_r(user, &pwres, pwbuf, sizeof(pwbuf), &pwd) != 0 ||
     70 	    pwd == NULL)
     71 		return (PAM_SESSION_ERR);
     72 	if (pwd->pw_uid == 0 && !openpam_get_option(pamh, "also_root"))
     73 		return (PAM_SUCCESS);
     74 	if (pwd->pw_dir == NULL)
     75 		return (PAM_SESSION_ERR);
     76 	if ((end = strstr(pwd->pw_dir, "/./")) != NULL) {
     77 		if (snprintf(buf, sizeof(buf), "%.*s",
     78 		    (int)(end - pwd->pw_dir), pwd->pw_dir) > (int)sizeof(buf)) {
     79 			openpam_log(PAM_LOG_ERROR,
     80 			    "%s's home directory is too long", user);
     81 			return (PAM_SESSION_ERR);
     82 		}
     83 		dir = buf;
     84 		cwd = end + 2;
     85 	} else if ((dir = openpam_get_option(pamh, "dir")) != NULL) {
     86 		if ((cwd = openpam_get_option(pamh, "cwd")) == NULL)
     87 			cwd = "/";
     88 	} else {
     89 		if (openpam_get_option(pamh, "always")) {
     90 			openpam_log(PAM_LOG_ERROR,
     91 			    "%s has no chroot directory", user);
     92 			return (PAM_SESSION_ERR);
     93 		}
     94 		return (PAM_SUCCESS);
     95 	}
     96 
     97 	openpam_log(PAM_LOG_DEBUG, "chrooting %s to %s", dir, user);
     98 
     99 	if (chroot(dir) == -1) {
    100 		openpam_log(PAM_LOG_ERROR, "chroot(): %s", strerror(errno));
    101 		return (PAM_SESSION_ERR);
    102 	}
    103 	if (chdir(cwd) == -1) {
    104 		openpam_log(PAM_LOG_ERROR, "chdir(): %s", strerror(errno));
    105 		return (PAM_SESSION_ERR);
    106 	}
    107 	pam_setenv(pamh, "HOME", cwd, 1);
    108 	return (PAM_SUCCESS);
    109 }
    110 
    111 PAM_EXTERN int
    112 pam_sm_close_session(pam_handle_t *pamh __unused, int flags __unused,
    113     int argc __unused, const char *argv[] __unused)
    114 {
    115 
    116 	return (PAM_SUCCESS);
    117 }
    118 
    119 PAM_MODULE_ENTRY("pam_chroot");
    120