Merge commit '00f1a4f432b3d8aad1aa270e91c44c57f03ef407'

[unleashed.git] / usr / src / cmd / vt / vtdaemon.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
 */

/*
 * vtdaemon is responsible for the session secure switch via hotkeys.
 *
 * vtdaemon itself, like ttymon(8), is also running on a virtual
 * console device (/dev/vt/1), and provides a text console session
 * for password input and authentication. The /dev/vt/1 special text
 * console is reserved and end users cannot switch to it via hotkeys.
 *
 *
 * The hotkey event request can come from either kernel or Xserver,
 * and a door server is setup to handle the request:
 *
 *   1) All text console hotkeys (e.g. "Alt + F#") are intercepted by
 *      the kernel console driver which sends a door upcall to the
 *      vtdaemon via door_upcall (target_vt).
 *
 *   2) All Xserver hotkeys ("Alt + Ctrl + F#") are intercepted by
 *      Xserver which sends a door call to the vtdaemon via
 *      door_call (target_vt).
 *
 *
 * server_for_door receives and handles any door server requests:
 *
 *   Firstly, check source session:
 *
 *      . If it's from kernel for a text console source session,
 *        then directly go to check the target session.
 *
 *      . If it's from Xserver for a graphical source session and the vt
 *        associated with the Xserver is currently active:
 *          check if a user has logged in, if true, issue an internal
 *          VT_EV_LOCK event to the main thread to request lock for
 *          the graphical source session; else, directly go to check
 *          the target session.
 *
 *      . otherwise, discard this request.
 *
 *
 *    Secondly, check the target session
 *
 *      . if the target session is a text one that no one has logged in
 *        or a graphical one, issue an internal VT_EV_ACTIVATE event to
 *        the main thread to request the actual VT switch.
 *
 *      . otherwise, the target session is a text one that someone has
 *        logged in, issue an internal VT_EV_AUTH event to the main
 *        thread to request authentication for the target session.
 *
 *
 * The main thread of vtdaemon is a loop waiting for internal events
 * which come from door call threads:
 *
 *   1)  VT_EV_AUTH      to authenticate for target session:
 *
 *                       firstly switch to the vtdaemon special text console;
 *                       then prompt for password (target_owner on target_vt),
 *                       e.g. "User Bob's password on vt/#: ".
 *
 *                       if the password is correct (authentication succeeds),
 *                       then actually issue the VT switch; otherwise, ignore
 *                       the request.
 *
 *   2)  VT_EV_LOCK      to lock the graphical source session:
 *
 *                       activate screenlock for this graphical session.
 *                       vtdaemon just invokes existing front-end command line
 *                       tools (e.g. xscreensaver-command -lock for JDS) to
 *                       lock the display.
 *
 *   3)  VT_EV_ACTIVATE  to directly switch to the target session
 *
 *
 * There is a system/vtdaemon:default SMF service for vtdaemon.
 *
 *      There's a "hotkeys" property (BOOLEAN) in the
 *      system/vtdaemon:default SMF service, which allows authorized
 *      users to dynamically enable or disable VT switch via hotkeys.
 *      Its default value is TRUE (enabled).
 *
 *      There's a "secure" property (BOOLEAN) in the
 *      system/vtdaemon:default SMF service, which allows authorized
 *      users to dynamically enable or disable hotkeys are secure.
 *      If disabled, the user can freely switch to any session without
 *      authentication. Its default value is TRUE (enabled).
 *
 *
 *  By default, there's only 16 virtual console device nodes (from
 *  /dev/vt/0 to /dev/vt/15). There's a property "nodecount"
 *  (default value is 16) in the system/vtdaemon:default SMF
 *  service, so authorized users can configure it to have more
 *  or less virtual console device nodes.
 *
 *  Xserver needs to switch back to previous active vt via VT_EV_X_EXIT
 *  door event request when it's exiting, so vtdaemon always needs to
 *  be there even if the hotkeys switch is disabled, otherwise the screen
 *  will be just blank when Xserver exits.
 */

#include <sys/param.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <sys/stat.h>
#include <sys/sysmacros.h>
#include <syslog.h>
#include <deflt.h>

#include <bsm/adt.h>
#include <bsm/adt_event.h>

#include <alloca.h>
#include <assert.h>
#include <errno.h>
#include <door.h>
#include <fcntl.h>
#include <signal.h>
#include <stdarg.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <strings.h>
#include <synch.h>
#include <thread.h>
#include <unistd.h>
#include <wait.h>
#include <limits.h>
#include <zone.h>
#include <priv.h>
#include <pwd.h>
#include <utmpx.h>
#include <procfs.h>
#include <poll.h>
#include <termio.h>
#include <security/pam_appl.h>
#include <time.h>
#include <sys/console.h>
#include <assert.h>
#include <syslog.h>

#include <sys/vt.h>
#include <sys/vtdaemon.h>

/*
 * The door file /var/run/vt/vtdaemon_door
 */
#define VT_TMPDIR "/var/run/vt"

#define VT_DAEMON_ARG   0
#define VT_DAEMON_CONSOLE_FILE  "/dev/vt/1"

#define VT_IS_SYSTEM_CONSOLE(vtno)      ((vtno) == 1)

/* Defaults for updating expired passwords */
#define DEF_ATTEMPTS    3

int daemonfd;

static boolean_t vt_hotkeys = B_TRUE;           /* '-k' option to disable */
static boolean_t vt_secure = B_TRUE;            /* '-s' option to disable */

static char     vt_door_path[MAXPATHLEN];
static int      vt_door = -1;

/* protecting vt_hotkeys_pending and vt_auth_doing */
static mutex_t  vt_mutex = DEFAULTMUTEX;

static boolean_t vt_hotkeys_pending = B_FALSE;
static boolean_t vt_auth_doing = B_FALSE;

static adt_session_data_t **vt_ah_array = NULL;
static int vtnodecount = 0;

static int vt_audit_start(adt_session_data_t **, pid_t);
static void vt_audit_event(adt_session_data_t *, au_event_t, int);
static void vt_check_source_audit(void);

static int
vt_setup_signal(int signo, int mask)
{
        sigset_t set;

        (void) sigemptyset(&set);
        (void) sigaddset(&set, signo);

        if (mask)
                return (sigprocmask(SIG_BLOCK, &set, NULL));
        else
                return (sigprocmask(SIG_UNBLOCK, &set, NULL));
}

static void
do_activate_screenlock(int display_num)
{
        char dpy[16];

        (void) snprintf(dpy, sizeof (dpy), "%d", display_num);
        (void) execl("/usr/lib/vtxlock", "vtxlock", dpy, NULL);
}

static void
vt_activate_screenlock(int display)
{
        pid_t pid;

        if ((pid = fork()) == -1)
                return;

        if (pid == 0) { /* child */
                do_activate_screenlock(display);
                exit(0);
        }

        /* parent */
        while (waitpid(pid, (int *)0, 0) != pid)
                continue;
}

/*
 * Find the login process and user logged in on the target vt.
 */
static void
vt_read_utx(int target_vt, pid_t *pid, char name[])
{
        struct utmpx  *u;
        char ttyntail[sizeof (u->ut_line)];

        *pid = (pid_t)-1;

        if (VT_IS_SYSTEM_CONSOLE(target_vt)) /* system console */
                (void) snprintf(ttyntail, sizeof (ttyntail),
                    "%s", "console");
        else
                (void) snprintf(ttyntail, sizeof (ttyntail),
                    "%s%d", "vt/", target_vt);

        setutxent();
        while ((u = getutxent()) != NULL)
                /* see if this is the entry we want */
                if ((u->ut_type == USER_PROCESS) &&
                    (!nonuserx(*u)) &&
                    (u->ut_host[0] == '\0') &&
                    (strncmp(u->ut_line, ttyntail, sizeof (u->ut_line)) == 0)) {

                        *pid = u->ut_pid;
                        if (name != NULL) {
                                (void) strncpy(name, u->ut_user,
                                    sizeof (u->ut_user));
                                name[sizeof (u->ut_user)] = '\0';
                        }
                        break;
                }

        endutxent();
}

static boolean_t
vt_is_tipline(void)
{
        static int is_tipline = 0;
        int fd;
        static char termbuf[MAX_TERM_TYPE_LEN];
        static struct cons_getterm cons_term = { sizeof (termbuf), termbuf};

        if (is_tipline != 0)
                return (is_tipline == 1);

        if ((fd = open("/dev/console", O_RDONLY)) < 0)
                return (B_FALSE);

        if (ioctl(fd, CONS_GETTERM, &cons_term) != 0 &&
            errno == ENODEV) {
                is_tipline = 1;
        } else {
                is_tipline = -1;
        }

        (void) close(fd);
        return (is_tipline == 1);
}

static int
validate_target_vt(int target_vt)
{
        int fd;
        struct vt_stat state;

        if (target_vt < 1)
                return (-1);

        if ((fd = open(VT_DAEMON_CONSOLE_FILE, O_WRONLY)) < 0)
                return (-1);

        if (ioctl(fd, VT_GETSTATE, &state) != 0) {
                (void) close(fd);
                return (-1);
        }

        (void) close(fd);

        if (state.v_active == target_vt) {
                return (1);     /* it's current active vt */
        }

        if (target_vt == 1) {
                /*
                 * In tipline case, the system console is always
                 * available, so ignore this request.
                 */
                if (vt_is_tipline())
                        return (-1);

                target_vt = 0;
        }

        /*
         * The hotkey request and corresponding target_vt number can come
         * from either kernel or Xserver (or other user applications).
         * In kernel we've validated the hotkey request, but Xserver (or
         * other user applications) cannot do it, so here we still try
         * to validate it.
         *
         * VT_GETSTATE is only valid for first 16 VTs for historical reasons.
         * Fortunately, in practice, Xserver can only send the hotkey
         * request of target_vt number from 1 to 12 (Ctrl + Alt + F1 to F2).
         */
        if (target_vt < 8 * sizeof (state.v_state)) {
                if ((state.v_state & (1 << target_vt)) != 0) {
                        return (0);
                } else {
                        return (-1);
                }
        }

        return (0);
}

static void
vt_do_activate(int target_vt)
{
        (void) ioctl(daemonfd, VT_ACTIVATE, target_vt);
        (void) mutex_lock(&vt_mutex);
        vt_hotkeys_pending = B_FALSE;
        (void) mutex_unlock(&vt_mutex);
}

/* events written to fd 0 and read from fd 1 */
#define VT_EV_AUTH      1
#define VT_EV_LOCK      2
#define VT_EV_ACTIVATE  3

/* events written to fd 1 and read from fd 0 */
#define VT_EV_TERMINATE_AUTH    4

typedef struct vt_evt {
        int     ve_cmd;
        int     ve_info;        /* vtno or display num */
} vt_evt_t;

static int eventstream[2];

boolean_t
eventstream_init(void)
{
        if (pipe(eventstream) == -1)
                return (B_FALSE);
        return (B_TRUE);
}

void
eventstream_write(int channel, vt_evt_t *pevt)
{
        (void) write(eventstream[channel], pevt, sizeof (vt_evt_t));
}

static boolean_t
eventstream_read(int channel, vt_evt_t *pevt)
{
        ssize_t rval;

        rval = read(eventstream[channel], pevt, sizeof (vt_evt_t));
        return (rval > 0);
}

static void
vt_ev_request(int cmd, int info)
{
        int channel;
        vt_evt_t ve;

        ve.ve_cmd = cmd;
        ve.ve_info = info;

        channel = (cmd == VT_EV_TERMINATE_AUTH) ? 1 : 0;
        eventstream_write(channel, &ve);
}

static void
vt_clear_events(void)
{
        int rval = 0;
        struct stat buf;
        vt_evt_t evt;

        while (rval == 0) {
                rval = fstat(eventstream[0], &buf);
                if (rval != -1 && buf.st_size > 0)
                        (void) eventstream_read(0, &evt);
                else
                        break;
        }
}

static int vt_conv(int, struct pam_message **,
    struct pam_response **, void *);

/*ARGSUSED*/
static void
catch(int x)
{
        (void) signal(SIGINT, catch);
}

/*
 * The SIGINT (ctl_c) will restart the authentication, and re-prompt
 * the end user to input the password.
 */
static int
vt_poll()
{
        struct pollfd pollfds[2];
        vt_evt_t ve;
        int ret;

        pollfds[0].fd = eventstream[0];
        pollfds[1].fd = daemonfd;
        pollfds[0].events = pollfds[1].events =
            POLLIN | POLLRDNORM | POLLRDBAND | POLLPRI;

        for (;;) {
                pollfds[0].revents = pollfds[1].revents = 0;

                ret = poll(pollfds,
                    sizeof (pollfds) / sizeof (struct pollfd), -1);
                if (ret == -1 && errno != EINTR) {
                        continue;
                }

                if (ret == -1 && errno == EINTR)
                        return (-1);

                if (pollfds[0].revents) {
                        (void) eventstream_read(0, &ve);
                        return (0);
                }

                if (pollfds[1].revents)
                        return (1);

                return (0);

        }
}

static char
vt_getchar(int fd)
{
        char c;
        int cnt;

        cnt = read(fd, &c, 1);
        if (cnt > 0) {
                return (c);
        }

        return (EOF);
}

static char *
vt_getinput(int noecho)
{
        int c;
        int i = 0;
        struct termio tty;
        tcflag_t tty_flags;
        char input[PAM_MAX_RESP_SIZE];

        if (noecho) {
                (void) ioctl(daemonfd, TCGETA, &tty);
                tty_flags = tty.c_lflag;
                tty.c_lflag &= ~(ECHO | ECHOE | ECHOK | ECHONL);
                (void) ioctl(daemonfd, TCSETAF, &tty);
        }

        while ((vt_poll()) == 1) {
                if ((c = vt_getchar(daemonfd)) != '\n' && c != '\r' &&
                    c != EOF && (i < PAM_MAX_RESP_SIZE - 1))
                        input[i++] = (char)c;
                else
                        break;
        }

        input[i] = '\0';

        if (noecho) {
                tty.c_lflag = tty_flags;
                (void) ioctl(daemonfd, TCSETAW, &tty);
                (void) fputc('\n', stdout);
        }

        return (strdup(input));
}

/*
 * vt_conv: vtdaemon PAM conversation function.
 * SIGINT/EINTR is handled in vt_getinput()/vt_poll().
 */

/*ARGSUSED*/
static int
vt_conv(int num_msg, struct pam_message **msg,
    struct pam_response **response, void *appdata_ptr)
{
        struct pam_message      *m;
        struct pam_response     *r;
        int                     i, k;

        if (num_msg >= PAM_MAX_NUM_MSG) {
                syslog(LOG_ERR, "too many messages %d >= %d",
                    num_msg, PAM_MAX_NUM_MSG);
                *response = NULL;
                return (PAM_CONV_ERR);
        }

        *response = calloc(num_msg, sizeof (struct pam_response));
        if (*response == NULL)
                return (PAM_BUF_ERR);

        m = *msg;
        r = *response;
        for (i = 0; i < num_msg; i++) {
                int echo_off = 0;

                /* Bad message */
                if (m->msg == NULL) {
                        syslog(LOG_ERR, "message[%d]: %d/NULL\n",
                            i, m->msg_style);
                        goto err;
                }

                /*
                 * Fix up final newline:
                 * remove from prompts, add back for messages.
                 */
                if (m->msg[strlen(m->msg)] == '\n')
                        m->msg[strlen(m->msg)] = '\0';

                r->resp = NULL;
                r->resp_retcode = 0;

                switch (m->msg_style) {

                case PAM_PROMPT_ECHO_OFF:
                        echo_off = 1;
                        /* FALLTHROUGH */

                case PAM_PROMPT_ECHO_ON:
                        (void) fputs(m->msg, stdout);

                        r->resp = vt_getinput(echo_off);
                        break;

                case PAM_ERROR_MSG:
                        /* the user may want to see this */
                        (void) fputs(m->msg, stdout);
                        (void) fputs("\n", stdout);
                        break;

                case PAM_TEXT_INFO:
                        (void) fputs(m->msg, stdout);
                        (void) fputs("\n", stdout);
                        break;

                default:
                        syslog(LOG_ERR, "message[%d]: unknown type"
                            "%d/val=\"%s\"", i, m->msg_style, m->msg);

                        /* error, service module won't clean up */
                        goto err;
                }

                /* Next message/response */
                m++;
                r++;

        }
        return (PAM_SUCCESS);

err:
        /*
         * Service modules don't clean up responses if an error is returned.
         * Free responses here.
         */
        r = *response;
        for (k = 0; k < i; k++, r++) {
                if (r->resp) {
                        /* Clear before freeing -- maybe a password */
                        bzero(r->resp, strlen(r->resp));
                        free(r->resp);
                        r->resp = NULL;
                }
        }

        free(*response);
        *response = NULL;
        return (PAM_CONV_ERR);
}

#define DEF_FILE        "/etc/default/login"

/* Get PASSREQ from default file */
static boolean_t
vt_default(void)
{
        int flags;
        char *ptr;
        boolean_t retval = B_FALSE;

        if ((defopen(DEF_FILE)) == 0) {
                /* ignore case */
                flags = defcntl(DC_GETFLAGS, 0);
                TURNOFF(flags, DC_CASE);
                (void) defcntl(DC_SETFLAGS, flags);

                if ((ptr = defread("PASSREQ=")) != NULL &&
                    strcasecmp("YES", ptr) == 0)
                        retval = B_TRUE;

                (void) defopen(NULL);
        }

        return (retval);
}

/*
 * VT_CLEAR_SCREEN_STR is the console terminal escape sequence used to
 * clear the current screen.  The vt special console (/dev/vt/1) is
 * just reserved for vtdaemon, and the TERM/termcap of it is always
 * the local sun-color, which is always supported by our kernel terminal
 * emulator.
 */
#define VT_CLEAR_SCREEN_STR     "\033[2J\033[1;1H"

static void
vt_do_auth(int target_vt)
{
        char    user_name[sizeof (((struct utmpx *)0)->ut_line) + 1] = {'\0'};
        pam_handle_t    *vt_pamh;
        int             err;
        int             pam_flag = 0;
        int             chpasswd_tries;
        struct pam_conv pam_conv = {vt_conv, NULL};
        pid_t           pid;
        adt_session_data_t      *ah;

        vt_read_utx(target_vt, &pid, user_name);

        if (pid == (pid_t)-1 || user_name[0] == '\0')
                return;

        if ((err = pam_start("vtdaemon", user_name, &pam_conv,
            &vt_pamh)) != PAM_SUCCESS)
                return;

        /*
         * firstly switch to the vtdaemon special console
         * and clear the current screen
         */
        (void) ioctl(daemonfd, VT_ACTIVATE, VT_DAEMON_ARG);
        (void) write(daemonfd, VT_CLEAR_SCREEN_STR,
            strlen(VT_CLEAR_SCREEN_STR));
        (void) ioctl(daemonfd, VT_SET_TARGET, target_vt);

        (void) mutex_lock(&vt_mutex);
        vt_auth_doing = B_TRUE;
        vt_hotkeys_pending = B_FALSE;
        (void) mutex_unlock(&vt_mutex);

        /*
         * Fetch audit handle.
         */
        ah = vt_ah_array[target_vt - 1];

        if (vt_default())
                pam_flag = PAM_DISALLOW_NULL_AUTHTOK;

        do {
                if (VT_IS_SYSTEM_CONSOLE(target_vt))
                        (void) fprintf(stdout,
                            "\nUnlock user %s on the system console\n",
                            user_name);
                else
                        (void) fprintf(stdout,
                            "\nUnlock user %s on vt/%d\n", user_name,
                            target_vt);

                err = pam_authenticate(vt_pamh, pam_flag);

                (void) mutex_lock(&vt_mutex);
                if (vt_hotkeys_pending) {
                        (void) mutex_unlock(&vt_mutex);
                        break;
                }
                (void) mutex_unlock(&vt_mutex);

                if (err == PAM_SUCCESS) {
                        err = pam_acct_mgmt(vt_pamh, pam_flag);

                        (void) mutex_lock(&vt_mutex);
                        if (vt_hotkeys_pending) {
                                (void) mutex_unlock(&vt_mutex);
                                break;
                        }
                        (void) mutex_unlock(&vt_mutex);

                        if (err == PAM_NEW_AUTHTOK_REQD) {
                                chpasswd_tries = 0;

                                do {
                                        err = pam_chauthtok(vt_pamh,
                                            PAM_CHANGE_EXPIRED_AUTHTOK);
                                        chpasswd_tries++;

                                        (void) mutex_lock(&vt_mutex);
                                        if (vt_hotkeys_pending) {
                                                (void) mutex_unlock(&vt_mutex);
                                                break;
                                        }
                                        (void) mutex_unlock(&vt_mutex);

                                } while ((err == PAM_AUTHTOK_ERR ||
                                    err == PAM_TRY_AGAIN) &&
                                    chpasswd_tries < DEF_ATTEMPTS);

                                (void) mutex_lock(&vt_mutex);
                                if (vt_hotkeys_pending) {
                                        (void) mutex_unlock(&vt_mutex);
                                        break;
                                }
                                (void) mutex_unlock(&vt_mutex);

                                vt_audit_event(ah, ADT_passwd, err);
                        }
                }

                /*
                 * Only audit failed unlock here, successful unlock
                 * will be audited after switching to target vt.
                 */
                if (err != PAM_SUCCESS) {
                        (void) fprintf(stdout, "%s",
                            pam_strerror(vt_pamh, err));

                        vt_audit_event(ah, ADT_screenunlock, err);
                }

                (void) mutex_lock(&vt_mutex);
                if (vt_hotkeys_pending) {
                        (void) mutex_unlock(&vt_mutex);
                        break;
                }
                (void) mutex_unlock(&vt_mutex);

        } while (err != PAM_SUCCESS);

        (void) mutex_lock(&vt_mutex);
        if (!vt_hotkeys_pending) {
                /*
                 * Should be PAM_SUCCESS to reach here.
                 */
                (void) ioctl(daemonfd, VT_ACTIVATE, target_vt);

                vt_audit_event(ah, ADT_screenunlock, err);

                /*
                 * Free audit handle.
                 */
                (void) adt_end_session(ah);
                vt_ah_array[target_vt - 1] = NULL;
        }
        (void) mutex_unlock(&vt_mutex);

        (void) pam_end(vt_pamh, err);

        (void) mutex_lock(&vt_mutex);
        vt_auth_doing = B_FALSE;
        vt_clear_events();
        (void) mutex_unlock(&vt_mutex);
}

/* main thread (lock and auth) */
static void __NORETURN
vt_serve_events(void)
{
        struct pollfd pollfds[1];
        int ret;
        vt_evt_t ve;

        pollfds[0].fd = eventstream[1];
        pollfds[0].events = POLLIN | POLLRDNORM | POLLRDBAND | POLLPRI;

        for (;;) {
                pollfds[0].revents = 0;
                ret = poll(pollfds,
                    sizeof (pollfds) / sizeof (struct pollfd), -1);
                if (ret == -1 && errno == EINTR) {
                        continue;
                }

                if (pollfds[0].revents && eventstream_read(1, &ve)) {
                        /* new request */
                        switch (ve.ve_cmd) {
                        case VT_EV_AUTH:
                                vt_do_auth(ve.ve_info);
                                break;

                        case VT_EV_LOCK:
                                vt_activate_screenlock(ve.ve_info);
                                break;

                        case VT_EV_ACTIVATE:
                                /* directly activate target vt */
                                vt_do_activate(ve.ve_info);
                                break;
                        }
                }
        }
}

static void
vt_check_target_session(uint32_t target_vt)
{
        pid_t   pid = (pid_t)-1;

        if (!vt_secure) {
                vt_ev_request(VT_EV_ACTIVATE, target_vt);
                return;
        }

        /* check the target session */
        vt_read_utx(target_vt, &pid, NULL);
        if (pid  == (pid_t)-1) {
                vt_ev_request(VT_EV_ACTIVATE, target_vt);
                return;
        }

        vt_ev_request(VT_EV_AUTH, target_vt);
}

static boolean_t
vt_get_active_disp_info(struct vt_dispinfo *vd)
{
        int fd;
        struct vt_stat state;
        char vtname[16];

        if ((fd = open(VT_DAEMON_CONSOLE_FILE, O_RDONLY)) < 0)
                return (B_FALSE);

        if (ioctl(fd, VT_GETSTATE, &state) != 0) {
                (void) close(fd);
                return (B_FALSE);
        }
        (void) close(fd);

        (void) snprintf(vtname, sizeof (vtname), "/dev/vt/%d", state.v_active);
        if ((fd = open(vtname, O_RDONLY)) < 0)
                return (B_FALSE);

        if (ioctl(fd, VT_GETDISPINFO, vd) != 0) {
                (void) close(fd);
                return (B_FALSE);
        }

        (void) close(fd);
        return (B_TRUE);
}

/*
 * Xserver registers its pid into kernel to associate it with
 * its vt upon startup for each graphical display. So here we can
 * check if the pid is of the Xserver for the current active
 * display when we receive a special VT_EV_X_EXIT request from
 * a process. If the request does not come from the current
 * active Xserver, it is discarded.
 */
static boolean_t
vt_check_disp_active(pid_t x_pid)
{
        struct vt_dispinfo vd;

        if (vt_get_active_disp_info(&vd) &&
            vd.v_pid == x_pid)
                return (B_TRUE);

        return (B_FALSE);
}

/*
 * check if the pid is of the Xserver for the current active display,
 * return true when it is, and then also return other associated
 * information with the Xserver.
 */
static boolean_t
vt_get_disp_info(pid_t x_pid, int *logged_in, int *display_num)
{
        struct vt_dispinfo vd;

        if (!vt_get_active_disp_info(&vd) ||
            vd.v_pid != x_pid)
                return (B_FALSE);

        *logged_in = vd.v_login;
        *display_num = vd.v_dispnum;
        return (B_TRUE);
}

static void
vt_terminate_auth(void)
{
        struct timespec sleeptime;

        sleeptime.tv_sec = 0;
        sleeptime.tv_nsec = 1000000; /* 1ms */

        (void) mutex_lock(&vt_mutex);
        while (vt_auth_doing) {
                vt_ev_request(VT_EV_TERMINATE_AUTH, 0);

                if (vt_auth_doing) {
                        (void) mutex_unlock(&vt_mutex);
                        (void) nanosleep(&sleeptime, NULL);
                        sleeptime.tv_nsec *= 2;
                        (void) mutex_lock(&vt_mutex);
                }
        }
        (void) mutex_unlock(&vt_mutex);
}

static void
vt_do_hotkeys(pid_t pid, uint32_t target_vt)
{
        int             logged_in;
        int             display_num;

        if (validate_target_vt(target_vt) != 0)
                return;

        /*
         * Maybe last switch action is being taken and the lock is ongoing,
         * here we must reject the newly request.
         */
        (void) mutex_lock(&vt_mutex);
        if (vt_hotkeys_pending) {
                (void) mutex_unlock(&vt_mutex);
                return;
        }

        /* cleared in vt_do_active and vt_do_auth */
        vt_hotkeys_pending = B_TRUE;
        (void) mutex_unlock(&vt_mutex);

        vt_terminate_auth();

        /* check source session for this hotkeys request */
        if (pid == 0) {
                /* ok, it comes from kernel. */
                if (vt_secure)
                        vt_check_source_audit();

                /* then only need to check target session */
                vt_check_target_session(target_vt);
                return;
        }

        /*
         * check if it comes from current active X graphical session,
         * if not, ignore this request.
         */
        if (!vt_get_disp_info(pid, &logged_in, &display_num)) {
                (void) mutex_lock(&vt_mutex);
                vt_hotkeys_pending = B_FALSE;
                (void) mutex_unlock(&vt_mutex);
                return;
        }

        if (logged_in && vt_secure)
                vt_ev_request(VT_EV_LOCK, display_num);

        vt_check_target_session(target_vt);
}

/*
 * The main routine for the door server that deals with secure hotkeys
 */
/* ARGSUSED */
static void
server_for_door(void *cookie, char *args, size_t alen, door_desc_t *dp,
    uint_t n_desc)
{
        ucred_t *uc = NULL;
        vt_cmd_arg_t *vtargp;

        /* LINTED E_BAD_PTR_CAST_ALIGN */
        vtargp = (vt_cmd_arg_t *)args;

        if (vtargp == NULL ||
            alen != sizeof (vt_cmd_arg_t) ||
            door_ucred(&uc) != 0) {
                (void) door_return(NULL, 0, NULL, 0);
                return;
        }

        switch (vtargp->vt_ev) {
        case VT_EV_X_EXIT:
                /*
                 * Xserver will issue this event requesting to switch back
                 * to previous active vt when it's exiting and the associated
                 * vt is currently active.
                 */
                if (vt_check_disp_active(ucred_getpid(uc)))
                        vt_do_hotkeys(0, vtargp->vt_num);
                break;

        case VT_EV_HOTKEYS:
                if (!vt_hotkeys)        /* hotkeys are disabled? */
                        break;

                vt_do_hotkeys(ucred_getpid(uc), vtargp->vt_num);
                break;

        default:
                break;
        }

        ucred_free(uc);
        (void) door_return(NULL, 0, NULL, 0);
}

static boolean_t
setup_door(void)
{
        if ((vt_door = door_create(server_for_door, NULL,
            DOOR_UNREF | DOOR_REFUSE_DESC | DOOR_NO_CANCEL)) < 0) {
                syslog(LOG_ERR, "door_create failed: %s", strerror(errno));
                return (B_FALSE);
        }

        (void) fdetach(vt_door_path);

        if (fattach(vt_door, vt_door_path) != 0) {
                syslog(LOG_ERR, "fattach to %s failed: %s",
                    vt_door_path, strerror(errno));
                (void) door_revoke(vt_door);
                (void) fdetach(vt_door_path);
                vt_door = -1;
                return (B_FALSE);
        }

        return (B_TRUE);
}

/*
 * check to see if vtdaemon is already running.
 *
 * The idea here is that we want to open the path to which we will
 * attach our door, lock it, and then make sure that no-one has beat us
 * to fattach(3c)ing onto it.
 *
 * fattach(3c) is really a mount, so there are actually two possible
 * vnodes we could be dealing with.  Our strategy is as follows:
 *
 * - If the file we opened is a regular file (common case):
 *      There is no fattach(3c)ed door, so we have a chance of becoming
 *      the running vtdaemon. We attempt to lock the file: if it is
 *      already locked, that means someone else raced us here, so we
 *      lose and give up.
 *
 * - If the file we opened is a namefs file:
 *      This means there is already an established door fattach(3c)'ed
 *      to the rendezvous path.  We've lost the race, so we give up.
 *      Note that in this case we also try to grab the file lock, and
 *      will succeed in acquiring it since the vnode locked by the
 *      "winning" vtdaemon was a regular one, and the one we locked was
 *      the fattach(3c)'ed door node.  At any rate, no harm is done.
 */
static boolean_t
make_daemon_exclusive(void)
{
        int doorfd = -1;
        boolean_t ret = B_FALSE;
        struct stat st;
        struct flock flock;

top:
        if ((doorfd = open(vt_door_path, O_CREAT|O_RDWR,
            S_IREAD|S_IWRITE|S_IRGRP|S_IROTH)) < 0) {
                syslog(LOG_ERR, "failed to open %s", vt_door_path);
                goto out;
        }
        if (fstat(doorfd, &st) < 0) {
                syslog(LOG_ERR, "failed to stat %s", vt_door_path);
                goto out;
        }
        /*
         * Lock the file to synchronize
         */
        flock.l_type = F_WRLCK;
        flock.l_whence = SEEK_SET;
        flock.l_start = (off_t)0;
        flock.l_len = (off_t)0;
        if (fcntl(doorfd, F_SETLK, &flock) < 0) {
                /*
                 * Someone else raced us here and grabbed the lock file
                 * first.  A warning here and exit.
                 */
                syslog(LOG_ERR, "vtdaemon is already running!");
                goto out;
        }

        if (strcmp(st.st_fstype, "namefs") == 0) {
                struct door_info info;

                /*
                 * There is already something fattach()'ed to this file.
                 * Lets see what the door is up to.
                 */
                if (door_info(doorfd, &info) == 0 && info.di_target != -1) {
                        syslog(LOG_ERR, "vtdaemon is already running!");
                        goto out;
                }

                (void) fdetach(vt_door_path);
                (void) close(doorfd);
                goto top;
        }

        ret = setup_door();

out:
        (void) close(doorfd);
        return (ret);
}

static boolean_t
mkvtdir(void)
{
        struct stat st;
        /*
         * We must create and lock everyone but root out of VT_TMPDIR
         * since anyone can open any UNIX domain socket, regardless of
         * its file system permissions.
         */
        if (mkdir(VT_TMPDIR, S_IRWXU|S_IROTH|S_IXOTH|S_IRGRP|S_IXGRP) < 0 &&
            errno != EEXIST) {
                syslog(LOG_ERR, "could not mkdir '%s'", VT_TMPDIR);
                return (B_FALSE);
        }
        /* paranoia */
        if ((stat(VT_TMPDIR, &st) < 0) || !S_ISDIR(st.st_mode)) {
                syslog(LOG_ERR, "'%s' is not a directory", VT_TMPDIR);
                return (B_FALSE);
        }
        (void) chmod(VT_TMPDIR, S_IRWXU|S_IROTH|S_IXOTH|S_IRGRP|S_IXGRP);
        return (B_TRUE);
}

int
main(int argc, char *argv[])
{
        int i;
        int opt;
        priv_set_t *privset;
        int active;

        openlog("vtdaemon", LOG_PID | LOG_CONS, 0);

        /*
         * Check that we have all privileges.  It would be nice to pare
         * this down, but this is at least a first cut.
         */
        if ((privset = priv_allocset()) == NULL) {
                syslog(LOG_ERR, "priv_allocset failed");
                return (1);
        }

        if (getppriv(PRIV_EFFECTIVE, privset) != 0) {
                syslog(LOG_ERR, "getppriv failed", "getppriv");
                priv_freeset(privset);
                return (1);
        }

        if (priv_isfullset(privset) == B_FALSE) {
                syslog(LOG_ERR, "You lack sufficient privilege "
                    "to run this command (all privs required)");
                priv_freeset(privset);
                return (1);
        }
        priv_freeset(privset);

        while ((opt = getopt(argc, argv, "ksrc:")) != EOF) {
                switch (opt) {
                case 'k':
                        vt_hotkeys = B_FALSE;
                        break;
                case 's':
                        vt_secure = B_FALSE;
                        break;
                case 'c':
                        vtnodecount = atoi(optarg);
                        break;
                default:
                        break;
                }
        }

        (void) vt_setup_signal(SIGINT, 1);

        if (!mkvtdir())
                return (1);

        if (!eventstream_init())
                return (1);

        (void) snprintf(vt_door_path, sizeof (vt_door_path),
            VT_TMPDIR "/vtdaemon_door");

        if (!make_daemon_exclusive())
                return (1);

        /* only the main thread accepts SIGINT */
        (void) vt_setup_signal(SIGINT, 0);
        (void) sigset(SIGPIPE, SIG_IGN);
        (void) signal(SIGQUIT, SIG_IGN);
        (void) signal(SIGINT, catch);

        for (i = 0; i < 3; i++)
                (void) close(i);
        (void) setsid();

        if ((daemonfd = open(VT_DAEMON_CONSOLE_FILE, O_RDWR)) < 0) {
                return (1);
        }

        if (daemonfd != 0)
                (void) dup2(daemonfd, STDIN_FILENO);
        if (daemonfd != 1)
                (void) dup2(daemonfd, STDOUT_FILENO);

        if (vtnodecount >= 2)
                (void) ioctl(daemonfd, VT_CONFIG, vtnodecount);

        if ((vt_ah_array = calloc(vtnodecount - 1,
            sizeof (adt_session_data_t *))) == NULL)
                return (1);

        (void) ioctl(daemonfd, VT_GETACTIVE, &active);

        if (active == 1) {
                /*
                 * This is for someone who restarts vtdaemon while vtdaemon
                 * is doing authentication on /dev/vt/1.
                 * A better way is to continue the authentication, but there
                 * are chances that the status of the target VT has changed.
                 * So we just clear the screen here.
                 */
                (void) write(daemonfd, VT_CLEAR_SCREEN_STR,
                    strlen(VT_CLEAR_SCREEN_STR));
        }

        vt_serve_events();
        /*NOTREACHED*/
}

static int
vt_audit_start(adt_session_data_t **ah, pid_t pid)
{
        ucred_t *uc;

        if (adt_start_session(ah, NULL, 0))
                return (-1);

        if ((uc = ucred_get(pid)) == NULL) {
                (void) adt_end_session(*ah);
                return (-1);
        }

        if (adt_set_from_ucred(*ah, uc, ADT_NEW)) {
                ucred_free(uc);
                (void) adt_end_session(*ah);
                return (-1);
        }

        ucred_free(uc);
        return (0);
}

/*
 * Write audit event
 */
static void
vt_audit_event(adt_session_data_t *ah, au_event_t event_id, int status)
{
        adt_event_data_t        *event;


        if ((event = adt_alloc_event(ah, event_id)) == NULL) {
                return;
        }

        (void) adt_put_event(event,
            status == PAM_SUCCESS ? ADT_SUCCESS : ADT_FAILURE,
            status == PAM_SUCCESS ? ADT_SUCCESS : ADT_FAIL_PAM + status);

        adt_free_event(event);
}

static void
vt_check_source_audit(void)
{
        int     fd;
        int     source_vt;
        int     real_vt;
        struct vt_stat state;
        pid_t   pid;
        adt_session_data_t *ah;

        if ((fd = open(VT_DAEMON_CONSOLE_FILE, O_WRONLY)) < 0)
                return;

        if (ioctl(fd, VT_GETSTATE, &state) != 0 ||
            ioctl(fd, VT_GETACTIVE, &real_vt) != 0) {
                (void) close(fd);
                return;
        }

        source_vt = state.v_active;     /* 1..n */
        (void) close(fd);

        /* check if it's already locked */
        if (real_vt == 1)       /* vtdaemon is taking over the screen */
                return;

        vt_read_utx(source_vt, &pid, NULL);
        if (pid == (pid_t)-1)
                return;

        if (vt_audit_start(&ah, pid) != 0) {
                syslog(LOG_ERR, "audit start failed ");
                return;
        }

        /*
         * In case the previous session terminated abnormally.
         */
        if (vt_ah_array[source_vt - 1] != NULL)
                (void) adt_end_session(vt_ah_array[source_vt - 1]);

        vt_ah_array[source_vt - 1] = ah;

        vt_audit_event(ah, ADT_screenlock, PAM_SUCCESS);
}