Attachment 248641 Details for Bug 367611 – patch to make login start up ssh-agent and a session bus

[patch] patch to make login start up ssh-agent and a session bus

util-linux-ng-2.13-dbus-agent.patch (text/plain), 7.81 KB, created by Nalin Dahyabhai on 2007-11-05 22:09:45 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Nalin Dahyabhai

Created: 2007-11-05 22:09:45 UTC

Size: 7.81 KB

patch

obsolete

>Make login(1) start an ssh-agent and a D-Bus session bus if either aren't
>already running, and to clean up those which it starts.  In targeted policy,
>this adds a requirement for:
>  allow local_login_t ssh_agent_exec_t:file execute;
>  allow local_login_t system_dbusd_exec_t:file execute;
>The daemons are started after the PAM session is opened, so if pam_selinux
>is being used to set the execution context for the user's shell, it affects
>these as well.
>
>--- util-linux-ng-2.13/configure.ac	2007-10-04 09:37:42.000000000 -0400
>+++ util-linux-ng-2.13/configure.ac	2007-11-05 15:39:43.000000000 -0500
>@@ -457,6 +457,21 @@
>   AC_DEFINE(LOGIN_STAT_MAIL, 1, [Should login stat() the mailbox?])
> fi
> 
>+AC_ARG_ENABLE([login-dbus],
>+  AS_HELP_STRING([--enable-login-dbus], [let login start a D-Bus session]),
>+  [], enable_login_dbus=yes)
>+
>+if test x$enable_login_dbus = xyes; then
>+  AC_DEFINE(LOGIN_DBUS, 1, [Should login start a D-Bus session?])
>+fi
>+
>+AC_ARG_ENABLE([login-ssh-agent],
>+  AS_HELP_STRING([--enable-login-ssh-agent], [let login start an ssh-agent]),
>+  [], enable_login_ssh_agent=yes)
>+
>+if test x$enable_login_ssh_agent = xyes; then
>+  AC_DEFINE(LOGIN_SSH_AGENT, 1, [Should login start an ssh-agent?])
>+fi
> 
> AC_ARG_ENABLE([pg-bell],
>   AS_HELP_STRING([--disable-pg-bell], [let pg not ring the bell on invalid keys]),
>--- util-linux-ng-2.13/login-utils/login.c	2007-11-05 16:41:17.000000000 -0500
>+++ util-linux-ng-2.13/login-utils/login.c	2007-11-05 16:52:38.000000000 -0500
>@@ -346,6 +346,199 @@
> # define logaudit(tty, username, hostname, pwd, status)
> #endif /* HAVE_LIBAUDIT */
> 
>+#ifdef LOGIN_DBUS
>+#define DBUS_ADDRESS_VAR "DBUS_SESSION_BUS_ADDRESS"
>+#define DBUS_PID_VAR "DBUS_SESSION_BUS_PID"
>+static pid_t pid_dbus = -1;
>+static void
>+stop_dbus_session(void)
>+{
>+    if (pid_dbus != -1) {
>+        kill(pid_dbus, SIGTERM);
>+        waitpid(pid_dbus, NULL, 0);
>+        pid_dbus = -1;
>+    }
>+}
>+static void
>+start_dbus_session(void)
>+{
>+    pid_t pid;
>+    int pidfd[2], addrfd[2], i;
>+    char pidarg[32], addrarg[32], output[LINE_MAX], *p;
>+    /* check if we even need to do anything */
>+    if (getenv(DBUS_ADDRESS_VAR) != NULL) {
>+        return;
>+    }
>+    /* prepare ways for the daemon to tell us what's up */
>+    if (pipe(pidfd) == -1) {
>+       fprintf(stderr, _("login: failure opening pipe for dbus: %s"),
>+               strerror(errno));
>+       return;
>+    }
>+    if (pipe(addrfd) == -1) {
>+       fprintf(stderr, _("login: failure opening pipe for dbus: %s"),
>+               strerror(errno));
>+       close(pidfd[0]);
>+       close(pidfd[1]);
>+       return;
>+    }
>+    pid = fork();
>+    switch (pid) {
>+    case -1:
>+       /* fork error - no change in behavior */
>+       close(pidfd[0]);
>+       close(pidfd[1]);
>+       close(addrfd[0]);
>+       close(addrfd[1]);
>+       fprintf(stderr, _("login: failure forking for dbus: %s"),
>+               strerror(errno));
>+       return;
>+    case 0:
>+       /* child - exec dbus-daemon */
>+       if (setuid(pwd->pw_uid) < 0 && pwd->pw_uid) {
>+          syslog(LOG_ALERT, _("setuid() failed while starting dbus"));
>+          _exit(1);
>+       }
>+       close(pidfd[0]);
>+       close(addrfd[0]);
>+       sprintf(pidarg, "--print-pid=%d", pidfd[1]);
>+       sprintf(addrarg, "--print-address=%d", addrfd[1]);
>+       execlp("dbus-daemon", "dbus-daemon", "--fork", "--session",
>+              pidarg, addrarg, NULL);
>+       _exit(1);
>+       return;
>+       break;
>+    default:
>+       break;
>+    }
>+    close(pidfd[1]);
>+    close(addrfd[1]);
>+    /* read the pid */
>+    memset(output, '\0', sizeof(output));
>+    i = sprintf(output, DBUS_PID_VAR "=");
>+    while ((read(pidfd[0], output + i, 1) == 1) && (i < sizeof(output))) {
>+        i++;
>+    }
>+    output[strcspn(output, "\r\n;")] = '\0';
>+    p = NULL;
>+    pid_dbus = strtol(output + sizeof(DBUS_PID_VAR), &p, 10);
>+    if ((p == NULL) || (*p != '\0')) {
>+        pid_dbus = -1;
>+    } else {
>+        putenv(strdup(output));
>+    }
>+    close(pidfd[0]);
>+    /* read the address */
>+    memset(output, '\0', sizeof(output));
>+    i = sprintf(output, DBUS_ADDRESS_VAR "=");
>+    while ((read(addrfd[0], output + i, 1) == 1) && (i < sizeof(output))) {
>+        i++;
>+    }
>+    output[strcspn(output, "\r\n;")] = '\0';
>+    putenv(strdup(output));
>+    close(addrfd[0]);
>+    waitpid(pid, NULL, 0);
>+    return;
>+}
>+#endif
>+
>+#ifdef LOGIN_SSH_AGENT
>+#define SSH_AGENT_ADDRESS_VAR "SSH_AUTH_SOCK"
>+#define SSH_AGENT_PID_VAR "SSH_AGENT_PID"
>+static pid_t pid_ssh_agent = -1;
>+static void
>+stop_ssh_agent(void)
>+{
>+    if (pid_ssh_agent != -1) {
>+        kill(pid_ssh_agent, SIGTERM);
>+        waitpid(pid_ssh_agent, NULL, 0);
>+        pid_ssh_agent = -1;
>+    }
>+}
>+static void
>+start_ssh_agent(void)
>+{
>+    pid_t pid;
>+    int fd[2], i;
>+    char output[LINE_MAX], *p;
>+    /* check if we even need to do anything */
>+    if (getenv(SSH_AGENT_ADDRESS_VAR) != NULL) {
>+        return;
>+    }
>+    /* okay, get going on starting it up */
>+    if (pipe(fd) == -1) {
>+       fprintf(stderr, _("login: failure opening pipe for ssh-agent: %s"),
>+               strerror(errno));
>+       return;
>+    }
>+    pid = fork();
>+    switch (pid) {
>+    case -1:
>+       /* fork error - no change in behavior */
>+       close(fd[0]);
>+       close(fd[1]);
>+       fprintf(stderr, _("login: failure forking for ssh-agent: %s"),
>+               strerror(errno));
>+       return;
>+    case 0:
>+       /* child - exec ssh-agent in debug mode so that it doesn't fork */
>+       if (setuid(pwd->pw_uid) < 0 && pwd->pw_uid) {
>+          syslog(LOG_ALERT, _("setuid() failed while starting ssh-agent"));
>+          _exit(1);
>+       }
>+       close(fd[0]);
>+       if (fd[1] != STDOUT_FILENO) {
>+           dup2(fd[1], STDOUT_FILENO);
>+           close(fd[1]);
>+       }
>+       dup2(STDOUT_FILENO, STDERR_FILENO);
>+       execlp("ssh-agent", "ssh-agent", "-s", NULL);
>+       _exit(1);
>+       return;
>+       break;
>+    default:
>+       break;
>+    }
>+    close(fd[1]);
>+    /* read the output */
>+    memset(output, '\0', sizeof(output));
>+    i = 0;
>+    while (read(fd[0], output + i, 1) == 1) {
>+        switch (output[i]) {
>+        case '\r':
>+        case '\n':
>+            memset(output + i, '\0', sizeof(output) - i);
>+            if (i > 0) {
>+                if (strncmp(output, SSH_AGENT_ADDRESS_VAR "=",
>+                            sizeof(SSH_AGENT_ADDRESS_VAR)) == 0) {
>+                    output[strcspn(output, ";")] = '\0';
>+                    putenv(strdup(output));
>+                }
>+                if (strncmp(output, SSH_AGENT_PID_VAR "=",
>+                            sizeof(SSH_AGENT_PID_VAR)) == 0) {
>+                    output[strcspn(output, ";")] = '\0';
>+                    putenv(strdup(output));
>+                    p = NULL;
>+                    pid_ssh_agent = strtol(output + 14, &p, 10);
>+                    if ((p == NULL) || (*p != '\0')) {
>+                        pid_ssh_agent = -1;
>+                    }
>+                }
>+            }
>+            memset(output, '\0', i);
>+            i = 0;
>+            break;
>+        default:
>+            i++;
>+            break;
>+        }
>+    }
>+    waitpid(pid, NULL, 0);
>+    close(fd[0]);
>+    return;
>+}
>+#endif
>+
> int
> main(int argc, char **argv)
> {
>@@ -1134,6 +1327,16 @@
> 
>     closelog();
> 
>+
>+#ifdef LOGIN_DBUS
>+    /* start up a session bus */
>+    start_dbus_session();
>+#endif
>+#ifdef LOGIN_SSH_AGENT
>+    /* start up an ssh-agent */
>+    start_ssh_agent();
>+#endif
>+
>     /*
>      * We must fork before setuid() because we need to call
>      * pam_close_session() as root.
>@@ -1161,6 +1364,14 @@
>        while(wait(NULL) == -1 && errno == EINTR)
> 	       ;
>        openlog("login", LOG_ODELAY, LOG_AUTHPRIV);
>+#ifdef LOGIN_SSH_AGENT
>+       /* stop the user's ssh-agent, if we started it */
>+       stop_ssh_agent();
>+#endif
>+#ifdef LOGIN_DBUS
>+       /* stop the session bus */
>+       stop_dbus_session();
>+#endif
>        PAM_END;
>        exit(0);
>     }

Actions: View | Diff

Attachments on bug 367611: 248641