Annotation of embedaddon/sudo/plugins/sudoers/pwutil.c, revision 1.1
1.1 ! misho 1: /*
! 2: * Copyright (c) 1996, 1998-2005, 2007-2011
! 3: * Todd C. Miller <Todd.Miller@courtesan.com>
! 4: *
! 5: * Permission to use, copy, modify, and distribute this software for any
! 6: * purpose with or without fee is hereby granted, provided that the above
! 7: * copyright notice and this permission notice appear in all copies.
! 8: *
! 9: * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
! 10: * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
! 11: * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
! 12: * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
! 13: * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
! 14: * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
! 15: * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
! 16: *
! 17: * Sponsored in part by the Defense Advanced Research Projects
! 18: * Agency (DARPA) and Air Force Research Laboratory, Air Force
! 19: * Materiel Command, USAF, under agreement number F39502-99-1-0512.
! 20: */
! 21:
! 22: #include <config.h>
! 23:
! 24: #include <sys/types.h>
! 25: #include <sys/stat.h>
! 26: #include <sys/param.h>
! 27: #include <stdio.h>
! 28: #ifdef STDC_HEADERS
! 29: # include <stdlib.h>
! 30: # include <stddef.h>
! 31: #else
! 32: # ifdef HAVE_STDLIB_H
! 33: # include <stdlib.h>
! 34: # endif
! 35: #endif /* STDC_HEADERS */
! 36: #ifdef HAVE_STRING_H
! 37: # if defined(HAVE_MEMORY_H) && !defined(STDC_HEADERS)
! 38: # include <memory.h>
! 39: # endif
! 40: # include <string.h>
! 41: #endif /* HAVE_STRING_H */
! 42: #ifdef HAVE_STRINGS_H
! 43: # include <strings.h>
! 44: #endif /* HAVE_STRINGS_H */
! 45: #ifdef HAVE_UNISTD_H
! 46: # include <unistd.h>
! 47: #endif /* HAVE_UNISTD_H */
! 48: #ifdef HAVE_SETAUTHDB
! 49: # include <usersec.h>
! 50: #endif /* HAVE_SETAUTHDB */
! 51: #ifdef HAVE_UTMPX_H
! 52: # include <utmpx.h>
! 53: #else
! 54: # include <utmp.h>
! 55: #endif /* HAVE_UTMPX_H */
! 56: #include <limits.h>
! 57: #include <pwd.h>
! 58: #include <grp.h>
! 59:
! 60: #include "sudoers.h"
! 61: #include "redblack.h"
! 62:
! 63: /*
! 64: * The passwd and group caches.
! 65: */
! 66: static struct rbtree *pwcache_byuid, *pwcache_byname;
! 67: static struct rbtree *grcache_bygid, *grcache_byname;
! 68: static struct rbtree *grlist_cache;
! 69:
! 70: static int cmp_pwuid(const void *, const void *);
! 71: static int cmp_pwnam(const void *, const void *);
! 72: static int cmp_grgid(const void *, const void *);
! 73:
! 74: #define cmp_grnam cmp_pwnam
! 75:
! 76: #define ptr_to_item(p) ((struct cache_item *)((char *)(p) - sizeof(struct cache_item)))
! 77:
! 78: struct cache_item {
! 79: unsigned int refcnt;
! 80: /* key */
! 81: union {
! 82: uid_t uid;
! 83: gid_t gid;
! 84: char *name;
! 85: } k;
! 86: /* datum */
! 87: union {
! 88: struct passwd *pw;
! 89: struct group *gr;
! 90: struct group_list *grlist;
! 91: } d;
! 92: };
! 93:
! 94: /*
! 95: * Compare by uid.
! 96: */
! 97: static int
! 98: cmp_pwuid(const void *v1, const void *v2)
! 99: {
! 100: const struct cache_item *ci1 = (const struct cache_item *) v1;
! 101: const struct cache_item *ci2 = (const struct cache_item *) v2;
! 102: return ci1->k.uid - ci2->k.uid;
! 103: }
! 104:
! 105: /*
! 106: * Compare by user name.
! 107: */
! 108: static int
! 109: cmp_pwnam(const void *v1, const void *v2)
! 110: {
! 111: const struct cache_item *ci1 = (const struct cache_item *) v1;
! 112: const struct cache_item *ci2 = (const struct cache_item *) v2;
! 113: return strcmp(ci1->k.name, ci2->k.name);
! 114: }
! 115:
! 116: #define FIELD_SIZE(src, name, size) \
! 117: do { \
! 118: if (src->name) { \
! 119: size = strlen(src->name) + 1; \
! 120: total += size; \
! 121: } \
! 122: } while (0)
! 123:
! 124: #define FIELD_COPY(src, dst, name, size) \
! 125: do { \
! 126: if (src->name) { \
! 127: memcpy(cp, src->name, size); \
! 128: dst->name = cp; \
! 129: cp += size; \
! 130: } \
! 131: } while (0)
! 132:
! 133: /*
! 134: * Dynamically allocate space for a struct item plus the key and data
! 135: * elements. If name is non-NULL it is used as the key, else the
! 136: * uid is the key. Fills in datum from struct password.
! 137: *
! 138: * We would like to fill in the encrypted password too but the
! 139: * call to the shadow function could overwrite the pw buffer (NIS).
! 140: */
! 141: static struct cache_item *
! 142: make_pwitem(const struct passwd *pw, const char *name)
! 143: {
! 144: char *cp;
! 145: const char *pw_shell;
! 146: size_t nsize, psize, csize, gsize, dsize, ssize, total;
! 147: struct cache_item *item;
! 148: struct passwd *newpw;
! 149:
! 150: /* If shell field is empty, expand to _PATH_BSHELL. */
! 151: pw_shell = (pw->pw_shell == NULL || pw->pw_shell[0] == '\0')
! 152: ? _PATH_BSHELL : pw->pw_shell;
! 153:
! 154: /* Allocate in one big chunk for easy freeing. */
! 155: nsize = psize = csize = gsize = dsize = ssize = 0;
! 156: total = sizeof(struct cache_item) + sizeof(struct passwd);
! 157: FIELD_SIZE(pw, pw_name, nsize);
! 158: FIELD_SIZE(pw, pw_passwd, psize);
! 159: #ifdef HAVE_LOGIN_CAP_H
! 160: FIELD_SIZE(pw, pw_class, csize);
! 161: #endif
! 162: FIELD_SIZE(pw, pw_gecos, gsize);
! 163: FIELD_SIZE(pw, pw_dir, dsize);
! 164: /* Treat shell specially since we expand "" -> _PATH_BSHELL */
! 165: ssize = strlen(pw_shell) + 1;
! 166: total += ssize;
! 167: if (name != NULL)
! 168: total += strlen(name) + 1;
! 169:
! 170: /* Allocate space for struct item, struct passwd and the strings. */
! 171: item = emalloc(total);
! 172: cp = (char *) item + sizeof(struct cache_item);
! 173:
! 174: /*
! 175: * Copy in passwd contents and make strings relative to space
! 176: * at the end of the buffer.
! 177: */
! 178: newpw = (struct passwd *) cp;
! 179: memcpy(newpw, pw, sizeof(struct passwd));
! 180: cp += sizeof(struct passwd);
! 181: FIELD_COPY(pw, newpw, pw_name, nsize);
! 182: FIELD_COPY(pw, newpw, pw_passwd, psize);
! 183: #ifdef HAVE_LOGIN_CAP_H
! 184: FIELD_COPY(pw, newpw, pw_class, csize);
! 185: #endif
! 186: FIELD_COPY(pw, newpw, pw_gecos, gsize);
! 187: FIELD_COPY(pw, newpw, pw_dir, dsize);
! 188: /* Treat shell specially since we expand "" -> _PATH_BSHELL */
! 189: memcpy(cp, pw_shell, ssize);
! 190: newpw->pw_shell = cp;
! 191: cp += ssize;
! 192:
! 193: /* Set key and datum. */
! 194: if (name != NULL) {
! 195: memcpy(cp, name, strlen(name) + 1);
! 196: item->k.name = cp;
! 197: } else {
! 198: item->k.uid = pw->pw_uid;
! 199: }
! 200: item->d.pw = newpw;
! 201: item->refcnt = 1;
! 202:
! 203: return item;
! 204: }
! 205:
! 206: void
! 207: pw_addref(struct passwd *pw)
! 208: {
! 209: ptr_to_item(pw)->refcnt++;
! 210: }
! 211:
! 212: static void
! 213: pw_delref_item(void *v)
! 214: {
! 215: struct cache_item *item = v;
! 216:
! 217: if (--item->refcnt == 0)
! 218: efree(item);
! 219: }
! 220:
! 221: void
! 222: pw_delref(struct passwd *pw)
! 223: {
! 224: pw_delref_item(ptr_to_item(pw));
! 225: }
! 226:
! 227: /*
! 228: * Get a password entry by uid and allocate space for it.
! 229: * Fills in pw_passwd from shadow file if necessary.
! 230: */
! 231: struct passwd *
! 232: sudo_getpwuid(uid_t uid)
! 233: {
! 234: struct cache_item key, *item;
! 235: struct rbnode *node;
! 236:
! 237: key.k.uid = uid;
! 238: if ((node = rbfind(pwcache_byuid, &key)) != NULL) {
! 239: item = (struct cache_item *) node->data;
! 240: goto done;
! 241: }
! 242: /*
! 243: * Cache passwd db entry if it exists or a negative response if not.
! 244: */
! 245: #ifdef HAVE_SETAUTHDB
! 246: aix_setauthdb(IDtouser(uid));
! 247: #endif
! 248: if ((key.d.pw = getpwuid(uid)) != NULL) {
! 249: item = make_pwitem(key.d.pw, NULL);
! 250: if (rbinsert(pwcache_byuid, item) != NULL)
! 251: errorx(1, _("unable to cache uid %u (%s), already exists"),
! 252: (unsigned int) uid, item->d.pw->pw_name);
! 253: } else {
! 254: item = emalloc(sizeof(*item));
! 255: item->refcnt = 1;
! 256: item->k.uid = uid;
! 257: item->d.pw = NULL;
! 258: if (rbinsert(pwcache_byuid, item) != NULL)
! 259: errorx(1, _("unable to cache uid %u, already exists"),
! 260: (unsigned int) uid);
! 261: }
! 262: #ifdef HAVE_SETAUTHDB
! 263: aix_restoreauthdb();
! 264: #endif
! 265: done:
! 266: item->refcnt++;
! 267: return item->d.pw;
! 268: }
! 269:
! 270: /*
! 271: * Get a password entry by name and allocate space for it.
! 272: * Fills in pw_passwd from shadow file if necessary.
! 273: */
! 274: struct passwd *
! 275: sudo_getpwnam(const char *name)
! 276: {
! 277: struct cache_item key, *item;
! 278: struct rbnode *node;
! 279: size_t len;
! 280:
! 281: key.k.name = (char *) name;
! 282: if ((node = rbfind(pwcache_byname, &key)) != NULL) {
! 283: item = (struct cache_item *) node->data;
! 284: goto done;
! 285: }
! 286: /*
! 287: * Cache passwd db entry if it exists or a negative response if not.
! 288: */
! 289: #ifdef HAVE_SETAUTHDB
! 290: aix_setauthdb((char *) name);
! 291: #endif
! 292: if ((key.d.pw = getpwnam(name)) != NULL) {
! 293: item = make_pwitem(key.d.pw, name);
! 294: if (rbinsert(pwcache_byname, item) != NULL)
! 295: errorx(1, _("unable to cache user %s, already exists"), name);
! 296: } else {
! 297: len = strlen(name) + 1;
! 298: item = emalloc(sizeof(*item) + len);
! 299: item->refcnt = 1;
! 300: item->k.name = (char *) item + sizeof(*item);
! 301: memcpy(item->k.name, name, len);
! 302: item->d.pw = NULL;
! 303: if (rbinsert(pwcache_byname, item) != NULL)
! 304: errorx(1, _("unable to cache user %s, already exists"), name);
! 305: }
! 306: #ifdef HAVE_SETAUTHDB
! 307: aix_restoreauthdb();
! 308: #endif
! 309: done:
! 310: item->refcnt++;
! 311: return item->d.pw;
! 312: }
! 313:
! 314: /*
! 315: * Take a user, uid and gid and return a faked up passwd struct.
! 316: */
! 317: struct passwd *
! 318: sudo_fakepwnamid(const char *user, uid_t uid, gid_t gid)
! 319: {
! 320: struct cache_item *item;
! 321: struct passwd *pw;
! 322: struct rbnode *node;
! 323: size_t len, namelen;
! 324: int i;
! 325:
! 326: namelen = strlen(user);
! 327: len = sizeof(*item) + sizeof(*pw) + namelen + 1 /* pw_name */ +
! 328: sizeof("*") /* pw_passwd */ + sizeof("") /* pw_gecos */ +
! 329: sizeof("/") /* pw_dir */ + sizeof(_PATH_BSHELL);
! 330:
! 331: for (i = 0; i < 2; i++) {
! 332: item = emalloc(len);
! 333: zero_bytes(item, sizeof(*item) + sizeof(*pw));
! 334: pw = (struct passwd *) ((char *)item + sizeof(*item));
! 335: pw->pw_uid = uid;
! 336: pw->pw_gid = gid;
! 337: pw->pw_name = (char *)pw + sizeof(struct passwd);
! 338: memcpy(pw->pw_name, user, namelen + 1);
! 339: pw->pw_passwd = pw->pw_name + namelen + 1;
! 340: memcpy(pw->pw_passwd, "*", 2);
! 341: pw->pw_gecos = pw->pw_passwd + 2;
! 342: pw->pw_gecos[0] = '\0';
! 343: pw->pw_dir = pw->pw_gecos + 1;
! 344: memcpy(pw->pw_dir, "/", 2);
! 345: pw->pw_shell = pw->pw_dir + 2;
! 346: memcpy(pw->pw_shell, _PATH_BSHELL, sizeof(_PATH_BSHELL));
! 347:
! 348: item->refcnt = 1;
! 349: item->d.pw = pw;
! 350: if (i == 0) {
! 351: /* Store by uid, overwriting cached version. */
! 352: item->k.uid = pw->pw_uid;
! 353: if ((node = rbinsert(pwcache_byuid, item)) != NULL) {
! 354: pw_delref_item(node->data);
! 355: node->data = item;
! 356: }
! 357: } else {
! 358: /* Store by name, overwriting cached version. */
! 359: item->k.name = pw->pw_name;
! 360: if ((node = rbinsert(pwcache_byname, item)) != NULL) {
! 361: pw_delref_item(node->data);
! 362: node->data = item;
! 363: }
! 364: }
! 365: }
! 366: item->refcnt++;
! 367: return pw;
! 368: }
! 369:
! 370: /*
! 371: * Take a uid in string form "#123" and return a faked up passwd struct.
! 372: */
! 373: struct passwd *
! 374: sudo_fakepwnam(const char *user, gid_t gid)
! 375: {
! 376: uid_t uid;
! 377:
! 378: uid = (uid_t) atoi(user + 1);
! 379: return sudo_fakepwnamid(user, uid, gid);
! 380: }
! 381:
! 382: void
! 383: sudo_setpwent(void)
! 384: {
! 385: setpwent();
! 386: if (pwcache_byuid == NULL)
! 387: pwcache_byuid = rbcreate(cmp_pwuid);
! 388: if (pwcache_byname == NULL)
! 389: pwcache_byname = rbcreate(cmp_pwnam);
! 390: }
! 391:
! 392: void
! 393: sudo_freepwcache(void)
! 394: {
! 395: if (pwcache_byuid != NULL) {
! 396: rbdestroy(pwcache_byuid, pw_delref_item);
! 397: pwcache_byuid = NULL;
! 398: }
! 399: if (pwcache_byname != NULL) {
! 400: rbdestroy(pwcache_byname, pw_delref_item);
! 401: pwcache_byname = NULL;
! 402: }
! 403: }
! 404:
! 405: void
! 406: sudo_endpwent(void)
! 407: {
! 408: endpwent();
! 409: sudo_freepwcache();
! 410: }
! 411:
! 412: /*
! 413: * Compare by gid.
! 414: */
! 415: static int
! 416: cmp_grgid(const void *v1, const void *v2)
! 417: {
! 418: const struct cache_item *ci1 = (const struct cache_item *) v1;
! 419: const struct cache_item *ci2 = (const struct cache_item *) v2;
! 420: return ci1->k.gid - ci2->k.gid;
! 421: }
! 422:
! 423: /*
! 424: * Dynamically allocate space for a struct item plus the key and data
! 425: * elements. If name is non-NULL it is used as the key, else the
! 426: * gid is the key. Fills in datum from struct group.
! 427: */
! 428: static struct cache_item *
! 429: make_gritem(const struct group *gr, const char *name)
! 430: {
! 431: char *cp;
! 432: size_t nsize, psize, nmem, total, len;
! 433: struct cache_item *item;
! 434: struct group *newgr;
! 435:
! 436: /* Allocate in one big chunk for easy freeing. */
! 437: nsize = psize = nmem = 0;
! 438: total = sizeof(struct cache_item) + sizeof(struct group);
! 439: FIELD_SIZE(gr, gr_name, nsize);
! 440: FIELD_SIZE(gr, gr_passwd, psize);
! 441: if (gr->gr_mem) {
! 442: for (nmem = 0; gr->gr_mem[nmem] != NULL; nmem++)
! 443: total += strlen(gr->gr_mem[nmem]) + 1;
! 444: nmem++;
! 445: total += sizeof(char *) * nmem;
! 446: }
! 447: if (name != NULL)
! 448: total += strlen(name) + 1;
! 449:
! 450: item = emalloc(total);
! 451: cp = (char *) item + sizeof(struct cache_item);
! 452:
! 453: /*
! 454: * Copy in group contents and make strings relative to space
! 455: * at the end of the buffer. Note that gr_mem must come
! 456: * immediately after struct group to guarantee proper alignment.
! 457: */
! 458: newgr = (struct group *)cp;
! 459: memcpy(newgr, gr, sizeof(struct group));
! 460: cp += sizeof(struct group);
! 461: if (gr->gr_mem) {
! 462: newgr->gr_mem = (char **)cp;
! 463: cp += sizeof(char *) * nmem;
! 464: for (nmem = 0; gr->gr_mem[nmem] != NULL; nmem++) {
! 465: len = strlen(gr->gr_mem[nmem]) + 1;
! 466: memcpy(cp, gr->gr_mem[nmem], len);
! 467: newgr->gr_mem[nmem] = cp;
! 468: cp += len;
! 469: }
! 470: newgr->gr_mem[nmem] = NULL;
! 471: }
! 472: FIELD_COPY(gr, newgr, gr_passwd, psize);
! 473: FIELD_COPY(gr, newgr, gr_name, nsize);
! 474:
! 475: /* Set key and datum. */
! 476: if (name != NULL) {
! 477: memcpy(cp, name, strlen(name) + 1);
! 478: item->k.name = cp;
! 479: } else {
! 480: item->k.gid = gr->gr_gid;
! 481: }
! 482: item->d.gr = newgr;
! 483: item->refcnt = 1;
! 484:
! 485: return item;
! 486: }
! 487:
! 488: #ifdef HAVE_UTMPX_H
! 489: # define GROUPNAME_LEN (sizeof((struct utmpx *)0)->ut_user + 1)
! 490: #else
! 491: # ifdef HAVE_STRUCT_UTMP_UT_USER
! 492: # define GROUPNAME_LEN (sizeof((struct utmp *)0)->ut_user + 1)
! 493: # else
! 494: # define GROUPNAME_LEN (sizeof((struct utmp *)0)->ut_name + 1)
! 495: # endif
! 496: #endif /* HAVE_UTMPX_H */
! 497:
! 498: /*
! 499: * Dynamically allocate space for a struct item plus the key and data
! 500: * elements. Fills in datum from the groups and gids arrays.
! 501: */
! 502: static struct cache_item *
! 503: make_grlist_item(const char *user, GETGROUPS_T *gids, int ngids)
! 504: {
! 505: char *cp;
! 506: size_t i, nsize, ngroups, total, len;
! 507: struct cache_item *item;
! 508: struct group_list *grlist;
! 509: struct group *grp;
! 510:
! 511: #ifdef HAVE_SETAUTHDB
! 512: aix_setauthdb((char *) user);
! 513: #endif
! 514:
! 515: /* Allocate in one big chunk for easy freeing. */
! 516: nsize = strlen(user) + 1;
! 517: total = sizeof(struct cache_item) + sizeof(struct group_list) + nsize;
! 518: total += sizeof(char *) * ngids;
! 519: total += sizeof(gid_t *) * ngids;
! 520: total += GROUPNAME_LEN * ngids;
! 521:
! 522: again:
! 523: item = emalloc(total);
! 524: cp = (char *) item + sizeof(struct cache_item);
! 525:
! 526: /*
! 527: * Copy in group list and make pointers relative to space
! 528: * at the end of the buffer. Note that the groups array must come
! 529: * immediately after struct group to guarantee proper alignment.
! 530: */
! 531: grlist = (struct group_list *)cp;
! 532: zero_bytes(grlist, sizeof(struct group_list));
! 533: cp += sizeof(struct group_list);
! 534: grlist->groups = (char **)cp;
! 535: cp += sizeof(char *) * ngids;
! 536: grlist->gids = (gid_t *)cp;
! 537: cp += sizeof(gid_t) * ngids;
! 538:
! 539: /* Set key and datum. */
! 540: memcpy(cp, user, nsize);
! 541: item->k.name = cp;
! 542: item->d.grlist = grlist;
! 543: item->refcnt = 1;
! 544: cp += nsize;
! 545:
! 546: /*
! 547: * Store group IDs.
! 548: */
! 549: for (i = 0; i < ngids; i++)
! 550: grlist->gids[i] = gids[i];
! 551: grlist->ngids = ngids;
! 552:
! 553: /*
! 554: * Resolve and store group names by ID.
! 555: */
! 556: ngroups = 0;
! 557: for (i = 0; i < ngids; i++) {
! 558: if ((grp = sudo_getgrgid(gids[i])) != NULL) {
! 559: len = strlen(grp->gr_name) + 1;
! 560: if (cp - (char *)item + len > total) {
! 561: total += len + GROUPNAME_LEN;
! 562: efree(item);
! 563: gr_delref(grp);
! 564: goto again;
! 565: }
! 566: memcpy(cp, grp->gr_name, len);
! 567: grlist->groups[ngroups++] = cp;
! 568: cp += len;
! 569: gr_delref(grp);
! 570: }
! 571: }
! 572: grlist->ngroups = ngroups;
! 573:
! 574: #ifdef HAVE_SETAUTHDB
! 575: aix_restoreauthdb();
! 576: #endif
! 577:
! 578: return item;
! 579: }
! 580:
! 581: void
! 582: gr_addref(struct group *gr)
! 583: {
! 584: ptr_to_item(gr)->refcnt++;
! 585: }
! 586:
! 587: static void
! 588: gr_delref_item(void *v)
! 589: {
! 590: struct cache_item *item = v;
! 591:
! 592: if (--item->refcnt == 0)
! 593: efree(item);
! 594: }
! 595:
! 596: void
! 597: gr_delref(struct group *gr)
! 598: {
! 599: gr_delref_item(ptr_to_item(gr));
! 600: }
! 601:
! 602: /*
! 603: * Get a group entry by gid and allocate space for it.
! 604: */
! 605: struct group *
! 606: sudo_getgrgid(gid_t gid)
! 607: {
! 608: struct cache_item key, *item;
! 609: struct rbnode *node;
! 610:
! 611: key.k.gid = gid;
! 612: if ((node = rbfind(grcache_bygid, &key)) != NULL) {
! 613: item = (struct cache_item *) node->data;
! 614: goto done;
! 615: }
! 616: /*
! 617: * Cache group db entry if it exists or a negative response if not.
! 618: */
! 619: if ((key.d.gr = getgrgid(gid)) != NULL) {
! 620: item = make_gritem(key.d.gr, NULL);
! 621: if (rbinsert(grcache_bygid, item) != NULL)
! 622: errorx(1, _("unable to cache gid %u (%s), already exists"),
! 623: (unsigned int) gid, key.d.gr->gr_name);
! 624: } else {
! 625: item = emalloc(sizeof(*item));
! 626: item->refcnt = 1;
! 627: item->k.gid = gid;
! 628: item->d.gr = NULL;
! 629: if (rbinsert(grcache_bygid, item) != NULL)
! 630: errorx(1, _("unable to cache gid %u, already exists"),
! 631: (unsigned int) gid);
! 632: }
! 633: done:
! 634: item->refcnt++;
! 635: return item->d.gr;
! 636: }
! 637:
! 638: /*
! 639: * Get a group entry by name and allocate space for it.
! 640: */
! 641: struct group *
! 642: sudo_getgrnam(const char *name)
! 643: {
! 644: struct cache_item key, *item;
! 645: struct rbnode *node;
! 646: size_t len;
! 647:
! 648: key.k.name = (char *) name;
! 649: if ((node = rbfind(grcache_byname, &key)) != NULL) {
! 650: item = (struct cache_item *) node->data;
! 651: goto done;
! 652: }
! 653: /*
! 654: * Cache group db entry if it exists or a negative response if not.
! 655: */
! 656: if ((key.d.gr = getgrnam(name)) != NULL) {
! 657: item = make_gritem(key.d.gr, name);
! 658: if (rbinsert(grcache_byname, item) != NULL)
! 659: errorx(1, _("unable to cache group %s, already exists"), name);
! 660: } else {
! 661: len = strlen(name) + 1;
! 662: item = emalloc(sizeof(*item) + len);
! 663: item->refcnt = 1;
! 664: item->k.name = (char *) item + sizeof(*item);
! 665: memcpy(item->k.name, name, len);
! 666: item->d.gr = NULL;
! 667: if (rbinsert(grcache_byname, item) != NULL)
! 668: errorx(1, _("unable to cache group %s, already exists"), name);
! 669: }
! 670: done:
! 671: item->refcnt++;
! 672: return item->d.gr;
! 673: }
! 674:
! 675: /*
! 676: * Take a gid in string form "#123" and return a faked up group struct.
! 677: */
! 678: struct group *
! 679: sudo_fakegrnam(const char *group)
! 680: {
! 681: struct cache_item *item;
! 682: struct group *gr;
! 683: struct rbnode *node;
! 684: size_t len, namelen;
! 685: int i;
! 686:
! 687: namelen = strlen(group);
! 688: len = sizeof(*item) + sizeof(*gr) + namelen + 1;
! 689:
! 690: for (i = 0; i < 2; i++) {
! 691: item = emalloc(len);
! 692: zero_bytes(item, sizeof(*item) + sizeof(*gr));
! 693: gr = (struct group *) ((char *)item + sizeof(*item));
! 694: gr->gr_gid = (gid_t) atoi(group + 1);
! 695: gr->gr_name = (char *)gr + sizeof(struct group);
! 696: memcpy(gr->gr_name, group, namelen + 1);
! 697:
! 698: item->refcnt = 1;
! 699: item->d.gr = gr;
! 700: if (i == 0) {
! 701: /* Store by gid, overwriting cached version. */
! 702: item->k.gid = gr->gr_gid;
! 703: if ((node = rbinsert(grcache_bygid, item)) != NULL) {
! 704: gr_delref_item(node->data);
! 705: node->data = item;
! 706: }
! 707: } else {
! 708: /* Store by name, overwriting cached version. */
! 709: item->k.name = gr->gr_name;
! 710: if ((node = rbinsert(grcache_byname, item)) != NULL) {
! 711: gr_delref_item(node->data);
! 712: node->data = item;
! 713: }
! 714: }
! 715: }
! 716: item->refcnt++;
! 717: return gr;
! 718: }
! 719:
! 720: void
! 721: grlist_addref(struct group_list *grlist)
! 722: {
! 723: ptr_to_item(grlist)->refcnt++;
! 724: }
! 725:
! 726: static void
! 727: grlist_delref_item(void *v)
! 728: {
! 729: struct cache_item *item = v;
! 730:
! 731: if (--item->refcnt == 0)
! 732: efree(item);
! 733: }
! 734:
! 735: void
! 736: grlist_delref(struct group_list *grlist)
! 737: {
! 738: grlist_delref_item(ptr_to_item(grlist));
! 739: }
! 740:
! 741: void
! 742: sudo_setgrent(void)
! 743: {
! 744: setgrent();
! 745: if (grcache_bygid == NULL)
! 746: grcache_bygid = rbcreate(cmp_grgid);
! 747: if (grcache_byname == NULL)
! 748: grcache_byname = rbcreate(cmp_grnam);
! 749: if (grlist_cache == NULL)
! 750: grlist_cache = rbcreate(cmp_grnam);
! 751: }
! 752:
! 753: void
! 754: sudo_freegrcache(void)
! 755: {
! 756: if (grcache_bygid != NULL) {
! 757: rbdestroy(grcache_bygid, gr_delref_item);
! 758: grcache_bygid = NULL;
! 759: }
! 760: if (grcache_byname != NULL) {
! 761: rbdestroy(grcache_byname, gr_delref_item);
! 762: grcache_byname = NULL;
! 763: }
! 764: if (grlist_cache != NULL) {
! 765: rbdestroy(grlist_cache, grlist_delref_item);
! 766: grlist_cache = NULL;
! 767: }
! 768: }
! 769:
! 770: void
! 771: sudo_endgrent(void)
! 772: {
! 773: endgrent();
! 774: sudo_freegrcache();
! 775: }
! 776:
! 777: struct group_list *
! 778: get_group_list(struct passwd *pw)
! 779: {
! 780: struct cache_item key, *item;
! 781: struct rbnode *node;
! 782: size_t len;
! 783: GETGROUPS_T *gids;
! 784: int ngids;
! 785:
! 786: key.k.name = pw->pw_name;
! 787: if ((node = rbfind(grlist_cache, &key)) != NULL) {
! 788: item = (struct cache_item *) node->data;
! 789: goto done;
! 790: }
! 791: /*
! 792: * Cache group db entry if it exists or a negative response if not.
! 793: */
! 794: #if defined(HAVE_SYSCONF) && defined(_SC_NGROUPS_MAX)
! 795: ngids = (int)sysconf(_SC_NGROUPS_MAX) * 2;
! 796: if (ngids < 0)
! 797: #endif
! 798: ngids = NGROUPS_MAX * 2;
! 799: gids = emalloc2(ngids, sizeof(GETGROUPS_T));
! 800: if (getgrouplist(pw->pw_name, pw->pw_gid, gids, &ngids) == -1) {
! 801: efree(gids);
! 802: gids = emalloc2(ngids, sizeof(GETGROUPS_T));
! 803: if (getgrouplist(pw->pw_name, pw->pw_gid, gids, &ngids) == -1) {
! 804: efree(gids);
! 805: return NULL;
! 806: }
! 807: }
! 808: if (ngids > 0) {
! 809: if ((item = make_grlist_item(pw->pw_name, gids, ngids)) == NULL)
! 810: errorx(1, "unable to parse group list for %s", pw->pw_name);
! 811: efree(gids);
! 812: if (rbinsert(grlist_cache, item) != NULL)
! 813: errorx(1, "unable to cache group list for %s, already exists",
! 814: pw->pw_name);
! 815: } else {
! 816: /* Should not happen. */
! 817: len = strlen(pw->pw_name) + 1;
! 818: item = emalloc(sizeof(*item) + len);
! 819: item->refcnt = 1;
! 820: item->k.name = (char *) item + sizeof(*item);
! 821: memcpy(item->k.name, pw->pw_name, len);
! 822: item->d.grlist = NULL;
! 823: if (rbinsert(grlist_cache, item) != NULL)
! 824: errorx(1, "unable to cache group list for %s, already exists",
! 825: pw->pw_name);
! 826: }
! 827: done:
! 828: item->refcnt++;
! 829: return item->d.grlist;
! 830: }
! 831:
! 832: void
! 833: set_group_list(const char *user, GETGROUPS_T *gids, int ngids)
! 834: {
! 835: struct cache_item key, *item;
! 836: struct rbnode *node;
! 837:
! 838: /*
! 839: * Cache group db entry if it doesn't already exist
! 840: */
! 841: key.k.name = (char *) user;
! 842: if ((node = rbfind(grlist_cache, &key)) == NULL) {
! 843: if ((item = make_grlist_item(user, gids, ngids)) == NULL)
! 844: errorx(1, "unable to parse group list for %s", user);
! 845: if (rbinsert(grlist_cache, item) != NULL)
! 846: errorx(1, "unable to cache group list for %s, already exists",
! 847: user);
! 848: }
! 849: }
! 850:
! 851: int
! 852: user_in_group(struct passwd *pw, const char *group)
! 853: {
! 854: struct group_list *grlist;
! 855: struct group *grp = NULL;
! 856: int i, matched = FALSE;
! 857:
! 858: if ((grlist = get_group_list(pw)) != NULL) {
! 859: /*
! 860: * If it could be a sudo-style group ID check gids first.
! 861: */
! 862: if (group[0] == '#') {
! 863: gid_t gid = atoi(group + 1);
! 864: if (gid == pw->pw_gid) {
! 865: matched = TRUE;
! 866: goto done;
! 867: }
! 868: for (i = 0; i < grlist->ngids; i++) {
! 869: if (gid == grlist->gids[i]) {
! 870: matched = TRUE;
! 871: goto done;
! 872: }
! 873: }
! 874: }
! 875:
! 876: /*
! 877: * Next check the supplementary group vector.
! 878: * It usually includes the password db group too.
! 879: */
! 880: for (i = 0; i < grlist->ngroups; i++) {
! 881: if (strcasecmp(group, grlist->groups[i]) == 0) {
! 882: matched = TRUE;
! 883: goto done;
! 884: }
! 885: }
! 886:
! 887: /* Finally check against user's primary (passwd file) group. */
! 888: if ((grp = sudo_getgrgid(pw->pw_gid)) != NULL) {
! 889: if (strcasecmp(group, grp->gr_name) == 0) {
! 890: matched = TRUE;
! 891: goto done;
! 892: }
! 893: }
! 894: done:
! 895: if (grp != NULL)
! 896: gr_delref(grp);
! 897: grlist_delref(grlist);
! 898: }
! 899: return matched;
! 900: }
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to pwutil.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / sudo / plugins / sudoers