2007-10-07 17:14:02 +05:30
|
|
|
/*
|
2008-04-27 06:10:09 +05:30
|
|
|
* Copyright (c) 1990 - 1994, Julianne Frances Haugh
|
|
|
|
* Copyright (c) 1996 - 2000, Marek Michałkiewicz
|
|
|
|
* Copyright (c) 2001 - 2006, Tomasz Kłoczko
|
|
|
|
* Copyright (c) 2007 - 2008, Nicolas François
|
2007-10-07 17:14:02 +05:30
|
|
|
* All rights reserved.
|
|
|
|
*
|
|
|
|
* Redistribution and use in source and binary forms, with or without
|
|
|
|
* modification, are permitted provided that the following conditions
|
|
|
|
* are met:
|
|
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer.
|
|
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
|
|
* documentation and/or other materials provided with the distribution.
|
2008-04-27 06:10:09 +05:30
|
|
|
* 3. The name of the copyright holders or contributors may not be used to
|
|
|
|
* endorse or promote products derived from this software without
|
|
|
|
* specific prior written permission.
|
2007-10-07 17:14:02 +05:30
|
|
|
*
|
2008-04-27 06:10:09 +05:30
|
|
|
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
|
|
|
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
|
|
|
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
|
|
|
|
* PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
|
|
|
* HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
|
|
|
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
|
|
|
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
|
|
|
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
|
|
|
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
|
|
|
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
|
|
|
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
|
|
|
|
|
|
|
#include <config.h>
|
|
|
|
|
2007-11-11 05:16:11 +05:30
|
|
|
#ident "$Id$"
|
2007-10-07 17:17:01 +05:30
|
|
|
|
2007-10-07 17:14:02 +05:30
|
|
|
#include <errno.h>
|
|
|
|
#include <grp.h>
|
|
|
|
#include <pwd.h>
|
2007-10-07 17:17:01 +05:30
|
|
|
#include <stdio.h>
|
2009-04-23 16:47:22 +05:30
|
|
|
#include <assert.h>
|
2007-10-07 17:14:02 +05:30
|
|
|
#include "defines.h"
|
|
|
|
#include "getdef.h"
|
2007-10-07 17:17:01 +05:30
|
|
|
#include "prototypes.h"
|
* src/newgrp.c, src/chfn.c, src/groupmems.c, src/usermod.c,
src/userdel.c, src/chpasswd.c, src/grpck.c, src/gpasswd.c,
src/groupdel.c, src/chgpasswd.c, src/vipw.c, src/useradd.c,
src/su.c, src/groupmod.c, src/passwd.c, src/pwck.c,
src/groupadd.c, src/chage.c, src/login.c, src/faillog.c,
src/sulogin.c, src/chsh.c, src/pwconv.c: Added splint annotations.
* src/userdel.c, src/pwconv.c, src/lastlog.c, src/grpck.c,
src/vipw.c, src/groupmod.c, src/passwd.c, src/pwck.c, src/login.c,
src/sulogin.c, src/usermod.c: Use return instead of exit at the
end of main().
* src/gpasswd.c, src/passwd.c, src/faillog.c: Use the exitcodes.h
exit codes.
* src/chpasswd.c: Added missing ||.
* src/nologin.c: Do not include exitcodes.h.
* src/nologin.c: Added brackets.
* src/nologin.c: Avoid assignments in comparisons.
2009-05-01 03:09:38 +05:30
|
|
|
/*@-exitarg@*/
|
2007-10-07 17:17:22 +05:30
|
|
|
#include "exitcodes.h"
|
* src/newgrp.c, src/chfn.c, src/groupmems.c, src/usermod.c,
src/userdel.c, src/chpasswd.c, src/grpck.c, src/gpasswd.c,
src/groupdel.c, src/chgpasswd.c, src/vipw.c, src/useradd.c,
src/su.c, src/groupmod.c, src/passwd.c, src/pwck.c,
src/groupadd.c, src/chage.c, src/login.c, src/faillog.c,
src/sulogin.c, src/chsh.c, src/pwconv.c: Added splint annotations.
* src/userdel.c, src/pwconv.c, src/lastlog.c, src/grpck.c,
src/vipw.c, src/groupmod.c, src/passwd.c, src/pwck.c, src/login.c,
src/sulogin.c, src/usermod.c: Use return instead of exit at the
end of main().
* src/gpasswd.c, src/passwd.c, src/faillog.c: Use the exitcodes.h
exit codes.
* src/chpasswd.c: Added missing ||.
* src/nologin.c: Do not include exitcodes.h.
* src/nologin.c: Added brackets.
* src/nologin.c: Avoid assignments in comparisons.
2009-05-01 03:09:38 +05:30
|
|
|
|
2007-10-07 17:17:01 +05:30
|
|
|
/*
|
|
|
|
* Global variables
|
|
|
|
*/
|
* src/newgrp.c, src/userdel.c, src/grpck.c, src/gpasswd.c,
src/newusers.c, src/pwconv.c, src/chpasswd.c, src/logoutd.c,
src/chfn.c, src/groupmems.c, src/usermod.c, src/pwunconv.c,
src/expiry.c, src/groupdel.c, src/chgpasswd.c, src/useradd.c,
src/su.c, src/groupmod.c, src/passwd.c, src/pwck.c,
src/groupadd.c, src/chage.c, src/login.c, src/grpconv.c,
src/groups.c, src/grpunconv.c, src/chsh.c: Prog is now global (not
static to the file) so that it can be used by the helper functions
of libmisc.
* lib/prototypes.h: Added extern char *Prog.
* libmisc/find_new_gid.c, libmisc/find_new_uid.c: Indicate the
program name with the warning.
2008-09-06 18:21:53 +05:30
|
|
|
char *Prog;
|
|
|
|
|
2007-10-07 17:17:22 +05:30
|
|
|
extern char **newenvp;
|
2007-10-07 17:14:02 +05:30
|
|
|
extern char **environ;
|
|
|
|
|
|
|
|
#ifdef HAVE_SETGROUPS
|
|
|
|
static int ngroups;
|
2009-04-24 02:07:00 +05:30
|
|
|
static /*@null@*/ /*@only@*/GETGROUPS_T *grouplist;
|
2007-10-07 17:14:02 +05:30
|
|
|
#endif
|
|
|
|
|
2008-06-09 23:53:23 +05:30
|
|
|
static bool is_newgrp;
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2008-04-17 03:34:46 +05:30
|
|
|
#ifdef WITH_AUDIT
|
2009-04-24 02:07:00 +05:30
|
|
|
static char audit_buf[80];
|
2008-04-17 03:34:46 +05:30
|
|
|
#endif
|
|
|
|
|
2007-10-07 17:14:02 +05:30
|
|
|
/* local function prototypes */
|
2007-10-07 17:14:59 +05:30
|
|
|
static void usage (void);
|
2008-01-02 05:05:55 +05:30
|
|
|
static void check_perms (const struct group *grp,
|
|
|
|
struct passwd *pwd,
|
|
|
|
const char *groupname);
|
2008-01-06 18:01:06 +05:30
|
|
|
static void syslog_sg (const char *name, const char *group);
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
/*
|
|
|
|
* usage - print command usage message
|
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
static void usage (void)
|
2007-10-07 17:14:02 +05:30
|
|
|
{
|
2008-06-09 23:53:23 +05:30
|
|
|
if (is_newgrp) {
|
2009-04-24 02:07:00 +05:30
|
|
|
(void) fputs (_("Usage: newgrp [-] [group]\n"), stderr);
|
2008-06-09 23:53:23 +05:30
|
|
|
} else {
|
2009-04-24 02:07:00 +05:30
|
|
|
(void) fputs (_("Usage: sg group [[-c] command]\n"), stderr);
|
2008-06-09 23:53:23 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
2007-10-07 17:16:34 +05:30
|
|
|
/*
|
|
|
|
* find_matching_group - search all groups of a given group id for
|
|
|
|
* membership of a given username
|
|
|
|
*/
|
2009-04-24 02:07:00 +05:30
|
|
|
static /*@null@*/struct group *find_matching_group (const char *name, gid_t gid)
|
2007-10-07 17:16:34 +05:30
|
|
|
{
|
|
|
|
struct group *gr;
|
|
|
|
char **look;
|
2008-06-09 23:53:23 +05:30
|
|
|
bool notfound = true;
|
2007-10-07 17:16:34 +05:30
|
|
|
|
|
|
|
setgrent ();
|
|
|
|
while ((gr = getgrent ()) != NULL) {
|
|
|
|
if (gr->gr_gid != gid) {
|
|
|
|
continue;
|
|
|
|
}
|
2007-10-07 17:17:01 +05:30
|
|
|
|
2007-10-07 17:16:34 +05:30
|
|
|
/*
|
|
|
|
* A group with matching GID was found.
|
|
|
|
* Test for membership of 'name'.
|
|
|
|
*/
|
|
|
|
look = gr->gr_mem;
|
2008-06-09 23:53:23 +05:30
|
|
|
while ((NULL != *look) && notfound) {
|
|
|
|
notfound = (strcmp (*look, name) != 0);
|
|
|
|
look++;
|
|
|
|
}
|
|
|
|
if (!notfound) {
|
2007-10-07 17:16:34 +05:30
|
|
|
break;
|
2008-06-09 23:53:23 +05:30
|
|
|
}
|
2007-10-07 17:16:34 +05:30
|
|
|
}
|
|
|
|
endgrent ();
|
|
|
|
return gr;
|
|
|
|
}
|
|
|
|
|
2008-01-02 05:05:55 +05:30
|
|
|
/*
|
|
|
|
* check_perms - check if the user is allowed to switch to this group
|
|
|
|
*
|
|
|
|
* If needed, the user will be authenticated.
|
|
|
|
*
|
|
|
|
* It will not return if the user could not be authenticated.
|
|
|
|
*/
|
|
|
|
static void check_perms (const struct group *grp,
|
|
|
|
struct passwd *pwd,
|
|
|
|
const char *groupname)
|
|
|
|
{
|
2008-06-09 23:53:23 +05:30
|
|
|
bool needspasswd = false;
|
2008-01-02 05:05:55 +05:30
|
|
|
struct spwd *spwd;
|
|
|
|
char *cp;
|
|
|
|
const char *cpasswd;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* see if she is a member of this group (i.e. in the list of
|
|
|
|
* members of the group, or if the group is her primary group).
|
|
|
|
*
|
|
|
|
* If she isn't a member, she needs to provide the group password.
|
|
|
|
* If there is no group password, she will be denied access
|
|
|
|
* anyway.
|
|
|
|
*
|
|
|
|
*/
|
2008-06-09 23:53:23 +05:30
|
|
|
if ( (grp->gr_gid != pwd->pw_gid)
|
|
|
|
&& !is_on_list (grp->gr_mem, pwd->pw_name)) {
|
|
|
|
needspasswd = true;
|
|
|
|
}
|
2008-01-02 05:05:55 +05:30
|
|
|
|
|
|
|
/*
|
|
|
|
* If she does not have either a shadowed password, or a regular
|
|
|
|
* password, and the group has a password, she needs to give the
|
|
|
|
* group password.
|
|
|
|
*/
|
|
|
|
spwd = xgetspnam (pwd->pw_name);
|
2008-06-09 23:53:23 +05:30
|
|
|
if (NULL != spwd) {
|
2008-01-02 05:05:55 +05:30
|
|
|
pwd->pw_passwd = spwd->sp_pwdp;
|
2008-06-09 23:53:23 +05:30
|
|
|
}
|
2008-01-02 05:05:55 +05:30
|
|
|
|
2008-06-09 23:53:23 +05:30
|
|
|
if ((pwd->pw_passwd[0] == '\0') && (grp->gr_passwd[0] != '\0')) {
|
|
|
|
needspasswd = true;
|
|
|
|
}
|
2008-01-02 05:05:55 +05:30
|
|
|
|
|
|
|
/*
|
|
|
|
* Now I see about letting her into the group she requested. If she
|
|
|
|
* is the root user, I'll let her in without having to prompt for
|
|
|
|
* the password. Otherwise I ask for a password if she flunked one
|
|
|
|
* of the tests above.
|
|
|
|
*/
|
2008-06-09 23:53:23 +05:30
|
|
|
if ((getuid () != 0) && needspasswd) {
|
2008-01-02 05:05:55 +05:30
|
|
|
/*
|
|
|
|
* get the password from her, and set the salt for
|
|
|
|
* the decryption from the group file.
|
|
|
|
*/
|
|
|
|
cp = getpass (_("Password: "));
|
2008-06-09 23:53:23 +05:30
|
|
|
if (NULL == cp) {
|
2008-01-02 05:05:55 +05:30
|
|
|
goto failure;
|
2008-06-09 23:53:23 +05:30
|
|
|
}
|
2008-01-02 05:05:55 +05:30
|
|
|
|
|
|
|
/*
|
|
|
|
* encrypt the key she gave us using the salt from the
|
|
|
|
* password in the group file. The result of this encryption
|
|
|
|
* must match the previously encrypted value in the file.
|
|
|
|
*/
|
|
|
|
cpasswd = pw_encrypt (cp, grp->gr_passwd);
|
|
|
|
strzero (cp);
|
|
|
|
|
|
|
|
if (grp->gr_passwd[0] == '\0' ||
|
|
|
|
strcmp (cpasswd, grp->gr_passwd) != 0) {
|
2008-03-08 01:51:15 +05:30
|
|
|
#ifdef WITH_AUDIT
|
|
|
|
snprintf (audit_buf, sizeof(audit_buf),
|
2008-06-14 01:51:24 +05:30
|
|
|
"authentication new-gid=%lu",
|
|
|
|
(unsigned long) grp->gr_gid);
|
2008-03-08 01:51:15 +05:30
|
|
|
audit_logger (AUDIT_GRP_AUTH, Prog,
|
2008-06-14 01:51:24 +05:30
|
|
|
audit_buf, NULL,
|
|
|
|
(unsigned int) getuid (), 0);
|
2008-03-08 01:51:15 +05:30
|
|
|
#endif
|
2008-01-02 05:05:55 +05:30
|
|
|
SYSLOG ((LOG_INFO,
|
* src/chfn.c, src/chsh.c, src/groupdel.c, src/groupmems.c,
src/groupmod.c, src/grpck.c, src/login.c, src/logoutd.c,
src/newgrp.c, src/newusers.c, src/passwd.c, src/pwck.c,
src/suauth.c, src/useradd.c, src/userdel.c, src/usermod.c,
src/vipw.c: Complete the switch from the `' quotation style to ''.
Do it also in SYSLOG messages. Quote some parameters. All this
permits to merge some messages.
2008-08-06 21:21:52 +05:30
|
|
|
"Invalid password for group '%s' from '%s'",
|
2008-01-02 05:05:55 +05:30
|
|
|
groupname, pwd->pw_name));
|
2009-04-24 02:07:00 +05:30
|
|
|
(void) sleep (1);
|
|
|
|
(void) fputs (_("Invalid password.\n"), stderr);
|
2008-01-02 05:05:55 +05:30
|
|
|
goto failure;
|
|
|
|
}
|
2008-03-08 01:51:15 +05:30
|
|
|
#ifdef WITH_AUDIT
|
|
|
|
snprintf (audit_buf, sizeof(audit_buf),
|
2008-06-14 01:51:24 +05:30
|
|
|
"authentication new-gid=%lu",
|
|
|
|
(unsigned long) grp->gr_gid);
|
2008-03-08 01:51:15 +05:30
|
|
|
audit_logger (AUDIT_GRP_AUTH, Prog,
|
2008-06-14 01:51:24 +05:30
|
|
|
audit_buf, NULL,
|
|
|
|
(unsigned int) getuid (), 1);
|
2008-03-08 01:51:15 +05:30
|
|
|
#endif
|
2008-01-02 05:05:55 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
return;
|
|
|
|
|
|
|
|
failure:
|
|
|
|
/* The closelog is probably unnecessary, but it does no
|
|
|
|
* harm. -- JWP
|
|
|
|
*/
|
|
|
|
closelog ();
|
|
|
|
#ifdef WITH_AUDIT
|
2008-02-15 00:21:37 +05:30
|
|
|
if (groupname) {
|
|
|
|
snprintf (audit_buf, sizeof(audit_buf),
|
|
|
|
"changing new-group=%s", groupname);
|
|
|
|
audit_logger (AUDIT_CHGRP_ID, Prog,
|
2008-06-14 01:51:24 +05:30
|
|
|
audit_buf, NULL,
|
|
|
|
(unsigned int) getuid (), 0);
|
2008-02-15 00:21:37 +05:30
|
|
|
} else {
|
2008-06-14 01:51:24 +05:30
|
|
|
audit_logger (AUDIT_CHGRP_ID, Prog,
|
|
|
|
"changing", NULL,
|
|
|
|
(unsigned int) getuid (), 0);
|
2008-02-15 00:21:37 +05:30
|
|
|
}
|
2008-01-02 05:05:55 +05:30
|
|
|
#endif
|
2009-04-24 02:07:00 +05:30
|
|
|
exit (EXIT_FAILURE);
|
2008-01-02 05:05:55 +05:30
|
|
|
}
|
|
|
|
|
2008-01-02 05:24:51 +05:30
|
|
|
#ifdef USE_SYSLOG
|
|
|
|
/*
|
|
|
|
* syslog_sg - log the change of group to syslog
|
|
|
|
*
|
|
|
|
* The loggout will also be logged when the user will quit the
|
|
|
|
* sg/newgrp session.
|
|
|
|
*/
|
2008-01-06 18:01:06 +05:30
|
|
|
static void syslog_sg (const char *name, const char *group)
|
2008-01-02 05:24:51 +05:30
|
|
|
{
|
2008-01-06 18:01:06 +05:30
|
|
|
const char *loginname = getlogin ();
|
|
|
|
const char *tty = ttyname (0);
|
2008-01-02 05:24:51 +05:30
|
|
|
|
2008-06-09 23:53:23 +05:30
|
|
|
if (loginname != NULL) {
|
2008-01-02 05:24:51 +05:30
|
|
|
loginname = xstrdup (loginname);
|
2008-06-09 23:53:23 +05:30
|
|
|
}
|
|
|
|
if (tty != NULL) {
|
2008-01-02 05:24:51 +05:30
|
|
|
tty = xstrdup (tty);
|
2008-06-09 23:53:23 +05:30
|
|
|
}
|
2008-01-02 05:24:51 +05:30
|
|
|
|
2008-06-09 23:53:23 +05:30
|
|
|
if (loginname == NULL) {
|
2008-01-02 05:24:51 +05:30
|
|
|
loginname = "???";
|
2008-06-09 23:53:23 +05:30
|
|
|
}
|
|
|
|
if (tty == NULL) {
|
2008-01-02 05:24:51 +05:30
|
|
|
tty = "???";
|
2008-06-09 23:53:23 +05:30
|
|
|
} else if (strncmp (tty, "/dev/", 5) == 0) {
|
2008-01-02 05:24:51 +05:30
|
|
|
tty += 5;
|
2008-06-09 23:53:23 +05:30
|
|
|
}
|
2008-01-02 05:24:51 +05:30
|
|
|
SYSLOG ((LOG_INFO,
|
* src/chfn.c, src/chsh.c, src/groupdel.c, src/groupmems.c,
src/groupmod.c, src/grpck.c, src/login.c, src/logoutd.c,
src/newgrp.c, src/newusers.c, src/passwd.c, src/pwck.c,
src/suauth.c, src/useradd.c, src/userdel.c, src/usermod.c,
src/vipw.c: Complete the switch from the `' quotation style to ''.
Do it also in SYSLOG messages. Quote some parameters. All this
permits to merge some messages.
2008-08-06 21:21:52 +05:30
|
|
|
"user '%s' (login '%s' on %s) switched to group '%s'",
|
2008-01-02 05:24:51 +05:30
|
|
|
name, loginname, tty, group));
|
|
|
|
#ifdef USE_PAM
|
|
|
|
/*
|
|
|
|
* We want to fork and exec the new shell in the child, leaving the
|
|
|
|
* parent waiting to log the session close.
|
|
|
|
*
|
|
|
|
* The parent must ignore signals generated from the console
|
|
|
|
* (SIGINT, SIGQUIT, SIGHUP) which might make the parent terminate
|
|
|
|
* before its child. When bash is exec'ed as the subshell, it
|
|
|
|
* generates a new process group id for itself, and consequently
|
|
|
|
* only SIGHUP, which is sent to all process groups in the session,
|
|
|
|
* can reach the parent. However, since arbitrary programs can be
|
|
|
|
* specified as login shells, there is no such guarantee in general.
|
|
|
|
* For the same reason, we must also ignore stop signals generated
|
|
|
|
* from the console (SIGTSTP, SIGTTIN, and SIGTTOU) in order to
|
|
|
|
* avoid any possibility of the parent being stopped when it
|
|
|
|
* receives SIGCHLD from the terminating subshell. -- JWP
|
|
|
|
*/
|
|
|
|
{
|
|
|
|
pid_t child, pid;
|
|
|
|
|
2008-06-14 01:51:24 +05:30
|
|
|
/* Ignore these signals. The signal handlers will later be
|
|
|
|
* restored to the default handlers. */
|
|
|
|
(void) signal (SIGINT, SIG_IGN);
|
|
|
|
(void) signal (SIGQUIT, SIG_IGN);
|
|
|
|
(void) signal (SIGHUP, SIG_IGN);
|
|
|
|
(void) signal (SIGTSTP, SIG_IGN);
|
|
|
|
(void) signal (SIGTTIN, SIG_IGN);
|
|
|
|
(void) signal (SIGTTOU, SIG_IGN);
|
2008-01-02 05:24:51 +05:30
|
|
|
child = fork ();
|
2008-06-14 01:51:24 +05:30
|
|
|
if ((pid_t)-1 == child) {
|
2008-01-02 05:24:51 +05:30
|
|
|
/* error in fork() */
|
2008-03-08 01:51:15 +05:30
|
|
|
fprintf (stderr, _("%s: failure forking: %s\n"),
|
2008-01-02 05:24:51 +05:30
|
|
|
is_newgrp ? "newgrp" : "sg", strerror (errno));
|
|
|
|
#ifdef WITH_AUDIT
|
2008-02-15 00:05:51 +05:30
|
|
|
if (group) {
|
|
|
|
snprintf (audit_buf, sizeof(audit_buf),
|
|
|
|
"changing new-group=%s", group);
|
|
|
|
audit_logger (AUDIT_CHGRP_ID, Prog,
|
2008-06-14 01:51:24 +05:30
|
|
|
audit_buf, NULL,
|
|
|
|
(unsigned int) getuid (), 0);
|
2008-02-15 00:05:51 +05:30
|
|
|
} else {
|
2008-06-14 01:51:24 +05:30
|
|
|
audit_logger (AUDIT_CHGRP_ID, Prog,
|
|
|
|
"changing", NULL,
|
|
|
|
(unsigned int) getuid (), 0);
|
2008-02-15 00:05:51 +05:30
|
|
|
}
|
2008-01-02 05:24:51 +05:30
|
|
|
#endif
|
2009-04-24 02:07:00 +05:30
|
|
|
exit (EXIT_FAILURE);
|
2008-06-09 23:53:23 +05:30
|
|
|
} else if (child != 0) {
|
2008-01-02 05:24:51 +05:30
|
|
|
/* parent - wait for child to finish, then log session close */
|
|
|
|
int cst = 0;
|
2008-01-22 05:03:43 +05:30
|
|
|
gid_t gid = getgid();
|
|
|
|
struct group *grp = getgrgid (gid);
|
2008-01-02 05:24:51 +05:30
|
|
|
|
|
|
|
do {
|
|
|
|
errno = 0;
|
|
|
|
pid = waitpid (child, &cst, WUNTRACED);
|
2008-06-09 23:53:23 +05:30
|
|
|
if ((pid == child) && (WIFSTOPPED (cst) != 0)) {
|
2008-01-02 05:24:51 +05:30
|
|
|
/* stop when child stops */
|
2008-05-18 22:08:13 +05:30
|
|
|
kill (getpid (), WSTOPSIG(cst));
|
2008-01-02 05:24:51 +05:30
|
|
|
/* wake child when resumed */
|
|
|
|
kill (child, SIGCONT);
|
|
|
|
}
|
2008-06-09 23:53:23 +05:30
|
|
|
} while ( ((pid == child) && (WIFSTOPPED (cst) != 0))
|
|
|
|
|| ((pid != child) && (errno == EINTR)));
|
2008-01-02 05:24:51 +05:30
|
|
|
/* local, no need for xgetgrgid */
|
2008-01-22 05:03:43 +05:30
|
|
|
if (NULL != grp) {
|
|
|
|
SYSLOG ((LOG_INFO,
|
* src/chfn.c, src/chsh.c, src/groupdel.c, src/groupmems.c,
src/groupmod.c, src/grpck.c, src/login.c, src/logoutd.c,
src/newgrp.c, src/newusers.c, src/passwd.c, src/pwck.c,
src/suauth.c, src/useradd.c, src/userdel.c, src/usermod.c,
src/vipw.c: Complete the switch from the `' quotation style to ''.
Do it also in SYSLOG messages. Quote some parameters. All this
permits to merge some messages.
2008-08-06 21:21:52 +05:30
|
|
|
"user '%s' (login '%s' on %s) returned to group '%s'",
|
2008-01-22 05:03:43 +05:30
|
|
|
name, loginname, tty, grp->gr_name));
|
|
|
|
} else {
|
|
|
|
SYSLOG ((LOG_INFO,
|
* src/chfn.c, src/chsh.c, src/groupdel.c, src/groupmems.c,
src/groupmod.c, src/grpck.c, src/login.c, src/logoutd.c,
src/newgrp.c, src/newusers.c, src/passwd.c, src/pwck.c,
src/suauth.c, src/useradd.c, src/userdel.c, src/usermod.c,
src/vipw.c: Complete the switch from the `' quotation style to ''.
Do it also in SYSLOG messages. Quote some parameters. All this
permits to merge some messages.
2008-08-06 21:21:52 +05:30
|
|
|
"user '%s' (login '%s' on %s) returned to group '%lu'",
|
2008-06-14 01:51:24 +05:30
|
|
|
name, loginname, tty,
|
|
|
|
(unsigned long) gid));
|
2008-01-22 05:03:43 +05:30
|
|
|
/* Either the user's passwd entry has a
|
|
|
|
* GID that does not match with any group,
|
|
|
|
* or the group was deleted while the user
|
|
|
|
* was in a newgrp session.*/
|
|
|
|
SYSLOG ((LOG_WARN,
|
* src/chfn.c, src/chsh.c, src/groupdel.c, src/groupmems.c,
src/groupmod.c, src/grpck.c, src/login.c, src/logoutd.c,
src/newgrp.c, src/newusers.c, src/passwd.c, src/pwck.c,
src/suauth.c, src/useradd.c, src/userdel.c, src/usermod.c,
src/vipw.c: Complete the switch from the `' quotation style to ''.
Do it also in SYSLOG messages. Quote some parameters. All this
permits to merge some messages.
2008-08-06 21:21:52 +05:30
|
|
|
"unknown GID '%lu' used by user '%s'",
|
2008-06-14 01:51:24 +05:30
|
|
|
(unsigned long) gid, name));
|
2008-01-22 05:03:43 +05:30
|
|
|
}
|
2008-01-02 05:24:51 +05:30
|
|
|
closelog ();
|
2009-05-22 16:40:02 +05:30
|
|
|
exit ((0 != WIFEXITED (cst)) ? WEXITSTATUS (cst)
|
|
|
|
: WTERMSIG (cst) + 128);
|
2008-01-02 05:24:51 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
/* child - restore signals to their default state */
|
2008-06-14 01:51:24 +05:30
|
|
|
(void) signal (SIGINT, SIG_DFL);
|
|
|
|
(void) signal (SIGQUIT, SIG_DFL);
|
|
|
|
(void) signal (SIGHUP, SIG_DFL);
|
|
|
|
(void) signal (SIGTSTP, SIG_DFL);
|
|
|
|
(void) signal (SIGTTIN, SIG_DFL);
|
|
|
|
(void) signal (SIGTTOU, SIG_DFL);
|
2008-01-02 05:24:51 +05:30
|
|
|
}
|
|
|
|
#endif /* USE_PAM */
|
|
|
|
}
|
|
|
|
#endif /* USE_SYSLOG */
|
|
|
|
|
2007-10-07 17:14:02 +05:30
|
|
|
/*
|
|
|
|
* newgrp - change the invokers current real and effective group id
|
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
int main (int argc, char **argv)
|
2007-10-07 17:14:02 +05:30
|
|
|
{
|
2008-06-09 23:53:23 +05:30
|
|
|
bool initflag = false;
|
2007-10-07 17:14:59 +05:30
|
|
|
int i;
|
2008-06-09 23:53:23 +05:30
|
|
|
bool cflag = false;
|
2007-10-07 17:17:22 +05:30
|
|
|
int err = 0;
|
2007-10-07 17:14:02 +05:30
|
|
|
gid_t gid;
|
|
|
|
char *cp;
|
2008-01-02 05:05:55 +05:30
|
|
|
const char *name, *prog;
|
2007-10-07 17:14:02 +05:30
|
|
|
char *group = NULL;
|
2007-10-07 17:14:59 +05:30
|
|
|
char *command = NULL;
|
|
|
|
char **envp = environ;
|
2007-10-07 17:14:02 +05:30
|
|
|
struct passwd *pwd;
|
2009-04-24 02:07:00 +05:30
|
|
|
/*@null@*/struct group *grp;
|
2007-10-07 17:14:59 +05:30
|
|
|
|
2007-10-07 17:14:02 +05:30
|
|
|
#ifdef SHADOWGRP
|
|
|
|
struct sgrp *sgrp;
|
|
|
|
#endif
|
|
|
|
|
2007-10-07 17:17:11 +05:30
|
|
|
#ifdef WITH_AUDIT
|
|
|
|
audit_help_open ();
|
|
|
|
#endif
|
2008-06-09 23:53:23 +05:30
|
|
|
(void) setlocale (LC_ALL, "");
|
|
|
|
(void) bindtextdomain (PACKAGE, LOCALEDIR);
|
|
|
|
(void) textdomain (PACKAGE);
|
2007-10-07 17:14:59 +05:30
|
|
|
|
2007-10-07 17:14:02 +05:30
|
|
|
/*
|
2007-10-07 17:14:59 +05:30
|
|
|
* Save my name for error messages and save my real gid incase of
|
|
|
|
* errors. If there is an error i have to exec a new login shell for
|
|
|
|
* the user since her old shell won't have fork'd to create the
|
|
|
|
* process. Skip over the program name to the next command line
|
|
|
|
* argument.
|
|
|
|
*
|
|
|
|
* This historical comment, and the code itself, suggest that the
|
|
|
|
* behavior of the system/shell on which it was written differed
|
|
|
|
* significantly from the one I am using. If this process was
|
|
|
|
* started from a shell (including the login shell), it was fork'ed
|
|
|
|
* and exec'ed as a child by that shell. In order to get the user
|
|
|
|
* back to that shell, it is only necessary to exit from this
|
|
|
|
* process which terminates the child of the fork. The parent shell,
|
|
|
|
* which is blocked waiting for a signal, will then receive a
|
|
|
|
* SIGCHLD and will continue; any changes made to the process
|
|
|
|
* persona or the environment after the fork never occurred in the
|
|
|
|
* parent process.
|
|
|
|
*
|
|
|
|
* Bottom line: we want to save the name and real gid for messages,
|
|
|
|
* but we do not need to restore the previous process persona and we
|
|
|
|
* don't need to re-exec anything. -- JWP
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
Prog = Basename (argv[0]);
|
|
|
|
is_newgrp = (strcmp (Prog, "newgrp") == 0);
|
|
|
|
OPENLOG (is_newgrp ? "newgrp" : "sg");
|
|
|
|
gid = getgid ();
|
|
|
|
argc--;
|
|
|
|
argv++;
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2007-10-07 17:14:59 +05:30
|
|
|
initenv ();
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2007-10-07 17:14:59 +05:30
|
|
|
pwd = get_my_pwent ();
|
2008-06-09 23:53:23 +05:30
|
|
|
if (NULL == pwd) {
|
2008-08-30 23:57:07 +05:30
|
|
|
fprintf (stderr, _("%s: Cannot determine your user name.\n"),
|
|
|
|
Prog);
|
2007-10-07 17:17:11 +05:30
|
|
|
#ifdef WITH_AUDIT
|
2008-06-14 01:51:24 +05:30
|
|
|
audit_logger (AUDIT_CHGRP_ID, Prog,
|
|
|
|
"changing", NULL,
|
|
|
|
(unsigned int) getuid (), 0);
|
2007-10-07 17:17:11 +05:30
|
|
|
#endif
|
2008-08-30 23:57:07 +05:30
|
|
|
SYSLOG ((LOG_WARN, "Cannot determine the user name of the caller (UID %lu)",
|
2008-06-14 01:51:24 +05:30
|
|
|
(unsigned long) getuid ()));
|
2007-10-07 17:14:59 +05:30
|
|
|
closelog ();
|
2009-04-24 02:07:00 +05:30
|
|
|
exit (EXIT_FAILURE);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
name = pwd->pw_name;
|
|
|
|
|
|
|
|
/*
|
2007-10-07 17:14:59 +05:30
|
|
|
* Parse the command line. There are two accepted flags. The first
|
|
|
|
* is "-", which for newgrp means to re-create the entire
|
|
|
|
* environment as though a login had been performed, and "-c", which
|
|
|
|
* for sg causes a command string to be executed.
|
2007-10-07 17:14:02 +05:30
|
|
|
*
|
2007-10-07 17:14:59 +05:30
|
|
|
* The next argument, if present, must be the new group name. Any
|
|
|
|
* remaining remaining arguments will be used to execute a command
|
|
|
|
* as the named group. If the group name isn't present, I just use
|
|
|
|
* the login group ID of the current user.
|
2007-10-07 17:14:02 +05:30
|
|
|
*
|
|
|
|
* The valid syntax are
|
2007-10-07 17:15:23 +05:30
|
|
|
* newgrp [-] [groupid]
|
|
|
|
* newgrp [-l] [groupid]
|
|
|
|
* sg [-]
|
|
|
|
* sg [-] groupid [[-c command]
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
2008-06-09 23:53:23 +05:30
|
|
|
if ( (argc > 0)
|
|
|
|
&& ( (strcmp (argv[0], "-") == 0)
|
|
|
|
|| (strcmp (argv[0], "-l") == 0))) {
|
2007-10-07 17:14:59 +05:30
|
|
|
argc--;
|
|
|
|
argv++;
|
2008-06-09 23:53:23 +05:30
|
|
|
initflag = true;
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
if (!is_newgrp) {
|
|
|
|
/*
|
|
|
|
* Do the command line for everything that is
|
|
|
|
* not "newgrp".
|
|
|
|
*/
|
2008-06-09 23:53:23 +05:30
|
|
|
if ((argc > 0) && (argv[0][0] != '-')) {
|
2007-10-07 17:14:02 +05:30
|
|
|
group = argv[0];
|
2007-10-07 17:14:59 +05:30
|
|
|
argc--;
|
|
|
|
argv++;
|
2007-10-07 17:14:02 +05:30
|
|
|
} else {
|
|
|
|
usage ();
|
2007-10-07 17:14:59 +05:30
|
|
|
closelog ();
|
2009-04-24 02:07:00 +05:30
|
|
|
exit (EXIT_FAILURE);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
if (argc > 0) {
|
2007-10-07 17:14:08 +05:30
|
|
|
|
2007-10-07 17:14:59 +05:30
|
|
|
/*
|
|
|
|
* skip -c if specified so both forms work:
|
|
|
|
* "sg group -c command" (as in the man page) or
|
|
|
|
* "sg group command" (as in the usage message).
|
|
|
|
*/
|
2008-06-09 23:53:23 +05:30
|
|
|
if ((argc > 1) && (strcmp (argv[0], "-c") == 0)) {
|
2007-10-07 17:14:08 +05:30
|
|
|
command = argv[1];
|
2008-06-09 23:53:23 +05:30
|
|
|
} else {
|
2007-10-07 17:14:08 +05:30
|
|
|
command = argv[0];
|
2008-06-09 23:53:23 +05:30
|
|
|
}
|
|
|
|
cflag = true;
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
} else {
|
|
|
|
/*
|
2007-10-07 17:14:59 +05:30
|
|
|
* Do the command line for "newgrp". It's just making sure
|
|
|
|
* there aren't any flags and getting the new group name.
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
2008-06-09 23:53:23 +05:30
|
|
|
if ((argc > 0) && (argv[0][0] == '-')) {
|
2007-10-07 17:14:02 +05:30
|
|
|
usage ();
|
|
|
|
goto failure;
|
|
|
|
} else if (argv[0] != (char *) 0) {
|
|
|
|
group = argv[0];
|
|
|
|
} else {
|
|
|
|
/*
|
2007-10-07 17:14:59 +05:30
|
|
|
* get the group file entry for her login group id.
|
2007-10-07 17:14:02 +05:30
|
|
|
* the entry must exist, simply to be annoying.
|
2007-10-07 17:14:59 +05:30
|
|
|
*
|
|
|
|
* Perhaps in the past, but the default behavior now depends on the
|
|
|
|
* group entry, so it had better exist. -- JWP
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
2008-01-02 04:37:55 +05:30
|
|
|
grp = xgetgrgid (pwd->pw_gid);
|
|
|
|
if (NULL == grp) {
|
2008-08-30 23:58:24 +05:30
|
|
|
fprintf (stderr,
|
|
|
|
_("%s: GID '%lu' does not exist\n"),
|
|
|
|
Prog, (unsigned long) pwd->pw_gid);
|
|
|
|
SYSLOG ((LOG_CRIT, "GID '%lu' does not exist",
|
|
|
|
(unsigned long) pwd->pw_gid));
|
2007-10-07 17:14:02 +05:30
|
|
|
goto failure;
|
2008-06-09 23:53:23 +05:30
|
|
|
} else {
|
2007-10-07 17:14:59 +05:30
|
|
|
group = grp->gr_name;
|
2008-06-09 23:53:23 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
#ifdef HAVE_SETGROUPS
|
|
|
|
/*
|
2007-10-07 17:14:59 +05:30
|
|
|
* get the current users groupset. The new group will be added to
|
|
|
|
* the concurrent groupset if there is room, otherwise you get a
|
|
|
|
* nasty message but at least your real and effective group id's are
|
|
|
|
* set.
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
|
|
|
/* don't use getgroups(0, 0) - it doesn't work on some systems */
|
|
|
|
i = 16;
|
|
|
|
for (;;) {
|
2007-10-07 17:16:07 +05:30
|
|
|
grouplist = (GETGROUPS_T *) xmalloc (i * sizeof (GETGROUPS_T));
|
2007-10-07 17:14:59 +05:30
|
|
|
ngroups = getgroups (i, grouplist);
|
2008-06-09 23:53:23 +05:30
|
|
|
if (i > ngroups && !(ngroups == -1 && errno == EINVAL)) {
|
2007-10-07 17:14:02 +05:30
|
|
|
break;
|
2008-06-09 23:53:23 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
/* not enough room, so try allocating a larger buffer */
|
2007-10-07 17:14:59 +05:30
|
|
|
free (grouplist);
|
2007-10-07 17:14:02 +05:30
|
|
|
i *= 2;
|
|
|
|
}
|
|
|
|
if (ngroups < 0) {
|
2007-10-07 17:14:59 +05:30
|
|
|
perror ("getgroups");
|
2007-10-07 17:17:11 +05:30
|
|
|
#ifdef WITH_AUDIT
|
2008-02-15 00:05:51 +05:30
|
|
|
if (group) {
|
|
|
|
snprintf (audit_buf, sizeof(audit_buf),
|
|
|
|
"changing new-group=%s", group);
|
|
|
|
audit_logger (AUDIT_CHGRP_ID, Prog,
|
2008-06-14 01:51:24 +05:30
|
|
|
audit_buf, NULL,
|
|
|
|
(unsigned int) getuid (), 0);
|
2008-02-15 00:05:51 +05:30
|
|
|
} else {
|
|
|
|
audit_logger (AUDIT_CHGRP_ID, Prog,
|
2008-06-14 01:51:24 +05:30
|
|
|
"changing", NULL,
|
|
|
|
(unsigned int) getuid (), 0);
|
2008-02-15 00:05:51 +05:30
|
|
|
}
|
2007-10-07 17:17:11 +05:30
|
|
|
#endif
|
2009-04-24 02:07:00 +05:30
|
|
|
exit (EXIT_FAILURE);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2007-10-07 17:14:59 +05:30
|
|
|
#endif /* HAVE_SETGROUPS */
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
/*
|
2007-10-07 17:14:59 +05:30
|
|
|
* now we put her in the new group. The password file entry for her
|
|
|
|
* current user id has been gotten. If there was no optional group
|
|
|
|
* argument she will have her real and effective group id set to the
|
|
|
|
* set to the value from her password file entry.
|
|
|
|
*
|
|
|
|
* If run as newgrp, or as sg with no command, this process exec's
|
2007-10-07 17:16:25 +05:30
|
|
|
* an interactive subshell with the effective GID of the new group.
|
2007-10-07 17:14:59 +05:30
|
|
|
* If run as sg with a command, that command is exec'ed in this
|
|
|
|
* subshell. When this process terminates, either because the user
|
|
|
|
* exits, or the command completes, the parent of this process
|
2007-10-07 17:16:25 +05:30
|
|
|
* resumes with the current GID.
|
2007-10-07 17:14:59 +05:30
|
|
|
*
|
|
|
|
* If a group is explicitly specified on the command line, the
|
2007-10-07 17:16:25 +05:30
|
|
|
* interactive shell or command is run with that effective GID.
|
2007-10-07 17:14:59 +05:30
|
|
|
* Access will be denied if no entry for that group can be found in
|
|
|
|
* /etc/group. If the current user name appears in the members list
|
|
|
|
* for that group, access will be granted immediately; if not, the
|
|
|
|
* user will be challenged for that group's password. If the
|
|
|
|
* password response is incorrect, if the specified group does not
|
|
|
|
* have a password, or if that group has been locked by gpasswd -R,
|
|
|
|
* access will be denied. This is true even if the group specified
|
2007-10-07 17:16:25 +05:30
|
|
|
* has the user's login GID (as shown in /etc/passwd). If no group
|
2007-10-07 17:14:59 +05:30
|
|
|
* is explicitly specified on the command line, the effect is
|
2007-10-07 17:16:25 +05:30
|
|
|
* exactly the same as if a group name matching the user's login GID
|
2007-10-07 17:14:59 +05:30
|
|
|
* had been explicitly specified. Root, however, is never
|
|
|
|
* challenged for passwords, and is always allowed access.
|
|
|
|
*
|
|
|
|
* The previous behavior was to allow access to the login group if
|
|
|
|
* no explicit group was specified, irrespective of the group
|
|
|
|
* control file(s). This behavior is usually not desirable. A user
|
|
|
|
* wishing to return to the login group has only to exit back to the
|
|
|
|
* login shell. Generating yet more shell levels in order to
|
|
|
|
* provide a convenient "return" to the default group has the
|
|
|
|
* undesirable side effects of confusing the user, scrambling the
|
|
|
|
* history file, and consuming system resources. The default now is
|
|
|
|
* to lock out such behavior. A sys admin can allow it by explicitly
|
|
|
|
* including the user's name in the member list of the user's login
|
|
|
|
* group. -- JWP
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
2008-01-02 04:37:55 +05:30
|
|
|
grp = getgrnam (group); /* local, no need for xgetgrnam */
|
|
|
|
if (NULL == grp) {
|
2008-08-30 23:57:07 +05:30
|
|
|
fprintf (stderr, _("%s: group '%s' does not exist\n"), Prog, group);
|
2007-10-07 17:14:02 +05:30
|
|
|
goto failure;
|
|
|
|
}
|
2007-10-07 17:16:34 +05:30
|
|
|
|
|
|
|
/*
|
|
|
|
* For splitted groups (due to limitations of NIS), check all
|
|
|
|
* groups of the same GID like the requested group for
|
|
|
|
* membership of the current user.
|
|
|
|
*/
|
|
|
|
grp = find_matching_group (name, grp->gr_gid);
|
2008-06-09 23:53:23 +05:30
|
|
|
if (NULL == grp) {
|
2007-10-07 17:16:34 +05:30
|
|
|
/*
|
|
|
|
* No matching group found. As we already know that
|
|
|
|
* the group exists, this happens only in the case
|
|
|
|
* of a requested group where the user is not member.
|
|
|
|
*
|
|
|
|
* Re-read the group entry for further processing.
|
|
|
|
*/
|
* lib/prototypes.h, configure.in, libmisc/Makefile.am,
libmisc/xgetXXbyYY.c, libmisc/xgetpwnam.c, libmisc/xgetpwuid.c,
libmisc/xgetgrnam.c, libmisc/xgetgrgid.c, libmisc/xgetspnam.c:
Added functions xgetpwnam(), xgetpwuid(), xgetgrnam(),
xgetgrgid(), and xgetspnam(). They allocate memory for the
returned structure and are more robust to successive calls. They
are implemented with the libc's getxxyyy_r() functions if
available.
* libmisc/limits.c, libmisc/entry.c, libmisc/chowntty.c,
libmisc/addgrps.c, libmisc/myname.c, libmisc/rlogin.c,
libmisc/pwdcheck.c, src/newgrp.c, src/login_nopam.c,
src/userdel.c, src/lastlog.c, src/grpck.c, src/gpasswd.c,
src/newusers.c, src/chpasswd.c, src/chfn.c, src/groupmems.c,
src/usermod.c, src/expiry.c, src/groupdel.c, src/chgpasswd.c,
src/su.c, src/useradd.c, src/groupmod.c, src/passwd.c, src/pwck.c,
src/groupadd.c, src/chage.c, src/login.c, src/suauth.c,
src/faillog.c, src/groups.c, src/chsh.c, src/id.c: Review all the
usage of one of the getpwnam(), getpwuid(), getgrnam(),
getgrgid(), and getspnam() functions. It was noticed on
http://bugs.debian.org/341230 that chfn and chsh use a passwd
structure after calling a pam function, which result in using
information from the passwd structure requested by pam, not the
original one. It is much easier to use the new xget... functions
to avoid these issues. I've checked which call to the original
get... functions could be left (reducing the scope of the
structure if possible), and I've left comments to ease future
reviews (e.g. /* local, no need for xgetpwnam */).
Note: the getpwent/getgrent calls should probably be checked also.
* src/groupdel.c, src/expiry.c: Fix typos in comments.
* src/groupmod.c: Re-indent.
* libmisc/Makefile.am, lib/groupmem.c, lib/groupio.c, lib/pwmem.c,
lib/pwio.c, lib/shadowmem.c, lib/shadowio.c: Move the __<xx>_dup
functions (used by the xget... functions) from the <xx>io.c files
to the new <xx>mem.c files. This avoid linking some utils against
the SELinux library.
2007-11-19 04:45:26 +05:30
|
|
|
grp = xgetgrnam (group);
|
2009-04-23 16:47:22 +05:30
|
|
|
assert (NULL != grp);
|
2007-10-07 17:16:34 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
#ifdef SHADOWGRP
|
2008-01-02 04:37:55 +05:30
|
|
|
sgrp = getsgnam (group);
|
|
|
|
if (NULL != sgrp) {
|
2007-10-07 17:14:02 +05:30
|
|
|
grp->gr_passwd = sgrp->sg_passwd;
|
|
|
|
grp->gr_mem = sgrp->sg_mem;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
|
|
|
/*
|
2008-01-02 05:05:55 +05:30
|
|
|
* Check if the user is allowed to access this group.
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
2008-01-02 05:05:55 +05:30
|
|
|
check_perms (grp, pwd, group);
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
/*
|
2007-10-07 17:14:59 +05:30
|
|
|
* all successful validations pass through this point. The group id
|
|
|
|
* will be set, and the group added to the concurrent groupset.
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
|
|
|
#ifdef USE_SYSLOG
|
2007-10-07 17:14:59 +05:30
|
|
|
if (getdef_bool ("SYSLOG_SG_ENAB")) {
|
2008-01-06 18:01:06 +05:30
|
|
|
syslog_sg (name, group);
|
2007-10-07 17:14:59 +05:30
|
|
|
}
|
|
|
|
#endif /* USE_SYSLOG */
|
|
|
|
|
2007-10-07 17:14:02 +05:30
|
|
|
gid = grp->gr_gid;
|
|
|
|
|
|
|
|
#ifdef HAVE_SETGROUPS
|
|
|
|
/*
|
2007-10-07 17:14:59 +05:30
|
|
|
* I am going to try to add her new group id to her concurrent group
|
|
|
|
* set. If the group id is already present i'll just skip this part.
|
|
|
|
* If the group doesn't fit, i'll complain loudly and skip this
|
|
|
|
* part.
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
for (i = 0; i < ngroups; i++) {
|
2008-06-09 23:53:23 +05:30
|
|
|
if (gid == grouplist[i]) {
|
2007-10-07 17:14:02 +05:30
|
|
|
break;
|
2008-06-09 23:53:23 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
if (i == ngroups) {
|
2007-10-07 17:14:59 +05:30
|
|
|
if (ngroups >= sysconf (_SC_NGROUPS_MAX)) {
|
2009-04-24 02:07:00 +05:30
|
|
|
(void) fputs (_("too many groups\n"), stderr);
|
2007-10-07 17:14:02 +05:30
|
|
|
} else {
|
|
|
|
grouplist[ngroups++] = gid;
|
2008-06-11 02:04:25 +05:30
|
|
|
if (setgroups (ngroups, grouplist) != 0) {
|
2007-10-07 17:14:59 +05:30
|
|
|
perror ("setgroups");
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
2009-04-26 22:41:38 +05:30
|
|
|
/*
|
|
|
|
* Close all files before changing the user/group IDs.
|
|
|
|
*
|
|
|
|
* The needed structure should have been copied before, or
|
|
|
|
* permission to read the database will be required.
|
|
|
|
*/
|
|
|
|
endspent ();
|
|
|
|
#ifdef SHADOWGRP
|
|
|
|
endsgent ();
|
|
|
|
#endif
|
|
|
|
endpwent ();
|
|
|
|
endgrent ();
|
|
|
|
|
2007-10-07 17:14:02 +05:30
|
|
|
/*
|
2007-10-07 17:16:25 +05:30
|
|
|
* Set the effective GID to the new group id and the effective UID
|
|
|
|
* to the real UID. For root, this also sets the real GID to the
|
2007-10-07 17:14:59 +05:30
|
|
|
* new group id.
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
2008-06-09 23:53:23 +05:30
|
|
|
if (setgid (gid) != 0) {
|
2007-10-07 17:14:59 +05:30
|
|
|
perror ("setgid");
|
2008-02-15 00:05:51 +05:30
|
|
|
#ifdef WITH_AUDIT
|
|
|
|
snprintf (audit_buf, sizeof(audit_buf),
|
2008-06-14 01:51:24 +05:30
|
|
|
"changing new-gid=%lu", (unsigned long) gid);
|
2008-02-15 00:05:51 +05:30
|
|
|
audit_logger (AUDIT_CHGRP_ID, Prog,
|
2008-06-14 01:51:24 +05:30
|
|
|
audit_buf, NULL,
|
|
|
|
(unsigned int) getuid (), 0);
|
2008-02-15 00:05:51 +05:30
|
|
|
#endif
|
2009-04-24 02:07:00 +05:30
|
|
|
exit (EXIT_FAILURE);
|
2008-02-15 00:05:51 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2008-06-09 23:53:23 +05:30
|
|
|
if (setuid (getuid ()) != 0) {
|
2007-10-07 17:14:59 +05:30
|
|
|
perror ("setuid");
|
2007-10-07 17:17:11 +05:30
|
|
|
#ifdef WITH_AUDIT
|
2008-02-15 00:05:51 +05:30
|
|
|
snprintf (audit_buf, sizeof(audit_buf),
|
2008-06-14 01:51:24 +05:30
|
|
|
"changing new-gid=%lu", (unsigned long) gid);
|
2008-02-15 00:05:51 +05:30
|
|
|
audit_logger (AUDIT_CHGRP_ID, Prog,
|
2008-06-14 01:51:24 +05:30
|
|
|
audit_buf, NULL,
|
|
|
|
(unsigned int) getuid (), 0);
|
2007-10-07 17:17:11 +05:30
|
|
|
#endif
|
2009-04-24 02:07:00 +05:30
|
|
|
exit (EXIT_FAILURE);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2007-10-07 17:14:59 +05:30
|
|
|
* See if the "-c" flag was used. If it was, i just create a shell
|
|
|
|
* command for her using the argument that followed the "-c" flag.
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
|
|
|
if (cflag) {
|
2007-10-07 17:14:59 +05:30
|
|
|
closelog ();
|
|
|
|
execl ("/bin/sh", "sh", "-c", command, (char *) 0);
|
2007-10-07 17:17:11 +05:30
|
|
|
#ifdef WITH_AUDIT
|
2008-02-15 00:05:51 +05:30
|
|
|
snprintf (audit_buf, sizeof(audit_buf),
|
2008-06-14 01:51:24 +05:30
|
|
|
"changing new-gid=%lu", (unsigned long) gid);
|
2008-02-15 00:05:51 +05:30
|
|
|
audit_logger (AUDIT_CHGRP_ID, Prog,
|
2008-06-14 01:51:24 +05:30
|
|
|
audit_buf, NULL,
|
|
|
|
(unsigned int) getuid (), 0);
|
2007-10-07 17:17:11 +05:30
|
|
|
#endif
|
2007-10-07 17:17:22 +05:30
|
|
|
perror ("/bin/sh");
|
* src/newgrp.c, src/chfn.c, src/groupmems.c, src/usermod.c,
src/userdel.c, src/chpasswd.c, src/grpck.c, src/gpasswd.c,
src/groupdel.c, src/chgpasswd.c, src/vipw.c, src/useradd.c,
src/su.c, src/groupmod.c, src/passwd.c, src/pwck.c,
src/groupadd.c, src/chage.c, src/login.c, src/faillog.c,
src/sulogin.c, src/chsh.c, src/pwconv.c: Added splint annotations.
* src/userdel.c, src/pwconv.c, src/lastlog.c, src/grpck.c,
src/vipw.c, src/groupmod.c, src/passwd.c, src/pwck.c, src/login.c,
src/sulogin.c, src/usermod.c: Use return instead of exit at the
end of main().
* src/gpasswd.c, src/passwd.c, src/faillog.c: Use the exitcodes.h
exit codes.
* src/chpasswd.c: Added missing ||.
* src/nologin.c: Do not include exitcodes.h.
* src/nologin.c: Added brackets.
* src/nologin.c: Avoid assignments in comparisons.
2009-05-01 03:09:38 +05:30
|
|
|
exit ((errno == ENOENT) ? E_CMD_NOTFOUND : E_CMD_NOEXEC);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2007-10-07 17:14:59 +05:30
|
|
|
* I have to get the pathname of her login shell. As a favor, i'll
|
|
|
|
* try her environment for a $SHELL value first, and then try the
|
|
|
|
* password file entry. Obviously this shouldn't be in the
|
|
|
|
* restricted command directory since it could be used to leave the
|
|
|
|
* restricted environment.
|
|
|
|
*
|
|
|
|
* Note that the following assumes this user's entry in /etc/passwd
|
|
|
|
* does not have a chroot * prefix. If it does, the * will be copied
|
|
|
|
* verbatim into the exec path. This is probably not an issue
|
|
|
|
* because if this user is operating in a chroot jail, her entry in
|
|
|
|
* the version of /etc/passwd that is accessible here should
|
|
|
|
* probably never have a chroot shell entry (but entries for other
|
|
|
|
* users might). If I have missed something, and this causes you a
|
|
|
|
* problem, try using $SHELL as a workaround; also please notify me
|
|
|
|
* at jparmele@wildbear.com -- JWP
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
2008-06-09 23:53:23 +05:30
|
|
|
cp = getenv ("SHELL");
|
|
|
|
if (!initflag && (NULL != cp)) {
|
2007-10-07 17:14:02 +05:30
|
|
|
prog = cp;
|
2008-06-09 23:53:23 +05:30
|
|
|
} else if ((NULL != pwd->pw_shell) && ('\0' != pwd->pw_shell[0])) {
|
2007-10-07 17:14:02 +05:30
|
|
|
prog = pwd->pw_shell;
|
2008-06-09 23:53:23 +05:30
|
|
|
} else {
|
2007-10-07 17:14:02 +05:30
|
|
|
prog = "/bin/sh";
|
2008-06-09 23:53:23 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
/*
|
Ensure that getpwent() is used in setpwent(), getpwent(),
endpwend() sequences (ditto for getgrent(), getspent(), and
getsgent()). The only real (minor) issue was in login, which kept
the passwd file open.
* libmisc/entry.c: Remove unneeded setspent() and endspent() (only
getspnam is called in the middle).
* libmisc/find_new_ids.c: Make sure to close the password and
group files with endpwent() and endgrent().
* libmisc/pwdcheck.c: Remove unneeded endspent() (only getspnam()
is called before).
* src/lastlog.c, src/passwd.c, src/groupmod.c, src/faillog.c,
src/groups.c: Make sure to close
the password file with endpwent().
* src/login.c: Remove unneeded setpwent() (only xgetpwnam is
called before).
* src/login.c, src/newgrp.c: Fix typos in comments.
2008-04-17 03:22:46 +05:30
|
|
|
* Now I try to find the basename of the login shell. This will
|
2007-10-07 17:14:59 +05:30
|
|
|
* become argv[0] of the spawned command.
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
cp = Basename ((char *) prog);
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
/*
|
2007-10-07 17:14:59 +05:30
|
|
|
* Switch back to her home directory if i am doing login
|
2007-10-07 17:14:02 +05:30
|
|
|
* initialization.
|
|
|
|
*/
|
|
|
|
if (initflag) {
|
2008-06-09 23:53:23 +05:30
|
|
|
if (chdir (pwd->pw_dir) != 0) {
|
2007-10-07 17:14:59 +05:30
|
|
|
perror ("chdir");
|
2008-06-09 23:53:23 +05:30
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
|
2008-06-09 23:53:23 +05:30
|
|
|
while (NULL != *envp) {
|
2007-10-07 17:14:02 +05:30
|
|
|
if (strncmp (*envp, "PATH=", 5) == 0 ||
|
2007-10-07 17:14:59 +05:30
|
|
|
strncmp (*envp, "HOME=", 5) == 0 ||
|
|
|
|
strncmp (*envp, "SHELL=", 6) == 0 ||
|
|
|
|
strncmp (*envp, "TERM=", 5) == 0)
|
|
|
|
addenv (*envp, NULL);
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
envp++;
|
|
|
|
}
|
|
|
|
} else {
|
2008-06-09 23:53:23 +05:30
|
|
|
while (NULL != *envp) {
|
|
|
|
addenv (*envp, NULL);
|
|
|
|
envp++;
|
|
|
|
}
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
|
|
|
|
2007-10-07 17:17:11 +05:30
|
|
|
#ifdef WITH_AUDIT
|
2008-06-14 01:51:24 +05:30
|
|
|
snprintf (audit_buf, sizeof(audit_buf), "changing new-gid=%lu",
|
|
|
|
(unsigned long) gid);
|
|
|
|
audit_logger (AUDIT_CHGRP_ID, Prog,
|
|
|
|
audit_buf, NULL,
|
|
|
|
(unsigned int) getuid (), 1);
|
2007-10-07 17:17:11 +05:30
|
|
|
#endif
|
2007-10-07 17:14:02 +05:30
|
|
|
/*
|
2007-10-07 17:14:59 +05:30
|
|
|
* Exec the login shell and go away. We are trying to get back to
|
|
|
|
* the previous environment which should be the user's login shell.
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
2007-10-07 17:17:22 +05:30
|
|
|
err = shell (prog, initflag ? (char *) 0 : cp, newenvp);
|
* src/newgrp.c, src/chfn.c, src/groupmems.c, src/usermod.c,
src/userdel.c, src/chpasswd.c, src/grpck.c, src/gpasswd.c,
src/groupdel.c, src/chgpasswd.c, src/vipw.c, src/useradd.c,
src/su.c, src/groupmod.c, src/passwd.c, src/pwck.c,
src/groupadd.c, src/chage.c, src/login.c, src/faillog.c,
src/sulogin.c, src/chsh.c, src/pwconv.c: Added splint annotations.
* src/userdel.c, src/pwconv.c, src/lastlog.c, src/grpck.c,
src/vipw.c, src/groupmod.c, src/passwd.c, src/pwck.c, src/login.c,
src/sulogin.c, src/usermod.c: Use return instead of exit at the
end of main().
* src/gpasswd.c, src/passwd.c, src/faillog.c: Use the exitcodes.h
exit codes.
* src/chpasswd.c: Added missing ||.
* src/nologin.c: Do not include exitcodes.h.
* src/nologin.c: Added brackets.
* src/nologin.c: Avoid assignments in comparisons.
2009-05-01 03:09:38 +05:30
|
|
|
exit ((err == ENOENT) ? E_CMD_NOTFOUND : E_CMD_NOEXEC);
|
2009-04-24 02:07:00 +05:30
|
|
|
/* @notreached@ */
|
2007-10-07 17:16:07 +05:30
|
|
|
failure:
|
2007-10-07 17:14:02 +05:30
|
|
|
|
|
|
|
/*
|
2007-10-07 17:14:59 +05:30
|
|
|
* The previous code, when run as newgrp, re-exec'ed the shell in
|
|
|
|
* the current process with the original gid on error conditions.
|
|
|
|
* See the comment above. This historical behavior now has the
|
|
|
|
* effect of creating unlogged extraneous shell layers when the
|
|
|
|
* command line has an error or there is an authentication failure.
|
|
|
|
* We now just want to exit with error status back to the parent
|
|
|
|
* process. The closelog is probably unnecessary, but it does no
|
|
|
|
* harm. -- JWP
|
2007-10-07 17:14:02 +05:30
|
|
|
*/
|
2007-10-07 17:14:59 +05:30
|
|
|
closelog ();
|
2007-10-07 17:17:11 +05:30
|
|
|
#ifdef WITH_AUDIT
|
2008-06-09 23:53:23 +05:30
|
|
|
if (NULL != group) {
|
2008-02-15 00:05:51 +05:30
|
|
|
snprintf (audit_buf, sizeof(audit_buf),
|
|
|
|
"changing new-group=%s", group);
|
|
|
|
audit_logger (AUDIT_CHGRP_ID, Prog,
|
2008-06-14 01:51:24 +05:30
|
|
|
audit_buf, NULL,
|
|
|
|
(unsigned int) getuid (), 0);
|
2008-02-15 00:05:51 +05:30
|
|
|
} else {
|
|
|
|
audit_logger (AUDIT_CHGRP_ID, Prog,
|
2008-06-14 01:51:24 +05:30
|
|
|
"changing", NULL,
|
|
|
|
(unsigned int) getuid (), 0);
|
2008-02-15 00:05:51 +05:30
|
|
|
}
|
2007-10-07 17:17:11 +05:30
|
|
|
#endif
|
2009-04-24 02:07:00 +05:30
|
|
|
exit (EXIT_FAILURE);
|
2007-10-07 17:14:02 +05:30
|
|
|
}
|
2008-06-09 23:53:23 +05:30
|
|
|
|