summaryrefslogtreecommitdiffstats
path: root/pam_lastlog2/src
diff options
context:
space:
mode:
authorDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-14 19:33:32 +0000
committerDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-14 19:33:32 +0000
commit8bb05ac73a5b448b339ce0bc8d396c82c459b47f (patch)
tree1fdda006866bca20d41cb206767ea5241e36852f /pam_lastlog2/src
parentAdding debian version 2.39.3-11. (diff)
downloadutil-linux-8bb05ac73a5b448b339ce0bc8d396c82c459b47f.tar.xz
util-linux-8bb05ac73a5b448b339ce0bc8d396c82c459b47f.zip
Merging upstream version 2.40.
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'pam_lastlog2/src')
-rw-r--r--pam_lastlog2/src/Makemodule.am21
-rw-r--r--pam_lastlog2/src/pam_lastlog2.c341
-rw-r--r--pam_lastlog2/src/pam_lastlog2.sym11
3 files changed, 373 insertions, 0 deletions
diff --git a/pam_lastlog2/src/Makemodule.am b/pam_lastlog2/src/Makemodule.am
new file mode 100644
index 0000000..9884416
--- /dev/null
+++ b/pam_lastlog2/src/Makemodule.am
@@ -0,0 +1,21 @@
+securelibdir = $(libdir)/security
+securelib_LTLIBRARIES = pam_lastlog2.la
+
+pam_lastlog2_la_SOURCES = \
+ pam_lastlog2/src/pam_lastlog2.c
+
+EXTRA_pam_lastlog2_la_DEPENDENCIES = \
+ pam_lastlog2/src/pam_lastlog2.sym
+
+pam_lastlog2_la_CFLAGS = \
+ $(AM_CFLAGS) \
+ $(SOLIB_CFLAGS) \
+ -I$(ul_liblastlog2_incdir) \
+ -Iliblastlog2/src
+
+pam_lastlog2_la_LDFLAGS = $(SOLIB_LDFLAGS) -module -avoid-version -shared
+if HAVE_VSCRIPT
+pam_lastlog2_la_LDFLAGS += pam_lastlog2_la_LDFLAGS += $(VSCRIPT_LDFLAGS),$(top_srcdir)/pam_lastlog2/src/pam_lastlog2.sym
+endif
+
+EXTRA_DIST += pam_lastlog2/src/pam_lastlog2.sym
diff --git a/pam_lastlog2/src/pam_lastlog2.c b/pam_lastlog2/src/pam_lastlog2.c
new file mode 100644
index 0000000..e800700
--- /dev/null
+++ b/pam_lastlog2/src/pam_lastlog2.c
@@ -0,0 +1,341 @@
+/* SPDX-License-Identifier: BSD-2-Clause
+
+ Copyright (c) 2023, Thorsten Kukuk <kukuk@suse.com>
+
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions are met:
+
+ 1. Redistributions of source code must retain the above copyright notice,
+ this list of conditions and the following disclaimer.
+
+ 2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
+
+ THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#include <time.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <syslog.h>
+#include <security/pam_modules.h>
+#include <security/pam_ext.h>
+#include <security/pam_modutil.h>
+#include <security/_pam_macros.h>
+
+#include "lastlog2.h"
+#include "strutils.h"
+
+#define LASTLOG2_DEBUG 01 /* send info to syslog(3) */
+#define LASTLOG2_QUIET 02 /* keep quiet about things */
+
+static const char *lastlog2_path = LL2_DEFAULT_DATABASE;
+
+/* check for list match. */
+static int
+check_in_list (const char *service, const char *arg)
+{
+ const char *item;
+ const char *remaining;
+
+ if (!service)
+ return 0;
+
+ remaining = arg;
+
+ for (;;) {
+ item = strstr (remaining, service);
+ if (item == NULL)
+ break;
+
+ /* is it really the start of an item in the list? */
+ if (item == arg || *(item - 1) == ',') {
+ item += strlen (service);
+ /* is item really the service? */
+ if (*item == '\0' || *item == ',')
+ return 1;
+ }
+
+ remaining = strchr (item, ',');
+ if (remaining == NULL)
+ break;
+
+ /* skip ',' */
+ ++remaining;
+ }
+
+ return 0;
+}
+
+
+static int
+_pam_parse_args (pam_handle_t *pamh,
+ int flags, int argc,
+ const char **argv)
+{
+ int ctrl = 0;
+ const char *str;
+
+ /* does the application require quiet? */
+ if (flags & PAM_SILENT)
+ ctrl |= LASTLOG2_QUIET;
+
+ /* step through arguments */
+ for (; argc-- > 0; ++argv) {
+ if (strcmp (*argv, "debug") == 0)
+ ctrl |= LASTLOG2_DEBUG;
+ else if (strcmp (*argv, "silent") == 0)
+ ctrl |= LASTLOG2_QUIET;
+ else if ((str = startswith (*argv, "database=")) != NULL)
+ lastlog2_path = str;
+ else if ((str = startswith (*argv, "silent_if=")) != NULL) {
+ const void *void_str = NULL;
+ const char *service;
+ if ((pam_get_item (pamh, PAM_SERVICE, &void_str) != PAM_SUCCESS) ||
+ void_str == NULL)
+ service = "";
+ else
+ service = void_str;
+
+ if (check_in_list (service, str)) {
+ if (ctrl & LASTLOG2_DEBUG)
+ pam_syslog (pamh, LOG_DEBUG, "silent_if='%s' contains '%s'", str, service);
+ ctrl |= LASTLOG2_QUIET;
+ }
+ } else
+ pam_syslog (pamh, LOG_ERR, "Unknown option: %s", *argv);
+ }
+
+ return ctrl;
+}
+
+static int
+write_login_data (pam_handle_t *pamh, int ctrl, const char *user)
+{
+ const void *void_str;
+ const char *tty;
+ const char *rhost;
+ const char *pam_service;
+ const char *xdg_vtnr;
+ int xdg_vtnr_nr;
+ char tty_buf[8];
+ time_t ll_time;
+ char *error = NULL;
+ int retval;
+
+ void_str = NULL;
+ retval = pam_get_item (pamh, PAM_TTY, &void_str);
+ if (retval != PAM_SUCCESS || void_str == NULL)
+ tty = "";
+ else
+ tty = void_str;
+
+ /* strip leading "/dev/" from tty. */
+ const char *str = startswith(tty, "/dev/");
+ if (str != NULL)
+ tty = str;
+
+ if (ctrl & LASTLOG2_DEBUG)
+ pam_syslog (pamh, LOG_DEBUG, "tty=%s", tty);
+
+ /* if PAM_TTY is not set or an X11 $DISPLAY, try XDG_VTNR */
+ if ((tty[0] == '\0' || strchr(tty, ':') != NULL) && (xdg_vtnr = pam_getenv (pamh, "XDG_VTNR")) != NULL) {
+ xdg_vtnr_nr = atoi (xdg_vtnr);
+ if (xdg_vtnr_nr > 0 && snprintf (tty_buf, sizeof(tty_buf), "tty%d", xdg_vtnr_nr) < (int) sizeof(tty_buf)) {
+ tty = tty_buf;
+ if (ctrl & LASTLOG2_DEBUG)
+ pam_syslog (pamh, LOG_DEBUG, "tty(XDG_VTNR)=%s", tty);
+ }
+ }
+
+ void_str = NULL;
+ retval = pam_get_item (pamh, PAM_RHOST, &void_str);
+ if (retval != PAM_SUCCESS || void_str == NULL) {
+ void_str = NULL;
+ retval = pam_get_item (pamh, PAM_XDISPLAY, &void_str);
+ if (retval != PAM_SUCCESS || void_str == NULL) {
+ rhost = "";
+ } else {
+ rhost = void_str;
+ if (ctrl & LASTLOG2_DEBUG)
+ pam_syslog (pamh, LOG_DEBUG, "rhost(PAM_XDISPLAY)=%s", rhost);
+ }
+ } else {
+ rhost = void_str;
+ if (ctrl & LASTLOG2_DEBUG)
+ pam_syslog (pamh, LOG_DEBUG, "rhost(PAM_RHOST)=%s", rhost);
+ }
+
+ void_str = NULL;
+ if ((pam_get_item (pamh, PAM_SERVICE, &void_str) != PAM_SUCCESS) ||
+ void_str == NULL)
+ pam_service = "";
+ else
+ pam_service = void_str;
+
+ if (time (&ll_time) < 0)
+ return PAM_SYSTEM_ERR;
+
+ struct ll2_context *context = ll2_new_context(lastlog2_path);
+ if (ll2_write_entry (context, user, ll_time, tty, rhost,
+ pam_service, &error) != 0) {
+ if (error) {
+ pam_syslog (pamh, LOG_ERR, "%s", error);
+ free (error);
+ } else
+ pam_syslog (pamh, LOG_ERR, "Unknown error writing to database %s", lastlog2_path);
+ ll2_unref_context(context);
+ return PAM_SYSTEM_ERR;
+ }
+ ll2_unref_context(context);
+
+ return PAM_SUCCESS;
+}
+
+static int
+show_lastlogin (pam_handle_t *pamh, int ctrl, const char *user)
+{
+ int64_t ll_time = 0;
+ char *tty = NULL;
+ char *rhost = NULL;
+ char *service = NULL;
+ char *date = NULL;
+ char the_time[256];
+ char *error = NULL;
+ int retval = PAM_SUCCESS;
+
+ if (ctrl & LASTLOG2_QUIET)
+ return retval;
+
+ struct ll2_context *context = ll2_new_context(lastlog2_path);
+ if (ll2_read_entry (context, user, &ll_time, &tty, &rhost,
+ &service, &error) != 0) {
+ if (errno == ENOENT)
+ {
+ /* DB file not found --> it is OK */
+ ll2_unref_context(context);
+ free(error);
+ return PAM_SUCCESS;
+ }
+ if (error) {
+ pam_syslog (pamh, LOG_ERR, "%s", error);
+ free (error);
+ } else
+ pam_syslog (pamh, LOG_ERR, "Unknown error reading database %s", lastlog2_path);
+ ll2_unref_context(context);
+ return PAM_SYSTEM_ERR;
+ }
+ ll2_unref_context(context);
+
+ if (ll_time) {
+ struct tm *tm, tm_buf;
+ /* this is necessary if you compile this on architectures with
+ a 32bit time_t type. */
+ time_t t_time = ll_time;
+
+ if ((tm = localtime_r (&t_time, &tm_buf)) != NULL) {
+ strftime (the_time, sizeof (the_time),
+ " %a %b %e %H:%M:%S %Z %Y", tm);
+ date = the_time;
+ }
+ }
+
+ if (date != NULL || rhost != NULL || tty != NULL)
+ retval = pam_info(pamh, "Last login:%s%s%s%s%s",
+ date ? date : "",
+ rhost ? " from " : "",
+ rhost ? rhost : "",
+ tty ? " on " : "",
+ tty ? tty : "");
+
+ _pam_drop(service);
+ _pam_drop(rhost);
+ _pam_drop(tty);
+
+ return retval;
+}
+
+int
+pam_sm_authenticate (pam_handle_t *pamh __attribute__((__unused__)),
+ int flags __attribute__((__unused__)),
+ int argc __attribute__((__unused__)),
+ const char **argv __attribute__((__unused__)))
+{
+ return PAM_IGNORE;
+}
+
+int
+pam_sm_setcred (pam_handle_t *pamh __attribute__((__unused__)),
+ int flags __attribute__((__unused__)),
+ int argc __attribute__((__unused__)),
+ const char **argv __attribute__((__unused__)))
+{
+ return PAM_IGNORE;
+}
+
+int
+pam_sm_acct_mgmt (pam_handle_t *pamh __attribute__((__unused__)),
+ int flags __attribute__((__unused__)),
+ int argc __attribute__((__unused__)),
+ const char **argv __attribute__((__unused__)))
+{
+ return PAM_IGNORE;
+}
+
+int
+pam_sm_open_session (pam_handle_t *pamh, int flags,
+ int argc, const char **argv)
+{
+ const struct passwd *pwd;
+ const void *void_str;
+ const char *user;
+ int ctrl;
+
+ ctrl = _pam_parse_args (pamh, flags, argc, argv);
+
+ void_str = NULL;
+ int retval = pam_get_item (pamh, PAM_USER, &void_str);
+ if (retval != PAM_SUCCESS || void_str == NULL || strlen (void_str) == 0) {
+ if (!(ctrl & LASTLOG2_QUIET))
+ pam_syslog (pamh, LOG_NOTICE, "User unknown");
+ return PAM_USER_UNKNOWN;
+ }
+ user = void_str;
+
+ /* verify the user exists */
+ pwd = pam_modutil_getpwnam (pamh, user);
+ if (pwd == NULL) {
+ if (ctrl & LASTLOG2_DEBUG)
+ pam_syslog (pamh, LOG_DEBUG, "Couldn't find user %s",
+ (const char *)user);
+ return PAM_USER_UNKNOWN;
+ }
+
+ if (ctrl & LASTLOG2_DEBUG)
+ pam_syslog (pamh, LOG_DEBUG, "user=%s", user);
+
+ show_lastlogin (pamh, ctrl, user);
+
+ return write_login_data (pamh, ctrl, user);
+}
+
+int
+pam_sm_close_session (pam_handle_t *pamh __attribute__((__unused__)),
+ int flags __attribute__((__unused__)),
+ int argc __attribute__((__unused__)),
+ const char **argv __attribute__((__unused__)))
+{
+ return PAM_SUCCESS;
+}
diff --git a/pam_lastlog2/src/pam_lastlog2.sym b/pam_lastlog2/src/pam_lastlog2.sym
new file mode 100644
index 0000000..1633155
--- /dev/null
+++ b/pam_lastlog2/src/pam_lastlog2.sym
@@ -0,0 +1,11 @@
+
+{
+ global:
+ pam_sm_acct_mgmt;
+ pam_sm_authenticate;
+ pam_sm_chauthtok;
+ pam_sm_close_session;
+ pam_sm_open_session;
+ pam_sm_setcred;
+ local: *;
+}; \ No newline at end of file