summaryrefslogtreecommitdiffstats
path: root/src/login/pam_systemd_loadkey.c
blob: 3b4e91124a2483e9a4f922878218dd09fef6c37d (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
/* SPDX-License-Identifier: LGPL-2.1-or-later */

#include <errno.h>
#include <security/_pam_macros.h>
#include <security/pam_ext.h>
#include <security/pam_misc.h>
#include <security/pam_modules.h>
#include <security/pam_modutil.h>

#include "keyring-util.h"
#include "macro.h"
#include "missing_syscall.h"
#include "nulstr-util.h"
#include "pam-util.h"
#include "strv.h"

/* By default, this module retrieves the key stored by systemd-cryptsetup.
 * This can be overridden by the keyname= parameter. */
static const char DEFAULT_KEYNAME[] = "cryptsetup";

_public_ int pam_sm_authenticate(
                pam_handle_t *handle,
                int flags,
                int argc, const char **argv) {

        assert(handle);

        /* Parse argv. */

        assert(argc >= 0);
        assert(argc == 0 || argv);

        const char *keyname = DEFAULT_KEYNAME;
        bool debug = false;

        for (int i = 0; i < argc; i++) {
                const char *p;

                if ((p = startswith(argv[i], "keyname=")))
                        keyname = p;
                else if (streq(argv[i], "debug"))
                        debug = true;
                else
                        pam_syslog(handle, LOG_WARNING, "Unknown parameter '%s', ignoring.", argv[i]);
        }

        pam_debug_syslog(handle, debug, "pam-systemd-loadkey initializing");

        /* Retrieve the key. */

        key_serial_t serial;
        serial = request_key("user", keyname, NULL, 0);
        if (serial < 0) {
                if (errno == ENOKEY) {
                        pam_debug_syslog(handle, debug, "Key not found: %s", keyname);
                        return PAM_AUTHINFO_UNAVAIL;
                } else if (errno == EKEYEXPIRED) {
                        pam_debug_syslog(handle, debug, "Key expired: %s", keyname);
                        return PAM_AUTHINFO_UNAVAIL;
                } else
                        return pam_syslog_errno(handle, LOG_ERR, errno, "Failed to look up the key: %m");
        }

        _cleanup_(erase_and_freep) void *p = NULL;
        size_t n;
        int r;

        r = keyring_read(serial, &p, &n);
        if (r < 0)
                return pam_syslog_errno(handle, LOG_ERR, r, "Failed to read the key: %m");

        /* Split the key by NUL. Set the last item as authtok. */

        _cleanup_(strv_free_erasep) char **passwords = strv_parse_nulstr(p, n);
        if (!passwords)
                return pam_log_oom(handle);

        size_t passwords_len = strv_length(passwords);
        if (passwords_len == 0) {
                pam_debug_syslog(handle, debug, "Key is empty");
                return PAM_AUTHINFO_UNAVAIL;
        } else if (passwords_len > 1)
                pam_debug_syslog(handle, debug, "Multiple passwords found in the key. Using the last one");

        r = pam_set_item(handle, PAM_AUTHTOK, passwords[passwords_len - 1]);
        if (r != PAM_SUCCESS)
                return pam_syslog_pam_error(handle, LOG_ERR, r, "Failed to set PAM auth token: @PAMERR@");

        return PAM_SUCCESS;
}

_public_ int pam_sm_setcred(
                pam_handle_t *handle,
                int flags,
                int argc, const char **argv) {

        return PAM_SUCCESS;
}