| /* SPDX-License-Identifier: LGPL-2.1-or-later */ |
| |
| #include <sys/xattr.h> |
| |
| #include "errno-util.h" |
| #include "home-util.h" |
| #include "id128-util.h" |
| #include "libcrypt-util.h" |
| #include "memory-util.h" |
| #include "recovery-key.h" |
| #include "mountpoint-util.h" |
| #include "path-util.h" |
| #include "stat-util.h" |
| #include "user-record-util.h" |
| #include "user-util.h" |
| |
| int user_record_synthesize( |
| UserRecord *h, |
| const char *user_name, |
| const char *realm, |
| const char *image_path, |
| UserStorage storage, |
| uid_t uid, |
| gid_t gid) { |
| |
| _cleanup_free_ char *hd = NULL, *un = NULL, *ip = NULL, *rr = NULL, *user_name_and_realm = NULL; |
| char smid[SD_ID128_STRING_MAX]; |
| sd_id128_t mid; |
| int r; |
| |
| assert(h); |
| assert(user_name); |
| assert(image_path); |
| assert(IN_SET(storage, USER_LUKS, USER_SUBVOLUME, USER_FSCRYPT, USER_DIRECTORY)); |
| assert(uid_is_valid(uid)); |
| assert(gid_is_valid(gid)); |
| |
| /* Fill in a home record from just a username and an image path. */ |
| |
| if (h->json) |
| return -EBUSY; |
| |
| if (!suitable_user_name(user_name)) |
| return -EINVAL; |
| |
| if (realm) { |
| r = suitable_realm(realm); |
| if (r < 0) |
| return r; |
| if (r == 0) |
| return -EINVAL; |
| } |
| |
| if (!suitable_image_path(image_path)) |
| return -EINVAL; |
| |
| r = sd_id128_get_machine(&mid); |
| if (r < 0) |
| return r; |
| |
| un = strdup(user_name); |
| if (!un) |
| return -ENOMEM; |
| |
| if (realm) { |
| rr = strdup(realm); |
| if (!rr) |
| return -ENOMEM; |
| |
| user_name_and_realm = strjoin(user_name, "@", realm); |
| if (!user_name_and_realm) |
| return -ENOMEM; |
| } |
| |
| ip = strdup(image_path); |
| if (!ip) |
| return -ENOMEM; |
| |
| hd = path_join("/home/", user_name); |
| if (!hd) |
| return -ENOMEM; |
| |
| r = json_build(&h->json, |
| JSON_BUILD_OBJECT( |
| JSON_BUILD_PAIR("userName", JSON_BUILD_STRING(user_name)), |
| JSON_BUILD_PAIR_CONDITION(!!rr, "realm", JSON_BUILD_STRING(realm)), |
| JSON_BUILD_PAIR("disposition", JSON_BUILD_STRING("regular")), |
| JSON_BUILD_PAIR("binding", JSON_BUILD_OBJECT( |
| JSON_BUILD_PAIR(sd_id128_to_string(mid, smid), JSON_BUILD_OBJECT( |
| JSON_BUILD_PAIR("imagePath", JSON_BUILD_STRING(image_path)), |
| JSON_BUILD_PAIR("homeDirectory", JSON_BUILD_STRING(hd)), |
| JSON_BUILD_PAIR("storage", JSON_BUILD_STRING(user_storage_to_string(storage))), |
| JSON_BUILD_PAIR("uid", JSON_BUILD_UNSIGNED(uid)), |
| JSON_BUILD_PAIR("gid", JSON_BUILD_UNSIGNED(gid)))))))); |
| if (r < 0) |
| return r; |
| |
| free_and_replace(h->user_name, un); |
| free_and_replace(h->realm, rr); |
| free_and_replace(h->user_name_and_realm_auto, user_name_and_realm); |
| free_and_replace(h->image_path, ip); |
| free_and_replace(h->home_directory, hd); |
| h->storage = storage; |
| h->uid = uid; |
| |
| h->mask = USER_RECORD_REGULAR|USER_RECORD_BINDING; |
| return 0; |
| } |
| |
| int group_record_synthesize(GroupRecord *g, UserRecord *h) { |
| _cleanup_free_ char *un = NULL, *rr = NULL, *group_name_and_realm = NULL, *description = NULL; |
| char smid[SD_ID128_STRING_MAX]; |
| sd_id128_t mid; |
| int r; |
| |
| assert(g); |
| assert(h); |
| |
| if (g->json) |
| return -EBUSY; |
| |
| r = sd_id128_get_machine(&mid); |
| if (r < 0) |
| return r; |
| |
| un = strdup(h->user_name); |
| if (!un) |
| return -ENOMEM; |
| |
| if (h->realm) { |
| rr = strdup(h->realm); |
| if (!rr) |
| return -ENOMEM; |
| |
| group_name_and_realm = strjoin(un, "@", rr); |
| if (!group_name_and_realm) |
| return -ENOMEM; |
| } |
| |
| description = strjoin("Primary Group of User ", un); |
| if (!description) |
| return -ENOMEM; |
| |
| r = json_build(&g->json, |
| JSON_BUILD_OBJECT( |
| JSON_BUILD_PAIR("groupName", JSON_BUILD_STRING(un)), |
| JSON_BUILD_PAIR_CONDITION(!!rr, "realm", JSON_BUILD_STRING(rr)), |
| JSON_BUILD_PAIR("description", JSON_BUILD_STRING(description)), |
| JSON_BUILD_PAIR("binding", JSON_BUILD_OBJECT( |
| JSON_BUILD_PAIR(sd_id128_to_string(mid, smid), JSON_BUILD_OBJECT( |
| JSON_BUILD_PAIR("gid", JSON_BUILD_UNSIGNED(user_record_gid(h))))))), |
| JSON_BUILD_PAIR_CONDITION(h->disposition >= 0, "disposition", JSON_BUILD_STRING(user_disposition_to_string(user_record_disposition(h)))), |
| JSON_BUILD_PAIR("status", JSON_BUILD_OBJECT( |
| JSON_BUILD_PAIR(sd_id128_to_string(mid, smid), JSON_BUILD_OBJECT( |
| JSON_BUILD_PAIR("service", JSON_BUILD_STRING("io.systemd.Home")))))))); |
| if (r < 0) |
| return r; |
| |
| free_and_replace(g->group_name, un); |
| free_and_replace(g->realm, rr); |
| free_and_replace(g->group_name_and_realm_auto, group_name_and_realm); |
| g->gid = user_record_gid(h); |
| g->disposition = h->disposition; |
| |
| g->mask = USER_RECORD_REGULAR|USER_RECORD_BINDING; |
| return 0; |
| } |
| |
| int user_record_reconcile( |
| UserRecord *host, |
| UserRecord *embedded, |
| UserReconcileMode mode, |
| UserRecord **ret) { |
| |
| int r, result; |
| |
| /* Reconciles the identity record stored on the host with the one embedded in a $HOME |
| * directory. Returns the following error codes: |
| * |
| * -EINVAL: one of the records not valid |
| * -REMCHG: identity records are not about the same user |
| * -ESTALE: embedded identity record is equally new or newer than supplied record |
| * |
| * Return the new record to use, which is either the embedded record updated with the host |
| * binding or the host record. In both cases the secret data is stripped. */ |
| |
| assert(host); |
| assert(embedded); |
| |
| /* Make sure both records are initialized */ |
| if (!host->json || !embedded->json) |
| return -EINVAL; |
| |
| /* Ensure these records actually contain user data */ |
| if (!(embedded->mask & host->mask & USER_RECORD_REGULAR)) |
| return -EINVAL; |
| |
| /* Make sure the user name and realm matches */ |
| if (!user_record_compatible(host, embedded)) |
| return -EREMCHG; |
| |
| /* Embedded identities may not contain secrets or binding info */ |
| if ((embedded->mask & (USER_RECORD_SECRET|USER_RECORD_BINDING)) != 0) |
| return -EINVAL; |
| |
| /* The embedded record checked out, let's now figure out which of the two identities we'll consider |
| * in effect from now on. We do this by checking the last change timestamp, and in doubt always let |
| * the embedded data win. */ |
| if (host->last_change_usec != UINT64_MAX && |
| (embedded->last_change_usec == UINT64_MAX || host->last_change_usec > embedded->last_change_usec)) |
| |
| /* The host version is definitely newer, either because it has a version at all and the |
| * embedded version doesn't or because it is numerically newer. */ |
| result = USER_RECONCILE_HOST_WON; |
| |
| else if (host->last_change_usec == embedded->last_change_usec) { |
| |
| /* The nominal version number of the host and the embedded identity is the same. If so, let's |
| * verify that, and tell the caller if we are ignoring embedded data. */ |
| |
| r = user_record_masked_equal(host, embedded, USER_RECORD_REGULAR|USER_RECORD_PRIVILEGED|USER_RECORD_PER_MACHINE); |
| if (r < 0) |
| return r; |
| if (r > 0) { |
| if (mode == USER_RECONCILE_REQUIRE_NEWER) |
| return -ESTALE; |
| |
| result = USER_RECONCILE_IDENTICAL; |
| } else |
| result = USER_RECONCILE_HOST_WON; |
| } else { |
| _cleanup_(json_variant_unrefp) JsonVariant *extended = NULL; |
| _cleanup_(user_record_unrefp) UserRecord *merged = NULL; |
| JsonVariant *e; |
| |
| /* The embedded version is newer */ |
| |
| if (mode == USER_RECONCILE_REQUIRE_NEWER_OR_EQUAL) |
| return -ESTALE; |
| |
| /* Copy in the binding data */ |
| extended = json_variant_ref(embedded->json); |
| |
| e = json_variant_by_key(host->json, "binding"); |
| if (e) { |
| r = json_variant_set_field(&extended, "binding", e); |
| if (r < 0) |
| return r; |
| } |
| |
| merged = user_record_new(); |
| if (!merged) |
| return -ENOMEM; |
| |
| r = user_record_load(merged, extended, USER_RECORD_LOAD_MASK_SECRET|USER_RECORD_PERMISSIVE); |
| if (r < 0) |
| return r; |
| |
| *ret = TAKE_PTR(merged); |
| return USER_RECONCILE_EMBEDDED_WON; /* update */ |
| } |
| |
| /* Strip out secrets */ |
| r = user_record_clone(host, USER_RECORD_LOAD_MASK_SECRET|USER_RECORD_PERMISSIVE, ret); |
| if (r < 0) |
| return r; |
| |
| return result; |
| } |
| |
| int user_record_add_binding( |
| UserRecord *h, |
| UserStorage storage, |
| const char *image_path, |
| sd_id128_t partition_uuid, |
| sd_id128_t luks_uuid, |
| sd_id128_t fs_uuid, |
| const char *luks_cipher, |
| const char *luks_cipher_mode, |
| uint64_t luks_volume_key_size, |
| const char *file_system_type, |
| const char *home_directory, |
| uid_t uid, |
| gid_t gid) { |
| |
| _cleanup_(json_variant_unrefp) JsonVariant *new_binding_entry = NULL, *binding = NULL; |
| char smid[SD_ID128_STRING_MAX], partition_uuids[ID128_UUID_STRING_MAX], luks_uuids[ID128_UUID_STRING_MAX], fs_uuids[ID128_UUID_STRING_MAX]; |
| _cleanup_free_ char *ip = NULL, *hd = NULL, *ip_auto = NULL, *lc = NULL, *lcm = NULL, *fst = NULL; |
| sd_id128_t mid; |
| int r; |
| |
| assert(h); |
| |
| if (!h->json) |
| return -EUNATCH; |
| |
| r = sd_id128_get_machine(&mid); |
| if (r < 0) |
| return r; |
| sd_id128_to_string(mid, smid); |
| |
| if (image_path) { |
| ip = strdup(image_path); |
| if (!ip) |
| return -ENOMEM; |
| } else if (!h->image_path && storage >= 0) { |
| r = user_record_build_image_path(storage, user_record_user_name_and_realm(h), &ip_auto); |
| if (r < 0) |
| return r; |
| } |
| |
| if (home_directory) { |
| hd = strdup(home_directory); |
| if (!hd) |
| return -ENOMEM; |
| } |
| |
| if (file_system_type) { |
| fst = strdup(file_system_type); |
| if (!fst) |
| return -ENOMEM; |
| } |
| |
| if (luks_cipher) { |
| lc = strdup(luks_cipher); |
| if (!lc) |
| return -ENOMEM; |
| } |
| |
| if (luks_cipher_mode) { |
| lcm = strdup(luks_cipher_mode); |
| if (!lcm) |
| return -ENOMEM; |
| } |
| |
| r = json_build(&new_binding_entry, |
| JSON_BUILD_OBJECT( |
| JSON_BUILD_PAIR_CONDITION(!!image_path, "imagePath", JSON_BUILD_STRING(image_path)), |
| JSON_BUILD_PAIR_CONDITION(!sd_id128_is_null(partition_uuid), "partitionUuid", JSON_BUILD_STRING(id128_to_uuid_string(partition_uuid, partition_uuids))), |
| JSON_BUILD_PAIR_CONDITION(!sd_id128_is_null(luks_uuid), "luksUuid", JSON_BUILD_STRING(id128_to_uuid_string(luks_uuid, luks_uuids))), |
| JSON_BUILD_PAIR_CONDITION(!sd_id128_is_null(fs_uuid), "fileSystemUuid", JSON_BUILD_STRING(id128_to_uuid_string(fs_uuid, fs_uuids))), |
| JSON_BUILD_PAIR_CONDITION(!!luks_cipher, "luksCipher", JSON_BUILD_STRING(luks_cipher)), |
| JSON_BUILD_PAIR_CONDITION(!!luks_cipher_mode, "luksCipherMode", JSON_BUILD_STRING(luks_cipher_mode)), |
| JSON_BUILD_PAIR_CONDITION(luks_volume_key_size != UINT64_MAX, "luksVolumeKeySize", JSON_BUILD_UNSIGNED(luks_volume_key_size)), |
| JSON_BUILD_PAIR_CONDITION(!!file_system_type, "fileSystemType", JSON_BUILD_STRING(file_system_type)), |
| JSON_BUILD_PAIR_CONDITION(!!home_directory, "homeDirectory", JSON_BUILD_STRING(home_directory)), |
| JSON_BUILD_PAIR_CONDITION(uid_is_valid(uid), "uid", JSON_BUILD_UNSIGNED(uid)), |
| JSON_BUILD_PAIR_CONDITION(gid_is_valid(gid), "gid", JSON_BUILD_UNSIGNED(gid)), |
| JSON_BUILD_PAIR_CONDITION(storage >= 0, "storage", JSON_BUILD_STRING(user_storage_to_string(storage))))); |
| if (r < 0) |
| return r; |
| |
| binding = json_variant_ref(json_variant_by_key(h->json, "binding")); |
| if (binding) { |
| _cleanup_(json_variant_unrefp) JsonVariant *be = NULL; |
| |
| /* Merge the new entry with an old one, if that exists */ |
| be = json_variant_ref(json_variant_by_key(binding, smid)); |
| if (be) { |
| r = json_variant_merge(&be, new_binding_entry); |
| if (r < 0) |
| return r; |
| |
| json_variant_unref(new_binding_entry); |
| new_binding_entry = TAKE_PTR(be); |
| } |
| } |
| |
| r = json_variant_set_field(&binding, smid, new_binding_entry); |
| if (r < 0) |
| return r; |
| |
| r = json_variant_set_field(&h->json, "binding", binding); |
| if (r < 0) |
| return r; |
| |
| if (storage >= 0) |
| h->storage = storage; |
| |
| if (ip) |
| free_and_replace(h->image_path, ip); |
| if (ip_auto) |
| free_and_replace(h->image_path_auto, ip_auto); |
| |
| if (!sd_id128_is_null(partition_uuid)) |
| h->partition_uuid = partition_uuid; |
| |
| if (!sd_id128_is_null(luks_uuid)) |
| h->luks_uuid = luks_uuid; |
| |
| if (!sd_id128_is_null(fs_uuid)) |
| h->file_system_uuid = fs_uuid; |
| |
| if (lc) |
| free_and_replace(h->luks_cipher, lc); |
| if (lcm) |
| free_and_replace(h->luks_cipher_mode, lcm); |
| if (luks_volume_key_size != UINT64_MAX) |
| h->luks_volume_key_size = luks_volume_key_size; |
| |
| if (fst) |
| free_and_replace(h->file_system_type, fst); |
| if (hd) |
| free_and_replace(h->home_directory, hd); |
| |
| if (uid_is_valid(uid)) |
| h->uid = uid; |
| if (gid_is_valid(gid)) |
| h->gid = gid; |
| |
| h->mask |= USER_RECORD_BINDING; |
| return 1; |
| } |
| |
| int user_record_test_home_directory(UserRecord *h) { |
| const char *hd; |
| int r; |
| |
| assert(h); |
| |
| /* Returns one of USER_TEST_ABSENT, USER_TEST_MOUNTED, USER_TEST_EXISTS on success */ |
| |
| hd = user_record_home_directory(h); |
| if (!hd) |
| return -ENXIO; |
| |
| r = is_dir(hd, false); |
| if (r == -ENOENT) |
| return USER_TEST_ABSENT; |
| if (r < 0) |
| return r; |
| if (r == 0) |
| return -ENOTDIR; |
| |
| r = path_is_mount_point(hd, NULL, 0); |
| if (r < 0) |
| return r; |
| if (r > 0) |
| return USER_TEST_MOUNTED; |
| |
| /* If the image path and the home directory are identical, then it's OK if the directory is |
| * populated. */ |
| if (IN_SET(user_record_storage(h), USER_CLASSIC, USER_DIRECTORY, USER_SUBVOLUME, USER_FSCRYPT)) { |
| const char *ip; |
| |
| ip = user_record_image_path(h); |
| if (ip && path_equal(ip, hd)) |
| return USER_TEST_EXISTS; |
| } |
| |
| /* Otherwise it's not OK */ |
| r = dir_is_empty(hd); |
| if (r < 0) |
| return r; |
| if (r == 0) |
| return -EBUSY; |
| |
| return USER_TEST_EXISTS; |
| } |
| |
| int user_record_test_home_directory_and_warn(UserRecord *h) { |
| int r; |
| |
| assert(h); |
| |
| r = user_record_test_home_directory(h); |
| if (r == -ENXIO) |
| return log_error_errno(r, "User record lacks home directory, refusing."); |
| if (r == -ENOTDIR) |
| return log_error_errno(r, "Home directory %s is not a directory, refusing.", user_record_home_directory(h)); |
| if (r == -EBUSY) |
| return log_error_errno(r, "Home directory %s exists, is not mounted but populated, refusing.", user_record_home_directory(h)); |
| if (r < 0) |
| return log_error_errno(r, "Failed to test whether the home directory %s exists: %m", user_record_home_directory(h)); |
| |
| return r; |
| } |
| |
| int user_record_test_image_path(UserRecord *h) { |
| const char *ip; |
| struct stat st; |
| |
| assert(h); |
| |
| if (user_record_storage(h) == USER_CIFS) |
| return USER_TEST_UNDEFINED; |
| |
| ip = user_record_image_path(h); |
| if (!ip) |
| return -ENXIO; |
| |
| if (stat(ip, &st) < 0) { |
| if (errno == ENOENT) |
| return USER_TEST_ABSENT; |
| |
| return -errno; |
| } |
| |
| switch (user_record_storage(h)) { |
| |
| case USER_LUKS: |
| if (S_ISREG(st.st_mode)) { |
| ssize_t n; |
| char x[2]; |
| |
| n = getxattr(ip, "user.home-dirty", x, sizeof(x)); |
| if (n < 0) { |
| if (errno != ENODATA) |
| log_debug_errno(errno, "Unable to read dirty xattr off image file, ignoring: %m"); |
| |
| } else if (n == 1 && x[0] == '1') |
| return USER_TEST_DIRTY; |
| |
| return USER_TEST_EXISTS; |
| } |
| |
| if (S_ISBLK(st.st_mode)) { |
| /* For block devices we can't really be sure if the device referenced actually is the |
| * fs we look for or some other file system (think: what does /dev/sdb1 refer |
| * to?). Hence, let's return USER_TEST_MAYBE as an ambiguous return value for these |
| * case, except if the device path used is one of the paths that is based on a |
| * filesystem or partition UUID or label, because in those cases we can be sure we |
| * are referring to the right device. */ |
| |
| if (PATH_STARTSWITH_SET(ip, |
| "/dev/disk/by-uuid/", |
| "/dev/disk/by-partuuid/", |
| "/dev/disk/by-partlabel/", |
| "/dev/disk/by-label/")) |
| return USER_TEST_EXISTS; |
| |
| return USER_TEST_MAYBE; |
| } |
| |
| return -EBADFD; |
| |
| case USER_CLASSIC: |
| case USER_DIRECTORY: |
| case USER_SUBVOLUME: |
| case USER_FSCRYPT: |
| if (S_ISDIR(st.st_mode)) |
| return USER_TEST_EXISTS; |
| |
| return -ENOTDIR; |
| |
| default: |
| assert_not_reached("Unexpected record type"); |
| } |
| } |
| |
| int user_record_test_image_path_and_warn(UserRecord *h) { |
| int r; |
| |
| assert(h); |
| |
| r = user_record_test_image_path(h); |
| if (r == -ENXIO) |
| return log_error_errno(r, "User record lacks image path, refusing."); |
| if (r == -EBADFD) |
| return log_error_errno(r, "Image path %s is not a regular file or block device, refusing.", user_record_image_path(h)); |
| if (r == -ENOTDIR) |
| return log_error_errno(r, "Image path %s is not a directory, refusing.", user_record_image_path(h)); |
| if (r < 0) |
| return log_error_errno(r, "Failed to test whether image path %s exists: %m", user_record_image_path(h)); |
| |
| return r; |
| } |
| |
| int user_record_test_password(UserRecord *h, UserRecord *secret) { |
| char **i; |
| int r; |
| |
| assert(h); |
| |
| /* Checks whether any of the specified passwords matches any of the hashed passwords of the entry */ |
| |
| if (strv_isempty(h->hashed_password)) |
| return -ENXIO; |
| |
| STRV_FOREACH(i, secret->password) { |
| r = test_password_many(h->hashed_password, *i); |
| if (r < 0) |
| return r; |
| if (r > 0) |
| return 0; |
| } |
| |
| return -ENOKEY; |
| } |
| |
| int user_record_test_recovery_key(UserRecord *h, UserRecord *secret) { |
| char **i; |
| int r; |
| |
| assert(h); |
| |
| /* Checks whether any of the specified passwords matches any of the hashed recovery keys of the entry */ |
| |
| if (h->n_recovery_key == 0) |
| return -ENXIO; |
| |
| STRV_FOREACH(i, secret->password) { |
| for (size_t j = 0; j < h->n_recovery_key; j++) { |
| _cleanup_(erase_and_freep) char *mangled = NULL; |
| const char *p; |
| |
| if (streq(h->recovery_key[j].type, "modhex64")) { |
| /* If this key is for a modhex64 recovery key, then try to normalize the |
| * passphrase to make things more robust: that way the password becomes case |
| * insensitive and the dashes become optional. */ |
| |
| r = normalize_recovery_key(*i, &mangled); |
| if (r == -EINVAL) /* Not a valid modhex64 passphrase, don't bother */ |
| continue; |
| if (r < 0) |
| return r; |
| |
| p = mangled; |
| } else |
| p = *i; /* Unknown recovery key types process as is */ |
| |
| r = test_password_one(h->recovery_key[j].hashed_password, p); |
| if (r < 0) |
| return r; |
| if (r > 0) |
| return 0; |
| } |
| } |
| |
| return -ENOKEY; |
| } |
| |
| int user_record_set_disk_size(UserRecord *h, uint64_t disk_size) { |
| _cleanup_(json_variant_unrefp) JsonVariant *new_per_machine = NULL, *midv = NULL, *midav = NULL, *ne = NULL; |
| _cleanup_free_ JsonVariant **array = NULL; |
| char smid[SD_ID128_STRING_MAX]; |
| size_t idx = SIZE_MAX, n; |
| JsonVariant *per_machine; |
| sd_id128_t mid; |
| int r; |
| |
| assert(h); |
| |
| if (!h->json) |
| return -EUNATCH; |
| |
| if (disk_size < USER_DISK_SIZE_MIN || disk_size > USER_DISK_SIZE_MAX) |
| return -ERANGE; |
| |
| r = sd_id128_get_machine(&mid); |
| if (r < 0) |
| return r; |
| |
| sd_id128_to_string(mid, smid); |
| |
| r = json_variant_new_string(&midv, smid); |
| if (r < 0) |
| return r; |
| |
| r = json_variant_new_array(&midav, (JsonVariant*[]) { midv }, 1); |
| if (r < 0) |
| return r; |
| |
| per_machine = json_variant_by_key(h->json, "perMachine"); |
| if (per_machine) { |
| size_t i; |
| |
| if (!json_variant_is_array(per_machine)) |
| return -EINVAL; |
| |
| n = json_variant_elements(per_machine); |
| |
| array = new(JsonVariant*, n + 1); |
| if (!array) |
| return -ENOMEM; |
| |
| for (i = 0; i < n; i++) { |
| JsonVariant *m; |
| |
| array[i] = json_variant_by_index(per_machine, i); |
| |
| if (!json_variant_is_object(array[i])) |
| return -EINVAL; |
| |
| m = json_variant_by_key(array[i], "matchMachineId"); |
| if (!m) { |
| /* No machineId field? Let's ignore this, but invalidate what we found so far */ |
| idx = SIZE_MAX; |
| continue; |
| } |
| |
| if (json_variant_equal(m, midv) || |
| json_variant_equal(m, midav)) { |
| /* Matches exactly what we are looking for. Let's use this */ |
| idx = i; |
| continue; |
| } |
| |
| r = per_machine_id_match(m, JSON_PERMISSIVE); |
| if (r < 0) |
| return r; |
| if (r > 0) |
| /* Also matches what we are looking for, but with a broader match. In this |
| * case let's ignore this entry, and add a new specific one to the end. */ |
| idx = SIZE_MAX; |
| } |
| |
| if (idx == SIZE_MAX) |
| idx = n++; /* Nothing suitable found, place new entry at end */ |
| else |
| ne = json_variant_ref(array[idx]); |
| |
| } else { |
| array = new(JsonVariant*, 1); |
| if (!array) |
| return -ENOMEM; |
| |
| idx = 0; |
| n = 1; |
| } |
| |
| if (!ne) { |
| r = json_variant_set_field(&ne, "matchMachineId", midav); |
| if (r < 0) |
| return r; |
| } |
| |
| r = json_variant_set_field_unsigned(&ne, "diskSize", disk_size); |
| if (r < 0) |
| return r; |
| |
| assert(idx < n); |
| array[idx] = ne; |
| |
| r = json_variant_new_array(&new_per_machine, array, n); |
| if (r < 0) |
| return r; |
| |
| r = json_variant_set_field(&h->json, "perMachine", new_per_machine); |
| if (r < 0) |
| return r; |
| |
| h->disk_size = disk_size; |
| h->mask |= USER_RECORD_PER_MACHINE; |
| return 0; |
| } |
| |
| int user_record_update_last_changed(UserRecord *h, bool with_password) { |
| _cleanup_(json_variant_unrefp) JsonVariant *v = NULL; |
| usec_t n; |
| int r; |
| |
| assert(h); |
| |
| if (!h->json) |
| return -EUNATCH; |
| |
| n = now(CLOCK_REALTIME); |
| |
| /* refuse downgrading */ |
| if (h->last_change_usec != UINT64_MAX && h->last_change_usec >= n) |
| return -ECHRNG; |
| if (h->last_password_change_usec != UINT64_MAX && h->last_password_change_usec >= n) |
| return -ECHRNG; |
| |
| v = json_variant_ref(h->json); |
| |
| r = json_variant_set_field_unsigned(&v, "lastChangeUSec", n); |
| if (r < 0) |
| return r; |
| |
| if (with_password) { |
| r = json_variant_set_field_unsigned(&v, "lastPasswordChangeUSec", n); |
| if (r < 0) |
| return r; |
| |
| h->last_password_change_usec = n; |
| } |
| |
| h->last_change_usec = n; |
| |
| json_variant_unref(h->json); |
| h->json = TAKE_PTR(v); |
| |
| h->mask |= USER_RECORD_REGULAR; |
| return 0; |
| } |
| |
| int user_record_make_hashed_password(UserRecord *h, char **secret, bool extend) { |
| _cleanup_(json_variant_unrefp) JsonVariant *priv = NULL; |
| _cleanup_strv_free_ char **np = NULL; |
| char **i; |
| int r; |
| |
| assert(h); |
| assert(secret); |
| |
| /* Initializes the hashed password list from the specified plaintext passwords */ |
| |
| if (extend) { |
| np = strv_copy(h->hashed_password); |
| if (!np) |
| return -ENOMEM; |
| |
| strv_uniq(np); |
| } |
| |
| STRV_FOREACH(i, secret) { |
| _cleanup_(erase_and_freep) char *hashed = NULL; |
| |
| r = hash_password(*i, &hashed); |
| if (r < 0) |
| return r; |
| |
| r = strv_consume(&np, TAKE_PTR(hashed)); |
| if (r < 0) |
| return r; |
| } |
| |
| priv = json_variant_ref(json_variant_by_key(h->json, "privileged")); |
| |
| if (strv_isempty(np)) |
| r = json_variant_filter(&priv, STRV_MAKE("hashedPassword")); |
| else { |
| _cleanup_(json_variant_unrefp) JsonVariant *new_array = NULL; |
| |
| r = json_variant_new_array_strv(&new_array, np); |
| if (r < 0) |
| return r; |
| |
| r = json_variant_set_field(&priv, "hashedPassword", new_array); |
| if (r < 0) |
| return r; |
| } |
| |
| r = json_variant_set_field(&h->json, "privileged", priv); |
| if (r < 0) |
| return r; |
| |
| strv_free_and_replace(h->hashed_password, np); |
| |
| SET_FLAG(h->mask, USER_RECORD_PRIVILEGED, !json_variant_is_blank_object(priv)); |
| return 0; |
| } |
| |
| int user_record_set_hashed_password(UserRecord *h, char **hashed_password) { |
| _cleanup_(json_variant_unrefp) JsonVariant *priv = NULL; |
| _cleanup_strv_free_ char **copy = NULL; |
| int r; |
| |
| assert(h); |
| |
| priv = json_variant_ref(json_variant_by_key(h->json, "privileged")); |
| |
| if (strv_isempty(hashed_password)) |
| r = json_variant_filter(&priv, STRV_MAKE("hashedPassword")); |
| else { |
| _cleanup_(json_variant_unrefp) JsonVariant *array = NULL; |
| |
| copy = strv_copy(hashed_password); |
| if (!copy) |
| return -ENOMEM; |
| |
| strv_uniq(copy); |
| |
| r = json_variant_new_array_strv(&array, copy); |
| if (r < 0) |
| return r; |
| |
| r = json_variant_set_field(&priv, "hashedPassword", array); |
| } |
| if (r < 0) |
| return r; |
| |
| r = json_variant_set_field(&h->json, "privileged", priv); |
| if (r < 0) |
| return r; |
| |
| strv_free_and_replace(h->hashed_password, copy); |
| |
| SET_FLAG(h->mask, USER_RECORD_PRIVILEGED, !json_variant_is_blank_object(priv)); |
| return 0; |
| } |
| |
| int user_record_set_password(UserRecord *h, char **password, bool prepend) { |
| _cleanup_(json_variant_unrefp) JsonVariant *w = NULL; |
| _cleanup_(strv_free_erasep) char **e = NULL; |
| int r; |
| |
| assert(h); |
| |
| if (prepend) { |
| e = strv_copy(password); |
| if (!e) |
| return -ENOMEM; |
| |
| r = strv_extend_strv(&e, h->password, true); |
| if (r < 0) |
| return r; |
| |
| strv_uniq(e); |
| |
| if (strv_equal(h->password, e)) |
| return 0; |
| |
| } else { |
| if (strv_equal(h->password, password)) |
| return 0; |
| |
| e = strv_copy(password); |
| if (!e) |
| return -ENOMEM; |
| |
| strv_uniq(e); |
| } |
| |
| w = json_variant_ref(json_variant_by_key(h->json, "secret")); |
| |
| if (strv_isempty(e)) |
| r = json_variant_filter(&w, STRV_MAKE("password")); |
| else { |
| _cleanup_(json_variant_unrefp) JsonVariant *l = NULL; |
| |
| r = json_variant_new_array_strv(&l, e); |
| if (r < 0) |
| return r; |
| |
| json_variant_sensitive(l); |
| |
| r = json_variant_set_field(&w, "password", l); |
| } |
| if (r < 0) |
| return r; |
| |
| json_variant_sensitive(w); |
| |
| r = json_variant_set_field(&h->json, "secret", w); |
| if (r < 0) |
| return r; |
| |
| strv_free_and_replace(h->password, e); |
| |
| SET_FLAG(h->mask, USER_RECORD_SECRET, !json_variant_is_blank_object(w)); |
| return 0; |
| } |
| |
| int user_record_set_token_pin(UserRecord *h, char **pin, bool prepend) { |
| _cleanup_(json_variant_unrefp) JsonVariant *w = NULL; |
| _cleanup_(strv_free_erasep) char **e = NULL; |
| int r; |
| |
| assert(h); |
| |
| if (prepend) { |
| e = strv_copy(pin); |
| if (!e) |
| return -ENOMEM; |
| |
| r = strv_extend_strv(&e, h->token_pin, true); |
| if (r < 0) |
| return r; |
| |
| strv_uniq(e); |
| |
| if (strv_equal(h->token_pin, e)) |
| return 0; |
| |
| } else { |
| if (strv_equal(h->token_pin, pin)) |
| return 0; |
| |
| e = strv_copy(pin); |
| if (!e) |
| return -ENOMEM; |
| |
| strv_uniq(e); |
| } |
| |
| w = json_variant_ref(json_variant_by_key(h->json, "secret")); |
| |
| if (strv_isempty(e)) |
| r = json_variant_filter(&w, STRV_MAKE("tokenPin")); |
| else { |
| _cleanup_(json_variant_unrefp) JsonVariant *l = NULL; |
| |
| r = json_variant_new_array_strv(&l, e); |
| if (r < 0) |
| return r; |
| |
| json_variant_sensitive(l); |
| |
| r = json_variant_set_field(&w, "tokenPin", l); |
| } |
| if (r < 0) |
| return r; |
| |
| json_variant_sensitive(w); |
| |
| r = json_variant_set_field(&h->json, "secret", w); |
| if (r < 0) |
| return r; |
| |
| strv_free_and_replace(h->token_pin, e); |
| |
| SET_FLAG(h->mask, USER_RECORD_SECRET, !json_variant_is_blank_object(w)); |
| return 0; |
| } |
| |
| int user_record_set_pkcs11_protected_authentication_path_permitted(UserRecord *h, int b) { |
| _cleanup_(json_variant_unrefp) JsonVariant *w = NULL; |
| int r; |
| |
| assert(h); |
| |
| w = json_variant_ref(json_variant_by_key(h->json, "secret")); |
| |
| if (b < 0) |
| r = json_variant_filter(&w, STRV_MAKE("pkcs11ProtectedAuthenticationPathPermitted")); |
| else |
| r = json_variant_set_field_boolean(&w, "pkcs11ProtectedAuthenticationPathPermitted", b); |
| if (r < 0) |
| return r; |
| |
| if (json_variant_is_blank_object(w)) |
| r = json_variant_filter(&h->json, STRV_MAKE("secret")); |
| else { |
| json_variant_sensitive(w); |
| |
| r = json_variant_set_field(&h->json, "secret", w); |
| } |
| if (r < 0) |
| return r; |
| |
| h->pkcs11_protected_authentication_path_permitted = b; |
| |
| SET_FLAG(h->mask, USER_RECORD_SECRET, !json_variant_is_blank_object(w)); |
| return 0; |
| } |
| |
| int user_record_set_fido2_user_presence_permitted(UserRecord *h, int b) { |
| _cleanup_(json_variant_unrefp) JsonVariant *w = NULL; |
| int r; |
| |
| assert(h); |
| |
| w = json_variant_ref(json_variant_by_key(h->json, "secret")); |
| |
| if (b < 0) |
| r = json_variant_filter(&w, STRV_MAKE("fido2UserPresencePermitted")); |
| else |
| r = json_variant_set_field_boolean(&w, "fido2UserPresencePermitted", b); |
| if (r < 0) |
| return r; |
| |
| if (json_variant_is_blank_object(w)) |
| r = json_variant_filter(&h->json, STRV_MAKE("secret")); |
| else |
| r = json_variant_set_field(&h->json, "secret", w); |
| if (r < 0) |
| return r; |
| |
| h->fido2_user_presence_permitted = b; |
| |
| SET_FLAG(h->mask, USER_RECORD_SECRET, !json_variant_is_blank_object(w)); |
| return 0; |
| } |
| |
| int user_record_set_fido2_user_verification_permitted(UserRecord *h, int b) { |
| _cleanup_(json_variant_unrefp) JsonVariant *w = NULL; |
| int r; |
| |
| assert(h); |
| |
| w = json_variant_ref(json_variant_by_key(h->json, "secret")); |
| |
| if (b < 0) |
| r = json_variant_filter(&w, STRV_MAKE("fido2UserVerificationPermitted")); |
| else |
| r = json_variant_set_field_boolean(&w, "fido2UserVerificationPermitted", b); |
| if (r < 0) |
| return r; |
| |
| if (json_variant_is_blank_object(w)) |
| r = json_variant_filter(&h->json, STRV_MAKE("secret")); |
| else |
| r = json_variant_set_field(&h->json, "secret", w); |
| if (r < 0) |
| return r; |
| |
| h->fido2_user_verification_permitted = b; |
| |
| SET_FLAG(h->mask, USER_RECORD_SECRET, !json_variant_is_blank_object(w)); |
| return 0; |
| } |
| |
| static bool per_machine_entry_empty(JsonVariant *v) { |
| const char *k; |
| _unused_ JsonVariant *e; |
| |
| JSON_VARIANT_OBJECT_FOREACH(k, e, v) |
| if (!STR_IN_SET(k, "matchMachineId", "matchHostname")) |
| return false; |
| |
| return true; |
| } |
| |
| int user_record_set_password_change_now(UserRecord *h, int b) { |
| _cleanup_(json_variant_unrefp) JsonVariant *w = NULL; |
| JsonVariant *per_machine; |
| int r; |
| |
| assert(h); |
| |
| w = json_variant_ref(h->json); |
| |
| if (b < 0) |
| r = json_variant_filter(&w, STRV_MAKE("passwordChangeNow")); |
| else |
| r = json_variant_set_field_boolean(&w, "passwordChangeNow", b); |
| if (r < 0) |
| return r; |
| |
| /* Also drop the field from all perMachine entries */ |
| per_machine = json_variant_by_key(w, "perMachine"); |
| if (per_machine) { |
| _cleanup_(json_variant_unrefp) JsonVariant *array = NULL; |
| JsonVariant *e; |
| |
| JSON_VARIANT_ARRAY_FOREACH(e, per_machine) { |
| _cleanup_(json_variant_unrefp) JsonVariant *z = NULL; |
| |
| if (!json_variant_is_object(e)) |
| return -EINVAL; |
| |
| z = json_variant_ref(e); |
| |
| r = json_variant_filter(&z, STRV_MAKE("passwordChangeNow")); |
| if (r < 0) |
| return r; |
| |
| if (per_machine_entry_empty(z)) |
| continue; |
| |
| r = json_variant_append_array(&array, z); |
| if (r < 0) |
| return r; |
| } |
| |
| if (json_variant_is_blank_array(array)) |
| r = json_variant_filter(&w, STRV_MAKE("perMachine")); |
| else |
| r = json_variant_set_field(&w, "perMachine", array); |
| if (r < 0) |
| return r; |
| |
| SET_FLAG(h->mask, USER_RECORD_PER_MACHINE, !json_variant_is_blank_array(array)); |
| } |
| |
| json_variant_unref(h->json); |
| h->json = TAKE_PTR(w); |
| |
| h->password_change_now = b; |
| |
| return 0; |
| } |
| |
| int user_record_merge_secret(UserRecord *h, UserRecord *secret) { |
| int r; |
| |
| assert(h); |
| |
| /* Merges the secrets from 'secret' into 'h'. */ |
| |
| r = user_record_set_password(h, secret->password, true); |
| if (r < 0) |
| return r; |
| |
| r = user_record_set_token_pin(h, secret->token_pin, true); |
| if (r < 0) |
| return r; |
| |
| if (secret->pkcs11_protected_authentication_path_permitted >= 0) { |
| r = user_record_set_pkcs11_protected_authentication_path_permitted( |
| h, |
| secret->pkcs11_protected_authentication_path_permitted); |
| if (r < 0) |
| return r; |
| } |
| |
| if (secret->fido2_user_presence_permitted >= 0) { |
| r = user_record_set_fido2_user_presence_permitted( |
| h, |
| secret->fido2_user_presence_permitted); |
| if (r < 0) |
| return r; |
| } |
| |
| if (secret->fido2_user_verification_permitted >= 0) { |
| r = user_record_set_fido2_user_verification_permitted( |
| h, |
| secret->fido2_user_verification_permitted); |
| if (r < 0) |
| return r; |
| } |
| |
| return 0; |
| } |
| |
| int user_record_good_authentication(UserRecord *h) { |
| _cleanup_(json_variant_unrefp) JsonVariant *v = NULL, *w = NULL, *z = NULL; |
| char buf[SD_ID128_STRING_MAX]; |
| uint64_t counter, usec; |
| sd_id128_t mid; |
| int r; |
| |
| assert(h); |
| |
| switch (h->good_authentication_counter) { |
| case UINT64_MAX: |
| counter = 1; |
| break; |
| case UINT64_MAX-1: |
| counter = h->good_authentication_counter; /* saturate */ |
| break; |
| default: |
| counter = h->good_authentication_counter + 1; |
| break; |
| } |
| |
| usec = now(CLOCK_REALTIME); |
| |
| r = sd_id128_get_machine(&mid); |
| if (r < 0) |
| return r; |
| |
| v = json_variant_ref(h->json); |
| w = json_variant_ref(json_variant_by_key(v, "status")); |
| z = json_variant_ref(json_variant_by_key(w, sd_id128_to_string(mid, buf))); |
| |
| r = json_variant_set_field_unsigned(&z, "goodAuthenticationCounter", counter); |
| if (r < 0) |
| return r; |
| |
| r = json_variant_set_field_unsigned(&z, "lastGoodAuthenticationUSec", usec); |
| if (r < 0) |
| return r; |
| |
| r = json_variant_set_field(&w, buf, z); |
| if (r < 0) |
| return r; |
| |
| r = json_variant_set_field(&v, "status", w); |
| if (r < 0) |
| return r; |
| |
| json_variant_unref(h->json); |
| h->json = TAKE_PTR(v); |
| |
| h->good_authentication_counter = counter; |
| h->last_good_authentication_usec = usec; |
| |
| h->mask |= USER_RECORD_STATUS; |
| return 0; |
| } |
| |
| int user_record_bad_authentication(UserRecord *h) { |
| _cleanup_(json_variant_unrefp) JsonVariant *v = NULL, *w = NULL, *z = NULL; |
| char buf[SD_ID128_STRING_MAX]; |
| uint64_t counter, usec; |
| sd_id128_t mid; |
| int r; |
| |
| assert(h); |
| |
| switch (h->bad_authentication_counter) { |
| case UINT64_MAX: |
| counter = 1; |
| break; |
| case UINT64_MAX-1: |
| counter = h->bad_authentication_counter; /* saturate */ |
| break; |
| default: |
| counter = h->bad_authentication_counter + 1; |
| break; |
| } |
| |
| usec = now(CLOCK_REALTIME); |
| |
| r = sd_id128_get_machine(&mid); |
| if (r < 0) |
| return r; |
| |
| v = json_variant_ref(h->json); |
| w = json_variant_ref(json_variant_by_key(v, "status")); |
| z = json_variant_ref(json_variant_by_key(w, sd_id128_to_string(mid, buf))); |
| |
| r = json_variant_set_field_unsigned(&z, "badAuthenticationCounter", counter); |
| if (r < 0) |
| return r; |
| |
| r = json_variant_set_field_unsigned(&z, "lastBadAuthenticationUSec", usec); |
| if (r < 0) |
| return r; |
| |
| r = json_variant_set_field(&w, buf, z); |
| if (r < 0) |
| return r; |
| |
| r = json_variant_set_field(&v, "status", w); |
| if (r < 0) |
| return r; |
| |
| json_variant_unref(h->json); |
| h->json = TAKE_PTR(v); |
| |
| h->bad_authentication_counter = counter; |
| h->last_bad_authentication_usec = usec; |
| |
| h->mask |= USER_RECORD_STATUS; |
| return 0; |
| } |
| |
| int user_record_ratelimit(UserRecord *h) { |
| _cleanup_(json_variant_unrefp) JsonVariant *v = NULL, *w = NULL, *z = NULL; |
| usec_t usec, new_ratelimit_begin_usec, new_ratelimit_count; |
| char buf[SD_ID128_STRING_MAX]; |
| sd_id128_t mid; |
| int r; |
| |
| assert(h); |
| |
| usec = now(CLOCK_REALTIME); |
| |
| if (h->ratelimit_begin_usec != UINT64_MAX && h->ratelimit_begin_usec > usec) { |
| /* Hmm, start-time is after the current time? If so, the RTC most likely doesn't work. */ |
| new_ratelimit_begin_usec = usec; |
| new_ratelimit_count = 1; |
| log_debug("Rate limit timestamp is in the future, assuming incorrect system clock, resetting limit."); |
| } else if (h->ratelimit_begin_usec == UINT64_MAX || |
| usec_add(h->ratelimit_begin_usec, user_record_ratelimit_interval_usec(h)) <= usec) { |
| /* Fresh start */ |
| new_ratelimit_begin_usec = usec; |
| new_ratelimit_count = 1; |
| } else if (h->ratelimit_count < user_record_ratelimit_burst(h)) { |
| /* Count up */ |
| new_ratelimit_begin_usec = h->ratelimit_begin_usec; |
| new_ratelimit_count = h->ratelimit_count + 1; |
| } else |
| /* Limit hit */ |
| return 0; |
| |
| r = sd_id128_get_machine(&mid); |
| if (r < 0) |
| return r; |
| |
| v = json_variant_ref(h->json); |
| w = json_variant_ref(json_variant_by_key(v, "status")); |
| z = json_variant_ref(json_variant_by_key(w, sd_id128_to_string(mid, buf))); |
| |
| r = json_variant_set_field_unsigned(&z, "rateLimitBeginUSec", new_ratelimit_begin_usec); |
| if (r < 0) |
| return r; |
| |
| r = json_variant_set_field_unsigned(&z, "rateLimitCount", new_ratelimit_count); |
| if (r < 0) |
| return r; |
| |
| r = json_variant_set_field(&w, buf, z); |
| if (r < 0) |
| return r; |
| |
| r = json_variant_set_field(&v, "status", w); |
| if (r < 0) |
| return r; |
| |
| json_variant_unref(h->json); |
| h->json = TAKE_PTR(v); |
| |
| h->ratelimit_begin_usec = new_ratelimit_begin_usec; |
| h->ratelimit_count = new_ratelimit_count; |
| |
| h->mask |= USER_RECORD_STATUS; |
| return 1; |
| } |
| |
| int user_record_is_supported(UserRecord *hr, sd_bus_error *error) { |
| assert(hr); |
| |
| if (hr->disposition >= 0 && hr->disposition != USER_REGULAR) |
| return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Cannot manage anything but regular users."); |
| |
| if (hr->storage >= 0 && !IN_SET(hr->storage, USER_LUKS, USER_DIRECTORY, USER_SUBVOLUME, USER_FSCRYPT, USER_CIFS)) |
| return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "User record has storage type this service cannot manage."); |
| |
| if (gid_is_valid(hr->gid) && hr->uid != (uid_t) hr->gid) |
| return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "User record has to have matching UID/GID fields."); |
| |
| if (hr->service && !streq(hr->service, "io.systemd.Home")) |
| return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Not accepted with service not matching io.systemd.Home."); |
| |
| return 0; |
| } |
