2 * Copyright (c) 2005, 2006, 2007, 2010 Thorsten Kukuk <kukuk@thkukuk.de>
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, and the entire permission notice in its entirety,
9 * including the disclaimer of warranties.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. The name of the author may not be used to endorse or promote
14 * products derived from this software without specific prior
17 * ALTERNATIVELY, this product may be distributed under the terms of
18 * the GNU Public License V2, in which case the provisions of the GPL
19 * are required INSTEAD OF the above restrictions. (This clause is
20 * necessary due to a potential bad interaction between the GPL and
21 * the restrictions contained in a BSD-style copyright.)
23 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
24 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
25 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
26 * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
27 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
28 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
29 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
31 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
32 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
33 * OF THE POSSIBILITY OF SUCH DAMAGE.
49 #include <sys/types.h>
50 #include <sys/resource.h>
53 #define PAM_SM_SESSION
55 #include <security/pam_modules.h>
56 #include <security/pam_modutil.h>
57 #include <security/pam_ext.h>
60 #define LOGIN_DEFS "/etc/login.defs"
61 #define LOGIN_CONF "/etc/default/login"
69 typedef struct options_t options_t;
72 parse_option (const pam_handle_t *pamh, const char *argv, options_t *options)
74 if (argv == NULL || argv[0] == '\0')
77 if (strcasecmp (argv, "debug") == 0)
79 else if (strncasecmp (argv, "umask=", 6) == 0)
80 options->umask = strdup (&argv[6]);
81 else if (strcasecmp (argv, "usergroups") == 0)
82 options->usergroups = 1;
83 else if (strcasecmp (argv, "silent") == 0)
86 pam_syslog (pamh, LOG_ERR, "Unknown option: `%s'", argv);
90 search_key (const char *filename)
97 fp = fopen (filename, "r");
104 #if defined(HAVE_GETLINE)
105 ssize_t n = getline (&buf, &buflen, fp);
106 #elif defined (HAVE_GETDELIM)
107 ssize_t n = getdelim (&buf, &buflen, '\n', fp);
114 buf = malloc (buflen);
117 if (fgets (buf, buflen - 1, fp) == NULL)
119 else if (buf != NULL)
123 #endif /* HAVE_GETLINE / HAVE_GETDELIM */
129 tmp = strchr (cp, '#'); /* remove comments */
132 while (isspace ((int)*cp)) /* remove spaces and tabs */
134 if (*cp == '\0') /* ignore empty lines */
137 if (cp[strlen (cp) - 1] == '\n')
138 cp[strlen (cp) - 1] = '\0';
140 tmp = strsep (&cp, " \t=");
142 while (isspace ((int)*cp) || *cp == '=')
145 if (strcasecmp (tmp, "UMASK") == 0)
147 retval = strdup (cp);
159 get_options (const pam_handle_t *pamh, options_t *options,
160 int argc, const char **argv)
162 memset (options, 0, sizeof (options_t));
163 /* Parse parameters for module */
164 for ( ; argc-- > 0; argv++)
165 parse_option (pamh, *argv, options);
167 if (options->umask == NULL)
168 options->umask = search_key (LOGIN_DEFS);
169 if (options->umask == NULL)
170 options->umask = search_key (LOGIN_CONF);
176 set_umask (const char *value)
178 const char *value_orig = value;
182 mask = strtoul (value, &endptr, 8) & 0777;
183 if (((mask == 0) && (value_orig == endptr)) ||
184 ((mask == UINT_MAX) && (errno == ERANGE)))
190 /* Set the process nice, ulimit, and umask from the
191 password file entry. */
193 setup_limits_from_gecos (pam_handle_t *pamh, options_t *options,
198 if (options->usergroups)
200 /* if not root and username is the same as primary group name,
201 set umask group bits to be the same as owner bits
202 (examples: 022 -> 002, 077 -> 007). */
205 struct group *grp = pam_modutil_getgrgid (pamh, pw->pw_gid);
206 if (grp && (strcmp (pw->pw_name, grp->gr_name) == 0))
208 mode_t oldmask = umask (0777);
209 umask ((oldmask & ~070) | ((oldmask >> 3) & 070));
214 /* See if the GECOS field contains values for NICE, UMASK or ULIMIT. */
215 for (cp = pw->pw_gecos; cp != NULL; cp = strchr (cp, ','))
220 if (strncasecmp (cp, "umask=", 6) == 0)
221 umask (strtol (cp + 6, NULL, 8) & 0777);
222 else if (strncasecmp (cp, "pri=", 4) == 0)
225 if (nice (strtol (cp + 4, NULL, 10)) == -1 && errno != 0)
227 if (!options->silent || options->debug)
228 pam_error (pamh, "nice failed: %m\n");
229 pam_syslog (pamh, LOG_ERR, "nice failed: %m");
232 else if (strncasecmp (cp, "ulimit=", 7) == 0)
234 struct rlimit rlimit_fsize;
235 rlimit_fsize.rlim_cur = 512L * strtol (cp + 7, NULL, 10);
236 rlimit_fsize.rlim_max = rlimit_fsize.rlim_cur;
237 if (setrlimit (RLIMIT_FSIZE, &rlimit_fsize) == -1)
239 if (!options->silent || options->debug)
240 pam_error (pamh, "setrlimit failed: %m\n");
241 pam_syslog (pamh, LOG_ERR, "setrlimit failed: %m");
249 pam_sm_open_session (pam_handle_t *pamh, int flags UNUSED,
250 int argc, const char **argv)
255 int retval = PAM_SUCCESS;
257 get_options (pamh, &options, argc, argv);
258 if (flags & PAM_SILENT)
261 /* get the user name. */
262 if ((retval = pam_get_user (pamh, &name, NULL)) != PAM_SUCCESS)
264 pam_syslog (pamh, LOG_ERR, "pam_get_user failed: return %d", retval);
265 return (retval == PAM_CONV_AGAIN ? PAM_INCOMPLETE:retval);
268 if (name == NULL || name[0] == '\0')
272 pam_syslog (pamh, LOG_ERR, "bad username [%s]", name);
273 return PAM_USER_UNKNOWN;
275 return PAM_SERVICE_ERR;
278 pw = pam_modutil_getpwnam (pamh, name);
281 pam_syslog (pamh, LOG_ERR, "account for %s not found", name);
282 return PAM_USER_UNKNOWN;
285 if (options.umask != NULL)
287 set_umask (options.umask);
288 free (options.umask);
291 setup_limits_from_gecos (pamh, &options, pw);
297 pam_sm_close_session (pam_handle_t *pamh UNUSED, int flags UNUSED,
298 int argc UNUSED, const char **argv UNUSED)
305 /* static module data */
307 struct pam_module _pam_umask_modstruct = {
313 pam_sm_close_session,
319 /* end of module definition */