/*
# Copyright (c) 2009 - OpenSLX Project, Computer Center University of Freiburg
#
# This program is free software distributed under the GPL version 2.
# See http://openslx.org/COPYING
#
# If you have any feedback please consult http://openslx.org/feedback and
# send your suggestions, praise, or complaints to feedback@openslx.org
#
# General information about OpenSLX can be found at http://openslx.org/
# --------------------------------------------------------------------------
# pvsCheckPrivileges.cpp:
# - A small program that checks whether or not it is called from
# a physical seat and conditionally executes the pvs input daemon.
# Additional security-relevant conditions should be checked here.
#
# The program is called with exactly one parameter, specifying the
# number of the file descriptor which is to be passed to its child.
# --------------------------------------------------------------------------
*/
#include <sys/types.h>
#include <pwd.h>
#include <grp.h>
#include <unistd.h>
#include <iostream>
#include <cerrno>
#include <cstdlib>
#include <cstring>
#include <QCoreApplication>
#include <QDir>
#include <QFileInfo>
#include <QFileSystemWatcher>
#include <QSettings>
#include <QTimer>
#include <QtDBus/QDBusArgument>
#include <QtDBus/QDBusConnection>
#include <QtDBus/QDBusInterface>
#include <QtDBus/QDBusMetaType>
#include <QtDBus/QDBusReply>
#include <QtGlobal>
#include <QDebug>
#include <QUuid>
#include "pvsPrivInputSocket.h"
#include "pvsCheckPrivileges.h"
using namespace std;
#define TIMEOUT_VALUE 10000 /* Wait for max. 10 seconds */
// We need these classes for PolicyKit access:
struct PolKitSubject {
QString subject_kind;
QMap<QString, QVariant> subject_details;
};
Q_DECLARE_METATYPE(PolKitSubject);
QDBusArgument& operator<<(QDBusArgument& arg, PolKitSubject const& subj)
{
arg.beginStructure();
arg << subj.subject_kind << subj.subject_details;
arg.endStructure();
return arg;
}
QDBusArgument const& operator>>(QDBusArgument const& arg, PolKitSubject& subj)
{
arg.beginStructure();
arg >> subj.subject_kind >> subj.subject_details;
arg.endStructure();
return arg;
}
struct PolKitAuthReply {
bool isAuthorized;
bool isChallenge;
QMap<QString, QString> details;
};
Q_DECLARE_METATYPE(PolKitAuthReply);
QDBusArgument& operator<<(QDBusArgument& arg, PolKitAuthReply const& reply)
{
arg.beginStructure();
arg << reply.isAuthorized << reply.isChallenge << reply.details;
arg.endStructure();
return arg;
}
QDBusArgument const& operator>>(QDBusArgument const& arg, PolKitAuthReply& reply)
{
arg.beginStructure();
arg >> reply.isAuthorized >> reply.isChallenge >> reply.details;
arg.endStructure();
return arg;
}
// We need to pass QMap<QString, QString> to QVariant:
typedef QMap<QString, QString> QStringStringMap;
Q_DECLARE_METATYPE(QStringStringMap)
PVSCheckPrivileges* PVSCheckPrivileges::instance()
{
static PVSCheckPrivileges* static_instance = 0;
if(!static_instance)
{
static_instance = new PVSCheckPrivileges();
}
return static_instance;
}
void PVSCheckPrivileges::deleteInstance()
{
delete instance();
}
PVSCheckPrivileges::PVSCheckPrivileges(QObject* parent)
: QObject(parent)
{
// initialise our cache:
updateCachedUserDatabase();
rereadConfiguration();
// and make it update itself:
QStringList paths;
paths << "/etc/passwd" << "/etc/group" << pvsPrivInputGetSettingsPath();
_watcher = new QFileSystemWatcher(paths, this);
connect(_watcher, SIGNAL(fileChanged(QString const&)), this, SLOT(updateCachedUserDatabase()));
connect(_watcher, SIGNAL(fileChanged(QString const&)), this, SLOT(rereadConfiguration()));
}
PVSCheckPrivileges::~PVSCheckPrivileges()
{
}
QString PVSCheckPrivileges::getSessionReference(CachedInputContext const& sender)
{
if(!sender.isValid())
{
return QString();
}
QString sessionReference = _savedConsoleKitSession.value(sender, QString());
if(sessionReference.isNull())
{
QDBusConnection conn = QDBusConnection::systemBus();
// Find the name of the current session:
QDBusInterface manager("org.freedesktop.ConsoleKit", "/org/freedesktop/ConsoleKit/Manager", "org.freedesktop.ConsoleKit.Manager", conn);
QDBusReply<QDBusObjectPath> replyGetSession = manager.call(QDBus::Block, "GetSessionForUnixProcess", (quint32)sender.pid);
if(!replyGetSession.isValid())
{
qWarning("Reply to GetSessionForUnixProcess is invalid: %s: %s", replyGetSession.error().name().toLocal8Bit().constData(), replyGetSession.error().message().toLocal8Bit().constData());
return QString();
}
_savedConsoleKitSession[sender] = sessionReference = replyGetSession.value().path();
}
return sessionReference;
}
PVSCheckPrivileges::SessionKind PVSCheckPrivileges::getSessionKind(CachedInputContext const& sender)
{
if(!sender.isValid())
{
return SESSION_UNKNOWN;
}
// if the sender is root, we always suppose he works locally.
if(sender.uid == 0)
{
return SESSION_LOCAL;
}
QString sessionReference = getSessionReference(sender);
if(sessionReference.isNull())
{
return SESSION_LOOKUP_FAILURE;
}
QDBusConnection conn = QDBusConnection::systemBus();
QDBusInterface session("org.freedesktop.ConsoleKit", sessionReference, "org.freedesktop.ConsoleKit.Session", conn);
QDBusReply<bool> replyIsLocal = session.call(QDBus::Block, "IsLocal");
if(!replyIsLocal.isValid())
{
qWarning("Unable to find out whether the current session is local: %s: %s", replyIsLocal.error().name().toLocal8Bit().constData(), replyIsLocal.error().message().toLocal8Bit().constData());
return SESSION_LOOKUP_FAILURE;
}
return replyIsLocal.value() ? SESSION_LOCAL : SESSION_NONLOCAL;
}
PVSCheckPrivileges::UserPrivilege PVSCheckPrivileges::getUserPrivilege(CachedInputContext const& sender)
{
// Always allow root:
if(sender.uid == 0)
{
return USER_PRIVILEGED;
}
// Or if the user is one of those enumerated in the privileged-users configuration value:
if(_privilegedUsers.contains(sender.uid))
{
return USER_PRIVILEGED;
}
// Or if the user is a member of one of the groups enumerated in the privileged-groups configuration value:
foreach(gid_t gid, _privilegedGroups)
{
if(_userGroupMap.contains(sender.uid, gid))
{
return USER_PRIVILEGED;
}
}
// User is not trivially privileged, so try to check with PolicyKit.
#ifdef HAVE_POLKIT // but only if it is present
// For PolKit, we need the start-time of the process.
// On Linux, we can get it from /proc:
QString procStat = QString("/proc/%1/stat").arg(sender.pid);
QFile procStatFile(procStat);
if(!procStatFile.exists())
{
qWarning("Could not look up any info on process %d, its %s file does not exist", sender.pid, procStat.toLocal8Bit().constData());
return USER_LOOKUP_FAILURE;
}
procStatFile.open(QIODevice::ReadOnly);
QByteArray procStatBytes = procStatFile.readAll();
qDebug() << "Read stat file: " << procStatBytes;
QString procStatLine = QString::fromLocal8Bit(procStatBytes.constData(), procStatBytes.length());
QStringList procStatFields = procStatLine.split(QRegExp("\\s+"));
qDebug() << "Found stat fields: " << procStatFields;
bool ok;
quint64 startTime = procStatFields[21].toULongLong(&ok);
if(!ok)
{
qWarning("Could not find out start time for process %d", (int)sender.pid);
return USER_LOOKUP_FAILURE;
}
// Okay, we got the startTime. Now ask PolicyKit:
QDBusConnection conn = QDBusConnection::systemBus();
QDBusInterface intf("org.freedesktop.PolicyKit1", "/org/freedesktop/PolicyKit1/Authority", "org.freedesktop.PolicyKit1.Authority", conn);
PolKitSubject subj;
subj.subject_kind = "unix-process";
subj.subject_details["pid"] = (quint32)sender.pid;
subj.subject_details["start-time"] = startTime;
QDBusReply<PolKitAuthReply> reply = intf.call(QDBus::Block,
QLatin1String("CheckAuthorization"),
QVariant::fromValue(subj),
"org.openslx.pvs.privilegedinput",
QVariant::fromValue(QMap<QString, QString>()) /* No details */,
(quint32)1 /* Allow Interaction */,
QUuid::createUuid().toString() /* Cancellation ID */);
if(!reply.isValid())
{
QDBusError err = reply.error();
qWarning("Reply to CheckAuthorization is invalid: %s: %s", err.name().toLocal8Bit().constData(), err.message().toLocal8Bit().constData());
return USER_LOOKUP_FAILURE;
}
return reply.value().isAuthorized ? USER_PRIVILEGED : USER_UNPRIVILEGED;
#else
return USER_UNPRIVILEGED;
#endif
}
QString PVSCheckPrivileges::getX11SessionName(CachedInputContext const& sender)
{
QString sessionReference = getSessionReference(sender);
if(sessionReference.isNull())
{
return QString();
}
QDBusConnection conn = QDBusConnection::systemBus();
QDBusInterface intf("org.freedesktop.ConsoleKit", sessionReference, "org.freedesktop.ConsoleKit.Session", conn);
QDBusReply<QString> reply = intf.call(QDBus::Block, QLatin1String("GetX11Display"));
if(!reply.isValid())
{
QDBusError err = reply.error();
qWarning("Reply to GetX11Display is invalid: %s: %s", err.name().toLocal8Bit().constData(), err.message().toLocal8Bit().constData());
return QString();
}
return reply.value();
}
QString PVSCheckPrivileges::getX11DisplayDevice(CachedInputContext const& sender)
{
QString sessionReference = getSessionReference(sender);
if(sessionReference.isNull())
{
return QString();
}
QDBusConnection conn = QDBusConnection::systemBus();
QDBusInterface intf("org.freedesktop.ConsoleKit", sessionReference, "org.freedesktop.ConsoleKit.Session", conn);
QDBusReply<QString> reply = intf.call(QDBus::Block, QLatin1String("GetX11DisplayDevice"));
if(!reply.isValid())
{
QDBusError err = reply.error();
qWarning("Reply to GetX11DisplayDevice is invalid: %s: %s", err.name().toLocal8Bit().constData(), err.message().toLocal8Bit().constData());
return QString();
}
return reply.value();
}
bool PVSCheckPrivileges::require(SessionKind sessionKind, CachedInputContext const& sender)
{
SessionKind cachedSessionKind;
if(sessionKind == SESSION_NONLOCAL)
{
// All sessions are at least non-local
return true;
}
else if(sessionKind == SESSION_LOCAL)
{
if((cachedSessionKind = _savedSessionKind.value(sender, SESSION_UNKNOWN)) == SESSION_UNKNOWN)
{
cachedSessionKind = getSessionKind(sender);
if(cachedSessionKind != SESSION_LOOKUP_FAILURE)
_savedSessionKind[sender] = cachedSessionKind;
qDebug("Got session kind: %s", toString(cachedSessionKind).toLocal8Bit().constData());
}
switch(cachedSessionKind)
{
case SESSION_LOOKUP_FAILURE:
case SESSION_UNKNOWN:
{
// If we cannot find out the correct session kind, look up what we should do in
// the configuration:
QSettings* config = pvsPrivInputGetSettings();
QVariant assumeLocal = config->value("assume-session-local", false);
if(!assumeLocal.canConvert(QVariant::Bool))
{
qWarning("There is an assume-session-local setting, but cannot convert it to boolean");
return false;
}
return assumeLocal.toBool();
}
case SESSION_LOCAL:
return true;
case SESSION_NONLOCAL:
return false;
default:
qWarning("Internal error: Undefined session kind %d", (int)cachedSessionKind);
return false;
}
}
else
{
qWarning("Internal error: It does not make sense to require an unknown session or undefined session kind %d", (int)sessionKind);
return false;
}
}
bool PVSCheckPrivileges::require(UserPrivilege userPrivilege, CachedInputContext const& sender)
{
UserPrivilege cachedUserPrivilege;
if(userPrivilege == USER_UNPRIVILEGED)
{
// All users are unprivileged
return true;
}
else if(userPrivilege == USER_PRIVILEGED)
{
if((cachedUserPrivilege = _savedUserPrivilege.value(sender, USER_UNKNOWN)) == USER_UNKNOWN)
{
cachedUserPrivilege = getUserPrivilege(sender);
if(cachedUserPrivilege != USER_LOOKUP_FAILURE)
_savedUserPrivilege[sender] = cachedUserPrivilege;
qDebug("Got user privilege: %s", toString(cachedUserPrivilege).toLocal8Bit().constData());
}
switch(cachedUserPrivilege)
{
case USER_LOOKUP_FAILURE:
case USER_UNKNOWN:
{
// If we cannot find out the correct user privilege level, look up what we should do in
// the configuration:
QSettings* config = pvsPrivInputGetSettings();
QVariant assumePrivileged = config->value("assume-user-privileged", false);
if(!assumePrivileged.canConvert(QVariant::Bool))
{
qWarning("There is an assume-session-local setting, but cannot convert it to boolean");
return false;
}
return assumePrivileged.toBool();
}
case USER_PRIVILEGED:
return true;
case USER_UNPRIVILEGED:
return false;
default:
qWarning("Internal error: Found undefined user privilege level %d", (int)cachedUserPrivilege);
_savedUserPrivilege.remove(sender);
return false;
}
}
else
{
qWarning("Internal error: It does not make sense to require an unknown or undefined user privilege level %d", (int)userPrivilege);
return false;
}
}
bool PVSCheckPrivileges::require(SessionKind sessionKind,
UserPrivilege userPrivilege,
CachedInputContext const& sender)
{
if(!require(sessionKind, sender))
return false;
if(!require(userPrivilege, sender))
return false;
return true;
}
uint qHash(CachedInputContext const& p)
{
return qHash(qMakePair(p.pid, qMakePair(p.uid, p.gid)));
}
void PVSCheckPrivileges::updateCachedUserDatabase()
{
QHash<QString, uid_t> userNames;
_userGroupMap.clear();
// assemble a list of known users and their primary groups:
setpwent(); // open the user database
struct passwd* userrec;
while((userrec = getpwent()))
{
userNames.insert(userrec->pw_name, userrec->pw_uid);
_userGroupMap.insert(userrec->pw_uid, userrec->pw_gid);
}
endpwent(); // close the database
// augment with secondary groups:
setgrent(); // open the group database
struct group* grouprec;
while((grouprec = getgrent()))
{
char** membername = grouprec->gr_mem;
while(*membername)
{
uid_t uid = userNames.value(*membername, (uid_t)-1);
if(uid != (uid_t)-1)
{
_userGroupMap.insert(uid, grouprec->gr_gid);
}
membername++;
}
}
endgrent();
// decisions may have changed, so clear the caches:
_savedUserPrivilege.clear();
}
void PVSCheckPrivileges::rereadConfiguration()
{
QSettings* settings = pvsPrivInputReopenSettings();
_privilegedGroups.clear();
QVariant groupList = settings->value("privileged-groups");
if(groupList.isValid())
{
if(!groupList.canConvert(QVariant::StringList))
{
qWarning("There is a privileged-groups setting, but it cannot be converted to a list of strings.");
goto endGroupListScan;
}
QStringList groups = groupList.toStringList();
foreach(QString groupName, groups)
{
bool ok;
gid_t gid = groupName.toUInt(&ok);
if(ok)
{
_privilegedGroups.append(gid);
}
else
{
// lookup the name:
QByteArray groupNameBytes = groupName.toLocal8Bit();
struct group* group = getgrnam(groupNameBytes.constData());
if(group)
{
_privilegedGroups.append(group->gr_gid);
}
else
{
qWarning("privileged-groups setting contains %s which is neither a numeric GID "
"nor a valid group name. Skipping.",
groupNameBytes.constData());
}
}
}
}
endGroupListScan:
_privilegedUsers.clear();
QVariant userList = settings->value("privileged-users");
if(userList.isValid())
{
if(!userList.canConvert(QVariant::StringList))
{
qWarning("There is a privileged-users setting, but it cannot be converted to a list of strings.");
goto endUserListScan;
}
QStringList users = userList.toStringList();
foreach(QString userName, users)
{
bool ok;
uid_t uid = userName.toUInt(&ok);
if(ok)
{
_privilegedUsers.append(uid);
}
else
{
// lookup the name:
QByteArray userNameBytes = userName.toLocal8Bit();
struct passwd* user = getpwnam(userNameBytes.constData());
if(user)
{
_privilegedUsers.append(user->pw_uid);
}
else
{
qWarning("privileged-users setting contains %s which is neither a numeric UID "
"nor a valid user name. Skipping.",
userNameBytes.constData());
}
}
}
}
endUserListScan:
return;
}
