lib/pam_wrapper/pam_wrapper.c

   1 /*
   2  * Copyright (c) 2015 Andreas Schneider <asn@samba.org>
   3  * Copyright (c) 2015 Jakub Hrozek <jakub.hrozek@posteo.se>
   4  *
   5  * This program is free software: you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation, either version 3 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License
  16  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  17  */
  18
  19 #include "config.h"
  20
  21 #include <errno.h>
  22 #include <stdarg.h>
  23 #include <stdbool.h>
  24 #include <stdlib.h>
  25 #include <stdio.h>
  26 #include <string.h>
  27 #include <stdint.h>
  28 #include <sys/types.h>
  29 #include <sys/stat.h>
  30 #include <dirent.h>
  31 #include <fcntl.h>
  32 #include <unistd.h>
  33 #include <dlfcn.h>
  34 #include <libgen.h>
  35 #include <signal.h>
  36 #include <limits.h>
  37
  38 #include <ftw.h>
  39
  40 #ifdef HAVE_SECURITY_PAM_APPL_H
  41 #include <security/pam_appl.h>
  42 #endif
  43 #ifdef HAVE_SECURITY_PAM_MODULES_H
  44 #include <security/pam_modules.h>
  45 #endif
  46 #ifdef HAVE_SECURITY_PAM_EXT_H
  47 #include <security/pam_ext.h>
  48 #endif
  49
  50 #include "pwrap_compat.h"
  51
  52 #ifdef HAVE_GCC_THREAD_LOCAL_STORAGE
  53 # define PWRAP_THREAD __thread
  54 #else
  55 # define PWRAP_THREAD
  56 #endif
  57
  58 #ifdef HAVE_CONSTRUCTOR_ATTRIBUTE
  59 #define CONSTRUCTOR_ATTRIBUTE __attribute__ ((constructor))
  60 #else
  61 #define CONSTRUCTOR_ATTRIBUTE
  62 #endif /* HAVE_CONSTRUCTOR_ATTRIBUTE */
  63
  64 #ifdef HAVE_DESTRUCTOR_ATTRIBUTE
  65 #define DESTRUCTOR_ATTRIBUTE __attribute__ ((destructor))
  66 #else
  67 #define DESTRUCTOR_ATTRIBUTE
  68 #endif /* HAVE_DESTRUCTOR_ATTRIBUTE */
  69
  70 #ifdef HAVE_ADDRESS_SANITIZER_ATTRIBUTE
  71 #define DO_NOT_SANITIZE_ADDRESS_ATTRIBUTE __attribute__((no_sanitize_address))
  72 #else /* DO_NOT_SANITIZE_ADDRESS_ATTRIBUTE */
  73 #define DO_NOT_SANITIZE_ADDRESS_ATTRIBUTE
  74 #endif /* DO_NOT_SANITIZE_ADDRESS_ATTRIBUTE */
  75
  76 /* GCC have printf type attribute check. */
  77 #ifdef HAVE_FUNCTION_ATTRIBUTE_FORMAT
  78 #define PRINTF_ATTRIBUTE(a,b) __attribute__ ((__format__ (__printf__, a, b)))
  79 #else
  80 #define PRINTF_ATTRIBUTE(a,b)
  81 #endif /* HAVE_FUNCTION_ATTRIBUTE_FORMAT */
  82
  83 #ifndef SAFE_FREE
  84 #define SAFE_FREE(x) do { if ((x) != NULL) {free(x); (x)=NULL;} } while(0)
  85 #endif
  86
  87 #ifndef discard_const
  88 #define discard_const(ptr) ((void *)((uintptr_t)(ptr)))
  89 #endif
  90
  91 #ifndef discard_const_p
  92 #define discard_const_p(type, ptr) ((type *)discard_const(ptr))
  93 #endif
  94
  95 /*****************
  96  * LOGGING
  97  *****************/
  98
  99 enum pwrap_dbglvl_e {
 100         PWRAP_LOG_ERROR = 0,
 101         PWRAP_LOG_WARN,
 102         PWRAP_LOG_DEBUG,
 103         PWRAP_LOG_TRACE
 104 };
 105
 106 static void pwrap_log(enum pwrap_dbglvl_e dbglvl,
 107                       const char *function,
 108                       const char *format, ...) PRINTF_ATTRIBUTE(3, 4);
 109 # define PWRAP_LOG(dbglvl, ...) pwrap_log((dbglvl), __func__, __VA_ARGS__)
 110
 111 static void pwrap_vlog(enum pwrap_dbglvl_e dbglvl,
 112                        const char *function,
 113                        const char *format,
 114                        va_list args) PRINTF_ATTRIBUTE(3, 0);
 115
 116 static void pwrap_vlog(enum pwrap_dbglvl_e dbglvl,
 117                        const char *function,
 118                        const char *format,
 119                        va_list args)
 120 {
 121         char buffer[1024];
 122         const char *d;
 123         unsigned int lvl = 0;
 124         const char *prefix = "PWRAP";
 125
 126         d = getenv("PAM_WRAPPER_DEBUGLEVEL");
 127         if (d != NULL) {
 128                 lvl = atoi(d);
 129         }
 130
 131         if (lvl < dbglvl) {
 132                 return;
 133         }
 134
 135         vsnprintf(buffer, sizeof(buffer), format, args);
 136
 137         switch (dbglvl) {
 138         case PWRAP_LOG_ERROR:
 139                 prefix = "PWRAP_ERROR";
 140                 break;
 141         case PWRAP_LOG_WARN:
 142                 prefix = "PWRAP_WARN";
 143                 break;
 144         case PWRAP_LOG_DEBUG:
 145                 prefix = "PWRAP_DEBUG";
 146                 break;
 147         case PWRAP_LOG_TRACE:
 148                 prefix = "PWRAP_TRACE";
 149                 break;
 150         }
 151
 152         fprintf(stderr,
 153                 "%s(%d) - %s: %s\n",
 154                 prefix,
 155                 (int)getpid(),
 156                 function,
 157                 buffer);
 158 }
 159
 160 static void pwrap_log(enum pwrap_dbglvl_e dbglvl,
 161                       const char *function,
 162                       const char *format, ...)
 163 {
 164         va_list va;
 165
 166         va_start(va, format);
 167         pwrap_vlog(dbglvl, function, format, va);
 168         va_end(va);
 169 }
 170
 171 /*****************
 172  * LIBC
 173  *****************/
 174
 175 #define LIBPAM_NAME "libpam.so.0"
 176
 177 typedef int (*__libpam_pam_start)(const char *service_name,
 178                                   const char *user,
 179                                   const struct pam_conv *pam_conversation,
 180                                   pam_handle_t **pamh);
 181
 182 typedef int (*__libpam_pam_end)(pam_handle_t *pamh, int pam_status);
 183
 184 typedef int (*__libpam_pam_authenticate)(pam_handle_t *pamh, int flags);
 185
 186 typedef int (*__libpam_pam_chauthtok)(pam_handle_t *pamh, int flags);
 187
 188 typedef int (*__libpam_pam_acct_mgmt)(pam_handle_t *pamh, int flags);
 189
 190 typedef int (*__libpam_pam_putenv)(pam_handle_t *pamh, const char *name_value);
 191
 192 typedef const char * (*__libpam_pam_getenv)(pam_handle_t *pamh, const char *name);
 193
 194 typedef char ** (*__libpam_pam_getenvlist)(pam_handle_t *pamh);
 195
 196 typedef int (*__libpam_pam_open_session)(pam_handle_t *pamh, int flags);
 197
 198 typedef int (*__libpam_pam_close_session)(pam_handle_t *pamh, int flags);
 199
 200 typedef int (*__libpam_pam_setcred)(pam_handle_t *pamh, int flags);
 201
 202 typedef int (*__libpam_pam_get_item)(const pam_handle_t *pamh,
 203                                      int item_type,
 204                                      const void **item);
 205
 206 typedef int (*__libpam_pam_set_item)(pam_handle_t *pamh,
 207                                      int item_type,
 208                                      const void *item);
 209
 210 typedef int (*__libpam_pam_get_data)(const pam_handle_t *pamh,
 211                                      const char *module_data_name,
 212                                      const void **data);
 213
 214 typedef int (*__libpam_pam_set_data)(pam_handle_t *pamh,
 215                                      const char *module_data_name,
 216                                      void *data,
 217                                      void (*cleanup)(pam_handle_t *pamh,
 218                                                      void *data,
 219                                                      int error_status));
 220
 221 typedef int (*__libpam_pam_vprompt)(pam_handle_t *pamh,
 222                                     int style,
 223                                     char **response,
 224                                     const char *fmt,
 225                                     va_list args);
 226
 227 typedef const char * (*__libpam_pam_strerror)(pam_handle_t *pamh,
 228                                               int errnum);
 229
 230 #ifdef HAVE_PAM_VSYSLOG
 231 typedef void (*__libpam_pam_vsyslog)(const pam_handle_t *pamh,
 232                                      int priority,
 233                                      const char *fmt,
 234                                      va_list args);
 235 #endif
 236
 237 #define PWRAP_SYMBOL_ENTRY(i) \
 238         union { \
 239                 __libpam_##i f; \
 240                 void *obj; \
 241         } _libpam_##i
 242
 243 struct pwrap_libpam_symbols {
 244         PWRAP_SYMBOL_ENTRY(pam_start);
 245         PWRAP_SYMBOL_ENTRY(pam_end);
 246         PWRAP_SYMBOL_ENTRY(pam_authenticate);
 247         PWRAP_SYMBOL_ENTRY(pam_chauthtok);
 248         PWRAP_SYMBOL_ENTRY(pam_acct_mgmt);
 249         PWRAP_SYMBOL_ENTRY(pam_putenv);
 250         PWRAP_SYMBOL_ENTRY(pam_getenv);
 251         PWRAP_SYMBOL_ENTRY(pam_getenvlist);
 252         PWRAP_SYMBOL_ENTRY(pam_open_session);
 253         PWRAP_SYMBOL_ENTRY(pam_close_session);
 254         PWRAP_SYMBOL_ENTRY(pam_setcred);
 255         PWRAP_SYMBOL_ENTRY(pam_get_item);
 256         PWRAP_SYMBOL_ENTRY(pam_set_item);
 257         PWRAP_SYMBOL_ENTRY(pam_get_data);
 258         PWRAP_SYMBOL_ENTRY(pam_set_data);
 259         PWRAP_SYMBOL_ENTRY(pam_vprompt);
 260         PWRAP_SYMBOL_ENTRY(pam_strerror);
 261 #ifdef HAVE_PAM_VSYSLOG
 262         PWRAP_SYMBOL_ENTRY(pam_vsyslog);
 263 #endif
 264 };
 265
 266 struct pwrap {
 267         struct {
 268                 void *handle;
 269                 struct pwrap_libpam_symbols symbols;
 270         } libpam;
 271
 272         bool enabled;
 273         bool initialised;
 274         char *config_dir;
 275         char *libpam_so;
 276 };
 277
 278 static struct pwrap pwrap;
 279
 280 /*********************************************************
 281  * PWRAP PROTOTYPES
 282  *********************************************************/
 283
 284 bool pam_wrapper_enabled(void);
 285 void pwrap_constructor(void) CONSTRUCTOR_ATTRIBUTE;
 286 void pwrap_destructor(void) DESTRUCTOR_ATTRIBUTE;
 287
 288 /*********************************************************
 289  * PWRAP LIBC LOADER FUNCTIONS
 290  *********************************************************/
 291
 292 enum pwrap_lib {
 293     PWRAP_LIBPAM,
 294 };
 295
 296 static void *pwrap_load_lib_handle(enum pwrap_lib lib)
 297 {
 298         int flags = RTLD_LAZY;
 299         void *handle = NULL;
 300
 301 #ifdef RTLD_DEEPBIND
 302         flags |= RTLD_DEEPBIND;
 303 #endif
 304
 305         switch (lib) {
 306         case PWRAP_LIBPAM:
 307                 handle = pwrap.libpam.handle;
 308                 if (handle == NULL) {
 309                         handle = dlopen(pwrap.libpam_so, flags);
 310                         if (handle != NULL) {
 311                                 PWRAP_LOG(PWRAP_LOG_DEBUG,
 312                                           "Opened %s\n", pwrap.libpam_so);
 313                                 pwrap.libpam.handle = handle;
 314                                 break;
 315                         }
 316                 }
 317                 break;
 318         }
 319
 320         if (handle == NULL) {
 321                 PWRAP_LOG(PWRAP_LOG_ERROR,
 322                           "Failed to dlopen library: %s\n",
 323                           dlerror());
 324                 exit(-1);
 325         }
 326
 327         return handle;
 328 }
 329
 330 static void *_pwrap_bind_symbol(enum pwrap_lib lib, const char *fn_name)
 331 {
 332         void *handle;
 333         void *func;
 334
 335         handle = pwrap_load_lib_handle(lib);
 336
 337         func = dlsym(handle, fn_name);
 338         if (func == NULL) {
 339                 PWRAP_LOG(PWRAP_LOG_ERROR,
 340                           "Failed to find %s: %s\n",
 341                           fn_name, dlerror());
 342                 exit(-1);
 343         }
 344
 345         return func;
 346 }
 347
 348 #define pwrap_bind_symbol_libpam(sym_name) \
 349         if (pwrap.libpam.symbols._libpam_##sym_name.obj == NULL) { \
 350                 pwrap.libpam.symbols._libpam_##sym_name.obj = \
 351                         _pwrap_bind_symbol(PWRAP_LIBPAM, #sym_name); \
 352         } \
 353
 354 /*
 355  * IMPORTANT
 356  *
 357  * Functions especially from libpam need to be loaded individually, you can't
 358  * load all at once or gdb will segfault at startup. The same applies to
 359  * valgrind and has probably something todo with with the linker.
 360  * So we need load each function at the point it is called the first time.
 361  */
 362 static int libpam_pam_start(const char *service_name,
 363                             const char *user,
 364                             const struct pam_conv *pam_conversation,
 365                             pam_handle_t **pamh)
 366 {
 367         pwrap_bind_symbol_libpam(pam_start);
 368
 369         return pwrap.libpam.symbols._libpam_pam_start.f(service_name,
 370                                                         user,
 371                                                         pam_conversation,
 372                                                         pamh);
 373 }
 374
 375 static int libpam_pam_end(pam_handle_t *pamh, int pam_status)
 376 {
 377         pwrap_bind_symbol_libpam(pam_end);
 378
 379         return pwrap.libpam.symbols._libpam_pam_end.f(pamh, pam_status);
 380 }
 381
 382 static int libpam_pam_authenticate(pam_handle_t *pamh, int flags)
 383 {
 384         pwrap_bind_symbol_libpam(pam_authenticate);
 385
 386         return pwrap.libpam.symbols._libpam_pam_authenticate.f(pamh, flags);
 387 }
 388
 389 static int libpam_pam_chauthtok(pam_handle_t *pamh, int flags)
 390 {
 391         pwrap_bind_symbol_libpam(pam_chauthtok);
 392
 393         return pwrap.libpam.symbols._libpam_pam_chauthtok.f(pamh, flags);
 394 }
 395
 396 static int libpam_pam_acct_mgmt(pam_handle_t *pamh, int flags)
 397 {
 398         pwrap_bind_symbol_libpam(pam_acct_mgmt);
 399
 400         return pwrap.libpam.symbols._libpam_pam_acct_mgmt.f(pamh, flags);
 401 }
 402
 403 static int libpam_pam_putenv(pam_handle_t *pamh, const char *name_value)
 404 {
 405         pwrap_bind_symbol_libpam(pam_putenv);
 406
 407         return pwrap.libpam.symbols._libpam_pam_putenv.f(pamh, name_value);
 408 }
 409
 410 static const char *libpam_pam_getenv(pam_handle_t *pamh, const char *name)
 411 {
 412         pwrap_bind_symbol_libpam(pam_getenv);
 413
 414         return pwrap.libpam.symbols._libpam_pam_getenv.f(pamh, name);
 415 }
 416
 417 static char **libpam_pam_getenvlist(pam_handle_t *pamh)
 418 {
 419         pwrap_bind_symbol_libpam(pam_getenvlist);
 420
 421         return pwrap.libpam.symbols._libpam_pam_getenvlist.f(pamh);
 422 }
 423
 424 static int libpam_pam_open_session(pam_handle_t *pamh, int flags)
 425 {
 426         pwrap_bind_symbol_libpam(pam_open_session);
 427
 428         return pwrap.libpam.symbols._libpam_pam_open_session.f(pamh, flags);
 429 }
 430
 431 static int libpam_pam_close_session(pam_handle_t *pamh, int flags)
 432 {
 433         pwrap_bind_symbol_libpam(pam_close_session);
 434
 435         return pwrap.libpam.symbols._libpam_pam_close_session.f(pamh, flags);
 436 }
 437
 438 static int libpam_pam_setcred(pam_handle_t *pamh, int flags)
 439 {
 440         pwrap_bind_symbol_libpam(pam_setcred);
 441
 442         return pwrap.libpam.symbols._libpam_pam_setcred.f(pamh, flags);
 443 }
 444
 445 static int libpam_pam_get_item(const pam_handle_t *pamh, int item_type, const void **item)
 446 {
 447         pwrap_bind_symbol_libpam(pam_get_item);
 448
 449         return pwrap.libpam.symbols._libpam_pam_get_item.f(pamh, item_type, item);
 450 }
 451
 452 static int libpam_pam_set_item(pam_handle_t *pamh, int item_type, const void *item)
 453 {
 454         pwrap_bind_symbol_libpam(pam_set_item);
 455
 456         return pwrap.libpam.symbols._libpam_pam_set_item.f(pamh, item_type, item);
 457 }
 458
 459 static int libpam_pam_get_data(const pam_handle_t *pamh,
 460                                const char *module_data_name,
 461                                const void **data)
 462 {
 463         pwrap_bind_symbol_libpam(pam_get_data);
 464
 465         return pwrap.libpam.symbols._libpam_pam_get_data.f(pamh,
 466                                                            module_data_name,
 467                                                            data);
 468 }
 469
 470 static int libpam_pam_set_data(pam_handle_t *pamh,
 471                                const char *module_data_name,
 472                                void *data,
 473                                void (*cleanup)(pam_handle_t *pamh,
 474                                                void *data,
 475                                                int error_status))
 476 {
 477         pwrap_bind_symbol_libpam(pam_set_data);
 478
 479         return pwrap.libpam.symbols._libpam_pam_set_data.f(pamh,
 480                                                            module_data_name,
 481                                                            data,
 482                                                            cleanup);
 483 }
 484
 485 static int libpam_pam_vprompt(pam_handle_t *pamh,
 486                               int style,
 487                               char **response,
 488                               const char *fmt,
 489                               va_list args)
 490 {
 491         pwrap_bind_symbol_libpam(pam_vprompt);
 492
 493         return pwrap.libpam.symbols._libpam_pam_vprompt.f(pamh,
 494                                                           style,
 495                                                           response,
 496                                                           fmt,
 497                                                           args);
 498 }
 499
 500 #ifdef HAVE_PAM_STRERROR_CONST
 501 static const char *libpam_pam_strerror(const pam_handle_t *pamh, int errnum)
 502 #else
 503 static const char *libpam_pam_strerror(pam_handle_t *pamh, int errnum)
 504 #endif
 505 {
 506         pwrap_bind_symbol_libpam(pam_strerror);
 507
 508         return pwrap.libpam.symbols._libpam_pam_strerror.f(discard_const_p(pam_handle_t, pamh), errnum);
 509 }
 510
 511 static void libpam_pam_vsyslog(const pam_handle_t *pamh,
 512                                int priority,
 513                                const char *fmt,
 514                                va_list args)
 515 {
 516 #ifdef HAVE_PAM_VSYSLOG
 517         pwrap_bind_symbol_libpam(pam_vsyslog);
 518
 519         pwrap.libpam.symbols._libpam_pam_vsyslog.f(pamh,
 520                                                    priority,
 521                                                    fmt,
 522                                                    args);
 523 #endif
 524 }
 525
 526 /*********************************************************
 527  * PWRAP INIT
 528  *********************************************************/
 529
 530 #define BUFFER_SIZE 32768
 531
 532 /* copy file from src to dst, overwrites dst */
 533 static int p_copy(const char *src, const char *dst, const char *pdir, mode_t mode)
 534 {
 535         int srcfd = -1;
 536         int dstfd = -1;
 537         int rc = -1;
 538         ssize_t bread, bwritten;
 539         struct stat sb;
 540         char buf[BUFFER_SIZE];
 541         int cmp;
 542
 543         cmp = strcmp(src, dst);
 544         if (cmp == 0) {
 545                 return -1;
 546         }
 547
 548         srcfd = open(src, O_RDONLY, 0);
 549         if (srcfd < 0) {
 550                 return -1;
 551         }
 552
 553         if (mode == 0) {
 554                 rc = fstat(srcfd, &sb);
 555                 if (rc != 0) {
 556                         rc = -1;
 557                         goto out;
 558                 }
 559                 mode = sb.st_mode;
 560         }
 561
 562         dstfd = open(dst, O_CREAT|O_WRONLY|O_TRUNC, mode);
 563         if (dstfd < 0) {
 564                 rc = -1;
 565                 goto out;
 566         }
 567
 568         for (;;) {
 569                 char *p;
 570                 bread = read(srcfd, buf, BUFFER_SIZE);
 571                 if (bread == 0) {
 572                         /* done */
 573                         break;
 574                 } else if (bread < 0) {
 575                         errno = EIO;
 576                         rc = -1;
 577                         goto out;
 578                 }
 579
 580                 /* EXTRA UGLY HACK */
 581                 if (pdir != NULL) {
 582                         p = buf;
 583
 584                         while (p < buf + BUFFER_SIZE) {
 585                                 if (*p == '/') {
 586                                         cmp = memcmp(p, "/etc/pam.d", 10);
 587                                         if (cmp == 0) {
 588                                                 memcpy(p, pdir, 10);
 589                                         }
 590                                 }
 591                                 p++;
 592                         }
 593                 }
 594
 595                 bwritten = write(dstfd, buf, bread);
 596                 if (bwritten < 0) {
 597                         errno = EIO;
 598                         rc = -1;
 599                         goto out;
 600                 }
 601
 602                 if (bread != bwritten) {
 603                         errno = EFAULT;
 604                         rc = -1;
 605                         goto out;
 606                 }
 607         }
 608
 609         rc = 0;
 610 out:
 611         if (srcfd != -1) {
 612                 close(srcfd);
 613         }
 614         if (dstfd != -1) {
 615                 close(dstfd);
 616         }
 617         if (rc < 0) {
 618                 unlink(dst);
 619         }
 620
 621         return rc;
 622 }
 623
 624 /* Do not pass any flag if not defined */
 625 #ifndef FTW_ACTIONRETVAL
 626 #define FTW_ACTIONRETVAL 0
 627 #endif
 628
 629 /* Action return values */
 630 #ifndef FTW_STOP
 631 #define FTW_STOP -1
 632 #endif
 633
 634 #ifndef FTW_CONTINUE
 635 #define FTW_CONTINUE 0
 636 #endif
 637
 638 #ifndef FTW_SKIP_SUBTREE
 639 #define FTW_SKIP_SUBTREE 0
 640 #endif
 641
 642 static int copy_ftw(const char *fpath,
 643                     const struct stat *sb,
 644                     int typeflag,
 645                     struct FTW *ftwbuf)
 646 {
 647         int rc;
 648         char buf[BUFFER_SIZE];
 649
 650         switch (typeflag) {
 651         case FTW_D:
 652         case FTW_DNR:
 653                 /* We want to copy the directories from this directory */
 654                 if (ftwbuf->level == 0) {
 655                         return FTW_CONTINUE;
 656                 }
 657                 return FTW_SKIP_SUBTREE;
 658         case FTW_F:
 659                 break;
 660         default:
 661                 return FTW_CONTINUE;
 662         }
 663
 664         rc = snprintf(buf, BUFFER_SIZE, "%s/%s", pwrap.config_dir, fpath + ftwbuf->base);
 665         if (rc >= BUFFER_SIZE) {
 666                 return FTW_STOP;
 667         }
 668
 669         PWRAP_LOG(PWRAP_LOG_TRACE, "Copying %s", fpath);
 670         rc = p_copy(fpath, buf, NULL, sb->st_mode);
 671         if (rc != 0) {
 672                 return FTW_STOP;
 673         }
 674
 675         return FTW_CONTINUE;
 676 }
 677
 678 static int copy_confdir(const char *src)
 679 {
 680         int rc;
 681
 682         PWRAP_LOG(PWRAP_LOG_DEBUG,
 683                   "Copy config files from %s to %s",
 684                   src,
 685                   pwrap.config_dir);
 686         rc = nftw(src, copy_ftw, 1, FTW_ACTIONRETVAL);
 687         if (rc != 0) {
 688                 return -1;
 689         }
 690
 691         return 0;
 692 }
 693
 694 static int p_rmdirs(const char *path);
 695
 696 static void pwrap_clean_stale_dirs(const char *dir)
 697 {
 698         size_t len = strlen(dir);
 699         char pidfile[len + 5];
 700         ssize_t rc;
 701         char buf[8] = {0};
 702         long int tmp;
 703         pid_t pid;
 704         int fd;
 705
 706         snprintf(pidfile,
 707                  sizeof(pidfile),
 708                  "%s/pid",
 709                  dir);
 710
 711         /* read the pidfile */
 712         fd = open(pidfile, O_RDONLY);
 713         if (fd < 0) {
 714                 if (errno == ENOENT) {
 715                         PWRAP_LOG(PWRAP_LOG_TRACE,
 716                                   "pidfile %s missing, nothing to do\n",
 717                                   pidfile);
 718                 } else {
 719                         PWRAP_LOG(PWRAP_LOG_ERROR,
 720                                   "Failed to open pidfile %s - error: %s",
 721                                   pidfile, strerror(errno));
 722                 }
 723                 return;
 724         }
 725
 726         rc = read(fd, buf, sizeof(buf));
 727         close(fd);
 728         if (rc < 0) {
 729                 PWRAP_LOG(PWRAP_LOG_ERROR,
 730                           "Failed to read pidfile %s - error: %s",
 731                           pidfile, strerror(errno));
 732                 return;
 733         }
 734
 735         buf[sizeof(buf) - 1] = '\0';
 736
 737         tmp = strtol(buf, NULL, 10);
 738         if (tmp == 0 || tmp > 0xFFFF || errno == ERANGE) {
 739                 PWRAP_LOG(PWRAP_LOG_ERROR,
 740                           "Failed to parse pid, buf=%s",
 741                           buf);
 742                 return;
 743         }
 744
 745         pid = (pid_t)(tmp & 0xFFFF);
 746
 747         rc = kill(pid, 0);
 748         if (rc == -1) {
 749                 PWRAP_LOG(PWRAP_LOG_TRACE,
 750                           "Remove stale pam_wrapper dir: %s",
 751                           dir);
 752                 p_rmdirs(dir);
 753         }
 754
 755         return;
 756 }
 757
 758 static void pwrap_init(void)
 759 {
 760         char tmp_config_dir[] = "/tmp/pam.X";
 761         size_t len = strlen(tmp_config_dir);
 762         const char *env;
 763         uint32_t i;
 764         int rc;
 765         char pam_library[128] = { 0 };
 766         char libpam_path[1024] = { 0 };
 767         ssize_t ret;
 768         FILE *pidfile;
 769         char pidfile_path[1024] = { 0 };
 770
 771         if (!pam_wrapper_enabled()) {
 772                 return;
 773         }
 774
 775         if (pwrap.initialised) {
 776                 return;
 777         }
 778
 779         PWRAP_LOG(PWRAP_LOG_DEBUG, "Initialize pam_wrapper");
 780
 781         for (i = 0; i < 36; i++) {
 782                 struct stat sb;
 783                 char c;
 784
 785                 if (i < 10) {
 786                         c = (char)(i + 48);
 787                 } else {
 788                         c = (char)(i + 87);
 789                 }
 790
 791                 tmp_config_dir[len - 1] = c;
 792                 rc = lstat(tmp_config_dir, &sb);
 793                 if (rc == 0) {
 794                         PWRAP_LOG(PWRAP_LOG_TRACE,
 795                                   "Check if pam_wrapper dir %s is a "
 796                                   "stale directory",
 797                                   tmp_config_dir);
 798                         pwrap_clean_stale_dirs(tmp_config_dir);
 799                         continue;
 800                 } else if (errno == ENOENT) {
 801                         break;
 802                 }
 803         }
 804
 805         if (i == 36) {
 806                 PWRAP_LOG(PWRAP_LOG_ERROR,
 807                           "Failed to find a possible path to create "
 808                           "pam_wrapper config dir: %s",
 809                           tmp_config_dir);
 810                 exit(1);
 811         }
 812
 813         pwrap.config_dir = strdup(tmp_config_dir);
 814         if (pwrap.config_dir == NULL) {
 815                 PWRAP_LOG(PWRAP_LOG_ERROR,
 816                           "No memory");
 817                 exit(1);
 818         }
 819         PWRAP_LOG(PWRAP_LOG_TRACE,
 820                   "pam_wrapper config dir: %s",
 821                   tmp_config_dir);
 822
 823         rc = mkdir(pwrap.config_dir, 0755);
 824         if (rc != 0) {
 825                 PWRAP_LOG(PWRAP_LOG_ERROR,
 826                           "Failed to create pam_wrapper config dir: %s - %s",
 827                           tmp_config_dir, strerror(errno));
 828         }
 829
 830         /* Create file with the PID of the the process */
 831         ret = snprintf(pidfile_path, sizeof(pidfile_path),
 832                        "%s/pid", pwrap.config_dir);
 833         if (ret < 0) {
 834                 p_rmdirs(pwrap.config_dir);
 835                 exit(1);
 836         }
 837
 838         pidfile = fopen(pidfile_path, "w");
 839         if (pidfile == NULL) {
 840                 p_rmdirs(pwrap.config_dir);
 841                 exit(1);
 842         }
 843
 844         rc = fprintf(pidfile, "%d", getpid());
 845         fclose(pidfile);
 846         if (rc <= 0) {
 847                 p_rmdirs(pwrap.config_dir);
 848                 exit(1);
 849         }
 850
 851         /* create lib subdirectory */
 852         snprintf(libpam_path,
 853                  sizeof(libpam_path),
 854                  "%s/lib",
 855                  pwrap.config_dir);
 856
 857         rc = mkdir(libpam_path, 0755);
 858         if (rc != 0) {
 859                 PWRAP_LOG(PWRAP_LOG_ERROR,
 860                           "Failed to create pam_wrapper config dir: %s - %s",
 861                           tmp_config_dir, strerror(errno));
 862                 p_rmdirs(pwrap.config_dir);
 863                 exit(1);
 864         }
 865
 866         snprintf(libpam_path,
 867                  sizeof(libpam_path),
 868                  "%s/lib/%s",
 869                  pwrap.config_dir,
 870                  LIBPAM_NAME);
 871
 872         pwrap.libpam_so = strdup(libpam_path);
 873         if (pwrap.libpam_so == NULL) {
 874                 PWRAP_LOG(PWRAP_LOG_ERROR, "No memory");
 875                 p_rmdirs(pwrap.config_dir);
 876                 exit(1);
 877         }
 878
 879         /* copy libpam.so.0 */
 880         snprintf(libpam_path, sizeof(libpam_path), "%s", PAM_LIBRARY);
 881         PWRAP_LOG(PWRAP_LOG_TRACE,
 882                   "PAM path: %s",
 883                   libpam_path);
 884
 885         ret = readlink(libpam_path, pam_library, sizeof(pam_library) - 1);
 886         PWRAP_LOG(PWRAP_LOG_TRACE,
 887                   "PAM library: %s",
 888                   pam_library);
 889         if (ret <= 0) {
 890                 PWRAP_LOG(PWRAP_LOG_ERROR, "Failed to read %s link", LIBPAM_NAME);
 891                 p_rmdirs(pwrap.config_dir);
 892                 exit(1);
 893         }
 894
 895         if (pam_library[0] == '/') {
 896                 snprintf(libpam_path,
 897                          sizeof(libpam_path),
 898                          "%s",
 899                          pam_library);
 900         } else {
 901                 char libpam_path_cp[sizeof(libpam_path)];
 902                 char *dname;
 903
 904                 strncpy(libpam_path_cp, libpam_path, sizeof(libpam_path_cp));
 905                 libpam_path_cp[sizeof(libpam_path_cp) - 1] = '\0';
 906
 907                 dname = dirname(libpam_path_cp);
 908                 if (dname == NULL) {
 909                         PWRAP_LOG(PWRAP_LOG_ERROR,
 910                                   "No directory component in %s", libpam_path);
 911                         p_rmdirs(pwrap.config_dir);
 912                         exit(1);
 913                 }
 914
 915                 snprintf(libpam_path,
 916                          sizeof(libpam_path),
 917                          "%s/%s",
 918                          dname,
 919                          pam_library);
 920         }
 921         PWRAP_LOG(PWRAP_LOG_TRACE, "Reconstructed PAM path: %s", libpam_path);
 922
 923         PWRAP_LOG(PWRAP_LOG_DEBUG, "Copy %s to %s", libpam_path, pwrap.libpam_so);
 924         rc = p_copy(libpam_path, pwrap.libpam_so, pwrap.config_dir, 0644);
 925         if (rc != 0) {
 926                 PWRAP_LOG(PWRAP_LOG_ERROR,
 927                           "Failed to copy %s - error: %s",
 928                           LIBPAM_NAME,
 929                           strerror(errno));
 930                 p_rmdirs(pwrap.config_dir);
 931                 exit(1);
 932         }
 933
 934         pwrap.initialised = true;
 935
 936         env = getenv("PAM_WRAPPER_SERVICE_DIR");
 937         if (env == NULL) {
 938                 PWRAP_LOG(PWRAP_LOG_ERROR, "No config file");
 939                 p_rmdirs(pwrap.config_dir);
 940                 exit(1);
 941         }
 942
 943         rc = copy_confdir(env);
 944         if (rc != 0) {
 945                 PWRAP_LOG(PWRAP_LOG_ERROR, "Failed to copy config files");
 946                 p_rmdirs(pwrap.config_dir);
 947                 exit(1);
 948         }
 949
 950         setenv("PAM_WRAPPER_RUNTIME_DIR", pwrap.config_dir, 1);
 951
 952         PWRAP_LOG(PWRAP_LOG_DEBUG, "Successfully initialized pam_wrapper");
 953 }
 954
 955 bool pam_wrapper_enabled(void)
 956 {
 957         const char *env;
 958
 959         pwrap.enabled = false;
 960
 961         env = getenv("PAM_WRAPPER");
 962         if (env != NULL && env[0] == '1') {
 963                 pwrap.enabled = true;
 964         }
 965
 966         if (pwrap.enabled) {
 967                 pwrap.enabled = false;
 968
 969                 env = getenv("PAM_WRAPPER_SERVICE_DIR");
 970                 if (env != NULL && env[0] != '\0') {
 971                         pwrap.enabled = true;
 972                 }
 973         }
 974
 975         return pwrap.enabled;
 976 }
 977
 978 /****************************
 979  * CONSTRUCTOR
 980  ***************************/
 981 void pwrap_constructor(void)
 982 {
 983         /*
 984          * Here is safe place to call pwrap_init() and initialize data
 985          * for main process.
 986          */
 987         pwrap_init();
 988 }
 989
 990
 991 #ifdef HAVE_OPENPAM
 992 static int pwrap_openpam_start(const char *service_name,
 993                                const char *user,
 994                                const struct pam_conv *pam_conversation,
 995                                pam_handle_t **pamh)
 996 {
 997         int rv;
 998         char fullpath[1024];
 999
1000         rv = openpam_set_feature(OPENPAM_RESTRICT_SERVICE_NAME, 0);
1001         if (rv != PAM_SUCCESS) {
1002                 PWRAP_LOG(PWRAP_LOG_ERROR,
1003                           "Cannot disable OPENPAM_RESTRICT_SERVICE_NAME");
1004                 return rv;
1005         }
1006
1007         rv = openpam_set_feature(OPENPAM_RESTRICT_MODULE_NAME, 0);
1008         if (rv != PAM_SUCCESS) {
1009                 PWRAP_LOG(PWRAP_LOG_ERROR,
1010                           "Cannot disable OPENPAM_RESTRICT_MODULE_NAME");
1011                 return rv;
1012         }
1013
1014         rv = openpam_set_feature(OPENPAM_VERIFY_MODULE_FILE, 0);
1015         if (rv != PAM_SUCCESS) {
1016                 PWRAP_LOG(PWRAP_LOG_ERROR,
1017                           "Cannot disable OPENPAM_VERIFY_MODULE_FILE");
1018                 return rv;
1019         }
1020
1021         rv = openpam_set_feature(OPENPAM_VERIFY_POLICY_FILE, 0);
1022         if (rv != PAM_SUCCESS) {
1023                 PWRAP_LOG(PWRAP_LOG_ERROR,
1024                           "Cannot disable OPENPAM_VERIFY_POLICY_FILE");
1025                 return rv;
1026         }
1027
1028         snprintf(fullpath,
1029                  sizeof(fullpath),
1030                  "%s/%s",
1031                  pwrap.config_dir,
1032                  service_name);
1033
1034         return libpam_pam_start(fullpath,
1035                                 user,
1036                                 pam_conversation,
1037                                 pamh);
1038 }
1039 #endif
1040
1041 static int pwrap_pam_start(const char *service_name,
1042                            const char *user,
1043                            const struct pam_conv *pam_conversation,
1044                            pam_handle_t **pamh)
1045 {
1046         PWRAP_LOG(PWRAP_LOG_TRACE,
1047                   "pam_start service=%s, user=%s",
1048                   service_name,
1049                   user);
1050
1051 #ifdef HAVE_OPENPAM
1052         return pwrap_openpam_start(service_name,
1053                                    user,
1054                                    pam_conversation,
1055                                    pamh);
1056 #else
1057         return libpam_pam_start(service_name,
1058                                 user,
1059                                 pam_conversation,
1060                                 pamh);
1061 #endif
1062 }
1063
1064
1065 int pam_start(const char *service_name,
1066               const char *user,
1067               const struct pam_conv *pam_conversation,
1068               pam_handle_t **pamh)
1069 {
1070         return pwrap_pam_start(service_name, user, pam_conversation, pamh);
1071 }
1072
1073 static int pwrap_pam_end(pam_handle_t *pamh, int pam_status)
1074 {
1075         PWRAP_LOG(PWRAP_LOG_TRACE, "pam_end status=%d", pam_status);
1076         return libpam_pam_end(pamh, pam_status);
1077 }
1078
1079
1080 int pam_end(pam_handle_t *pamh, int pam_status)
1081 {
1082         return pwrap_pam_end(pamh, pam_status);
1083 }
1084
1085 static int pwrap_pam_authenticate(pam_handle_t *pamh, int flags)
1086 {
1087         PWRAP_LOG(PWRAP_LOG_TRACE, "pwrap_pam_authenticate flags=%d", flags);
1088         return libpam_pam_authenticate(pamh, flags);
1089 }
1090
1091 int pam_authenticate(pam_handle_t *pamh, int flags)
1092 {
1093         return pwrap_pam_authenticate(pamh, flags);
1094 }
1095
1096 static int pwrap_pam_chauthtok(pam_handle_t *pamh, int flags)
1097 {
1098         PWRAP_LOG(PWRAP_LOG_TRACE, "pwrap_pam_chauthtok flags=%d", flags);
1099         return libpam_pam_chauthtok(pamh, flags);
1100 }
1101
1102 int pam_chauthtok(pam_handle_t *pamh, int flags)
1103 {
1104         return pwrap_pam_chauthtok(pamh, flags);
1105 }
1106
1107 static int pwrap_pam_acct_mgmt(pam_handle_t *pamh, int flags)
1108 {
1109         PWRAP_LOG(PWRAP_LOG_TRACE, "pwrap_pam_acct_mgmt flags=%d", flags);
1110         return libpam_pam_acct_mgmt(pamh, flags);
1111 }
1112
1113 int pam_acct_mgmt(pam_handle_t *pamh, int flags)
1114 {
1115         return pwrap_pam_acct_mgmt(pamh, flags);
1116 }
1117
1118 static int pwrap_pam_putenv(pam_handle_t *pamh, const char *name_value)
1119 {
1120         PWRAP_LOG(PWRAP_LOG_TRACE, "pwrap_putenv name_value=%s", name_value);
1121         return libpam_pam_putenv(pamh, name_value);
1122 }
1123
1124 int pam_putenv(pam_handle_t *pamh, const char *name_value)
1125 {
1126         return pwrap_pam_putenv(pamh, name_value);
1127 }
1128
1129 static const char *pwrap_pam_getenv(pam_handle_t *pamh, const char *name)
1130 {
1131         PWRAP_LOG(PWRAP_LOG_TRACE, "pwrap_getenv name=%s", name);
1132         return libpam_pam_getenv(pamh, name);
1133 }
1134
1135 const char *pam_getenv(pam_handle_t *pamh, const char *name)
1136 {
1137         return pwrap_pam_getenv(pamh, name);
1138 }
1139
1140 static char **pwrap_pam_getenvlist(pam_handle_t *pamh)
1141 {
1142         PWRAP_LOG(PWRAP_LOG_TRACE, "pwrap_getenvlist called");
1143         return libpam_pam_getenvlist(pamh);
1144 }
1145
1146 char **pam_getenvlist(pam_handle_t *pamh)
1147 {
1148         return pwrap_pam_getenvlist(pamh);
1149 }
1150
1151 static int pwrap_pam_open_session(pam_handle_t *pamh, int flags)
1152 {
1153         PWRAP_LOG(PWRAP_LOG_TRACE, "pwrap_pam_open_session flags=%d", flags);
1154         return libpam_pam_open_session(pamh, flags);
1155 }
1156
1157 int pam_open_session(pam_handle_t *pamh, int flags)
1158 {
1159         return pwrap_pam_open_session(pamh, flags);
1160 }
1161
1162 static int pwrap_pam_close_session(pam_handle_t *pamh, int flags)
1163 {
1164         PWRAP_LOG(PWRAP_LOG_TRACE, "pwrap_pam_close_session flags=%d", flags);
1165         return libpam_pam_close_session(pamh, flags);
1166 }
1167
1168 int pam_close_session(pam_handle_t *pamh, int flags)
1169 {
1170         return pwrap_pam_close_session(pamh, flags);
1171 }
1172
1173 static int pwrap_pam_setcred(pam_handle_t *pamh, int flags)
1174 {
1175         PWRAP_LOG(PWRAP_LOG_TRACE, "pwrap_pam_setcred flags=%d", flags);
1176         return libpam_pam_setcred(pamh, flags);
1177 }
1178
1179 int pam_setcred(pam_handle_t *pamh, int flags)
1180 {
1181         return pwrap_pam_setcred(pamh, flags);
1182 }
1183
1184 static const char *pwrap_get_service(const char *libpam_service)
1185 {
1186 #ifdef HAVE_OPENPAM
1187         const char *service_name;
1188
1189         PWRAP_LOG(PWRAP_LOG_TRACE,
1190                   "internal PAM_SERVICE=%s", libpam_service);
1191         service_name = strrchr(libpam_service, '/');
1192         if (service_name != NULL && service_name[0] == '/') {
1193                 service_name++;
1194         }
1195         PWRAP_LOG(PWRAP_LOG_TRACE,
1196                   "PAM_SERVICE=%s", service_name);
1197         return service_name;
1198 #else
1199         return libpam_service;
1200 #endif
1201 }
1202
1203 static int pwrap_pam_get_item(const pam_handle_t *pamh,
1204                               int item_type,
1205                               const void **item)
1206 {
1207         int rc;
1208         const char *svc;
1209
1210         PWRAP_LOG(PWRAP_LOG_TRACE, "pwrap_get_item called");
1211
1212         rc = libpam_pam_get_item(pamh, item_type, item);
1213
1214         if (rc == PAM_SUCCESS) {
1215                 switch(item_type) {
1216                 case PAM_USER:
1217                         PWRAP_LOG(PWRAP_LOG_TRACE,
1218                                   "pwrap_get_item PAM_USER=%s",
1219                                   (const char *)*item);
1220                         break;
1221                 case PAM_SERVICE:
1222                         svc = pwrap_get_service((const char *) *item);
1223
1224                         PWRAP_LOG(PWRAP_LOG_TRACE,
1225                                   "pwrap_get_item PAM_SERVICE=%s",
1226                                   svc);
1227                         *item = svc;
1228                         break;
1229                 case PAM_USER_PROMPT:
1230                         PWRAP_LOG(PWRAP_LOG_TRACE,
1231                                   "pwrap_get_item PAM_USER_PROMPT=%s",
1232                                   (const char *)*item);
1233                         break;
1234                 case PAM_TTY:
1235                         PWRAP_LOG(PWRAP_LOG_TRACE,
1236                                   "pwrap_get_item PAM_TTY=%s",
1237                                   (const char *)*item);
1238                         break;
1239                 case PAM_RUSER:
1240                         PWRAP_LOG(PWRAP_LOG_TRACE,
1241                                   "pwrap_get_item PAM_RUSER=%s",
1242                                   (const char *)*item);
1243                         break;
1244                 case PAM_RHOST:
1245                         PWRAP_LOG(PWRAP_LOG_TRACE,
1246                                   "pwrap_get_item PAM_RHOST=%s",
1247                                   (const char *)*item);
1248                         break;
1249                 case PAM_AUTHTOK:
1250                         PWRAP_LOG(PWRAP_LOG_TRACE,
1251                                   "pwrap_get_item PAM_AUTHTOK=%s",
1252                                   (const char *)*item);
1253                         break;
1254                 case PAM_OLDAUTHTOK:
1255                         PWRAP_LOG(PWRAP_LOG_TRACE,
1256                                   "pwrap_get_item PAM_OLDAUTHTOK=%s",
1257                                   (const char *)*item);
1258                         break;
1259                 case PAM_CONV:
1260                         PWRAP_LOG(PWRAP_LOG_TRACE,
1261                                   "pwrap_get_item PAM_CONV=%p",
1262                                   (const void *)*item);
1263                         break;
1264                 default:
1265                         PWRAP_LOG(PWRAP_LOG_TRACE,
1266                                   "pwrap_get_item item_type=%d item=%p",
1267                                   item_type, (const void *)*item);
1268                         break;
1269                 }
1270         } else {
1271                 PWRAP_LOG(PWRAP_LOG_TRACE, "pwrap_get_item failed rc=%d", rc);
1272         }
1273
1274         return rc;
1275 }
1276
1277 int pam_get_item(const pam_handle_t *pamh, int item_type, const void **item)
1278 {
1279         return pwrap_pam_get_item(pamh, item_type, item);
1280 }
1281
1282 static int pwrap_pam_set_item(pam_handle_t *pamh,
1283                               int item_type,
1284                               const void *item)
1285 {
1286         int rc;
1287
1288         PWRAP_LOG(PWRAP_LOG_TRACE, "pwrap_set_item called");
1289
1290         rc = libpam_pam_set_item(pamh, item_type, item);
1291         if (rc == PAM_SUCCESS) {
1292                 switch(item_type) {
1293                 case PAM_USER:
1294                         PWRAP_LOG(PWRAP_LOG_TRACE,
1295                                   "pwrap_set_item PAM_USER=%s",
1296                                   (const char *)item);
1297                         break;
1298                 case PAM_SERVICE:
1299                         PWRAP_LOG(PWRAP_LOG_TRACE,
1300                                   "pwrap_set_item PAM_SERVICE=%s",
1301                                   (const char *)item);
1302                         break;
1303                 case PAM_USER_PROMPT:
1304                         PWRAP_LOG(PWRAP_LOG_TRACE,
1305                                   "pwrap_set_item PAM_USER_PROMPT=%s",
1306                                   (const char *)item);
1307                         break;
1308                 case PAM_TTY:
1309                         PWRAP_LOG(PWRAP_LOG_TRACE,
1310                                   "pwrap_set_item PAM_TTY=%s",
1311                                   (const char *)item);
1312                         break;
1313                 case PAM_RUSER:
1314                         PWRAP_LOG(PWRAP_LOG_TRACE,
1315                                   "pwrap_set_item PAM_RUSER=%s",
1316                                   (const char *)item);
1317                         break;
1318                 case PAM_RHOST:
1319                         PWRAP_LOG(PWRAP_LOG_TRACE,
1320                                   "pwrap_set_item PAM_RHOST=%s",
1321                                   (const char *)item);
1322                         break;
1323                 case PAM_AUTHTOK:
1324                         PWRAP_LOG(PWRAP_LOG_TRACE,
1325                                   "pwrap_set_item PAM_AUTHTOK=%s",
1326                                   (const char *)item);
1327                         break;
1328                 case PAM_OLDAUTHTOK:
1329                         PWRAP_LOG(PWRAP_LOG_TRACE,
1330                                   "pwrap_set_item PAM_OLDAUTHTOK=%s",
1331                                   (const char *)item);
1332                         break;
1333                 case PAM_CONV:
1334                         PWRAP_LOG(PWRAP_LOG_TRACE,
1335                                   "pwrap_set_item PAM_CONV=%p",
1336                                   item);
1337                         break;
1338                 default:
1339                         PWRAP_LOG(PWRAP_LOG_TRACE,
1340                                   "pwrap_set_item item_type=%d item=%p",
1341                                   item_type, item);
1342                         break;
1343                 }
1344         } else {
1345                 PWRAP_LOG(PWRAP_LOG_TRACE, "pwrap_set_item failed rc=%d", rc);
1346         }
1347
1348         return rc;
1349 }
1350
1351 int pam_set_item(pam_handle_t *pamh, int item_type, const void *item)
1352 {
1353         return pwrap_pam_set_item(pamh, item_type, item);
1354 }
1355
1356 static int pwrap_pam_get_data(const pam_handle_t *pamh,
1357                               const char *module_data_name,
1358                               const void **data)
1359 {
1360         PWRAP_LOG(PWRAP_LOG_TRACE,
1361                   "pwrap_get_data module_data_name=%s", module_data_name);
1362         return libpam_pam_get_data(pamh, module_data_name, data);
1363 }
1364
1365 int pam_get_data(const pam_handle_t *pamh,
1366                  const char *module_data_name,
1367                  const void **data)
1368 {
1369         return pwrap_pam_get_data(pamh, module_data_name, data);
1370 }
1371
1372 static int pwrap_pam_set_data(pam_handle_t *pamh,
1373                               const char *module_data_name,
1374                               void *data,
1375                               void (*cleanup)(pam_handle_t *pamh,
1376                                               void *data,
1377                                               int error_status))
1378 {
1379         PWRAP_LOG(PWRAP_LOG_TRACE,
1380                   "pwrap_set_data module_data_name=%s data=%p",
1381                   module_data_name, data);
1382         return libpam_pam_set_data(pamh, module_data_name, data, cleanup);
1383 }
1384
1385 int pam_set_data(pam_handle_t *pamh,
1386                  const char *module_data_name,
1387                  void *data,
1388                  void (*cleanup)(pam_handle_t *pamh,
1389                                  void *data,
1390                                  int error_status))
1391 {
1392         return pwrap_pam_set_data(pamh, module_data_name, data, cleanup);
1393 }
1394
1395 #ifdef HAVE_PAM_VPROMPT_CONST
1396 static int pwrap_pam_vprompt(const pam_handle_t *pamh,
1397 #else
1398 static int pwrap_pam_vprompt(pam_handle_t *pamh,
1399 #endif
1400                              int style,
1401                              char **response,
1402                              const char *fmt,
1403                              va_list args)
1404 {
1405         PWRAP_LOG(PWRAP_LOG_TRACE, "pwrap_pam_vprompt style=%d", style);
1406         return libpam_pam_vprompt(discard_const_p(pam_handle_t, pamh),
1407                                   style,
1408                                   response,
1409                                   fmt,
1410                                   args);
1411 }
1412
1413 #ifdef HAVE_PAM_VPROMPT_CONST
1414 int pam_vprompt(const pam_handle_t *pamh,
1415                 int style,
1416                 char **response,
1417                 const char *fmt,
1418                 va_list args)
1419 #else
1420 int pam_vprompt(pam_handle_t *pamh,
1421                 int style,
1422                 char **response,
1423                 const char *fmt,
1424                 va_list args)
1425 #endif
1426 {
1427         return pwrap_pam_vprompt(discard_const_p(pam_handle_t, pamh),
1428                                  style,
1429                                  response,
1430                                  fmt,
1431                                  args);
1432 }
1433
1434 #ifdef HAVE_PAM_PROMPT_CONST
1435 int pam_prompt(const pam_handle_t *pamh,
1436                int style,
1437                char **response,
1438                const char *fmt, ...)
1439 #else
1440 int pam_prompt(pam_handle_t *pamh,
1441                int style,
1442                char **response,
1443                const char *fmt, ...)
1444 #endif
1445 {
1446         va_list args;
1447         int rv;
1448
1449         va_start(args, fmt);
1450         rv = pwrap_pam_vprompt(discard_const_p(pam_handle_t, pamh),
1451                                style,
1452                                response,
1453                                fmt,
1454                                args);
1455         va_end(args);
1456
1457         return rv;
1458 }
1459
1460 #ifdef HAVE_PAM_STRERROR_CONST
1461 static const char *pwrap_pam_strerror(const pam_handle_t *pamh, int errnum)
1462 #else
1463 static const char *pwrap_pam_strerror(pam_handle_t *pamh, int errnum)
1464 #endif
1465 {
1466         const char *str;
1467
1468         pwrap_init();
1469
1470         PWRAP_LOG(PWRAP_LOG_TRACE, "pam_strerror errnum=%d", errnum);
1471
1472         str = libpam_pam_strerror(discard_const_p(pam_handle_t, pamh),
1473                                   errnum);
1474
1475         PWRAP_LOG(PWRAP_LOG_TRACE, "pam_strerror error=%s", str);
1476
1477         return str;
1478 }
1479
1480 #ifdef HAVE_PAM_STRERROR_CONST
1481 const char *pam_strerror(const pam_handle_t *pamh, int errnum)
1482 #else
1483 const char *pam_strerror(pam_handle_t *pamh, int errnum)
1484 #endif
1485 {
1486         return pwrap_pam_strerror(discard_const_p(pam_handle_t, pamh),
1487                                   errnum);
1488 }
1489
1490 static void pwrap_pam_vsyslog(const pam_handle_t *pamh,
1491                               int priority,
1492                               const char *fmt,
1493                               va_list args) PRINTF_ATTRIBUTE(3, 0);
1494
1495 static void pwrap_pam_vsyslog(const pam_handle_t *pamh,
1496                               int priority,
1497                               const char *fmt,
1498                               va_list args)
1499 {
1500         const char *d;
1501         char syslog_str[32] = {0};
1502         enum pwrap_dbglvl_e dbglvl = PWRAP_LOG_TRACE;
1503
1504         PWRAP_LOG(PWRAP_LOG_TRACE, "pwrap_pam_vsyslog called");
1505
1506         d = getenv("PAM_WRAPPER_USE_SYSLOG");
1507         if (d != NULL && d[0] == '1') {
1508                 libpam_pam_vsyslog(pamh, priority, fmt, args);
1509                 return;
1510         }
1511
1512         switch(priority) {
1513         case 0: /* LOG_EMERG */
1514         case 1: /* LOG_ALERT */
1515         case 2: /* LOG_CRIT */
1516         case 3: /* LOG_ERR */
1517                 dbglvl = PWRAP_LOG_ERROR;
1518                 break;
1519         case 4: /* LOG_WARN */
1520                 dbglvl = PWRAP_LOG_WARN;
1521                 break;
1522         case 5: /* LOG_NOTICE */
1523         case 6: /* LOG_INFO */
1524         case 7: /* LOG_DEBUG */
1525                 dbglvl = PWRAP_LOG_DEBUG;
1526                 break;
1527         default:
1528                 dbglvl = PWRAP_LOG_TRACE;
1529                 break;
1530         }
1531
1532         snprintf(syslog_str, sizeof(syslog_str), "SYSLOG(%d)", priority);
1533
1534         pwrap_vlog(dbglvl, syslog_str, fmt, args);
1535 }
1536
1537 #ifdef HAVE_PAM_VSYSLOG
1538 void pam_vsyslog(const pam_handle_t *pamh,
1539                  int priority,
1540                  const char *fmt,
1541                  va_list args)
1542 {
1543         pwrap_pam_vsyslog(pamh, priority, fmt, args);
1544 }
1545 #endif
1546
1547 #ifdef HAVE_PAM_SYSLOG
1548 void pam_syslog(const pam_handle_t *pamh,
1549                 int priority,
1550                 const char *fmt, ...)
1551 {
1552         va_list args;
1553
1554         va_start(args, fmt);
1555         pwrap_pam_vsyslog(pamh, priority, fmt, args);
1556         va_end(args);
1557 }
1558 #endif
1559
1560 /* This might be called by pam_end() running with sshd */
1561 int audit_open(void);
1562 int audit_open(void)
1563 {
1564         /*
1565          * Tell the application that the kernel doesn't
1566          * have audit compiled in.
1567          */
1568         errno = EPROTONOSUPPORT;
1569         return -1;
1570 }
1571
1572 /* Disable BSD auditing */
1573 int cannot_audit(int x);
1574 int cannot_audit(int x)
1575 {
1576         (void) x;
1577
1578         return 1;
1579 }
1580
1581 /****************************
1582  * DESTRUCTOR
1583  ***************************/
1584
1585 static int p_rmdirs_at(const char *path, int parent_fd)
1586 {
1587         DIR *d;
1588         struct dirent *dp;
1589         struct stat sb;
1590         int path_fd;
1591         int rc;
1592
1593         /* If path is absolute, parent_fd is ignored. */
1594         PWRAP_LOG(PWRAP_LOG_TRACE,
1595                   "p_rmdirs_at removing %s at %d\n", path, parent_fd);
1596
1597         path_fd = openat(parent_fd,
1598                          path, O_RDONLY | O_DIRECTORY | O_NOFOLLOW);
1599         if (path_fd == -1) {
1600                 return -1;
1601         }
1602
1603         d = fdopendir(path_fd);
1604         if (d == NULL) {
1605                 close(path_fd);
1606                 return -1;
1607         }
1608
1609         while ((dp = readdir(d)) != NULL) {
1610                 /* skip '.' and '..' */
1611                 if (dp->d_name[0] == '.' &&
1612                         (dp->d_name[1] == '\0' ||
1613                         (dp->d_name[1] == '.' && dp->d_name[2] == '\0'))) {
1614                         continue;
1615                 }
1616
1617                 rc = fstatat(path_fd, dp->d_name,
1618                              &sb, AT_SYMLINK_NOFOLLOW);
1619                 if (rc != 0) {
1620                         continue;
1621                 }
1622
1623                 if (S_ISDIR(sb.st_mode)) {
1624                         rc = p_rmdirs_at(dp->d_name, path_fd);
1625                 } else {
1626                         rc = unlinkat(path_fd, dp->d_name, 0);
1627                 }
1628                 if (rc != 0) {
1629                         continue;
1630                 }
1631         }
1632         closedir(d);
1633
1634         rc = unlinkat(parent_fd, path, AT_REMOVEDIR);
1635         if (rc != 0) {
1636                 rc = errno;
1637                 PWRAP_LOG(PWRAP_LOG_TRACE,
1638                           "cannot unlink %s error %d\n", path, rc);
1639                 return -1;
1640         }
1641
1642         return 0;
1643 }
1644
1645 static int p_rmdirs(const char *path)
1646 {
1647         /*
1648          * If path is absolute, p_rmdirs_at ignores parent_fd.
1649          * If it's relative, start from cwd.
1650          */
1651         return p_rmdirs_at(path, AT_FDCWD);
1652 }
1653
1654 /*
1655  * This function is called when the library is unloaded and makes sure that
1656  * resources are freed.
1657  */
1658 void pwrap_destructor(void)
1659 {
1660         const char *env;
1661
1662         PWRAP_LOG(PWRAP_LOG_TRACE, "entering pwrap_destructor");
1663
1664         if (pwrap.libpam.handle != NULL) {
1665                 dlclose(pwrap.libpam.handle);
1666         }
1667
1668         if (pwrap.libpam_so != NULL) {
1669                 free(pwrap.libpam_so);
1670                 pwrap.libpam_so = NULL;
1671         }
1672
1673         if (!pwrap.initialised) {
1674                 return;
1675         }
1676
1677         PWRAP_LOG(PWRAP_LOG_TRACE,
1678                   "destructor called for pam_wrapper dir %s",
1679                   pwrap.config_dir);
1680         env = getenv("PAM_WRAPPER_KEEP_DIR");
1681         if (env == NULL || env[0] != '1') {
1682                 p_rmdirs(pwrap.config_dir);
1683         }
1684
1685         if (pwrap.config_dir != NULL) {
1686                 free(pwrap.config_dir);
1687                 pwrap.config_dir = NULL;
1688         }
1689 }