src/shared/ask-password-api.c

   1 /***
   2   This file is part of systemd.
   3
   4   Copyright 2010 Lennart Poettering
   5
   6   systemd is free software; you can redistribute it and/or modify it
   7   under the terms of the GNU Lesser General Public License as published by
   8   the Free Software Foundation; either version 2.1 of the License, or
   9   (at your option) any later version.
  10
  11   systemd is distributed in the hope that it will be useful, but
  12   WITHOUT ANY WARRANTY; without even the implied warranty of
  13   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14   Lesser General Public License for more details.
  15
  16   You should have received a copy of the GNU Lesser General Public License
  17   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  18 ***/
  19
  20 #include <errno.h>
  21 #include <fcntl.h>
  22 #include <inttypes.h>
  23 #include <limits.h>
  24 #include <poll.h>
  25 #include <signal.h>
  26 #include <stdbool.h>
  27 #include <stddef.h>
  28 #include <stdint.h>
  29 #include <stdio.h>
  30 #include <stdlib.h>
  31 #include <string.h>
  32 #include <sys/inotify.h>
  33 #include <sys/signalfd.h>
  34 #include <sys/socket.h>
  35 #include <sys/stat.h>
  36 #include <sys/time.h>
  37 #include <sys/uio.h>
  38 #include <sys/un.h>
  39 #include <termios.h>
  40 #include <unistd.h>
  41
  42 #include "alloc-util.h"
  43 #include "ask-password-api.h"
  44 #include "fd-util.h"
  45 #include "fileio.h"
  46 #include "format-util.h"
  47 #include "io-util.h"
  48 #include "log.h"
  49 #include "macro.h"
  50 #include "missing.h"
  51 #include "mkdir.h"
  52 #include "process-util.h"
  53 #include "random-util.h"
  54 #include "signal-util.h"
  55 #include "socket-util.h"
  56 #include "string-util.h"
  57 #include "strv.h"
  58 #include "terminal-util.h"
  59 #include "time-util.h"
  60 #include "umask-util.h"
  61 #include "utf8.h"
  62 #include "util.h"
  63
  64 #define KEYRING_TIMEOUT_USEC ((5 * USEC_PER_MINUTE) / 2)
  65
  66 static int lookup_key(const char *keyname, key_serial_t *ret) {
  67         key_serial_t serial;
  68
  69         assert(keyname);
  70         assert(ret);
  71
  72         serial = request_key("user", keyname, NULL, 0);
  73         if (serial == -1)
  74                 return negative_errno();
  75
  76         *ret = serial;
  77         return 0;
  78 }
  79
  80 static int retrieve_key(key_serial_t serial, char ***ret) {
  81         _cleanup_free_ char *p = NULL;
  82         long m = 100, n;
  83         char **l;
  84
  85         assert(ret);
  86
  87         for (;;) {
  88                 p = new(char, m);
  89                 if (!p)
  90                         return -ENOMEM;
  91
  92                 n = keyctl(KEYCTL_READ, (unsigned long) serial, (unsigned long) p, (unsigned long) m, 0);
  93                 if (n < 0)
  94                         return -errno;
  95
  96                 if (n < m)
  97                         break;
  98
  99                 explicit_bzero(p, n);
 100                 free(p);
 101                 m *= 2;
 102         }
 103
 104         l = strv_parse_nulstr(p, n);
 105         if (!l)
 106                 return -ENOMEM;
 107
 108         explicit_bzero(p, n);
 109
 110         *ret = l;
 111         return 0;
 112 }
 113
 114 static int add_to_keyring(const char *keyname, AskPasswordFlags flags, char **passwords) {
 115         _cleanup_strv_free_erase_ char **l = NULL;
 116         _cleanup_free_ char *p = NULL;
 117         key_serial_t serial;
 118         size_t n;
 119         int r;
 120
 121         assert(keyname);
 122         assert(passwords);
 123
 124         if (!(flags & ASK_PASSWORD_PUSH_CACHE))
 125                 return 0;
 126
 127         r = lookup_key(keyname, &serial);
 128         if (r >= 0) {
 129                 r = retrieve_key(serial, &l);
 130                 if (r < 0)
 131                         return r;
 132         } else if (r != -ENOKEY)
 133                 return r;
 134
 135         r = strv_extend_strv(&l, passwords, true);
 136         if (r <= 0)
 137                 return r;
 138
 139         r = strv_make_nulstr(l, &p, &n);
 140         if (r < 0)
 141                 return r;
 142
 143         serial = add_key("user", keyname, p, n, KEY_SPEC_USER_KEYRING);
 144         explicit_bzero(p, n);
 145         if (serial == -1)
 146                 return -errno;
 147
 148         if (keyctl(KEYCTL_SET_TIMEOUT,
 149                    (unsigned long) serial,
 150                    (unsigned long) DIV_ROUND_UP(KEYRING_TIMEOUT_USEC, USEC_PER_SEC), 0, 0) < 0)
 151                 log_debug_errno(errno, "Failed to adjust timeout: %m");
 152
 153         log_debug("Added key to keyring as %" PRIi32 ".", serial);
 154
 155         return 1;
 156 }
 157
 158 static int add_to_keyring_and_log(const char *keyname, AskPasswordFlags flags, char **passwords) {
 159         int r;
 160
 161         assert(keyname);
 162         assert(passwords);
 163
 164         r = add_to_keyring(keyname, flags, passwords);
 165         if (r < 0)
 166                 return log_debug_errno(r, "Failed to add password to keyring: %m");
 167
 168         return 0;
 169 }
 170
 171 int ask_password_keyring(const char *keyname, AskPasswordFlags flags, char ***ret) {
 172
 173         key_serial_t serial;
 174         int r;
 175
 176         assert(keyname);
 177         assert(ret);
 178
 179         if (!(flags & ASK_PASSWORD_ACCEPT_CACHED))
 180                 return -EUNATCH;
 181
 182         r = lookup_key(keyname, &serial);
 183         if (r == -ENOSYS) /* when retrieving the distinction doesn't matter */
 184                 return -ENOKEY;
 185         if (r < 0)
 186                 return r;
 187
 188         return retrieve_key(serial, ret);
 189 }
 190
 191 static void backspace_chars(int ttyfd, size_t p) {
 192
 193         if (ttyfd < 0)
 194                 return;
 195
 196         while (p > 0) {
 197                 p--;
 198
 199                 loop_write(ttyfd, "\b \b", 3, false);
 200         }
 201 }
 202
 203 int ask_password_tty(
 204                 const char *message,
 205                 const char *keyname,
 206                 usec_t until,
 207                 AskPasswordFlags flags,
 208                 const char *flag_file,
 209                 char **ret) {
 210
 211         struct termios old_termios, new_termios;
 212         char passphrase[LINE_MAX + 1] = {}, *x;
 213         size_t p = 0, codepoint = 0;
 214         int r;
 215         _cleanup_close_ int ttyfd = -1, notify = -1;
 216         struct pollfd pollfd[2];
 217         bool reset_tty = false;
 218         bool dirty = false;
 219         enum {
 220                 POLL_TTY,
 221                 POLL_INOTIFY
 222         };
 223
 224         assert(ret);
 225
 226         if (flags & ASK_PASSWORD_NO_TTY)
 227                 return -EUNATCH;
 228
 229         if (!message)
 230                 message = "Password:";
 231
 232         if (flag_file) {
 233                 notify = inotify_init1(IN_CLOEXEC|IN_NONBLOCK);
 234                 if (notify < 0) {
 235                         r = -errno;
 236                         goto finish;
 237                 }
 238
 239                 if (inotify_add_watch(notify, flag_file, IN_ATTRIB /* for the link count */) < 0) {
 240                         r = -errno;
 241                         goto finish;
 242                 }
 243         }
 244
 245         ttyfd = open("/dev/tty", O_RDWR|O_NOCTTY|O_CLOEXEC);
 246         if (ttyfd >= 0) {
 247
 248                 if (tcgetattr(ttyfd, &old_termios) < 0) {
 249                         r = -errno;
 250                         goto finish;
 251                 }
 252
 253                 if (colors_enabled())
 254                         loop_write(ttyfd, ANSI_HIGHLIGHT, strlen(ANSI_HIGHLIGHT), false);
 255                 loop_write(ttyfd, message, strlen(message), false);
 256                 loop_write(ttyfd, " ", 1, false);
 257                 if (colors_enabled())
 258                         loop_write(ttyfd, ANSI_NORMAL, strlen(ANSI_NORMAL), false);
 259
 260                 new_termios = old_termios;
 261                 new_termios.c_lflag &= ~(ICANON|ECHO);
 262                 new_termios.c_cc[VMIN] = 1;
 263                 new_termios.c_cc[VTIME] = 0;
 264
 265                 if (tcsetattr(ttyfd, TCSADRAIN, &new_termios) < 0) {
 266                         r = -errno;
 267                         goto finish;
 268                 }
 269
 270                 reset_tty = true;
 271         }
 272
 273         zero(pollfd);
 274         pollfd[POLL_TTY].fd = ttyfd >= 0 ? ttyfd : STDIN_FILENO;
 275         pollfd[POLL_TTY].events = POLLIN;
 276         pollfd[POLL_INOTIFY].fd = notify;
 277         pollfd[POLL_INOTIFY].events = POLLIN;
 278
 279         for (;;) {
 280                 char c;
 281                 int sleep_for = -1, k;
 282                 ssize_t n;
 283
 284                 if (until > 0) {
 285                         usec_t y;
 286
 287                         y = now(CLOCK_MONOTONIC);
 288
 289                         if (y > until) {
 290                                 r = -ETIME;
 291                                 goto finish;
 292                         }
 293
 294                         sleep_for = (int) ((until - y) / USEC_PER_MSEC);
 295                 }
 296
 297                 if (flag_file)
 298                         if (access(flag_file, F_OK) < 0) {
 299                                 r = -errno;
 300                                 goto finish;
 301                         }
 302
 303                 k = poll(pollfd, notify >= 0 ? 2 : 1, sleep_for);
 304                 if (k < 0) {
 305                         if (errno == EINTR)
 306                                 continue;
 307
 308                         r = -errno;
 309                         goto finish;
 310                 } else if (k == 0) {
 311                         r = -ETIME;
 312                         goto finish;
 313                 }
 314
 315                 if (notify >= 0 && pollfd[POLL_INOTIFY].revents != 0)
 316                         flush_fd(notify);
 317
 318                 if (pollfd[POLL_TTY].revents == 0)
 319                         continue;
 320
 321                 n = read(ttyfd >= 0 ? ttyfd : STDIN_FILENO, &c, 1);
 322                 if (n < 0) {
 323                         if (errno == EINTR || errno == EAGAIN)
 324                                 continue;
 325
 326                         r = -errno;
 327                         goto finish;
 328
 329                 } else if (n == 0)
 330                         break;
 331
 332                 if (c == '\n')
 333                         break;
 334                 else if (c == 21) { /* C-u */
 335
 336                         if (!(flags & ASK_PASSWORD_SILENT))
 337                                 backspace_chars(ttyfd, p);
 338                         p = 0;
 339
 340                 } else if (c == '\b' || c == 127) {
 341
 342                         if (p > 0) {
 343
 344                                 if (!(flags & ASK_PASSWORD_SILENT))
 345                                         backspace_chars(ttyfd, 1);
 346
 347                                 p--;
 348                         } else if (!dirty && !(flags & ASK_PASSWORD_SILENT)) {
 349
 350                                 flags |= ASK_PASSWORD_SILENT;
 351
 352                                 /* There are two ways to enter silent
 353                                  * mode. Either by pressing backspace
 354                                  * as first key (and only as first
 355                                  * key), or ... */
 356                                 if (ttyfd >= 0)
 357                                         loop_write(ttyfd, "(no echo) ", 10, false);
 358
 359                         } else if (ttyfd >= 0)
 360                                 loop_write(ttyfd, "\a", 1, false);
 361
 362                 } else if (c == '\t' && !(flags & ASK_PASSWORD_SILENT)) {
 363
 364                         backspace_chars(ttyfd, p);
 365                         flags |= ASK_PASSWORD_SILENT;
 366
 367                         /* ... or by pressing TAB at any time. */
 368
 369                         if (ttyfd >= 0)
 370                                 loop_write(ttyfd, "(no echo) ", 10, false);
 371                 } else {
 372                         if (p >= sizeof(passphrase)-1) {
 373                                 loop_write(ttyfd, "\a", 1, false);
 374                                 continue;
 375                         }
 376
 377                         passphrase[p++] = c;
 378
 379                         if (!(flags & ASK_PASSWORD_SILENT) && ttyfd >= 0) {
 380                                 n = utf8_encoded_valid_unichar(passphrase + codepoint);
 381                                 if (n >= 0) {
 382                                         codepoint = p;
 383                                         loop_write(ttyfd, (flags & ASK_PASSWORD_ECHO) ? &c : "*", 1, false);
 384                                 }
 385                         }
 386
 387                         dirty = true;
 388                 }
 389
 390                 c = 'x';
 391         }
 392
 393         x = strndup(passphrase, p);
 394         explicit_bzero(passphrase, p);
 395         if (!x) {
 396                 r = -ENOMEM;
 397                 goto finish;
 398         }
 399
 400         if (keyname)
 401                 (void) add_to_keyring_and_log(keyname, flags, STRV_MAKE(x));
 402
 403         *ret = x;
 404         r = 0;
 405
 406 finish:
 407         if (ttyfd >= 0 && reset_tty) {
 408                 loop_write(ttyfd, "\n", 1, false);
 409                 tcsetattr(ttyfd, TCSADRAIN, &old_termios);
 410         }
 411
 412         return r;
 413 }
 414
 415 static int create_socket(char **name) {
 416         union sockaddr_union sa = {
 417                 .un.sun_family = AF_UNIX,
 418         };
 419         _cleanup_close_ int fd = -1;
 420         static const int one = 1;
 421         char *c;
 422         int r;
 423
 424         assert(name);
 425
 426         fd = socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
 427         if (fd < 0)
 428                 return -errno;
 429
 430         snprintf(sa.un.sun_path, sizeof(sa.un.sun_path)-1, "/run/systemd/ask-password/sck.%" PRIx64, random_u64());
 431
 432         RUN_WITH_UMASK(0177) {
 433                 if (bind(fd, &sa.sa, SOCKADDR_UN_LEN(sa.un)) < 0)
 434                         return -errno;
 435         }
 436
 437         if (setsockopt(fd, SOL_SOCKET, SO_PASSCRED, &one, sizeof(one)) < 0)
 438                 return -errno;
 439
 440         c = strdup(sa.un.sun_path);
 441         if (!c)
 442                 return -ENOMEM;
 443
 444         *name = c;
 445
 446         r = fd;
 447         fd = -1;
 448
 449         return r;
 450 }
 451
 452 int ask_password_agent(
 453                 const char *message,
 454                 const char *icon,
 455                 const char *id,
 456                 const char *keyname,
 457                 usec_t until,
 458                 AskPasswordFlags flags,
 459                 char ***ret) {
 460
 461         enum {
 462                 FD_SOCKET,
 463                 FD_SIGNAL,
 464                 _FD_MAX
 465         };
 466
 467         _cleanup_close_ int socket_fd = -1, signal_fd = -1, fd = -1;
 468         char temp[] = "/run/systemd/ask-password/tmp.XXXXXX";
 469         char final[sizeof(temp)] = "";
 470         _cleanup_free_ char *socket_name = NULL;
 471         _cleanup_strv_free_ char **l = NULL;
 472         _cleanup_fclose_ FILE *f = NULL;
 473         struct pollfd pollfd[_FD_MAX];
 474         sigset_t mask, oldmask;
 475         int r;
 476
 477         assert(ret);
 478
 479         if (flags & ASK_PASSWORD_NO_AGENT)
 480                 return -EUNATCH;
 481
 482         assert_se(sigemptyset(&mask) >= 0);
 483         assert_se(sigset_add_many(&mask, SIGINT, SIGTERM, -1) >= 0);
 484         assert_se(sigprocmask(SIG_BLOCK, &mask, &oldmask) >= 0);
 485
 486         (void) mkdir_p_label("/run/systemd/ask-password", 0755);
 487
 488         fd = mkostemp_safe(temp);
 489         if (fd < 0) {
 490                 r = fd;
 491                 goto finish;
 492         }
 493
 494         (void) fchmod(fd, 0644);
 495
 496         f = fdopen(fd, "w");
 497         if (!f) {
 498                 r = -errno;
 499                 goto finish;
 500         }
 501
 502         fd = -1;
 503
 504         signal_fd = signalfd(-1, &mask, SFD_NONBLOCK|SFD_CLOEXEC);
 505         if (signal_fd < 0) {
 506                 r = -errno;
 507                 goto finish;
 508         }
 509
 510         socket_fd = create_socket(&socket_name);
 511         if (socket_fd < 0) {
 512                 r = socket_fd;
 513                 goto finish;
 514         }
 515
 516         fprintf(f,
 517                 "[Ask]\n"
 518                 "PID="PID_FMT"\n"
 519                 "Socket=%s\n"
 520                 "AcceptCached=%i\n"
 521                 "Echo=%i\n"
 522                 "NotAfter="USEC_FMT"\n",
 523                 getpid_cached(),
 524                 socket_name,
 525                 (flags & ASK_PASSWORD_ACCEPT_CACHED) ? 1 : 0,
 526                 (flags & ASK_PASSWORD_ECHO) ? 1 : 0,
 527                 until);
 528
 529         if (message)
 530                 fprintf(f, "Message=%s\n", message);
 531
 532         if (icon)
 533                 fprintf(f, "Icon=%s\n", icon);
 534
 535         if (id)
 536                 fprintf(f, "Id=%s\n", id);
 537
 538         r = fflush_and_check(f);
 539         if (r < 0)
 540                 goto finish;
 541
 542         memcpy(final, temp, sizeof(temp));
 543
 544         final[sizeof(final)-11] = 'a';
 545         final[sizeof(final)-10] = 's';
 546         final[sizeof(final)-9] = 'k';
 547
 548         if (rename(temp, final) < 0) {
 549                 r = -errno;
 550                 goto finish;
 551         }
 552
 553         zero(pollfd);
 554         pollfd[FD_SOCKET].fd = socket_fd;
 555         pollfd[FD_SOCKET].events = POLLIN;
 556         pollfd[FD_SIGNAL].fd = signal_fd;
 557         pollfd[FD_SIGNAL].events = POLLIN;
 558
 559         for (;;) {
 560                 char passphrase[LINE_MAX+1];
 561                 struct msghdr msghdr;
 562                 struct iovec iovec;
 563                 struct ucred *ucred;
 564                 union {
 565                         struct cmsghdr cmsghdr;
 566                         uint8_t buf[CMSG_SPACE(sizeof(struct ucred))];
 567                 } control;
 568                 ssize_t n;
 569                 int k;
 570                 usec_t t;
 571
 572                 t = now(CLOCK_MONOTONIC);
 573
 574                 if (until > 0 && until <= t) {
 575                         r = -ETIME;
 576                         goto finish;
 577                 }
 578
 579                 k = poll(pollfd, _FD_MAX, until > 0 ? (int) ((until-t)/USEC_PER_MSEC) : -1);
 580                 if (k < 0) {
 581                         if (errno == EINTR)
 582                                 continue;
 583
 584                         r = -errno;
 585                         goto finish;
 586                 }
 587
 588                 if (k <= 0) {
 589                         r = -ETIME;
 590                         goto finish;
 591                 }
 592
 593                 if (pollfd[FD_SIGNAL].revents & POLLIN) {
 594                         r = -EINTR;
 595                         goto finish;
 596                 }
 597
 598                 if (pollfd[FD_SOCKET].revents != POLLIN) {
 599                         r = -EIO;
 600                         goto finish;
 601                 }
 602
 603                 zero(iovec);
 604                 iovec.iov_base = passphrase;
 605                 iovec.iov_len = sizeof(passphrase);
 606
 607                 zero(control);
 608                 zero(msghdr);
 609                 msghdr.msg_iov = &iovec;
 610                 msghdr.msg_iovlen = 1;
 611                 msghdr.msg_control = &control;
 612                 msghdr.msg_controllen = sizeof(control);
 613
 614                 n = recvmsg(socket_fd, &msghdr, 0);
 615                 if (n < 0) {
 616                         if (errno == EAGAIN ||
 617                             errno == EINTR)
 618                                 continue;
 619
 620                         r = -errno;
 621                         goto finish;
 622                 }
 623
 624                 cmsg_close_all(&msghdr);
 625
 626                 if (n <= 0) {
 627                         log_debug("Message too short");
 628                         continue;
 629                 }
 630
 631                 if (msghdr.msg_controllen < CMSG_LEN(sizeof(struct ucred)) ||
 632                     control.cmsghdr.cmsg_level != SOL_SOCKET ||
 633                     control.cmsghdr.cmsg_type != SCM_CREDENTIALS ||
 634                     control.cmsghdr.cmsg_len != CMSG_LEN(sizeof(struct ucred))) {
 635                         log_debug("Received message without credentials. Ignoring.");
 636                         continue;
 637                 }
 638
 639                 ucred = (struct ucred*) CMSG_DATA(&control.cmsghdr);
 640                 if (ucred->uid != 0) {
 641                         log_debug("Got request from unprivileged user. Ignoring.");
 642                         continue;
 643                 }
 644
 645                 if (passphrase[0] == '+') {
 646                         /* An empty message refers to the empty password */
 647                         if (n == 1)
 648                                 l = strv_new("", NULL);
 649                         else
 650                                 l = strv_parse_nulstr(passphrase+1, n-1);
 651                         explicit_bzero(passphrase, n);
 652                         if (!l) {
 653                                 r = -ENOMEM;
 654                                 goto finish;
 655                         }
 656
 657                         if (strv_length(l) <= 0) {
 658                                 l = strv_free(l);
 659                                 log_debug("Invalid packet");
 660                                 continue;
 661                         }
 662
 663                         break;
 664                 }
 665
 666                 if (passphrase[0] == '-') {
 667                         r = -ECANCELED;
 668                         goto finish;
 669                 }
 670
 671                 log_debug("Invalid packet");
 672         }
 673
 674         if (keyname)
 675                 (void) add_to_keyring_and_log(keyname, flags, l);
 676
 677         *ret = l;
 678         l = NULL;
 679         r = 0;
 680
 681 finish:
 682         if (socket_name)
 683                 (void) unlink(socket_name);
 684
 685         (void) unlink(temp);
 686
 687         if (final[0])
 688                 (void) unlink(final);
 689
 690         assert_se(sigprocmask(SIG_SETMASK, &oldmask, NULL) == 0);
 691         return r;
 692 }
 693
 694 int ask_password_auto(
 695                 const char *message,
 696                 const char *icon,
 697                 const char *id,
 698                 const char *keyname,
 699                 usec_t until,
 700                 AskPasswordFlags flags,
 701                 char ***ret) {
 702
 703         int r;
 704
 705         assert(ret);
 706
 707         if ((flags & ASK_PASSWORD_ACCEPT_CACHED) && keyname) {
 708                 r = ask_password_keyring(keyname, flags, ret);
 709                 if (r != -ENOKEY)
 710                         return r;
 711         }
 712
 713         if (!(flags & ASK_PASSWORD_NO_TTY) && isatty(STDIN_FILENO)) {
 714                 char *s = NULL, **l = NULL;
 715
 716                 r = ask_password_tty(message, keyname, until, flags, NULL, &s);
 717                 if (r < 0)
 718                         return r;
 719
 720                 r = strv_push(&l, s);
 721                 if (r < 0) {
 722                         string_erase(s);
 723                         free(s);
 724                         return -ENOMEM;
 725                 }
 726
 727                 *ret = l;
 728                 return 0;
 729         }
 730
 731         if (!(flags & ASK_PASSWORD_NO_AGENT))
 732                 return ask_password_agent(message, icon, id, keyname, until, flags, ret);
 733
 734         return -EUNATCH;
 735 }