94 lines
2.2 KiB
Bash
Executable File
94 lines
2.2 KiB
Bash
Executable File
#!/bin/sh
|
|
set -eu
|
|
|
|
if [ "$(id -u)" -ne 0 ]; then
|
|
echo "pam-fixture: SKIP (root is required to install a temporary PAM policy)"
|
|
exit 0
|
|
fi
|
|
|
|
service="latchd-fixture-$$"
|
|
session_service="latchd-session-fixture-$$"
|
|
policy="/etc/pam.d/$service"
|
|
session_policy="/etc/pam.d/$session_service"
|
|
checker="/tmp/latchd-pam-session-check-$$"
|
|
module_source="/tmp/latchd-pam-session-env-$$.c"
|
|
module="/tmp/latchd-pam-session-env-$$.so"
|
|
cleanup() {
|
|
rm -f "$policy" "$session_policy" "$checker" "$module_source" "$module"
|
|
}
|
|
trap cleanup EXIT HUP INT TERM
|
|
|
|
umask 077
|
|
cat >"$policy" <<'PAM'
|
|
auth required pam_deny.so
|
|
account required pam_permit.so
|
|
password required pam_deny.so
|
|
session required pam_permit.so
|
|
PAM
|
|
|
|
cat >"$checker" <<'SH'
|
|
#!/bin/sh
|
|
set -eu
|
|
|
|
[ "${PAM_TTY:-}" = "tty2" ]
|
|
[ "${XDG_SESSION_CLASS:-}" = "user" ]
|
|
[ "${XDG_SESSION_TYPE:-}" = "wayland" ]
|
|
[ "${XDG_SESSION_DESKTOP:-}" = "niri" ]
|
|
[ "${XDG_SEAT:-}" = "seat0" ]
|
|
[ "${XDG_VTNR:-}" = "2" ]
|
|
SH
|
|
chmod 700 "$checker"
|
|
|
|
cat >"$module_source" <<'C'
|
|
#include <security/pam_appl.h>
|
|
#include <security/pam_modules.h>
|
|
|
|
PAM_EXTERN int pam_sm_open_session(
|
|
pam_handle_t *pamh,
|
|
int flags,
|
|
int argc,
|
|
const char **argv
|
|
) {
|
|
int result;
|
|
(void)flags;
|
|
(void)argc;
|
|
(void)argv;
|
|
|
|
result = pam_putenv(pamh, "XDG_SESSION_ID=fixture-session");
|
|
if (result != PAM_SUCCESS) return result;
|
|
result = pam_putenv(pamh, "XDG_RUNTIME_DIR=/tmp/latchd-runtime-fixture");
|
|
if (result != PAM_SUCCESS) return result;
|
|
return pam_putenv(
|
|
pamh,
|
|
"DBUS_SESSION_BUS_ADDRESS=unix:path=/tmp/latchd-runtime-fixture/bus"
|
|
);
|
|
}
|
|
|
|
PAM_EXTERN int pam_sm_close_session(
|
|
pam_handle_t *pamh,
|
|
int flags,
|
|
int argc,
|
|
const char **argv
|
|
) {
|
|
(void)pamh;
|
|
(void)flags;
|
|
(void)argc;
|
|
(void)argv;
|
|
return PAM_SUCCESS;
|
|
}
|
|
C
|
|
${CC:-cc} -shared -fPIC "$module_source" -o "$module" -lpam
|
|
chmod 700 "$module"
|
|
|
|
cat >"$session_policy" <<PAM
|
|
auth required pam_permit.so
|
|
account required pam_permit.so
|
|
password required pam_deny.so
|
|
session required $module
|
|
session required pam_exec.so $checker
|
|
PAM
|
|
|
|
LATCHD_PAM_FIXTURE_SERVICE="$service" \
|
|
LATCHD_PAM_SESSION_FIXTURE_SERVICE="$session_service" \
|
|
cargo test --locked -p latchd-auth --test pam_fixture -- --ignored
|