source:
trunk/server/common/patches/krb5-kuserok-scripts.patch
@
1561
Last change on this file since 1561 was 1069, checked in by mitchb, 16 years ago | |
---|---|
File size: 3.8 KB |
-
krb5-1.6.3/src/lib/krb5/os/kuserok.c
# scripts.mit.edu krb5 kuserok patch # Copyright (C) 2006 Tim Abbott <tabbott@mit.edu> # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License # as published by the Free Software Foundation; either version 2 # of the License, or (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA # # See /COPYRIGHT in this repository for more information. #
old new 31 31 #if !defined(_WIN32) /* Not yet for Windows */ 32 32 #include <stdio.h> 33 33 #include <pwd.h> 34 #include <sys/wait.h> 34 35 35 36 #if defined(_AIX) && defined(_IBMR2) 36 37 #include <sys/access.h> … … 71 72 { 72 73 struct stat sbuf; 73 74 struct passwd *pwd; 74 char pbuf[MAXPATHLEN];75 75 krb5_boolean isok = FALSE; 76 76 FILE *fp; 77 77 char kuser[MAX_USERNAME]; … … 79 79 char linebuf[BUFSIZ]; 80 80 char *newline; 81 81 int gobble; 82 int pid, status; 82 83 83 84 /* no account => no access */ 84 85 char pwbuf[BUFSIZ]; 85 86 struct passwd pwx; 86 87 if (k5_getpwnam_r(luser, &pwx, pwbuf, sizeof(pwbuf), &pwd) != 0) 87 88 return(FALSE); 88 (void) strncpy(pbuf, pwd->pw_dir, sizeof(pbuf) - 1);89 pbuf[sizeof(pbuf) - 1] = '\0';90 (void) strncat(pbuf, "/.k5login", sizeof(pbuf) - 1 - strlen(pbuf));91 92 if (access(pbuf, F_OK)) { /* not accessible */93 /*94 * if he's trying to log in as himself, and there is no .k5login file,95 * let him. To find out, call96 * krb5_aname_to_localname to convert the principal to a name97 * which we can string compare.98 */99 if (!(krb5_aname_to_localname(context, principal,100 sizeof(kuser), kuser))101 && (strcmp(kuser, luser) == 0)) {102 return(TRUE);103 }104 }105 89 if (krb5_unparse_name(context, principal, &princname)) 106 90 return(FALSE); /* no hope of matching */ 107 91 108 /* open ~/.k5login */ 109 if ((fp = fopen(pbuf, "r")) == NULL) { 110 free(princname); 111 return(FALSE); 112 } 113 /* 114 * For security reasons, the .k5login file must be owned either by 115 * the user himself, or by root. Otherwise, don't grant access. 116 */ 117 if (fstat(fileno(fp), &sbuf)) { 118 fclose(fp); 119 free(princname); 120 return(FALSE); 92 if ((pid = fork()) == -1) { 93 free(princname); 94 return(FALSE); 121 95 } 122 if (sbuf.st_uid != pwd->pw_uid && !FILE_OWNER_OK(sbuf.st_uid)) { 123 fclose(fp); 124 free(princname); 125 return(FALSE); 96 if (pid == 0) { 97 char *args[4]; 98 #define ADMOF_PATH "/usr/local/sbin/ssh-admof" 99 args[0] = ADMOF_PATH; 100 args[1] = (char *) luser; 101 args[2] = princname; 102 args[3] = NULL; 103 execv(ADMOF_PATH, args); 104 exit(1); 126 105 } 127 128 /* check each line */ 129 while (!isok && (fgets(linebuf, BUFSIZ, fp) != NULL)) { 130 /* null-terminate the input string */ 131 linebuf[BUFSIZ-1] = '\0'; 132 newline = NULL; 133 /* nuke the newline if it exists */ 134 if ((newline = strchr(linebuf, '\n'))) 135 *newline = '\0'; 136 if (!strcmp(linebuf, princname)) { 137 isok = TRUE; 138 continue; 139 } 140 /* clean up the rest of the line if necessary */ 141 if (!newline) 142 while (((gobble = getc(fp)) != EOF) && gobble != '\n'); 106 if (waitpid(pid, &status, 0) > 0 && WIFEXITED(status) && WEXITSTATUS(status) == 33) { 107 isok=TRUE; 143 108 } 109 144 110 free(princname); 145 fclose(fp);146 111 return(isok); 147 112 } 148 113
Note: See TracBrowser
for help on using the repository browser.