[1] | 1 | # scripts.mit.edu krb5 kuserok patch |
---|
| 2 | # Copyright (C) 2006 Tim Abbott <tabbott@mit.edu> |
---|
[1807] | 3 | # 2011 Alexander Chernyakhovsky <achernya@mit.edu> |
---|
[1] | 4 | # |
---|
| 5 | # This program is free software; you can redistribute it and/or |
---|
| 6 | # modify it under the terms of the GNU General Public License |
---|
| 7 | # as published by the Free Software Foundation; either version 2 |
---|
| 8 | # of the License, or (at your option) any later version. |
---|
| 9 | # |
---|
| 10 | # This program is distributed in the hope that it will be useful, |
---|
| 11 | # but WITHOUT ANY WARRANTY; without even the implied warranty of |
---|
| 12 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
---|
| 13 | # GNU General Public License for more details. |
---|
| 14 | # |
---|
| 15 | # You should have received a copy of the GNU General Public License |
---|
| 16 | # along with this program; if not, write to the Free Software |
---|
| 17 | # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA |
---|
| 18 | # |
---|
| 19 | # See /COPYRIGHT in this repository for more information. |
---|
| 20 | # |
---|
[1807] | 21 | --- krb5-1.9/src/lib/krb5/os/kuserok.c.old 2011-04-16 19:09:58.000000000 -0400 |
---|
| 22 | +++ krb5-1.9/src/lib/krb5/os/kuserok.c 2011-04-16 19:34:23.000000000 -0400 |
---|
| 23 | @@ -32,6 +32,7 @@ |
---|
| 24 | #if !defined(_WIN32) /* Not yet for Windows */ |
---|
[1] | 25 | #include <stdio.h> |
---|
| 26 | #include <pwd.h> |
---|
| 27 | +#include <sys/wait.h> |
---|
| 28 | |
---|
| 29 | #if defined(_AIX) && defined(_IBMR2) |
---|
| 30 | #include <sys/access.h> |
---|
[1807] | 31 | @@ -100,6 +101,7 @@ |
---|
[1] | 32 | struct stat sbuf; |
---|
[1807] | 33 | struct passwd pwx, *pwd; |
---|
| 34 | FILE *fp = NULL; |
---|
[1] | 35 | + int pid, status; |
---|
| 36 | |
---|
[1807] | 37 | if (profile_get_boolean(context->profile, KRB5_CONF_LIBDEFAULTS, |
---|
| 38 | KRB5_CONF_K5LOGIN_AUTHORITATIVE, NULL, TRUE, |
---|
| 39 | @@ -110,41 +112,27 @@ |
---|
[1] | 40 | if (k5_getpwnam_r(luser, &pwx, pwbuf, sizeof(pwbuf), &pwd) != 0) |
---|
[1807] | 41 | goto cleanup; |
---|
| 42 | |
---|
| 43 | - if (get_k5login_filename(context, luser, pwd->pw_dir, &filename) != 0) |
---|
| 44 | - goto cleanup; |
---|
[1] | 45 | - |
---|
[1807] | 46 | - if (access(filename, F_OK) != 0) { |
---|
| 47 | - result = PASS; |
---|
| 48 | - goto cleanup; |
---|
[1] | 49 | - } |
---|
[1807] | 50 | - |
---|
| 51 | if (krb5_unparse_name(context, principal, &princname) != 0) |
---|
| 52 | goto cleanup; |
---|
[1] | 53 | |
---|
[1807] | 54 | - fp = fopen(filename, "r"); |
---|
| 55 | - if (fp == NULL) |
---|
| 56 | + if ((pid = fork()) == -1) |
---|
| 57 | goto cleanup; |
---|
[1693] | 58 | - set_cloexec_file(fp); |
---|
[1807] | 59 | - |
---|
| 60 | - /* For security reasons, the .k5login file must be owned either by |
---|
| 61 | - * the user or by root. */ |
---|
| 62 | - if (fstat(fileno(fp), &sbuf)) |
---|
| 63 | - goto cleanup; |
---|
| 64 | - if (sbuf.st_uid != pwd->pw_uid && !FILE_OWNER_OK(sbuf.st_uid)) |
---|
| 65 | - goto cleanup; |
---|
| 66 | - |
---|
| 67 | - /* Check each line. */ |
---|
| 68 | - while (result != ACCEPT && (fgets(linebuf, sizeof(linebuf), fp) != NULL)) { |
---|
| 69 | - newline = strrchr(linebuf, '\n'); |
---|
| 70 | - if (newline != NULL) |
---|
| 71 | - *newline = '\0'; |
---|
| 72 | - if (strcmp(linebuf, princname) == 0) |
---|
| 73 | - result = ACCEPT; |
---|
| 74 | - /* Clean up the rest of the line if necessary. */ |
---|
| 75 | - if (newline == NULL) |
---|
| 76 | - while (((gobble = getc(fp)) != EOF) && gobble != '\n'); |
---|
| 77 | + |
---|
[1069] | 78 | + if (pid == 0) { |
---|
[1807] | 79 | + char *args[4]; |
---|
[1069] | 80 | +#define ADMOF_PATH "/usr/local/sbin/ssh-admof" |
---|
[1807] | 81 | + args[0] = ADMOF_PATH; |
---|
| 82 | + args[1] = (char *) luser; |
---|
| 83 | + args[2] = princname; |
---|
| 84 | + args[3] = NULL; |
---|
| 85 | + execv(ADMOF_PATH, args); |
---|
| 86 | + exit(1); |
---|
[1069] | 87 | } |
---|
[1807] | 88 | |
---|
[1] | 89 | + if (waitpid(pid, &status, 0) > 0 && WIFEXITED(status) && WEXITSTATUS(status) == 33) { |
---|
[1807] | 90 | + result = ACCEPT; |
---|
| 91 | + } |
---|
[1] | 92 | + |
---|
[1807] | 93 | cleanup: |
---|
[1] | 94 | free(princname); |
---|
[1807] | 95 | free(filename); |
---|