vlock: Handle tty dying

PATCH Applied Kyle Manna 3 participants 5 messages Sep 26, 2014 – Jan 25, 2015

lore

Share & tools

lore

Kyle Manna

author

2014-09-26 05:42 UTC #0 lore raw

PATCH 1/1 vlock: Handle tty dying

Hi guys,

I ran into a problem where if vlock was running over ssh and the ssh session died my system logs would get spammed by the now orphaned vlock process on Arch Linux:

    Sep 25 20:51:12 hostname vlock[31336]: pam_unix(vlock:auth): auth could not identify password for [user]
    Sep 25 20:51:13 hostname vlock[31336]: pam_unix(vlock:auth): auth could not identify password for [user]
    Sep 25 20:51:14 hostname vlock[31336]: pam_unix(vlock:auth): auth could not identify password for [user]

I was able to re-create this in many other situations (ssh, xterm window/tab, tmux window/pane, etc).

The patch know checks for a tty on stdin where PAM will likely ask for the password and exits if it's not found.

From ec97bfb838ff45a1f7c3a640cb29f7eeb2718db3 Mon Sep 17 00:00:00 2001
From: Kyle Manna <[email protected]>
Date: Thu, 25 Sep 2014 22:22:17 -0700
Subject: [PATCH] vlock: Handle tty dying

* Gracefully exit when the parent tty dies.
* Typical causes of death include closing:
* terminal tab or window
* shell
* ssh session
* If no tty exists, I'm not sure what vlock would be locking.

Signed-off-by Kyle Manna <[email protected]>

---
 src/vlock/auth.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

src/vlock/auth.c +11 -0

index da135ce..79b1319 100644
@@ -67,6 +67,17 @@ get_password (pam_handle_t * pamh, const char *username, const char *tty)
 		int     rc;
 		const char *msg;
 
+		/* Ensure that the process has a tty.  If the parent had died,
+		 * stdin/out are likely no longer valid and PAM will fail continuously.
+		 */
+		if (isatty(STDIN_FILENO) != 1)
+		{
+			syslog (LOG_INFO,
+				"TTY %s disappeared for %s by (uid=%u)",
+				tty, username, uid);
+			return EXIT_FAILURE;
+		}
+
 		if (!pamh)
 		{
 			pamh = init_pam (username, tty, 1);

Signature · 1 line

2.1.1

Dmitry V. Levin

2015-01-23 17:46 UTC #1 lore raw

Hi,

Quoted 10 lines · Kyle Manna

Hi guys,
I ran into a problem where if vlock was running over ssh and the ssh session died my system logs would get spammed by the now orphaned vlock process on Arch Linux:
    Sep 25 20:51:12 hostname vlock[31336]: pam_unix(vlock:auth): auth could not identify password for [user]
    Sep 25 20:51:13 hostname vlock[31336]: pam_unix(vlock:auth): auth could not identify password for [user]
    Sep 25 20:51:14 hostname vlock[31336]: pam_unix(vlock:auth): auth could not identify password for [user]

Quoted 5 lines

I was able to re-create this in many other situations (ssh, xterm window/tab, tmux window/pane, etc).
The patch know checks for a tty on stdin where PAM will likely ask for the password and exits if it's not found.

I've never seen this myself because in systems where I use vlock pam_authenticate consistently returns PAM_INCOMPLETE in such cases.

I'll shortly post patches to handle these cases gracefully.

Signature · 1 line

ldv

Dmitry V. Levin

2015-01-23 17:47 UTC #2 lore raw

PATCH 1/2 vlock: move some code around

Move the code that handles PAM_MAXTRIES and PAM_ABORT cases before the code that handles PAM_INCOMPLETE case. This no-op change is only needed to make the next change easier to read.

---
 src/vlock/auth.c | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

src/vlock/auth.c +13 ~~-13~~

index da135ce..dc47ee8 100644
@@ -130,6 +130,19 @@ get_password (pam_handle_t * pamh, const char *username, const char *tty)
 					locked_name (), tty, username, uid);
 				return EXIT_SUCCESS;
 
+			case PAM_MAXTRIES:
+			case PAM_ABORT:
+				msg = pam_strerror (pamh, rc);
+				/* Log the fact of failure. */
+				syslog (LOG_WARNING, "%s", msg);
+				printf ("%s.\n\n\n", msg);
+				fflush (stdout);
+				msg = 0;
+				pam_end (pamh, rc);
+				pamh = 0;
+				sleep (LONG_DELAY);
+				break;
+
 			case PAM_INCOMPLETE:
 				/*
 				 * EOF encountered on read?

@@ -149,19 +162,6 @@ get_password (pam_handle_t * pamh, const char *username, const char *tty)
 					locked_name (), tty, username, uid);
 				return EXIT_FAILURE;
 
-			case PAM_MAXTRIES:
-			case PAM_ABORT:
-				msg = pam_strerror (pamh, rc);
-				/* Log the fact of failure. */
-				syslog (LOG_WARNING, "%s", msg);
-				printf ("%s.\n\n\n", msg);
-				fflush (stdout);
-				msg = 0;
-				pam_end (pamh, rc);
-				pamh = 0;
-				sleep (LONG_DELAY);
-				break;
-
 			default:
 				printf ("%s.\n\n\n", pam_strerror (pamh, rc));
 				fflush (stdout);

Signature · 1 line

ldv

Dmitry V. Levin

2015-01-23 17:49 UTC #3 lore raw

PATCH 2/2 vlock: handle disappearing ttys gracefully

In reply to Dmitry V. Levin

vlock used to check for disappearing ttys after PAM_INCOMPLETE error returned by pam_authenticate. This change extends the check to cover other non-fatal error codes that could be returned by pam_authenticate.

Reported-by Kyle Manna <[email protected]>

---
 src/vlock/auth.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

src/vlock/auth.c +3 -6

index dc47ee8..eddce51 100644
@@ -143,7 +143,9 @@ get_password (pam_handle_t * pamh, const char *username, const char *tty)
 				sleep (LONG_DELAY);
 				break;
 
-			case PAM_INCOMPLETE:
+			default:
+				printf ("%s.\n\n\n", pam_strerror (pamh, rc));
+				fflush (stdout);
 				/*
 				 * EOF encountered on read?
 				 * If not on VT, check stdin.

@@ -161,11 +163,6 @@ get_password (pam_handle_t * pamh, const char *username, const char *tty)
 					"Cancelled lock of %s on %s for %s by (uid=%u)",
 					locked_name (), tty, username, uid);
 				return EXIT_FAILURE;
-
-			default:
-				printf ("%s.\n\n\n", pam_strerror (pamh, rc));
-				fflush (stdout);
-				sleep (SHORT_DELAY);
 		}
 	}
 }

Signature · 1 line

ldv

Alexey Gladkov

Applied

2015-01-25 11:18 UTC #4 lore raw

In reply to Dmitry V. Levin

23.01.2015 20:46, Dmitry V. Levin пишет:

Quoted 16 lines

Hi,
Quoted 13 lines · Kyle Manna
Hi guys,
I ran into a problem where if vlock was running over ssh and the ssh session died my system logs would get spammed by the now orphaned vlock process on Arch Linux:
    Sep 25 20:51:12 hostname vlock[31336]: pam_unix(vlock:auth): auth could not identify password for [user]
    Sep 25 20:51:13 hostname vlock[31336]: pam_unix(vlock:auth): auth could not identify password for [user]
    Sep 25 20:51:14 hostname vlock[31336]: pam_unix(vlock:auth): auth could not identify password for [user]
I was able to re-create this in many other situations (ssh, xterm window/tab, tmux window/pane, etc).

Quoted 7 lines

Quoted 2 lines
The patch know checks for a tty on stdin where PAM will likely ask for the password and exits if it's not found.
I've never seen this myself because in systems where I use vlock pam_authenticate consistently returns PAM_INCOMPLETE in such cases.
I'll shortly post patches to handle these cases gracefully.

Applied. Thanks a lot!

Signature · 1 line

Rgrds, legion