1 /* SPDX-License-Identifier: LGPL-2.1+ */
3 #include <security/pam_ext.h>
4 #include <security/pam_modules.h>
8 #include "bus-common-errors.h"
9 #include "bus-locator.h"
10 #include "errno-util.h"
12 #include "home-util.h"
13 #include "memory-util.h"
15 #include "parse-util.h"
17 #include "user-record-util.h"
18 #include "user-record.h"
19 #include "user-util.h"
21 static int parse_argv(
23 int argc
, const char **argv
,
30 assert(argc
== 0 || argv
);
32 for (i
= 0; i
< argc
; i
++) {
35 if ((v
= startswith(argv
[i
], "suspend="))) {
40 pam_syslog(handle
, LOG_WARNING
, "Failed to parse suspend= argument, ignoring: %s", v
);
41 else if (please_suspend
)
44 } else if (streq(argv
[i
], "debug")) {
48 } else if ((v
= startswith(argv
[i
], "debug="))) {
52 pam_syslog(handle
, LOG_WARNING
, "Failed to parse debug= argument, ignoring: %s", v
);
57 pam_syslog(handle
, LOG_WARNING
, "Unknown parameter '%s', ignoring", argv
[i
]);
65 bool *please_suspend
) {
70 /* Let's read the suspend setting from an env var in addition to the PAM command line. That makes it
71 * easy to declare the features of a display manager in code rather than configuration, and this is
72 * really a feature of code */
74 v
= pam_getenv(handle
, "SYSTEMD_HOME_SUSPEND");
76 /* Also check the process env block, so that people can control this via an env var from the
77 * outside of our process. */
78 v
= secure_getenv("SYSTEMD_HOME_SUSPEND");
85 pam_syslog(handle
, LOG_WARNING
, "Failed to parse $SYSTEMD_HOME_SUSPEND argument, ignoring: %s", v
);
86 else if (please_suspend
)
92 static int acquire_user_record(
95 UserRecord
**ret_record
) {
97 _cleanup_(sd_bus_message_unrefp
) sd_bus_message
*reply
= NULL
;
98 _cleanup_(json_variant_unrefp
) JsonVariant
*v
= NULL
;
99 _cleanup_(user_record_unrefp
) UserRecord
*ur
= NULL
;
100 _cleanup_(sd_bus_unrefp
) sd_bus
*bus
= NULL
;
101 _cleanup_free_
char *homed_field
= NULL
;
102 const char *json
= NULL
;
108 r
= pam_get_user(handle
, &username
, NULL
);
109 if (r
!= PAM_SUCCESS
) {
110 pam_syslog(handle
, LOG_ERR
, "Failed to get user name: %s", pam_strerror(handle
, r
));
114 if (isempty(username
)) {
115 pam_syslog(handle
, LOG_ERR
, "User name not set.");
116 return PAM_SERVICE_ERR
;
120 /* Let's bypass all IPC complexity for the two user names we know for sure we don't manage, and for
121 * user names we don't consider valid. */
122 if (STR_IN_SET(username
, "root", NOBODY_USER_NAME
) || !valid_user_group_name(username
, 0))
123 return PAM_USER_UNKNOWN
;
125 /* We cache the user record in the PAM context. We use a field name that includes the username, since
126 * clients might change the user name associated with a PAM context underneath us. Notably, 'sudo'
127 * creates a single PAM context and first authenticates it with the user set to the originating user,
128 * then updates the user for the destination user and issues the session stack with the same PAM
129 * context. We thus must be prepared that the user record changes between calls and we keep any
130 * caching separate. */
131 homed_field
= strjoin("systemd-home-user-record-", username
);
133 return pam_log_oom(handle
);
135 /* Let's use the cache, so that we can share it between the session and the authentication hooks */
136 r
= pam_get_data(handle
, homed_field
, (const void**) &json
);
137 if (!IN_SET(r
, PAM_SUCCESS
, PAM_NO_MODULE_DATA
)) {
138 pam_syslog(handle
, LOG_ERR
, "Failed to get PAM user record data: %s", pam_strerror(handle
, r
));
141 if (r
== PAM_SUCCESS
&& json
) {
142 /* We determined earlier that this is not a homed user? Then exit early. (We use -1 as
143 * negative cache indicator) */
144 if (json
== (void*) -1)
145 return PAM_USER_UNKNOWN
;
147 _cleanup_(sd_bus_error_free
) sd_bus_error error
= SD_BUS_ERROR_NULL
;
148 _cleanup_free_
char *generic_field
= NULL
, *json_copy
= NULL
;
150 r
= pam_acquire_bus_connection(handle
, &bus
);
151 if (r
!= PAM_SUCCESS
)
154 r
= bus_call_method(bus
, bus_home_mgr
, "GetUserRecordByName", &error
, &reply
, "s", username
);
156 if (sd_bus_error_has_name(&error
, SD_BUS_ERROR_SERVICE_UNKNOWN
) ||
157 sd_bus_error_has_name(&error
, SD_BUS_ERROR_NAME_HAS_NO_OWNER
)) {
158 pam_syslog(handle
, LOG_DEBUG
, "systemd-homed is not available: %s", bus_error_message(&error
, r
));
162 if (sd_bus_error_has_name(&error
, BUS_ERROR_NO_SUCH_HOME
)) {
163 pam_syslog(handle
, LOG_DEBUG
, "Not a user managed by systemd-homed: %s", bus_error_message(&error
, r
));
167 pam_syslog(handle
, LOG_ERR
, "Failed to query user record: %s", bus_error_message(&error
, r
));
168 return PAM_SERVICE_ERR
;
171 r
= sd_bus_message_read(reply
, "sbo", &json
, NULL
, NULL
);
173 return pam_bus_log_parse_error(handle
, r
);
175 /* First copy: for the homed-specific data field, i.e. where we know the user record is from
177 json_copy
= strdup(json
);
179 return pam_log_oom(handle
);
181 r
= pam_set_data(handle
, homed_field
, json_copy
, pam_cleanup_free
);
182 if (r
!= PAM_SUCCESS
) {
183 pam_syslog(handle
, LOG_ERR
, "Failed to set PAM user record data '%s': %s",
184 homed_field
, pam_strerror(handle
, r
));
188 /* Take a second copy: for the generic data field, the one which we share with
189 * pam_systemd. While we insist on only reusing homed records, pam_systemd is fine with homed
190 * and non-homed user records. */
191 json_copy
= strdup(json
);
193 return pam_log_oom(handle
);
195 generic_field
= strjoin("systemd-user-record-", username
);
197 return pam_log_oom(handle
);
199 r
= pam_set_data(handle
, generic_field
, json_copy
, pam_cleanup_free
);
200 if (r
!= PAM_SUCCESS
) {
201 pam_syslog(handle
, LOG_ERR
, "Failed to set PAM user record data '%s': %s",
202 homed_field
, pam_strerror(handle
, r
));
209 r
= json_parse(json
, JSON_PARSE_SENSITIVE
, &v
, NULL
, NULL
);
211 pam_syslog(handle
, LOG_ERR
, "Failed to parse JSON user record: %s", strerror_safe(r
));
212 return PAM_SERVICE_ERR
;
215 ur
= user_record_new();
217 return pam_log_oom(handle
);
219 r
= user_record_load(ur
, v
, USER_RECORD_LOAD_REFUSE_SECRET
);
221 pam_syslog(handle
, LOG_ERR
, "Failed to load user record: %s", strerror_safe(r
));
222 return PAM_SERVICE_ERR
;
225 /* Safety check if cached record actually matches what we are looking for */
226 if (!streq_ptr(username
, ur
->user_name
)) {
227 pam_syslog(handle
, LOG_ERR
, "Acquired user record does not match user name.");
228 return PAM_SERVICE_ERR
;
232 *ret_record
= TAKE_PTR(ur
);
237 /* Cache this, so that we don't check again */
238 r
= pam_set_data(handle
, homed_field
, (void*) -1, NULL
);
239 if (r
!= PAM_SUCCESS
)
240 pam_syslog(handle
, LOG_ERR
, "Failed to set PAM user record data '%s' to invalid, ignoring: %s",
241 homed_field
, pam_strerror(handle
, r
));
243 return PAM_USER_UNKNOWN
;
246 static int release_user_record(pam_handle_t
*handle
, const char *username
) {
247 _cleanup_free_
char *homed_field
= NULL
, *generic_field
= NULL
;
253 homed_field
= strjoin("systemd-home-user-record-", username
);
255 return pam_log_oom(handle
);
257 r
= pam_set_data(handle
, homed_field
, NULL
, NULL
);
258 if (r
!= PAM_SUCCESS
)
259 pam_syslog(handle
, LOG_ERR
, "Failed to release PAM user record data '%s': %s", homed_field
, pam_strerror(handle
, r
));
261 generic_field
= strjoin("systemd-user-record-", username
);
263 return pam_log_oom(handle
);
265 k
= pam_set_data(handle
, generic_field
, NULL
, NULL
);
266 if (k
!= PAM_SUCCESS
)
267 pam_syslog(handle
, LOG_ERR
, "Failed to release PAM user record data '%s': %s", generic_field
, pam_strerror(handle
, k
));
269 return IN_SET(r
, PAM_SUCCESS
, PAM_NO_MODULE_DATA
) ? k
: r
;
272 static void cleanup_home_fd(pam_handle_t
*handle
, void *data
, int error_status
) {
273 safe_close(PTR_TO_FD(data
));
276 static int handle_generic_user_record_error(
277 pam_handle_t
*handle
,
278 const char *user_name
,
281 const sd_bus_error
*error
) {
289 /* Logs about all errors, except for PAM_CONV_ERR, i.e. when requesting more info failed. */
291 if (sd_bus_error_has_name(error
, BUS_ERROR_HOME_ABSENT
)) {
292 (void) pam_prompt(handle
, PAM_ERROR_MSG
, NULL
, "Home of user %s is currently absent, please plug in the necessary storage device or backing file system.", user_name
);
293 pam_syslog(handle
, LOG_ERR
, "Failed to acquire home for user %s: %s", user_name
, bus_error_message(error
, ret
));
294 return PAM_PERM_DENIED
;
296 } else if (sd_bus_error_has_name(error
, BUS_ERROR_AUTHENTICATION_LIMIT_HIT
)) {
297 (void) pam_prompt(handle
, PAM_ERROR_MSG
, NULL
, "Too frequent unsuccessful login attempts for user %s, try again later.", user_name
);
298 pam_syslog(handle
, LOG_ERR
, "Failed to acquire home for user %s: %s", user_name
, bus_error_message(error
, ret
));
301 } else if (sd_bus_error_has_name(error
, BUS_ERROR_BAD_PASSWORD
)) {
302 _cleanup_(erase_and_freep
) char *newp
= NULL
;
304 /* This didn't work? Ask for an (additional?) password */
306 if (strv_isempty(secret
->password
))
307 r
= pam_prompt(handle
, PAM_PROMPT_ECHO_OFF
, &newp
, "Password: ");
309 (void) pam_prompt(handle
, PAM_ERROR_MSG
, NULL
, "Password incorrect or not sufficient for authentication of user %s.", user_name
);
310 r
= pam_prompt(handle
, PAM_PROMPT_ECHO_OFF
, &newp
, "Sorry, try again: ");
312 if (r
!= PAM_SUCCESS
)
313 return PAM_CONV_ERR
; /* no logging here */
316 pam_syslog(handle
, LOG_DEBUG
, "Password request aborted.");
317 return PAM_AUTHTOK_ERR
;
320 r
= user_record_set_password(secret
, STRV_MAKE(newp
), true);
322 pam_syslog(handle
, LOG_ERR
, "Failed to store password: %s", strerror_safe(r
));
323 return PAM_SERVICE_ERR
;
326 } else if (sd_bus_error_has_name(error
, BUS_ERROR_BAD_PASSWORD_AND_NO_TOKEN
)) {
327 _cleanup_(erase_and_freep
) char *newp
= NULL
;
329 if (strv_isempty(secret
->password
)) {
330 (void) pam_prompt(handle
, PAM_ERROR_MSG
, NULL
, "Security token of user %s not inserted.", user_name
);
331 r
= pam_prompt(handle
, PAM_PROMPT_ECHO_OFF
, &newp
, "Try again with password: ");
333 (void) pam_prompt(handle
, PAM_ERROR_MSG
, NULL
, "Password incorrect or not sufficient, and configured security token of user %s not inserted.", user_name
);
334 r
= pam_prompt(handle
, PAM_PROMPT_ECHO_OFF
, &newp
, "Try again with password: ");
336 if (r
!= PAM_SUCCESS
)
337 return PAM_CONV_ERR
; /* no logging here */
340 pam_syslog(handle
, LOG_DEBUG
, "Password request aborted.");
341 return PAM_AUTHTOK_ERR
;
344 r
= user_record_set_password(secret
, STRV_MAKE(newp
), true);
346 pam_syslog(handle
, LOG_ERR
, "Failed to store password: %s", strerror_safe(r
));
347 return PAM_SERVICE_ERR
;
350 } else if (sd_bus_error_has_name(error
, BUS_ERROR_TOKEN_PIN_NEEDED
)) {
351 _cleanup_(erase_and_freep
) char *newp
= NULL
;
353 r
= pam_prompt(handle
, PAM_PROMPT_ECHO_OFF
, &newp
, "Security token PIN: ");
354 if (r
!= PAM_SUCCESS
)
355 return PAM_CONV_ERR
; /* no logging here */
358 pam_syslog(handle
, LOG_DEBUG
, "PIN request aborted.");
359 return PAM_AUTHTOK_ERR
;
362 r
= user_record_set_pkcs11_pin(secret
, STRV_MAKE(newp
), false);
364 pam_syslog(handle
, LOG_ERR
, "Failed to store PIN: %s", strerror_safe(r
));
365 return PAM_SERVICE_ERR
;
368 } else if (sd_bus_error_has_name(error
, BUS_ERROR_TOKEN_PROTECTED_AUTHENTICATION_PATH_NEEDED
)) {
370 (void) pam_prompt(handle
, PAM_ERROR_MSG
, NULL
, "Please authenticate physically on security token of user %s.", user_name
);
372 r
= user_record_set_pkcs11_protected_authentication_path_permitted(secret
, true);
374 pam_syslog(handle
, LOG_ERR
, "Failed to set PKCS#11 protected authentication path permitted flag: %s", strerror_safe(r
));
375 return PAM_SERVICE_ERR
;
378 } else if (sd_bus_error_has_name(error
, BUS_ERROR_TOKEN_BAD_PIN
)) {
379 _cleanup_(erase_and_freep
) char *newp
= NULL
;
381 (void) pam_prompt(handle
, PAM_ERROR_MSG
, NULL
, "Security token PIN incorrect for user %s.", user_name
);
382 r
= pam_prompt(handle
, PAM_PROMPT_ECHO_OFF
, &newp
, "Sorry, retry security token PIN: ");
383 if (r
!= PAM_SUCCESS
)
384 return PAM_CONV_ERR
; /* no logging here */
387 pam_syslog(handle
, LOG_DEBUG
, "PIN request aborted.");
388 return PAM_AUTHTOK_ERR
;
391 r
= user_record_set_pkcs11_pin(secret
, STRV_MAKE(newp
), false);
393 pam_syslog(handle
, LOG_ERR
, "Failed to store PIN: %s", strerror_safe(r
));
394 return PAM_SERVICE_ERR
;
397 } else if (sd_bus_error_has_name(error
, BUS_ERROR_TOKEN_BAD_PIN_FEW_TRIES_LEFT
)) {
398 _cleanup_(erase_and_freep
) char *newp
= NULL
;
400 (void) pam_prompt(handle
, PAM_ERROR_MSG
, NULL
, "Security token PIN of user %s incorrect (only a few tries left!)", user_name
);
401 r
= pam_prompt(handle
, PAM_PROMPT_ECHO_OFF
, &newp
, "Sorry, retry security token PIN: ");
402 if (r
!= PAM_SUCCESS
)
403 return PAM_CONV_ERR
; /* no logging here */
406 pam_syslog(handle
, LOG_DEBUG
, "PIN request aborted.");
407 return PAM_AUTHTOK_ERR
;
410 r
= user_record_set_pkcs11_pin(secret
, STRV_MAKE(newp
), false);
412 pam_syslog(handle
, LOG_ERR
, "Failed to store PIN: %s", strerror_safe(r
));
413 return PAM_SERVICE_ERR
;
416 } else if (sd_bus_error_has_name(error
, BUS_ERROR_TOKEN_BAD_PIN_ONE_TRY_LEFT
)) {
417 _cleanup_(erase_and_freep
) char *newp
= NULL
;
419 (void) pam_prompt(handle
, PAM_ERROR_MSG
, NULL
, "Security token PIN of user %s incorrect (only one try left!)", user_name
);
420 r
= pam_prompt(handle
, PAM_PROMPT_ECHO_OFF
, &newp
, "Sorry, retry security token PIN: ");
421 if (r
!= PAM_SUCCESS
)
422 return PAM_CONV_ERR
; /* no logging here */
425 pam_syslog(handle
, LOG_DEBUG
, "PIN request aborted.");
426 return PAM_AUTHTOK_ERR
;
429 r
= user_record_set_pkcs11_pin(secret
, STRV_MAKE(newp
), false);
431 pam_syslog(handle
, LOG_ERR
, "Failed to store PIN: %s", strerror_safe(r
));
432 return PAM_SERVICE_ERR
;
436 pam_syslog(handle
, LOG_ERR
, "Failed to acquire home for user %s: %s", user_name
, bus_error_message(error
, ret
));
437 return PAM_SERVICE_ERR
;
443 static int acquire_home(
444 pam_handle_t
*handle
,
445 bool please_authenticate
,
449 _cleanup_(user_record_unrefp
) UserRecord
*ur
= NULL
, *secret
= NULL
;
450 bool do_auth
= please_authenticate
, home_not_active
= false, home_locked
= false;
451 _cleanup_(sd_bus_unrefp
) sd_bus
*bus
= NULL
;
452 _cleanup_close_
int acquired_fd
= -1;
453 _cleanup_free_
char *fd_field
= NULL
;
454 const void *home_fd_ptr
= NULL
;
455 const char *username
= NULL
;
456 unsigned n_attempts
= 0;
461 /* This acquires a reference to a home directory in one of two ways: if please_authenticate is true,
462 * then we'll call AcquireHome() after asking the user for a password. Otherwise it tries to call
463 * RefHome() and if that fails queries the user for a password and uses AcquireHome().
465 * The idea is that the PAM authentication hook sets please_authenticate and thus always
466 * authenticates, while the other PAM hooks unset it so that they can a ref of their own without
467 * authentication if possible, but with authentication if necessary. */
469 r
= pam_get_user(handle
, &username
, NULL
);
470 if (r
!= PAM_SUCCESS
) {
471 pam_syslog(handle
, LOG_ERR
, "Failed to get user name: %s", pam_strerror(handle
, r
));
475 if (isempty(username
)) {
476 pam_syslog(handle
, LOG_ERR
, "User name not set.");
477 return PAM_SERVICE_ERR
;
480 /* If we already have acquired the fd, let's shortcut this */
481 fd_field
= strjoin("systemd-home-fd-", username
);
483 return pam_log_oom(handle
);
485 r
= pam_get_data(handle
, fd_field
, &home_fd_ptr
);
486 if (!IN_SET(r
, PAM_SUCCESS
, PAM_NO_MODULE_DATA
)) {
487 pam_syslog(handle
, LOG_ERR
, "Failed to retrieve PAM home reference fd: %s", pam_strerror(handle
, r
));
490 if (r
== PAM_SUCCESS
&& PTR_TO_FD(home_fd_ptr
) >= 0)
493 r
= pam_acquire_bus_connection(handle
, &bus
);
494 if (r
!= PAM_SUCCESS
)
497 r
= acquire_user_record(handle
, username
, &ur
);
498 if (r
!= PAM_SUCCESS
)
501 /* Implement our own retry loop here instead of relying on the PAM client's one. That's because it
502 * might happen that the the record we stored on the host does not match the encryption password of
503 * the LUKS image in case the image was used in a different system where the password was
504 * changed. In that case it will happen that the LUKS password and the host password are
505 * different, and we handle that by collecting and passing multiple passwords in that case. Hence we
506 * treat bad passwords as a request to collect one more password and pass the new all all previously
507 * used passwords again. */
510 _cleanup_(sd_bus_message_unrefp
) sd_bus_message
*m
= NULL
, *reply
= NULL
;
511 _cleanup_(sd_bus_error_free
) sd_bus_error error
= SD_BUS_ERROR_NULL
;
513 if (do_auth
&& !secret
) {
514 const char *cached_password
= NULL
;
516 secret
= user_record_new();
518 return pam_log_oom(handle
);
520 /* If there's already a cached password, use it. But if not let's authenticate
521 * without anything, maybe some other authentication mechanism systemd-homed
522 * implements (such as PKCS#11) allows us to authenticate without anything else. */
523 r
= pam_get_item(handle
, PAM_AUTHTOK
, (const void**) &cached_password
);
524 if (!IN_SET(r
, PAM_BAD_ITEM
, PAM_SUCCESS
)) {
525 pam_syslog(handle
, LOG_ERR
, "Failed to get cached password: %s", pam_strerror(handle
, r
));
529 if (!isempty(cached_password
)) {
530 r
= user_record_set_password(secret
, STRV_MAKE(cached_password
), true);
532 pam_syslog(handle
, LOG_ERR
, "Failed to store password: %s", strerror_safe(r
));
533 return PAM_SERVICE_ERR
;
538 r
= bus_message_new_method_call(bus
, &m
, bus_home_mgr
, do_auth
? "AcquireHome" : "RefHome");
540 return pam_bus_log_create_error(handle
, r
);
542 r
= sd_bus_message_append(m
, "s", ur
->user_name
);
544 return pam_bus_log_create_error(handle
, r
);
547 r
= bus_message_append_secret(m
, secret
);
549 return pam_bus_log_create_error(handle
, r
);
552 r
= sd_bus_message_append(m
, "b", please_suspend
);
554 return pam_bus_log_create_error(handle
, r
);
556 r
= sd_bus_call(bus
, m
, HOME_SLOW_BUS_CALL_TIMEOUT_USEC
, &error
, &reply
);
559 if (sd_bus_error_has_name(&error
, BUS_ERROR_HOME_NOT_ACTIVE
))
560 /* Only on RefHome(): We can't access the home directory currently, unless
561 * it's unlocked with a password. Hence, let's try this again, this time with
563 home_not_active
= true;
564 else if (sd_bus_error_has_name(&error
, BUS_ERROR_HOME_LOCKED
))
565 home_locked
= true; /* Similar */
567 r
= handle_generic_user_record_error(handle
, ur
->user_name
, secret
, r
, &error
);
568 if (r
== PAM_CONV_ERR
) {
569 /* Password/PIN prompts will fail in certain environments, for example when
570 * we are called from OpenSSH's account or session hooks, or in systemd's
571 * per-service PAM logic. In that case, print a friendly message and accept
575 (void) pam_prompt(handle
, PAM_ERROR_MSG
, NULL
, "Home of user %s is currently not active, please log in locally first.", ur
->user_name
);
577 (void) pam_prompt(handle
, PAM_ERROR_MSG
, NULL
, "Home of user %s is currently locked, please unlock locally first.", ur
->user_name
);
579 pam_syslog(handle
, please_authenticate
? LOG_ERR
: LOG_DEBUG
, "Failed to prompt for password/prompt.");
581 return home_not_active
|| home_locked
? PAM_PERM_DENIED
: PAM_CONV_ERR
;
583 if (r
!= PAM_SUCCESS
)
590 r
= sd_bus_message_read(reply
, "h", &fd
);
592 return pam_bus_log_parse_error(handle
, r
);
594 acquired_fd
= fcntl(fd
, F_DUPFD_CLOEXEC
, 3);
595 if (acquired_fd
< 0) {
596 pam_syslog(handle
, LOG_ERR
, "Failed to duplicate acquired fd: %s", bus_error_message(&error
, r
));
597 return PAM_SERVICE_ERR
;
603 if (++n_attempts
>= 5) {
604 (void) pam_prompt(handle
, PAM_ERROR_MSG
, NULL
, "Too many unsuccessful login attempts for user %s, refusing.", ur
->user_name
);
605 pam_syslog(handle
, LOG_ERR
, "Failed to acquire home for user %s: %s", ur
->user_name
, bus_error_message(&error
, r
));
609 /* Try again, this time with authentication if we didn't do that before. */
613 r
= pam_set_data(handle
, fd_field
, FD_TO_PTR(acquired_fd
), cleanup_home_fd
);
615 pam_syslog(handle
, LOG_ERR
, "Failed to set PAM bus data: %s", pam_strerror(handle
, r
));
618 TAKE_FD(acquired_fd
);
621 /* We likely just activated the home directory, let's flush out the user record, since a
622 * newer embedded user record might have been acquired from the activation. */
624 r
= release_user_record(handle
, ur
->user_name
);
625 if (!IN_SET(r
, PAM_SUCCESS
, PAM_NO_MODULE_DATA
))
629 pam_syslog(handle
, LOG_NOTICE
, "Home for user %s successfully acquired.", ur
->user_name
);
634 static int release_home_fd(pam_handle_t
*handle
, const char *username
) {
635 _cleanup_free_
char *fd_field
= NULL
;
636 const void *home_fd_ptr
= NULL
;
642 fd_field
= strjoin("systemd-home-fd-", username
);
644 return pam_log_oom(handle
);
646 r
= pam_get_data(handle
, fd_field
, &home_fd_ptr
);
647 if (r
== PAM_NO_MODULE_DATA
|| (r
== PAM_SUCCESS
&& PTR_TO_FD(home_fd_ptr
) < 0))
648 return PAM_NO_MODULE_DATA
;
649 if (r
!= PAM_SUCCESS
) {
650 pam_syslog(handle
, LOG_ERR
, "Failed to retrieve PAM home reference fd: %s", pam_strerror(handle
, r
));
654 r
= pam_set_data(handle
, fd_field
, NULL
, NULL
);
655 if (r
!= PAM_SUCCESS
)
656 pam_syslog(handle
, LOG_ERR
, "Failed to release PAM home reference fd: %s", pam_strerror(handle
, r
));
661 _public_ PAM_EXTERN
int pam_sm_authenticate(
662 pam_handle_t
*handle
,
664 int argc
, const char **argv
) {
666 bool debug
= false, suspend_please
= false;
668 if (parse_env(handle
, &suspend_please
) < 0)
671 if (parse_argv(handle
,
678 pam_syslog(handle
, LOG_DEBUG
, "pam-systemd-homed authenticating");
680 return acquire_home(handle
, /* please_authenticate= */ true, suspend_please
, debug
);
683 _public_ PAM_EXTERN
int pam_sm_setcred(pam_handle_t
*pamh
, int flags
, int argc
, const char **argv
) {
687 _public_ PAM_EXTERN
int pam_sm_open_session(
688 pam_handle_t
*handle
,
690 int argc
, const char **argv
) {
692 bool debug
= false, suspend_please
= false;
695 if (parse_env(handle
, &suspend_please
) < 0)
696 return PAM_SESSION_ERR
;
698 if (parse_argv(handle
,
702 return PAM_SESSION_ERR
;
705 pam_syslog(handle
, LOG_DEBUG
, "pam-systemd-homed session start");
707 r
= acquire_home(handle
, /* please_authenticate = */ false, suspend_please
, debug
);
708 if (r
== PAM_USER_UNKNOWN
) /* Not managed by us? Don't complain. */
710 if (r
!= PAM_SUCCESS
)
713 r
= pam_putenv(handle
, "SYSTEMD_HOME=1");
714 if (r
!= PAM_SUCCESS
) {
715 pam_syslog(handle
, LOG_ERR
, "Failed to set PAM environment variable $SYSTEMD_HOME: %s", pam_strerror(handle
, r
));
719 r
= pam_putenv(handle
, suspend_please
? "SYSTEMD_HOME_SUSPEND=1" : "SYSTEMD_HOME_SUSPEND=0");
720 if (r
!= PAM_SUCCESS
) {
721 pam_syslog(handle
, LOG_ERR
, "Failed to set PAM environment variable $SYSTEMD_HOME_SUSPEND: %s", pam_strerror(handle
, r
));
725 /* Let's release the D-Bus connection, after all the session might live quite a long time, and we are
726 * not going to process the bus connection in that time, so let's better close before the daemon
727 * kicks us off because we are not processing anything. */
728 (void) pam_release_bus_connection(handle
);
732 _public_ PAM_EXTERN
int pam_sm_close_session(
733 pam_handle_t
*handle
,
735 int argc
, const char **argv
) {
737 _cleanup_(sd_bus_error_free
) sd_bus_error error
= SD_BUS_ERROR_NULL
;
738 _cleanup_(sd_bus_message_unrefp
) sd_bus_message
*m
= NULL
;
739 _cleanup_(sd_bus_unrefp
) sd_bus
*bus
= NULL
;
740 const char *username
= NULL
;
744 if (parse_argv(handle
,
748 return PAM_SESSION_ERR
;
751 pam_syslog(handle
, LOG_DEBUG
, "pam-systemd-homed session end");
753 r
= pam_get_user(handle
, &username
, NULL
);
754 if (r
!= PAM_SUCCESS
) {
755 pam_syslog(handle
, LOG_ERR
, "Failed to get user name: %s", pam_strerror(handle
, r
));
759 if (isempty(username
)) {
760 pam_syslog(handle
, LOG_ERR
, "User name not set.");
761 return PAM_SERVICE_ERR
;
764 /* Let's explicitly drop the reference to the homed session, so that the subsequent ReleaseHome()
765 * call will be able to do its thing. */
766 r
= release_home_fd(handle
, username
);
767 if (r
== PAM_NO_MODULE_DATA
) /* Nothing to do, we never acquired an fd */
769 if (r
!= PAM_SUCCESS
)
772 r
= pam_acquire_bus_connection(handle
, &bus
);
773 if (r
!= PAM_SUCCESS
)
776 r
= bus_message_new_method_call(bus
, &m
, bus_home_mgr
, "ReleaseHome");
778 return pam_bus_log_create_error(handle
, r
);
780 r
= sd_bus_message_append(m
, "s", username
);
782 return pam_bus_log_create_error(handle
, r
);
784 r
= sd_bus_call(bus
, m
, HOME_SLOW_BUS_CALL_TIMEOUT_USEC
, &error
, NULL
);
786 if (sd_bus_error_has_name(&error
, BUS_ERROR_HOME_BUSY
))
787 pam_syslog(handle
, LOG_NOTICE
, "Not deactivating home directory of %s, as it is still used.", username
);
789 pam_syslog(handle
, LOG_ERR
, "Failed to release user home: %s", bus_error_message(&error
, r
));
790 return PAM_SESSION_ERR
;
797 _public_ PAM_EXTERN
int pam_sm_acct_mgmt(
798 pam_handle_t
*handle
,
803 _cleanup_(user_record_unrefp
) UserRecord
*ur
= NULL
;
804 bool debug
= false, please_suspend
= false;
808 if (parse_env(handle
, &please_suspend
) < 0)
811 if (parse_argv(handle
,
818 pam_syslog(handle
, LOG_DEBUG
, "pam-systemd-homed account management");
820 r
= acquire_home(handle
, /* please_authenticate = */ false, please_suspend
, debug
);
821 if (r
== PAM_USER_UNKNOWN
)
822 return PAM_SUCCESS
; /* we don't have anything to say about users we don't manage */
823 if (r
!= PAM_SUCCESS
)
826 r
= acquire_user_record(handle
, NULL
, &ur
);
827 if (r
!= PAM_SUCCESS
)
830 r
= user_record_test_blocked(ur
);
834 (void) pam_prompt(handle
, PAM_ERROR_MSG
, NULL
, "User record is newer than current system time, prohibiting access.");
835 return PAM_ACCT_EXPIRED
;
838 (void) pam_prompt(handle
, PAM_ERROR_MSG
, NULL
, "User record is blocked, prohibiting access.");
839 return PAM_ACCT_EXPIRED
;
842 (void) pam_prompt(handle
, PAM_ERROR_MSG
, NULL
, "User record is not valid yet, prohibiting access.");
843 return PAM_ACCT_EXPIRED
;
846 (void) pam_prompt(handle
, PAM_ERROR_MSG
, NULL
, "User record is not valid anymore, prohibiting access.");
847 return PAM_ACCT_EXPIRED
;
851 (void) pam_prompt(handle
, PAM_ERROR_MSG
, NULL
, "User record not valid, prohibiting access.");
852 return PAM_ACCT_EXPIRED
;
858 t
= user_record_ratelimit_next_try(ur
);
859 if (t
!= USEC_INFINITY
) {
860 usec_t n
= now(CLOCK_REALTIME
);
863 char buf
[FORMAT_TIMESPAN_MAX
];
864 (void) pam_prompt(handle
, PAM_ERROR_MSG
, NULL
, "Too many logins, try again in %s.",
865 format_timespan(buf
, sizeof(buf
), t
- n
, USEC_PER_SEC
));
871 r
= user_record_test_password_change_required(ur
);
875 (void) pam_prompt(handle
, PAM_ERROR_MSG
, NULL
, "Password change required.");
876 return PAM_NEW_AUTHTOK_REQD
;
879 (void) pam_prompt(handle
, PAM_ERROR_MSG
, NULL
, "Password expired, change requird.");
880 return PAM_NEW_AUTHTOK_REQD
;
883 /* Strictly speaking this is only about password expiration, and we might want to allow
884 * authentication via PKCS#11 or so, but let's ignore this fine distinction for now. */
885 (void) pam_prompt(handle
, PAM_ERROR_MSG
, NULL
, "Password is expired, but can't change, refusing login.");
886 return PAM_AUTHTOK_EXPIRED
;
889 (void) pam_prompt(handle
, PAM_ERROR_MSG
, NULL
, "Password will expire soon, please change.");
893 /* All good, just means the password if we wanted to change we couldn't, but we don't need to */
898 (void) pam_prompt(handle
, PAM_ERROR_MSG
, NULL
, "User record not valid, prohibiting access.");
899 return PAM_AUTHTOK_EXPIRED
;
908 _public_ PAM_EXTERN
int pam_sm_chauthtok(
909 pam_handle_t
*handle
,
914 _cleanup_(user_record_unrefp
) UserRecord
*ur
= NULL
, *old_secret
= NULL
, *new_secret
= NULL
;
915 const char *old_password
= NULL
, *new_password
= NULL
;
916 _cleanup_(sd_bus_unrefp
) sd_bus
*bus
= NULL
;
917 unsigned n_attempts
= 0;
921 if (parse_argv(handle
,
928 pam_syslog(handle
, LOG_DEBUG
, "pam-systemd-homed account management");
930 r
= pam_acquire_bus_connection(handle
, &bus
);
931 if (r
!= PAM_SUCCESS
)
934 r
= acquire_user_record(handle
, NULL
, &ur
);
935 if (r
!= PAM_SUCCESS
)
938 /* Start with cached credentials */
939 r
= pam_get_item(handle
, PAM_OLDAUTHTOK
, (const void**) &old_password
);
940 if (!IN_SET(r
, PAM_BAD_ITEM
, PAM_SUCCESS
)) {
941 pam_syslog(handle
, LOG_ERR
, "Failed to get old password: %s", pam_strerror(handle
, r
));
944 r
= pam_get_item(handle
, PAM_AUTHTOK
, (const void**) &new_password
);
945 if (!IN_SET(r
, PAM_BAD_ITEM
, PAM_SUCCESS
)) {
946 pam_syslog(handle
, LOG_ERR
, "Failed to get cached password: %s", pam_strerror(handle
, r
));
950 if (isempty(new_password
)) {
951 /* No, it's not cached, then let's ask for the password and its verification, and cache
954 r
= pam_get_authtok_noverify(handle
, &new_password
, "New password: ");
955 if (r
!= PAM_SUCCESS
) {
956 pam_syslog(handle
, LOG_ERR
, "Failed to get new password: %s", pam_strerror(handle
, r
));
959 if (isempty(new_password
)) {
960 pam_syslog(handle
, LOG_DEBUG
, "Password request aborted.");
961 return PAM_AUTHTOK_ERR
;
964 r
= pam_get_authtok_verify(handle
, &new_password
, "new password: "); /* Lower case, since PAM prefixes 'Repeat' */
965 if (r
!= PAM_SUCCESS
) {
966 pam_syslog(handle
, LOG_ERR
, "Failed to get password again: %s", pam_strerror(handle
, r
));
970 // FIXME: pam_pwquality will ask for the password a third time. It really shouldn't do
971 // that, and instead assume the password was already verified once when it is found to be
972 // cached already. needs to be fixed in pam_pwquality
975 /* Now everything is cached and checked, let's exit from the preliminary check */
976 if (FLAGS_SET(flags
, PAM_PRELIM_CHECK
))
979 old_secret
= user_record_new();
981 return pam_log_oom(handle
);
983 if (!isempty(old_password
)) {
984 r
= user_record_set_password(old_secret
, STRV_MAKE(old_password
), true);
986 pam_syslog(handle
, LOG_ERR
, "Failed to store old password: %s", strerror_safe(r
));
987 return PAM_SERVICE_ERR
;
991 new_secret
= user_record_new();
993 return pam_log_oom(handle
);
995 r
= user_record_set_password(new_secret
, STRV_MAKE(new_password
), true);
997 pam_syslog(handle
, LOG_ERR
, "Failed to store new password: %s", strerror_safe(r
));
998 return PAM_SERVICE_ERR
;
1002 _cleanup_(sd_bus_error_free
) sd_bus_error error
= SD_BUS_ERROR_NULL
;
1003 _cleanup_(sd_bus_message_unrefp
) sd_bus_message
*m
= NULL
;
1005 r
= bus_message_new_method_call(bus
, &m
, bus_home_mgr
, "ChangePasswordHome");
1007 return pam_bus_log_create_error(handle
, r
);
1009 r
= sd_bus_message_append(m
, "s", ur
->user_name
);
1011 return pam_bus_log_create_error(handle
, r
);
1013 r
= bus_message_append_secret(m
, new_secret
);
1015 return pam_bus_log_create_error(handle
, r
);
1017 r
= bus_message_append_secret(m
, old_secret
);
1019 return pam_bus_log_create_error(handle
, r
);
1021 r
= sd_bus_call(bus
, m
, HOME_SLOW_BUS_CALL_TIMEOUT_USEC
, &error
, NULL
);
1023 r
= handle_generic_user_record_error(handle
, ur
->user_name
, old_secret
, r
, &error
);
1024 if (r
== PAM_CONV_ERR
) {
1025 pam_syslog(handle
, LOG_ERR
, "Failed to prompt for password/prompt.");
1026 return PAM_CONV_ERR
;
1028 if (r
!= PAM_SUCCESS
)
1031 pam_syslog(handle
, LOG_NOTICE
, "Successfully changed password for user %s.", ur
->user_name
);
1035 if (++n_attempts
>= 5)
1041 pam_syslog(handle
, LOG_NOTICE
, "Failed to change password for user %s: %m", ur
->user_name
);
1042 return PAM_MAXTRIES
;