[linux-pam] Extend pam_exec by stdout and type= options (ticket #8):

[kukuk]

commit fbd7a2c8e9e3e7b10ba408b28f286cbdeccc5691
Author: Thorsten Kukuk <kukuk(a)thkukuk.de&gt;
Date:   Wed Sep 4 16:40:37 2013 +0200

    Extend pam_exec by stdout and type= options (ticket #8):
    
    * modules/pam_exec/pam_exec.c: Add stdout and type= option
    * modules/pam_exec/pam_exec.8.xml: Document new options

 modules/pam_exec/pam_exec.8.xml |   34 ++++++++++++-
 modules/pam_exec/pam_exec.c     |  108 ++++++++++++++++++++++++++++++++++-----
 2 files changed, 127 insertions(+), 15 deletions(-)
---
diff --git a/modules/pam_exec/pam_exec.8.xml b/modules/pam_exec/pam_exec.8.xml
index 4dc2a19..2379366 100644
--- a/modules/pam_exec/pam_exec.8.xml
+++ b/modules/pam_exec/pam_exec.8.xml
@@ -31,8 +31,14 @@
         quiet
       </arg>
       <arg choice="opt">
+        stdout
+      </arg>
+      <arg choice="opt">
         log=<replaceable>file</replaceable>
       </arg>
+      <arg choice="opt">
+        type=<replaceable>type</replaceable>
+      </arg>
       <arg choice="plain">
        <replaceable>command</replaceable>
       </arg>
@@ -119,6 +125,28 @@
 
         <varlistentry>
           <term>
+           
<option>type=<replaceable>type</replaceable></option>
+          </term>
+          <listitem>
+            <para>
+              Only run the command if the module type matches the given type.
+            </para>
+          </listitem>
+	</varlistentry>
+
+        <varlistentry>
+          <term>
+            <option>stdout</option>
+          </term>
+          <listitem>
+            <para>
+              Per default the output of the executed command is written to
<filename>/dev/null</filename>. With this option, the stdout output of the
executed command is redirected to the calling application. It's in the responsibility
of this application what happens with the output. The <option>log</option>
option is ignored.
+            </para>
+          </listitem>
+       </varlistentry>
+
+        <varlistentry>
+          <term>
             <option>quiet</option>
           </term>
           <listitem>
@@ -194,7 +222,8 @@
           <listitem>
             <para>
 	      <function>pam_setcred</function> was called, which
-	      does not execute the command.
+	      does not execute the command.  Or, the value given for the type=
+	      parameter did not match the module type.
             </para>
           </listitem>
         </varlistentry>
@@ -236,7 +265,8 @@
   <refsect1 id='pam_exec-author'>
     <title>AUTHOR</title>
       <para>
-        pam_exec was written by Thorsten Kukuk &amp;lt;kukuk(a)thkukuk.de&amp;gt;.
+        pam_exec was written by Thorsten Kukuk &amp;lt;kukuk(a)thkukuk.de&amp;gt; and
+        Josh Triplett &amp;lt;josh(a)joshtriplett.org&amp;gt;.
       </para>
   </refsect1>
 
diff --git a/modules/pam_exec/pam_exec.c b/modules/pam_exec/pam_exec.c
index 8b37e95..b56e4b2 100644
--- a/modules/pam_exec/pam_exec.c
+++ b/modules/pam_exec/pam_exec.c
@@ -72,6 +72,24 @@ static struct {
   ENV_ITEM(PAM_RUSER),
 };
 
+/* move_fd_to_non_stdio copies the given file descriptor to something other
+ * than stdin, stdout, or stderr.  Assumes that the caller will close all
+ * unwanted fds after calling. */
+static int
+move_fd_to_non_stdio (pam_handle_t *pamh, int fd)
+{
+  while (fd < 3)
+    {
+      fd = dup(fd);
+      if (fd == -1)
+	{
+	  int err = errno;
+	  pam_syslog (pamh, LOG_ERR, "dup failed: %m");
+	  _exit (err);
+	}
+    }
+  return fd;
+}
 
 static int
 call_exec (const char *pam_type, pam_handle_t *pamh,
@@ -81,11 +99,14 @@ call_exec (const char *pam_type, pam_handle_t *pamh,
   int call_setuid = 0;
   int quiet = 0;
   int expose_authtok = 0;
+  int use_stdout = 0;
   int optargc;
   const char *logfile = NULL;
   const char *authtok = NULL;
   pid_t pid;
   int fds[2];
+  int stdout_fds[2];
+  FILE *stdout_file = NULL;
 
   if (argc < 1) {
     pam_syslog (pamh, LOG_ERR,
@@ -100,8 +121,15 @@ call_exec (const char *pam_type, pam_handle_t *pamh,
 
       if (strcasecmp (argv[optargc], "debug") == 0)
 	debug = 1;
+      else if (strcasecmp (argv[optargc], "stdout") == 0)
+	use_stdout = 1;
       else if (strncasecmp (argv[optargc], "log=", 4) == 0)
 	logfile = &argv[optargc][4];
+      else if (strncasecmp (argv[optargc], "type=", 5) == 0)
+	{
+	  if (strcmp (pam_type, &argv[optargc][5]) != 0)
+	    return PAM_IGNORE;
+	}
       else if (strcasecmp (argv[optargc], "seteuid") == 0)
 	call_setuid = 1;
       else if (strcasecmp (argv[optargc], "quiet") == 0)
@@ -164,6 +192,21 @@ call_exec (const char *pam_type, pam_handle_t *pamh,
 	}
     }
 
+  if (use_stdout)
+    {
+      if (pipe(stdout_fds) != 0)
+	{
+	  pam_syslog (pamh, LOG_ERR, "Could not create pipe: %m");
+	  return PAM_SYSTEM_ERR;
+	}
+      stdout_file = fdopen(stdout_fds[0], "r");
+      if (!stdout_file)
+	{
+	  pam_syslog (pamh, LOG_ERR, "Could not fdopen pipe: %m");
+	  return PAM_SYSTEM_ERR;
+	}
+    }
+
   if (optargc >= argc) {
     pam_syslog (pamh, LOG_ERR, "No path given as argument");
     return PAM_SERVICE_ERR;
@@ -198,6 +241,21 @@ call_exec (const char *pam_type, pam_handle_t *pamh,
         close(fds[1]);
 	}
 
+      if (use_stdout)
+	{
+	  char buf[4096];
+	  close(stdout_fds[1]);
+	  while (fgets(buf, sizeof(buf), stdout_file) != NULL)
+	    {
+	      size_t len;
+	      len = strlen(buf);
+	      if (buf[len-1] == '\n')
+		buf[len-1] = '\0';
+	      pam_info(pamh, "%s", buf);
+	    }
+	  fclose(stdout_file);
+	}
+
       while ((retval = waitpid (pid, &status, 0)) == -1 &&
 	     errno == EINTR);
       if (retval == (pid_t)-1)
@@ -245,6 +303,23 @@ call_exec (const char *pam_type, pam_handle_t *pamh,
       int envlen, nitems;
       char *envstr;
 
+      /* First, move all the pipes off of stdin, stdout, and stderr, to ensure
+       * that calls to dup2 won't close them. */
+
+      if (expose_authtok)
+	{
+	  fds[0] = move_fd_to_non_stdio(pamh, fds[0]);
+	  close(fds[1]);
+	}
+
+      if (use_stdout)
+	{
+	  stdout_fds[1] = move_fd_to_non_stdio(pamh, stdout_fds[1]);
+	  close(stdout_fds[0]);
+	}
+
+      /* Set up stdin. */
+
       if (expose_authtok)
 	{
 	  /* reopen stdin as pipe */
@@ -254,17 +329,10 @@ call_exec (const char *pam_type, pam_handle_t *pamh,
 	      pam_syslog (pamh, LOG_ERR, "dup2 of STDIN failed: %m");
 	      _exit (err);
 	    }
-
-	  for (i = 0; i < sysconf (_SC_OPEN_MAX); i++)
-	    {
-	      if (i != STDIN_FILENO)
-		close (i);
-	    }
 	}
       else
 	{
-	  for (i = 0; i < sysconf (_SC_OPEN_MAX); i++)
-	    close (i);
+	  close (STDIN_FILENO);
 
 	  /* New stdin.  */
 	  if ((i = open ("/dev/null", O_RDWR)) < 0)
@@ -275,12 +343,23 @@ call_exec (const char *pam_type, pam_handle_t *pamh,
 	    }
 	}
 
-      /* New stdout and stderr.  */
-      if (logfile)
+      /* Set up stdout. */
+
+      if (use_stdout)
+	{
+	  if (dup2(stdout_fds[1], STDOUT_FILENO) == -1)
+	    {
+	      int err = errno;
+	      pam_syslog (pamh, LOG_ERR, "dup2 to stdout failed: %m");
+	      _exit (err);
+	    }
+	}
+      else if (logfile)
 	{
 	  time_t tm = time (NULL);
 	  char *buffer = NULL;
 
+	  close (STDOUT_FILENO);
 	  if ((i = open (logfile, O_CREAT|O_APPEND|O_WRONLY,
 			 S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH)) == -1)
 	    {
@@ -297,7 +376,7 @@ call_exec (const char *pam_type, pam_handle_t *pamh,
 	}
       else
 	{
-	  /* New stdout/stderr.  */
+	  close (STDOUT_FILENO);
 	  if ((i = open ("/dev/null", O_RDWR)) < 0)
 	    {
 	      int err = errno;
@@ -306,13 +385,16 @@ call_exec (const char *pam_type, pam_handle_t *pamh,
 	    }
 	}
 
-      if (dup (i) == -1)
+      if (dup2 (STDOUT_FILENO, STDERR_FILENO) == -1)
 	{
 	  int err = errno;
-	  pam_syslog (pamh, LOG_ERR, "dup failed: %m");
+	  pam_syslog (pamh, LOG_ERR, "dup2 failed: %m");
 	  _exit (err);
 	}
 
+      for (i = 3; i < sysconf (_SC_OPEN_MAX); i++)
+	close (i);
+
       if (call_setuid)
 	if (setuid (geteuid ()) == -1)
 	  {