mirror of
https://gitlab.freedesktop.org/wayland/weston
synced 2024-09-30 05:54:08 +00:00
libweston: Add user authentication support via PAM
Add user authentication support for remote backends via PAM. This requires a configuration file /etc/pam.d/weston. Signed-off-by: Philipp Zabel <philipp.zabel@gmail.com>
This commit is contained in:
parent
1a027e63cb
commit
0733c8f571
116
libweston/auth.c
Normal file
116
libweston/auth.c
Normal file
|
@ -0,0 +1,116 @@
|
||||||
|
/*
|
||||||
|
* Copyright © 2022 Philipp Zabel
|
||||||
|
*
|
||||||
|
* Permission is hereby granted, free of charge, to any person obtaining
|
||||||
|
* a copy of this software and associated documentation files (the
|
||||||
|
* "Software"), to deal in the Software without restriction, including
|
||||||
|
* without limitation the rights to use, copy, modify, merge, publish,
|
||||||
|
* distribute, sublicense, and/or sell copies of the Software, and to
|
||||||
|
* permit persons to whom the Software is furnished to do so, subject to
|
||||||
|
* the following conditions:
|
||||||
|
*
|
||||||
|
* The above copyright notice and this permission notice (including the
|
||||||
|
* next paragraph) shall be included in all copies or substantial
|
||||||
|
* portions of the Software.
|
||||||
|
*
|
||||||
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
||||||
|
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
||||||
|
* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
|
||||||
|
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
|
||||||
|
* BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
|
||||||
|
* ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
|
||||||
|
* CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||||
|
* SOFTWARE.
|
||||||
|
*/
|
||||||
|
|
||||||
|
#include "config.h"
|
||||||
|
|
||||||
|
#include <shared/xalloc.h>
|
||||||
|
#include <stdbool.h>
|
||||||
|
#include "libweston-internal.h"
|
||||||
|
|
||||||
|
#ifdef HAVE_PAM
|
||||||
|
|
||||||
|
#include <security/pam_appl.h>
|
||||||
|
#include <security/pam_misc.h>
|
||||||
|
|
||||||
|
static int
|
||||||
|
weston_pam_conv(int num_msg, const struct pam_message **msg,
|
||||||
|
struct pam_response **resp, void *appdata_ptr)
|
||||||
|
{
|
||||||
|
const char *password = appdata_ptr;
|
||||||
|
struct pam_response *rsp;
|
||||||
|
int i;
|
||||||
|
|
||||||
|
if (!num_msg)
|
||||||
|
return PAM_CONV_ERR;
|
||||||
|
|
||||||
|
rsp = calloc(num_msg, sizeof(*rsp));
|
||||||
|
if (!rsp)
|
||||||
|
return PAM_CONV_ERR;
|
||||||
|
|
||||||
|
for (i = 0; i < num_msg; i++) {
|
||||||
|
switch (msg[i]->msg_style) {
|
||||||
|
case PAM_PROMPT_ECHO_OFF:
|
||||||
|
rsp[i].resp = strdup(password);
|
||||||
|
break;
|
||||||
|
case PAM_PROMPT_ECHO_ON:
|
||||||
|
break;
|
||||||
|
case PAM_ERROR_MSG:
|
||||||
|
weston_log("PAM error message: %s\n", msg[i]->msg);
|
||||||
|
break;
|
||||||
|
case PAM_TEXT_INFO:
|
||||||
|
weston_log("PAM info text: %s\n", msg[i]->msg);
|
||||||
|
break;
|
||||||
|
default:
|
||||||
|
free(rsp);
|
||||||
|
return PAM_CONV_ERR;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
*resp = rsp;
|
||||||
|
return PAM_SUCCESS;
|
||||||
|
}
|
||||||
|
|
||||||
|
#endif
|
||||||
|
|
||||||
|
WL_EXPORT bool
|
||||||
|
weston_authenticate_user(const char *username, const char *password)
|
||||||
|
{
|
||||||
|
bool authenticated = false;
|
||||||
|
#ifdef HAVE_PAM
|
||||||
|
struct pam_conv conv = {
|
||||||
|
.conv = weston_pam_conv,
|
||||||
|
.appdata_ptr = strdup(password),
|
||||||
|
};
|
||||||
|
struct pam_handle *pam;
|
||||||
|
int ret;
|
||||||
|
|
||||||
|
conv.appdata_ptr = strdup(password);
|
||||||
|
|
||||||
|
ret = pam_start("weston-remote-access", username, &conv, &pam);
|
||||||
|
if (ret != PAM_SUCCESS) {
|
||||||
|
weston_log("PAM: start failed\n");
|
||||||
|
goto out;
|
||||||
|
}
|
||||||
|
|
||||||
|
ret = pam_authenticate(pam, 0);
|
||||||
|
if (ret != PAM_SUCCESS) {
|
||||||
|
weston_log("PAM: authentication failed\n");
|
||||||
|
goto out;
|
||||||
|
}
|
||||||
|
|
||||||
|
ret = pam_acct_mgmt(pam, 0);
|
||||||
|
if (ret != PAM_SUCCESS) {
|
||||||
|
weston_log("PAM: account check failed\n");
|
||||||
|
goto out;
|
||||||
|
}
|
||||||
|
|
||||||
|
authenticated = true;
|
||||||
|
out:
|
||||||
|
ret = pam_end(pam, ret);
|
||||||
|
assert(ret == PAM_SUCCESS);
|
||||||
|
free(conv.appdata_ptr);
|
||||||
|
#endif
|
||||||
|
return authenticated;
|
||||||
|
}
|
|
@ -490,4 +490,9 @@ wl_data_device_manager_init(struct wl_display *display);
|
||||||
bool
|
bool
|
||||||
weston_output_set_color_outcome(struct weston_output *output);
|
weston_output_set_color_outcome(struct weston_output *output);
|
||||||
|
|
||||||
|
/* User authentication for remote backends */
|
||||||
|
|
||||||
|
bool
|
||||||
|
weston_authenticate_user(const char *username, const char *password);
|
||||||
|
|
||||||
#endif
|
#endif
|
||||||
|
|
|
@ -10,6 +10,7 @@ deps_libweston = [
|
||||||
srcs_libweston = [
|
srcs_libweston = [
|
||||||
git_version_h,
|
git_version_h,
|
||||||
'animation.c',
|
'animation.c',
|
||||||
|
'auth.c',
|
||||||
'bindings.c',
|
'bindings.c',
|
||||||
'clipboard.c',
|
'clipboard.c',
|
||||||
'color.c',
|
'color.c',
|
||||||
|
@ -81,6 +82,18 @@ if get_option('renderer-gl')
|
||||||
deps_libweston += dep_egl
|
deps_libweston += dep_egl
|
||||||
endif
|
endif
|
||||||
|
|
||||||
|
if get_option('backend-vnc')
|
||||||
|
dep_pam = dependency('pam', required: false)
|
||||||
|
if not dep_pam.found()
|
||||||
|
dep_pam = cc.find_library('pam')
|
||||||
|
endif
|
||||||
|
if not dep_pam.found()
|
||||||
|
error('VNC backend requires libpam which was not found. Or, you can use \'-Dbackend-vnc=false\'.')
|
||||||
|
endif
|
||||||
|
config_h.set('HAVE_PAM', '1')
|
||||||
|
deps_libweston += dep_pam
|
||||||
|
endif
|
||||||
|
|
||||||
lib_weston = shared_library(
|
lib_weston = shared_library(
|
||||||
'weston-@0@'.format(libweston_major),
|
'weston-@0@'.format(libweston_major),
|
||||||
srcs_libweston,
|
srcs_libweston,
|
||||||
|
|
|
@ -44,6 +44,7 @@ dir_data_pc = join_paths(dir_data, 'pkgconfig')
|
||||||
dir_lib_pc = join_paths(dir_lib, 'pkgconfig')
|
dir_lib_pc = join_paths(dir_lib, 'pkgconfig')
|
||||||
dir_man = join_paths(dir_prefix, get_option('mandir'))
|
dir_man = join_paths(dir_prefix, get_option('mandir'))
|
||||||
dir_protocol_libweston = join_paths('libweston-@0@'.format(libweston_major), 'protocols')
|
dir_protocol_libweston = join_paths('libweston-@0@'.format(libweston_major), 'protocols')
|
||||||
|
dir_sysconf = join_paths(dir_prefix, get_option('sysconfdir'))
|
||||||
|
|
||||||
public_inc = include_directories('include')
|
public_inc = include_directories('include')
|
||||||
common_inc = [ include_directories('.'), public_inc ]
|
common_inc = [ include_directories('.'), public_inc ]
|
||||||
|
@ -170,6 +171,7 @@ subdir('wcap')
|
||||||
subdir('tests')
|
subdir('tests')
|
||||||
subdir('data')
|
subdir('data')
|
||||||
subdir('man')
|
subdir('man')
|
||||||
|
subdir('pam')
|
||||||
|
|
||||||
if meson.version().version_compare('>= 0.58.0')
|
if meson.version().version_compare('>= 0.58.0')
|
||||||
devenv = environment()
|
devenv = environment()
|
||||||
|
|
8
pam/meson.build
Normal file
8
pam/meson.build
Normal file
|
@ -0,0 +1,8 @@
|
||||||
|
if not get_option('backend-vnc')
|
||||||
|
subdir_done()
|
||||||
|
endif
|
||||||
|
|
||||||
|
install_data(
|
||||||
|
'weston-remote-access',
|
||||||
|
install_dir: join_paths(dir_sysconf, 'pam.d')
|
||||||
|
)
|
3
pam/weston-remote-access
Normal file
3
pam/weston-remote-access
Normal file
|
@ -0,0 +1,3 @@
|
||||||
|
#%PAM-1.0
|
||||||
|
auth include login
|
||||||
|
account include login
|
Loading…
Reference in a new issue