Differential D23198 Diff 68482 head/lib/libpam/modules/pam_login_access/login_access.c

Changeset View

Standalone View

head/lib/libpam/modules/pam_login_access/login_access.c

Show All 25 Lines
#include <stdio.h>		#include <stdio.h>
#include <stdlib.h>		#include <stdlib.h>
#include <string.h>		#include <string.h>
#include <syslog.h>		#include <syslog.h>
#include <unistd.h>		#include <unistd.h>

#include "pam_login_access.h"		#include "pam_login_access.h"

#define _PATH_LOGACCESS "/etc/login.access"

/* Delimiters for fields and for lists of users, ttys or hosts. */

static char fs[] = ":"; /* field separator */
static char sep[] = ", \t"; /* list-element separator */

/* Constants to be used in assignments only, not in comparisons... */		/* Constants to be used in assignments only, not in comparisons... */

#define YES 1		#define YES 1
#define NO 0		#define NO 0

static int from_match(const char , const char );		static int from_match(const char , const char , struct pam_login_access_options *);
static int list_match(char , const char ,		static int list_match(char , const char ,
int ()(const char , const char *));		int ()(const char , const char *,
		struct pam_login_access_options *),
		struct pam_login_access_options *);
static int netgroup_match(const char , const char , const char *);		static int netgroup_match(const char , const char , const char *);
static int string_match(const char , const char );		static int string_match(const char , const char );
static int user_match(const char , const char );		static int user_match(const char , const char , struct pam_login_access_options *);
		static int group_match(const char , const char );

/* login_access - match username/group and host/tty with access control file */		/* login_access - match username/group and host/tty with access control file */

int		int
login_access(const char user, const char from)		login_access(const char user, const char from,
		struct pam_login_access_options *login_access_opts)
{		{
FILE *fp;		FILE *fp;
char line[BUFSIZ];		char line[BUFSIZ];
char perm; / becomes permission field */		char perm; / becomes permission field */
char users; / becomes list of login names */		char users; / becomes list of login names */
char froms; / becomes list of terminals or hosts */		char froms; / becomes list of terminals or hosts */
int match = NO;		int match = NO;
int end;		int end;
int lineno = 0; /* for diagnostics */		int lineno = 0; /* for diagnostics */
		const char *fieldsep = login_access_opts->fieldsep;

/*		/*
* Process the table one line at a time and stop at the first match.		* Process the table one line at a time and stop at the first match.
* Blank lines and lines that begin with a '#' character are ignored.		* Blank lines and lines that begin with a '#' character are ignored.
* Non-comment lines are broken at the ':' character. All fields are		* Non-comment lines are broken at the ':' character. All fields are
* mandatory. The first field should be a "+" or "-" character. A		* mandatory. The first field should be a "+" or "-" character. A
* non-existing table means no access control.		* non-existing table means no access control.
*/		*/

if ((fp = fopen(_PATH_LOGACCESS, "r")) != NULL) {		if ((fp = fopen(login_access_opts->accessfile, "r")) != NULL) {
while (!match && fgets(line, sizeof(line), fp)) {		while (!match && fgets(line, sizeof(line), fp)) {
lineno++;		lineno++;
if (line[end = strlen(line) - 1] != '\n') {		if (line[end = strlen(line) - 1] != '\n') {
syslog(LOG_ERR, "%s: line %d: missing newline or line too long",		syslog(LOG_ERR, "%s: line %d: missing newline or line too long",
_PATH_LOGACCESS, lineno);		login_access_opts->accessfile, lineno);
continue;		continue;
}		}
if (line[0] == '#')		if (line[0] == '#')
continue; /* comment line */		continue; /* comment line */
while (end > 0 && isspace(line[end - 1]))		while (end > 0 && isspace(line[end - 1]))
end--;		end--;
line[end] = 0; /* strip trailing whitespace */		line[end] = 0; /* strip trailing whitespace */
if (line[0] == 0) /* skip blank lines */		if (line[0] == 0) /* skip blank lines */
continue;		continue;
if (!(perm = strtok(line, fs))		if (!(perm = strtok(line, fieldsep))
\|\| !(users = strtok((char *) 0, fs))		\|\| !(users = strtok((char *) 0, fieldsep))
\|\| !(froms = strtok((char *) 0, fs))		\|\| !(froms = strtok((char *) 0, fieldsep))
\|\| strtok((char *) 0, fs)) {		\|\| strtok((char *) 0, fieldsep)) {
syslog(LOG_ERR, "%s: line %d: bad field count", _PATH_LOGACCESS,		syslog(LOG_ERR, "%s: line %d: bad field count", login_access_opts->accessfile,
lineno);		lineno);
continue;		continue;
}		}
if (perm[0] != '+' && perm[0] != '-') {		if (perm[0] != '+' && perm[0] != '-') {
syslog(LOG_ERR, "%s: line %d: bad first field", _PATH_LOGACCESS,		syslog(LOG_ERR, "%s: line %d: bad first field", login_access_opts->accessfile,
lineno);		lineno);
continue;		continue;
}		}
match = (list_match(froms, from, from_match)		match = (list_match(froms, from, from_match, login_access_opts)
&& list_match(users, user, user_match));		&& list_match(users, user, user_match, login_access_opts));
}		}
(void) fclose(fp);		(void) fclose(fp);
} else if (errno != ENOENT) {		} else if (errno != ENOENT) {
syslog(LOG_ERR, "cannot open %s: %m", _PATH_LOGACCESS);		syslog(LOG_ERR, "cannot open %s: %m", login_access_opts->accessfile);
}		}
return (match == 0 \|\| (line[0] == '+'));		return (match == 0 \|\| (line[0] == '+'));
}		}

/* list_match - match an item against a list of tokens with exceptions */		/* list_match - match an item against a list of tokens with exceptions */

static int		static int
list_match(char list, const char item,		list_match(char list, const char item,
int (match_fn)(const char , const char *))		int (match_fn)(const char , const char , struct pam_login_access_options ),
		struct pam_login_access_options *login_access_opts)
{		{
char *tok;		char *tok;
int match = NO;		int match = NO;
		const char *listsep = login_access_opts->listsep;

/*		/*
* Process tokens one at a time. We have exhausted all possible matches		* Process tokens one at a time. We have exhausted all possible matches
* when we reach an "EXCEPT" token or the end of the list. If we do find		* when we reach an "EXCEPT" token or the end of the list. If we do find
* a match, look for an "EXCEPT" list and recurse to determine whether		* a match, look for an "EXCEPT" list and recurse to determine whether
* the match is affected by any exceptions.		* the match is affected by any exceptions.
*/		*/

for (tok = strtok(list, sep); tok != NULL; tok = strtok((char *) 0, sep)) {		for (tok = strtok(list, listsep); tok != NULL; tok = strtok((char *) 0, listsep)) {
if (strcmp(tok, "EXCEPT") == 0) /* EXCEPT: give up */		if (strcmp(tok, "EXCEPT") == 0) /* EXCEPT: give up */
break;		break;
if ((match = (match_fn)(tok, item)) != 0) / YES */		if ((match = (match_fn)(tok, item, login_access_opts)) != 0) / YES */
break;		break;
}		}
/* Process exceptions to matches. */		/* Process exceptions to matches. */

if (match != NO) {		if (match != NO) {
while ((tok = strtok((char *) 0, sep)) && strcmp(tok, "EXCEPT"))		while ((tok = strtok((char *) 0, listsep)) && strcmp(tok, "EXCEPT")) {
/* VOID */ ;		/* VOID */ ;
if (tok == NULL \|\| list_match((char *) 0, item, match_fn) == NO)		if (tok == NULL \|\| list_match((char *) 0, item, match_fn,
		login_access_opts) == NO) {
return (match);		return (match);
}		}
		}
		}
return (NO);		return (NO);
}		}

/* netgroup_match - match group against machine or user */		/* netgroup_match - match group against machine or user */

static int		static int
netgroup_match(const char group, const char machine, const char *user)		netgroup_match(const char group, const char machine, const char *user)
{		{
Show All 14 Lines	netgroup_match(const char group, const char machine, const char *user)
return (NO);		return (NO);
}		}

if (innetgr(group, machine, user, domain) == 1)		if (innetgr(group, machine, user, domain) == 1)
return (YES);		return (YES);
return (NO);		return (NO);
}		}

/* user_match - match a username against one token */		/* group_match - match a group against one token */

static int		int
user_match(const char tok, const char string)		group_match(const char tok, const char username)
{		{
struct group *group;		struct group *group;
struct passwd *passwd;		struct passwd *passwd;
gid_t *grouplist;		gid_t *grouplist;
int ngroups = NGROUPS;		int i, ret, ngroups = NGROUPS;
int i;

		if ((passwd = getpwnam(username)) == NULL)
		return (NO);
		errno = 0;
		if ((group = getgrnam(tok)) == NULL) {
		if (errno != 0)
		syslog(LOG_ERR, "getgrnam() failed for %s: %s", username, strerror(errno));
		else
		syslog(LOG_NOTICE, "group not found: %s", username);
		return (NO);
		}
		if ((grouplist = calloc(ngroups, sizeof(gid_t))) == NULL) {
		syslog(LOG_ERR, "cannot allocate memory for grouplist: %s", username);
		return (NO);
		}
		ret = NO;
		if (getgrouplist(username, passwd->pw_gid, grouplist, &ngroups) != 0)
		syslog(LOG_ERR, "getgrouplist() failed for %s", username);
		for (i = 0; i < ngroups; i++)
		if (grouplist[i] == group->gr_gid)
		ret = YES;
		free(grouplist);
		return (ret);
		}

		/* user_match - match a username against one token */

		static int
		user_match(const char tok, const char string,
		struct pam_login_access_options *login_access_opts)
		{
		size_t stringlen;
		char *grpstr;
		int rc;

/*		/*
* If a token has the magic value "ALL" the match always succeeds.		* If a token has the magic value "ALL" the match always succeeds.
* Otherwise, return YES if the token fully matches the username, or if		* Otherwise, return YES if the token fully matches the username, or if
* the token is a group that contains the username.		* the token is a group that contains the username.
*/		*/

if (tok[0] == '@') { /* netgroup */		if (tok[0] == '@') { /* netgroup */
return (netgroup_match(tok + 1, (char *) 0, string));		return (netgroup_match(tok + 1, (char *) 0, string));
} else if (string_match(tok, string)) { /* ALL or exact match */		} else if (tok[0] == '(' && tok[(stringlen = strlen(&tok[1]))] == ')') { /* group */
return (YES);		if ((grpstr = strndup(&tok[1], stringlen - 1)) == NULL) {
} else {		syslog(LOG_ERR, "cannot allocate memory for %s", string);
if ((passwd = getpwnam(string)) == NULL)
return (NO);		return (NO);
errno = 0;
if ((group = getgrnam(tok)) == NULL) {/* try group membership */
if (errno != 0) {
syslog(LOG_ERR, "getgrnam() failed for %s: %s", string, strerror(errno));
} else {
syslog(LOG_NOTICE, "group not found: %s", string);
}		}
return (NO);		rc = group_match(grpstr, string);
}		free(grpstr);
errno = 0;		return (rc);
if ((grouplist = calloc(ngroups, sizeof(gid_t))) == NULL) {		} else if (string_match(tok, string)) { /* ALL or exact match */
if (errno == ENOMEM) {
syslog(LOG_ERR, "cannot allocate memory for grouplist: %s", string);
}
return (NO);
}
if (getgrouplist(string, passwd->pw_gid, grouplist, &ngroups) != 0) {
syslog(LOG_ERR, "getgrouplist() failed for %s", string);
free(grouplist);
return (NO);
}
for (i = 0; i < ngroups; i++) {
if (grouplist[i] == group->gr_gid) {
free(grouplist);
return (YES);		return (YES);
		} else if (login_access_opts->defgroup == true) {/* try group membership */
		return (group_match(tok, string));
}		}
}
free(grouplist);
}
return (NO);		return (NO);
}		}

/* from_match - match a host or tty against a list of tokens */		/* from_match - match a host or tty against a list of tokens */

static int		static int
from_match(const char tok, const char string)		from_match(const char tok, const char string,
		struct pam_login_access_options *login_access_opts __unused)
{		{
int tok_len;		int tok_len;
int str_len;		int str_len;

/*		/*
* If a token has the magic value "ALL" the match always succeeds. Return		* If a token has the magic value "ALL" the match always succeeds. Return
* YES if the token fully matches the string. If the token is a domain		* YES if the token fully matches the string. If the token is a domain
* name, return YES if it matches the last fields of the string. If the		* name, return YES if it matches the last fields of the string. If the
▲ Show 20 Lines • Show All 41 Lines • Show Last 20 Lines