lib/crypt: Add helpers for operating on /etc/shadow

[petitboot] / lib / crypt / crypt.c

diff --git a/lib/crypt/crypt.c b/lib/crypt/crypt.c
new file mode 100644 (file)
index 0000000..b5e183a
--- /dev/null
+++ b/lib/crypt/crypt.c
@@ -0,0 +1,217 @@
+/*
+ *  Copyright (C) 2018 IBM Corporation
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; version 2 of the License.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ */
+#include <string.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <shadow.h>
+#include <crypt.h>
+#include <errno.h>
+
+#include <talloc/talloc.h>
+#include <log/log.h>
+
+#include "crypt.h"
+
+int crypt_set_password_hash(void *ctx, const char *hash)
+{
+       struct spwd **shadow, *entry;
+       bool found_root;
+       int rc, i, n;
+       FILE *fp;
+
+       if (lckpwdf()) {
+               pb_log("Could not obtain access to shadow file\n");
+               return -1;
+       }
+       setspent();
+
+       found_root = false;
+       shadow = NULL;
+       n = 0;
+
+       /* Read all entries and modify the root entry */
+       errno = 0;
+       fp = fopen("/etc/shadow", "r");
+       if (!fp) {
+               pb_log("Could not open shadow file, %m\n");
+               rc = -1;
+               goto out;
+       }
+
+       entry = fgetspent(fp);
+       while (entry) {
+               shadow = talloc_realloc(ctx, shadow, struct spwd *, n + 1);
+               if (!shadow) {
+                       pb_log("Failed to allocate shadow struct\n");
+                       rc = -1;
+                       goto out;
+               }
+
+               shadow[n] = talloc_memdup(shadow, entry, sizeof(struct spwd));
+               if (!shadow[n]) {
+                       pb_log("Could not duplicate entry for %s\n",
+                                       entry->sp_namp);
+                       rc = -1;
+                       goto out;
+               }
+
+               shadow[n]->sp_namp = talloc_strdup(shadow, entry->sp_namp);
+               if (strncmp(shadow[n]->sp_namp, "root", strlen("root")) == 0) {
+                       shadow[n]->sp_pwdp = talloc_strdup(shadow, hash);
+                       found_root = true;
+               } else {
+                       shadow[n]->sp_pwdp = talloc_strdup(shadow,
+                                       entry->sp_pwdp);
+               }
+
+               if (!shadow[n]->sp_namp || !shadow[n]->sp_pwdp) {
+                       pb_log("Failed to allocate new fields for %s\n",
+                                       entry->sp_namp);
+                       rc = -1;
+                       goto out;
+               }
+
+               n++;
+               entry = fgetspent(fp);
+       }
+
+       if (n == 0)
+               pb_debug_fn("No entries found\n");
+
+       fclose(fp);
+
+       if (!found_root) {
+               /* Make our own */
+               pb_debug_fn("No root user found, creating entry\n");
+               shadow = talloc_realloc(ctx, shadow, struct spwd *, n + 1);
+               if (!shadow) {
+                       pb_log("Failed to allocate shadow struct\n");
+                       rc = -1;
+                       goto out;
+               }
+
+               shadow[n] = talloc_zero(shadow, struct spwd);
+               shadow[n]->sp_namp = talloc_asprintf(shadow, "root");
+               shadow[n]->sp_pwdp = talloc_strdup(shadow, hash);
+               if (!shadow[n]->sp_namp || !shadow[n]->sp_pwdp) {
+                       pb_log("Failed to allocate new fields for root entry\n");
+                       rc = -1;
+                       goto out;
+               }
+               n++;
+       }
+
+       errno = 0;
+       fp = fopen("/etc/shadow", "w");
+       if (!fp) {
+               pb_log("Could not open shadow file, %m\n");
+               rc = -1;
+               goto out;
+       }
+
+       /* Write each entry back to keep the same format in /etc/shadow */
+       for (i = 0; i < n; i++) {
+               rc = putspent(shadow[i], fp);
+               if (rc)
+                       pb_log("Failed to write back shadow entry for %s!\n",
+                                       shadow[i]->sp_namp);
+       }
+
+       rc = 0;
+out:
+       if (fp)
+               fclose(fp);
+       talloc_free(shadow);
+       endspent();
+       ulckpwdf();
+       return rc;
+}
+
+static const char *crypt_hash_password(const char *password)
+{
+       struct spwd *shadow;
+       char *hash, *salt;
+       char new_salt[17];
+       int i;
+
+       shadow = getspnam("root");
+       if (!shadow) {
+               pb_log("Could not find root shadow\n");
+               return NULL;
+       }
+
+       if (shadow->sp_pwdp && strlen(shadow->sp_pwdp)) {
+               salt = shadow->sp_pwdp;
+       } else {
+               for (i = 0; i < 16; i++)
+                       new_salt[i] = random() % 94 + 32;
+               new_salt[i] = '\0';
+               salt = talloc_asprintf(password, "$6$%s", new_salt);
+       }
+
+       hash = crypt(password ?: "", salt);
+       if (!hash)
+               pb_log("Could not create hash, %m\n");
+
+
+       return hash;
+}
+
+
+int crypt_set_password(void *ctx, const char *password)
+{
+       const char *hash;
+
+       if (!password || !strlen(password))
+               return crypt_set_password_hash(ctx, "");
+
+       hash = crypt_hash_password(password);
+       if (!hash)
+               return -1;
+
+       return crypt_set_password_hash(ctx, hash);
+}
+
+char *crypt_get_hash(void *ctx)
+{
+       struct spwd *shadow;
+
+       shadow = getspnam("root");
+       if (!shadow) {
+               pb_log("Could not find root shadow\n");
+               return false;
+       }
+
+       return talloc_strdup(ctx, shadow->sp_pwdp);
+}
+
+bool crypt_check_password(const char *password)
+{
+       struct spwd *shadow;
+       char *hash;
+
+       shadow = getspnam("root");
+       if (!shadow) {
+               pb_log("Could not find root shadow\n");
+               return false;
+       }
+
+       hash = crypt(password ? : "", shadow->sp_pwdp);
+       if (!hash) {
+               pb_log("Could not create hash, %m\n");
+               return false;
+       }
+
+       return strncmp(shadow->sp_pwdp, hash, strlen(shadow->sp_pwdp)) == 0;
+}