source: server/common/patches/krb5-kuserok-scripts.patch @ 1069

Last change on this file since 1069 was 1069, checked in by mitchb, 13 years ago
Updates to the build system for krb5 Allow us to build with patches for CVE-2009-0844 through CVE-2009-0847
File size: 3.8 KB
RevLine 
[1]1# scripts.mit.edu krb5 kuserok patch
2# Copyright (C) 2006  Tim Abbott <tabbott@mit.edu>
3#
4# This program is free software; you can redistribute it and/or
5# modify it under the terms of the GNU General Public License
6# as published by the Free Software Foundation; either version 2
7# of the License, or (at your option) any later version.
8#
9# This program is distributed in the hope that it will be useful,
10# but WITHOUT ANY WARRANTY; without even the implied warranty of
11# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
12# GNU General Public License for more details.
13#
14# You should have received a copy of the GNU General Public License
15# along with this program; if not, write to the Free Software
16# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA
17#
18# See /COPYRIGHT in this repository for more information.
19#
[1069]20--- krb5-1.6.3/src/lib/krb5/os/kuserok.c.old    2009-04-08 06:17:06.000000000 -0400
21+++ krb5-1.6.3/src/lib/krb5/os/kuserok.c        2009-04-08 06:17:18.000000000 -0400
[1]22@@ -31,6 +31,7 @@
23 #if !defined(_WIN32)           /* Not yet for Windows */
24 #include <stdio.h>
25 #include <pwd.h>
26+#include <sys/wait.h>
27 
28 #if defined(_AIX) && defined(_IBMR2)
29 #include <sys/access.h>
[1069]30@@ -71,7 +72,6 @@
[1]31 {
32     struct stat sbuf;
33     struct passwd *pwd;
34-    char pbuf[MAXPATHLEN];
35     krb5_boolean isok = FALSE;
36     FILE *fp;
37     char kuser[MAX_USERNAME];
[1069]38@@ -79,70 +79,35 @@
[1]39     char linebuf[BUFSIZ];
40     char *newline;
41     int gobble;
42+    int pid, status;
43 
44     /* no account => no access */
45     char pwbuf[BUFSIZ];
46     struct passwd pwx;
47     if (k5_getpwnam_r(luser, &pwx, pwbuf, sizeof(pwbuf), &pwd) != 0)
48        return(FALSE);
49-    (void) strncpy(pbuf, pwd->pw_dir, sizeof(pbuf) - 1);
50-    pbuf[sizeof(pbuf) - 1] = '\0';
51-    (void) strncat(pbuf, "/.k5login", sizeof(pbuf) - 1 - strlen(pbuf));
52-
53-    if (access(pbuf, F_OK)) {   /* not accessible */
54-       /*
55-        * if he's trying to log in as himself, and there is no .k5login file,
56-        * let him.  To find out, call
57-        * krb5_aname_to_localname to convert the principal to a name
58-        * which we can string compare.
59-        */
60-       if (!(krb5_aname_to_localname(context, principal,
61-                                     sizeof(kuser), kuser))
62-           && (strcmp(kuser, luser) == 0)) {
63-           return(TRUE);
64-       }
65-    }
66     if (krb5_unparse_name(context, principal, &princname))
67        return(FALSE);                  /* no hope of matching */
68 
69-    /* open ~/.k5login */
70-    if ((fp = fopen(pbuf, "r")) == NULL) {
71-       free(princname);
72-       return(FALSE);
73-    }
74-    /*
75-     * For security reasons, the .k5login file must be owned either by
76-     * the user himself, or by root.  Otherwise, don't grant access.
77-     */
78-    if (fstat(fileno(fp), &sbuf)) {
79-       fclose(fp);
80-       free(princname);
81-       return(FALSE);
[1069]82+    if ((pid = fork()) == -1) {
83+       free(princname);
84+       return(FALSE);
85     }
[35]86-    if (sbuf.st_uid != pwd->pw_uid && !FILE_OWNER_OK(sbuf.st_uid)) {
[1]87-       fclose(fp);
88-       free(princname);
89-       return(FALSE);
[1069]90+    if (pid == 0) {
91+       char *args[4];
92+#define ADMOF_PATH "/usr/local/sbin/ssh-admof"
93+       args[0] = ADMOF_PATH;
94+       args[1] = (char *) luser;
95+       args[2] = princname;
96+       args[3] = NULL;
97+       execv(ADMOF_PATH, args);
98+       exit(1);
99     }
[1]100-
101-    /* check each line */
102-    while (!isok && (fgets(linebuf, BUFSIZ, fp) != NULL)) {
103-       /* null-terminate the input string */
104-       linebuf[BUFSIZ-1] = '\0';
105-       newline = NULL;
106-       /* nuke the newline if it exists */
107-       if ((newline = strchr(linebuf, '\n')))
108-           *newline = '\0';
109-       if (!strcmp(linebuf, princname)) {
110-           isok = TRUE;
111-           continue;
112-       }
113-       /* clean up the rest of the line if necessary */
114-       if (!newline)
115-           while (((gobble = getc(fp)) != EOF) && gobble != '\n');
116+    if (waitpid(pid, &status, 0) > 0 && WIFEXITED(status) && WEXITSTATUS(status) == 33) {
117+       isok=TRUE;
[1069]118     }
[1]119+   
120     free(princname);
121-    fclose(fp);
122     return(isok);
123 }
124 
Note: See TracBrowser for help on using the repository browser.