From 7e7252616137378731af75a8482d4a4cade33dbd Mon Sep 17 00:00:00 2001

From: Sumit Bose <sbose@redhat.com>

Date: Tue, 9 Oct 2018 10:47:04 +0200

Subject: [PATCH 45/47] PAM: add p11_uri option

Related to https://pagure.io/SSSD/sssd/issue/3814

Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

(cherry picked from commit 725b65081d19da658b16338686c53dcf16d49de0)

---

 src/confdb/confdb.h                  |  1 +

 src/config/SSSDConfig/__init__.py.in |  1 +

 src/config/cfg_rules.ini             |  1 +

 src/config/etc/sssd.api.conf         |  1 +

 src/man/sssd.conf.5.xml              | 33 +++++++++++++++++++++++++++++++++

 src/responder/pam/pamsrv.h           |  1 +

 src/responder/pam/pamsrv_cmd.c       | 12 +++++++++++-

 src/responder/pam/pamsrv_p11.c       |  9 ++++++++-

 8 files changed, 57 insertions(+), 2 deletions(-)

diff --git a/src/confdb/confdb.h b/src/confdb/confdb.h

index 87904c2146b33b57106ac3799c5a67ee02387e9b..741d4bc47dc77fe23e2ff0bc683354909f61d88f 100644

--- a/src/confdb/confdb.h

+++ b/src/confdb/confdb.h

@@ -133,6 +133,7 @@

 #define CONFDB_PAM_WAIT_FOR_CARD_TIMEOUT "p11_wait_for_card_timeout"

 #define CONFDB_PAM_APP_SERVICES "pam_app_services"

 #define CONFDB_PAM_P11_ALLOWED_SERVICES "pam_p11_allowed_services"

+#define CONFDB_PAM_P11_URI "p11_uri"

 /* SUDO */

 #define CONFDB_SUDO_CONF_ENTRY "config/sudo"

diff --git a/src/config/SSSDConfig/__init__.py.in b/src/config/SSSDConfig/__init__.py.in

index 4d1dba2d22eae4716fbabe3a3957952f7cd17751..a20157c719765a847a872fe134afe5e0415296db 100644

--- a/src/config/SSSDConfig/__init__.py.in

+++ b/src/config/SSSDConfig/__init__.py.in

@@ -105,6 +105,7 @@ option_strings = {

     'pam_app_services' : _('Which PAM services are permitted to contact application domains'),

     'pam_p11_allowed_services' : _('Allowed services for using smartcards'),

     'p11_wait_for_card_timeout' : _('Additional timeout to wait for a card if requested'),

+    'p11_uri' : _('PKCS#11 URI to restrict the selection of devices for Smartcard authentication'),

     # [sudo]

     'sudo_timed' : _('Whether to evaluate the time-based attributes in sudo rules'),

diff --git a/src/config/cfg_rules.ini b/src/config/cfg_rules.ini

index 717ccfa3f382b92800bf00ed79f68641a5a83d5c..85366d25dfe508c0faf92d7d0891e287eb66dbe0 100644

--- a/src/config/cfg_rules.ini

+++ b/src/config/cfg_rules.ini

@@ -128,6 +128,7 @@ option = p11_child_timeout

 option = pam_app_services

 option = pam_p11_allowed_services

 option = p11_wait_for_card_timeout

+option = p11_uri

 [rule/allowed_sudo_options]

 validator = ini_allowed_options

diff --git a/src/config/etc/sssd.api.conf b/src/config/etc/sssd.api.conf

index bb686c34480be27d0829b57a853fa05921730630..c6d6690fb44cafb19b0a01b286812c74cdb2fc71 100644

--- a/src/config/etc/sssd.api.conf

+++ b/src/config/etc/sssd.api.conf

@@ -77,6 +77,7 @@ p11_child_timeout = int, None, false

 pam_app_services = str, None, false

 pam_p11_allowed_services = str, None, false

 p11_wait_for_card_timeout = int, None, false

+p11_uri = str, None, false

 [sudo]

 # sudo service

diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml

index 4df0163311fb3845e6a027be7d0b500cb5d2f0b6..c8d53f01f3eedea1e37f6593d02ce1eeaf11d2de 100644

--- a/src/man/sssd.conf.5.xml

+++ b/src/man/sssd.conf.5.xml

@@ -1478,6 +1478,39 @@ pam_p11_allowed_services = +my_pam_service, -login

                         </para>

                     </listitem>

                 </varlistentry>

+                <varlistentry>

+                    <term>p11_uri (string)</term>

+                    <listitem>

+                        <para>

+                            PKCS#11 URI (see RFC-7512 for details) which can be

+                            used to restrict the selection of devices used for

+                            Smartcard authentication. By default SSSD's

+                            p11_child will search for a PKCS#11 slot (reader)

+                            where the 'removable' flags is set and read the

+                            certificates from the inserted token from the first

+                            slot found. If multiple readers are connected

+                            p11_uri can be use to tell p11_child to use a

+                            specific reader.

+                        </para>

+                        <para>

+                            Example:

+                            <programlisting>

+p11_uri = slot-description=My%20Smartcar%20Reader

+                            </programlisting>

+                            or

+                            <programlisting>

+p11_uri = library-description=OpenSC%20smartcard%20framework;slot-id=2

+                            </programlisting>

+                            To find suitable URI please check the debug output

+                            of p11_child. As an alternative the GnuTLS utility

+                            'p11tool' with e.g. the '--list-all' will show

+                            PKCS#11 URIs as well.

+                        </para>

+                        <para>

+                            Default: none

+                        </para>

+                    </listitem>

+                </varlistentry>

             </variablelist>

         </refsect2>

diff --git a/src/responder/pam/pamsrv.h b/src/responder/pam/pamsrv.h

index 5d877566fc7bacced4f6385f1eae344a9e6d8bd4..60aa97967456b9b7ab35e64f103c1c9a17bef3a9 100644

--- a/src/responder/pam/pamsrv.h

+++ b/src/responder/pam/pamsrv.h

@@ -103,6 +103,7 @@ struct tevent_req *pam_check_cert_send(TALLOC_CTX *mem_ctx,

                                        time_t timeout,

                                        const char *verify_opts,

                                        struct sss_certmap_ctx *sss_certmap_ctx,

+                                       const char *uri,

                                        struct pam_data *pd);

 errno_t pam_check_cert_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,

                             struct cert_auth_info **cert_list);

diff --git a/src/responder/pam/pamsrv_cmd.c b/src/responder/pam/pamsrv_cmd.c

index 6e37f831602e4c367176cc14126dbbec72c858cd..a22afd225894872847a0fb13e202f927fd2ae124 100644

--- a/src/responder/pam/pamsrv_cmd.c

+++ b/src/responder/pam/pamsrv_cmd.c

@@ -1306,6 +1306,7 @@ static errno_t check_cert(TALLOC_CTX *mctx,

     char *cert_verification_opts;

     errno_t ret;

     struct tevent_req *req;

+    char *uri = NULL;

     ret = confdb_get_int(pctx->rctx->cdb, CONFDB_PAM_CONF_ENTRY,

                          CONFDB_PAM_P11_CHILD_TIMEOUT,

@@ -1342,10 +1343,19 @@ static errno_t check_cert(TALLOC_CTX *mctx,

         return ret;

     }

+    ret = confdb_get_string(pctx->rctx->cdb, mctx, CONFDB_PAM_CONF_ENTRY,

+                            CONFDB_PAM_P11_URI, NULL, &uri);

+    if (ret != EOK) {

+        DEBUG(SSSDBG_CRIT_FAILURE,

+              "Failed to read certificate_verification from confdb: [%d]: %s\n",

+              ret, sss_strerror(ret));

+        return ret;

+    }

+

     req = pam_check_cert_send(mctx, ev, pctx->p11_child_debug_fd,

                               pctx->nss_db, p11_child_timeout,

                               cert_verification_opts, pctx->sss_certmap_ctx,

-                              pd);

+                              uri, pd);

     if (req == NULL) {

         DEBUG(SSSDBG_OP_FAILURE, "pam_check_cert_send failed.\n");

         return ENOMEM;

diff --git a/src/responder/pam/pamsrv_p11.c b/src/responder/pam/pamsrv_p11.c

index 8b8859d9d335aec6d310201256522fa8afdd3694..491bd2b01d7bf9137b37c35f9da9eca1eed95a6d 100644

--- a/src/responder/pam/pamsrv_p11.c

+++ b/src/responder/pam/pamsrv_p11.c

@@ -711,6 +711,7 @@ struct tevent_req *pam_check_cert_send(TALLOC_CTX *mem_ctx,

                                        time_t timeout,

                                        const char *verify_opts,

                                        struct sss_certmap_ctx *sss_certmap_ctx,

+                                       const char *uri,

                                        struct pam_data *pd)

 {

     errno_t ret;

@@ -721,7 +722,7 @@ struct tevent_req *pam_check_cert_send(TALLOC_CTX *mem_ctx,

     struct timeval tv;

     int pipefd_to_child[2] = PIPE_INIT;

     int pipefd_from_child[2] = PIPE_INIT;

-    const char *extra_args[14] = { NULL };

+    const char *extra_args[16] = { NULL };

     uint8_t *write_buf = NULL;

     size_t write_buf_len = 0;

     size_t arg_c;

@@ -748,6 +749,12 @@ struct tevent_req *pam_check_cert_send(TALLOC_CTX *mem_ctx,

     /* extra_args are added in revers order */

     arg_c = 0;

+    if (uri != NULL) {

+        DEBUG(SSSDBG_TRACE_ALL, "Adding PKCS#11 URI [%s].\n", uri);

+        extra_args[arg_c++] = uri;

+        extra_args[arg_c++] = "--uri";

+    }

+

     if ((pd->cli_flags & PAM_CLI_FLAGS_REQUIRE_CERT_AUTH) && pd->priv == 1) {

         extra_args[arg_c++] = "--wait_for_card";

     }

-- 

2.14.4