Robert Griebl | 1fca558 | 2002-06-04 20:45:46 +0000 | [diff] [blame] | 1 | /* vi: set sw=4 ts=4: */ |
"Robert P. J. Day" | 801ab14 | 2006-07-12 07:56:04 +0000 | [diff] [blame] | 2 | /* |
Denys Vlasenko | 0ef64bd | 2010-08-16 20:14:46 +0200 | [diff] [blame] | 3 | * Licensed under GPLv2 or later, see file LICENSE in this source tree. |
"Robert P. J. Day" | 801ab14 | 2006-07-12 07:56:04 +0000 | [diff] [blame] | 4 | */ |
Pere Orga | 6a3e01d | 2011-04-01 22:56:30 +0200 | [diff] [blame] | 5 | |
| 6 | //usage:#define login_trivial_usage |
| 7 | //usage: "[-p] [-h HOST] [[-f] USER]" |
| 8 | //usage:#define login_full_usage "\n\n" |
| 9 | //usage: "Begin a new session on the system\n" |
Pere Orga | 6a3e01d | 2011-04-01 22:56:30 +0200 | [diff] [blame] | 10 | //usage: "\n -f Don't authenticate (user already authenticated)" |
| 11 | //usage: "\n -h Name of the remote host" |
| 12 | //usage: "\n -p Preserve environment" |
| 13 | |
Denis Vlasenko | b6adbf1 | 2007-05-26 19:00:18 +0000 | [diff] [blame] | 14 | #include "libbb.h" |
Bernhard Reutner-Fischer | f470196 | 2008-01-27 12:50:12 +0000 | [diff] [blame] | 15 | #include <syslog.h> |
Robert Griebl | 1fca558 | 2002-06-04 20:45:46 +0000 | [diff] [blame] | 16 | #include <sys/resource.h> |
Eric Andersen | 27f64e1 | 2002-06-23 04:24:25 +0000 | [diff] [blame] | 17 | |
Denis Vlasenko | c0415a9 | 2007-03-24 17:04:07 +0000 | [diff] [blame] | 18 | #if ENABLE_SELINUX |
Denys Vlasenko | 37f5bef | 2010-04-05 03:18:40 +0200 | [diff] [blame] | 19 | # include <selinux/selinux.h> /* for is_selinux_enabled() */ |
maxwen | 27116ba | 2015-08-14 21:41:28 +0200 | [diff] [blame] | 20 | #ifndef __BIONIC__ |
Denys Vlasenko | 37f5bef | 2010-04-05 03:18:40 +0200 | [diff] [blame] | 21 | # include <selinux/get_context_list.h> /* for get_default_context() */ |
| 22 | # include <selinux/flask.h> /* for security class definitions */ |
Eric Andersen | 9e48045 | 2003-07-03 10:07:04 +0000 | [diff] [blame] | 23 | #endif |
maxwen | 27116ba | 2015-08-14 21:41:28 +0200 | [diff] [blame] | 24 | #endif |
Robert Griebl | 1fca558 | 2002-06-04 20:45:46 +0000 | [diff] [blame] | 25 | |
Denis Vlasenko | d6e81c7 | 2007-08-21 10:58:18 +0000 | [diff] [blame] | 26 | #if ENABLE_PAM |
Denis Vlasenko | c6c2345 | 2007-08-22 18:14:44 +0000 | [diff] [blame] | 27 | /* PAM may include <locale.h>. We may need to undefine bbox's stub define: */ |
Denys Vlasenko | 37f5bef | 2010-04-05 03:18:40 +0200 | [diff] [blame] | 28 | # undef setlocale |
Denis Vlasenko | c6c2345 | 2007-08-22 18:14:44 +0000 | [diff] [blame] | 29 | /* For some obscure reason, PAM is not in pam/xxx, but in security/xxx. |
| 30 | * Apparently they like to confuse people. */ |
Denys Vlasenko | 37f5bef | 2010-04-05 03:18:40 +0200 | [diff] [blame] | 31 | # include <security/pam_appl.h> |
| 32 | # include <security/pam_misc.h> |
Denis Vlasenko | d6e81c7 | 2007-08-21 10:58:18 +0000 | [diff] [blame] | 33 | static const struct pam_conv conv = { |
| 34 | misc_conv, |
| 35 | NULL |
| 36 | }; |
| 37 | #endif |
| 38 | |
Denis Vlasenko | 942e429 | 2006-09-08 17:25:04 +0000 | [diff] [blame] | 39 | enum { |
| 40 | TIMEOUT = 60, |
| 41 | EMPTY_USERNAME_COUNT = 10, |
Tanguy Pruvot | 823694d | 2012-11-18 13:20:29 +0100 | [diff] [blame] | 42 | /* Some users found 32 chars limit to be too low: */ |
| 43 | USERNAME_SIZE = 64, |
Denis Vlasenko | 9a9edf2 | 2006-09-08 17:29:53 +0000 | [diff] [blame] | 44 | TTYNAME_SIZE = 32, |
Denis Vlasenko | 942e429 | 2006-09-08 17:25:04 +0000 | [diff] [blame] | 45 | }; |
Eric Andersen | 0fbff13 | 2002-06-22 17:49:29 +0000 | [diff] [blame] | 46 | |
Tanguy Pruvot | 8a6c2c2 | 2012-04-28 00:24:09 +0200 | [diff] [blame] | 47 | struct globals { |
| 48 | struct termios tty_attrs; |
| 49 | } FIX_ALIASING; |
| 50 | #define G (*(struct globals*)&bb_common_bufsiz1) |
| 51 | #define INIT_G() do { } while (0) |
| 52 | |
Denis Vlasenko | 7ccf5cc | 2006-09-14 17:03:18 +0000 | [diff] [blame] | 53 | |
Denis Vlasenko | f312e32 | 2007-06-12 22:04:57 +0000 | [diff] [blame] | 54 | #if ENABLE_FEATURE_NOLOGIN |
Denis Vlasenko | 68404f1 | 2008-03-17 09:00:54 +0000 | [diff] [blame] | 55 | static void die_if_nologin(void) |
Denis Vlasenko | 7ccf5cc | 2006-09-14 17:03:18 +0000 | [diff] [blame] | 56 | { |
| 57 | FILE *fp; |
| 58 | int c; |
Denis Vlasenko | 694b514 | 2008-11-07 01:12:16 +0000 | [diff] [blame] | 59 | int empty = 1; |
Denis Vlasenko | 7ccf5cc | 2006-09-14 17:03:18 +0000 | [diff] [blame] | 60 | |
Denis Vlasenko | 5415c85 | 2008-07-21 23:05:26 +0000 | [diff] [blame] | 61 | fp = fopen_for_read("/etc/nologin"); |
Denis Vlasenko | 694b514 | 2008-11-07 01:12:16 +0000 | [diff] [blame] | 62 | if (!fp) /* assuming it does not exist */ |
| 63 | return; |
| 64 | |
| 65 | while ((c = getc(fp)) != EOF) { |
| 66 | if (c == '\n') |
| 67 | bb_putchar('\r'); |
| 68 | bb_putchar(c); |
| 69 | empty = 0; |
| 70 | } |
| 71 | if (empty) |
Denis Vlasenko | 7ccf5cc | 2006-09-14 17:03:18 +0000 | [diff] [blame] | 72 | puts("\r\nSystem closed for routine maintenance\r"); |
Denis Vlasenko | 694b514 | 2008-11-07 01:12:16 +0000 | [diff] [blame] | 73 | |
| 74 | fclose(fp); |
Denys Vlasenko | 8131eea | 2009-11-02 14:19:51 +0100 | [diff] [blame] | 75 | fflush_all(); |
Denis Vlasenko | 694b514 | 2008-11-07 01:12:16 +0000 | [diff] [blame] | 76 | /* Users say that they do need this prior to exit: */ |
| 77 | tcdrain(STDOUT_FILENO); |
Bernhard Reutner-Fischer | 636a1f8 | 2008-05-19 09:29:47 +0000 | [diff] [blame] | 78 | exit(EXIT_FAILURE); |
Denis Vlasenko | 7ccf5cc | 2006-09-14 17:03:18 +0000 | [diff] [blame] | 79 | } |
Denis Vlasenko | f312e32 | 2007-06-12 22:04:57 +0000 | [diff] [blame] | 80 | #else |
Denys Vlasenko | 37f5bef | 2010-04-05 03:18:40 +0200 | [diff] [blame] | 81 | # define die_if_nologin() ((void)0) |
Denis Vlasenko | f312e32 | 2007-06-12 22:04:57 +0000 | [diff] [blame] | 82 | #endif |
Robert Griebl | 1fca558 | 2002-06-04 20:45:46 +0000 | [diff] [blame] | 83 | |
Denis Vlasenko | d6e81c7 | 2007-08-21 10:58:18 +0000 | [diff] [blame] | 84 | #if ENABLE_FEATURE_SECURETTY && !ENABLE_PAM |
Tanguy Pruvot | 8a6c2c2 | 2012-04-28 00:24:09 +0200 | [diff] [blame] | 85 | static int check_securetty(const char *short_tty) |
Denis Vlasenko | 7ccf5cc | 2006-09-14 17:03:18 +0000 | [diff] [blame] | 86 | { |
Denis Vlasenko | 084266e | 2008-07-26 23:08:31 +0000 | [diff] [blame] | 87 | char *buf = (char*)"/etc/securetty"; /* any non-NULL is ok */ |
Denis Vlasenko | 5415c85 | 2008-07-21 23:05:26 +0000 | [diff] [blame] | 88 | parser_t *parser = config_open2("/etc/securetty", fopen_for_read); |
Denis Vlasenko | 084266e | 2008-07-26 23:08:31 +0000 | [diff] [blame] | 89 | while (config_read(parser, &buf, 1, 1, "# \t", PARSE_NORMAL)) { |
| 90 | if (strcmp(buf, short_tty) == 0) |
| 91 | break; |
| 92 | buf = NULL; |
Denis Vlasenko | 7ccf5cc | 2006-09-14 17:03:18 +0000 | [diff] [blame] | 93 | } |
Denis Vlasenko | 084266e | 2008-07-26 23:08:31 +0000 | [diff] [blame] | 94 | config_close(parser); |
| 95 | /* buf != NULL here if config file was not found, empty |
| 96 | * or line was found which equals short_tty */ |
| 97 | return buf != NULL; |
Denis Vlasenko | 7ccf5cc | 2006-09-14 17:03:18 +0000 | [diff] [blame] | 98 | } |
Robert Griebl | 1fca558 | 2002-06-04 20:45:46 +0000 | [diff] [blame] | 99 | #else |
Tanguy Pruvot | 8a6c2c2 | 2012-04-28 00:24:09 +0200 | [diff] [blame] | 100 | static ALWAYS_INLINE int check_securetty(const char *short_tty UNUSED_PARAM) { return 1; } |
Robert Griebl | 1fca558 | 2002-06-04 20:45:46 +0000 | [diff] [blame] | 101 | #endif |
| 102 | |
Denis Vlasenko | 4eff8ef | 2009-02-02 00:15:00 +0000 | [diff] [blame] | 103 | #if ENABLE_SELINUX |
| 104 | static void initselinux(char *username, char *full_tty, |
| 105 | security_context_t *user_sid) |
| 106 | { |
| 107 | security_context_t old_tty_sid, new_tty_sid; |
| 108 | |
| 109 | if (!is_selinux_enabled()) |
| 110 | return; |
| 111 | |
| 112 | if (get_default_context(username, NULL, user_sid)) { |
Denys Vlasenko | 6331cf0 | 2009-11-13 09:08:27 +0100 | [diff] [blame] | 113 | bb_error_msg_and_die("can't get SID for %s", username); |
Denis Vlasenko | 4eff8ef | 2009-02-02 00:15:00 +0000 | [diff] [blame] | 114 | } |
| 115 | if (getfilecon(full_tty, &old_tty_sid) < 0) { |
| 116 | bb_perror_msg_and_die("getfilecon(%s) failed", full_tty); |
| 117 | } |
Denis Vlasenko | 8e5de2a | 2009-02-24 17:10:24 +0000 | [diff] [blame] | 118 | if (security_compute_relabel(*user_sid, old_tty_sid, |
Denis Vlasenko | 4eff8ef | 2009-02-02 00:15:00 +0000 | [diff] [blame] | 119 | SECCLASS_CHR_FILE, &new_tty_sid) != 0) { |
| 120 | bb_perror_msg_and_die("security_change_sid(%s) failed", full_tty); |
| 121 | } |
| 122 | if (setfilecon(full_tty, new_tty_sid) != 0) { |
maxwen | 27116ba | 2015-08-14 21:41:28 +0200 | [diff] [blame] | 123 | if (strcmp(old_tty_sid, new_tty_sid)) |
| 124 | bb_perror_msg_and_die("chsid(%s, %s) failed", full_tty, new_tty_sid); |
Denis Vlasenko | 4eff8ef | 2009-02-02 00:15:00 +0000 | [diff] [blame] | 125 | } |
| 126 | } |
| 127 | #endif |
| 128 | |
| 129 | #if ENABLE_LOGIN_SCRIPTS |
| 130 | static void run_login_script(struct passwd *pw, char *full_tty) |
| 131 | { |
| 132 | char *t_argv[2]; |
| 133 | |
| 134 | t_argv[0] = getenv("LOGIN_PRE_SUID_SCRIPT"); |
| 135 | if (t_argv[0]) { |
| 136 | t_argv[1] = NULL; |
| 137 | xsetenv("LOGIN_TTY", full_tty); |
| 138 | xsetenv("LOGIN_USER", pw->pw_name); |
| 139 | xsetenv("LOGIN_UID", utoa(pw->pw_uid)); |
| 140 | xsetenv("LOGIN_GID", utoa(pw->pw_gid)); |
| 141 | xsetenv("LOGIN_SHELL", pw->pw_shell); |
Denys Vlasenko | e4dcba1 | 2010-10-28 18:57:19 +0200 | [diff] [blame] | 142 | spawn_and_wait(t_argv); /* NOMMU-friendly */ |
Denis Vlasenko | 4eff8ef | 2009-02-02 00:15:00 +0000 | [diff] [blame] | 143 | unsetenv("LOGIN_TTY"); |
| 144 | unsetenv("LOGIN_USER"); |
| 145 | unsetenv("LOGIN_UID"); |
| 146 | unsetenv("LOGIN_GID"); |
| 147 | unsetenv("LOGIN_SHELL"); |
| 148 | } |
| 149 | } |
| 150 | #else |
| 151 | void run_login_script(struct passwd *pw, char *full_tty); |
| 152 | #endif |
| 153 | |
Tanguy Pruvot | 8a6c2c2 | 2012-04-28 00:24:09 +0200 | [diff] [blame] | 154 | #if ENABLE_LOGIN_SESSION_AS_CHILD && ENABLE_PAM |
| 155 | static void login_pam_end(pam_handle_t *pamh) |
| 156 | { |
| 157 | int pamret; |
| 158 | |
| 159 | pamret = pam_setcred(pamh, PAM_DELETE_CRED); |
| 160 | if (pamret != PAM_SUCCESS) { |
| 161 | bb_error_msg("pam_%s failed: %s (%d)", "setcred", |
| 162 | pam_strerror(pamh, pamret), pamret); |
| 163 | } |
| 164 | pamret = pam_close_session(pamh, 0); |
| 165 | if (pamret != PAM_SUCCESS) { |
| 166 | bb_error_msg("pam_%s failed: %s (%d)", "close_session", |
| 167 | pam_strerror(pamh, pamret), pamret); |
| 168 | } |
| 169 | pamret = pam_end(pamh, pamret); |
| 170 | if (pamret != PAM_SUCCESS) { |
| 171 | bb_error_msg("pam_%s failed: %s (%d)", "end", |
| 172 | pam_strerror(pamh, pamret), pamret); |
| 173 | } |
| 174 | } |
| 175 | #endif /* ENABLE_PAM */ |
| 176 | |
Denis Vlasenko | 7ccf5cc | 2006-09-14 17:03:18 +0000 | [diff] [blame] | 177 | static void get_username_or_die(char *buf, int size_buf) |
| 178 | { |
| 179 | int c, cntdown; |
Denis Vlasenko | d8540f7 | 2007-06-14 07:53:06 +0000 | [diff] [blame] | 180 | |
Denis Vlasenko | 7ccf5cc | 2006-09-14 17:03:18 +0000 | [diff] [blame] | 181 | cntdown = EMPTY_USERNAME_COUNT; |
Denis Vlasenko | d8540f7 | 2007-06-14 07:53:06 +0000 | [diff] [blame] | 182 | prompt: |
Denis Vlasenko | 7ccf5cc | 2006-09-14 17:03:18 +0000 | [diff] [blame] | 183 | print_login_prompt(); |
Denis Vlasenko | d8540f7 | 2007-06-14 07:53:06 +0000 | [diff] [blame] | 184 | /* skip whitespace */ |
Denis Vlasenko | 7ccf5cc | 2006-09-14 17:03:18 +0000 | [diff] [blame] | 185 | do { |
| 186 | c = getchar(); |
Denys Vlasenko | f2cbb03 | 2009-10-23 03:16:08 +0200 | [diff] [blame] | 187 | if (c == EOF) |
| 188 | exit(EXIT_FAILURE); |
Denis Vlasenko | 7ccf5cc | 2006-09-14 17:03:18 +0000 | [diff] [blame] | 189 | if (c == '\n') { |
Denys Vlasenko | f2cbb03 | 2009-10-23 03:16:08 +0200 | [diff] [blame] | 190 | if (!--cntdown) |
| 191 | exit(EXIT_FAILURE); |
Denis Vlasenko | 7ccf5cc | 2006-09-14 17:03:18 +0000 | [diff] [blame] | 192 | goto prompt; |
| 193 | } |
Denys Vlasenko | f2cbb03 | 2009-10-23 03:16:08 +0200 | [diff] [blame] | 194 | } while (isspace(c)); /* maybe isblank? */ |
Denis Vlasenko | 7ccf5cc | 2006-09-14 17:03:18 +0000 | [diff] [blame] | 195 | |
| 196 | *buf++ = c; |
| 197 | if (!fgets(buf, size_buf-2, stdin)) |
Bernhard Reutner-Fischer | 636a1f8 | 2008-05-19 09:29:47 +0000 | [diff] [blame] | 198 | exit(EXIT_FAILURE); |
Denis Vlasenko | 7ccf5cc | 2006-09-14 17:03:18 +0000 | [diff] [blame] | 199 | if (!strchr(buf, '\n')) |
Bernhard Reutner-Fischer | 636a1f8 | 2008-05-19 09:29:47 +0000 | [diff] [blame] | 200 | exit(EXIT_FAILURE); |
Denys Vlasenko | f2cbb03 | 2009-10-23 03:16:08 +0200 | [diff] [blame] | 201 | while ((unsigned char)*buf > ' ') |
| 202 | buf++; |
Denis Vlasenko | 7ccf5cc | 2006-09-14 17:03:18 +0000 | [diff] [blame] | 203 | *buf = '\0'; |
| 204 | } |
| 205 | |
| 206 | static void motd(void) |
| 207 | { |
Denis Vlasenko | 0de3c55 | 2007-04-12 12:31:02 +0000 | [diff] [blame] | 208 | int fd; |
Denis Vlasenko | 7ccf5cc | 2006-09-14 17:03:18 +0000 | [diff] [blame] | 209 | |
Denis Vlasenko | 0de3c55 | 2007-04-12 12:31:02 +0000 | [diff] [blame] | 210 | fd = open(bb_path_motd_file, O_RDONLY); |
Denis Vlasenko | 5281630 | 2007-11-06 05:26:51 +0000 | [diff] [blame] | 211 | if (fd >= 0) { |
Denys Vlasenko | 8131eea | 2009-11-02 14:19:51 +0100 | [diff] [blame] | 212 | fflush_all(); |
Denis Vlasenko | 0de3c55 | 2007-04-12 12:31:02 +0000 | [diff] [blame] | 213 | bb_copyfd_eof(fd, STDOUT_FILENO); |
| 214 | close(fd); |
Denis Vlasenko | 7ccf5cc | 2006-09-14 17:03:18 +0000 | [diff] [blame] | 215 | } |
| 216 | } |
Robert Griebl | 1fca558 | 2002-06-04 20:45:46 +0000 | [diff] [blame] | 217 | |
Denis Vlasenko | a60f84e | 2008-07-05 09:18:54 +0000 | [diff] [blame] | 218 | static void alarm_handler(int sig UNUSED_PARAM) |
Robert Griebl | 1fca558 | 2002-06-04 20:45:46 +0000 | [diff] [blame] | 219 | { |
Tanguy Pruvot | 8a6c2c2 | 2012-04-28 00:24:09 +0200 | [diff] [blame] | 220 | /* This is the escape hatch! Poor serial line users and the like |
Denis Vlasenko | 2f50aa4 | 2006-09-08 17:56:52 +0000 | [diff] [blame] | 221 | * arrive here when their connection is broken. |
| 222 | * We don't want to block here */ |
Tanguy Pruvot | 8a6c2c2 | 2012-04-28 00:24:09 +0200 | [diff] [blame] | 223 | ndelay_on(STDOUT_FILENO); |
| 224 | /* Test for correct attr restoring: |
| 225 | * run "getty 0 -" from a shell, enter bogus username, stop at |
| 226 | * password prompt, let it time out. Without the tcsetattr below, |
| 227 | * when you are back at shell prompt, echo will be still off. |
| 228 | */ |
| 229 | tcsetattr_stdin_TCSANOW(&G.tty_attrs); |
| 230 | printf("\r\nLogin timed out after %u seconds\r\n", TIMEOUT); |
Denys Vlasenko | 8131eea | 2009-11-02 14:19:51 +0100 | [diff] [blame] | 231 | fflush_all(); |
Denis Vlasenko | 5281630 | 2007-11-06 05:26:51 +0000 | [diff] [blame] | 232 | /* unix API is brain damaged regarding O_NONBLOCK, |
| 233 | * we should undo it, or else we can affect other processes */ |
Tanguy Pruvot | 8a6c2c2 | 2012-04-28 00:24:09 +0200 | [diff] [blame] | 234 | ndelay_off(STDOUT_FILENO); |
Denis Vlasenko | 400d8bb | 2008-02-24 13:36:01 +0000 | [diff] [blame] | 235 | _exit(EXIT_SUCCESS); |
Robert Griebl | 1fca558 | 2002-06-04 20:45:46 +0000 | [diff] [blame] | 236 | } |
| 237 | |
Denis Vlasenko | 9b49a5e | 2007-10-11 10:05:36 +0000 | [diff] [blame] | 238 | int login_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE; |
Denis Vlasenko | a60f84e | 2008-07-05 09:18:54 +0000 | [diff] [blame] | 239 | int login_main(int argc UNUSED_PARAM, char **argv) |
Robert Griebl | 1fca558 | 2002-06-04 20:45:46 +0000 | [diff] [blame] | 240 | { |
Denis Vlasenko | 66fabdb | 2006-09-17 14:45:09 +0000 | [diff] [blame] | 241 | enum { |
| 242 | LOGIN_OPT_f = (1<<0), |
| 243 | LOGIN_OPT_h = (1<<1), |
| 244 | LOGIN_OPT_p = (1<<2), |
| 245 | }; |
Denis Vlasenko | d6e81c7 | 2007-08-21 10:58:18 +0000 | [diff] [blame] | 246 | char *fromhost; |
Eric Andersen | 0fbff13 | 2002-06-22 17:49:29 +0000 | [diff] [blame] | 247 | char username[USERNAME_SIZE]; |
Denis Vlasenko | 2ec94a7 | 2008-11-07 12:59:31 +0000 | [diff] [blame] | 248 | int run_by_root; |
Denis Vlasenko | 67b23e6 | 2006-10-03 21:00:06 +0000 | [diff] [blame] | 249 | unsigned opt; |
Denis Vlasenko | 942e429 | 2006-09-08 17:25:04 +0000 | [diff] [blame] | 250 | int count = 0; |
Denis Vlasenko | 9a9edf2 | 2006-09-08 17:29:53 +0000 | [diff] [blame] | 251 | struct passwd *pw; |
Denys Vlasenko | 37f5bef | 2010-04-05 03:18:40 +0200 | [diff] [blame] | 252 | char *opt_host = NULL; |
Denis Vlasenko | cdf6277 | 2008-03-17 08:42:43 +0000 | [diff] [blame] | 253 | char *opt_user = opt_user; /* for compiler */ |
Denis Vlasenko | 512c8ae | 2009-02-02 00:15:57 +0000 | [diff] [blame] | 254 | char *full_tty; |
Tanguy Pruvot | 8a6c2c2 | 2012-04-28 00:24:09 +0200 | [diff] [blame] | 255 | char *short_tty; |
Denis Vlasenko | 5e34ff2 | 2009-04-21 11:09:40 +0000 | [diff] [blame] | 256 | IF_SELINUX(security_context_t user_sid = NULL;) |
Denis Vlasenko | a29a5e4 | 2007-11-07 00:23:47 +0000 | [diff] [blame] | 257 | #if ENABLE_PAM |
| 258 | int pamret; |
| 259 | pam_handle_t *pamh; |
| 260 | const char *pamuser; |
| 261 | const char *failed_msg; |
| 262 | struct passwd pwdstruct; |
| 263 | char pwdbuf[256]; |
Ian Wienand | 260fb55 | 2010-12-20 11:33:38 -0800 | [diff] [blame] | 264 | char **pamenv; |
Denis Vlasenko | a29a5e4 | 2007-11-07 00:23:47 +0000 | [diff] [blame] | 265 | #endif |
Tanguy Pruvot | 8a6c2c2 | 2012-04-28 00:24:09 +0200 | [diff] [blame] | 266 | #if ENABLE_LOGIN_SESSION_AS_CHILD |
| 267 | pid_t child_pid; |
| 268 | #endif |
Robert Griebl | 1fca558 | 2002-06-04 20:45:46 +0000 | [diff] [blame] | 269 | |
Tanguy Pruvot | 8a6c2c2 | 2012-04-28 00:24:09 +0200 | [diff] [blame] | 270 | INIT_G(); |
Eric Andersen | c7bda1c | 2004-03-15 08:29:22 +0000 | [diff] [blame] | 271 | |
Denis Vlasenko | 2ec94a7 | 2008-11-07 12:59:31 +0000 | [diff] [blame] | 272 | /* More of suid paranoia if called by non-root: */ |
| 273 | /* Clear dangerous stuff, set PATH */ |
| 274 | run_by_root = !sanitize_env_if_suid(); |
Denis Vlasenko | c9ca0a3 | 2008-02-18 11:08:33 +0000 | [diff] [blame] | 275 | |
Denis Vlasenko | 0de3c55 | 2007-04-12 12:31:02 +0000 | [diff] [blame] | 276 | /* Mandatory paranoia for suid applet: |
| 277 | * ensure that fd# 0,1,2 are opened (at least to /dev/null) |
| 278 | * and any extra open fd's are closed. |
| 279 | * (The name of the function is misleading. Not daemonizing here.) */ |
| 280 | bb_daemonize_or_rexec(DAEMON_ONLY_SANITIZE | DAEMON_CLOSE_EXTRA_FDS, NULL); |
| 281 | |
Tanguy Pruvot | 8a6c2c2 | 2012-04-28 00:24:09 +0200 | [diff] [blame] | 282 | username[0] = '\0'; |
Denis Vlasenko | fe7cd64 | 2007-08-18 15:32:12 +0000 | [diff] [blame] | 283 | opt = getopt32(argv, "f:h:p", &opt_user, &opt_host); |
Denis Vlasenko | 66fabdb | 2006-09-17 14:45:09 +0000 | [diff] [blame] | 284 | if (opt & LOGIN_OPT_f) { |
Denis Vlasenko | 2ec94a7 | 2008-11-07 12:59:31 +0000 | [diff] [blame] | 285 | if (!run_by_root) |
Denis Vlasenko | 66fabdb | 2006-09-17 14:45:09 +0000 | [diff] [blame] | 286 | bb_error_msg_and_die("-f is for root only"); |
Denis Vlasenko | 22f6dcb | 2006-09-26 16:31:01 +0000 | [diff] [blame] | 287 | safe_strncpy(username, opt_user, sizeof(username)); |
Robert Griebl | 1fca558 | 2002-06-04 20:45:46 +0000 | [diff] [blame] | 288 | } |
Denis Vlasenko | 1d42665 | 2008-03-17 09:09:09 +0000 | [diff] [blame] | 289 | argv += optind; |
| 290 | if (argv[0]) /* user from command line (getty) */ |
| 291 | safe_strncpy(username, argv[0], sizeof(username)); |
Robert Griebl | 1fca558 | 2002-06-04 20:45:46 +0000 | [diff] [blame] | 292 | |
Tanguy Pruvot | 8a6c2c2 | 2012-04-28 00:24:09 +0200 | [diff] [blame] | 293 | /* Save tty attributes - and by doing it, check that it's indeed a tty */ |
| 294 | if (tcgetattr(STDIN_FILENO, &G.tty_attrs) < 0 |
| 295 | || !isatty(STDOUT_FILENO) |
| 296 | /*|| !isatty(STDERR_FILENO) - no, guess some people might want to redirect this */ |
| 297 | ) { |
Denys Vlasenko | e4dcba1 | 2010-10-28 18:57:19 +0200 | [diff] [blame] | 298 | return EXIT_FAILURE; /* Must be a terminal */ |
Tanguy Pruvot | 8a6c2c2 | 2012-04-28 00:24:09 +0200 | [diff] [blame] | 299 | } |
| 300 | |
| 301 | /* We install timeout handler only _after_ we saved G.tty_attrs */ |
| 302 | signal(SIGALRM, alarm_handler); |
| 303 | alarm(TIMEOUT); |
| 304 | |
| 305 | /* Find out and memorize our tty name */ |
Denis Vlasenko | 512c8ae | 2009-02-02 00:15:57 +0000 | [diff] [blame] | 306 | full_tty = xmalloc_ttyname(STDIN_FILENO); |
| 307 | if (!full_tty) |
| 308 | full_tty = xstrdup("UNKNOWN"); |
Denys Vlasenko | f8d8aa1 | 2010-04-06 18:50:05 +0200 | [diff] [blame] | 309 | short_tty = skip_dev_pfx(full_tty); |
Robert Griebl | 1fca558 | 2002-06-04 20:45:46 +0000 | [diff] [blame] | 310 | |
Denys Vlasenko | 37f5bef | 2010-04-05 03:18:40 +0200 | [diff] [blame] | 311 | if (opt_host) { |
Denis Vlasenko | d6e81c7 | 2007-08-21 10:58:18 +0000 | [diff] [blame] | 312 | fromhost = xasprintf(" on '%s' from '%s'", short_tty, opt_host); |
Denis Vlasenko | 4e12b1a | 2008-12-23 23:36:47 +0000 | [diff] [blame] | 313 | } else { |
Denis Vlasenko | d6e81c7 | 2007-08-21 10:58:18 +0000 | [diff] [blame] | 314 | fromhost = xasprintf(" on '%s'", short_tty); |
Denis Vlasenko | 4e12b1a | 2008-12-23 23:36:47 +0000 | [diff] [blame] | 315 | } |
Eric Andersen | c7bda1c | 2004-03-15 08:29:22 +0000 | [diff] [blame] | 316 | |
Denis Vlasenko | d6e81c7 | 2007-08-21 10:58:18 +0000 | [diff] [blame] | 317 | /* Was breaking "login <username>" from shell command line: */ |
| 318 | /*bb_setpgrp();*/ |
Eric Andersen | 0fbff13 | 2002-06-22 17:49:29 +0000 | [diff] [blame] | 319 | |
Denis Vlasenko | 54ac03a | 2009-03-11 15:59:49 +0000 | [diff] [blame] | 320 | openlog(applet_name, LOG_PID | LOG_CONS, LOG_AUTH); |
Robert Griebl | 1fca558 | 2002-06-04 20:45:46 +0000 | [diff] [blame] | 321 | |
Denis Vlasenko | 942e429 | 2006-09-08 17:25:04 +0000 | [diff] [blame] | 322 | while (1) { |
Paul Fox | 6e1b62b | 2007-11-07 15:51:35 +0000 | [diff] [blame] | 323 | /* flush away any type-ahead (as getty does) */ |
Jeremie Koenig | f812eac | 2010-05-27 15:37:32 +0200 | [diff] [blame] | 324 | tcflush(0, TCIFLUSH); |
Paul Fox | 6e1b62b | 2007-11-07 15:51:35 +0000 | [diff] [blame] | 325 | |
Denis Vlasenko | 942e429 | 2006-09-08 17:25:04 +0000 | [diff] [blame] | 326 | if (!username[0]) |
Denis Vlasenko | 9a9edf2 | 2006-09-08 17:29:53 +0000 | [diff] [blame] | 327 | get_username_or_die(username, sizeof(username)); |
Robert Griebl | 1fca558 | 2002-06-04 20:45:46 +0000 | [diff] [blame] | 328 | |
Denis Vlasenko | d6e81c7 | 2007-08-21 10:58:18 +0000 | [diff] [blame] | 329 | #if ENABLE_PAM |
| 330 | pamret = pam_start("login", username, &conv, &pamh); |
| 331 | if (pamret != PAM_SUCCESS) { |
Denis Vlasenko | a29a5e4 | 2007-11-07 00:23:47 +0000 | [diff] [blame] | 332 | failed_msg = "start"; |
Denis Vlasenko | d6e81c7 | 2007-08-21 10:58:18 +0000 | [diff] [blame] | 333 | goto pam_auth_failed; |
| 334 | } |
| 335 | /* set TTY (so things like securetty work) */ |
| 336 | pamret = pam_set_item(pamh, PAM_TTY, short_tty); |
| 337 | if (pamret != PAM_SUCCESS) { |
Denis Vlasenko | a29a5e4 | 2007-11-07 00:23:47 +0000 | [diff] [blame] | 338 | failed_msg = "set_item(TTY)"; |
Denis Vlasenko | d6e81c7 | 2007-08-21 10:58:18 +0000 | [diff] [blame] | 339 | goto pam_auth_failed; |
| 340 | } |
Ryan Phillips | cf9074b | 2011-03-22 18:27:21 +0100 | [diff] [blame] | 341 | /* set RHOST */ |
| 342 | if (opt_host) { |
| 343 | pamret = pam_set_item(pamh, PAM_RHOST, opt_host); |
| 344 | if (pamret != PAM_SUCCESS) { |
| 345 | failed_msg = "set_item(RHOST)"; |
| 346 | goto pam_auth_failed; |
| 347 | } |
| 348 | } |
Tanguy Pruvot | 8a6c2c2 | 2012-04-28 00:24:09 +0200 | [diff] [blame] | 349 | if (!(opt & LOGIN_OPT_f)) { |
| 350 | pamret = pam_authenticate(pamh, 0); |
| 351 | if (pamret != PAM_SUCCESS) { |
| 352 | failed_msg = "authenticate"; |
| 353 | goto pam_auth_failed; |
| 354 | /* TODO: or just "goto auth_failed" |
| 355 | * since user seems to enter wrong password |
| 356 | * (in this case pamret == 7) |
| 357 | */ |
| 358 | } |
Denis Vlasenko | 82f3b16 | 2007-09-03 11:56:27 +0000 | [diff] [blame] | 359 | } |
| 360 | /* check that the account is healthy */ |
| 361 | pamret = pam_acct_mgmt(pamh, 0); |
| 362 | if (pamret != PAM_SUCCESS) { |
Denis Vlasenko | a29a5e4 | 2007-11-07 00:23:47 +0000 | [diff] [blame] | 363 | failed_msg = "acct_mgmt"; |
Denis Vlasenko | 82f3b16 | 2007-09-03 11:56:27 +0000 | [diff] [blame] | 364 | goto pam_auth_failed; |
| 365 | } |
| 366 | /* read user back */ |
Denis Vlasenko | a29a5e4 | 2007-11-07 00:23:47 +0000 | [diff] [blame] | 367 | pamuser = NULL; |
| 368 | /* gcc: "dereferencing type-punned pointer breaks aliasing rules..." |
| 369 | * thus we cast to (void*) */ |
| 370 | if (pam_get_item(pamh, PAM_USER, (void*)&pamuser) != PAM_SUCCESS) { |
| 371 | failed_msg = "get_item(USER)"; |
| 372 | goto pam_auth_failed; |
Denis Vlasenko | d6e81c7 | 2007-08-21 10:58:18 +0000 | [diff] [blame] | 373 | } |
Denis Vlasenko | a29a5e4 | 2007-11-07 00:23:47 +0000 | [diff] [blame] | 374 | if (!pamuser || !pamuser[0]) |
| 375 | goto auth_failed; |
| 376 | safe_strncpy(username, pamuser, sizeof(username)); |
| 377 | /* Don't use "pw = getpwnam(username);", |
| 378 | * PAM is said to be capable of destroying static storage |
| 379 | * used by getpwnam(). We are using safe(r) function */ |
| 380 | pw = NULL; |
| 381 | getpwnam_r(username, &pwdstruct, pwdbuf, sizeof(pwdbuf), &pw); |
| 382 | if (!pw) |
| 383 | goto auth_failed; |
| 384 | pamret = pam_open_session(pamh, 0); |
| 385 | if (pamret != PAM_SUCCESS) { |
| 386 | failed_msg = "open_session"; |
| 387 | goto pam_auth_failed; |
| 388 | } |
| 389 | pamret = pam_setcred(pamh, PAM_ESTABLISH_CRED); |
| 390 | if (pamret != PAM_SUCCESS) { |
| 391 | failed_msg = "setcred"; |
| 392 | goto pam_auth_failed; |
| 393 | } |
| 394 | break; /* success, continue login process */ |
| 395 | |
Denis Vlasenko | d6e81c7 | 2007-08-21 10:58:18 +0000 | [diff] [blame] | 396 | pam_auth_failed: |
Denys Vlasenko | c297ea9 | 2009-09-25 01:50:45 +0200 | [diff] [blame] | 397 | /* syslog, because we don't want potential attacker |
| 398 | * to know _why_ login failed */ |
| 399 | syslog(LOG_WARNING, "pam_%s call failed: %s (%d)", failed_msg, |
Denis Vlasenko | a29a5e4 | 2007-11-07 00:23:47 +0000 | [diff] [blame] | 400 | pam_strerror(pamh, pamret), pamret); |
Denis Vlasenko | d6e81c7 | 2007-08-21 10:58:18 +0000 | [diff] [blame] | 401 | safe_strncpy(username, "UNKNOWN", sizeof(username)); |
| 402 | #else /* not PAM */ |
maxwen | 27116ba | 2015-08-14 21:41:28 +0200 | [diff] [blame] | 403 | pw = safegetpwnam(username); |
Denis Vlasenko | 942e429 | 2006-09-08 17:25:04 +0000 | [diff] [blame] | 404 | if (!pw) { |
Denis Vlasenko | 65e14b4 | 2007-06-08 15:27:06 +0000 | [diff] [blame] | 405 | strcpy(username, "UNKNOWN"); |
| 406 | goto fake_it; |
Robert Griebl | 1fca558 | 2002-06-04 20:45:46 +0000 | [diff] [blame] | 407 | } |
| 408 | |
Denis Vlasenko | 9a9edf2 | 2006-09-08 17:29:53 +0000 | [diff] [blame] | 409 | if (pw->pw_passwd[0] == '!' || pw->pw_passwd[0] == '*') |
| 410 | goto auth_failed; |
| 411 | |
Denis Vlasenko | 66fabdb | 2006-09-17 14:45:09 +0000 | [diff] [blame] | 412 | if (opt & LOGIN_OPT_f) |
Denis Vlasenko | 9a9edf2 | 2006-09-08 17:29:53 +0000 | [diff] [blame] | 413 | break; /* -f USER: success without asking passwd */ |
| 414 | |
Tanguy Pruvot | 8a6c2c2 | 2012-04-28 00:24:09 +0200 | [diff] [blame] | 415 | if (pw->pw_uid == 0 && !check_securetty(short_tty)) |
Denis Vlasenko | 9a9edf2 | 2006-09-08 17:29:53 +0000 | [diff] [blame] | 416 | goto auth_failed; |
Robert Griebl | 1fca558 | 2002-06-04 20:45:46 +0000 | [diff] [blame] | 417 | |
| 418 | /* Don't check the password if password entry is empty (!) */ |
Denis Vlasenko | 942e429 | 2006-09-08 17:25:04 +0000 | [diff] [blame] | 419 | if (!pw->pw_passwd[0]) |
Denis Vlasenko | 66fabdb | 2006-09-17 14:45:09 +0000 | [diff] [blame] | 420 | break; |
Denis Vlasenko | 65e14b4 | 2007-06-08 15:27:06 +0000 | [diff] [blame] | 421 | fake_it: |
Tanguy Pruvot | 8a6c2c2 | 2012-04-28 00:24:09 +0200 | [diff] [blame] | 422 | /* Password reading and authorization takes place here. |
| 423 | * Note that reads (in no-echo mode) trash tty attributes. |
| 424 | * If we get interrupted by SIGALRM, we need to restore attrs. |
| 425 | */ |
maxwen | 27116ba | 2015-08-14 21:41:28 +0200 | [diff] [blame] | 426 | if (ask_and_check_password(pw) > 0) |
Denis Vlasenko | 66fabdb | 2006-09-17 14:45:09 +0000 | [diff] [blame] | 427 | break; |
Denis Vlasenko | d6e81c7 | 2007-08-21 10:58:18 +0000 | [diff] [blame] | 428 | #endif /* ENABLE_PAM */ |
Denis Vlasenko | 0de3c55 | 2007-04-12 12:31:02 +0000 | [diff] [blame] | 429 | auth_failed: |
Denis Vlasenko | 66fabdb | 2006-09-17 14:45:09 +0000 | [diff] [blame] | 430 | opt &= ~LOGIN_OPT_f; |
Denys Vlasenko | 7d4e7a2 | 2011-03-08 21:07:05 +0100 | [diff] [blame] | 431 | bb_do_delay(LOGIN_FAIL_DELAY); |
Denis Vlasenko | 82f3b16 | 2007-09-03 11:56:27 +0000 | [diff] [blame] | 432 | /* TODO: doesn't sound like correct English phrase to me */ |
Robert Griebl | 1fca558 | 2002-06-04 20:45:46 +0000 | [diff] [blame] | 433 | puts("Login incorrect"); |
Denis Vlasenko | 942e429 | 2006-09-08 17:25:04 +0000 | [diff] [blame] | 434 | if (++count == 3) { |
Denis Vlasenko | 89f0b34 | 2006-11-18 22:04:09 +0000 | [diff] [blame] | 435 | syslog(LOG_WARNING, "invalid password for '%s'%s", |
Denis Vlasenko | 9a9edf2 | 2006-09-08 17:29:53 +0000 | [diff] [blame] | 436 | username, fromhost); |
Alexander Shishkin | 78b286f | 2010-10-27 19:52:40 +0300 | [diff] [blame] | 437 | |
| 438 | if (ENABLE_FEATURE_CLEAN_UP) |
| 439 | free(fromhost); |
| 440 | |
Robert Griebl | 1fca558 | 2002-06-04 20:45:46 +0000 | [diff] [blame] | 441 | return EXIT_FAILURE; |
Denis Vlasenko | 942e429 | 2006-09-08 17:25:04 +0000 | [diff] [blame] | 442 | } |
Denis Vlasenko | 9a9edf2 | 2006-09-08 17:29:53 +0000 | [diff] [blame] | 443 | username[0] = '\0'; |
Denis Vlasenko | 2ec94a7 | 2008-11-07 12:59:31 +0000 | [diff] [blame] | 444 | } /* while (1) */ |
Eric Andersen | c7bda1c | 2004-03-15 08:29:22 +0000 | [diff] [blame] | 445 | |
Denis Vlasenko | 942e429 | 2006-09-08 17:25:04 +0000 | [diff] [blame] | 446 | alarm(0); |
Denis Vlasenko | 2ec94a7 | 2008-11-07 12:59:31 +0000 | [diff] [blame] | 447 | /* We can ignore /etc/nologin if we are logging in as root, |
| 448 | * it doesn't matter whether we are run by root or not */ |
| 449 | if (pw->pw_uid != 0) |
Denis Vlasenko | 68404f1 | 2008-03-17 09:00:54 +0000 | [diff] [blame] | 450 | die_if_nologin(); |
Robert Griebl | 1fca558 | 2002-06-04 20:45:46 +0000 | [diff] [blame] | 451 | |
Tanguy Pruvot | 8a6c2c2 | 2012-04-28 00:24:09 +0200 | [diff] [blame] | 452 | #if ENABLE_LOGIN_SESSION_AS_CHILD |
| 453 | child_pid = vfork(); |
| 454 | if (child_pid != 0) { |
| 455 | if (child_pid < 0) |
| 456 | bb_perror_msg("vfork"); |
| 457 | else { |
| 458 | if (safe_waitpid(child_pid, NULL, 0) == -1) |
| 459 | bb_perror_msg("waitpid"); |
| 460 | update_utmp(child_pid, DEAD_PROCESS, NULL, NULL, NULL); |
| 461 | } |
| 462 | IF_PAM(login_pam_end(pamh);) |
| 463 | return 0; |
| 464 | } |
| 465 | #endif |
| 466 | |
| 467 | IF_SELINUX(initselinux(username, full_tty, &user_sid);) |
Rob Landley | 60158cb | 2005-05-03 06:25:50 +0000 | [diff] [blame] | 468 | |
Denis Vlasenko | 2f50aa4 | 2006-09-08 17:56:52 +0000 | [diff] [blame] | 469 | /* Try these, but don't complain if they fail. |
| 470 | * _f_chown is safe wrt race t=ttyname(0);...;chown(t); */ |
| 471 | fchown(0, pw->pw_uid, pw->pw_gid); |
| 472 | fchmod(0, 0600); |
Robert Griebl | 1fca558 | 2002-06-04 20:45:46 +0000 | [diff] [blame] | 473 | |
Denys Vlasenko | 3a41611 | 2010-04-05 22:10:38 +0200 | [diff] [blame] | 474 | update_utmp(getpid(), USER_PROCESS, short_tty, username, run_by_root ? opt_host : NULL); |
Denys Vlasenko | 37f5bef | 2010-04-05 03:18:40 +0200 | [diff] [blame] | 475 | |
Denis Vlasenko | 5281630 | 2007-11-06 05:26:51 +0000 | [diff] [blame] | 476 | /* We trust environment only if we run by root */ |
Denis Vlasenko | 3266aa9 | 2009-04-01 11:24:04 +0000 | [diff] [blame] | 477 | if (ENABLE_LOGIN_SCRIPTS && run_by_root) |
Denis Vlasenko | 4eff8ef | 2009-02-02 00:15:00 +0000 | [diff] [blame] | 478 | run_login_script(pw, full_tty); |
Denis Vlasenko | 2e50291 | 2006-09-08 17:22:45 +0000 | [diff] [blame] | 479 | |
Denis Vlasenko | 942e429 | 2006-09-08 17:25:04 +0000 | [diff] [blame] | 480 | change_identity(pw); |
Denys Vlasenko | bd74e3d | 2011-03-06 18:49:40 +0100 | [diff] [blame] | 481 | setup_environment(pw->pw_shell, |
Denys Vlasenko | fd686a2 | 2010-02-26 09:52:45 +0100 | [diff] [blame] | 482 | (!(opt & LOGIN_OPT_p) * SETUP_ENV_CLEARENV) + SETUP_ENV_CHANGEENV, |
| 483 | pw); |
Robert Griebl | 1fca558 | 2002-06-04 20:45:46 +0000 | [diff] [blame] | 484 | |
Ian Wienand | 260fb55 | 2010-12-20 11:33:38 -0800 | [diff] [blame] | 485 | #if ENABLE_PAM |
| 486 | /* Modules such as pam_env will setup the PAM environment, |
| 487 | * which should be copied into the new environment. */ |
| 488 | pamenv = pam_getenvlist(pamh); |
| 489 | if (pamenv) while (*pamenv) { |
| 490 | putenv(*pamenv); |
| 491 | pamenv++; |
| 492 | } |
| 493 | #endif |
| 494 | |
Denis Vlasenko | 942e429 | 2006-09-08 17:25:04 +0000 | [diff] [blame] | 495 | motd(); |
Robert Griebl | 1fca558 | 2002-06-04 20:45:46 +0000 | [diff] [blame] | 496 | |
Denis Vlasenko | 942e429 | 2006-09-08 17:25:04 +0000 | [diff] [blame] | 497 | if (pw->pw_uid == 0) |
Denis Vlasenko | 2f50aa4 | 2006-09-08 17:56:52 +0000 | [diff] [blame] | 498 | syslog(LOG_INFO, "root login%s", fromhost); |
Denis Vlasenko | 4eff8ef | 2009-02-02 00:15:00 +0000 | [diff] [blame] | 499 | |
Alexander Shishkin | 78b286f | 2010-10-27 19:52:40 +0300 | [diff] [blame] | 500 | if (ENABLE_FEATURE_CLEAN_UP) |
| 501 | free(fromhost); |
| 502 | |
Rob Landley | d1f8c1c | 2006-03-27 23:04:42 +0000 | [diff] [blame] | 503 | /* well, a simple setexeccon() here would do the job as well, |
| 504 | * but let's play the game for now */ |
Denis Vlasenko | 5e34ff2 | 2009-04-21 11:09:40 +0000 | [diff] [blame] | 505 | IF_SELINUX(set_current_security_context(user_sid);) |
Denis Vlasenko | 6ae8079 | 2006-10-31 17:34:44 +0000 | [diff] [blame] | 506 | |
| 507 | // util-linux login also does: |
| 508 | // /* start new session */ |
| 509 | // setsid(); |
| 510 | // /* TIOCSCTTY: steal tty from other process group */ |
| 511 | // if (ioctl(0, TIOCSCTTY, 1)) error_msg... |
Denis Vlasenko | 0de3c55 | 2007-04-12 12:31:02 +0000 | [diff] [blame] | 512 | // BBox login used to do this (see above): |
| 513 | // bb_setpgrp(); |
| 514 | // If this stuff is really needed, add it and explain why! |
Denis Vlasenko | 6ae8079 | 2006-10-31 17:34:44 +0000 | [diff] [blame] | 515 | |
Denis Vlasenko | 2ec94a7 | 2008-11-07 12:59:31 +0000 | [diff] [blame] | 516 | /* Set signals to defaults */ |
Denis Vlasenko | 3fa36e2 | 2008-11-09 00:15:11 +0000 | [diff] [blame] | 517 | /* Non-ignored signals revert to SIG_DFL on exec anyway */ |
| 518 | /*signal(SIGALRM, SIG_DFL);*/ |
Denis Vlasenko | 2ec94a7 | 2008-11-07 12:59:31 +0000 | [diff] [blame] | 519 | |
Denis Vlasenko | 8c76487 | 2006-10-31 18:30:56 +0000 | [diff] [blame] | 520 | /* Is this correct? This way user can ctrl-c out of /etc/profile, |
| 521 | * potentially creating security breach (tested with bash 3.0). |
| 522 | * But without this, bash 3.0 will not enable ctrl-c either. |
| 523 | * Maybe bash is buggy? |
| 524 | * Need to find out what standards say about /bin/login - |
Denis Vlasenko | 2ec94a7 | 2008-11-07 12:59:31 +0000 | [diff] [blame] | 525 | * should we leave SIGINT etc enabled or disabled? */ |
Denis Vlasenko | 6ae8079 | 2006-10-31 17:34:44 +0000 | [diff] [blame] | 526 | signal(SIGINT, SIG_DFL); |
| 527 | |
Denis Vlasenko | a2f6101 | 2007-09-10 13:15:28 +0000 | [diff] [blame] | 528 | /* Exec login shell with no additional parameters */ |
Denys Vlasenko | bd74e3d | 2011-03-06 18:49:40 +0100 | [diff] [blame] | 529 | run_shell(pw->pw_shell, 1, NULL, NULL); |
Eric Andersen | c7bda1c | 2004-03-15 08:29:22 +0000 | [diff] [blame] | 530 | |
Denis Vlasenko | a2f6101 | 2007-09-10 13:15:28 +0000 | [diff] [blame] | 531 | /* return EXIT_FAILURE; - not reached */ |
Robert Griebl | 1fca558 | 2002-06-04 20:45:46 +0000 | [diff] [blame] | 532 | } |