2 changed files with 294 additions and 0 deletions
@ -0,0 +1,263 @@ |
|||
+++ LICENSE-slock
|
|||
@@ -0,0 +1,24 @@
|
|||
+MIT/X Consortium License
|
|||
+
|
|||
+© 2015-2016 Markus Teich <markus.teich@stusta.mhn.de>
|
|||
+© 2014 Dimitris Papastamos <sin@2f30.org>
|
|||
+© 2006-2014 Anselm R Garbe <anselm@garbe.us>
|
|||
+© 2014-2016 Laslo Hunhold <dev@frign.de>
|
|||
+
|
|||
+Permission is hereby granted, free of charge, to any person obtaining a
|
|||
+copy of this software and associated documentation files (the "Software"),
|
|||
+to deal in the Software without restriction, including without limitation
|
|||
+the rights to use, copy, modify, merge, publish, distribute, sublicense,
|
|||
+and/or sell copies of the Software, and to permit persons to whom the
|
|||
+Software is furnished to do so, subject to the following conditions:
|
|||
+
|
|||
+The above copyright notice and this permission notice shall be included in
|
|||
+all copies or substantial portions of the Software.
|
|||
+
|
|||
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|||
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|||
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
|
|||
+THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|||
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
|
|||
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
|
|||
+DEALINGS IN THE SOFTWARE.
|
|||
+++ Makefile
|
|||
@@ -14,7 +14,7 @@
|
|||
CPPFLAGS += -D_GNU_SOURCE |
|||
CFLAGS += $(shell $(PKG_CONFIG) --cflags cairo xcb-dpms xcb-xinerama xcb-atom xcb-image xcb-xkb xkbcommon xkbcommon-x11) |
|||
LIBS += $(shell $(PKG_CONFIG) --libs cairo xcb-dpms xcb-xinerama xcb-atom xcb-image xcb-xkb xkbcommon xkbcommon-x11) |
|||
-LIBS += -lpam
|
|||
+LIBS += -lcrypt
|
|||
LIBS += -lev |
|||
LIBS += -lm |
|||
|
|||
@@ -37,9 +37,7 @@
|
|||
|
|||
install: all |
|||
$(INSTALL) -d $(DESTDIR)$(PREFIX)/bin |
|||
- $(INSTALL) -d $(DESTDIR)$(SYSCONFDIR)/pam.d
|
|||
$(INSTALL) -m 755 i3lock $(DESTDIR)$(PREFIX)/bin/i3lock |
|||
- $(INSTALL) -m 644 i3lock.pam $(DESTDIR)$(SYSCONFDIR)/pam.d/i3lock
|
|||
|
|||
uninstall: |
|||
rm -f $(DESTDIR)$(PREFIX)/bin/i3lock |
|||
+++ i3lock.1
|
|||
@@ -45,8 +45,6 @@
|
|||
You can specify either a background color or a PNG image which will be displayed while your screen is locked. |
|||
.IP \[bu] |
|||
You can specify whether i3lock should bell upon a wrong password. |
|||
-.IP \[bu]
|
|||
-i3lock uses PAM and therefore is compatible with LDAP, etc.
|
|||
|
|||
|
|||
.SH OPTIONS |
|||
@@ -75,7 +73,7 @@
|
|||
.B \-u, \-\-no-unlock-indicator |
|||
Disable the unlock indicator. i3lock will by default show an unlock indicator |
|||
after pressing keys. This will give feedback for every keypress and it will |
|||
-show you the current PAM state (whether your password is currently being
|
|||
+show you the current state (whether your password is currently being
|
|||
verified or whether it is wrong). |
|||
|
|||
.TP |
|||
@@ -104,7 +102,7 @@
|
|||
.TP |
|||
.B \-e, \-\-ignore-empty-password |
|||
When an empty password is provided by the user, do not validate |
|||
-it. Without this option, the empty password will be provided to PAM
|
|||
+it. Without this option, the empty password will be checked
|
|||
and, if invalid, the user will have to wait a few seconds before |
|||
another try. This can be useful if the XF86ScreenSaver key is used to |
|||
put a laptop to sleep and bounce on resume or if you happen to wake up |
|||
+++ i3lock.c
|
|||
@@ -18,7 +18,6 @@
|
|||
#include <xcb/xkb.h> |
|||
#include <err.h> |
|||
#include <assert.h> |
|||
-#include <security/pam_appl.h>
|
|||
#include <getopt.h> |
|||
#include <string.h> |
|||
#include <ev.h> |
|||
@@ -28,6 +27,8 @@
|
|||
#include <xkbcommon/xkbcommon-x11.h> |
|||
#include <cairo.h> |
|||
#include <cairo/cairo-xcb.h> |
|||
+#include <unistd.h>
|
|||
+#include <shadow.h>
|
|||
|
|||
#include "i3lock.h" |
|||
#include "xcb.h" |
|||
@@ -49,10 +50,10 @@
|
|||
uint32_t last_resolution[2]; |
|||
xcb_window_t win; |
|||
static xcb_cursor_t cursor; |
|||
-static pam_handle_t *pam_handle;
|
|||
int input_position = 0; |
|||
/* Holds the password you enter (in UTF-8). */ |
|||
static char password[512]; |
|||
+const char *pws = NULL;
|
|||
static bool beep = false; |
|||
bool debug_mode = false; |
|||
bool unlock_indicator = true; |
|||
@@ -80,6 +81,39 @@
|
|||
bool ignore_empty_password = false; |
|||
bool skip_repeated_empty_password = false; |
|||
|
|||
+/*
|
|||
+ * Shamelessly stolen from slock. See LICENSE-slock.
|
|||
+ * This adjusts the process' out of memory score,
|
|||
+ * so it isn't killed by the kernel under any circumstances.
|
|||
+ */
|
|||
+#ifdef __linux__
|
|||
+#include <fcntl.h>
|
|||
+#include <linux/oom.h>
|
|||
+#include <errno.h>
|
|||
+
|
|||
+static void
|
|||
+dontkillme(void)
|
|||
+{
|
|||
+ int fd;
|
|||
+ int length;
|
|||
+ char value[64];
|
|||
+
|
|||
+ fd = open("/proc/self/oom_score_adj", O_WRONLY);
|
|||
+ if (fd < 0 && errno == ENOENT)
|
|||
+ return;
|
|||
+
|
|||
+ /* convert OOM_SCORE_ADJ_MIN to string for writing */
|
|||
+ length = snprintf(value, sizeof(value), "%d\n", OOM_SCORE_ADJ_MIN);
|
|||
+
|
|||
+ /* bail on truncation */
|
|||
+ if (length >= sizeof(value))
|
|||
+ errx(EXIT_FAILURE, "buffer too small\n");
|
|||
+
|
|||
+ if (fd < 0 || write(fd, value, length) != length || close(fd) != 0)
|
|||
+ errx(EXIT_FAILURE, "cannot disable the out-of-memory killer for this process (make sure to suid or sgid i3lock)\n");
|
|||
+}
|
|||
+#endif
|
|||
+
|
|||
/* isutf, u8_dec © 2005 Jeff Bezanson, public domain */ |
|||
#define isutf(c) (((c)&0xC0) != 0x80) |
|||
|
|||
@@ -235,17 +269,10 @@
|
|||
unlock_state = STATE_STARTED; |
|||
redraw_screen(); |
|||
|
|||
- if (pam_authenticate(pam_handle, 0) == PAM_SUCCESS) {
|
|||
+ if (!strcmp(crypt(password, pws), pws)) {
|
|||
DEBUG("successfully authenticated\n"); |
|||
clear_password_memory(); |
|||
|
|||
- /* PAM credentials should be refreshed, this will for example update any kerberos tickets.
|
|||
- * Related to credentials pam_end() needs to be called to cleanup any temporary
|
|||
- * credentials like kerberos /tmp/krb5cc_pam_* files which may of been left behind if the
|
|||
- * refresh of the credentials failed. */
|
|||
- pam_setcred(pam_handle, PAM_REFRESH_CRED);
|
|||
- pam_end(pam_handle, PAM_SUCCESS);
|
|||
-
|
|||
exit(0); |
|||
} |
|||
|
|||
@@ -580,37 +607,6 @@
|
|||
} |
|||
|
|||
/* |
|||
- * Callback function for PAM. We only react on password request callbacks.
|
|||
- *
|
|||
- */
|
|||
-static int conv_callback(int num_msg, const struct pam_message **msg,
|
|||
- struct pam_response **resp, void *appdata_ptr) {
|
|||
- if (num_msg == 0)
|
|||
- return 1;
|
|||
-
|
|||
- /* PAM expects an array of responses, one for each message */
|
|||
- if ((*resp = calloc(num_msg, sizeof(struct pam_response))) == NULL) {
|
|||
- perror("calloc");
|
|||
- return 1;
|
|||
- }
|
|||
-
|
|||
- for (int c = 0; c < num_msg; c++) {
|
|||
- if (msg[c]->msg_style != PAM_PROMPT_ECHO_OFF &&
|
|||
- msg[c]->msg_style != PAM_PROMPT_ECHO_ON)
|
|||
- continue;
|
|||
-
|
|||
- /* return code is currently not used but should be set to zero */
|
|||
- resp[c]->resp_retcode = 0;
|
|||
- if ((resp[c]->resp = strdup(password)) == NULL) {
|
|||
- perror("strdup");
|
|||
- return 1;
|
|||
- }
|
|||
- }
|
|||
-
|
|||
- return 0;
|
|||
-}
|
|||
-
|
|||
-/*
|
|||
* This callback is only a dummy, see xcb_prepare_cb and xcb_check_cb. |
|||
* See also man libev(3): "ev_prepare" and "ev_check" - customise your event loop |
|||
* |
|||
@@ -764,8 +760,6 @@
|
|||
struct passwd *pw; |
|||
char *username; |
|||
char *image_path = NULL; |
|||
- int ret;
|
|||
- struct pam_conv conv = {conv_callback, NULL};
|
|||
int curs_choice = CURS_NONE; |
|||
int o; |
|||
int optind = 0; |
|||
@@ -791,6 +785,30 @@
|
|||
if ((username = pw->pw_name) == NULL) |
|||
errx(EXIT_FAILURE, "pw->pw_name is NULL.\n"); |
|||
|
|||
+ /*
|
|||
+ * This piece of code is shamelessly stolen from slock.
|
|||
+ * See LICENSE-slock.
|
|||
+ */
|
|||
+#ifdef __linux__
|
|||
+ dontkillme();
|
|||
+#endif
|
|||
+
|
|||
+ pws = pw->pw_passwd;
|
|||
+
|
|||
+ if (pws[0] == 'x' && pws[1] == '\0') {
|
|||
+ struct spwd *sp;
|
|||
+ if (!(sp = getspnam(getenv("USER"))))
|
|||
+ errx(EXIT_FAILURE, "cannot retrieve shadow entry (make sure to suid or sgid i3lock)\n");
|
|||
+ pws = sp->sp_pwdp;
|
|||
+ }
|
|||
+
|
|||
+ /* drop privileges */
|
|||
+ if (geteuid() == 0 &&
|
|||
+ ((getegid() != pw->pw_gid && setgid(pw->pw_gid) < 0) || setuid(pw->pw_uid) < 0))
|
|||
+ errx(EXIT_FAILURE, "cannot drop privileges\n");
|
|||
+
|
|||
+ /* End of stolen code */
|
|||
+
|
|||
char *optstring = "hvnbdc:p:ui:teI:f"; |
|||
while ((o = getopt_long(argc, argv, optstring, longopts, &optind)) != -1) { |
|||
switch (o) { |
|||
@@ -862,13 +880,6 @@
|
|||
* the unlock indicator upon keypresses. */ |
|||
srand(time(NULL)); |
|||
|
|||
- /* Initialize PAM */
|
|||
- if ((ret = pam_start("i3lock", username, &conv, &pam_handle)) != PAM_SUCCESS)
|
|||
- errx(EXIT_FAILURE, "PAM: %s", pam_strerror(pam_handle, ret));
|
|||
-
|
|||
- if ((ret = pam_set_item(pam_handle, PAM_TTY, getenv("DISPLAY"))) != PAM_SUCCESS)
|
|||
- errx(EXIT_FAILURE, "PAM: %s", pam_strerror(pam_handle, ret));
|
|||
-
|
|||
/* Using mlock() as non-super-user seems only possible in Linux. Users of other |
|||
* operating systems should use encrypted swap/no swap (or remove the ifdef and |
|||
* run i3lock as super-user). */ |
|||
+++ i3lock.pam
|
|||
@@ -1,6 +0,0 @@
|
|||
-#
|
|||
-# PAM configuration file for the i3lock screen locker. By default, it includes
|
|||
-# the 'login' configuration file (see /etc/pam.d/login)
|
|||
-#
|
|||
-
|
|||
-auth include login
|
|||
@ -0,0 +1,31 @@ |
|||
name=i3lock |
|||
version=2.8 |
|||
update_url="https://i3wm.org/$name/" |
|||
|
|||
define_option 'pam: Use PAM for authentication' |
|||
|
|||
dlextract "https://i3wm.org/$name/$name-$version.tar.bz2" \ |
|||
'89de7b7d46fdb05638122cf3c2512093' |
|||
option !pam extrafile "$name-$version-no-pam.patch" |
|||
header_end |
|||
|
|||
cd "$name-$version" |
|||
|
|||
option !pam patch -p0 -i "../$name-$version-no-pam.patch" |
|||
|
|||
# Fix install directories |
|||
sed -i -e "/\$(INSTALL)/s/bin/$(safe_sed "$dir_bindir")/" Makefile |
|||
|
|||
make install \ |
|||
PREFIX="/$dir_prefix" \ |
|||
SYSCONFDIR="/$dir_sysconfdir" \ |
|||
DESTDIR="$dir_install" |
|||
|
|||
# Install the manpage |
|||
install -Dm644 -t "$dir_install/$dir_prefix/$dir_mandir/man1/" "$name.1" |
|||
|
|||
# If not using PAM, we need suid to know the user's password, as well as make sure the locker isn't killed by the kernel. |
|||
# Don't worry, the locker drops privileges back to your user as soon as possible. |
|||
option !pam chmod +s "$dir_install/$dir_prefix/$dir_bindir/$name" |
|||
|
|||
# vim:set tabstop=4 shiftwidth=4 syntax=sh et: |
|||
Loading…
Reference in new issue