Compare commits
5 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
2173cd0d33 | ||
|
|
28f9aed5be | ||
|
|
3021f35c3a | ||
|
|
ad0797f129 | ||
|
|
b8a41d9480 |
50
.gitignore
vendored
50
.gitignore
vendored
@@ -1,50 +0,0 @@
|
||||
*~
|
||||
lib*.a
|
||||
*.o
|
||||
*.lo
|
||||
*.la
|
||||
*.gmo
|
||||
.deps
|
||||
.libs
|
||||
|
||||
*.patch
|
||||
*.rej
|
||||
*.orig
|
||||
|
||||
Makefile
|
||||
Makefile.in
|
||||
|
||||
/ABOUT-NLS
|
||||
/aclocal.m4
|
||||
/autom4te.cache
|
||||
/compile
|
||||
/config.cache
|
||||
/config.guess
|
||||
/config.h
|
||||
/config.h.in
|
||||
/config.log
|
||||
/config.rpath
|
||||
/config.status
|
||||
/config.sub
|
||||
/configure
|
||||
/depcomp
|
||||
/install-sh
|
||||
/libtool
|
||||
/ltmain.sh
|
||||
/m4
|
||||
/missing
|
||||
/stamp-h1
|
||||
/ylwrap
|
||||
|
||||
/po/*.header
|
||||
/po/*.sed
|
||||
/po/*.sin
|
||||
/po/Makefile.in.in
|
||||
/po/Makevars.template
|
||||
/po/POTFILES
|
||||
/po/Rules-quot
|
||||
/po/stamp-po
|
||||
|
||||
/shadow.spec
|
||||
/shadow-*.tar.*
|
||||
/libmisc/getdate.c
|
||||
52
.travis.yml
52
.travis.yml
@@ -1,52 +0,0 @@
|
||||
dist: bionic
|
||||
sudo: false
|
||||
|
||||
language: c
|
||||
|
||||
compiler:
|
||||
- gcc
|
||||
- clang
|
||||
|
||||
arch:
|
||||
- amd64
|
||||
- arm64
|
||||
- ppc64le
|
||||
- s390x
|
||||
|
||||
before_install:
|
||||
- sudo apt-get update -qq
|
||||
- sudo apt-get -y install -qq automake autopoint xsltproc libselinux1-dev gettext expect
|
||||
- sudo apt-get -y install -qq byacc libtool
|
||||
script:
|
||||
- ./autogen.sh --without-selinux --disable-man
|
||||
- grep ENABLE_ config.status
|
||||
- make
|
||||
|
||||
env:
|
||||
global:
|
||||
- secure: "G47VYFrtzqalrVjixTqBG9Qsa8EZRcaqsh1k6fq5JgEyHmMQActpvTUDs9FXf1MEqiY5XX3VDVfBsZgKPHgmHsMzD1bX11xpnpGByB8g7gr8I3u2ZkCREqgi77a5l3LeBh+seWiambe/DYOgvPCNa6pCynLgR9advqtgKhpCruU="
|
||||
|
||||
addons:
|
||||
coverity_scan:
|
||||
|
||||
project:
|
||||
name: "shadow-maint/shadow"
|
||||
description: "Upstream shadow utils tree"
|
||||
|
||||
notification_email: christian.brauner@ubuntu.com,serge@hallyn.com
|
||||
|
||||
build_command_prepend: "./autogen.sh --without-selinux --disable-man"
|
||||
build_command: "make -j4"
|
||||
branch_pattern: master
|
||||
|
||||
script:
|
||||
- cat /proc/self/uid_map
|
||||
- cat /proc/self/status
|
||||
- systemd-detect-virt
|
||||
- ./autogen.sh --without-selinux --disable-man
|
||||
- grep ENABLE_ config.status
|
||||
- make
|
||||
- sudo make install
|
||||
- (cd tests; sudo ./run_some; cat testsuite.log)
|
||||
|
||||
# vim:et:ts=2:sw=2
|
||||
13
Makefile.am
13
Makefile.am
@@ -2,14 +2,7 @@
|
||||
|
||||
EXTRA_DIST = NEWS README TODO shadow.spec.in
|
||||
|
||||
SUBDIRS = libmisc lib
|
||||
AUTOMAKE_OPTIONS = 1.5 dist-bzip2 foreign
|
||||
|
||||
if ENABLE_SUBIDS
|
||||
SUBDIRS += libsubid
|
||||
endif
|
||||
|
||||
SUBDIRS += src po contrib doc etc
|
||||
|
||||
if ENABLE_REGENERATE_MAN
|
||||
SUBDIRS += man
|
||||
endif
|
||||
SUBDIRS = po man libmisc lib src \
|
||||
contrib doc etc
|
||||
|
||||
581
NEWS
581
NEWS
@@ -1,442 +1,5 @@
|
||||
$Id$
|
||||
|
||||
shadow-4.1.5.1 -> shadow-4.2 UNRELEASED
|
||||
|
||||
*** general
|
||||
* Handle libc whose crypt() returns NULL when passed a salt that
|
||||
violates specs or system requirements (e.g. FIPS140). This is needed
|
||||
with glibc/eglibc 2.17 for tools checking passwords (passwd (non PAM
|
||||
enabled) or newgrp), and for tools generating encrypted passwords
|
||||
(chgpasswd, chpasswd, or gpasswd when non PAM enabled or when a fixed
|
||||
crypt method is requested on the command line, and newusers, or passwd
|
||||
in their non PAM enabled versions)
|
||||
* Fix segfault when reading groups split on multiple lines. This impacts
|
||||
most user/group management tools when MAX_MEMBERS_PER_GROUP is set.
|
||||
|
||||
- su
|
||||
* When su receives a signal (SIGTERM, or SIGINT/SIGQUIT in non
|
||||
interactive mode), kill the child process group, rather than just the
|
||||
immediate child.
|
||||
* Fix segmentation faults for users without a proper home or shell in
|
||||
their passwd entries.
|
||||
|
||||
- login
|
||||
* Fix segmentation faults for users without a proper home or shell in
|
||||
their passwd entries.
|
||||
|
||||
*** documentation
|
||||
* Fixed useradd man page (--home-dir option, instead of --home).
|
||||
|
||||
*** translation
|
||||
* Updated Russian translation.
|
||||
* Updated German man pages translation.
|
||||
* Fixed gshadow Japanese man page translation.
|
||||
|
||||
shadow-4.1.5 -> shadow-4.1.5.1 2012-05-25
|
||||
|
||||
- login
|
||||
* Log into utmp(x) when PAM is enabled, but do not log into wtmp.
|
||||
This complete pam_lastlog which logs into wtmp and in into utmp(x).
|
||||
- su
|
||||
* non PAM enabled versions: do not fail if su is called without a
|
||||
controlling terminal.
|
||||
- userdel
|
||||
* Fix segfault when userdel removes the user's group.
|
||||
|
||||
*** documentation
|
||||
* .so links now point to paths relative to the top-level manual hierarchy
|
||||
|
||||
*** translation
|
||||
* Updated French man pages translation.
|
||||
* Updated German man pages translation.
|
||||
* Updated Polish man pages translation. (logoutd.8)
|
||||
|
||||
shadow-4.1.4.3 -> shadow-4.1.5 2012-02-12
|
||||
|
||||
*** security
|
||||
* su -c could be abused by the executed command to invoke commands with
|
||||
the caller privileges. See below. (CVE-2005-4890)
|
||||
|
||||
*** general
|
||||
* report usage error to stderr, but report usage help to stdout (and return
|
||||
zero) when explicitly requested (e.g. with --help).
|
||||
* initial support for tcb (http://openwall.com/tcb/) for useradd,
|
||||
userdel, usermod, chage, pwck, vipw.
|
||||
* Added support for ACLs and Extended Attributes in useradd and usermod.
|
||||
Support shall be enabled with the new --with-acl or --with-attr
|
||||
configure options.
|
||||
* Added diagnosis for lock failures.
|
||||
* use libsemanage instead of the semanage tool.
|
||||
|
||||
- chage
|
||||
* Add --root option.
|
||||
- chfn
|
||||
* Add --root option.
|
||||
- chgpasswd
|
||||
* When the gshadow file exists but there are no gshadow entries, an entry
|
||||
is created if the password is changed and group requires a
|
||||
shadow entry.
|
||||
* Add --root option.
|
||||
- chpasswd
|
||||
* PAM enabled versions: restore the -e option to allow restoring
|
||||
passwords without knowing those passwords. Restore together the -m
|
||||
and -c options. (These options were removed in shadow-4.1.4 on PAM
|
||||
enabled versions)
|
||||
* When the shadow file exists but there are no shadow entries, an entry
|
||||
is created if the password is changed and passwd requires a
|
||||
shadow entry.
|
||||
* Add --root option.
|
||||
- chsh
|
||||
* Add --root option.
|
||||
- faillog
|
||||
* The -l, -m, -r, -t options only act on the existing users, unless -a is
|
||||
specified.
|
||||
* Add --root option.
|
||||
- gpasswd
|
||||
* Add --root option.
|
||||
- groupadd
|
||||
* Add --root option.
|
||||
- groupdel
|
||||
* Add --root option.
|
||||
- groupmems
|
||||
* Fix parsing of gshadow entries.
|
||||
* Add --root option.
|
||||
- groupmod
|
||||
* Fixed groupmod when configured with --enable-account-tools-setuid.
|
||||
* When the gshadow file exists but there are no gshadow entries, an entry
|
||||
is created if the password is changed and group requires a
|
||||
shadow entry.
|
||||
* Add --root option.
|
||||
- grpck
|
||||
* Add --root option.
|
||||
* NIS entries were dropped by -s (sort).
|
||||
- grpconv
|
||||
* Add --root option.
|
||||
- grpunconv
|
||||
* Add --root option.
|
||||
- lastlog
|
||||
* Add --root option.
|
||||
- login
|
||||
* Fixed limits support (non PAM enabled versions only)
|
||||
* Added support for infinite limits and group based limits (non PAM
|
||||
enabled versions only)
|
||||
* Fixed infinite loop when CONSOLE is configured with a colon-separated
|
||||
list of TTYs.
|
||||
* Fixed warning and support for CONSOLE_GROUPS for users member of more
|
||||
than 16 groups.
|
||||
* Do not log into utmp(x) or wtmp when PAM is enabled. This is done by
|
||||
pam_lastlog.
|
||||
- newgrp, sg
|
||||
* Fix parsing of gshadow entries.
|
||||
- newusers
|
||||
* Add --root option.
|
||||
- passwd
|
||||
* Add --root option.
|
||||
- pwpck
|
||||
* NIS entries were dropped by -s (sort).
|
||||
* Add --root option.
|
||||
- pwconv
|
||||
* Add --root option.
|
||||
- pwunconv
|
||||
* Add --root option.
|
||||
- useradd
|
||||
* If the skeleton directory contained hardlinked files, copies of the
|
||||
hardlink were removed from the skeleton directory.
|
||||
* Add --root option.
|
||||
- userdel
|
||||
* Check the existence of the user's mail spool before trying to remove
|
||||
it. If it does not exist, a warning is issued, but no failure.
|
||||
* Do not remove a group with the same name as the user (usergroup) if
|
||||
this group isn't the user's primary group.
|
||||
* Add --root option.
|
||||
* Add --selinux-user option.
|
||||
- usermod
|
||||
* Accept options in any order (username not necessarily at the end)
|
||||
* When the shadow file exists but there are no shadow entries, an entry
|
||||
is created if the password is changed and passwd requires a
|
||||
shadow entry, or if aging features are used (-e or -f).
|
||||
* Add --root option.
|
||||
- su
|
||||
* Document the su exit values.
|
||||
* When su receives a signal, wait for the child to terminate (after
|
||||
sending a SIGTERM), and kill it only if it did not terminate by itself.
|
||||
No delay will be enforced if the child cooperates.
|
||||
* Default ENV_SUPATH is /sbin:/bin:/usr/sbin:/usr/bin
|
||||
* Fixed infinite loop when CONSOLE is configured with a colon-separated
|
||||
list of TTYs.
|
||||
* Fixed warning and support for CONSOLE_GROUPS for users member of more
|
||||
than 16 groups.
|
||||
* Do not forward the controlling terminal to commands executed with -c.
|
||||
This prevents tty hijacking which could lead to execution with the
|
||||
caller's privileges.
|
||||
* Close PAM sessions as root. This will be more friendly to PAM modules
|
||||
like pam_mount or pam_systemd.
|
||||
* Added support for PAM modules which change PAM_USER.
|
||||
|
||||
*** translation
|
||||
* Updated Brazilian Portuguese translation.
|
||||
* Updated Catalan translation.
|
||||
* Updated Czech translation.
|
||||
* Updated Danish translation.
|
||||
* New Danish man pages translation.
|
||||
* Updated French translation.
|
||||
* Updated French man pages translation.
|
||||
* Updated German translation.
|
||||
* Updated German man pages translation.
|
||||
* Updated Greek translation.
|
||||
* Updated Italian man pages translation.
|
||||
* Updated Japanese translation.
|
||||
* Updated Kazakh translation.
|
||||
* Updated Norwegian Bokmål translation.
|
||||
* Updated Portuguese translation.
|
||||
* Updated Russian translation.
|
||||
* Updated Simplified Chinese translation.
|
||||
* Updated Simplified Chinese man pages translation.
|
||||
* Updated Swedish translation.
|
||||
* Updated Vietnamese translation.
|
||||
|
||||
shadow-4.1.4.2 -> shadow-4.1.4.3 2011-02-15
|
||||
|
||||
*** security
|
||||
- CVE-2011-0721: An insufficient input sanitation in chfn can be exploited
|
||||
to create users or groups in a NIS environment.
|
||||
|
||||
shadow-4.1.4.1 -> shadow-4.1.4.2 2009-07-24
|
||||
|
||||
- general
|
||||
* Improved support for large groups (impacts most user/group management
|
||||
tools).
|
||||
|
||||
- addition of system users or groups
|
||||
* Speed improvement. This should be noticeable in case of LDAP configured
|
||||
systems. This should impact useradd, groupadd, and newusers
|
||||
* Since system accounts are allocated from SYS_?ID_MIN to SYS_?ID_MAX in
|
||||
reverse order, accounts are packed close to SYS_?ID_MAX if SYS_?ID_MIN
|
||||
is already used but there are still dome gaps.
|
||||
|
||||
- login
|
||||
* Add support for shells being a shell script without a shebang.
|
||||
- su
|
||||
* Preserve the DISPLAY and XAUTHORITY environment variables. This was
|
||||
only the case in the non PAM enabled versions.
|
||||
* Add support for shells being a shell script without a shebang.
|
||||
|
||||
*** translation
|
||||
* The Finnish translation of passwd(1) was outdated and is no more
|
||||
distributed.
|
||||
|
||||
shadow-4.1.4 -> shadow-4.1.4.1 2009-05-22
|
||||
|
||||
- login
|
||||
* Fix failures with empty usernames on non PAM versions.
|
||||
* Fix CONSOLE (securetty) support on non PAM versions.
|
||||
- newgrp
|
||||
* Return the exit status of the child.
|
||||
- userdel
|
||||
* On Linux, do not check if an user is logged in with utmp, but check if
|
||||
the user is running some processes.
|
||||
* If not on Linux, continue to search for an utmp record, but make sure
|
||||
the process recorded in the utmp entry is still running.
|
||||
* Report failures to remove the user's mailbox
|
||||
* When USERGROUPS_ENAB is enabled, remove the user's group when the
|
||||
user was the only member.
|
||||
* Do not fail when -r is used and the home directory does not exist.
|
||||
- usermod
|
||||
* Check if the user is busy when the user's UID, name or home directory
|
||||
is changed.
|
||||
|
||||
shadow-4.1.3.1 -> shadow-4.1.4 2009-05-10
|
||||
|
||||
- packaging
|
||||
* Enable --enable-account-tools-setuid by default for PAM builds.
|
||||
* Add configure option --enable-utmpx, disabled by default to mimic
|
||||
the previous behavior on Linux (where utmp and utmpx are identical).
|
||||
* Fix build failure on non-PAM systems when --without-pam is not
|
||||
specified.
|
||||
|
||||
- chpasswd
|
||||
* Change the passwords using PAM. This permits to define the password
|
||||
policy in a central place. The -c/--crypt-method, -e/--encrypted,
|
||||
-m/--md5 and -s/--sha-rounds options are no more supported on PAM
|
||||
enabled systems.
|
||||
- grpck
|
||||
* Warn if a group has an entry in group and gshadow, and the password
|
||||
field in group is not 'x'.
|
||||
- login
|
||||
* Do not trust the current utmp entry's ut_line to set PAM_TTY. This could
|
||||
lead to DOS attacks.
|
||||
* (PAM) Even if the user was already authenticated (-f flag), ask the
|
||||
user to update his authentication token if needed.
|
||||
- lastlog
|
||||
* Fix regression causing empty reports.
|
||||
- newusers
|
||||
* Change the passwords using PAM. This permits to define the password
|
||||
policy in a central place. The -c/--crypt-method and -s/--sha-rounds
|
||||
options are no more supported on PAM enabled systems.
|
||||
- pwck
|
||||
* Warn if an user has an entry in passwd and shadow, and the password
|
||||
field in passwd is not 'x'.
|
||||
|
||||
*** translation
|
||||
- Updated Czech translation
|
||||
- Updated French translation
|
||||
- Updated German translation
|
||||
- Updated Japanese translation
|
||||
- Updated Korean translation
|
||||
- Updated Portuguese translation
|
||||
- Updated Russian translation
|
||||
|
||||
shadow-4.1.3 -> shadow-4.1.3.1 2009-04-15
|
||||
|
||||
*** security:
|
||||
- Due to bad parsing of octal permissions, the permissions on tty (login)
|
||||
but also UMASK were set wrongly (and weirdly). Only shadow-4.1.3 was
|
||||
affected.
|
||||
|
||||
*** general
|
||||
- login
|
||||
* Fix regression when no user is specified on the command line.
|
||||
- userdel
|
||||
* Fixed SE Linux support
|
||||
- vipw
|
||||
* SE Linux: Set the default context to the context of the file being
|
||||
edited. This ensures that the backup file inherit from the file's
|
||||
context.
|
||||
|
||||
*** translation
|
||||
- Updated Norwegian Bokmål translation
|
||||
|
||||
shadow-4.1.2.2 -> shadow-4.1.3 2009-04-12
|
||||
|
||||
*** general:
|
||||
- packaging
|
||||
* Fixed support for OpenPAM.
|
||||
* Fixed support for uclibc.
|
||||
* Added configure --enable-account-tools-setuid (default) /
|
||||
--disable-account-tools-setuid options. This permits to disable the
|
||||
PAM authentication of the caller for chage, chgpasswd, chpasswd,
|
||||
groupadd, groupdel, groupmod, newusers, useradd, userdel, and usermod.
|
||||
This authentication is not necessary when these tools are not
|
||||
installed setuid root.
|
||||
* Added configure --with-group-name-max-length (default) /
|
||||
--without-group-name-max-length options. This permits to configure the maximum length allowed for group names:
|
||||
<no option> -> default of 16 (like today)
|
||||
--with-group-name-max-length -> default of 16
|
||||
--without-group-name-max-length -> no max length
|
||||
--with-group-name-max-length=n > max is set to n
|
||||
No sanity checking is performed on n so people could do
|
||||
something neat like --with-group-name-max-length=MAX_INT
|
||||
- addition of users or groups
|
||||
* Speed improvement in case UID_MAX/SYS_UID_MAX/GID_MAX/SYS_GID_MAX is
|
||||
used for an user/group. This should be noticeable in case of LDAP
|
||||
configured systems. This should impact useradd, groupadd, and newusers
|
||||
- error handling improvement
|
||||
* Make sure errors and incomplete changes are reported to syslog and
|
||||
audit in case of unexpected failures.
|
||||
* Report system inconsistencies to syslog and audit.
|
||||
* Only report success to syslog and audit if the changes are really
|
||||
performed in the system databases.
|
||||
This is still not complete.
|
||||
- /etc/login.defs
|
||||
* New CREATE_HOME variable to tell useradd to create a home directory by
|
||||
default.
|
||||
- Translations
|
||||
* New Kazakh translation.
|
||||
* Spanish manpages are no more distributed. They are outdated. Please
|
||||
contact pkg-shadow-devel@lists.alioth.debian.org if you wish to
|
||||
provide updates.
|
||||
|
||||
- faillog
|
||||
* Accept users specified as a numerical UID, or ranges of users (-user,
|
||||
user-, user1-user2).
|
||||
* -l, -m, and -r now apply not only to existing users, but to all the
|
||||
specified UIDs.
|
||||
* Options can be specified in any order.
|
||||
- gpasswd
|
||||
* Added support for long options --add (-a), --delete (-d),
|
||||
--remove-password (-r), --restrict (-R), --administrators (-A), and
|
||||
--members (-M).
|
||||
* Added support for usernames with arbitrary length.
|
||||
* audit logging improvements.
|
||||
* error handling improvement (see above).
|
||||
* Log permission denied to syslog and audit.
|
||||
- groupadd
|
||||
* audit logging improvements.
|
||||
* error handling improvement (see above).
|
||||
* Speedup (see "addition of users or groups" above).
|
||||
* do not create groups with GID set to (gid_t)-1.
|
||||
* Allocate system group GIDs in reverse order. This could be useful
|
||||
later to increase the static IDs range.
|
||||
- groupdel
|
||||
* audit logging improvements.
|
||||
* error handling improvement (see above).
|
||||
- groupmems
|
||||
* Check if user exist before they are added to groups.
|
||||
* Avoid segfault in case the specified group does not exist in /etc/group.
|
||||
* Everybody is allowed to list the users of a group.
|
||||
* /etc/group is open readonly when one just wants to list the users of a
|
||||
group.
|
||||
* Added syslog support.
|
||||
* Use the groupmems PAM service name instead of groupmod.
|
||||
* Fix segmentation faults when adding or removing users from a group.
|
||||
* Added support for shadow groups.
|
||||
* Added support long options --add (-a), --delete (-d), --purge (-p),
|
||||
--list (-l), --group (-g).
|
||||
- groupmod
|
||||
* audit logging improvements.
|
||||
* error handling improvement (see above).
|
||||
* do not create groups with GID set to (gid_t)-1.
|
||||
- grpck
|
||||
* warn for groups with GID set to (gid_t)-1.
|
||||
- login
|
||||
* Restore the echoctl, echoke, onclr flags to the terminal termio flags.
|
||||
Reset echoprt, noflsh, tostop. This behavior seems to have change by
|
||||
mistake in earlier releases (4.0.8, for no obvious reason).
|
||||
- newusers
|
||||
* Implement the -r, --system option.
|
||||
* Speedup (see "addition of users or groups" above).
|
||||
* do not create users with UID set to (gid_t)-1.
|
||||
* do not create groups with GID set to (gid_t)-1.
|
||||
* Allocate system account UIDs/GIDs in reverse order. This could be useful
|
||||
later to increase the static IDs range.
|
||||
- passwd
|
||||
* For compatibility with other passwd version, the --lock an --unlock
|
||||
options do not lock or unlock the user account anymore. They only
|
||||
lock or unlock the user's password.
|
||||
- pwck
|
||||
* warn for users with UID set to (uid_t)-1.
|
||||
- su
|
||||
* Preserve COLORTERM in addition to TERM when su is called with the -l
|
||||
option.
|
||||
- useradd
|
||||
* audit logging improvements.
|
||||
* Speedup (see "addition of users or groups" above).
|
||||
* See CREATE_HOME above.
|
||||
* New -M/--no-create-home option to disable CREATE_HOME.
|
||||
* do not create users with UID set to (gid_t)-1.
|
||||
* Added -Z option to map SELinux user for user's login.
|
||||
* Allocate system user UIDs in reverse order. This could be useful
|
||||
later to increase the static IDs range.
|
||||
- userdel
|
||||
* audit logging improvements.
|
||||
* Do not fail if the removed user is not in the shadow database.
|
||||
* When the user's group shall be removed, do not fail if this group is
|
||||
not in the gshadow file.
|
||||
* Delete the SELinux user mapping for user's login.
|
||||
- usermod
|
||||
* Allow adding LDAP users (or any user not present in the local passwd
|
||||
file) to local groups
|
||||
* do not create users with UID set to (gid_t)-1.
|
||||
* Added -Z option to map SELinux user for user's login.
|
||||
|
||||
shadow-4.1.2.1 -> shadow-4.1.2.2 23-11-2008
|
||||
|
||||
*** security
|
||||
- Fix a race condition in login that could lead to gaining ownership or
|
||||
changing mode of arbitrary files.
|
||||
- Fix a possible login DOS, which could be caused by injecting forged
|
||||
entries in utmp.
|
||||
|
||||
shadow-4.1.2 -> shadow-4.1.2.1 26-06-2008
|
||||
|
||||
*** security
|
||||
@@ -511,7 +74,7 @@ shadow-4.1.0 -> shadow-4.1.1 02-04-2008
|
||||
faillog faster.
|
||||
- gpasswd
|
||||
* Fix failures when the gshadow file is not present.
|
||||
* When a password is moved to the gshadow file, use "x" instead of "!"
|
||||
* When a password is moved to the gshadow file, use "x" instead of "x"
|
||||
to indicate that the password is shadowed (consistency with grpconv).
|
||||
* Make sure the group and gshadow files are unlocked on exit.
|
||||
- groupadd
|
||||
@@ -654,9 +217,9 @@ shadow-4.0.18.2 -> shadow-4.1.0 09-12-2007
|
||||
- Use MD5_CRYPT_ENAB, ENCRYPT_METHOD, SHA_CRYPT_MIN_ROUNDS, and
|
||||
SHA_CRYPT_MAX_ROUNDS to define the default encryption algorithm for the
|
||||
passwords.
|
||||
- chpasswd, chgpasswd, newusers: New options -c/--crypt-method and
|
||||
- chpaswd, chgpasswd, newusers: New options -c/--crypt-method and
|
||||
-s/--sha-rounds to supersede the system default encryption algorithm.
|
||||
- chpasswd, chgpasswd, newusers: DES is no more the default algorithm. They
|
||||
- chpaswd, chgpasswd, newusers: DES is no more the default algorithm. They
|
||||
will respect the system default configured in /etc/login.defs
|
||||
|
||||
*** documentation:
|
||||
@@ -701,14 +264,14 @@ shadow-4.0.17 -> shadow-4.0.18 01-08-2006
|
||||
- groupadd, groupmod, useradd, usermod: fixed UID/GID overflow (fixed
|
||||
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=198920)
|
||||
- passwd, useradd, usermod: fixed inactive/mindays/warndays/maxdays overflow
|
||||
(similar to RH#198920),
|
||||
- groupmems: rewritten for use PAM and getopt_long() and now it is enabled
|
||||
(simillar to RH#198920),
|
||||
- groupmems: rewrited for use PAM and getopt_long() and now it is enabled
|
||||
for build and install (patch by George Kraft <gk4@swbell.net>),
|
||||
- S/Key: removed assign getpass() to libshadow_getpass() on autoconf level
|
||||
(patch by Ulrich Mueller <ulm@kph.uni-mainz.de>; http://bugs.gentoo.org/139966),
|
||||
- usermod: back to previous -a option semantics and clarify -a behavior
|
||||
on documentation level (by Greg Schafer <gschafer@zip.com.au>),
|
||||
- chsh, groupmod: rewritten for use getopt_long().
|
||||
- chsh, groupmod: rewrited for use getopt_long().
|
||||
- updated translations: ca, cs, da, eu, fr, gl, hu, ko, pl, pt, ru, sv, tr, uk, vi.
|
||||
*** documentation:
|
||||
- fr and ru man pages are up to date,
|
||||
@@ -743,7 +306,7 @@ shadow-4.0.15 -> shadow-4.0.16 05-06-2006
|
||||
|
||||
*** general:
|
||||
- userdel: better fix for old CERT VU#312962 (which was fixed in shadow 4.0.8):
|
||||
fixed forgotten checking of the return value from fchown() before
|
||||
fixed forgoten checking of the return value from fchown() before
|
||||
proceeding with the fchmod() (based on Owl patch prepared by
|
||||
Rafal Wojtczuk <nergal@owl.openwall.com>),
|
||||
- userdel: use login.defs::MAIL_DIR instead hardcoded /var/mail in created
|
||||
@@ -755,7 +318,7 @@ shadow-4.0.15 -> shadow-4.0.16 05-06-2006
|
||||
passwords and libshadow_getpass() is used only because libc getpass()
|
||||
do not handles password prompting with echo enabled,
|
||||
- move login.defs::MD5_CRYPT_ENAB to non-PAM part,
|
||||
- userdel: rewritten for use getopt_log(),
|
||||
- userdel: rewrited for use getopt_log(),
|
||||
- install default/template configuration files:
|
||||
-- if shadow is configured with use PAM install /etc/pam.d/* files,
|
||||
-- if shadow do not uses PAM install /etc/{limits,login.acces} files,
|
||||
@@ -793,7 +356,7 @@ shadow-4.0.15 -> shadow-4.0.16 05-06-2006
|
||||
- updated ru login.defs(5), passwd(1), userdel(8), usermod(8) man pages,
|
||||
- pw_auth(3) man page removed (outdated),
|
||||
- install limits(5), login.access(5) and porttime(5) man pages only when
|
||||
shadow is built with PAM support disabled,
|
||||
shadow is builded with PAM support disabled,
|
||||
- passwd(1): better document how password strength is checked
|
||||
(fixed http://bugs.debian.org/115380),
|
||||
- usermod(8): added missing -a option description
|
||||
@@ -816,7 +379,7 @@ shadow-4.0.14 -> shadow-4.0.15 13-03-2006
|
||||
- login: default UMASK if not specified in login.defs is 022 (pointed by
|
||||
Peter Vrabec <pvrabec@redhat.com>),
|
||||
- chgpasswd: new tool (by Jonas Meurer <mejo@debian.org>),
|
||||
- lastlog: print the usage and exit if an additional argument is provided to
|
||||
- lastlog: print the usage and exit if an additional argument is profided to
|
||||
lastlog (merge 488_laslog_verify_arguments Debian patch),
|
||||
- login, newgrp, nologin, su: do not link with libselinux (merge
|
||||
490_link_selinux_only_when_needed Debian patch),
|
||||
@@ -830,9 +393,9 @@ shadow-4.0.14 -> shadow-4.0.15 13-03-2006
|
||||
tries exceeded,
|
||||
- always prints the number of tries in the syslog entry.
|
||||
- add special handling for PAM_ABORT
|
||||
- add an entry to faillog, as when USE_PAM is not defined. (#53164)
|
||||
- add an entry to failog, as when USE_PAM is not defined. (#53164)
|
||||
- changed pam_end to PAM_END. This is certainly was a mistake. PAM_END is
|
||||
pam_close_session + pam_end. Here, the session is still not open, we
|
||||
pam_close_seesion + pam_end. Here, the session is still not open, we
|
||||
don't have to close it.
|
||||
- a HAVE_PAM_FAIL_DELAY is missing,
|
||||
- su: fixed pam session support (patch from Topi Miettinen; fixed #57526,
|
||||
@@ -840,7 +403,7 @@ shadow-4.0.14 -> shadow-4.0.15 13-03-2006
|
||||
- userdel: user's group is already removed by update_groups().
|
||||
remove_group() is not needed (bug introduced in 4.0.14 on merge FC fixes).
|
||||
Fixed by Nicolas François <nicolas.francois@centraliens.net>,
|
||||
- useradd: always remove group and gshadow databases lock, Fixed by Nicolas
|
||||
- useradd: allways remove group and gshadow databases lock, Fixed by Nicolas
|
||||
François <nicolas.francois@centraliens.net>
|
||||
(http://bugs.debian.org/348250)
|
||||
- auditing fixes:
|
||||
@@ -848,14 +411,14 @@ shadow-4.0.14 -> shadow-4.0.15 13-03-2006
|
||||
added audit_logger() prototype),
|
||||
- useradd: fixed excess audit_logger() argument,
|
||||
- chage: added missing \n on display password status if password must be
|
||||
changed,
|
||||
chaged,
|
||||
- useradd: fixed allow non-unique UID (http://bugs.debian.org/351281),
|
||||
- various code cleanups for make possible compilation of shadow with -Wall
|
||||
- variouse code cleanups for make possible compilation of shadow with -Wall
|
||||
-Werror (by Alexander Gattin <xrgtn@yandex.ru>),
|
||||
- su: move exit() outside libmisc/shell.c::shell() for handle shell() errors
|
||||
on higher level (now is better visable where some programs exit with 126
|
||||
and 127 exit codes); added new shell() parameter (char *const envp[])
|
||||
which allow fix preserving enviroment in su on using -p, (patch by
|
||||
which allow fix preserving enviloment in su on using -p, (patch by
|
||||
Alexander Gattin <xrgtn@yandex.ru>),
|
||||
- su: added handle -c,--command option for GNU su compliance (merge
|
||||
437_su_-c_option Debian patch),
|
||||
@@ -903,7 +466,7 @@ shadow-4.0.13 -> shadow-4.0.14 03-01-2006
|
||||
- userdel: make the -f option force the removal of the user's group (even if it
|
||||
is the primary group of another user)
|
||||
(merge 453_userdel_-f_removes_group Debian patch),
|
||||
- usermod: rewritten for use getopt_long() (Christian Perrier <bubulle@kheops.frmug.org>),
|
||||
- usermod: rewrited for use getopt_long() (Christian Perrier <bubulle@kheops.frmug.org>),
|
||||
- grpck: fixed segmentation fault on using -s when /etc/gshadow is empty (fix by
|
||||
Tomasz Lemiech <szpajder@staszic.waw.pl>),
|
||||
- passwd: remove handle -f, -g and -s options.
|
||||
@@ -912,7 +475,7 @@ shadow-4.0.13 -> shadow-4.0.14 03-01-2006
|
||||
Nicolas François <nicolas.francois@centraliens.net>)
|
||||
- su: export $USER and $SHELL as well as $HOME (http://bugs.debian.org/11003 and
|
||||
http://bugs.debian.org/11189),
|
||||
- su, vipw: rewritten for use getopt_long(),
|
||||
- su, vipw: rewrited for use getopt_long(),
|
||||
- su: log successful/failed through syslog (http://bugs.debian.org/190215),
|
||||
- updated translations: ca, cs, da, eu, fi, fr, it, pl, pt, ru, sv, tl, vi,
|
||||
- new translations: gl.
|
||||
@@ -946,7 +509,7 @@ shadow-4.0.12 -> shadow-4.0.13 10-10-2005
|
||||
|
||||
*** general:
|
||||
- chage: removed duplicated pam_start(),
|
||||
- chfn, chsh: finished PAM support using pam_start() and co.,
|
||||
- chfn, chsh: finished PAM support usin pam_start() and co.,
|
||||
- userdel: userdel should not remove the group which is primary for someone else
|
||||
(fix by Nicolas François <nicolas.francois@centraliens.net>
|
||||
http://bugs.debian.org/295416),
|
||||
@@ -955,7 +518,7 @@ shadow-4.0.12 -> shadow-4.0.13 10-10-2005
|
||||
- fixedlib/commonio.c: don't assume selinux is enabled if is_selinux_enabled()
|
||||
returns -1 (merge isSelinuxEnabled FC patch by Jeremy Katz <katzj@redhat.com>),
|
||||
- login, su (non-PAM case): fixed setup max address space limits (added missing break
|
||||
statement in case) spotted by Lasse Collin <lasse.collin@tukaani.org>,
|
||||
statement in case) spoted by Lasse Collin <lasse.collin@tukaani.org>,
|
||||
- auditing support added. Patch prepared by Peter Vrabec <pvrabec@redhat.com> basing
|
||||
on work by Steve Grubb from http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=159215
|
||||
Now auditing support have commands: chage, gpasswd, groupadd, groupdel, groupmod,
|
||||
@@ -972,12 +535,12 @@ shadow-4.0.12 -> shadow-4.0.13 10-10-2005
|
||||
This will permit to adduser Debian script to detect if chage failed because the
|
||||
system doesn't have shadowed passwords (fix for http://bugs.debian.org/317012),
|
||||
- merge 010_more-i18ned-messages Debian patch which adds i18n support for few
|
||||
more messages (originally patch was prepared by Guillem Jover <guillem@debian.org>),
|
||||
more messages (orginaly patch was prepared by Guillem Jover <guillem@debian.org>),
|
||||
- lastlog: added handle -b option which allow print only lastlog records older than
|
||||
specified DAYS (fix by <miles@lubin.us>),
|
||||
- chpasswd, gpasswd, newusers: fixed libmisc/salt.c for use login.defs::MD5_CRYPT_ENAB
|
||||
only if PAM support is disabled (fix by John Gatewood Ham <zappaman@buraphalinux.org>),
|
||||
- passwd: rewritten for use getopt_long(),
|
||||
- passwd: rewrited for use getopt_long(),
|
||||
- newgrp: when newgrp process sits between parent and child shells, it should
|
||||
propagate STOPs from child to parent and CONTs from parent to child,
|
||||
otherwise e.g. bash's "suspend" command won't work
|
||||
@@ -987,11 +550,11 @@ shadow-4.0.12 -> shadow-4.0.13 10-10-2005
|
||||
- chsh(1), groupadd(8), newusers(8), pwconv(8), useradd(8), userdel(8), usermod(8):
|
||||
added missing references to /etc/login.defs and login.defs(5)
|
||||
(Christian Perrier <bubulle@kheops.frmug.org>),
|
||||
- passwd(5): rewritten based on work by Greg Wooledge <greg@wooledge.org>
|
||||
- passwd(5): rewrited based on work by Greg Wooledge <greg@wooledge.org>
|
||||
http://bugs.debian.org/328113
|
||||
- login(1): added securetty(5) to SEE ALSO section
|
||||
(fixed Debian bug http://bugs.debian.org/325773),
|
||||
- groupadd(8), useradd(8): fix regular expression describing allowed login/group
|
||||
- groupadd(8), useradd(8): fix regular expression describing alloved login/group
|
||||
names (pointed by Nicolas François <nicolas.francois@centraliens.net>)
|
||||
(correct is [a-z_][a-z0-9_-]*[$]),
|
||||
- groupadd(8), useradd(8): documents in CAVEATS section the limitations shadow
|
||||
@@ -1001,9 +564,9 @@ shadow-4.0.12 -> shadow-4.0.13 10-10-2005
|
||||
shadow-4.0.11.1 -> shadow-4.0.12 22-08-2005
|
||||
|
||||
*** general:
|
||||
- newgrp, login: remove using login.defs::CLOSE_SESSIONS variable and always
|
||||
- newgrp, login: remove using login.defs::CLOSE_SESSIONS variable and allways
|
||||
close PAM session,
|
||||
- fixed configure.in: really enable shadow group support by default (pointed by
|
||||
- fixed configure.in: realy enable shadow group support by default (pointed by
|
||||
Greg Schafer <gschafer@zip.com.au> and Peter Vrabec <pvrabec@redhat.com>),
|
||||
- login.defs: removed handle QMAIL_DIR variable,
|
||||
- login: allow regular user to login on read-only root file system (not only for root)
|
||||
@@ -1028,9 +591,9 @@ shadow-4.0.11.1 -> shadow-4.0.12 22-08-2005
|
||||
period and permit brute-force attacks (fixed http://bugs.debian.org/288827),
|
||||
- uClibc fixes (by Martin Schlemmer <azarah@nosferatu.za.org>):
|
||||
added require ngettext (added [need-ngettext] to AM_GNU_GETTEXT() parameters)
|
||||
and stub prototype for ngettext() in lib/prototypes.h (necessary if shadow
|
||||
and stub prototype for ngettext() in lib/prototypes.h (neccessary if shadow
|
||||
compiled with disabled NLS support)
|
||||
- groupadd: rewritten for use getopt_long(),
|
||||
- groupadd: rewrited for use getopt_long(),
|
||||
- groupadd, groupdel, groupmod, userdel: do OPENLOG() before pam_start(),
|
||||
- groupadd: fixed double OPENLOG(),
|
||||
- removed lib/{grpack,gspack,pwpack,sppack}.c and prototypes from lib/prototypes.h
|
||||
@@ -1066,7 +629,7 @@ shadow-4.0.10 -> shadow-4.0.11 18-07-2005
|
||||
- su: ignore SIGINT while authenticating. A ^C could defeat the waiting period and
|
||||
permit brute-force attacks. Also ignore SIGQUIT.
|
||||
Fixed: http://bugs.debian.org/52372 and http://bugs.debian.org/288827
|
||||
- useradd: rewritten for use getopt_long(),
|
||||
- useradd: rewrited for use getopt_long(),
|
||||
- newgrp: add fix for handle splitted NIS groups: extends the functionality that,
|
||||
if the requested group is given, all groups of the same GID are tested for
|
||||
membership of the requesting user.
|
||||
@@ -1097,7 +660,7 @@ shadow-4.0.10 -> shadow-4.0.11 18-07-2005
|
||||
- updated translations: cs, da, de, es, fi, pl, pt, ro, ru, sk.
|
||||
*** documentation:
|
||||
- pwck(8): document -q option (based on Debian patch for fix http://bugs.debian.org/309408)
|
||||
- pwck(8): rewritten OPTIONS section and better SYNOPSIS,
|
||||
- pwck(8): rewrited OPTIONS section and better SYNOPSIS,
|
||||
- lastlog(8): document that lastlog is a sparse file, and don't need to be rotated
|
||||
http://bugs.debian.org/219321
|
||||
- login(8): better explain the respective roles of login, init and getty with regards
|
||||
@@ -1111,12 +674,12 @@ shadow-4.0.9 -> shadow-4.0.10 28-06-2005
|
||||
|
||||
*** general:
|
||||
- mkpasswd: removed,
|
||||
- userdel: now deletes user groups from /etc/gshadow as well as /etc/group.
|
||||
- userdel: now deletes user groups from /etc/gshdow as well as /etc/group.
|
||||
Fix by Nicolas François <nicolas.francois@centraliens.net>.
|
||||
http://bugs.debian.org/99442
|
||||
- usermod: when relocating a user's home directory, don't fail and remove the new
|
||||
home directory if we can't remove the old home directory for some
|
||||
reason; the results can be spectacularly poor if, for instance, only
|
||||
reason; the results can be spectularly poort if, for instance, only
|
||||
the rmdir() fails. Patch prepared by Timo Lindfors <lindi-spamtrap@newmail.com>.
|
||||
http://bugs.debian.org/166369
|
||||
- su: fix syslogs to be less ambiguous. Use old:new format instead of old-new
|
||||
@@ -1124,7 +687,7 @@ shadow-4.0.9 -> shadow-4.0.10 28-06-2005
|
||||
http://bugs.debian.org/213592
|
||||
- removed not used now libmisc/setup.c,
|
||||
- login: use also UTMPX API instead UTMP on failure (login was affected for this
|
||||
when shadow was built without PAM support)
|
||||
when shadow was builded without PAM support)
|
||||
patch by Nicolas François <nicolas.francois@centraliens.net>
|
||||
- login: the PAM session needs to be closed as root, thus before change_uid()
|
||||
http://bugs.debian.org/53570 http://bugs.debian.org/195048 http://bugs.debian.org/211884
|
||||
@@ -1135,12 +698,12 @@ shadow-4.0.9 -> shadow-4.0.10 28-06-2005
|
||||
http://bugs.debian.org/48002
|
||||
- login: fixed username on succesful login (was using the normal username,
|
||||
when it should have used pam_user) http://bugs.debian.org/47819
|
||||
- remove using SHADOWPWD #define so now shadow is always built with shadow
|
||||
password support,
|
||||
- chage: rewritten for use getopt_long(),
|
||||
- remove using SHADOWPWD #define so now shadow is allways builded with shadow
|
||||
passwowd support,
|
||||
- chage: rewrited for use getopt_long(),
|
||||
- updated translations: ca, cs, da, fi, pl, ru, zh_TW.
|
||||
*** documentation:
|
||||
- most of the man pages now are generated from XML files so in case submitting any
|
||||
- most of the man pages now are generated from XML files so in case submiting any
|
||||
chages to this resources please make diff to XML files,
|
||||
- chfn: give more details about the influence of login.defs on what's allowed to
|
||||
users.
|
||||
@@ -1148,7 +711,7 @@ shadow-4.0.9 -> shadow-4.0.10 28-06-2005
|
||||
shadow-4.0.8 -> shadow-4.0.9 23-05-2005
|
||||
|
||||
*** general:
|
||||
- passwd: fixed segfault in non-PAM configuration
|
||||
- passwd: fixed segfault in non-PAM connfiguration
|
||||
(submited by Greg Schafer <gschafer@zip.com.au>),
|
||||
- newgrp: fixed NULL pointer dereference - getlogin() and ttyname() can
|
||||
return NULL which is not checked (http://bugs.debian.org/162303),
|
||||
@@ -1170,15 +733,15 @@ shadow-4.0.7 -> shadow-4.0.8 26-04-2005
|
||||
- configure.in: add using AC_GNU_SOURCE macro for kill compilation warnings about
|
||||
implicit declaration of function `fseeko',
|
||||
- faillog: changed faillog record display format for allow fit in 80 columns all
|
||||
faillog attributes,
|
||||
faillog atributies,
|
||||
- removed NDBM code (unused),
|
||||
- fixed use of SU_WHEEL_ONLY in su. Now su really is available for wheel group
|
||||
- fixed use of SU_WHEEL_ONLY in su. Now su realy is avalaible for wheel group
|
||||
members. Thanks to Mike Frysinger <vapier@gentoo.org> for report:
|
||||
http://bugs.gentoo.org/show_bug.cgi?id=80345
|
||||
- drop never finished kerberos and des_rpc support (for kerberos support back firs
|
||||
must be prepared modularization),
|
||||
- fixed UTMP path detection (by Kelledin <kelledin@users.sf.net>),
|
||||
- useradd: rewritten group count to dynamic (by John Newbigin
|
||||
- useradd: rewrited group count to dynamic (by John Newbigin
|
||||
<jnewbigin@ict.swin.edu.au>),
|
||||
- login: fixed create lastlog entry fo users never loged in on non-PAM
|
||||
variant of login (fix by <oracular@ziplip.com>),
|
||||
@@ -1193,7 +756,7 @@ shadow-4.0.7 -> shadow-4.0.8 26-04-2005
|
||||
fchmod() is executed. (Actually, we could also pass the final "mode" to
|
||||
the open() call and then save the consequent fchmod().)
|
||||
- SELinux changes: added changes in chage, chfn, chsh, passwd for allow
|
||||
construct more grained user password/account properties on SELinux
|
||||
construct more grained user password/accuunt properties on SELinux
|
||||
policies level. Patch originally based on RH changes (submited by Chris
|
||||
PeBenito <pebenito@gentoo.org>),
|
||||
- added SELinux changes: in libmisc/copydir.c (based on Fedora patch),
|
||||
@@ -1211,7 +774,7 @@ shadow-4.0.7 -> shadow-4.0.8 26-04-2005
|
||||
- newgrp(1): fix #251926, #166173, #113191 Debian bugs: explain why editing /etc/group
|
||||
(without gshadow) doesn't permit to use newgrp,
|
||||
- newgrp(1): newgrp uses /bin/sh (not bash),
|
||||
- faillog(8): updated after rewritten faillog command for use getopt_long(),
|
||||
- faillog(8): updated after rewrited faillog command for use getopt_long(),
|
||||
- login(1): removed fragment about abilities pass enviroment variables in login prompt,
|
||||
- gshadow(5): new file (by Nicolas Nicolas François <nicolas.francois@centraliens.net>),
|
||||
- usermod(8): fixed #302388 Debian bug: added separated -o option description,
|
||||
@@ -1229,24 +792,24 @@ shadow-4.0.6 -> shadow-4.0.7 26-01-2005
|
||||
-- use fseeko() instead fseek() and remove casting file offsets to unsigned
|
||||
long.
|
||||
- lastlog:
|
||||
-- rewritten source code using the same style as in chpasswd.c,
|
||||
-- open lastlog file after finish parse commandline options
|
||||
(now --help output can be displayed for users without lastlog
|
||||
-- rewrited source code using the same style as in chpasswd.c,
|
||||
-- open lastlog file after finish parse comman line optiomns
|
||||
(now --help otput can be displayd for users without lastlog
|
||||
file read permission),
|
||||
-- cleanups in lastlog(8) man page using the same style as in
|
||||
chpasswd(8).
|
||||
- chpasswd:
|
||||
-- switch chpasswd to use getopt_long() and adds a --md5 option
|
||||
(by Ian Gulliver <ian@penguinhosting.net>),
|
||||
-- rewritten chpasswd(8) man page.
|
||||
-- rewrited chpasswd(8) man page.
|
||||
|
||||
shadow-4.0.5 -> shadow-4.0.6 08-11-2004
|
||||
|
||||
- su: fixed adding of pam_env env variables to enviroment
|
||||
(Martin Schlemmer <azarah@nosferatu.za.org>),
|
||||
- autoconf: fixed filling MAIL_SPOOL_DIR and MAIL_SPOOL_FILE variables
|
||||
which was always empty (Gregorio Guidi <g.guidi@sns.it>),
|
||||
- really close security bug in libmisc/pwdcheck.c,
|
||||
which was allways empty (Gregorio Guidi <g.guidi@sns.it>),
|
||||
- realuy closse security bug in libmisc/pwdcheck.c,
|
||||
- added missing template/example PAM service config files for chfn, chsh and
|
||||
userdel,
|
||||
- do not translate variable names from /etc/default/useradd during
|
||||
@@ -1257,10 +820,10 @@ shadow-4.0.4.1 -> shadow-4.0.5 27-10-2004
|
||||
- change libmisc to private static library,
|
||||
- added SELinux support (basing on patch from Gentoo),
|
||||
- chage: more verbose/human readable -l output. This output is much more
|
||||
better for send directly via email for each users as message with account
|
||||
beter for send directly via email for each users as message with account
|
||||
status (for example as message with warning about account/password expiration),
|
||||
- login: fixed handle -f option: now it works correctly without specify "-h
|
||||
<host>" if open login session locally is required (thanks for help
|
||||
<host>" if open login session localy is required (thanks for help
|
||||
investigate bug for Krzysztof Kotlenga),
|
||||
- userdel: when removing a user with userdel, userdel was always exits with 1 (fixed).
|
||||
Based on http://bugs.gentoo.org/show_bug.cgi?id=66687,
|
||||
@@ -1274,7 +837,7 @@ shadow-4.0.4.1 -> shadow-4.0.5 27-10-2004
|
||||
makes httpd Option SymlinkIfOwnerMatch break for default weg pages
|
||||
including symlinks placed into /etc/skel/public_html for example.
|
||||
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=66819
|
||||
- su: add pam_open_session() support. If built without PAM support
|
||||
- su: add pam_open_session() support. If builded without PAM support
|
||||
propagate $DISPLAY and $XAUTHORITY enviroment variables.
|
||||
Based on http://www.gentoo.org/cgi-bin/viewcvs.cgi/sys-apps/shadow/files/shadow-4.0.4.1-su-pam_open_session.patch?rev=1.1
|
||||
- applied 036_pam_access_with_preauth.patch Debian patch submited by Bjorn
|
||||
@@ -1287,11 +850,11 @@ shadow-4.0.4.1 -> shadow-4.0.5 27-10-2004
|
||||
Use constant strings rather than argv[0] for syslog ident in the user
|
||||
management commands,
|
||||
shadow-4.0.4.1-owl-tmp.diff:
|
||||
Remove using mktemp() if mkstemp() prototype not found (use always mkstemp()),
|
||||
Remove using mktemp() if mkstemp() prototype not found (use allways mkstemp()),
|
||||
shadow-4.0.4.1-owl-check-reads.diff:
|
||||
Add checking for read errors in commonio and vipw/vigr (not doing so could
|
||||
result in data loss when the records are written back),
|
||||
- fixed security bug in libmisc/pwdcheck.c which allow unauthorized
|
||||
- fixed securirty bug in libmisc/pwdcheck.c which allow unauthorized
|
||||
account properties modification.
|
||||
Affected tools: chfn and chsh.
|
||||
Bug was discovered by Martin Schulze <joey@infodrom.org>.
|
||||
@@ -1307,12 +870,12 @@ shadow-4.0.4.1 -> shadow-4.0.5 27-10-2004
|
||||
|
||||
shadow-4.0.4 => shadow-4.0.4.1 14-01-2004
|
||||
- bug fixes in automake files for generate correct tar ball on "make dist":
|
||||
added missing "EXTRA_DIST = $(man_MANS)" in man/*/Makefile.am.
|
||||
added mising "EXTRA_DIST = $(man_MANS)" in man/*/Makefile.am.
|
||||
|
||||
shadow-4.0.3 => shadow-4.0.4 14-01-2004
|
||||
|
||||
*** general:
|
||||
- added missing information about -f options in groupadd usage message
|
||||
- added missing information about -f options in groupadd usage mesage
|
||||
(document this also in man page),
|
||||
- removed TCFS support (tcfs is dead),
|
||||
- convert all po/*.po files to utf-8,
|
||||
@@ -1320,7 +883,7 @@ shadow-4.0.3 => shadow-4.0.4 14-01-2004
|
||||
per service flushing method instead HUPing nscd process),
|
||||
- removed old AUTH_METHODS dependent code,
|
||||
- chage: now all code depend on SHADOWPWD. If shadow will not be configured
|
||||
on autoconf level for using shadow password chage is olny stub which
|
||||
on autoconf level for using shadow possword chage is olny stub which
|
||||
informs "chage not configured for shadow password support."
|
||||
- dpasswd: removed,
|
||||
- login: remove handle login.defs::DIALUPS_CHECK_ENAB code,
|
||||
@@ -1328,7 +891,7 @@ shadow-4.0.3 => shadow-4.0.4 14-01-2004
|
||||
- ALL tools, libraries: remove old SVR4, SVR4_SI86_EUA BSD_QUOTA and ATT_AGE
|
||||
dependent code,
|
||||
- ALL: ready for gettext 0.11.5, automake 1.7.4, autoconf 2.57,
|
||||
- logoutd, userd: handle also utmpx if available,
|
||||
- logoutd, userd: handle also utmpx if avalaile,
|
||||
- newgrp: fix for non-PAM version
|
||||
Use CLOSE_SESSIONS depending code only when USE_PAM.
|
||||
The problem was reported by Mattias Webjorn Eriksson using Slackware
|
||||
@@ -1356,7 +919,7 @@ shadow-4.0.3 => shadow-4.0.4 14-01-2004
|
||||
|
||||
shadow-4.0.2 => shadow-4.0.3 13-03-2002
|
||||
|
||||
- added various cs, de, fr, id, it, ko man pages found mainly in national
|
||||
- added variouse cs, de, fr, id, it, ko man pages found mainly in national
|
||||
man pages translations projects (this documents are not synced with
|
||||
current en version but you know .. "Documentations is lik sex. When it is
|
||||
good it very very good. Whet it is bad it is better than nothing."). Any
|
||||
@@ -1372,9 +935,9 @@ shadow-4.0.2 => shadow-4.0.3 13-03-2002
|
||||
shadow-4.0.1 => shadow-4.0.2 17-02-2002
|
||||
|
||||
- resolve many fuzzy translations also all this which may cause problems on
|
||||
displaying long uid/gid,
|
||||
- allow use "$" on ending in created by useradd username accounts for allow
|
||||
create machine accounts for samba (thanks to Jerome Borsboom
|
||||
displaing long uid/gid,
|
||||
- allow use "$" on ending in cereated by useradd usermname accounts for allow
|
||||
create machine acounts for samba (thanks to Jerome Borsboom
|
||||
<borsboom@tch.fgg.eur.nl> for point this problem in 4.0.1),
|
||||
- fix small but ugly bug in configure.in in libpam_mics library detection.
|
||||
|
||||
@@ -1394,7 +957,7 @@ shadow-4.0.0 => shadow-4.0.1
|
||||
as root. If root does read-only, there's no lock needed. Added missing
|
||||
"#include <errno.h>" for above (me).
|
||||
shadow-4.0.0-owl-warnings.diff
|
||||
Olny one fix from this patch was applied because other was fixed few days
|
||||
Olny one fix from this patch was aplayd because other was fixed few days
|
||||
before :)
|
||||
shadow-4.0.0-owl-check_names.diff
|
||||
Merge only prat this patch with checking login name matching; checking
|
||||
@@ -1402,7 +965,7 @@ shadow-4.0.0 => shadow-4.0.1
|
||||
probably _POSIX_LOGIN_NAME_MAX from <bits/posix1_lim.h>,
|
||||
shadow-4.0.0-owl-chage-drop-priv.diff
|
||||
shadow-4.0.0-owl-pam-auth.diff
|
||||
Merge part with reorder initialize PAM and checking if chage is runed by
|
||||
Merge part with reorder initialize PAM and checkin is chage is runed by
|
||||
root or not - now chage can be runed from non-root account for checking
|
||||
by user own account information (if PAM enabled).
|
||||
- fixes for handle/print correctly 32bit uid/gid (Thorsten Kukuk <kukuk@suse.de>),
|
||||
@@ -1446,30 +1009,30 @@ shadow-20001016 => shadow-4.0.0 06-01-2002
|
||||
- much better automake support,
|
||||
- added pt_BR man pages for gpasswd(1), groupadd(8), groupdel(8),
|
||||
groupmod(8), shadow(5) (man pages for other nations also are welcome),
|
||||
- many small fixes and updates nad improvements in man pages,
|
||||
- applied Debian patch to man pages for shadowconfig,
|
||||
- mamny small fixes and updates nad improvements in man pages,
|
||||
- aplayed Debian patch to man pages for shadowconfig,
|
||||
- remove limit to 6 chars logged tty name (012_libmisc_sulog.c.diff Debian
|
||||
patch).
|
||||
|
||||
shadow-20001012 -> shadow-20001016:
|
||||
- conditionally disabled body reload_nscd() because not every
|
||||
- conditionaly disabled body reload_nscd() because not every
|
||||
version of nscd can handle it (this can be enabled by define
|
||||
ENABLE_NSCD_SIGHUP) (Marek Michałkiewicz <marekm@linux.org.pl>)
|
||||
- fixes on autoconf/automake level for dist target,
|
||||
- Julianne F. Haugh new contact address.
|
||||
- Julianne F. Haugh new contact adress.
|
||||
|
||||
shadow-20000902 => shadow-20001012
|
||||
|
||||
- removed /redhat directory with obsoleted files (partially rewritten spec
|
||||
- removed /redhat directory with obsoleted files (partialy rewrited spec
|
||||
file is now in root directory),
|
||||
- applied shadow-19990827-group.patch patch from RH wich prevents adduser
|
||||
- aplayed shadow-19990827-group.patch patch from RH wich prevents adduser
|
||||
overwrite previously existing groups in adduser,
|
||||
- added PAM support for chage (bind to "chage" PAM config file) also
|
||||
added PAM support for all other small tools like chpasswd, groupadd,
|
||||
groupdel, groupmod, newusers, useradd, userdel, usermod (bind to common
|
||||
"shadow" PAM config file) - this modifications mainly based on
|
||||
"shadow" PAM config file) - this modificaytions mainly based on
|
||||
modifications prepared by Janek Rękojarski <baggins@pld.org.pl>,
|
||||
- many small fixes and improvements in automake (mow "make dist"
|
||||
- many small fixes and improvments in automake (mow "make dist"
|
||||
works correctly),
|
||||
- added cs translation (Jiri Pavlovsky <Jiri.Pavlovsky@ff.cuni.cz>).
|
||||
|
||||
|
||||
46
README
46
README
@@ -1,26 +1,26 @@
|
||||
Shadow SITES
|
||||
============
|
||||
|
||||
Homepage
|
||||
http://github.com/shadow-maint/shadow
|
||||
FTP site
|
||||
ftp://pkg-shadow.alioth.debian.org/pub/pkg-shadow
|
||||
|
||||
Issue tracker
|
||||
http://github.com/shadow-maint/shadow/issues
|
||||
SVN repository
|
||||
anonymous read only access: svn://svn.debian.org/pkg-shadow/
|
||||
|
||||
Releases
|
||||
https://github.com/shadow-maint/shadow/releases
|
||||
SVN web interface
|
||||
http://svn.debian.org/wsvn/pkg-shadow
|
||||
|
||||
Mailing lists
|
||||
for general discuss: pkg-shadow-devel@alioth-lists.debian.net
|
||||
commit list: pkg-shadow-commits@alioth-lists.debian.net
|
||||
for general discuss: pkg-shadow-devel@lists.alioth.debian.org
|
||||
commit list: pkg-shadow-commits@lists.alioth.debian.org
|
||||
|
||||
Mailing lists subscription
|
||||
http://alioth-lists.debian.net/mailman/listinfo/pkg-shadow-devel
|
||||
http://alioth-lists.debian.net/mailman/listinfo/pkg-shadow-commits
|
||||
http://lists.alioth.debian.org/mailman/listinfo/pkg-shadow-devel
|
||||
http://lists.alioth.debian.org/mailman/listinfo/pkg-shadow-commits
|
||||
|
||||
Mailing lists archives:
|
||||
http://alioth-lists.debian.net/pipermail/pkg-shadow-devel/
|
||||
http://alioth-lists.debian.net/pipermail/pkg-shadow-commits/
|
||||
http://lists.alioth.debian.org/pipermail/pkg-shadow-devel/
|
||||
http://lists.alioth.debian.org/pipermail/pkg-shadow-commits/
|
||||
|
||||
S/Key support:
|
||||
Shadow can be built with S/Key support using the S/Key package from:
|
||||
@@ -32,14 +32,13 @@ S/Key support:
|
||||
Authors and contributors
|
||||
========================
|
||||
|
||||
Thanks to at least the following people for sending patches, bug
|
||||
Thanks to at least the following people for sending me patches, bug
|
||||
reports and various comments. This list may be incomplete, I received
|
||||
a lot of mail...
|
||||
|
||||
|
||||
Adam Rudnicki <adam@v-lo.krakow.pl>
|
||||
Alan Curry <pacman@tardis.mars.net>
|
||||
Aleksa Sarai <cyphar@cyphar.com>
|
||||
Alexander O. Yuriev <alex@bach.cis.temple.edu>
|
||||
Algis Rudys <arudys@rice.edu>
|
||||
Andreas Jaeger <aj@arthur.rhein-neckar.de>
|
||||
@@ -51,16 +50,12 @@ Brian R. Gaeke <brg@dgate.org>
|
||||
Calle Karlsson <ckn@kash.se>
|
||||
Chip Rosenthal <chip@unicom.com>
|
||||
Chris Evans <lady0110@sable.ox.ac.uk>
|
||||
Chris Lamb <chris@chris-lamb.co.uk>
|
||||
Cristian Gafton <gafton@sorosis.ro>
|
||||
Dan Walsh <dwalsh@redhat.com>
|
||||
Darcy Boese <possum@chardonnay.niagara.com>
|
||||
Dave Hagewood <admin@arrowweb.com>
|
||||
David A. Holland <dholland@hcs.harvard.edu>
|
||||
David Frey <David.Frey@lugs.ch>
|
||||
Ed Carp <ecarp@netcom.com>
|
||||
Ed Neville <ed@s5h.net>
|
||||
Eric W. Biederman" <ebiederm@xmission.com>
|
||||
Floody <flood@evcom.net>
|
||||
Frank Denis <j@4u.net>
|
||||
George Kraft IV <gk4@us.ibm.com>
|
||||
@@ -68,9 +63,7 @@ Greg Mortensen <loki@world.std.com>
|
||||
Guido van Rooij
|
||||
Guy Maor <maor@debian.org>
|
||||
Hrvoje Dogan <hdogan@bjesomar.srce.hr>
|
||||
Jakub Hrozek <jhrozek@redhat.com>
|
||||
Janos Farkas <chexum@bankinf.banki.hu>
|
||||
Jason Franklin <jason.franklin@quoininc.com>
|
||||
Jay Soffian <jay@lw.net>
|
||||
Jesse Thilo <Jesse.Thilo@pobox.com>
|
||||
Joey Hess <joey@kite.ml.org>
|
||||
@@ -81,31 +74,23 @@ Joshua Cowan <jcowan@hermit.reslife.okstate.edu>
|
||||
Judd Bourgeois <shagboy@bluesky.net>
|
||||
Juergen Heinzl <unicorn@noris.net>
|
||||
Juha Virtanen <jiivee@iki.fi>
|
||||
Julian Pidancet <julian.pidancet@gmail.com>
|
||||
Julianne Frances Haugh <jockgrrl@ix.netcom.com>
|
||||
Leonard N. Zubkoff <lnz@dandelion.com>
|
||||
Luca Berra <bluca@www.polimi.it>
|
||||
Lukáš Kuklínek <lkukline@redhat.com>
|
||||
Lutz Schwalowsky <schwalow@mineralogie.uni-hamburg.de>
|
||||
Marc Ewing <marc@redhat.com>
|
||||
Martin Bene <mb@sime.com>
|
||||
Martin Mares <mj@gts.cz>
|
||||
Michael Meskes <meskes@topsystem.de>
|
||||
Michael Talbot-Wilson <mike@calypso.bns.com.au>
|
||||
Michael Vetter <jubalh@iodoru.org>
|
||||
Mike Frysinger <vapier@gentoo.org>
|
||||
Mike Pakovic <mpakovic@users.southeast.net>
|
||||
Nicolas François <nicolas.francois@centraliens.net>
|
||||
Nikos Mavroyanopoulos <nmav@i-net.paiko.gr>
|
||||
Pavel Machek <pavel@bug.ucw.cz>
|
||||
Peter Vrabec <pvrabec@redhat.com>
|
||||
Phillip Street
|
||||
Rafał Maszkowski <rzm@icm.edu.pl>
|
||||
Rani Chouha <ranibey@smartec.com>
|
||||
Sami Kerola <kerolasa@rocketmail.com>
|
||||
Scott Garman <scott.a.garman@intel.com>
|
||||
Sebastian Rick Rijkers <srrijkers@gmail.com>
|
||||
Seraphim Mellos <mellos@ceid.upatras.gr>
|
||||
Shane Watts <shane@nexus.mlckew.edu.au>
|
||||
Steve M. Robbins <steve@nyongwa.montreal.qc.ca>
|
||||
Thorsten Kukuk <kukuk@suse.de>
|
||||
@@ -117,8 +102,5 @@ Werner Fink <werner@suse.de>
|
||||
Maintainers
|
||||
===========
|
||||
|
||||
Tomasz Kłoczko <kloczek@pld.org.pl> (2000-2007)
|
||||
Nicolas François <nicolas.francois@centraliens.net> (2007-2014)
|
||||
Serge E. Hallyn <serge@hallyn.com> (2014-now)
|
||||
Christian Brauner <christian@brauner.io> (2019-now)
|
||||
Tomasz Kłoczko <kloczek@pld.org.pl> (2000-2006)
|
||||
|
||||
|
||||
121
TODO
121
TODO
@@ -1,45 +1,11 @@
|
||||
* Create a common usage function that'd take the array of
|
||||
long options and an array of descriptions and output that so things would
|
||||
be standardized across the utils.
|
||||
Usage strings should be normalized and split first.
|
||||
Investigate optparse.
|
||||
passwd -l should lock the password, not the account.
|
||||
|
||||
vipw: Test SHADOWGRP support before using gshadow features.
|
||||
|
||||
/etc/default/useradd
|
||||
* GROUP=1000 should accept a group name.
|
||||
PAM: add support for customization of the PAM support (i.e. support the
|
||||
Debian PAM configuration)
|
||||
|
||||
Check when RLOGIN is enabled if ruserok() exists
|
||||
|
||||
Move selinux_file_context out of libmisc/copydir.c
|
||||
|
||||
Review hardcoded root account?
|
||||
|
||||
review all call to strto
|
||||
|
||||
libmisc/cleanup_user.c
|
||||
cleanup needed (cleanup_report_add_user* not used)
|
||||
|
||||
|
||||
libxcrypt support
|
||||
* http://wiki.linuxfromscratch.org/patches/browser/trunk/shadow/shadow-4.0.18.1-owl_blowfish-1.patch
|
||||
|
||||
implement getlong, getulong.
|
||||
avoid atoi, atol, atoul, strtol, strtoul, ...
|
||||
|
||||
manpages: comment the RLOGIN parts
|
||||
|
||||
Replace build_list (in lib/gshadow.c) and list (in lib/sgetgrent.c) by
|
||||
comma_to_list()
|
||||
|
||||
Revert the modified files if all files could not be changed.
|
||||
* or warn and indicate which files were modified and which were not.
|
||||
* check the order the files are modified.
|
||||
|
||||
report nscd_flush_cache failures?
|
||||
call nscd from the programs or from lib (commonio?)
|
||||
|
||||
PAM: check if a non-interactive conversation function could be used to set
|
||||
the password in chpasswd and newusers
|
||||
PAM: check if a non-interactive conversation function could be used to
|
||||
|
||||
WITH_SELINUX
|
||||
- review all tools to check that the strategies are consistent
|
||||
@@ -47,20 +13,33 @@ WITH_SELINUX
|
||||
chage, chfn, chsh: same change needed as in passwd.
|
||||
- probably need moving check_selinux_access to a separate file.
|
||||
|
||||
man useradd
|
||||
document default behavior for GROUP
|
||||
remove "The default group number is 1 or whatever is..."
|
||||
|
||||
useradd manpage
|
||||
- add -k option
|
||||
- mention that -o require -u
|
||||
|
||||
testsuite
|
||||
- newgrp
|
||||
- test with unknown user's GID
|
||||
|
||||
newusers
|
||||
- add logging to SYSLOG & AUDIT
|
||||
- use CREATE_HOME
|
||||
- Add a -Z option (see useradd / usermod)
|
||||
|
||||
faillog
|
||||
- accept numerical user and range of users
|
||||
|
||||
Document when/where option appeared, document whether an option is standard
|
||||
or not.
|
||||
|
||||
depends rules for the manpages
|
||||
|
||||
Check all the expiry semantics
|
||||
|
||||
Add options --crypt-method and --sha-rounds to gpasswd
|
||||
|
||||
ALL:
|
||||
- move base passwd/shadow/group/gshadow operation to module for allow write
|
||||
different backend modules for db, NIS, LDAP and others. Default backend it
|
||||
@@ -70,58 +49,38 @@ ALL:
|
||||
passwd have old piece of code with handling -r option and it will be good
|
||||
finish this and propagate on other shadow tools for allow operate on other
|
||||
user databases by well known tools.
|
||||
- Protect against signals. Register do_cleanups in a signal handler.
|
||||
|
||||
- login.defs
|
||||
- generate depending on configuration
|
||||
|
||||
- useradd:
|
||||
- add handle create user mail spool in maildir format.
|
||||
- Add support for -k in -D mode
|
||||
- Add support for -K in -D mode
|
||||
- Add option to create or not the mail spool (and set the default in -D
|
||||
mode)
|
||||
- Change -l to reset the entry if an entry was already there
|
||||
- set the mask in mkdir?
|
||||
|
||||
- add handle -n switch in groups and id command for allow query is
|
||||
group/user with specified id/gid exist - this will be very usable
|
||||
on automation in packages for query/check is group/user exist in system
|
||||
or not,
|
||||
|
||||
- groupmems:
|
||||
- need some work on add PAM and i18n support.
|
||||
|
||||
- userdel:
|
||||
- add backup option for the removal of user resources,
|
||||
- add lookop and remove per user group.
|
||||
- user_busy: check that the user is not running any processes.
|
||||
- missing "deleting group" FAILED
|
||||
- home dir removed, but userdel may fail and may leave the user
|
||||
=> warning needed
|
||||
|
||||
- usermod
|
||||
- add an option equivalent to useradd's -l (only when uid is changed)
|
||||
- the mode of new home directories should be set according to the
|
||||
original mode. Does copy_tree does this?
|
||||
- user renamed, order is not kept in /etc/group (see
|
||||
47_usermod-l_no_shadow_file). This is a problem when the first user is
|
||||
considered as the admin.
|
||||
- see mail "user ID change" on April, 15
|
||||
+ fix call to chown (combination of -m and -u/-g)
|
||||
+ add tests
|
||||
|
||||
- passwd:
|
||||
- check combination of options (e.g. -u/-l)
|
||||
- when -u refuse to unlock because it would create an empty password, it
|
||||
should not display "Password changed."
|
||||
exit instead?
|
||||
|
||||
- newgrp: check the USE_PAM section.
|
||||
|
||||
- pwck
|
||||
- Add check to move passwd passwords to shadow if there is a shadow
|
||||
entry (with a password).
|
||||
- Add check to move passwd passwords to shadow if there is a shadow
|
||||
file.
|
||||
- Support an alternative /etc/tcb directory as second parameter.
|
||||
- add options -g / -G to specify alternative group / gshadow files
|
||||
- groupmems: check reason for isgroup
|
||||
|
||||
- su
|
||||
- add a login.defs configuration parameter to add variables to keep in
|
||||
the environment with "su -l" (TERM/TERMCOLOR/...)
|
||||
- newusers: doc for pw_gid not clear. Differentiate
|
||||
pw_gid specified and exist
|
||||
pw_gid specified but does not exist
|
||||
* name
|
||||
* number
|
||||
pw_gid not specified.
|
||||
- newusers: document what happens when no uid is specified.
|
||||
- newusers: add option --system?
|
||||
|
||||
- vipw
|
||||
- set ACLs and XATTRs on the temporary file (and backups?)
|
||||
- vipw + selinux -> use lib/selinux.c
|
||||
-Documentation:
|
||||
* document when options were added.
|
||||
|
||||
@@ -1,12 +1,10 @@
|
||||
#! /bin/sh
|
||||
|
||||
autoreconf -v -f --install || exit 1
|
||||
|
||||
./configure \
|
||||
CFLAGS="-O2 -Wall" \
|
||||
--enable-man \
|
||||
--enable-maintainer-mode \
|
||||
--enable-shared \
|
||||
--disable-shared \
|
||||
--without-libpam \
|
||||
--with-selinux \
|
||||
"$@"
|
||||
|
||||
774
configure.ac
774
configure.ac
@@ -1,774 +0,0 @@
|
||||
dnl Process this file with autoconf to produce a configure script.
|
||||
AC_PREREQ([2.69])
|
||||
m4_define([libsubid_abi_major], 3)
|
||||
m4_define([libsubid_abi_minor], 0)
|
||||
m4_define([libsubid_abi_micro], 0)
|
||||
m4_define([libsubid_abi], [libsubid_abi_major.libsubid_abi_minor.libsubid_abi_micro])
|
||||
AC_INIT([shadow], [4.9], [pkg-shadow-devel@lists.alioth.debian.org], [],
|
||||
[https://github.com/shadow-maint/shadow])
|
||||
AM_INIT_AUTOMAKE([1.11 foreign dist-xz])
|
||||
AC_CONFIG_MACRO_DIRS([m4])
|
||||
AM_SILENT_RULES([yes])
|
||||
AC_CONFIG_HEADERS([config.h])
|
||||
|
||||
AC_SUBST([LIBSUBID_ABI_MAJOR], [libsubid_abi_major])
|
||||
AC_SUBST([LIBSUBID_ABI_MINOR], [libsubid_abi_minor])
|
||||
AC_SUBST([LIBSUBID_ABI_MICRO], [libsubid_abi_micro])
|
||||
AC_SUBST([LIBSUBID_ABI], [libsubid_abi])
|
||||
|
||||
dnl Some hacks...
|
||||
test "$prefix" = "NONE" && prefix="/usr"
|
||||
test "$prefix" = "/usr" && exec_prefix=""
|
||||
|
||||
AC_GNU_SOURCE
|
||||
|
||||
AM_ENABLE_STATIC
|
||||
AM_ENABLE_SHARED
|
||||
|
||||
AM_MAINTAINER_MODE
|
||||
|
||||
dnl Checks for programs.
|
||||
AC_PROG_CC
|
||||
AC_ISC_POSIX
|
||||
AC_PROG_LN_S
|
||||
AC_PROG_YACC
|
||||
AM_PROG_LIBTOOL
|
||||
|
||||
dnl Checks for libraries.
|
||||
|
||||
dnl Checks for header files.
|
||||
AC_HEADER_DIRENT
|
||||
AC_HEADER_STDC
|
||||
AC_HEADER_SYS_WAIT
|
||||
AC_HEADER_STDBOOL
|
||||
|
||||
AC_CHECK_HEADERS(crypt.h errno.h fcntl.h limits.h unistd.h sys/time.h utmp.h \
|
||||
utmpx.h termios.h termio.h sgtty.h sys/ioctl.h syslog.h paths.h \
|
||||
utime.h ulimit.h sys/capability.h sys/random.h sys/resource.h \
|
||||
gshadow.h lastlog.h locale.h rpc/key_prot.h netdb.h acl/libacl.h \
|
||||
attr/libattr.h attr/error_context.h)
|
||||
|
||||
dnl shadow now uses the libc's shadow implementation
|
||||
AC_CHECK_HEADER([shadow.h],,[AC_MSG_ERROR([You need a libc with shadow.h])])
|
||||
|
||||
AC_CHECK_FUNCS(arc4random_buf l64a fchmod fchown fsync futimes getgroups \
|
||||
gethostname getentropy getrandom getspnam gettimeofday getusershell \
|
||||
getutent initgroups lchown lckpwdf lstat lutimes memcpy memset \
|
||||
setgroups sigaction strchr updwtmp updwtmpx innetgr getpwnam_r \
|
||||
getpwuid_r getgrnam_r getgrgid_r getspnam_r getaddrinfo ruserok \
|
||||
dlopen)
|
||||
AC_SYS_LARGEFILE
|
||||
|
||||
dnl Checks for typedefs, structures, and compiler characteristics.
|
||||
AC_C_CONST
|
||||
AC_TYPE_UID_T
|
||||
AC_TYPE_OFF_T
|
||||
AC_TYPE_PID_T
|
||||
AC_TYPE_MODE_T
|
||||
AC_HEADER_STAT
|
||||
AC_CHECK_MEMBERS([struct stat.st_rdev])
|
||||
AC_CHECK_MEMBERS([struct stat.st_atim])
|
||||
AC_CHECK_MEMBERS([struct stat.st_atimensec])
|
||||
AC_CHECK_MEMBERS([struct stat.st_mtim])
|
||||
AC_CHECK_MEMBERS([struct stat.st_mtimensec])
|
||||
AC_HEADER_TIME
|
||||
AC_STRUCT_TM
|
||||
|
||||
AC_CHECK_MEMBERS([struct utmp.ut_type,
|
||||
struct utmp.ut_id,
|
||||
struct utmp.ut_name,
|
||||
struct utmp.ut_user,
|
||||
struct utmp.ut_host,
|
||||
struct utmp.ut_syslen,
|
||||
struct utmp.ut_addr,
|
||||
struct utmp.ut_addr_v6,
|
||||
struct utmp.ut_time,
|
||||
struct utmp.ut_xtime,
|
||||
struct utmp.ut_tv],,,[[#include <utmp.h>]])
|
||||
|
||||
AC_CHECK_MEMBERS([struct utmpx.ut_name,
|
||||
struct utmpx.ut_host,
|
||||
struct utmpx.ut_syslen,
|
||||
struct utmpx.ut_addr,
|
||||
struct utmpx.ut_addr_v6,
|
||||
struct utmpx.ut_time,
|
||||
struct utmpx.ut_xtime],,,[[#include <utmpx.h>]])
|
||||
|
||||
if test "$ac_cv_header_lastlog_h" = "yes"; then
|
||||
AC_CACHE_CHECK(for ll_host in struct lastlog,
|
||||
ac_cv_struct_lastlog_ll_host,
|
||||
AC_COMPILE_IFELSE([AC_LANG_PROGRAM([#include <lastlog.h>],
|
||||
[struct lastlog ll; char *cp = ll.ll_host;]
|
||||
)],
|
||||
[ac_cv_struct_lastlog_ll_host=yes],
|
||||
[ac_cv_struct_lastlog_ll_host=no]
|
||||
)
|
||||
)
|
||||
|
||||
if test "$ac_cv_struct_lastlog_ll_host" = "yes"; then
|
||||
AC_DEFINE(HAVE_LL_HOST, 1,
|
||||
[Define if struct lastlog has ll_host])
|
||||
fi
|
||||
fi
|
||||
|
||||
dnl Checks for library functions.
|
||||
AC_TYPE_GETGROUPS
|
||||
AC_TYPE_SIGNAL
|
||||
AC_FUNC_UTIME_NULL
|
||||
AC_FUNC_STRFTIME
|
||||
AC_REPLACE_FUNCS(mkdir putgrent putpwent putspent rename rmdir)
|
||||
AC_REPLACE_FUNCS(sgetgrent sgetpwent sgetspent)
|
||||
AC_REPLACE_FUNCS(snprintf strcasecmp strdup strerror strstr)
|
||||
|
||||
AC_CHECK_FUNC(setpgrp)
|
||||
AC_CHECK_FUNC(secure_getenv, [AC_DEFINE(HAS_SECURE_GETENV,
|
||||
1,
|
||||
[Defined to 1 if you have the declaration of 'secure_getenv'])])
|
||||
|
||||
if test "$ac_cv_header_shadow_h" = "yes"; then
|
||||
AC_CACHE_CHECK(for working shadow group support,
|
||||
ac_cv_libc_shadowgrp,
|
||||
AC_RUN_IFELSE([AC_LANG_SOURCE([
|
||||
#include <shadow.h>
|
||||
main()
|
||||
{
|
||||
struct sgrp *sg = sgetsgent("test:x::");
|
||||
/* NYS libc on Red Hat 3.0.3 has broken shadow group support */
|
||||
return !sg || !sg->sg_adm || !sg->sg_mem;
|
||||
}]
|
||||
)],
|
||||
[ac_cv_libc_shadowgrp=yes],
|
||||
[ac_cv_libc_shadowgrp=no],
|
||||
[ac_cv_libc_shadowgrp=no]
|
||||
)
|
||||
)
|
||||
|
||||
if test "$ac_cv_libc_shadowgrp" = "yes"; then
|
||||
AC_DEFINE(HAVE_SHADOWGRP, 1, [Have working shadow group support in libc])
|
||||
fi
|
||||
fi
|
||||
|
||||
AC_CACHE_CHECK([location of shared mail directory], shadow_cv_maildir,
|
||||
[for shadow_cv_maildir in /var/mail /var/spool/mail /usr/spool/mail /usr/mail none; do
|
||||
if test -d $shadow_cv_maildir; then
|
||||
break
|
||||
fi
|
||||
done])
|
||||
if test $shadow_cv_maildir != none; then
|
||||
AC_DEFINE_UNQUOTED(MAIL_SPOOL_DIR, "$shadow_cv_maildir",
|
||||
[Location of system mail spool directory.])
|
||||
fi
|
||||
|
||||
AC_CACHE_CHECK([location of user mail file], shadow_cv_mailfile,
|
||||
[for shadow_cv_mailfile in Mailbox mailbox Mail mail .mail none; do
|
||||
if test -f $HOME/$shadow_cv_mailfile; then
|
||||
break
|
||||
fi
|
||||
done])
|
||||
if test $shadow_cv_mailfile != none; then
|
||||
AC_DEFINE_UNQUOTED(MAIL_SPOOL_FILE, "$shadow_cv_mailfile",
|
||||
[Name of user's mail spool file if stored in user's home directory.])
|
||||
fi
|
||||
|
||||
AC_CACHE_CHECK([location of utmp], shadow_cv_utmpdir,
|
||||
[for shadow_cv_utmpdir in /var/run /var/adm /usr/adm /etc none; do
|
||||
if test -f $shadow_cv_utmpdir/utmp; then
|
||||
break
|
||||
fi
|
||||
done])
|
||||
if test "$shadow_cv_utmpdir" = "none"; then
|
||||
AC_MSG_WARN(utmp file not found)
|
||||
fi
|
||||
AC_DEFINE_UNQUOTED(_UTMP_FILE, "$shadow_cv_utmpdir/utmp",
|
||||
[Path for utmp file.])
|
||||
|
||||
AC_CACHE_CHECK([location of faillog/lastlog/wtmp], shadow_cv_logdir,
|
||||
[for shadow_cv_logdir in /var/log /var/adm /usr/adm /etc; do
|
||||
if test -d $shadow_cv_logdir; then
|
||||
break
|
||||
fi
|
||||
done])
|
||||
AC_DEFINE_UNQUOTED(_WTMP_FILE, "$shadow_cv_logdir/wtmp",
|
||||
[Path for wtmp file.])
|
||||
AC_DEFINE_UNQUOTED(LASTLOG_FILE, "$shadow_cv_logdir/lastlog",
|
||||
[Path for lastlog file.])
|
||||
AC_DEFINE_UNQUOTED(FAILLOG_FILE, "$shadow_cv_logdir/faillog",
|
||||
[Path for faillog file.])
|
||||
|
||||
AC_CACHE_CHECK([location of the passwd program], shadow_cv_passwd_dir,
|
||||
[if test -f /usr/bin/passwd; then
|
||||
shadow_cv_passwd_dir=/usr/bin
|
||||
else
|
||||
shadow_cv_passwd_dir=/bin
|
||||
fi])
|
||||
AC_DEFINE_UNQUOTED(PASSWD_PROGRAM, "$shadow_cv_passwd_dir/passwd",
|
||||
[Path to passwd program.])
|
||||
|
||||
dnl XXX - quick hack, should disappear before anyone notices :).
|
||||
AC_DEFINE(USE_SYSLOG, 1, [Define to use syslog().])
|
||||
if test "$ac_cv_func_ruserok" = "yes"; then
|
||||
AC_DEFINE(RLOGIN, 1, [Define if login should support the -r flag for rlogind.])
|
||||
AC_DEFINE(RUSEROK, 0, [Define to the ruserok() "success" return value (0 or 1).])
|
||||
fi
|
||||
|
||||
AC_ARG_ENABLE(shadowgrp,
|
||||
[AC_HELP_STRING([--enable-shadowgrp], [enable shadow group support @<:@default=yes@:>@])],
|
||||
[case "${enableval}" in
|
||||
yes) enable_shadowgrp="yes" ;;
|
||||
no) enable_shadowgrp="no" ;;
|
||||
*) AC_MSG_ERROR(bad value ${enableval} for --enable-shadowgrp) ;;
|
||||
esac],
|
||||
[enable_shadowgrp="yes"]
|
||||
)
|
||||
|
||||
AC_ARG_ENABLE(man,
|
||||
[AC_HELP_STRING([--enable-man],
|
||||
[regenerate roff man pages from Docbook @<:@default=no@:>@])],
|
||||
[enable_man="${enableval}"],
|
||||
[enable_man="no"]
|
||||
)
|
||||
|
||||
AC_ARG_ENABLE(account-tools-setuid,
|
||||
[AC_HELP_STRING([--enable-account-tools-setuid],
|
||||
[Install the user and group management tools setuid and authenticate the callers. This requires --with-pam.])],
|
||||
[case "${enableval}" in
|
||||
yes) enable_acct_tools_setuid="yes" ;;
|
||||
no) enable_acct_tools_setuid="no" ;;
|
||||
*) AC_MSG_ERROR(bad value ${enableval} for --enable-account-tools-setuid)
|
||||
;;
|
||||
esac],
|
||||
[enable_acct_tools_setuid="no"]
|
||||
)
|
||||
|
||||
AC_ARG_ENABLE(utmpx,
|
||||
[AC_HELP_STRING([--enable-utmpx],
|
||||
[enable loggin in utmpx / wtmpx @<:@default=no@:>@])],
|
||||
[case "${enableval}" in
|
||||
yes) enable_utmpx="yes" ;;
|
||||
no) enable_utmpx="no" ;;
|
||||
*) AC_MSG_ERROR(bad value ${enableval} for --enable-utmpx) ;;
|
||||
esac],
|
||||
[enable_utmpx="no"]
|
||||
)
|
||||
|
||||
AC_ARG_ENABLE(subordinate-ids,
|
||||
[AC_HELP_STRING([--enable-subordinate-ids],
|
||||
[support subordinate ids @<:@default=yes@:>@])],
|
||||
[enable_subids="${enableval}"],
|
||||
[enable_subids="maybe"]
|
||||
)
|
||||
|
||||
AC_ARG_WITH(audit,
|
||||
[AC_HELP_STRING([--with-audit], [use auditing support @<:@default=yes if found@:>@])],
|
||||
[with_audit=$withval], [with_audit=maybe])
|
||||
AC_ARG_WITH(libpam,
|
||||
[AC_HELP_STRING([--with-libpam], [use libpam for PAM support @<:@default=yes if found@:>@])],
|
||||
[with_libpam=$withval], [with_libpam=maybe])
|
||||
AC_ARG_WITH(btrfs,
|
||||
[AC_HELP_STRING([--with-btrfs], [add BtrFS support @<:@default=yes if found@:>@])],
|
||||
[with_btrfs=$withval], [with_btrfs=maybe])
|
||||
AC_ARG_WITH(selinux,
|
||||
[AC_HELP_STRING([--with-selinux], [use SELinux support @<:@default=yes if found@:>@])],
|
||||
[with_selinux=$withval], [with_selinux=maybe])
|
||||
AC_ARG_WITH(acl,
|
||||
[AC_HELP_STRING([--with-acl], [use ACL support @<:@default=yes if found@:>@])],
|
||||
[with_acl=$withval], [with_acl=maybe])
|
||||
AC_ARG_WITH(attr,
|
||||
[AC_HELP_STRING([--with-attr], [use Extended Attribute support @<:@default=yes if found@:>@])],
|
||||
[with_attr=$withval], [with_attr=maybe])
|
||||
AC_ARG_WITH(skey,
|
||||
[AC_HELP_STRING([--with-skey], [use S/Key support @<:@default=no@:>@])],
|
||||
[with_skey=$withval], [with_skey=no])
|
||||
AC_ARG_WITH(tcb,
|
||||
[AC_HELP_STRING([--with-tcb], [use tcb support (incomplete) @<:@default=yes if found@:>@])],
|
||||
[with_tcb=$withval], [with_tcb=maybe])
|
||||
AC_ARG_WITH(libcrack,
|
||||
[AC_HELP_STRING([--with-libcrack], [use libcrack @<:@default=no@:>@])],
|
||||
[with_libcrack=$withval], [with_libcrack=no])
|
||||
AC_ARG_WITH(sha-crypt,
|
||||
[AC_HELP_STRING([--with-sha-crypt], [allow the SHA256 and SHA512 password encryption algorithms @<:@default=yes@:>@])],
|
||||
[with_sha_crypt=$withval], [with_sha_crypt=yes])
|
||||
AC_ARG_WITH(bcrypt,
|
||||
[AC_HELP_STRING([--with-bcrypt], [allow the bcrypt password encryption algorithm @<:@default=no@:>@])],
|
||||
[with_bcrypt=$withval], [with_bcrypt=no])
|
||||
AC_ARG_WITH(yescrypt,
|
||||
[AC_HELP_STRING([--with-yescrypt], [allow the yescrypt password encryption algorithm @<:@default=no@:>@])],
|
||||
[with_yescrypt=$withval], [with_yescrypt=no])
|
||||
AC_ARG_WITH(nscd,
|
||||
[AC_HELP_STRING([--with-nscd], [enable support for nscd @<:@default=yes@:>@])],
|
||||
[with_nscd=$withval], [with_nscd=yes])
|
||||
AC_ARG_WITH(sssd,
|
||||
[AC_HELP_STRING([--with-sssd], [enable support for flushing sssd caches @<:@default=yes@:>@])],
|
||||
[with_sssd=$withval], [with_sssd=yes])
|
||||
AC_ARG_WITH(group-name-max-length,
|
||||
[AC_HELP_STRING([--with-group-name-max-length], [set max group name length @<:@default=16@:>@])],
|
||||
[with_group_name_max_length=$withval], [with_group_name_max_length=yes])
|
||||
AC_ARG_WITH(su,
|
||||
[AC_HELP_STRING([--with-su], [build and install su program and man page @<:@default=yes@:>@])],
|
||||
[with_su=$withval], [with_su=yes])
|
||||
|
||||
if test "$with_group_name_max_length" = "no" ; then
|
||||
with_group_name_max_length=0
|
||||
elif test "$with_group_name_max_length" = "yes" ; then
|
||||
with_group_name_max_length=16
|
||||
fi
|
||||
AC_DEFINE_UNQUOTED(GROUP_NAME_MAX_LENGTH, $with_group_name_max_length, [max group name length])
|
||||
AC_SUBST(GROUP_NAME_MAX_LENGTH)
|
||||
GROUP_NAME_MAX_LENGTH="$with_group_name_max_length"
|
||||
|
||||
AM_CONDITIONAL(USE_SHA_CRYPT, test "x$with_sha_crypt" = "xyes")
|
||||
if test "$with_sha_crypt" = "yes"; then
|
||||
AC_DEFINE(USE_SHA_CRYPT, 1, [Define to allow the SHA256 and SHA512 password encryption algorithms])
|
||||
fi
|
||||
|
||||
AM_CONDITIONAL(USE_BCRYPT, test "x$with_bcrypt" = "xyes")
|
||||
if test "$with_bcrypt" = "yes"; then
|
||||
AC_DEFINE(USE_BCRYPT, 1, [Define to allow the bcrypt password encryption algorithm])
|
||||
fi
|
||||
|
||||
AM_CONDITIONAL(USE_YESCRYPT, test "x$with_yescrypt" = "xyes")
|
||||
if test "$with_yescrypt" = "yes"; then
|
||||
AC_DEFINE(USE_YESCRYPT, 1, [Define to allow the yescrypt password encryption algorithm])
|
||||
fi
|
||||
|
||||
if test "$with_nscd" = "yes"; then
|
||||
AC_CHECK_FUNC(posix_spawn,
|
||||
[AC_DEFINE(USE_NSCD, 1, [Define to support flushing of nscd caches])],
|
||||
[AC_MSG_ERROR([posix_spawn is needed for nscd support])])
|
||||
fi
|
||||
|
||||
if test "$with_sssd" = "yes"; then
|
||||
AC_CHECK_FUNC(posix_spawn,
|
||||
[AC_DEFINE(USE_SSSD, 1, [Define to support flushing of sssd caches])],
|
||||
[AC_MSG_ERROR([posix_spawn is needed for sssd support])])
|
||||
fi
|
||||
|
||||
AS_IF([test "$with_su" != "no"], AC_DEFINE(WITH_SU, 1, [Build with su])])
|
||||
AM_CONDITIONAL([WITH_SU], [test "x$with_su" != "xno"])
|
||||
|
||||
dnl Check for some functions in libc first, only if not found check for
|
||||
dnl other libraries. This should prevent linking libnsl if not really
|
||||
dnl needed (Linux glibc, Irix), but still link it if needed (Solaris).
|
||||
|
||||
AC_SEARCH_LIBS(inet_ntoa, inet)
|
||||
AC_SEARCH_LIBS(socket, socket)
|
||||
AC_SEARCH_LIBS(gethostbyname, nsl)
|
||||
|
||||
AC_CHECK_LIB([econf],[econf_readDirs],[LIBECONF="-leconf"],[LIBECONF=""])
|
||||
if test -n "$LIBECONF"; then
|
||||
ECONF_CPPFLAGS="-DUSE_ECONF=1"
|
||||
AC_ARG_ENABLE([vendordir],
|
||||
AS_HELP_STRING([--enable-vendordir=DIR], [Directory for distribution provided configuration files]),,[])
|
||||
fi
|
||||
AC_SUBST(ECONF_CPPFLAGS)
|
||||
AC_SUBST(LIBECONF)
|
||||
AC_SUBST([VENDORDIR], [$enable_vendordir])
|
||||
AM_CONDITIONAL([HAVE_VENDORDIR], [test "x$enable_vendordir" != x])
|
||||
|
||||
if test "$enable_shadowgrp" = "yes"; then
|
||||
AC_DEFINE(SHADOWGRP, 1, [Define to support the shadow group file.])
|
||||
fi
|
||||
AM_CONDITIONAL(SHADOWGRP, test "x$enable_shadowgrp" = "xyes")
|
||||
|
||||
if test "$enable_man" = "yes"; then
|
||||
dnl
|
||||
dnl Check for xsltproc
|
||||
dnl
|
||||
AC_PATH_PROG([XSLTPROC], [xsltproc])
|
||||
if test -z "$XSLTPROC"; then
|
||||
enable_man=no
|
||||
AC_MSG_ERROR([xsltproc is missing.])
|
||||
fi
|
||||
|
||||
dnl check for DocBook DTD and stylesheets in the local catalog.
|
||||
JH_CHECK_XML_CATALOG([-//OASIS//DTD DocBook XML V4.5//EN],
|
||||
[DocBook XML DTD V4.5], [], enable_man=no)
|
||||
JH_CHECK_XML_CATALOG([http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl],
|
||||
[DocBook XSL Stylesheets >= 1.70.1], [], enable_man=no)
|
||||
fi
|
||||
AM_CONDITIONAL(ENABLE_REGENERATE_MAN, test "x$enable_man" != "xno")
|
||||
|
||||
if test "$enable_subids" != "no"; then
|
||||
dnl
|
||||
dnl FIXME: check if 32 bit UIDs/GIDs are supported by libc
|
||||
dnl
|
||||
AC_CHECK_SIZEOF([uid_t],, [#include "sys/types.h"])
|
||||
AC_CHECK_SIZEOF([gid_t],, [#include "sys/types.h"])
|
||||
|
||||
if test "$ac_cv_sizeof_uid_t" -ge 4 && test "$ac_cv_sizeof_gid_t" -ge 4; then
|
||||
AC_DEFINE(ENABLE_SUBIDS, 1, [Define to support the subordinate IDs.])
|
||||
enable_subids="yes"
|
||||
else
|
||||
if test "x$enable_subids" = "xyes"; then
|
||||
AC_MSG_ERROR([Cannot enable support the subordinate IDs on systems where gid_t or uid_t has less than 32 bits])
|
||||
fi
|
||||
enable_subids="no"
|
||||
fi
|
||||
fi
|
||||
AM_CONDITIONAL(ENABLE_SUBIDS, test "x$enable_subids" != "xno")
|
||||
|
||||
AC_SUBST(LIBCRYPT)
|
||||
AC_CHECK_LIB(crypt, crypt, [LIBCRYPT=-lcrypt],
|
||||
[AC_MSG_ERROR([crypt() not found])])
|
||||
|
||||
AC_SUBST(LIYESCRYPT)
|
||||
AC_CHECK_LIB(crypt, crypt, [LIYESCRYPT=-lcrypt],
|
||||
[AC_MSG_ERROR([crypt() not found])])
|
||||
|
||||
AC_SUBST(LIBACL)
|
||||
if test "$with_acl" != "no"; then
|
||||
AC_CHECK_HEADERS(acl/libacl.h attr/error_context.h, [acl_header="yes"], [acl_header="no"])
|
||||
if test "$acl_header$with_acl" = "noyes" ; then
|
||||
AC_MSG_ERROR([acl/libacl.h or attr/error_context.h is missing])
|
||||
elif test "$acl_header" = "yes" ; then
|
||||
AC_CHECK_LIB(acl, perm_copy_file,
|
||||
[AC_CHECK_LIB(acl, perm_copy_fd,
|
||||
[acl_lib="yes"],
|
||||
[acl_lib="no"])],
|
||||
[acl_lib="no"])
|
||||
if test "$acl_lib$with_acl" = "noyes" ; then
|
||||
AC_MSG_ERROR([libacl not found])
|
||||
elif test "$acl_lib" = "no" ; then
|
||||
with_acl="no"
|
||||
else
|
||||
AC_DEFINE(WITH_ACL, 1,
|
||||
[Build shadow with ACL support])
|
||||
LIBACL="-lacl"
|
||||
with_acl="yes"
|
||||
fi
|
||||
else
|
||||
with_acl="no"
|
||||
fi
|
||||
fi
|
||||
|
||||
AC_SUBST(LIBATTR)
|
||||
if test "$with_attr" != "no"; then
|
||||
AC_CHECK_HEADERS(attr/libattr.h attr/error_context.h, [attr_header="yes"], [attr_header="no"])
|
||||
if test "$attr_header$with_attr" = "noyes" ; then
|
||||
AC_MSG_ERROR([attr/libattr.h or attr/error_context.h is missing])
|
||||
elif test "$attr_header" = "yes" ; then
|
||||
AC_CHECK_LIB(attr, attr_copy_file,
|
||||
[AC_CHECK_LIB(attr, attr_copy_fd,
|
||||
[attr_lib="yes"],
|
||||
[attr_lib="no"])],
|
||||
[attr_lib="no"])
|
||||
if test "$attr_lib$with_attr" = "noyes" ; then
|
||||
AC_MSG_ERROR([libattr not found])
|
||||
elif test "$attr_lib" = "no" ; then
|
||||
with_attr="no"
|
||||
else
|
||||
AC_DEFINE(WITH_ATTR, 1,
|
||||
[Build shadow with Extended Attributes support])
|
||||
LIBATTR="-lattr"
|
||||
with_attr="yes"
|
||||
fi
|
||||
else
|
||||
with_attr="no"
|
||||
fi
|
||||
fi
|
||||
|
||||
AC_SUBST(LIBAUDIT)
|
||||
if test "$with_audit" != "no"; then
|
||||
AC_CHECK_HEADER(libaudit.h, [audit_header="yes"], [audit_header="no"])
|
||||
if test "$audit_header$with_audit" = "noyes" ; then
|
||||
AC_MSG_ERROR([libaudit.h is missing])
|
||||
elif test "$audit_header" = "yes"; then
|
||||
AC_CHECK_DECL(AUDIT_ADD_USER,,[audit_header="no"],[#include <libaudit.h>])
|
||||
AC_CHECK_DECL(AUDIT_DEL_USER,,[audit_header="no"],[#include <libaudit.h>])
|
||||
AC_CHECK_DECL(AUDIT_ADD_GROUP,,[audit_header="no"],[#include <libaudit.h>])
|
||||
AC_CHECK_DECL(AUDIT_DEL_GROUP,,[audit_header="no"],[#include <libaudit.h>])
|
||||
if test "$audit_header$with_audit" = "noyes" ; then
|
||||
AC_MSG_ERROR([AUDIT_ADD_USER AUDIT_DEL_USER AUDIT_ADD_GROUP or AUDIT_DEL_GROUP missing from libaudit.h])
|
||||
fi
|
||||
fi
|
||||
if test "$audit_header" = "yes"; then
|
||||
AC_CHECK_LIB(audit, audit_log_acct_message,
|
||||
[audit_lib="yes"], [audit_lib="no"])
|
||||
if test "$audit_lib$with_audit" = "noyes" ; then
|
||||
AC_MSG_ERROR([libaudit not found])
|
||||
elif test "$audit_lib" = "no" ; then
|
||||
with_audit="no"
|
||||
else
|
||||
AC_DEFINE(WITH_AUDIT, 1,
|
||||
[Define if you want to enable Audit messages])
|
||||
LIBAUDIT="-laudit"
|
||||
with_audit="yes"
|
||||
fi
|
||||
else
|
||||
with_audit="no"
|
||||
fi
|
||||
fi
|
||||
|
||||
AC_SUBST(LIBCRACK)
|
||||
if test "$with_libcrack" = "yes"; then
|
||||
echo "checking cracklib flavour, don't be surprised by the results"
|
||||
AC_CHECK_LIB(crack, FascistCheck,
|
||||
[LIBCRACK=-lcrack AC_DEFINE(HAVE_LIBCRACK, 1, [Defined if you have libcrack.])])
|
||||
AC_CHECK_LIB(crack, FascistHistory,
|
||||
AC_DEFINE(HAVE_LIBCRACK_HIST, 1, [Defined if you have the ts&szs cracklib.]))
|
||||
AC_CHECK_LIB(crack, FascistHistoryPw,
|
||||
AC_DEFINE(HAVE_LIBCRACK_PW, 1, [Defined if it includes *Pw functions.]))
|
||||
fi
|
||||
|
||||
if test "$with_btrfs" != "no"; then
|
||||
AC_CHECK_HEADERS([sys/statfs.h linux/magic.h linux/btrfs_tree.h], \
|
||||
[btrfs_headers="yes"], [btrfs_headers="no"])
|
||||
if test "$btrfs_headers$with_btrfs" = "noyes" ; then
|
||||
AC_MSG_ERROR([One of sys/statfs.h linux/magic.h linux/btrfs_tree.h is missing])
|
||||
fi
|
||||
|
||||
if test "$btrfs_headers" = "yes" ; then
|
||||
AC_DEFINE(WITH_BTRFS, 1, [Build shadow with BtrFS support])
|
||||
with_btrfs="yes"
|
||||
fi
|
||||
fi
|
||||
AM_CONDITIONAL(WITH_BTRFS, test x$with_btrfs = xyes)
|
||||
|
||||
AC_SUBST(LIBSELINUX)
|
||||
AC_SUBST(LIBSEMANAGE)
|
||||
if test "$with_selinux" != "no"; then
|
||||
AC_CHECK_HEADERS(selinux/selinux.h, [selinux_header="yes"], [selinux_header="no"])
|
||||
if test "$selinux_header$with_selinux" = "noyes" ; then
|
||||
AC_MSG_ERROR([selinux/selinux.h is missing])
|
||||
fi
|
||||
|
||||
AC_CHECK_HEADERS(semanage/semanage.h, [semanage_header="yes"], [semanage_header="no"])
|
||||
if test "$semanage_header$with_selinux" = "noyes" ; then
|
||||
AC_MSG_ERROR([semanage/semanage.h is missing])
|
||||
fi
|
||||
|
||||
if test "$selinux_header$semanage_header" = "yesyes" ; then
|
||||
AC_CHECK_LIB(selinux, is_selinux_enabled, [selinux_lib="yes"], [selinux_lib="no"])
|
||||
if test "$selinux_lib$with_selinux" = "noyes" ; then
|
||||
AC_MSG_ERROR([libselinux not found])
|
||||
fi
|
||||
|
||||
AC_CHECK_LIB(semanage, semanage_connect, [semanage_lib="yes"], [semanage_lib="no"])
|
||||
if test "$semanage_lib$with_selinux" = "noyes" ; then
|
||||
AC_MSG_ERROR([libsemanage not found])
|
||||
fi
|
||||
|
||||
if test "$selinux_lib$semanage_lib" = "yesyes" ; then
|
||||
AC_DEFINE(WITH_SELINUX, 1,
|
||||
[Build shadow with SELinux support])
|
||||
LIBSELINUX="-lselinux"
|
||||
LIBSEMANAGE="-lsemanage"
|
||||
with_selinux="yes"
|
||||
else
|
||||
with_selinux="no"
|
||||
fi
|
||||
else
|
||||
with_selinux="no"
|
||||
fi
|
||||
fi
|
||||
|
||||
AC_SUBST(LIBTCB)
|
||||
if test "$with_tcb" != "no"; then
|
||||
AC_CHECK_HEADERS(tcb.h, [tcb_header="yes"], [tcb_header="no"])
|
||||
if test "$tcb_header$with_tcb" = "noyes" ; then
|
||||
AC_MSG_ERROR([tcb.h is missing])
|
||||
elif test "$tcb_header" = "yes" ; then
|
||||
AC_CHECK_LIB(tcb, tcb_is_suspect, [tcb_lib="yes"], [tcb_lib="no"])
|
||||
if test "$tcb_lib$with_tcb" = "noyes" ; then
|
||||
AC_MSG_ERROR([libtcb not found])
|
||||
elif test "$tcb_lib" = "no" ; then
|
||||
with_tcb="no"
|
||||
else
|
||||
AC_DEFINE(WITH_TCB, 1, [Build shadow with tcb support (incomplete)])
|
||||
LIBTCB="-ltcb"
|
||||
with_tcb="yes"
|
||||
fi
|
||||
else
|
||||
with_tcb="no"
|
||||
fi
|
||||
fi
|
||||
AM_CONDITIONAL(WITH_TCB, test x$with_tcb = xyes)
|
||||
|
||||
AC_SUBST(LIBPAM)
|
||||
if test "$with_libpam" != "no"; then
|
||||
AC_CHECK_LIB(pam, pam_start,
|
||||
[pam_lib="yes"], [pam_lib="no"])
|
||||
if test "$pam_lib$with_libpam" = "noyes" ; then
|
||||
AC_MSG_ERROR(libpam not found)
|
||||
fi
|
||||
|
||||
LIBPAM="-lpam"
|
||||
pam_conv_function="no"
|
||||
|
||||
AC_CHECK_LIB(pam, openpam_ttyconv,
|
||||
[pam_conv_function="openpam_ttyconv"],
|
||||
AC_CHECK_LIB(pam_misc, misc_conv,
|
||||
[pam_conv_function="misc_conv"; LIBPAM="$LIBPAM -lpam_misc"])
|
||||
)
|
||||
|
||||
if test "$pam_conv_function$with_libpam" = "noyes" ; then
|
||||
AC_MSG_ERROR(PAM conversation function not found)
|
||||
fi
|
||||
|
||||
pam_headers_found=no
|
||||
AC_CHECK_HEADERS( [security/openpam.h security/pam_misc.h],
|
||||
[ pam_headers_found=yes ; break ], [],
|
||||
[ #include <security/pam_appl.h> ] )
|
||||
if test "$pam_headers_found$with_libpam" = "noyes" ; then
|
||||
AC_MSG_ERROR(PAM headers not found)
|
||||
fi
|
||||
|
||||
|
||||
if test "$pam_lib$pam_headers_found" = "yesyes" -a "$pam_conv_function" != "no" ; then
|
||||
with_libpam="yes"
|
||||
else
|
||||
with_libpam="no"
|
||||
unset LIBPAM
|
||||
fi
|
||||
fi
|
||||
dnl Now with_libpam is either yes or no
|
||||
if test "$with_libpam" = "yes"; then
|
||||
AC_CHECK_DECLS([PAM_ESTABLISH_CRED,
|
||||
PAM_DELETE_CRED,
|
||||
PAM_NEW_AUTHTOK_REQD,
|
||||
PAM_DATA_SILENT],
|
||||
[], [], [#include <security/pam_appl.h>])
|
||||
|
||||
|
||||
save_libs=$LIBS
|
||||
LIBS="$LIBS $LIBPAM"
|
||||
# We do not use AC_CHECK_FUNCS to avoid duplicated definition with
|
||||
# Linux PAM.
|
||||
AC_CHECK_FUNC(pam_fail_delay, [AC_DEFINE(HAS_PAM_FAIL_DELAY, 1, [Define to 1 if you have the declaration of 'pam_fail_delay'])])
|
||||
LIBS=$save_libs
|
||||
|
||||
AC_DEFINE(USE_PAM, 1, [Define to support Pluggable Authentication Modules])
|
||||
AC_DEFINE_UNQUOTED(SHADOW_PAM_CONVERSATION, [$pam_conv_function],[PAM conversation to use])
|
||||
AM_CONDITIONAL(USE_PAM, [true])
|
||||
|
||||
AC_MSG_CHECKING(use login and su access checking if PAM not used)
|
||||
AC_MSG_RESULT(no)
|
||||
else
|
||||
AC_DEFINE(SU_ACCESS, 1, [Define to support /etc/suauth su access control.])
|
||||
AM_CONDITIONAL(USE_PAM, [false])
|
||||
AC_MSG_CHECKING(use login and su access checking if PAM not used)
|
||||
AC_MSG_RESULT(yes)
|
||||
fi
|
||||
|
||||
if test "$enable_acct_tools_setuid" != "no"; then
|
||||
if test "$with_libpam" != "yes"; then
|
||||
if test "$enable_acct_tools_setuid" = "yes"; then
|
||||
AC_MSG_ERROR(PAM support is required for --enable-account-tools-setuid)
|
||||
else
|
||||
enable_acct_tools_setuid="no"
|
||||
fi
|
||||
else
|
||||
enable_acct_tools_setuid="yes"
|
||||
fi
|
||||
if test "$enable_acct_tools_setuid" = "yes"; then
|
||||
AC_DEFINE(ACCT_TOOLS_SETUID,
|
||||
1,
|
||||
[Define if account management tools should be installed setuid and authenticate the callers])
|
||||
fi
|
||||
fi
|
||||
AM_CONDITIONAL(ACCT_TOOLS_SETUID, test "x$enable_acct_tools_setuid" = "xyes")
|
||||
|
||||
|
||||
AC_ARG_WITH(fcaps,
|
||||
[AC_HELP_STRING([--with-fcaps], [use file capabilities instead of suid binaries for newuidmap/newgidmap @<:@default=no@:>@])],
|
||||
[with_fcaps=$withval], [with_fcaps=no])
|
||||
AM_CONDITIONAL(FCAPS, test "x$with_fcaps" = "xyes")
|
||||
|
||||
if test "x$with_fcaps" = "xyes"; then
|
||||
AC_CHECK_PROGS(capcmd, "setcap")
|
||||
if test "x$capcmd" = "x" ; then
|
||||
AC_MSG_ERROR([setcap command not available])
|
||||
fi
|
||||
fi
|
||||
|
||||
AC_SUBST(LIBSKEY)
|
||||
AC_SUBST(LIBMD)
|
||||
if test "$with_skey" = "yes"; then
|
||||
AC_CHECK_LIB(md, MD5Init, [LIBMD=-lmd])
|
||||
AC_CHECK_LIB(skey, skeychallenge, [LIBSKEY=-lskey],
|
||||
[AC_MSG_ERROR([liskey missing. You can download S/Key source code from http://rsync1.it.gentoo.org/gentoo/distfiles/skey-1.1.5.tar.bz2])])
|
||||
AC_DEFINE(SKEY, 1, [Define to support S/Key logins.])
|
||||
AC_TRY_COMPILE([
|
||||
#include <stdio.h>
|
||||
#include <skey.h>
|
||||
],[
|
||||
skeychallenge((void*)0, (void*)0, (void*)0, 0);
|
||||
],[AC_DEFINE(SKEY_BSD_STYLE, 1, [Define to support newer BSD S/Key API])])
|
||||
fi
|
||||
|
||||
if test "$enable_utmpx" = "yes"; then
|
||||
if test "$ac_cv_header_utmpx_h" != "yes"; then
|
||||
AC_MSG_ERROR([The utmpx.h header file is required for utmpx support.])
|
||||
fi
|
||||
AC_DEFINE(USE_UTMPX,
|
||||
1,
|
||||
[Define if utmpx should be used])
|
||||
fi
|
||||
|
||||
AC_DEFINE_UNQUOTED(SHELL, ["$SHELL"], [The default shell.])
|
||||
|
||||
AM_GNU_GETTEXT_VERSION(0.16)
|
||||
AM_GNU_GETTEXT([external], [need-ngettext])
|
||||
AM_CONDITIONAL(USE_NLS, test "x$USE_NLS" = "xyes")
|
||||
|
||||
AC_CONFIG_FILES([
|
||||
Makefile
|
||||
po/Makefile.in
|
||||
doc/Makefile
|
||||
man/Makefile
|
||||
man/config.xml
|
||||
man/po/Makefile
|
||||
man/cs/Makefile
|
||||
man/da/Makefile
|
||||
man/de/Makefile
|
||||
man/es/Makefile
|
||||
man/fi/Makefile
|
||||
man/fr/Makefile
|
||||
man/hu/Makefile
|
||||
man/id/Makefile
|
||||
man/it/Makefile
|
||||
man/ja/Makefile
|
||||
man/ko/Makefile
|
||||
man/pl/Makefile
|
||||
man/pt_BR/Makefile
|
||||
man/ru/Makefile
|
||||
man/sv/Makefile
|
||||
man/tr/Makefile
|
||||
man/zh_CN/Makefile
|
||||
man/zh_TW/Makefile
|
||||
libmisc/Makefile
|
||||
lib/Makefile
|
||||
libsubid/Makefile
|
||||
src/Makefile
|
||||
contrib/Makefile
|
||||
etc/Makefile
|
||||
etc/pam.d/Makefile
|
||||
shadow.spec
|
||||
])
|
||||
AC_OUTPUT
|
||||
|
||||
echo
|
||||
echo "shadow will be compiled with the following features:"
|
||||
echo
|
||||
echo " auditing support: $with_audit"
|
||||
echo " CrackLib support: $with_libcrack"
|
||||
echo " PAM support: $with_libpam"
|
||||
if test "$with_libpam" = "yes"; then
|
||||
echo " suid account management tools: $enable_acct_tools_setuid"
|
||||
fi
|
||||
echo " SELinux support: $with_selinux"
|
||||
echo " BtrFS support: $with_btrfs"
|
||||
echo " ACL support: $with_acl"
|
||||
echo " Extended Attributes support: $with_attr"
|
||||
echo " tcb support (incomplete): $with_tcb"
|
||||
echo " shadow group support: $enable_shadowgrp"
|
||||
echo " S/Key support: $with_skey"
|
||||
echo " SHA passwords encryption: $with_sha_crypt"
|
||||
echo " bcrypt passwords encryption: $with_bcrypt"
|
||||
echo " yescrypt passwords encryption: $with_yescrypt"
|
||||
echo " nscd support: $with_nscd"
|
||||
echo " sssd support: $with_sssd"
|
||||
echo " subordinate IDs support: $enable_subids"
|
||||
echo " use file caps: $with_fcaps"
|
||||
echo " install su: $with_su"
|
||||
echo
|
||||
430
configure.in
Normal file
430
configure.in
Normal file
@@ -0,0 +1,430 @@
|
||||
dnl Process this file with autoconf to produce a configure script.
|
||||
AC_INIT
|
||||
AM_INIT_AUTOMAKE(shadow, 4.1.2.1)
|
||||
AC_CONFIG_HEADERS([config.h])
|
||||
|
||||
dnl Some hacks...
|
||||
test "$prefix" = "NONE" && prefix="/usr"
|
||||
test "$prefix" = "/usr" && exec_prefix=""
|
||||
|
||||
AC_GNU_SOURCE
|
||||
|
||||
AM_DISABLE_SHARED
|
||||
AM_ENABLE_STATIC
|
||||
|
||||
AM_MAINTAINER_MODE
|
||||
|
||||
dnl Checks for programs.
|
||||
AC_PROG_CC
|
||||
AC_ISC_POSIX
|
||||
AC_PROG_LN_S
|
||||
AC_PROG_YACC
|
||||
AM_C_PROTOTYPES
|
||||
AM_PROG_LIBTOOL
|
||||
|
||||
dnl Checks for libraries.
|
||||
|
||||
dnl Checks for header files.
|
||||
AC_HEADER_DIRENT
|
||||
AC_HEADER_STDC
|
||||
AC_HEADER_SYS_WAIT
|
||||
|
||||
AC_CHECK_HEADERS(errno.h fcntl.h limits.h unistd.h sys/time.h utmp.h \
|
||||
utmpx.h termios.h termio.h sgtty.h sys/ioctl.h syslog.h paths.h \
|
||||
utime.h ulimit.h sys/resource.h gshadow.h lastlog.h \
|
||||
locale.h rpc/key_prot.h netdb.h)
|
||||
|
||||
dnl shadow now uses the libc's shadow implementation
|
||||
AC_CHECK_HEADER([shadow.h],,[AC_MSG_ERROR([You need a libc with shadow.h])])
|
||||
|
||||
AC_CHECK_FUNCS(l64a fchmod fchown fsync getgroups gethostname getspnam \
|
||||
gettimeofday getusershell getutent initgroups lchown lckpwdf lstat \
|
||||
memcpy memset setgroups sigaction strchr updwtmp updwtmpx innetgr \
|
||||
getpwnam_r getpwuid_r getgrnam_r getgrgid_r getspnam_r)
|
||||
AC_SYS_LARGEFILE
|
||||
|
||||
dnl Checks for typedefs, structures, and compiler characteristics.
|
||||
AC_C_CONST
|
||||
AC_TYPE_UID_T
|
||||
AC_TYPE_OFF_T
|
||||
AC_TYPE_PID_T
|
||||
AC_TYPE_MODE_T
|
||||
AC_HEADER_STAT
|
||||
AC_CHECK_MEMBERS([struct stat.st_rdev])
|
||||
AC_HEADER_TIME
|
||||
AC_STRUCT_TM
|
||||
|
||||
if test "$ac_cv_header_utmp_h" = "yes"; then
|
||||
AC_CACHE_CHECK(for ut_host in struct utmp,
|
||||
ac_cv_struct_utmp_ut_host,
|
||||
AC_COMPILE_IFELSE(
|
||||
[AC_LANG_PROGRAM([#include <utmp.h>],
|
||||
[struct utmp ut; char *cp = ut.ut_host;]
|
||||
)],
|
||||
[ac_cv_struct_utmp_ut_host=yes],
|
||||
[ac_cv_struct_utmp_ut_host=no]
|
||||
)
|
||||
)
|
||||
|
||||
if test "$ac_cv_struct_utmp_ut_host" = "yes"; then
|
||||
AC_DEFINE(UT_HOST, 1, [Define if you have ut_host in struct utmp.])
|
||||
fi
|
||||
|
||||
AC_CACHE_CHECK(for ut_user in struct utmp,
|
||||
ac_cv_struct_utmp_ut_user,
|
||||
AC_COMPILE_IFELSE([AC_LANG_PROGRAM([#include <utmp.h>],
|
||||
[struct utmp ut; char *cp = ut.ut_user;]
|
||||
)],
|
||||
[ac_cv_struct_utmp_ut_user=yes],
|
||||
[ac_cv_struct_utmp_ut_user=no]
|
||||
)
|
||||
)
|
||||
|
||||
if test "$ac_cv_struct_utmp_ut_user" = "no"; then
|
||||
AC_DEFINE(ut_user, ut_name,
|
||||
[Define to ut_name if struct utmp has ut_name (not ut_user).])
|
||||
fi
|
||||
fi
|
||||
|
||||
if test "$ac_cv_header_lastlog_h" = "yes"; then
|
||||
AC_CACHE_CHECK(for ll_host in struct lastlog,
|
||||
ac_cv_struct_lastlog_ll_host,
|
||||
AC_COMPILE_IFELSE([AC_LANG_PROGRAM([#include <lastlog.h>],
|
||||
[struct lastlog ll; char *cp = ll.ll_host;]
|
||||
)],
|
||||
[ac_cv_struct_lastlog_ll_host=yes],
|
||||
[ac_cv_struct_lastlog_ll_host=no]
|
||||
)
|
||||
)
|
||||
|
||||
if test "$ac_cv_struct_lastlog_ll_host" = "yes"; then
|
||||
AC_DEFINE(HAVE_LL_HOST, 1,
|
||||
[Define if struct lastlog has ll_host])
|
||||
fi
|
||||
fi
|
||||
|
||||
dnl Checks for library functions.
|
||||
AC_TYPE_GETGROUPS
|
||||
AC_TYPE_SIGNAL
|
||||
AC_FUNC_UTIME_NULL
|
||||
AC_FUNC_STRFTIME
|
||||
AC_REPLACE_FUNCS(mkdir putgrent putpwent putspent rename rmdir)
|
||||
AC_REPLACE_FUNCS(sgetgrent sgetpwent sgetspent)
|
||||
AC_REPLACE_FUNCS(snprintf strcasecmp strdup strerror strstr)
|
||||
|
||||
AC_CHECK_FUNC(setpgrp)
|
||||
AC_FUNC_SETPGRP
|
||||
|
||||
if test "$ac_cv_header_shadow_h" = "yes"; then
|
||||
AC_CACHE_CHECK(for working shadow group support,
|
||||
ac_cv_libc_shadowgrp,
|
||||
AC_RUN_IFELSE([AC_LANG_SOURCE([
|
||||
#include <shadow.h>
|
||||
main()
|
||||
{
|
||||
struct sgrp *sg = sgetsgent("test:x::");
|
||||
/* NYS libc on Red Hat 3.0.3 has broken shadow group support */
|
||||
return !sg || !sg->sg_adm || !sg->sg_mem;
|
||||
}]
|
||||
)],
|
||||
[ac_cv_libc_shadowgrp=yes],
|
||||
[ac_cv_libc_shadowgrp=no],
|
||||
[ac_cv_libc_shadowgrp=no]
|
||||
)
|
||||
)
|
||||
|
||||
if test "$ac_cv_libc_shadowgrp" = "yes"; then
|
||||
AC_DEFINE(HAVE_SHADOWGRP, 1, [Have working shadow group support in libc])
|
||||
fi
|
||||
fi
|
||||
|
||||
AC_CACHE_CHECK([location of shared mail directory], shadow_cv_maildir,
|
||||
[for shadow_cv_maildir in /var/mail /var/spool/mail /usr/spool/mail /usr/mail none; do
|
||||
if test -d $shadow_cv_maildir; then
|
||||
break
|
||||
fi
|
||||
done])
|
||||
if test $shadow_cv_maildir != none; then
|
||||
AC_DEFINE_UNQUOTED(MAIL_SPOOL_DIR, "$shadow_cv_maildir",
|
||||
[Location of system mail spool directory.])
|
||||
fi
|
||||
|
||||
AC_CACHE_CHECK([location of user mail file], shadow_cv_mailfile,
|
||||
[for shadow_cv_mailfile in Mailbox mailbox Mail mail .mail none; do
|
||||
if test -f $HOME/$shadow_cv_mailfile; then
|
||||
break
|
||||
fi
|
||||
done])
|
||||
if test $shadow_cv_mailfile != none; then
|
||||
AC_DEFINE_UNQUOTED(MAIL_SPOOL_FILE, "$shadow_cv_mailfile",
|
||||
[Name of user's mail spool file if stored in user's home directory.])
|
||||
fi
|
||||
|
||||
AC_CACHE_CHECK([location of utmp], shadow_cv_utmpdir,
|
||||
[for shadow_cv_utmpdir in /var/run /var/adm /usr/adm /etc none; do
|
||||
if test -f $shadow_cv_utmpdir/utmp; then
|
||||
break
|
||||
fi
|
||||
done])
|
||||
if test "$shadow_cv_utmpdir" = "none"; then
|
||||
AC_MSG_WARN(utmp file not found)
|
||||
fi
|
||||
AC_DEFINE_UNQUOTED(_UTMP_FILE, "$shadow_cv_utmpdir/utmp",
|
||||
[Path for utmp file.])
|
||||
|
||||
AC_CACHE_CHECK([location of faillog/lastlog/wtmp], shadow_cv_logdir,
|
||||
[for shadow_cv_logdir in /var/log /var/adm /usr/adm /etc; do
|
||||
if test -d $shadow_cv_logdir; then
|
||||
break
|
||||
fi
|
||||
done])
|
||||
AC_DEFINE_UNQUOTED(_WTMP_FILE, "$shadow_cv_logdir/wtmp",
|
||||
[Path for wtmp file.])
|
||||
AC_DEFINE_UNQUOTED(LASTLOG_FILE, "$shadow_cv_logdir/lastlog",
|
||||
[Path for lastlog file.])
|
||||
AC_DEFINE_UNQUOTED(FAILLOG_FILE, "$shadow_cv_logdir/faillog",
|
||||
[Path for faillog file.])
|
||||
|
||||
AC_CACHE_CHECK([location of the passwd program], shadow_cv_passwd_dir,
|
||||
[if test -f /usr/bin/passwd; then
|
||||
shadow_cv_passwd_dir=/usr/bin
|
||||
else
|
||||
shadow_cv_passwd_dir=/bin
|
||||
fi])
|
||||
AC_DEFINE_UNQUOTED(PASSWD_PROGRAM, "$shadow_cv_passwd_dir/passwd",
|
||||
[Path to passwd program.])
|
||||
|
||||
dnl XXX - quick hack, should disappear before anyone notices :).
|
||||
AC_DEFINE(USE_SYSLOG, 1, [Define to use syslog().])
|
||||
AC_DEFINE(RLOGIN, 1, [Define if login should support the -r flag for rlogind.])
|
||||
AC_DEFINE(RUSEROK, 0, [Define to the ruserok() "success" return value (0 or 1).])
|
||||
|
||||
AC_ARG_ENABLE(shadowgrp,
|
||||
[AC_HELP_STRING([--enable-shadowgrp], [enable shadow group support @<:@default=yes@:>@])],
|
||||
[case "${enableval}" in
|
||||
yes) enable_shadowgrp="yes" ;;
|
||||
no) enable_shadowgrp="no" ;;
|
||||
*) AC_MSG_ERROR(bad value ${enableval} for --enable-shadowgrp) ;;
|
||||
esac],
|
||||
[enable_shadowgrp="yes"]
|
||||
)
|
||||
|
||||
AC_ARG_ENABLE(man,
|
||||
[AC_HELP_STRING([--enable-man],
|
||||
[regenerate roff man pages from Docbook @<:@default=no@:>@])],
|
||||
[enable_man=yes],
|
||||
[enable_man=no]
|
||||
)
|
||||
|
||||
AC_ARG_WITH(audit,
|
||||
[AC_HELP_STRING([--with-audit], [use auditing support @<:@default=yes if found@:>@])],
|
||||
[with_audit=$withval], [with_audit=maybe])
|
||||
AC_ARG_WITH(libpam,
|
||||
[AC_HELP_STRING([--with-libpam], [use libpam for PAM support @<:@default=yes if found@:>@])],
|
||||
[with_libpam=$withval], [with_libpam=maybe])
|
||||
AC_ARG_WITH(selinux,
|
||||
[AC_HELP_STRING([--with-selinux], [use SELinux support @<:@default=yes if found@:>@])],
|
||||
[with_selinux=$withval], [with_selinux=maybe])
|
||||
AC_ARG_WITH(skey,
|
||||
[AC_HELP_STRING([--with-skey], [use S/Key support @<:@default=no@:>@])],
|
||||
[with_skey=$withval], [with_skey=no])
|
||||
AC_ARG_WITH(libcrack,
|
||||
[AC_HELP_STRING([--with-libcrack], [use libcrack @<:@default=yes if found and if PAM not enabled@:>@])],
|
||||
[with_libcrack=$withval], [with_libcrack=no])
|
||||
AC_ARG_WITH(sha-crypt,
|
||||
[AC_HELP_STRING([--with-sha-crypt], [allow the SHA256 and SHA512 password encryption algorithms @<:@default=yes@:>@])],
|
||||
[with_sha_crypt=$withval], [with_sha_crypt=yes])
|
||||
|
||||
AM_CONDITIONAL(USE_SHA_CRYPT, test "x$with_sha_crypt" = "xyes")
|
||||
if test "$with_sha_crypt" = "yes"; then
|
||||
AC_DEFINE(USE_SHA_CRYPT, 1, [Define to allow the SHA256 and SHA512 password encryption algorithms])
|
||||
fi
|
||||
|
||||
dnl Check for some functions in libc first, only if not found check for
|
||||
dnl other libraries. This should prevent linking libnsl if not really
|
||||
dnl needed (Linux glibc, Irix), but still link it if needed (Solaris).
|
||||
|
||||
AC_SEARCH_LIBS(inet_ntoa, inet)
|
||||
AC_SEARCH_LIBS(socket, socket)
|
||||
AC_SEARCH_LIBS(gethostbyname, nsl)
|
||||
|
||||
if test "$enable_shadowgrp" = "yes"; then
|
||||
AC_DEFINE(SHADOWGRP, 1, [Define to support the shadow group file.])
|
||||
fi
|
||||
AM_CONDITIONAL(SHADOWGRP, test "x$enable_shadowgrp" = "xyes")
|
||||
|
||||
if test "$enable_man" = "yes"; then
|
||||
dnl
|
||||
dnl Check for xsltproc
|
||||
dnl
|
||||
AC_PATH_PROG([XSLTPROC], [xsltproc])
|
||||
if test -z "$XSLTPROC"; then
|
||||
enable_man=no
|
||||
fi
|
||||
|
||||
dnl check for DocBook DTD and stylesheets in the local catalog.
|
||||
JH_CHECK_XML_CATALOG([-//OASIS//DTD DocBook XML V4.1.2//EN],
|
||||
[DocBook XML DTD V4.1.2], [], enable_man=no)
|
||||
JH_CHECK_XML_CATALOG([http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl],
|
||||
[DocBook XSL Stylesheets >= 1.70.1], [], enable_man=no)
|
||||
fi
|
||||
AM_CONDITIONAL(ENABLE_REGENERATE_MAN, test x$enable_man != xno)
|
||||
|
||||
AC_SUBST(LIBCRYPT)
|
||||
AC_CHECK_LIB(crypt, crypt, [LIBCRYPT=-lcrypt],
|
||||
[AC_MSG_ERROR([crypt() not found])])
|
||||
|
||||
AC_SUBST(LIBAUDIT)
|
||||
if test "$with_audit" != "no"; then
|
||||
AC_CHECK_HEADER(libaudit.h, [audit_header="yes"], [audit_header="no"])
|
||||
if test "$audit_header$with_audit" = "noyes" ; then
|
||||
AC_MSG_ERROR([libaudit.h is missing])
|
||||
elif test "$audit_header" = "yes"; then
|
||||
AC_CHECK_LIB(audit, audit_log_acct_message,
|
||||
[audit_lib="yes"], [audit_lib="no"])
|
||||
if test "$audit_lib$with_audit" = "noyes" ; then
|
||||
AC_MSG_ERROR([libaudit not found])
|
||||
elif test "$audit_lib" = "no" ; then
|
||||
with_audit="no"
|
||||
else
|
||||
AC_DEFINE(WITH_AUDIT, 1,
|
||||
[Define if you want to enable Audit messages])
|
||||
LIBAUDIT="-laudit"
|
||||
with_audit="yes"
|
||||
fi
|
||||
else
|
||||
with_audit="no"
|
||||
fi
|
||||
fi
|
||||
|
||||
AC_SUBST(LIBCRACK)
|
||||
if test "$with_libcrack" = "yes"; then
|
||||
echo "checking cracklib flavour, don't be surprised by the results"
|
||||
AC_CHECK_LIB(crack, FascistCheck,
|
||||
[LIBCRACK=-lcrack AC_DEFINE(HAVE_LIBCRACK, 1, [Defined if you have libcrack.])])
|
||||
AC_CHECK_LIB(crack, FascistHistory,
|
||||
AC_DEFINE(HAVE_LIBCRACK_HIST, 1, [Defined if you have the ts&szs cracklib.]))
|
||||
AC_CHECK_LIB(crack, FascistHistoryPw,
|
||||
AC_DEFINE(HAVE_LIBCRACK_PW, 1, [Defined if it includes *Pw functions.]))
|
||||
fi
|
||||
|
||||
AC_SUBST(LIBSELINUX)
|
||||
if test "$with_selinux" != "no"; then
|
||||
AC_CHECK_HEADERS(selinux/selinux.h, [selinux_header="yes"], [selinux_header="no"])
|
||||
if test "$selinux_header$with_selinux" = "noyes" ; then
|
||||
AC_MSG_ERROR([selinux/selinux.h is missing])
|
||||
elif test "$selinux_header" = "yes" ; then
|
||||
AC_CHECK_LIB(selinux, is_selinux_enabled,
|
||||
[selinux_lib="yes"], [selinux_lib="no"])
|
||||
if test "$selinux_lib$with_selinux" = "noyes" ; then
|
||||
AC_MSG_ERROR([libselinux not found])
|
||||
elif test "$selinux_lib" = "no" ; then
|
||||
with_selinux="no"
|
||||
else
|
||||
AC_DEFINE(WITH_SELINUX, 1,
|
||||
[Build shadow with SELinux support])
|
||||
LIBSELINUX="-lselinux"
|
||||
with_selinux="yes"
|
||||
fi
|
||||
else
|
||||
with_selinux="no"
|
||||
fi
|
||||
fi
|
||||
|
||||
AC_SUBST(LIBPAM)
|
||||
if test "$with_libpam" != "no"; then
|
||||
AC_CHECK_LIB(pam, pam_start,
|
||||
[pam_lib="yes"], [pam_lib="no"])
|
||||
if test "$pam_lib$with_libpam" = "noyes" ; then
|
||||
AC_MSG_ERROR(libpam not found)
|
||||
fi
|
||||
|
||||
AC_CHECK_LIB(pam_misc, main,
|
||||
[pam_misc_lib="yes"], [pam_misc_lib="no"])
|
||||
if test "$pam_misc_lib$with_libpam" = "noyes" ; then
|
||||
AC_MSG_ERROR(libpam_misc not found)
|
||||
fi
|
||||
|
||||
if test "$pam_lib$pam_misc_lib" = "yesyes" ; then
|
||||
with_libpam="yes"
|
||||
else
|
||||
with_libpam="no"
|
||||
fi
|
||||
fi
|
||||
dnl Now with_libpam is either yes or no
|
||||
if test "$with_libpam" = "yes"; then
|
||||
AC_DEFINE(USE_PAM, 1, [Define to support Pluggable Authentication Modules])
|
||||
AM_CONDITIONAL(USE_PAM, [true])
|
||||
LIBPAM="-lpam -lpam_misc"
|
||||
AC_MSG_CHECKING(use login and su access checking if PAM not used)
|
||||
AC_MSG_RESULT(no)
|
||||
else
|
||||
AC_DEFINE(SU_ACCESS, 1, [Define to support /etc/suauth su access control.])
|
||||
AM_CONDITIONAL(USE_PAM, [false])
|
||||
AC_MSG_CHECKING(use login and su access checking if PAM not used)
|
||||
AC_MSG_RESULT(yes)
|
||||
fi
|
||||
|
||||
AC_SUBST(LIBSKEY)
|
||||
AC_SUBST(LIBMD)
|
||||
if test "$with_skey" = "yes"; then
|
||||
AC_CHECK_LIB(md, MD5Init, [LIBMD=-lmd])
|
||||
AC_CHECK_LIB(skey, skeychallenge, [LIBSKEY=-lskey],
|
||||
[AC_MSG_ERROR([liskey missing. You can download S/Key source code from http://rsync1.it.gentoo.org/gentoo/distfiles/skey-1.1.5.tar.bz2])])
|
||||
AC_DEFINE(SKEY, 1, [Define to support S/Key logins.])
|
||||
AC_TRY_COMPILE([
|
||||
#include <stdio.h>
|
||||
#include <skey.h>
|
||||
],[
|
||||
skeychallenge((void*)0, (void*)0, (void*)0, 0);
|
||||
],[AC_DEFINE(SKEY_BSD_STYLE, 1, [Define to support newer BSD S/Key API])])
|
||||
fi
|
||||
|
||||
AM_GNU_GETTEXT_VERSION(0.16)
|
||||
AM_GNU_GETTEXT([external], [need-ngettext])
|
||||
AM_CONDITIONAL(USE_NLS, test "x$USE_NLS" = "xyes")
|
||||
|
||||
AC_CONFIG_FILES([
|
||||
Makefile
|
||||
po/Makefile.in
|
||||
doc/Makefile
|
||||
man/Makefile
|
||||
man/po/Makefile.in
|
||||
man/cs/Makefile
|
||||
man/de/Makefile
|
||||
man/es/Makefile
|
||||
man/fi/Makefile
|
||||
man/fr/Makefile
|
||||
man/hu/Makefile
|
||||
man/id/Makefile
|
||||
man/it/Makefile
|
||||
man/ja/Makefile
|
||||
man/ko/Makefile
|
||||
man/pl/Makefile
|
||||
man/pt_BR/Makefile
|
||||
man/ru/Makefile
|
||||
man/sv/Makefile
|
||||
man/tr/Makefile
|
||||
man/zh_CN/Makefile
|
||||
man/zh_TW/Makefile
|
||||
libmisc/Makefile
|
||||
lib/Makefile
|
||||
src/Makefile
|
||||
contrib/Makefile
|
||||
etc/Makefile
|
||||
etc/pam.d/Makefile
|
||||
shadow.spec
|
||||
])
|
||||
AC_OUTPUT
|
||||
|
||||
echo
|
||||
echo "shadow will be compiled with the following features:"
|
||||
echo
|
||||
echo " auditing support: $with_audit"
|
||||
echo " CrackLib support: $with_libcrack"
|
||||
echo " PAM support: $with_libpam"
|
||||
echo " SELinux support: $with_selinux"
|
||||
echo " shadow group support: $enable_shadowgrp"
|
||||
echo " S/Key support: $with_skey"
|
||||
echo " SHA passwords encryption: $with_sha_crypt"
|
||||
echo
|
||||
@@ -20,7 +20,7 @@
|
||||
** 1/28/95
|
||||
** shadow-adduser 1.3:
|
||||
**
|
||||
** Basically a bug-fix on my additions in 1.2. Thanks to Terry Stewart
|
||||
** Basically a bug-fix on my additions in 1.2. Thanx to Terry Stewart
|
||||
** (stew@texas.net) for pointing out one of the many idiotic bugs I introduced.
|
||||
** It was such a stupid bug that I would have never seen it myself.
|
||||
**
|
||||
@@ -230,7 +230,7 @@ void main()
|
||||
fflush(stdin);
|
||||
} else
|
||||
if (dir[strlen(dir)-1]=='/')
|
||||
sprintf(dir+strlen(dir),"%s",uname);
|
||||
sprintf(dir,"%s%s",dir,uname);
|
||||
|
||||
printf("\nShell [%s]: ",DEFAULT_SHELL);
|
||||
fflush(stdout);
|
||||
|
||||
@@ -34,7 +34,7 @@
|
||||
** 1/28/95
|
||||
** shadow-adduser 1.3:
|
||||
**
|
||||
** Basically a bug-fix on my additions in 1.2. Thanks to Terry Stewart
|
||||
** Basically a bug-fix on my additions in 1.2. Thanx to Terry Stewart
|
||||
** (stew@texas.net) for pointing out one of the many idiotic bugs I introduced.
|
||||
** It was such a stupid bug that I would have never seen it myself.
|
||||
**
|
||||
@@ -296,7 +296,7 @@ main (void)
|
||||
sprintf (dir, "%s/%s", DEFAULT_HOME, usrname);
|
||||
}
|
||||
else if (dir[strlen (dir) - 1] == '/')
|
||||
sprintf (dir+strlen(dir), "%s", usrname);
|
||||
sprintf (dir, "%s%s", dir, usrname);
|
||||
}
|
||||
else
|
||||
{
|
||||
|
||||
@@ -32,7 +32,7 @@ def_home_dir=/home/users
|
||||
# default shell
|
||||
def_shell=/bin/tcsh
|
||||
|
||||
# Default expiration date (mm/dd/yy)
|
||||
# Defaul expiration date (mm/dd/yy)
|
||||
def_expire=""
|
||||
|
||||
# default dates
|
||||
|
||||
@@ -480,7 +480,7 @@ X.B groupmems
|
||||
\fB-D\fR |
|
||||
[\fB-g\fI group_name \fR]
|
||||
X.SH DESCRIPTION
|
||||
The \fBgroupmems\fR utility allows a user to administer their own
|
||||
The \fBgroupmems\fR utility allows a user to administer his/her own
|
||||
group membership list without the requirement of superuser privileges.
|
||||
The \fBgroupmems\fR utility is for systems that configure its users to
|
||||
be in their own name sake primary group (i.e., guest / guest).
|
||||
|
||||
@@ -2,7 +2,7 @@ Hello Marek,
|
||||
|
||||
I have created a diffile against the 980403 release that adds
|
||||
functionality to newusers for automatic handling of users with only
|
||||
anonymous ftp login (using the guestgroup feature in ftpaccess, which
|
||||
anonomous ftp login (using the guestgroup feature in ftpaccess, which
|
||||
means that the users home directory looks like '/home/user/./'). It also
|
||||
adds a commandline argument to specify an initial directory structure
|
||||
for such users, with a tarball normally containing the bin,lib,etc
|
||||
|
||||
@@ -15,7 +15,7 @@ Changes:
|
||||
- code merged into lmain.c --cristiang
|
||||
|
||||
TODO: - support groups in the limits file
|
||||
(only usernames are supported at this moment :-( )
|
||||
(only usernames are supported at this momment :-( )
|
||||
|
||||
Setting user limits for shadow login program
|
||||
|
||||
|
||||
@@ -31,6 +31,8 @@ New ideas to add to this list are welcome, too. --marekm
|
||||
- new option for /etc/suauth: don't load user's environment (force "su -")
|
||||
suggested by Ulisses Alonso Camaro
|
||||
- find out why recent releases won't compile on Solaris
|
||||
- newusers UID/GID selection algorithm should be the same as useradd
|
||||
(and use UID_MIN, UID_MAX from login.defs)
|
||||
- newusers should be able to copy /etc/skel to the new home directory
|
||||
(like useradd)
|
||||
- add directories where other packages can add hooks for package-specific
|
||||
|
||||
@@ -1,15 +0,0 @@
|
||||
<HEAD>
|
||||
<title>shadow - Welcome</title>
|
||||
</head>
|
||||
<body>
|
||||
<h2> Welcome!</h2>
|
||||
<p> This is the shadow tool suite home page. </p>
|
||||
|
||||
<p>
|
||||
You can find releases <a href="https://github.com/shadow-maint/shadow/releases">here</a>.
|
||||
</p>
|
||||
|
||||
<p>
|
||||
Raise issues, request features, and report bugs <a href="https://github.com/shadow-maint/shadow/issues">here</a>.
|
||||
</p>
|
||||
</body>
|
||||
@@ -4,7 +4,8 @@
|
||||
sysconf_DATA = login.defs
|
||||
|
||||
defaultdir = $(sysconfdir)/default
|
||||
default_DATA =
|
||||
default_DATA = \
|
||||
useradd
|
||||
|
||||
nonpam_files = \
|
||||
limits \
|
||||
|
||||
204
etc/login.defs
204
etc/login.defs
@@ -6,18 +6,16 @@
|
||||
|
||||
#
|
||||
# Delay in seconds before being allowed another attempt after a login failure
|
||||
# Note: When PAM is used, some modules may enforce a minimum delay (e.g.
|
||||
# pam_unix(8) enforces a 2s delay)
|
||||
#
|
||||
FAIL_DELAY 3
|
||||
|
||||
#
|
||||
# Enable logging and display of /var/log/faillog login(1) failure info.
|
||||
# Enable logging and display of /var/log/faillog login failure info.
|
||||
#
|
||||
FAILLOG_ENAB yes
|
||||
|
||||
#
|
||||
# Enable display of unknown usernames when login(1) failures are recorded.
|
||||
# Enable display of unknown usernames when login failures are recorded.
|
||||
#
|
||||
LOG_UNKFAIL_ENAB no
|
||||
|
||||
@@ -27,19 +25,10 @@ LOG_UNKFAIL_ENAB no
|
||||
LOG_OK_LOGINS no
|
||||
|
||||
#
|
||||
# Enable logging and display of /var/log/lastlog login(1) time info.
|
||||
# Enable logging and display of /var/log/lastlog login time info.
|
||||
#
|
||||
LASTLOG_ENAB yes
|
||||
|
||||
#
|
||||
# Limit the highest user ID number for which the lastlog entries should
|
||||
# be updated.
|
||||
#
|
||||
# No LASTLOG_UID_MAX means that there is no user ID limit for writing
|
||||
# lastlog entries.
|
||||
#
|
||||
#LASTLOG_UID_MAX
|
||||
|
||||
#
|
||||
# Enable checking and display of mailbox status upon login.
|
||||
#
|
||||
@@ -59,13 +48,13 @@ OBSCURE_CHECKS_ENAB yes
|
||||
PORTTIME_CHECKS_ENAB yes
|
||||
|
||||
#
|
||||
# Enable setting of ulimit, umask, and niceness from passwd(5) gecos field.
|
||||
# Enable setting of ulimit, umask, and niceness from passwd gecos field.
|
||||
#
|
||||
QUOTAS_ENAB yes
|
||||
|
||||
#
|
||||
# Enable "syslog" logging of su(1) activity - in addition to sulog file logging.
|
||||
# SYSLOG_SG_ENAB does the same for newgrp(1) and sg(1).
|
||||
# Enable "syslog" logging of su activity - in addition to sulog file logging.
|
||||
# SYSLOG_SG_ENAB does the same for newgrp and sg.
|
||||
#
|
||||
SYSLOG_SU_ENAB yes
|
||||
SYSLOG_SG_ENAB yes
|
||||
@@ -73,13 +62,13 @@ SYSLOG_SG_ENAB yes
|
||||
#
|
||||
# If defined, either full pathname of a file containing device names or
|
||||
# a ":" delimited list of device names. Root logins will be allowed only
|
||||
# from these devices.
|
||||
# upon these devices.
|
||||
#
|
||||
CONSOLE /etc/securetty
|
||||
#CONSOLE console:tty01:tty02:tty03:tty04
|
||||
|
||||
#
|
||||
# If defined, all su(1) activity is logged to this file.
|
||||
# If defined, all su activity is logged to this file.
|
||||
#
|
||||
#SULOG_FILE /var/log/sulog
|
||||
|
||||
@@ -91,33 +80,33 @@ MOTD_FILE /etc/motd
|
||||
#MOTD_FILE /etc/motd:/usr/lib/news/news-motd
|
||||
|
||||
#
|
||||
# If defined, this file will be output before each login(1) prompt.
|
||||
# If defined, this file will be output before each login prompt.
|
||||
#
|
||||
#ISSUE_FILE /etc/issue
|
||||
|
||||
#
|
||||
# If defined, file which maps tty line to TERM environment parameter.
|
||||
# Each line of the file is in a format similar to "vt100 tty01".
|
||||
# Each line of the file is in a format something like "vt100 tty01".
|
||||
#
|
||||
#TTYTYPE_FILE /etc/ttytype
|
||||
|
||||
#
|
||||
# If defined, login(1) failures will be logged here in a utmp format.
|
||||
# last(1), when invoked as lastb(1), will read /var/log/btmp, so...
|
||||
# If defined, login failures will be logged here in a utmp format.
|
||||
# last, when invoked as lastb, will read /var/log/btmp, so...
|
||||
#
|
||||
FTMP_FILE /var/log/btmp
|
||||
|
||||
#
|
||||
# If defined, name of file whose presence will inhibit non-root
|
||||
# logins. The content of this file should be a message indicating
|
||||
# If defined, name of file whose presence which will inhibit non-root
|
||||
# logins. The contents of this file should be a message indicating
|
||||
# why logins are inhibited.
|
||||
#
|
||||
NOLOGINS_FILE /etc/nologin
|
||||
|
||||
#
|
||||
# If defined, the command name to display when running "su -". For
|
||||
# example, if this is defined as "su" then ps(1) will display the
|
||||
# command as "-su". If not defined, then ps(1) will display the
|
||||
# example, if this is defined as "su" then a "ps" will display the
|
||||
# command is "-su". If not defined, then "ps" would display the
|
||||
# name of the shell actually being run, e.g. something like "-sh".
|
||||
#
|
||||
SU_NAME su
|
||||
@@ -167,10 +156,10 @@ ENV_PATH PATH=/bin:/usr/bin
|
||||
# TTYGROUP Login tty will be assigned this group ownership.
|
||||
# TTYPERM Login tty will be set to this permission.
|
||||
#
|
||||
# If you have a write(1) program which is "setgid" to a special group
|
||||
# which owns the terminals, define TTYGROUP as the number of such group
|
||||
# and TTYPERM as 0620. Otherwise leave TTYGROUP commented out and
|
||||
# set TTYPERM to either 622 or 600.
|
||||
# If you have a "write" program which is "setgid" to a special group
|
||||
# which owns the terminals, define TTYGROUP to the group number and
|
||||
# TTYPERM to 0620. Otherwise leave TTYGROUP commented out and assign
|
||||
# TTYPERM to either 622 or 600.
|
||||
#
|
||||
TTYGROUP tty
|
||||
TTYPERM 0600
|
||||
@@ -180,6 +169,7 @@ TTYPERM 0600
|
||||
#
|
||||
# ERASECHAR Terminal ERASE character ('\010' = backspace).
|
||||
# KILLCHAR Terminal KILL character ('\025' = CTRL/U).
|
||||
# UMASK Default "umask" value.
|
||||
# ULIMIT Default "ulimit" value.
|
||||
#
|
||||
# The ERASECHAR and KILLCHAR are used only on System V machines.
|
||||
@@ -190,21 +180,8 @@ TTYPERM 0600
|
||||
#
|
||||
ERASECHAR 0177
|
||||
KILLCHAR 025
|
||||
#ULIMIT 2097152
|
||||
|
||||
# Default initial "umask" value used by login(1) on non-PAM enabled systems.
|
||||
# Default "umask" value for pam_umask(8) on PAM enabled systems.
|
||||
# UMASK is also used by useradd(8) and newusers(8) to set the mode for new
|
||||
# home directories if HOME_MODE is not set.
|
||||
# 022 is the default value, but 027, or even 077, could be considered
|
||||
# for increased privacy. There is no One True Answer here: each sysadmin
|
||||
# must make up their mind.
|
||||
UMASK 022
|
||||
|
||||
# HOME_MODE is used by useradd(8) and newusers(8) to set the mode for new
|
||||
# home directories.
|
||||
# If HOME_MODE is not set, the value of UMASK is used to create the mode.
|
||||
#HOME_MODE 0700
|
||||
#ULIMIT 2097152
|
||||
|
||||
#
|
||||
# Password aging controls:
|
||||
@@ -228,43 +205,35 @@ PASS_WARN_AGE 7
|
||||
SU_WHEEL_ONLY no
|
||||
|
||||
#
|
||||
# If compiled with cracklib support, sets the path to the dictionaries
|
||||
# If compiled with cracklib support, where are the dictionaries
|
||||
#
|
||||
CRACKLIB_DICTPATH /var/cache/cracklib/cracklib_dict
|
||||
|
||||
#
|
||||
# Min/max values for automatic uid selection in useradd(8)
|
||||
# Min/max values for automatic uid selection in useradd
|
||||
#
|
||||
UID_MIN 1000
|
||||
UID_MAX 60000
|
||||
# System accounts
|
||||
SYS_UID_MIN 101
|
||||
SYS_UID_MIN 100
|
||||
SYS_UID_MAX 999
|
||||
# Extra per user uids
|
||||
SUB_UID_MIN 100000
|
||||
SUB_UID_MAX 600100000
|
||||
SUB_UID_COUNT 65536
|
||||
|
||||
#
|
||||
# Min/max values for automatic gid selection in groupadd(8)
|
||||
# Min/max values for automatic gid selection in groupadd
|
||||
#
|
||||
GID_MIN 1000
|
||||
GID_MAX 60000
|
||||
# System accounts
|
||||
SYS_GID_MIN 101
|
||||
SYS_GID_MIN 100
|
||||
SYS_GID_MAX 999
|
||||
# Extra per user group ids
|
||||
SUB_GID_MIN 100000
|
||||
SUB_GID_MAX 600100000
|
||||
SUB_GID_COUNT 65536
|
||||
|
||||
#
|
||||
# Max number of login(1) retries if password is bad
|
||||
# Max number of login retries if password is bad
|
||||
#
|
||||
LOGIN_RETRIES 5
|
||||
|
||||
#
|
||||
# Max time in seconds for login(1)
|
||||
# Max time in seconds for login
|
||||
#
|
||||
LOGIN_TIMEOUT 60
|
||||
|
||||
@@ -286,16 +255,16 @@ PASS_ALWAYS_WARN yes
|
||||
#PASS_MAX_LEN 8
|
||||
|
||||
#
|
||||
# Require password before chfn(1)/chsh(1) can make any changes.
|
||||
# Require password before chfn/chsh can make any changes.
|
||||
#
|
||||
CHFN_AUTH yes
|
||||
|
||||
#
|
||||
# Which fields may be changed by regular users using chfn(1) - use
|
||||
# Which fields may be changed by regular users using chfn - use
|
||||
# any combination of letters "frwh" (full name, room number, work
|
||||
# phone, home phone). If not defined, no changes are allowed.
|
||||
# For backward compatibility, "yes" = "rwh" and "no" = "frwh".
|
||||
#
|
||||
#
|
||||
CHFN_RESTRICT rwh
|
||||
|
||||
#
|
||||
@@ -316,19 +285,16 @@ CHFN_RESTRICT rwh
|
||||
# Note: If you use PAM, it is recommended to use a value consistent with
|
||||
# the PAM modules configuration.
|
||||
#
|
||||
# This variable is deprecated. You should use ENCRYPT_METHOD instead.
|
||||
# This variable is deprecated. You should use ENCRYPT_METHOD.
|
||||
#
|
||||
#MD5_CRYPT_ENAB no
|
||||
|
||||
#
|
||||
# Only works if compiled with ENCRYPTMETHOD_SELECT defined:
|
||||
# If set to MD5, MD5-based algorithm will be used for encrypting password
|
||||
# If set to MD5 , MD5-based algorithm will be used for encrypting password
|
||||
# If set to SHA256, SHA256-based algorithm will be used for encrypting password
|
||||
# If set to SHA512, SHA512-based algorithm will be used for encrypting password
|
||||
# If set to BCRYPT, BCRYPT-based algorithm will be used for encrypting password
|
||||
# If set to YESCRYPT, YESCRYPT-based algorithm will be used for encrypting password
|
||||
# If set to DES, DES-based algorithm will be used for encrypting password (default)
|
||||
# MD5 and DES should not be used for new hashes, see crypt(5) for recommendations.
|
||||
# Overrides the MD5_CRYPT_ENAB option
|
||||
#
|
||||
# Note: If you use PAM, it is recommended to use a value consistent with
|
||||
@@ -340,72 +306,35 @@ CHFN_RESTRICT rwh
|
||||
# Only works if ENCRYPT_METHOD is set to SHA256 or SHA512.
|
||||
#
|
||||
# Define the number of SHA rounds.
|
||||
# With a lot of rounds, it is more difficult to brute-force the password.
|
||||
# However, more CPU resources will be needed to authenticate users if
|
||||
# this value is increased.
|
||||
# With a lot of rounds, it is more difficult to brute forcing the password.
|
||||
# But note also that it more CPU resources will be needed to authenticate
|
||||
# users.
|
||||
#
|
||||
# If not specified, the libc will choose the default number of rounds (5000),
|
||||
# which is orders of magnitude too low for modern hardware.
|
||||
# The values must be within the 1000-999999999 range.
|
||||
# If not specified, the libc will choose the default number of rounds (5000).
|
||||
# The values must be inside the 1000-999999999 range.
|
||||
# If only one of the MIN or MAX values is set, then this value will be used.
|
||||
# If MIN > MAX, the highest value will be used.
|
||||
#
|
||||
#SHA_CRYPT_MIN_ROUNDS 5000
|
||||
#SHA_CRYPT_MAX_ROUNDS 5000
|
||||
|
||||
#
|
||||
# Only works if ENCRYPT_METHOD is set to BCRYPT.
|
||||
#
|
||||
# Define the number of BCRYPT rounds.
|
||||
# With a lot of rounds, it is more difficult to brute-force the password.
|
||||
# However, more CPU resources will be needed to authenticate users if
|
||||
# this value is increased.
|
||||
#
|
||||
# If not specified, 13 rounds will be attempted.
|
||||
# If only one of the MIN or MAX values is set, then this value will be used.
|
||||
# If MIN > MAX, the highest value will be used.
|
||||
#
|
||||
#BCRYPT_MIN_ROUNDS 13
|
||||
#BCRYPT_MAX_ROUNDS 13
|
||||
|
||||
#
|
||||
# Only works if ENCRYPT_METHOD is set to YESCRYPT.
|
||||
#
|
||||
# Define the YESCRYPT cost factor.
|
||||
# With a higher cost factor, it is more difficult to brute-force the password.
|
||||
# However, more CPU time and more memory will be needed to authenticate users
|
||||
# if this value is increased.
|
||||
#
|
||||
# If not specified, a cost factor of 5 will be used.
|
||||
# The value must be within the 1-11 range.
|
||||
#
|
||||
#YESCRYPT_COST_FACTOR 5
|
||||
# SHA_CRYPT_MIN_ROUNDS 5000
|
||||
# SHA_CRYPT_MAX_ROUNDS 5000
|
||||
|
||||
#
|
||||
# List of groups to add to the user's supplementary group set
|
||||
# when logging in from the console (as determined by the CONSOLE
|
||||
# when logging in on the console (as determined by the CONSOLE
|
||||
# setting). Default is none.
|
||||
#
|
||||
# Use with caution - it is possible for users to gain permanent
|
||||
# access to these groups, even when not logged in from the console.
|
||||
# access to these groups, even when not logged in on the console.
|
||||
# How to do it is left as an exercise for the reader...
|
||||
#
|
||||
#CONSOLE_GROUPS floppy:audio:cdrom
|
||||
|
||||
#
|
||||
# Should login be allowed if we can't cd to the home directory?
|
||||
# Default is no.
|
||||
# Default in no.
|
||||
#
|
||||
DEFAULT_HOME yes
|
||||
|
||||
#
|
||||
# The pwck(8) utility emits a warning for any system account with a home
|
||||
# directory that does not exist. Some system accounts intentionally do
|
||||
# not have a home directory. Such accounts may have this string as
|
||||
# their home directory in /etc/passwd to avoid a spurious warning.
|
||||
#
|
||||
NONEXISTENT /nonexistent
|
||||
|
||||
#
|
||||
# If this file exists and is readable, login environment will be
|
||||
# read from it. Every line should be in the form name=value.
|
||||
@@ -424,56 +353,17 @@ ENVIRON_FILE /etc/environment
|
||||
# (examples: 022 -> 002, 077 -> 007) for non-root users, if the uid is
|
||||
# the same as gid, and username is the same as the primary group name.
|
||||
#
|
||||
# This also enables userdel(8) to remove user groups if no members exist.
|
||||
# This also enables userdel to remove user groups if no members exist.
|
||||
#
|
||||
USERGROUPS_ENAB yes
|
||||
|
||||
#
|
||||
# If set to a non-zero number, the shadow utilities will make sure that
|
||||
# If set to a non-nul number, the shadow utilities will make sure that
|
||||
# groups never have more than this number of users on one line.
|
||||
# This permits to support split groups (groups split into multiple lines,
|
||||
# This permit to support split groups (groups split into multiple lines,
|
||||
# with the same group ID, to avoid limitation of the line length in the
|
||||
# group file).
|
||||
#
|
||||
# 0 is the default value and disables this feature.
|
||||
#
|
||||
#MAX_MEMBERS_PER_GROUP 0
|
||||
|
||||
#
|
||||
# If useradd(8) should create home directories for users by default (non
|
||||
# system users only).
|
||||
# This option is overridden with the -M or -m flags on the useradd(8)
|
||||
# command-line.
|
||||
#
|
||||
#CREATE_HOME yes
|
||||
|
||||
#
|
||||
# Force use shadow, even if shadow passwd & shadow group files are
|
||||
# missing.
|
||||
#
|
||||
#FORCE_SHADOW yes
|
||||
|
||||
#
|
||||
# Allow newuidmap and newgidmap when running under an alternative
|
||||
# primary group.
|
||||
#
|
||||
#GRANT_AUX_GROUP_SUBIDS yes
|
||||
|
||||
#
|
||||
# Prevents an empty password field to be interpreted as "no authentication
|
||||
# required".
|
||||
# Set to "yes" to prevent for all accounts
|
||||
# Set to "superuser" to prevent for UID 0 / root (default)
|
||||
# Set to "no" to not prevent for any account (dangerous, historical default)
|
||||
|
||||
PREVENT_NO_AUTH superuser
|
||||
|
||||
#
|
||||
# Select the HMAC cryptography algorithm.
|
||||
# Used in pam_timestamp module to calculate the keyed-hash message
|
||||
# authentication code.
|
||||
#
|
||||
# Note: It is recommended to check hmac(3) to see the possible algorithms
|
||||
# that are available in your system.
|
||||
#
|
||||
#HMAC_CRYPTO_ALGO SHA512
|
||||
|
||||
@@ -2,20 +2,19 @@
|
||||
# and also cooperate to make a distribution for `make dist'
|
||||
|
||||
pamd_files = \
|
||||
chfn \
|
||||
chsh \
|
||||
groupmems \
|
||||
login \
|
||||
passwd
|
||||
|
||||
pamd_acct_tools_files = \
|
||||
chage \
|
||||
chfn \
|
||||
chgpasswd \
|
||||
chpasswd \
|
||||
chsh \
|
||||
groupadd \
|
||||
groupdel \
|
||||
groupmems \
|
||||
groupmod \
|
||||
login \
|
||||
newusers \
|
||||
passwd \
|
||||
su \
|
||||
useradd \
|
||||
userdel \
|
||||
usermod
|
||||
@@ -23,13 +22,6 @@ pamd_acct_tools_files = \
|
||||
if USE_PAM
|
||||
pamddir = $(sysconfdir)/pam.d
|
||||
pamd_DATA = $(pamd_files)
|
||||
if ACCT_TOOLS_SETUID
|
||||
pamd_DATA += $(pamd_acct_tools_files)
|
||||
endif
|
||||
endif
|
||||
|
||||
if WITH_SU
|
||||
pamd_files += su
|
||||
endif
|
||||
|
||||
EXTRA_DIST = $(pamd_files) $(pamd_acct_tools_files)
|
||||
EXTRA_DIST = $(pamd_files)
|
||||
|
||||
8
etc/useradd
Normal file
8
etc/useradd
Normal file
@@ -0,0 +1,8 @@
|
||||
# useradd defaults file
|
||||
GROUP=1000
|
||||
HOME=/home
|
||||
INACTIVE=-1
|
||||
EXPIRE=
|
||||
SHELL=/bin/bash
|
||||
SKEL=/etc/skel
|
||||
CREATE_MAIL_SPOOL=yes
|
||||
@@ -5,10 +5,7 @@ DEFS =
|
||||
|
||||
noinst_LTLIBRARIES = libshadow.la
|
||||
|
||||
libshadow_la_CPPFLAGS = $(ECONF_CPPFLAGS)
|
||||
if HAVE_VENDORDIR
|
||||
libshadow_la_CPPFLAGS += -DVENDORDIR=\"$(VENDORDIR)\"
|
||||
endif
|
||||
libshadow_la_LDFLAGS = -version-info 0:0:0
|
||||
|
||||
libshadow_la_SOURCES = \
|
||||
commonio.c \
|
||||
@@ -17,25 +14,16 @@ libshadow_la_SOURCES = \
|
||||
encrypt.c \
|
||||
exitcodes.h \
|
||||
faillog.h \
|
||||
fields.c \
|
||||
fputsx.c \
|
||||
getdef.c \
|
||||
getdef.h \
|
||||
get_gid.c \
|
||||
getlong.c \
|
||||
get_pid.c \
|
||||
get_uid.c \
|
||||
getulong.c \
|
||||
groupio.c \
|
||||
groupmem.c \
|
||||
groupio.h \
|
||||
gshadow.c \
|
||||
lockpw.c \
|
||||
nss.c \
|
||||
nscd.c \
|
||||
nscd.h \
|
||||
sssd.c \
|
||||
sssd.h \
|
||||
pam_defs.h \
|
||||
port.c \
|
||||
port.h \
|
||||
@@ -45,28 +33,16 @@ libshadow_la_SOURCES = \
|
||||
pwio.c \
|
||||
pwio.h \
|
||||
pwmem.c \
|
||||
run_part.h \
|
||||
run_part.c \
|
||||
subordinateio.h \
|
||||
subordinateio.c \
|
||||
selinux.c \
|
||||
semanage.c \
|
||||
sgetgrent.c \
|
||||
sgetpwent.c \
|
||||
sgetspent.c \
|
||||
sgroupio.c \
|
||||
sgroupio.h\
|
||||
shadow.c \
|
||||
shadowio.c \
|
||||
shadowio.h \
|
||||
shadowmem.c \
|
||||
spawn.c \
|
||||
utent.c
|
||||
|
||||
if WITH_TCB
|
||||
libshadow_la_SOURCES += tcbfuncs.c tcbfuncs.h
|
||||
endif
|
||||
|
||||
# These files are unneeded for some reason, listed in
|
||||
# order of appearance:
|
||||
#
|
||||
|
||||
853
lib/commonio.c
853
lib/commonio.c
File diff suppressed because it is too large
Load Diff
@@ -2,7 +2,7 @@
|
||||
* Copyright (c) 1990 - 1994, Julianne Frances Haugh
|
||||
* Copyright (c) 1996 - 2000, Marek Michałkiewicz
|
||||
* Copyright (c) 2001 - 2005, Tomasz Kłoczko
|
||||
* Copyright (c) 2007 - 2010, Nicolas François
|
||||
* Copyright (c) 2007 - 2008, Nicolas François
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
@@ -31,20 +31,20 @@
|
||||
*/
|
||||
|
||||
/* $Id$ */
|
||||
#ifndef COMMONIO_H
|
||||
#define COMMONIO_H
|
||||
|
||||
#include "defines.h" /* bool */
|
||||
#ifndef _COMMONIO_H
|
||||
#define _COMMONIO_H
|
||||
|
||||
#ifdef WITH_SELINUX
|
||||
#include <selinux/selinux.h>
|
||||
#endif
|
||||
/*
|
||||
* Linked list entry.
|
||||
*/
|
||||
struct commonio_entry {
|
||||
/*@null@*/char *line;
|
||||
/*@null@*/void *eptr; /* struct passwd, struct spwd, ... */
|
||||
/*@dependent@*/ /*@null@*/struct commonio_entry *prev;
|
||||
/*@owned@*/ /*@null@*/struct commonio_entry *next;
|
||||
bool changed:1;
|
||||
char *line;
|
||||
void *eptr; /* struct passwd, struct spwd, ... */
|
||||
struct commonio_entry *prev, *next;
|
||||
unsigned int changed:1;
|
||||
};
|
||||
|
||||
/*
|
||||
@@ -55,12 +55,12 @@ struct commonio_ops {
|
||||
* Make a copy of the object (for example, struct passwd)
|
||||
* and all strings pointed by it, in malloced memory.
|
||||
*/
|
||||
/*@null@*/ /*@only@*/void *(*dup) (const void *);
|
||||
void *(*dup) (const void *);
|
||||
|
||||
/*
|
||||
* free() the object including any strings pointed by it.
|
||||
*/
|
||||
void (*free) (/*@out@*/ /*@only@*/void *);
|
||||
void (*free) (void *);
|
||||
|
||||
/*
|
||||
* Return the name of the object (for example, pw_name
|
||||
@@ -84,7 +84,7 @@ struct commonio_ops {
|
||||
* fgets and fputs (can be replaced by versions that
|
||||
* understand line continuation conventions).
|
||||
*/
|
||||
/*@null@*/char *(*fgets) (/*@returned@*/ /*@out@*/char *s, int n, FILE *stream);
|
||||
char *(*fgets) (char *, int, FILE *);
|
||||
int (*fputs) (const char *, FILE *);
|
||||
|
||||
/*
|
||||
@@ -93,8 +93,8 @@ struct commonio_ops {
|
||||
* is open or before it is closed.
|
||||
* They return 0 on failure and 1 on success.
|
||||
*/
|
||||
/*@null@*/int (*open_hook) (void);
|
||||
/*@null@*/int (*close_hook) (void);
|
||||
int (*open_hook) (void);
|
||||
int (*close_hook) (void);
|
||||
};
|
||||
|
||||
/*
|
||||
@@ -109,59 +109,47 @@ struct commonio_db {
|
||||
/*
|
||||
* Operations from above.
|
||||
*/
|
||||
/*@observer@*/const struct commonio_ops *ops;
|
||||
struct commonio_ops *ops;
|
||||
|
||||
/*
|
||||
* Currently open file stream.
|
||||
*/
|
||||
/*@dependent@*/ /*@null@*/FILE *fp;
|
||||
FILE *fp;
|
||||
|
||||
#ifdef WITH_SELINUX
|
||||
/*@null@*/char *scontext;
|
||||
security_context_t scontext;
|
||||
#endif
|
||||
/*
|
||||
* Default permissions and owner for newly created data file.
|
||||
*/
|
||||
mode_t st_mode;
|
||||
uid_t st_uid;
|
||||
gid_t st_gid;
|
||||
/*
|
||||
* Head, tail, current position in linked list.
|
||||
*/
|
||||
/*@owned@*/ /*@null@*/struct commonio_entry *head;
|
||||
/*@dependent@*/ /*@null@*/struct commonio_entry *tail;
|
||||
/*@dependent@*/ /*@null@*/struct commonio_entry *cursor;
|
||||
struct commonio_entry *head, *tail, *cursor;
|
||||
|
||||
/*
|
||||
* Various flags.
|
||||
*/
|
||||
bool changed:1;
|
||||
bool isopen:1;
|
||||
bool locked:1;
|
||||
bool readonly:1;
|
||||
bool setname:1;
|
||||
unsigned int changed:1;
|
||||
unsigned int isopen:1;
|
||||
unsigned int locked:1;
|
||||
unsigned int readonly:1;
|
||||
};
|
||||
|
||||
extern int commonio_setname (struct commonio_db *, const char *);
|
||||
extern bool commonio_present (const struct commonio_db *db);
|
||||
extern int commonio_present (const struct commonio_db *);
|
||||
extern int commonio_lock (struct commonio_db *);
|
||||
extern int commonio_lock_nowait (struct commonio_db *, bool log);
|
||||
extern int commonio_lock_nowait (struct commonio_db *);
|
||||
extern int commonio_open (struct commonio_db *, int);
|
||||
extern /*@observer@*/ /*@null@*/const void *commonio_locate (struct commonio_db *, const char *);
|
||||
extern const void *commonio_locate (struct commonio_db *, const char *);
|
||||
extern int commonio_update (struct commonio_db *, const void *);
|
||||
#ifdef ENABLE_SUBIDS
|
||||
extern int commonio_append (struct commonio_db *, const void *);
|
||||
#endif /* ENABLE_SUBIDS */
|
||||
extern int commonio_remove (struct commonio_db *, const char *);
|
||||
extern int commonio_rewind (struct commonio_db *);
|
||||
extern /*@observer@*/ /*@null@*/const void *commonio_next (struct commonio_db *);
|
||||
extern const void *commonio_next (struct commonio_db *);
|
||||
extern int commonio_close (struct commonio_db *);
|
||||
extern int commonio_unlock (struct commonio_db *);
|
||||
extern void commonio_del_entry (struct commonio_db *,
|
||||
const struct commonio_entry *);
|
||||
const struct commonio_entry *);
|
||||
extern int commonio_sort_wrt (struct commonio_db *shadow,
|
||||
const struct commonio_db *passwd);
|
||||
struct commonio_db *passwd);
|
||||
extern int commonio_sort (struct commonio_db *db,
|
||||
int (*cmp) (const void *, const void *));
|
||||
int (*cmp) (const void *, const void *));
|
||||
|
||||
#endif
|
||||
|
||||
107
lib/defines.h
107
lib/defines.h
@@ -4,62 +4,29 @@
|
||||
#ifndef _DEFINES_H_
|
||||
#define _DEFINES_H_
|
||||
|
||||
#include "config.h"
|
||||
|
||||
#if HAVE_STDBOOL_H
|
||||
# include <stdbool.h>
|
||||
#else
|
||||
# if ! HAVE__BOOL
|
||||
# ifdef __cplusplus
|
||||
typedef bool _Bool;
|
||||
# else
|
||||
typedef unsigned char _Bool;
|
||||
# endif
|
||||
# endif
|
||||
# define bool _Bool
|
||||
# define false (0)
|
||||
# define true (1)
|
||||
# define __bool_true_false_are_defined 1
|
||||
#endif
|
||||
|
||||
#define ISDIGIT_LOCALE(c) (IN_CTYPE_DOMAIN (c) && isdigit (c))
|
||||
|
||||
/* Take care of NLS matters. */
|
||||
#ifdef S_SPLINT_S
|
||||
extern char *setlocale(int categories, const char *locale);
|
||||
# define LC_ALL (6)
|
||||
extern char * bindtextdomain (const char * domainname, const char * dirname);
|
||||
extern char * textdomain (const char * domainname);
|
||||
# define _(Text) Text
|
||||
# define ngettext(Msgid1, Msgid2, N) \
|
||||
((N) == 1 ? (const char *) (Msgid1) : (const char *) (Msgid2))
|
||||
#else
|
||||
#ifdef HAVE_LOCALE_H
|
||||
|
||||
#if HAVE_LOCALE_H
|
||||
# include <locale.h>
|
||||
#else
|
||||
# undef setlocale
|
||||
# define setlocale(category, locale) (NULL)
|
||||
# ifndef LC_ALL
|
||||
# define LC_ALL 6
|
||||
# endif
|
||||
#endif
|
||||
|
||||
#define gettext_noop(String) (String)
|
||||
/* #define gettext_def(String) "#define String" */
|
||||
|
||||
#ifdef ENABLE_NLS
|
||||
#if ENABLE_NLS
|
||||
# include <libintl.h>
|
||||
# define _(Text) gettext (Text)
|
||||
#else
|
||||
# undef bindtextdomain
|
||||
# define bindtextdomain(Domain, Directory) (NULL)
|
||||
# define bindtextdomain(Domain, Directory) /* empty */
|
||||
# undef textdomain
|
||||
# define textdomain(Domain) (NULL)
|
||||
# define textdomain(Domain) /* empty */
|
||||
# define _(Text) Text
|
||||
# define ngettext(Msgid1, Msgid2, N) \
|
||||
((N) == 1 ? (const char *) (Msgid1) : (const char *) (Msgid2))
|
||||
#endif
|
||||
#endif
|
||||
|
||||
#if STDC_HEADERS
|
||||
# include <stdlib.h>
|
||||
@@ -96,14 +63,6 @@ char *strchr (), *strrchr (), *strtok ();
|
||||
# include <unistd.h>
|
||||
#endif
|
||||
|
||||
/*
|
||||
* crypt(3), crypt_gensalt(3), and their
|
||||
* feature test macros may be defined in here.
|
||||
*/
|
||||
#if HAVE_CRYPT_H
|
||||
# include <crypt.h>
|
||||
#endif
|
||||
|
||||
#if TIME_WITH_SYS_TIME
|
||||
# include <sys/time.h>
|
||||
# include <time.h>
|
||||
@@ -177,7 +136,7 @@ char *strchr (), *strrchr (), *strtok ();
|
||||
|
||||
/* cleaner than lots of #ifdefs everywhere - use this as follows:
|
||||
SYSLOG((LOG_CRIT, "user %s cracked root", user)); */
|
||||
#ifdef ENABLE_NLS
|
||||
#if ENABLE_NLS
|
||||
/* Temporarily set LC_TIME to "C" to avoid strange dates in syslog.
|
||||
This is a workaround for a more general syslog(d) design problem -
|
||||
syslogd should log the current system time for each event, and not
|
||||
@@ -187,20 +146,17 @@ char *strchr (), *strrchr (), *strtok ();
|
||||
* --Nekral */
|
||||
#define SYSLOG(x) \
|
||||
do { \
|
||||
char *old_locale = setlocale (LC_ALL, NULL); \
|
||||
char *saved_locale = NULL; \
|
||||
if (NULL != old_locale) { \
|
||||
saved_locale = strdup (old_locale); \
|
||||
} \
|
||||
if (NULL != saved_locale) { \
|
||||
(void) setlocale (LC_ALL, "C"); \
|
||||
} \
|
||||
char *saved_locale = setlocale(LC_ALL, NULL); \
|
||||
if (saved_locale) \
|
||||
saved_locale = strdup(saved_locale); \
|
||||
if (saved_locale) \
|
||||
setlocale(LC_ALL, "C"); \
|
||||
syslog x ; \
|
||||
if (NULL != saved_locale) { \
|
||||
(void) setlocale (LC_ALL, saved_locale); \
|
||||
free (saved_locale); \
|
||||
if (saved_locale) { \
|
||||
setlocale(LC_ALL, saved_locale); \
|
||||
free(saved_locale); \
|
||||
} \
|
||||
} while (false)
|
||||
} while (0)
|
||||
#else /* !ENABLE_NLS */
|
||||
#define SYSLOG(x) syslog x
|
||||
#endif /* !ENABLE_NLS */
|
||||
@@ -347,8 +303,6 @@ extern char *strerror ();
|
||||
#define SHADOW_PASSWD_STRING "x"
|
||||
#endif
|
||||
|
||||
#define SHADOW_SP_FLAG_UNSET ((unsigned long int)-1)
|
||||
|
||||
#ifdef WITH_AUDIT
|
||||
#ifdef __u8 /* in case we use pam < 0.80 */
|
||||
#undef __u8
|
||||
@@ -367,35 +321,4 @@ extern char *strerror ();
|
||||
# define unused
|
||||
#endif
|
||||
|
||||
/* ! Arguments evaluated twice ! */
|
||||
#ifndef MIN
|
||||
#define MIN(a,b) (((a) < (b)) ? (a) : (b))
|
||||
#endif
|
||||
#ifndef MAX
|
||||
#define MAX(x,y) (((x) > (y)) ? (x) : (y))
|
||||
#endif
|
||||
|
||||
/* Maximum length of usernames */
|
||||
#ifdef HAVE_UTMPX_H
|
||||
# include <utmpx.h>
|
||||
# define USER_NAME_MAX_LENGTH (sizeof (((struct utmpx *)NULL)->ut_user))
|
||||
#else
|
||||
# include <utmp.h>
|
||||
# ifdef HAVE_STRUCT_UTMP_UT_USER
|
||||
# define USER_NAME_MAX_LENGTH (sizeof (((struct utmp *)NULL)->ut_user))
|
||||
# else
|
||||
# ifdef HAVE_STRUCT_UTMP_UT_NAME
|
||||
# define USER_NAME_MAX_LENGTH (sizeof (((struct utmp *)NULL)->ut_name))
|
||||
# else
|
||||
# define USER_NAME_MAX_LENGTH 32
|
||||
# endif
|
||||
# endif
|
||||
#endif
|
||||
|
||||
#ifdef HAVE_SECURE_GETENV
|
||||
# define shadow_getenv(name) secure_getenv(name)
|
||||
# else
|
||||
# define shadow_getenv(name) getenv(name)
|
||||
#endif
|
||||
|
||||
#endif /* _DEFINES_H_ */
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
* Copyright (c) 1990 - 1993, Julianne Frances Haugh
|
||||
* Copyright (c) 1996 - 2000, Marek Michałkiewicz
|
||||
* Copyright (c) 2005 , Tomasz Kłoczko
|
||||
* Copyright (c) 2007 - 2010, Nicolas François
|
||||
* Copyright (c) 2007 - 2008, Nicolas François
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
@@ -40,43 +40,38 @@
|
||||
#include "prototypes.h"
|
||||
#include "defines.h"
|
||||
|
||||
/*@exposed@*//*@null@*/char *pw_encrypt (const char *clear, const char *salt)
|
||||
char *pw_encrypt (const char *clear, const char *salt)
|
||||
{
|
||||
static char cipher[128];
|
||||
char *cp;
|
||||
|
||||
cp = crypt (clear, salt);
|
||||
if (NULL == cp) {
|
||||
if (!cp) {
|
||||
/*
|
||||
* Single Unix Spec: crypt() may return a null pointer,
|
||||
* and set errno to indicate an error. In this case return
|
||||
* the NULL so the caller can handle appropriately.
|
||||
* and set errno to indicate an error. The caller doesn't
|
||||
* expect us to return NULL, so...
|
||||
*/
|
||||
return NULL;
|
||||
perror ("crypt");
|
||||
exit (1);
|
||||
}
|
||||
|
||||
/* Some crypt() do not return NULL if the algorithm is not
|
||||
/* The GNU crypt does not return NULL if the algorithm is not
|
||||
* supported, and return a DES encrypted password. */
|
||||
if ((NULL != salt) && (salt[0] == '$') && (strlen (cp) <= 13))
|
||||
if (salt && salt[0] == '$' && strlen (cp) <= 13)
|
||||
{
|
||||
/*@observer@*/const char *method;
|
||||
const char *method;
|
||||
switch (salt[1])
|
||||
{
|
||||
case '1':
|
||||
method = "MD5";
|
||||
break;
|
||||
case '2':
|
||||
method = "BCRYPT";
|
||||
break;
|
||||
case '5':
|
||||
method = "SHA256";
|
||||
break;
|
||||
case '6':
|
||||
method = "SHA512";
|
||||
break;
|
||||
case 'y':
|
||||
method = "YESCRYPT";
|
||||
break;
|
||||
default:
|
||||
{
|
||||
static char nummethod[4] = "$x$";
|
||||
@@ -84,18 +79,15 @@
|
||||
method = &nummethod[0];
|
||||
}
|
||||
}
|
||||
(void) fprintf (shadow_logfd,
|
||||
_("crypt method not supported by libcrypt? (%s)\n"),
|
||||
method);
|
||||
exit (EXIT_FAILURE);
|
||||
fprintf (stderr,
|
||||
_("crypt method not supported by libcrypt? (%s)\n"),
|
||||
method);
|
||||
exit (1);
|
||||
}
|
||||
|
||||
if (strlen (cp) != 13) {
|
||||
if (strlen (cp) != 13)
|
||||
return cp; /* nonstandard crypt() in libc, better bail out */
|
||||
}
|
||||
|
||||
strcpy (cipher, cp);
|
||||
|
||||
return cipher;
|
||||
}
|
||||
|
||||
|
||||
@@ -32,12 +32,7 @@
|
||||
/*
|
||||
* Exit codes used by shadow programs
|
||||
*/
|
||||
#define E_SUCCESS EXIT_SUCCESS /* success */
|
||||
/*
|
||||
* FIXME: other values should differ from EXIT_FAILURE (and EXIT_SUCCESS).
|
||||
*
|
||||
* FIXME: reserve EXIT_FAILURE for internal failures.
|
||||
*/
|
||||
#define E_SUCCESS 0 /* success */
|
||||
#define E_NOPERM 1 /* permission denied */
|
||||
#define E_USAGE 2 /* invalid command syntax */
|
||||
#define E_BAD_ARG 3 /* invalid argument to option */
|
||||
|
||||
28
lib/fputsx.c
28
lib/fputsx.c
@@ -39,29 +39,23 @@
|
||||
#ident "$Id$"
|
||||
|
||||
|
||||
/*@null@*/char *fgetsx (/*@returned@*/ /*@out@*/char *buf, int cnt, FILE * f)
|
||||
char *fgetsx (char *buf, int cnt, FILE * f)
|
||||
{
|
||||
char *cp = buf;
|
||||
char *ep;
|
||||
|
||||
while (cnt > 0) {
|
||||
if (fgets (cp, cnt, f) != cp) {
|
||||
if (cp == buf) {
|
||||
if (fgets (cp, cnt, f) == 0) {
|
||||
if (cp == buf)
|
||||
return 0;
|
||||
} else {
|
||||
else
|
||||
break;
|
||||
}
|
||||
}
|
||||
ep = strrchr (cp, '\\');
|
||||
if ((NULL != ep) && (*(ep + 1) == '\n')) {
|
||||
cnt -= ep - cp;
|
||||
if (cnt > 0) {
|
||||
cp = ep;
|
||||
*cp = '\0';
|
||||
}
|
||||
} else {
|
||||
if ((ep = strrchr (cp, '\\')) && *(ep + 1) == '\n') {
|
||||
if ((cnt -= ep - cp) > 0)
|
||||
*(cp = ep) = '\0';
|
||||
} else
|
||||
break;
|
||||
}
|
||||
}
|
||||
return buf;
|
||||
}
|
||||
@@ -70,10 +64,9 @@ int fputsx (const char *s, FILE * stream)
|
||||
{
|
||||
int i;
|
||||
|
||||
for (i = 0; '\0' != *s; i++, s++) {
|
||||
if (putc (*s, stream) == EOF) {
|
||||
for (i = 0; *s; i++, s++) {
|
||||
if (putc (*s, stream) == EOF)
|
||||
return EOF;
|
||||
}
|
||||
|
||||
#if 0 /* The standard getgr*() can't handle that. --marekm */
|
||||
if (i > (BUFSIZ / 2)) {
|
||||
@@ -87,4 +80,3 @@ int fputsx (const char *s, FILE * stream)
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
@@ -1,54 +0,0 @@
|
||||
/*
|
||||
* Copyright (c) 2009 , Nicolas François
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. The name of the copyright holders or contributors may not be used to
|
||||
* endorse or promote products derived from this software without
|
||||
* specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
|
||||
* PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
* HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include <config.h>
|
||||
|
||||
#ident "$Id$"
|
||||
|
||||
#include "prototypes.h"
|
||||
#include "defines.h"
|
||||
|
||||
int get_gid (const char *gidstr, gid_t *gid)
|
||||
{
|
||||
long long int val;
|
||||
char *endptr;
|
||||
|
||||
errno = 0;
|
||||
val = strtoll (gidstr, &endptr, 10);
|
||||
if ( ('\0' == *gidstr)
|
||||
|| ('\0' != *endptr)
|
||||
|| (ERANGE == errno)
|
||||
|| (/*@+longintegral@*/val != (gid_t)val)/*@=longintegral@*/) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
*gid = (gid_t)val;
|
||||
return 1;
|
||||
}
|
||||
|
||||
@@ -1,54 +0,0 @@
|
||||
/*
|
||||
* Copyright (c) 2009 , Nicolas François
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. The name of the copyright holders or contributors may not be used to
|
||||
* endorse or promote products derived from this software without
|
||||
* specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
|
||||
* PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
* HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include <config.h>
|
||||
|
||||
#ident "$Id$"
|
||||
|
||||
#include "prototypes.h"
|
||||
#include "defines.h"
|
||||
|
||||
int get_pid (const char *pidstr, pid_t *pid)
|
||||
{
|
||||
long long int val;
|
||||
char *endptr;
|
||||
|
||||
errno = 0;
|
||||
val = strtoll (pidstr, &endptr, 10);
|
||||
if ( ('\0' == *pidstr)
|
||||
|| ('\0' != *endptr)
|
||||
|| (ERANGE == errno)
|
||||
|| (/*@+longintegral@*/val != (pid_t)val)/*@=longintegral@*/) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
*pid = (pid_t)val;
|
||||
return 1;
|
||||
}
|
||||
|
||||
@@ -1,54 +0,0 @@
|
||||
/*
|
||||
* Copyright (c) 2009 , Nicolas François
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. The name of the copyright holders or contributors may not be used to
|
||||
* endorse or promote products derived from this software without
|
||||
* specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
|
||||
* PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
* HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include <config.h>
|
||||
|
||||
#ident "$Id$"
|
||||
|
||||
#include "prototypes.h"
|
||||
#include "defines.h"
|
||||
|
||||
int get_uid (const char *uidstr, uid_t *uid)
|
||||
{
|
||||
long long int val;
|
||||
char *endptr;
|
||||
|
||||
errno = 0;
|
||||
val = strtoll (uidstr, &endptr, 10);
|
||||
if ( ('\0' == *uidstr)
|
||||
|| ('\0' != *endptr)
|
||||
|| (ERANGE == errno)
|
||||
|| (/*@+longintegral@*/val != (uid_t)val)/*@=longintegral@*/) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
*uid = (uid_t)val;
|
||||
return 1;
|
||||
}
|
||||
|
||||
404
lib/getdef.c
404
lib/getdef.c
@@ -39,56 +39,15 @@
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <ctype.h>
|
||||
#include <errno.h>
|
||||
#ifdef USE_ECONF
|
||||
#include <libeconf.h>
|
||||
#endif
|
||||
#include "getdef.h"
|
||||
/*
|
||||
* A configuration item definition.
|
||||
*/
|
||||
struct itemdef {
|
||||
/*@null@*/const char *name; /* name of the item */
|
||||
/*@null@*/char *value; /* value given, or NULL if no value */
|
||||
const char *name; /* name of the item */
|
||||
char *value; /* value given, or NULL if no value */
|
||||
};
|
||||
|
||||
#define PAMDEFS \
|
||||
{"CHFN_AUTH", NULL}, \
|
||||
{"CHSH_AUTH", NULL}, \
|
||||
{"CRACKLIB_DICTPATH", NULL}, \
|
||||
{"ENV_HZ", NULL}, \
|
||||
{"ENVIRON_FILE", NULL}, \
|
||||
{"ENV_TZ", NULL}, \
|
||||
{"FAILLOG_ENAB", NULL}, \
|
||||
{"FTMP_FILE", NULL}, \
|
||||
{"HMAC_CRYPTO_ALGO", NULL}, \
|
||||
{"ISSUE_FILE", NULL}, \
|
||||
{"LASTLOG_ENAB", NULL}, \
|
||||
{"LOGIN_STRING", NULL}, \
|
||||
{"MAIL_CHECK_ENAB", NULL}, \
|
||||
{"MOTD_FILE", NULL}, \
|
||||
{"NOLOGINS_FILE", NULL}, \
|
||||
{"OBSCURE_CHECKS_ENAB", NULL}, \
|
||||
{"PASS_ALWAYS_WARN", NULL}, \
|
||||
{"PASS_CHANGE_TRIES", NULL}, \
|
||||
{"PASS_MAX_LEN", NULL}, \
|
||||
{"PASS_MIN_LEN", NULL}, \
|
||||
{"PORTTIME_CHECKS_ENAB", NULL}, \
|
||||
{"QUOTAS_ENAB", NULL}, \
|
||||
{"SU_WHEEL_ONLY", NULL}, \
|
||||
{"ULIMIT", NULL},
|
||||
|
||||
/*
|
||||
* Items used in other tools (util-linux, etc.)
|
||||
*/
|
||||
#define FOREIGNDEFS \
|
||||
{"ALWAYS_SET_PATH", NULL}, \
|
||||
{"ENV_ROOTPATH", NULL}, \
|
||||
{"LOGIN_KEEP_USERNAME", NULL}, \
|
||||
{"LOGIN_PLAIN_PROMPT", NULL}, \
|
||||
{"MOTD_FIRSTONLY", NULL}, \
|
||||
|
||||
|
||||
#define NUMDEFS (sizeof(def_table)/sizeof(def_table[0]))
|
||||
static struct itemdef def_table[] = {
|
||||
{"CHFN_RESTRICT", NULL},
|
||||
@@ -104,10 +63,8 @@ static struct itemdef def_table[] = {
|
||||
{"FAKE_SHELL", NULL},
|
||||
{"GID_MAX", NULL},
|
||||
{"GID_MIN", NULL},
|
||||
{"HOME_MODE", NULL},
|
||||
{"HUSHLOGIN_FILE", NULL},
|
||||
{"KILLCHAR", NULL},
|
||||
{"LASTLOG_UID_MAX", NULL},
|
||||
{"LOGIN_RETRIES", NULL},
|
||||
{"LOGIN_TIMEOUT", NULL},
|
||||
{"LOG_OK_LOGINS", NULL},
|
||||
@@ -116,7 +73,6 @@ static struct itemdef def_table[] = {
|
||||
{"MAIL_FILE", NULL},
|
||||
{"MAX_MEMBERS_PER_GROUP", NULL},
|
||||
{"MD5_CRYPT_ENAB", NULL},
|
||||
{"NONEXISTENT", NULL},
|
||||
{"PASS_MAX_DAYS", NULL},
|
||||
{"PASS_MIN_DAYS", NULL},
|
||||
{"PASS_WARN_AGE", NULL},
|
||||
@@ -124,19 +80,6 @@ static struct itemdef def_table[] = {
|
||||
{"SHA_CRYPT_MAX_ROUNDS", NULL},
|
||||
{"SHA_CRYPT_MIN_ROUNDS", NULL},
|
||||
#endif
|
||||
#ifdef USE_BCRYPT
|
||||
{"BCRYPT_MAX_ROUNDS", NULL},
|
||||
{"BCRYPT_MIN_ROUNDS", NULL},
|
||||
#endif
|
||||
#ifdef USE_YESCRYPT
|
||||
{"YESCRYPT_COST_FACTOR", NULL},
|
||||
#endif
|
||||
{"SUB_GID_COUNT", NULL},
|
||||
{"SUB_GID_MAX", NULL},
|
||||
{"SUB_GID_MIN", NULL},
|
||||
{"SUB_UID_COUNT", NULL},
|
||||
{"SUB_UID_MAX", NULL},
|
||||
{"SUB_UID_MIN", NULL},
|
||||
{"SULOG_FILE", NULL},
|
||||
{"SU_NAME", NULL},
|
||||
{"SYS_GID_MAX", NULL},
|
||||
@@ -152,50 +95,46 @@ static struct itemdef def_table[] = {
|
||||
{"USERDEL_CMD", NULL},
|
||||
{"USERGROUPS_ENAB", NULL},
|
||||
#ifndef USE_PAM
|
||||
PAMDEFS
|
||||
{"CHFN_AUTH", NULL},
|
||||
{"CHSH_AUTH", NULL},
|
||||
{"CRACKLIB_DICTPATH", NULL},
|
||||
{"ENV_HZ", NULL},
|
||||
{"ENVIRON_FILE", NULL},
|
||||
{"ENV_TZ", NULL},
|
||||
{"FAILLOG_ENAB", NULL},
|
||||
{"FTMP_FILE", NULL},
|
||||
{"ISSUE_FILE", NULL},
|
||||
{"LASTLOG_ENAB", NULL},
|
||||
{"LOGIN_STRING", NULL},
|
||||
{"MAIL_CHECK_ENAB", NULL},
|
||||
{"MOTD_FILE", NULL},
|
||||
{"NOLOGINS_FILE", NULL},
|
||||
{"OBSCURE_CHECKS_ENAB", NULL},
|
||||
{"PASS_ALWAYS_WARN", NULL},
|
||||
{"PASS_CHANGE_TRIES", NULL},
|
||||
{"PASS_MAX_LEN", NULL},
|
||||
{"PASS_MIN_LEN", NULL},
|
||||
{"PORTTIME_CHECKS_ENAB", NULL},
|
||||
{"QUOTAS_ENAB", NULL},
|
||||
{"SU_WHEEL_ONLY", NULL},
|
||||
{"ULIMIT", NULL},
|
||||
#endif
|
||||
#ifdef USE_SYSLOG
|
||||
{"SYSLOG_SG_ENAB", NULL},
|
||||
{"SYSLOG_SU_ENAB", NULL},
|
||||
#endif
|
||||
#ifdef WITH_TCB
|
||||
{"TCB_AUTH_GROUP", NULL},
|
||||
{"TCB_SYMLINKS", NULL},
|
||||
{"USE_TCB", NULL},
|
||||
#endif
|
||||
{"FORCE_SHADOW", NULL},
|
||||
{"GRANT_AUX_GROUP_SUBIDS", NULL},
|
||||
{"PREVENT_NO_AUTH", NULL},
|
||||
{NULL, NULL}
|
||||
};
|
||||
|
||||
#define NUMKNOWNDEFS (sizeof(knowndef_table)/sizeof(knowndef_table[0]))
|
||||
static struct itemdef knowndef_table[] = {
|
||||
#ifdef USE_PAM
|
||||
PAMDEFS
|
||||
#endif
|
||||
FOREIGNDEFS
|
||||
{NULL, NULL}
|
||||
};
|
||||
|
||||
#ifdef USE_ECONF
|
||||
#ifdef VENDORDIR
|
||||
static const char* vendordir = VENDORDIR;
|
||||
#else
|
||||
static const char* vendordir = NULL;
|
||||
#endif
|
||||
static const char* sysconfdir = "/etc";
|
||||
#else
|
||||
#ifndef LOGINDEFS
|
||||
#define LOGINDEFS "/etc/login.defs"
|
||||
#endif
|
||||
|
||||
static const char* def_fname = LOGINDEFS; /* login config defs file */
|
||||
#endif
|
||||
static bool def_loaded = false; /* are defs already loaded? */
|
||||
static char def_fname[] = LOGINDEFS; /* login config defs file */
|
||||
static int def_loaded = 0; /* are defs already loaded? */
|
||||
|
||||
/* local function prototypes */
|
||||
static /*@observer@*/ /*@null@*/struct itemdef *def_find (const char *);
|
||||
static struct itemdef *def_find (const char *);
|
||||
static void def_load (void);
|
||||
|
||||
|
||||
@@ -206,16 +145,14 @@ static void def_load (void);
|
||||
* defined. First time invoked, will load definitions from the file.
|
||||
*/
|
||||
|
||||
/*@observer@*/ /*@null@*/const char *getdef_str (const char *item)
|
||||
char *getdef_str (const char *item)
|
||||
{
|
||||
struct itemdef *d;
|
||||
|
||||
if (!def_loaded) {
|
||||
if (!def_loaded)
|
||||
def_load ();
|
||||
}
|
||||
|
||||
d = def_find (item);
|
||||
return ((NULL == d)? (const char *) NULL : d->value);
|
||||
return ((d = def_find (item)) == NULL ? (char *) NULL : d->value);
|
||||
}
|
||||
|
||||
|
||||
@@ -225,18 +162,15 @@ static void def_load (void);
|
||||
* Return TRUE if specified item is defined as "yes", else FALSE.
|
||||
*/
|
||||
|
||||
bool getdef_bool (const char *item)
|
||||
int getdef_bool (const char *item)
|
||||
{
|
||||
struct itemdef *d;
|
||||
|
||||
if (!def_loaded) {
|
||||
if (!def_loaded)
|
||||
def_load ();
|
||||
}
|
||||
|
||||
d = def_find (item);
|
||||
if ((NULL == d) || (NULL == d->value)) {
|
||||
return false;
|
||||
}
|
||||
if ((d = def_find (item)) == NULL || d->value == NULL)
|
||||
return 0;
|
||||
|
||||
return (strcasecmp (d->value, "yes") == 0);
|
||||
}
|
||||
@@ -253,27 +187,14 @@ bool getdef_bool (const char *item)
|
||||
int getdef_num (const char *item, int dflt)
|
||||
{
|
||||
struct itemdef *d;
|
||||
long val;
|
||||
|
||||
if (!def_loaded) {
|
||||
if (!def_loaded)
|
||||
def_load ();
|
||||
}
|
||||
|
||||
d = def_find (item);
|
||||
if ((NULL == d) || (NULL == d->value)) {
|
||||
if ((d = def_find (item)) == NULL || d->value == NULL)
|
||||
return dflt;
|
||||
}
|
||||
|
||||
if ( (getlong (d->value, &val) == 0)
|
||||
|| (val > INT_MAX)
|
||||
|| (val < INT_MIN)) {
|
||||
fprintf (shadow_logfd,
|
||||
_("configuration error - cannot parse %s value: '%s'"),
|
||||
item, d->value);
|
||||
return dflt;
|
||||
}
|
||||
|
||||
return (int) val;
|
||||
return (int) strtol (d->value, (char **) NULL, 0);
|
||||
}
|
||||
|
||||
|
||||
@@ -288,27 +209,14 @@ int getdef_num (const char *item, int dflt)
|
||||
unsigned int getdef_unum (const char *item, unsigned int dflt)
|
||||
{
|
||||
struct itemdef *d;
|
||||
long val;
|
||||
|
||||
if (!def_loaded) {
|
||||
if (!def_loaded)
|
||||
def_load ();
|
||||
}
|
||||
|
||||
d = def_find (item);
|
||||
if ((NULL == d) || (NULL == d->value)) {
|
||||
if ((d = def_find (item)) == NULL || d->value == NULL)
|
||||
return dflt;
|
||||
}
|
||||
|
||||
if ( (getlong (d->value, &val) == 0)
|
||||
|| (val < 0)
|
||||
|| (val > INT_MAX)) {
|
||||
fprintf (shadow_logfd,
|
||||
_("configuration error - cannot parse %s value: '%s'"),
|
||||
item, d->value);
|
||||
return dflt;
|
||||
}
|
||||
|
||||
return (unsigned int) val;
|
||||
return (unsigned int) strtoul (d->value, (char **) NULL, 0);
|
||||
}
|
||||
|
||||
|
||||
@@ -323,59 +231,16 @@ unsigned int getdef_unum (const char *item, unsigned int dflt)
|
||||
long getdef_long (const char *item, long dflt)
|
||||
{
|
||||
struct itemdef *d;
|
||||
long val;
|
||||
|
||||
if (!def_loaded) {
|
||||
if (!def_loaded)
|
||||
def_load ();
|
||||
}
|
||||
|
||||
d = def_find (item);
|
||||
if ((NULL == d) || (NULL == d->value)) {
|
||||
if ((d = def_find (item)) == NULL || d->value == NULL)
|
||||
return dflt;
|
||||
}
|
||||
|
||||
if (getlong (d->value, &val) == 0) {
|
||||
fprintf (shadow_logfd,
|
||||
_("configuration error - cannot parse %s value: '%s'"),
|
||||
item, d->value);
|
||||
return dflt;
|
||||
}
|
||||
|
||||
return val;
|
||||
return strtol (d->value, (char **) NULL, 0);
|
||||
}
|
||||
|
||||
/*
|
||||
* getdef_ulong - get unsigned long numerical value from table of definitions
|
||||
*
|
||||
* Returns numeric value of specified item, else the "dflt" value if
|
||||
* the item is not defined. Octal (leading "0") and hex (leading "0x")
|
||||
* values are handled.
|
||||
*/
|
||||
|
||||
unsigned long getdef_ulong (const char *item, unsigned long dflt)
|
||||
{
|
||||
struct itemdef *d;
|
||||
unsigned long val;
|
||||
|
||||
if (!def_loaded) {
|
||||
def_load ();
|
||||
}
|
||||
|
||||
d = def_find (item);
|
||||
if ((NULL == d) || (NULL == d->value)) {
|
||||
return dflt;
|
||||
}
|
||||
|
||||
if (getulong (d->value, &val) == 0) {
|
||||
/* FIXME: we should have a getulong */
|
||||
fprintf (shadow_logfd,
|
||||
_("configuration error - cannot parse %s value: '%s'"),
|
||||
item, d->value);
|
||||
return dflt;
|
||||
}
|
||||
|
||||
return val;
|
||||
}
|
||||
|
||||
/*
|
||||
* putdef_str - override the value read from /etc/login.defs
|
||||
@@ -387,33 +252,28 @@ int putdef_str (const char *name, const char *value)
|
||||
struct itemdef *d;
|
||||
char *cp;
|
||||
|
||||
if (!def_loaded) {
|
||||
if (!def_loaded)
|
||||
def_load ();
|
||||
}
|
||||
|
||||
/*
|
||||
* Locate the slot to save the value. If this parameter
|
||||
* is unknown then "def_find" will print an err message.
|
||||
*/
|
||||
d = def_find (name);
|
||||
if (NULL == d) {
|
||||
if ((d = def_find (name)) == NULL)
|
||||
return -1;
|
||||
}
|
||||
|
||||
/*
|
||||
* Save off the value.
|
||||
*/
|
||||
cp = strdup (value);
|
||||
if (NULL == cp) {
|
||||
(void) fputs (_("Could not allocate space for config info.\n"),
|
||||
shadow_logfd);
|
||||
if ((cp = strdup (value)) == NULL) {
|
||||
fputs (_("Could not allocate space for config info.\n"),
|
||||
stderr);
|
||||
SYSLOG ((LOG_ERR, "could not allocate space for config info"));
|
||||
return -1;
|
||||
}
|
||||
|
||||
if (NULL != d->value) {
|
||||
if (d->value)
|
||||
free (d->value);
|
||||
}
|
||||
|
||||
d->value = cp;
|
||||
return 0;
|
||||
@@ -427,69 +287,33 @@ int putdef_str (const char *name, const char *value)
|
||||
* specified configuration option.
|
||||
*/
|
||||
|
||||
static /*@observer@*/ /*@null@*/struct itemdef *def_find (const char *name)
|
||||
static struct itemdef *def_find (const char *name)
|
||||
{
|
||||
int n;
|
||||
struct itemdef *ptr;
|
||||
|
||||
|
||||
/*
|
||||
* Search into the table.
|
||||
*/
|
||||
|
||||
for (ptr = def_table; NULL != ptr->name; ptr++) {
|
||||
if (strcmp (ptr->name, name) == 0) {
|
||||
for (ptr = def_table; ptr->name; ptr++) {
|
||||
if (!(n = strcmp (ptr->name, name)))
|
||||
return ptr;
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* Item was never found.
|
||||
*/
|
||||
|
||||
for (ptr = knowndef_table; NULL != ptr->name; ptr++) {
|
||||
if (strcmp (ptr->name, name) == 0) {
|
||||
goto out;
|
||||
}
|
||||
}
|
||||
fprintf (shadow_logfd,
|
||||
_("configuration error - unknown item '%s' (notify administrator)\n"),
|
||||
name);
|
||||
fprintf (stderr,
|
||||
_
|
||||
("configuration error - unknown item '%s' (notify administrator)\n"),
|
||||
name);
|
||||
SYSLOG ((LOG_CRIT, "unknown configuration item `%s'", name));
|
||||
|
||||
out:
|
||||
return (struct itemdef *) NULL;
|
||||
}
|
||||
|
||||
/*
|
||||
* setdef_config_file - set the default configuration file path
|
||||
*
|
||||
* must be called prior to any def* calls.
|
||||
*/
|
||||
|
||||
void setdef_config_file (const char* file)
|
||||
{
|
||||
#ifdef USE_ECONF
|
||||
size_t len;
|
||||
char* cp;
|
||||
|
||||
len = strlen(file) + strlen(sysconfdir) + 2;
|
||||
cp = malloc(len);
|
||||
if (cp == NULL)
|
||||
exit (13);
|
||||
snprintf(cp, len, "%s/%s", file, sysconfdir);
|
||||
sysconfdir = cp;
|
||||
#ifdef VENDORDIR
|
||||
len = strlen(file) + strlen(vendordir) + 2;
|
||||
cp = malloc(len);
|
||||
if (cp == NULL)
|
||||
exit (13);
|
||||
snprintf(cp, len, "%s/%s", file, vendordir);
|
||||
vendordir = cp;
|
||||
#endif
|
||||
#else
|
||||
def_fname = file;
|
||||
#endif
|
||||
}
|
||||
|
||||
/*
|
||||
* def_load - load configuration table
|
||||
*
|
||||
@@ -498,88 +322,38 @@ void setdef_config_file (const char* file)
|
||||
|
||||
static void def_load (void)
|
||||
{
|
||||
#ifdef USE_ECONF
|
||||
econf_file *defs_file = NULL;
|
||||
econf_err error;
|
||||
char **keys;
|
||||
size_t key_number;
|
||||
#else
|
||||
int i;
|
||||
FILE *fp;
|
||||
char buf[1024], *name, *value, *s;
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Open the configuration definitions file.
|
||||
*/
|
||||
if ((fp = fopen (def_fname, "r")) == NULL) {
|
||||
SYSLOG ((LOG_CRIT, "cannot open login definitions %s [%m]",
|
||||
def_fname));
|
||||
exit (1);
|
||||
}
|
||||
|
||||
/*
|
||||
* Set the initialized flag.
|
||||
* (do it early to prevent recursion in putdef_str())
|
||||
*/
|
||||
def_loaded = true;
|
||||
|
||||
#ifdef USE_ECONF
|
||||
|
||||
error = econf_readDirs (&defs_file, vendordir, sysconfdir, "login", "defs", " \t", "#");
|
||||
if (error) {
|
||||
if (error == ECONF_NOFILE)
|
||||
return;
|
||||
|
||||
SYSLOG ((LOG_CRIT, "cannot open login definitions [%s]",
|
||||
econf_errString(error)));
|
||||
exit (EXIT_FAILURE);
|
||||
}
|
||||
|
||||
if ((error = econf_getKeys(defs_file, NULL, &key_number, &keys))) {
|
||||
SYSLOG ((LOG_CRIT, "cannot read login definitions [%s]",
|
||||
econf_errString(error)));
|
||||
exit (EXIT_FAILURE);
|
||||
}
|
||||
|
||||
for (size_t i = 0; i < key_number; i++) {
|
||||
char *value;
|
||||
|
||||
econf_getStringValue(defs_file, NULL, keys[i], &value);
|
||||
|
||||
/*
|
||||
* Store the value in def_table.
|
||||
*
|
||||
* Ignore failures to load the login.defs file.
|
||||
* The error was already reported to the user and to
|
||||
* syslog. The tools will just use their default values.
|
||||
*/
|
||||
(void)putdef_str (keys[i], value);
|
||||
}
|
||||
|
||||
econf_free (keys);
|
||||
econf_free (defs_file);
|
||||
#else
|
||||
/*
|
||||
* Open the configuration definitions file.
|
||||
*/
|
||||
fp = fopen (def_fname, "r");
|
||||
if (NULL == fp) {
|
||||
if (errno == ENOENT)
|
||||
return;
|
||||
|
||||
int err = errno;
|
||||
SYSLOG ((LOG_CRIT, "cannot open login definitions %s [%s]",
|
||||
def_fname, strerror (err)));
|
||||
exit (EXIT_FAILURE);
|
||||
}
|
||||
++def_loaded;
|
||||
|
||||
/*
|
||||
* Go through all of the lines in the file.
|
||||
*/
|
||||
while (fgets (buf, (int) sizeof (buf), fp) != NULL) {
|
||||
while (fgets (buf, sizeof (buf), fp) != NULL) {
|
||||
|
||||
/*
|
||||
* Trim trailing whitespace.
|
||||
*/
|
||||
for (i = (int) strlen (buf) - 1; i >= 0; --i) {
|
||||
if (!isspace (buf[i])) {
|
||||
for (i = strlen (buf) - 1; i >= 0; --i) {
|
||||
if (!isspace (buf[i]))
|
||||
break;
|
||||
}
|
||||
}
|
||||
i++;
|
||||
buf[i] = '\0';
|
||||
buf[++i] = '\0';
|
||||
|
||||
/*
|
||||
* Break the line into two fields.
|
||||
@@ -598,23 +372,17 @@ static void def_load (void)
|
||||
|
||||
/*
|
||||
* Store the value in def_table.
|
||||
*
|
||||
* Ignore failures to load the login.defs file.
|
||||
* The error was already reported to the user and to
|
||||
* syslog. The tools will just use their default values.
|
||||
*/
|
||||
(void)putdef_str (name, value);
|
||||
putdef_str (name, value);
|
||||
}
|
||||
|
||||
if (ferror (fp) != 0) {
|
||||
int err = errno;
|
||||
SYSLOG ((LOG_CRIT, "cannot read login definitions %s [%s]",
|
||||
def_fname, strerror (err)));
|
||||
exit (EXIT_FAILURE);
|
||||
if (ferror (fp)) {
|
||||
SYSLOG ((LOG_CRIT, "cannot read login definitions %s [%m]",
|
||||
def_fname));
|
||||
exit (1);
|
||||
}
|
||||
|
||||
(void) fclose (fp);
|
||||
#endif
|
||||
}
|
||||
|
||||
|
||||
@@ -628,22 +396,18 @@ int main (int argc, char **argv)
|
||||
def_load ();
|
||||
|
||||
for (i = 0; i < NUMDEFS; ++i) {
|
||||
d = def_find (def_table[i].name);
|
||||
if (NULL == d) {
|
||||
if ((d = def_find (def_table[i].name)) == NULL)
|
||||
printf ("error - lookup '%s' failed\n",
|
||||
def_table[i].name);
|
||||
} else {
|
||||
def_table[i].name);
|
||||
else
|
||||
printf ("%4d %-24s %s\n", i + 1, d->name, d->value);
|
||||
}
|
||||
}
|
||||
for (i = 1; i < argc; i++) {
|
||||
cp = getdef_str (argv[1]);
|
||||
if (NULL != cp) {
|
||||
if ((cp = getdef_str (argv[1])) != NULL)
|
||||
printf ("%s `%s'\n", argv[1], cp);
|
||||
} else {
|
||||
else
|
||||
printf ("%s not found\n", argv[1]);
|
||||
}
|
||||
}
|
||||
exit (EXIT_SUCCESS);
|
||||
exit (0);
|
||||
}
|
||||
#endif
|
||||
|
||||
@@ -2,7 +2,6 @@
|
||||
* Copyright (c) 1991 - 1994, Julianne Frances Haugh
|
||||
* Copyright (c) 1996 - 2000, Marek Michałkiewicz
|
||||
* Copyright (c) 2002 - 2006, Tomasz Kłoczko
|
||||
* Copyright (c) 2008 , Nicolas François
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
@@ -33,14 +32,12 @@
|
||||
#define _GETDEF_H
|
||||
|
||||
/* getdef.c */
|
||||
extern bool getdef_bool (const char *);
|
||||
extern int getdef_bool (const char *);
|
||||
extern long getdef_long (const char *, long);
|
||||
extern int getdef_num (const char *, int);
|
||||
extern unsigned long getdef_ulong (const char *, unsigned long);
|
||||
extern unsigned int getdef_unum (const char *, unsigned int);
|
||||
extern /*@observer@*/ /*@null@*/const char *getdef_str (const char *);
|
||||
extern char *getdef_str (const char *);
|
||||
extern int putdef_str (const char *, const char *);
|
||||
extern void setdef_config_file (const char* file);
|
||||
|
||||
/* default UMASK value if not specified in /etc/login.defs */
|
||||
#define GETDEF_DEFAULT_UMASK 022
|
||||
|
||||
@@ -1,62 +0,0 @@
|
||||
/*
|
||||
* Copyright (c) 2007 - 2009, Nicolas François
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. The name of the copyright holders or contributors may not be used to
|
||||
* endorse or promote products derived from this software without
|
||||
* specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
|
||||
* PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
* HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include <config.h>
|
||||
|
||||
#ident "$Id: getlong.c 2763 2009-04-23 09:57:03Z nekral-guest $"
|
||||
|
||||
#include <stdlib.h>
|
||||
#include <errno.h>
|
||||
#include "prototypes.h"
|
||||
|
||||
/*
|
||||
* getulong - extract an unsigned long integer provided by the numstr string in *result
|
||||
*
|
||||
* It supports decimal, hexadecimal or octal representations.
|
||||
*
|
||||
* Returns 0 on failure, 1 on success.
|
||||
*/
|
||||
int getulong (const char *numstr, /*@out@*/unsigned long int *result)
|
||||
{
|
||||
unsigned long int val;
|
||||
char *endptr;
|
||||
|
||||
errno = 0;
|
||||
val = strtoul (numstr, &endptr, 0);
|
||||
if ( ('\0' == *numstr)
|
||||
|| ('\0' != *endptr)
|
||||
|| (ERANGE == errno)
|
||||
) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
*result = val;
|
||||
return 1;
|
||||
}
|
||||
|
||||
166
lib/groupio.c
166
lib/groupio.c
@@ -3,7 +3,7 @@
|
||||
* Copyright (c) 1996 - 2000, Marek Michałkiewicz
|
||||
* Copyright (c) 2001 , Michał Moskal
|
||||
* Copyright (c) 2005 , Tomasz Kłoczko
|
||||
* Copyright (c) 2007 - 2010, Nicolas François
|
||||
* Copyright (c) 2007 - 2008, Nicolas François
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
@@ -35,7 +35,6 @@
|
||||
|
||||
#ident "$Id$"
|
||||
|
||||
#include <assert.h>
|
||||
#include <stdio.h>
|
||||
|
||||
#include "prototypes.h"
|
||||
@@ -44,24 +43,29 @@
|
||||
#include "getdef.h"
|
||||
#include "groupio.h"
|
||||
|
||||
static /*@null@*/struct commonio_entry *merge_group_entries (
|
||||
/*@null@*/ /*@returned@*/struct commonio_entry *gr1,
|
||||
/*@null@*/struct commonio_entry *gr2);
|
||||
static struct commonio_entry *merge_group_entries (struct commonio_entry *gr1,
|
||||
struct commonio_entry *gr2);
|
||||
static int split_groups (unsigned int max_members);
|
||||
static int group_open_hook (void);
|
||||
|
||||
static /*@null@*/ /*@only@*/void *group_dup (const void *ent)
|
||||
static void *group_dup (const void *ent)
|
||||
{
|
||||
const struct group *gr = ent;
|
||||
|
||||
return __gr_dup (gr);
|
||||
}
|
||||
|
||||
static void group_free (/*@out@*/ /*@only@*/void *ent)
|
||||
static void group_free (void *ent)
|
||||
{
|
||||
struct group *gr = ent;
|
||||
|
||||
gr_free (gr);
|
||||
free (gr->gr_name);
|
||||
free (gr->gr_passwd);
|
||||
while (*(gr->gr_mem)) {
|
||||
free (*(gr->gr_mem));
|
||||
gr->gr_mem++;
|
||||
}
|
||||
free (gr);
|
||||
}
|
||||
|
||||
static const char *group_getname (const void *ent)
|
||||
@@ -80,23 +84,6 @@ static int group_put (const void *ent, FILE * file)
|
||||
{
|
||||
const struct group *gr = ent;
|
||||
|
||||
if ( (NULL == gr)
|
||||
|| (valid_field (gr->gr_name, ":\n") == -1)
|
||||
|| (valid_field (gr->gr_passwd, ":\n") == -1)
|
||||
|| (gr->gr_gid == (gid_t)-1)) {
|
||||
return -1;
|
||||
}
|
||||
|
||||
/* FIXME: fail also if gr->gr_mem == NULL ?*/
|
||||
if (NULL != gr->gr_mem) {
|
||||
size_t i;
|
||||
for (i = 0; NULL != gr->gr_mem[i]; i++) {
|
||||
if (valid_field (gr->gr_mem[i], ",:\n") == -1) {
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return (putgrent (gr, file) == -1) ? -1 : 0;
|
||||
}
|
||||
|
||||
@@ -104,9 +91,8 @@ static int group_close_hook (void)
|
||||
{
|
||||
unsigned int max_members = getdef_unum("MAX_MEMBERS_PER_GROUP", 0);
|
||||
|
||||
if (0 == max_members) {
|
||||
if (0 == max_members)
|
||||
return 1;
|
||||
}
|
||||
|
||||
return split_groups (max_members);
|
||||
}
|
||||
@@ -123,36 +109,27 @@ static struct commonio_ops group_ops = {
|
||||
group_close_hook
|
||||
};
|
||||
|
||||
static /*@owned@*/struct commonio_db group_db = {
|
||||
static struct commonio_db group_db = {
|
||||
GROUP_FILE, /* filename */
|
||||
&group_ops, /* ops */
|
||||
NULL, /* fp */
|
||||
#ifdef WITH_SELINUX
|
||||
NULL, /* scontext */
|
||||
#endif
|
||||
0644, /* st_mode */
|
||||
0, /* st_uid */
|
||||
0, /* st_gid */
|
||||
NULL, /* head */
|
||||
NULL, /* tail */
|
||||
NULL, /* cursor */
|
||||
false, /* changed */
|
||||
false, /* isopen */
|
||||
false, /* locked */
|
||||
false, /* readonly */
|
||||
false /* setname */
|
||||
0, /* changed */
|
||||
0, /* isopen */
|
||||
0, /* locked */
|
||||
0 /* readonly */
|
||||
};
|
||||
|
||||
int gr_setdbname (const char *filename)
|
||||
int gr_name (const char *filename)
|
||||
{
|
||||
return commonio_setname (&group_db, filename);
|
||||
}
|
||||
|
||||
/*@observer@*/const char *gr_dbname (void)
|
||||
{
|
||||
return group_db.filename;
|
||||
}
|
||||
|
||||
int gr_lock (void)
|
||||
{
|
||||
return commonio_lock (&group_db);
|
||||
@@ -163,12 +140,12 @@ int gr_open (int mode)
|
||||
return commonio_open (&group_db, mode);
|
||||
}
|
||||
|
||||
/*@observer@*/ /*@null@*/const struct group *gr_locate (const char *name)
|
||||
const struct group *gr_locate (const char *name)
|
||||
{
|
||||
return commonio_locate (&group_db, name);
|
||||
}
|
||||
|
||||
/*@observer@*/ /*@null@*/const struct group *gr_locate_gid (gid_t gid)
|
||||
const struct group *gr_locate_gid (gid_t gid)
|
||||
{
|
||||
const struct group *grp;
|
||||
|
||||
@@ -195,7 +172,7 @@ int gr_rewind (void)
|
||||
return commonio_rewind (&group_db);
|
||||
}
|
||||
|
||||
/*@observer@*/ /*@null@*/const struct group *gr_next (void)
|
||||
const struct group *gr_next (void)
|
||||
{
|
||||
return commonio_next (&group_db);
|
||||
}
|
||||
@@ -212,15 +189,15 @@ int gr_unlock (void)
|
||||
|
||||
void __gr_set_changed (void)
|
||||
{
|
||||
group_db.changed = true;
|
||||
group_db.changed = 1;
|
||||
}
|
||||
|
||||
/*@dependent@*/ /*@null@*/struct commonio_entry *__gr_get_head (void)
|
||||
struct commonio_entry *__gr_get_head (void)
|
||||
{
|
||||
return group_db.head;
|
||||
}
|
||||
|
||||
/*@observer@*/const struct commonio_db *__gr_get_db (void)
|
||||
struct commonio_db *__gr_get_db (void)
|
||||
{
|
||||
return &group_db;
|
||||
}
|
||||
@@ -234,23 +211,20 @@ static int gr_cmp (const void *p1, const void *p2)
|
||||
{
|
||||
gid_t u1, u2;
|
||||
|
||||
if ((*(struct commonio_entry **) p1)->eptr == NULL) {
|
||||
if ((*(struct commonio_entry **) p1)->eptr == NULL)
|
||||
return 1;
|
||||
}
|
||||
if ((*(struct commonio_entry **) p2)->eptr == NULL) {
|
||||
if ((*(struct commonio_entry **) p2)->eptr == NULL)
|
||||
return -1;
|
||||
}
|
||||
|
||||
u1 = ((struct group *) (*(struct commonio_entry **) p1)->eptr)->gr_gid;
|
||||
u2 = ((struct group *) (*(struct commonio_entry **) p2)->eptr)->gr_gid;
|
||||
|
||||
if (u1 < u2) {
|
||||
if (u1 < u2)
|
||||
return -1;
|
||||
} else if (u1 > u2) {
|
||||
else if (u1 > u2)
|
||||
return 1;
|
||||
} else {
|
||||
else
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
|
||||
/* Sort entries by GID */
|
||||
@@ -264,12 +238,11 @@ static int group_open_hook (void)
|
||||
unsigned int max_members = getdef_unum("MAX_MEMBERS_PER_GROUP", 0);
|
||||
struct commonio_entry *gr1, *gr2;
|
||||
|
||||
if (0 == max_members) {
|
||||
if (0 == max_members)
|
||||
return 1;
|
||||
}
|
||||
|
||||
for (gr1 = group_db.head; NULL != gr1; gr1 = gr1->next) {
|
||||
for (gr2 = gr1->next; NULL != gr2; gr2 = gr2->next) {
|
||||
for (gr1 = group_db.head; gr1; gr1 = gr1->next) {
|
||||
for (gr2 = gr1->next; gr2; gr2 = gr2->next) {
|
||||
struct group *g1 = (struct group *)gr1->eptr;
|
||||
struct group *g2 = (struct group *)gr2->eptr;
|
||||
if (NULL != g1 &&
|
||||
@@ -284,15 +257,11 @@ static int group_open_hook (void)
|
||||
if (NULL == gr1)
|
||||
return 0;
|
||||
/* Unlink gr2 */
|
||||
if (NULL != gr2->next) {
|
||||
if (NULL != gr2->next)
|
||||
gr2->next->prev = gr2->prev;
|
||||
}
|
||||
/* gr2 does not start with head */
|
||||
assert (NULL != gr2->prev);
|
||||
gr2->prev->next = gr2->next;
|
||||
}
|
||||
}
|
||||
assert (NULL != gr1);
|
||||
}
|
||||
|
||||
return 1;
|
||||
@@ -310,16 +279,15 @@ static int group_open_hook (void)
|
||||
* the modified first entry on success, or NULL on failure (with errno
|
||||
* set).
|
||||
*/
|
||||
static /*@null@*/struct commonio_entry *merge_group_entries (
|
||||
/*@null@*/ /*@returned@*/struct commonio_entry *gr1,
|
||||
/*@null@*/struct commonio_entry *gr2)
|
||||
static struct commonio_entry *merge_group_entries (struct commonio_entry *gr1,
|
||||
struct commonio_entry *gr2)
|
||||
{
|
||||
struct group *gptr1;
|
||||
struct group *gptr2;
|
||||
char **new_members;
|
||||
size_t members = 0;
|
||||
int members = 0;
|
||||
char *new_line;
|
||||
size_t new_line_len, i;
|
||||
int new_line_len, i;
|
||||
if (NULL == gr2 || NULL == gr1) {
|
||||
errno = EINVAL;
|
||||
return NULL;
|
||||
@@ -334,12 +302,13 @@ static /*@null@*/struct commonio_entry *merge_group_entries (
|
||||
|
||||
/* Concatenate the 2 lines */
|
||||
new_line_len = strlen (gr1->line) + strlen (gr2->line) +1;
|
||||
new_line = (char *)malloc (new_line_len + 1);
|
||||
new_line = (char *)malloc ((new_line_len + 1) * sizeof(char*));
|
||||
if (NULL == new_line) {
|
||||
errno = ENOMEM;
|
||||
return NULL;
|
||||
}
|
||||
snprintf(new_line, new_line_len + 1, "%s\n%s", gr1->line, gr2->line);
|
||||
snprintf(new_line, new_line_len, "%s\n%s", gr1->line, gr2->line);
|
||||
new_line[new_line_len] = '\0';
|
||||
|
||||
/* Concatenate the 2 list of members */
|
||||
for (i=0; NULL != gptr1->gr_mem[i]; i++);
|
||||
@@ -347,38 +316,30 @@ static /*@null@*/struct commonio_entry *merge_group_entries (
|
||||
for (i=0; NULL != gptr2->gr_mem[i]; i++) {
|
||||
char **pmember = gptr1->gr_mem;
|
||||
while (NULL != *pmember) {
|
||||
if (0 == strcmp(*pmember, gptr2->gr_mem[i])) {
|
||||
if (0 == strcmp(*pmember, gptr2->gr_mem[i]))
|
||||
break;
|
||||
}
|
||||
pmember++;
|
||||
}
|
||||
if (NULL == *pmember) {
|
||||
if (NULL == *pmember)
|
||||
members++;
|
||||
}
|
||||
}
|
||||
new_members = (char **)calloc ( (members+1), sizeof(char*) );
|
||||
new_members = (char **)malloc ( (members+1) * sizeof(char*) );
|
||||
if (NULL == new_members) {
|
||||
free (new_line);
|
||||
errno = ENOMEM;
|
||||
return NULL;
|
||||
}
|
||||
for (i=0; NULL != gptr1->gr_mem[i]; i++) {
|
||||
for (i=0; NULL != gptr1->gr_mem[i]; i++)
|
||||
new_members[i] = gptr1->gr_mem[i];
|
||||
}
|
||||
/* NULL termination enforced by above calloc */
|
||||
|
||||
members = i;
|
||||
for (i=0; NULL != gptr2->gr_mem[i]; i++) {
|
||||
char **pmember = new_members;
|
||||
while (NULL != *pmember) {
|
||||
if (0 == strcmp(*pmember, gptr2->gr_mem[i])) {
|
||||
if (0 == strcmp(*pmember, gptr2->gr_mem[i]))
|
||||
break;
|
||||
}
|
||||
pmember++;
|
||||
}
|
||||
if (NULL == *pmember) {
|
||||
new_members[members] = gptr2->gr_mem[i];
|
||||
members++;
|
||||
new_members[members++] = gptr2->gr_mem[i];
|
||||
new_members[members] = NULL;
|
||||
}
|
||||
}
|
||||
@@ -399,24 +360,20 @@ static int split_groups (unsigned int max_members)
|
||||
{
|
||||
struct commonio_entry *gr;
|
||||
|
||||
for (gr = group_db.head; NULL != gr; gr = gr->next) {
|
||||
for (gr = group_db.head; gr; gr = gr->next) {
|
||||
struct group *gptr = (struct group *)gr->eptr;
|
||||
struct commonio_entry *new;
|
||||
struct group *new_gptr;
|
||||
unsigned int members = 0;
|
||||
unsigned int i;
|
||||
|
||||
/* Check if this group must be split */
|
||||
if (!gr->changed) {
|
||||
if (!gr->changed)
|
||||
continue;
|
||||
}
|
||||
if (NULL == gptr) {
|
||||
if (NULL == gptr)
|
||||
continue;
|
||||
}
|
||||
for (members = 0; NULL != gptr->gr_mem[members]; members++);
|
||||
if (members <= max_members) {
|
||||
if (members <= max_members)
|
||||
continue;
|
||||
}
|
||||
|
||||
new = (struct commonio_entry *) malloc (sizeof *new);
|
||||
if (NULL == new) {
|
||||
@@ -425,32 +382,17 @@ static int split_groups (unsigned int max_members)
|
||||
}
|
||||
new->eptr = group_dup(gr->eptr);
|
||||
if (NULL == new->eptr) {
|
||||
free (new);
|
||||
errno = ENOMEM;
|
||||
return 0;
|
||||
}
|
||||
new_gptr = (struct group *)new->eptr;
|
||||
new->line = NULL;
|
||||
new->changed = true;
|
||||
new->changed = 1;
|
||||
|
||||
/* Enforce the maximum number of members on gptr */
|
||||
for (i = max_members; NULL != gptr->gr_mem[i]; i++) {
|
||||
free (gptr->gr_mem[i]);
|
||||
gptr->gr_mem[i] = NULL;
|
||||
}
|
||||
/* Shift all the members */
|
||||
gptr->gr_mem[max_members] = NULL;
|
||||
/* The number of members in new_gptr will be check later */
|
||||
for (i = 0; NULL != new_gptr->gr_mem[i + max_members]; i++) {
|
||||
if (NULL != new_gptr->gr_mem[i]) {
|
||||
free (new_gptr->gr_mem[i]);
|
||||
}
|
||||
new_gptr->gr_mem[i] = new_gptr->gr_mem[i + max_members];
|
||||
new_gptr->gr_mem[i + max_members] = NULL;
|
||||
}
|
||||
for (; NULL != new_gptr->gr_mem[i]; i++) {
|
||||
free (new_gptr->gr_mem[i]);
|
||||
new_gptr->gr_mem[i] = NULL;
|
||||
}
|
||||
new_gptr->gr_mem = &new_gptr->gr_mem[max_members];
|
||||
|
||||
/* insert the new entry in the list */
|
||||
new->prev = gr;
|
||||
|
||||
@@ -31,25 +31,17 @@
|
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
/* $Id$ */
|
||||
#ifndef _GROUPIO_H
|
||||
#define _GROUPIO_H
|
||||
|
||||
#include <sys/types.h>
|
||||
#include <grp.h>
|
||||
|
||||
extern int gr_close (void);
|
||||
extern /*@observer@*/ /*@null@*/const struct group *gr_locate (const char *name);
|
||||
extern /*@observer@*/ /*@null@*/const struct group *gr_locate_gid (gid_t gid);
|
||||
extern const struct group *gr_locate (const char *);
|
||||
extern const struct group *gr_locate_gid (gid_t gid);
|
||||
extern int gr_lock (void);
|
||||
extern int gr_setdbname (const char *filename);
|
||||
extern /*@observer@*/const char *gr_dbname (void);
|
||||
extern /*@observer@*/ /*@null@*/const struct group *gr_next (void);
|
||||
extern int gr_open (int mode);
|
||||
extern int gr_remove (const char *name);
|
||||
extern int gr_name (const char *);
|
||||
extern const struct group *gr_next (void);
|
||||
extern int gr_open (int);
|
||||
extern int gr_remove (const char *);
|
||||
extern int gr_rewind (void);
|
||||
extern int gr_unlock (void);
|
||||
extern int gr_update (const struct group *gr);
|
||||
extern int gr_update (const struct group *);
|
||||
extern int gr_sort (void);
|
||||
|
||||
#endif
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
* Copyright (c) 1996 - 2000, Marek Michałkiewicz
|
||||
* Copyright (c) 2001 , Michał Moskal
|
||||
* Copyright (c) 2005 , Tomasz Kłoczko
|
||||
* Copyright (c) 2007 - 2013, Nicolas François
|
||||
* Copyright (c) 2007 , Nicolas François
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
@@ -39,103 +39,29 @@
|
||||
#include "defines.h"
|
||||
#include "groupio.h"
|
||||
|
||||
/*@null@*/ /*@only@*/struct group *__gr_dup (const struct group *grent)
|
||||
struct group *__gr_dup (const struct group *grent)
|
||||
{
|
||||
struct group *gr;
|
||||
int i;
|
||||
|
||||
gr = (struct group *) malloc (sizeof *gr);
|
||||
if (NULL == gr) {
|
||||
if (!(gr = (struct group *) malloc (sizeof *gr)))
|
||||
return NULL;
|
||||
}
|
||||
/* The libc might define other fields. They won't be copied. */
|
||||
memset (gr, 0, sizeof *gr);
|
||||
gr->gr_gid = grent->gr_gid;
|
||||
/*@-mustfreeonly@*/
|
||||
gr->gr_name = strdup (grent->gr_name);
|
||||
/*@=mustfreeonly@*/
|
||||
if (NULL == gr->gr_name) {
|
||||
gr_free(gr);
|
||||
*gr = *grent;
|
||||
if (!(gr->gr_name = strdup (grent->gr_name)))
|
||||
return NULL;
|
||||
}
|
||||
/*@-mustfreeonly@*/
|
||||
gr->gr_passwd = strdup (grent->gr_passwd);
|
||||
/*@=mustfreeonly@*/
|
||||
if (NULL == gr->gr_passwd) {
|
||||
gr_free(gr);
|
||||
if (!(gr->gr_passwd = strdup (grent->gr_passwd)))
|
||||
return NULL;
|
||||
}
|
||||
|
||||
for (i = 0; grent->gr_mem[i]; i++);
|
||||
|
||||
/*@-mustfreeonly@*/
|
||||
gr->gr_mem = (char **) malloc ((i + 1) * sizeof (char *));
|
||||
/*@=mustfreeonly@*/
|
||||
if (NULL == gr->gr_mem) {
|
||||
gr_free(gr);
|
||||
if (!gr->gr_mem)
|
||||
return NULL;
|
||||
}
|
||||
for (i = 0; grent->gr_mem[i]; i++) {
|
||||
gr->gr_mem[i] = strdup (grent->gr_mem[i]);
|
||||
if (NULL == gr->gr_mem[i]) {
|
||||
gr_free(gr);
|
||||
if (!gr->gr_mem[i])
|
||||
return NULL;
|
||||
}
|
||||
}
|
||||
gr->gr_mem[i] = NULL;
|
||||
|
||||
return gr;
|
||||
}
|
||||
|
||||
void gr_free_members (struct group *grent)
|
||||
{
|
||||
if (NULL != grent->gr_mem) {
|
||||
size_t i;
|
||||
for (i = 0; NULL != grent->gr_mem[i]; i++) {
|
||||
free (grent->gr_mem[i]);
|
||||
}
|
||||
free (grent->gr_mem);
|
||||
grent->gr_mem = NULL;
|
||||
}
|
||||
}
|
||||
|
||||
void gr_free (/*@out@*/ /*@only@*/struct group *grent)
|
||||
{
|
||||
free (grent->gr_name);
|
||||
if (NULL != grent->gr_passwd) {
|
||||
memzero (grent->gr_passwd, strlen (grent->gr_passwd));
|
||||
free (grent->gr_passwd);
|
||||
}
|
||||
gr_free_members(grent);
|
||||
free (grent);
|
||||
}
|
||||
|
||||
bool gr_append_member(struct group *grp, char *member)
|
||||
{
|
||||
int i;
|
||||
|
||||
if (NULL == grp->gr_mem || grp->gr_mem[0] == NULL) {
|
||||
grp->gr_mem = (char **)malloc(2 * sizeof(char *));
|
||||
if (!grp->gr_mem) {
|
||||
return false;
|
||||
}
|
||||
grp->gr_mem[0] = strdup(member);
|
||||
if (!grp->gr_mem[0]) {
|
||||
return false;
|
||||
}
|
||||
grp->gr_mem[1] = NULL;
|
||||
return true;
|
||||
}
|
||||
|
||||
for (i = 0; grp->gr_mem[i]; i++) ;
|
||||
grp->gr_mem = realloc(grp->gr_mem, (i + 2) * sizeof(char *));
|
||||
if (NULL == grp->gr_mem) {
|
||||
return false;
|
||||
}
|
||||
grp->gr_mem[i] = strdup(member);
|
||||
if (NULL == grp->gr_mem[i]) {
|
||||
return false;
|
||||
}
|
||||
grp->gr_mem[i + 1] = NULL;
|
||||
return true;
|
||||
}
|
||||
|
||||
235
lib/gshadow.c
235
lib/gshadow.c
@@ -2,7 +2,7 @@
|
||||
* Copyright (c) 1990 - 1994, Julianne Frances Haugh
|
||||
* Copyright (c) 1996 - 1998, Marek Michałkiewicz
|
||||
* Copyright (c) 2005 , Tomasz Kłoczko
|
||||
* Copyright (c) 2008 - 2009, Nicolas François
|
||||
* Copyright (c) 2008 , Nicolas François
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
@@ -40,20 +40,21 @@
|
||||
#include <stdio.h>
|
||||
#include "prototypes.h"
|
||||
#include "defines.h"
|
||||
static /*@null@*/FILE *shadow;
|
||||
static /*@null@*//*@only@*/char **members = NULL;
|
||||
static FILE *shadow;
|
||||
static char sgrbuf[BUFSIZ * 4];
|
||||
static char **members = NULL;
|
||||
static size_t nmembers = 0;
|
||||
static /*@null@*//*@only@*/char **admins = NULL;
|
||||
static char **admins = NULL;
|
||||
static size_t nadmins = 0;
|
||||
static struct sgrp sgroup;
|
||||
|
||||
#define FIELDS 4
|
||||
|
||||
#ifdef USE_NIS
|
||||
static bool nis_used;
|
||||
static bool nis_ignore;
|
||||
static int nis_used;
|
||||
static int nis_ignore;
|
||||
static enum { native, start, middle, native2 } nis_state;
|
||||
static bool nis_bound;
|
||||
static int nis_bound;
|
||||
static char *nis_domain;
|
||||
static char *nis_key;
|
||||
static int nis_keylen;
|
||||
@@ -64,6 +65,19 @@ static int nis_vallen;
|
||||
#endif
|
||||
|
||||
#ifdef USE_NIS
|
||||
|
||||
/*
|
||||
* __setsgNIS - turn on or off NIS searches
|
||||
*/
|
||||
|
||||
void __setsgNIS (int flag)
|
||||
{
|
||||
nis_ignore = !flag;
|
||||
|
||||
if (nis_ignore)
|
||||
nis_used = 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* bind_nis - bind to NIS server
|
||||
*/
|
||||
@@ -73,35 +87,29 @@ static int bind_nis (void)
|
||||
if (yp_get_default_domain (&nis_domain))
|
||||
return -1;
|
||||
|
||||
nis_bound = true;
|
||||
nis_bound = 1;
|
||||
return 0;
|
||||
}
|
||||
#endif
|
||||
|
||||
static /*@null@*/char **build_list (char *s, char **list[], size_t * nlist)
|
||||
static char **build_list (char *s, char **list[], size_t * nlist)
|
||||
{
|
||||
char **ptr = *list;
|
||||
size_t nelem = *nlist, size;
|
||||
|
||||
while (s != NULL && *s != '\0') {
|
||||
size = (nelem + 1) * sizeof (ptr);
|
||||
ptr = realloc (*list, size);
|
||||
if (NULL != ptr) {
|
||||
ptr[nelem] = s;
|
||||
nelem++;
|
||||
if ((ptr = realloc (*list, size)) != NULL) {
|
||||
ptr[nelem++] = s;
|
||||
*list = ptr;
|
||||
*nlist = nelem;
|
||||
s = strchr (s, ',');
|
||||
if (NULL != s) {
|
||||
*s = '\0';
|
||||
s++;
|
||||
}
|
||||
if ((s = strchr (s, ',')))
|
||||
*s++ = '\0';
|
||||
}
|
||||
}
|
||||
size = (nelem + 1) * sizeof (ptr);
|
||||
ptr = realloc (*list, size);
|
||||
if (NULL != ptr) {
|
||||
ptr[nelem] = NULL;
|
||||
if ((ptr = realloc (*list, size)) != NULL) {
|
||||
ptr[nelem] = '\0';
|
||||
*list = ptr;
|
||||
}
|
||||
return ptr;
|
||||
@@ -112,60 +120,41 @@ void setsgent (void)
|
||||
#ifdef USE_NIS
|
||||
nis_state = native;
|
||||
#endif
|
||||
if (NULL != shadow) {
|
||||
if (shadow)
|
||||
rewind (shadow);
|
||||
} else {
|
||||
else
|
||||
shadow = fopen (SGROUP_FILE, "r");
|
||||
}
|
||||
}
|
||||
|
||||
void endsgent (void)
|
||||
{
|
||||
if (NULL != shadow) {
|
||||
if (shadow)
|
||||
(void) fclose (shadow);
|
||||
}
|
||||
|
||||
shadow = (FILE *) 0;
|
||||
}
|
||||
|
||||
/*@observer@*//*@null@*/struct sgrp *sgetsgent (const char *string)
|
||||
struct sgrp *sgetsgent (const char *string)
|
||||
{
|
||||
static char *sgrbuf = NULL;
|
||||
static size_t sgrbuflen = 0;
|
||||
|
||||
char *fields[FIELDS];
|
||||
char *cp;
|
||||
int i;
|
||||
size_t len = strlen (string) + 1;
|
||||
|
||||
if (len > sgrbuflen) {
|
||||
char *buf = (char *) realloc (sgrbuf, sizeof (char) * len);
|
||||
if (NULL == buf) {
|
||||
return NULL;
|
||||
}
|
||||
sgrbuf = buf;
|
||||
sgrbuflen = len;
|
||||
}
|
||||
strncpy (sgrbuf, string, (int) sizeof sgrbuf - 1);
|
||||
sgrbuf[sizeof sgrbuf - 1] = '\0';
|
||||
|
||||
strncpy (sgrbuf, string, len);
|
||||
sgrbuf[len-1] = '\0';
|
||||
|
||||
cp = strrchr (sgrbuf, '\n');
|
||||
if (NULL != cp) {
|
||||
if ((cp = strrchr (sgrbuf, '\n')))
|
||||
*cp = '\0';
|
||||
}
|
||||
|
||||
/*
|
||||
* There should be exactly 4 colon separated fields. Find
|
||||
* all 4 of them and save the starting addresses in fields[].
|
||||
*/
|
||||
|
||||
for (cp = sgrbuf, i = 0; (i < FIELDS) && (NULL != cp); i++) {
|
||||
for (cp = sgrbuf, i = 0; i < FIELDS && cp; i++) {
|
||||
fields[i] = cp;
|
||||
cp = strchr (cp, ':');
|
||||
if (NULL != cp) {
|
||||
if ((cp = strchr (cp, ':')))
|
||||
*cp++ = '\0';
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
@@ -173,26 +162,24 @@ void endsgent (void)
|
||||
* the line is invalid.
|
||||
*/
|
||||
|
||||
if ((NULL != cp) || (i != FIELDS)) {
|
||||
if (cp || i != FIELDS)
|
||||
#ifdef USE_NIS
|
||||
if (!IS_NISCHAR (fields[0][0])) {
|
||||
if (!IS_NISCHAR (fields[0][0]))
|
||||
return 0;
|
||||
} else {
|
||||
nis_used = true;
|
||||
}
|
||||
else
|
||||
nis_used = 1;
|
||||
#else
|
||||
return 0;
|
||||
#endif
|
||||
}
|
||||
|
||||
sgroup.sg_name = fields[0];
|
||||
sgroup.sg_passwd = fields[1];
|
||||
if (0 != nadmins) {
|
||||
if (nadmins) {
|
||||
nadmins = 0;
|
||||
free (admins);
|
||||
admins = NULL;
|
||||
}
|
||||
if (0 != nmembers) {
|
||||
if (nmembers) {
|
||||
nmembers = 0;
|
||||
free (members);
|
||||
members = NULL;
|
||||
@@ -210,76 +197,44 @@ void endsgent (void)
|
||||
* converts it to a (struct sgrp). NULL is returned on EOF.
|
||||
*/
|
||||
|
||||
/*@observer@*//*@null@*/struct sgrp *fgetsgent (/*@null@*/FILE * fp)
|
||||
struct sgrp *fgetsgent (FILE * fp)
|
||||
{
|
||||
static size_t buflen = 0;
|
||||
static char *buf = NULL;
|
||||
|
||||
char buf[sizeof sgrbuf];
|
||||
char *cp;
|
||||
|
||||
if (0 == buflen) {
|
||||
buf = (char *) malloc (BUFSIZ);
|
||||
if (NULL == buf) {
|
||||
return NULL;
|
||||
}
|
||||
buflen = BUFSIZ;
|
||||
}
|
||||
|
||||
if (NULL == fp) {
|
||||
return NULL;
|
||||
}
|
||||
if (!fp)
|
||||
return (0);
|
||||
|
||||
#ifdef USE_NIS
|
||||
while (fgetsx (buf, (int) buflen, fp) == buf)
|
||||
while (fgetsx (buf, sizeof buf, fp) != (char *) 0)
|
||||
#else
|
||||
if (fgetsx (buf, (int) buflen, fp) == buf)
|
||||
if (fgetsx (buf, sizeof buf, fp) != (char *) 0)
|
||||
#endif
|
||||
{
|
||||
while ( ((cp = strrchr (buf, '\n')) == NULL)
|
||||
&& (feof (fp) == 0)) {
|
||||
size_t len;
|
||||
|
||||
cp = (char *) realloc (buf, buflen*2);
|
||||
if (NULL == cp) {
|
||||
return NULL;
|
||||
}
|
||||
buf = cp;
|
||||
buflen *= 2;
|
||||
|
||||
len = strlen (buf);
|
||||
if (fgetsx (&buf[len],
|
||||
(int) (buflen - len),
|
||||
fp) != &buf[len]) {
|
||||
return NULL;
|
||||
}
|
||||
}
|
||||
cp = strrchr (buf, '\n');
|
||||
if (NULL != cp) {
|
||||
if ((cp = strchr (buf, '\n')))
|
||||
*cp = '\0';
|
||||
}
|
||||
#ifdef USE_NIS
|
||||
if (nis_ignore && IS_NISCHAR (buf[0])) {
|
||||
if (nis_ignore && IS_NISCHAR (buf[0]))
|
||||
continue;
|
||||
}
|
||||
#endif
|
||||
return (sgetsgent (buf));
|
||||
}
|
||||
return NULL;
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* getsgent - get a single shadow group entry
|
||||
*/
|
||||
|
||||
/*@observer@*//*@null@*/struct sgrp *getsgent (void)
|
||||
struct sgrp *getsgent (void)
|
||||
{
|
||||
#ifdef USE_NIS
|
||||
bool nis_1_group = false;
|
||||
int nis_1_group = 0;
|
||||
struct sgrp *val;
|
||||
char buf[BUFSIZ];
|
||||
#endif
|
||||
if (NULL == shadow) {
|
||||
if (!shadow)
|
||||
setsgent ();
|
||||
}
|
||||
|
||||
#ifdef USE_NIS
|
||||
again:
|
||||
@@ -294,10 +249,8 @@ void endsgent (void)
|
||||
* NULL right away if there is none.
|
||||
*/
|
||||
|
||||
val = fgetsgent (shadow);
|
||||
if (NULL == val) {
|
||||
if (!(val = fgetsgent (shadow)))
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* If this entry began with a NIS escape character, we have
|
||||
@@ -306,11 +259,10 @@ void endsgent (void)
|
||||
*/
|
||||
|
||||
if (IS_NISCHAR (val->sg_name[0])) {
|
||||
if ('\0' != val->sg_name[1]) {
|
||||
nis_1_group = true;
|
||||
} else {
|
||||
if (val->sg_name[1])
|
||||
nis_1_group = 1;
|
||||
else
|
||||
nis_state = start;
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
@@ -318,18 +270,16 @@ void endsgent (void)
|
||||
* use a NIS map, it must be a regular local group.
|
||||
*/
|
||||
|
||||
if (!nis_1_group && (nis_state != start)) {
|
||||
if (nis_1_group == 0 && nis_state != start)
|
||||
return val;
|
||||
}
|
||||
|
||||
/*
|
||||
* If this is an escape to use an NIS map, switch over to
|
||||
* that bunch of code.
|
||||
*/
|
||||
|
||||
if (nis_state == start) {
|
||||
if (nis_state == start)
|
||||
goto again;
|
||||
}
|
||||
|
||||
/*
|
||||
* NEEDSWORK. Here we substitute pieces-parts of this entry.
|
||||
@@ -337,7 +287,7 @@ void endsgent (void)
|
||||
|
||||
return 0;
|
||||
} else {
|
||||
if (!nis_bound) {
|
||||
if (nis_bound == 0) {
|
||||
if (bind_nis ()) {
|
||||
nis_state = native2;
|
||||
goto again;
|
||||
@@ -369,11 +319,12 @@ void endsgent (void)
|
||||
* getsgnam - get a shadow group entry by name
|
||||
*/
|
||||
|
||||
/*@observer@*//*@null@*/struct sgrp *getsgnam (const char *name)
|
||||
struct sgrp *getsgnam (const char *name)
|
||||
{
|
||||
struct sgrp *sgrp;
|
||||
|
||||
#ifdef USE_NIS
|
||||
char buf[BUFSIZ];
|
||||
static char save_name[16];
|
||||
int nis_disabled = 0;
|
||||
#endif
|
||||
@@ -388,9 +339,8 @@ void endsgent (void)
|
||||
* Search the gshadow.byname map for this group.
|
||||
*/
|
||||
|
||||
if (!nis_bound) {
|
||||
if (!nis_bound)
|
||||
bind_nis ();
|
||||
}
|
||||
|
||||
if (nis_bound) {
|
||||
char *cp;
|
||||
@@ -398,14 +348,11 @@ void endsgent (void)
|
||||
if (yp_match (nis_domain, "gshadow.byname", name,
|
||||
strlen (name), &nis_val,
|
||||
&nis_vallen) == 0) {
|
||||
cp = strchr (nis_val, '\n');
|
||||
if (NULL != cp) {
|
||||
if (cp = strchr (nis_val, '\n'))
|
||||
*cp = '\0';
|
||||
}
|
||||
|
||||
nis_state = middle;
|
||||
sgrp = sgetsgent (nis_val);
|
||||
if (NULL != sgrp) {
|
||||
if (sgrp = sgetsgent (nis_val)) {
|
||||
strcpy (save_name, sgrp->sg_name);
|
||||
nis_key = save_name;
|
||||
nis_keylen = strlen (save_name);
|
||||
@@ -418,19 +365,20 @@ void endsgent (void)
|
||||
#endif
|
||||
#ifdef USE_NIS
|
||||
if (nis_used) {
|
||||
nis_ignore = true;
|
||||
nis_disabled = true;
|
||||
nis_ignore++;
|
||||
nis_disabled++;
|
||||
}
|
||||
#endif
|
||||
while ((sgrp = getsgent ()) != (struct sgrp *) 0) {
|
||||
if (strcmp (name, sgrp->sg_name) == 0) {
|
||||
if (strcmp (name, sgrp->sg_name) == 0)
|
||||
break;
|
||||
}
|
||||
}
|
||||
#ifdef USE_NIS
|
||||
nis_ignore = false;
|
||||
nis_ignore--;
|
||||
#endif
|
||||
return sgrp;
|
||||
if (sgrp)
|
||||
return sgrp;
|
||||
return (0);
|
||||
}
|
||||
|
||||
/*
|
||||
@@ -447,23 +395,19 @@ int putsgent (const struct sgrp *sgrp, FILE * fp)
|
||||
int i;
|
||||
size_t size;
|
||||
|
||||
if ((NULL == fp) || (NULL == sgrp)) {
|
||||
if (!fp || !sgrp)
|
||||
return -1;
|
||||
}
|
||||
|
||||
/* calculate the required buffer size */
|
||||
size = strlen (sgrp->sg_name) + strlen (sgrp->sg_passwd) + 10;
|
||||
for (i = 0; (NULL != sgrp->sg_adm) && (NULL != sgrp->sg_adm[i]); i++) {
|
||||
for (i = 0; sgrp->sg_adm && sgrp->sg_adm[i]; i++)
|
||||
size += strlen (sgrp->sg_adm[i]) + 1;
|
||||
}
|
||||
for (i = 0; (NULL != sgrp->sg_mem) && (NULL != sgrp->sg_mem[i]); i++) {
|
||||
for (i = 0; sgrp->sg_mem && sgrp->sg_mem[i]; i++)
|
||||
size += strlen (sgrp->sg_mem[i]) + 1;
|
||||
}
|
||||
|
||||
buf = malloc (size);
|
||||
if (NULL == buf) {
|
||||
if (!buf)
|
||||
return -1;
|
||||
}
|
||||
cp = buf;
|
||||
|
||||
/*
|
||||
@@ -483,32 +427,27 @@ int putsgent (const struct sgrp *sgrp, FILE * fp)
|
||||
* with a ",".
|
||||
*/
|
||||
|
||||
for (i = 0; NULL != sgrp->sg_adm[i]; i++) {
|
||||
if (i > 0) {
|
||||
for (i = 0; sgrp->sg_adm[i]; i++) {
|
||||
if (i > 0)
|
||||
*cp++ = ',';
|
||||
}
|
||||
|
||||
strcpy (cp, sgrp->sg_adm[i]);
|
||||
cp += strlen (cp);
|
||||
}
|
||||
*cp = ':';
|
||||
cp++;
|
||||
*cp++ = ':';
|
||||
|
||||
/*
|
||||
* Now do likewise with the group members.
|
||||
*/
|
||||
|
||||
for (i = 0; NULL != sgrp->sg_mem[i]; i++) {
|
||||
if (i > 0) {
|
||||
*cp = ',';
|
||||
cp++;
|
||||
}
|
||||
for (i = 0; sgrp->sg_mem[i]; i++) {
|
||||
if (i > 0)
|
||||
*cp++ = ',';
|
||||
|
||||
strcpy (cp, sgrp->sg_mem[i]);
|
||||
cp += strlen (cp);
|
||||
}
|
||||
*cp = '\n';
|
||||
cp++;
|
||||
*cp++ = '\n';
|
||||
*cp = '\0';
|
||||
|
||||
/*
|
||||
|
||||
@@ -43,7 +43,7 @@
|
||||
struct sgrp {
|
||||
char *sg_name; /* group name */
|
||||
char *sg_passwd; /* group password */
|
||||
char **sg_adm; /* group administrator list */
|
||||
char **sg_adm; /* group administator list */
|
||||
char **sg_mem; /* group membership list */
|
||||
};
|
||||
|
||||
@@ -54,18 +54,18 @@ struct sgrp {
|
||||
#include <stdio.h> /* for FILE */
|
||||
|
||||
#if __STDC__
|
||||
/*@observer@*//*@null@*/struct sgrp *getsgent (void);
|
||||
/*@observer@*//*@null@*/struct sgrp *getsgnam (const char *);
|
||||
/*@observer@*//*@null@*/struct sgrp *sgetsgent (const char *);
|
||||
/*@observer@*//*@null@*/struct sgrp *fgetsgent (/*@null@*/FILE *);
|
||||
struct sgrp *getsgent (void);
|
||||
struct sgrp *getsgnam (const char *);
|
||||
struct sgrp *sgetsgent (const char *);
|
||||
struct sgrp *fgetsgent (FILE *);
|
||||
void setsgent (void);
|
||||
void endsgent (void);
|
||||
int putsgent (const struct sgrp *, FILE *);
|
||||
#else
|
||||
/*@observer@*//*@null@*/struct sgrp *getsgent ();
|
||||
/*@observer@*//*@null@*/struct sgrp *getsgnam ();
|
||||
/*@observer@*//*@null@*/struct sgrp *sgetsgent ();
|
||||
/*@observer@*//*@null@*/struct sgrp *fgetsgent ();
|
||||
struct sgrp *getsgent ();
|
||||
struct sgrp *getsgnam ();
|
||||
struct sgrp *sgetsgent ();
|
||||
struct sgrp *fgetsgent ();
|
||||
void setsgent ();
|
||||
void endsgent ();
|
||||
int putsgent ();
|
||||
|
||||
59
lib/nscd.c
59
lib/nscd.c
@@ -1,57 +1,50 @@
|
||||
/* Author: Peter Vrabec <pvrabec@redhat.com> */
|
||||
|
||||
#include <config.h>
|
||||
#ifdef USE_NSCD
|
||||
/* because of TEMP_FAILURE_RETRY */
|
||||
#define _GNU_SOURCE
|
||||
|
||||
#include <features.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <unistd.h>
|
||||
#include <spawn.h>
|
||||
#include <errno.h>
|
||||
#include <sys/wait.h>
|
||||
#include <sys/types.h>
|
||||
#include "exitcodes.h"
|
||||
#include "defines.h"
|
||||
#include "prototypes.h"
|
||||
#include "nscd.h"
|
||||
|
||||
#define MSG_NSCD_FLUSH_CACHE_FAILED "%s: Failed to flush the nscd cache.\n"
|
||||
|
||||
/*
|
||||
* nscd_flush_cache - flush specified service buffer in nscd cache
|
||||
*/
|
||||
int nscd_flush_cache (const char *service)
|
||||
{
|
||||
int status, code;
|
||||
const char *cmd = "/usr/sbin/nscd";
|
||||
const char *spawnedArgs[] = {"nscd", "-i", service, NULL};
|
||||
const char *spawnedEnv[] = {NULL};
|
||||
pid_t pid, termpid;
|
||||
int err, status;
|
||||
char *spawnedArgs[] = {"/usr/sbin/nscd", "nscd", "-i", service, NULL};
|
||||
char *spawnedEnv[] = {NULL};
|
||||
|
||||
if (run_command (cmd, spawnedArgs, spawnedEnv, &status) != 0) {
|
||||
/* run_command writes its own more detailed message. */
|
||||
(void) fprintf (shadow_logfd, _(MSG_NSCD_FLUSH_CACHE_FAILED), Prog);
|
||||
/* spawn process */
|
||||
if( (err=posix_spawn(&pid, spawnedArgs[0], NULL, NULL,
|
||||
spawnedArgs, spawnedEnv)) !=0 )
|
||||
{
|
||||
fprintf(stderr, "posix_spawn() error=%d\n", err);
|
||||
return -1;
|
||||
}
|
||||
|
||||
code = WEXITSTATUS (status);
|
||||
if (!WIFEXITED (status)) {
|
||||
(void) fprintf (shadow_logfd,
|
||||
_("%s: nscd did not terminate normally (signal %d)\n"),
|
||||
Prog, WTERMSIG (status));
|
||||
/* Wait for the spawned process to exit */
|
||||
termpid = TEMP_FAILURE_RETRY (waitpid (pid, &status, 0));
|
||||
if (termpid == -1)
|
||||
{
|
||||
perror("waitpid");
|
||||
return -1;
|
||||
} else if (code == E_CMD_NOTFOUND) {
|
||||
/* nscd is not installed, or it is installed but uses an
|
||||
interpreter that is missing. Probably the former. */
|
||||
return 0;
|
||||
} else if (code == 1) {
|
||||
/* nscd is installed, but it isn't active. */
|
||||
return 0;
|
||||
} else if (code != 0) {
|
||||
(void) fprintf (shadow_logfd, _("%s: nscd exited with status %d\n"),
|
||||
Prog, code);
|
||||
(void) fprintf (shadow_logfd, _(MSG_NSCD_FLUSH_CACHE_FAILED), Prog);
|
||||
}
|
||||
else if (termpid != pid)
|
||||
{
|
||||
fprintf(stderr, "waitpid returned %ld != %ld\n",
|
||||
(long int) termpid, (long int) pid);
|
||||
return -1;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
#else /* USE_NSCD */
|
||||
extern int errno; /* warning: ANSI C forbids an empty source file */
|
||||
#endif /* USE_NSCD */
|
||||
|
||||
|
||||
@@ -4,10 +4,6 @@
|
||||
/*
|
||||
* nscd_flush_cache - flush specified service buffer in nscd cache
|
||||
*/
|
||||
#ifdef USE_NSCD
|
||||
extern int nscd_flush_cache (const char *service);
|
||||
#else
|
||||
#define nscd_flush_cache(service) (0)
|
||||
#endif
|
||||
|
||||
#endif
|
||||
|
||||
149
lib/nss.c
149
lib/nss.c
@@ -1,149 +0,0 @@
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <dlfcn.h>
|
||||
#include <stdbool.h>
|
||||
#include <string.h>
|
||||
#include <strings.h>
|
||||
#include <ctype.h>
|
||||
#include <stdatomic.h>
|
||||
#include "prototypes.h"
|
||||
#include "../libsubid/subid.h"
|
||||
|
||||
#define NSSWITCH "/etc/nsswitch.conf"
|
||||
|
||||
// NSS plugin handling for subids
|
||||
// If nsswitch has a line like
|
||||
// subid: sssd
|
||||
// then sssd will be consulted for subids. Unlike normal NSS dbs,
|
||||
// only one db is supported at a time. That's open to debate, but
|
||||
// the subids are a pretty limited resource, and local files seem
|
||||
// bound to step on any other allocations leading to insecure
|
||||
// conditions.
|
||||
static atomic_flag nss_init_started;
|
||||
static atomic_bool nss_init_completed;
|
||||
|
||||
static struct subid_nss_ops *subid_nss;
|
||||
|
||||
bool nss_is_initialized() {
|
||||
return atomic_load(&nss_init_completed);
|
||||
}
|
||||
|
||||
void nss_exit() {
|
||||
if (nss_is_initialized() && subid_nss) {
|
||||
dlclose(subid_nss->handle);
|
||||
free(subid_nss);
|
||||
subid_nss = NULL;
|
||||
}
|
||||
}
|
||||
|
||||
// nsswitch_path is an argument only to support testing.
|
||||
void nss_init(char *nsswitch_path) {
|
||||
FILE *nssfp = NULL;
|
||||
char *line = NULL, *p, *token, *saveptr;
|
||||
size_t len = 0;
|
||||
|
||||
if (atomic_flag_test_and_set(&nss_init_started)) {
|
||||
// Another thread has started nss_init, wait for it to complete
|
||||
while (!atomic_load(&nss_init_completed))
|
||||
usleep(100);
|
||||
return;
|
||||
}
|
||||
|
||||
if (!nsswitch_path)
|
||||
nsswitch_path = NSSWITCH;
|
||||
|
||||
// read nsswitch.conf to check for a line like:
|
||||
// subid: files
|
||||
nssfp = fopen(nsswitch_path, "r");
|
||||
if (!nssfp) {
|
||||
fprintf(shadow_logfd, "Failed opening %s: %m", nsswitch_path);
|
||||
atomic_store(&nss_init_completed, true);
|
||||
return;
|
||||
}
|
||||
while ((getline(&line, &len, nssfp)) != -1) {
|
||||
if (line[0] == '\0' || line[0] == '#')
|
||||
continue;
|
||||
if (strlen(line) < 8)
|
||||
continue;
|
||||
if (strncasecmp(line, "subid:", 6) != 0)
|
||||
continue;
|
||||
p = &line[6];
|
||||
while ((*p) && isspace(*p))
|
||||
p++;
|
||||
if (!*p)
|
||||
continue;
|
||||
for (token = strtok_r(p, " \n\t", &saveptr);
|
||||
token;
|
||||
token = strtok_r(NULL, " \n\t", &saveptr)) {
|
||||
char libname[65];
|
||||
void *h;
|
||||
if (strcmp(token, "files") == 0) {
|
||||
subid_nss = NULL;
|
||||
goto done;
|
||||
}
|
||||
if (strlen(token) > 50) {
|
||||
fprintf(shadow_logfd, "Subid NSS module name too long (longer than 50 characters): %s\n", token);
|
||||
fprintf(shadow_logfd, "Using files\n");
|
||||
subid_nss = NULL;
|
||||
goto done;
|
||||
}
|
||||
snprintf(libname, 64, "libsubid_%s.so", token);
|
||||
h = dlopen(libname, RTLD_LAZY);
|
||||
if (!h) {
|
||||
fprintf(shadow_logfd, "Error opening %s: %s\n", libname, dlerror());
|
||||
fprintf(shadow_logfd, "Using files\n");
|
||||
subid_nss = NULL;
|
||||
goto done;
|
||||
}
|
||||
subid_nss = malloc(sizeof(*subid_nss));
|
||||
if (!subid_nss) {
|
||||
dlclose(h);
|
||||
goto done;
|
||||
}
|
||||
subid_nss->has_range = dlsym(h, "shadow_subid_has_range");
|
||||
if (!subid_nss->has_range) {
|
||||
fprintf(shadow_logfd, "%s did not provide @has_range@\n", libname);
|
||||
dlclose(h);
|
||||
free(subid_nss);
|
||||
subid_nss = NULL;
|
||||
goto done;
|
||||
}
|
||||
subid_nss->list_owner_ranges = dlsym(h, "shadow_subid_list_owner_ranges");
|
||||
if (!subid_nss->list_owner_ranges) {
|
||||
fprintf(shadow_logfd, "%s did not provide @list_owner_ranges@\n", libname);
|
||||
dlclose(h);
|
||||
free(subid_nss);
|
||||
subid_nss = NULL;
|
||||
goto done;
|
||||
}
|
||||
subid_nss->find_subid_owners = dlsym(h, "shadow_subid_find_subid_owners");
|
||||
if (!subid_nss->find_subid_owners) {
|
||||
fprintf(shadow_logfd, "%s did not provide @find_subid_owners@\n", libname);
|
||||
dlclose(h);
|
||||
free(subid_nss);
|
||||
subid_nss = NULL;
|
||||
goto done;
|
||||
}
|
||||
subid_nss->handle = h;
|
||||
goto done;
|
||||
}
|
||||
fprintf(shadow_logfd, "No usable subid NSS module found, using files\n");
|
||||
// subid_nss has to be null here, but to ease reviews:
|
||||
free(subid_nss);
|
||||
subid_nss = NULL;
|
||||
goto done;
|
||||
}
|
||||
|
||||
done:
|
||||
atomic_store(&nss_init_completed, true);
|
||||
free(line);
|
||||
if (nssfp) {
|
||||
atexit(nss_exit);
|
||||
fclose(nssfp);
|
||||
}
|
||||
}
|
||||
|
||||
struct subid_nss_ops *get_subid_nss_handle() {
|
||||
nss_init(NULL);
|
||||
return subid_nss;
|
||||
}
|
||||
@@ -28,31 +28,24 @@
|
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include <config.h>
|
||||
#include <security/pam_appl.h>
|
||||
#ifdef HAVE_SECURITY_PAM_MISC_H
|
||||
# include <security/pam_misc.h>
|
||||
#endif
|
||||
#ifdef HAVE_SECURITY_OPENPAM_H
|
||||
# include <security/openpam.h>
|
||||
#endif
|
||||
|
||||
#include <security/pam_misc.h>
|
||||
|
||||
static struct pam_conv conv = {
|
||||
SHADOW_PAM_CONVERSATION,
|
||||
misc_conv,
|
||||
NULL
|
||||
};
|
||||
|
||||
/* compatibility with different versions of Linux-PAM */
|
||||
#if !HAVE_DECL_PAM_ESTABLISH_CRED
|
||||
#ifndef PAM_ESTABLISH_CRED
|
||||
#define PAM_ESTABLISH_CRED PAM_CRED_ESTABLISH
|
||||
#endif
|
||||
#if !HAVE_DECL_PAM_DELETE_CRED
|
||||
#ifndef PAM_DELETE_CRED
|
||||
#define PAM_DELETE_CRED PAM_CRED_DELETE
|
||||
#endif
|
||||
#if !HAVE_DECL_PAM_NEW_AUTHTOK_REQD
|
||||
#ifndef PAM_NEW_AUTHTOK_REQD
|
||||
#define PAM_NEW_AUTHTOK_REQD PAM_AUTHTOKEN_REQD
|
||||
#endif
|
||||
#if !HAVE_DECL_PAM_DATA_SILENT
|
||||
#ifndef PAM_DATA_SILENT
|
||||
#define PAM_DATA_SILENT 0
|
||||
#endif
|
||||
|
||||
162
lib/port.c
162
lib/port.c
@@ -57,19 +57,15 @@ static int portcmp (const char *pattern, const char *port)
|
||||
{
|
||||
const char *orig = port;
|
||||
|
||||
while (('\0' != *pattern) && (*pattern == *port)) {
|
||||
pattern++;
|
||||
port++;
|
||||
}
|
||||
while (*pattern && *pattern == *port)
|
||||
pattern++, port++;
|
||||
|
||||
if (('\0' == *pattern) && ('\0' == *port)) {
|
||||
if (*pattern == 0 && *port == 0)
|
||||
return 0;
|
||||
}
|
||||
if (('S' == orig[0]) && ('U' == orig[1]) && ('\0' == orig[2])) {
|
||||
if (orig[0] == 'S' && orig[1] == 'U' && orig[2] == '\0')
|
||||
return 1;
|
||||
}
|
||||
|
||||
return (*pattern == '*') ? 0 : 1;
|
||||
return *pattern == '*' ? 0 : 1;
|
||||
}
|
||||
|
||||
/*
|
||||
@@ -81,11 +77,10 @@ static int portcmp (const char *pattern, const char *port)
|
||||
|
||||
static void setportent (void)
|
||||
{
|
||||
if (NULL != ports) {
|
||||
if (ports)
|
||||
rewind (ports);
|
||||
} else {
|
||||
else
|
||||
ports = fopen (PORTS, "r");
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
@@ -98,9 +93,8 @@ static void setportent (void)
|
||||
|
||||
static void endportent (void)
|
||||
{
|
||||
if (NULL != ports) {
|
||||
(void) fclose (ports);
|
||||
}
|
||||
if (ports)
|
||||
fclose (ports);
|
||||
|
||||
ports = (FILE *) 0;
|
||||
}
|
||||
@@ -131,11 +125,10 @@ static struct port *getportent (void)
|
||||
* since we want to search from the beginning each time.
|
||||
*/
|
||||
|
||||
if (NULL == ports) {
|
||||
if (!ports)
|
||||
setportent ();
|
||||
}
|
||||
|
||||
if (NULL == ports) {
|
||||
if (!ports) {
|
||||
errno = saveerr;
|
||||
return 0;
|
||||
}
|
||||
@@ -157,13 +150,12 @@ static struct port *getportent (void)
|
||||
* is a '\n'. Lines which begin with '#' are all ignored.
|
||||
*/
|
||||
|
||||
if (fgets (buf, (int) sizeof buf, ports) == 0) {
|
||||
if (fgets (buf, sizeof buf, ports) == 0) {
|
||||
errno = saveerr;
|
||||
return 0;
|
||||
}
|
||||
if ('#' == buf[0]) {
|
||||
if (buf[0] == '#')
|
||||
goto again;
|
||||
}
|
||||
|
||||
/*
|
||||
* Get the name of the TTY device. It is the first colon
|
||||
@@ -177,24 +169,19 @@ static struct port *getportent (void)
|
||||
port.pt_names = ttys;
|
||||
for (cp = buf, j = 0; j < PORT_TTY; j++) {
|
||||
port.pt_names[j] = cp;
|
||||
while (('\0' != *cp) && (':' != *cp) && (',' != *cp)) {
|
||||
while (*cp && *cp != ':' && *cp != ',')
|
||||
cp++;
|
||||
}
|
||||
|
||||
if ('\0' == *cp) {
|
||||
if (!*cp)
|
||||
goto again; /* line format error */
|
||||
}
|
||||
|
||||
if (':' == *cp) { /* end of tty name list */
|
||||
if (*cp == ':') /* end of tty name list */
|
||||
break;
|
||||
}
|
||||
|
||||
if (',' == *cp) { /* end of current tty name */
|
||||
if (*cp == ',') /* end of current tty name */
|
||||
*cp++ = '\0';
|
||||
}
|
||||
}
|
||||
*cp = '\0';
|
||||
cp++;
|
||||
*cp++ = 0;
|
||||
port.pt_names[j + 1] = (char *) 0;
|
||||
|
||||
/*
|
||||
@@ -204,29 +191,24 @@ static struct port *getportent (void)
|
||||
* The last entry in the list is a (char *) 0 pointer.
|
||||
*/
|
||||
|
||||
if (':' != *cp) {
|
||||
if (*cp != ':') {
|
||||
port.pt_users = users;
|
||||
port.pt_users[0] = cp;
|
||||
|
||||
for (j = 1; ':' != *cp; cp++) {
|
||||
if ((',' == *cp) && (j < PORT_IDS)) {
|
||||
*cp = '\0';
|
||||
cp++;
|
||||
port.pt_users[j] = cp;
|
||||
j++;
|
||||
for (j = 1; *cp != ':'; cp++) {
|
||||
if (*cp == ',' && j < PORT_IDS) {
|
||||
*cp++ = 0;
|
||||
port.pt_users[j++] = cp;
|
||||
}
|
||||
}
|
||||
port.pt_users[j] = 0;
|
||||
} else {
|
||||
} else
|
||||
port.pt_users = 0;
|
||||
}
|
||||
|
||||
if (':' != *cp) {
|
||||
if (*cp != ':')
|
||||
goto again;
|
||||
}
|
||||
|
||||
*cp = '\0';
|
||||
cp++;
|
||||
*cp++ = 0;
|
||||
|
||||
/*
|
||||
* Get the list of valid times. The times field is the third
|
||||
@@ -241,7 +223,7 @@ static struct port *getportent (void)
|
||||
* the starting time. Days are presumed to wrap at 0000.
|
||||
*/
|
||||
|
||||
if ('\0' == *cp) {
|
||||
if (*cp == '\0') {
|
||||
port.pt_times = 0;
|
||||
return &port;
|
||||
}
|
||||
@@ -252,7 +234,7 @@ static struct port *getportent (void)
|
||||
* Get the next comma separated entry
|
||||
*/
|
||||
|
||||
for (j = 0; ('\0' != *cp) && (j < PORT_TIMES); j++) {
|
||||
for (j = 0; *cp && j < PORT_TIMES; j++) {
|
||||
|
||||
/*
|
||||
* Start off with no days of the week
|
||||
@@ -266,9 +248,7 @@ static struct port *getportent (void)
|
||||
* week or the other two values.
|
||||
*/
|
||||
|
||||
for (i = 0;
|
||||
('\0' != cp[i]) && ('\0' != cp[i + 1]) && isalpha (cp[i]);
|
||||
i += 2) {
|
||||
for (i = 0; cp[i] && cp[i + 1] && isalpha (cp[i]); i += 2) {
|
||||
switch ((cp[i] << 8) | (cp[i + 1])) {
|
||||
case ('S' << 8) | 'u':
|
||||
port.pt_times[j].t_days |= 01;
|
||||
@@ -307,9 +287,8 @@ static struct port *getportent (void)
|
||||
* The default is 'Al' if no days were seen.
|
||||
*/
|
||||
|
||||
if (0 == i) {
|
||||
if (i == 0)
|
||||
port.pt_times[j].t_days = 0177;
|
||||
}
|
||||
|
||||
/*
|
||||
* The start and end times are separated from each
|
||||
@@ -317,27 +296,19 @@ static struct port *getportent (void)
|
||||
* representing the times of day.
|
||||
*/
|
||||
|
||||
for (dtime = 0; ('\0' != cp[i]) && isdigit (cp[i]); i++) {
|
||||
for (dtime = 0; cp[i] && isdigit (cp[i]); i++)
|
||||
dtime = dtime * 10 + cp[i] - '0';
|
||||
}
|
||||
|
||||
if (('-' != cp[i]) || (dtime > 2400) || ((dtime % 100) > 59)) {
|
||||
if (cp[i] != '-' || dtime > 2400 || dtime % 100 > 59)
|
||||
goto again;
|
||||
}
|
||||
port.pt_times[j].t_start = dtime;
|
||||
cp = cp + i + 1;
|
||||
|
||||
for (dtime = 0, i = 0;
|
||||
('\0' != cp[i]) && isdigit (cp[i]);
|
||||
i++) {
|
||||
for (dtime = i = 0; cp[i] && isdigit (cp[i]); i++)
|
||||
dtime = dtime * 10 + cp[i] - '0';
|
||||
}
|
||||
|
||||
if ( ((',' != cp[i]) && ('\0' != cp[i]))
|
||||
|| (dtime > 2400)
|
||||
|| ((dtime % 100) > 59)) {
|
||||
if ((cp[i] != ',' && cp[i]) || dtime > 2400 || dtime % 100 > 59)
|
||||
goto again;
|
||||
}
|
||||
|
||||
port.pt_times[j].t_end = dtime;
|
||||
cp = cp + i + 1;
|
||||
@@ -369,32 +340,24 @@ static struct port *getttyuser (const char *tty, const char *user)
|
||||
|
||||
setportent ();
|
||||
|
||||
while ((port = getportent ()) != NULL) {
|
||||
if ( (0 == port->pt_names)
|
||||
|| (0 == port->pt_users)) {
|
||||
while ((port = getportent ())) {
|
||||
if (port->pt_names == 0 || port->pt_users == 0)
|
||||
continue;
|
||||
}
|
||||
|
||||
for (i = 0; NULL != port->pt_names[i]; i++) {
|
||||
if (portcmp (port->pt_names[i], tty) == 0) {
|
||||
for (i = 0; port->pt_names[i]; i++)
|
||||
if (portcmp (port->pt_names[i], tty) == 0)
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
if (port->pt_names[i] == 0) {
|
||||
if (port->pt_names[i] == 0)
|
||||
continue;
|
||||
}
|
||||
|
||||
for (j = 0; NULL != port->pt_users[j]; j++) {
|
||||
if ( (strcmp (user, port->pt_users[j]) == 0)
|
||||
|| (strcmp (port->pt_users[j], "*") == 0)) {
|
||||
for (j = 0; port->pt_users[j]; j++)
|
||||
if (strcmp (user, port->pt_users[j]) == 0 ||
|
||||
strcmp (port->pt_users[j], "*") == 0)
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
if (port->pt_users[j] != 0) {
|
||||
if (port->pt_users[j] != 0)
|
||||
break;
|
||||
}
|
||||
}
|
||||
endportent ();
|
||||
return port;
|
||||
@@ -407,7 +370,7 @@ static struct port *getttyuser (const char *tty, const char *user)
|
||||
* the user name and TTY given.
|
||||
*/
|
||||
|
||||
bool isttytime (const char *id, const char *port, time_t when)
|
||||
int isttytime (const char *id, const char *port, time_t when)
|
||||
{
|
||||
int i;
|
||||
int dtime;
|
||||
@@ -416,27 +379,24 @@ bool isttytime (const char *id, const char *port, time_t when)
|
||||
|
||||
/*
|
||||
* Try to find a matching entry for this user. Default to
|
||||
* letting the user in - there are plenty of ways to have an
|
||||
* letting the user in - there are pleny of ways to have an
|
||||
* entry to match all users.
|
||||
*/
|
||||
|
||||
pp = getttyuser (port, id);
|
||||
if (NULL == pp) {
|
||||
return true;
|
||||
}
|
||||
if (!(pp = getttyuser (port, id)))
|
||||
return 1;
|
||||
|
||||
/*
|
||||
* The entry is there, but has no time entries - don't
|
||||
* ever let them login.
|
||||
*/
|
||||
|
||||
if (0 == pp->pt_times) {
|
||||
return false;
|
||||
}
|
||||
if (pp->pt_times == 0)
|
||||
return 0;
|
||||
|
||||
/*
|
||||
* The current time is converted to HHMM format for
|
||||
* comparison against the time values in the TTY entry.
|
||||
* comparision against the time values in the TTY entry.
|
||||
*/
|
||||
|
||||
tm = localtime (&when);
|
||||
@@ -445,25 +405,22 @@ bool isttytime (const char *id, const char *port, time_t when)
|
||||
/*
|
||||
* Each time entry is compared against the current
|
||||
* time. For entries with the start after the end time,
|
||||
* the comparison is made so that the time is between
|
||||
* the comparision is made so that the time is between
|
||||
* midnight and either the start or end time.
|
||||
*/
|
||||
|
||||
for (i = 0; pp->pt_times[i].t_start != -1; i++) {
|
||||
if (!(pp->pt_times[i].t_days & PORT_DAY (tm->tm_wday))) {
|
||||
if (!(pp->pt_times[i].t_days & PORT_DAY (tm->tm_wday)))
|
||||
continue;
|
||||
}
|
||||
|
||||
if (pp->pt_times[i].t_start <= pp->pt_times[i].t_end) {
|
||||
if ( (dtime >= pp->pt_times[i].t_start)
|
||||
&& (dtime <= pp->pt_times[i].t_end)) {
|
||||
return true;
|
||||
}
|
||||
if (dtime >= pp->pt_times[i].t_start &&
|
||||
dtime <= pp->pt_times[i].t_end)
|
||||
return 1;
|
||||
} else {
|
||||
if ( (dtime >= pp->pt_times[i].t_start)
|
||||
|| (dtime <= pp->pt_times[i].t_end)) {
|
||||
return true;
|
||||
}
|
||||
if (dtime >= pp->pt_times[i].t_start ||
|
||||
dtime <= pp->pt_times[i].t_end)
|
||||
return 1;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -472,6 +429,5 @@ bool isttytime (const char *id, const char *port, time_t when)
|
||||
* be let in right now.
|
||||
*/
|
||||
|
||||
return false;
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
375
lib/prototypes.h
375
lib/prototypes.h
@@ -2,7 +2,7 @@
|
||||
* Copyright (c) 1990 - 1994, Julianne Frances Haugh
|
||||
* Copyright (c) 1996 - 2000, Marek Michałkiewicz
|
||||
* Copyright (c) 2003 - 2006, Tomasz Kłoczko
|
||||
* Copyright (c) 2007 - 2010, Nicolas François
|
||||
* Copyright (c) 2007 - 2008, Nicolas François
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
@@ -42,15 +42,12 @@
|
||||
#ifndef _PROTOTYPES_H
|
||||
#define _PROTOTYPES_H
|
||||
|
||||
#include <config.h>
|
||||
|
||||
#include <sys/stat.h>
|
||||
#ifdef USE_UTMPX
|
||||
#if HAVE_UTMPX_H
|
||||
#include <utmpx.h>
|
||||
#else
|
||||
#include <utmp.h>
|
||||
#endif
|
||||
#include <sys/types.h>
|
||||
#include <pwd.h>
|
||||
#include <grp.h>
|
||||
#include <shadow.h>
|
||||
@@ -59,89 +56,41 @@
|
||||
#include "defines.h"
|
||||
#include "commonio.h"
|
||||
|
||||
extern /*@observer@*/ const char *Prog; /* Program name showed in error messages */
|
||||
extern FILE *shadow_logfd; /* file descripter to which error messages are printed */
|
||||
|
||||
/* addgrps.c */
|
||||
#if defined (HAVE_SETGROUPS) && ! defined (USE_PAM)
|
||||
extern int add_groups (const char *);
|
||||
#endif
|
||||
extern void add_cons_grps (void);
|
||||
|
||||
/* age.c */
|
||||
extern void agecheck (/*@null@*/const struct spwd *);
|
||||
extern int expire (const struct passwd *, /*@null@*/const struct spwd *);
|
||||
/* isexpired.c */
|
||||
extern int isexpired (const struct passwd *, /*@null@*/const struct spwd *);
|
||||
|
||||
/* btrfs.c */
|
||||
#ifdef WITH_BTRFS
|
||||
extern int btrfs_create_subvolume(const char *path);
|
||||
extern int btrfs_remove_subvolume(const char *path);
|
||||
extern int btrfs_is_subvolume(const char *path);
|
||||
extern int is_btrfs(const char *path);
|
||||
#endif
|
||||
extern void agecheck (const struct passwd *, const struct spwd *);
|
||||
extern int expire (const struct passwd *, const struct spwd *);
|
||||
extern int isexpired (const struct passwd *, const struct spwd *);
|
||||
|
||||
/* basename() renamed to Basename() to avoid libc name space confusion */
|
||||
/* basename.c */
|
||||
extern /*@observer@*/const char *Basename (const char *str);
|
||||
extern char *Basename (char *str);
|
||||
|
||||
/* chowndir.c */
|
||||
extern int chown_tree (const char *root,
|
||||
uid_t old_uid, uid_t new_uid,
|
||||
gid_t old_gid, gid_t new_gid);
|
||||
extern int chown_tree (const char *, uid_t, uid_t, gid_t, gid_t);
|
||||
|
||||
/* chowntty.c */
|
||||
extern void chown_tty (const struct passwd *);
|
||||
|
||||
/* cleanup.c */
|
||||
typedef /*@null@*/void (*cleanup_function) (/*@null@*/void *arg);
|
||||
void add_cleanup (/*@notnull@*/cleanup_function pcf, /*@null@*/void *arg);
|
||||
void del_cleanup (/*@notnull@*/cleanup_function pcf);
|
||||
void do_cleanups (void);
|
||||
|
||||
/* cleanup_group.c */
|
||||
struct cleanup_info_mod {
|
||||
char *audit_msg;
|
||||
char *action;
|
||||
/*@observer@*/const char *name;
|
||||
};
|
||||
void cleanup_report_add_group (void *group_name);
|
||||
void cleanup_report_add_group_group (void *group_name);
|
||||
#ifdef SHADOWGRP
|
||||
void cleanup_report_add_group_gshadow (void *group_name);
|
||||
#endif
|
||||
void cleanup_report_del_group (void *group_name);
|
||||
void cleanup_report_del_group_group (void *group_name);
|
||||
#ifdef SHADOWGRP
|
||||
void cleanup_report_del_group_gshadow (void *group_name);
|
||||
#endif
|
||||
void cleanup_report_mod_passwd (void *cleanup_info);
|
||||
void cleanup_report_mod_group (void *cleanup_info);
|
||||
void cleanup_report_mod_gshadow (void *cleanup_info);
|
||||
void cleanup_unlock_group (/*@null@*/void *unused);
|
||||
#ifdef SHADOWGRP
|
||||
void cleanup_unlock_gshadow (/*@null@*/void *unused);
|
||||
#endif
|
||||
void cleanup_unlock_passwd (/*@null@*/void *unused);
|
||||
extern void chown_tty (const char *, const struct passwd *);
|
||||
|
||||
/* console.c */
|
||||
extern bool console (const char *);
|
||||
extern int console (const char *);
|
||||
|
||||
/* copydir.c */
|
||||
extern int copy_tree (const char *src_root, const char *dst_root,
|
||||
bool copy_root,
|
||||
bool reset_selinux,
|
||||
uid_t old_uid, uid_t new_uid,
|
||||
gid_t old_gid, gid_t new_gid);
|
||||
long int uid, long int gid);
|
||||
extern int remove_tree (const char *root);
|
||||
|
||||
/* encrypt.c */
|
||||
extern /*@exposed@*//*@null@*/char *pw_encrypt (const char *, const char *);
|
||||
extern char *pw_encrypt (const char *, const char *);
|
||||
|
||||
/* entry.c */
|
||||
extern void pw_entry (const char *, struct passwd *);
|
||||
|
||||
/* env.c */
|
||||
extern void addenv (const char *, /*@null@*/const char *);
|
||||
extern void addenv (const char *, const char *);
|
||||
extern void initenv (void);
|
||||
extern void set_env (int, char *const *);
|
||||
extern void sanitize_env (void);
|
||||
@@ -150,69 +99,28 @@ extern void sanitize_env (void);
|
||||
extern void change_field (char *, size_t, const char *);
|
||||
extern int valid_field (const char *, const char *);
|
||||
|
||||
/* find_new_gid.c */
|
||||
extern int find_new_gid (bool sys_group,
|
||||
gid_t *gid,
|
||||
/*@null@*/gid_t const *preferred_gid);
|
||||
|
||||
/* find_new_uid.c */
|
||||
extern int find_new_uid (bool sys_user,
|
||||
uid_t *uid,
|
||||
/*@null@*/uid_t const *preferred_uid);
|
||||
|
||||
#ifdef ENABLE_SUBIDS
|
||||
/* find_new_sub_gids.c */
|
||||
extern int find_new_sub_gids (gid_t *range_start, unsigned long *range_count);
|
||||
|
||||
/* find_new_sub_uids.c */
|
||||
extern int find_new_sub_uids (uid_t *range_start, unsigned long *range_count);
|
||||
#endif /* ENABLE_SUBIDS */
|
||||
|
||||
|
||||
/* get_gid.c */
|
||||
extern int get_gid (const char *gidstr, gid_t *gid);
|
||||
|
||||
/* getgr_nam_gid.c */
|
||||
extern /*@only@*//*@null@*/struct group *getgr_nam_gid (/*@null@*/const char *grname);
|
||||
/* find_new_ids.c */
|
||||
extern int find_new_uid (int sys_user, uid_t *uid, uid_t const *preferred_uid);
|
||||
extern int find_new_gid (int sys_group, gid_t *gid, gid_t const *preferred_gid);
|
||||
|
||||
/* getlong.c */
|
||||
extern int getlong (const char *numstr, /*@out@*/long int *result);
|
||||
|
||||
/* get_pid.c */
|
||||
extern int get_pid (const char *pidstr, pid_t *pid);
|
||||
|
||||
/* getrange */
|
||||
extern int getrange (char *range,
|
||||
unsigned long *min, bool *has_min,
|
||||
unsigned long *max, bool *has_max);
|
||||
|
||||
/* gettime.c */
|
||||
extern time_t gettime ();
|
||||
|
||||
/* get_uid.c */
|
||||
extern int get_uid (const char *uidstr, uid_t *uid);
|
||||
|
||||
/* getulong.c */
|
||||
extern int getulong (const char *numstr, /*@out@*/unsigned long int *result);
|
||||
extern int getlong(const char *numstr, long int *result);
|
||||
|
||||
/* fputsx.c */
|
||||
extern /*@null@*/char *fgetsx (/*@returned@*/ /*@out@*/char *, int, FILE *);
|
||||
extern char *fgetsx (char *, int, FILE *);
|
||||
extern int fputsx (const char *, FILE *);
|
||||
|
||||
/* groupio.c */
|
||||
extern void __gr_del_entry (const struct commonio_entry *ent);
|
||||
extern /*@observer@*/const struct commonio_db *__gr_get_db (void);
|
||||
extern /*@dependent@*/ /*@null@*/struct commonio_entry *__gr_get_head (void);
|
||||
extern struct commonio_db *__gr_get_db (void);
|
||||
extern struct commonio_entry *__gr_get_head (void);
|
||||
extern void __gr_set_changed (void);
|
||||
|
||||
/* groupmem.c */
|
||||
extern /*@null@*/ /*@only@*/struct group *__gr_dup (const struct group *grent);
|
||||
extern void gr_free_members (struct group *grent);
|
||||
extern void gr_free (/*@out@*/ /*@only@*/struct group *grent);
|
||||
extern bool gr_append_member (struct group *grp, char *member);
|
||||
extern struct group *__gr_dup (const struct group *grent);
|
||||
|
||||
/* hushed.c */
|
||||
extern bool hushed (const char *username);
|
||||
extern int hushed (const struct passwd *);
|
||||
|
||||
/* audit_help.c */
|
||||
#ifdef WITH_AUDIT
|
||||
@@ -220,33 +128,25 @@ extern int audit_fd;
|
||||
extern void audit_help_open (void);
|
||||
/* Use AUDIT_NO_ID when a name is provided to audit_logger instead of an ID */
|
||||
#define AUDIT_NO_ID ((unsigned int) -1)
|
||||
typedef enum {
|
||||
SHADOW_AUDIT_FAILURE = 0,
|
||||
SHADOW_AUDIT_SUCCESS = 1} shadow_audit_result;
|
||||
extern void audit_logger (int type, const char *pgname, const char *op,
|
||||
const char *name, unsigned int id,
|
||||
shadow_audit_result result);
|
||||
void audit_logger_message (const char *message, shadow_audit_result result);
|
||||
const char *name, unsigned int id, int result);
|
||||
#endif
|
||||
|
||||
/* limits.c */
|
||||
#ifndef USE_PAM
|
||||
extern void setup_limits (const struct passwd *);
|
||||
#endif
|
||||
|
||||
/* list.c */
|
||||
extern /*@only@*/ /*@out@*/char **add_list (/*@returned@*/ /*@only@*/char **, const char *);
|
||||
extern /*@only@*/ /*@out@*/char **del_list (/*@returned@*/ /*@only@*/char **, const char *);
|
||||
extern /*@only@*/ /*@out@*/char **dup_list (char *const *);
|
||||
extern bool is_on_list (char *const *list, const char *member);
|
||||
extern /*@only@*/char **comma_to_list (const char *);
|
||||
extern char **add_list (char **, const char *);
|
||||
extern char **del_list (char **, const char *);
|
||||
extern char **dup_list (char *const *);
|
||||
extern int is_on_list (char *const *, const char *);
|
||||
extern char **comma_to_list (const char *);
|
||||
|
||||
/* log.c */
|
||||
extern void dolastlog (
|
||||
struct lastlog *ll,
|
||||
const struct passwd *pw,
|
||||
/*@unique@*/const char *line,
|
||||
/*@unique@*/const char *host);
|
||||
extern void dolastlog (struct lastlog *ll,
|
||||
const struct passwd *pw,
|
||||
const char *line,
|
||||
const char *host);
|
||||
|
||||
/* login_nopam.c */
|
||||
extern int login_access (const char *user, const char *from);
|
||||
@@ -261,108 +161,22 @@ extern void mailcheck (void);
|
||||
extern void motd (void);
|
||||
|
||||
/* myname.c */
|
||||
extern /*@null@*//*@only@*/struct passwd *get_my_pwent (void);
|
||||
|
||||
/* nss.c */
|
||||
#include <libsubid/subid.h>
|
||||
extern void nss_init(char *nsswitch_path);
|
||||
extern bool nss_is_initialized();
|
||||
|
||||
struct subid_nss_ops {
|
||||
/*
|
||||
* nss_has_range: does a user own a given subid range
|
||||
*
|
||||
* @owner: username
|
||||
* @start: first subid in queried range
|
||||
* @count: number of subids in queried range
|
||||
* @idtype: subuid or subgid
|
||||
* @result: true if @owner has been allocated the subid range.
|
||||
*
|
||||
* returns success if the module was able to determine an answer (true or false),
|
||||
* else an error status.
|
||||
*/
|
||||
enum subid_status (*has_range)(const char *owner, unsigned long start, unsigned long count, enum subid_type idtype, bool *result);
|
||||
|
||||
/*
|
||||
* nss_list_owner_ranges: list the subid ranges delegated to a user.
|
||||
*
|
||||
* @owner - string representing username being queried
|
||||
* @id_type - subuid or subgid
|
||||
* @ranges - pointer to an array of struct subid_range, or NULL. The
|
||||
* returned array must be freed by the caller.
|
||||
* @count - pointer to an integer into which the number of returned ranges
|
||||
* is written.
|
||||
|
||||
* returns success if the module was able to determine an answer,
|
||||
* else an error status.
|
||||
*/
|
||||
enum subid_status (*list_owner_ranges)(const char *owner, enum subid_type id_type, struct subid_range **ranges, int *count);
|
||||
|
||||
/*
|
||||
* nss_find_subid_owners: find uids who own a given subuid or subgid.
|
||||
*
|
||||
* @id - the delegated id (subuid or subgid) being queried
|
||||
* @id_type - subuid or subgid
|
||||
* @uids - pointer to an array of uids which will be allocated by
|
||||
* nss_find_subid_owners()
|
||||
* @count - number of uids found
|
||||
*
|
||||
* returns success if the module was able to determine an answer,
|
||||
* else an error status.
|
||||
*/
|
||||
enum subid_status (*find_subid_owners)(unsigned long id, enum subid_type id_type, uid_t **uids, int *count);
|
||||
|
||||
/* The dlsym handle to close */
|
||||
void *handle;
|
||||
};
|
||||
|
||||
extern struct subid_nss_ops *get_subid_nss_handle();
|
||||
|
||||
|
||||
/* pam_pass_non_interactive.c */
|
||||
#ifdef USE_PAM
|
||||
extern int do_pam_passwd_non_interactive (const char *pam_service,
|
||||
const char *username,
|
||||
const char* password);
|
||||
#endif /* USE_PAM */
|
||||
extern struct passwd *get_my_pwent (void);
|
||||
|
||||
/* obscure.c */
|
||||
#ifndef USE_PAM
|
||||
extern bool obscure (const char *, const char *, const struct passwd *);
|
||||
#endif
|
||||
extern int obscure (const char *, const char *, const struct passwd *);
|
||||
|
||||
/* pam_pass.c */
|
||||
#ifdef USE_PAM
|
||||
extern void do_pam_passwd (const char *user, bool silent, bool change_expired);
|
||||
#endif
|
||||
extern void do_pam_passwd (const char *, int, int);
|
||||
|
||||
/* port.c */
|
||||
extern bool isttytime (const char *, const char *, time_t);
|
||||
|
||||
/* prefix_flag.c */
|
||||
extern const char* process_prefix_flag (const char* short_opt, int argc, char **argv);
|
||||
extern struct group *prefix_getgrnam(const char *name);
|
||||
extern struct group *prefix_getgrgid(gid_t gid);
|
||||
extern struct passwd *prefix_getpwuid(uid_t uid);
|
||||
extern struct passwd *prefix_getpwnam(const char* name);
|
||||
extern struct spwd *prefix_getspnam(const char* name);
|
||||
extern struct group *prefix_getgr_nam_gid(const char *grname);
|
||||
extern void prefix_setpwent();
|
||||
extern struct passwd* prefix_getpwent();
|
||||
extern void prefix_endpwent();
|
||||
extern void prefix_setgrent();
|
||||
extern struct group* prefix_getgrent();
|
||||
extern void prefix_endgrent();
|
||||
extern int isttytime (const char *, const char *, time_t);
|
||||
|
||||
/* pwd2spwd.c */
|
||||
#ifndef USE_PAM
|
||||
extern struct spwd *pwd_to_spwd (const struct passwd *);
|
||||
#endif
|
||||
|
||||
/* pwdcheck.c */
|
||||
#ifndef USE_PAM
|
||||
extern void passwd_check (const char *, const char *, const char *);
|
||||
#endif
|
||||
|
||||
/* pwd_init.c */
|
||||
extern void pwd_init (void);
|
||||
@@ -370,46 +184,21 @@ extern void pwd_init (void);
|
||||
/* pwio.c */
|
||||
extern void __pw_del_entry (const struct commonio_entry *ent);
|
||||
extern struct commonio_db *__pw_get_db (void);
|
||||
extern /*@dependent@*/ /*@null@*/struct commonio_entry *__pw_get_head (void);
|
||||
extern struct commonio_entry *__pw_get_head (void);
|
||||
|
||||
/* pwmem.c */
|
||||
extern /*@null@*/ /*@only@*/struct passwd *__pw_dup (const struct passwd *pwent);
|
||||
extern void pw_free (/*@out@*/ /*@only@*/struct passwd *pwent);
|
||||
|
||||
/* remove_tree.c */
|
||||
extern int remove_tree (const char *root, bool remove_root);
|
||||
extern struct passwd *__pw_dup (const struct passwd *pwent);
|
||||
|
||||
/* rlogin.c */
|
||||
extern int do_rlogin (const char *remote_host, char *name, size_t namelen,
|
||||
char *term, size_t termlen);
|
||||
|
||||
/* root_flag.c */
|
||||
extern void process_root_flag (const char* short_opt, int argc, char **argv);
|
||||
extern int do_rlogin (const char *, char *, int, char *, int);
|
||||
|
||||
/* salt.c */
|
||||
extern /*@observer@*/const char *crypt_make_salt (/*@null@*//*@observer@*/const char *meth, /*@null@*/void *arg);
|
||||
|
||||
/* selinux.c */
|
||||
#ifdef WITH_SELINUX
|
||||
extern int set_selinux_file_context (const char *dst_name, mode_t mode);
|
||||
extern int reset_selinux_file_context (void);
|
||||
extern int check_selinux_permit (const char *perm_name);
|
||||
#endif
|
||||
|
||||
/* semanage.c */
|
||||
#ifdef WITH_SELINUX
|
||||
extern int set_seuser(const char *login_name, const char *seuser_name);
|
||||
extern int del_seuser(const char *login_name);
|
||||
#endif
|
||||
extern char *crypt_make_salt (const char *meth, void *arg);
|
||||
|
||||
/* setugid.c */
|
||||
extern int setup_groups (const struct passwd *info);
|
||||
extern int change_uid (const struct passwd *info);
|
||||
#if (defined HAVE_INITGROUPS) && (! defined USE_PAM)
|
||||
extern int setup_uid_gid (const struct passwd *info, bool is_console);
|
||||
#else
|
||||
extern int setup_uid_gid (const struct passwd *info);
|
||||
#endif
|
||||
extern int setup_groups (const struct passwd *);
|
||||
extern int change_uid (const struct passwd *);
|
||||
extern int setup_uid_gid (const struct passwd *, int);
|
||||
|
||||
/* setup.c */
|
||||
extern void setup (struct passwd *);
|
||||
@@ -423,46 +212,30 @@ extern struct group *sgetgrent (const char *buf);
|
||||
/* sgetpwent.c */
|
||||
extern struct passwd *sgetpwent (const char *buf);
|
||||
|
||||
/* sgetspent.c */
|
||||
#ifndef HAVE_SGETSPENT
|
||||
extern struct spwd *sgetspent (const char *string);
|
||||
#endif
|
||||
|
||||
/* sgroupio.c */
|
||||
extern void __sgr_del_entry (const struct commonio_entry *ent);
|
||||
extern /*@null@*/ /*@only@*/struct sgrp *__sgr_dup (const struct sgrp *sgent);
|
||||
extern void sgr_free (/*@out@*/ /*@only@*/struct sgrp *sgent);
|
||||
extern /*@dependent@*/ /*@null@*/struct commonio_entry *__sgr_get_head (void);
|
||||
extern struct sgrp *__sgr_dup (const struct sgrp *sgent);
|
||||
extern struct commonio_entry *__sgr_get_head (void);
|
||||
extern void __sgr_set_changed (void);
|
||||
|
||||
/* shadowio.c */
|
||||
extern /*@dependent@*/ /*@null@*/struct commonio_entry *__spw_get_head (void);
|
||||
extern struct commonio_entry *__spw_get_head (void);
|
||||
extern void __spw_del_entry (const struct commonio_entry *ent);
|
||||
|
||||
/* shadowmem.c */
|
||||
extern /*@null@*/ /*@only@*/struct spwd *__spw_dup (const struct spwd *spent);
|
||||
extern void spw_free (/*@out@*/ /*@only@*/struct spwd *spent);
|
||||
extern struct spwd *__spw_dup (const struct spwd *spent);
|
||||
|
||||
/* shell.c */
|
||||
extern int shell (const char *file, /*@null@*/const char *arg, char *const envp[]);
|
||||
|
||||
/* spawn.c */
|
||||
extern int run_command (const char *cmd, const char *argv[],
|
||||
/*@null@*/const char *envp[], /*@out@*/int *status);
|
||||
extern int shell (const char *, const char *, char *const *);
|
||||
|
||||
/* strtoday.c */
|
||||
extern long strtoday (const char *);
|
||||
|
||||
/* suauth.c */
|
||||
extern int check_su_auth (const char *actual_id,
|
||||
const char *wanted_id,
|
||||
bool su_to_root);
|
||||
extern int check_su_auth (const char *actual_id, const char *wanted_id);
|
||||
|
||||
/* sulog.c */
|
||||
extern void sulog (const char *tty,
|
||||
bool success,
|
||||
const char *oldname,
|
||||
const char *name);
|
||||
extern void sulog (const char *, int, const char *, const char *);
|
||||
|
||||
/* sub.c */
|
||||
extern void subsystem (const struct passwd *);
|
||||
@@ -471,54 +244,34 @@ extern void subsystem (const struct passwd *);
|
||||
extern void ttytype (const char *);
|
||||
|
||||
/* tz.c */
|
||||
#ifndef USE_PAM
|
||||
extern /*@observer@*/const char *tz (const char *);
|
||||
#endif
|
||||
extern char *tz (const char *);
|
||||
|
||||
/* ulimit.c */
|
||||
extern int set_filesize_limit (int blocks);
|
||||
|
||||
/* user_busy.c */
|
||||
extern int user_busy (const char *name, uid_t uid);
|
||||
extern void set_filesize_limit (int);
|
||||
|
||||
/* utmp.c */
|
||||
#ifndef USE_UTMPX
|
||||
extern /*@null@*/struct utmp *get_current_utmp (void);
|
||||
extern struct utmp *prepare_utmp (const char *name,
|
||||
const char *line,
|
||||
const char *host,
|
||||
/*@null@*/const struct utmp *ut);
|
||||
extern int setutmp (struct utmp *ut);
|
||||
#else
|
||||
extern /*@null@*/struct utmpx *get_current_utmp (void);
|
||||
extern struct utmpx *prepare_utmpx (const char *name,
|
||||
const char *line,
|
||||
const char *host,
|
||||
/*@null@*/const struct utmpx *ut);
|
||||
extern int setutmpx (struct utmpx *utx);
|
||||
#endif /* USE_UTMPX */
|
||||
extern void checkutmp (int);
|
||||
extern void setutmp (const char *, const char *, const char *);
|
||||
|
||||
/* valid.c */
|
||||
extern bool valid (const char *, const struct passwd *);
|
||||
extern int valid (const char *, const struct passwd *);
|
||||
|
||||
/* xmalloc.c */
|
||||
extern /*@maynotreturn@*/ /*@only@*//*@out@*//*@notnull@*/char *xmalloc (size_t size)
|
||||
/*@ensures MaxSet(result) == (size - 1); @*/;
|
||||
extern /*@maynotreturn@*/ /*@only@*//*@notnull@*/char *xstrdup (const char *);
|
||||
extern void xfree(void *ap);
|
||||
extern char *xmalloc (size_t);
|
||||
extern char *xstrdup (const char *);
|
||||
|
||||
/* xgetpwnam.c */
|
||||
extern /*@null@*/ /*@only@*/struct passwd *xgetpwnam (const char *);
|
||||
extern struct passwd *xgetpwnam (const char *);
|
||||
/* xgetpwuid.c */
|
||||
extern /*@null@*/ /*@only@*/struct passwd *xgetpwuid (uid_t);
|
||||
extern struct passwd *xgetpwuid (uid_t);
|
||||
/* xgetgrnam.c */
|
||||
extern /*@null@*/ /*@only@*/struct group *xgetgrnam (const char *);
|
||||
extern struct group *xgetgrnam (const char *);
|
||||
/* xgetgrgid.c */
|
||||
extern /*@null@*/ /*@only@*/struct group *xgetgrgid (gid_t);
|
||||
extern struct group *xgetgrgid (gid_t);
|
||||
/* xgetspnam.c */
|
||||
extern /*@null@*/ /*@only@*/struct spwd *xgetspnam(const char *);
|
||||
extern struct spwd *xgetspnam(const char *);
|
||||
|
||||
/* yesno.c */
|
||||
extern bool yes_or_no (bool read_only);
|
||||
extern int yes_or_no (int read_only);
|
||||
|
||||
#endif /* _PROTOTYPES_H */
|
||||
|
||||
65
lib/pwauth.c
65
lib/pwauth.c
@@ -2,7 +2,7 @@
|
||||
* Copyright (c) 1992 - 1994, Julianne Frances Haugh
|
||||
* Copyright (c) 1996 - 2000, Marek Michałkiewicz
|
||||
* Copyright (c) 2003 - 2006, Tomasz Kłoczko
|
||||
* Copyright (c) 2008 - 2009, Nicolas François
|
||||
* Copyright (c) 2008 , Nicolas François
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
@@ -54,8 +54,8 @@ static const char *PROMPT = gettext_noop ("Password: ");
|
||||
static const char *PROMPT = gettext_noop ("%s's Password: ");
|
||||
#endif
|
||||
|
||||
bool wipe_clear_pass = true;
|
||||
/*@null@*/char *clear_pass = NULL;
|
||||
int wipe_clear_pass = 1;
|
||||
char *clear_pass = NULL;
|
||||
|
||||
/*
|
||||
* pw_auth - perform getpass/crypt authentication
|
||||
@@ -65,19 +65,16 @@ bool wipe_clear_pass = true;
|
||||
* compared.
|
||||
*/
|
||||
|
||||
int pw_auth (const char *cipher,
|
||||
const char *user,
|
||||
int reason,
|
||||
/*@null@*/const char *input)
|
||||
int
|
||||
pw_auth (const char *cipher, const char *user, int reason, const char *input)
|
||||
{
|
||||
char prompt[1024];
|
||||
char *clear = NULL;
|
||||
const char *cp;
|
||||
const char *encrypted;
|
||||
int retval;
|
||||
|
||||
#ifdef SKEY
|
||||
bool use_skey = false;
|
||||
int use_skey = 0;
|
||||
char challenge_info[40];
|
||||
struct skey skey;
|
||||
#endif
|
||||
@@ -86,17 +83,15 @@ int pw_auth (const char *cipher,
|
||||
* There are programs for adding and deleting authentication data.
|
||||
*/
|
||||
|
||||
if ((PW_ADD == reason) || (PW_DELETE == reason)) {
|
||||
if (reason == PW_ADD || reason == PW_DELETE)
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* There are even programs for changing the user name ...
|
||||
*/
|
||||
|
||||
if ((PW_CHANGE == reason) && (NULL != input)) {
|
||||
if (reason == PW_CHANGE && input != (char *) 0)
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* WARNING:
|
||||
@@ -107,9 +102,8 @@ int pw_auth (const char *cipher,
|
||||
* revisited.
|
||||
*/
|
||||
|
||||
if ((PW_CHANGE == reason) && (getuid () == 0)) {
|
||||
if (reason == PW_CHANGE && getuid () == 0)
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* WARNING:
|
||||
@@ -120,9 +114,8 @@ int pw_auth (const char *cipher,
|
||||
* matter.
|
||||
*/
|
||||
|
||||
if ((NULL == cipher) || ('\0' == *cipher)) {
|
||||
if (cipher == (char *) 0 || *cipher == '\0')
|
||||
return 0;
|
||||
}
|
||||
|
||||
#ifdef SKEY
|
||||
/*
|
||||
@@ -139,9 +132,8 @@ int pw_auth (const char *cipher,
|
||||
# define skeychallenge(s,u,c) skeychallenge(s,u,c,sizeof(c))
|
||||
# endif
|
||||
|
||||
if (skeychallenge (&skey, user, challenge_info) == 0) {
|
||||
use_skey = true;
|
||||
}
|
||||
if (skeychallenge (&skey, user, challenge_info) == 0)
|
||||
use_skey = 1;
|
||||
#endif
|
||||
|
||||
/*
|
||||
@@ -149,20 +141,17 @@ int pw_auth (const char *cipher,
|
||||
* get the cleartext password for us.
|
||||
*/
|
||||
|
||||
if ((PW_FTP != reason) && (PW_REXEC != reason) && (NULL == input)) {
|
||||
cp = getdef_str ("LOGIN_STRING");
|
||||
if (NULL == cp) {
|
||||
if (reason != PW_FTP && reason != PW_REXEC && !input) {
|
||||
if (!(cp = getdef_str ("LOGIN_STRING")))
|
||||
cp = _(PROMPT);
|
||||
}
|
||||
#ifdef SKEY
|
||||
if (use_skey) {
|
||||
if (use_skey)
|
||||
printf ("[%s]\n", challenge_info);
|
||||
}
|
||||
#endif
|
||||
|
||||
snprintf (prompt, sizeof prompt, cp, user);
|
||||
clear = getpass (prompt);
|
||||
if (NULL == clear) {
|
||||
if (!clear) {
|
||||
static char c[1];
|
||||
|
||||
c[0] = '\0';
|
||||
@@ -178,12 +167,7 @@ int pw_auth (const char *cipher,
|
||||
* the results there as well.
|
||||
*/
|
||||
|
||||
encrypted = pw_encrypt (input, cipher);
|
||||
if (NULL != encrypted) {
|
||||
retval = strcmp (encrypted, cipher);
|
||||
} else {
|
||||
retval = -1;
|
||||
}
|
||||
retval = strcmp (pw_encrypt (input, cipher), cipher);
|
||||
|
||||
#ifdef SKEY
|
||||
/*
|
||||
@@ -193,9 +177,9 @@ int pw_auth (const char *cipher,
|
||||
* ...Re-prompt, with echo on.
|
||||
* -- AR 8/22/1999
|
||||
*/
|
||||
if ((0 != retval) && ('\0' == input[0]) && use_skey) {
|
||||
if (retval && !input[0] && (use_skey)) {
|
||||
clear = getpass (prompt);
|
||||
if (NULL == clear) {
|
||||
if (!clear) {
|
||||
static char c[1];
|
||||
|
||||
c[0] = '\0';
|
||||
@@ -204,15 +188,13 @@ int pw_auth (const char *cipher,
|
||||
input = clear;
|
||||
}
|
||||
|
||||
if ((0 != retval) && use_skey) {
|
||||
if (retval && use_skey) {
|
||||
int passcheck = -1;
|
||||
|
||||
if (skeyverify (&skey, input) == 0) {
|
||||
if (skeyverify (&skey, input) == 0)
|
||||
passcheck = skey.n;
|
||||
}
|
||||
if (passcheck > 0) {
|
||||
if (passcheck > 0)
|
||||
retval = 0;
|
||||
}
|
||||
}
|
||||
#endif
|
||||
|
||||
@@ -224,9 +206,8 @@ int pw_auth (const char *cipher,
|
||||
*/
|
||||
|
||||
clear_pass = clear;
|
||||
if (wipe_clear_pass && (NULL != clear) && ('\0' != *clear)) {
|
||||
if (wipe_clear_pass && clear && *clear)
|
||||
strzero (clear);
|
||||
}
|
||||
return retval;
|
||||
}
|
||||
#else /* !USE_PAM */
|
||||
|
||||
@@ -2,7 +2,6 @@
|
||||
* Copyright (c) 1992 - 1993, Julianne Frances Haugh
|
||||
* Copyright (c) 1996 - 1997, Marek Michałkiewicz
|
||||
* Copyright (c) 2003 - 2005, Tomasz Kłoczko
|
||||
* Copyright (c) 2009 , Nicolas François
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
@@ -35,10 +34,7 @@
|
||||
*/
|
||||
|
||||
#ifndef USE_PAM
|
||||
int pw_auth (const char *cipher,
|
||||
const char *user,
|
||||
int flag,
|
||||
/*@null@*/const char *input);
|
||||
int pw_auth (const char *cipher, const char *user, int flag, const char *input);
|
||||
#endif /* !USE_PAM */
|
||||
|
||||
/*
|
||||
|
||||
51
lib/pwio.c
51
lib/pwio.c
@@ -3,7 +3,7 @@
|
||||
* Copyright (c) 1996 - 2000, Marek Michałkiewicz
|
||||
* Copyright (c) 2001 , Michał Moskal
|
||||
* Copyright (c) 2003 - 2005, Tomasz Kłoczko
|
||||
* Copyright (c) 2007 - 2009, Nicolas François
|
||||
* Copyright (c) 2007 - 2008, Nicolas François
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
@@ -42,18 +42,23 @@
|
||||
#include "commonio.h"
|
||||
#include "pwio.h"
|
||||
|
||||
static /*@null@*/ /*@only@*/void *passwd_dup (const void *ent)
|
||||
static void *passwd_dup (const void *ent)
|
||||
{
|
||||
const struct passwd *pw = ent;
|
||||
|
||||
return __pw_dup (pw);
|
||||
}
|
||||
|
||||
static void passwd_free (/*@out@*/ /*@only@*/void *ent)
|
||||
static void passwd_free (void *ent)
|
||||
{
|
||||
struct passwd *pw = ent;
|
||||
|
||||
pw_free (pw);
|
||||
free (pw->pw_name);
|
||||
free (pw->pw_passwd);
|
||||
free (pw->pw_gecos);
|
||||
free (pw->pw_dir);
|
||||
free (pw->pw_shell);
|
||||
free (pw);
|
||||
}
|
||||
|
||||
static const char *passwd_getname (const void *ent)
|
||||
@@ -72,17 +77,6 @@ static int passwd_put (const void *ent, FILE * file)
|
||||
{
|
||||
const struct passwd *pw = ent;
|
||||
|
||||
if ( (NULL == pw)
|
||||
|| (valid_field (pw->pw_name, ":\n") == -1)
|
||||
|| (valid_field (pw->pw_passwd, ":\n") == -1)
|
||||
|| (pw->pw_uid == (uid_t)-1)
|
||||
|| (pw->pw_gid == (gid_t)-1)
|
||||
|| (valid_field (pw->pw_gecos, ":\n") == -1)
|
||||
|| (valid_field (pw->pw_dir, ":\n") == -1)
|
||||
|| (valid_field (pw->pw_shell, ":\n") == -1)) {
|
||||
return -1;
|
||||
}
|
||||
|
||||
return (putpwent (pw, file) == -1) ? -1 : 0;
|
||||
}
|
||||
|
||||
@@ -105,29 +99,20 @@ static struct commonio_db passwd_db = {
|
||||
#ifdef WITH_SELINUX
|
||||
NULL, /* scontext */
|
||||
#endif
|
||||
0644, /* st_mode */
|
||||
0, /* st_uid */
|
||||
0, /* st_gid */
|
||||
NULL, /* head */
|
||||
NULL, /* tail */
|
||||
NULL, /* cursor */
|
||||
false, /* changed */
|
||||
false, /* isopen */
|
||||
false, /* locked */
|
||||
false, /* readonly */
|
||||
false /* setname */
|
||||
0, /* changed */
|
||||
0, /* isopen */
|
||||
0, /* locked */
|
||||
0 /* readonly */
|
||||
};
|
||||
|
||||
int pw_setdbname (const char *filename)
|
||||
int pw_name (const char *filename)
|
||||
{
|
||||
return commonio_setname (&passwd_db, filename);
|
||||
}
|
||||
|
||||
/*@observer@*/const char *pw_dbname (void)
|
||||
{
|
||||
return passwd_db.filename;
|
||||
}
|
||||
|
||||
int pw_lock (void)
|
||||
{
|
||||
return commonio_lock (&passwd_db);
|
||||
@@ -138,12 +123,12 @@ int pw_open (int mode)
|
||||
return commonio_open (&passwd_db, mode);
|
||||
}
|
||||
|
||||
/*@observer@*/ /*@null@*/const struct passwd *pw_locate (const char *name)
|
||||
const struct passwd *pw_locate (const char *name)
|
||||
{
|
||||
return commonio_locate (&passwd_db, name);
|
||||
}
|
||||
|
||||
/*@observer@*/ /*@null@*/const struct passwd *pw_locate_uid (uid_t uid)
|
||||
const struct passwd *pw_locate_uid (uid_t uid)
|
||||
{
|
||||
const struct passwd *pwd;
|
||||
|
||||
@@ -170,7 +155,7 @@ int pw_rewind (void)
|
||||
return commonio_rewind (&passwd_db);
|
||||
}
|
||||
|
||||
/*@observer@*/ /*@null@*/const struct passwd *pw_next (void)
|
||||
const struct passwd *pw_next (void)
|
||||
{
|
||||
return commonio_next (&passwd_db);
|
||||
}
|
||||
@@ -185,7 +170,7 @@ int pw_unlock (void)
|
||||
return commonio_unlock (&passwd_db);
|
||||
}
|
||||
|
||||
/*@null@*/struct commonio_entry *__pw_get_head (void)
|
||||
struct commonio_entry *__pw_get_head (void)
|
||||
{
|
||||
return passwd_db.head;
|
||||
}
|
||||
|
||||
22
lib/pwio.h
22
lib/pwio.h
@@ -31,25 +31,17 @@
|
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
/* $Id$ */
|
||||
#ifndef _PWIO_H
|
||||
#define _PWIO_H
|
||||
|
||||
#include <sys/types.h>
|
||||
#include <pwd.h>
|
||||
|
||||
extern int pw_close (void);
|
||||
extern /*@observer@*/ /*@null@*/const struct passwd *pw_locate (const char *name);
|
||||
extern /*@observer@*/ /*@null@*/const struct passwd *pw_locate_uid (uid_t uid);
|
||||
extern const struct passwd *pw_locate (const char *);
|
||||
extern const struct passwd *pw_locate_uid (uid_t uid);
|
||||
extern int pw_lock (void);
|
||||
extern int pw_setdbname (const char *filename);
|
||||
extern /*@observer@*/const char *pw_dbname (void);
|
||||
extern /*@observer@*/ /*@null@*/const struct passwd *pw_next (void);
|
||||
extern int pw_open (int mode);
|
||||
extern int pw_remove (const char *name);
|
||||
extern int pw_name (const char *);
|
||||
extern const struct passwd *pw_next (void);
|
||||
extern int pw_open (int);
|
||||
extern int pw_remove (const char *);
|
||||
extern int pw_rewind (void);
|
||||
extern int pw_unlock (void);
|
||||
extern int pw_update (const struct passwd *pw);
|
||||
extern int pw_update (const struct passwd *);
|
||||
extern int pw_sort (void);
|
||||
|
||||
#endif
|
||||
|
||||
67
lib/pwmem.c
67
lib/pwmem.c
@@ -3,7 +3,7 @@
|
||||
* Copyright (c) 1996 - 2000, Marek Michałkiewicz
|
||||
* Copyright (c) 2001 , Michał Moskal
|
||||
* Copyright (c) 2003 - 2005, Tomasz Kłoczko
|
||||
* Copyright (c) 2007 - 2013, Nicolas François
|
||||
* Copyright (c) 2007 , Nicolas François
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
@@ -35,72 +35,29 @@
|
||||
|
||||
#ident "$Id$"
|
||||
|
||||
#include <stdio.h>
|
||||
#include "defines.h"
|
||||
#include "prototypes.h"
|
||||
#include "defines.h"
|
||||
#include <pwd.h>
|
||||
#include <stdio.h>
|
||||
#include "pwio.h"
|
||||
|
||||
/*@null@*/ /*@only@*/struct passwd *__pw_dup (const struct passwd *pwent)
|
||||
struct passwd *__pw_dup (const struct passwd *pwent)
|
||||
{
|
||||
struct passwd *pw;
|
||||
|
||||
pw = (struct passwd *) malloc (sizeof *pw);
|
||||
if (NULL == pw) {
|
||||
if (!(pw = (struct passwd *) malloc (sizeof *pw)))
|
||||
return NULL;
|
||||
}
|
||||
/* The libc might define other fields. They won't be copied. */
|
||||
memset (pw, 0, sizeof *pw);
|
||||
pw->pw_uid = pwent->pw_uid;
|
||||
pw->pw_gid = pwent->pw_gid;
|
||||
/*@-mustfreeonly@*/
|
||||
pw->pw_name = strdup (pwent->pw_name);
|
||||
/*@=mustfreeonly@*/
|
||||
if (NULL == pw->pw_name) {
|
||||
pw_free(pw);
|
||||
*pw = *pwent;
|
||||
if (!(pw->pw_name = strdup (pwent->pw_name)))
|
||||
return NULL;
|
||||
}
|
||||
/*@-mustfreeonly@*/
|
||||
pw->pw_passwd = strdup (pwent->pw_passwd);
|
||||
/*@=mustfreeonly@*/
|
||||
if (NULL == pw->pw_passwd) {
|
||||
pw_free(pw);
|
||||
if (!(pw->pw_passwd = strdup (pwent->pw_passwd)))
|
||||
return NULL;
|
||||
}
|
||||
/*@-mustfreeonly@*/
|
||||
pw->pw_gecos = strdup (pwent->pw_gecos);
|
||||
/*@=mustfreeonly@*/
|
||||
if (NULL == pw->pw_gecos) {
|
||||
pw_free(pw);
|
||||
if (!(pw->pw_gecos = strdup (pwent->pw_gecos)))
|
||||
return NULL;
|
||||
}
|
||||
/*@-mustfreeonly@*/
|
||||
pw->pw_dir = strdup (pwent->pw_dir);
|
||||
/*@=mustfreeonly@*/
|
||||
if (NULL == pw->pw_dir) {
|
||||
pw_free(pw);
|
||||
if (!(pw->pw_dir = strdup (pwent->pw_dir)))
|
||||
return NULL;
|
||||
}
|
||||
/*@-mustfreeonly@*/
|
||||
pw->pw_shell = strdup (pwent->pw_shell);
|
||||
/*@=mustfreeonly@*/
|
||||
if (NULL == pw->pw_shell) {
|
||||
pw_free(pw);
|
||||
if (!(pw->pw_shell = strdup (pwent->pw_shell)))
|
||||
return NULL;
|
||||
}
|
||||
|
||||
return pw;
|
||||
}
|
||||
|
||||
void pw_free (/*@out@*/ /*@only@*/struct passwd *pwent)
|
||||
{
|
||||
free (pwent->pw_name);
|
||||
if (pwent->pw_passwd) {
|
||||
memzero (pwent->pw_passwd, strlen (pwent->pw_passwd));
|
||||
free (pwent->pw_passwd);
|
||||
}
|
||||
free (pwent->pw_gecos);
|
||||
free (pwent->pw_dir);
|
||||
free (pwent->pw_shell);
|
||||
free (pwent);
|
||||
}
|
||||
|
||||
|
||||
102
lib/run_part.c
102
lib/run_part.c
@@ -1,102 +0,0 @@
|
||||
#include <dirent.h>
|
||||
#include <errno.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <sys/stat.h>
|
||||
#include <sys/types.h>
|
||||
#include <sys/wait.h>
|
||||
#include <unistd.h>
|
||||
#include <lib/prototypes.h>
|
||||
|
||||
int run_part (char *script_path, char *name, char *action)
|
||||
{
|
||||
int pid;
|
||||
int wait_status;
|
||||
int pid_status;
|
||||
char *args[] = { script_path, NULL };
|
||||
|
||||
pid=fork();
|
||||
if (pid==-1){
|
||||
perror ("Could not fork");
|
||||
return 1;
|
||||
}
|
||||
if (pid==0) {
|
||||
setenv ("ACTION",action,1);
|
||||
setenv ("SUBJECT",name,1);
|
||||
execv (script_path,args);
|
||||
perror ("execv");
|
||||
exit(1);
|
||||
}
|
||||
|
||||
pid_status = wait (&wait_status);
|
||||
if (pid_status == pid) {
|
||||
return (wait_status);
|
||||
}
|
||||
|
||||
perror ("waitpid");
|
||||
return (1);
|
||||
}
|
||||
|
||||
int run_parts (char *directory, char *name, char *action)
|
||||
{
|
||||
struct dirent **namelist;
|
||||
int scanlist;
|
||||
int n;
|
||||
int execute_result;
|
||||
|
||||
scanlist = scandir (directory, &namelist, 0, alphasort);
|
||||
if (scanlist<0) {
|
||||
return (0);
|
||||
}
|
||||
|
||||
for (n=0; n<scanlist; n++) {
|
||||
int path_length;
|
||||
struct stat sb;
|
||||
|
||||
path_length=strlen(directory) + strlen(namelist[n]->d_name) + 2;
|
||||
char *s = (char*)malloc(path_length);
|
||||
if (!s) {
|
||||
printf ("could not allocate memory\n");
|
||||
for (; n<scanlist; n++) {
|
||||
free (namelist[n]);
|
||||
}
|
||||
free (namelist);
|
||||
return (1);
|
||||
}
|
||||
snprintf (s, path_length, "%s/%s", directory, namelist[n]->d_name);
|
||||
|
||||
execute_result = 0;
|
||||
if (stat (s, &sb) == -1) {
|
||||
perror ("stat");
|
||||
free (s);
|
||||
for (; n<scanlist; n++) {
|
||||
free (namelist[n]);
|
||||
}
|
||||
free (namelist);
|
||||
return (1);
|
||||
}
|
||||
|
||||
if (S_ISREG (sb.st_mode) || S_ISLNK (sb.st_mode)) {
|
||||
execute_result = run_part (s, name, action);
|
||||
}
|
||||
|
||||
free (s);
|
||||
|
||||
if (execute_result!=0) {
|
||||
fprintf (shadow_logfd,
|
||||
"%s: did not exit cleanly.\n",
|
||||
namelist[n]->d_name);
|
||||
for (; n<scanlist; n++) {
|
||||
free (namelist[n]);
|
||||
}
|
||||
break;
|
||||
}
|
||||
|
||||
free (namelist[n]);
|
||||
}
|
||||
free (namelist);
|
||||
|
||||
return (execute_result);
|
||||
}
|
||||
|
||||
@@ -1,2 +0,0 @@
|
||||
int run_part (char *script_path, char *name, char *action);
|
||||
int run_parts (char *directory, char *name, char *action);
|
||||
226
lib/selinux.c
226
lib/selinux.c
@@ -1,226 +0,0 @@
|
||||
/*
|
||||
* Copyright (c) 2011 , Peter Vrabec <pvrabec@redhat.com>
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. The name of the copyright holders or contributors may not be used to
|
||||
* endorse or promote products derived from this software without
|
||||
* specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
|
||||
* PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
* HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include <config.h>
|
||||
|
||||
#ifdef WITH_SELINUX
|
||||
|
||||
#include <stdio.h>
|
||||
#include "defines.h"
|
||||
|
||||
#include <selinux/selinux.h>
|
||||
#include <selinux/label.h>
|
||||
#include "prototypes.h"
|
||||
|
||||
static bool selinux_checked = false;
|
||||
static bool selinux_enabled;
|
||||
static /*@null@*/struct selabel_handle *selabel_hnd = NULL;
|
||||
|
||||
static void cleanup(void)
|
||||
{
|
||||
if (selabel_hnd) {
|
||||
selabel_close(selabel_hnd);
|
||||
selabel_hnd = NULL;
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* set_selinux_file_context - Set the security context before any file or
|
||||
* directory creation.
|
||||
*
|
||||
* set_selinux_file_context () should be called before any creation
|
||||
* of file, symlink, directory, ...
|
||||
*
|
||||
* Callers may have to Reset SELinux to create files with default
|
||||
* contexts with reset_selinux_file_context
|
||||
*/
|
||||
int set_selinux_file_context (const char *dst_name, mode_t mode)
|
||||
{
|
||||
if (!selinux_checked) {
|
||||
selinux_enabled = is_selinux_enabled () > 0;
|
||||
selinux_checked = true;
|
||||
}
|
||||
|
||||
if (selinux_enabled) {
|
||||
/* Get the default security context for this file */
|
||||
|
||||
/*@null@*/char *fcontext_raw = NULL;
|
||||
int r;
|
||||
|
||||
if (selabel_hnd == NULL) {
|
||||
selabel_hnd = selabel_open(SELABEL_CTX_FILE, NULL, 0);
|
||||
if (selabel_hnd == NULL) {
|
||||
return security_getenforce () != 0;
|
||||
}
|
||||
(void) atexit(cleanup);
|
||||
}
|
||||
|
||||
r = selabel_lookup_raw(selabel_hnd, &fcontext_raw, dst_name, mode);
|
||||
if (r < 0) {
|
||||
/* No context specified for the searched path */
|
||||
if (errno == ENOENT) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
return security_getenforce () != 0;
|
||||
}
|
||||
|
||||
/* Set the security context for the next created file */
|
||||
r = setfscreatecon_raw (fcontext_raw);
|
||||
freecon (fcontext_raw);
|
||||
if (r < 0) {
|
||||
return security_getenforce () != 0;
|
||||
}
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* reset_selinux_file_context - Reset the security context to the default
|
||||
* policy behavior
|
||||
*
|
||||
* reset_selinux_file_context () should be called after the context
|
||||
* was changed with set_selinux_file_context ()
|
||||
*/
|
||||
int reset_selinux_file_context (void)
|
||||
{
|
||||
if (!selinux_checked) {
|
||||
selinux_enabled = is_selinux_enabled () > 0;
|
||||
selinux_checked = true;
|
||||
}
|
||||
if (selinux_enabled) {
|
||||
if (setfscreatecon_raw (NULL) != 0) {
|
||||
return security_getenforce () != 0;
|
||||
}
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* Log callback for libselinux internal error reporting.
|
||||
*/
|
||||
__attribute__((__format__ (printf, 2, 3)))
|
||||
static int selinux_log_cb (int type, const char *fmt, ...) {
|
||||
va_list ap;
|
||||
char *buf;
|
||||
int r;
|
||||
#ifdef WITH_AUDIT
|
||||
static int selinux_audit_fd = -2;
|
||||
#endif
|
||||
|
||||
va_start (ap, fmt);
|
||||
r = vasprintf (&buf, fmt, ap);
|
||||
va_end (ap);
|
||||
|
||||
if (r < 0) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
#ifdef WITH_AUDIT
|
||||
if (-2 == selinux_audit_fd) {
|
||||
selinux_audit_fd = audit_open ();
|
||||
|
||||
if (-1 == selinux_audit_fd) {
|
||||
/* You get these only when the kernel doesn't have
|
||||
* audit compiled in. */
|
||||
if ( (errno != EINVAL)
|
||||
&& (errno != EPROTONOSUPPORT)
|
||||
&& (errno != EAFNOSUPPORT)) {
|
||||
|
||||
(void) fputs (_("Cannot open audit interface.\n"),
|
||||
shadow_logfd);
|
||||
SYSLOG ((LOG_WARN, "Cannot open audit interface."));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (-1 != selinux_audit_fd) {
|
||||
if (SELINUX_AVC == type) {
|
||||
if (audit_log_user_avc_message (selinux_audit_fd,
|
||||
AUDIT_USER_AVC, buf, NULL, NULL,
|
||||
NULL, 0) > 0) {
|
||||
goto skip_syslog;
|
||||
}
|
||||
} else if (SELINUX_ERROR == type) {
|
||||
if (audit_log_user_avc_message (selinux_audit_fd,
|
||||
AUDIT_USER_SELINUX_ERR, buf, NULL, NULL,
|
||||
NULL, 0) > 0) {
|
||||
goto skip_syslog;
|
||||
}
|
||||
}
|
||||
}
|
||||
#endif
|
||||
|
||||
SYSLOG ((LOG_WARN, "libselinux: %s", buf));
|
||||
|
||||
skip_syslog:
|
||||
free (buf);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* check_selinux_permit - Check whether SELinux grants the given
|
||||
* operation
|
||||
*
|
||||
* Parameter is the SELinux permission name, e.g. rootok
|
||||
*
|
||||
* Returns 0 when permission is granted
|
||||
* or something failed but running in
|
||||
* permissive mode
|
||||
*/
|
||||
int check_selinux_permit (const char *perm_name)
|
||||
{
|
||||
char *user_context_raw;
|
||||
int r;
|
||||
|
||||
if (0 == is_selinux_enabled ()) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
selinux_set_callback (SELINUX_CB_LOG, (union selinux_callback) selinux_log_cb);
|
||||
|
||||
if (getprevcon_raw (&user_context_raw) != 0) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: can not get previous SELinux process context: %s\n"),
|
||||
Prog, strerror (errno));
|
||||
SYSLOG ((LOG_WARN,
|
||||
"can not get previous SELinux process context: %s",
|
||||
strerror (errno)));
|
||||
return (security_getenforce () != 0);
|
||||
}
|
||||
|
||||
r = selinux_check_access (user_context_raw, user_context_raw, "passwd", perm_name, NULL);
|
||||
freecon (user_context_raw);
|
||||
return r;
|
||||
}
|
||||
|
||||
#else /* !WITH_SELINUX */
|
||||
extern int errno; /* warning: ANSI C forbids an empty source file */
|
||||
#endif /* !WITH_SELINUX */
|
||||
378
lib/semanage.c
378
lib/semanage.c
@@ -1,378 +0,0 @@
|
||||
/*
|
||||
* Copyright (c) 2010 , Jakub Hrozek <jhrozek@redhat.com>
|
||||
* Copyright (c) 2011 , Peter Vrabec <pvrabec@redhat.com>
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. The name of the copyright holders or contributors may not be used to
|
||||
* endorse or promote products derived from this software without
|
||||
* specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
|
||||
* PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
* HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include <config.h>
|
||||
|
||||
#ifdef WITH_SELINUX
|
||||
|
||||
#include "defines.h"
|
||||
|
||||
#ifndef _GNU_SOURCE
|
||||
#define _GNU_SOURCE
|
||||
#endif
|
||||
#include <stdio.h>
|
||||
#include <stdarg.h>
|
||||
#include <selinux/selinux.h>
|
||||
#include <semanage/semanage.h>
|
||||
#include "prototypes.h"
|
||||
|
||||
|
||||
#ifndef DEFAULT_SERANGE
|
||||
#define DEFAULT_SERANGE "s0"
|
||||
#endif
|
||||
|
||||
|
||||
static void semanage_error_callback (unused void *varg,
|
||||
semanage_handle_t *handle,
|
||||
const char *fmt, ...)
|
||||
{
|
||||
int ret;
|
||||
char * message = NULL;
|
||||
va_list ap;
|
||||
|
||||
|
||||
va_start (ap, fmt);
|
||||
ret = vasprintf (&message, fmt, ap);
|
||||
va_end (ap);
|
||||
if (ret < 0) {
|
||||
/* ENOMEM */
|
||||
return;
|
||||
}
|
||||
|
||||
switch (semanage_msg_get_level (handle)) {
|
||||
case SEMANAGE_MSG_ERR:
|
||||
case SEMANAGE_MSG_WARN:
|
||||
fprintf (shadow_logfd, _("[libsemanage]: %s\n"), message);
|
||||
break;
|
||||
case SEMANAGE_MSG_INFO:
|
||||
/* nop */
|
||||
break;
|
||||
}
|
||||
|
||||
free (message);
|
||||
}
|
||||
|
||||
|
||||
static semanage_handle_t *semanage_init (void)
|
||||
{
|
||||
int ret;
|
||||
semanage_handle_t *handle = NULL;
|
||||
|
||||
handle = semanage_handle_create ();
|
||||
if (NULL == handle) {
|
||||
fprintf (shadow_logfd,
|
||||
_("Cannot create SELinux management handle\n"));
|
||||
return NULL;
|
||||
}
|
||||
|
||||
semanage_msg_set_callback (handle, semanage_error_callback, NULL);
|
||||
|
||||
ret = semanage_is_managed (handle);
|
||||
if (ret != 1) {
|
||||
fprintf (shadow_logfd, _("SELinux policy not managed\n"));
|
||||
goto fail;
|
||||
}
|
||||
|
||||
ret = semanage_access_check (handle);
|
||||
if (ret < SEMANAGE_CAN_READ) {
|
||||
fprintf (shadow_logfd, _("Cannot read SELinux policy store\n"));
|
||||
goto fail;
|
||||
}
|
||||
|
||||
ret = semanage_connect (handle);
|
||||
if (ret != 0) {
|
||||
fprintf (shadow_logfd,
|
||||
_("Cannot establish SELinux management connection\n"));
|
||||
goto fail;
|
||||
}
|
||||
|
||||
ret = semanage_begin_transaction (handle);
|
||||
if (ret != 0) {
|
||||
fprintf (shadow_logfd, _("Cannot begin SELinux transaction\n"));
|
||||
goto fail;
|
||||
}
|
||||
|
||||
return handle;
|
||||
|
||||
fail:
|
||||
semanage_handle_destroy (handle);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
|
||||
static int semanage_user_mod (semanage_handle_t *handle,
|
||||
semanage_seuser_key_t *key,
|
||||
const char *login_name,
|
||||
const char *seuser_name)
|
||||
{
|
||||
int ret;
|
||||
semanage_seuser_t *seuser = NULL;
|
||||
|
||||
semanage_seuser_query (handle, key, &seuser);
|
||||
if (NULL == seuser) {
|
||||
fprintf (shadow_logfd,
|
||||
_("Could not query seuser for %s\n"), login_name);
|
||||
ret = 1;
|
||||
goto done;
|
||||
}
|
||||
|
||||
ret = semanage_seuser_set_mlsrange (handle, seuser, DEFAULT_SERANGE);
|
||||
if (ret != 0) {
|
||||
fprintf (shadow_logfd,
|
||||
_("Could not set serange for %s\n"), login_name);
|
||||
ret = 1;
|
||||
goto done;
|
||||
}
|
||||
|
||||
ret = semanage_seuser_set_sename (handle, seuser, seuser_name);
|
||||
if (ret != 0) {
|
||||
fprintf (shadow_logfd,
|
||||
_("Could not set sename for %s\n"),
|
||||
login_name);
|
||||
ret = 1;
|
||||
goto done;
|
||||
}
|
||||
|
||||
ret = semanage_seuser_modify_local (handle, key, seuser);
|
||||
if (ret != 0) {
|
||||
fprintf (shadow_logfd,
|
||||
_("Could not modify login mapping for %s\n"),
|
||||
login_name);
|
||||
ret = 1;
|
||||
goto done;
|
||||
}
|
||||
|
||||
ret = 0;
|
||||
done:
|
||||
semanage_seuser_free (seuser);
|
||||
return ret;
|
||||
}
|
||||
|
||||
|
||||
static int semanage_user_add (semanage_handle_t *handle,
|
||||
semanage_seuser_key_t *key,
|
||||
const char *login_name,
|
||||
const char *seuser_name)
|
||||
{
|
||||
int ret;
|
||||
semanage_seuser_t *seuser = NULL;
|
||||
|
||||
ret = semanage_seuser_create (handle, &seuser);
|
||||
if (ret != 0) {
|
||||
fprintf (shadow_logfd,
|
||||
_("Cannot create SELinux login mapping for %s\n"),
|
||||
login_name);
|
||||
ret = 1;
|
||||
goto done;
|
||||
}
|
||||
|
||||
ret = semanage_seuser_set_name (handle, seuser, login_name);
|
||||
if (ret != 0) {
|
||||
fprintf (shadow_logfd, _("Could not set name for %s\n"), login_name);
|
||||
ret = 1;
|
||||
goto done;
|
||||
}
|
||||
|
||||
ret = semanage_seuser_set_mlsrange (handle, seuser, DEFAULT_SERANGE);
|
||||
if (ret != 0) {
|
||||
fprintf (shadow_logfd,
|
||||
_("Could not set serange for %s\n"),
|
||||
login_name);
|
||||
ret = 1;
|
||||
goto done;
|
||||
}
|
||||
|
||||
ret = semanage_seuser_set_sename (handle, seuser, seuser_name);
|
||||
if (ret != 0) {
|
||||
fprintf (shadow_logfd,
|
||||
_("Could not set SELinux user for %s\n"),
|
||||
login_name);
|
||||
ret = 1;
|
||||
goto done;
|
||||
}
|
||||
|
||||
ret = semanage_seuser_modify_local (handle, key, seuser);
|
||||
if (ret != 0) {
|
||||
fprintf (shadow_logfd,
|
||||
_("Could not add login mapping for %s\n"),
|
||||
login_name);
|
||||
ret = 1;
|
||||
goto done;
|
||||
}
|
||||
|
||||
ret = 0;
|
||||
done:
|
||||
semanage_seuser_free (seuser);
|
||||
return ret;
|
||||
}
|
||||
|
||||
|
||||
int set_seuser (const char *login_name, const char *seuser_name)
|
||||
{
|
||||
semanage_handle_t *handle = NULL;
|
||||
semanage_seuser_key_t *key = NULL;
|
||||
int ret;
|
||||
int seuser_exists = 0;
|
||||
|
||||
if (NULL == seuser_name) {
|
||||
/* don't care, just let system pick the defaults */
|
||||
return 0;
|
||||
}
|
||||
|
||||
handle = semanage_init ();
|
||||
if (NULL == handle) {
|
||||
fprintf (shadow_logfd, _("Cannot init SELinux management\n"));
|
||||
ret = 1;
|
||||
goto done;
|
||||
}
|
||||
|
||||
ret = semanage_seuser_key_create (handle, login_name, &key);
|
||||
if (ret != 0) {
|
||||
fprintf (shadow_logfd, _("Cannot create SELinux user key\n"));
|
||||
ret = 1;
|
||||
goto done;
|
||||
}
|
||||
|
||||
ret = semanage_seuser_exists (handle, key, &seuser_exists);
|
||||
if (ret < 0) {
|
||||
fprintf (shadow_logfd, _("Cannot verify the SELinux user\n"));
|
||||
ret = 1;
|
||||
goto done;
|
||||
}
|
||||
|
||||
if (0 != seuser_exists) {
|
||||
ret = semanage_user_mod (handle, key, login_name, seuser_name);
|
||||
if (ret != 0) {
|
||||
fprintf (shadow_logfd,
|
||||
_("Cannot modify SELinux user mapping\n"));
|
||||
ret = 1;
|
||||
goto done;
|
||||
}
|
||||
} else {
|
||||
ret = semanage_user_add (handle, key, login_name, seuser_name);
|
||||
if (ret != 0) {
|
||||
fprintf (shadow_logfd,
|
||||
_("Cannot add SELinux user mapping\n"));
|
||||
ret = 1;
|
||||
goto done;
|
||||
}
|
||||
}
|
||||
|
||||
ret = semanage_commit (handle);
|
||||
if (ret < 0) {
|
||||
fprintf (shadow_logfd, _("Cannot commit SELinux transaction\n"));
|
||||
ret = 1;
|
||||
goto done;
|
||||
}
|
||||
|
||||
ret = 0;
|
||||
|
||||
done:
|
||||
semanage_seuser_key_free (key);
|
||||
semanage_handle_destroy (handle);
|
||||
return ret;
|
||||
}
|
||||
|
||||
|
||||
int del_seuser (const char *login_name)
|
||||
{
|
||||
semanage_handle_t *handle = NULL;
|
||||
semanage_seuser_key_t *key = NULL;
|
||||
int ret;
|
||||
int exists = 0;
|
||||
|
||||
handle = semanage_init ();
|
||||
if (NULL == handle) {
|
||||
fprintf (shadow_logfd, _("Cannot init SELinux management\n"));
|
||||
ret = 1;
|
||||
goto done;
|
||||
}
|
||||
|
||||
ret = semanage_seuser_key_create (handle, login_name, &key);
|
||||
if (ret != 0) {
|
||||
fprintf (shadow_logfd, _("Cannot create SELinux user key\n"));
|
||||
ret = 1;
|
||||
goto done;
|
||||
}
|
||||
|
||||
ret = semanage_seuser_exists (handle, key, &exists);
|
||||
if (ret < 0) {
|
||||
fprintf (shadow_logfd, _("Cannot verify the SELinux user\n"));
|
||||
ret = 1;
|
||||
goto done;
|
||||
}
|
||||
|
||||
if (0 == exists) {
|
||||
fprintf (shadow_logfd,
|
||||
_("Login mapping for %s is not defined, OK if default mapping was used\n"),
|
||||
login_name);
|
||||
ret = 0; /* probably default mapping */
|
||||
goto done;
|
||||
}
|
||||
|
||||
ret = semanage_seuser_exists_local (handle, key, &exists);
|
||||
if (ret < 0) {
|
||||
fprintf (shadow_logfd, _("Cannot verify the SELinux user\n"));
|
||||
ret = 1;
|
||||
goto done;
|
||||
}
|
||||
|
||||
if (0 == exists) {
|
||||
fprintf (shadow_logfd,
|
||||
_("Login mapping for %s is defined in policy, cannot be deleted\n"),
|
||||
login_name);
|
||||
ret = 0; /* Login mapping defined in policy can't be deleted */
|
||||
goto done;
|
||||
}
|
||||
|
||||
ret = semanage_seuser_del_local (handle, key);
|
||||
if (ret != 0) {
|
||||
fprintf (shadow_logfd,
|
||||
_("Could not delete login mapping for %s"),
|
||||
login_name);
|
||||
ret = 1;
|
||||
goto done;
|
||||
}
|
||||
|
||||
ret = semanage_commit (handle);
|
||||
if (ret < 0) {
|
||||
fprintf (shadow_logfd, _("Cannot commit SELinux transaction\n"));
|
||||
ret = 1;
|
||||
goto done;
|
||||
}
|
||||
|
||||
ret = 0;
|
||||
done:
|
||||
semanage_handle_destroy (handle);
|
||||
return ret;
|
||||
}
|
||||
#else /* !WITH_SELINUX */
|
||||
extern int errno; /* warning: ANSI C forbids an empty source file */
|
||||
#endif /* !WITH_SELINUX */
|
||||
@@ -35,7 +35,6 @@
|
||||
#ident "$Id$"
|
||||
|
||||
#include <stdio.h>
|
||||
#include <sys/types.h>
|
||||
#include <grp.h>
|
||||
#include "defines.h"
|
||||
#include "prototypes.h"
|
||||
@@ -88,12 +87,10 @@ static char **list (char *s)
|
||||
if (!s || s[0] == '\0')
|
||||
break;
|
||||
members[i++] = s;
|
||||
while (('\0' != *s) && (',' != *s)) {
|
||||
while (*s && *s != ',')
|
||||
s++;
|
||||
}
|
||||
if ('\0' != *s) {
|
||||
if (*s)
|
||||
*s++ = '\0';
|
||||
}
|
||||
}
|
||||
members[i] = (char *) 0;
|
||||
return members;
|
||||
@@ -123,32 +120,22 @@ struct group *sgetgrent (const char *buf)
|
||||
}
|
||||
strcpy (grpbuf, buf);
|
||||
|
||||
cp = strrchr (grpbuf, '\n');
|
||||
if (NULL != cp) {
|
||||
if ((cp = strrchr (grpbuf, '\n')))
|
||||
*cp = '\0';
|
||||
}
|
||||
|
||||
for (cp = grpbuf, i = 0; (i < NFIELDS) && (NULL != cp); i++) {
|
||||
for (cp = grpbuf, i = 0; i < NFIELDS && cp; i++) {
|
||||
grpfields[i] = cp;
|
||||
cp = strchr (cp, ':');
|
||||
if (NULL != cp) {
|
||||
*cp = '\0';
|
||||
cp++;
|
||||
}
|
||||
}
|
||||
if (i < (NFIELDS - 1) || *grpfields[2] == '\0' || cp != NULL) {
|
||||
return (struct group *) 0;
|
||||
if ((cp = strchr (cp, ':')))
|
||||
*cp++ = 0;
|
||||
}
|
||||
if (i < (NFIELDS - 1) || *grpfields[2] == '\0')
|
||||
return 0;
|
||||
grent.gr_name = grpfields[0];
|
||||
grent.gr_passwd = grpfields[1];
|
||||
if (get_gid (grpfields[2], &grent.gr_gid) == 0) {
|
||||
return (struct group *) 0;
|
||||
}
|
||||
grent.gr_gid = atoi (grpfields[2]);
|
||||
grent.gr_mem = list (grpfields[3]);
|
||||
if (NULL == grent.gr_mem) {
|
||||
if (!grent.gr_mem)
|
||||
return (struct group *) 0; /* out of memory */
|
||||
}
|
||||
|
||||
return &grent;
|
||||
}
|
||||
|
||||
|
||||
@@ -60,6 +60,7 @@ struct passwd *sgetpwent (const char *buf)
|
||||
static char pwdbuf[1024];
|
||||
register int i;
|
||||
register char *cp;
|
||||
char *ep;
|
||||
char *fields[NFIELDS];
|
||||
|
||||
/*
|
||||
@@ -76,23 +77,15 @@ struct passwd *sgetpwent (const char *buf)
|
||||
* field. The fields are converted into NUL terminated strings.
|
||||
*/
|
||||
|
||||
for (cp = pwdbuf, i = 0; (i < NFIELDS) && (NULL != cp); i++) {
|
||||
for (cp = pwdbuf, i = 0; i < NFIELDS && cp; i++) {
|
||||
fields[i] = cp;
|
||||
while (('\0' != *cp) && (':' != *cp)) {
|
||||
cp++;
|
||||
}
|
||||
while (*cp && *cp != ':')
|
||||
++cp;
|
||||
|
||||
if ('\0' != *cp) {
|
||||
*cp = '\0';
|
||||
cp++;
|
||||
} else {
|
||||
cp = NULL;
|
||||
}
|
||||
}
|
||||
|
||||
/* something at the end, columns over shot */
|
||||
if( cp != NULL ) {
|
||||
return( NULL );
|
||||
if (*cp)
|
||||
*cp++ = '\0';
|
||||
else
|
||||
cp = 0;
|
||||
}
|
||||
|
||||
/*
|
||||
@@ -101,7 +94,7 @@ struct passwd *sgetpwent (const char *buf)
|
||||
*/
|
||||
|
||||
if (i != NFIELDS || *fields[2] == '\0' || *fields[3] == '\0')
|
||||
return NULL;
|
||||
return 0;
|
||||
|
||||
/*
|
||||
* Each of the fields is converted the appropriate data type
|
||||
@@ -112,11 +105,13 @@ struct passwd *sgetpwent (const char *buf)
|
||||
|
||||
pwent.pw_name = fields[0];
|
||||
pwent.pw_passwd = fields[1];
|
||||
if (get_uid (fields[2], &pwent.pw_uid) == 0) {
|
||||
return NULL;
|
||||
if (fields[2][0] == '\0' ||
|
||||
((pwent.pw_uid = strtol (fields[2], &ep, 10)) == 0 && *ep)) {
|
||||
return 0;
|
||||
}
|
||||
if (get_gid (fields[3], &pwent.pw_gid) == 0) {
|
||||
return NULL;
|
||||
if (fields[3][0] == '\0' ||
|
||||
((pwent.pw_gid = strtol (fields[3], &ep, 10)) == 0 && *ep)) {
|
||||
return 0;
|
||||
}
|
||||
pwent.pw_gecos = fields[4];
|
||||
pwent.pw_dir = fields[5];
|
||||
@@ -124,4 +119,3 @@ struct passwd *sgetpwent (const char *buf)
|
||||
|
||||
return &pwent;
|
||||
}
|
||||
|
||||
|
||||
@@ -2,7 +2,6 @@
|
||||
* Copyright (c) 1989 - 1994, Julianne Frances Haugh
|
||||
* Copyright (c) 1996 - 1998, Marek Michałkiewicz
|
||||
* Copyright (c) 2003 - 2005, Tomasz Kłoczko
|
||||
* Copyright (c) 2009 , Nicolas François
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
@@ -32,9 +31,6 @@
|
||||
|
||||
#include <config.h>
|
||||
|
||||
/* Newer versions of Linux libc already have shadow support. */
|
||||
#ifndef HAVE_SGETSPENT
|
||||
|
||||
#ident "$Id$"
|
||||
|
||||
#include <sys/types.h>
|
||||
@@ -52,6 +48,7 @@ struct spwd *sgetspent (const char *string)
|
||||
static struct spwd spwd;
|
||||
char *fields[FIELDS];
|
||||
char *cp;
|
||||
char *cpp;
|
||||
int i;
|
||||
|
||||
/*
|
||||
@@ -59,41 +56,32 @@ struct spwd *sgetspent (const char *string)
|
||||
* have to do that to our private copy.
|
||||
*/
|
||||
|
||||
if (strlen (string) >= sizeof spwbuf) {
|
||||
if (strlen (string) >= sizeof spwbuf)
|
||||
return 0; /* fail if too long */
|
||||
}
|
||||
strcpy (spwbuf, string);
|
||||
|
||||
cp = strrchr (spwbuf, '\n');
|
||||
if (NULL != cp) {
|
||||
if ((cp = strrchr (spwbuf, '\n')))
|
||||
*cp = '\0';
|
||||
}
|
||||
|
||||
/*
|
||||
* Tokenize the string into colon separated fields. Allow up to
|
||||
* FIELDS different fields.
|
||||
*/
|
||||
|
||||
for (cp = spwbuf, i = 0; ('\0' != *cp) && (i < FIELDS); i++) {
|
||||
for (cp = spwbuf, i = 0; *cp && i < FIELDS; i++) {
|
||||
fields[i] = cp;
|
||||
while (('\0' != *cp) && (':' != *cp)) {
|
||||
while (*cp && *cp != ':')
|
||||
cp++;
|
||||
}
|
||||
|
||||
if ('\0' != *cp) {
|
||||
*cp = '\0';
|
||||
cp++;
|
||||
}
|
||||
if (*cp)
|
||||
*cp++ = '\0';
|
||||
}
|
||||
|
||||
if (i == (FIELDS - 1)) {
|
||||
if (i == (FIELDS - 1))
|
||||
fields[i++] = cp;
|
||||
}
|
||||
|
||||
if ( ((NULL != cp) && ('\0' != *cp)) ||
|
||||
((i != FIELDS) && (i != OFIELDS)) ) {
|
||||
if ((cp && *cp) || (i != FIELDS && i != OFIELDS))
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* Start populating the structure. The fields are all in
|
||||
@@ -109,34 +97,28 @@ struct spwd *sgetspent (const char *string)
|
||||
* incorrectly formatted number.
|
||||
*/
|
||||
|
||||
if (fields[2][0] == '\0') {
|
||||
spwd.sp_lstchg = -1;
|
||||
} else if ( (getlong (fields[2], &spwd.sp_lstchg) == 0)
|
||||
|| (spwd.sp_lstchg < 0)) {
|
||||
if ((spwd.sp_lstchg = strtol (fields[2], &cpp, 10)) == 0 && *cpp) {
|
||||
return 0;
|
||||
}
|
||||
} else if (fields[2][0] == '\0')
|
||||
spwd.sp_lstchg = -1;
|
||||
|
||||
/*
|
||||
* Get the minimum period between password changes.
|
||||
*/
|
||||
|
||||
if (fields[3][0] == '\0') {
|
||||
spwd.sp_min = -1;
|
||||
} else if ( (getlong (fields[3], &spwd.sp_min) == 0)
|
||||
|| (spwd.sp_min < 0)) {
|
||||
if ((spwd.sp_min = strtol (fields[3], &cpp, 10)) == 0 && *cpp) {
|
||||
return 0;
|
||||
}
|
||||
} else if (fields[3][0] == '\0')
|
||||
spwd.sp_min = -1;
|
||||
|
||||
/*
|
||||
* Get the maximum number of days a password is valid.
|
||||
*/
|
||||
|
||||
if (fields[4][0] == '\0') {
|
||||
spwd.sp_max = -1;
|
||||
} else if ( (getlong (fields[4], &spwd.sp_max) == 0)
|
||||
|| (spwd.sp_max < 0)) {
|
||||
if ((spwd.sp_max = strtol (fields[4], &cpp, 10)) == 0 && *cpp) {
|
||||
return 0;
|
||||
}
|
||||
} else if (fields[4][0] == '\0')
|
||||
spwd.sp_max = -1;
|
||||
|
||||
/*
|
||||
* If there are only OFIELDS fields (this is a SVR3.2 /etc/shadow
|
||||
@@ -144,10 +126,8 @@ struct spwd *sgetspent (const char *string)
|
||||
*/
|
||||
|
||||
if (i == OFIELDS) {
|
||||
spwd.sp_warn = -1;
|
||||
spwd.sp_inact = -1;
|
||||
spwd.sp_expire = -1;
|
||||
spwd.sp_flag = SHADOW_SP_FLAG_UNSET;
|
||||
spwd.sp_warn = spwd.sp_inact = spwd.sp_expire =
|
||||
spwd.sp_flag = -1;
|
||||
|
||||
return &spwd;
|
||||
}
|
||||
@@ -156,52 +136,40 @@ struct spwd *sgetspent (const char *string)
|
||||
* Get the number of days of password expiry warning.
|
||||
*/
|
||||
|
||||
if (fields[5][0] == '\0') {
|
||||
spwd.sp_warn = -1;
|
||||
} else if ( (getlong (fields[5], &spwd.sp_warn) == 0)
|
||||
|| (spwd.sp_warn < 0)) {
|
||||
if ((spwd.sp_warn = strtol (fields[5], &cpp, 10)) == 0 && *cpp) {
|
||||
return 0;
|
||||
}
|
||||
} else if (fields[5][0] == '\0')
|
||||
spwd.sp_warn = -1;
|
||||
|
||||
/*
|
||||
* Get the number of days of inactivity before an account is
|
||||
* disabled.
|
||||
*/
|
||||
|
||||
if (fields[6][0] == '\0') {
|
||||
spwd.sp_inact = -1;
|
||||
} else if ( (getlong (fields[6], &spwd.sp_inact) == 0)
|
||||
|| (spwd.sp_inact < 0)) {
|
||||
if ((spwd.sp_inact = strtol (fields[6], &cpp, 10)) == 0 && *cpp) {
|
||||
return 0;
|
||||
}
|
||||
} else if (fields[6][0] == '\0')
|
||||
spwd.sp_inact = -1;
|
||||
|
||||
/*
|
||||
* Get the number of days after the epoch before the account is
|
||||
* set to expire.
|
||||
*/
|
||||
|
||||
if (fields[7][0] == '\0') {
|
||||
spwd.sp_expire = -1;
|
||||
} else if ( (getlong (fields[7], &spwd.sp_expire) == 0)
|
||||
|| (spwd.sp_expire < 0)) {
|
||||
if ((spwd.sp_expire = strtol (fields[7], &cpp, 10)) == 0 && *cpp) {
|
||||
return 0;
|
||||
}
|
||||
} else if (fields[7][0] == '\0')
|
||||
spwd.sp_expire = -1;
|
||||
|
||||
/*
|
||||
* This field is reserved for future use. But it isn't supposed
|
||||
* to have anything other than a valid integer in it.
|
||||
*/
|
||||
|
||||
if (fields[8][0] == '\0') {
|
||||
spwd.sp_flag = SHADOW_SP_FLAG_UNSET;
|
||||
} else if (getlong (fields[8], &spwd.sp_flag) == 0) {
|
||||
/* FIXME: add a getulong function */
|
||||
if ((spwd.sp_flag = strtol (fields[8], &cpp, 10)) == 0 && *cpp) {
|
||||
return 0;
|
||||
}
|
||||
} else if (fields[8][0] == '\0')
|
||||
spwd.sp_flag = -1;
|
||||
|
||||
return (&spwd);
|
||||
}
|
||||
#else
|
||||
extern int errno; /* warning: ANSI C forbids an empty source file */
|
||||
#endif
|
||||
|
||||
|
||||
168
lib/sgroupio.c
168
lib/sgroupio.c
@@ -3,7 +3,7 @@
|
||||
* Copyright (c) 1996 - 2000, Marek Michałkiewicz
|
||||
* Copyright (c) 2001 , Michał Moskal
|
||||
* Copyright (c) 2005 , Tomasz Kłoczko
|
||||
* Copyright (c) 2007 - 2013, Nicolas François
|
||||
* Copyright (c) 2007 - 2008, Nicolas François
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
@@ -40,129 +40,68 @@
|
||||
#include "prototypes.h"
|
||||
#include "defines.h"
|
||||
#include "commonio.h"
|
||||
#include "getdef.h"
|
||||
#include "sgroupio.h"
|
||||
|
||||
/*@null@*/ /*@only@*/struct sgrp *__sgr_dup (const struct sgrp *sgent)
|
||||
struct sgrp *__sgr_dup (const struct sgrp *sgent)
|
||||
{
|
||||
struct sgrp *sg;
|
||||
int i;
|
||||
|
||||
sg = (struct sgrp *) malloc (sizeof *sg);
|
||||
if (NULL == sg) {
|
||||
if (!(sg = (struct sgrp *) malloc (sizeof *sg)))
|
||||
return NULL;
|
||||
}
|
||||
/* Do the same as the other _dup function, even if we know the
|
||||
* structure. */
|
||||
memset (sg, 0, sizeof *sg);
|
||||
/*@-mustfreeonly@*/
|
||||
sg->sg_name = strdup (sgent->sg_name);
|
||||
/*@=mustfreeonly@*/
|
||||
if (NULL == sg->sg_name) {
|
||||
free (sg);
|
||||
*sg = *sgent;
|
||||
if (!(sg->sg_name = strdup (sgent->sg_name)))
|
||||
return NULL;
|
||||
}
|
||||
/*@-mustfreeonly@*/
|
||||
sg->sg_passwd = strdup (sgent->sg_passwd);
|
||||
/*@=mustfreeonly@*/
|
||||
if (NULL == sg->sg_passwd) {
|
||||
free (sg->sg_name);
|
||||
free (sg);
|
||||
if (!(sg->sg_passwd = strdup (sgent->sg_passwd)))
|
||||
return NULL;
|
||||
}
|
||||
|
||||
for (i = 0; NULL != sgent->sg_adm[i]; i++);
|
||||
/*@-mustfreeonly@*/
|
||||
for (i = 0; sgent->sg_adm[i]; i++);
|
||||
sg->sg_adm = (char **) malloc ((i + 1) * sizeof (char *));
|
||||
/*@=mustfreeonly@*/
|
||||
if (NULL == sg->sg_adm) {
|
||||
free (sg->sg_passwd);
|
||||
free (sg->sg_name);
|
||||
free (sg);
|
||||
if (!sg->sg_adm)
|
||||
return NULL;
|
||||
}
|
||||
for (i = 0; NULL != sgent->sg_adm[i]; i++) {
|
||||
for (i = 0; sgent->sg_adm[i]; i++) {
|
||||
sg->sg_adm[i] = strdup (sgent->sg_adm[i]);
|
||||
if (NULL == sg->sg_adm[i]) {
|
||||
for (i = 0; NULL != sg->sg_adm[i]; i++) {
|
||||
free (sg->sg_adm[i]);
|
||||
}
|
||||
free (sg->sg_adm);
|
||||
free (sg->sg_passwd);
|
||||
free (sg->sg_name);
|
||||
free (sg);
|
||||
if (!sg->sg_adm[i])
|
||||
return NULL;
|
||||
}
|
||||
}
|
||||
sg->sg_adm[i] = NULL;
|
||||
|
||||
for (i = 0; NULL != sgent->sg_mem[i]; i++);
|
||||
/*@-mustfreeonly@*/
|
||||
for (i = 0; sgent->sg_mem[i]; i++);
|
||||
sg->sg_mem = (char **) malloc ((i + 1) * sizeof (char *));
|
||||
/*@=mustfreeonly@*/
|
||||
if (NULL == sg->sg_mem) {
|
||||
for (i = 0; NULL != sg->sg_adm[i]; i++) {
|
||||
free (sg->sg_adm[i]);
|
||||
}
|
||||
free (sg->sg_adm);
|
||||
free (sg->sg_passwd);
|
||||
free (sg->sg_name);
|
||||
free (sg);
|
||||
if (!sg->sg_mem)
|
||||
return NULL;
|
||||
}
|
||||
for (i = 0; NULL != sgent->sg_mem[i]; i++) {
|
||||
for (i = 0; sgent->sg_mem[i]; i++) {
|
||||
sg->sg_mem[i] = strdup (sgent->sg_mem[i]);
|
||||
if (NULL == sg->sg_mem[i]) {
|
||||
for (i = 0; NULL != sg->sg_mem[i]; i++) {
|
||||
free (sg->sg_mem[i]);
|
||||
}
|
||||
free (sg->sg_mem);
|
||||
for (i = 0; NULL != sg->sg_adm[i]; i++) {
|
||||
free (sg->sg_adm[i]);
|
||||
}
|
||||
free (sg->sg_adm);
|
||||
free (sg->sg_passwd);
|
||||
free (sg->sg_name);
|
||||
free (sg);
|
||||
if (!sg->sg_mem[i])
|
||||
return NULL;
|
||||
}
|
||||
}
|
||||
sg->sg_mem[i] = NULL;
|
||||
|
||||
return sg;
|
||||
}
|
||||
|
||||
static /*@null@*/ /*@only@*/void *gshadow_dup (const void *ent)
|
||||
static void *gshadow_dup (const void *ent)
|
||||
{
|
||||
const struct sgrp *sg = ent;
|
||||
|
||||
return __sgr_dup (sg);
|
||||
}
|
||||
|
||||
static void gshadow_free (/*@out@*/ /*@only@*/void *ent)
|
||||
static void gshadow_free (void *ent)
|
||||
{
|
||||
struct sgrp *sg = ent;
|
||||
|
||||
sgr_free (sg);
|
||||
}
|
||||
|
||||
void sgr_free (/*@out@*/ /*@only@*/struct sgrp *sgent)
|
||||
{
|
||||
size_t i;
|
||||
free (sgent->sg_name);
|
||||
if (NULL != sgent->sg_passwd) {
|
||||
memzero (sgent->sg_passwd, strlen (sgent->sg_passwd));
|
||||
free (sgent->sg_passwd);
|
||||
free (sg->sg_name);
|
||||
free (sg->sg_passwd);
|
||||
while (*(sg->sg_adm)) {
|
||||
free (*(sg->sg_adm));
|
||||
sg->sg_adm++;
|
||||
}
|
||||
for (i = 0; NULL != sgent->sg_adm[i]; i++) {
|
||||
free (sgent->sg_adm[i]);
|
||||
while (*(sg->sg_mem)) {
|
||||
free (*(sg->sg_mem));
|
||||
sg->sg_mem++;
|
||||
}
|
||||
free (sgent->sg_adm);
|
||||
for (i = 0; NULL != sgent->sg_mem[i]; i++) {
|
||||
free (sgent->sg_mem[i]);
|
||||
}
|
||||
free (sgent->sg_mem);
|
||||
free (sgent);
|
||||
free (sg);
|
||||
}
|
||||
|
||||
static const char *gshadow_getname (const void *ent)
|
||||
@@ -181,32 +120,6 @@ static int gshadow_put (const void *ent, FILE * file)
|
||||
{
|
||||
const struct sgrp *sg = ent;
|
||||
|
||||
if ( (NULL == sg)
|
||||
|| (valid_field (sg->sg_name, ":\n") == -1)
|
||||
|| (valid_field (sg->sg_passwd, ":\n") == -1)) {
|
||||
return -1;
|
||||
}
|
||||
|
||||
/* FIXME: fail also if sg->sg_adm == NULL ?*/
|
||||
if (NULL != sg->sg_adm) {
|
||||
size_t i;
|
||||
for (i = 0; NULL != sg->sg_adm[i]; i++) {
|
||||
if (valid_field (sg->sg_adm[i], ",:\n") == -1) {
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/* FIXME: fail also if sg->sg_mem == NULL ?*/
|
||||
if (NULL != sg->sg_mem) {
|
||||
size_t i;
|
||||
for (i = 0; NULL != sg->sg_mem[i]; i++) {
|
||||
if (valid_field (sg->sg_mem[i], ",:\n") == -1) {
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return (putsgent (sg, file) == -1) ? -1 : 0;
|
||||
}
|
||||
|
||||
@@ -229,33 +142,22 @@ static struct commonio_db gshadow_db = {
|
||||
#ifdef WITH_SELINUX
|
||||
NULL, /* scontext */
|
||||
#endif
|
||||
0400, /* st_mode */
|
||||
0, /* st_uid */
|
||||
0, /* st_gid */
|
||||
NULL, /* head */
|
||||
NULL, /* tail */
|
||||
NULL, /* cursor */
|
||||
false, /* changed */
|
||||
false, /* isopen */
|
||||
false, /* locked */
|
||||
false, /* readonly */
|
||||
false /* setname */
|
||||
0, /* changed */
|
||||
0, /* isopen */
|
||||
0, /* locked */
|
||||
0 /* readonly */
|
||||
};
|
||||
|
||||
int sgr_setdbname (const char *filename)
|
||||
int sgr_name (const char *filename)
|
||||
{
|
||||
return commonio_setname (&gshadow_db, filename);
|
||||
}
|
||||
|
||||
/*@observer@*/const char *sgr_dbname (void)
|
||||
int sgr_file_present (void)
|
||||
{
|
||||
return gshadow_db.filename;
|
||||
}
|
||||
|
||||
bool sgr_file_present (void)
|
||||
{
|
||||
if (getdef_bool ("FORCE_SHADOW"))
|
||||
return true;
|
||||
return commonio_present (&gshadow_db);
|
||||
}
|
||||
|
||||
@@ -269,7 +171,7 @@ int sgr_open (int mode)
|
||||
return commonio_open (&gshadow_db, mode);
|
||||
}
|
||||
|
||||
/*@observer@*/ /*@null@*/const struct sgrp *sgr_locate (const char *name)
|
||||
const struct sgrp *sgr_locate (const char *name)
|
||||
{
|
||||
return commonio_locate (&gshadow_db, name);
|
||||
}
|
||||
@@ -289,7 +191,7 @@ int sgr_rewind (void)
|
||||
return commonio_rewind (&gshadow_db);
|
||||
}
|
||||
|
||||
/*@null@*/const struct sgrp *sgr_next (void)
|
||||
const struct sgrp *sgr_next (void)
|
||||
{
|
||||
return commonio_next (&gshadow_db);
|
||||
}
|
||||
@@ -306,10 +208,10 @@ int sgr_unlock (void)
|
||||
|
||||
void __sgr_set_changed (void)
|
||||
{
|
||||
gshadow_db.changed = true;
|
||||
gshadow_db.changed = 1;
|
||||
}
|
||||
|
||||
/*@dependent@*/ /*@null@*/struct commonio_entry *__sgr_get_head (void)
|
||||
struct commonio_entry *__sgr_get_head (void)
|
||||
{
|
||||
return gshadow_db.head;
|
||||
}
|
||||
|
||||
@@ -31,22 +31,16 @@
|
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
/* $Id$ */
|
||||
#ifndef _SGROUPIO_H
|
||||
#define _SGROUPIO_H
|
||||
|
||||
extern int sgr_close (void);
|
||||
extern bool sgr_file_present (void);
|
||||
extern /*@observer@*/ /*@null@*/const struct sgrp *sgr_locate (const char *name);
|
||||
extern int sgr_file_present (void);
|
||||
extern const struct sgrp *sgr_locate (const char *);
|
||||
extern int sgr_lock (void);
|
||||
extern int sgr_setdbname (const char *filename);
|
||||
extern /*@observer@*/const char *sgr_dbname (void);
|
||||
extern /*@null@*/const struct sgrp *sgr_next (void);
|
||||
extern int sgr_open (int mode);
|
||||
extern int sgr_remove (const char *name);
|
||||
extern int sgr_name (const char *);
|
||||
extern const struct sgrp *sgr_next (void);
|
||||
extern int sgr_open (int);
|
||||
extern int sgr_remove (const char *);
|
||||
extern int sgr_rewind (void);
|
||||
extern int sgr_unlock (void);
|
||||
extern int sgr_update (const struct sgrp *sg);
|
||||
extern int sgr_update (const struct sgrp *);
|
||||
extern int sgr_sort (void);
|
||||
|
||||
#endif
|
||||
|
||||
261
lib/shadow.c
261
lib/shadow.c
@@ -2,7 +2,7 @@
|
||||
* Copyright (c) 1989 - 1994, Julianne Frances Haugh
|
||||
* Copyright (c) 1996 - 1998, Marek Michałkiewicz
|
||||
* Copyright (c) 2003 - 2005, Tomasz Kłoczko
|
||||
* Copyright (c) 2009 , Nicolas François
|
||||
* Copyright (c) 2008 , Nicolas François
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
@@ -42,10 +42,10 @@
|
||||
#include "defines.h"
|
||||
#include <stdio.h>
|
||||
#ifdef USE_NIS
|
||||
static bool nis_used;
|
||||
static bool nis_ignore;
|
||||
static int nis_used;
|
||||
static int nis_ignore;
|
||||
static enum { native, start, middle, native2 } nis_state;
|
||||
static bool nis_bound;
|
||||
static int nis_bound;
|
||||
static char *nis_domain;
|
||||
static char *nis_key;
|
||||
static int nis_keylen;
|
||||
@@ -56,6 +56,8 @@ static int nis_vallen;
|
||||
#endif
|
||||
|
||||
static FILE *shadow;
|
||||
static char spwbuf[BUFSIZ];
|
||||
static struct spwd spwd;
|
||||
|
||||
#define FIELDS 9
|
||||
#define OFIELDS 5
|
||||
@@ -66,13 +68,12 @@ static FILE *shadow;
|
||||
* __setspNIS - turn on or off NIS searches
|
||||
*/
|
||||
|
||||
void __setspNIS (bool flag)
|
||||
void __setspNIS (int flag)
|
||||
{
|
||||
nis_ignore = !flag;
|
||||
|
||||
if (nis_ignore) {
|
||||
nis_used = false;
|
||||
}
|
||||
if (nis_ignore)
|
||||
nis_used = 0;
|
||||
}
|
||||
|
||||
/*
|
||||
@@ -81,11 +82,10 @@ void __setspNIS (bool flag)
|
||||
|
||||
static int bind_nis (void)
|
||||
{
|
||||
if (yp_get_default_domain (&nis_domain)) {
|
||||
if (yp_get_default_domain (&nis_domain))
|
||||
return -1;
|
||||
}
|
||||
|
||||
nis_bound = true;
|
||||
nis_bound = 1;
|
||||
return 0;
|
||||
}
|
||||
#endif
|
||||
@@ -96,11 +96,10 @@ static int bind_nis (void)
|
||||
|
||||
void setspent (void)
|
||||
{
|
||||
if (NULL != shadow) {
|
||||
if (shadow)
|
||||
rewind (shadow);
|
||||
}else {
|
||||
else
|
||||
shadow = fopen (SHADOW_FILE, "r");
|
||||
}
|
||||
|
||||
#ifdef USE_NIS
|
||||
nis_state = native;
|
||||
@@ -113,9 +112,8 @@ void setspent (void)
|
||||
|
||||
void endspent (void)
|
||||
{
|
||||
if (NULL != shadow) {
|
||||
if (shadow)
|
||||
(void) fclose (shadow);
|
||||
}
|
||||
|
||||
shadow = (FILE *) 0;
|
||||
}
|
||||
@@ -126,10 +124,9 @@ void endspent (void)
|
||||
|
||||
static struct spwd *my_sgetspent (const char *string)
|
||||
{
|
||||
static char spwbuf[BUFSIZ];
|
||||
static struct spwd spwd;
|
||||
char *fields[FIELDS];
|
||||
char *cp;
|
||||
char *cpp;
|
||||
int i;
|
||||
|
||||
/*
|
||||
@@ -174,9 +171,8 @@ static struct spwd *my_sgetspent (const char *string)
|
||||
|
||||
spwd.sp_namp = fields[0];
|
||||
#ifdef USE_NIS
|
||||
if (IS_NISCHAR (fields[0][0])) {
|
||||
nis_used = true;
|
||||
}
|
||||
if (IS_NISCHAR (fields[0][0]))
|
||||
nis_used = 1;
|
||||
#endif
|
||||
spwd.sp_pwdp = fields[1];
|
||||
|
||||
@@ -186,60 +182,52 @@ static struct spwd *my_sgetspent (const char *string)
|
||||
* incorrectly formatted number, unless we are using NIS.
|
||||
*/
|
||||
|
||||
if (fields[2][0] == '\0') {
|
||||
spwd.sp_lstchg = -1;
|
||||
} else {
|
||||
if (getlong (fields[2], &spwd.sp_lstchg) == 0) {
|
||||
spwd.sp_lstchg = strtol (fields[2], &cpp, 10);
|
||||
if ((spwd.sp_lstchg == 0) && *cpp) {
|
||||
#ifdef USE_NIS
|
||||
if (nis_used) {
|
||||
spwd.sp_lstchg = -1;
|
||||
} else
|
||||
#endif
|
||||
return 0;
|
||||
} else if (spwd.sp_lstchg < 0) {
|
||||
if (!nis_used)
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
else
|
||||
spwd.sp_lstchg = -1;
|
||||
#else
|
||||
return 0;
|
||||
#endif
|
||||
} else if (fields[2][0] == '\0')
|
||||
spwd.sp_lstchg = -1;
|
||||
|
||||
/*
|
||||
* Get the minimum period between password changes.
|
||||
*/
|
||||
|
||||
if (fields[3][0] == '\0') {
|
||||
spwd.sp_min = -1;
|
||||
} else {
|
||||
if (getlong (fields[3], &spwd.sp_min) == 0) {
|
||||
spwd.sp_min = strtol (fields[3], &cpp, 10);
|
||||
if ((spwd.sp_min == 0) && *cpp) {
|
||||
#ifdef USE_NIS
|
||||
if (nis_used) {
|
||||
spwd.sp_min = -1;
|
||||
} else
|
||||
#endif
|
||||
{
|
||||
return 0;
|
||||
}
|
||||
} else if (spwd.sp_min < 0) {
|
||||
if (!nis_used)
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
else
|
||||
spwd.sp_min = -1;
|
||||
#else
|
||||
return 0;
|
||||
#endif
|
||||
} else if (fields[3][0] == '\0')
|
||||
spwd.sp_min = -1;
|
||||
|
||||
/*
|
||||
* Get the maximum number of days a password is valid.
|
||||
*/
|
||||
|
||||
if (fields[4][0] == '\0') {
|
||||
spwd.sp_max = -1;
|
||||
} else {
|
||||
if (getlong (fields[4], &spwd.sp_max) == 0) {
|
||||
spwd.sp_max = strtol (fields[4], &cpp, 10);
|
||||
if ((spwd.sp_max == 0) && *cpp) {
|
||||
#ifdef USE_NIS
|
||||
if (nis_used) {
|
||||
spwd.sp_max = -1;
|
||||
} else
|
||||
#endif
|
||||
return 0;
|
||||
} else if (spwd.sp_max < 0) {
|
||||
if (!nis_used)
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
else
|
||||
spwd.sp_max = -1;
|
||||
#else
|
||||
return 0;
|
||||
#endif
|
||||
} else if (fields[4][0] == '\0')
|
||||
spwd.sp_max = -1;
|
||||
|
||||
/*
|
||||
* If there are only OFIELDS fields (this is a SVR3.2 /etc/shadow
|
||||
@@ -247,10 +235,8 @@ static struct spwd *my_sgetspent (const char *string)
|
||||
*/
|
||||
|
||||
if (i == OFIELDS) {
|
||||
spwd.sp_warn = -1;
|
||||
spwd.sp_inact = -1;
|
||||
spwd.sp_expire = -1;
|
||||
spwd.sp_flag = SHADOW_SP_FLAG_UNSET;
|
||||
spwd.sp_warn = spwd.sp_inact = spwd.sp_expire =
|
||||
spwd.sp_flag = -1;
|
||||
|
||||
return &spwd;
|
||||
}
|
||||
@@ -259,89 +245,72 @@ static struct spwd *my_sgetspent (const char *string)
|
||||
* Get the number of days of password expiry warning.
|
||||
*/
|
||||
|
||||
if (fields[5][0] == '\0') {
|
||||
spwd.sp_warn = -1;
|
||||
} else {
|
||||
if (getlong (fields[5], &spwd.sp_warn) == 0) {
|
||||
spwd.sp_warn = strtol (fields[5], &cpp, 10);
|
||||
if ((spwd.sp_warn == 0) && *cpp) {
|
||||
#ifdef USE_NIS
|
||||
if (nis_used) {
|
||||
spwd.sp_warn = -1;
|
||||
} else
|
||||
#endif
|
||||
{
|
||||
return 0;
|
||||
}
|
||||
} else if (spwd.sp_warn < 0) {
|
||||
if (!nis_used)
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
else
|
||||
spwd.sp_warn = -1;
|
||||
#else
|
||||
return 0;
|
||||
#endif
|
||||
} else if (fields[5][0] == '\0')
|
||||
spwd.sp_warn = -1;
|
||||
|
||||
/*
|
||||
* Get the number of days of inactivity before an account is
|
||||
* disabled.
|
||||
*/
|
||||
|
||||
if (fields[6][0] == '\0') {
|
||||
spwd.sp_inact = -1;
|
||||
} else {
|
||||
if (getlong (fields[6], &spwd.sp_inact) == 0) {
|
||||
spwd.sp_inact = strtol (fields[6], &cpp, 10);
|
||||
if ((spwd.sp_inact == 0) && *cpp) {
|
||||
#ifdef USE_NIS
|
||||
if (nis_used) {
|
||||
spwd.sp_inact = -1;
|
||||
} else
|
||||
#endif
|
||||
{
|
||||
return 0;
|
||||
}
|
||||
} else if (spwd.sp_inact < 0) {
|
||||
if (!nis_used)
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
else
|
||||
spwd.sp_inact = -1;
|
||||
#else
|
||||
return 0;
|
||||
#endif
|
||||
} else if (fields[6][0] == '\0')
|
||||
spwd.sp_inact = -1;
|
||||
|
||||
/*
|
||||
* Get the number of days after the epoch before the account is
|
||||
* set to expire.
|
||||
*/
|
||||
|
||||
if (fields[7][0] == '\0') {
|
||||
spwd.sp_expire = -1;
|
||||
} else {
|
||||
if (getlong (fields[7], &spwd.sp_expire) == 0) {
|
||||
spwd.sp_expire = strtol (fields[7], &cpp, 10);
|
||||
if ((spwd.sp_expire == 0) && *cpp) {
|
||||
#ifdef USE_NIS
|
||||
if (nis_used) {
|
||||
spwd.sp_expire = -1;
|
||||
} else
|
||||
#endif
|
||||
{
|
||||
return 0;
|
||||
}
|
||||
} else if (spwd.sp_expire < 0) {
|
||||
if (!nis_used)
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
else
|
||||
spwd.sp_expire = -1;
|
||||
#else
|
||||
return 0;
|
||||
#endif
|
||||
} else if (fields[7][0] == '\0')
|
||||
spwd.sp_expire = -1;
|
||||
|
||||
/*
|
||||
* This field is reserved for future use. But it isn't supposed
|
||||
* to have anything other than a valid integer in it.
|
||||
*/
|
||||
|
||||
if (fields[8][0] == '\0') {
|
||||
spwd.sp_flag = SHADOW_SP_FLAG_UNSET;
|
||||
} else {
|
||||
if (getlong (fields[8], &spwd.sp_flag) == 0) {
|
||||
/* FIXME: add a getulong function */
|
||||
spwd.sp_flag = strtol (fields[8], &cpp, 10);
|
||||
if ((spwd.sp_flag == 0) && *cpp) {
|
||||
#ifdef USE_NIS
|
||||
if (nis_used) {
|
||||
spwd.sp_flag = SHADOW_SP_FLAG_UNSET;
|
||||
} else
|
||||
#endif
|
||||
{
|
||||
return 0;
|
||||
}
|
||||
} else if (spwd.sp_flag < 0) {
|
||||
if (!nis_used)
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
else
|
||||
spwd.sp_flag = -1;
|
||||
#else
|
||||
return 0;
|
||||
#endif
|
||||
} else if (fields[8][0] == '\0')
|
||||
spwd.sp_flag = -1;
|
||||
|
||||
return (&spwd);
|
||||
}
|
||||
@@ -355,24 +324,21 @@ struct spwd *fgetspent (FILE * fp)
|
||||
char buf[BUFSIZ];
|
||||
char *cp;
|
||||
|
||||
if (NULL == fp) {
|
||||
if (!fp)
|
||||
return (0);
|
||||
}
|
||||
|
||||
#ifdef USE_NIS
|
||||
while (fgets (buf, (int) sizeof buf, fp) != (char *) 0)
|
||||
while (fgets (buf, sizeof buf, fp) != (char *) 0)
|
||||
#else
|
||||
if (fgets (buf, (int) sizeof buf, fp) != (char *) 0)
|
||||
if (fgets (buf, sizeof buf, fp) != (char *) 0)
|
||||
#endif
|
||||
{
|
||||
cp = strchr (buf, '\n');
|
||||
if (NULL != cp) {
|
||||
if (NULL != cp)
|
||||
*cp = '\0';
|
||||
}
|
||||
#ifdef USE_NIS
|
||||
if (nis_ignore && IS_NISCHAR (buf[0])) {
|
||||
if (nis_ignore && IS_NISCHAR (buf[0]))
|
||||
continue;
|
||||
}
|
||||
#endif
|
||||
return my_sgetspent (buf);
|
||||
}
|
||||
@@ -388,10 +354,10 @@ struct spwd *getspent (void)
|
||||
#ifdef USE_NIS
|
||||
int nis_1_user = 0;
|
||||
struct spwd *val;
|
||||
char buf[BUFSIZ];
|
||||
#endif
|
||||
if (NULL == shadow) {
|
||||
if (!shadow)
|
||||
setspent ();
|
||||
}
|
||||
|
||||
#ifdef USE_NIS
|
||||
again:
|
||||
@@ -445,7 +411,7 @@ struct spwd *getspent (void)
|
||||
|
||||
return 0;
|
||||
} else {
|
||||
if (!nis_bound) {
|
||||
if (nis_bound == 0) {
|
||||
if (bind_nis ()) {
|
||||
nis_state = native2;
|
||||
goto again;
|
||||
@@ -453,15 +419,15 @@ struct spwd *getspent (void)
|
||||
}
|
||||
if (nis_state == start) {
|
||||
if (yp_first (nis_domain, "shadow.bynam", &nis_key,
|
||||
&nis_keylen, &nis_val, &nis_vallen)) {
|
||||
&nis_keylen, &nis_val, &nis_vallen)) {
|
||||
nis_state = native2;
|
||||
goto again;
|
||||
}
|
||||
nis_state = middle;
|
||||
} else if (nis_state == middle) {
|
||||
if (yp_next (nis_domain, "shadow.bynam", nis_key,
|
||||
nis_keylen, &nis_key, &nis_keylen,
|
||||
&nis_val, &nis_vallen)) {
|
||||
nis_keylen, &nis_key, &nis_keylen,
|
||||
&nis_val, &nis_vallen)) {
|
||||
nis_state = native2;
|
||||
goto again;
|
||||
}
|
||||
@@ -482,8 +448,9 @@ struct spwd *getspnam (const char *name)
|
||||
struct spwd *sp;
|
||||
|
||||
#ifdef USE_NIS
|
||||
char buf[BUFSIZ];
|
||||
static char save_name[16];
|
||||
bool nis_disabled = false;
|
||||
int nis_disabled = 0;
|
||||
#endif
|
||||
|
||||
setspent ();
|
||||
@@ -493,20 +460,18 @@ struct spwd *getspnam (const char *name)
|
||||
* Search the shadow.byname map for this user.
|
||||
*/
|
||||
|
||||
if (!nis_ignore && !nis_bound) {
|
||||
if (!nis_ignore && !nis_bound)
|
||||
bind_nis ();
|
||||
}
|
||||
|
||||
if (!nis_ignore && nis_bound) {
|
||||
char *cp;
|
||||
|
||||
if (yp_match (nis_domain, "shadow.byname", name,
|
||||
strlen (name), &nis_val, &nis_vallen) == 0) {
|
||||
strlen (name), &nis_val, &nis_vallen) == 0) {
|
||||
|
||||
cp = strchr (nis_val, '\n');
|
||||
if (NULL != cp) {
|
||||
if (NULL != cp)
|
||||
*cp = '\0';
|
||||
}
|
||||
|
||||
nis_state = middle;
|
||||
sp = my_sgetspent (nis_val);
|
||||
@@ -517,9 +482,8 @@ struct spwd *getspnam (const char *name)
|
||||
}
|
||||
endspent ();
|
||||
return sp;
|
||||
} else {
|
||||
} else
|
||||
nis_state = native2;
|
||||
}
|
||||
}
|
||||
#endif
|
||||
#ifdef USE_NIS
|
||||
@@ -531,19 +495,17 @@ struct spwd *getspnam (const char *name)
|
||||
*/
|
||||
|
||||
if (nis_used) {
|
||||
nis_ignore = true;
|
||||
nis_disabled = true;
|
||||
nis_ignore++;
|
||||
nis_disabled++;
|
||||
}
|
||||
#endif
|
||||
while ((sp = getspent ()) != (struct spwd *) 0) {
|
||||
if (strcmp (name, sp->sp_namp) == 0) {
|
||||
if (strcmp (name, sp->sp_namp) == 0)
|
||||
break;
|
||||
}
|
||||
}
|
||||
#ifdef USE_NIS
|
||||
if (nis_disabled) {
|
||||
nis_ignore = false;
|
||||
}
|
||||
if (nis_disabled)
|
||||
nis_ignore--;
|
||||
#endif
|
||||
endspent ();
|
||||
return (sp);
|
||||
@@ -551,4 +513,3 @@ struct spwd *getspnam (const char *name)
|
||||
#else
|
||||
extern int errno; /* warning: ANSI C forbids an empty source file */
|
||||
#endif
|
||||
|
||||
|
||||
129
lib/shadowio.c
129
lib/shadowio.c
@@ -3,7 +3,7 @@
|
||||
* Copyright (c) 1996 - 2000, Marek Michałkiewicz
|
||||
* Copyright (c) 2001 , Michał Moskal
|
||||
* Copyright (c) 2005 , Tomasz Kłoczko
|
||||
* Copyright (c) 2007 - 2009, Nicolas François
|
||||
* Copyright (c) 2007 - 2008, Nicolas François
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
@@ -40,25 +40,22 @@
|
||||
#include <shadow.h>
|
||||
#include <stdio.h>
|
||||
#include "commonio.h"
|
||||
#include "getdef.h"
|
||||
#include "shadowio.h"
|
||||
#ifdef WITH_TCB
|
||||
#include <tcb.h>
|
||||
#include "tcbfuncs.h"
|
||||
#endif /* WITH_TCB */
|
||||
|
||||
static /*@null@*/ /*@only@*/void *shadow_dup (const void *ent)
|
||||
static void *shadow_dup (const void *ent)
|
||||
{
|
||||
const struct spwd *sp = ent;
|
||||
|
||||
return __spw_dup (sp);
|
||||
}
|
||||
|
||||
static void shadow_free (/*@out@*//*@only@*/void *ent)
|
||||
static void shadow_free (void *ent)
|
||||
{
|
||||
struct spwd *sp = ent;
|
||||
|
||||
spw_free (sp);
|
||||
free (sp->sp_namp);
|
||||
free (sp->sp_pwdp);
|
||||
free (sp);
|
||||
}
|
||||
|
||||
static const char *shadow_getname (const void *ent)
|
||||
@@ -77,12 +74,6 @@ static int shadow_put (const void *ent, FILE * file)
|
||||
{
|
||||
const struct spwd *sp = ent;
|
||||
|
||||
if ( (NULL == sp)
|
||||
|| (valid_field (sp->sp_namp, ":\n") == -1)
|
||||
|| (valid_field (sp->sp_pwdp, ":\n") == -1)) {
|
||||
return -1;
|
||||
}
|
||||
|
||||
return (putspent (sp, file) == -1) ? -1 : 0;
|
||||
}
|
||||
|
||||
@@ -104,81 +95,37 @@ static struct commonio_db shadow_db = {
|
||||
NULL, /* fp */
|
||||
#ifdef WITH_SELINUX
|
||||
NULL, /* scontext */
|
||||
#endif /* WITH_SELINUX */
|
||||
0400, /* st_mode */
|
||||
0, /* st_uid */
|
||||
0, /* st_gid */
|
||||
#endif
|
||||
NULL, /* head */
|
||||
NULL, /* tail */
|
||||
NULL, /* cursor */
|
||||
false, /* changed */
|
||||
false, /* isopen */
|
||||
false, /* locked */
|
||||
false, /* readonly */
|
||||
false /* setname */
|
||||
0, /* changed */
|
||||
0, /* isopen */
|
||||
0, /* locked */
|
||||
0 /* readonly */
|
||||
};
|
||||
|
||||
int spw_setdbname (const char *filename)
|
||||
int spw_name (const char *filename)
|
||||
{
|
||||
return commonio_setname (&shadow_db, filename);
|
||||
}
|
||||
|
||||
/*@observer@*/const char *spw_dbname (void)
|
||||
int spw_file_present (void)
|
||||
{
|
||||
return shadow_db.filename;
|
||||
}
|
||||
|
||||
bool spw_file_present (void)
|
||||
{
|
||||
if (getdef_bool ("FORCE_SHADOW"))
|
||||
return true;
|
||||
return commonio_present (&shadow_db);
|
||||
}
|
||||
|
||||
int spw_lock (void)
|
||||
{
|
||||
#ifdef WITH_TCB
|
||||
int retval = 0;
|
||||
|
||||
if (!getdef_bool ("USE_TCB")) {
|
||||
#endif /* WITH_TCB */
|
||||
return commonio_lock (&shadow_db);
|
||||
#ifdef WITH_TCB
|
||||
}
|
||||
if (shadowtcb_drop_priv () == SHADOWTCB_FAILURE) {
|
||||
return 0;
|
||||
}
|
||||
if (lckpwdf_tcb (shadow_db.filename) == 0) {
|
||||
shadow_db.locked = 1;
|
||||
retval = 1;
|
||||
}
|
||||
if (shadowtcb_gain_priv () == SHADOWTCB_FAILURE) {
|
||||
return 0;
|
||||
}
|
||||
return retval;
|
||||
#endif /* WITH_TCB */
|
||||
return commonio_lock (&shadow_db);
|
||||
}
|
||||
|
||||
int spw_open (int mode)
|
||||
{
|
||||
int retval = 0;
|
||||
#ifdef WITH_TCB
|
||||
bool use_tcb = getdef_bool ("USE_TCB");
|
||||
|
||||
if (use_tcb && (shadowtcb_drop_priv () == SHADOWTCB_FAILURE)) {
|
||||
return 0;
|
||||
}
|
||||
#endif /* WITH_TCB */
|
||||
retval = commonio_open (&shadow_db, mode);
|
||||
#ifdef WITH_TCB
|
||||
if (use_tcb && (shadowtcb_gain_priv () == SHADOWTCB_FAILURE)) {
|
||||
return 0;
|
||||
}
|
||||
#endif /* WITH_TCB */
|
||||
return retval;
|
||||
return commonio_open (&shadow_db, mode);
|
||||
}
|
||||
|
||||
/*@observer@*/ /*@null@*/const struct spwd *spw_locate (const char *name)
|
||||
const struct spwd *spw_locate (const char *name)
|
||||
{
|
||||
return commonio_locate (&shadow_db, name);
|
||||
}
|
||||
@@ -198,52 +145,19 @@ int spw_rewind (void)
|
||||
return commonio_rewind (&shadow_db);
|
||||
}
|
||||
|
||||
/*@observer@*/ /*@null@*/const struct spwd *spw_next (void)
|
||||
const struct spwd *spw_next (void)
|
||||
{
|
||||
return commonio_next (&shadow_db);
|
||||
}
|
||||
|
||||
int spw_close (void)
|
||||
{
|
||||
int retval = 0;
|
||||
#ifdef WITH_TCB
|
||||
bool use_tcb = getdef_bool ("USE_TCB");
|
||||
|
||||
if (use_tcb && (shadowtcb_drop_priv () == SHADOWTCB_FAILURE)) {
|
||||
return 0;
|
||||
}
|
||||
#endif /* WITH_TCB */
|
||||
retval = commonio_close (&shadow_db);
|
||||
#ifdef WITH_TCB
|
||||
if (use_tcb && (shadowtcb_gain_priv () == SHADOWTCB_FAILURE)) {
|
||||
return 0;
|
||||
}
|
||||
#endif /* WITH_TCB */
|
||||
return retval;
|
||||
return commonio_close (&shadow_db);
|
||||
}
|
||||
|
||||
int spw_unlock (void)
|
||||
{
|
||||
#ifdef WITH_TCB
|
||||
int retval = 0;
|
||||
|
||||
if (!getdef_bool ("USE_TCB")) {
|
||||
#endif /* WITH_TCB */
|
||||
return commonio_unlock (&shadow_db);
|
||||
#ifdef WITH_TCB
|
||||
}
|
||||
if (shadowtcb_drop_priv () == SHADOWTCB_FAILURE) {
|
||||
return 0;
|
||||
}
|
||||
if (ulckpwdf_tcb () == 0) {
|
||||
shadow_db.locked = 0;
|
||||
retval = 1;
|
||||
}
|
||||
if (shadowtcb_gain_priv () == SHADOWTCB_FAILURE) {
|
||||
return 0;
|
||||
}
|
||||
return retval;
|
||||
#endif /* WITH_TCB */
|
||||
return commonio_unlock (&shadow_db);
|
||||
}
|
||||
|
||||
struct commonio_entry *__spw_get_head (void)
|
||||
@@ -259,10 +173,5 @@ void __spw_del_entry (const struct commonio_entry *ent)
|
||||
/* Sort with respect to passwd ordering. */
|
||||
int spw_sort ()
|
||||
{
|
||||
#ifdef WITH_TCB
|
||||
if (getdef_bool ("USE_TCB")) {
|
||||
return 0;
|
||||
}
|
||||
#endif /* WITH_TCB */
|
||||
return commonio_sort_wrt (&shadow_db, __pw_get_db ());
|
||||
}
|
||||
|
||||
@@ -30,24 +30,16 @@
|
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
/* $Id$ */
|
||||
#ifndef SHADOWIO_H
|
||||
#define SHADOWIO_H
|
||||
|
||||
#include "defines.h"
|
||||
|
||||
extern int spw_close (void);
|
||||
extern bool spw_file_present (void);
|
||||
extern /*@observer@*/ /*@null@*/const struct spwd *spw_locate (const char *name);
|
||||
extern int spw_file_present (void);
|
||||
extern const struct spwd *spw_locate (const char *);
|
||||
extern int spw_lock (void);
|
||||
extern int spw_setdbname (const char *filename);
|
||||
extern /*@observer@*/const char *spw_dbname (void);
|
||||
extern /*@observer@*/ /*@null@*/const struct spwd *spw_next (void);
|
||||
extern int spw_open (int mode);
|
||||
extern int spw_remove (const char *name);
|
||||
extern int spw_name (const char *);
|
||||
extern const struct spwd *spw_next (void);
|
||||
extern int spw_open (int);
|
||||
extern int spw_remove (const char *);
|
||||
extern int spw_rewind (void);
|
||||
extern int spw_unlock (void);
|
||||
extern int spw_update (const struct spwd *sp);
|
||||
extern int spw_update (const struct spwd *);
|
||||
extern int spw_sort (void);
|
||||
|
||||
#endif
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
* Copyright (c) 1996 - 2000, Marek Michałkiewicz
|
||||
* Copyright (c) 2001 , Michał Moskal
|
||||
* Copyright (c) 2005 , Tomasz Kłoczko
|
||||
* Copyright (c) 2007 - 2013, Nicolas François
|
||||
* Copyright (c) 2007 - 2008, Nicolas François
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
@@ -41,49 +41,17 @@
|
||||
#include <stdio.h>
|
||||
#include "shadowio.h"
|
||||
|
||||
/*@null@*/ /*@only@*/struct spwd *__spw_dup (const struct spwd *spent)
|
||||
struct spwd *__spw_dup (const struct spwd *spent)
|
||||
{
|
||||
struct spwd *sp;
|
||||
|
||||
sp = (struct spwd *) malloc (sizeof *sp);
|
||||
if (NULL == sp) {
|
||||
if (!(sp = (struct spwd *) malloc (sizeof *sp)))
|
||||
return NULL;
|
||||
}
|
||||
/* The libc might define other fields. They won't be copied. */
|
||||
memset (sp, 0, sizeof *sp);
|
||||
sp->sp_lstchg = spent->sp_lstchg;
|
||||
sp->sp_min = spent->sp_min;
|
||||
sp->sp_max = spent->sp_max;
|
||||
sp->sp_warn = spent->sp_warn;
|
||||
sp->sp_inact = spent->sp_inact;
|
||||
sp->sp_expire = spent->sp_expire;
|
||||
sp->sp_flag = spent->sp_flag;
|
||||
/*@-mustfreeonly@*/
|
||||
sp->sp_namp = strdup (spent->sp_namp);
|
||||
/*@=mustfreeonly@*/
|
||||
if (NULL == sp->sp_namp) {
|
||||
free(sp);
|
||||
*sp = *spent;
|
||||
if (!(sp->sp_namp = strdup (spent->sp_namp)))
|
||||
return NULL;
|
||||
}
|
||||
/*@-mustfreeonly@*/
|
||||
sp->sp_pwdp = strdup (spent->sp_pwdp);
|
||||
/*@=mustfreeonly@*/
|
||||
if (NULL == sp->sp_pwdp) {
|
||||
free(sp->sp_namp);
|
||||
free(sp);
|
||||
if (!(sp->sp_pwdp = strdup (spent->sp_pwdp)))
|
||||
return NULL;
|
||||
}
|
||||
|
||||
return sp;
|
||||
}
|
||||
|
||||
void spw_free (/*@out@*/ /*@only@*/struct spwd *spent)
|
||||
{
|
||||
free (spent->sp_namp);
|
||||
if (NULL != spent->sp_pwdp) {
|
||||
memzero (spent->sp_pwdp, strlen (spent->sp_pwdp));
|
||||
free (spent->sp_pwdp);
|
||||
}
|
||||
free (spent);
|
||||
}
|
||||
|
||||
|
||||
84
lib/spawn.c
84
lib/spawn.c
@@ -1,84 +0,0 @@
|
||||
/*
|
||||
* Copyright (c) 2011 , Jonathan Nieder
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. The name of the copyright holders or contributors may not be used to
|
||||
* endorse or promote products derived from this software without
|
||||
* specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
|
||||
* PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
* HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include <config.h>
|
||||
|
||||
#include <stdio.h>
|
||||
#include <sys/types.h>
|
||||
#include <sys/wait.h>
|
||||
#include <unistd.h>
|
||||
#include <errno.h>
|
||||
#include <string.h>
|
||||
#include "exitcodes.h"
|
||||
#include "prototypes.h"
|
||||
|
||||
int run_command (const char *cmd, const char *argv[],
|
||||
/*@null@*/const char *envp[], /*@out@*/int *status)
|
||||
{
|
||||
pid_t pid, wpid;
|
||||
|
||||
if (NULL == envp) {
|
||||
envp = (const char **)environ;
|
||||
}
|
||||
|
||||
(void) fflush (stdout);
|
||||
(void) fflush (shadow_logfd);
|
||||
|
||||
pid = fork ();
|
||||
if (0 == pid) {
|
||||
(void) execve (cmd, (char * const *) argv,
|
||||
(char * const *) envp);
|
||||
if (ENOENT == errno) {
|
||||
exit (E_CMD_NOTFOUND);
|
||||
}
|
||||
fprintf (shadow_logfd, "%s: cannot execute %s: %s\n",
|
||||
Prog, cmd, strerror (errno));
|
||||
exit (E_CMD_NOEXEC);
|
||||
} else if ((pid_t)-1 == pid) {
|
||||
fprintf (shadow_logfd, "%s: cannot execute %s: %s\n",
|
||||
Prog, cmd, strerror (errno));
|
||||
return -1;
|
||||
}
|
||||
|
||||
do {
|
||||
wpid = waitpid (pid, status, 0);
|
||||
if ((pid_t)-1 == wpid && errno == ECHILD)
|
||||
break;
|
||||
} while ( ((pid_t)-1 == wpid && errno == EINTR)
|
||||
|| ((pid_t)-1 != wpid && wpid != pid));
|
||||
|
||||
if ((pid_t)-1 == wpid) {
|
||||
fprintf (shadow_logfd, "%s: waitpid (status: %d): %s\n",
|
||||
Prog, *status, strerror (errno));
|
||||
return -1;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
73
lib/sssd.c
73
lib/sssd.c
@@ -1,73 +0,0 @@
|
||||
/* Author: Peter Vrabec <pvrabec@redhat.com> */
|
||||
|
||||
#include <config.h>
|
||||
#ifdef USE_SSSD
|
||||
|
||||
#include <stdio.h>
|
||||
#include <sys/wait.h>
|
||||
#include <sys/types.h>
|
||||
#include "exitcodes.h"
|
||||
#include "defines.h"
|
||||
#include "prototypes.h"
|
||||
#include "sssd.h"
|
||||
|
||||
#define MSG_SSSD_FLUSH_CACHE_FAILED "%s: Failed to flush the sssd cache."
|
||||
|
||||
int sssd_flush_cache (int dbflags)
|
||||
{
|
||||
int status, code, rv;
|
||||
const char *cmd = "/usr/sbin/sss_cache";
|
||||
char *sss_cache_args = NULL;
|
||||
const char *spawnedArgs[] = {"sss_cache", NULL, NULL};
|
||||
const char *spawnedEnv[] = {NULL};
|
||||
int i = 0;
|
||||
|
||||
sss_cache_args = malloc(4);
|
||||
if (sss_cache_args == NULL) {
|
||||
return -1;
|
||||
}
|
||||
|
||||
sss_cache_args[i++] = '-';
|
||||
if (dbflags & SSSD_DB_PASSWD) {
|
||||
sss_cache_args[i++] = 'U';
|
||||
}
|
||||
if (dbflags & SSSD_DB_GROUP) {
|
||||
sss_cache_args[i++] = 'G';
|
||||
}
|
||||
sss_cache_args[i++] = '\0';
|
||||
if (i == 2) {
|
||||
/* Neither passwd nor group, nothing to do */
|
||||
free(sss_cache_args);
|
||||
return 0;
|
||||
}
|
||||
spawnedArgs[1] = sss_cache_args;
|
||||
|
||||
rv = run_command (cmd, spawnedArgs, spawnedEnv, &status);
|
||||
free(sss_cache_args);
|
||||
if (rv != 0) {
|
||||
/* run_command writes its own more detailed message. */
|
||||
SYSLOG ((LOG_WARN, MSG_SSSD_FLUSH_CACHE_FAILED, Prog));
|
||||
return -1;
|
||||
}
|
||||
|
||||
code = WEXITSTATUS (status);
|
||||
if (!WIFEXITED (status)) {
|
||||
SYSLOG ((LOG_WARN, "%s: sss_cache did not terminate normally (signal %d)",
|
||||
Prog, WTERMSIG (status)));
|
||||
return -1;
|
||||
} else if (code == E_CMD_NOTFOUND) {
|
||||
/* sss_cache is not installed, or it is installed but uses an
|
||||
interpreter that is missing. Probably the former. */
|
||||
return 0;
|
||||
} else if (code != 0) {
|
||||
SYSLOG ((LOG_WARN, "%s: sss_cache exited with status %d", Prog, code));
|
||||
SYSLOG ((LOG_WARN, MSG_SSSD_FLUSH_CACHE_FAILED, Prog));
|
||||
return -1;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
#else /* USE_SSSD */
|
||||
extern int errno; /* warning: ANSI C forbids an empty source file */
|
||||
#endif /* USE_SSSD */
|
||||
|
||||
17
lib/sssd.h
17
lib/sssd.h
@@ -1,17 +0,0 @@
|
||||
#ifndef _SSSD_H_
|
||||
#define _SSSD_H_
|
||||
|
||||
#define SSSD_DB_PASSWD 0x001
|
||||
#define SSSD_DB_GROUP 0x002
|
||||
|
||||
/*
|
||||
* sssd_flush_cache - flush specified service buffer in sssd cache
|
||||
*/
|
||||
#ifdef USE_SSSD
|
||||
extern int sssd_flush_cache (int dbflags);
|
||||
#else
|
||||
#define sssd_flush_cache(service) (0)
|
||||
#endif
|
||||
|
||||
#endif
|
||||
|
||||
1052
lib/subordinateio.c
1052
lib/subordinateio.c
File diff suppressed because it is too large
Load Diff
@@ -1,48 +0,0 @@
|
||||
/*
|
||||
* Copyright (c) 2012- Eric W. Biederman
|
||||
*/
|
||||
|
||||
#ifndef _SUBORDINATEIO_H
|
||||
#define _SUBORDINATEIO_H
|
||||
|
||||
#include <config.h>
|
||||
|
||||
#ifdef ENABLE_SUBIDS
|
||||
|
||||
#include <sys/types.h>
|
||||
|
||||
#include "../libsubid/subid.h"
|
||||
|
||||
extern int sub_uid_close(void);
|
||||
extern bool have_sub_uids(const char *owner, uid_t start, unsigned long count);
|
||||
extern bool sub_uid_file_present (void);
|
||||
extern bool local_sub_uid_assigned(const char *owner);
|
||||
extern int sub_uid_lock (void);
|
||||
extern int sub_uid_setdbname (const char *filename);
|
||||
extern /*@observer@*/const char *sub_uid_dbname (void);
|
||||
extern int sub_uid_open (int mode);
|
||||
extern int sub_uid_unlock (void);
|
||||
extern int sub_uid_add (const char *owner, uid_t start, unsigned long count);
|
||||
extern int sub_uid_remove (const char *owner, uid_t start, unsigned long count);
|
||||
extern uid_t sub_uid_find_free_range(uid_t min, uid_t max, unsigned long count);
|
||||
extern int list_owner_ranges(const char *owner, enum subid_type id_type, struct subid_range **ranges);
|
||||
extern bool new_subid_range(struct subordinate_range *range, enum subid_type id_type, bool reuse);
|
||||
extern bool release_subid_range(struct subordinate_range *range, enum subid_type id_type);
|
||||
extern int find_subid_owners(unsigned long id, enum subid_type id_type, uid_t **uids);
|
||||
extern void free_subordinate_ranges(struct subordinate_range **ranges, int count);
|
||||
|
||||
extern int sub_gid_close(void);
|
||||
extern bool have_sub_gids(const char *owner, gid_t start, unsigned long count);
|
||||
extern bool sub_gid_file_present (void);
|
||||
extern bool local_sub_gid_assigned(const char *owner);
|
||||
extern int sub_gid_lock (void);
|
||||
extern int sub_gid_setdbname (const char *filename);
|
||||
extern /*@observer@*/const char *sub_gid_dbname (void);
|
||||
extern int sub_gid_open (int mode);
|
||||
extern int sub_gid_unlock (void);
|
||||
extern int sub_gid_add (const char *owner, gid_t start, unsigned long count);
|
||||
extern int sub_gid_remove (const char *owner, gid_t start, unsigned long count);
|
||||
extern uid_t sub_gid_find_free_range(gid_t min, gid_t max, unsigned long count);
|
||||
#endif /* ENABLE_SUBIDS */
|
||||
|
||||
#endif
|
||||
613
lib/tcbfuncs.c
613
lib/tcbfuncs.c
@@ -1,613 +0,0 @@
|
||||
/*
|
||||
* Copyright (c) 2001 Rafal Wojtczuk, Solar Designer
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
|
||||
* PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
* HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#define _GNU_SOURCE
|
||||
|
||||
#include <errno.h>
|
||||
#include <fcntl.h>
|
||||
#include <grp.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <sys/stat.h>
|
||||
#include <tcb.h>
|
||||
#include <unistd.h>
|
||||
|
||||
#include "config.h"
|
||||
|
||||
#include "defines.h"
|
||||
#include "prototypes.h"
|
||||
#include "getdef.h"
|
||||
#include "shadowio.h"
|
||||
#include "tcbfuncs.h"
|
||||
|
||||
#define SHADOWTCB_HASH_BY 1000
|
||||
#define SHADOWTCB_LOCK_SUFFIX ".lock"
|
||||
|
||||
static /*@null@*//*@only@*/char *stored_tcb_user = NULL;
|
||||
|
||||
shadowtcb_status shadowtcb_drop_priv (void)
|
||||
{
|
||||
if (!getdef_bool ("USE_TCB")) {
|
||||
return SHADOWTCB_SUCCESS;
|
||||
}
|
||||
|
||||
if (NULL != stored_tcb_user) {
|
||||
if (tcb_drop_priv (stored_tcb_user) == 0) {
|
||||
return SHADOWTCB_SUCCESS;
|
||||
}
|
||||
}
|
||||
|
||||
return SHADOWTCB_FAILURE;
|
||||
}
|
||||
|
||||
shadowtcb_status shadowtcb_gain_priv (void)
|
||||
{
|
||||
if (!getdef_bool ("USE_TCB")) {
|
||||
return SHADOWTCB_SUCCESS;
|
||||
}
|
||||
|
||||
return (tcb_gain_priv () == 0) ? SHADOWTCB_SUCCESS : SHADOWTCB_FAILURE;
|
||||
}
|
||||
|
||||
/* In case something goes wrong, we return immediately, not polluting the
|
||||
* code with free(). All errors are fatal, so the application is expected
|
||||
* to exit soon.
|
||||
*/
|
||||
#define OUT_OF_MEMORY do { \
|
||||
fprintf (shadow_logfd, _("%s: out of memory\n"), Prog); \
|
||||
(void) fflush (shadow_logfd); \
|
||||
} while (false)
|
||||
|
||||
/* Returns user's tcb directory path relative to TCB_DIR. */
|
||||
static /*@null@*/ char *shadowtcb_path_rel (const char *name, uid_t uid)
|
||||
{
|
||||
char *ret;
|
||||
|
||||
if (!getdef_bool ("TCB_SYMLINKS") || uid < SHADOWTCB_HASH_BY) {
|
||||
if (asprintf (&ret, "%s", name) == -1) {
|
||||
OUT_OF_MEMORY;
|
||||
return NULL;
|
||||
}
|
||||
} else if (uid < SHADOWTCB_HASH_BY * SHADOWTCB_HASH_BY) {
|
||||
if (asprintf (&ret, ":%dK/%s",
|
||||
uid / SHADOWTCB_HASH_BY, name) == -1) {
|
||||
OUT_OF_MEMORY;
|
||||
return NULL;
|
||||
}
|
||||
} else {
|
||||
if (asprintf (&ret, ":%dM/:%dK/%s",
|
||||
uid / (SHADOWTCB_HASH_BY * SHADOWTCB_HASH_BY),
|
||||
(uid % (SHADOWTCB_HASH_BY * SHADOWTCB_HASH_BY)) / SHADOWTCB_HASH_BY,
|
||||
name) == -1) {
|
||||
OUT_OF_MEMORY;
|
||||
return NULL;
|
||||
}
|
||||
}
|
||||
return ret;
|
||||
}
|
||||
|
||||
static /*@null@*/ char *shadowtcb_path_rel_existing (const char *name)
|
||||
{
|
||||
char *path, *rval;
|
||||
struct stat st;
|
||||
char link[8192];
|
||||
ssize_t ret;
|
||||
|
||||
if (asprintf (&path, TCB_DIR "/%s", name) == -1) {
|
||||
OUT_OF_MEMORY;
|
||||
return NULL;
|
||||
}
|
||||
if (lstat (path, &st) != 0) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Cannot stat %s: %s\n"),
|
||||
Prog, path, strerror (errno));
|
||||
free (path);
|
||||
return NULL;
|
||||
}
|
||||
if (S_ISDIR (st.st_mode)) {
|
||||
free (path);
|
||||
rval = strdup (name);
|
||||
if (NULL == rval) {
|
||||
OUT_OF_MEMORY;
|
||||
return NULL;
|
||||
}
|
||||
return rval;
|
||||
}
|
||||
if (!S_ISLNK (st.st_mode)) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: %s is neither a directory, nor a symlink.\n"),
|
||||
Prog, path);
|
||||
free (path);
|
||||
return NULL;
|
||||
}
|
||||
ret = readlink (path, link, sizeof (link) - 1);
|
||||
if (-1 == ret) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Cannot read symbolic link %s: %s\n"),
|
||||
Prog, path, strerror (errno));
|
||||
free (path);
|
||||
return NULL;
|
||||
}
|
||||
free (path);
|
||||
if ((size_t)ret >= sizeof(link) - 1) {
|
||||
link[sizeof(link) - 1] = '\0';
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Suspiciously long symlink: %s\n"),
|
||||
Prog, link);
|
||||
return NULL;
|
||||
}
|
||||
link[(size_t)ret] = '\0';
|
||||
rval = strdup (link);
|
||||
if (NULL == rval) {
|
||||
OUT_OF_MEMORY;
|
||||
return NULL;
|
||||
}
|
||||
return rval;
|
||||
}
|
||||
|
||||
static /*@null@*/ char *shadowtcb_path (const char *name, uid_t uid)
|
||||
{
|
||||
char *ret, *rel;
|
||||
|
||||
rel = shadowtcb_path_rel (name, uid);
|
||||
if (NULL == rel) {
|
||||
return NULL;
|
||||
}
|
||||
if (asprintf (&ret, TCB_DIR "/%s", rel) == -1) {
|
||||
OUT_OF_MEMORY;
|
||||
free (rel);
|
||||
return NULL;
|
||||
}
|
||||
free (rel);
|
||||
return ret;
|
||||
}
|
||||
|
||||
static /*@null@*/ char *shadowtcb_path_existing (const char *name)
|
||||
{
|
||||
char *ret, *rel;
|
||||
|
||||
rel = shadowtcb_path_rel_existing (name);
|
||||
if (NULL == rel) {
|
||||
return NULL;
|
||||
}
|
||||
if (asprintf (&ret, TCB_DIR "/%s", rel) == -1) {
|
||||
OUT_OF_MEMORY;
|
||||
free (rel);
|
||||
return NULL;
|
||||
}
|
||||
free (rel);
|
||||
return ret;
|
||||
}
|
||||
|
||||
static shadowtcb_status mkdir_leading (const char *name, uid_t uid)
|
||||
{
|
||||
char *ind, *dir, *ptr, *path = shadowtcb_path_rel (name, uid);
|
||||
struct stat st;
|
||||
|
||||
if (NULL == path) {
|
||||
return SHADOWTCB_FAILURE;
|
||||
}
|
||||
ptr = path;
|
||||
if (stat (TCB_DIR, &st) != 0) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Cannot stat %s: %s\n"),
|
||||
Prog, TCB_DIR, strerror (errno));
|
||||
goto out_free_path;
|
||||
}
|
||||
while ((ind = strchr (ptr, '/'))) {
|
||||
*ind = '\0';
|
||||
if (asprintf (&dir, TCB_DIR "/%s", path) == -1) {
|
||||
OUT_OF_MEMORY;
|
||||
return SHADOWTCB_FAILURE;
|
||||
}
|
||||
if ((mkdir (dir, 0700) != 0) && (errno != EEXIST)) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Cannot create directory %s: %s\n"),
|
||||
Prog, dir, strerror (errno));
|
||||
goto out_free_dir;
|
||||
}
|
||||
if (chown (dir, 0, st.st_gid) != 0) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Cannot change owner of %s: %s\n"),
|
||||
Prog, dir, strerror (errno));
|
||||
goto out_free_dir;
|
||||
}
|
||||
if (chmod (dir, 0711) != 0) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Cannot change mode of %s: %s\n"),
|
||||
Prog, dir, strerror (errno));
|
||||
goto out_free_dir;
|
||||
}
|
||||
free (dir);
|
||||
*ind = '/';
|
||||
ptr = ind + 1;
|
||||
}
|
||||
free (path);
|
||||
return SHADOWTCB_SUCCESS;
|
||||
out_free_dir:
|
||||
free (dir);
|
||||
out_free_path:
|
||||
free (path);
|
||||
return SHADOWTCB_FAILURE;
|
||||
}
|
||||
|
||||
static shadowtcb_status unlink_suffs (const char *user)
|
||||
{
|
||||
static char *suffs[] = { "+", "-", SHADOWTCB_LOCK_SUFFIX };
|
||||
char *tmp;
|
||||
int i;
|
||||
|
||||
for (i = 0; i < 3; i++) {
|
||||
if (asprintf (&tmp, TCB_FMT "%s", user, suffs[i]) == -1) {
|
||||
OUT_OF_MEMORY;
|
||||
return SHADOWTCB_FAILURE;
|
||||
}
|
||||
if ((unlink (tmp) != 0) && (errno != ENOENT)) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: unlink: %s: %s\n"),
|
||||
Prog, tmp, strerror (errno));
|
||||
free (tmp);
|
||||
return SHADOWTCB_FAILURE;
|
||||
}
|
||||
free (tmp);
|
||||
}
|
||||
|
||||
return SHADOWTCB_SUCCESS;
|
||||
}
|
||||
|
||||
/* path should be a relative existing tcb directory */
|
||||
static shadowtcb_status rmdir_leading (char *path)
|
||||
{
|
||||
char *ind, *dir;
|
||||
shadowtcb_status ret = SHADOWTCB_SUCCESS;
|
||||
while ((ind = strrchr (path, '/'))) {
|
||||
*ind = '\0';
|
||||
if (asprintf (&dir, TCB_DIR "/%s", path) == -1) {
|
||||
OUT_OF_MEMORY;
|
||||
return SHADOWTCB_FAILURE;
|
||||
}
|
||||
if (rmdir (dir) != 0) {
|
||||
if (errno != ENOTEMPTY) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Cannot remove directory %s: %s\n"),
|
||||
Prog, dir, strerror (errno));
|
||||
ret = SHADOWTCB_FAILURE;
|
||||
}
|
||||
free (dir);
|
||||
break;
|
||||
}
|
||||
free (dir);
|
||||
}
|
||||
return ret;
|
||||
}
|
||||
|
||||
static shadowtcb_status move_dir (const char *user_newname, uid_t user_newid)
|
||||
{
|
||||
char *olddir = NULL, *newdir = NULL;
|
||||
char *real_old_dir = NULL, *real_new_dir = NULL;
|
||||
char *real_old_dir_rel = NULL, *real_new_dir_rel = NULL;
|
||||
uid_t old_uid, the_newid;
|
||||
struct stat oldmode;
|
||||
shadowtcb_status ret = SHADOWTCB_FAILURE;
|
||||
|
||||
if (NULL == stored_tcb_user) {
|
||||
return SHADOWTCB_FAILURE;
|
||||
}
|
||||
if (asprintf (&olddir, TCB_DIR "/%s", stored_tcb_user) == -1) {
|
||||
goto out_free_nomem;
|
||||
}
|
||||
if (stat (olddir, &oldmode) != 0) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Cannot stat %s: %s\n"),
|
||||
Prog, olddir, strerror (errno));
|
||||
goto out_free;
|
||||
}
|
||||
old_uid = oldmode.st_uid;
|
||||
the_newid = (user_newid == -1) ? old_uid : user_newid;
|
||||
real_old_dir = shadowtcb_path_existing (stored_tcb_user);
|
||||
if (NULL == real_old_dir) {
|
||||
goto out_free;
|
||||
}
|
||||
real_new_dir = shadowtcb_path (user_newname, the_newid);
|
||||
if (NULL == real_new_dir) {
|
||||
goto out_free;
|
||||
}
|
||||
if (strcmp (real_old_dir, real_new_dir) == 0) {
|
||||
ret = SHADOWTCB_SUCCESS;
|
||||
goto out_free;
|
||||
}
|
||||
real_old_dir_rel = shadowtcb_path_rel_existing (stored_tcb_user);
|
||||
if (NULL == real_old_dir_rel) {
|
||||
goto out_free;
|
||||
}
|
||||
if (mkdir_leading (user_newname, the_newid) == SHADOWTCB_FAILURE) {
|
||||
goto out_free;
|
||||
}
|
||||
if (rename (real_old_dir, real_new_dir) != 0) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Cannot rename %s to %s: %s\n"),
|
||||
Prog, real_old_dir, real_new_dir, strerror (errno));
|
||||
goto out_free;
|
||||
}
|
||||
if (rmdir_leading (real_old_dir_rel) == SHADOWTCB_FAILURE) {
|
||||
goto out_free;
|
||||
}
|
||||
if ((unlink (olddir) != 0) && (errno != ENOENT)) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Cannot remove %s: %s\n"),
|
||||
Prog, olddir, strerror (errno));
|
||||
goto out_free;
|
||||
}
|
||||
if (asprintf (&newdir, TCB_DIR "/%s", user_newname) == -1) {
|
||||
goto out_free_nomem;
|
||||
}
|
||||
real_new_dir_rel = shadowtcb_path_rel (user_newname, the_newid);
|
||||
if (NULL == real_new_dir_rel) {
|
||||
goto out_free;
|
||||
}
|
||||
if ( (strcmp (real_new_dir, newdir) != 0)
|
||||
&& (symlink (real_new_dir_rel, newdir) != 0)) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Cannot create symbolic link %s: %s\n"),
|
||||
Prog, real_new_dir_rel, strerror (errno));
|
||||
goto out_free;
|
||||
}
|
||||
ret = SHADOWTCB_SUCCESS;
|
||||
goto out_free;
|
||||
out_free_nomem:
|
||||
OUT_OF_MEMORY;
|
||||
out_free:
|
||||
free (olddir);
|
||||
free (newdir);
|
||||
free (real_old_dir);
|
||||
free (real_new_dir);
|
||||
free (real_old_dir_rel);
|
||||
free (real_new_dir_rel);
|
||||
return ret;
|
||||
}
|
||||
|
||||
shadowtcb_status shadowtcb_set_user (const char* name)
|
||||
{
|
||||
char *buf;
|
||||
shadowtcb_status retval;
|
||||
|
||||
if (!getdef_bool ("USE_TCB")) {
|
||||
return SHADOWTCB_SUCCESS;
|
||||
}
|
||||
|
||||
if (NULL != stored_tcb_user) {
|
||||
free (stored_tcb_user);
|
||||
}
|
||||
|
||||
stored_tcb_user = strdup (name);
|
||||
if (NULL == stored_tcb_user) {
|
||||
OUT_OF_MEMORY;
|
||||
return SHADOWTCB_FAILURE;
|
||||
}
|
||||
if (asprintf (&buf, TCB_FMT, name) == -1) {
|
||||
OUT_OF_MEMORY;
|
||||
return SHADOWTCB_FAILURE;
|
||||
}
|
||||
|
||||
retval = (spw_setdbname (buf) != 0) ? SHADOWTCB_SUCCESS : SHADOWTCB_FAILURE;
|
||||
free (buf);
|
||||
return retval;
|
||||
}
|
||||
|
||||
/* tcb directory must be empty before shadowtcb_remove is called. */
|
||||
shadowtcb_status shadowtcb_remove (const char *name)
|
||||
{
|
||||
shadowtcb_status ret = SHADOWTCB_SUCCESS;
|
||||
char *path = shadowtcb_path_existing (name);
|
||||
char *rel = shadowtcb_path_rel_existing (name);
|
||||
if ((NULL == path) || (NULL == rel) || (rmdir (path) != 0)) {
|
||||
return SHADOWTCB_FAILURE;
|
||||
}
|
||||
if (rmdir_leading (rel) == SHADOWTCB_FAILURE) {
|
||||
return SHADOWTCB_FAILURE;
|
||||
}
|
||||
free (path);
|
||||
free (rel);
|
||||
if (asprintf (&path, TCB_DIR "/%s", name) == -1) {
|
||||
OUT_OF_MEMORY;
|
||||
return SHADOWTCB_FAILURE;
|
||||
}
|
||||
if ((unlink (path) != 0) && (errno != ENOENT)) {
|
||||
ret = SHADOWTCB_FAILURE;
|
||||
}
|
||||
free (path);
|
||||
return ret;
|
||||
}
|
||||
|
||||
shadowtcb_status shadowtcb_move (/*@NULL@*/const char *user_newname, uid_t user_newid)
|
||||
{
|
||||
struct stat dirmode, filemode;
|
||||
char *tcbdir, *shadow;
|
||||
shadowtcb_status ret = SHADOWTCB_FAILURE;
|
||||
|
||||
if (!getdef_bool ("USE_TCB")) {
|
||||
return SHADOWTCB_SUCCESS;
|
||||
}
|
||||
if (NULL == stored_tcb_user) {
|
||||
return SHADOWTCB_FAILURE;
|
||||
}
|
||||
if (NULL == user_newname) {
|
||||
user_newname = stored_tcb_user;
|
||||
}
|
||||
if (move_dir (user_newname, user_newid) == SHADOWTCB_FAILURE) {
|
||||
return SHADOWTCB_FAILURE;
|
||||
}
|
||||
if (-1 == user_newid) {
|
||||
return SHADOWTCB_SUCCESS;
|
||||
}
|
||||
if ( (asprintf (&tcbdir, TCB_DIR "/%s", user_newname) == -1)
|
||||
|| (asprintf (&shadow, TCB_FMT, user_newname) == -1)) {
|
||||
OUT_OF_MEMORY;
|
||||
return SHADOWTCB_FAILURE;
|
||||
}
|
||||
if (stat (tcbdir, &dirmode) != 0) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Cannot stat %s: %s\n"),
|
||||
Prog, tcbdir, strerror (errno));
|
||||
goto out_free;
|
||||
}
|
||||
if (chown (tcbdir, 0, 0) != 0) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Cannot change owners of %s: %s\n"),
|
||||
Prog, tcbdir, strerror (errno));
|
||||
goto out_free;
|
||||
}
|
||||
if (chmod (tcbdir, 0700) != 0) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Cannot change mode of %s: %s\n"),
|
||||
Prog, tcbdir, strerror (errno));
|
||||
goto out_free;
|
||||
}
|
||||
if (lstat (shadow, &filemode) != 0) {
|
||||
if (errno != ENOENT) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Cannot lstat %s: %s\n"),
|
||||
Prog, shadow, strerror (errno));
|
||||
goto out_free;
|
||||
}
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Warning, user %s has no tcb shadow file.\n"),
|
||||
Prog, user_newname);
|
||||
} else {
|
||||
if (!S_ISREG (filemode.st_mode) ||
|
||||
filemode.st_nlink != 1) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Emergency: %s's tcb shadow is not a "
|
||||
"regular file with st_nlink=1.\n"
|
||||
"The account is left locked.\n"),
|
||||
Prog, user_newname);
|
||||
goto out_free;
|
||||
}
|
||||
if (chown (shadow, user_newid, filemode.st_gid) != 0) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Cannot change owner of %s: %s\n"),
|
||||
Prog, shadow, strerror (errno));
|
||||
goto out_free;
|
||||
}
|
||||
if (chmod (shadow, filemode.st_mode & 07777) != 0) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Cannot change mode of %s: %s\n"),
|
||||
Prog, shadow, strerror (errno));
|
||||
goto out_free;
|
||||
}
|
||||
}
|
||||
if (unlink_suffs (user_newname) == SHADOWTCB_FAILURE) {
|
||||
goto out_free;
|
||||
}
|
||||
if (chown (tcbdir, user_newid, dirmode.st_gid) != 0) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Cannot change owner of %s: %s\n"),
|
||||
Prog, tcbdir, strerror (errno));
|
||||
goto out_free;
|
||||
}
|
||||
ret = SHADOWTCB_SUCCESS;
|
||||
out_free:
|
||||
free (tcbdir);
|
||||
free (shadow);
|
||||
return ret;
|
||||
}
|
||||
|
||||
shadowtcb_status shadowtcb_create (const char *name, uid_t uid)
|
||||
{
|
||||
char *dir, *shadow;
|
||||
struct stat tcbdir_stat;
|
||||
gid_t shadowgid, authgid;
|
||||
struct group *gr;
|
||||
int fd;
|
||||
shadowtcb_status ret = SHADOWTCB_FAILURE;
|
||||
|
||||
if (!getdef_bool ("USE_TCB")) {
|
||||
return SHADOWTCB_SUCCESS;
|
||||
}
|
||||
if (stat (TCB_DIR, &tcbdir_stat) != 0) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Cannot stat %s: %s\n"),
|
||||
Prog, TCB_DIR, strerror (errno));
|
||||
return SHADOWTCB_FAILURE;
|
||||
}
|
||||
shadowgid = tcbdir_stat.st_gid;
|
||||
authgid = shadowgid;
|
||||
if (getdef_bool ("TCB_AUTH_GROUP")) {
|
||||
gr = getgrnam ("auth");
|
||||
if (NULL != gr) {
|
||||
authgid = gr->gr_gid;
|
||||
}
|
||||
}
|
||||
|
||||
if ( (asprintf (&dir, TCB_DIR "/%s", name) == -1)
|
||||
|| (asprintf (&shadow, TCB_FMT, name) == -1)) {
|
||||
OUT_OF_MEMORY;
|
||||
return SHADOWTCB_FAILURE;
|
||||
}
|
||||
if (mkdir (dir, 0700) != 0) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: mkdir: %s: %s\n"),
|
||||
Prog, dir, strerror (errno));
|
||||
goto out_free;
|
||||
}
|
||||
fd = open (shadow, O_RDWR | O_CREAT | O_TRUNC, 0600);
|
||||
if (fd < 0) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Cannot open %s: %s\n"),
|
||||
Prog, shadow, strerror (errno));
|
||||
goto out_free;
|
||||
}
|
||||
close (fd);
|
||||
if (chown (shadow, 0, authgid) != 0) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Cannot change owner of %s: %s\n"),
|
||||
Prog, shadow, strerror (errno));
|
||||
goto out_free;
|
||||
}
|
||||
if (chmod (shadow, (mode_t) ((authgid == shadowgid) ? 0600 : 0640)) != 0) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Cannot change mode of %s: %s\n"),
|
||||
Prog, shadow, strerror (errno));
|
||||
goto out_free;
|
||||
}
|
||||
if (chown (dir, 0, authgid) != 0) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Cannot change owner of %s: %s\n"),
|
||||
Prog, dir, strerror (errno));
|
||||
goto out_free;
|
||||
}
|
||||
if (chmod (dir, (mode_t) ((authgid == shadowgid) ? 02700 : 02710)) != 0) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Cannot change mode of %s: %s\n"),
|
||||
Prog, dir, strerror (errno));
|
||||
goto out_free;
|
||||
}
|
||||
if ( (shadowtcb_set_user (name) == SHADOWTCB_FAILURE)
|
||||
|| (shadowtcb_move (NULL, uid) == SHADOWTCB_FAILURE)) {
|
||||
goto out_free;
|
||||
}
|
||||
ret = SHADOWTCB_SUCCESS;
|
||||
out_free:
|
||||
free (dir);
|
||||
free (shadow);
|
||||
return ret;
|
||||
}
|
||||
|
||||
@@ -1,19 +0,0 @@
|
||||
#ifndef _TCBFUNCS_H
|
||||
#define _TCBFUNCS_H
|
||||
|
||||
#include <sys/types.h>
|
||||
|
||||
typedef enum {
|
||||
SHADOWTCB_FAILURE = 0,
|
||||
SHADOWTCB_SUCCESS = 1
|
||||
} shadowtcb_status;
|
||||
|
||||
extern shadowtcb_status shadowtcb_drop_priv (void);
|
||||
extern shadowtcb_status shadowtcb_gain_priv (void);
|
||||
extern shadowtcb_status shadowtcb_set_user (const char *name);
|
||||
extern shadowtcb_status shadowtcb_remove (const char *name);
|
||||
extern shadowtcb_status shadowtcb_move (/*@null@*/const char *user_newname,
|
||||
uid_t user_newid);
|
||||
extern shadowtcb_status shadowtcb_create (const char *name, uid_t uid);
|
||||
|
||||
#endif
|
||||
19
lib/utent.c
19
lib/utent.c
@@ -88,6 +88,25 @@ struct utmp *getutent (void)
|
||||
|
||||
return &utmp_buf;
|
||||
}
|
||||
|
||||
/*
|
||||
* getutline - get the utmp entry matching ut_line
|
||||
*/
|
||||
|
||||
struct utmp *getutline (const struct utmp *utent)
|
||||
{
|
||||
struct utmp save;
|
||||
struct utmp *new;
|
||||
|
||||
save = *utent;
|
||||
while (new = getutent ())
|
||||
if (strncmp (new->ut_line, save.ut_line, sizeof new->ut_line))
|
||||
continue;
|
||||
else
|
||||
return new;
|
||||
|
||||
return (struct utmp *) 0;
|
||||
}
|
||||
#else
|
||||
extern int errno; /* warning: ANSI C forbids an empty source file */
|
||||
#endif
|
||||
|
||||
@@ -1,11 +1,11 @@
|
||||
|
||||
EXTRA_DIST = .indent.pro xgetXXbyYY.c
|
||||
|
||||
AM_CPPFLAGS = -I$(top_srcdir)/lib $(ECONF_CPPFLAGS)
|
||||
INCLUDES = -I$(top_srcdir)/lib
|
||||
|
||||
noinst_LTLIBRARIES = libmisc.la
|
||||
noinst_LIBRARIES = libmisc.a
|
||||
|
||||
libmisc_la_SOURCES = \
|
||||
libmisc_a_SOURCES = \
|
||||
addgrps.c \
|
||||
age.c \
|
||||
audit_help.c \
|
||||
@@ -14,27 +14,18 @@ libmisc_la_SOURCES = \
|
||||
chkname.h \
|
||||
chowndir.c \
|
||||
chowntty.c \
|
||||
cleanup.c \
|
||||
cleanup_group.c \
|
||||
cleanup_user.c \
|
||||
console.c \
|
||||
copydir.c \
|
||||
entry.c \
|
||||
env.c \
|
||||
failure.c \
|
||||
failure.h \
|
||||
find_new_gid.c \
|
||||
find_new_uid.c \
|
||||
find_new_sub_gids.c \
|
||||
find_new_sub_uids.c \
|
||||
fields.c \
|
||||
find_new_ids.c \
|
||||
getdate.h \
|
||||
getdate.y \
|
||||
getgr_nam_gid.c \
|
||||
getrange.c \
|
||||
gettime.c \
|
||||
getlong.c \
|
||||
hushed.c \
|
||||
idmapping.h \
|
||||
idmapping.c \
|
||||
isexpired.c \
|
||||
limits.c \
|
||||
list.c log.c \
|
||||
@@ -44,14 +35,10 @@ libmisc_la_SOURCES = \
|
||||
myname.c \
|
||||
obscure.c \
|
||||
pam_pass.c \
|
||||
pam_pass_non_interactive.c \
|
||||
prefix_flag.c \
|
||||
pwd2spwd.c \
|
||||
pwdcheck.c \
|
||||
pwd_init.c \
|
||||
remove_tree.c \
|
||||
rlogin.c \
|
||||
root_flag.c \
|
||||
salt.c \
|
||||
setugid.c \
|
||||
setupenv.c \
|
||||
@@ -62,7 +49,6 @@ libmisc_la_SOURCES = \
|
||||
ttytype.c \
|
||||
tz.c \
|
||||
ulimit.c \
|
||||
user_busy.c \
|
||||
utmp.c \
|
||||
valid.c \
|
||||
xgetpwnam.c \
|
||||
@@ -72,8 +58,3 @@ libmisc_la_SOURCES = \
|
||||
xgetspnam.c \
|
||||
xmalloc.c \
|
||||
yesno.c
|
||||
|
||||
if WITH_BTRFS
|
||||
libmisc_la_SOURCES += btrfs.c
|
||||
endif
|
||||
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
* Copyright (c) 1989 - 1994, Julianne Frances Haugh
|
||||
* Copyright (c) 1996 - 1998, Marek Michałkiewicz
|
||||
* Copyright (c) 2001 - 2006, Tomasz Kłoczko
|
||||
* Copyright (c) 2007 - 2009, Nicolas François
|
||||
* Copyright (c) 2007 - 2008, Nicolas François
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
@@ -32,7 +32,7 @@
|
||||
|
||||
#include <config.h>
|
||||
|
||||
#if defined (HAVE_SETGROUPS) && ! defined (USE_PAM)
|
||||
#ifdef HAVE_SETGROUPS
|
||||
|
||||
#include "prototypes.h"
|
||||
#include "defines.h"
|
||||
@@ -52,12 +52,9 @@
|
||||
int add_groups (const char *list)
|
||||
{
|
||||
GETGROUPS_T *grouplist, *tmp;
|
||||
size_t i;
|
||||
int ngroups;
|
||||
bool added;
|
||||
int i, ngroups, added;
|
||||
char *token;
|
||||
char buf[1024];
|
||||
int ret;
|
||||
|
||||
if (strlen (list) >= sizeof (buf)) {
|
||||
errno = EINVAL;
|
||||
@@ -68,17 +65,11 @@ int add_groups (const char *list)
|
||||
i = 16;
|
||||
for (;;) {
|
||||
grouplist = (gid_t *) malloc (i * sizeof (GETGROUPS_T));
|
||||
if (NULL == grouplist) {
|
||||
if (!grouplist)
|
||||
return -1;
|
||||
}
|
||||
ngroups = getgroups (i, grouplist);
|
||||
if ( ( (-1 == ngroups)
|
||||
&& (EINVAL != errno))
|
||||
|| (i > (size_t)ngroups)) {
|
||||
/* Unexpected failure of getgroups or successful
|
||||
* reception of the groups */
|
||||
if (i > ngroups)
|
||||
break;
|
||||
}
|
||||
/* not enough room, so try allocating a larger buffer */
|
||||
free (grouplist);
|
||||
i *= 2;
|
||||
@@ -88,48 +79,40 @@ int add_groups (const char *list)
|
||||
return -1;
|
||||
}
|
||||
|
||||
added = false;
|
||||
for (token = strtok (buf, SEP); NULL != token; token = strtok (NULL, SEP)) {
|
||||
added = 0;
|
||||
for (token = strtok (buf, SEP); token; token = strtok (NULL, SEP)) {
|
||||
struct group *grp;
|
||||
|
||||
grp = getgrnam (token); /* local, no need for xgetgrnam */
|
||||
if (NULL == grp) {
|
||||
fprintf (shadow_logfd, _("Warning: unknown group %s\n"),
|
||||
if (!grp) {
|
||||
fprintf (stderr, _("Warning: unknown group %s\n"),
|
||||
token);
|
||||
continue;
|
||||
}
|
||||
|
||||
for (i = 0; i < (size_t)ngroups && grouplist[i] != grp->gr_gid; i++);
|
||||
for (i = 0; i < ngroups && grouplist[i] != grp->gr_gid; i++);
|
||||
|
||||
if (i < (size_t)ngroups) {
|
||||
if (i < ngroups)
|
||||
continue;
|
||||
}
|
||||
|
||||
if (ngroups >= sysconf (_SC_NGROUPS_MAX)) {
|
||||
fputs (_("Warning: too many groups\n"), shadow_logfd);
|
||||
fputs (_("Warning: too many groups\n"), stderr);
|
||||
break;
|
||||
}
|
||||
tmp = (gid_t *) realloc (grouplist, (size_t)(ngroups + 1) * sizeof (GETGROUPS_T));
|
||||
if (NULL == tmp) {
|
||||
tmp = (gid_t *) realloc (grouplist, (ngroups + 1) * sizeof (GETGROUPS_T));
|
||||
if (!tmp) {
|
||||
free (grouplist);
|
||||
return -1;
|
||||
}
|
||||
tmp[ngroups] = grp->gr_gid;
|
||||
ngroups++;
|
||||
tmp[ngroups++] = grp->gr_gid;
|
||||
grouplist = tmp;
|
||||
added = true;
|
||||
added++;
|
||||
}
|
||||
|
||||
if (added) {
|
||||
ret = setgroups ((size_t)ngroups, grouplist);
|
||||
free (grouplist);
|
||||
return ret;
|
||||
}
|
||||
if (added)
|
||||
return setgroups (ngroups, grouplist);
|
||||
|
||||
free (grouplist);
|
||||
return 0;
|
||||
}
|
||||
#else /* HAVE_SETGROUPS && !USE_PAM */
|
||||
extern int errno; /* warning: ANSI C forbids an empty source file */
|
||||
#endif /* HAVE_SETGROUPS && !USE_PAM */
|
||||
#endif
|
||||
|
||||
|
||||
101
libmisc/age.c
101
libmisc/age.c
@@ -2,7 +2,7 @@
|
||||
* Copyright (c) 1989 - 1994, Julianne Frances Haugh
|
||||
* Copyright (c) 1996 - 1998, Marek Michałkiewicz
|
||||
* Copyright (c) 2001 - 2006, Tomasz Kłoczko
|
||||
* Copyright (c) 2008 - 2009, Nicolas François
|
||||
* Copyright (c) 2008 , Nicolas François
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
@@ -53,33 +53,31 @@
|
||||
* expire() calls /bin/passwd to change the user's password
|
||||
* if it has expired.
|
||||
*/
|
||||
int expire (const struct passwd *pw, /*@null@*/const struct spwd *sp)
|
||||
int expire (const struct passwd *pw, const struct spwd *sp)
|
||||
{
|
||||
int status;
|
||||
pid_t child;
|
||||
pid_t pid;
|
||||
int child;
|
||||
int pid;
|
||||
|
||||
if (NULL == sp) {
|
||||
return 0;
|
||||
}
|
||||
if (!sp)
|
||||
sp = pwd_to_spwd (pw);
|
||||
|
||||
/*
|
||||
* See if the user's password has expired, and if so
|
||||
* force them to change their password.
|
||||
*/
|
||||
|
||||
status = isexpired (pw, sp);
|
||||
switch (status) {
|
||||
switch (status = isexpired (pw, sp)) {
|
||||
case 0:
|
||||
return 0;
|
||||
case 1:
|
||||
(void) fputs (_("Your password has expired."), stdout);
|
||||
fputs (_("Your password has expired."), stdout);
|
||||
break;
|
||||
case 2:
|
||||
(void) fputs (_("Your password is inactive."), stdout);
|
||||
fputs (_("Your password is inactive."), stdout);
|
||||
break;
|
||||
case 3:
|
||||
(void) fputs (_("Your login has expired."), stdout);
|
||||
fputs (_("Your login has expired."), stdout);
|
||||
break;
|
||||
}
|
||||
|
||||
@@ -90,12 +88,12 @@ int expire (const struct passwd *pw, /*@null@*/const struct spwd *sp)
|
||||
* change that password.
|
||||
*/
|
||||
|
||||
if ((status > 1) || (sp->sp_max < sp->sp_min)) {
|
||||
(void) puts (_(" Contact the system administrator."));
|
||||
exit (EXIT_FAILURE);
|
||||
if (status > 1 || sp->sp_max < sp->sp_min) {
|
||||
puts (_(" Contact the system administrator."));
|
||||
exit (1);
|
||||
}
|
||||
(void) puts (_(" Choose a new password."));
|
||||
(void) fflush (stdout);
|
||||
puts (_(" Choose a new password."));
|
||||
fflush (stdout);
|
||||
|
||||
/*
|
||||
* Close all the files so that unauthorized access won't
|
||||
@@ -117,8 +115,7 @@ int expire (const struct passwd *pw, /*@null@*/const struct spwd *sp)
|
||||
* change their password before being able to use the account.
|
||||
*/
|
||||
|
||||
pid = fork ();
|
||||
if (0 == pid) {
|
||||
if ((pid = fork ()) == 0) {
|
||||
int err;
|
||||
|
||||
/*
|
||||
@@ -126,32 +123,24 @@ int expire (const struct passwd *pw, /*@null@*/const struct spwd *sp)
|
||||
* passwd to work just like it would had they executed
|
||||
* it from the command line while logged in.
|
||||
*/
|
||||
#if defined(HAVE_INITGROUPS) && ! defined(USE_PAM)
|
||||
if (setup_uid_gid (pw, false) != 0)
|
||||
#else
|
||||
if (setup_uid_gid (pw) != 0)
|
||||
#endif
|
||||
{
|
||||
if (setup_uid_gid (pw, 0))
|
||||
_exit (126);
|
||||
}
|
||||
|
||||
(void) execl (PASSWD_PROGRAM, PASSWD_PROGRAM, pw->pw_name, (char *) 0);
|
||||
execl (PASSWD_PROGRAM, PASSWD_PROGRAM, pw->pw_name, (char *) 0);
|
||||
err = errno;
|
||||
perror ("Can't execute " PASSWD_PROGRAM);
|
||||
_exit ((ENOENT == err) ? E_CMD_NOTFOUND : E_CMD_NOEXEC);
|
||||
} else if ((pid_t) -1 == pid) {
|
||||
_exit (err == ENOENT ? E_CMD_NOTFOUND : E_CMD_NOEXEC);
|
||||
} else if (pid == -1) {
|
||||
perror ("fork");
|
||||
exit (EXIT_FAILURE);
|
||||
exit (1);
|
||||
}
|
||||
while ((child = wait (&status)) != pid && child != -1);
|
||||
|
||||
while (((child = wait (&status)) != pid) && (child != (pid_t)-1));
|
||||
|
||||
if ((child == pid) && (0 == status)) {
|
||||
if (child == pid && status == 0)
|
||||
return 1;
|
||||
}
|
||||
|
||||
exit (EXIT_FAILURE);
|
||||
/*@notreached@*/}
|
||||
exit (1);
|
||||
/*NOTREACHED*/}
|
||||
|
||||
/*
|
||||
* agecheck - see if warning is needed for password expiration
|
||||
@@ -160,42 +149,30 @@ int expire (const struct passwd *pw, /*@null@*/const struct spwd *sp)
|
||||
* to expire and warns the user of the pending password expiration.
|
||||
*/
|
||||
|
||||
void agecheck (/*@null@*/const struct spwd *sp)
|
||||
void agecheck (const struct passwd *pw, const struct spwd *sp)
|
||||
{
|
||||
long now = (long) time ((time_t *) 0) / SCALE;
|
||||
long now = time ((long *) 0) / SCALE;
|
||||
long remain;
|
||||
|
||||
if (NULL == sp) {
|
||||
return;
|
||||
}
|
||||
if (!sp)
|
||||
sp = pwd_to_spwd (pw);
|
||||
|
||||
/*
|
||||
* The last, max, and warn fields must be supported or the
|
||||
* warning period cannot be calculated.
|
||||
*/
|
||||
|
||||
if ( (-1 == sp->sp_lstchg)
|
||||
|| (-1 == sp->sp_max)
|
||||
|| (-1 == sp->sp_warn)) {
|
||||
if (sp->sp_lstchg == -1 || sp->sp_max == -1 || sp->sp_warn == -1)
|
||||
return;
|
||||
}
|
||||
|
||||
if (0 == sp->sp_lstchg) {
|
||||
(void) puts (_("You must change your password."));
|
||||
return;
|
||||
}
|
||||
|
||||
remain = sp->sp_lstchg + sp->sp_max - now;
|
||||
if (remain <= sp->sp_warn) {
|
||||
if ((remain = (sp->sp_lstchg + sp->sp_max) - now) <= sp->sp_warn) {
|
||||
remain /= DAY / SCALE;
|
||||
if (remain > 1) {
|
||||
(void) printf (_("Your password will expire in %ld days.\n"),
|
||||
remain);
|
||||
} else if (1 == remain) {
|
||||
(void) puts (_("Your password will expire tomorrow."));
|
||||
} else if (remain == 0) {
|
||||
(void) puts (_("Your password will expire today."));
|
||||
}
|
||||
if (remain > 1)
|
||||
printf (_
|
||||
("Your password will expire in %ld days.\n"),
|
||||
remain);
|
||||
else if (remain == 1)
|
||||
puts (_("Your password will expire tomorrow."));
|
||||
else if (remain == 0)
|
||||
puts (_("Your password will expire today."));
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -53,14 +53,11 @@ void audit_help_open (void)
|
||||
if (audit_fd < 0) {
|
||||
/* You get these only when the kernel doesn't have
|
||||
* audit compiled in. */
|
||||
if ( (errno == EINVAL)
|
||||
|| (errno == EPROTONOSUPPORT)
|
||||
|| (errno == EAFNOSUPPORT)) {
|
||||
if (errno == EINVAL || errno == EPROTONOSUPPORT ||
|
||||
errno == EAFNOSUPPORT)
|
||||
return;
|
||||
}
|
||||
(void) fputs (_("Cannot open audit interface - aborting.\n"),
|
||||
shadow_logfd);
|
||||
exit (EXIT_FAILURE);
|
||||
fprintf (stderr, "Cannot open audit interface - aborting.\n");
|
||||
exit (1);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -75,32 +72,16 @@ void audit_help_open (void)
|
||||
* name - user's account or group name. If not available use NULL.
|
||||
* id - uid or gid that the operation is being performed on. This is used
|
||||
* only when user is NULL.
|
||||
* result - 1 is "success" and 0 is "failed"
|
||||
*/
|
||||
void audit_logger (int type, unused const char *pgname, const char *op,
|
||||
const char *name, unsigned int id,
|
||||
shadow_audit_result result)
|
||||
void audit_logger (int type, const char *pgname, const char *op,
|
||||
const char *name, unsigned int id, int result)
|
||||
{
|
||||
if (audit_fd < 0) {
|
||||
if (audit_fd < 0)
|
||||
return;
|
||||
} else {
|
||||
else
|
||||
audit_log_acct_message (audit_fd, type, NULL, op, name, id,
|
||||
NULL, NULL, NULL, (int) result);
|
||||
}
|
||||
}
|
||||
|
||||
void audit_logger_message (const char *message, shadow_audit_result result)
|
||||
{
|
||||
if (audit_fd < 0) {
|
||||
return;
|
||||
} else {
|
||||
audit_log_user_message (audit_fd,
|
||||
AUDIT_USYS_CONFIG,
|
||||
message,
|
||||
NULL, /* hostname */
|
||||
NULL, /* addr */
|
||||
NULL, /* tty */
|
||||
(int) result);
|
||||
}
|
||||
NULL, NULL, NULL, result);
|
||||
}
|
||||
|
||||
#else /* WITH_AUDIT */
|
||||
|
||||
@@ -42,9 +42,9 @@
|
||||
|
||||
#include "defines.h"
|
||||
#include "prototypes.h"
|
||||
/*@observer@*/const char *Basename (const char *str)
|
||||
char *Basename (char *str)
|
||||
{
|
||||
char *cp = strrchr (str, '/');
|
||||
|
||||
return (NULL != cp) ? cp + 1 : str;
|
||||
return cp ? cp + 1 : str;
|
||||
}
|
||||
|
||||
110
libmisc/btrfs.c
110
libmisc/btrfs.c
@@ -1,110 +0,0 @@
|
||||
#include <linux/btrfs_tree.h>
|
||||
#include <linux/magic.h>
|
||||
#include <sys/statfs.h>
|
||||
#include <stdbool.h>
|
||||
|
||||
#include "prototypes.h"
|
||||
|
||||
static bool path_exists(const char *p)
|
||||
{
|
||||
struct stat sb;
|
||||
|
||||
return stat(p, &sb) == 0;
|
||||
}
|
||||
|
||||
static const char *btrfs_cmd(void)
|
||||
{
|
||||
const char *btrfs_paths[] = {"/sbin/btrfs",
|
||||
"/bin/btrfs", "/usr/sbin/btrfs", "/usr/bin/btrfs", NULL};
|
||||
const char *p;
|
||||
int i;
|
||||
|
||||
for (i = 0, p = btrfs_paths[i]; p; i++, p = btrfs_paths[i])
|
||||
if (path_exists(p))
|
||||
return p;
|
||||
|
||||
return NULL;
|
||||
}
|
||||
|
||||
static int run_btrfs_subvolume_cmd(const char *subcmd, const char *arg1, const char *arg2)
|
||||
{
|
||||
int status = 0;
|
||||
const char *cmd = btrfs_cmd();
|
||||
const char *argv[] = {
|
||||
"btrfs",
|
||||
"subvolume",
|
||||
subcmd,
|
||||
arg1,
|
||||
arg2,
|
||||
NULL
|
||||
};
|
||||
|
||||
if (access(cmd, X_OK)) {
|
||||
return 1;
|
||||
}
|
||||
|
||||
if (run_command(cmd, argv, NULL, &status))
|
||||
return -1;
|
||||
return status;
|
||||
}
|
||||
|
||||
|
||||
int btrfs_create_subvolume(const char *path)
|
||||
{
|
||||
return run_btrfs_subvolume_cmd("create", path, NULL);
|
||||
}
|
||||
|
||||
|
||||
int btrfs_remove_subvolume(const char *path)
|
||||
{
|
||||
return run_btrfs_subvolume_cmd("delete", "-C", path);
|
||||
}
|
||||
|
||||
|
||||
/* Adapted from btrfsprogs */
|
||||
/*
|
||||
* This intentionally duplicates btrfs_util_is_subvolume_fd() instead of opening
|
||||
* a file descriptor and calling it, because fstat() and fstatfs() don't accept
|
||||
* file descriptors opened with O_PATH on old kernels (before v3.6 and before
|
||||
* v3.12, respectively), but stat() and statfs() can be called on a path that
|
||||
* the user doesn't have read or write permissions to.
|
||||
*
|
||||
* returns:
|
||||
* 1 - btrfs subvolume
|
||||
* 0 - not btrfs subvolume
|
||||
* -1 - error
|
||||
*/
|
||||
int btrfs_is_subvolume(const char *path)
|
||||
{
|
||||
struct stat st;
|
||||
int ret;
|
||||
|
||||
ret = is_btrfs(path);
|
||||
if (ret <= 0)
|
||||
return ret;
|
||||
|
||||
ret = stat(path, &st);
|
||||
if (ret == -1)
|
||||
return -1;
|
||||
|
||||
if (st.st_ino != BTRFS_FIRST_FREE_OBJECTID || !S_ISDIR(st.st_mode)) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
|
||||
/* Adapted from btrfsprogs */
|
||||
int is_btrfs(const char *path)
|
||||
{
|
||||
struct statfs sfs;
|
||||
int ret;
|
||||
|
||||
ret = statfs(path, &sfs);
|
||||
if (ret == -1)
|
||||
return -1;
|
||||
|
||||
return sfs.f_type == BTRFS_SUPER_MAGIC;
|
||||
}
|
||||
|
||||
@@ -31,11 +31,8 @@
|
||||
*/
|
||||
|
||||
/*
|
||||
* is_valid_user_name(), is_valid_group_name() - check the new user/group
|
||||
* name for validity;
|
||||
* return values:
|
||||
* true - OK
|
||||
* false - bad name
|
||||
* check_user_name(), check_group_name() - check the new user/group
|
||||
* name for validity; return value: 1 - OK, 0 - bad name
|
||||
*/
|
||||
|
||||
#include <config.h>
|
||||
@@ -45,62 +42,57 @@
|
||||
#include <ctype.h>
|
||||
#include "defines.h"
|
||||
#include "chkname.h"
|
||||
|
||||
int allow_bad_names = false;
|
||||
|
||||
static bool is_valid_name (const char *name)
|
||||
#if HAVE_UTMPX_H
|
||||
#include <utmpx.h>
|
||||
#else
|
||||
#include <utmp.h>
|
||||
#endif
|
||||
static int good_name (const char *name)
|
||||
{
|
||||
if (allow_bad_names) {
|
||||
return true;
|
||||
}
|
||||
|
||||
/*
|
||||
* User/group names must match [a-z_][a-z0-9_-]*[$]
|
||||
*/
|
||||
if (!*name || !((*name >= 'a' && *name <= 'z') || *name == '_'))
|
||||
return 0;
|
||||
|
||||
if (('\0' == *name) ||
|
||||
!((('a' <= *name) && ('z' >= *name)) || ('_' == *name))) {
|
||||
return false;
|
||||
while (*++name) {
|
||||
if (!((*name >= 'a' && *name <= 'z') ||
|
||||
(*name >= '0' && *name <= '9') ||
|
||||
*name == '_' || *name == '-' ||
|
||||
(*name == '$' && *(name + 1) == '\0')))
|
||||
return 0;
|
||||
}
|
||||
|
||||
while ('\0' != *++name) {
|
||||
if (!(( ('a' <= *name) && ('z' >= *name) ) ||
|
||||
( ('0' <= *name) && ('9' >= *name) ) ||
|
||||
('_' == *name) ||
|
||||
('-' == *name) ||
|
||||
( ('$' == *name) && ('\0' == *(name + 1)) )
|
||||
)) {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
return true;
|
||||
return 1;
|
||||
}
|
||||
|
||||
bool is_valid_user_name (const char *name)
|
||||
int check_user_name (const char *name)
|
||||
{
|
||||
#if HAVE_UTMPX_H
|
||||
struct utmpx ut;
|
||||
#else
|
||||
struct utmp ut;
|
||||
#endif
|
||||
|
||||
/*
|
||||
* User names are limited by whatever utmp can
|
||||
* handle.
|
||||
* handle (usually max 8 characters).
|
||||
*/
|
||||
if (strlen (name) > USER_NAME_MAX_LENGTH) {
|
||||
return false;
|
||||
}
|
||||
if (strlen (name) > sizeof (ut.ut_user))
|
||||
return 0;
|
||||
|
||||
return is_valid_name (name);
|
||||
return good_name (name);
|
||||
}
|
||||
|
||||
bool is_valid_group_name (const char *name)
|
||||
int check_group_name (const char *name)
|
||||
{
|
||||
/*
|
||||
* Arbitrary limit for group names.
|
||||
* HP-UX 10 limits to 16 characters
|
||||
* Arbitrary limit for group names - max 16
|
||||
* characters (same as on HP-UX 10).
|
||||
*/
|
||||
if ( (GROUP_NAME_MAX_LENGTH > 0)
|
||||
&& (strlen (name) > GROUP_NAME_MAX_LENGTH)) {
|
||||
return false;
|
||||
}
|
||||
if (strlen (name) > 16)
|
||||
return 0;
|
||||
|
||||
return is_valid_name (name);
|
||||
return good_name (name);
|
||||
}
|
||||
|
||||
|
||||
@@ -2,7 +2,6 @@
|
||||
* Copyright (c) 1990 - 1994, Julianne Frances Haugh
|
||||
* Copyright (c) 1997 - 2000, Marek Michałkiewicz
|
||||
* Copyright (c) 2005 , Tomasz Kłoczko
|
||||
* Copyright (c) 2008 , Nicolas François
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
@@ -35,16 +34,13 @@
|
||||
#define _CHKNAME_H_
|
||||
|
||||
/*
|
||||
* is_valid_user_name(), is_valid_group_name() - check the new user/group
|
||||
* name for validity;
|
||||
* return values:
|
||||
* true - OK
|
||||
* false - bad name
|
||||
* check_user_name(), check_group_name() - check the new user/group
|
||||
* name for validity; return value: 1 - OK, 0 - bad name
|
||||
*/
|
||||
|
||||
#include "defines.h"
|
||||
|
||||
extern bool is_valid_user_name (const char *name);
|
||||
extern bool is_valid_group_name (const char *name);
|
||||
extern int check_user_name (const char *);
|
||||
extern int check_group_name (const char *name);
|
||||
|
||||
#endif
|
||||
|
||||
@@ -2,7 +2,6 @@
|
||||
* Copyright (c) 1992 - 1993, Julianne Frances Haugh
|
||||
* Copyright (c) 1996 - 2000, Marek Michałkiewicz
|
||||
* Copyright (c) 2003 - 2005, Tomasz Kłoczko
|
||||
* Copyright (c) 2010 - , Nicolas François
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
@@ -45,92 +44,59 @@
|
||||
*
|
||||
* chown_dir() walks a directory tree and changes the ownership
|
||||
* of all files owned by the provided user ID.
|
||||
*
|
||||
* Only files owned (resp. group-owned) by old_uid (resp. by old_gid)
|
||||
* will have their ownership (resp. group-ownership) modified, unless
|
||||
* old_uid (resp. old_gid) is set to -1.
|
||||
*
|
||||
* new_uid and new_gid can be set to -1 to indicate that no owner or
|
||||
* group-owner shall be changed.
|
||||
*/
|
||||
int chown_tree (const char *root,
|
||||
uid_t old_uid,
|
||||
uid_t new_uid,
|
||||
gid_t old_gid,
|
||||
gid_t new_gid)
|
||||
int
|
||||
chown_tree (const char *root, uid_t old_uid, uid_t new_uid, gid_t old_gid,
|
||||
gid_t new_gid)
|
||||
{
|
||||
char *new_name;
|
||||
size_t new_name_len;
|
||||
char new_name[1024];
|
||||
int rc = 0;
|
||||
struct DIRECT *ent;
|
||||
struct stat sb;
|
||||
DIR *dir;
|
||||
|
||||
new_name = malloc (1024);
|
||||
if (NULL == new_name) {
|
||||
return -1;
|
||||
}
|
||||
new_name_len = 1024;
|
||||
|
||||
/*
|
||||
* Make certain the directory exists. This routine is called
|
||||
* directly by the invoker, or recursively.
|
||||
* directory by the invoker, or recursively.
|
||||
*/
|
||||
|
||||
if (access (root, F_OK) != 0) {
|
||||
free (new_name);
|
||||
if (access (root, F_OK) != 0)
|
||||
return -1;
|
||||
}
|
||||
|
||||
/*
|
||||
* Open the directory and read each entry. Every entry is tested
|
||||
* to see if it is a directory, and if so this routine is called
|
||||
* recursively. If not, it is checked to see if an ownership
|
||||
* shall be changed.
|
||||
* recursively. If not, it is checked to see if it is owned by
|
||||
* old user ID.
|
||||
*/
|
||||
|
||||
dir = opendir (root);
|
||||
if (NULL == dir) {
|
||||
free (new_name);
|
||||
if (!(dir = opendir (root)))
|
||||
return -1;
|
||||
}
|
||||
|
||||
while ((ent = readdir (dir))) {
|
||||
size_t ent_name_len;
|
||||
uid_t tmpuid = (uid_t) -1;
|
||||
gid_t tmpgid = (gid_t) -1;
|
||||
|
||||
/*
|
||||
* Skip the "." and ".." entries
|
||||
*/
|
||||
|
||||
if ( (strcmp (ent->d_name, ".") == 0)
|
||||
|| (strcmp (ent->d_name, "..") == 0)) {
|
||||
if (strcmp (ent->d_name, ".") == 0 ||
|
||||
strcmp (ent->d_name, "..") == 0)
|
||||
continue;
|
||||
}
|
||||
|
||||
/*
|
||||
* Make the filename for both the source and the
|
||||
* destination files.
|
||||
*/
|
||||
|
||||
ent_name_len = strlen (root) + strlen (ent->d_name) + 2;
|
||||
if (ent_name_len > new_name_len) {
|
||||
/*@only@*/char *tmp = realloc (new_name, ent_name_len);
|
||||
if (NULL == tmp) {
|
||||
rc = -1;
|
||||
break;
|
||||
}
|
||||
new_name = tmp;
|
||||
new_name_len = ent_name_len;
|
||||
}
|
||||
if (strlen (root) + strlen (ent->d_name) + 2 > sizeof new_name)
|
||||
break;
|
||||
|
||||
(void) snprintf (new_name, new_name_len, "%s/%s", root, ent->d_name);
|
||||
snprintf (new_name, sizeof new_name, "%s/%s", root,
|
||||
ent->d_name);
|
||||
|
||||
/* Don't follow symbolic links! */
|
||||
if (LSTAT (new_name, &sb) == -1) {
|
||||
if (LSTAT (new_name, &sb) == -1)
|
||||
continue;
|
||||
}
|
||||
|
||||
if (S_ISDIR (sb.st_mode) && !S_ISLNK (sb.st_mode)) {
|
||||
|
||||
@@ -138,64 +104,29 @@ int chown_tree (const char *root,
|
||||
* Do the entire subdirectory.
|
||||
*/
|
||||
|
||||
rc = chown_tree (new_name, old_uid, new_uid,
|
||||
old_gid, new_gid);
|
||||
if (0 != rc) {
|
||||
if ((rc = chown_tree (new_name, old_uid, new_uid,
|
||||
old_gid, new_gid)))
|
||||
break;
|
||||
}
|
||||
}
|
||||
#ifndef HAVE_LCHOWN
|
||||
/* don't use chown (follows symbolic links!) */
|
||||
if (S_ISLNK (sb.st_mode)) {
|
||||
if (S_ISLNK (sb.st_mode))
|
||||
continue;
|
||||
}
|
||||
#endif
|
||||
/*
|
||||
* By default, the IDs are not changed (-1).
|
||||
*
|
||||
* If the file is not owned by the user, the owner is not
|
||||
* changed.
|
||||
*
|
||||
* If the file is not group-owned by the group, the
|
||||
* group-owner is not changed.
|
||||
*/
|
||||
if (((uid_t) -1 == old_uid) || (sb.st_uid == old_uid)) {
|
||||
tmpuid = new_uid;
|
||||
}
|
||||
if (((gid_t) -1 == old_gid) || (sb.st_gid == old_gid)) {
|
||||
tmpgid = new_gid;
|
||||
}
|
||||
if (((uid_t) -1 != tmpuid) || ((gid_t) -1 != tmpgid)) {
|
||||
rc = LCHOWN (new_name, tmpuid, tmpgid);
|
||||
if (0 != rc) {
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (sb.st_uid == old_uid)
|
||||
LCHOWN (new_name, new_uid,
|
||||
sb.st_gid == old_gid ? new_gid : sb.st_gid);
|
||||
}
|
||||
|
||||
free (new_name);
|
||||
(void) closedir (dir);
|
||||
closedir (dir);
|
||||
|
||||
/*
|
||||
* Now do the root of the tree
|
||||
*/
|
||||
|
||||
if ((0 == rc) && (stat (root, &sb) == 0)) {
|
||||
uid_t tmpuid = (uid_t) -1;
|
||||
gid_t tmpgid = (gid_t) -1;
|
||||
if (((uid_t) -1 == old_uid) || (sb.st_uid == old_uid)) {
|
||||
tmpuid = new_uid;
|
||||
}
|
||||
if (((gid_t) -1 == old_gid) || (sb.st_gid == old_gid)) {
|
||||
tmpgid = new_gid;
|
||||
}
|
||||
if (((uid_t) -1 != tmpuid) || ((gid_t) -1 != tmpgid)) {
|
||||
rc = LCHOWN (root, tmpuid, tmpgid);
|
||||
}
|
||||
} else {
|
||||
rc = -1;
|
||||
if (!stat (root, &sb)) {
|
||||
if (sb.st_uid == old_uid)
|
||||
LCHOWN (root, new_uid,
|
||||
sb.st_gid == old_gid ? new_gid : sb.st_gid);
|
||||
}
|
||||
|
||||
return rc;
|
||||
}
|
||||
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
* Copyright (c) 1989 - 1994, Julianne Frances Haugh
|
||||
* Copyright (c) 1996 - 2001, Marek Michałkiewicz
|
||||
* Copyright (c) 2003 - 2005, Tomasz Kłoczko
|
||||
* Copyright (c) 2007 - 2009, Nicolas François
|
||||
* Copyright (c) 2007 , Nicolas François
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
@@ -43,14 +43,31 @@
|
||||
#include "defines.h"
|
||||
#include <pwd.h>
|
||||
#include "getdef.h"
|
||||
/*
|
||||
* is_my_tty -- determine if "tty" is the same as TTY stdin is using
|
||||
*/
|
||||
static int is_my_tty (const char *tty)
|
||||
{
|
||||
struct stat by_name, by_fd;
|
||||
|
||||
if (stat (tty, &by_name) || fstat (0, &by_fd))
|
||||
return 0;
|
||||
|
||||
if (by_name.st_rdev != by_fd.st_rdev)
|
||||
return 0;
|
||||
else
|
||||
return 1;
|
||||
}
|
||||
|
||||
/*
|
||||
* chown_tty() sets the login tty to be owned by the new user ID
|
||||
* with TTYPERM modes
|
||||
*/
|
||||
|
||||
void chown_tty (const struct passwd *info)
|
||||
void chown_tty (const char *tty, const struct passwd *info)
|
||||
{
|
||||
char buf[200], full_tty[200];
|
||||
char *group; /* TTY group name or number */
|
||||
struct group *grent;
|
||||
gid_t gid;
|
||||
|
||||
@@ -59,33 +76,45 @@ void chown_tty (const struct passwd *info)
|
||||
* ID. Otherwise, use the user's primary group ID.
|
||||
*/
|
||||
|
||||
grent = getgr_nam_gid (getdef_str ("TTYGROUP"));
|
||||
if (NULL != grent) {
|
||||
gid = grent->gr_gid;
|
||||
gr_free (grent);
|
||||
} else {
|
||||
if (!(group = getdef_str ("TTYGROUP")))
|
||||
gid = info->pw_gid;
|
||||
else if (group[0] >= '0' && group[0] <= '9')
|
||||
gid = atoi (group);
|
||||
else if ((grent = getgrnam (group))) /* local, no need for xgetgrnam */
|
||||
gid = grent->gr_gid;
|
||||
else
|
||||
gid = info->pw_gid;
|
||||
}
|
||||
|
||||
/*
|
||||
* Change the permissions on the TTY to be owned by the user with
|
||||
* the group as determined above.
|
||||
*/
|
||||
|
||||
if ( (fchown (STDIN_FILENO, info->pw_uid, gid) != 0)
|
||||
|| (fchmod (STDIN_FILENO, (mode_t)getdef_num ("TTYPERM", 0600)) != 0)) {
|
||||
if (*tty != '/') {
|
||||
snprintf (full_tty, sizeof full_tty, "/dev/%s", tty);
|
||||
tty = full_tty;
|
||||
}
|
||||
|
||||
if (!is_my_tty (tty)) {
|
||||
SYSLOG ((LOG_WARN,
|
||||
"unable to determine TTY name, got %s\n", tty));
|
||||
closelog ();
|
||||
exit (1);
|
||||
}
|
||||
|
||||
if (chown (tty, info->pw_uid, gid) ||
|
||||
chmod (tty, getdef_num ("TTYPERM", 0600))) {
|
||||
int err = errno;
|
||||
|
||||
fprintf (shadow_logfd,
|
||||
_("Unable to change owner or mode of tty stdin: %s"),
|
||||
strerror (err));
|
||||
snprintf (buf, sizeof buf, _("Unable to change tty %s"), tty);
|
||||
perror (buf);
|
||||
SYSLOG ((LOG_WARN,
|
||||
"unable to change owner or mode of tty stdin for user `%s': %s\n",
|
||||
info->pw_name, strerror (err)));
|
||||
if (EROFS != err) {
|
||||
closelog ();
|
||||
exit (EXIT_FAILURE);
|
||||
}
|
||||
"unable to change tty `%s' for user `%s'\n", tty,
|
||||
info->pw_name));
|
||||
closelog ();
|
||||
|
||||
if (err != EROFS)
|
||||
exit (1);
|
||||
}
|
||||
#ifdef __linux__
|
||||
/*
|
||||
|
||||
@@ -1,144 +0,0 @@
|
||||
/*
|
||||
* Copyright (c) 2008 - 2011, Nicolas François
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. The name of the copyright holders or contributors may not be used to
|
||||
* endorse or promote products derived from this software without
|
||||
* specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
|
||||
* PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
* HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include <config.h>
|
||||
|
||||
#include <assert.h>
|
||||
#include <stdio.h>
|
||||
|
||||
#include "prototypes.h"
|
||||
|
||||
/*
|
||||
* The cleanup_functions stack.
|
||||
*/
|
||||
#define CLEANUP_FUNCTIONS 10
|
||||
|
||||
typedef /*@null@*/void * parg_t;
|
||||
|
||||
static cleanup_function cleanup_functions[CLEANUP_FUNCTIONS];
|
||||
static parg_t cleanup_function_args[CLEANUP_FUNCTIONS];
|
||||
static pid_t cleanup_pid = 0;
|
||||
|
||||
/*
|
||||
* - Cleanup functions shall not fail.
|
||||
* - You should register do_cleanups with atexit.
|
||||
* - You should add cleanup functions to the stack with add_cleanup when
|
||||
* an operation is expected to be executed later, and remove it from the
|
||||
* stack with del_cleanup when it has been executed.
|
||||
*
|
||||
**/
|
||||
|
||||
/*
|
||||
* do_cleanups - perform the actions stored in the cleanup_functions stack.
|
||||
*
|
||||
* Cleanup action are not executed on exit of the processes started by the
|
||||
* parent (first caller of add_cleanup).
|
||||
*
|
||||
* It is intended to be used as:
|
||||
* atexit (do_cleanups);
|
||||
*/
|
||||
void do_cleanups (void)
|
||||
{
|
||||
unsigned int i;
|
||||
|
||||
/* Make sure there were no overflow */
|
||||
assert (NULL == cleanup_functions[CLEANUP_FUNCTIONS-1]);
|
||||
|
||||
if (getpid () != cleanup_pid) {
|
||||
return;
|
||||
}
|
||||
|
||||
i = CLEANUP_FUNCTIONS;
|
||||
do {
|
||||
i--;
|
||||
if (cleanup_functions[i] != NULL) {
|
||||
cleanup_functions[i] (cleanup_function_args[i]);
|
||||
}
|
||||
} while (i>0);
|
||||
}
|
||||
|
||||
/*
|
||||
* add_cleanup - Add a cleanup_function to the cleanup_functions stack.
|
||||
*/
|
||||
void add_cleanup (/*@notnull@*/cleanup_function pcf, /*@null@*/void *arg)
|
||||
{
|
||||
unsigned int i;
|
||||
assert (NULL != pcf);
|
||||
|
||||
assert (NULL == cleanup_functions[CLEANUP_FUNCTIONS-2]);
|
||||
|
||||
if (0 == cleanup_pid) {
|
||||
cleanup_pid = getpid ();
|
||||
}
|
||||
|
||||
/* Add the cleanup_function at the end of the stack */
|
||||
for (i=0; NULL != cleanup_functions[i]; i++);
|
||||
cleanup_functions[i] = pcf;
|
||||
cleanup_function_args[i] = arg;
|
||||
}
|
||||
|
||||
/*
|
||||
* del_cleanup - Remove a cleanup_function from the cleanup_functions stack.
|
||||
*/
|
||||
void del_cleanup (/*@notnull@*/cleanup_function pcf)
|
||||
{
|
||||
unsigned int i;
|
||||
assert (NULL != pcf);
|
||||
|
||||
/* Find the pcf cleanup function */
|
||||
for (i=0; i<CLEANUP_FUNCTIONS; i++) {
|
||||
if (cleanup_functions[i] == pcf) {
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
/* Make sure the cleanup function was found */
|
||||
assert (i<CLEANUP_FUNCTIONS);
|
||||
|
||||
/* Move the rest of the cleanup functions */
|
||||
for (; i<CLEANUP_FUNCTIONS; i++) {
|
||||
/* Make sure the cleanup function was specified only once */
|
||||
assert ( (i == (CLEANUP_FUNCTIONS -1))
|
||||
|| (cleanup_functions[i+1] != pcf));
|
||||
|
||||
if (i == (CLEANUP_FUNCTIONS -1)) {
|
||||
cleanup_functions[i] = NULL;
|
||||
cleanup_function_args[i] = NULL;
|
||||
} else {
|
||||
cleanup_functions[i] = cleanup_functions[i+1];
|
||||
cleanup_function_args[i] = cleanup_function_args[i+1];
|
||||
}
|
||||
|
||||
/* A NULL indicates the end of the stack */
|
||||
if (NULL == cleanup_functions[i]) {
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,237 +0,0 @@
|
||||
/*
|
||||
* Copyright (c) 2008 , Nicolas François
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. The name of the copyright holders or contributors may not be used to
|
||||
* endorse or promote products derived from this software without
|
||||
* specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
|
||||
* PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
* HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include <config.h>
|
||||
|
||||
#include <assert.h>
|
||||
#include <stdio.h>
|
||||
|
||||
#include "defines.h"
|
||||
#include "groupio.h"
|
||||
#include "sgroupio.h"
|
||||
#include "prototypes.h"
|
||||
|
||||
/*
|
||||
* cleanup_report_add_group - Report failure to add a group to the system
|
||||
*
|
||||
* It should be registered when it is decided to add a group to the system.
|
||||
*/
|
||||
void cleanup_report_add_group (void *group_name)
|
||||
{
|
||||
const char *name = (const char *)group_name;
|
||||
|
||||
SYSLOG ((LOG_ERR, "failed to add group %s", name));
|
||||
#ifdef WITH_AUDIT
|
||||
audit_logger (AUDIT_ADD_GROUP, Prog,
|
||||
"",
|
||||
name, AUDIT_NO_ID,
|
||||
SHADOW_AUDIT_FAILURE);
|
||||
#endif
|
||||
}
|
||||
|
||||
/*
|
||||
* cleanup_report_del_group - Report failure to remove a group from the system
|
||||
*
|
||||
* It should be registered when it is decided to remove a group from the system.
|
||||
*/
|
||||
void cleanup_report_del_group (void *group_name)
|
||||
{
|
||||
const char *name = (const char *)group_name;
|
||||
|
||||
SYSLOG ((LOG_ERR, "failed to remove group %s", name));
|
||||
#ifdef WITH_AUDIT
|
||||
audit_logger (AUDIT_DEL_GROUP, Prog,
|
||||
"",
|
||||
name, AUDIT_NO_ID,
|
||||
SHADOW_AUDIT_FAILURE);
|
||||
#endif
|
||||
}
|
||||
|
||||
void cleanup_report_mod_group (void *cleanup_info)
|
||||
{
|
||||
const struct cleanup_info_mod *info;
|
||||
info = (const struct cleanup_info_mod *)cleanup_info;
|
||||
|
||||
SYSLOG ((LOG_ERR,
|
||||
"failed to change %s (%s)",
|
||||
gr_dbname (),
|
||||
info->action));
|
||||
#ifdef WITH_AUDIT
|
||||
audit_logger (AUDIT_USER_ACCT, Prog,
|
||||
info->audit_msg,
|
||||
info->name, AUDIT_NO_ID,
|
||||
SHADOW_AUDIT_FAILURE);
|
||||
#endif
|
||||
}
|
||||
|
||||
#ifdef SHADOWGRP
|
||||
void cleanup_report_mod_gshadow (void *cleanup_info)
|
||||
{
|
||||
const struct cleanup_info_mod *info;
|
||||
info = (const struct cleanup_info_mod *)cleanup_info;
|
||||
|
||||
SYSLOG ((LOG_ERR,
|
||||
"failed to change %s (%s)",
|
||||
sgr_dbname (),
|
||||
info->action));
|
||||
#ifdef WITH_AUDIT
|
||||
audit_logger (AUDIT_USER_ACCT, Prog,
|
||||
info->audit_msg,
|
||||
info->name, AUDIT_NO_ID,
|
||||
SHADOW_AUDIT_FAILURE);
|
||||
#endif
|
||||
}
|
||||
#endif
|
||||
|
||||
/*
|
||||
* cleanup_report_add_group_group - Report failure to add a group to group
|
||||
*
|
||||
* It should be registered when it is decided to add a group to the
|
||||
* group database.
|
||||
*/
|
||||
void cleanup_report_add_group_group (void *group_name)
|
||||
{
|
||||
const char *name = (const char *)group_name;
|
||||
|
||||
SYSLOG ((LOG_ERR, "failed to add group %s to %s", name, gr_dbname ()));
|
||||
#ifdef WITH_AUDIT
|
||||
audit_logger (AUDIT_ADD_GROUP, Prog,
|
||||
"adding group to /etc/group",
|
||||
name, AUDIT_NO_ID,
|
||||
SHADOW_AUDIT_FAILURE);
|
||||
#endif
|
||||
}
|
||||
|
||||
#ifdef SHADOWGRP
|
||||
/*
|
||||
* cleanup_report_add_group_gshadow - Report failure to add a group to gshadow
|
||||
*
|
||||
* It should be registered when it is decided to add a group to the
|
||||
* gshadow database.
|
||||
*/
|
||||
void cleanup_report_add_group_gshadow (void *group_name)
|
||||
{
|
||||
const char *name = (const char *)group_name;
|
||||
|
||||
SYSLOG ((LOG_ERR, "failed to add group %s to %s", name, sgr_dbname ()));
|
||||
#ifdef WITH_AUDIT
|
||||
audit_logger (AUDIT_ADD_GROUP, Prog,
|
||||
"adding group to /etc/gshadow",
|
||||
name, AUDIT_NO_ID,
|
||||
SHADOW_AUDIT_FAILURE);
|
||||
#endif
|
||||
}
|
||||
#endif
|
||||
|
||||
/*
|
||||
* cleanup_report_del_group_group - Report failure to remove a group from the
|
||||
* regular group database
|
||||
*
|
||||
* It should be registered when it is decided to remove a group from the
|
||||
* regular group database.
|
||||
*/
|
||||
void cleanup_report_del_group_group (void *group_name)
|
||||
{
|
||||
const char *name = (const char *)group_name;
|
||||
|
||||
SYSLOG ((LOG_ERR,
|
||||
"failed to remove group %s from %s",
|
||||
name, gr_dbname ()));
|
||||
#ifdef WITH_AUDIT
|
||||
audit_logger (AUDIT_ADD_GROUP, Prog,
|
||||
"removing group from /etc/group",
|
||||
name, AUDIT_NO_ID,
|
||||
SHADOW_AUDIT_FAILURE);
|
||||
#endif
|
||||
}
|
||||
|
||||
#ifdef SHADOWGRP
|
||||
/*
|
||||
* cleanup_report_del_group_gshadow - Report failure to remove a group from
|
||||
* gshadow
|
||||
*
|
||||
* It should be registered when it is decided to remove a group from the
|
||||
* gshadow database.
|
||||
*/
|
||||
void cleanup_report_del_group_gshadow (void *group_name)
|
||||
{
|
||||
const char *name = (const char *)group_name;
|
||||
|
||||
SYSLOG ((LOG_ERR,
|
||||
"failed to remove group %s from %s",
|
||||
name, sgr_dbname ()));
|
||||
#ifdef WITH_AUDIT
|
||||
audit_logger (AUDIT_ADD_GROUP, Prog,
|
||||
"removing group from /etc/gshadow",
|
||||
name, AUDIT_NO_ID,
|
||||
SHADOW_AUDIT_FAILURE);
|
||||
#endif
|
||||
}
|
||||
#endif
|
||||
|
||||
/*
|
||||
* cleanup_unlock_group - Unlock the group file
|
||||
*
|
||||
* It should be registered after the group file is successfully locked.
|
||||
*/
|
||||
void cleanup_unlock_group (unused void *arg)
|
||||
{
|
||||
if (gr_unlock () == 0) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: failed to unlock %s\n"),
|
||||
Prog, gr_dbname ());
|
||||
SYSLOG ((LOG_ERR, "failed to unlock %s", gr_dbname ()));
|
||||
#ifdef WITH_AUDIT
|
||||
audit_logger_message ("unlocking group file",
|
||||
SHADOW_AUDIT_FAILURE);
|
||||
#endif
|
||||
}
|
||||
}
|
||||
|
||||
#ifdef SHADOWGRP
|
||||
/*
|
||||
* cleanup_unlock_gshadow - Unlock the gshadow file
|
||||
*
|
||||
* It should be registered after the gshadow file is successfully locked.
|
||||
*/
|
||||
void cleanup_unlock_gshadow (unused void *arg)
|
||||
{
|
||||
if (sgr_unlock () == 0) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: failed to unlock %s\n"),
|
||||
Prog, sgr_dbname ());
|
||||
SYSLOG ((LOG_ERR, "failed to unlock %s", sgr_dbname ()));
|
||||
#ifdef WITH_AUDIT
|
||||
audit_logger_message ("unlocking gshadow file",
|
||||
SHADOW_AUDIT_FAILURE);
|
||||
#endif
|
||||
}
|
||||
}
|
||||
#endif
|
||||
|
||||
@@ -1,152 +0,0 @@
|
||||
/*
|
||||
* Copyright (c) 2008 , Nicolas François
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. The name of the copyright holders or contributors may not be used to
|
||||
* endorse or promote products derived from this software without
|
||||
* specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
|
||||
* PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
* HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include <config.h>
|
||||
|
||||
#include <assert.h>
|
||||
#include <stdio.h>
|
||||
|
||||
#include "defines.h"
|
||||
#include "pwio.h"
|
||||
#include "shadowio.h"
|
||||
#include "prototypes.h"
|
||||
|
||||
/*
|
||||
* cleanup_report_add_user - Report failure to add an user to the system
|
||||
*
|
||||
* It should be registered when it is decided to add an user to the system.
|
||||
*/
|
||||
void cleanup_report_add_user (void *user_name)
|
||||
{
|
||||
const char *name = (const char *)user_name;
|
||||
|
||||
SYSLOG ((LOG_ERR, "failed to add user %s", name));
|
||||
#ifdef WITH_AUDIT
|
||||
audit_logger (AUDIT_ADD_USER, Prog,
|
||||
"",
|
||||
name, AUDIT_NO_ID,
|
||||
SHADOW_AUDIT_FAILURE);
|
||||
#endif
|
||||
}
|
||||
|
||||
void cleanup_report_mod_passwd (void *cleanup_info)
|
||||
{
|
||||
const struct cleanup_info_mod *info;
|
||||
info = (const struct cleanup_info_mod *)cleanup_info;
|
||||
|
||||
SYSLOG ((LOG_ERR,
|
||||
"failed to change %s (%s)",
|
||||
pw_dbname (),
|
||||
info->action));
|
||||
#ifdef WITH_AUDIT
|
||||
audit_logger (AUDIT_USER_ACCT, Prog,
|
||||
info->audit_msg,
|
||||
info->name, AUDIT_NO_ID,
|
||||
SHADOW_AUDIT_FAILURE);
|
||||
#endif
|
||||
}
|
||||
|
||||
/*
|
||||
* cleanup_report_add_user_passwd - Report failure to add an user to
|
||||
* /etc/passwd
|
||||
*
|
||||
* It should be registered when it is decided to add an user to the
|
||||
* /etc/passwd database.
|
||||
*/
|
||||
void cleanup_report_add_user_passwd (void *user_name)
|
||||
{
|
||||
const char *name = (const char *)user_name;
|
||||
|
||||
SYSLOG ((LOG_ERR, "failed to add user %s to %s", name, pw_dbname ()));
|
||||
#ifdef WITH_AUDIT
|
||||
audit_logger (AUDIT_ADD_USER, Prog,
|
||||
"adding user to /etc/passwd",
|
||||
name, AUDIT_NO_ID,
|
||||
SHADOW_AUDIT_FAILURE);
|
||||
#endif
|
||||
}
|
||||
|
||||
/*
|
||||
* cleanup_report_add_user_shadow - Report failure to add an user to
|
||||
* /etc/shadow
|
||||
*
|
||||
* It should be registered when it is decided to add an user to the
|
||||
* /etc/shadow database.
|
||||
*/
|
||||
void cleanup_report_add_user_shadow (void *user_name)
|
||||
{
|
||||
const char *name = (const char *)user_name;
|
||||
|
||||
SYSLOG ((LOG_ERR, "failed to add user %s to %s", name, spw_dbname ()));
|
||||
#ifdef WITH_AUDIT
|
||||
audit_logger (AUDIT_ADD_USER, Prog,
|
||||
"adding user to /etc/shadow",
|
||||
name, AUDIT_NO_ID,
|
||||
SHADOW_AUDIT_FAILURE);
|
||||
#endif
|
||||
}
|
||||
|
||||
/*
|
||||
* cleanup_unlock_passwd - Unlock the /etc/passwd database
|
||||
*
|
||||
* It should be registered after the passwd database is successfully locked.
|
||||
*/
|
||||
void cleanup_unlock_passwd (unused void *arg)
|
||||
{
|
||||
if (pw_unlock () == 0) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: failed to unlock %s\n"),
|
||||
Prog, pw_dbname ());
|
||||
SYSLOG ((LOG_ERR, "failed to unlock %s", pw_dbname ()));
|
||||
#ifdef WITH_AUDIT
|
||||
audit_logger_message ("unlocking passwd file",
|
||||
SHADOW_AUDIT_FAILURE);
|
||||
#endif
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* cleanup_unlock_shadow - Unlock the /etc/shadow database
|
||||
*
|
||||
* It should be registered after the shadow database is successfully locked.
|
||||
*/
|
||||
void cleanup_unlock_shadow (unused void *arg)
|
||||
{
|
||||
if (spw_unlock () == 0) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: failed to unlock %s\n"),
|
||||
Prog, spw_dbname ());
|
||||
SYSLOG ((LOG_ERR, "failed to unlock %s", spw_dbname ()));
|
||||
#ifdef WITH_AUDIT
|
||||
audit_logger_message ("unlocking shadow file",
|
||||
SHADOW_AUDIT_FAILURE);
|
||||
#endif
|
||||
}
|
||||
}
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
* Copyright (c) 1991 , Chip Rosenthal
|
||||
* Copyright (c) 1996 - 1998, Marek Michałkiewicz
|
||||
* Copyright (c) 2003 - 2005, Tomasz Kłoczko
|
||||
* Copyright (c) 2007 - 2010, Nicolas François
|
||||
* Copyright (c) 2007 - 2008, Nicolas François
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
@@ -40,28 +40,25 @@
|
||||
#ident "$Id$"
|
||||
|
||||
/* local function prototypes */
|
||||
static bool is_listed (const char *cfgin, const char *tty, bool def);
|
||||
static int is_listed (const char *cfgin, const char *tty, int def);
|
||||
|
||||
/*
|
||||
* This is now rather generic function which decides if "tty" is listed
|
||||
* under "cfgin" in config (directly or indirectly). Fallback to default if
|
||||
* something is bad.
|
||||
*/
|
||||
static bool is_listed (const char *cfgin, const char *tty, bool def)
|
||||
static int is_listed (const char *cfgin, const char *tty, int def)
|
||||
{
|
||||
FILE *fp;
|
||||
char buf[1024], *s;
|
||||
const char *cons;
|
||||
char buf[200], *cons, *s;
|
||||
|
||||
/*
|
||||
* If the CONSOLE configuration definition isn't given,
|
||||
* fallback to default.
|
||||
*/
|
||||
|
||||
cons = getdef_str (cfgin);
|
||||
if (NULL == cons) {
|
||||
if ((cons = getdef_str (cfgin)) == NULL)
|
||||
return def;
|
||||
}
|
||||
|
||||
/*
|
||||
* If this isn't a filename, then it is a ":" delimited list of
|
||||
@@ -69,18 +66,14 @@ static bool is_listed (const char *cfgin, const char *tty, bool def)
|
||||
*/
|
||||
|
||||
if (*cons != '/') {
|
||||
char *pbuf;
|
||||
strncpy (buf, cons, sizeof (buf));
|
||||
buf[sizeof (buf) - 1] = '\0';
|
||||
pbuf = &buf[0];
|
||||
while ((s = strtok (pbuf, ":")) != NULL) {
|
||||
if (strcmp (s, tty) == 0) {
|
||||
return true;
|
||||
}
|
||||
cons = strcpy (buf, cons);
|
||||
while ((s = strtok (cons, ":")) != NULL) {
|
||||
if (strcmp (s, tty) == 0)
|
||||
return 1;
|
||||
|
||||
pbuf = NULL;
|
||||
cons = NULL;
|
||||
}
|
||||
return false;
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
@@ -88,20 +81,18 @@ static bool is_listed (const char *cfgin, const char *tty, bool def)
|
||||
* console - otherwise root will never be allowed to login.
|
||||
*/
|
||||
|
||||
fp = fopen (cons, "r");
|
||||
if (NULL == fp) {
|
||||
if ((fp = fopen (cons, "r")) == NULL)
|
||||
return def;
|
||||
}
|
||||
|
||||
/*
|
||||
* See if this tty is listed in the console file.
|
||||
*/
|
||||
|
||||
while (fgets (buf, (int) sizeof (buf), fp) != NULL) {
|
||||
while (fgets (buf, sizeof (buf), fp) != NULL) {
|
||||
buf[strlen (buf) - 1] = '\0';
|
||||
if (strcmp (buf, tty) == 0) {
|
||||
(void) fclose (fp);
|
||||
return true;
|
||||
return 1;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -110,7 +101,7 @@ static bool is_listed (const char *cfgin, const char *tty, bool def)
|
||||
*/
|
||||
|
||||
(void) fclose (fp);
|
||||
return false;
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
@@ -123,12 +114,7 @@ static bool is_listed (const char *cfgin, const char *tty, bool def)
|
||||
* that would allow an unauthorized root login.
|
||||
*/
|
||||
|
||||
bool console (const char *tty)
|
||||
int console (const char *tty)
|
||||
{
|
||||
if (strncmp (tty, "/dev/", 5) == 0) {
|
||||
tty += 5;
|
||||
}
|
||||
|
||||
return is_listed ("CONSOLE", tty, true);
|
||||
return is_listed ("CONSOLE", tty, 1);
|
||||
}
|
||||
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
* Copyright (c) 1991 - 1994, Julianne Frances Haugh
|
||||
* Copyright (c) 1996 - 2001, Marek Michałkiewicz
|
||||
* Copyright (c) 2003 - 2006, Tomasz Kłoczko
|
||||
* Copyright (c) 2007 - 2010, Nicolas François
|
||||
* Copyright (c) 2007 - 2008, Nicolas François
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
@@ -34,7 +34,6 @@
|
||||
|
||||
#ident "$Id$"
|
||||
|
||||
#include <assert.h>
|
||||
#include <sys/stat.h>
|
||||
#include <sys/types.h>
|
||||
#include <sys/time.h>
|
||||
@@ -44,104 +43,78 @@
|
||||
#include "defines.h"
|
||||
#ifdef WITH_SELINUX
|
||||
#include <selinux/selinux.h>
|
||||
#endif /* WITH_SELINUX */
|
||||
#if defined(WITH_ACL) || defined(WITH_ATTR)
|
||||
#include <stdarg.h>
|
||||
#include <attr/error_context.h>
|
||||
#endif /* WITH_ACL || WITH_ATTR */
|
||||
#ifdef WITH_ACL
|
||||
#include <acl/libacl.h>
|
||||
#endif /* WITH_ACL */
|
||||
#ifdef WITH_ATTR
|
||||
#include <attr/libattr.h>
|
||||
#endif /* WITH_ATTR */
|
||||
|
||||
|
||||
static /*@null@*/const char *src_orig;
|
||||
static /*@null@*/const char *dst_orig;
|
||||
static int selinux_enabled = -1;
|
||||
#endif
|
||||
static const char *src_orig;
|
||||
static const char *dst_orig;
|
||||
|
||||
struct link_name {
|
||||
dev_t ln_dev;
|
||||
ino_t ln_ino;
|
||||
nlink_t ln_count;
|
||||
int ln_count;
|
||||
char *ln_name;
|
||||
/*@dependent@*/struct link_name *ln_next;
|
||||
struct link_name *ln_next;
|
||||
};
|
||||
static /*@exposed@*/struct link_name *links;
|
||||
static struct link_name *links;
|
||||
|
||||
static int copy_entry (const char *src, const char *dst,
|
||||
bool reset_selinux,
|
||||
uid_t old_uid, uid_t new_uid,
|
||||
gid_t old_gid, gid_t new_gid);
|
||||
long int uid, long int gid);
|
||||
static int copy_dir (const char *src, const char *dst,
|
||||
bool reset_selinux,
|
||||
const struct stat *statp, const struct timeval mt[],
|
||||
uid_t old_uid, uid_t new_uid,
|
||||
gid_t old_gid, gid_t new_gid);
|
||||
const struct stat *statp, const struct timeval mt[2],
|
||||
long int uid, long int gid);
|
||||
#ifdef S_IFLNK
|
||||
static /*@null@*/char *readlink_malloc (const char *filename);
|
||||
static int copy_symlink (const char *src, const char *dst,
|
||||
unused bool reset_selinux,
|
||||
const struct stat *statp, const struct timeval mt[],
|
||||
uid_t old_uid, uid_t new_uid,
|
||||
gid_t old_gid, gid_t new_gid);
|
||||
#endif /* S_IFLNK */
|
||||
static int copy_hardlink (const char *dst,
|
||||
unused bool reset_selinux,
|
||||
const struct stat *statp, const struct timeval mt[2],
|
||||
long int uid, long int gid);
|
||||
#endif
|
||||
static int copy_hardlink (const char *src, const char *dst,
|
||||
struct link_name *lp);
|
||||
static int copy_special (const char *src, const char *dst,
|
||||
bool reset_selinux,
|
||||
const struct stat *statp, const struct timeval mt[],
|
||||
uid_t old_uid, uid_t new_uid,
|
||||
gid_t old_gid, gid_t new_gid);
|
||||
static int copy_special (const char *dst,
|
||||
const struct stat *statp, const struct timeval mt[2],
|
||||
long int uid, long int gid);
|
||||
static int copy_file (const char *src, const char *dst,
|
||||
bool reset_selinux,
|
||||
const struct stat *statp, const struct timeval mt[],
|
||||
uid_t old_uid, uid_t new_uid,
|
||||
gid_t old_gid, gid_t new_gid);
|
||||
static int chown_if_needed (const char *dst, const struct stat *statp,
|
||||
uid_t old_uid, uid_t new_uid,
|
||||
gid_t old_gid, gid_t new_gid);
|
||||
static int lchown_if_needed (const char *dst, const struct stat *statp,
|
||||
uid_t old_uid, uid_t new_uid,
|
||||
gid_t old_gid, gid_t new_gid);
|
||||
static int fchown_if_needed (int fdst, const struct stat *statp,
|
||||
uid_t old_uid, uid_t new_uid,
|
||||
gid_t old_gid, gid_t new_gid);
|
||||
const struct stat *statp, const struct timeval mt[2],
|
||||
long int uid, long int gid);
|
||||
|
||||
#if defined(WITH_ACL) || defined(WITH_ATTR)
|
||||
#ifdef WITH_SELINUX
|
||||
/*
|
||||
* error_acl - format the error messages for the ACL and EQ libraries.
|
||||
* selinux_file_context - Set the security context before any file or
|
||||
* directory creation.
|
||||
*
|
||||
* selinux_file_context () should be called before any creation of file,
|
||||
* symlink, directory, ...
|
||||
*
|
||||
*/
|
||||
static void error_acl (struct error_context *ctx, const char *fmt, ...)
|
||||
static int selinux_file_context (const char *dst_name)
|
||||
{
|
||||
va_list ap;
|
||||
security_context_t scontext = NULL;
|
||||
|
||||
/* ignore the case when destination does not support ACLs
|
||||
* or extended attributes */
|
||||
if (ENOTSUP == errno) {
|
||||
errno = 0;
|
||||
return;
|
||||
if (selinux_enabled < 0) {
|
||||
selinux_enabled = is_selinux_enabled () > 0;
|
||||
}
|
||||
|
||||
va_start (ap, fmt);
|
||||
(void) fprintf (shadow_logfd, _("%s: "), Prog);
|
||||
if (vfprintf (shadow_logfd, fmt, ap) != 0) {
|
||||
(void) fputs (_(": "), shadow_logfd);
|
||||
if (selinux_enabled) {
|
||||
/* Get the default security context for this file */
|
||||
if (matchpathcon (dst_name, 0, &scontext) < 0) {
|
||||
if (security_getenforce () != 0) {
|
||||
return 1;
|
||||
}
|
||||
}
|
||||
/* Set the security context for the next created file */
|
||||
if (setfscreatecon (scontext) < 0) {
|
||||
if (security_getenforce () != 0) {
|
||||
return 1;
|
||||
}
|
||||
}
|
||||
freecon (scontext);
|
||||
}
|
||||
(void) fprintf (shadow_logfd, "%s\n", strerror (errno));
|
||||
va_end (ap);
|
||||
return 0;
|
||||
}
|
||||
|
||||
static struct error_context ctx = {
|
||||
error_acl
|
||||
};
|
||||
#endif /* WITH_ACL || WITH_ATTR */
|
||||
#endif
|
||||
|
||||
/*
|
||||
* remove_link - delete a link from the linked list
|
||||
*/
|
||||
static void remove_link (/*@only@*/struct link_name *ln)
|
||||
static void remove_link (struct link_name *ln)
|
||||
{
|
||||
struct link_name *lp;
|
||||
|
||||
@@ -158,8 +131,6 @@ static void remove_link (/*@only@*/struct link_name *ln)
|
||||
}
|
||||
|
||||
if (NULL == lp) {
|
||||
free (ln->ln_name);
|
||||
free (ln);
|
||||
return;
|
||||
}
|
||||
|
||||
@@ -172,19 +143,15 @@ static void remove_link (/*@only@*/struct link_name *ln)
|
||||
* check_link - see if a file is really a link
|
||||
*/
|
||||
|
||||
static /*@exposed@*/ /*@null@*/struct link_name *check_link (const char *name, const struct stat *sb)
|
||||
static struct link_name *check_link (const char *name, const struct stat *sb)
|
||||
{
|
||||
struct link_name *lp;
|
||||
size_t src_len;
|
||||
size_t dst_len;
|
||||
size_t name_len;
|
||||
size_t len;
|
||||
int src_len;
|
||||
int dst_len;
|
||||
int name_len;
|
||||
int len;
|
||||
|
||||
/* copy_tree () must be the entry point */
|
||||
assert (NULL != src_orig);
|
||||
assert (NULL != dst_orig);
|
||||
|
||||
for (lp = links; NULL != lp; lp = lp->ln_next) {
|
||||
for (lp = links; lp; lp = lp->ln_next) {
|
||||
if ((lp->ln_dev == sb->st_dev) && (lp->ln_ino == sb->st_ino)) {
|
||||
return lp;
|
||||
}
|
||||
@@ -202,8 +169,8 @@ static /*@exposed@*/ /*@null@*/struct link_name *check_link (const char *name, c
|
||||
lp->ln_ino = sb->st_ino;
|
||||
lp->ln_count = sb->st_nlink;
|
||||
len = name_len - src_len + dst_len + 1;
|
||||
lp->ln_name = (char *) xmalloc (len);
|
||||
(void) snprintf (lp->ln_name, len, "%s%s", dst_orig, name + src_len);
|
||||
lp->ln_name = xmalloc (len);
|
||||
snprintf (lp->ln_name, len, "%s%s", dst_orig, name + src_len);
|
||||
lp->ln_next = links;
|
||||
links = lp;
|
||||
|
||||
@@ -215,49 +182,17 @@ static /*@exposed@*/ /*@null@*/struct link_name *check_link (const char *name, c
|
||||
*
|
||||
* copy_tree() walks a directory tree and copies ordinary files
|
||||
* as it goes.
|
||||
*
|
||||
* When reset_selinux is enabled, extended attributes (and thus
|
||||
* SELinux attributes) are not copied.
|
||||
*
|
||||
* old_uid and new_uid are used to set the ownership of the copied
|
||||
* files. Unless old_uid is set to -1, only the files owned by
|
||||
* old_uid have their ownership changed to new_uid. In addition, if
|
||||
* new_uid is set to -1, no ownership will be changed.
|
||||
*
|
||||
* The same logic applies for the group-ownership and
|
||||
* old_gid/new_gid.
|
||||
*/
|
||||
int copy_tree (const char *src_root, const char *dst_root,
|
||||
bool copy_root, bool reset_selinux,
|
||||
uid_t old_uid, uid_t new_uid,
|
||||
gid_t old_gid, gid_t new_gid)
|
||||
long int uid, long int gid)
|
||||
{
|
||||
char src_name[1024];
|
||||
char dst_name[1024];
|
||||
int err = 0;
|
||||
bool set_orig = false;
|
||||
int set_orig = 0;
|
||||
struct DIRECT *ent;
|
||||
DIR *dir;
|
||||
|
||||
if (copy_root) {
|
||||
struct stat sb;
|
||||
if (access (dst_root, F_OK) == 0) {
|
||||
return -1;
|
||||
}
|
||||
|
||||
if (LSTAT (src_root, &sb) == -1) {
|
||||
return -1;
|
||||
}
|
||||
|
||||
if (!S_ISDIR (sb.st_mode)) {
|
||||
fprintf (shadow_logfd,
|
||||
"%s: %s is not a directory",
|
||||
Prog, src_root);
|
||||
return -1;
|
||||
}
|
||||
|
||||
return copy_entry (src_root, dst_root, reset_selinux,
|
||||
old_uid, new_uid, old_gid, new_gid);
|
||||
}
|
||||
|
||||
/*
|
||||
* Make certain both directories exist. This routine is called
|
||||
* after the home directory is created, or recursively after the
|
||||
@@ -281,10 +216,10 @@ int copy_tree (const char *src_root, const char *dst_root,
|
||||
return -1;
|
||||
}
|
||||
|
||||
if (src_orig == NULL) {
|
||||
if (src_orig == 0) {
|
||||
src_orig = src_root;
|
||||
dst_orig = dst_root;
|
||||
set_orig = true;
|
||||
set_orig++;
|
||||
}
|
||||
while ((0 == err) && (ent = readdir (dir)) != NULL) {
|
||||
/*
|
||||
@@ -292,66 +227,35 @@ int copy_tree (const char *src_root, const char *dst_root,
|
||||
*/
|
||||
if ((strcmp (ent->d_name, ".") != 0) &&
|
||||
(strcmp (ent->d_name, "..") != 0)) {
|
||||
char *src_name;
|
||||
char *dst_name;
|
||||
size_t src_len = strlen (ent->d_name) + 2;
|
||||
size_t dst_len = strlen (ent->d_name) + 2;
|
||||
src_len += strlen (src_root);
|
||||
dst_len += strlen (dst_root);
|
||||
|
||||
src_name = (char *) malloc (src_len);
|
||||
dst_name = (char *) malloc (dst_len);
|
||||
|
||||
if ((NULL == src_name) || (NULL == dst_name)) {
|
||||
/*
|
||||
* Make sure the resulting source and destination
|
||||
* filenames will fit in their buffers.
|
||||
*/
|
||||
if ( (strlen (src_root) + strlen (ent->d_name) + 2 >
|
||||
sizeof src_name)
|
||||
|| (strlen (dst_root) + strlen (ent->d_name) + 2 >
|
||||
sizeof dst_name)) {
|
||||
err = -1;
|
||||
} else {
|
||||
/*
|
||||
* Build the filename for both the source and
|
||||
* the destination files.
|
||||
*/
|
||||
(void) snprintf (src_name, src_len, "%s/%s",
|
||||
src_root, ent->d_name);
|
||||
(void) snprintf (dst_name, dst_len, "%s/%s",
|
||||
dst_root, ent->d_name);
|
||||
snprintf (src_name, sizeof src_name, "%s/%s",
|
||||
src_root, ent->d_name);
|
||||
snprintf (dst_name, sizeof dst_name, "%s/%s",
|
||||
dst_root, ent->d_name);
|
||||
|
||||
err = copy_entry (src_name, dst_name,
|
||||
reset_selinux,
|
||||
old_uid, new_uid,
|
||||
old_gid, new_gid);
|
||||
}
|
||||
if (NULL != src_name) {
|
||||
free (src_name);
|
||||
}
|
||||
if (NULL != dst_name) {
|
||||
free (dst_name);
|
||||
err = copy_entry (src_name, dst_name, uid, gid);
|
||||
}
|
||||
}
|
||||
}
|
||||
(void) closedir (dir);
|
||||
|
||||
if (set_orig) {
|
||||
src_orig = NULL;
|
||||
dst_orig = NULL;
|
||||
/* FIXME: clean links
|
||||
* Since there can be hardlinks elsewhere on the device,
|
||||
* we cannot check that all the hardlinks were found:
|
||||
assert (NULL == links);
|
||||
*/
|
||||
src_orig = 0;
|
||||
dst_orig = 0;
|
||||
}
|
||||
|
||||
#ifdef WITH_SELINUX
|
||||
/* Reset SELinux to create files with default contexts.
|
||||
* Note that the context is only reset on exit of copy_tree (it is
|
||||
* assumed that the program would quit without needing a restored
|
||||
* context if copy_tree failed previously), and that copy_tree can
|
||||
* be called recursively (hence the context is set on the
|
||||
* sub-functions of copy_entry).
|
||||
*/
|
||||
if (reset_selinux_file_context () != 0) {
|
||||
err = -1;
|
||||
}
|
||||
#endif /* WITH_SELINUX */
|
||||
|
||||
return err;
|
||||
}
|
||||
|
||||
@@ -365,19 +269,13 @@ int copy_tree (const char *src_root, const char *dst_root,
|
||||
*
|
||||
* The access and modification time will not be modified.
|
||||
*
|
||||
* The permissions will be set to new_uid/new_gid.
|
||||
* The permissions will be set to uid/gid.
|
||||
*
|
||||
* If new_uid (resp. new_gid) is equal to -1, the user (resp. group) will
|
||||
* If uid (resp. gid) is equal to -1, the user (resp. group) will
|
||||
* not be modified.
|
||||
*
|
||||
* Only the files owned (resp. group-owned) by old_uid (resp.
|
||||
* old_gid) will be modified, unless old_uid (resp. old_gid) is set
|
||||
* to -1.
|
||||
*/
|
||||
static int copy_entry (const char *src, const char *dst,
|
||||
bool reset_selinux,
|
||||
uid_t old_uid, uid_t new_uid,
|
||||
gid_t old_gid, gid_t new_gid)
|
||||
long int uid, long int gid)
|
||||
{
|
||||
int err = 0;
|
||||
struct stat sb;
|
||||
@@ -387,33 +285,20 @@ static int copy_entry (const char *src, const char *dst,
|
||||
if (LSTAT (src, &sb) == -1) {
|
||||
/* If we cannot stat the file, do not care. */
|
||||
} else {
|
||||
#ifdef HAVE_STRUCT_STAT_ST_ATIM
|
||||
#if defined(_BSD_SOURCE) || defined(_SVID_SOURCE)
|
||||
mt[0].tv_sec = sb.st_atim.tv_sec;
|
||||
mt[0].tv_usec = sb.st_atim.tv_nsec / 1000;
|
||||
#else /* !HAVE_STRUCT_STAT_ST_ATIM */
|
||||
mt[0].tv_sec = sb.st_atime;
|
||||
# ifdef HAVE_STRUCT_STAT_ST_ATIMENSEC
|
||||
mt[0].tv_usec = sb.st_atimensec / 1000;
|
||||
# else /* !HAVE_STRUCT_STAT_ST_ATIMENSEC */
|
||||
mt[0].tv_usec = 0;
|
||||
# endif /* !HAVE_STRUCT_STAT_ST_ATIMENSEC */
|
||||
#endif /* !HAVE_STRUCT_STAT_ST_ATIM */
|
||||
|
||||
#ifdef HAVE_STRUCT_STAT_ST_MTIM
|
||||
mt[1].tv_sec = sb.st_mtim.tv_sec;
|
||||
mt[1].tv_usec = sb.st_mtim.tv_nsec / 1000;
|
||||
#else /* !HAVE_STRUCT_STAT_ST_MTIM */
|
||||
#else
|
||||
mt[0].tv_sec = sb.st_atime;
|
||||
mt[0].tv_usec = sb.st_atimensec / 1000;
|
||||
mt[1].tv_sec = sb.st_mtime;
|
||||
# ifdef HAVE_STRUCT_STAT_ST_MTIMENSEC
|
||||
mt[1].tv_usec = sb.st_mtimensec / 1000;
|
||||
# else /* !HAVE_STRUCT_STAT_ST_MTIMENSEC */
|
||||
mt[1].tv_usec = 0;
|
||||
# endif /* !HAVE_STRUCT_STAT_ST_MTIMENSEC */
|
||||
#endif /* !HAVE_STRUCT_STAT_ST_MTIM */
|
||||
#endif
|
||||
|
||||
if (S_ISDIR (sb.st_mode)) {
|
||||
err = copy_dir (src, dst, reset_selinux, &sb, mt,
|
||||
old_uid, new_uid, old_gid, new_gid);
|
||||
err = copy_dir (src, dst, &sb, mt, uid, gid);
|
||||
}
|
||||
|
||||
#ifdef S_IFLNK
|
||||
@@ -422,17 +307,16 @@ static int copy_entry (const char *src, const char *dst,
|
||||
*/
|
||||
|
||||
else if (S_ISLNK (sb.st_mode)) {
|
||||
err = copy_symlink (src, dst, reset_selinux, &sb, mt,
|
||||
old_uid, new_uid, old_gid, new_gid);
|
||||
err = copy_symlink (src, dst, &sb, mt, uid, gid);
|
||||
}
|
||||
#endif /* S_IFLNK */
|
||||
#endif
|
||||
|
||||
/*
|
||||
* See if this is a previously copied link
|
||||
*/
|
||||
|
||||
else if ((lp = check_link (src, &sb)) != NULL) {
|
||||
err = copy_hardlink (dst, reset_selinux, lp);
|
||||
err = copy_hardlink (src, dst, lp);
|
||||
}
|
||||
|
||||
/*
|
||||
@@ -442,8 +326,7 @@ static int copy_entry (const char *src, const char *dst,
|
||||
*/
|
||||
|
||||
else if (!S_ISREG (sb.st_mode)) {
|
||||
err = copy_special (src, dst, reset_selinux, &sb, mt,
|
||||
old_uid, new_uid, old_gid, new_gid);
|
||||
err = copy_special (dst, &sb, mt, uid, gid);
|
||||
}
|
||||
|
||||
/*
|
||||
@@ -452,8 +335,7 @@ static int copy_entry (const char *src, const char *dst,
|
||||
*/
|
||||
|
||||
else {
|
||||
err = copy_file (src, dst, reset_selinux, &sb, mt,
|
||||
old_uid, new_uid, old_gid, new_gid);
|
||||
err = copy_file (src, dst, &sb, mt, uid, gid);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -465,16 +347,14 @@ static int copy_entry (const char *src, const char *dst,
|
||||
*
|
||||
* Copy a directory (recursively) from src to dst.
|
||||
*
|
||||
* statp, mt, old_uid, new_uid, old_gid, and new_gid are used to set
|
||||
* the access and modification and the access rights.
|
||||
* statp, mt, uid, gid are used to set the access and modification and the
|
||||
* access rights.
|
||||
*
|
||||
* Return 0 on success, -1 on error.
|
||||
*/
|
||||
static int copy_dir (const char *src, const char *dst,
|
||||
bool reset_selinux,
|
||||
const struct stat *statp, const struct timeval mt[],
|
||||
uid_t old_uid, uid_t new_uid,
|
||||
gid_t old_gid, gid_t new_gid)
|
||||
const struct stat *statp, const struct timeval mt[2],
|
||||
long int uid, long int gid)
|
||||
{
|
||||
int err = 0;
|
||||
|
||||
@@ -484,33 +364,14 @@ static int copy_dir (const char *src, const char *dst,
|
||||
*/
|
||||
|
||||
#ifdef WITH_SELINUX
|
||||
if (set_selinux_file_context (dst, S_IFDIR) != 0) {
|
||||
return -1;
|
||||
}
|
||||
#endif /* WITH_SELINUX */
|
||||
selinux_file_context (dst);
|
||||
#endif
|
||||
if ( (mkdir (dst, statp->st_mode) != 0)
|
||||
|| (chown_if_needed (dst, statp,
|
||||
old_uid, new_uid, old_gid, new_gid) != 0)
|
||||
#ifdef WITH_ACL
|
||||
|| ( (perm_copy_file (src, dst, &ctx) != 0)
|
||||
&& (errno != 0))
|
||||
#else /* !WITH_ACL */
|
||||
|| (chown (dst,
|
||||
(uid == - 1) ? statp->st_uid : (uid_t) uid,
|
||||
(gid == - 1) ? statp->st_gid : (gid_t) gid) != 0)
|
||||
|| (chmod (dst, statp->st_mode) != 0)
|
||||
#endif /* !WITH_ACL */
|
||||
#ifdef WITH_ATTR
|
||||
/*
|
||||
* If the third parameter is NULL, all extended attributes
|
||||
* except those that define Access Control Lists are copied.
|
||||
* ACLs are excluded by default because copying them between
|
||||
* file systems with and without ACL support needs some
|
||||
* additional logic so that no unexpected permissions result.
|
||||
*/
|
||||
|| ( !reset_selinux
|
||||
&& (attr_copy_file (src, dst, NULL, &ctx) != 0)
|
||||
&& (errno != 0))
|
||||
#endif /* WITH_ATTR */
|
||||
|| (copy_tree (src, dst, false, reset_selinux,
|
||||
old_uid, new_uid, old_gid, new_gid) != 0)
|
||||
|| (copy_tree (src, dst, uid, gid) != 0)
|
||||
|| (utimes (dst, mt) != 0)) {
|
||||
err = -1;
|
||||
}
|
||||
@@ -519,63 +380,24 @@ static int copy_dir (const char *src, const char *dst,
|
||||
}
|
||||
|
||||
#ifdef S_IFLNK
|
||||
/*
|
||||
* readlink_malloc - wrapper for readlink
|
||||
*
|
||||
* return NULL on error.
|
||||
* The return string shall be freed by the caller.
|
||||
*/
|
||||
static /*@null@*/char *readlink_malloc (const char *filename)
|
||||
{
|
||||
size_t size = 1024;
|
||||
|
||||
while (true) {
|
||||
ssize_t nchars;
|
||||
char *buffer = (char *) malloc (size);
|
||||
if (NULL == buffer) {
|
||||
return NULL;
|
||||
}
|
||||
|
||||
nchars = readlink (filename, buffer, size);
|
||||
|
||||
if (nchars < 0) {
|
||||
free(buffer);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
if ((size_t) nchars < size) { /* The buffer was large enough */
|
||||
/* readlink does not nul-terminate */
|
||||
buffer[nchars] = '\0';
|
||||
return buffer;
|
||||
}
|
||||
|
||||
/* Try again with a bigger buffer */
|
||||
free (buffer);
|
||||
size *= 2;
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* copy_symlink - copy a symlink
|
||||
*
|
||||
* Copy a symlink from src to dst.
|
||||
*
|
||||
* statp, mt, old_uid, new_uid, old_gid, and new_gid are used to set
|
||||
* the access and modification and the access rights.
|
||||
* statp, mt, uid, gid are used to set the access and modification and the
|
||||
* access rights.
|
||||
*
|
||||
* Return 0 on success, -1 on error.
|
||||
*/
|
||||
static int copy_symlink (const char *src, const char *dst,
|
||||
unused bool reset_selinux,
|
||||
const struct stat *statp, const struct timeval mt[],
|
||||
uid_t old_uid, uid_t new_uid,
|
||||
gid_t old_gid, gid_t new_gid)
|
||||
const struct stat *statp, const struct timeval mt[2],
|
||||
long int uid, long int gid)
|
||||
{
|
||||
char *oldlink;
|
||||
|
||||
/* copy_tree () must be the entry point */
|
||||
assert (NULL != src_orig);
|
||||
assert (NULL != dst_orig);
|
||||
char oldlink[1024];
|
||||
char dummy[1024];
|
||||
int len;
|
||||
int err = 0;
|
||||
|
||||
/*
|
||||
* Get the name of the file which the link points
|
||||
@@ -585,58 +407,37 @@ static int copy_symlink (const char *src, const char *dst,
|
||||
* destination directory name.
|
||||
*/
|
||||
|
||||
oldlink = readlink_malloc (src);
|
||||
if (NULL == oldlink) {
|
||||
len = readlink (src, oldlink, sizeof (oldlink) - 1);
|
||||
if (len < 0) {
|
||||
return -1;
|
||||
}
|
||||
|
||||
/* If src was a link to an entry of the src_orig directory itself,
|
||||
* create a link to the corresponding entry in the dst_orig
|
||||
* directory.
|
||||
*/
|
||||
oldlink[len] = '\0'; /* readlink() does not NUL-terminate */
|
||||
if (strncmp (oldlink, src_orig, strlen (src_orig)) == 0) {
|
||||
size_t len = strlen (dst_orig) + strlen (oldlink) - strlen (src_orig) + 1;
|
||||
char *dummy = (char *) xmalloc (len);
|
||||
(void) snprintf (dummy, len, "%s%s",
|
||||
dst_orig,
|
||||
oldlink + strlen (src_orig));
|
||||
free (oldlink);
|
||||
oldlink = dummy;
|
||||
snprintf (dummy, sizeof dummy, "%s%s",
|
||||
dst_orig,
|
||||
oldlink + strlen (src_orig));
|
||||
strcpy (oldlink, dummy);
|
||||
}
|
||||
|
||||
#ifdef WITH_SELINUX
|
||||
if (set_selinux_file_context (dst, S_IFLNK) != 0) {
|
||||
free (oldlink);
|
||||
return -1;
|
||||
}
|
||||
#endif /* WITH_SELINUX */
|
||||
selinux_file_context (dst);
|
||||
#endif
|
||||
if ( (symlink (oldlink, dst) != 0)
|
||||
|| (lchown_if_needed (dst, statp,
|
||||
old_uid, new_uid, old_gid, new_gid) != 0)) {
|
||||
/* FIXME: there are no modes on symlinks, right?
|
||||
* ACL could be copied, but this would be much more
|
||||
* complex than calling perm_copy_file.
|
||||
* Ditto for Extended Attributes.
|
||||
* We currently only document that ACL and Extended
|
||||
* Attributes are not copied.
|
||||
*/
|
||||
free (oldlink);
|
||||
|| (lchown (dst,
|
||||
(uid == -1) ? statp->st_uid : (uid_t) uid,
|
||||
(gid == -1) ? statp->st_gid : (gid_t) gid) != 0)) {
|
||||
return -1;
|
||||
}
|
||||
free (oldlink);
|
||||
|
||||
#ifdef HAVE_LUTIMES
|
||||
/* 2007-10-18: We don't care about
|
||||
* exit status of lutimes because
|
||||
* it returns ENOSYS on many system
|
||||
* - not implemented
|
||||
*/
|
||||
(void) lutimes (dst, mt);
|
||||
#endif /* HAVE_LUTIMES */
|
||||
lutimes (dst, mt);
|
||||
|
||||
return 0;
|
||||
return err;
|
||||
}
|
||||
#endif /* S_IFLNK */
|
||||
#endif
|
||||
|
||||
/*
|
||||
* copy_hardlink - copy a hardlink
|
||||
@@ -645,18 +446,20 @@ static int copy_symlink (const char *src, const char *dst,
|
||||
*
|
||||
* Return 0 on success, -1 on error.
|
||||
*/
|
||||
static int copy_hardlink (const char *dst,
|
||||
unused bool reset_selinux,
|
||||
static int copy_hardlink (const char *src, const char *dst,
|
||||
struct link_name *lp)
|
||||
{
|
||||
/* FIXME: selinux, ACL, Extended Attributes needed? */
|
||||
/* TODO: selinux needed? */
|
||||
|
||||
if (link (lp->ln_name, dst) != 0) {
|
||||
return -1;
|
||||
}
|
||||
if (unlink (src) != 0) {
|
||||
return -1;
|
||||
}
|
||||
|
||||
/* If the file could be unlinked, decrement the links counter,
|
||||
* and forget about this link if it was the last reference */
|
||||
* and delete the file if it was the last reference */
|
||||
lp->ln_count--;
|
||||
if (lp->ln_count <= 0) {
|
||||
remove_link (lp);
|
||||
@@ -670,46 +473,26 @@ static int copy_hardlink (const char *dst,
|
||||
*
|
||||
* Copy a special file from src to dst.
|
||||
*
|
||||
* statp, mt, old_uid, new_uid, old_gid, and new_gid are used to set
|
||||
* the access and modification and the access rights.
|
||||
* statp, mt, uid, gid are used to set the access and modification and the
|
||||
* access rights.
|
||||
*
|
||||
* Return 0 on success, -1 on error.
|
||||
*/
|
||||
static int copy_special (const char *src, const char *dst,
|
||||
bool reset_selinux,
|
||||
const struct stat *statp, const struct timeval mt[],
|
||||
uid_t old_uid, uid_t new_uid,
|
||||
gid_t old_gid, gid_t new_gid)
|
||||
static int copy_special (const char *dst,
|
||||
const struct stat *statp, const struct timeval mt[2],
|
||||
long int uid, long int gid)
|
||||
{
|
||||
int err = 0;
|
||||
|
||||
#ifdef WITH_SELINUX
|
||||
if (set_selinux_file_context (dst, statp->st_mode & S_IFMT) != 0) {
|
||||
return -1;
|
||||
}
|
||||
#endif /* WITH_SELINUX */
|
||||
selinux_file_context (dst);
|
||||
#endif
|
||||
|
||||
if ( (mknod (dst, statp->st_mode & ~07777, statp->st_rdev) != 0)
|
||||
|| (chown_if_needed (dst, statp,
|
||||
old_uid, new_uid, old_gid, new_gid) != 0)
|
||||
#ifdef WITH_ACL
|
||||
|| ( (perm_copy_file (src, dst, &ctx) != 0)
|
||||
&& (errno != 0))
|
||||
#else /* !WITH_ACL */
|
||||
|| (chown (dst,
|
||||
(uid == -1) ? statp->st_uid : (uid_t) uid,
|
||||
(gid == -1) ? statp->st_gid : (gid_t) gid) != 0)
|
||||
|| (chmod (dst, statp->st_mode & 07777) != 0)
|
||||
#endif /* !WITH_ACL */
|
||||
#ifdef WITH_ATTR
|
||||
/*
|
||||
* If the third parameter is NULL, all extended attributes
|
||||
* except those that define Access Control Lists are copied.
|
||||
* ACLs are excluded by default because copying them between
|
||||
* file systems with and without ACL support needs some
|
||||
* additional logic so that no unexpected permissions result.
|
||||
*/
|
||||
|| ( !reset_selinux
|
||||
&& (attr_copy_file (src, dst, NULL, &ctx) != 0)
|
||||
&& (errno != 0))
|
||||
#endif /* WITH_ATTR */
|
||||
|| (utimes (dst, mt) != 0)) {
|
||||
err = -1;
|
||||
}
|
||||
@@ -722,124 +505,144 @@ static int copy_special (const char *src, const char *dst,
|
||||
*
|
||||
* Copy a file from src to dst.
|
||||
*
|
||||
* statp, mt, old_uid, new_uid, old_gid, and new_gid are used to set
|
||||
* the access and modification and the access rights.
|
||||
* statp, mt, uid, gid are used to set the access and modification and the
|
||||
* access rights.
|
||||
*
|
||||
* Return 0 on success, -1 on error.
|
||||
*/
|
||||
static int copy_file (const char *src, const char *dst,
|
||||
bool reset_selinux,
|
||||
const struct stat *statp, const struct timeval mt[],
|
||||
uid_t old_uid, uid_t new_uid,
|
||||
gid_t old_gid, gid_t new_gid)
|
||||
const struct stat *statp, const struct timeval mt[2],
|
||||
long int uid, long int gid)
|
||||
{
|
||||
int err = 0;
|
||||
int ifd;
|
||||
int ofd;
|
||||
char buf[1024];
|
||||
ssize_t cnt;
|
||||
int cnt;
|
||||
|
||||
ifd = open (src, O_RDONLY);
|
||||
if (ifd < 0) {
|
||||
return -1;
|
||||
}
|
||||
#ifdef WITH_SELINUX
|
||||
if (set_selinux_file_context (dst, S_IFREG) != 0) {
|
||||
(void) close (ifd);
|
||||
return -1;
|
||||
}
|
||||
#endif /* WITH_SELINUX */
|
||||
ofd = open (dst, O_WRONLY | O_CREAT | O_TRUNC, statp->st_mode & 07777);
|
||||
selinux_file_context (dst);
|
||||
#endif
|
||||
ofd = open (dst, O_WRONLY | O_CREAT | O_TRUNC, 0);
|
||||
if ( (ofd < 0)
|
||||
|| (fchown_if_needed (ofd, statp,
|
||||
old_uid, new_uid, old_gid, new_gid) != 0)
|
||||
#ifdef WITH_ACL
|
||||
|| ( (perm_copy_fd (src, ifd, dst, ofd, &ctx) != 0)
|
||||
&& (errno != 0))
|
||||
#else /* !WITH_ACL */
|
||||
|| (fchmod (ofd, statp->st_mode & 07777) != 0)
|
||||
#endif /* !WITH_ACL */
|
||||
#ifdef WITH_ATTR
|
||||
/*
|
||||
* If the third parameter is NULL, all extended attributes
|
||||
* except those that define Access Control Lists are copied.
|
||||
* ACLs are excluded by default because copying them between
|
||||
* file systems with and without ACL support needs some
|
||||
* additional logic so that no unexpected permissions result.
|
||||
*/
|
||||
|| ( !reset_selinux
|
||||
&& (attr_copy_fd (src, ifd, dst, ofd, NULL, &ctx) != 0)
|
||||
&& (errno != 0))
|
||||
#endif /* WITH_ATTR */
|
||||
) {
|
||||
if (ofd >= 0) {
|
||||
(void) close (ofd);
|
||||
}
|
||||
|| (chown (dst,
|
||||
(uid == -1) ? statp->st_uid : (uid_t) uid,
|
||||
(gid == -1) ? statp->st_gid : (gid_t) gid) != 0)
|
||||
|| (chmod (dst, statp->st_mode & 07777) != 0)) {
|
||||
(void) close (ifd);
|
||||
return -1;
|
||||
}
|
||||
|
||||
while ((cnt = read (ifd, buf, sizeof buf)) > 0) {
|
||||
if (write (ofd, buf, (size_t)cnt) != cnt) {
|
||||
(void) close (ofd);
|
||||
(void) close (ifd);
|
||||
if (write (ofd, buf, cnt) != cnt) {
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
|
||||
(void) close (ifd);
|
||||
|
||||
#ifdef HAVE_FUTIMES
|
||||
if (futimes (ofd, mt) != 0) {
|
||||
(void) close (ofd);
|
||||
return -1;
|
||||
}
|
||||
#endif /* HAVE_FUTIMES */
|
||||
|
||||
if (close (ofd) != 0) {
|
||||
return -1;
|
||||
}
|
||||
|
||||
#ifndef HAVE_FUTIMES
|
||||
if (utimes(dst, mt) != 0) {
|
||||
return err;
|
||||
}
|
||||
|
||||
/*
|
||||
* remove_tree - delete a directory tree
|
||||
*
|
||||
* remove_tree() walks a directory tree and deletes all the files
|
||||
* and directories.
|
||||
* At the end, it deletes the root directory itself.
|
||||
*/
|
||||
|
||||
int remove_tree (const char *root)
|
||||
{
|
||||
char new_name[1024];
|
||||
int err = 0;
|
||||
struct DIRECT *ent;
|
||||
struct stat sb;
|
||||
DIR *dir;
|
||||
|
||||
/*
|
||||
* Make certain the directory exists.
|
||||
*/
|
||||
|
||||
if (access (root, F_OK) != 0) {
|
||||
return -1;
|
||||
}
|
||||
#endif /* !HAVE_FUTIMES */
|
||||
|
||||
/*
|
||||
* Open the source directory and read each entry. Every file
|
||||
* entry in the directory is copied with the UID and GID set
|
||||
* to the provided values. As an added security feature only
|
||||
* regular files (and directories ...) are copied, and no file
|
||||
* is made set-ID.
|
||||
*/
|
||||
dir = opendir (root);
|
||||
if (NULL == dir) {
|
||||
return -1;
|
||||
}
|
||||
|
||||
while ((ent = readdir (dir))) {
|
||||
|
||||
/*
|
||||
* Skip the "." and ".." entries
|
||||
*/
|
||||
|
||||
if (strcmp (ent->d_name, ".") == 0 ||
|
||||
strcmp (ent->d_name, "..") == 0) {
|
||||
continue;
|
||||
}
|
||||
|
||||
/*
|
||||
* Make the filename for the current entry.
|
||||
*/
|
||||
|
||||
if (strlen (root) + strlen (ent->d_name) + 2 > sizeof new_name) {
|
||||
err = -1;
|
||||
break;
|
||||
}
|
||||
snprintf (new_name, sizeof new_name, "%s/%s", root,
|
||||
ent->d_name);
|
||||
if (LSTAT (new_name, &sb) == -1) {
|
||||
continue;
|
||||
}
|
||||
|
||||
if (S_ISDIR (sb.st_mode)) {
|
||||
/*
|
||||
* Recursively delete this directory.
|
||||
*/
|
||||
if (remove_tree (new_name) != 0) {
|
||||
err = -1;
|
||||
break;
|
||||
}
|
||||
} else {
|
||||
/*
|
||||
* Delete the file.
|
||||
*/
|
||||
if (unlink (new_name) != 0) {
|
||||
err = -1;
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
(void) closedir (dir);
|
||||
|
||||
if (0 == err) {
|
||||
if (rmdir (root) != 0) {
|
||||
err = -1;
|
||||
}
|
||||
}
|
||||
|
||||
return err;
|
||||
}
|
||||
|
||||
#define def_chown_if_needed(chown_function, type_dst) \
|
||||
static int chown_function ## _if_needed (type_dst dst, \
|
||||
const struct stat *statp, \
|
||||
uid_t old_uid, uid_t new_uid, \
|
||||
gid_t old_gid, gid_t new_gid) \
|
||||
{ \
|
||||
uid_t tmpuid = (uid_t) -1; \
|
||||
gid_t tmpgid = (gid_t) -1; \
|
||||
\
|
||||
/* Use new_uid if old_uid is set to -1 or if the file was \
|
||||
* owned by the user. */ \
|
||||
if (((uid_t) -1 == old_uid) || (statp->st_uid == old_uid)) { \
|
||||
tmpuid = new_uid; \
|
||||
} \
|
||||
/* Otherwise, or if new_uid was set to -1, we keep the same \
|
||||
* owner. */ \
|
||||
if ((uid_t) -1 == tmpuid) { \
|
||||
tmpuid = statp->st_uid; \
|
||||
} \
|
||||
\
|
||||
if (((gid_t) -1 == old_gid) || (statp->st_gid == old_gid)) { \
|
||||
tmpgid = new_gid; \
|
||||
} \
|
||||
if ((gid_t) -1 == tmpgid) { \
|
||||
tmpgid = statp->st_gid; \
|
||||
} \
|
||||
\
|
||||
return chown_function (dst, tmpuid, tmpgid); \
|
||||
}
|
||||
|
||||
def_chown_if_needed (chown, const char *)
|
||||
def_chown_if_needed (lchown, const char *)
|
||||
def_chown_if_needed (fchown, int)
|
||||
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
* Copyright (c) 1989 - 1992, Julianne Frances Haugh
|
||||
* Copyright (c) 1996 - 1999, Marek Michałkiewicz
|
||||
* Copyright (c) 2003 - 2005, Tomasz Kłoczko
|
||||
* Copyright (c) 2008 - 2009, Nicolas François
|
||||
* Copyright (c) 2008 , Nicolas François
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
@@ -34,7 +34,6 @@
|
||||
|
||||
#ident "$Id$"
|
||||
|
||||
#include <assert.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
@@ -47,7 +46,7 @@
|
||||
*/
|
||||
#define NEWENVP_STEP 16
|
||||
size_t newenvc = 0;
|
||||
/*@null@*/char **newenvp = NULL;
|
||||
char **newenvp = NULL;
|
||||
extern char **environ;
|
||||
|
||||
static const char *forbid[] = {
|
||||
@@ -86,18 +85,15 @@ void initenv (void)
|
||||
}
|
||||
|
||||
|
||||
void addenv (const char *string, /*@null@*/const char *value)
|
||||
void addenv (const char *string, const char *value)
|
||||
{
|
||||
char *cp, *newstring;
|
||||
size_t i;
|
||||
size_t n;
|
||||
|
||||
if (NULL != value) {
|
||||
size_t len = strlen (string) + strlen (value) + 2;
|
||||
int wlen;
|
||||
newstring = xmalloc (len);
|
||||
wlen = snprintf (newstring, len, "%s=%s", string, value);
|
||||
assert (wlen == (int) len -1);
|
||||
if (value) {
|
||||
newstring = xmalloc (strlen (string) + strlen (value) + 2);
|
||||
sprintf (newstring, "%s=%s", string, value);
|
||||
} else {
|
||||
newstring = xstrdup (string);
|
||||
}
|
||||
@@ -108,21 +104,17 @@ void addenv (const char *string, /*@null@*/const char *value)
|
||||
*/
|
||||
|
||||
cp = strchr (newstring, '=');
|
||||
if (NULL == cp) {
|
||||
if (!cp) {
|
||||
free (newstring);
|
||||
return;
|
||||
}
|
||||
|
||||
n = (size_t) (cp - newstring);
|
||||
|
||||
/*
|
||||
* If this environment variable is already set, change its value.
|
||||
*/
|
||||
for (i = 0; i < newenvc; i++) {
|
||||
if ( (strncmp (newstring, newenvp[i], n) == 0)
|
||||
&& (('=' == newenvp[i][n]) || ('\0' == newenvp[i][n]))) {
|
||||
if (strncmp (newstring, newenvp[i], n) == 0 &&
|
||||
(newenvp[i][n] == '=' || newenvp[i][n] == '\0'))
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
if (i < newenvc) {
|
||||
@@ -131,15 +123,8 @@ void addenv (const char *string, /*@null@*/const char *value)
|
||||
return;
|
||||
}
|
||||
|
||||
/*
|
||||
* Otherwise, save the new environment variable
|
||||
*/
|
||||
newenvp[newenvc++] = newstring;
|
||||
|
||||
/*
|
||||
* And extend the environment if needed.
|
||||
*/
|
||||
|
||||
/*
|
||||
* Check whether newenvc is a multiple of NEWENVP_STEP.
|
||||
* If so we have to resize the vector.
|
||||
@@ -153,27 +138,25 @@ void addenv (const char *string, /*@null@*/const char *value)
|
||||
size_t newsize;
|
||||
|
||||
/*
|
||||
* If the resize operation succeeds we can
|
||||
* If the resize operation succeds we can
|
||||
* happily go on, else print a message.
|
||||
*/
|
||||
|
||||
newsize = (newenvc + NEWENVP_STEP) * sizeof (char *);
|
||||
__newenvp = (char **) realloc (newenvp, newsize);
|
||||
|
||||
if (NULL != __newenvp) {
|
||||
if (__newenvp) {
|
||||
/*
|
||||
* If this is our current environment, update
|
||||
* environ so that it doesn't point to some
|
||||
* free memory area (realloc() could move it).
|
||||
*/
|
||||
if (environ == newenvp) {
|
||||
if (environ == newenvp)
|
||||
environ = __newenvp;
|
||||
}
|
||||
newenvp = __newenvp;
|
||||
} else {
|
||||
(void) fputs (_("Environment overflow\n"), shadow_logfd);
|
||||
newenvc--;
|
||||
free (newenvp[newenvc]);
|
||||
fputs (_("Environment overflow\n"), stderr);
|
||||
free (newenvp[--newenvc]);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -195,28 +178,21 @@ void set_env (int argc, char *const *argv)
|
||||
char *cp;
|
||||
|
||||
for (; argc > 0; argc--, argv++) {
|
||||
if (strlen (*argv) >= sizeof variable) {
|
||||
if (strlen (*argv) >= sizeof variable)
|
||||
continue; /* ignore long entries */
|
||||
}
|
||||
|
||||
cp = strchr (*argv, '=');
|
||||
if (NULL == cp) {
|
||||
int wlen;
|
||||
wlen = snprintf (variable, sizeof variable, "L%d", noname);
|
||||
assert (wlen < (int) sizeof(variable));
|
||||
noname++;
|
||||
if (!(cp = strchr (*argv, '='))) {
|
||||
snprintf (variable, sizeof variable, "L%d", noname++);
|
||||
addenv (variable, *argv);
|
||||
} else {
|
||||
const char **p;
|
||||
|
||||
for (p = forbid; NULL != *p; p++) {
|
||||
if (strncmp (*argv, *p, strlen (*p)) == 0) {
|
||||
for (p = forbid; *p; p++)
|
||||
if (strncmp (*argv, *p, strlen (*p)) == 0)
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
if (NULL != *p) {
|
||||
strncpy (variable, *argv, (size_t)(cp - *argv));
|
||||
if (*p) {
|
||||
strncpy (variable, *argv, cp - *argv);
|
||||
variable[cp - *argv] = '\0';
|
||||
printf (_("You may not change $%s\n"),
|
||||
variable);
|
||||
@@ -244,32 +220,27 @@ void sanitize_env (void)
|
||||
char **cur;
|
||||
char **move;
|
||||
|
||||
for (cur = envp; NULL != *cur; cur++) {
|
||||
for (bad = forbid; NULL != *bad; bad++) {
|
||||
for (cur = envp; *cur; cur++) {
|
||||
for (bad = forbid; *bad; bad++) {
|
||||
if (strncmp (*cur, *bad, strlen (*bad)) == 0) {
|
||||
for (move = cur; NULL != *move; move++) {
|
||||
for (move = cur; *move; move++)
|
||||
*move = *(move + 1);
|
||||
}
|
||||
cur--;
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
for (cur = envp; NULL != *cur; cur++) {
|
||||
for (bad = noslash; NULL != *bad; bad++) {
|
||||
if (strncmp (*cur, *bad, strlen (*bad)) != 0) {
|
||||
for (cur = envp; *cur; cur++) {
|
||||
for (bad = noslash; *bad; bad++) {
|
||||
if (strncmp (*cur, *bad, strlen (*bad)) != 0)
|
||||
continue;
|
||||
}
|
||||
if (strchr (*cur, '/') == NULL) {
|
||||
if (!strchr (*cur, '/'))
|
||||
continue; /* OK */
|
||||
}
|
||||
for (move = cur; NULL != *move; move++) {
|
||||
for (move = cur; *move; move++)
|
||||
*move = *(move + 1);
|
||||
}
|
||||
cur--;
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -2,7 +2,6 @@
|
||||
* Copyright (c) 1989 - 1994, Julianne Frances Haugh
|
||||
* Copyright (c) 1996 - 1998, Marek Michałkiewicz
|
||||
* Copyright (c) 2002 - 2005, Tomasz Kłoczko
|
||||
* Copyright (c) 2008 - 2010, Nicolas François
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
@@ -36,7 +35,6 @@
|
||||
|
||||
#include <fcntl.h>
|
||||
#include <stdio.h>
|
||||
#include <unistd.h>
|
||||
#include "defines.h"
|
||||
#include "faillog.h"
|
||||
#include "getdef.h"
|
||||
@@ -51,23 +49,13 @@
|
||||
void failure (uid_t uid, const char *tty, struct faillog *fl)
|
||||
{
|
||||
int fd;
|
||||
off_t offset_uid = (off_t) (sizeof *fl) * uid;
|
||||
|
||||
/*
|
||||
* Don't do anything if failure logging isn't set up.
|
||||
*/
|
||||
|
||||
if (access (FAILLOG_FILE, F_OK) != 0) {
|
||||
if ((fd = open (FAILLOG_FILE, O_RDWR)) < 0)
|
||||
return;
|
||||
}
|
||||
|
||||
fd = open (FAILLOG_FILE, O_RDWR);
|
||||
if (fd < 0) {
|
||||
SYSLOG ((LOG_WARN,
|
||||
"Can't write faillog entry for UID %lu in %s.",
|
||||
(unsigned long) uid, FAILLOG_FILE));
|
||||
return;
|
||||
}
|
||||
|
||||
/*
|
||||
* The file is indexed by UID value meaning that shared UID's
|
||||
@@ -75,17 +63,9 @@ void failure (uid_t uid, const char *tty, struct faillog *fl)
|
||||
* share just about everything else ...
|
||||
*/
|
||||
|
||||
if ( (lseek (fd, offset_uid, SEEK_SET) != offset_uid)
|
||||
|| (read (fd, (char *) fl, sizeof *fl) != (ssize_t) sizeof *fl)) {
|
||||
/* This is not necessarily a failure. The file is
|
||||
* initially zero length.
|
||||
*
|
||||
* If lseek() or read() failed for any other reason, this
|
||||
* might reset the counter. But the new failure will be
|
||||
* logged.
|
||||
*/
|
||||
lseek (fd, (off_t) (sizeof *fl) * uid, SEEK_SET);
|
||||
if (read (fd, (char *) fl, sizeof *fl) != sizeof *fl)
|
||||
memzero (fl, sizeof *fl);
|
||||
}
|
||||
|
||||
/*
|
||||
* Update the record. We increment the failure count to log the
|
||||
@@ -94,12 +74,11 @@ void failure (uid_t uid, const char *tty, struct faillog *fl)
|
||||
* updated as well.
|
||||
*/
|
||||
|
||||
if (fl->fail_cnt + 1 > 0) {
|
||||
if (fl->fail_cnt + 1 > 0)
|
||||
fl->fail_cnt++;
|
||||
}
|
||||
|
||||
strncpy (fl->fail_line, tty, sizeof (fl->fail_line) - 1);
|
||||
(void) time (&fl->fail_time);
|
||||
strncpy (fl->fail_line, tty, sizeof fl->fail_line);
|
||||
time (&fl->fail_time);
|
||||
|
||||
/*
|
||||
* Seek back to the correct position in the file and write the
|
||||
@@ -108,34 +87,26 @@ void failure (uid_t uid, const char *tty, struct faillog *fl)
|
||||
* seem that great.
|
||||
*/
|
||||
|
||||
if ( (lseek (fd, offset_uid, SEEK_SET) != offset_uid)
|
||||
|| (write (fd, (char *) fl, sizeof *fl) != (ssize_t) sizeof *fl)
|
||||
|| (close (fd) != 0)) {
|
||||
SYSLOG ((LOG_WARN,
|
||||
"Can't write faillog entry for UID %lu in %s.",
|
||||
(unsigned long) uid, FAILLOG_FILE));
|
||||
(void) close (fd);
|
||||
}
|
||||
lseek (fd, (off_t) (sizeof *fl) * uid, SEEK_SET);
|
||||
write (fd, (char *) fl, sizeof *fl);
|
||||
close (fd);
|
||||
}
|
||||
|
||||
static bool too_many_failures (const struct faillog *fl)
|
||||
static int too_many_failures (const struct faillog *fl)
|
||||
{
|
||||
time_t now;
|
||||
|
||||
if ((0 == fl->fail_max) || (fl->fail_cnt < fl->fail_max)) {
|
||||
return false;
|
||||
}
|
||||
if (fl->fail_max == 0 || fl->fail_cnt < fl->fail_max)
|
||||
return 0;
|
||||
|
||||
if (0 == fl->fail_locktime) {
|
||||
return true; /* locked until reset manually */
|
||||
}
|
||||
if (fl->fail_locktime == 0)
|
||||
return 1; /* locked until reset manually */
|
||||
|
||||
(void) time (&now);
|
||||
if ((fl->fail_time + fl->fail_locktime) < now) {
|
||||
return false; /* enough time since last failure */
|
||||
}
|
||||
time (&now);
|
||||
if (fl->fail_time + fl->fail_locktime < now)
|
||||
return 0; /* enough time since last failure */
|
||||
|
||||
return true;
|
||||
return 1;
|
||||
}
|
||||
|
||||
/*
|
||||
@@ -143,35 +114,21 @@ static bool too_many_failures (const struct faillog *fl)
|
||||
*
|
||||
* failcheck() is called AFTER the password has been validated. If the
|
||||
* account has been "attacked" with too many login failures, failcheck()
|
||||
* returns 0 to indicate that the login should be denied even though
|
||||
* returns FALSE to indicate that the login should be denied even though
|
||||
* the password is valid.
|
||||
*
|
||||
* failed indicates if the login failed AFTER the password has been
|
||||
* validated.
|
||||
*/
|
||||
|
||||
int failcheck (uid_t uid, struct faillog *fl, bool failed)
|
||||
int failcheck (uid_t uid, struct faillog *fl, int failed)
|
||||
{
|
||||
int fd;
|
||||
struct faillog fail;
|
||||
off_t offset_uid = (off_t) (sizeof *fl) * uid;
|
||||
|
||||
/*
|
||||
* Suppress the check if the log file isn't there.
|
||||
*/
|
||||
|
||||
if (access (FAILLOG_FILE, F_OK) != 0) {
|
||||
if ((fd = open (FAILLOG_FILE, O_RDWR)) < 0)
|
||||
return 1;
|
||||
}
|
||||
|
||||
fd = open (FAILLOG_FILE, failed?O_RDONLY:O_RDWR);
|
||||
if (fd < 0) {
|
||||
SYSLOG ((LOG_WARN,
|
||||
"Can't open the faillog file (%s) to check UID %lu. "
|
||||
"User access authorized.",
|
||||
FAILLOG_FILE, (unsigned long) uid));
|
||||
return 1;
|
||||
}
|
||||
|
||||
/*
|
||||
* Get the record from the file and determine if the user has
|
||||
@@ -185,14 +142,14 @@ int failcheck (uid_t uid, struct faillog *fl, bool failed)
|
||||
* no need to reset the count.
|
||||
*/
|
||||
|
||||
if ( (lseek (fd, offset_uid, SEEK_SET) != offset_uid)
|
||||
|| (read (fd, (char *) fl, sizeof *fl) != (ssize_t) sizeof *fl)) {
|
||||
(void) close (fd);
|
||||
lseek (fd, (off_t) (sizeof *fl) * uid, SEEK_SET);
|
||||
if (read (fd, (char *) fl, sizeof *fl) != sizeof *fl) {
|
||||
close (fd);
|
||||
return 1;
|
||||
}
|
||||
|
||||
if (too_many_failures (fl)) {
|
||||
(void) close (fd);
|
||||
close (fd);
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -207,18 +164,10 @@ int failcheck (uid_t uid, struct faillog *fl, bool failed)
|
||||
fail = *fl;
|
||||
fail.fail_cnt = 0;
|
||||
|
||||
if ( (lseek (fd, offset_uid, SEEK_SET) != offset_uid)
|
||||
|| (write (fd, (const void *) &fail, sizeof fail) != (ssize_t) sizeof fail)
|
||||
|| (close (fd) != 0)) {
|
||||
SYSLOG ((LOG_WARN,
|
||||
"Can't reset faillog entry for UID %lu in %s.",
|
||||
(unsigned long) uid, FAILLOG_FILE));
|
||||
(void) close (fd);
|
||||
}
|
||||
} else {
|
||||
(void) close (fd);
|
||||
lseek (fd, (off_t) sizeof fail * uid, SEEK_SET);
|
||||
write (fd, (char *) &fail, sizeof fail);
|
||||
}
|
||||
|
||||
close (fd);
|
||||
return 1;
|
||||
}
|
||||
|
||||
@@ -241,18 +190,17 @@ void failprint (const struct faillog *fail)
|
||||
#endif
|
||||
time_t NOW;
|
||||
|
||||
if (0 == fail->fail_cnt) {
|
||||
if (fail->fail_cnt == 0)
|
||||
return;
|
||||
}
|
||||
|
||||
tp = localtime (&(fail->fail_time));
|
||||
(void) time (&NOW);
|
||||
time (&NOW);
|
||||
|
||||
#if HAVE_STRFTIME
|
||||
/*
|
||||
* Print all information we have.
|
||||
*/
|
||||
(void) strftime (lasttimeb, sizeof lasttimeb, "%c", tp);
|
||||
strftime (lasttimeb, sizeof lasttimeb, "%c", tp);
|
||||
#else
|
||||
|
||||
/*
|
||||
@@ -262,43 +210,38 @@ void failprint (const struct faillog *fail)
|
||||
lasttime = asctime (tp);
|
||||
lasttime[24] = '\0';
|
||||
|
||||
if ((NOW - fail->fail_time) < YEAR) {
|
||||
if (NOW - fail->fail_time < YEAR)
|
||||
lasttime[19] = '\0';
|
||||
}
|
||||
if ((NOW - fail->fail_time) < DAY) {
|
||||
if (NOW - fail->fail_time < DAY)
|
||||
lasttime = lasttime + 11;
|
||||
}
|
||||
|
||||
if (' ' == *lasttime) {
|
||||
if (*lasttime == ' ')
|
||||
lasttime++;
|
||||
}
|
||||
#endif
|
||||
/*@-formatconst@*/
|
||||
(void) printf (ngettext ("%d failure since last login.\n"
|
||||
"Last was %s on %s.\n",
|
||||
"%d failures since last login.\n"
|
||||
"Last was %s on %s.\n",
|
||||
(unsigned long) fail->fail_cnt),
|
||||
fail->fail_cnt, lasttime, fail->fail_line);
|
||||
/*@=formatconst@*/
|
||||
printf (ngettext ("%d failure since last login.\n"
|
||||
"Last was %s on %s.\n",
|
||||
"%d failures since last login.\n"
|
||||
"Last was %s on %s.\n",
|
||||
fail->fail_cnt),
|
||||
fail->fail_cnt, lasttime, fail->fail_line);
|
||||
}
|
||||
|
||||
/*
|
||||
* failtmp - update the cumulative failure log
|
||||
* failtmp - update the cummulative failure log
|
||||
*
|
||||
* failtmp updates the (struct utmp) formatted failure log which
|
||||
* maintains a record of all login failures.
|
||||
*/
|
||||
|
||||
void failtmp (const char *username,
|
||||
#ifdef USE_UTMPX
|
||||
void failtmp (
|
||||
#ifdef HAVE_UTMPX_H
|
||||
const struct utmpx *failent
|
||||
#else /* !USE_UTMPX */
|
||||
#else
|
||||
const struct utmp *failent
|
||||
#endif /* !USE_UTMPX */
|
||||
#endif
|
||||
)
|
||||
{
|
||||
const char *ftmp;
|
||||
char *ftmp;
|
||||
int fd;
|
||||
|
||||
/*
|
||||
@@ -306,38 +249,21 @@ void failtmp (const char *username,
|
||||
* in login.defs, don't do this.
|
||||
*/
|
||||
|
||||
ftmp = getdef_str ("FTMP_FILE");
|
||||
if (NULL == ftmp) {
|
||||
if (!(ftmp = getdef_str ("FTMP_FILE")))
|
||||
return;
|
||||
}
|
||||
|
||||
/*
|
||||
* Open the file for append. It must already exist for this
|
||||
* feature to be used.
|
||||
*/
|
||||
|
||||
if (access (ftmp, F_OK) != 0) {
|
||||
if ((fd = open (ftmp, O_WRONLY | O_APPEND)) == -1)
|
||||
return;
|
||||
}
|
||||
|
||||
fd = open (ftmp, O_WRONLY | O_APPEND);
|
||||
if (-1 == fd) {
|
||||
SYSLOG ((LOG_WARN,
|
||||
"Can't append failure of user %s to %s.",
|
||||
username, ftmp));
|
||||
return;
|
||||
}
|
||||
|
||||
/*
|
||||
* Append the new failure record and close the log file.
|
||||
* Output the new failure record and close the log file.
|
||||
*/
|
||||
|
||||
if ( (write (fd, (const void *) failent, sizeof *failent) != (ssize_t) sizeof *failent)
|
||||
|| (close (fd) != 0)) {
|
||||
SYSLOG ((LOG_WARN,
|
||||
"Can't append failure of user %s to %s.",
|
||||
username, ftmp));
|
||||
(void) close (fd);
|
||||
}
|
||||
write (fd, (const char *) failent, sizeof *failent);
|
||||
close (fd);
|
||||
}
|
||||
|
||||
|
||||
@@ -2,7 +2,6 @@
|
||||
* Copyright (c) 1990 - 1994, Julianne Frances Haugh
|
||||
* Copyright (c) 1997 - 2000, Marek Michałkiewicz
|
||||
* Copyright (c) 2005 , Tomasz Kłoczko
|
||||
* Copyright (c) 2008 - 2009, Nicolas François
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
@@ -36,11 +35,11 @@
|
||||
|
||||
#include "defines.h"
|
||||
#include "faillog.h"
|
||||
#ifdef USE_UTMPX
|
||||
#ifdef HAVE_UTMPX_H
|
||||
#include <utmpx.h>
|
||||
#else /* !USE_UTMPX */
|
||||
#else
|
||||
#include <utmp.h>
|
||||
#endif /* !USE_UTMPX */
|
||||
#endif
|
||||
|
||||
/*
|
||||
* failure - make failure entry
|
||||
@@ -58,7 +57,7 @@ extern void failure (uid_t, const char *, struct faillog *);
|
||||
* returns FALSE to indicate that the login should be denied even though
|
||||
* the password is valid.
|
||||
*/
|
||||
extern int failcheck (uid_t uid, struct faillog *fl, bool failed);
|
||||
extern int failcheck (uid_t, struct faillog *, int);
|
||||
|
||||
/*
|
||||
* failprint - print line of failure information
|
||||
@@ -69,16 +68,16 @@ extern int failcheck (uid_t uid, struct faillog *fl, bool failed);
|
||||
extern void failprint (const struct faillog *);
|
||||
|
||||
/*
|
||||
* failtmp - update the cumulative failure log
|
||||
* failtmp - update the cummulative failure log
|
||||
*
|
||||
* failtmp updates the (struct utmp) formatted failure log which
|
||||
* maintains a record of all login failures.
|
||||
*/
|
||||
#ifdef USE_UTMPX
|
||||
extern void failtmp (const char *username, const struct utmpx *);
|
||||
#else /* !USE_UTMPX */
|
||||
extern void failtmp (const char *username, const struct utmp *);
|
||||
#endif /* !USE_UTMPX */
|
||||
#ifdef HAVE_UTMPX_H
|
||||
extern void failtmp (const struct utmpx *);
|
||||
#else
|
||||
extern void failtmp (const struct utmp *);
|
||||
#endif
|
||||
|
||||
#endif
|
||||
|
||||
|
||||
@@ -54,10 +54,6 @@ int valid_field (const char *field, const char *illegal)
|
||||
const char *cp;
|
||||
int err = 0;
|
||||
|
||||
if (NULL == field) {
|
||||
return -1;
|
||||
}
|
||||
|
||||
/* For each character of field, search if it appears in the list
|
||||
* of illegal characters. */
|
||||
for (cp = field; '\0' != *cp; cp++) {
|
||||
@@ -1,498 +0,0 @@
|
||||
/*
|
||||
* Copyright (c) 1991 - 1994, Julianne Frances Haugh
|
||||
* Copyright (c) 2008 - 2011, Nicolas François
|
||||
* Copyright (c) 2014, Red Hat, Inc.
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. The name of the copyright holders or contributors may not be used to
|
||||
* endorse or promote products derived from this software without
|
||||
* specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
|
||||
* PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
* HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include <config.h>
|
||||
|
||||
#include <assert.h>
|
||||
#include <stdio.h>
|
||||
#include <errno.h>
|
||||
|
||||
#include "prototypes.h"
|
||||
#include "groupio.h"
|
||||
#include "getdef.h"
|
||||
|
||||
/*
|
||||
* get_ranges - Get the minimum and maximum ID ranges for the search
|
||||
*
|
||||
* This function will return the minimum and maximum ranges for IDs
|
||||
*
|
||||
* 0: The function completed successfully
|
||||
* EINVAL: The provided ranges are impossible (such as maximum < minimum)
|
||||
*
|
||||
* preferred_min: The special-case minimum value for a specifically-
|
||||
* requested ID, which may be lower than the standard min_id
|
||||
*/
|
||||
static int get_ranges (bool sys_group, gid_t *min_id, gid_t *max_id,
|
||||
gid_t *preferred_min)
|
||||
{
|
||||
gid_t gid_def_max = 0;
|
||||
|
||||
if (sys_group) {
|
||||
/* System groups */
|
||||
|
||||
/* A requested ID is allowed to be below the autoselect range */
|
||||
*preferred_min = (gid_t) 1;
|
||||
|
||||
/* Get the minimum ID range from login.defs or default to 101 */
|
||||
*min_id = (gid_t) getdef_ulong ("SYS_GID_MIN", 101UL);
|
||||
|
||||
/*
|
||||
* If SYS_GID_MAX is unspecified, we should assume it to be one
|
||||
* less than the GID_MIN (which is reserved for non-system accounts)
|
||||
*/
|
||||
gid_def_max = (gid_t) getdef_ulong ("GID_MIN", 1000UL) - 1;
|
||||
*max_id = (gid_t) getdef_ulong ("SYS_GID_MAX",
|
||||
(unsigned long) gid_def_max);
|
||||
|
||||
/* Check that the ranges make sense */
|
||||
if (*max_id < *min_id) {
|
||||
(void) fprintf (shadow_logfd,
|
||||
_("%s: Invalid configuration: SYS_GID_MIN (%lu), "
|
||||
"GID_MIN (%lu), SYS_GID_MAX (%lu)\n"),
|
||||
Prog, (unsigned long) *min_id,
|
||||
getdef_ulong ("GID_MIN", 1000UL),
|
||||
(unsigned long) *max_id);
|
||||
return EINVAL;
|
||||
}
|
||||
} else {
|
||||
/* Non-system groups */
|
||||
|
||||
/* Get the values from login.defs or use reasonable defaults */
|
||||
*min_id = (gid_t) getdef_ulong ("GID_MIN", 1000UL);
|
||||
*max_id = (gid_t) getdef_ulong ("GID_MAX", 60000UL);
|
||||
|
||||
/*
|
||||
* The preferred minimum should match the standard ID minimum
|
||||
* for non-system groups.
|
||||
*/
|
||||
*preferred_min = *min_id;
|
||||
|
||||
/* Check that the ranges make sense */
|
||||
if (*max_id < *min_id) {
|
||||
(void) fprintf (shadow_logfd,
|
||||
_("%s: Invalid configuration: GID_MIN (%lu), "
|
||||
"GID_MAX (%lu)\n"),
|
||||
Prog, (unsigned long) *min_id,
|
||||
(unsigned long) *max_id);
|
||||
return EINVAL;
|
||||
}
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* check_gid - See if the requested GID is available
|
||||
*
|
||||
* On success, return 0
|
||||
* If the ID is in use, return EEXIST
|
||||
* If the ID is outside the range, return ERANGE
|
||||
* In other cases, return errno from getgrgid()
|
||||
*/
|
||||
static int check_gid (const gid_t gid,
|
||||
const gid_t gid_min,
|
||||
const gid_t gid_max,
|
||||
bool *used_gids)
|
||||
{
|
||||
/* First test that the preferred ID is in the range */
|
||||
if (gid < gid_min || gid > gid_max) {
|
||||
return ERANGE;
|
||||
}
|
||||
|
||||
/*
|
||||
* Check whether we already detected this GID
|
||||
* using the gr_next() loop
|
||||
*/
|
||||
if (used_gids != NULL && used_gids[gid]) {
|
||||
return EEXIST;
|
||||
}
|
||||
/* Check if the GID exists according to NSS */
|
||||
errno = 0;
|
||||
if (prefix_getgrgid (gid) != NULL) {
|
||||
return EEXIST;
|
||||
} else {
|
||||
/* getgrgid() was NULL
|
||||
* we have to ignore errors as temporary
|
||||
* failures of remote user identity services
|
||||
* would completely block user/group creation
|
||||
*/
|
||||
}
|
||||
|
||||
/* If we've made it here, the GID must be available */
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* find_new_gid - Find a new unused GID.
|
||||
*
|
||||
* If successful, find_new_gid provides an unused group ID in the
|
||||
* [GID_MIN:GID_MAX] range.
|
||||
* This ID should be higher than all the used GID, but if not possible,
|
||||
* the lowest unused ID in the range will be returned.
|
||||
*
|
||||
* Return 0 on success, -1 if no unused GIDs are available.
|
||||
*/
|
||||
int find_new_gid (bool sys_group,
|
||||
gid_t *gid,
|
||||
/*@null@*/gid_t const *preferred_gid)
|
||||
{
|
||||
bool *used_gids;
|
||||
const struct group *grp;
|
||||
gid_t gid_min, gid_max, preferred_min;
|
||||
gid_t id;
|
||||
gid_t lowest_found, highest_found;
|
||||
int result;
|
||||
int nospam = 0;
|
||||
|
||||
assert(gid != NULL);
|
||||
|
||||
/*
|
||||
* First, figure out what ID range is appropriate for
|
||||
* automatic assignment
|
||||
*/
|
||||
result = get_ranges (sys_group, &gid_min, &gid_max, &preferred_min);
|
||||
if (result == EINVAL) {
|
||||
return -1;
|
||||
}
|
||||
|
||||
/* Check if the preferred GID is available */
|
||||
if (preferred_gid) {
|
||||
result = check_gid (*preferred_gid, preferred_min, gid_max, NULL);
|
||||
if (result == 0) {
|
||||
/*
|
||||
* Make sure the GID isn't queued for use already
|
||||
*/
|
||||
if (gr_locate_gid (*preferred_gid) == NULL) {
|
||||
*gid = *preferred_gid;
|
||||
return 0;
|
||||
}
|
||||
/*
|
||||
* gr_locate_gid() found the GID in an as-yet uncommitted
|
||||
* entry. We'll proceed below and auto-set a GID.
|
||||
*/
|
||||
} else if (result == EEXIST || result == ERANGE) {
|
||||
/*
|
||||
* Continue on below. At this time, we won't
|
||||
* treat these two cases differently.
|
||||
*/
|
||||
} else {
|
||||
/*
|
||||
* An unexpected error occurred. We should report
|
||||
* this and fail the group creation.
|
||||
* This differs from the automatic creation
|
||||
* behavior below, since if a specific GID was
|
||||
* requested and generated an error, the user is
|
||||
* more likely to want to stop and address the
|
||||
* issue.
|
||||
*/
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Encountered error attempting to use "
|
||||
"preferred GID: %s\n"),
|
||||
Prog, strerror (result));
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* Search the entire group file,
|
||||
* looking for the next unused value.
|
||||
*
|
||||
* We first check the local database with gr_rewind/gr_next to find
|
||||
* all local values that are in use.
|
||||
*
|
||||
* We then compare the next free value to all databases (local and
|
||||
* remote) and iterate until we find a free one. If there are free
|
||||
* values beyond the lowest (system groups) or highest (non-system
|
||||
* groups), we will prefer those and avoid potentially reclaiming a
|
||||
* deleted group (which can be a security issue, since it may grant
|
||||
* access to files belonging to that former group).
|
||||
*
|
||||
* If there are no GIDs available at the end of the search, we will
|
||||
* have no choice but to iterate through the range looking for gaps.
|
||||
*
|
||||
*/
|
||||
|
||||
/* Create an array to hold all of the discovered GIDs */
|
||||
used_gids = malloc (sizeof (bool) * (gid_max +1));
|
||||
if (NULL == used_gids) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: failed to allocate memory: %s\n"),
|
||||
Prog, strerror (errno));
|
||||
return -1;
|
||||
}
|
||||
memset (used_gids, false, sizeof (bool) * (gid_max + 1));
|
||||
|
||||
/* First look for the lowest and highest value in the local database */
|
||||
(void) gr_rewind ();
|
||||
highest_found = gid_min;
|
||||
lowest_found = gid_max;
|
||||
while ((grp = gr_next ()) != NULL) {
|
||||
/*
|
||||
* Does this entry have a lower GID than the lowest we've found
|
||||
* so far?
|
||||
*/
|
||||
if ((grp->gr_gid <= lowest_found) && (grp->gr_gid >= gid_min)) {
|
||||
lowest_found = grp->gr_gid - 1;
|
||||
}
|
||||
|
||||
/*
|
||||
* Does this entry have a higher GID than the highest we've found
|
||||
* so far?
|
||||
*/
|
||||
if ((grp->gr_gid >= highest_found) && (grp->gr_gid <= gid_max)) {
|
||||
highest_found = grp->gr_gid + 1;
|
||||
}
|
||||
|
||||
/* create index of used GIDs */
|
||||
if (grp->gr_gid >= gid_min
|
||||
&& grp->gr_gid <= gid_max) {
|
||||
|
||||
used_gids[grp->gr_gid] = true;
|
||||
}
|
||||
}
|
||||
|
||||
if (sys_group) {
|
||||
/*
|
||||
* For system groups, we want to start from the
|
||||
* top of the range and work downwards.
|
||||
*/
|
||||
|
||||
/*
|
||||
* At the conclusion of the gr_next() search, we will either
|
||||
* have a presumed-free GID or we will be at GID_MIN - 1.
|
||||
*/
|
||||
if (lowest_found < gid_min) {
|
||||
/*
|
||||
* In this case, a GID is in use at GID_MIN.
|
||||
*
|
||||
* We will reset the search to GID_MAX and proceed down
|
||||
* through all the GIDs (skipping those we detected with
|
||||
* used_gids) for a free one. It is a known issue that
|
||||
* this may result in reusing a previously-deleted GID,
|
||||
* so administrators should be instructed to use this
|
||||
* auto-detection with care (and prefer to assign GIDs
|
||||
* explicitly).
|
||||
*/
|
||||
lowest_found = gid_max;
|
||||
}
|
||||
|
||||
/* Search through all of the IDs in the range */
|
||||
for (id = lowest_found; id >= gid_min; id--) {
|
||||
result = check_gid (id, gid_min, gid_max, used_gids);
|
||||
if (result == 0) {
|
||||
/* This GID is available. Return it. */
|
||||
*gid = id;
|
||||
free (used_gids);
|
||||
return 0;
|
||||
} else if (result == EEXIST) {
|
||||
/* This GID is in use, we'll continue to the next */
|
||||
} else {
|
||||
/*
|
||||
* An unexpected error occurred.
|
||||
*
|
||||
* Only report it the first time to avoid spamming
|
||||
* the logs
|
||||
*
|
||||
*/
|
||||
if (!nospam) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Can't get unique system GID (%s). "
|
||||
"Suppressing additional messages.\n"),
|
||||
Prog, strerror (result));
|
||||
SYSLOG ((LOG_ERR,
|
||||
"Error checking available GIDs: %s",
|
||||
strerror (result)));
|
||||
nospam = 1;
|
||||
}
|
||||
/*
|
||||
* We will continue anyway. Hopefully a later GID
|
||||
* will work properly.
|
||||
*/
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* If we get all the way through the loop, try again from GID_MAX,
|
||||
* unless that was where we previously started. (NOTE: the worst-case
|
||||
* scenario here is that we will run through (GID_MAX - GID_MIN - 1)
|
||||
* cycles *again* if we fall into this case with lowest_found as
|
||||
* GID_MAX - 1, all groups in the range in use and maintained by
|
||||
* network services such as LDAP.)
|
||||
*/
|
||||
if (lowest_found != gid_max) {
|
||||
for (id = gid_max; id >= gid_min; id--) {
|
||||
result = check_gid (id, gid_min, gid_max, used_gids);
|
||||
if (result == 0) {
|
||||
/* This GID is available. Return it. */
|
||||
*gid = id;
|
||||
free (used_gids);
|
||||
return 0;
|
||||
} else if (result == EEXIST) {
|
||||
/* This GID is in use, we'll continue to the next */
|
||||
} else {
|
||||
/*
|
||||
* An unexpected error occurred.
|
||||
*
|
||||
* Only report it the first time to avoid spamming
|
||||
* the logs
|
||||
*
|
||||
*/
|
||||
if (!nospam) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Can't get unique system GID (%s). "
|
||||
"Suppressing additional messages.\n"),
|
||||
Prog, strerror (result));
|
||||
SYSLOG ((LOG_ERR,
|
||||
"Error checking available GIDs: %s",
|
||||
strerror (result)));
|
||||
nospam = 1;
|
||||
}
|
||||
/*
|
||||
* We will continue anyway. Hopefully a later GID
|
||||
* will work properly.
|
||||
*/
|
||||
}
|
||||
}
|
||||
}
|
||||
} else { /* !sys_group */
|
||||
/*
|
||||
* For non-system groups, we want to start from the
|
||||
* bottom of the range and work upwards.
|
||||
*/
|
||||
|
||||
/*
|
||||
* At the conclusion of the gr_next() search, we will either
|
||||
* have a presumed-free GID or we will be at GID_MAX + 1.
|
||||
*/
|
||||
if (highest_found > gid_max) {
|
||||
/*
|
||||
* In this case, a GID is in use at GID_MAX.
|
||||
*
|
||||
* We will reset the search to GID_MIN and proceed up
|
||||
* through all the GIDs (skipping those we detected with
|
||||
* used_gids) for a free one. It is a known issue that
|
||||
* this may result in reusing a previously-deleted GID,
|
||||
* so administrators should be instructed to use this
|
||||
* auto-detection with care (and prefer to assign GIDs
|
||||
* explicitly).
|
||||
*/
|
||||
highest_found = gid_min;
|
||||
}
|
||||
|
||||
/* Search through all of the IDs in the range */
|
||||
for (id = highest_found; id <= gid_max; id++) {
|
||||
result = check_gid (id, gid_min, gid_max, used_gids);
|
||||
if (result == 0) {
|
||||
/* This GID is available. Return it. */
|
||||
*gid = id;
|
||||
free (used_gids);
|
||||
return 0;
|
||||
} else if (result == EEXIST) {
|
||||
/* This GID is in use, we'll continue to the next */
|
||||
} else {
|
||||
/*
|
||||
* An unexpected error occurred.
|
||||
*
|
||||
* Only report it the first time to avoid spamming
|
||||
* the logs
|
||||
*
|
||||
*/
|
||||
if (!nospam) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Can't get unique GID (%s). "
|
||||
"Suppressing additional messages.\n"),
|
||||
Prog, strerror (result));
|
||||
SYSLOG ((LOG_ERR,
|
||||
"Error checking available GIDs: %s",
|
||||
strerror (result)));
|
||||
nospam = 1;
|
||||
}
|
||||
/*
|
||||
* We will continue anyway. Hopefully a later GID
|
||||
* will work properly.
|
||||
*/
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* If we get all the way through the loop, try again from GID_MIN,
|
||||
* unless that was where we previously started. (NOTE: the worst-case
|
||||
* scenario here is that we will run through (GID_MAX - GID_MIN - 1)
|
||||
* cycles *again* if we fall into this case with highest_found as
|
||||
* GID_MIN + 1, all groups in the range in use and maintained by
|
||||
* network services such as LDAP.)
|
||||
*/
|
||||
if (highest_found != gid_min) {
|
||||
for (id = gid_min; id <= gid_max; id++) {
|
||||
result = check_gid (id, gid_min, gid_max, used_gids);
|
||||
if (result == 0) {
|
||||
/* This GID is available. Return it. */
|
||||
*gid = id;
|
||||
free (used_gids);
|
||||
return 0;
|
||||
} else if (result == EEXIST) {
|
||||
/* This GID is in use, we'll continue to the next */
|
||||
} else {
|
||||
/*
|
||||
* An unexpected error occurred.
|
||||
*
|
||||
* Only report it the first time to avoid spamming
|
||||
* the logs
|
||||
*
|
||||
*/
|
||||
if (!nospam) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Can't get unique GID (%s). "
|
||||
"Suppressing additional messages.\n"),
|
||||
Prog, strerror (result));
|
||||
SYSLOG ((LOG_ERR,
|
||||
"Error checking available GIDs: %s",
|
||||
strerror (result)));
|
||||
nospam = 1;
|
||||
}
|
||||
/*
|
||||
* We will continue anyway. Hopefully a later GID
|
||||
* will work properly.
|
||||
*/
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/* The code reached here and found no available IDs in the range */
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Can't get unique GID (no more available GIDs)\n"),
|
||||
Prog);
|
||||
SYSLOG ((LOG_WARN, "no more available GIDs on the system"));
|
||||
free (used_gids);
|
||||
return -1;
|
||||
}
|
||||
|
||||
205
libmisc/find_new_ids.c
Normal file
205
libmisc/find_new_ids.c
Normal file
@@ -0,0 +1,205 @@
|
||||
/*
|
||||
* Copyright (c) 1991 - 1994, Julianne Frances Haugh
|
||||
* Copyright (c) 2008 , Nicolas François
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. The name of the copyright holders or contributors may not be used to
|
||||
* endorse or promote products derived from this software without
|
||||
* specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
|
||||
* PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
* HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include <config.h>
|
||||
|
||||
#include <assert.h>
|
||||
#include <stdio.h>
|
||||
|
||||
#include "prototypes.h"
|
||||
#include "pwio.h"
|
||||
#include "groupio.h"
|
||||
#include "getdef.h"
|
||||
|
||||
/*
|
||||
* find_new_uid - Find a new unused UID.
|
||||
*
|
||||
* If successful, find_new_uid provides an unused user ID in the
|
||||
* [UID_MIN:UID_MAX] range.
|
||||
* This ID should be higher than all the used UID, but if not possible,
|
||||
* the lowest unused ID in the range will be returned.
|
||||
*
|
||||
* Return 0 on success, -1 if no unused UIDs are available.
|
||||
*/
|
||||
int find_new_uid (int sys_user, uid_t *uid, uid_t const *preferred_uid)
|
||||
{
|
||||
const struct passwd *pwd;
|
||||
uid_t uid_min, uid_max, user_id;
|
||||
|
||||
assert (uid != NULL);
|
||||
|
||||
if (sys_user == 0) {
|
||||
uid_min = getdef_unum ("UID_MIN", 1000);
|
||||
uid_max = getdef_unum ("UID_MAX", 60000);
|
||||
} else {
|
||||
uid_min = getdef_unum ("SYS_UID_MIN", 1);
|
||||
uid_max = getdef_unum ("UID_MIN", 1000) - 1;
|
||||
uid_max = getdef_unum ("SYS_UID_MAX", uid_max);
|
||||
}
|
||||
|
||||
if ( (NULL != preferred_uid)
|
||||
&& (*preferred_uid >= uid_min)
|
||||
&& (*preferred_uid <= uid_max)
|
||||
/* Check if the user exists according to NSS */
|
||||
&& (getpwuid (*preferred_uid) == NULL)
|
||||
/* Check also the local database in case of uncommitted
|
||||
* changes */
|
||||
&& (pw_locate_uid (*preferred_uid) == NULL)) {
|
||||
*uid = *preferred_uid;
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
user_id = uid_min;
|
||||
|
||||
/*
|
||||
* Search the entire password file,
|
||||
* looking for the largest unused value.
|
||||
*
|
||||
* We check the list of users according to NSS (setpwent/getpwent),
|
||||
* but we also check the local database (pw_rewind/pw_next) in case
|
||||
* some users were created but the changes were not committed yet.
|
||||
*/
|
||||
setpwent ();
|
||||
pw_rewind ();
|
||||
while ( ((pwd = getpwent ()) != NULL)
|
||||
|| ((pwd = pw_next ()) != NULL)) {
|
||||
if ((pwd->pw_uid >= user_id) && (pwd->pw_uid <= uid_max)) {
|
||||
user_id = pwd->pw_uid + 1;
|
||||
}
|
||||
}
|
||||
endpwent ();
|
||||
|
||||
/*
|
||||
* If a user with UID equal to UID_MAX exists, the above algorithm
|
||||
* will give us UID_MAX+1 even if not unique. Search for the first
|
||||
* free UID starting with UID_MIN (it's O(n*n) but can be avoided
|
||||
* by not having users with UID equal to UID_MAX). --marekm
|
||||
*/
|
||||
if (user_id == uid_max + 1) {
|
||||
for (user_id = uid_min; user_id < uid_max; user_id++) {
|
||||
/* local, no need for xgetpwuid */
|
||||
if ( (getpwuid (user_id) == NULL)
|
||||
&& (pw_locate_uid (user_id) == NULL)) {
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (user_id == uid_max) {
|
||||
fputs (_("Can't get unique UID (no more available UIDs)\n"), stderr);
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
|
||||
*uid = user_id;
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* find_new_gid - Find a new unused GID.
|
||||
*
|
||||
* If successful, find_new_gid provides an unused group ID in the
|
||||
* [GID_MIN:GID_MAX] range.
|
||||
* This ID should be higher than all the used GID, but if not possible,
|
||||
* the lowest unused ID in the range will be returned.
|
||||
*
|
||||
* Return 0 on success, -1 if no unused GIDs are available.
|
||||
*/
|
||||
int find_new_gid (int sys_group, gid_t *gid, gid_t const *preferred_gid)
|
||||
{
|
||||
const struct group *grp;
|
||||
gid_t gid_min, gid_max, group_id;
|
||||
|
||||
assert (gid != NULL);
|
||||
|
||||
if (sys_group == 0) {
|
||||
gid_min = getdef_unum ("GID_MIN", 1000);
|
||||
gid_max = getdef_unum ("GID_MAX", 60000);
|
||||
} else {
|
||||
gid_min = getdef_unum ("SYS_GID_MIN", 1);
|
||||
gid_max = getdef_unum ("GID_MIN", 1000) - 1;
|
||||
gid_max = getdef_unum ("SYS_GID_MAX", gid_max);
|
||||
}
|
||||
|
||||
if ( (NULL != preferred_gid)
|
||||
&& (*preferred_gid >= gid_min)
|
||||
&& (*preferred_gid <= gid_max)
|
||||
/* Check if the user exists according to NSS */
|
||||
&& (getgrgid (*preferred_gid) == NULL)
|
||||
/* Check also the local database in case of uncommitted
|
||||
* changes */
|
||||
&& (gr_locate_gid (*preferred_gid) == NULL)) {
|
||||
*gid = *preferred_gid;
|
||||
return 0;
|
||||
}
|
||||
|
||||
group_id = gid_min;
|
||||
|
||||
/*
|
||||
* Search the entire group file,
|
||||
* looking for the largest unused value.
|
||||
*
|
||||
* We check the list of users according to NSS (setpwent/getpwent),
|
||||
* but we also check the local database (pw_rewind/pw_next) in case
|
||||
* some groups were created but the changes were not committed yet.
|
||||
*/
|
||||
setgrent ();
|
||||
gr_rewind ();
|
||||
while ( ((grp = getgrent ()) != NULL)
|
||||
|| ((grp = gr_next ()) != NULL)) {
|
||||
if ((grp->gr_gid >= group_id) && (grp->gr_gid <= gid_max)) {
|
||||
group_id = grp->gr_gid + 1;
|
||||
}
|
||||
}
|
||||
endgrent ();
|
||||
|
||||
/*
|
||||
* If a group with GID equal to GID_MAX exists, the above algorithm
|
||||
* will give us GID_MAX+1 even if not unique. Search for the first
|
||||
* free GID starting with GID_MIN (it's O(n*n) but can be avoided
|
||||
* by not having users with GID equal to GID_MAX). --marekm
|
||||
*/
|
||||
if (group_id == gid_max + 1) {
|
||||
for (group_id = gid_min; group_id < gid_max; group_id++) {
|
||||
/* local, no need for xgetgrgid */
|
||||
if ( (getgrgid (group_id) == NULL)
|
||||
&& (gr_locate_gid (group_id) == NULL)) {
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (group_id == gid_max) {
|
||||
fputs (_("Can't get unique GID (no more available GIDs)\n"), stderr);
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
|
||||
*gid = group_id;
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -1,85 +0,0 @@
|
||||
/*
|
||||
* Copyright (c) 2012 Eric Biederman
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. The name of the copyright holders or contributors may not be used to
|
||||
* endorse or promote products derived from this software without
|
||||
* specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
|
||||
* PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
* HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include <config.h>
|
||||
|
||||
#ifdef ENABLE_SUBIDS
|
||||
|
||||
#include <assert.h>
|
||||
#include <stdio.h>
|
||||
#include <errno.h>
|
||||
|
||||
#include "prototypes.h"
|
||||
#include "subordinateio.h"
|
||||
#include "getdef.h"
|
||||
|
||||
/*
|
||||
* find_new_sub_gids - Find a new unused range of GIDs.
|
||||
*
|
||||
* If successful, find_new_sub_gids provides a range of unused
|
||||
* user IDs in the [SUB_GID_MIN:SUB_GID_MAX] range.
|
||||
*
|
||||
* Return 0 on success, -1 if no unused GIDs are available.
|
||||
*/
|
||||
int find_new_sub_gids (gid_t *range_start, unsigned long *range_count)
|
||||
{
|
||||
unsigned long min, max;
|
||||
unsigned long count;
|
||||
gid_t start;
|
||||
|
||||
assert (range_start != NULL);
|
||||
assert (range_count != NULL);
|
||||
|
||||
min = getdef_ulong ("SUB_GID_MIN", 100000UL);
|
||||
max = getdef_ulong ("SUB_GID_MAX", 600100000UL);
|
||||
count = getdef_ulong ("SUB_GID_COUNT", 65536);
|
||||
|
||||
if (min > max || count >= max || (min + count - 1) > max) {
|
||||
(void) fprintf (shadow_logfd,
|
||||
_("%s: Invalid configuration: SUB_GID_MIN (%lu),"
|
||||
" SUB_GID_MAX (%lu), SUB_GID_COUNT (%lu)\n"),
|
||||
Prog, min, max, count);
|
||||
return -1;
|
||||
}
|
||||
|
||||
start = sub_gid_find_free_range(min, max, count);
|
||||
if (start == (gid_t)-1) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Can't get unique subordinate GID range\n"),
|
||||
Prog);
|
||||
SYSLOG ((LOG_WARN, "no more available subordinate GIDs on the system"));
|
||||
return -1;
|
||||
}
|
||||
*range_start = start;
|
||||
*range_count = count;
|
||||
return 0;
|
||||
}
|
||||
#else /* !ENABLE_SUBIDS */
|
||||
extern int errno; /* warning: ANSI C forbids an empty source file */
|
||||
#endif /* !ENABLE_SUBIDS */
|
||||
|
||||
@@ -1,85 +0,0 @@
|
||||
/*
|
||||
* Copyright (c) 2012 Eric Biederman
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. The name of the copyright holders or contributors may not be used to
|
||||
* endorse or promote products derived from this software without
|
||||
* specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
|
||||
* PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
* HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include <config.h>
|
||||
|
||||
#ifdef ENABLE_SUBIDS
|
||||
|
||||
#include <assert.h>
|
||||
#include <stdio.h>
|
||||
#include <errno.h>
|
||||
|
||||
#include "prototypes.h"
|
||||
#include "subordinateio.h"
|
||||
#include "getdef.h"
|
||||
|
||||
/*
|
||||
* find_new_sub_uids - Find a new unused range of UIDs.
|
||||
*
|
||||
* If successful, find_new_sub_uids provides a range of unused
|
||||
* user IDs in the [SUB_UID_MIN:SUB_UID_MAX] range.
|
||||
*
|
||||
* Return 0 on success, -1 if no unused UIDs are available.
|
||||
*/
|
||||
int find_new_sub_uids (uid_t *range_start, unsigned long *range_count)
|
||||
{
|
||||
unsigned long min, max;
|
||||
unsigned long count;
|
||||
uid_t start;
|
||||
|
||||
assert (range_start != NULL);
|
||||
assert (range_count != NULL);
|
||||
|
||||
min = getdef_ulong ("SUB_UID_MIN", 100000UL);
|
||||
max = getdef_ulong ("SUB_UID_MAX", 600100000UL);
|
||||
count = getdef_ulong ("SUB_UID_COUNT", 65536);
|
||||
|
||||
if (min > max || count >= max || (min + count - 1) > max) {
|
||||
(void) fprintf (shadow_logfd,
|
||||
_("%s: Invalid configuration: SUB_UID_MIN (%lu),"
|
||||
" SUB_UID_MAX (%lu), SUB_UID_COUNT (%lu)\n"),
|
||||
Prog, min, max, count);
|
||||
return -1;
|
||||
}
|
||||
|
||||
start = sub_uid_find_free_range(min, max, count);
|
||||
if (start == (uid_t)-1) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Can't get unique subordinate UID range\n"),
|
||||
Prog);
|
||||
SYSLOG ((LOG_WARN, "no more available subordinate UIDs on the system"));
|
||||
return -1;
|
||||
}
|
||||
*range_start = start;
|
||||
*range_count = count;
|
||||
return 0;
|
||||
}
|
||||
#else /* !ENABLE_SUBIDS */
|
||||
extern int errno; /* warning: ANSI C forbids an empty source file */
|
||||
#endif /* !ENABLE_SUBIDS */
|
||||
|
||||
@@ -1,498 +0,0 @@
|
||||
/*
|
||||
* Copyright (c) 1991 - 1994, Julianne Frances Haugh
|
||||
* Copyright (c) 2008 - 2011, Nicolas François
|
||||
* Copyright (c) 2014, Red Hat, Inc.
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. The name of the copyright holders or contributors may not be used to
|
||||
* endorse or promote products derived from this software without
|
||||
* specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
|
||||
* PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
* HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include <config.h>
|
||||
|
||||
#include <assert.h>
|
||||
#include <stdio.h>
|
||||
#include <errno.h>
|
||||
|
||||
#include "prototypes.h"
|
||||
#include "pwio.h"
|
||||
#include "getdef.h"
|
||||
|
||||
/*
|
||||
* get_ranges - Get the minimum and maximum ID ranges for the search
|
||||
*
|
||||
* This function will return the minimum and maximum ranges for IDs
|
||||
*
|
||||
* 0: The function completed successfully
|
||||
* EINVAL: The provided ranges are impossible (such as maximum < minimum)
|
||||
*
|
||||
* preferred_min: The special-case minimum value for a specifically-
|
||||
* requested ID, which may be lower than the standard min_id
|
||||
*/
|
||||
static int get_ranges (bool sys_user, uid_t *min_id, uid_t *max_id,
|
||||
uid_t *preferred_min)
|
||||
{
|
||||
uid_t uid_def_max = 0;
|
||||
|
||||
if (sys_user) {
|
||||
/* System users */
|
||||
|
||||
/* A requested ID is allowed to be below the autoselect range */
|
||||
*preferred_min = (uid_t) 1;
|
||||
|
||||
/* Get the minimum ID range from login.defs or default to 101 */
|
||||
*min_id = (uid_t) getdef_ulong ("SYS_UID_MIN", 101UL);
|
||||
|
||||
/*
|
||||
* If SYS_UID_MAX is unspecified, we should assume it to be one
|
||||
* less than the UID_MIN (which is reserved for non-system accounts)
|
||||
*/
|
||||
uid_def_max = (uid_t) getdef_ulong ("UID_MIN", 1000UL) - 1;
|
||||
*max_id = (uid_t) getdef_ulong ("SYS_UID_MAX",
|
||||
(unsigned long) uid_def_max);
|
||||
|
||||
/* Check that the ranges make sense */
|
||||
if (*max_id < *min_id) {
|
||||
(void) fprintf (shadow_logfd,
|
||||
_("%s: Invalid configuration: SYS_UID_MIN (%lu), "
|
||||
"UID_MIN (%lu), SYS_UID_MAX (%lu)\n"),
|
||||
Prog, (unsigned long) *min_id,
|
||||
getdef_ulong ("UID_MIN", 1000UL),
|
||||
(unsigned long) *max_id);
|
||||
return EINVAL;
|
||||
}
|
||||
} else {
|
||||
/* Non-system users */
|
||||
|
||||
/* Get the values from login.defs or use reasonable defaults */
|
||||
*min_id = (uid_t) getdef_ulong ("UID_MIN", 1000UL);
|
||||
*max_id = (uid_t) getdef_ulong ("UID_MAX", 60000UL);
|
||||
|
||||
/*
|
||||
* The preferred minimum should match the standard ID minimum
|
||||
* for non-system users.
|
||||
*/
|
||||
*preferred_min = *min_id;
|
||||
|
||||
/* Check that the ranges make sense */
|
||||
if (*max_id < *min_id) {
|
||||
(void) fprintf (shadow_logfd,
|
||||
_("%s: Invalid configuration: UID_MIN (%lu), "
|
||||
"UID_MAX (%lu)\n"),
|
||||
Prog, (unsigned long) *min_id,
|
||||
(unsigned long) *max_id);
|
||||
return EINVAL;
|
||||
}
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* check_uid - See if the requested UID is available
|
||||
*
|
||||
* On success, return 0
|
||||
* If the ID is in use, return EEXIST
|
||||
* If the ID is outside the range, return ERANGE
|
||||
* In other cases, return errno from getpwuid()
|
||||
*/
|
||||
static int check_uid(const uid_t uid,
|
||||
const uid_t uid_min,
|
||||
const uid_t uid_max,
|
||||
bool *used_uids)
|
||||
{
|
||||
/* First test that the preferred ID is in the range */
|
||||
if (uid < uid_min || uid > uid_max) {
|
||||
return ERANGE;
|
||||
}
|
||||
|
||||
/*
|
||||
* Check whether we already detected this UID
|
||||
* using the pw_next() loop
|
||||
*/
|
||||
if (used_uids != NULL && used_uids[uid]) {
|
||||
return EEXIST;
|
||||
}
|
||||
/* Check if the UID exists according to NSS */
|
||||
errno = 0;
|
||||
if (prefix_getpwuid(uid) != NULL) {
|
||||
return EEXIST;
|
||||
} else {
|
||||
/* getpwuid() was NULL
|
||||
* we have to ignore errors as temporary
|
||||
* failures of remote user identity services
|
||||
* would completely block user/group creation
|
||||
*/
|
||||
}
|
||||
|
||||
/* If we've made it here, the UID must be available */
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* find_new_uid - Find a new unused UID.
|
||||
*
|
||||
* If successful, find_new_uid provides an unused user ID in the
|
||||
* [UID_MIN:UID_MAX] range.
|
||||
* This ID should be higher than all the used UID, but if not possible,
|
||||
* the lowest unused ID in the range will be returned.
|
||||
*
|
||||
* Return 0 on success, -1 if no unused UIDs are available.
|
||||
*/
|
||||
int find_new_uid(bool sys_user,
|
||||
uid_t *uid,
|
||||
/*@null@*/uid_t const *preferred_uid)
|
||||
{
|
||||
bool *used_uids;
|
||||
const struct passwd *pwd;
|
||||
uid_t uid_min, uid_max, preferred_min;
|
||||
uid_t id;
|
||||
uid_t lowest_found, highest_found;
|
||||
int result;
|
||||
int nospam = 0;
|
||||
|
||||
assert (uid != NULL);
|
||||
|
||||
/*
|
||||
* First, figure out what ID range is appropriate for
|
||||
* automatic assignment
|
||||
*/
|
||||
result = get_ranges (sys_user, &uid_min, &uid_max, &preferred_min);
|
||||
if (result == EINVAL) {
|
||||
return -1;
|
||||
}
|
||||
|
||||
/* Check if the preferred UID is available */
|
||||
if (preferred_uid) {
|
||||
result = check_uid (*preferred_uid, preferred_min, uid_max, NULL);
|
||||
if (result == 0) {
|
||||
/*
|
||||
* Make sure the UID isn't queued for use already
|
||||
*/
|
||||
if (pw_locate_uid (*preferred_uid) == NULL) {
|
||||
*uid = *preferred_uid;
|
||||
return 0;
|
||||
}
|
||||
/*
|
||||
* pw_locate_uid() found the UID in an as-yet uncommitted
|
||||
* entry. We'll proceed below and auto-set an UID.
|
||||
*/
|
||||
} else if (result == EEXIST || result == ERANGE) {
|
||||
/*
|
||||
* Continue on below. At this time, we won't
|
||||
* treat these two cases differently.
|
||||
*/
|
||||
} else {
|
||||
/*
|
||||
* An unexpected error occurred. We should report
|
||||
* this and fail the user creation.
|
||||
* This differs from the automatic creation
|
||||
* behavior below, since if a specific UID was
|
||||
* requested and generated an error, the user is
|
||||
* more likely to want to stop and address the
|
||||
* issue.
|
||||
*/
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Encountered error attempting to use "
|
||||
"preferred UID: %s\n"),
|
||||
Prog, strerror (result));
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* Search the entire passwd file,
|
||||
* looking for the next unused value.
|
||||
*
|
||||
* We first check the local database with pw_rewind/pw_next to find
|
||||
* all local values that are in use.
|
||||
*
|
||||
* We then compare the next free value to all databases (local and
|
||||
* remote) and iterate until we find a free one. If there are free
|
||||
* values beyond the lowest (system users) or highest (non-system
|
||||
* users), we will prefer those and avoid potentially reclaiming a
|
||||
* deleted user (which can be a security issue, since it may grant
|
||||
* access to files belonging to that former user).
|
||||
*
|
||||
* If there are no UIDs available at the end of the search, we will
|
||||
* have no choice but to iterate through the range looking for gaps.
|
||||
*
|
||||
*/
|
||||
|
||||
/* Create an array to hold all of the discovered UIDs */
|
||||
used_uids = malloc (sizeof (bool) * (uid_max +1));
|
||||
if (NULL == used_uids) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: failed to allocate memory: %s\n"),
|
||||
Prog, strerror (errno));
|
||||
return -1;
|
||||
}
|
||||
memset (used_uids, false, sizeof (bool) * (uid_max + 1));
|
||||
|
||||
/* First look for the lowest and highest value in the local database */
|
||||
(void) pw_rewind ();
|
||||
highest_found = uid_min;
|
||||
lowest_found = uid_max;
|
||||
while ((pwd = pw_next ()) != NULL) {
|
||||
/*
|
||||
* Does this entry have a lower UID than the lowest we've found
|
||||
* so far?
|
||||
*/
|
||||
if ((pwd->pw_uid <= lowest_found) && (pwd->pw_uid >= uid_min)) {
|
||||
lowest_found = pwd->pw_uid - 1;
|
||||
}
|
||||
|
||||
/*
|
||||
* Does this entry have a higher UID than the highest we've found
|
||||
* so far?
|
||||
*/
|
||||
if ((pwd->pw_uid >= highest_found) && (pwd->pw_uid <= uid_max)) {
|
||||
highest_found = pwd->pw_uid + 1;
|
||||
}
|
||||
|
||||
/* create index of used UIDs */
|
||||
if (pwd->pw_uid >= uid_min
|
||||
&& pwd->pw_uid <= uid_max) {
|
||||
|
||||
used_uids[pwd->pw_uid] = true;
|
||||
}
|
||||
}
|
||||
|
||||
if (sys_user) {
|
||||
/*
|
||||
* For system users, we want to start from the
|
||||
* top of the range and work downwards.
|
||||
*/
|
||||
|
||||
/*
|
||||
* At the conclusion of the pw_next() search, we will either
|
||||
* have a presumed-free UID or we will be at UID_MIN - 1.
|
||||
*/
|
||||
if (lowest_found < uid_min) {
|
||||
/*
|
||||
* In this case, an UID is in use at UID_MIN.
|
||||
*
|
||||
* We will reset the search to UID_MAX and proceed down
|
||||
* through all the UIDs (skipping those we detected with
|
||||
* used_uids) for a free one. It is a known issue that
|
||||
* this may result in reusing a previously-deleted UID,
|
||||
* so administrators should be instructed to use this
|
||||
* auto-detection with care (and prefer to assign UIDs
|
||||
* explicitly).
|
||||
*/
|
||||
lowest_found = uid_max;
|
||||
}
|
||||
|
||||
/* Search through all of the IDs in the range */
|
||||
for (id = lowest_found; id >= uid_min; id--) {
|
||||
result = check_uid (id, uid_min, uid_max, used_uids);
|
||||
if (result == 0) {
|
||||
/* This UID is available. Return it. */
|
||||
*uid = id;
|
||||
free (used_uids);
|
||||
return 0;
|
||||
} else if (result == EEXIST) {
|
||||
/* This UID is in use, we'll continue to the next */
|
||||
} else {
|
||||
/*
|
||||
* An unexpected error occurred.
|
||||
*
|
||||
* Only report it the first time to avoid spamming
|
||||
* the logs
|
||||
*
|
||||
*/
|
||||
if (!nospam) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Can't get unique system UID (%s). "
|
||||
"Suppressing additional messages.\n"),
|
||||
Prog, strerror (result));
|
||||
SYSLOG ((LOG_ERR,
|
||||
"Error checking available UIDs: %s",
|
||||
strerror (result)));
|
||||
nospam = 1;
|
||||
}
|
||||
/*
|
||||
* We will continue anyway. Hopefully a later UID
|
||||
* will work properly.
|
||||
*/
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* If we get all the way through the loop, try again from UID_MAX,
|
||||
* unless that was where we previously started. (NOTE: the worst-case
|
||||
* scenario here is that we will run through (UID_MAX - UID_MIN - 1)
|
||||
* cycles *again* if we fall into this case with lowest_found as
|
||||
* UID_MAX - 1, all users in the range in use and maintained by
|
||||
* network services such as LDAP.)
|
||||
*/
|
||||
if (lowest_found != uid_max) {
|
||||
for (id = uid_max; id >= uid_min; id--) {
|
||||
result = check_uid (id, uid_min, uid_max, used_uids);
|
||||
if (result == 0) {
|
||||
/* This UID is available. Return it. */
|
||||
*uid = id;
|
||||
free (used_uids);
|
||||
return 0;
|
||||
} else if (result == EEXIST) {
|
||||
/* This UID is in use, we'll continue to the next */
|
||||
} else {
|
||||
/*
|
||||
* An unexpected error occurred.
|
||||
*
|
||||
* Only report it the first time to avoid spamming
|
||||
* the logs
|
||||
*
|
||||
*/
|
||||
if (!nospam) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Can't get unique system UID (%s). "
|
||||
"Suppressing additional messages.\n"),
|
||||
Prog, strerror (result));
|
||||
SYSLOG((LOG_ERR,
|
||||
"Error checking available UIDs: %s",
|
||||
strerror (result)));
|
||||
nospam = 1;
|
||||
}
|
||||
/*
|
||||
* We will continue anyway. Hopefully a later UID
|
||||
* will work properly.
|
||||
*/
|
||||
}
|
||||
}
|
||||
}
|
||||
} else { /* !sys_user */
|
||||
/*
|
||||
* For non-system users, we want to start from the
|
||||
* bottom of the range and work upwards.
|
||||
*/
|
||||
|
||||
/*
|
||||
* At the conclusion of the pw_next() search, we will either
|
||||
* have a presumed-free UID or we will be at UID_MAX + 1.
|
||||
*/
|
||||
if (highest_found > uid_max) {
|
||||
/*
|
||||
* In this case, a UID is in use at UID_MAX.
|
||||
*
|
||||
* We will reset the search to UID_MIN and proceed up
|
||||
* through all the UIDs (skipping those we detected with
|
||||
* used_uids) for a free one. It is a known issue that
|
||||
* this may result in reusing a previously-deleted UID,
|
||||
* so administrators should be instructed to use this
|
||||
* auto-detection with care (and prefer to assign UIDs
|
||||
* explicitly).
|
||||
*/
|
||||
highest_found = uid_min;
|
||||
}
|
||||
|
||||
/* Search through all of the IDs in the range */
|
||||
for (id = highest_found; id <= uid_max; id++) {
|
||||
result = check_uid (id, uid_min, uid_max, used_uids);
|
||||
if (result == 0) {
|
||||
/* This UID is available. Return it. */
|
||||
*uid = id;
|
||||
free (used_uids);
|
||||
return 0;
|
||||
} else if (result == EEXIST) {
|
||||
/* This UID is in use, we'll continue to the next */
|
||||
} else {
|
||||
/*
|
||||
* An unexpected error occurred.
|
||||
*
|
||||
* Only report it the first time to avoid spamming
|
||||
* the logs
|
||||
*
|
||||
*/
|
||||
if (!nospam) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Can't get unique UID (%s). "
|
||||
"Suppressing additional messages.\n"),
|
||||
Prog, strerror (result));
|
||||
SYSLOG ((LOG_ERR,
|
||||
"Error checking available UIDs: %s",
|
||||
strerror (result)));
|
||||
nospam = 1;
|
||||
}
|
||||
/*
|
||||
* We will continue anyway. Hopefully a later UID
|
||||
* will work properly.
|
||||
*/
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* If we get all the way through the loop, try again from UID_MIN,
|
||||
* unless that was where we previously started. (NOTE: the worst-case
|
||||
* scenario here is that we will run through (UID_MAX - UID_MIN - 1)
|
||||
* cycles *again* if we fall into this case with highest_found as
|
||||
* UID_MIN + 1, all users in the range in use and maintained by
|
||||
* network services such as LDAP.)
|
||||
*/
|
||||
if (highest_found != uid_min) {
|
||||
for (id = uid_min; id <= uid_max; id++) {
|
||||
result = check_uid (id, uid_min, uid_max, used_uids);
|
||||
if (result == 0) {
|
||||
/* This UID is available. Return it. */
|
||||
*uid = id;
|
||||
free (used_uids);
|
||||
return 0;
|
||||
} else if (result == EEXIST) {
|
||||
/* This UID is in use, we'll continue to the next */
|
||||
} else {
|
||||
/*
|
||||
* An unexpected error occurred.
|
||||
*
|
||||
* Only report it the first time to avoid spamming
|
||||
* the logs
|
||||
*
|
||||
*/
|
||||
if (!nospam) {
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Can't get unique UID (%s). "
|
||||
"Suppressing additional messages.\n"),
|
||||
Prog, strerror (result));
|
||||
SYSLOG ((LOG_ERR,
|
||||
"Error checking available UIDs: %s",
|
||||
strerror (result)));
|
||||
nospam = 1;
|
||||
}
|
||||
/*
|
||||
* We will continue anyway. Hopefully a later UID
|
||||
* will work properly.
|
||||
*/
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/* The code reached here and found no available IDs in the range */
|
||||
fprintf (shadow_logfd,
|
||||
_("%s: Can't get unique UID (no more available UIDs)\n"),
|
||||
Prog);
|
||||
SYSLOG ((LOG_WARN, "no more available UIDs on the system"));
|
||||
free (used_uids);
|
||||
return -1;
|
||||
}
|
||||
|
||||
@@ -35,5 +35,5 @@
|
||||
#include <config.h>
|
||||
#include "defines.h"
|
||||
|
||||
time_t get_date (const char *p, /*@null@*/const time_t *now);
|
||||
time_t get_date (const char *, const time_t *);
|
||||
#endif
|
||||
|
||||
@@ -66,7 +66,7 @@
|
||||
#endif
|
||||
|
||||
/* Remap normal yacc parser interface names (yyparse, yylex, yyerror, etc),
|
||||
as well as gratuitously global symbol names, so we can have multiple
|
||||
as well as gratuitiously global symbol names, so we can have multiple
|
||||
yacc generated parsers in the same program. Note that these are only
|
||||
the variables produced by yacc. If other parser generators (bison,
|
||||
byacc, etc) produce additional global names that conflict at link time,
|
||||
@@ -395,7 +395,7 @@ relunit : tUNUMBER tYEAR_UNIT {
|
||||
|
||||
number : tUNUMBER
|
||||
{
|
||||
if ((yyHaveTime != 0) && (yyHaveDate != 0) && (yyHaveRel == 0))
|
||||
if (yyHaveTime && yyHaveDate && !yyHaveRel)
|
||||
yyYear = $1;
|
||||
else
|
||||
{
|
||||
@@ -647,10 +647,10 @@ static int LookupWord (char *buff)
|
||||
register char *q;
|
||||
register const TABLE *tp;
|
||||
int i;
|
||||
bool abbrev;
|
||||
int abbrev;
|
||||
|
||||
/* Make it lowercase. */
|
||||
for (p = buff; '\0' != *p; p++)
|
||||
for (p = buff; *p; p++)
|
||||
if (ISUPPER (*p))
|
||||
*p = tolower (*p);
|
||||
|
||||
@@ -667,14 +667,14 @@ static int LookupWord (char *buff)
|
||||
|
||||
/* See if we have an abbreviation for a month. */
|
||||
if (strlen (buff) == 3)
|
||||
abbrev = true;
|
||||
abbrev = 1;
|
||||
else if (strlen (buff) == 4 && buff[3] == '.')
|
||||
{
|
||||
abbrev = true;
|
||||
abbrev = 1;
|
||||
buff[3] = '\0';
|
||||
}
|
||||
else
|
||||
abbrev = false;
|
||||
abbrev = 0;
|
||||
|
||||
for (tp = MonthDayTable; tp->name; tp++)
|
||||
{
|
||||
@@ -743,14 +743,14 @@ static int LookupWord (char *buff)
|
||||
}
|
||||
|
||||
/* Drop out any periods and try the timezone table again. */
|
||||
for (i = 0, p = q = buff; '\0' != *q; q++)
|
||||
for (i = 0, p = q = buff; *q; q++)
|
||||
if (*q != '.')
|
||||
*p++ = *q;
|
||||
else
|
||||
i++;
|
||||
*p = '\0';
|
||||
if (0 != i)
|
||||
for (tp = TimezoneTable; NULL != tp->name; tp++)
|
||||
if (i)
|
||||
for (tp = TimezoneTable; tp->name; tp++)
|
||||
if (strcmp (buff, tp->name) == 0)
|
||||
{
|
||||
yylval.Number = tp->value;
|
||||
@@ -790,7 +790,7 @@ yylex (void)
|
||||
yyInput--;
|
||||
if (sign < 0)
|
||||
yylval.Number = -yylval.Number;
|
||||
return (0 != sign) ? tSNUMBER : tUNUMBER;
|
||||
return sign ? tSNUMBER : tUNUMBER;
|
||||
}
|
||||
if (ISALPHA (c))
|
||||
{
|
||||
@@ -874,8 +874,7 @@ time_t get_date (const char *p, const time_t *now)
|
||||
tm.tm_year = ToYear (yyYear) - TM_YEAR_ORIGIN + yyRelYear;
|
||||
tm.tm_mon = yyMonth - 1 + yyRelMonth;
|
||||
tm.tm_mday = yyDay + yyRelDay;
|
||||
if ((yyHaveTime != 0) ||
|
||||
( (yyHaveRel != 0) && (yyHaveDate == 0) && (yyHaveDay == 0) ))
|
||||
if (yyHaveTime || (yyHaveRel && !yyHaveDate && !yyHaveDay))
|
||||
{
|
||||
tm.tm_hour = ToHour (yyHour, yyMeridian);
|
||||
if (tm.tm_hour < 0)
|
||||
|
||||
@@ -1,66 +0,0 @@
|
||||
/*
|
||||
* Copyright (c) 1991 - 1994, Julianne Frances Haugh
|
||||
* Copyright (c) 1996 - 2000, Marek Michałkiewicz
|
||||
* Copyright (c) 2000 - 2006, Tomasz Kłoczko
|
||||
* Copyright (c) 2007 - 2009, Nicolas François
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. The name of the copyright holders or contributors may not be used to
|
||||
* endorse or promote products derived from this software without
|
||||
* specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
|
||||
* PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
* HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include <config.h>
|
||||
|
||||
#ident "$Id$"
|
||||
|
||||
#include <stdlib.h>
|
||||
#include <errno.h>
|
||||
#include <grp.h>
|
||||
#include "prototypes.h"
|
||||
|
||||
/*
|
||||
* getgr_nam_gid - Return a pointer to the group specified by a string.
|
||||
* The string may be a valid GID or a valid groupname.
|
||||
* If the group does not exist on the system, NULL is returned.
|
||||
*/
|
||||
extern /*@only@*//*@null@*/struct group *getgr_nam_gid (/*@null@*/const char *grname)
|
||||
{
|
||||
long long int gid;
|
||||
char *endptr;
|
||||
|
||||
if (NULL == grname) {
|
||||
return NULL;
|
||||
}
|
||||
|
||||
errno = 0;
|
||||
gid = strtoll (grname, &endptr, 10);
|
||||
if ( ('\0' != *grname)
|
||||
&& ('\0' == *endptr)
|
||||
&& (ERANGE != errno)
|
||||
&& (/*@+longintegral@*/gid == (gid_t)gid)/*@=longintegral@*/) {
|
||||
return xgetgrgid ((gid_t) gid);
|
||||
}
|
||||
return xgetgrnam (grname);
|
||||
}
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (c) 2007 - 2009, Nicolas François
|
||||
* Copyright (c) 2007 , Nicolas François
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
@@ -31,27 +31,17 @@
|
||||
|
||||
#ident "$Id$"
|
||||
|
||||
#include <stdlib.h>
|
||||
#include <errno.h>
|
||||
#include "prototypes.h"
|
||||
#include "defines.h"
|
||||
|
||||
/*
|
||||
* getlong - extract a long integer provided by the numstr string in *result
|
||||
*
|
||||
* It supports decimal, hexadecimal or octal representations.
|
||||
*
|
||||
* Returns 0 on failure, 1 on success.
|
||||
*/
|
||||
int getlong (const char *numstr, /*@out@*/long int *result)
|
||||
int getlong(const char *numstr, long int *result)
|
||||
{
|
||||
long val;
|
||||
char *endptr;
|
||||
|
||||
errno = 0;
|
||||
val = strtol (numstr, &endptr, 0);
|
||||
if (('\0' == *numstr) || ('\0' != *endptr) || (ERANGE == errno)) {
|
||||
val = strtol (numstr, &endptr, 10);
|
||||
if (*endptr || errno == ERANGE)
|
||||
return 0;
|
||||
}
|
||||
|
||||
*result = val;
|
||||
return 1;
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user