[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

[PATCH] Cleanup of pam_namespace code



Hello,
	I am working on the pam_namespace code a bit and while going through 
and making my changes I did a little code cleanup to make it more readable 
(atleast in my opinion). Attached is a patch that factors out some parts of 
the larger functions in pam_namespace and also moves all of the includes and 
defines into a header file.

 Makefile.am     |    2 
 pam_namespace.c |  492 +++++++++++++++++++++++++-------------------------------
 pam_namespace.h |  135 +++++++++++++++
 3 files changed, 357 insertions(+), 272 deletions(-)

diff -uprN -X dontdiff pam_namespace_orig/Makefile.am pam_namespace/Makefile.am
--- pam_namespace_orig/Makefile.am	2006-06-28 03:22:43.000000000 -0400
+++ pam_namespace/Makefile.am	2006-07-17 13:16:39.000000000 -0400
@@ -32,7 +32,7 @@ endif
 
 if HAVE_UNSHARE
 securelib_LTLIBRARIES = pam_namespace.la
-pam_namespace_la_SOURCES = pam_namespace.c md5.c md5.h
+pam_namespace_la_SOURCES = pam_namespace.c pam_namespace.h md5.c md5.h
 
 secureconf_DATA = namespace.conf
 secureconf_SCRIPTS = namespace.init
diff -uprN -X dontdiff pam_namespace_orig/pam_namespace.c pam_namespace/pam_namespace.c
--- pam_namespace_orig/pam_namespace.c	2006-06-27 09:07:44.000000000 -0400
+++ pam_namespace/pam_namespace.c	2006-07-17 13:13:41.000000000 -0400
@@ -30,110 +30,33 @@
  * DEALINGS IN THE SOFTWARE.
  */
 
-#if !(defined(linux))
-#error THIS CODE IS KNOWN TO WORK ONLY ON LINUX !!!
-#endif
-
-#include "config.h"
-
-#include <stdio.h>
-#include <stdio_ext.h>
-#include <unistd.h>
-#include <string.h>
-#include <ctype.h>
-#include <stdlib.h>
-#include <errno.h>
-#include <syslog.h>
-#include <dlfcn.h>
-#include <stdarg.h>
-#include <pwd.h>
-#include <limits.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <sys/resource.h>
-#include <sys/mount.h>
-#include <sys/wait.h>
-#include <libgen.h>
-#include <fcntl.h>
-#include <sched.h>
-#include "security/pam_modules.h"
-#include "security/pam_modutil.h"
-#include "security/pam_ext.h"
-#include "md5.h"
-
-#ifdef WITH_SELINUX
-#include <selinux/selinux.h>
-#endif
-
-#ifndef CLONE_NEWNS
-#define CLONE_NEWNS 0x00020000 /* Flag to create new namespace */
-#endif
+#include "pam_namespace.h"
 
 /*
- * Module defines
+ * Copies the contents of ent into pent
  */
-#ifndef PAM_NAMESPACE_CONFIG
-#define PAM_NAMESPACE_CONFIG "/etc/security/namespace.conf"
-#endif
-
-#ifndef NAMESPACE_INIT_SCRIPT
-#define NAMESPACE_INIT_SCRIPT "/etc/security/namespace.init"
-#endif
-
-#define PAMNS_DEBUG           0x00000100 /* Running in debug mode */
-#define PAMNS_SELINUX_ENABLED 0x00000400 /* SELinux is enabled */
-#define PAMNS_CTXT_BASED_INST 0x00000800 /* Context based instance needed */
-#define PAMNS_GEN_HASH        0x00002000 /* Generate md5 hash for inst names */
-#define PAMNS_IGN_CONFIG_ERR  0x00004000 /* Ignore format error in conf file */
-#define PAMNS_IGN_INST_PARENT_MODE  0x00008000 /* Ignore instance parent mode */
-
-/*
- * Polyinstantiation method options, based on user, security context
- * or both
- */
-enum polymethod {
-    USER,
-    CONTEXT,
-    BOTH,
-};
-
-/*
- * Depending on the application using this namespace module, we
- * may need to unmount priviously bind mounted instance directory.
- * Applications such as login and sshd, that establish a new 
- * session unmount of instance directory is not needed. For applications
- * such as su and newrole, that switch the identity, this module 
- * has to unmount previous instance directory first and re-mount
- * based on the new indentity. For other trusted applications that
- * just want to undo polyinstantiation, only unmount of previous
- * instance directory is needed.
- */
-enum unmnt_op {
-    NO_UNMNT,
-    UNMNT_REMNT,
-    UNMNT_ONLY,
-};
-
-/*
- * Structure that holds information about a directory to polyinstantiate
- */
-struct polydir_s {
-    char dir[PATH_MAX];    	       	/* directory to polyinstantiate */
-    char instance_prefix[PATH_MAX];	/* prefix for instance dir path name */
-    enum polymethod method;		/* method used to polyinstantiate */
-    unsigned int num_uids;		/* number of override uids */
-    uid_t *uid;				/* list of override uids */
-    struct polydir_s *next;		/* pointer to the next polydir entry */
-};
-
-struct instance_data {
-    pam_handle_t *pamh;		/* The pam handle for this instance */
-    struct polydir_s *polydirs_ptr; /* The linked list pointer */
-    char user[LOGIN_NAME_MAX];	/* User name */
-    uid_t uid;			/* The uid of the user */
-    unsigned long flags;		/* Flags for debug, selinux etc */
-};
+static int copy_ent(const struct polydir_s *ent, struct polydir_s *pent)
+{
+	unsigned int i;
 
+	strcpy(pent->dir, ent->dir);
+	strcpy(pent->instance_prefix, ent->instance_prefix);
+	pent->method = ent->method;
+	pent->num_uids = ent->num_uids;
+	if (ent->num_uids) {
+		uid_t *pptr, *eptr;
+
+		pent->uid = (uid_t *) malloc(ent->num_uids * sizeof(uid_t));
+		if (!(pent->uid)) {
+			return -1;
+		}
+		for (i = 0, pptr = pent->uid, eptr = ent->uid; i < ent->num_uids;
+				i++, eptr++, pptr++)
+			*pptr = *eptr;
+	} else 
+		pent->uid = NULL;
+	return 0;
+}
 /*
  * Adds an entry for a polyinstantiated directory to the linked list of
  * polyinstantiated directories. It is called from process_line() while
@@ -143,7 +66,7 @@ static int add_polydir_entry(struct inst
 	const struct polydir_s *ent)
 {
     struct polydir_s *pent;
-    unsigned int i;
+    int rc = 0;
 
     /*
      * Allocate an entry to hold information about a directory to
@@ -152,27 +75,14 @@ static int add_polydir_entry(struct inst
      * directories.
      */
     pent = (struct polydir_s *) malloc(sizeof(struct polydir_s));
-    if (!pent) 
-        return -1;
-
+	if (!pent) { 
+		rc = -1;
+		goto out;
+	}
     /* Make copy */
-    strcpy(pent->dir, ent->dir);
-    strcpy(pent->instance_prefix, ent->instance_prefix);
-    pent->method = ent->method;
-    pent->num_uids = ent->num_uids;
-    if (ent->num_uids) {
-        uid_t *pptr, *eptr;
-
-        pent->uid = (uid_t *) malloc(ent->num_uids * sizeof(uid_t));
-        if (!(pent->uid)) {
-            free(pent);
-            return -1;
-        }
-        for (i = 0, pptr = pent->uid, eptr = ent->uid; i < ent->num_uids;
-                 i++, eptr++, pptr++)
-             *pptr = *eptr;
-    } else 
-        pent->uid = NULL;
+	rc = copy_ent(ent,pent);
+	if(rc < 0)
+		goto out_clean;
 
     /* Now attach to linked list */
     pent->next = NULL;
@@ -186,8 +96,11 @@ static int add_polydir_entry(struct inst
             tail = tail->next;
         tail->next = pent;
     }
-
-    return 0;
+    goto out;
+out_clean:
+	free(pent);
+out:
+	return rc;
 }
 
 
@@ -515,7 +428,55 @@ static int ns_override(struct polydir_s 
     return 0;
 }
 
+#ifdef WITH_SELINUX
+static int form_context(const struct polydir_s *polyptr,
+		security_context_t *i_context, security_context_t *origcon,
+		struct instance_data *idata)
+{
+	int rc = PAM_SUCCESS;
+	security_context_t scon = NULL;
+	security_class_t tclass;
+
+	/*
+	 * Get the security context of the directory to polyinstantiate.
+	 */
+	rc = getfilecon(polyptr->dir, origcon);
+	if (rc < 0 || *origcon == NULL) {
+		pam_syslog(idata->pamh, LOG_ERR,
+				"Error getting poly dir context, %m");
+		return PAM_SESSION_ERR;
+	}
+
+	/*
+	 * If polyinstantiating based on security context, get current
+	 * process security context, get security class for directories,
+	 * and ask the policy to provide security context of the
+	 * polyinstantiated instance directory.
+	 */
+	if ((polyptr->method == CONTEXT) || (polyptr->method == BOTH)) {
+		rc = getexeccon(&scon);
+		if (rc < 0 || scon == NULL) {
+			pam_syslog(idata->pamh, LOG_ERR, 
+					"Error getting exec context, %m");
+			return PAM_SESSION_ERR;
+		}
+		tclass = string_to_security_class("dir");
+
+		if (security_compute_member(scon, *origcon, tclass,
+					i_context) < 0) {
+			pam_syslog(idata->pamh, LOG_ERR,
+					"Error computing poly dir member context");
+			freecon(scon);
+			return PAM_SESSION_ERR;
+		} else if (idata->flags & PAMNS_DEBUG)
+			pam_syslog(idata->pamh, LOG_DEBUG, 
+					"member context returned by policy %s", *i_context);
+		freecon(scon);
+	}
+	return PAM_SUCCESS;
+}
 
+#endif
 /*
  * poly_name returns the name of the polyinstantiated instance directory
  * based on the method used for polyinstantiation (user, context or both)
@@ -532,49 +493,10 @@ static int poly_name(const struct polydi
 	struct instance_data *idata)
 #endif
 {
-#ifdef WITH_SELINUX
-    security_context_t scon = NULL;
-    security_class_t tclass;
-#endif
     int rc;
 
 # ifdef WITH_SELINUX
-    /*
-     * Get the security context of the directory to polyinstantiate.
-     */
-    rc = getfilecon(polyptr->dir, origcon);
-    if (rc < 0 || *origcon == NULL) {
-       pam_syslog(idata->pamh, LOG_ERR,
-		"Error getting poly dir context, %m");
-       return PAM_SESSION_ERR;
-    }
-
-    /*
-     * If polyinstantiating based on security context, get current
-     * process security context, get security class for directories,
-     * and ask the policy to provide security context of the
-     * polyinstantiated instance directory.
-     */
-    if ((polyptr->method == CONTEXT) || (polyptr->method == BOTH)) {
-        rc = getexeccon(&scon);
-        if (rc < 0 || scon == NULL) {
-            pam_syslog(idata->pamh, LOG_ERR, 
-		"Error getting exec context, %m");
-            return PAM_SESSION_ERR;
-	}
-        tclass = string_to_security_class("dir");
-
-        if (security_compute_member(scon, *origcon, tclass,
-						i_context) < 0) {
-    	    pam_syslog(idata->pamh, LOG_ERR,
-                       "Error computing poly dir member context");
-	    freecon(scon);
-    	    return PAM_SESSION_ERR;
-        } else if (idata->flags & PAMNS_DEBUG)
-    	    pam_syslog(idata->pamh, LOG_DEBUG, 
-		    "member context returned by policy %s", *i_context);
-	freecon(scon);
-    }
+    rc = form_context(polyptr, i_context, origcon, idata);
 #endif
     rc = PAM_SUCCESS;
 
@@ -618,6 +540,122 @@ static int poly_name(const struct polydi
     return rc;
 }
 
+static int check_inst_parent(char *ipath, struct instance_data *idata)
+{
+	struct stat instpbuf;
+	char *inst_parent, *trailing_slash;
+	/*
+	 * stat the instance parent path to make sure it exists
+	 * and is a directory. Check that its mode is 000 (unless the
+	 * admin explicitly instructs to ignore the instance parent
+	 * mode by the "ignore_instance_parent_mode" argument).
+	 */
+	inst_parent = (char *) malloc(strlen(ipath)+1);
+	if (!inst_parent) {
+		pam_syslog(idata->pamh, LOG_ERR, "Error allocating pathname string");
+		return PAM_SESSION_ERR;
+	}
+
+	strcpy(inst_parent, ipath);
+	trailing_slash = strrchr(inst_parent, '/');
+	if (trailing_slash)
+		*trailing_slash = '\0';
+
+	if (stat(inst_parent, &instpbuf) < 0) {
+		pam_syslog(idata->pamh, LOG_ERR, "Error stating %s, %m", inst_parent);
+		free(inst_parent);
+		return PAM_SESSION_ERR;
+	}
+
+	/*
+	 * Make sure we are dealing with a directory
+	 */
+	if (!S_ISDIR(instpbuf.st_mode)) {
+		pam_syslog(idata->pamh, LOG_ERR, "Instance parent %s is not a dir",
+				inst_parent);
+		free(inst_parent);
+		return PAM_SESSION_ERR;
+	}
+
+	if ((idata->flags & PAMNS_IGN_INST_PARENT_MODE) == 0) {
+		if (instpbuf.st_mode & (S_IRWXU|S_IRWXG|S_IRWXO)) {
+			pam_syslog(idata->pamh, LOG_ERR, "Mode of inst parent %s not 000",
+					inst_parent);
+			free(inst_parent);
+			return PAM_SESSION_ERR;
+		}
+	}
+	free(inst_parent);
+	return PAM_SUCCESS;
+}
+
+/*
+* Check to see if there is a namespace initialization script in
+* the /etc/security directory. If such a script exists
+* execute it and pass directory to polyinstantiate and instance
+* directory as arguments.
+*/
+static int inst_init(const struct polydir_s *polyptr, char *ipath,  
+	   struct instance_data *idata)
+{
+	pid_t rc, pid;
+	sighandler_t osighand = NULL;
+	int status;
+
+	osighand = signal(SIGCHLD, SIG_DFL);
+	if (osighand == SIG_ERR) {
+		pam_syslog(idata->pamh, LOG_ERR, "Cannot set signal value");
+		rc = PAM_SESSION_ERR;
+		goto out;
+	}
+
+	if (access(NAMESPACE_INIT_SCRIPT, F_OK) == 0) {
+		if (access(NAMESPACE_INIT_SCRIPT, X_OK) < 0) {
+			if (idata->flags & PAMNS_DEBUG)
+				pam_syslog(idata->pamh, LOG_ERR,
+						"Namespace init script not executable");
+			rc = PAM_SESSION_ERR;
+			goto out;
+		} else {
+			pid = fork();
+			if (pid == 0) {
+#ifdef WITH_SELINUX
+				if (idata->flags & PAMNS_SELINUX_ENABLED) {
+					if (setexeccon(NULL) < 0)
+						exit(1);
+				}
+#endif
+				if (execl(NAMESPACE_INIT_SCRIPT, NAMESPACE_INIT_SCRIPT,
+							polyptr->dir, ipath, (char *)NULL) < 0)
+					exit(1);
+			} else if (pid > 0) {
+				while (((rc = waitpid(pid, &status, 0)) == (pid_t)-1) &&
+						(errno == EINTR));
+				if (rc == (pid_t)-1) {
+					pam_syslog(idata->pamh, LOG_ERR, "waitpid failed- %m");
+					rc = PAM_SESSION_ERR;
+					goto out;
+				}
+				if (!WIFEXITED(status) || WIFSIGNALED(status) > 0) {
+					pam_syslog(idata->pamh, LOG_ERR,
+							"Error initializing instance");
+					rc = PAM_SESSION_ERR;
+					goto out;
+				}
+			} else if (pid < 0) {
+				pam_syslog(idata->pamh, LOG_ERR,
+						"Cannot fork to run namespace init script, %m");
+				rc = PAM_SESSION_ERR;
+				goto out;
+			}
+		}
+	}
+	rc = PAM_SUCCESS;
+out:
+   (void) signal(SIGCHLD, osighand);
+
+   return rc;
+}
 
 /*
  * Create polyinstantiated instance directory (ipath).
@@ -631,16 +669,14 @@ static int create_dirs(const struct poly
 	struct instance_data *idata)
 #endif
 {
-    struct stat statbuf, newstatbuf, instpbuf;
-    int fd, status;
-    char *inst_parent, *trailing_slash;
-    pid_t rc, pid;
-    sighandler_t osighand = NULL;
+	struct stat statbuf, newstatbuf;
+	int rc, fd;
 
     /*
      * stat the directory to polyinstantiate, so its owner-group-mode
      * can be propagated to instance directory
      */
+	rc = PAM_SUCCESS;
     if (stat(polyptr->dir, &statbuf) < 0) {
         pam_syslog(idata->pamh, LOG_ERR, "Error stating %s, %m",
 		polyptr->dir);
@@ -655,49 +691,12 @@ static int create_dirs(const struct poly
 		polyptr->dir);
         return PAM_SESSION_ERR;
     }
-
-    /*
-     * stat the instance parent path to make sure it exists
-     * and is a directory. Check that its mode is 000 (unless the
-     * admin explicitly instructs to ignore the instance parent
-     * mode by the "ignore_instance_parent_mode" argument).
-     */
-    inst_parent = (char *) malloc(strlen(ipath)+1);
-    if (!inst_parent) {
-	pam_syslog(idata->pamh, LOG_ERR, "Error allocating pathname string");
-        return PAM_SESSION_ERR;
-    }
-
-    strcpy(inst_parent, ipath);
-    trailing_slash = strrchr(inst_parent, '/');
-    if (trailing_slash)
-        *trailing_slash = '\0';
-
-    if (stat(inst_parent, &instpbuf) < 0) {
-        pam_syslog(idata->pamh, LOG_ERR, "Error stating %s, %m", inst_parent);
-        free(inst_parent);
-        return PAM_SESSION_ERR;
-    }
-
-    /*
-     * Make sure we are dealing with a directory
-     */
-    if (!S_ISDIR(instpbuf.st_mode)) {
-	pam_syslog(idata->pamh, LOG_ERR, "Instance parent %s is not a dir",
-		inst_parent);
-        free(inst_parent);
-        return PAM_SESSION_ERR;
-    }
-
-    if ((idata->flags & PAMNS_IGN_INST_PARENT_MODE) == 0) {
-        if (instpbuf.st_mode & (S_IRWXU|S_IRWXG|S_IRWXO)) {
-	    pam_syslog(idata->pamh, LOG_ERR, "Mode of inst parent %s not 000",
-		    inst_parent);
-            free(inst_parent);
-            return PAM_SESSION_ERR;
-        }
-    }
-    free(inst_parent);
+	
+	/*
+	 * Check to make sure instance parent is valid.
+	 */
+	if (check_inst_parent(ipath, idata))
+		return PAM_SESSION_ERR;
 
     /*
      * Create instance directory and set its security context to the context
@@ -779,56 +778,8 @@ static int create_dirs(const struct poly
      */
 
 inst_init:
-    osighand = signal(SIGCHLD, SIG_DFL);
-    if (osighand == SIG_ERR) {
-        pam_syslog(idata->pamh, LOG_ERR, "Cannot set signal value");
-        return PAM_SESSION_ERR;
-    }
-
-    if (access(NAMESPACE_INIT_SCRIPT, F_OK) == 0) {
-        if (access(NAMESPACE_INIT_SCRIPT, X_OK) < 0) {
-            if (idata->flags & PAMNS_DEBUG)
-                pam_syslog(idata->pamh, LOG_ERR,
-                           "Namespace init script not executable");
-            (void) signal(SIGCHLD, osighand);
-            return PAM_SESSION_ERR;
-        } else {
-            pid = fork();
-	    if (pid == 0) {
-#ifdef WITH_SELINUX
-		if (idata->flags & PAMNS_SELINUX_ENABLED) {
-		    if (setexeccon(NULL) < 0)
-			exit(1);
-		}
-#endif
-	        if (execl(NAMESPACE_INIT_SCRIPT, NAMESPACE_INIT_SCRIPT,
-		          polyptr->dir, ipath, (char *)NULL) < 0)
-		    exit(1);
-            } else if (pid > 0) {
-                while (((rc = waitpid(pid, &status, 0)) == (pid_t)-1) &&
-                       (errno == EINTR));
-                if (rc == (pid_t)-1) {
-                    pam_syslog(idata->pamh, LOG_ERR, "waitpid failed- %m");
-                    (void) signal(SIGCHLD, osighand);
-                    return PAM_SESSION_ERR;
-                }
-                if (!WIFEXITED(status) || WIFSIGNALED(status) > 0) {
-                    pam_syslog(idata->pamh, LOG_ERR,
-                               "Error initializing instance");
-                    (void) signal(SIGCHLD, osighand);
-                    return PAM_SESSION_ERR;
-                }
-	    } else if (pid < 0) {
-                pam_syslog(idata->pamh, LOG_ERR,
-                           "Cannot fork to run namespace init script, %m");
-                (void) signal(SIGCHLD, osighand);
-                return PAM_SESSION_ERR;
-	    }
-        }
-    }
-
-    (void) signal(SIGCHLD, osighand);
-    return PAM_SUCCESS;
+	rc = inst_init(polyptr, ipath, idata); 
+    return rc;
 }
 
 
@@ -1173,16 +1124,16 @@ static int orig_namespace(struct instanc
  */
 static int ctxt_based_inst_needed(void)
 {
-    security_context_t scon = NULL;
-    int rc = 0;
+	security_context_t scon = NULL;
+	int rc = 0;
 
-    rc = getexeccon(&scon);
-    if (rc < 0 || scon == NULL)
-        return 0;
-    else {
-        freecon(scon);
-        return 1;
-    }
+	rc = getexeccon(&scon);
+	if (rc < 0 || scon == NULL)
+		return 0;
+	else {
+		freecon(scon);
+		return 1;
+	}
 }
 #endif
 
@@ -1285,7 +1236,6 @@ PAM_EXTERN int pam_sm_open_session(pam_h
     return retval;
 }
 
-
 /*
  * Entry point from pam_close_session call.
  */
diff -uprN -X dontdiff pam_namespace_orig/pam_namespace.h pam_namespace/pam_namespace.h
--- pam_namespace_orig/pam_namespace.h	1969-12-31 19:00:00.000000000 -0500
+++ pam_namespace/pam_namespace.h	2006-07-17 13:11:36.000000000 -0400
@@ -0,0 +1,135 @@
+/******************************************************************************
+ * A module for Linux-PAM that will set the default namespace after 
+ * establishing a session via PAM.
+ *
+ * (C) Copyright IBM Corporation 2005
+ * (C) Copyright Red Hat 2006
+ * All Rights Reserved.
+ *
+ * Written by: Janak Desai <janak us ibm com>
+ * With Revisions by: Steve Grubb <sgrubb redhat com>
+ * Derived from a namespace setup patch by Chad Sellers <cdselle tycho nsa gov>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * on the rights to use, copy, modify, merge, publish, distribute, sub
+ * license, and/or sell copies of the Software, and to permit persons to whom
+ * the Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT.  IN NO EVENT SHALL
+ * IBM AND/OR THEIR SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ */
+
+#if !(defined(linux))
+#error THIS CODE IS KNOWN TO WORK ONLY ON LINUX !!!
+#endif
+
+#include "config.h"
+
+#include <stdio.h>
+#include <stdio_ext.h>
+#include <unistd.h>
+#include <string.h>
+#include <ctype.h>
+#include <stdlib.h>
+#include <errno.h>
+#include <syslog.h>
+#include <dlfcn.h>
+#include <stdarg.h>
+#include <pwd.h>
+#include <limits.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/resource.h>
+#include <sys/mount.h>
+#include <sys/wait.h>
+#include <libgen.h>
+#include <fcntl.h>
+#include <sched.h>
+#include "security/pam_modules.h"
+#include "security/pam_modutil.h"
+#include "security/pam_ext.h"
+#include "md5.h"
+
+#ifdef WITH_SELINUX
+#include <selinux/selinux.h>
+#endif
+
+#ifndef CLONE_NEWNS
+#define CLONE_NEWNS 0x00020000 /* Flag to create new namespace */
+#endif
+
+/*
+ * Module defines
+ */
+#ifndef PAM_NAMESPACE_CONFIG
+#define PAM_NAMESPACE_CONFIG "/etc/security/namespace.conf"
+#endif
+
+#ifndef NAMESPACE_INIT_SCRIPT
+#define NAMESPACE_INIT_SCRIPT "/etc/security/namespace.init"
+#endif
+
+#define PAMNS_DEBUG           0x00000100 /* Running in debug mode */
+#define PAMNS_SELINUX_ENABLED 0x00000400 /* SELinux is enabled */
+#define PAMNS_CTXT_BASED_INST 0x00000800 /* Context based instance needed */
+#define PAMNS_GEN_HASH        0x00002000 /* Generate md5 hash for inst names */
+#define PAMNS_IGN_CONFIG_ERR  0x00004000 /* Ignore format error in conf file */
+#define PAMNS_IGN_INST_PARENT_MODE  0x00008000 /* Ignore instance parent mode */
+
+/*
+ * Polyinstantiation method options, based on user, security context
+ * or both
+ */
+enum polymethod {
+    USER,
+    CONTEXT,
+    BOTH,
+};
+
+/*
+ * Depending on the application using this namespace module, we
+ * may need to unmount priviously bind mounted instance directory.
+ * Applications such as login and sshd, that establish a new 
+ * session unmount of instance directory is not needed. For applications
+ * such as su and newrole, that switch the identity, this module 
+ * has to unmount previous instance directory first and re-mount
+ * based on the new indentity. For other trusted applications that
+ * just want to undo polyinstantiation, only unmount of previous
+ * instance directory is needed.
+ */
+enum unmnt_op {
+    NO_UNMNT,
+    UNMNT_REMNT,
+    UNMNT_ONLY,
+};
+
+/*
+ * Structure that holds information about a directory to polyinstantiate
+ */
+struct polydir_s {
+    char dir[PATH_MAX];    	       	/* directory to polyinstantiate */
+    char instance_prefix[PATH_MAX];	/* prefix for instance dir path name */
+    enum polymethod method;		/* method used to polyinstantiate */
+    unsigned int num_uids;		/* number of override uids */
+    uid_t *uid;				/* list of override uids */
+    struct polydir_s *next;		/* pointer to the next polydir entry */
+};
+
+struct instance_data {
+    pam_handle_t *pamh;		/* The pam handle for this instance */
+    struct polydir_s *polydirs_ptr; /* The linked list pointer */
+    char user[LOGIN_NAME_MAX];	/* User name */
+    uid_t uid;			/* The uid of the user */
+    unsigned long flags;		/* Flags for debug, selinux etc */
+};


-- 
David Quigley <dpquigl tycho nsa gov>


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]