From 3efa319b43fb1f66a96e5001c9e5cba51f854370 Mon Sep 17 00:00:00 2001 From: Dhaval Giani Date: Fri, 15 Aug 2008 19:52:13 +0000 Subject: libcgroup: A simple pam module (pam_cgroup.so) for task placement in right cgroup From: Vivek Goyal o A simple pam module pam_cgroup for placement of tasks in right cgroup. Details are available in documentation. o This pam module will be included in libcgroup source and not in pam sources. o Copyright notice looks little odd as I copied the original copyright notice of pam_limits.c. Any suggestions for improvement are welcome. Signed-off-by: Vivek Goyal Signed-off-by: Dhaval Giani git-svn-id: https://libcg.svn.sourceforge.net/svnroot/libcg/trunk@162 4f4bb910-9a46-0410-90c8-c897d4f1cd53 --- Makefile.in | 7 ++- README | 24 +++++++-- pam_cgroup.c | 162 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 188 insertions(+), 5 deletions(-) create mode 100644 pam_cgroup.c diff --git a/Makefile.in b/Makefile.in index a36a5f4..90147dd 100644 --- a/Makefile.in +++ b/Makefile.in @@ -55,6 +55,10 @@ libcgroup.so: api.c libcgroup.h wrapper.c test: $(MAKE) -C tests +pam_cgroup.so: pam_cgroup.c + $(CC) $(CFLAGS) -shared -fPIC -Wall -o $@ pam_cgroup.c $(LDFLAGS) \ + $(LIBS) -lpam + install: libcgroup.so cgexec cgclassify $(INSTALL_DATA) -D libcgroup.h $(DESTDIR)$(includedir)/libcgroup.h $(INSTALL) -D libcgroup.so $(DESTDIR)$(libdir)/libcgroup-$(PACKAGE_VERSION).so @@ -75,4 +79,5 @@ uninstall: libcgroup.so clean: \rm -f y.tab.c y.tab.h lex.yy.c y.output libcgroup.so cgclassify\ - libcgroup.so.$(VERSION) cgconfigparser config.log config.status cgexec + libcgroup.so.$(VERSION) cgconfigparser config.log config.status cgexec \ + pam_cgroup.so diff --git a/README b/README index 0835004..34ca090 100644 --- a/README +++ b/README @@ -50,7 +50,7 @@ cgroups. - Use pam_cgroup PAM plugin which will make sure users are placed in right cgroup at login time and any tasks launch after login, will continue to run - in user's cgroup. (PAM module is still on TODO list) + in user's cgroup. - Use command line tool "cgexec" to launch the task in right cgroup. @@ -113,14 +113,15 @@ Section 3: To use a pam plugin which will automatically place the task in right cgroup upon login. -- Download pam source tree and apply the patch for pam_cgroup module. - Build pam_cgroup.so - ./configure; make + make pam_cgroup.so - Copy pam_cgroup.so to /lib/security/ - Edit /etc/pam.d/su to make use of pam_cgroup.so session module upon execution of su. -example: Add following line to the end. +example: + Add following line at the end of /etc/pam.d/su file + session optional pam_cgroup.so - Now launch a shell for a user "xyz" using su and the resulting shell @@ -129,6 +130,21 @@ session optional pam_cgroup.so ex. "su test1" +Try similar things with other services like sshd. + +Note: pam_cgroup.so moves the service providing process in the right cgroup + and not the process which will be launched later. Due to parent child + relationship, yet to be forked/execed process will launch in right + group. + +Ex. Lets say user root does "su test1". In this case process "su" is the + one providing service (launching a shell) for user "test1". pam_cgroup.so + will move process "su" to the user "test1"'s cgroup (Decided by the uid + and gid of "test1"). Now once su forks/execs a shell for user test1, + final shell is effectively running in the cgroup it should have been + running based on /etc/cgrules.conf for user test1. + + Section 4: ---------- To use cgrulesengd which will move a task to right cgroup based on diff --git a/pam_cgroup.c b/pam_cgroup.c new file mode 100644 index 0000000..c4ce633 --- /dev/null +++ b/pam_cgroup.c @@ -0,0 +1,162 @@ +/* + * Copyright RedHat Inc. 2008 + * + * Author: Vivek Goyal + * + * Derived from pam_limits.c. Original Copyright notice follows. + * + * Copyright (c) Cristian Gafton, 1996-1997, + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, and the entire permission notice in its entirety, + * including the disclaimer of warranties. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. The name of the author may not be used to endorse or promote + * products derived from this software without specific prior + * written permission. + * + * ALTERNATIVELY, this product may be distributed under the terms of + * the GNU Public License, in which case the provisions of the GPL are + * required INSTEAD OF the above restrictions. (This clause is + * necessary due to a potential bad interaction between the GPL and + * the restrictions contained in a BSD-style copyright.) + * + * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED + * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, + * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES + * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR + * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * + * End of original copyright notice. + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of version 2.1 of the GNU Lesser General Public License + * as published by the Free Software Foundation. + * + * This program is distributed in the hope that it would be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include + +/* + * Module defines + */ + +#define PAM_SM_SESSION + +#include +#include +#include +#include + +/* argument parsing */ + +#define PAM_DEBUG_ARG 0x0001 + +static int _pam_parse(const pam_handle_t *pamh, int argc, const char **argv) +{ + int ctrl = 0; + + /* step through arguments */ + for (ctrl = 0; argc-- > 0; ++argv) { + if (!strcmp(*argv, "debug")) + ctrl |= PAM_DEBUG_ARG; + else + pam_syslog(pamh, LOG_ERR, "unknown option: %s", *argv); + } + + return ctrl; +} + +/* now the session stuff */ +PAM_EXTERN int pam_sm_open_session(pam_handle_t *pamh, int flags, + int argc, const char **argv) +{ + pid_t pid; + int ctrl, ret; + char *user_name; + struct passwd *pwd; + + D(("called.")); + + ctrl = _pam_parse(pamh, argc, argv); + + ret = pam_get_item(pamh, PAM_USER, (void *) &user_name); + if (user_name == NULL || ret != PAM_SUCCESS) { + pam_syslog(pamh, LOG_ERR, "open_session - error recovering" + "username"); + return PAM_SESSION_ERR; + } + + pwd = pam_modutil_getpwnam(pamh, user_name); + if (!pwd) { + if (ctrl & PAM_DEBUG_ARG) + pam_syslog(pamh, LOG_ERR, "open_session username" + " '%s' does not exist", user_name); + return PAM_SESSION_ERR; + } + + D(("user name is %s", user_name)); + + /* Initialize libcg */ + ret = cgroup_init(); + if (ret) { + if (ctrl & PAM_DEBUG_ARG) + pam_syslog(pamh, LOG_ERR, "libcgroup initialization" + " failed"); + return PAM_SESSION_ERR; + } + + D(("Initialized libcgroup successfuly.")); + + /* Determine the pid of the task */ + pid = getpid(); + + /* Note: We are using default gid here. Is there a way to determine + * under what egid service will be provided? + */ + ret = cgroup_change_cgroup_uid_gid(pwd->pw_uid, pwd->pw_gid, pid); + if (ret) { + if (ctrl & PAM_DEBUG_ARG) + pam_syslog(pamh, LOG_ERR, "Change of cgroup for process" + " with username %s failed.\n", user_name); + return PAM_SESSION_ERR; + } + + if (ctrl & PAM_DEBUG_ARG) + pam_syslog(pamh, LOG_DEBUG, "Changed cgroup for process %d" + " with username %s.\n", pid, user_name); + + return PAM_SUCCESS; +} + +PAM_EXTERN int pam_sm_close_session(pam_handle_t *pamh, int flags, int argc, + const char **argv) +{ + D(("called pam_cgroup close session")); + + /* nothing to do yet */ + return PAM_SUCCESS; +} -- cgit