src/shared/ask-password-api.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include <errno.h>
   4 #include <fcntl.h>
   5 #include <inttypes.h>
   6 #include <limits.h>
   7 #include <stdbool.h>
   8 #include <stddef.h>
   9 #include <stdint.h>
  10 #include <stdio.h>
  11 #include <stdlib.h>
  12 #include <sys/inotify.h>
  13 #include <sys/signalfd.h>
  14 #include <sys/stat.h>
  15 #include <sys/time.h>
  16 #include <sys/uio.h>
  17 #include <sys/un.h>
  18 #include <termios.h>
  19 #include <unistd.h>
  20
  21 #include "alloc-util.h"
  22 #include "ask-password-api.h"
  23 #include "creds-util.h"
  24 #include "fd-util.h"
  25 #include "fileio.h"
  26 #include "format-util.h"
  27 #include "fs-util.h"
  28 #include "glyph-util.h"
  29 #include "io-util.h"
  30 #include "iovec-util.h"
  31 #include "keyring-util.h"
  32 #include "log.h"
  33 #include "macro.h"
  34 #include "memory-util.h"
  35 #include "missing_syscall.h"
  36 #include "mkdir-label.h"
  37 #include "nulstr-util.h"
  38 #include "plymouth-util.h"
  39 #include "process-util.h"
  40 #include "random-util.h"
  41 #include "signal-util.h"
  42 #include "socket-util.h"
  43 #include "string-util.h"
  44 #include "strv.h"
  45 #include "terminal-util.h"
  46 #include "time-util.h"
  47 #include "tmpfile-util.h"
  48 #include "umask-util.h"
  49 #include "utf8.h"
  50
  51 #define KEYRING_TIMEOUT_USEC ((5 * USEC_PER_MINUTE) / 2)
  52
  53 static int lookup_key(const char *keyname, key_serial_t *ret) {
  54         key_serial_t serial;
  55
  56         assert(keyname);
  57         assert(ret);
  58
  59         serial = request_key("user", keyname, NULL, 0);
  60         if (serial == -1)
  61                 return negative_errno();
  62
  63         *ret = serial;
  64         return 0;
  65 }
  66
  67 static int retrieve_key(key_serial_t serial, char ***ret) {
  68         _cleanup_(erase_and_freep) void *p = NULL;
  69         char **l;
  70         size_t n;
  71         int r;
  72
  73         assert(ret);
  74
  75         r = keyring_read(serial, &p, &n);
  76         if (r < 0)
  77                 return r;
  78
  79         l = strv_parse_nulstr(p, n);
  80         if (!l)
  81                 return -ENOMEM;
  82
  83         *ret = l;
  84         return 0;
  85 }
  86
  87 static int add_to_keyring(const char *keyname, AskPasswordFlags flags, char **passwords) {
  88         _cleanup_strv_free_erase_ char **l = NULL;
  89         _cleanup_(erase_and_freep) char *p = NULL;
  90         key_serial_t serial;
  91         size_t n;
  92         int r;
  93
  94         assert(keyname);
  95
  96         if (!FLAGS_SET(flags, ASK_PASSWORD_PUSH_CACHE))
  97                 return 0;
  98         if (strv_isempty(passwords))
  99                 return 0;
 100
 101         r = lookup_key(keyname, &serial);
 102         if (r >= 0) {
 103                 r = retrieve_key(serial, &l);
 104                 if (r < 0)
 105                         return r;
 106         } else if (r != -ENOKEY)
 107                 return r;
 108
 109         r = strv_extend_strv(&l, passwords, true);
 110         if (r <= 0)
 111                 return r;
 112
 113         r = strv_make_nulstr(l, &p, &n);
 114         if (r < 0)
 115                 return r;
 116
 117         /* chop off the final NUL byte. We do this because we want to use the separator NUL bytes only if we
 118          * have multiple passwords. */
 119         n = LESS_BY(n, (size_t) 1);
 120
 121         serial = add_key("user", keyname, p, n, KEY_SPEC_USER_KEYRING);
 122         if (serial == -1)
 123                 return -errno;
 124
 125         if (keyctl(KEYCTL_SET_TIMEOUT,
 126                    (unsigned long) serial,
 127                    (unsigned long) DIV_ROUND_UP(KEYRING_TIMEOUT_USEC, USEC_PER_SEC), 0, 0) < 0)
 128                 log_debug_errno(errno, "Failed to adjust kernel keyring key timeout: %m");
 129
 130         /* Tell everyone to check the keyring */
 131         (void) touch("/run/systemd/ask-password");
 132
 133         log_debug("Added key to kernel keyring as %" PRIi32 ".", serial);
 134
 135         return 1;
 136 }
 137
 138 static int add_to_keyring_and_log(const char *keyname, AskPasswordFlags flags, char **passwords) {
 139         int r;
 140
 141         assert(keyname);
 142
 143         r = add_to_keyring(keyname, flags, passwords);
 144         if (r < 0)
 145                 return log_debug_errno(r, "Failed to add password to kernel keyring: %m");
 146
 147         return 0;
 148 }
 149
 150 static int ask_password_keyring(const char *keyname, AskPasswordFlags flags, char ***ret) {
 151
 152         key_serial_t serial;
 153         int r;
 154
 155         assert(keyname);
 156         assert(ret);
 157
 158         if (!FLAGS_SET(flags, ASK_PASSWORD_ACCEPT_CACHED))
 159                 return -EUNATCH;
 160
 161         r = lookup_key(keyname, &serial);
 162         if (ERRNO_IS_NEG_NOT_SUPPORTED(r) || r == -EPERM)
 163                 /* When retrieving, the distinction between "kernel or container manager don't support or
 164                  * allow this" and "no matching key known" doesn't matter. Note that we propagate EACCESS
 165                  * here (even if EPERM not) since that is used if the keyring is available, but we lack
 166                  * access to the key. */
 167                 return -ENOKEY;
 168         if (r < 0)
 169                 return r;
 170
 171         return retrieve_key(serial, ret);
 172 }
 173
 174 static int backspace_chars(int ttyfd, size_t p) {
 175         if (ttyfd < 0)
 176                 return 0;
 177
 178         _cleanup_free_ char *buf = malloc_multiply(3, p);
 179         if (!buf)
 180                 return log_oom();
 181
 182         for (size_t i = 0; i < p; i++)
 183                 memcpy(buf + 3 * i, "\b \b", 3);
 184
 185         return loop_write(ttyfd, buf, 3 * p);
 186 }
 187
 188 static int backspace_string(int ttyfd, const char *str) {
 189         assert(str);
 190
 191         /* Backspaces through enough characters to entirely undo printing of the specified string. */
 192
 193         if (ttyfd < 0)
 194                 return 0;
 195
 196         size_t m = utf8_n_codepoints(str);
 197         if (m == SIZE_MAX)
 198                 m = strlen(str); /* Not a valid UTF-8 string? If so, let's backspace the number of bytes
 199                                   * output. Most likely this happened because we are not in a UTF-8 locale,
 200                                   * and in that case that is the correct thing to do. And even if it's not,
 201                                   * terminals tend to stop backspacing at the leftmost column, hence
 202                                   * backspacing too much should be mostly OK. */
 203
 204         return backspace_chars(ttyfd, m);
 205 }
 206
 207 int ask_password_plymouth(
 208                 const char *message,
 209                 usec_t until,
 210                 AskPasswordFlags flags,
 211                 const char *flag_file,
 212                 char ***ret) {
 213
 214         _cleanup_close_ int fd = -EBADF, notify = -EBADF;
 215         _cleanup_free_ char *packet = NULL;
 216         ssize_t k;
 217         int r, n;
 218         struct pollfd pollfd[2] = {};
 219         char buffer[LINE_MAX];
 220         size_t p = 0;
 221         enum {
 222                 POLL_SOCKET,
 223                 POLL_INOTIFY
 224         };
 225
 226         assert(ret);
 227
 228         if (!message)
 229                 message = "Password:";
 230
 231         if (flag_file) {
 232                 notify = inotify_init1(IN_CLOEXEC|IN_NONBLOCK);
 233                 if (notify < 0)
 234                         return -errno;
 235
 236                 if (inotify_add_watch(notify, flag_file, IN_ATTRIB) < 0) /* for the link count */
 237                         return -errno;
 238         }
 239
 240         fd = plymouth_connect(SOCK_NONBLOCK);
 241         if (fd < 0)
 242                 return fd;
 243
 244         if (FLAGS_SET(flags, ASK_PASSWORD_ACCEPT_CACHED)) {
 245                 packet = strdup("c");
 246                 n = 1;
 247         } else if (asprintf(&packet, "*\002%c%s%n", (int) (strlen(message) + 1), message, &n) < 0)
 248                 packet = NULL;
 249         if (!packet)
 250                 return -ENOMEM;
 251
 252         r = loop_write_full(fd, packet, n + 1, USEC_INFINITY);
 253         if (r < 0)
 254                 return r;
 255
 256         CLEANUP_ERASE(buffer);
 257
 258         pollfd[POLL_SOCKET].fd = fd;
 259         pollfd[POLL_SOCKET].events = POLLIN;
 260         pollfd[POLL_INOTIFY].fd = notify;
 261         pollfd[POLL_INOTIFY].events = POLLIN;
 262
 263         for (;;) {
 264                 usec_t timeout;
 265
 266                 if (until > 0)
 267                         timeout = usec_sub_unsigned(until, now(CLOCK_MONOTONIC));
 268                 else
 269                         timeout = USEC_INFINITY;
 270
 271                 if (flag_file && access(flag_file, F_OK) < 0)
 272                         return -errno;
 273
 274                 r = ppoll_usec(pollfd, notify >= 0 ? 2 : 1, timeout);
 275                 if (r == -EINTR)
 276                         continue;
 277                 if (r < 0)
 278                         return r;
 279                 if (r == 0)
 280                         return -ETIME;
 281
 282                 if (notify >= 0 && pollfd[POLL_INOTIFY].revents != 0)
 283                         (void) flush_fd(notify);
 284
 285                 if (pollfd[POLL_SOCKET].revents == 0)
 286                         continue;
 287
 288                 k = read(fd, buffer + p, sizeof(buffer) - p);
 289                 if (k < 0) {
 290                         if (ERRNO_IS_TRANSIENT(errno))
 291                                 continue;
 292
 293                         return -errno;
 294                 }
 295                 if (k == 0)
 296                         return -EIO;
 297
 298                 p += k;
 299
 300                 if (buffer[0] == 5) {
 301
 302                         if (FLAGS_SET(flags, ASK_PASSWORD_ACCEPT_CACHED)) {
 303                                 /* Hmm, first try with cached
 304                                  * passwords failed, so let's retry
 305                                  * with a normal password request */
 306                                 packet = mfree(packet);
 307
 308                                 if (asprintf(&packet, "*\002%c%s%n", (int) (strlen(message) + 1), message, &n) < 0)
 309                                         return -ENOMEM;
 310
 311                                 r = loop_write_full(fd, packet, n + 1, USEC_INFINITY);
 312                                 if (r < 0)
 313                                         return r;
 314
 315                                 flags &= ~ASK_PASSWORD_ACCEPT_CACHED;
 316                                 p = 0;
 317                                 continue;
 318                         }
 319
 320                         /* No password, because UI not shown */
 321                         return -ENOENT;
 322
 323                 } else if (IN_SET(buffer[0], 2, 9)) {
 324                         uint32_t size;
 325                         char **l;
 326
 327                         /* One or more answers */
 328                         if (p < 5)
 329                                 continue;
 330
 331                         memcpy(&size, buffer+1, sizeof(size));
 332                         size = le32toh(size);
 333                         if (size + 5 > sizeof(buffer))
 334                                 return -EIO;
 335
 336                         if (p-5 < size)
 337                                 continue;
 338
 339                         l = strv_parse_nulstr(buffer + 5, size);
 340                         if (!l)
 341                                 return -ENOMEM;
 342
 343                         *ret = l;
 344                         break;
 345
 346                 } else
 347                         /* Unknown packet */
 348                         return -EIO;
 349         }
 350
 351         return 0;
 352 }
 353
 354 #define NO_ECHO "(no echo) "
 355 #define PRESS_TAB "(press TAB for no echo) "
 356 #define SKIPPED "(skipped)"
 357
 358 int ask_password_tty(
 359                 int ttyfd,
 360                 const char *message,
 361                 const char *keyname,
 362                 usec_t until,
 363                 AskPasswordFlags flags,
 364                 const char *flag_file,
 365                 char ***ret) {
 366
 367         enum {
 368                 POLL_TTY,
 369                 POLL_INOTIFY,
 370                 _POLL_MAX,
 371         };
 372
 373         bool reset_tty = false, dirty = false, use_color = false, press_tab_visible = false;
 374         _cleanup_close_ int cttyfd = -EBADF, notify = -EBADF;
 375         struct termios old_termios, new_termios;
 376         char passphrase[LINE_MAX + 1] = {}, *x;
 377         _cleanup_strv_free_erase_ char **l = NULL;
 378         struct pollfd pollfd[_POLL_MAX];
 379         size_t p = 0, codepoint = 0;
 380         int r;
 381
 382         assert(ret);
 383
 384         if (FLAGS_SET(flags, ASK_PASSWORD_NO_TTY))
 385                 return -EUNATCH;
 386
 387         if (!message)
 388                 message = "Password:";
 389
 390         if (!FLAGS_SET(flags, ASK_PASSWORD_HIDE_EMOJI) && emoji_enabled())
 391                 message = strjoina(special_glyph(SPECIAL_GLYPH_LOCK_AND_KEY), " ", message);
 392
 393         if (flag_file || (FLAGS_SET(flags, ASK_PASSWORD_ACCEPT_CACHED) && keyname)) {
 394                 notify = inotify_init1(IN_CLOEXEC|IN_NONBLOCK);
 395                 if (notify < 0)
 396                         return -errno;
 397         }
 398         if (flag_file) {
 399                 if (inotify_add_watch(notify, flag_file, IN_ATTRIB /* for the link count */) < 0)
 400                         return -errno;
 401         }
 402         if (FLAGS_SET(flags, ASK_PASSWORD_ACCEPT_CACHED) && keyname) {
 403                 r = ask_password_keyring(keyname, flags, ret);
 404                 if (r >= 0)
 405                         return 0;
 406                 else if (r != -ENOKEY)
 407                         return r;
 408
 409                 if (inotify_add_watch(notify, "/run/systemd/ask-password", IN_ATTRIB /* for mtime */) < 0)
 410                         return -errno;
 411         }
 412
 413         CLEANUP_ERASE(passphrase);
 414
 415         /* If the caller didn't specify a TTY, then use the controlling tty, if we can. */
 416         if (ttyfd < 0)
 417                 ttyfd = cttyfd = open("/dev/tty", O_RDWR|O_NOCTTY|O_CLOEXEC);
 418
 419         if (ttyfd >= 0) {
 420                 if (tcgetattr(ttyfd, &old_termios) < 0)
 421                         return -errno;
 422
 423                 if (FLAGS_SET(flags, ASK_PASSWORD_CONSOLE_COLOR))
 424                         use_color = dev_console_colors_enabled();
 425                 else
 426                         use_color = colors_enabled();
 427
 428                 if (use_color)
 429                         (void) loop_write(ttyfd, ANSI_HIGHLIGHT, SIZE_MAX);
 430
 431                 (void) loop_write(ttyfd, message, SIZE_MAX);
 432                 (void) loop_write(ttyfd, " ", 1);
 433
 434                 if (!FLAGS_SET(flags, ASK_PASSWORD_SILENT) && !FLAGS_SET(flags, ASK_PASSWORD_ECHO)) {
 435                         if (use_color)
 436                                 (void) loop_write(ttyfd, ansi_grey(), SIZE_MAX);
 437
 438                         (void) loop_write(ttyfd, PRESS_TAB, SIZE_MAX);
 439                         press_tab_visible = true;
 440                 }
 441
 442                 if (use_color)
 443                         (void) loop_write(ttyfd, ANSI_NORMAL, SIZE_MAX);
 444
 445                 new_termios = old_termios;
 446                 termios_disable_echo(&new_termios);
 447
 448                 r = RET_NERRNO(tcsetattr(ttyfd, TCSADRAIN, &new_termios));
 449                 if (r < 0)
 450                         goto finish;
 451
 452                 reset_tty = true;
 453         }
 454
 455         pollfd[POLL_TTY] = (struct pollfd) {
 456                 .fd = ttyfd >= 0 ? ttyfd : STDIN_FILENO,
 457                 .events = POLLIN,
 458         };
 459         pollfd[POLL_INOTIFY] = (struct pollfd) {
 460                 .fd = notify,
 461                 .events = POLLIN,
 462         };
 463
 464         for (;;) {
 465                 _cleanup_(erase_char) char c;
 466                 usec_t timeout;
 467                 ssize_t n;
 468
 469                 if (until > 0)
 470                         timeout = usec_sub_unsigned(until, now(CLOCK_MONOTONIC));
 471                 else
 472                         timeout = USEC_INFINITY;
 473
 474                 if (flag_file) {
 475                         r = RET_NERRNO(access(flag_file, F_OK));
 476                         if (r < 0)
 477                                 goto finish;
 478                 }
 479
 480                 r = ppoll_usec(pollfd, notify >= 0 ? 2 : 1, timeout);
 481                 if (r == -EINTR)
 482                         continue;
 483                 if (r < 0)
 484                         goto finish;
 485                 if (r == 0) {
 486                         r = -ETIME;
 487                         goto finish;
 488                 }
 489
 490                 if (notify >= 0 && pollfd[POLL_INOTIFY].revents != 0 && keyname) {
 491                         (void) flush_fd(notify);
 492
 493                         r = ask_password_keyring(keyname, flags, ret);
 494                         if (r >= 0) {
 495                                 r = 0;
 496                                 goto finish;
 497                         } else if (r != -ENOKEY)
 498                                 goto finish;
 499                 }
 500
 501                 if (pollfd[POLL_TTY].revents == 0)
 502                         continue;
 503
 504                 n = read(ttyfd >= 0 ? ttyfd : STDIN_FILENO, &c, 1);
 505                 if (n < 0) {
 506                         if (ERRNO_IS_TRANSIENT(errno))
 507                                 continue;
 508
 509                         r = -errno;
 510                         goto finish;
 511
 512                 }
 513
 514                 if (press_tab_visible) {
 515                         assert(ttyfd >= 0);
 516                         backspace_chars(ttyfd, strlen(PRESS_TAB));
 517                         press_tab_visible = false;
 518                 }
 519
 520                 /* We treat EOF, newline and NUL byte all as valid end markers */
 521                 if (n == 0 || c == '\n' || c == 0)
 522                         break;
 523
 524                 if (c == 4) { /* C-d also known as EOT */
 525                         if (ttyfd >= 0)
 526                                 (void) loop_write(ttyfd, SKIPPED, SIZE_MAX);
 527
 528                         goto skipped;
 529                 }
 530
 531                 if (c == 21) { /* C-u */
 532
 533                         if (!FLAGS_SET(flags, ASK_PASSWORD_SILENT))
 534                                 (void) backspace_string(ttyfd, passphrase);
 535
 536                         explicit_bzero_safe(passphrase, sizeof(passphrase));
 537                         p = codepoint = 0;
 538
 539                 } else if (IN_SET(c, '\b', 127)) {
 540
 541                         if (p > 0) {
 542                                 size_t q;
 543
 544                                 if (!FLAGS_SET(flags, ASK_PASSWORD_SILENT))
 545                                         (void) backspace_chars(ttyfd, 1);
 546
 547                                 /* Remove a full UTF-8 codepoint from the end. For that, figure out where the
 548                                  * last one begins */
 549                                 q = 0;
 550                                 for (;;) {
 551                                         int z;
 552
 553                                         z = utf8_encoded_valid_unichar(passphrase + q, SIZE_MAX);
 554                                         if (z <= 0) {
 555                                                 q = SIZE_MAX; /* Invalid UTF8! */
 556                                                 break;
 557                                         }
 558
 559                                         if (q + z >= p) /* This one brings us over the edge */
 560                                                 break;
 561
 562                                         q += z;
 563                                 }
 564
 565                                 p = codepoint = q == SIZE_MAX ? p - 1 : q;
 566                                 explicit_bzero_safe(passphrase + p, sizeof(passphrase) - p);
 567
 568                         } else if (!dirty && !FLAGS_SET(flags, ASK_PASSWORD_SILENT)) {
 569
 570                                 flags |= ASK_PASSWORD_SILENT;
 571
 572                                 /* There are two ways to enter silent mode. Either by pressing backspace as
 573                                  * first key (and only as first key), or ... */
 574
 575                                 if (ttyfd >= 0)
 576                                         (void) loop_write(ttyfd, NO_ECHO, SIZE_MAX);
 577
 578                         } else if (ttyfd >= 0)
 579                                 (void) loop_write(ttyfd, "\a", 1);
 580
 581                 } else if (c == '\t' && !FLAGS_SET(flags, ASK_PASSWORD_SILENT)) {
 582
 583                         (void) backspace_string(ttyfd, passphrase);
 584                         flags |= ASK_PASSWORD_SILENT;
 585
 586                         /* ... or by pressing TAB at any time. */
 587
 588                         if (ttyfd >= 0)
 589                                 (void) loop_write(ttyfd, NO_ECHO, SIZE_MAX);
 590
 591                 } else if (p >= sizeof(passphrase)-1) {
 592
 593                         /* Reached the size limit */
 594                         if (ttyfd >= 0)
 595                                 (void) loop_write(ttyfd, "\a", 1);
 596
 597                 } else {
 598                         passphrase[p++] = c;
 599
 600                         if (!FLAGS_SET(flags, ASK_PASSWORD_SILENT) && ttyfd >= 0) {
 601                                 /* Check if we got a complete UTF-8 character now. If so, let's output one '*'. */
 602                                 n = utf8_encoded_valid_unichar(passphrase + codepoint, SIZE_MAX);
 603                                 if (n >= 0) {
 604                                         if (FLAGS_SET(flags, ASK_PASSWORD_ECHO))
 605                                                 (void) loop_write(ttyfd, passphrase + codepoint, n);
 606                                         else
 607                                                 (void) loop_write(ttyfd,
 608                                                                   special_glyph(SPECIAL_GLYPH_BULLET),
 609                                                                   SIZE_MAX);
 610                                         codepoint = p;
 611                                 }
 612                         }
 613
 614                         dirty = true;
 615                 }
 616         }
 617
 618         x = strndup(passphrase, p);
 619         if (!x) {
 620                 r = -ENOMEM;
 621                 goto finish;
 622         }
 623
 624         r = strv_consume(&l, x);
 625         if (r < 0)
 626                 goto finish;
 627
 628 skipped:
 629         if (strv_isempty(l))
 630                 r = log_debug_errno(SYNTHETIC_ERRNO(ECANCELED), "Password query was cancelled.");
 631         else {
 632                 if (keyname)
 633                         (void) add_to_keyring_and_log(keyname, flags, l);
 634
 635                 *ret = TAKE_PTR(l);
 636                 r = 0;
 637         }
 638
 639 finish:
 640         if (ttyfd >= 0 && reset_tty) {
 641                 (void) loop_write(ttyfd, "\n", 1);
 642                 (void) tcsetattr(ttyfd, TCSADRAIN, &old_termios);
 643         }
 644
 645         return r;
 646 }
 647
 648 static int create_socket(char **ret) {
 649         _cleanup_free_ char *path = NULL;
 650         union sockaddr_union sa;
 651         socklen_t sa_len;
 652         _cleanup_close_ int fd = -EBADF;
 653         int r;
 654
 655         assert(ret);
 656
 657         fd = socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
 658         if (fd < 0)
 659                 return -errno;
 660
 661         if (asprintf(&path, "/run/systemd/ask-password/sck.%" PRIx64, random_u64()) < 0)
 662                 return -ENOMEM;
 663
 664         r = sockaddr_un_set_path(&sa.un, path);
 665         if (r < 0)
 666                 return r;
 667         sa_len = r;
 668
 669         WITH_UMASK(0177)
 670                 if (bind(fd, &sa.sa, sa_len) < 0)
 671                         return -errno;
 672
 673         r = setsockopt_int(fd, SOL_SOCKET, SO_PASSCRED, true);
 674         if (r < 0)
 675                 return r;
 676
 677         *ret = TAKE_PTR(path);
 678         return TAKE_FD(fd);
 679 }
 680
 681 int ask_password_agent(
 682                 const char *message,
 683                 const char *icon,
 684                 const char *id,
 685                 const char *keyname,
 686                 usec_t until,
 687                 AskPasswordFlags flags,
 688                 char ***ret) {
 689
 690         enum {
 691                 FD_SOCKET,
 692                 FD_SIGNAL,
 693                 FD_INOTIFY,
 694                 _FD_MAX
 695         };
 696
 697         _cleanup_close_ int socket_fd = -EBADF, signal_fd = -EBADF, notify = -EBADF, fd = -EBADF;
 698         char temp[] = "/run/systemd/ask-password/tmp.XXXXXX";
 699         char final[sizeof(temp)] = "";
 700         _cleanup_free_ char *socket_name = NULL;
 701         _cleanup_strv_free_erase_ char **l = NULL;
 702         _cleanup_fclose_ FILE *f = NULL;
 703         struct pollfd pollfd[_FD_MAX];
 704         sigset_t mask, oldmask;
 705         int r;
 706
 707         assert(ret);
 708
 709         if (FLAGS_SET(flags, ASK_PASSWORD_NO_AGENT))
 710                 return -EUNATCH;
 711
 712         assert_se(sigemptyset(&mask) >= 0);
 713         assert_se(sigset_add_many(&mask, SIGINT, SIGTERM, -1) >= 0);
 714         assert_se(sigprocmask(SIG_BLOCK, &mask, &oldmask) >= 0);
 715
 716         (void) mkdir_p_label("/run/systemd/ask-password", 0755);
 717
 718         if (FLAGS_SET(flags, ASK_PASSWORD_ACCEPT_CACHED) && keyname) {
 719                 r = ask_password_keyring(keyname, flags, ret);
 720                 if (r >= 0) {
 721                         r = 0;
 722                         goto finish;
 723                 } else if (r != -ENOKEY)
 724                         goto finish;
 725
 726                 notify = inotify_init1(IN_CLOEXEC | IN_NONBLOCK);
 727                 if (notify < 0) {
 728                         r = -errno;
 729                         goto finish;
 730                 }
 731
 732                 r = RET_NERRNO(inotify_add_watch(notify, "/run/systemd/ask-password", IN_ATTRIB /* for mtime */));
 733                 if (r < 0)
 734                         goto finish;
 735         }
 736
 737         fd = mkostemp_safe(temp);
 738         if (fd < 0) {
 739                 r = fd;
 740                 goto finish;
 741         }
 742
 743         (void) fchmod(fd, 0644);
 744
 745         f = take_fdopen(&fd, "w");
 746         if (!f) {
 747                 r = -errno;
 748                 goto finish;
 749         }
 750
 751         signal_fd = signalfd(-1, &mask, SFD_NONBLOCK|SFD_CLOEXEC);
 752         if (signal_fd < 0) {
 753                 r = -errno;
 754                 goto finish;
 755         }
 756
 757         socket_fd = create_socket(&socket_name);
 758         if (socket_fd < 0) {
 759                 r = socket_fd;
 760                 goto finish;
 761         }
 762
 763         fprintf(f,
 764                 "[Ask]\n"
 765                 "PID="PID_FMT"\n"
 766                 "Socket=%s\n"
 767                 "AcceptCached=%i\n"
 768                 "Echo=%i\n"
 769                 "NotAfter="USEC_FMT"\n"
 770                 "Silent=%i\n",
 771                 getpid_cached(),
 772                 socket_name,
 773                 FLAGS_SET(flags, ASK_PASSWORD_ACCEPT_CACHED),
 774                 FLAGS_SET(flags, ASK_PASSWORD_ECHO),
 775                 until,
 776                 FLAGS_SET(flags, ASK_PASSWORD_SILENT));
 777
 778         if (message)
 779                 fprintf(f, "Message=%s\n", message);
 780
 781         if (icon)
 782                 fprintf(f, "Icon=%s\n", icon);
 783
 784         if (id)
 785                 fprintf(f, "Id=%s\n", id);
 786
 787         r = fflush_and_check(f);
 788         if (r < 0)
 789                 goto finish;
 790
 791         memcpy(final, temp, sizeof(temp));
 792
 793         final[sizeof(final)-11] = 'a';
 794         final[sizeof(final)-10] = 's';
 795         final[sizeof(final)-9] = 'k';
 796
 797         r = RET_NERRNO(rename(temp, final));
 798         if (r < 0)
 799                 goto finish;
 800
 801         zero(pollfd);
 802         pollfd[FD_SOCKET].fd = socket_fd;
 803         pollfd[FD_SOCKET].events = POLLIN;
 804         pollfd[FD_SIGNAL].fd = signal_fd;
 805         pollfd[FD_SIGNAL].events = POLLIN;
 806         pollfd[FD_INOTIFY].fd = notify;
 807         pollfd[FD_INOTIFY].events = POLLIN;
 808
 809         for (;;) {
 810                 CMSG_BUFFER_TYPE(CMSG_SPACE(sizeof(struct ucred))) control;
 811                 char passphrase[LINE_MAX+1];
 812                 struct iovec iovec;
 813                 struct ucred *ucred;
 814                 usec_t timeout;
 815                 ssize_t n;
 816
 817                 if (until > 0)
 818                         timeout = usec_sub_unsigned(until, now(CLOCK_MONOTONIC));
 819                 else
 820                         timeout = USEC_INFINITY;
 821
 822                 r = ppoll_usec(pollfd, notify >= 0 ? _FD_MAX : _FD_MAX - 1, timeout);
 823                 if (r == -EINTR)
 824                         continue;
 825                 if (r < 0)
 826                         goto finish;
 827                 if (r == 0) {
 828                         r = -ETIME;
 829                         goto finish;
 830                 }
 831
 832                 if (pollfd[FD_SIGNAL].revents & POLLIN) {
 833                         r = -EINTR;
 834                         goto finish;
 835                 }
 836
 837                 if (notify >= 0 && pollfd[FD_INOTIFY].revents != 0) {
 838                         (void) flush_fd(notify);
 839
 840                         r = ask_password_keyring(keyname, flags, ret);
 841                         if (r >= 0) {
 842                                 r = 0;
 843                                 goto finish;
 844                         } else if (r != -ENOKEY)
 845                                 goto finish;
 846                 }
 847
 848                 if (pollfd[FD_SOCKET].revents == 0)
 849                         continue;
 850
 851                 if (pollfd[FD_SOCKET].revents != POLLIN) {
 852                         r = -EIO;
 853                         goto finish;
 854                 }
 855
 856                 iovec = IOVEC_MAKE(passphrase, sizeof(passphrase));
 857
 858                 struct msghdr msghdr = {
 859                         .msg_iov = &iovec,
 860                         .msg_iovlen = 1,
 861                         .msg_control = &control,
 862                         .msg_controllen = sizeof(control),
 863                 };
 864
 865                 n = recvmsg_safe(socket_fd, &msghdr, 0);
 866                 if (ERRNO_IS_NEG_TRANSIENT(n))
 867                         continue;
 868                 else if (n == -EXFULL) {
 869                         log_debug("Got message with truncated control data, ignoring.");
 870                         continue;
 871                 } else if (n < 0) {
 872                         r = (int) n;
 873                         goto finish;
 874                 }
 875
 876                 CLEANUP_ERASE(passphrase);
 877
 878                 cmsg_close_all(&msghdr);
 879
 880                 if (n == 0) {
 881                         log_debug("Message too short");
 882                         continue;
 883                 }
 884
 885                 ucred = CMSG_FIND_DATA(&msghdr, SOL_SOCKET, SCM_CREDENTIALS, struct ucred);
 886                 if (!ucred) {
 887                         log_debug("Received message without credentials. Ignoring.");
 888                         continue;
 889                 }
 890
 891                 if (ucred->uid != 0) {
 892                         log_debug("Got request from unprivileged user. Ignoring.");
 893                         continue;
 894                 }
 895
 896                 if (passphrase[0] == '+') {
 897                         /* An empty message refers to the empty password */
 898                         if (n == 1)
 899                                 l = strv_new("");
 900                         else
 901                                 l = strv_parse_nulstr(passphrase+1, n-1);
 902                         if (!l) {
 903                                 r = -ENOMEM;
 904                                 goto finish;
 905                         }
 906
 907                         if (strv_isempty(l)) {
 908                                 l = strv_free(l);
 909                                 log_debug("Invalid packet");
 910                                 continue;
 911                         }
 912
 913                         break;
 914                 }
 915
 916                 if (passphrase[0] == '-') {
 917                         r = -ECANCELED;
 918                         goto finish;
 919                 }
 920
 921                 log_debug("Invalid packet");
 922         }
 923
 924         if (keyname)
 925                 (void) add_to_keyring_and_log(keyname, flags, l);
 926
 927         *ret = TAKE_PTR(l);
 928         r = 0;
 929
 930 finish:
 931         if (socket_name)
 932                 (void) unlink(socket_name);
 933
 934         (void) unlink(temp);
 935
 936         if (final[0])
 937                 (void) unlink(final);
 938
 939         assert_se(sigprocmask(SIG_SETMASK, &oldmask, NULL) == 0);
 940         return r;
 941 }
 942
 943 static int ask_password_credential(const char *credential_name, AskPasswordFlags flags, char ***ret) {
 944         _cleanup_(erase_and_freep) char *buffer = NULL;
 945         size_t size;
 946         char **l;
 947         int r;
 948
 949         assert(credential_name);
 950         assert(ret);
 951
 952         r = read_credential(credential_name, (void**) &buffer, &size);
 953         if (IN_SET(r, -ENXIO, -ENOENT)) /* No credentials passed or this credential not defined? */
 954                 return -ENOKEY;
 955
 956         l = strv_parse_nulstr(buffer, size);
 957         if (!l)
 958                 return -ENOMEM;
 959
 960         *ret = l;
 961         return 0;
 962 }
 963
 964 int ask_password_auto(
 965                 const char *message,
 966                 const char *icon,
 967                 const char *id,                /* id in "ask-password" protocol */
 968                 const char *key_name,          /* name in kernel keyring */
 969                 const char *credential_name,   /* name in $CREDENTIALS_DIRECTORY directory */
 970                 usec_t until,
 971                 AskPasswordFlags flags,
 972                 char ***ret) {
 973
 974         int r;
 975
 976         assert(ret);
 977
 978         if (!FLAGS_SET(flags, ASK_PASSWORD_NO_CREDENTIAL) && credential_name) {
 979                 r = ask_password_credential(credential_name, flags, ret);
 980                 if (r != -ENOKEY)
 981                         return r;
 982         }
 983
 984         if (FLAGS_SET(flags, ASK_PASSWORD_ACCEPT_CACHED) &&
 985             key_name &&
 986             (FLAGS_SET(flags, ASK_PASSWORD_NO_TTY) || !isatty(STDIN_FILENO)) &&
 987             FLAGS_SET(flags, ASK_PASSWORD_NO_AGENT)) {
 988                 r = ask_password_keyring(key_name, flags, ret);
 989                 if (r != -ENOKEY)
 990                         return r;
 991         }
 992
 993         if (!FLAGS_SET(flags, ASK_PASSWORD_NO_TTY) && isatty(STDIN_FILENO))
 994                 return ask_password_tty(-1, message, key_name, until, flags, NULL, ret);
 995
 996         if (!FLAGS_SET(flags, ASK_PASSWORD_NO_AGENT))
 997                 return ask_password_agent(message, icon, id, key_name, until, flags, ret);
 998
 999         return -EUNATCH;
1000 }