[X2Go-Commits] libpam-x2go.git - x2gosession (branch) updated: 343ae349c3645c8ad6f80215ceaf685a5b975cc7
X2Go dev team
git-admin at x2go.org
Wed Apr 24 18:47:30 CEST 2013
The branch, x2gosession has been updated
via 343ae349c3645c8ad6f80215ceaf685a5b975cc7 (commit)
from c06ef184d455532c267526f82fb73f00081f70f9 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
-----------------------------------------------------------------------
Summary of changes:
src/Makefile.am | 3 +-
src/pam-freerdp.c | 196 ++---------------------------------------
tests/mock_guest.c | 71 +++++++++++++++
tests/mock_guest.h | 2 +
tests/test-freerdp-wrapper.cc | 2 +
5 files changed, 82 insertions(+), 192 deletions(-)
The diff of changes is:
diff --git a/src/Makefile.am b/src/Makefile.am
index 34d1ddd..ed9087c 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -23,7 +23,8 @@ noinst_LTLIBRARIES = \
libfreerdpcore.la
libfreerdpcore_la_SOURCES = \
- pam-freerdp.c
+ pam-freerdp.c \
+ pam-freerdp-children.c
libfreerdpcore_la_CFLAGS = \
-Wall -Werror \
$(COVERAGE_CFLAGS)
diff --git a/src/pam-freerdp.c b/src/pam-freerdp.c
index fbfe182..8979e6e 100644
--- a/src/pam-freerdp.c
+++ b/src/pam-freerdp.c
@@ -34,11 +34,9 @@
#include <security/pam_modutil.h>
#include <security/pam_appl.h>
+#include "pam-freerdp-children.h"
#include "auth-check-path.h"
-#define PAM_TYPE_DOMAIN 1234
-#define ALL_GOOD_SIGNAL "Ar, ready to authenticate cap'n"
-
static int unpriveleged_kill (struct passwd * pwdent);
static char * global_domain = NULL;
@@ -236,44 +234,7 @@ pam_sm_authenticate (pam_handle_t *pamh, int flags, int argc, const char **argv)
pid_t pid;
switch (pid = fork()) {
case 0: { /* child */
- dup2(stdinpipe[0], 0);
-
- char * args[5];
-
- args[0] = (char *)auth_check_path;
- args[1] = rhost;
- args[2] = ruser;
- args[3] = rdomain;
- args[4] = NULL;
-
- struct passwd * pwdent = getpwnam(username);
- if (pwdent == NULL) {
- _exit(EXIT_FAILURE);
- }
-
- /* Setting groups, but allowing EPERM as if we're not 100% root
- we might not be able to do this */
- if (setgroups(1, &pwdent->pw_gid) != 0 && errno != EPERM) {
- _exit(EXIT_FAILURE);
- }
-
- if (setgid(pwdent->pw_gid) < 0 || setuid(pwdent->pw_uid) < 0 ||
- setegid(pwdent->pw_gid) < 0 || seteuid(pwdent->pw_uid) < 0) {
- _exit(EXIT_FAILURE);
- }
-
- if (clearenv() != 0) {
- _exit(EXIT_FAILURE);
- }
-
- if (chdir(pwdent->pw_dir) != 0) {
- _exit(EXIT_FAILURE);
- }
-
- setenv("HOME", pwdent->pw_dir, 1);
-
- execvp(args[0], args);
- _exit(EXIT_FAILURE);
+ pam_sm_authenticate_helper (stdinpipe, username, rhost, ruser, rdomain);
break;
}
case -1: { /* fork'n error! */
@@ -304,153 +265,7 @@ done:
return retval;
}
-static int
-session_socket_handler (struct passwd * pwdent, int readypipe, const char * ruser, const char * rhost, const char * rdomain, const char * password)
-{
- /* Socket stuff */
- int socketfd = 0;
- struct sockaddr_un socket_addr;
-
- /* Connected user */
- socklen_t connected_addr_size;
- int connectfd = 0;
- struct sockaddr_un connected_addr;
-
- /* Our buffer */
- char * buffer = NULL;
- int buffer_len = 0;
- int buffer_fill = 0;
-
- /* Track write out */
- int writedata = 0;
-
- /* Track ready writing */
- int readywrite = 0;
-
- /* Setting groups, but allowing EPERM as if we're not 100% root
- we might not be able to do this */
- if (setgroups(1, &pwdent->pw_gid) != 0 && errno != EPERM) {
- _exit(EXIT_FAILURE);
- }
-
- if (setgid(pwdent->pw_gid) < 0 || setuid(pwdent->pw_uid) < 0 ||
- setegid(pwdent->pw_gid) < 0 || seteuid(pwdent->pw_uid) < 0) {
- /* Don't need to clean up yet */
- return EXIT_FAILURE;
- }
-
- if (clearenv() != 0) {
- /* Don't need to clean up yet */
- return EXIT_FAILURE;
- }
-
- if (chdir(pwdent->pw_dir) != 0) {
- /* Don't need to clean up yet */
- return EXIT_FAILURE;
- }
-
- if (rdomain[0] == '\0') {
- rdomain = ".";
- }
-
- /* Build this up as a buffer so we can just write it and see that
- very, very clearly */
- buffer_len += strlen(ruser) + 1; /* Add one for the space */
- buffer_len += strlen(rhost) + 1; /* Add one for the space */
- buffer_len += strlen(rdomain) + 1; /* Add one for the space */
- buffer_len += strlen(password) + 1; /* Add one for the NULL */
-
- if (buffer_len < 5) {
- /* Don't need to clean up yet */
- return EXIT_FAILURE;
- }
-
- buffer = malloc(buffer_len);
-
- if (buffer == NULL) {
- /* Don't need to clean up yet */
- return EXIT_FAILURE;
- }
-
- /* Lock the buffer before writing */
- if (mlock(buffer, buffer_len) != 0) {
- /* We can't lock, we go home */
- goto cleanup;
- }
-
- buffer_fill = snprintf(buffer, buffer_len, "%s %s %s %s", ruser, password, rdomain, rhost);
- if (buffer_fill > buffer_len) {
- /* This really shouldn't happen, but if for some reason we have an
- difference between they way that the lengths are calculated we want
- to catch that. */
- goto cleanup;
- }
-
- /* Make our socket and bind it */
- socketfd = socket(AF_UNIX, SOCK_STREAM, 0);
- if (socketfd < 0) {
- goto cleanup;
- }
- memset(&socket_addr, 0, sizeof(struct sockaddr_un));
- socket_addr.sun_family = AF_UNIX;
- strncpy(socket_addr.sun_path, pwdent->pw_dir, sizeof(socket_addr.sun_path) - 1);
- strncpy(socket_addr.sun_path + strlen(pwdent->pw_dir), "/.freerdp-socket", (sizeof(socket_addr.sun_path) - strlen(pwdent->pw_dir)) - 1);
-
- /* We bind the socket before forking so that we ensure that
- there isn't a race condition to get to it. Things will block
- otherwise. */
- if (bind(socketfd, (struct sockaddr *)&socket_addr, sizeof(struct sockaddr_un)) < 0) {
- goto cleanup;
- }
-
- /* Set the socket file permissions to be 600 and the user and group
- to be the guest user. NOTE: This won't protect on BSD */
- if (chmod(socket_addr.sun_path, S_IRUSR | S_IWUSR) != 0 ||
- chown(socket_addr.sun_path, pwdent->pw_uid, pwdent->pw_gid) != 0) {
- goto cleanup;
- }
-
- if (listen(socketfd, 1) < 0) {
- goto cleanup;
- }
-
- readywrite = write(readypipe, ALL_GOOD_SIGNAL, strlen(ALL_GOOD_SIGNAL) + 1);
- if (readywrite != strlen(ALL_GOOD_SIGNAL) + 1) {
- goto cleanup;
- }
-
- connected_addr_size = sizeof(struct sockaddr_un);
- connectfd = accept(socketfd, (struct sockaddr *)&connected_addr, &connected_addr_size);
- if (connectfd < 0) {
- goto cleanup;
- }
-
- writedata = write(connectfd, buffer, buffer_len);
-
-cleanup:
- if (socketfd != 0) {
- close(socketfd);
- }
- if (connectfd != 0) {
- close(connectfd);
- }
-
- if (buffer != NULL) {
- memset(buffer, 0, buffer_len);
- munlock(buffer, buffer_len);
- free(buffer);
- buffer = NULL;
- }
-
- /* This should be only true on the write, so we can use this to check
- out as writedata is init to 0 */
- if (writedata == buffer_len) {
- return 0;
- }
-
- return EXIT_FAILURE;
-}
pid_t session_pid = 0;
/* Open Session. Here we need to fork a little process so that we can
@@ -492,12 +307,11 @@ pam_sm_open_session (pam_handle_t *pamh, int flags, int argc, const char ** argv
pid_t pid = fork();
if (pid == 0) {
- int retval = 0;
-
- retval = session_socket_handler(pwdent, sessionready[1], ruser, rhost, rdomain, password);
+
+ int ret = session_socket_handler(pwdent, sessionready[1], ruser, rhost, rdomain, password);
close(sessionready[1]);
- _exit(retval);
+ _exit(ret);
} else if (pid < 0) {
close(sessionready[0]);
close(sessionready[1]);
diff --git a/tests/mock_guest.c b/tests/mock_guest.c
index 2cf04b3..8bf2c3a 100644
--- a/tests/mock_guest.c
+++ b/tests/mock_guest.c
@@ -9,6 +9,11 @@
#include <errno.h>
#include <unistd.h>
#include <sys/stat.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/un.h>
+#include <stdio.h>
static struct passwd guest = { "guest",
"password",
@@ -49,3 +54,69 @@ int chmod(const char *path, mode_t mode)
int chown(const char *path, uid_t owner, gid_t group)
{ return 0; }
+int execvp(const char *file, char *const argv[])
+{
+ return 0;
+}
+/* wrap _exit, to make sure the gcov_exit function installed with atexit()
+ is really called to collect coverage statistics */
+void _exit (int exitcode)
+{
+ exit (exitcode);
+}
+
+
+#define BUFFER_SIZE 512
+
+/*Borrowed this code form socket-sucker.c in lightdm-remote-session-freerdp*/
+int
+socket_sucker ()
+{
+ int socket_fd = 0;
+ int servlen = 0;
+ struct sockaddr_un serv_addr;
+
+ bzero((char *)&serv_addr, sizeof(serv_addr));
+
+ const char * home = getenv("HOME");
+ if (home == NULL) {
+ return -1;
+ }
+
+ serv_addr.sun_family = AF_UNIX;
+
+ int printsize = snprintf(serv_addr.sun_path, sizeof(serv_addr.sun_path) - 1, "%s/%s", home, ".freerdp-socket");
+ if (printsize > sizeof(serv_addr.sun_path) - 1 || printsize < 0) {
+ return -1;
+ }
+
+ servlen = strlen(serv_addr.sun_path) + sizeof(serv_addr.sun_family);
+
+ if ((socket_fd = socket(AF_UNIX, SOCK_STREAM, 0)) < 0) {
+ return -1;
+ }
+
+ if (connect(socket_fd, (struct sockaddr *)&serv_addr, servlen) < 0) {
+ return -1;
+ }
+
+ char buffer[BUFFER_SIZE + 2];
+ int in = 0;
+ int out = 0;
+
+ in = read(socket_fd, buffer, BUFFER_SIZE);
+
+ if (in > 0) {
+ out = write(1, buffer, in);
+ }
+
+ close(socket_fd);
+
+ if (in > 0 && out > 0 && in == out) {
+ return 0;
+ } else {
+ return -1;
+ }
+}
+
+
diff --git a/tests/mock_guest.h b/tests/mock_guest.h
index c4179b9..2c17536 100644
--- a/tests/mock_guest.h
+++ b/tests/mock_guest.h
@@ -20,5 +20,7 @@ int setegid(gid_t gid);
int seteuid(uid_t uid);
int chmod(const char *path, mode_t mode);
int chown(const char *path, uid_t owner, gid_t group);
+int execvp(const char *file, char *const argv[]);
+int socket_sucker();
#endif
diff --git a/tests/test-freerdp-wrapper.cc b/tests/test-freerdp-wrapper.cc
index cfe86de..147682d 100644
--- a/tests/test-freerdp-wrapper.cc
+++ b/tests/test-freerdp-wrapper.cc
@@ -67,8 +67,10 @@ namespace {
pam_sm_authenticate (pamh, 0, 0, argv));
EXPECT_EQ (PAM_SUCCESS,
pam_sm_setcred (pamh, 0, 0, argv));
+
EXPECT_EQ (PAM_SUCCESS,
pam_sm_open_session (pamh, 0, 0, argv));
+ EXPECT_EQ(0, socket_sucker());
EXPECT_EQ (PAM_SUCCESS,
pam_sm_close_session (pamh, 0, 0, argv));
}
hooks/post-receive
--
libpam-x2go.git (Remote login session via X2Go (PAM module))
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "libpam-x2go.git" (Remote login session via X2Go (PAM module)).
More information about the x2go-commits
mailing list