Annotation of embedaddon/sudo/plugins/sudoers/match.c, revision 1.1
1.1 ! misho 1: /*
! 2: * Copyright (c) 1996, 1998-2005, 2007-2011
! 3: * Todd C. Miller <Todd.Miller@courtesan.com>
! 4: *
! 5: * Permission to use, copy, modify, and distribute this software for any
! 6: * purpose with or without fee is hereby granted, provided that the above
! 7: * copyright notice and this permission notice appear in all copies.
! 8: *
! 9: * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
! 10: * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
! 11: * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
! 12: * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
! 13: * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
! 14: * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
! 15: * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
! 16: * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
! 17: * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
! 18: *
! 19: * Sponsored in part by the Defense Advanced Research Projects
! 20: * Agency (DARPA) and Air Force Research Laboratory, Air Force
! 21: * Materiel Command, USAF, under agreement number F39502-99-1-0512.
! 22: */
! 23:
! 24: #include <config.h>
! 25:
! 26: #include <sys/types.h>
! 27: #include <sys/param.h>
! 28: #include <sys/stat.h>
! 29: #include <stdio.h>
! 30: #ifdef STDC_HEADERS
! 31: # include <stdlib.h>
! 32: # include <stddef.h>
! 33: #else
! 34: # ifdef HAVE_STDLIB_H
! 35: # include <stdlib.h>
! 36: # endif
! 37: #endif /* STDC_HEADERS */
! 38: #ifdef HAVE_STRING_H
! 39: # include <string.h>
! 40: #endif /* HAVE_STRING_H */
! 41: #ifdef HAVE_STRINGS_H
! 42: # include <strings.h>
! 43: #endif /* HAVE_STRINGS_H */
! 44: #ifdef HAVE_UNISTD_H
! 45: # include <unistd.h>
! 46: #endif /* HAVE_UNISTD_H */
! 47: #ifdef HAVE_FNMATCH
! 48: # include <fnmatch.h>
! 49: #endif /* HAVE_FNMATCH */
! 50: #ifdef HAVE_EXTENDED_GLOB
! 51: # include <glob.h>
! 52: #endif /* HAVE_EXTENDED_GLOB */
! 53: #ifdef HAVE_NETGROUP_H
! 54: # include <netgroup.h>
! 55: #endif /* HAVE_NETGROUP_H */
! 56: #include <ctype.h>
! 57: #include <pwd.h>
! 58: #include <grp.h>
! 59: #include <netdb.h>
! 60: #ifdef HAVE_DIRENT_H
! 61: # include <dirent.h>
! 62: # define NAMLEN(dirent) strlen((dirent)->d_name)
! 63: #else
! 64: # define dirent direct
! 65: # define NAMLEN(dirent) (dirent)->d_namlen
! 66: # ifdef HAVE_SYS_NDIR_H
! 67: # include <sys/ndir.h>
! 68: # endif
! 69: # ifdef HAVE_SYS_DIR_H
! 70: # include <sys/dir.h>
! 71: # endif
! 72: # ifdef HAVE_NDIR_H
! 73: # include <ndir.h>
! 74: # endif
! 75: #endif
! 76:
! 77: #include "sudoers.h"
! 78: #include "parse.h"
! 79: #include <gram.h>
! 80:
! 81: #ifndef HAVE_FNMATCH
! 82: # include "compat/fnmatch.h"
! 83: #endif /* HAVE_FNMATCH */
! 84: #ifndef HAVE_EXTENDED_GLOB
! 85: # include "compat/glob.h"
! 86: #endif /* HAVE_EXTENDED_GLOB */
! 87:
! 88: static struct member_list empty;
! 89:
! 90: static int command_matches_dir(char *, size_t);
! 91: static int command_matches_glob(char *, char *);
! 92: static int command_matches_fnmatch(char *, char *);
! 93: static int command_matches_normal(char *, char *);
! 94:
! 95: /*
! 96: * Returns TRUE if string 's' contains meta characters.
! 97: */
! 98: #define has_meta(s) (strpbrk(s, "\\?*[]") != NULL)
! 99:
! 100: /*
! 101: * Check for user described by pw in a list of members.
! 102: * Returns ALLOW, DENY or UNSPEC.
! 103: */
! 104: static int
! 105: _userlist_matches(struct passwd *pw, struct member_list *list)
! 106: {
! 107: struct member *m;
! 108: struct alias *a;
! 109: int rval, matched = UNSPEC;
! 110:
! 111: tq_foreach_rev(list, m) {
! 112: switch (m->type) {
! 113: case ALL:
! 114: matched = !m->negated;
! 115: break;
! 116: case NETGROUP:
! 117: if (netgr_matches(m->name, NULL, NULL, pw->pw_name))
! 118: matched = !m->negated;
! 119: break;
! 120: case USERGROUP:
! 121: if (usergr_matches(m->name, pw->pw_name, pw))
! 122: matched = !m->negated;
! 123: break;
! 124: case ALIAS:
! 125: if ((a = alias_find(m->name, USERALIAS)) != NULL) {
! 126: rval = _userlist_matches(pw, &a->members);
! 127: if (rval != UNSPEC)
! 128: matched = m->negated ? !rval : rval;
! 129: break;
! 130: }
! 131: /* FALLTHROUGH */
! 132: case WORD:
! 133: if (userpw_matches(m->name, pw->pw_name, pw))
! 134: matched = !m->negated;
! 135: break;
! 136: }
! 137: if (matched != UNSPEC)
! 138: break;
! 139: }
! 140: return matched;
! 141: }
! 142:
! 143: int
! 144: userlist_matches(struct passwd *pw, struct member_list *list)
! 145: {
! 146: alias_seqno++;
! 147: return _userlist_matches(pw, list);
! 148: }
! 149:
! 150: /*
! 151: * Check for user described by pw in a list of members.
! 152: * If both lists are empty compare against def_runas_default.
! 153: * Returns ALLOW, DENY or UNSPEC.
! 154: */
! 155: static int
! 156: _runaslist_matches(struct member_list *user_list, struct member_list *group_list)
! 157: {
! 158: struct member *m;
! 159: struct alias *a;
! 160: int rval;
! 161: int user_matched = UNSPEC;
! 162: int group_matched = UNSPEC;
! 163:
! 164: if (runas_pw != NULL) {
! 165: /* If no runas user or runas group listed in sudoers, use default. */
! 166: if (tq_empty(user_list) && tq_empty(group_list))
! 167: return userpw_matches(def_runas_default, runas_pw->pw_name, runas_pw);
! 168:
! 169: tq_foreach_rev(user_list, m) {
! 170: switch (m->type) {
! 171: case ALL:
! 172: user_matched = !m->negated;
! 173: break;
! 174: case NETGROUP:
! 175: if (netgr_matches(m->name, NULL, NULL, runas_pw->pw_name))
! 176: user_matched = !m->negated;
! 177: break;
! 178: case USERGROUP:
! 179: if (usergr_matches(m->name, runas_pw->pw_name, runas_pw))
! 180: user_matched = !m->negated;
! 181: break;
! 182: case ALIAS:
! 183: if ((a = alias_find(m->name, RUNASALIAS)) != NULL) {
! 184: rval = _runaslist_matches(&a->members, &empty);
! 185: if (rval != UNSPEC)
! 186: user_matched = m->negated ? !rval : rval;
! 187: break;
! 188: }
! 189: /* FALLTHROUGH */
! 190: case WORD:
! 191: if (userpw_matches(m->name, runas_pw->pw_name, runas_pw))
! 192: user_matched = !m->negated;
! 193: break;
! 194: }
! 195: if (user_matched != UNSPEC)
! 196: break;
! 197: }
! 198: }
! 199:
! 200: if (runas_gr != NULL) {
! 201: if (user_matched == UNSPEC) {
! 202: if (runas_pw == NULL || strcmp(runas_pw->pw_name, user_name) == 0)
! 203: user_matched = ALLOW; /* only changing group */
! 204: }
! 205: tq_foreach_rev(group_list, m) {
! 206: switch (m->type) {
! 207: case ALL:
! 208: group_matched = !m->negated;
! 209: break;
! 210: case ALIAS:
! 211: if ((a = alias_find(m->name, RUNASALIAS)) != NULL) {
! 212: rval = _runaslist_matches(&empty, &a->members);
! 213: if (rval != UNSPEC)
! 214: group_matched = m->negated ? !rval : rval;
! 215: break;
! 216: }
! 217: /* FALLTHROUGH */
! 218: case WORD:
! 219: if (group_matches(m->name, runas_gr))
! 220: group_matched = !m->negated;
! 221: break;
! 222: }
! 223: if (group_matched != UNSPEC)
! 224: break;
! 225: }
! 226: if (group_matched == UNSPEC) {
! 227: if (runas_pw != NULL && runas_pw->pw_gid == runas_gr->gr_gid)
! 228: group_matched = ALLOW; /* runas group matches passwd db */
! 229: }
! 230: }
! 231:
! 232: if (user_matched == DENY || group_matched == DENY)
! 233: return DENY;
! 234: if (user_matched == group_matched || runas_gr == NULL)
! 235: return user_matched;
! 236: return UNSPEC;
! 237: }
! 238:
! 239: int
! 240: runaslist_matches(struct member_list *user_list, struct member_list *group_list)
! 241: {
! 242: alias_seqno++;
! 243: return _runaslist_matches(user_list ? user_list : &empty,
! 244: group_list ? group_list : &empty);
! 245: }
! 246:
! 247: /*
! 248: * Check for host and shost in a list of members.
! 249: * Returns ALLOW, DENY or UNSPEC.
! 250: */
! 251: static int
! 252: _hostlist_matches(struct member_list *list)
! 253: {
! 254: struct member *m;
! 255: struct alias *a;
! 256: int rval, matched = UNSPEC;
! 257:
! 258: tq_foreach_rev(list, m) {
! 259: switch (m->type) {
! 260: case ALL:
! 261: matched = !m->negated;
! 262: break;
! 263: case NETGROUP:
! 264: if (netgr_matches(m->name, user_host, user_shost, NULL))
! 265: matched = !m->negated;
! 266: break;
! 267: case NTWKADDR:
! 268: if (addr_matches(m->name))
! 269: matched = !m->negated;
! 270: break;
! 271: case ALIAS:
! 272: if ((a = alias_find(m->name, HOSTALIAS)) != NULL) {
! 273: rval = _hostlist_matches(&a->members);
! 274: if (rval != UNSPEC)
! 275: matched = m->negated ? !rval : rval;
! 276: break;
! 277: }
! 278: /* FALLTHROUGH */
! 279: case WORD:
! 280: if (hostname_matches(user_shost, user_host, m->name))
! 281: matched = !m->negated;
! 282: break;
! 283: }
! 284: if (matched != UNSPEC)
! 285: break;
! 286: }
! 287: return matched;
! 288: }
! 289:
! 290: int
! 291: hostlist_matches(struct member_list *list)
! 292: {
! 293: alias_seqno++;
! 294: return _hostlist_matches(list);
! 295: }
! 296:
! 297: /*
! 298: * Check for cmnd and args in a list of members.
! 299: * Returns ALLOW, DENY or UNSPEC.
! 300: */
! 301: static int
! 302: _cmndlist_matches(struct member_list *list)
! 303: {
! 304: struct member *m;
! 305: int matched = UNSPEC;
! 306:
! 307: tq_foreach_rev(list, m) {
! 308: matched = cmnd_matches(m);
! 309: if (matched != UNSPEC)
! 310: break;
! 311: }
! 312: return matched;
! 313: }
! 314:
! 315: int
! 316: cmndlist_matches(struct member_list *list)
! 317: {
! 318: alias_seqno++;
! 319: return _cmndlist_matches(list);
! 320: }
! 321:
! 322: /*
! 323: * Check cmnd and args.
! 324: * Returns ALLOW, DENY or UNSPEC.
! 325: */
! 326: int
! 327: cmnd_matches(struct member *m)
! 328: {
! 329: struct alias *a;
! 330: struct sudo_command *c;
! 331: int rval, matched = UNSPEC;
! 332:
! 333: switch (m->type) {
! 334: case ALL:
! 335: matched = !m->negated;
! 336: break;
! 337: case ALIAS:
! 338: alias_seqno++;
! 339: if ((a = alias_find(m->name, CMNDALIAS)) != NULL) {
! 340: rval = _cmndlist_matches(&a->members);
! 341: if (rval != UNSPEC)
! 342: matched = m->negated ? !rval : rval;
! 343: }
! 344: break;
! 345: case COMMAND:
! 346: c = (struct sudo_command *)m->name;
! 347: if (command_matches(c->cmnd, c->args))
! 348: matched = !m->negated;
! 349: break;
! 350: }
! 351: return matched;
! 352: }
! 353:
! 354: static int
! 355: command_args_match(sudoers_cmnd, sudoers_args)
! 356: char *sudoers_cmnd;
! 357: char *sudoers_args;
! 358: {
! 359: int flags = 0;
! 360:
! 361: /*
! 362: * If no args specified in sudoers, any user args are allowed.
! 363: * If the empty string is specified in sudoers, no user args are allowed.
! 364: */
! 365: if (!sudoers_args ||
! 366: (!user_args && sudoers_args && !strcmp("\"\"", sudoers_args)))
! 367: return TRUE;
! 368: /*
! 369: * If args are specified in sudoers, they must match the user args.
! 370: * If running as sudoedit, all args are assumed to be paths.
! 371: */
! 372: if (sudoers_args) {
! 373: /* For sudoedit, all args are assumed to be pathnames. */
! 374: if (strcmp(sudoers_cmnd, "sudoedit") == 0)
! 375: flags = FNM_PATHNAME;
! 376: if (fnmatch(sudoers_args, user_args ? user_args : "", flags) == 0)
! 377: return TRUE;
! 378: }
! 379: return FALSE;
! 380: }
! 381:
! 382: /*
! 383: * If path doesn't end in /, return TRUE iff cmnd & path name the same inode;
! 384: * otherwise, return TRUE if user_cmnd names one of the inodes in path.
! 385: */
! 386: int
! 387: command_matches(char *sudoers_cmnd, char *sudoers_args)
! 388: {
! 389: /* Check for pseudo-commands */
! 390: if (sudoers_cmnd[0] != '/') {
! 391: /*
! 392: * Return true if both sudoers_cmnd and user_cmnd are "sudoedit" AND
! 393: * a) there are no args in sudoers OR
! 394: * b) there are no args on command line and none req by sudoers OR
! 395: * c) there are args in sudoers and on command line and they match
! 396: */
! 397: if (strcmp(sudoers_cmnd, "sudoedit") != 0 ||
! 398: strcmp(user_cmnd, "sudoedit") != 0)
! 399: return FALSE;
! 400: if (command_args_match(sudoers_cmnd, sudoers_args)) {
! 401: efree(safe_cmnd);
! 402: safe_cmnd = estrdup(sudoers_cmnd);
! 403: return TRUE;
! 404: } else
! 405: return FALSE;
! 406: }
! 407:
! 408: if (has_meta(sudoers_cmnd)) {
! 409: /*
! 410: * If sudoers_cmnd has meta characters in it, we need to
! 411: * use glob(3) and/or fnmatch(3) to do the matching.
! 412: */
! 413: if (def_fast_glob)
! 414: return command_matches_fnmatch(sudoers_cmnd, sudoers_args);
! 415: return command_matches_glob(sudoers_cmnd, sudoers_args);
! 416: }
! 417: return command_matches_normal(sudoers_cmnd, sudoers_args);
! 418: }
! 419:
! 420: static int
! 421: command_matches_fnmatch(char *sudoers_cmnd, char *sudoers_args)
! 422: {
! 423: /*
! 424: * Return true if fnmatch(3) succeeds AND
! 425: * a) there are no args in sudoers OR
! 426: * b) there are no args on command line and none required by sudoers OR
! 427: * c) there are args in sudoers and on command line and they match
! 428: * else return false.
! 429: */
! 430: if (fnmatch(sudoers_cmnd, user_cmnd, FNM_PATHNAME) != 0)
! 431: return FALSE;
! 432: if (command_args_match(sudoers_cmnd, sudoers_args)) {
! 433: if (safe_cmnd)
! 434: free(safe_cmnd);
! 435: safe_cmnd = estrdup(user_cmnd);
! 436: return TRUE;
! 437: } else
! 438: return FALSE;
! 439: }
! 440:
! 441: static int
! 442: command_matches_glob(char *sudoers_cmnd, char *sudoers_args)
! 443: {
! 444: struct stat sudoers_stat;
! 445: size_t dlen;
! 446: char **ap, *base, *cp;
! 447: glob_t gl;
! 448:
! 449: /*
! 450: * First check to see if we can avoid the call to glob(3).
! 451: * Short circuit if there are no meta chars in the command itself
! 452: * and user_base and basename(sudoers_cmnd) don't match.
! 453: */
! 454: dlen = strlen(sudoers_cmnd);
! 455: if (sudoers_cmnd[dlen - 1] != '/') {
! 456: if ((base = strrchr(sudoers_cmnd, '/')) != NULL) {
! 457: base++;
! 458: if (!has_meta(base) && strcmp(user_base, base) != 0)
! 459: return FALSE;
! 460: }
! 461: }
! 462: /*
! 463: * Return true if we find a match in the glob(3) results AND
! 464: * a) there are no args in sudoers OR
! 465: * b) there are no args on command line and none required by sudoers OR
! 466: * c) there are args in sudoers and on command line and they match
! 467: * else return false.
! 468: */
! 469: #define GLOB_FLAGS (GLOB_NOSORT | GLOB_MARK | GLOB_BRACE | GLOB_TILDE)
! 470: if (glob(sudoers_cmnd, GLOB_FLAGS, NULL, &gl) != 0 || gl.gl_pathc == 0) {
! 471: globfree(&gl);
! 472: return FALSE;
! 473: }
! 474: /* For each glob match, compare basename, st_dev and st_ino. */
! 475: for (ap = gl.gl_pathv; (cp = *ap) != NULL; ap++) {
! 476: /* If it ends in '/' it is a directory spec. */
! 477: dlen = strlen(cp);
! 478: if (cp[dlen - 1] == '/') {
! 479: if (command_matches_dir(cp, dlen))
! 480: return TRUE;
! 481: continue;
! 482: }
! 483:
! 484: /* Only proceed if user_base and basename(cp) match */
! 485: if ((base = strrchr(cp, '/')) != NULL)
! 486: base++;
! 487: else
! 488: base = cp;
! 489: if (strcmp(user_base, base) != 0 ||
! 490: stat(cp, &sudoers_stat) == -1)
! 491: continue;
! 492: if (user_stat == NULL ||
! 493: (user_stat->st_dev == sudoers_stat.st_dev &&
! 494: user_stat->st_ino == sudoers_stat.st_ino)) {
! 495: efree(safe_cmnd);
! 496: safe_cmnd = estrdup(cp);
! 497: break;
! 498: }
! 499: }
! 500: globfree(&gl);
! 501: if (cp == NULL)
! 502: return FALSE;
! 503:
! 504: if (command_args_match(sudoers_cmnd, sudoers_args)) {
! 505: efree(safe_cmnd);
! 506: safe_cmnd = estrdup(user_cmnd);
! 507: return TRUE;
! 508: }
! 509: return FALSE;
! 510: }
! 511:
! 512: static int
! 513: command_matches_normal(char *sudoers_cmnd, char *sudoers_args)
! 514: {
! 515: struct stat sudoers_stat;
! 516: char *base;
! 517: size_t dlen;
! 518:
! 519: /* If it ends in '/' it is a directory spec. */
! 520: dlen = strlen(sudoers_cmnd);
! 521: if (sudoers_cmnd[dlen - 1] == '/')
! 522: return command_matches_dir(sudoers_cmnd, dlen);
! 523:
! 524: /* Only proceed if user_base and basename(sudoers_cmnd) match */
! 525: if ((base = strrchr(sudoers_cmnd, '/')) == NULL)
! 526: base = sudoers_cmnd;
! 527: else
! 528: base++;
! 529: if (strcmp(user_base, base) != 0 ||
! 530: stat(sudoers_cmnd, &sudoers_stat) == -1)
! 531: return FALSE;
! 532:
! 533: /*
! 534: * Return true if inode/device matches AND
! 535: * a) there are no args in sudoers OR
! 536: * b) there are no args on command line and none req by sudoers OR
! 537: * c) there are args in sudoers and on command line and they match
! 538: */
! 539: if (user_stat != NULL &&
! 540: (user_stat->st_dev != sudoers_stat.st_dev ||
! 541: user_stat->st_ino != sudoers_stat.st_ino))
! 542: return FALSE;
! 543: if (command_args_match(sudoers_cmnd, sudoers_args)) {
! 544: efree(safe_cmnd);
! 545: safe_cmnd = estrdup(sudoers_cmnd);
! 546: return TRUE;
! 547: }
! 548: return FALSE;
! 549: }
! 550:
! 551: /*
! 552: * Return TRUE if user_cmnd names one of the inodes in dir, else FALSE.
! 553: */
! 554: static int
! 555: command_matches_dir(char *sudoers_dir, size_t dlen)
! 556: {
! 557: struct stat sudoers_stat;
! 558: struct dirent *dent;
! 559: char buf[PATH_MAX];
! 560: DIR *dirp;
! 561:
! 562: /*
! 563: * Grot through directory entries, looking for user_base.
! 564: */
! 565: dirp = opendir(sudoers_dir);
! 566: if (dirp == NULL)
! 567: return FALSE;
! 568:
! 569: if (strlcpy(buf, sudoers_dir, sizeof(buf)) >= sizeof(buf)) {
! 570: closedir(dirp);
! 571: return FALSE;
! 572: }
! 573: while ((dent = readdir(dirp)) != NULL) {
! 574: /* ignore paths > PATH_MAX (XXX - log) */
! 575: buf[dlen] = '\0';
! 576: if (strlcat(buf, dent->d_name, sizeof(buf)) >= sizeof(buf))
! 577: continue;
! 578:
! 579: /* only stat if basenames are the same */
! 580: if (strcmp(user_base, dent->d_name) != 0 ||
! 581: stat(buf, &sudoers_stat) == -1)
! 582: continue;
! 583: if (user_stat == NULL ||
! 584: (user_stat->st_dev == sudoers_stat.st_dev &&
! 585: user_stat->st_ino == sudoers_stat.st_ino)) {
! 586: efree(safe_cmnd);
! 587: safe_cmnd = estrdup(buf);
! 588: break;
! 589: }
! 590: }
! 591:
! 592: closedir(dirp);
! 593: return dent != NULL;
! 594: }
! 595:
! 596: /*
! 597: * Returns TRUE if the hostname matches the pattern, else FALSE
! 598: */
! 599: int
! 600: hostname_matches(char *shost, char *lhost, char *pattern)
! 601: {
! 602: if (has_meta(pattern)) {
! 603: if (strchr(pattern, '.'))
! 604: return !fnmatch(pattern, lhost, FNM_CASEFOLD);
! 605: else
! 606: return !fnmatch(pattern, shost, FNM_CASEFOLD);
! 607: } else {
! 608: if (strchr(pattern, '.'))
! 609: return !strcasecmp(lhost, pattern);
! 610: else
! 611: return !strcasecmp(shost, pattern);
! 612: }
! 613: }
! 614:
! 615: /*
! 616: * Returns TRUE if the user/uid from sudoers matches the specified user/uid,
! 617: * else returns FALSE.
! 618: */
! 619: int
! 620: userpw_matches(char *sudoers_user, char *user, struct passwd *pw)
! 621: {
! 622: if (pw != NULL && *sudoers_user == '#') {
! 623: uid_t uid = (uid_t) atoi(sudoers_user + 1);
! 624: if (uid == pw->pw_uid)
! 625: return TRUE;
! 626: }
! 627: return strcmp(sudoers_user, user) == 0;
! 628: }
! 629:
! 630: /*
! 631: * Returns TRUE if the group/gid from sudoers matches the specified group/gid,
! 632: * else returns FALSE.
! 633: */
! 634: int
! 635: group_matches(char *sudoers_group, struct group *gr)
! 636: {
! 637: if (*sudoers_group == '#') {
! 638: gid_t gid = (gid_t) atoi(sudoers_group + 1);
! 639: if (gid == gr->gr_gid)
! 640: return TRUE;
! 641: }
! 642: return strcmp(gr->gr_name, sudoers_group) == 0;
! 643: }
! 644:
! 645: /*
! 646: * Returns TRUE if the given user belongs to the named group,
! 647: * else returns FALSE.
! 648: */
! 649: int
! 650: usergr_matches(char *group, char *user, struct passwd *pw)
! 651: {
! 652: int matched = FALSE;
! 653: struct passwd *pw0 = NULL;
! 654:
! 655: /* make sure we have a valid usergroup, sudo style */
! 656: if (*group++ != '%')
! 657: goto done;
! 658:
! 659: if (*group == ':' && def_group_plugin) {
! 660: matched = group_plugin_query(user, group + 1, pw);
! 661: goto done;
! 662: }
! 663:
! 664: /* look up user's primary gid in the passwd file */
! 665: if (pw == NULL) {
! 666: if ((pw0 = sudo_getpwnam(user)) == NULL)
! 667: goto done;
! 668: pw = pw0;
! 669: }
! 670:
! 671: if (user_in_group(pw, group)) {
! 672: matched = TRUE;
! 673: goto done;
! 674: }
! 675:
! 676: /* not a Unix group, could be an external group */
! 677: if (def_group_plugin && group_plugin_query(user, group, pw)) {
! 678: matched = TRUE;
! 679: goto done;
! 680: }
! 681:
! 682: done:
! 683: if (pw0 != NULL)
! 684: pw_delref(pw0);
! 685:
! 686: return matched;
! 687: }
! 688:
! 689: /*
! 690: * Returns TRUE if "host" and "user" belong to the netgroup "netgr",
! 691: * else return FALSE. Either of "host", "shost" or "user" may be NULL
! 692: * in which case that argument is not checked...
! 693: *
! 694: * XXX - swap order of host & shost
! 695: */
! 696: int
! 697: netgr_matches(char *netgr, char *lhost, char *shost, char *user)
! 698: {
! 699: static char *domain;
! 700: #ifdef HAVE_GETDOMAINNAME
! 701: static int initialized;
! 702: #endif
! 703:
! 704: /* make sure we have a valid netgroup, sudo style */
! 705: if (*netgr++ != '+')
! 706: return FALSE;
! 707:
! 708: #ifdef HAVE_GETDOMAINNAME
! 709: /* get the domain name (if any) */
! 710: if (!initialized) {
! 711: domain = (char *) emalloc(MAXHOSTNAMELEN + 1);
! 712: if (getdomainname(domain, MAXHOSTNAMELEN + 1) == -1 || *domain == '\0') {
! 713: efree(domain);
! 714: domain = NULL;
! 715: }
! 716: initialized = 1;
! 717: }
! 718: #endif /* HAVE_GETDOMAINNAME */
! 719:
! 720: #ifdef HAVE_INNETGR
! 721: if (innetgr(netgr, lhost, user, domain))
! 722: return TRUE;
! 723: else if (lhost != shost && innetgr(netgr, shost, user, domain))
! 724: return TRUE;
! 725: #endif /* HAVE_INNETGR */
! 726:
! 727: return FALSE;
! 728: }
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to match.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / sudo / plugins / sudoers