Annotation of src/usr.bin/skeyaudit/skeyaudit.c, Revision 1.8
1.8 ! millert 1: /* $OpenBSD: skeyaudit.c,v 1.7 1997/09/09 00:04:19 millert Exp $ */
1.2 millert 2:
3: /*
4: * Copyright (c) 1997 Todd C. Miller <Todd.Miller@courtesan.com>
5: * All rights reserved.
6: *
7: * Redistribution and use in source and binary forms, with or without
8: * modification, are permitted provided that the following conditions
9: * are met:
10: * 1. Redistributions of source code must retain the above copyright
11: * notice, this list of conditions and the following disclaimer.
12: * 2. Redistributions in binary form must reproduce the above copyright
13: * notice, this list of conditions and the following disclaimer in the
14: * documentation and/or other materials provided with the distribution.
1.8 ! millert 15: * 3. The name of the author may not be used to endorse or promote products
1.2 millert 16: * derived from this software without specific prior written permission.
17: *
18: * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
19: * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
20: * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
21: * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
22: * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
23: * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
24: * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
25: * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
26: * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
27: * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28: */
29:
1.1 millert 30: #include <err.h>
31: #include <errno.h>
32: #include <limits.h>
33: #include <paths.h>
34: #include <pwd.h>
35: #include <stdio.h>
36: #include <stdlib.h>
37: #include <string.h>
38: #include <unistd.h>
39: #include <skey.h>
40:
41: #include <sys/types.h>
42: #include <sys/param.h>
1.6 millert 43: #include <sys/wait.h>
1.1 millert 44:
45: extern char *__progname;
46:
1.6 millert 47: void notify __P((char *, uid_t, gid_t, int, int));
48: FILE *runsendmail __P((char *, uid_t, gid_t, int *));
1.1 millert 49: void usage __P((void));
50:
51: int
52: main(argc, argv)
53: int argc;
54: char **argv;
55: {
56: struct passwd *pw;
57: struct skey key;
1.6 millert 58: int ch, errs = 0, left = 0, aflag = 0, iflag = 0, limit = 12;
59: char *name;
60:
61: if (geteuid() != 0)
62: errx(1, "must be setuid root");
1.1 millert 63:
1.6 millert 64: while ((ch = getopt(argc, argv, "ail:")) != -1)
1.1 millert 65: switch(ch) {
1.6 millert 66: case 'a':
67: aflag = 1;
68: if (getuid() != 0)
69: errx(1, "only root may use the -a flag");
70: break;
1.1 millert 71: case 'i':
72: iflag = 1;
73: break;
74: case 'l':
75: errno = 0;
76: if ((limit = (int)strtol(optarg, NULL, 10)) == 0)
77: errno = ERANGE;
78: if (errno) {
79: warn("key limit");
80: usage();
81: }
82: break;
83: default:
84: usage();
85: }
86:
87: if (argc - optind > 0)
88: usage();
89:
1.6 millert 90: /* Need key.keyfile zero'd at the very least */
91: (void)memset(&key, 0, sizeof(key));
92:
93: if (aflag) {
94: while ((ch = skeygetnext(&key)) == 0) {
1.1 millert 95: left = key.n - 1;
1.6 millert 96: if ((pw = getpwnam(key.logname)) == NULL)
97: continue;
98: if (left >= limit)
99: continue;
100: notify(key.logname, pw->pw_uid, pw->pw_gid, left, iflag);
101: }
102: if (ch == -1)
103: errx(-1, "cannot open %s", _PATH_SKEYKEYS);
104: else
105: (void)fclose(key.keyfile);
106: } else {
107: if ((pw = getpwuid(getuid())) == NULL)
108: errx(1, "no passwd entry for uid %u", getuid());
109: if ((name = strdup(pw->pw_name)) == NULL)
110: err(1, "cannot allocate memory");
111: sevenbit(name);
112:
113: errs = skeylookup(&key, name);
114: switch (errs) {
115: case 0: /* Success! */
116: left = key.n - 1;
117: break;
118: case -1: /* File error */
119: errx(errs, "cannot open %s", _PATH_SKEYKEYS);
120: break;
121: case 1: /* Unknown user */
122: warnx("%s is not listed in %s", name,
123: _PATH_SKEYKEYS);
124: }
125: (void)fclose(key.keyfile);
126:
127: if (!errs && left < limit)
128: notify(name, pw->pw_uid, pw->pw_gid, left, iflag);
1.1 millert 129: }
1.6 millert 130:
131: exit(errs);
132: }
1.1 millert 133:
1.6 millert 134: void
135: notify(user, uid, gid, seq, interactive)
136: char *user;
137: uid_t uid;
138: gid_t gid;
139: int seq;
140: int interactive;
141: {
142: static char hostname[MAXHOSTNAMELEN];
143: int pid;
144: FILE *out;
1.1 millert 145:
1.6 millert 146: /* Only set this once */
147: if (hostname[0] == '\0' && gethostname(hostname, sizeof(hostname)) == -1)
1.1 millert 148: strcpy(hostname, "unknown");
149:
1.6 millert 150: if (interactive)
1.1 millert 151: out = stdout;
1.6 millert 152: else
153: out = runsendmail(user, uid, gid, &pid);
1.1 millert 154:
1.6 millert 155: if (!interactive)
1.1 millert 156: (void)fprintf(out,
1.6 millert 157: "To: %s\nSubject: IMPORTANT action required\n", user);
1.1 millert 158:
159: (void)fprintf(out,
160: "\nYou are nearing the end of your current S/Key sequence for account\n\
161: %s on system %s.\n\n\
162: Your S/key sequence number is now %d. When it reaches zero\n\
163: you will no longer be able to use S/Key to login into the system.\n\n\
164: Type \"skeyinit -s\" to reinitialize your sequence number.\n\n",
1.6 millert 165: user, hostname, seq);
1.1 millert 166:
1.6 millert 167: (void)fclose(out);
168: if (!interactive)
169: (void)waitpid(pid, NULL, 0);
1.1 millert 170: }
171:
1.6 millert 172: FILE *
173: runsendmail(user, uid, gid, pidp)
174: char *user;
175: uid_t uid;
176: gid_t gid;
177: int *pidp;
178: {
179: FILE *fp;
180: int pfd[2], pid;
181:
182: if (pipe(pfd) < 0)
183: return(NULL);
184:
185: switch (pid = fork()) {
186: case -1: /* fork(2) failed */
187: (void)close(pfd[0]);
188: (void)close(pfd[1]);
189: return(NULL);
190: case 0: /* In child */
191: (void)close(pfd[1]);
192: (void)dup2(pfd[0], STDIN_FILENO);
193: (void)close(pfd[0]);
194:
195: /* Run sendmail as target user not root */
196: initgroups(user, gid);
197: setegid(gid);
198: setgid(gid);
1.7 millert 199: setlogin(user);
1.6 millert 200: seteuid(uid);
201: setuid(uid);
202:
203: execl(_PATH_SENDMAIL, "sendmail", "-t", NULL);
204: warn("cannot run \"%s -t\"", _PATH_SENDMAIL);
205: _exit(127);
206: }
207:
208: /* In parent */
209: *pidp = pid;
210: fp = fdopen(pfd[1], "w");
211: (void)close(pfd[0]);
212:
213: return(fp);
214: }
1.1 millert 215: void
216: usage()
217: {
218: (void)fprintf(stderr, "Usage: %s [-i] [-l limit]\n",
219: __progname);
220: exit(1);
221: }
![[BACK]](/icons/back.gif){kind=icon}
Return to skeyaudit.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / skeyaudit