source: trunk/server/common/patches/krb5-kuserok-scripts.patch @ 1715

# scripts.mit.edu krb5 kuserok patch
# Copyright (C) 2006  Tim Abbott <tabbott@mit.edu>
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA
#
# See /COPYRIGHT in this repository for more information.
#
--- krb5-1.6.3/src/lib/krb5/os/kuserok.c.old    2009-04-08 06:17:06.000000000 -0400
+++ krb5-1.6.3/src/lib/krb5/os/kuserok.c        2009-04-08 06:17:18.000000000 -0400
@@ -31,6 +31,7 @@
 #if !defined(_WIN32)           /* Not yet for Windows */
 #include <stdio.h>
 #include <pwd.h>
+#include <sys/wait.h>
 
 #if defined(_AIX) && defined(_IBMR2)
 #include <sys/access.h>
@@ -71,7 +72,6 @@
 {
     struct stat sbuf;
     struct passwd *pwd;
-    char pbuf[MAXPATHLEN];
     krb5_boolean isok = FALSE;
     FILE *fp;
     char kuser[MAX_USERNAME];
@@ -79,71 +79,35 @@
     char linebuf[BUFSIZ];
     char *newline;
     int gobble;
+    int pid, status;
 
     /* no account => no access */
     char pwbuf[BUFSIZ];
     struct passwd pwx;
     if (k5_getpwnam_r(luser, &pwx, pwbuf, sizeof(pwbuf), &pwd) != 0)
        return(FALSE);
-    (void) strncpy(pbuf, pwd->pw_dir, sizeof(pbuf) - 1);
-    pbuf[sizeof(pbuf) - 1] = '\0';
-    (void) strncat(pbuf, "/.k5login", sizeof(pbuf) - 1 - strlen(pbuf));
-
-    if (access(pbuf, F_OK)) {   /* not accessible */
-       /*
-        * if he's trying to log in as himself, and there is no .k5login file,
-        * let him.  To find out, call
-        * krb5_aname_to_localname to convert the principal to a name
-        * which we can string compare. 
-        */
-       if (!(krb5_aname_to_localname(context, principal,
-                                     sizeof(kuser), kuser))
-           && (strcmp(kuser, luser) == 0)) {
-           return(TRUE);
-       }
-    }
     if (krb5_unparse_name(context, principal, &princname))
        return(FALSE);                  /* no hope of matching */
 
-    /* open ~/.k5login */
-    if ((fp = fopen(pbuf, "r")) == NULL) {
-       free(princname);
-       return(FALSE);
-    }
-    set_cloexec_file(fp);
-    /*
-     * For security reasons, the .k5login file must be owned either by
-     * the user himself, or by root.  Otherwise, don't grant access.
-     */
-    if (fstat(fileno(fp), &sbuf)) {
-       fclose(fp);
-       free(princname);
-       return(FALSE);
+    if ((pid = fork()) == -1) {
+       free(princname);
+       return(FALSE);
     }
-    if (sbuf.st_uid != pwd->pw_uid && !FILE_OWNER_OK(sbuf.st_uid)) {
-       fclose(fp);
-       free(princname);
-       return(FALSE);
+    if (pid == 0) {
+       char *args[4];
+#define ADMOF_PATH "/usr/local/sbin/ssh-admof"
+       args[0] = ADMOF_PATH;
+       args[1] = (char *) luser;
+       args[2] = princname;
+       args[3] = NULL;
+       execv(ADMOF_PATH, args);
+       exit(1);
     }
-
-    /* check each line */
-    while (!isok && (fgets(linebuf, BUFSIZ, fp) != NULL)) {
-       /* null-terminate the input string */
-       linebuf[BUFSIZ-1] = '\0';
-       newline = NULL;
-       /* nuke the newline if it exists */
-       if ((newline = strchr(linebuf, '\n')))
-           *newline = '\0';
-       if (!strcmp(linebuf, princname)) {
-           isok = TRUE;
-           continue;
-       }
-       /* clean up the rest of the line if necessary */
-       if (!newline)
-           while (((gobble = getc(fp)) != EOF) && gobble != '\n');
+    if (waitpid(pid, &status, 0) > 0 && WIFEXITED(status) && WEXITSTATUS(status) == 33) {
+       isok=TRUE;
     }
+    
     free(princname);
-    fclose(fp);
     return(isok);
 }