Merge lp:~jeff-apple/openvista-gtm-integration/bug385746 into lp:openvista-gtm-integration

[jeff.apple]

[jeff.apple (jeff-apple)]

The packaging parts may not be quite up to snuff. Jon should pay special attention to that.

[Jon Tai (jontai)]

In src/libopenvista/compile.sh, can you remove the -lpam flag?

In packages/rpm/openvista-libs-5.3003.spec, I'm thinking ovauth may be better in /sbin like unix_chkpwd, or at least /usr/sbin. It definitely should not be installed chgrp gtm, since it has nothing to do with GT.M. Perhaps chgrp openvista would be more appropriate?

In src/ovauth/ovauth.c, "reading an appending" should be "reading and appending".

Finally, should we test this on a LDAP and non-LDAP machine before merging?

[lp:~jeff-apple/openvista-gtm-integration/bug385746]

66. By jeff.apple on 2009-06-17

Change install location of ovauth binary
Make ovauth be in group openvista
Remove PAM library dependency in libopenvista

=== modified file 'mumps/ZOSVGUX.m'
--- mumps/ZOSVGUX.m	2009-06-11 20:20:10 +0000
+++ mumps/ZOSVGUX.m	2009-06-16 22:31:04 +0000
@@ -71,7 +71,14 @@
  Q 1 ; until we fix this, we're never in application mode
  ;
 AUTH(USER,PASS) ;
- Q $&openvista.dopam($G(USER),$G(PASS),"openvista")
+ N DEV,OLDIO,STATUS
+ S DEV="ovauth",OLDIO=$IO,STATUS="Problem opening pipe"
+ O DEV:(COMMAND=$ZTRNLNM("gtm_dist")_"/ovauth "_USER:PARSE:INDEPENDENT:EXCEPTION="G AUTHDONE")::"PIPE"
+ U DEV W PASS R STATUS
+AUTHDONE
+ U OLDIO
+ C DEV
+ Q STATUS="OK"
 UCI ;
  S Y=^%ZOSF("PROD") Q
  ;
 
=== modified file 'packages/rpm/openvista-libs-5.3003.spec'
--- packages/rpm/openvista-libs-5.3003.spec	2009-06-05 19:50:29 +0000
+++ packages/rpm/openvista-libs-5.3003.spec	2009-06-16 05:54:58 +0000
@@ -49,6 +49,11 @@
 cd src/suidwrapper
 ./compile.sh
 
+cd ../../
+
+cd src/ovauth
+./compile.sh
+
 %install
 rm -rf %{buildroot}
 
@@ -56,6 +61,7 @@
 install -m 550 src/libopenvista/libopenvista.so %{buildroot}%{gtm_dist}
 install -m 440 src/libopenvista/openvista.xc %{buildroot}%{gtm_dist}
 install -m 4550 src/suidwrapper/gtmsignal %{buildroot}%{gtm_dist}
+install -m 4550 src/ovauth/ovauth %{buildroot}%{gtm_dist}
 
 %clean
 rm -rf %{buildroot}
@@ -71,6 +77,7 @@
 %{gtm_dist}/openvista.xc
 %defattr(-,root,gtm)
 %{gtm_dist}/gtmsignal
+%{gtm_dist}/ovauth
 
 %post
 # See http://fedoraproject.org/wiki/PackagingDrafts/SELinux
 
=== removed file 'src/libopenvista/authdata.h'
--- src/libopenvista/authdata.h	2009-02-18 07:36:49 +0000
+++ src/libopenvista/authdata.h	1970-01-01 00:00:00 +0000
@@ -1,27 +0,0 @@
-/*
-* Copyright (C) 2009 Medsphere Systems Corporation
-*
-* This program is free software; you can redistribute it and/or modify it
-* solely under the terms of the GNU Affero General Public License version 3 as
-* published by the Free Software Foundation.
-* 
-* This program is distributed in the hope that it will be useful, but WITHOUT
-* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-* FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License
-* for more details.
-* 
-* You should have received a copy of the GNU Affero General Public License
-* along with this program.  If not, see <http://www.gnu.org/licenses>.
-* 
-* You can contact Medsphere Systems Corporation headquarters at 1917 Palomar 
-* Oaks Way, Suite 200, Carlsbad, CA 92008 or at [e-mail]. 
-*/
-#ifndef AUTHDATA_H
-#define AUTHDATA_H
-
-typedef struct {
-  char *user;
-  char *password;
-} authdata; 
-
-#endif
 
=== modified file 'src/libopenvista/compile.sh'
--- src/libopenvista/compile.sh	2009-04-30 06:54:29 +0000
+++ src/libopenvista/compile.sh	2009-06-16 05:54:58 +0000
@@ -17,7 +17,5 @@
 # You can contact Medsphere Systems Corporation headquarters at 1917 Palomar 
 # Oaks Way, Suite 200, Carlsbad, CA 92008 or at [e-mail]. 
 
-gcc -c -FPIC myconv.c
-gcc -c -FPIC -I /opt/lsb-gtm/V5.3-003_i686 dopam.c
 gcc -c -FPIC -I /opt/lsb-gtm/V5.3-003_i686 gtmserver.c
-gcc -o libopenvista.so -shared myconv.o dopam.o gtmserver.o -lpam
+gcc -o libopenvista.so -shared gtmserver.o -lpam
 
=== removed file 'src/libopenvista/dopam.c'
--- src/libopenvista/dopam.c	2009-04-30 06:54:29 +0000
+++ src/libopenvista/dopam.c	1970-01-01 00:00:00 +0000
@@ -1,71 +0,0 @@
-/*
-* Copyright (C) 2009 Medsphere Systems Corporation
-*
-* This program is free software; you can redistribute it and/or modify it
-* solely under the terms of the GNU Affero General Public License version 3 as
-* published by the Free Software Foundation.
-* 
-* This program is distributed in the hope that it will be useful, but WITHOUT
-* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-* FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License
-* for more details.
-* 
-* You should have received a copy of the GNU Affero General Public License
-* along with this program.  If not, see <http://www.gnu.org/licenses>.
-* 
-* You can contact Medsphere Systems Corporation headquarters at 1917 Palomar 
-* Oaks Way, Suite 200, Carlsbad, CA 92008 or at [e-mail]. 
-*/
-#include <stdio.h>
-
-#include <stdlib.h>
-#include <security/pam_appl.h>
-
-#include "authdata.h"
-#include "gtmxc_types.h"
-
-extern int myconv(int n, const struct pam_message **msg, struct pam_response **resp, void *data);
-
-xc_long_t dopam(int count, char *user, char *password, char *pam_mod)
-{
-  int pam_err;
-  pam_handle_t *pamh;
-  struct pam_conv pamc;
-  authdata adata;
-
-  if (password && *password!='\0')
-    adata.password = password;
-  else
-    return 0;
-
-  if (user && *user!='\0')
-    adata.user = user;
-  else
-    return 0;
-
-  if (!pam_mod || *pam_mod=='\0')
-    pam_mod = "openvista";
-
-  /* initialize PAM */
-  pamc.conv = &myconv;
-  pamc.appdata_ptr = &adata;
-  pam_start(pam_mod, adata.user, &pamc, &pamh);
-
-  /* authenticate the applicant */
-  if ((pam_err = pam_authenticate(pamh, 0)) != PAM_SUCCESS)
-    goto pamerr;
-  if ((pam_err = pam_acct_mgmt(pamh, 0)) != PAM_SUCCESS)
-    goto pamerr;
-
-  /* establish the requested credentials */
-  if ((pam_err = pam_setcred(pamh, PAM_ESTABLISH_CRED)) != PAM_SUCCESS)
-    goto pamerr;
-
-  pam_end(pamh, pam_err);
-  return 1;
-
-pamerr:
-  pam_end(pamh, pam_err);
-  return 0;
-}
-
 
=== modified file 'src/libopenvista/openvista.xc'
--- src/libopenvista/openvista.xc	2009-04-30 06:48:24 +0000
+++ src/libopenvista/openvista.xc	2009-06-16 05:54:58 +0000
@@ -1,3 +1,2 @@
 /opt/lsb-gtm/V5.3-003_i686/libopenvista.so
-dopam: xc_long_t dopam(I:xc_char_t*, I:xc_char_t*, I:xc_char_t*)
 gtmserver: xc_long_t gtmserver(I:xc_long_t, I:xc_char_t*)
 
=== added directory 'src/ovauth'
=== renamed file 'src/libopenvista/SYSAUTH.m' => 'src/ovauth/SYSAUTH.m'
--- src/libopenvista/SYSAUTH.m	2009-06-11 20:55:44 +0000
+++ src/ovauth/SYSAUTH.m	2009-06-16 22:31:04 +0000
@@ -29,6 +29,13 @@
  X ^%ZOSF("EON")
  W !
  Q:PASS="^" 0
- Q $$AUTH(USER,PASS)
-AUTH(USER,PASS,MOD)
- Q $&openvista.dopam($G(USER),$G(PASS),$G(MOD))
+ ; fall through
+AUTH(USER,PASS)
+ N DEV,OLDIO,STATUS
+ S DEV="ovauth",OLDIO=$IO,STATUS="Problem opening pipe"
+ O DEV:(COMMAND=$ZTRNLNM("gtm_dist")_"/ovauth "_USER:PARSE:INDEPENDENT:EXCEPTION="G AUTHDONE")::"PIPE"
+ U DEV W PASS R STATUS
+AUTHDONE
+ U OLDIO
+ C DEV
+ Q STATUS="OK"
 
=== added file 'src/ovauth/compile.sh'
--- src/ovauth/compile.sh	1970-01-01 00:00:00 +0000
+++ src/ovauth/compile.sh	2009-06-16 05:54:58 +0000
@@ -0,0 +1,3 @@
+#/bin/sh
+
+gcc -O2 ovauth.c -lpam -o ovauth
 
=== added file 'src/ovauth/ovauth.c'
--- src/ovauth/ovauth.c	1970-01-01 00:00:00 +0000
+++ src/ovauth/ovauth.c	2009-06-16 23:01:16 +0000
@@ -0,0 +1,292 @@
+/*
+* Copyright (C) 2009 Medsphere Systems Corporation
+*
+* This program is free software; you can redistribute it and/or modify it
+* solely under the terms of the GNU Affero General Public License version 3 as
+* published by the Free Software Foundation.
+* 
+* This program is distributed in the hope that it will be useful, but WITHOUT
+* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+* FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License
+* for more details.
+* 
+* You should have received a copy of the GNU Affero General Public License
+* along with this program.  If not, see <http://www.gnu.org/licenses>.
+* 
+* You can contact Medsphere Systems Corporation headquarters at 1917 Palomar 
+* Oaks Way, Suite 200, Carlsbad, CA 92008 or at [e-mail]. 
+*/
+
+#include <unistd.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <grp.h>
+#include <pwd.h>
+#include <security/pam_appl.h>
+#include <syslog.h>
+#include <stdarg.h>
+
+#define MAXPASS     200
+#define OV_GROUP    "openvista"
+#define OV_USER     "openvista"
+#define OV_PAM_MOD  "openvista"
+
+typedef struct {
+  const char *user;
+  const char *password;
+} authdata; 
+
+/* Log to syslog, and print to stdout */
+static void ov_auth_log(int priority, const char *format, ...)
+{
+  va_list args;
+  char msg[1000];
+
+  /* Print the var args to buffer */
+  va_start(args, format);
+  vsnprintf( msg, 1000, format, args );
+  va_end(args);
+
+  /* Write to syslog */
+  openlog("ovauth", LOG_CONS | LOG_PID, LOG_AUTHPRIV);
+  syslog(priority, "%s", msg);
+  closelog();
+
+  /* Write to stdout and flush */
+  printf( "%s\n", msg );
+  fflush( stdout );
+}
+
+/* PAM conversation function */
+int myconv(int n, const struct pam_message **msg, struct pam_response **resp, void *data) {
+  struct pam_response *aresp;
+  char buf[PAM_MAX_RESP_SIZE];
+  int i;
+  int len;
+  int sysretry;
+
+  authdata *adata = (authdata *) data;
+  if (!adata) {
+    goto fail;
+  }
+
+  if (n <= 0 || n > PAM_MAX_NUM_MSG) {
+    return (PAM_CONV_ERR);
+  }
+  if ((aresp = calloc(n, sizeof *aresp)) == NULL) {
+    return (PAM_BUF_ERR);
+  }
+  for (i = 0; i < n; ++i) {
+    aresp[i].resp_retcode = 0;
+    aresp[i].resp = NULL;
+    switch (msg[i]->msg_style) {
+    case PAM_PROMPT_ECHO_OFF:
+      aresp[i].resp = strdup(adata->password);
+      if (aresp[i].resp == NULL)
+        goto fail;
+      break;
+    case PAM_PROMPT_ECHO_ON:
+      aresp[i].resp = strdup(adata->user);
+      if (aresp[i].resp == NULL)
+        goto fail;
+      break;
+    case PAM_ERROR_MSG:
+      // fall though
+    case PAM_TEXT_INFO:
+      // do nothing
+      break;
+    default:
+      goto fail;
+    }
+  }
+  *resp = aresp;
+  return (PAM_SUCCESS);
+ fail:
+  for (i = 0; i < n; ++i) {
+    if (aresp[i].resp != NULL) {
+      memset(aresp[i].resp, 0, strlen(aresp[i].resp));
+      free(aresp[i].resp);
+    }
+  }
+  memset(aresp, 0, n * sizeof *aresp);
+  *resp = NULL;
+  return (PAM_CONV_ERR);
+}
+
+int using_shadow_pw( struct passwd *pwd ) {
+  /* This logic is from the PAM module */
+  char *pass_wd;
+  if (strcmp(pwd->pw_passwd, "x") == 0) {
+    /* Password is just "x" */
+    return 1;
+  }
+  pass_wd = pwd->pw_passwd;
+  if (*(pass_wd++)=='#' && *(pass_wd++)=='#' && strcmp(pwd->pw_name, pass_wd)==0) {
+    /* Password is "##username" */
+    return 1;
+  }
+  return 0;
+}
+
+int pam_auth(const char *user, const char *pass) {
+  int pam_err;
+  pam_handle_t *pamh;
+  struct pam_conv pamc;
+  authdata adata;
+
+  adata.password = pass;
+  adata.user = user;
+
+  /* initialize PAM */
+  pamc.conv = &myconv;
+  pamc.appdata_ptr = &adata;
+  pam_start(OV_PAM_MOD, adata.user, &pamc, &pamh);
+
+  /* authenticate the applicant */
+  if ((pam_err = pam_authenticate(pamh, 0)) != PAM_SUCCESS) {
+    goto pamerr;
+  }
+  if ((pam_err = pam_acct_mgmt(pamh, 0)) != PAM_SUCCESS) {
+    goto pamerr;
+  }
+
+  /* establish the requested credentials */
+  if ((pam_err = pam_setcred(pamh, PAM_ESTABLISH_CRED)) != PAM_SUCCESS) {
+    goto pamerr;
+  }
+
+  pam_end(pamh, pam_err);
+  return 1;
+
+pamerr:
+  pam_end(pamh, pam_err);
+  return 0;
+}
+
+int user_in_ov_group( struct passwd *user_pwd  ) {
+  gid_t ov_gid;
+  gid_t user_gid;
+  struct group *group_struct;
+  int ngroups;
+  gid_t *groups;
+  int g_idx;
+  int ret_val = 0;
+
+  /* Get the gid for openvista group */
+  group_struct = getgrnam( OV_GROUP );
+  if (group_struct==0) {
+    ov_auth_log( LOG_ALERT, "Group %s was not found", OV_GROUP );
+    return 0;
+  }
+  ov_gid = group_struct->gr_gid;
+  user_gid = user_pwd->pw_gid;
+  if (ov_gid == user_gid) {
+    return 1;
+  }
+
+  /* Get the groups for this user. Allocate space for 20. */
+  ngroups = 20;
+  groups = malloc( ngroups * sizeof(gid_t) );
+  if (-1 == getgrouplist( user_pwd->pw_name, user_gid, groups, &ngroups )) {
+    /* User was in more than 20 groups, so reallocate and grab them all */
+    groups = realloc( groups, ngroups * sizeof(gid_t) );
+    getgrouplist( user_pwd->pw_name, user_gid, groups, &ngroups );
+  }
+  /* Scan for the group we're looking for */
+  for (g_idx=0; g_idx<ngroups; ++g_idx) {
+    if (groups[g_idx] == ov_gid) {
+      ret_val = 1;
+      break;
+    }
+  }
+  free( groups );
+  return ret_val;
+}
+
+int check_perms( struct passwd *user_pwd ) {
+  struct passwd *pwd = NULL;
+  /* Verify that user is openvista */
+  pwd = getpwuid(getuid());
+  if (pwd==0) {
+    ov_auth_log( LOG_ALERT, "Can not determine who is logged in" );
+    return 0;
+  }
+  if (strcmp(pwd->pw_name,OV_USER)!=0) {
+    ov_auth_log( LOG_NOTICE, "Can not be called by this user (%s)", pwd->pw_name );
+    return 0;
+  }
+  /* Verify that the user being authenticated is in openvista group */
+  if (!user_in_ov_group( user_pwd )) {
+    ov_auth_log( LOG_NOTICE, "User '%s' is not in %s group", user_pwd->pw_name, OV_GROUP );
+    return 0;
+  }
+  return 1;
+}
+
+int main( int argc, char *argv[] )
+{
+  int ret_val;
+  char pass[MAXPASS + 1];
+  char *user = argv[1];
+  int npass = 0;
+  struct passwd *user_pwd = NULL;
+
+  /* Make sure we're being run as intended. Provides only a usage guideline,
+   * really, not security.
+   */
+  if (isatty(STDIN_FILENO) || argc != 2 ) {
+    fprintf( stderr, "This program is not run meant to be run this way.\n" );
+    ov_auth_log( LOG_ALERT, "Run with tty stdin" );
+    return 1;
+  }
+
+  /* Read the password from stdin. We have to keep reading an appending if the
+   * message is fragmented.
+   */
+  memset(pass, '\0', MAXPASS);
+  while (1) {
+    npass += read(STDIN_FILENO, pass+npass, MAXPASS);
+    if (npass < 0) {
+      ov_auth_log( LOG_NOTICE, "Password not read" );
+      return 1;
+    } else if (npass >= MAXPASS) {
+      ov_auth_log( LOG_NOTICE, "Password too long" );
+      return 1;
+    }
+    if (pass[npass-1]=='\x0a') {
+      break;
+    }
+  }
+  pass[npass-1] = '\0';
+  user = argv[1];
+
+  /* Get the user's password info */
+  user_pwd = getpwnam( user );
+  if (user_pwd == NULL) {
+    ov_auth_log( LOG_NOTICE, "User '%s' not found", user );
+    return 1;
+  }
+
+  /* Verify that the right users are involved */
+  if (!check_perms(user_pwd)) {
+    return 1;
+  }
+
+  /* Only elevate privs if the user in question has a shadow password */
+  if (using_shadow_pw(user_pwd)) {
+    setuid( 0 );
+  }
+
+  /* Do the actual PAM authentication */
+  ret_val = pam_auth( user, pass );
+  memset(pass, '\0', MAXPASS);
+  if (ret_val==0) {
+    printf("Authentication failure\n");
+  } else {
+    printf("OK\n");
+  }
+  return (ret_val==0);
+}
+
+