[SSSD] [PATCH] PAM: close socket fd with pam_set_data

Jakub Hrozek jhrozek at redhat.com
Thu Oct 11 11:37:49 UTC 2012


On Thu, Oct 11, 2012 at 01:28:03PM +0200, Sumit Bose wrote:
> On Thu, Oct 11, 2012 at 10:00:15AM +0200, Jakub Hrozek wrote:
> > When a PAM-aware application calls pam_end(), our module would call its
> > close_fd "destructor" and close the pipe from its end.
> > 
> > https://fedorahosted.org/sssd/ticket/1569
> 
> Patch looks good, I just wonder if pam_set_data() better should be
> called directly after sss_pam_make_request() to make sure the socket is
> closed even in the case of errors in sss_pam_make_request() or
> eval_response() ?
> 
> bye,
> Sumit

Yes, it should. I've also made the failure of pam_set_data() non fatal.

Thank you for the review!
-------------- next part --------------
>From 812554f3adb45f428a3f6d973ed2f4243c15212c Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Thu, 4 Oct 2012 19:08:08 +0200
Subject: [PATCH] PAM: close socket fd with pam_set_data

https://fedorahosted.org/sssd/ticket/1569
---
 src/sss_client/common.c  |  6 ++++++
 src/sss_client/pam_sss.c | 25 +++++++++++++++++++++++++
 src/sss_client/sss_cli.h |  2 ++
 3 files changed, 33 insertions(+)

diff --git a/src/sss_client/common.c b/src/sss_client/common.c
index 1ef3ba15e5a86952a05de29c9db212fc829111bc..a4d523cdf45665c2e1b4984cc9b6db14c3d05340 100644
--- a/src/sss_client/common.c
+++ b/src/sss_client/common.c
@@ -794,6 +794,12 @@ errno_t check_server_cred(int sockfd)
 #endif
     return 0;
 }
+
+int *sss_pam_get_socket(void)
+{
+    return &sss_cli_sd;
+}
+
 int sss_pam_make_request(enum sss_cli_command cmd,
                       struct sss_cli_req_data *rd,
                       uint8_t **repbuf, size_t *replen,
diff --git a/src/sss_client/pam_sss.c b/src/sss_client/pam_sss.c
index efbc48b6ef0458bb79dad53f81c584611f2be22d..90d4c0a331f4bac81426d148e529b41060b19250 100644
--- a/src/sss_client/pam_sss.c
+++ b/src/sss_client/pam_sss.c
@@ -54,6 +54,7 @@
 #define FLAGS_USE_AUTHTOK    (1 << 2)
 
 #define PWEXP_FLAG "pam_sss:password_expired_flag"
+#define FD_DESTRUCTOR "pam_sss:fd_destructor"
 
 #define PW_RESET_MSG_FILENAME_TEMPLATE SSSD_CONF_DIR"/customize/%s/pam_sss_pw_reset_message.%s"
 #define PW_RESET_MSG_MAX_SIZE 4096
@@ -122,6 +123,24 @@ static void free_exp_data(pam_handle_t *pamh, void *ptr, int err)
     ptr = NULL;
 }
 
+static void close_fd(pam_handle_t *pamh, void *ptr, int err)
+{
+    int fd = *((int *) ptr);
+
+    if (err & PAM_DATA_REPLACE) {
+        /* Nothing to do */
+        return;
+    }
+
+    if (fd == -1) {
+        /* fd not yet initialized */
+        return;
+    }
+
+    D(("Closing the fd"));
+    close(fd);
+}
+
 static size_t add_authtok_item(enum pam_item_type type,
                                enum sss_authtok_type authtok_type,
                                const char *tok, const size_t size,
@@ -1058,6 +1077,7 @@ static int send_and_receive(pam_handle_t *pamh, struct pam_items *pi,
                             enum sss_cli_command task, bool quiet_mode)
 {
     int ret;
+    int sret;
     int errnop;
     struct sss_cli_req_data rd;
     uint8_t *buf = NULL;
@@ -1078,6 +1098,11 @@ static int send_and_receive(pam_handle_t *pamh, struct pam_items *pi,
     errnop = 0;
     ret = sss_pam_make_request(task, &rd, &repbuf, &replen, &errnop);
 
+    sret = pam_set_data(pamh, FD_DESTRUCTOR, sss_pam_get_socket(), close_fd);
+    if (sret != PAM_SUCCESS) {
+        D(("pam_set_data failed, client might leaks fds"));
+    }
+
     if (ret != PAM_SUCCESS) {
         if (errnop != 0) {
             logger(pamh, LOG_ERR, "Request to sssd failed. %s", ssscli_err2string(errnop));
diff --git a/src/sss_client/sss_cli.h b/src/sss_client/sss_cli.h
index f60bd99121dd45f7811699da64eec8b106b20bf3..f3cb44adbcefb31c60c88c71e9251b351dc3a6c7 100644
--- a/src/sss_client/sss_cli.h
+++ b/src/sss_client/sss_cli.h
@@ -481,6 +481,8 @@ int sss_pam_make_request(enum sss_cli_command cmd,
                                      struct sss_cli_req_data *rd,
                                      uint8_t **repbuf, size_t *replen,
                                      int *errnop);
+int *sss_pam_get_socket(void);
+
 int sss_pac_make_request(enum sss_cli_command cmd,
                          struct sss_cli_req_data *rd,
                          uint8_t **repbuf, size_t *replen,
-- 
1.7.11.4



More information about the sssd-devel mailing list