pam: Forward environment variables from PAM client to p11_child

Makefile.am

@@ -695,6 +695,8 @@ dist_noinst_HEADERS = \
     src/util/safe-format-string.h \
     src/util/session_recording.h \
     src/util/strtonum.h \
+    src/util/client_envs.h \
+    src/util/sss_client_envs.h \
     src/util/sss_cli_cmd.h \
     src/util/sss_chain_id_tevent.h \
     src/util/sss_chain_id.h \
@@ -1260,6 +1262,8 @@ libsss_util_la_SOURCES = \
     src/util/atomic_io.c \
     src/util/authtok.c \
     src/util/authtok-utils.c \
+    src/util/client_envs.c \
+    src/util/sss_client_envs.c \
     src/util/domain_info_utils.c \
     src/util/util_lock.c \
     src/util/util_errors.c \
@@ -4195,6 +4199,7 @@ pam_sss_la_SOURCES = \
     src/sss_client/sss_cli.h \
     src/util/atomic_io.c \
     src/util/authtok-utils.c \
+    src/util/client_envs.c \
     src/util/memory_erase.c \
     src/sss_client/sss_pam_macros.h \
     src/sss_client/sss_pam_compat.h
@@ -4725,6 +4730,7 @@ krb5_child_SOURCES = \
     src/util/sss_chain_id.c \
     src/util/strtonum.c \
     src/util/util_errors.c \
+    src/util/client_envs.c \
     src/sss_client/common.c \
     src/krb5_plugin/common/utils.c \
     src/krb5_plugin/idp/idp_utils.c \
@@ -4860,6 +4866,7 @@ p11_child_SOURCES = \
     src/util/util_ext.c \
     src/util/sss_chain_id.c \
     src/util/sss_prctl.c \
+    src/util/client_envs.c \
     $(NULL)
 p11_child_SOURCES += src/p11_child/p11_child_openssl.c
 

contrib/sssd-pcsc.rules.in

@@ -13,3 +13,10 @@ polkit.addRule(function(action, subject) {
             return polkit.Result.YES;
     }
 });
+
+polkit.addRule(function(action, subject) {
+    if (action.id == "org.gnome.remotedesktop.use-grd-pcscd" &&
+        subject.user == "@SSSD_USER@") {
+            return polkit.Result.YES;
+    }
+});

src/p11_child/p11_child_common.c

@@ -35,6 +35,7 @@
 #include "util/crypto/sss_crypto.h"
 #include "util/cert.h"
 #include "util/sss_chain_id.h"
+#include "util/client_envs.h"
 #include "p11_child/p11_child.h"
 
 static const char *op_mode_str(enum op_mode mode)
@@ -165,6 +166,7 @@ int main(int argc, const char *argv[])
     long timeout = -1;
     bool wait_for_card = false;
     char *uri = NULL;
+    char *set_env = NULL;
 
     struct poptOption long_options[] = {
         SSSD_BASIC_CHILD_OPTS
@@ -194,6 +196,8 @@ int main(int argc, const char *argv[])
          _("PKCS#11 URI to restrict selection"), NULL},
         {"timeout", 0, POPT_ARG_LONG, &timeout,
          0, _("OCSP communication timeout"), NULL},
+        {"set-env", 0, POPT_ARG_STRING, &set_env, 'e',
+         _("Set environment variable (KEY=VALUE)"), NULL},
         POPT_TABLEEND
     };
 
@@ -264,6 +268,21 @@ int main(int argc, const char *argv[])
         case 'w':
             wait_for_card = true;
             break;
+        case 'e':
+            if (set_env != NULL && strchr(set_env, '=') != NULL) {
+                char *env = set_env;
+                char *val = strchr(set_env, '=');
+                *val = '\0';
+                val++;
+                if (!is_client_env_allowed(env)) {
+                    fprintf(stderr, "\nEnvironment variable '%s' is not allowed\n\n", env);
+                    poptPrintUsage(pc, stderr, 0);
+                    _exit(-1);
+                }
+                setenv(env, val, 1);
+                set_env = NULL;
+            }
+            break;
         default:
             fprintf(stderr, "\nInvalid option %s: %s\n\n",
                   poptBadOption(pc, 0), poptStrerror(opt));

src/providers/krb5/krb5_auth.h

@@ -46,6 +46,7 @@
 #define CHILD_OPT_CANONICALIZE "canonicalize"
 #define CHILD_OPT_SSS_CREDS_PASSWORD "sss-creds-password"
 #define CHILD_OPT_CHECK_PAC "check-pac"
+#define CHILD_OPT_SET_ENV "set-env"
 
 struct krb5child_req {
     struct pam_data *pd;

src/providers/krb5/krb5_child.c

@@ -40,6 +40,7 @@
 #include "util/find_uid.h"
 #include "util/sss_chain_id.h"
 #include "util/sss_ptr_hash.h"
+#include "util/client_envs.h"
 #include "src/util/util_errors.h"
 #include "providers/backend.h"
 #include "providers/krb5/krb5_auth.h"
@@ -4300,6 +4301,7 @@ int main(int argc, const char *argv[])
     struct cli_opts cli_opts = { 0 };
     int sss_creds_password = 0;
     long dummy_long = 0;
+    char *set_env = NULL;
 
     /* Don't touch PR_SET_DUMPABLE as 'krb5_child' handles host keytab.
      * Rely on system settings instead: this flag "is reset to the
@@ -4329,6 +4331,8 @@ int main(int argc, const char *argv[])
          0, _("Use custom version of krb5_get_init_creds_password"), NULL},
         {CHILD_OPT_CHECK_PAC, 0, POPT_ARG_LONG, &dummy_long, 0,
          _("Check PAC flags"), NULL},
+        {CHILD_OPT_SET_ENV, 0, POPT_ARG_STRING, &set_env, 'e',
+         _("Set environment variable (KEY=VALUE)"), NULL},
         POPT_TABLEEND
     };
 
@@ -4347,6 +4351,21 @@ int main(int argc, const char *argv[])
         case 'C':
             cli_opts.canonicalize = true;
             break;
+        case 'e':
+            if (set_env != NULL && strchr(set_env, '=') != NULL) {
+                char *env = set_env;
+                char *val = strchr(set_env, '=');
+                *val = '\0';
+                val++;
+                if (!is_client_env_allowed(env)) {
+                    fprintf(stderr, "\nEnvironment variable '%s' is not allowed\n\n", env);
+                    poptPrintUsage(pc, stderr, 0);
+                    _exit(-1);
+                }
+                setenv(env, val, 1);
+                set_env = NULL;
+            }
+            break;
         default:
         fprintf(stderr, "\nInvalid option %s: %s\n\n",
                   poptBadOption(pc, 0), poptStrerror(opt));

src/providers/krb5/krb5_child_handler.c

@@ -253,18 +253,27 @@ static errno_t create_send_buffer(struct krb5child_req *kr,
 
 errno_t set_extra_args(TALLOC_CTX *mem_ctx, struct krb5_ctx *krb5_ctx,
                        struct sss_domain_info *domain,
+                       struct pam_data *pd,
                        const char ***krb5_child_extra_args)
 {
     const char **extra_args;
     const char *krb5_realm;
+    size_t num_extra_args;
     size_t c = 0;
     int ret;
 
     if (krb5_ctx == NULL || krb5_child_extra_args == NULL) {
         return EINVAL;
     }
 
-    extra_args = talloc_zero_array(mem_ctx, const char *, 10);
+    num_extra_args = 10; /* base existing args */
+    if (pd != NULL && pd->client_envs != NULL) {
+        for (size_t i = 0; pd->client_envs[i] != NULL; i++) {
+            num_extra_args += 2; /* --set-env + value */
+        }
+    }
+
+    extra_args = talloc_zero_array(mem_ctx, const char *, num_extra_args);
     if (extra_args == NULL) {
         DEBUG(SSSDBG_OP_FAILURE, "talloc_zero_array failed.\n");
         return ENOMEM;
@@ -377,6 +386,13 @@ errno_t set_extra_args(TALLOC_CTX *mem_ctx, struct krb5_ctx *krb5_ctx,
         c++;
     }
 
+    if (pd != NULL && pd->client_envs != NULL) {
+        for (size_t i = 0; pd->client_envs[i] != NULL; i++) {
+            extra_args[c++] = pd->client_envs[i];
+            extra_args[c++] = "--" CHILD_OPT_SET_ENV;
+        }
+    }
+
     extra_args[c] = NULL;
 
     *krb5_child_extra_args = extra_args;
@@ -424,7 +440,7 @@ static errno_t start_krb5_child(struct tevent_req *req)
     ev = child_state->ev;
     kr = child_state->kr;
 
-    ret = set_extra_args(kr, kr->krb5_ctx, kr->dom, &krb5_child_extra_args);
+    ret = set_extra_args(kr, kr->krb5_ctx, kr->dom, kr->pd, &krb5_child_extra_args);
     if (ret != EOK) {
         DEBUG(SSSDBG_OP_FAILURE, "set_extra_args failed.\n");
         return ret;

src/providers/krb5/krb5_common.h

@@ -245,5 +245,6 @@ krb5_error_code copy_keytab_into_memory(TALLOC_CTX *mem_ctx, krb5_context kctx,
 
 errno_t set_extra_args(TALLOC_CTX *mem_ctx, struct krb5_ctx *krb5_ctx,
                        struct sss_domain_info *domain,
+                       struct pam_data *pd,
                        const char ***krb5_child_extra_args);
 #endif /* __KRB5_COMMON_H__ */

src/responder/pam/pamsrv_cmd.c

@@ -40,6 +40,7 @@
 #include "responder/pam/pamsrv_json.h"
 #include "responder/pam/pamsrv_passkey.h"
 #include "responder/pam/pam_helpers.h"
+#include "util/sss_client_envs.h"
 #include "responder/common/cache_req/cache_req.h"
 
 enum pam_verbosity {
@@ -279,6 +280,29 @@ static int pd_set_primary_name(const struct ldb_message *msg,struct pam_data *pd
     return EOK;
 }
 
+static int extract_client_envs(TALLOC_CTX *mem_ctx,
+                               const char ***_envs, size_t size, uint8_t *body,
+                               size_t blen, size_t *c)
+{
+    const char **envs = NULL;
+    uint8_t *data;
+    size_t count;
+    int ret;
+
+    if (*c + size > blen || SIZE_T_OVERFLOW(*c, size)) return EINVAL;
+
+    data = body + (*c);
+    if (size == 0 || data[size - 1] != '\0') return EINVAL;
+
+    ret = parse_client_env_list(mem_ctx, data, size, &envs, &count);
+    if (ret != EOK) return ret;
+
+    *_envs = envs;
+    *c += size;
+
+    return EOK;
+}
+
 static int pam_parse_in_data_v2(struct pam_data *pd,
                                 uint8_t *body, size_t blen)
 {
@@ -408,6 +432,11 @@ static int pam_parse_in_data_v2(struct pam_data *pd,
                                          blen, &c);
                     if (ret != EOK) return ret;
                     break;
+                case SSS_PAM_ITEM_CLIENT_ENVS:
+                    ret = extract_client_envs(pd, &pd->client_envs,
+                                              size, body, blen, &c);
+                    if (ret != EOK) return ret;
+                    break;
                 default:
                     DEBUG(SSSDBG_CRIT_FAILURE,
                           "Ignoring unknown data type [%d].\n", type);

src/responder/pam/pamsrv_p11.c

@@ -771,7 +771,8 @@ struct tevent_req *pam_check_cert_send(TALLOC_CTX *mem_ctx,
     struct tevent_req *req;
     struct tevent_req *subreq;
     struct pam_check_cert_state *state;
-    const char *extra_args[22] = { NULL };
+    const char **extra_args = NULL;
+    size_t num_extra_args;
     uint8_t *write_buf = NULL;
     size_t write_buf_len = 0;
     size_t arg_c;
@@ -800,6 +801,18 @@ struct tevent_req *pam_check_cert_send(TALLOC_CTX *mem_ctx,
 
     state->pam_data = pd;
 
+    num_extra_args = 22; /* base slots for existing args + NULL terminator */
+    if (pd->client_envs != NULL) {
+        for (size_t i = 0; pd->client_envs[i] != NULL; i++) {
+            num_extra_args += 2; /* --set-env + value */
+        }
+    }
+    extra_args = talloc_zero_array(state, const char *, num_extra_args);
+    if (extra_args == NULL) {
+        ret = ENOMEM;
+        goto done;
+    }
+
     /* extra_args are added in revers order */
     arg_c = 0;
 
@@ -880,6 +893,13 @@ struct tevent_req *pam_check_cert_send(TALLOC_CTX *mem_ctx,
         goto done;
     }
 
+    if (pd->client_envs != NULL) {
+        for (size_t i = 0; pd->client_envs[i] != NULL; i++) {
+            extra_args[arg_c++] = pd->client_envs[i];
+            extra_args[arg_c++] = "--set-env";
+        }
+    }
+
     state->ev = ev;
 
     ret = sss_child_start(state, ev,
@@ -933,6 +953,7 @@ struct tevent_req *pam_check_cert_send(TALLOC_CTX *mem_ctx,
     ret = EOK;
 
 done:
+    talloc_free(extra_args);
     if (ret != EOK) {
         tevent_req_error(req, ret);
         tevent_req_post(req, ev);

src/sbus/codegen/sbus_CodeGen.py

@@ -246,7 +246,7 @@ def InitializeDataTypes():
 
     # Custom types
     DataType.Create("pam_data", "struct pam_data *",
-                    DBusType="issssssuayuayiu", RequireTalloc=True)
+                    DBusType="issssssuayuayiuuuay", RequireTalloc=True)
     DataType.Create("pam_response", "struct pam_data *",
                     DBusType="uua(uay)", RequireTalloc=True)
     DataType.Create("ifp_extra", "hash_table_t *",

src/sss_client/pam_message.c

@@ -132,6 +132,8 @@ int pack_message_v3(struct pam_items *pi, size_t *size, uint8_t **buffer)
             2*sizeof(uint32_t) + pi->json_auth_msg_size : 0;
     len += *pi->json_auth_selected != '\0' ?
             2*sizeof(uint32_t) + pi->json_auth_selected_size : 0;
+    len += (pi->client_envs != NULL && pi->client_envs_size > 0) ?
+            2*sizeof(uint32_t) + pi->client_envs_size : 0;
 
     /* optional child_pid */
     if(pi->child_pid > 0) {
@@ -186,6 +188,10 @@ int pack_message_v3(struct pam_items *pi, size_t *size, uint8_t **buffer)
                           pi->json_auth_msg_size, &buf[rp]);
     rp += add_string_item(SSS_PAM_ITEM_JSON_AUTH_SELECTED, pi->json_auth_selected,
                           pi->json_auth_selected_size, &buf[rp]);
+    if (pi->client_envs != NULL && pi->client_envs_size > 0) {
+        rp += add_string_item(SSS_PAM_ITEM_CLIENT_ENVS, (const char *)pi->client_envs,
+                              pi->client_envs_size, &buf[rp]);
+    }
 
     SAFEALIGN_SETMEM_UINT32(buf + rp, SSS_END_OF_PAM_REQUEST, &rp);
 

src/sss_client/pam_message.h

@@ -71,6 +71,8 @@ struct pam_items {
     const char *json_auth_selected;
     size_t json_auth_selected_size;
     bool password_prompting;
+    uint8_t *client_envs;
+    size_t client_envs_size;
 
     bool user_name_hint;
     struct cert_auth_info *cert_list;