2 * Copyright (c) 1996 by
3 * Sean Eric Fagan <sef@kithrup.com>
4 * David Nugent <davidn@blaze.net.au>
7 * Portions copyright (c) 1995,1997
8 * Berkeley Software Design, Inc.
11 * Redistribution and use in source and binary forms, with or without
12 * modification, is permitted provided that the following conditions
14 * 1. Redistributions of source code must retain the above copyright
15 * notice immediately at the beginning of the file, without modification,
16 * this list of conditions, and the following disclaimer.
17 * 2. Redistributions in binary form must reproduce the above copyright
18 * notice, this list of conditions and the following disclaimer in the
19 * documentation and/or other materials provided with the distribution.
20 * 3. This work was done expressly for inclusion into FreeBSD. Other use
21 * is permitted provided this notation is included.
22 * 4. Absolutely no warranty of function or purpose is made by the authors.
23 * 5. Modifications may be freely made to this file providing the above
26 * Low-level routines relating to the user capabilities database
29 #include <sys/cdefs.h>
30 __FBSDID("$FreeBSD$");
32 #include <sys/types.h>
34 #include <sys/resource.h>
35 #include <sys/param.h>
39 #include <login_cap.h>
49 * Manage a single static pointer for handling a local char* buffer,
50 * resizing as necessary to contain the string.
53 * Manage a static array for handling a group of strings, resizing
57 static int lc_object_count = 0;
59 static size_t internal_stringsz = 0;
60 static char * internal_string = NULL;
61 static size_t internal_arraysz = 0;
62 static const char ** internal_array = NULL;
64 static char path_login_conf[] = _PATH_LOGIN_CONF;
67 allocstr(const char *str)
71 size_t sz = strlen(str) + 1; /* realloc() only if necessary */
72 if (sz <= internal_stringsz)
73 p = strcpy(internal_string, str);
74 else if ((p = realloc(internal_string, sz)) != NULL) {
75 internal_stringsz = sz;
76 internal_string = strcpy(p, str);
85 static const char **p;
87 if (sz <= internal_arraysz)
89 else if ((p = reallocarray(internal_array, sz, sizeof(char*))) != NULL) {
90 internal_arraysz = sz;
98 * This is a variant of strcspn, which checks for quoted
100 * strcspn_quote("how 'now, brown' cow", ",", NULL);
101 * will return the index for the nul, rather than the comma, because
102 * the string is quoted. It does not handle escaped characters
106 strcspn_quote(const char *str, const char *exclude, int *is_quoted)
117 for (indx = 0; str[indx] != 0; indx++) {
118 if (quote && str[indx] == quote) {
125 (str[indx] == '\'' || str[indx] == '"')) {
130 strchr(exclude, str[indx]) != NULL)
137 * Remove quotes from the given string.
138 * It's a very simplistic approach: the first
139 * single or double quote it finds, it looks for
140 * the next one, and if it finds it, moves the
141 * entire string backwards in two chunks
142 * (first quote + 1 to first quote, length
143 * rest of string, and then second quote + 1
144 * to second quote, length rest of the string).
147 remove_quotes(char *str)
149 static const char *quote_chars = "'\"";
158 * If qc is 0, then we haven't found
159 * a quote yet, so do a strcspn search.
163 indx = strcspn(str, quote_chars);
164 if (str[indx] == '\0')
165 return; /* We're done */
170 * We've found a quote character,
171 * so use strchr to find the next one.
173 loc = strchr(str, qc);
180 * This gives us the location of the
181 * quoted character. We need to move
182 * the entire string down, from loc+1
185 size_t len = strlen(loc + 1) + 1;
186 memmove(loc, loc + 1, len);
189 } while (found != 0);
194 * Turn a simple string <str> separated by any of
195 * the set of <chars> into an array. The last element
196 * of the array will be NULL, as is proper.
197 * Free using freearraystr()
201 arrayize(const char *str, const char *chars, int *size)
206 const char **res = NULL;
208 /* count the sub-strings */
209 for (i = 0, cptr = str; *cptr; i++) {
210 int count = strcspn_quote(cptr, chars, NULL);
216 /* alloc the array */
217 if ((ptr = allocstr(str)) != NULL) {
218 if ((res = allocarray(++i)) == NULL)
219 free((void *)(uintptr_t)(const void *)str);
221 /* now split the string */
225 int count = strcspn_quote(ptr, chars, "ed);
232 * If the string contains a quoted element, we
233 * need to remove the quotes.
253 * Frees up all resources relating to a login class
258 login_close(login_cap_t * lc)
265 if (--lc_object_count == 0) {
266 free(internal_string);
267 free(internal_array);
268 internal_array = NULL;
269 internal_arraysz = 0;
270 internal_string = NULL;
271 internal_stringsz = 0;
279 * login_getclassbyname()
280 * Get the login class by its name.
281 * If the name given is NULL or empty, the default class
282 * LOGIN_DEFCLASS (i.e., "default") is fetched.
283 * If the name given is LOGIN_MECLASS and
284 * 'pwd' argument is non-NULL and contains an non-NULL
285 * dir entry, then the file _FILE_LOGIN_CONF is picked
286 * up from that directory and used before the system
287 * login database. In that case the system login database
288 * is looked up using LOGIN_MECLASS, too, which is a bug.
289 * Return a filled-out login_cap_t structure, including
290 * class name, and the capability record buffer.
294 login_getclassbyname(char const *name, const struct passwd *pwd)
298 if ((lc = malloc(sizeof(login_cap_t))) != NULL) {
302 const char *msg = NULL;
304 char userpath[MAXPATHLEN];
306 static char *login_dbarray[] = { NULL, NULL, NULL };
308 me = (name != NULL && strcmp(name, LOGIN_MECLASS) == 0);
309 dir = (!me || pwd == NULL) ? NULL : pwd->pw_dir;
311 * Switch to user mode before checking/reading its ~/.login_conf
312 * - some NFSes have root read access disabled.
314 * XXX: This fails to configure additional groups.
319 (void)setegid(pwd->pw_gid);
320 (void)seteuid(pwd->pw_uid);
323 if (dir && snprintf(userpath, MAXPATHLEN, "%s/%s", dir,
324 _FILE_LOGIN_CONF) < MAXPATHLEN) {
325 if (_secure_path(userpath, pwd->pw_uid, pwd->pw_gid) != -1)
326 login_dbarray[i++] = userpath;
329 * XXX: Why to add the system database if the class is `me'?
331 if (_secure_path(path_login_conf, 0, 0) != -1)
332 login_dbarray[i++] = path_login_conf;
333 login_dbarray[i] = NULL;
335 memset(lc, 0, sizeof(login_cap_t));
336 lc->lc_cap = lc->lc_class = lc->lc_style = NULL;
338 if (name == NULL || *name == '\0')
339 name = LOGIN_DEFCLASS;
341 switch (cgetent(&lc->lc_cap, login_dbarray, name)) {
342 case -1: /* Failed, entry does not exist */
344 break; /* Don't retry default on 'me' */
347 else if ((r = open(login_dbarray[0], O_RDONLY | O_CLOEXEC)) >= 0)
350 * If there's at least one login class database,
351 * and we aren't searching for a default class
352 * then complain about a non-existent class.
354 if (r >= 0 || strcmp(name, LOGIN_DEFCLASS) != 0)
355 syslog(LOG_ERR, "login_getclass: unknown class '%s'", name);
356 /* fall-back to default class */
357 name = LOGIN_DEFCLASS;
358 msg = "%s: no default/fallback class '%s'";
359 if (cgetent(&lc->lc_cap, login_dbarray, name) != 0 && r >= 0)
361 /* FALLTHROUGH - just return system defaults */
362 case 0: /* success! */
363 if ((lc->lc_class = strdup(name)) != NULL) {
371 msg = "%s: strdup: %m";
374 msg = "%s: retrieving class information: %m";
377 msg = "%s: 'tc=' reference loop '%s'";
380 msg = "couldn't resolve 'tc=' reference in '%s'";
383 msg = "%s: unexpected cgetent() error '%s': %m";
391 syslog(LOG_ERR, msg, "login_getclass", name);
402 * Get the login class for the system (only) login class database.
403 * Return a filled-out login_cap_t structure, including
404 * class name, and the capability record buffer.
408 login_getclass(const char *cls)
410 return login_getclassbyname(cls, NULL);
416 * Get the login class for a given password entry from
417 * the system (only) login class database.
418 * If the password entry's class field is not set, or
419 * the class specified does not exist, then use the
420 * default of LOGIN_DEFCLASS (i.e., "default") for an unprivileged
421 * user or that of LOGIN_DEFROOTCLASS (i.e., "root") for a super-user.
422 * Return a filled-out login_cap_t structure, including
423 * class name, and the capability record buffer.
427 login_getpwclass(const struct passwd *pwd)
429 const char *cls = NULL;
433 if (cls == NULL || *cls == '\0')
434 cls = (pwd->pw_uid == 0) ? LOGIN_DEFROOTCLASS : LOGIN_DEFCLASS;
437 * XXX: pwd should be unused by login_getclassbyname() unless cls is `me',
438 * so NULL can be passed instead of pwd for more safety.
440 return login_getclassbyname(cls, pwd);
445 * login_getuserclass()
446 * Get the `me' login class, allowing user overrides via ~/.login_conf.
447 * Note that user overrides are allowed only in the `me' class.
451 login_getuserclass(const struct passwd *pwd)
453 return login_getclassbyname(LOGIN_MECLASS, pwd);
459 * Given a login_cap entry, and a capability name, return the
460 * value defined for that capability, a default if not found, or
461 * an error string on error.
465 login_getcapstr(login_cap_t *lc, const char *cap, const char *def, const char *error)
470 if (lc == NULL || cap == NULL || lc->lc_cap == NULL || *cap == '\0')
473 if ((ret = cgetstr(lc->lc_cap, cap, &res)) == -1)
475 return (ret >= 0) ? res : error;
481 * Given a login_cap entry, and a capability name, return the
482 * value defined for that capability split into an array of
487 login_getcaplist(login_cap_t *lc, const char *cap, const char *chars)
493 if ((lstring = login_getcapstr(lc, cap, NULL, NULL)) != NULL)
494 return arrayize(lstring, chars, NULL);
501 * From the login_cap_t <lc>, get the capability <cap> which is
502 * formatted as either a space or comma delimited list of paths
503 * and append them all into a string and separate by semicolons.
504 * If there is an error of any kind, return <error>.
508 login_getpath(login_cap_t *lc, const char *cap, const char *error)
514 str = login_getcapstr(lc, cap, NULL, NULL);
517 ptr = __DECONST(char *, str); /* XXXX Yes, very dodgy */
519 count = strcspn(ptr, ", \t");
529 isinfinite(const char *s)
531 static const char *infs[] = {
539 const char **i = &infs[0];
542 if (strcasecmp(s, *i) == 0)
551 rmultiply(u_quad_t n1, u_quad_t n2)
558 /* Handle simple cases */
559 if (n1 == 0 || n2 == 0)
567 * sizeof() returns number of bytes needed for storage.
568 * This may be different from the actual number of useful bits.
571 bpw = sizeof(u_quad_t) * 8;
572 while (((u_quad_t)1 << (bpw-1)) == 0)
577 * First check the magnitude of each number. If the sum of the
578 * magnatude is way to high, reject the number. (If this test
579 * is not done then the first multiply below may overflow.)
581 for (b1 = bpw; (((u_quad_t)1 << (b1-1)) & n1) == 0; --b1)
583 for (b2 = bpw; (((u_quad_t)1 << (b2-1)) & n2) == 0; --b2)
585 if (b1 + b2 - 2 > bpw) {
591 * Decompose the multiplication to be:
596 * (h1 + l1) * (h2 + l2)
597 * (h1 * h2) + (h1 * l2) + (l1 * h2) + (l1 * l2)
599 * Since h1 && h2 do not have the low bit set, we can then say:
601 * (h1>>1 * h2>>1 * 4) + ...
603 * So if (h1>>1 * h2>>1) > (1<<(bpw - 2)) then the result will
606 * Finally, if MAX - ((h1 * l2) + (l1 * h2) + (l1 * l2)) < (h1*h2)
607 * then adding in residual amout will cause an overflow.
610 m = (n1 >> 1) * (n2 >> 1);
611 if (m >= ((u_quad_t)1 << (bpw-2))) {
618 + (n2 & 1) * (n1 & ~(u_quad_t)1)
619 + (n1 & 1) * (n2 & ~(u_quad_t)1);
621 if ((u_quad_t)(m + r) < m) {
633 * From the login_cap_t <lc>, get the capability <cap>, which is
634 * formatted as a time (e.g., "<cap>=10h3m2s"). If <cap> is not
635 * present in <lc>, return <def>; if there is an error of some kind,
640 login_getcaptime(login_cap_t *lc, const char *cap, rlim_t def, rlim_t error)
642 char *res, *ep, *oval;
647 if (lc == NULL || lc->lc_cap == NULL)
651 * Look for <cap> in lc_cap.
652 * If it's not there (-1), return <def>.
653 * If there's an error, return <error>.
656 if ((r = cgetstr(lc->lc_cap, cap, &res)) == -1)
663 /* "inf" and "infinity" are special cases */
665 return RLIM_INFINITY;
668 * Now go through the string, turning something like 1h2m3s into
669 * an integral value. Whee.
676 rlim_t tim = strtoq(res, &ep, 0);
679 if (ep == NULL || ep == res || errno != 0) {
681 syslog(LOG_WARNING, "login_getcaptime: class '%s' bad value %s=%s",
682 lc->lc_class, cap, oval);
686 /* Look for suffixes */
690 break; /* end of string */
691 case 's': case 'S': /* seconds */
693 case 'm': case 'M': /* minutes */
696 case 'h': case 'H': /* hours */
699 case 'd': case 'D': /* days */
700 mult = 60L * 60L * 24L;
702 case 'w': case 'W': /* weeks */
703 mult = 60L * 60L * 24L * 7L;
705 case 'y': case 'Y': /* 365-day years */
706 mult = 60L * 60L * 24L * 365L;
712 tot += rmultiply(tim, mult);
723 * From the login_cap_t <lc>, extract the numerical value <cap>.
724 * If it is not present, return <def> for a default, and return
725 * <error> if there is an error.
726 * Like login_getcaptime(), only it only converts to a number, not
727 * to a time; "infinity" and "inf" are 'special.'
731 login_getcapnum(login_cap_t *lc, const char *cap, rlim_t def, rlim_t error)
737 if (lc == NULL || lc->lc_cap == NULL)
741 * For BSDI compatibility, try for the tag=<val> first
743 if ((r = cgetstr(lc->lc_cap, cap, &res)) == -1) {
745 /* string capability not present, so try for tag#<val> as numeric */
746 if ((r = cgetnum(lc->lc_cap, cap, &lval)) == -1)
747 return def; /* Not there, so return default */
758 return RLIM_INFINITY;
761 val = strtoq(res, &ep, 0);
762 if (ep == NULL || ep == res || errno != 0) {
763 syslog(LOG_WARNING, "login_getcapnum: class '%s' bad value %s=%s",
764 lc->lc_class, cap, res);
776 * From the login_cap_t <lc>, extract the capability <cap>, which is
777 * formatted as a size (e.g., "<cap>=10M"); it can also be "infinity".
778 * If not present, return <def>, or <error> if there is an error of
783 login_getcapsize(login_cap_t *lc, const char *cap, rlim_t def, rlim_t error)
785 char *ep, *res, *oval;
789 if (lc == NULL || lc->lc_cap == NULL)
792 if ((r = cgetstr(lc->lc_cap, cap, &res)) == -1)
800 return RLIM_INFINITY;
806 rlim_t siz = strtoq(res, &ep, 0);
809 if (ep == NULL || ep == res || errno != 0) {
811 syslog(LOG_WARNING, "login_getcapsize: class '%s' bad value %s=%s",
812 lc->lc_class, cap, oval);
817 case 0: /* end of string */
820 case 'b': case 'B': /* 512-byte blocks */
823 case 'k': case 'K': /* 1024-byte Kilobytes */
826 case 'm': case 'M': /* 1024-k kbytes */
829 case 'g': case 'G': /* 1Gbyte */
830 mult = 1024 * 1024 * 1024;
832 case 't': case 'T': /* 1TBte */
833 mult = 1024LL * 1024LL * 1024LL * 1024LL;
839 tot += rmultiply(siz, mult);
850 * From the login_cap_t <lc>, check for the existence of the capability
851 * of <cap>. Return <def> if <lc>->lc_cap is NULL, otherwise return
852 * the whether or not <cap> exists there.
856 login_getcapbool(login_cap_t *lc, const char *cap, int def)
858 if (lc == NULL || lc->lc_cap == NULL)
860 return (cgetcap(lc->lc_cap, cap, ':') != NULL);
866 * Given a login_cap entry <lc>, and optionally a type of auth <auth>,
867 * and optionally a style <style>, find the style that best suits these
869 * 1. If <auth> is non-null, look for an "auth-<auth>=" string
870 * in the capability; if not present, default to "auth=".
871 * 2. If there is no auth list found from (1), default to
872 * "passwd" as an authorization list.
873 * 3. If <style> is non-null, look for <style> in the list of
874 * authorization methods found from (2); if <style> is NULL, default
875 * to LOGIN_DEFSTYLE ("passwd").
876 * 4. If the chosen style is found in the chosen list of authorization
877 * methods, return that; otherwise, return NULL.
879 * login_getstyle(lc, NULL, "ftp");
880 * login_getstyle(lc, "login", NULL);
881 * login_getstyle(lc, "skey", "network");
885 login_getstyle(login_cap_t *lc, const char *style, const char *auth)
888 const char **authtypes = NULL;
892 static const char *defauthtypes[] = { LOGIN_DEFSTYLE, NULL };
894 if (auth != NULL && *auth != '\0') {
895 if (snprintf(realauth, sizeof realauth, "auth-%s", auth) < (int)sizeof(realauth))
896 authtypes = login_getcaplist(lc, realauth, NULL);
899 if (authtypes == NULL)
900 authtypes = login_getcaplist(lc, "auth", NULL);
902 if (authtypes == NULL)
903 authtypes = defauthtypes;
906 * We have at least one authtype now; auths is a comma-separated
907 * (or space-separated) list of authentication types. We have to
908 * convert from this to an array of char*'s; authtypes then gets this.
911 if (style != NULL && *style != '\0') {
912 while (authtypes[i] != NULL && strcmp(style, authtypes[i]) != 0)
917 if (authtypes[i] != NULL && (auths = strdup(authtypes[i])) != NULL)
918 lc->lc_style = auths;
920 if (lc->lc_style != NULL)
921 lc->lc_style = strdup(lc->lc_style);