Annotation of embedaddon/sudo/plugins/sudoers/timestamp.c, revision 1.1.1.1
1.1 misho 1: /*
2: * Copyright (c) 1993-1996,1998-2005, 2007-2013
3: * Todd C. Miller <Todd.Miller@courtesan.com>
4: *
5: * Permission to use, copy, modify, and distribute this software for any
6: * purpose with or without fee is hereby granted, provided that the above
7: * copyright notice and this permission notice appear in all copies.
8: *
9: * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10: * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11: * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12: * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13: * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14: * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15: * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16: *
17: * Sponsored in part by the Defense Advanced Research Projects
18: * Agency (DARPA) and Air Force Research Laboratory, Air Force
19: * Materiel Command, USAF, under agreement number F39502-99-1-0512.
20: */
21:
22: #include <config.h>
23:
24: #include <sys/types.h>
25: #include <sys/time.h>
26: #include <sys/stat.h>
27: #ifndef __TANDEM
28: # include <sys/file.h>
29: #endif
30: #include <stdio.h>
31: #ifdef STDC_HEADERS
32: # include <stdlib.h>
33: # include <stddef.h>
34: #else
35: # ifdef HAVE_STDLIB_H
36: # include <stdlib.h>
37: # endif
38: #endif /* STDC_HEADERS */
39: #ifdef HAVE_STRING_H
40: # include <string.h>
41: #endif /* HAVE_STRING_H */
42: #ifdef HAVE_STRINGS_H
43: # include <strings.h>
44: #endif /* HAVE_STRINGS_H */
45: #ifdef HAVE_UNISTD_H
46: # include <unistd.h>
47: #endif /* HAVE_UNISTD_H */
48: #if TIME_WITH_SYS_TIME
49: # include <time.h>
50: #endif
51: #include <errno.h>
52: #include <fcntl.h>
53: #include <signal.h>
54: #include <pwd.h>
55: #include <grp.h>
56:
57: #include "sudoers.h"
58: #include "check.h"
59:
60: static struct sudo_tty_info tty_info;
61: static char timestampdir[PATH_MAX];
62: static char timestampfile[PATH_MAX];
63:
64: /*
65: * Fills in timestampdir as well as timestampfile if using tty tickets.
66: */
67: int
68: build_timestamp(struct passwd *pw)
69: {
70: char *dirparent;
71: struct stat sb;
72: int len;
73: debug_decl(build_timestamp, SUDO_DEBUG_AUTH)
74:
75: /* Stash the tty's device, session ID and ctime for ticket comparison. */
76: if (def_tty_tickets && user_ttypath && stat(user_ttypath, &sb) == 0) {
77: tty_info.dev = sb.st_dev;
78: tty_info.ino = sb.st_ino;
79: tty_info.rdev = sb.st_rdev;
80: tty_info.uid = sb.st_uid;
81: tty_info.gid = sb.st_gid;
82: tty_info.sid = user_sid;
83: }
84:
85: dirparent = def_timestampdir;
86: timestampfile[0] = '\0';
87: len = snprintf(timestampdir, sizeof(timestampdir), "%s/%s", dirparent,
88: user_name);
89: if (len <= 0 || len >= sizeof(timestampdir))
90: goto bad;
91:
92: /*
93: * Timestamp file may be a file in the directory or NUL to use
94: * the directory as the timestamp.
95: */
96: if (def_tty_tickets) {
97: char *p;
98:
99: if ((p = strrchr(user_tty, '/')))
100: p++;
101: else
102: p = user_tty;
103: if (def_targetpw)
104: len = snprintf(timestampfile, sizeof(timestampfile), "%s/%s/%s:%s",
105: dirparent, user_name, p, runas_pw->pw_name);
106: else
107: len = snprintf(timestampfile, sizeof(timestampfile), "%s/%s/%s",
108: dirparent, user_name, p);
109: if (len <= 0 || len >= sizeof(timestampfile))
110: goto bad;
111: } else if (def_targetpw) {
112: len = snprintf(timestampfile, sizeof(timestampfile), "%s/%s/%s",
113: dirparent, user_name, runas_pw->pw_name);
114: if (len <= 0 || len >= sizeof(timestampfile))
115: goto bad;
116: }
117: sudo_debug_printf(SUDO_DEBUG_INFO, "using timestamp file %s", timestampfile);
118:
119: debug_return_int(len);
120: bad:
121: log_fatal(0, N_("timestamp path too long: %s"),
122: *timestampfile ? timestampfile : timestampdir);
123: /* NOTREACHED */
124: debug_return_int(-1);
125: }
126:
127: /*
128: * Update the time on the timestamp file/dir or create it if necessary.
129: */
130: bool
131: update_timestamp(struct passwd *pw)
132: {
133: debug_decl(update_timestamp, SUDO_DEBUG_AUTH)
134:
135: /* If using tty timestamps but we have no tty there is nothing to do. */
136: if (def_tty_tickets && !user_ttypath)
137: debug_return_bool(false);
138:
139: if (timestamp_uid != 0)
140: set_perms(PERM_TIMESTAMP);
141: if (*timestampfile) {
142: /*
143: * Store tty info in timestamp file
144: */
145: int fd = open(timestampfile, O_WRONLY|O_CREAT, 0600);
146: if (fd == -1)
147: log_warning(USE_ERRNO, N_("unable to open %s"), timestampfile);
148: else {
149: lock_file(fd, SUDO_LOCK);
150: if (write(fd, &tty_info, sizeof(tty_info)) != sizeof(tty_info))
151: log_warning(USE_ERRNO, N_("unable to write to %s"), timestampfile);
152: close(fd);
153: }
154: } else {
155: if (touch(-1, timestampdir, NULL) == -1) {
156: if (mkdir(timestampdir, 0700) == -1) {
157: log_warning(USE_ERRNO, N_("unable to mkdir %s"),
158: timestampdir);
159: }
160: }
161: }
162: if (timestamp_uid != 0)
163: restore_perms();
164: debug_return_bool(true);
165: }
166:
167: /*
168: * Check the timestamp file and directory and return their status.
169: */
170: static int
171: timestamp_status_internal(bool removing)
172: {
173: struct stat sb;
174: struct timeval boottime, mtime;
175: time_t now;
176: char *dirparent = def_timestampdir;
177: int status = TS_ERROR; /* assume the worst */
178: debug_decl(timestamp_status_internal, SUDO_DEBUG_AUTH)
179:
180: if (timestamp_uid != 0)
181: set_perms(PERM_TIMESTAMP);
182:
183: /*
184: * Sanity check dirparent and make it if it doesn't already exist.
185: * We start out assuming the worst (that the dir is not sane) and
186: * if it is ok upgrade the status to ``no timestamp file''.
187: * Note that we don't check the parent(s) of dirparent for
188: * sanity since the sudo dir is often just located in /tmp.
189: */
190: if (lstat(dirparent, &sb) == 0) {
191: if (!S_ISDIR(sb.st_mode))
192: log_warning(0, N_("%s exists but is not a directory (0%o)"),
193: dirparent, (unsigned int) sb.st_mode);
194: else if (sb.st_uid != timestamp_uid)
195: log_warning(0, N_("%s owned by uid %u, should be uid %u"),
196: dirparent, (unsigned int) sb.st_uid,
197: (unsigned int) timestamp_uid);
198: else if ((sb.st_mode & 0000022))
199: log_warning(0,
200: N_("%s writable by non-owner (0%o), should be mode 0700"),
201: dirparent, (unsigned int) sb.st_mode);
202: else {
203: if ((sb.st_mode & 0000777) != 0700)
204: (void) chmod(dirparent, 0700);
205: status = TS_MISSING;
206: }
207: } else if (errno != ENOENT) {
208: log_warning(USE_ERRNO, N_("unable to stat %s"), dirparent);
209: } else {
210: /* No dirparent, try to make one. */
211: if (!removing) {
212: if (mkdir(dirparent, S_IRWXU))
213: log_warning(USE_ERRNO, N_("unable to mkdir %s"),
214: dirparent);
215: else
216: status = TS_MISSING;
217: }
218: }
219: if (status == TS_ERROR)
220: goto done;
221:
222: /*
223: * Sanity check the user's ticket dir. We start by downgrading
224: * the status to TS_ERROR. If the ticket dir exists and is sane
225: * this will be upgraded to TS_OLD. If the dir does not exist,
226: * it will be upgraded to TS_MISSING.
227: */
228: status = TS_ERROR; /* downgrade status again */
229: if (lstat(timestampdir, &sb) == 0) {
230: if (!S_ISDIR(sb.st_mode)) {
231: if (S_ISREG(sb.st_mode)) {
232: /* convert from old style */
233: if (unlink(timestampdir) == 0)
234: status = TS_MISSING;
235: } else
236: log_warning(0, N_("%s exists but is not a directory (0%o)"),
237: timestampdir, (unsigned int) sb.st_mode);
238: } else if (sb.st_uid != timestamp_uid)
239: log_warning(0, N_("%s owned by uid %u, should be uid %u"),
240: timestampdir, (unsigned int) sb.st_uid,
241: (unsigned int) timestamp_uid);
242: else if ((sb.st_mode & 0000022))
243: log_warning(0,
244: N_("%s writable by non-owner (0%o), should be mode 0700"),
245: timestampdir, (unsigned int) sb.st_mode);
246: else {
247: if ((sb.st_mode & 0000777) != 0700)
248: (void) chmod(timestampdir, 0700);
249: status = TS_OLD; /* do date check later */
250: }
251: } else if (errno != ENOENT) {
252: log_warning(USE_ERRNO, N_("unable to stat %s"), timestampdir);
253: } else
254: status = TS_MISSING;
255:
256: /*
257: * If there is no user ticket dir, AND we are in tty ticket mode,
258: * AND we are not just going to remove it, create the user ticket dir.
259: */
260: if (status == TS_MISSING && *timestampfile && !removing) {
261: if (mkdir(timestampdir, S_IRWXU) == -1) {
262: status = TS_ERROR;
263: log_warning(USE_ERRNO, N_("unable to mkdir %s"), timestampdir);
264: }
265: }
266:
267: /*
268: * Sanity check the tty ticket file if it exists.
269: */
270: if (*timestampfile && status != TS_ERROR) {
271: if (status != TS_MISSING)
272: status = TS_NOFILE; /* dir there, file missing */
273: if (def_tty_tickets && !user_ttypath)
274: goto done; /* no tty, always prompt */
275: if (lstat(timestampfile, &sb) == 0) {
276: if (!S_ISREG(sb.st_mode)) {
277: status = TS_ERROR;
278: log_warning(0, N_("%s exists but is not a regular file (0%o)"),
279: timestampfile, (unsigned int) sb.st_mode);
280: } else {
281: /* If bad uid or file mode, complain and kill the bogus file. */
282: if (sb.st_uid != timestamp_uid) {
283: log_warning(0,
284: N_("%s owned by uid %u, should be uid %u"),
285: timestampfile, (unsigned int) sb.st_uid,
286: (unsigned int) timestamp_uid);
287: (void) unlink(timestampfile);
288: } else if ((sb.st_mode & 0000022)) {
289: log_warning(0,
290: N_("%s writable by non-owner (0%o), should be mode 0600"),
291: timestampfile, (unsigned int) sb.st_mode);
292: (void) unlink(timestampfile);
293: } else {
294: /* If not mode 0600, fix it. */
295: if ((sb.st_mode & 0000777) != 0600)
296: (void) chmod(timestampfile, 0600);
297:
298: /*
299: * Check for stored tty info. If the file is zero-sized
300: * it is an old-style timestamp with no tty info in it.
301: * If removing, we don't care about the contents.
302: * The actual mtime check is done later.
303: */
304: if (removing) {
305: status = TS_OLD;
306: } else if (sb.st_size != 0) {
307: struct sudo_tty_info info;
308: int fd = open(timestampfile, O_RDONLY, 0644);
309: if (fd != -1) {
310: if (read(fd, &info, sizeof(info)) == sizeof(info) &&
311: memcmp(&info, &tty_info, sizeof(info)) == 0) {
312: status = TS_OLD;
313: }
314: close(fd);
315: }
316: }
317: }
318: }
319: } else if (errno != ENOENT) {
320: log_warning(USE_ERRNO, N_("unable to stat %s"), timestampfile);
321: status = TS_ERROR;
322: }
323: }
324:
325: /*
326: * If the file/dir exists and we are not removing it, check its mtime.
327: */
328: if (status == TS_OLD && !removing) {
329: mtim_get(&sb, &mtime);
330: if (timevalisset(&mtime)) {
331: /* Negative timeouts only expire manually (sudo -k). */
332: if (def_timestamp_timeout < 0) {
333: status = TS_CURRENT;
334: } else {
335: time(&now);
336: if (def_timestamp_timeout &&
337: now - mtime.tv_sec < 60 * def_timestamp_timeout) {
338: /*
339: * Check for bogus time on the stampfile. The clock may
340: * have been set back or user could be trying to spoof us.
341: */
342: if (mtime.tv_sec > now + 60 * def_timestamp_timeout * 2) {
343: time_t tv_sec = (time_t)mtime.tv_sec;
344: log_warning(0,
345: N_("timestamp too far in the future: %20.20s"),
346: 4 + ctime(&tv_sec));
347: if (*timestampfile)
348: (void) unlink(timestampfile);
349: else
350: (void) rmdir(timestampdir);
351: status = TS_MISSING;
352: } else if (get_boottime(&boottime) &&
353: timevalcmp(&mtime, &boottime, <)) {
354: status = TS_OLD;
355: } else {
356: status = TS_CURRENT;
357: }
358: }
359: }
360: }
361: }
362:
363: done:
364: if (timestamp_uid != 0)
365: restore_perms();
366: debug_return_int(status);
367: }
368:
369: int
370: timestamp_status(struct passwd *pw)
371: {
372: return timestamp_status_internal(false);
373: }
374:
375: /*
376: * Remove the timestamp ticket file/dir.
377: */
378: void
379: remove_timestamp(bool remove)
380: {
381: struct timeval tv;
382: char *path;
383: int status;
384: debug_decl(remove_timestamp, SUDO_DEBUG_AUTH)
385:
386: if (build_timestamp(NULL) == -1)
387: debug_return;
388:
389: status = timestamp_status_internal(true);
390: if (status != TS_MISSING && status != TS_ERROR) {
391: path = *timestampfile ? timestampfile : timestampdir;
392: if (remove) {
393: if (*timestampfile)
394: status = unlink(timestampfile);
395: else
396: status = rmdir(timestampdir);
397: if (status == -1 && errno != ENOENT) {
398: log_warning(0,
399: N_("unable to remove %s, will reset to the epoch"), path);
400: remove = false;
401: }
402: }
403: if (!remove) {
404: timevalclear(&tv);
405: if (touch(-1, path, &tv) == -1 && errno != ENOENT)
406: fatal(_("unable to reset %s to the epoch"), path);
407: }
408: }
409:
410: debug_return;
411: }
412:
413: /*
414: * Lecture status is currently implied by the timestamp status but
415: * may be stored separately in a future release.
416: */
417: bool
418: set_lectured(void)
419: {
420: return true;
421: }
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to timestamp.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / sudo / plugins / sudoers