diff -up ecryptfs-utils-108/src/pam_ecryptfs/pam_ecryptfs.c.pamdata ecryptfs-utils-108/src/pam_ecryptfs/pam_ecryptfs.c
--- ecryptfs-utils-108/src/pam_ecryptfs/pam_ecryptfs.c.pamdata 2015-08-11 14:44:00.963818440 +0200
+++ ecryptfs-utils-108/src/pam_ecryptfs/pam_ecryptfs.c 2015-08-11 14:44:00.965818435 +0200
@@ -46,6 +46,26 @@
#define PRIVATE_DIR "Private"
+#define ECRYPTFS_PAM_DATA "ecryptfs:passphrase"
+
+struct ecryptfs_pam_data {
+ int unwrap;
+ uid_t uid;
+ gid_t gid;
+ char *passphrase;
+ const char *homedir;
+ const char *username;
+ char salt[ECRYPTFS_SALT_SIZE];
+};
+
+static void pam_free_ecryptfsdata(pam_handle_t *pamh, void *data, int error_status)
+{
+ if (data) {
+ free(((struct ecryptfs_pam_data *)data)->passphrase);
+ free(data);
+ }
+}
+
/* returns: 0 if file does not exist, 1 if it exists, <0 for error */
static int file_exists_dotecryptfs(const char *homedir, char *filename)
{
@@ -65,7 +85,7 @@ out:
return rc;
}
-static int wrap_passphrase_if_necessary(const char *username, uid_t uid, char *wrapped_pw_filename, char *passphrase, char *salt)
+static int wrap_passphrase_if_necessary(const char *username, uid_t uid, const char *wrapped_pw_filename, const char *passphrase, const char *salt)
{
char *unwrapped_pw_filename = NULL;
struct stat s;
@@ -93,7 +113,7 @@ static int wrap_passphrase_if_necessary(
}
static int rewrap_passphrase_if_necessary(char *wrapped_pw_filename,
- char *wrapping_passphrase, char *salt)
+ char *wrapping_passphrase, const char *salt)
{
char passphrase[ECRYPTFS_MAX_PASSPHRASE_BYTES + 1];
uint8_t version;
@@ -123,147 +143,68 @@ static int rewrap_passphrase_if_necessar
PAM_EXTERN int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc,
const char **argv)
{
- uid_t uid = 0, oeuid = 0;
- long ngroups_max = sysconf(_SC_NGROUPS_MAX);
- gid_t gid = 0, oegid = 0, groups[ngroups_max+1];
- int ngids = 0;
- char *homedir = NULL;
- const char *username;
- char *passphrase = NULL;
- char salt[ECRYPTFS_SALT_SIZE];
char salt_hex[ECRYPTFS_SALT_SIZE_HEX];
- char *auth_tok_sig = NULL;
char *private_mnt = NULL;
- pid_t child_pid, tmp_pid;
long rc;
+ struct ecryptfs_pam_data *epd;
- rc = pam_get_user(pamh, &username, NULL);
+ if ((epd = calloc(1, sizeof(struct ecryptfs_pam_data))) == NULL) {
+ syslog(LOG_ERR,"Memory allocation failed");
+ rc = -ENOMEM;
+ goto out;
+ }
+
+ rc = pam_get_user(pamh, &epd->username, NULL);
if (rc == PAM_SUCCESS) {
struct passwd *pwd;
- pwd = getpwnam(username);
+ errno = 0;
+ pwd = getpwnam(epd->username);
if (pwd) {
- uid = pwd->pw_uid;
- gid = pwd->pw_gid;
- homedir = pwd->pw_dir;
- }
- } else {
- syslog(LOG_ERR, "pam_ecryptfs: Error getting passwd info for user [%s]; rc = [%ld]\n", username, rc);
- goto out;
+ epd->uid = pwd->pw_uid;
+ epd->gid = pwd->pw_gid;
+ epd->homedir = pwd->pw_dir;
+ rc = 0;
+ } else rc = errno;
}
-
- oeuid = geteuid();
- oegid = getegid();
- if ((ngids = getgroups(sizeof(groups)/sizeof(gid_t), groups)) < 0) {
- syslog(LOG_ERR, "pam_ecryptfs: geteuid error");
- goto outnouid;
- }
-
- if (setegid(gid) < 0 || setgroups(1, &gid) < 0 || seteuid(uid) < 0) {
- syslog(LOG_ERR, "pam_ecryptfs: seteuid error");
+ if (!epd->homedir) {
+ syslog(LOG_ERR, "pam_ecryptfs: Error getting passwd info for user; rc = [%ld]\n", rc);
goto out;
}
- if (!file_exists_dotecryptfs(homedir, "auto-mount"))
+ if (!file_exists_dotecryptfs(epd->homedir, "auto-mount"))
goto out;
- private_mnt = ecryptfs_fetch_private_mnt(homedir);
+ private_mnt = ecryptfs_fetch_private_mnt(epd->homedir);
if (ecryptfs_private_is_mounted(NULL, private_mnt, NULL, 1)) {
- syslog(LOG_DEBUG, "pam_ecryptfs: %s: %s is already mounted\n", __FUNCTION__, homedir);
+ syslog(LOG_DEBUG, "pam_ecryptfs: %s: %s is already mounted\n", __FUNCTION__, epd->homedir);
/* If private/home is already mounted, then we can skip
costly loading of keys */
goto out;
}
- if(file_exists_dotecryptfs(homedir, "wrapping-independent") == 1)
- rc = pam_prompt(pamh, PAM_PROMPT_ECHO_OFF, &passphrase, "Encryption passphrase: ");
+ if(file_exists_dotecryptfs(epd->homedir, "wrapping-independent") == 1)
+ rc = pam_prompt(pamh, PAM_PROMPT_ECHO_OFF, &epd->passphrase, "Encryption passphrase: ");
else
- rc = pam_get_item(pamh, PAM_AUTHTOK, (const void **)&passphrase);
+ rc = pam_get_item(pamh, PAM_AUTHTOK, (const void **)&epd->passphrase);
if (rc != PAM_SUCCESS) {
syslog(LOG_ERR, "pam_ecryptfs: Error retrieving passphrase; rc = [%ld]\n",
rc);
goto out;
}
- auth_tok_sig = malloc(ECRYPTFS_SIG_SIZE_HEX + 1);
- if (!auth_tok_sig) {
- rc = -ENOMEM;
- syslog(LOG_ERR, "pam_ecryptfs: Out of memory\n");
- goto out;
- }
+ epd->passphrase = strdup(epd->passphrase);
rc = ecryptfs_read_salt_hex_from_rc(salt_hex);
if (rc) {
- from_hex(salt, ECRYPTFS_DEFAULT_SALT_HEX, ECRYPTFS_SALT_SIZE);
+ from_hex(epd->salt, ECRYPTFS_DEFAULT_SALT_HEX, ECRYPTFS_SALT_SIZE);
} else
- from_hex(salt, salt_hex, ECRYPTFS_SALT_SIZE);
- if ((child_pid = fork()) == 0) {
- /* temp regain uid 0 to drop privs */
- seteuid(oeuid);
- /* setgroups() already called */
- if (setgid(gid) < 0 || setuid(uid) < 0)
- goto out_child;
-
- if (passphrase == NULL) {
- syslog(LOG_ERR, "pam_ecryptfs: NULL passphrase; aborting\n");
- rc = -EINVAL;
- goto out_child;
- }
- if ((rc = ecryptfs_validate_keyring())) {
- syslog(LOG_WARNING, "pam_ecryptfs: Cannot validate keyring integrity\n");
- }
- rc = 0;
- if ((argc == 1)
- && (memcmp(argv[0], "unwrap\0", 7) == 0)) {
- char *wrapped_pw_filename;
-
- rc = asprintf(
- &wrapped_pw_filename, "%s/.ecryptfs/%s",
- homedir,
- ECRYPTFS_DEFAULT_WRAPPED_PASSPHRASE_FILENAME);
- if (rc == -1) {
- syslog(LOG_ERR, "pam_ecryptfs: Unable to allocate memory\n");
- rc = -ENOMEM;
- goto out_child;
- }
- if (wrap_passphrase_if_necessary(username, uid, wrapped_pw_filename, passphrase, salt) == 0) {
- syslog(LOG_DEBUG, "pam_ecryptfs: Passphrase file wrapped");
- } else {
- goto out_child;
- }
- if (rewrap_passphrase_if_necessary(wrapped_pw_filename, passphrase, salt)) {
- /* Non fatal condition. Log a warning. */
- syslog(LOG_WARNING, "pam_ecryptfs: Unable to rewrap passphrase file\n");
- }
- rc = ecryptfs_insert_wrapped_passphrase_into_keyring(
- auth_tok_sig, wrapped_pw_filename, passphrase,
- salt);
- free(wrapped_pw_filename);
- } else {
- rc = ecryptfs_add_passphrase_key_to_keyring(
- auth_tok_sig, passphrase, salt);
- }
- if (rc == 1) {
- goto out_child;
- }
- if (rc) {
- syslog(LOG_ERR, "pam_ecryptfs: Error adding passphrase key token to user session keyring; rc = [%ld]\n", rc);
- goto out_child;
- }
-out_child:
- free(auth_tok_sig);
- _exit(0);
+ from_hex(epd->salt, salt_hex, ECRYPTFS_SALT_SIZE);
+ epd->unwrap = ((argc == 1) && (memcmp(argv[0], "unwrap\0", 7) == 0));
+ if ((rc=pam_set_data(pamh, ECRYPTFS_PAM_DATA, epd, pam_free_ecryptfsdata)) != PAM_SUCCESS) {
+ syslog(LOG_ERR, "Unable to store ecryptfs pam data : %s", pam_strerror(pamh, rc));
+ goto out;
}
- tmp_pid = waitpid(child_pid, NULL, 0);
- if (tmp_pid == -1)
- syslog(LOG_WARNING, "pam_ecryptfs: waitpid() returned with error condition\n");
-out:
- seteuid(oeuid);
- setegid(oegid);
- setgroups(ngids, groups);
-
-outnouid:
+out:
if (private_mnt != NULL)
free(private_mnt);
- if (auth_tok_sig != NULL)
- free(auth_tok_sig);
return PAM_SUCCESS;
}
@@ -407,10 +348,124 @@ static int umount_private_dir(pam_handle
return private_dir(pamh, 0);
}
+static int fill_keyring(pam_handle_t *pamh)
+{
+ pid_t child_pid,tmp_pid;
+ uid_t oeuid = 0;
+ long ngroups_max = sysconf(_SC_NGROUPS_MAX);
+ gid_t oegid = 0, groups[ngroups_max+1];
+ int ngids = 0;
+ int rc = 0;
+ const struct ecryptfs_pam_data *epd;
+ char *auth_tok_sig = NULL;
+ auth_tok_sig = malloc(ECRYPTFS_SIG_SIZE_HEX + 1);
+
+ if ((rc=pam_get_data(pamh, ECRYPTFS_PAM_DATA, (const void **)&epd)) != PAM_SUCCESS)
+ {
+ syslog(LOG_ERR,"Unable to get ecryptfs pam data : %s", pam_strerror(pamh, rc));
+ return -EINVAL;
+ }
+
+ oeuid = geteuid();
+ oegid = getegid();
+ if ((ngids = getgroups(sizeof(groups)/sizeof(gid_t), groups)) < 0) {
+ syslog(LOG_ERR, "pam_ecryptfs: geteuid error");
+ goto outnouid;
+ }
+
+ if (setegid(epd->gid) < 0 || setgroups(1, &epd->gid) < 0 || seteuid(epd->uid) < 0) {
+ syslog(LOG_ERR, "pam_ecryptfs: seteuid error");
+ goto out;
+ }
+
+ if (!auth_tok_sig) {
+ syslog(LOG_ERR, "Out of memory\n");
+ return -ENOMEM;
+ }
+
+ if ((child_pid = fork()) == 0) {
+ /* temp regain uid 0 to drop privs */
+ if (seteuid(oeuid) < 0)
+ {
+ syslog(LOG_ERR, "pam_ecryptfs: seteuid error");
+ goto out_child;
+ }
+ /* setgroups() already called */
+ if (setgid(epd->gid) < 0 || setuid(epd->uid) < 0)
+ goto out_child;
+
+ if (epd->passphrase == NULL) {
+ syslog(LOG_ERR, "NULL passphrase; aborting\n");
+ rc = -EINVAL;
+ goto out_child;
+ }
+ if ((rc = ecryptfs_validate_keyring())) {
+ syslog(LOG_WARNING,
+ "Cannot validate keyring integrity\n");
+ }
+ rc = 0;
+ if (epd->unwrap) {
+ char *wrapped_pw_filename;
+
+ rc = asprintf(
+ &wrapped_pw_filename, "%s/.ecryptfs/%s",
+ epd->homedir,
+ ECRYPTFS_DEFAULT_WRAPPED_PASSPHRASE_FILENAME);
+ if (rc == -1) {
+ syslog(LOG_ERR, "Unable to allocate memory\n");
+ rc = -ENOMEM;
+ goto out_child;
+ }
+ if (wrap_passphrase_if_necessary(epd->username, epd->uid, wrapped_pw_filename, epd->passphrase, epd->salt) == 0) {
+ syslog(LOG_INFO, "Passphrase file wrapped");
+ } else {
+ goto out_child;
+ }
+ if (rewrap_passphrase_if_necessary(wrapped_pw_filename, epd->passphrase, epd->salt)) {
+ /* Non fatal condition. Log a warning. */
+ syslog(LOG_WARNING, "pam_ecryptfs: Unable to rewrap passphrase file\n");
+ }
+ rc = ecryptfs_insert_wrapped_passphrase_into_keyring(
+ auth_tok_sig, wrapped_pw_filename, epd->passphrase,
+ epd->salt);
+ free(wrapped_pw_filename);
+ } else {
+ rc = ecryptfs_add_passphrase_key_to_keyring(
+ auth_tok_sig, epd->passphrase, epd->salt);
+ }
+ if (rc == 1) {
+ goto out_child;
+ }
+ if (rc) {
+ syslog(LOG_ERR, "Error adding passphrase key token to "
+ "user session keyring; rc = [%d]\n", rc);
+ goto out_child;
+ }
+out_child:
+ free(auth_tok_sig);
+ _exit(0);
+ }
+ tmp_pid = waitpid(child_pid, NULL, 0);
+ if (tmp_pid == -1)
+ syslog(LOG_WARNING,
+ "waitpid() returned with error condition\n");
+out:
+ rc = seteuid(oeuid);
+ rc = setegid(oegid);
+ rc = setgroups(ngids, groups);
+
+outnouid:
+ if (auth_tok_sig != NULL)
+ free(auth_tok_sig);
+ return 0;
+}
+
+
PAM_EXTERN int
pam_sm_open_session(pam_handle_t *pamh, int flags,
int argc, const char *argv[])
{
+ fill_keyring(pamh);
mount_private_dir(pamh);
return PAM_SUCCESS;
}