HEX

File: //opt/saltstack/salt/lib/python3.10/site-packages/salt/auth/__pycache__/pam.cpython-310.pyc
o

;j�0�@s�dZddlZddlZddlZddlZddlZddlmZmZm	Z	m
Z
mZmZm
Z
mZmZmZmZmZddlmZdZzddlZWneyKdZYnwe�e�Zzeed��ZejZee_eege_ ej!Z"ege"_#e	e�e"_Wne$y�ej%ddd	�dZ&YnwdZ&d
Z'dZ(dZ)d
Z*Gdd�de
�Z+Gdd�de
�Z,Gdd�de
�Z-ee
e
e	e	e,��e	e	e-��e�Z.Gdd�de
�Z/z:eed��Z0e0j1Z2e
e2_eee	e/�e	e+�ge2_ e0j3Z4e
e4_e+e
ge4_ e0j5Z6e
e6_e+e
ge6_ e0j7Z8e
e8_e+e
ge8_ Wne$�y
ej%ddd	�dZ9YnwdZ9dd�Z:d-dd�Z;da<dZ=dd�Z>d d!�Z?d"d#�Z@d$d%�ZAd&d'�ZBed(k�rSe;ejCd)ejCd*ejCd+ejCd,��rLe�Dd�e�Dd
�dSdS).a�
Authenticate against PAM

Provides an authenticate function that will allow the caller to authenticate
a user against the Pluggable Authentication Modules (PAM) on the system.

Implemented using ctypes, so no compilation is necessary.

There is one extra configuration option for pam.  The `pam_service` that is
authenticated against.  This defaults to `login`

.. code-block:: yaml

    auth.pam.service: login

.. note:: Solaris-like (SmartOS, OmniOS, ...) systems may need ``auth.pam.service`` set to ``other``.

.. note:: PAM authentication will not work for the ``root`` user.

    The Python interface to PAM does not support authenticating as ``root``.

.. note:: This module executes itself in a subprocess in order to user the system python
    and pam libraries. We do this to avoid openssl version conflicts when
    running under a salt onedir build.

.. note:: Running ``salt-master`` as a non-root user (the 3006.x packaging
    default is the ``salt`` user) and using PAM eauth requires extra
    privileges so that PAM's ``unix_chkpwd`` helper can validate other
    users' passwords. ``unix_chkpwd`` refuses to authenticate users other
    than the caller unless the caller can read ``/etc/shadow``. The two
    standard remediations are:

    1. **Debian-derived distributions:** add the master's user to the
       ``shadow`` group (e.g. ``usermod -a -G shadow salt``) so the master
       process can read ``/etc/shadow`` indirectly via the setgid-shadow
       ``unix_chkpwd`` helper.
    2. **RPM-based distributions:** revert the master to run as ``root``
       (``user: root`` in ``/etc/salt/master``); ``/etc/shadow`` cannot be
       made readable to a non-root group safely there.

    When PAM auth fails and the master is running as a non-root user
    without ``/etc/shadow`` access, a CRITICAL log entry naming the cause
    and the two remediations is emitted (once per process). See
    https://github.com/saltstack/salt/issues/64275 for the full
    discussion.
�N)�CDLL�	CFUNCTYPE�POINTER�	Structure�c_char�c_char_p�c_int�c_uint�c_void_p�cast�pointer�sizeof)�find_libraryTF�cz Failed to load libc using ctypes)�exc_info����c@s"eZdZdZdefgZdd�ZdS)�	PamHandlez(
    Wrapper class for pam_handle_t
    �handlecCst�|�d|_dS)Nr)r�__init__r��self�r�A/opt/saltstack/salt/lib/python3.10/site-packages/salt/auth/pam.pyrps

zPamHandle.__init__N)�__name__�
__module__�__qualname__�__doc__r
�_fields_rrrrrris
rc@�(eZdZdZdefdefgZdd�ZdS)�
PamMessagez1
    Wrapper class for pam_message structure
    �	msg_style�msgcC�d|j�d|j�d�S)Nz<PamMessage � '�'>)r#r$rrrr�__repr__�zPamMessage.__repr__N)rrrrrrr r(rrrrr"u��r"c@r!)�PamResponsez2
    Wrapper class for pam_response structure
    �resp�resp_retcodecCr%)Nz
<PamResponse r&r')r-r,rrrrr(�r)zPamResponse.__repr__N)rrrrrrr r(rrrrr+�r*r+c@s eZdZdZdefdefgZdS)�PamConvz.
    Wrapper class for pam_conv structure
    �convZappdata_ptrN)rrrr�	CONV_FUNCr
r rrrrr.�sr.ZpamzFailed to load pam using ctypescCstotS)z$
    Only load on Linux systems
    )�HAS_LIBC�HAS_PAMrrrr�__virtual__�sr3�utf-8cs�t�t�r
��|��t�t�r��|��t|t�r|�|�}t��fdd��}t�}t|d�}t|�t|�t|��}|dkrEt||�dSt	|d�}|dkrSt
|d�}t|d�|dkS)��
    Returns True if the given username and password authenticate for the
    given service.  Returns False otherwise

    ``username``: the username to authenticate

    ``password``: the password in plain text
    cs�t|tt��}t|tt��|d<t|�D]*}||jj}|tkr%t	��}n
|t
kr.t	��}nqt|t�|j|_d|j|_
qdS)u~
        Conversation function that answers PAM prompts:

        * ``PAM_PROMPT_ECHO_OFF`` (hidden input) is answered with the
          supplied password.
        * ``PAM_PROMPT_ECHO_ON`` (visible input) is answered with the
          supplied username. Some PAM modules issue such a prompt — for
          example to re-prompt for the user — and previously the conv
          left that response slot NULL, which caused ``pam_authenticate``
          to fail with no diagnostic.
        * ``PAM_ERROR_MSG`` and ``PAM_TEXT_INFO`` are informational and
          require no response; their CALLOC-zeroed slots are left alone.
        r)�CALLOCr
r+rr�range�contentsr#�PAM_PROMPT_ECHO_OFF�STRDUP�PAM_PROMPT_ECHO_ONrr,r-)Z
n_messages�messagesZ
p_responseZapp_data�addr�i�styleZ	resp_copy��password�usernamerr�my_conv�s

z_authenticate.<locals>.my_convrF)�
isinstance�str�encoder0rr.�	PAM_STARTr�PAM_END�PAM_AUTHENTICATE�
PAM_ACCT_MGMT)rBrAZservice�encodingrCrr/�retvalrr@r�
_authenticate�s&
	









rMz/etc/shadowcCsTzt��dkr
WdSWn
tyYdSwt�ttj�rdSddjt��td�fS)u�
    Return ``(True, "")`` if the current process has the privileges PAM
    needs to validate a *different* user's password via ``unix_chkpwd``;
    return ``(False, <reason>)`` otherwise.

    On Linux PAM's ``pam_unix`` module shells out to the setgid-shadow
    helper ``unix_chkpwd`` for password verification. ``unix_chkpwd``
    refuses to authenticate users other than the caller unless the
    caller can read ``/etc/shadow`` — either because the caller's
    effective uid is 0, or because the caller is in the ``shadow``
    group (Debian-style). See linux-pam upstream discussion at
    https://github.com/linux-pam/linux-pam/issues/112 for the full
    rationale.

    This helper is used to produce an actionable diagnostic when
    ``authenticate()`` fails on a master running as a non-root user
    without ``shadow``-group access — the failure mode behind issue
    #64275, which previously logged only a bare "Pam auth failed" with
    empty stdout/stderr.
    r)T�Fz�process running as uid {uid} cannot read {shadow}, so PAM's unix_chkpwd helper will refuse to authenticate users other than the caller)�uidZshadow)�os�geteuid�AttributeError�access�_SHADOW_PATH�R_OK�formatrrrr�_can_validate_other_userss��
��rWcCs2trdSt�\}}|r
dSdat�d||t�dS)a�
    Emit, at most once per process, a CRITICAL log entry that explains
    why PAM auth is failing on a non-root master and how to fix it.

    Issue #64275: when the master runs as the ``salt`` user (the 3006.x
    packaging default) PAM auth fails silently because the helper
    subprocess inherits that uid and ``unix_chkpwd`` can't read
    ``/etc/shadow``. Three years of users hit this without a
    diagnostic; this function makes the failure self-explanatory.
    NTaZPAM authentication for %r failed and %s. Either run the salt-master as the 'root' user, or add the master's user to the 'shadow' group so it can read %s (the latter works on Debian-derived distributions; on RPM-based distributions the master must run as root for PAM eauth to work). See https://github.com/saltstack/salt/issues/64275 for context.)�_SHADOW_DIAGNOSTIC_LOGGEDrW�log�criticalrT)rB�ok�reasonrrr�_log_shadow_diagnostic_once.s
�r]cCs�tj��}||d<||d<t�dd�|d<t|d<t�t�dd����}t�t	���}|�
�s7t�d	|�d
St
jt|�t|�g|dd
d�}|jd
krMdSt�d||j|j�t|�d
S)r5�SALT_PAM_USERNAME�SALT_PAM_PASSWORDzauth.pam.serviceZlogin�SALT_PAM_SERVICE�SALT_PAM_ENCODINGzauth.pam.pythonz/usr/bin/python3z7Error 'auth.pam.python' config value does not exist: %sFT)�env�capture_output�checkrzPam auth failed for %s: %s %s)rP�environ�copyZ__opts__�getZ__salt_system_encoding__�pathlib�Path�resolve�__file__�existsrY�error�
subprocess�runrE�
returncode�stdout�stderrr])rBrArbZpyexeZpyfile�retrrr�authenticateMs*
	�
rtcKs
t||�S)z
    Authenticate via pam
    )rt)rBrA�kwargsrrr�authqs
rvcOstjj�|�S)zY
    Retrieve groups for a given user for this auth provider

    Uses system groups
    )�salt�utils�userZget_group_list)rB�argsrurrr�groupsxsr{�__main__r^r_r`ra)r4)Er�loggingrPrhrn�sys�ctypesrrrrrrrr	r
rrr
Zctypes.utilrZHAS_USERZsalt.utils.userrw�ImportError�	getLoggerrrYZLIBCZcallocr6�restype�argtypesZstrdupr:Z	argstypes�	ExceptionZtracer1r9r;Z
PAM_ERROR_MSGZ
PAM_TEXT_INFOrr"r+r0r.ZLIBPAMZ	pam_startrGZpam_authenticaterIZ
pam_acct_mgmtrJZpam_endrHr2r3rMrXrTrWr]rtrvr{re�exitrrrr�<module>s�/8�

��

�
B($
	�
�