1 |
|
|
/* $OpenBSD: getgrouplist.c,v 1.27 2015/12/01 15:08:25 deraadt Exp $ */ |
2 |
|
|
/* |
3 |
|
|
* Copyright (c) 2008 Ingo Schwarze <schwarze@usta.de> |
4 |
|
|
* Copyright (c) 1991, 1993 |
5 |
|
|
* The Regents of the University of California. All rights reserved. |
6 |
|
|
* |
7 |
|
|
* Redistribution and use in source and binary forms, with or without |
8 |
|
|
* modification, are permitted provided that the following conditions |
9 |
|
|
* are met: |
10 |
|
|
* 1. Redistributions of source code must retain the above copyright |
11 |
|
|
* notice, this list of conditions and the following disclaimer. |
12 |
|
|
* 2. Redistributions in binary form must reproduce the above copyright |
13 |
|
|
* notice, this list of conditions and the following disclaimer in the |
14 |
|
|
* documentation and/or other materials provided with the distribution. |
15 |
|
|
* 3. Neither the name of the University nor the names of its contributors |
16 |
|
|
* may be used to endorse or promote products derived from this software |
17 |
|
|
* without specific prior written permission. |
18 |
|
|
* |
19 |
|
|
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND |
20 |
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
21 |
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
22 |
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE |
23 |
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
24 |
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
25 |
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
26 |
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
27 |
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
28 |
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
29 |
|
|
* SUCH DAMAGE. |
30 |
|
|
*/ |
31 |
|
|
|
32 |
|
|
/* |
33 |
|
|
* get credential |
34 |
|
|
*/ |
35 |
|
|
#include <sys/types.h> |
36 |
|
|
#include <sys/limits.h> |
37 |
|
|
#include <string.h> |
38 |
|
|
#include <unistd.h> |
39 |
|
|
#include <stdio.h> |
40 |
|
|
#include <stdlib.h> |
41 |
|
|
#include <grp.h> |
42 |
|
|
#include <pwd.h> |
43 |
|
|
|
44 |
|
|
#include <rpc/rpc.h> |
45 |
|
|
#include <rpcsvc/yp.h> |
46 |
|
|
#include <rpcsvc/ypclnt.h> |
47 |
|
|
|
48 |
|
|
#ifdef YP |
49 |
|
|
#define _PATH_NETID "/etc/netid" |
50 |
|
|
#define MAXLINELENGTH 1024 |
51 |
|
|
|
52 |
|
|
static int _parse_netid(char*, uid_t, gid_t*, int*, int); |
53 |
|
|
static int _read_netid(const char *, uid_t, gid_t*, int*, int); |
54 |
|
|
|
55 |
|
|
/* |
56 |
|
|
* Parse one string of the form "uid:gid[,gid[,...]]". |
57 |
|
|
* If the uid matches, add the groups to the group list. |
58 |
|
|
* If the groups fit, return 1, otherwise return -1. |
59 |
|
|
* If the uid does not match, return 0. |
60 |
|
|
*/ |
61 |
|
|
static int |
62 |
|
|
_parse_netid(char *netid, uid_t uid, gid_t *groups, int *ngroups, |
63 |
|
|
int maxgroups) |
64 |
|
|
{ |
65 |
|
|
const char *errstr = NULL; |
66 |
|
|
char *start, *p; |
67 |
|
|
uid_t tuid; |
68 |
|
|
gid_t gid; |
69 |
|
|
int i; |
70 |
|
|
|
71 |
|
|
/* Check the uid. */ |
72 |
|
|
p = strchr(netid, ':'); |
73 |
|
|
if (!p) |
74 |
|
|
return (0); |
75 |
|
|
*p++ = '\0'; |
76 |
|
|
tuid = (uid_t)strtonum(netid, 0, UID_MAX, &errstr); |
77 |
|
|
if (errstr || tuid != uid) |
78 |
|
|
return (0); |
79 |
|
|
|
80 |
|
|
/* Loop over the gids. */ |
81 |
|
|
while (p && *p) { |
82 |
|
|
start = p; |
83 |
|
|
p = strchr(start, ','); |
84 |
|
|
if (p) |
85 |
|
|
*p++ = '\0'; |
86 |
|
|
gid = (gid_t)strtonum(start, 0, GID_MAX, &errstr); |
87 |
|
|
if (errstr) |
88 |
|
|
continue; |
89 |
|
|
|
90 |
|
|
/* Skip this group if it is already in the list. */ |
91 |
|
|
for (i = 0; i < *ngroups; i++) |
92 |
|
|
if (groups[i] == gid) |
93 |
|
|
break; |
94 |
|
|
|
95 |
|
|
/* Try to add this new group to the list. */ |
96 |
|
|
if (i == *ngroups) { |
97 |
|
|
if (*ngroups >= maxgroups) |
98 |
|
|
return (-1); |
99 |
|
|
groups[(*ngroups)++] = gid; |
100 |
|
|
} |
101 |
|
|
} |
102 |
|
|
return (1); |
103 |
|
|
} |
104 |
|
|
|
105 |
|
|
/* |
106 |
|
|
* Search /etc/netid for a particular uid and process that line. |
107 |
|
|
* See _parse_netid for details, including return values. |
108 |
|
|
*/ |
109 |
|
|
static int |
110 |
|
|
_read_netid(const char *key, uid_t uid, gid_t *groups, int *ngroups, |
111 |
|
|
int maxgroups) |
112 |
|
|
{ |
113 |
|
|
FILE *fp; |
114 |
|
|
char line[MAXLINELENGTH], *p; |
115 |
|
|
int found = 0; |
116 |
|
|
|
117 |
|
|
fp = fopen(_PATH_NETID, "re"); |
118 |
|
|
if (!fp) |
119 |
|
|
return (0); |
120 |
|
|
while (!found && fgets(line, sizeof(line), fp)) { |
121 |
|
|
p = strchr(line, '\n'); |
122 |
|
|
if (p) |
123 |
|
|
*p = '\0'; |
124 |
|
|
else { /* Skip lines that are too long. */ |
125 |
|
|
int ch; |
126 |
|
|
while ((ch = getc_unlocked(fp)) != '\n' && ch != EOF) |
127 |
|
|
; |
128 |
|
|
continue; |
129 |
|
|
} |
130 |
|
|
p = strchr(line, ' '); |
131 |
|
|
if (!p) |
132 |
|
|
continue; |
133 |
|
|
*p++ = '\0'; |
134 |
|
|
if (strcmp(line, key)) |
135 |
|
|
continue; |
136 |
|
|
found = _parse_netid(p, uid, groups, ngroups, maxgroups); |
137 |
|
|
} |
138 |
|
|
(void)fclose(fp); |
139 |
|
|
return (found); |
140 |
|
|
} |
141 |
|
|
#endif /* YP */ |
142 |
|
|
|
143 |
|
|
int |
144 |
|
|
getgrouplist(const char *uname, gid_t agroup, gid_t *groups, int *grpcnt) |
145 |
|
|
{ |
146 |
|
|
int i, ngroups = 0, ret = 0, maxgroups = *grpcnt, bail; |
147 |
|
|
int needyp = 0, foundyp = 0; |
148 |
|
|
int *skipyp = &foundyp; |
149 |
|
|
extern struct group *_getgrent_yp(int *); |
150 |
|
|
struct group *grp; |
151 |
|
|
|
152 |
|
|
/* |
153 |
|
|
* install primary group |
154 |
|
|
*/ |
155 |
|
|
if (ngroups >= maxgroups) { |
156 |
|
|
*grpcnt = ngroups; |
157 |
|
|
return (-1); |
158 |
|
|
} |
159 |
|
|
groups[ngroups++] = agroup; |
160 |
|
|
|
161 |
|
|
#ifdef YP |
162 |
|
|
/* |
163 |
|
|
* Hint to the kernel that a passwd database operation is happening. |
164 |
|
|
*/ |
165 |
|
|
(void)access("/var/run/ypbind.lock", R_OK); |
166 |
|
|
#endif |
167 |
|
|
|
168 |
|
|
/* |
169 |
|
|
* Scan the group file to find additional groups. |
170 |
|
|
*/ |
171 |
|
|
setgrent(); |
172 |
|
|
while ((grp = _getgrent_yp(skipyp)) || foundyp) { |
173 |
|
|
if (foundyp) { |
174 |
|
|
if (foundyp > 0) |
175 |
|
|
needyp = 1; |
176 |
|
|
else |
177 |
|
|
skipyp = NULL; |
178 |
|
|
foundyp = 0; |
179 |
|
|
continue; |
180 |
|
|
} |
181 |
|
|
if (grp->gr_gid == agroup) |
182 |
|
|
continue; |
183 |
|
|
for (bail = 0, i = 0; bail == 0 && i < ngroups; i++) |
184 |
|
|
if (groups[i] == grp->gr_gid) |
185 |
|
|
bail = 1; |
186 |
|
|
if (bail) |
187 |
|
|
continue; |
188 |
|
|
for (i = 0; grp->gr_mem[i]; i++) { |
189 |
|
|
if (!strcmp(grp->gr_mem[i], uname)) { |
190 |
|
|
if (ngroups >= maxgroups) { |
191 |
|
|
ret = -1; |
192 |
|
|
goto out; |
193 |
|
|
} |
194 |
|
|
groups[ngroups++] = grp->gr_gid; |
195 |
|
|
break; |
196 |
|
|
} |
197 |
|
|
} |
198 |
|
|
} |
199 |
|
|
|
200 |
|
|
#ifdef YP |
201 |
|
|
/* |
202 |
|
|
* If we were told that there is a YP marker, look at netid data. |
203 |
|
|
*/ |
204 |
|
|
if (skipyp && needyp) { |
205 |
|
|
char buf[MAXLINELENGTH], *ypdata = NULL, *key; |
206 |
|
|
static char *__ypdomain; |
207 |
|
|
struct passwd pwstore; |
208 |
|
|
int ypdatalen; |
209 |
|
|
|
210 |
|
|
/* Construct the netid key to look up. */ |
211 |
|
|
if (getpwnam_r(uname, &pwstore, buf, sizeof buf, NULL) || |
212 |
|
|
(!__ypdomain && yp_get_default_domain(&__ypdomain))) |
213 |
|
|
goto out; |
214 |
|
|
i = asprintf(&key, "unix.%u@%s", pwstore.pw_uid, __ypdomain); |
215 |
|
|
if (i == -1) |
216 |
|
|
goto out; |
217 |
|
|
|
218 |
|
|
/* First scan the static netid file. */ |
219 |
|
|
switch (_read_netid(key, pwstore.pw_uid, |
220 |
|
|
groups, &ngroups, maxgroups)) { |
221 |
|
|
case -1: |
222 |
|
|
ret = -1; |
223 |
|
|
/* FALLTHROUGH */ |
224 |
|
|
case 1: |
225 |
|
|
free(key); |
226 |
|
|
goto out; |
227 |
|
|
default: |
228 |
|
|
break; |
229 |
|
|
} |
230 |
|
|
|
231 |
|
|
/* Only access YP when there is no static entry. */ |
232 |
|
|
if (!yp_bind(__ypdomain) && |
233 |
|
|
!yp_match(__ypdomain, "netid.byname", key, |
234 |
|
|
(int)strlen(key), &ypdata, &ypdatalen)) |
235 |
|
|
if (_parse_netid(ypdata, pwstore.pw_uid, |
236 |
|
|
groups, &ngroups, maxgroups) == -1) |
237 |
|
|
ret = -1; |
238 |
|
|
|
239 |
|
|
free(key); |
240 |
|
|
free(ypdata); |
241 |
|
|
} |
242 |
|
|
#endif /* YP */ |
243 |
|
|
|
244 |
|
|
out: |
245 |
|
|
endgrent(); |
246 |
|
|
*grpcnt = ngroups; |
247 |
|
|
return (ret); |
248 |
|
|
} |
249 |
|
|
DEF_WEAK(getgrouplist); |