Changeset 580

Timestamp:

Jan 5, 2008, 6:06:59 AM (17 years ago)

Author:

andersk

Message:

Check .k5login owner for security reasons as per the equivalent krb5
code.

File:

• server/common/oursrc/accountadm/admof.c (modified) (2 diffs)

server/common/oursrc/accountadm/admof.c

@@ -14 +14 @@
 #include <string.h>
 #include <sys/types.h>
+#include <sys/stat.h>
 #include <pwd.h>
+#include <unistd.h>
 #include <netinet/in.h>
 #include <afs/vice.h>
@@ -97 +99 @@
         if (fp == NULL)
             die("internal error: .k5login: %m\n");
+        struct stat st;
+        if (fstat(fileno(fp), &st) != 0)
+            die("internal error: fstat: %m\n");
+        if (st.st_uid != pwd->pw_uid && st.st_uid != 0) {
+            fclose(fp);
+            die("internal error: bad .k5login permissions\n");
+        }
         bool found = false;
         char *line = NULL;