source:
branches/fc15-dev/server/common/patches/krb5-kuserok-scripts.patch
@
1807
Last change on this file since 1807 was 1807, checked in by achernya, 13 years ago | |
---|---|
File size: 3.2 KB |
-
krb5-1.9/src/lib/krb5/os/kuserok.c
# scripts.mit.edu krb5 kuserok patch # Copyright (C) 2006 Tim Abbott <tabbott@mit.edu> # 2011 Alexander Chernyakhovsky <achernya@mit.edu> # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License # as published by the Free Software Foundation; either version 2 # of the License, or (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA # # See /COPYRIGHT in this repository for more information. #
old new 32 32 #if !defined(_WIN32) /* Not yet for Windows */ 33 33 #include <stdio.h> 34 34 #include <pwd.h> 35 #include <sys/wait.h> 35 36 36 37 #if defined(_AIX) && defined(_IBMR2) 37 38 #include <sys/access.h> … … 100 101 struct stat sbuf; 101 102 struct passwd pwx, *pwd; 102 103 FILE *fp = NULL; 104 int pid, status; 103 105 104 106 if (profile_get_boolean(context->profile, KRB5_CONF_LIBDEFAULTS, 105 107 KRB5_CONF_K5LOGIN_AUTHORITATIVE, NULL, TRUE, … … 110 112 if (k5_getpwnam_r(luser, &pwx, pwbuf, sizeof(pwbuf), &pwd) != 0) 111 113 goto cleanup; 112 114 113 if (get_k5login_filename(context, luser, pwd->pw_dir, &filename) != 0)114 goto cleanup;115 116 if (access(filename, F_OK) != 0) {117 result = PASS;118 goto cleanup;119 }120 121 115 if (krb5_unparse_name(context, principal, &princname) != 0) 122 116 goto cleanup; 123 117 124 fp = fopen(filename, "r"); 125 if (fp == NULL) 118 if ((pid = fork()) == -1) 126 119 goto cleanup; 127 set_cloexec_file(fp); 128 129 /* For security reasons, the .k5login file must be owned either by 130 * the user or by root. */ 131 if (fstat(fileno(fp), &sbuf)) 132 goto cleanup; 133 if (sbuf.st_uid != pwd->pw_uid && !FILE_OWNER_OK(sbuf.st_uid)) 134 goto cleanup; 135 136 /* Check each line. */ 137 while (result != ACCEPT && (fgets(linebuf, sizeof(linebuf), fp) != NULL)) { 138 newline = strrchr(linebuf, '\n'); 139 if (newline != NULL) 140 *newline = '\0'; 141 if (strcmp(linebuf, princname) == 0) 142 result = ACCEPT; 143 /* Clean up the rest of the line if necessary. */ 144 if (newline == NULL) 145 while (((gobble = getc(fp)) != EOF) && gobble != '\n'); 120 121 if (pid == 0) { 122 char *args[4]; 123 #define ADMOF_PATH "/usr/local/sbin/ssh-admof" 124 args[0] = ADMOF_PATH; 125 args[1] = (char *) luser; 126 args[2] = princname; 127 args[3] = NULL; 128 execv(ADMOF_PATH, args); 129 exit(1); 146 130 } 147 131 132 if (waitpid(pid, &status, 0) > 0 && WIFEXITED(status) && WEXITSTATUS(status) == 33) { 133 result = ACCEPT; 134 } 135 148 136 cleanup: 149 137 free(princname); 150 138 free(filename);
Note: See TracBrowser
for help on using the repository browser.