1 | /* admof |
---|
2 | * Version 2.0, released 2007-12-30 |
---|
3 | * Anders Kaseorg <andersk@mit.edu> |
---|
4 | * replacing Perl version by Jeff Arnold <jbarnold@mit.edu> |
---|
5 | * |
---|
6 | * Usage: |
---|
7 | * admof scripts andersk/root@ATHENA.MIT.EDU |
---|
8 | * Outputs "yes" and exits with status 33 if the given principal is an |
---|
9 | * administrator of the locker. |
---|
10 | * |
---|
11 | * Requires tokens (to authenticate/encrypt the connection to the |
---|
12 | * ptserver) unless -noauth is given. |
---|
13 | */ |
---|
14 | |
---|
15 | #include <stdio.h> |
---|
16 | #include <limits.h> |
---|
17 | #include <string.h> |
---|
18 | #include <sys/types.h> |
---|
19 | #include <sys/stat.h> |
---|
20 | #include <pwd.h> |
---|
21 | #include <unistd.h> |
---|
22 | #include <netinet/in.h> |
---|
23 | #include <afs/vice.h> |
---|
24 | #include <afs/venus.h> |
---|
25 | #include <afs/ptclient.h> |
---|
26 | #include <afs/ptuser.h> |
---|
27 | #include <afs/prs_fs.h> |
---|
28 | #include <afs/ptint.h> |
---|
29 | #include <afs/cellconfig.h> |
---|
30 | #include <afs/afsutil.h> |
---|
31 | #include <krb5.h> |
---|
32 | #include <kerberosIV/krb.h> |
---|
33 | #include <stdbool.h> |
---|
34 | #include <syslog.h> |
---|
35 | |
---|
36 | extern int pioctl(char *, afs_int32, struct ViceIoctl *, afs_int32); |
---|
37 | |
---|
38 | #define die(args...) do { fprintf(stderr, args); pr_End(); exit(1); } while(0) |
---|
39 | #define _STR(x) #x |
---|
40 | #define STR(x) _STR(x) |
---|
41 | |
---|
42 | #define OVERLORDS "system:scripts-root" |
---|
43 | |
---|
44 | static bool |
---|
45 | ismember(const char *user, const char *group) |
---|
46 | { |
---|
47 | int flag; |
---|
48 | if (pr_IsAMemberOf((char *)user, (char *)group, &flag) == 0) |
---|
49 | return flag; |
---|
50 | else |
---|
51 | return 0; |
---|
52 | } |
---|
53 | |
---|
54 | /* Parse an ACL of n entries, returning the rights for user. */ |
---|
55 | static int |
---|
56 | parse_rights(int n, const char **p, const char *user) |
---|
57 | { |
---|
58 | int rights = 0, *trights = malloc(n * sizeof(int)), i; |
---|
59 | namelist tnames = {.namelist_len = n, |
---|
60 | .namelist_val = malloc(n * PR_MAXNAMELEN)}; |
---|
61 | idlist tids = {.idlist_len = 0, |
---|
62 | .idlist_val = NULL}; |
---|
63 | |
---|
64 | if (trights == NULL || tnames.namelist_val == NULL) |
---|
65 | die("internal error: malloc failed: %m"); |
---|
66 | |
---|
67 | for (i = 0; i < n; ++i) { |
---|
68 | int off; |
---|
69 | if (sscanf(*p, "%" STR(PR_MAXNAMELEN) "s %d\n%n", |
---|
70 | tnames.namelist_val[i], &trights[i], &off) < 2) |
---|
71 | die("internal error: can't parse output from pioctl\n"); |
---|
72 | *p += off; |
---|
73 | } |
---|
74 | |
---|
75 | if (pr_NameToId(&tnames, &tids) != 0) |
---|
76 | die("internal error: pr_NameToId failed"); |
---|
77 | if (tids.idlist_len < n) |
---|
78 | die("internal error: pr_NameToId did not return enough ids"); |
---|
79 | |
---|
80 | for (i = 0; i < n; ++i) { |
---|
81 | if (~rights & trights[i] && |
---|
82 | (strcasecmp(tnames.namelist_val[i], user) == 0 || |
---|
83 | (tids.idlist_val[i] < 0 && ismember(user, tnames.namelist_val[i])))) |
---|
84 | rights |= trights[i]; |
---|
85 | } |
---|
86 | |
---|
87 | /* Note: this first free probably should be xdr_free in OpenAFS 1.5. |
---|
88 | * See commits b40b606 and f02f2e8 */ |
---|
89 | free(tids.idlist_val); |
---|
90 | tids.idlist_val = NULL; |
---|
91 | free(tnames.namelist_val); |
---|
92 | free(trights); |
---|
93 | |
---|
94 | return rights; |
---|
95 | } |
---|
96 | |
---|
97 | int |
---|
98 | main(int argc, const char *argv[]) |
---|
99 | { |
---|
100 | /* Get arguments. */ |
---|
101 | const char *locker, *name; |
---|
102 | afs_int32 secLevel; |
---|
103 | |
---|
104 | if (argc == 3) { |
---|
105 | locker = argv[1]; |
---|
106 | name = argv[2]; |
---|
107 | secLevel = 3; |
---|
108 | } else if (argc == 4 && strcmp("-noauth", argv[1]) == 0) { |
---|
109 | locker = argv[2]; |
---|
110 | name = argv[3]; |
---|
111 | secLevel = 0; |
---|
112 | } else { |
---|
113 | die("Usage: %s [-noauth] LOCKER PRINCIPAL\n", argv[0]); |
---|
114 | } |
---|
115 | |
---|
116 | /* Convert the locker into a directory. */ |
---|
117 | char dir[PATH_MAX]; |
---|
118 | int n; |
---|
119 | struct passwd *pwd = getpwnam(locker); |
---|
120 | if (pwd != NULL) |
---|
121 | n = snprintf(dir, sizeof dir, "%s", pwd->pw_dir); |
---|
122 | else |
---|
123 | n = snprintf(dir, sizeof dir, "/mit/%s", locker); |
---|
124 | if (n < 0 || n >= sizeof dir) |
---|
125 | die("internal error\n"); |
---|
126 | |
---|
127 | /* For non-AFS homedirs, read the .k5login file. */ |
---|
128 | if (strncmp(dir, "/afs/", 5) != 0 && strncmp(dir, "/mit/", 5) != 0) { |
---|
129 | if (chdir(dir) != 0) |
---|
130 | die("internal error: chdir: %m\n"); |
---|
131 | FILE *fp = fopen(".k5login", "r"); |
---|
132 | if (fp == NULL) |
---|
133 | die("internal error: .k5login: %m\n"); |
---|
134 | struct stat st; |
---|
135 | if (fstat(fileno(fp), &st) != 0) |
---|
136 | die("internal error: fstat: %m\n"); |
---|
137 | if (st.st_uid != pwd->pw_uid && st.st_uid != 0) { |
---|
138 | fclose(fp); |
---|
139 | die("internal error: bad .k5login permissions\n"); |
---|
140 | } |
---|
141 | bool found = false; |
---|
142 | char *line = NULL; |
---|
143 | size_t len = 0; |
---|
144 | ssize_t read; |
---|
145 | while ((read = getline(&line, &len, fp)) != -1) { |
---|
146 | if (read > 0 && line[read - 1] == '\n') |
---|
147 | line[read - 1] = '\0'; |
---|
148 | if (strcmp(name, line) == 0) { |
---|
149 | found = true; |
---|
150 | break; |
---|
151 | } |
---|
152 | } |
---|
153 | if (line) |
---|
154 | free(line); |
---|
155 | fclose(fp); |
---|
156 | if (found) { |
---|
157 | printf("yes\n"); |
---|
158 | exit(33); |
---|
159 | } else { |
---|
160 | printf("no\n"); |
---|
161 | exit(1); |
---|
162 | } |
---|
163 | } |
---|
164 | |
---|
165 | /* Get the locker's cell. */ |
---|
166 | char cell[MAXCELLCHARS]; |
---|
167 | struct ViceIoctl vi; |
---|
168 | vi.in = NULL; |
---|
169 | vi.in_size = 0; |
---|
170 | vi.out = cell; |
---|
171 | vi.out_size = sizeof cell; |
---|
172 | if (pioctl(dir, VIOC_FILE_CELL_NAME, &vi, 1) != 0) |
---|
173 | die("internal error: pioctl: %m\n"); |
---|
174 | |
---|
175 | if (pr_Initialize(secLevel, (char *)AFSDIR_CLIENT_ETC_DIRPATH, cell) != 0) |
---|
176 | die("internal error: pr_Initialize failed\n"); |
---|
177 | |
---|
178 | /* Get the cell configuration. */ |
---|
179 | struct afsconf_dir *configdir = afsconf_Open(AFSDIR_CLIENT_ETC_DIRPATH); |
---|
180 | if (configdir == NULL) |
---|
181 | die("internal error: afsconf_Open failed\n"); |
---|
182 | struct afsconf_cell cellconfig; |
---|
183 | if (afsconf_GetCellInfo(configdir, cell, NULL, &cellconfig) != 0) |
---|
184 | die("internal error: afsconf_GetCellInfo failed\n"); |
---|
185 | afsconf_Close(configdir); |
---|
186 | |
---|
187 | /* Figure out the cell's realm. */ |
---|
188 | krb5_context context; |
---|
189 | krb5_init_context(&context); |
---|
190 | |
---|
191 | char **realm_list; |
---|
192 | if (krb5_get_host_realm(context, cellconfig.hostName[0], &realm_list) != 0 || |
---|
193 | realm_list[0] == NULL) |
---|
194 | die("internal error: krb5_get_host_realm failed"); |
---|
195 | |
---|
196 | /* Convert the Kerberos 5 principal into a (Kerberos IV-style) AFS |
---|
197 | name, omitting the realm if it equals the cell's realm. */ |
---|
198 | krb5_principal principal; |
---|
199 | if (krb5_parse_name(context, name, &principal) != 0) |
---|
200 | die("internal error: krb5_parse_name failed"); |
---|
201 | char pname[ANAME_SZ], pinst[INST_SZ], prealm[REALM_SZ]; |
---|
202 | if (krb5_524_conv_principal(context, principal, pname, pinst, prealm) != 0) |
---|
203 | die("internal error: krb5_524_conv_principal failed\n"); |
---|
204 | char user[MAX(PR_MAXNAMELEN, MAX_K_NAME_SZ)]; |
---|
205 | if (kname_unparse(user, pname, pinst, |
---|
206 | strcmp(prealm, realm_list[0]) == 0 ? NULL : prealm) != 0) |
---|
207 | die("internal error: kname_unparse failed\n"); |
---|
208 | |
---|
209 | krb5_free_principal(context, principal); |
---|
210 | krb5_free_host_realm(context, realm_list); |
---|
211 | krb5_free_context(context); |
---|
212 | |
---|
213 | /* Instead of canonicalizing the name as below, we just use |
---|
214 | strcasecmp above. */ |
---|
215 | #if 0 |
---|
216 | afs_int32 id; |
---|
217 | if (pr_SNameToId((char *)user, &id) != 0) |
---|
218 | die("bad principal\n"); |
---|
219 | if (id == ANONYMOUSID) |
---|
220 | die("anonymous\n"); |
---|
221 | if (pr_SIdToName(id, user) != 0) |
---|
222 | die("internal error: pr_SIdToName failed\n"); |
---|
223 | #endif |
---|
224 | |
---|
225 | /* Read the locker ACL. */ |
---|
226 | char acl[2048]; |
---|
227 | vi.in = NULL; |
---|
228 | vi.in_size = 0; |
---|
229 | vi.out = acl; |
---|
230 | vi.out_size = sizeof acl; |
---|
231 | if (pioctl(dir, VIOCGETAL, &vi, 1) != 0) |
---|
232 | die("internal error: pioctl: %m\n"); |
---|
233 | |
---|
234 | /* Parse the locker ACL to compute the user's rights. */ |
---|
235 | const char *p = acl; |
---|
236 | |
---|
237 | int nplus, nminus; |
---|
238 | int off; |
---|
239 | if (sscanf(p, "%d\n%d\n%n", &nplus, &nminus, &off) < 2) |
---|
240 | die("internal error: can't parse output from pioctl\n"); |
---|
241 | p += off; |
---|
242 | |
---|
243 | int rights = parse_rights(nplus, &p, user); |
---|
244 | rights &= ~parse_rights(nminus, &p, user); |
---|
245 | #ifdef OVERLORDS |
---|
246 | if (~rights & PRSFS_ADMINISTER && ismember(user, OVERLORDS)) { |
---|
247 | openlog("admof", 0, LOG_AUTHPRIV); |
---|
248 | syslog(LOG_NOTICE, "giving %s admin rights on %s", user, locker); |
---|
249 | closelog(); |
---|
250 | rights |= PRSFS_ADMINISTER; |
---|
251 | } |
---|
252 | #endif |
---|
253 | |
---|
254 | pr_End(); |
---|
255 | |
---|
256 | /* Output whether the user is an administrator. */ |
---|
257 | if (rights & PRSFS_ADMINISTER) { |
---|
258 | printf("yes\n"); |
---|
259 | exit(33); |
---|
260 | } else { |
---|
261 | printf("no\n"); |
---|
262 | exit(1); |
---|
263 | } |
---|
264 | } |
---|