![[BACK]](/icons/back.gif){kind=icon}
Return to parse.yacc CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / sudo|
Return to parse.yacc CVS log | Up to [local] / src / usr.bin / sudo |
1.1 millert 1: %{
2: /*
3: * Copyright (c) 1996, 1998, 1999 Todd C. Miller <Todd.Miller@courtesan.com>
4: * All rights reserved.
5: *
6: * This code is derived from software contributed by Chris Jepeway
7: * <jepeway@cs.utk.edu>
8: *
9: * Redistribution and use in source and binary forms, with or without
10: * modification, are permitted provided that the following conditions
11: * are met:
12: *
13: * 1. Redistributions of source code must retain the above copyright
14: * notice, this list of conditions and the following disclaimer.
15: *
16: * 2. Redistributions in binary form must reproduce the above copyright
17: * notice, this list of conditions and the following disclaimer in the
18: * documentation and/or other materials provided with the distribution.
19: *
20: * 3. The name of the author may not be used to endorse or promote products
21: * derived from this software without specific prior written permission.
22: *
23: * 4. Products derived from this software may not be called "Sudo" nor
24: * may "Sudo" appear in their names without specific prior written
25: * permission from the author.
26: *
27: * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
28: * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
29: * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
30: * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
31: * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
32: * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
33: * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
34: * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
35: * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
36: * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
37: */
38:
39: /*
40: * XXX - the whole opFOO naming thing is somewhat bogus.
41: *
42: * XXX - the way things are stored for printmatches is stupid,
43: * they should be stored as elements in an array and then
44: * list_matches() can format things the way it wants.
45: */
46:
47: #include "config.h"
48: #include <stdio.h>
49: #ifdef STDC_HEADERS
50: #include <stdlib.h>
51: #endif /* STDC_HEADERS */
52: #ifdef HAVE_UNISTD_H
53: #include <unistd.h>
54: #endif /* HAVE_UNISTD_H */
55: #include <pwd.h>
56: #include <sys/types.h>
57: #include <sys/param.h>
58: #ifdef HAVE_STRING_H
59: #include <string.h>
60: #endif /* HAVE_STRING_H */
61: #ifdef HAVE_STRINGS_H
62: #include <strings.h>
63: #endif /* HAVE_STRINGS_H */
64: #if defined(HAVE_MALLOC_H) && !defined(STDC_HEADERS)
65: #include <malloc.h>
66: #endif /* HAVE_MALLOC_H && !STDC_HEADERS */
67: #if defined(YYBISON) && defined(HAVE_ALLOCA_H) && !defined(__GNUC__)
68: #include <alloca.h>
69: #endif /* YYBISON && HAVE_ALLOCA_H && !__GNUC__ */
70: #ifdef HAVE_LSEARCH
71: #include <search.h>
72: #endif /* HAVE_LSEARCH */
73:
74: #include "sudo.h"
75: #include "parse.h"
76:
77: #ifndef HAVE_LSEARCH
78: #include "emul/search.h"
79: #endif /* HAVE_LSEARCH */
80:
81: #ifndef lint
82: static const char rcsid[] = "$Sudo: parse.yacc,v 1.166 1999/10/07 21:20:57 millert Exp $";
83: #endif /* lint */
84:
85: /*
86: * Globals
87: */
88: extern int sudolineno, parse_error;
89: int errorlineno = -1;
90: int clearaliases = TRUE;
91: int printmatches = FALSE;
92: int pedantic = FALSE;
93:
94: /*
95: * Alias types
96: */
97: #define HOST_ALIAS 1
98: #define CMND_ALIAS 2
99: #define USER_ALIAS 3
100: #define RUNAS_ALIAS 4
101:
102: /*
103: * The matching stack, initial space allocated in init_parser().
104: */
105: struct matchstack *match;
106: int top = 0, stacksize = 0;
107:
108: #define push \
109: do { \
110: if (top >= stacksize) { \
111: while ((stacksize += STACKINCREMENT) < top); \
112: match = (struct matchstack *) erealloc(match, sizeof(struct matchstack) * stacksize); \
113: } \
114: match[top].user = -1; \
115: match[top].cmnd = -1; \
116: match[top].host = -1; \
117: match[top].runas = -1; \
118: match[top].nopass = def_flag(I_AUTHENTICATE) ? -1 : TRUE; \
119: top++; \
120: } while (0)
121:
122: #define pushcp \
123: do { \
124: if (top >= stacksize) { \
125: while ((stacksize += STACKINCREMENT) < top); \
126: match = (struct matchstack *) erealloc(match, sizeof(struct matchstack) * stacksize); \
127: } \
128: match[top].user = match[top-1].user; \
129: match[top].cmnd = match[top-1].cmnd; \
130: match[top].host = match[top-1].host; \
131: match[top].runas = match[top-1].runas; \
132: match[top].nopass = match[top-1].nopass; \
133: top++; \
134: } while (0)
135:
136: #define pop \
137: { \
138: if (top == 0) \
139: yyerror("matching stack underflow"); \
140: else \
141: top--; \
142: }
143:
144: /*
145: * Shortcuts for append()
146: */
147: #define append_cmnd(s, p) append(s, &cm_list[cm_list_len].cmnd, \
148: &cm_list[cm_list_len].cmnd_len, &cm_list[cm_list_len].cmnd_size, p)
149:
150: #define append_runas(s, p) append(s, &cm_list[cm_list_len].runas, \
151: &cm_list[cm_list_len].runas_len, &cm_list[cm_list_len].runas_size, p)
152:
153: #define append_entries(s, p) append(s, &ga_list[ga_list_len-1].entries, \
154: &ga_list[ga_list_len-1].entries_len, \
155: &ga_list[ga_list_len-1].entries_size, p)
156:
157: /*
158: * The stack for printmatches. A list of allowed commands for the user.
159: */
160: static struct command_match *cm_list = NULL;
161: static size_t cm_list_len = 0, cm_list_size = 0;
162:
163: /*
164: * List of Cmnd_Aliases and expansions for `sudo -l'
165: */
166: static int in_alias = FALSE;
167: static size_t ga_list_len = 0, ga_list_size = 0;
168: static struct generic_alias *ga_list = NULL;
169:
170: /*
171: * Does this Defaults list pertain to this user?
172: */
173: static int defaults_matches = 0;
174:
175: /*
176: * Local protoypes
177: */
178: static int add_alias __P((char *, int, int));
179: static void append __P((char *, char **, size_t *, size_t *, char *));
180: static void expand_ga_list __P((void));
181: static void expand_match_list __P((void));
182: static aliasinfo *find_alias __P((char *, int));
183: static int more_aliases __P((void));
184: void init_parser __P((void));
185: void yyerror __P((char *));
186:
187: void
188: yyerror(s)
189: char *s;
190: {
191: /* Save the line the first error occured on. */
192: if (errorlineno == -1)
193: errorlineno = sudolineno ? sudolineno - 1 : 0;
194: if (s) {
195: #ifndef TRACELEXER
196: (void) fprintf(stderr, ">>> sudoers file: %s, line %d <<<\n", s,
197: sudolineno ? sudolineno - 1 : 0);
198: #else
199: (void) fprintf(stderr, "<*> ");
200: #endif
201: }
202: parse_error = TRUE;
203: }
204: %}
205:
206: %union {
207: char *string;
208: int BOOLEAN;
209: struct sudo_command command;
210: int tok;
211: }
212:
213: %start file /* special start symbol */
214: %token <command> COMMAND /* absolute pathname w/ optional args */
215: %token <string> ALIAS /* an UPPERCASE alias name */
216: %token <string> NTWKADDR /* w.x.y.z */
217: %token <string> FQHOST /* foo.bar.com */
218: %token <string> NETGROUP /* a netgroup (+NAME) */
219: %token <string> USERGROUP /* a usergroup (%NAME) */
220: %token <string> WORD /* a word */
221: %token <tok> DEFAULTS /* Defaults entry */
222: %token <tok> DEFAULTS_HOST /* Host-specific defaults entry */
223: %token <tok> DEFAULTS_USER /* User-specific defaults entry */
224: %token <tok> RUNAS /* ( runas_list ) */
225: %token <tok> NOPASSWD /* no passwd req for command */
226: %token <tok> PASSWD /* passwd req for command (default) */
227: %token <tok> ALL /* ALL keyword */
228: %token <tok> COMMENT /* comment and/or carriage return */
229: %token <tok> HOSTALIAS /* Host_Alias keyword */
230: %token <tok> CMNDALIAS /* Cmnd_Alias keyword */
231: %token <tok> USERALIAS /* User_Alias keyword */
232: %token <tok> RUNASALIAS /* Runas_Alias keyword */
233: %token <tok> ':' '=' ',' '!' /* union member tokens */
234: %token <tok> ERROR
235:
236: /*
237: * NOTE: these are not true booleans as there are actually 3 possible values:
238: * 1) TRUE (positive match)
239: * 0) FALSE (negative match due to a '!' somewhere)
240: * -1) No match (don't change the value of *_matches)
241: */
242: %type <BOOLEAN> cmnd
243: %type <BOOLEAN> host
244: %type <BOOLEAN> runasuser
245: %type <BOOLEAN> user
246:
247: %%
248:
249: file : entry
250: | file entry
251: ;
252:
253: entry : COMMENT
254: { ; }
255: | error COMMENT
256: { yyerrok; }
257: | { push; } userlist privileges {
258: while (top && user_matches != TRUE)
259: pop;
260: }
261: | USERALIAS useraliases
262: { ; }
263: | HOSTALIAS hostaliases
264: { ; }
265: | CMNDALIAS cmndaliases
266: { ; }
267: | RUNASALIAS runasaliases
268: { ; }
269: | defaults_line
270: { ; }
271: ;
272:
273: defaults_line : defaults_type defaults_list
274:
275: defaults_type : DEFAULTS {
276: defaults_matches = TRUE;
277: }
278: | DEFAULTS_USER { push; } userlist {
279: defaults_matches = user_matches;
280: pop;
281: }
282: | DEFAULTS_HOST { push; } hostlist {
283: defaults_matches = host_matches;
284: pop;
285: }
286: ;
287:
288: defaults_list : defaults_entry
289: | defaults_entry ',' defaults_list
290:
291: defaults_entry : WORD {
292: if (defaults_matches && !set_default($1, NULL, 1)) {
293: yyerror(NULL);
294: YYERROR;
295: }
296: free($1);
297: }
298: | '!' WORD {
299: if (defaults_matches && !set_default($2, NULL, 0)) {
300: yyerror(NULL);
301: YYERROR;
302: }
303: free($2);
304: }
305: | WORD '=' WORD {
306: /* XXX - need to support quoted values */
307: if (defaults_matches && !set_default($1, $3, 1)) {
308: yyerror(NULL);
309: YYERROR;
310: }
311: free($1);
312: free($3);
313: }
314:
315: privileges : privilege
316: | privileges ':' privilege
317: ;
318:
319: privilege : hostlist '=' cmndspeclist {
320: /*
321: * We already did a push if necessary in
322: * cmndspec so just reset some values so
323: * the next 'privilege' gets a clean slate.
324: */
325: host_matches = -1;
326: runas_matches = -1;
327: if (def_flag(I_AUTHENTICATE))
328: no_passwd = -1;
329: else
330: no_passwd = TRUE;
331: }
332: ;
333:
334: ophost : host {
335: if ($1 != -1)
336: host_matches = $1;
337: }
338: | '!' host {
339: if ($2 != -1)
340: host_matches = ! $2;
341: }
342:
343: host : ALL {
344: $$ = TRUE;
345: }
346: | NTWKADDR {
347: if (addr_matches($1))
348: $$ = TRUE;
349: else
350: $$ = -1;
351: free($1);
352: }
353: | NETGROUP {
354: if (netgr_matches($1, user_host, NULL))
355: $$ = TRUE;
356: else
357: $$ = -1;
358: free($1);
359: }
360: | WORD {
361: if (strcasecmp(user_shost, $1) == 0)
362: $$ = TRUE;
363: else
364: $$ = -1;
365: free($1);
366: }
367: | FQHOST {
368: if (strcasecmp(user_host, $1) == 0)
369: $$ = TRUE;
370: else
371: $$ = -1;
372: free($1);
373: }
374: | ALIAS {
375: aliasinfo *aip = find_alias($1, HOST_ALIAS);
376:
377: /* could be an all-caps hostname */
378: if (aip)
379: $$ = aip->val;
380: else if (strcasecmp(user_shost, $1) == 0)
381: $$ = TRUE;
382: else {
383: if (pedantic) {
384: (void) fprintf(stderr,
385: "%s: undeclared Host_Alias `%s' referenced near line %d\n",
386: (pedantic == 1) ? "Warning" : "Error", $1, sudolineno);
387: if (pedantic > 1) {
388: yyerror(NULL);
389: YYERROR;
390: }
391: }
392: $$ = -1;
393: }
394: free($1);
395: }
396: ;
397:
398: cmndspeclist : cmndspec
399: | cmndspeclist ',' cmndspec
400: ;
401:
402: cmndspec : runasspec nopasswd opcmnd {
403: /*
404: * Push the entry onto the stack if it is worth
405: * saving and clear cmnd_matches for next cmnd.
406: *
407: * We need to save at least one entry on
408: * the stack so sudoers_lookup() can tell that
409: * the user was listed in sudoers. Also, we
410: * need to be able to tell whether or not a
411: * user was listed for this specific host.
412: */
413: if (user_matches != -1 && host_matches != -1 &&
414: cmnd_matches != -1 && runas_matches != -1)
415: pushcp;
416: else if (user_matches != -1 && (top == 1 ||
417: (top == 2 && host_matches != -1 &&
418: match[0].host == -1)))
419: pushcp;
420: cmnd_matches = -1;
421: }
422: ;
423:
424: opcmnd : cmnd {
425: if ($1 != -1)
426: cmnd_matches = $1;
427: }
428: | '!' {
429: if (printmatches == TRUE) {
430: if (in_alias == TRUE)
431: append_entries("!", ", ");
432: else if (host_matches == TRUE &&
433: user_matches == TRUE)
434: append_cmnd("!", NULL);
435: }
436: } cmnd {
437: if ($3 != -1)
438: cmnd_matches = ! $3;
439: }
440: ;
441:
442: runasspec : /* empty */ {
443: if (printmatches == TRUE && host_matches == TRUE &&
444: user_matches == TRUE) {
445: if (runas_matches == -1) {
446: cm_list[cm_list_len].runas_len = 0;
447: } else {
448: /* Inherit runas data. */
449: cm_list[cm_list_len].runas =
450: estrdup(cm_list[cm_list_len-1].runas);
451: cm_list[cm_list_len].runas_len =
452: cm_list[cm_list_len-1].runas_len;
453: cm_list[cm_list_len].runas_size =
454: cm_list[cm_list_len-1].runas_size;
455: }
456: }
457: /*
458: * If this is the first entry in a command list
459: * then check against default runas user.
460: */
461: if (runas_matches == -1)
462: runas_matches = (strcmp(*user_runas,
463: def_str(I_RUNAS_DEF)) == 0);
464: }
465: | RUNAS runaslist { ; }
466: ;
467:
468: runaslist : oprunasuser
469: | runaslist ',' oprunasuser
470: ;
471:
472: oprunasuser : runasuser {
473: if ($1 != -1)
474: runas_matches = $1;
475: }
476: | '!' {
477: if (printmatches == TRUE) {
478: if (in_alias == TRUE)
479: append_entries("!", ", ");
480: else if (host_matches == TRUE &&
481: user_matches == TRUE)
482: append_runas("!", ", ");
483: }
484: } runasuser {
485: if ($3 != -1)
486: runas_matches = ! $3;
487: }
488:
489: runasuser : WORD {
490: if (printmatches == TRUE) {
491: if (in_alias == TRUE)
492: append_entries($1, ", ");
493: else if (host_matches == TRUE &&
494: user_matches == TRUE)
495: append_runas($1, ", ");
496: }
497: if (strcmp($1, *user_runas) == 0)
498: $$ = TRUE;
499: else
500: $$ = -1;
501: free($1);
502: }
503: | USERGROUP {
504: if (printmatches == TRUE) {
505: if (in_alias == TRUE)
506: append_entries($1, ", ");
507: else if (host_matches == TRUE &&
508: user_matches == TRUE)
509: append_runas($1, ", ");
510: }
511: if (usergr_matches($1, *user_runas))
512: $$ = TRUE;
513: else
514: $$ = -1;
515: free($1);
516: }
517: | NETGROUP {
518: if (printmatches == TRUE) {
519: if (in_alias == TRUE)
520: append_entries($1, ", ");
521: else if (host_matches == TRUE &&
522: user_matches == TRUE)
523: append_runas($1, ", ");
524: }
525: if (netgr_matches($1, NULL, *user_runas))
526: $$ = TRUE;
527: else
528: $$ = -1;
529: free($1);
530: }
531: | ALIAS {
532: aliasinfo *aip = find_alias($1, RUNAS_ALIAS);
533:
534: if (printmatches == TRUE) {
535: if (in_alias == TRUE)
536: append_entries($1, ", ");
537: else if (host_matches == TRUE &&
538: user_matches == TRUE)
539: append_runas($1, ", ");
540: }
541: /* could be an all-caps username */
542: if (aip)
543: $$ = aip->val;
544: else if (strcmp($1, *user_runas) == 0)
545: $$ = TRUE;
546: else {
547: if (pedantic) {
548: (void) fprintf(stderr,
549: "%s: undeclared Runas_Alias `%s' referenced near line %d\n",
550: (pedantic == 1) ? "Warning" : "Error", $1, sudolineno);
551: if (pedantic > 1) {
552: yyerror(NULL);
553: YYERROR;
554: }
555: }
556: $$ = -1;
557: }
558: free($1);
559: }
560: | ALL {
561: if (printmatches == TRUE) {
562: if (in_alias == TRUE)
563: append_entries("ALL", ", ");
564: else if (host_matches == TRUE &&
565: user_matches == TRUE)
566: append_runas("ALL", ", ");
567: }
568: $$ = TRUE;
569: }
570: ;
571:
572: nopasswd : /* empty */ {
573: /* Inherit NOPASSWD/PASSWD status. */
574: if (printmatches == TRUE && host_matches == TRUE &&
575: user_matches == TRUE) {
576: if (no_passwd == TRUE)
577: cm_list[cm_list_len].nopasswd = TRUE;
578: else
579: cm_list[cm_list_len].nopasswd = FALSE;
580: }
581: }
582: | NOPASSWD {
583: no_passwd = TRUE;
584: if (printmatches == TRUE && host_matches == TRUE &&
585: user_matches == TRUE)
586: cm_list[cm_list_len].nopasswd = TRUE;
587: }
588: | PASSWD {
589: no_passwd = FALSE;
590: if (printmatches == TRUE && host_matches == TRUE &&
591: user_matches == TRUE)
592: cm_list[cm_list_len].nopasswd = FALSE;
593: }
594: ;
595:
596: cmnd : ALL {
597: if (printmatches == TRUE) {
598: if (in_alias == TRUE)
599: append_entries("ALL", ", ");
600: else if (host_matches == TRUE &&
601: user_matches == TRUE) {
602: append_cmnd("ALL", NULL);
603: expand_match_list();
604: }
605: }
606:
607: $$ = TRUE;
608:
609: if (safe_cmnd)
610: free(safe_cmnd);
611: safe_cmnd = estrdup(user_cmnd);
612: }
613: | ALIAS {
614: aliasinfo *aip;
615:
616: if (printmatches == TRUE) {
617: if (in_alias == TRUE)
618: append_entries($1, ", ");
619: else if (host_matches == TRUE &&
620: user_matches == TRUE) {
621: append_cmnd($1, NULL);
622: expand_match_list();
623: }
624: }
625:
626: if ((aip = find_alias($1, CMND_ALIAS)))
627: $$ = aip->val;
628: else {
629: if (pedantic) {
630: (void) fprintf(stderr,
631: "%s: undeclared Cmnd_Alias `%s' referenced near line %d\n",
632: (pedantic == 1) ? "Warning" : "Error", $1, sudolineno);
633: if (pedantic > 1) {
634: yyerror(NULL);
635: YYERROR;
636: }
637: }
638: $$ = -1;
639: }
640: free($1);
641: }
642: | COMMAND {
643: if (printmatches == TRUE) {
644: if (in_alias == TRUE) {
645: append_entries($1.cmnd, ", ");
646: if ($1.args)
647: append_entries($1.args, " ");
648: }
649: if (host_matches == TRUE &&
650: user_matches == TRUE) {
651: append_cmnd($1.cmnd, NULL);
652: if ($1.args)
653: append_cmnd($1.args, " ");
654: expand_match_list();
655: }
656: }
657:
658: if (command_matches(user_cmnd, user_args,
659: $1.cmnd, $1.args))
660: $$ = TRUE;
661: else
662: $$ = -1;
663:
664: free($1.cmnd);
665: if ($1.args)
666: free($1.args);
667: }
668: ;
669:
670: hostaliases : hostalias
671: | hostaliases ':' hostalias
672: ;
673:
674: hostalias : ALIAS { push; } '=' hostlist {
675: if ((host_matches != -1 || pedantic) &&
676: !add_alias($1, HOST_ALIAS, host_matches))
677: YYERROR;
678: pop;
679: }
680: ;
681:
682: hostlist : ophost
683: | hostlist ',' ophost
684: ;
685:
686: cmndaliases : cmndalias
687: | cmndaliases ':' cmndalias
688: ;
689:
690: cmndalias : ALIAS {
691: push;
692: if (printmatches == TRUE) {
693: in_alias = TRUE;
694: /* Allocate space for ga_list if necessary. */
695: expand_ga_list();
696: ga_list[ga_list_len-1].type = CMND_ALIAS;
697: ga_list[ga_list_len-1].alias = estrdup($1);
698: }
699: } '=' cmndlist {
700: if ((cmnd_matches != -1 || pedantic) &&
701: !add_alias($1, CMND_ALIAS, cmnd_matches))
702: YYERROR;
703: pop;
704: free($1);
705:
706: if (printmatches == TRUE)
707: in_alias = FALSE;
708: }
709: ;
710:
711: cmndlist : opcmnd { ; }
712: | cmndlist ',' opcmnd
713: ;
714:
715: runasaliases : runasalias
716: | runasaliases ':' runasalias
717: ;
718:
719: runasalias : ALIAS {
720: push;
721: if (printmatches == TRUE) {
722: in_alias = TRUE;
723: /* Allocate space for ga_list if necessary. */
724: expand_ga_list();
725: ga_list[ga_list_len-1].type = RUNAS_ALIAS;
726: ga_list[ga_list_len-1].alias = estrdup($1);
727: }
728: } '=' runaslist {
729: if ((runas_matches != -1 || pedantic) &&
730: !add_alias($1, RUNAS_ALIAS, runas_matches))
731: YYERROR;
732: pop;
733: free($1);
734:
735: if (printmatches == TRUE)
736: in_alias = FALSE;
737: }
738: ;
739:
740: useraliases : useralias
741: | useraliases ':' useralias
742: ;
743:
744: useralias : ALIAS { push; } '=' userlist {
745: if ((user_matches != -1 || pedantic) &&
746: !add_alias($1, USER_ALIAS, user_matches))
747: YYERROR;
748: pop;
749: free($1);
750: }
751: ;
752:
753: userlist : opuser
754: | userlist ',' opuser
755: ;
756:
757: opuser : user {
758: if ($1 != -1)
759: user_matches = $1;
760: }
761: | '!' user {
762: if ($2 != -1)
763: user_matches = ! $2;
764: }
765:
766: user : WORD {
767: if (strcmp($1, user_name) == 0)
768: $$ = TRUE;
769: else
770: $$ = -1;
771: free($1);
772: }
773: | USERGROUP {
774: if (usergr_matches($1, user_name))
775: $$ = TRUE;
776: else
777: $$ = -1;
778: free($1);
779: }
780: | NETGROUP {
781: if (netgr_matches($1, NULL, user_name))
782: $$ = TRUE;
783: else
784: $$ = -1;
785: free($1);
786: }
787: | ALIAS {
788: aliasinfo *aip = find_alias($1, USER_ALIAS);
789:
790: /* could be an all-caps username */
791: if (aip)
792: $$ = aip->val;
793: else if (strcmp($1, user_name) == 0)
794: $$ = TRUE;
795: else {
796: if (pedantic) {
797: (void) fprintf(stderr,
798: "%s: undeclared User_Alias `%s' referenced near line %d\n",
799: (pedantic == 1) ? "Warning" : "Error", $1, sudolineno);
800: if (pedantic > 1)
801: YYERROR;
802: }
803: $$ = -1;
804: }
805: free($1);
806: }
807: | ALL {
808: $$ = TRUE;
809: }
810: ;
811:
812: %%
813:
814: #define MOREALIASES (32)
815: aliasinfo *aliases = NULL;
816: size_t naliases = 0;
817: size_t nslots = 0;
818:
819:
820: /*
821: * Compare two aliasinfo structures, strcmp() style.
822: * Note that we do *not* compare their values.
823: */
824: static int
825: aliascmp(a1, a2)
826: const VOID *a1, *a2;
827: {
828: int r;
829: aliasinfo *ai1, *ai2;
830:
831: ai1 = (aliasinfo *) a1;
832: ai2 = (aliasinfo *) a2;
833: if ((r = strcmp(ai1->name, ai2->name)) == 0)
834: r = ai1->type - ai2->type;
835:
836: return(r);
837: }
838:
839: /*
840: * Compare two generic_alias structures, strcmp() style.
841: */
842: static int
843: genaliascmp(entry, key)
844: const VOID *entry, *key;
845: {
846: int r;
847: struct generic_alias *ga1, *ga2;
848:
849: ga1 = (struct generic_alias *) key;
850: ga2 = (struct generic_alias *) entry;
851: if ((r = strcmp(ga1->alias, ga2->alias)) == 0)
852: r = ga1->type - ga2->type;
853:
854: return(r);
855: }
856:
857:
858: /*
859: * Adds the named alias of the specified type to the aliases list.
860: */
861: static int
862: add_alias(alias, type, val)
863: char *alias;
864: int type;
865: int val;
866: {
867: aliasinfo ai, *aip;
868: size_t onaliases;
869: char s[512];
870:
871: if (naliases >= nslots && !more_aliases()) {
872: (void) snprintf(s, sizeof(s), "Out of memory defining alias `%s'",
873: alias);
874: yyerror(s);
875: return(FALSE);
876: }
877:
878: ai.type = type;
879: ai.val = val;
880: ai.name = estrdup(alias);
881: onaliases = naliases;
882:
883: aip = (aliasinfo *) lsearch((VOID *)&ai, (VOID *)aliases, &naliases,
884: sizeof(ai), aliascmp);
885: if (aip == NULL) {
886: (void) snprintf(s, sizeof(s), "Aliases corrupted defining alias `%s'",
887: alias);
888: yyerror(s);
889: return(FALSE);
890: }
891: if (onaliases == naliases) {
892: (void) snprintf(s, sizeof(s), "Alias `%s' already defined", alias);
893: yyerror(s);
894: return(FALSE);
895: }
896:
897: return(TRUE);
898: }
899:
900: /*
901: * Searches for the named alias of the specified type.
902: */
903: static aliasinfo *
904: find_alias(alias, type)
905: char *alias;
906: int type;
907: {
908: aliasinfo ai;
909:
910: ai.name = alias;
911: ai.type = type;
912:
913: return((aliasinfo *) lfind((VOID *)&ai, (VOID *)aliases, &naliases,
914: sizeof(ai), aliascmp));
915: }
916:
917: /*
918: * Allocates more space for the aliases list.
919: */
920: static int
921: more_aliases()
922: {
923:
924: nslots += MOREALIASES;
925: if (nslots == MOREALIASES)
926: aliases = (aliasinfo *) malloc(nslots * sizeof(aliasinfo));
927: else
928: aliases = (aliasinfo *) realloc(aliases, nslots * sizeof(aliasinfo));
929:
930: return(aliases != NULL);
931: }
932:
933: /*
934: * Lists the contents of the aliases list.
935: */
936: void
937: dumpaliases()
938: {
939: size_t n;
940:
941: for (n = 0; n < naliases; n++) {
942: if (aliases[n].val == -1)
943: continue;
944:
945: switch (aliases[n].type) {
946: case HOST_ALIAS:
947: (void) puts("HOST_ALIAS");
948: break;
949:
950: case CMND_ALIAS:
951: (void) puts("CMND_ALIAS");
952: break;
953:
954: case USER_ALIAS:
955: (void) puts("USER_ALIAS");
956: break;
957:
958: case RUNAS_ALIAS:
959: (void) puts("RUNAS_ALIAS");
960: break;
961: }
962: (void) printf("\t%s: %d\n", aliases[n].name, aliases[n].val);
963: }
964: }
965:
966: /*
967: * Lists the contents of cm_list and ga_list for `sudo -l'.
968: */
969: void
970: list_matches()
971: {
972: int i;
973: char *p;
974: struct generic_alias *ga, key;
975:
976: (void) printf("User %s may run the following commands on this host:\n",
977: user_name);
978: for (i = 0; i < cm_list_len; i++) {
979:
980: /* Print the runas list. */
981: (void) fputs(" ", stdout);
982: if (cm_list[i].runas) {
983: (void) putchar('(');
984: p = strtok(cm_list[i].runas, ", ");
985: do {
986: if (p != cm_list[i].runas)
987: (void) fputs(", ", stdout);
988:
989: key.alias = p;
990: key.type = RUNAS_ALIAS;
991: if ((ga = (struct generic_alias *) lfind((VOID *) &key,
992: (VOID *) &ga_list[0], &ga_list_len, sizeof(key), genaliascmp)))
993: (void) fputs(ga->entries, stdout);
994: else
995: (void) fputs(p, stdout);
996: } while ((p = strtok(NULL, ", ")));
997: (void) fputs(") ", stdout);
998: } else {
999: (void) printf("(%s) ", def_str(I_RUNAS_DEF));
1000: }
1001:
1002: /* Is a password required? */
1003: if (cm_list[i].nopasswd == TRUE && def_flag(I_AUTHENTICATE))
1004: (void) fputs("NOPASSWD: ", stdout);
1005: else if (cm_list[i].nopasswd == FALSE && !def_flag(I_AUTHENTICATE))
1006: (void) fputs("PASSWD: ", stdout);
1007:
1008: /* Print the actual command or expanded Cmnd_Alias. */
1009: key.alias = cm_list[i].cmnd;
1010: key.type = CMND_ALIAS;
1011: if ((ga = (struct generic_alias *) lfind((VOID *) &key,
1012: (VOID *) &ga_list[0], &ga_list_len, sizeof(key), genaliascmp)))
1013: (void) puts(ga->entries);
1014: else
1015: (void) puts(cm_list[i].cmnd);
1016: }
1017:
1018: /* Be nice and free up space now that we are done. */
1019: for (i = 0; i < ga_list_len; i++) {
1020: free(ga_list[i].alias);
1021: free(ga_list[i].entries);
1022: }
1023: free(ga_list);
1024: ga_list = NULL;
1025:
1026: for (i = 0; i < cm_list_len; i++) {
1027: free(cm_list[i].runas);
1028: free(cm_list[i].cmnd);
1029: }
1030: free(cm_list);
1031: cm_list = NULL;
1032: cm_list_len = 0;
1033: cm_list_size = 0;
1034: }
1035:
1036: /*
1037: * Appends a source string to the destination, optionally prefixing a separator.
1038: */
1039: static void
1040: append(src, dstp, dst_len, dst_size, separator)
1041: char *src, **dstp;
1042: size_t *dst_len, *dst_size;
1043: char *separator;
1044: {
1045: size_t src_len = strlen(src);
1046: char *dst = *dstp;
1047:
1048: /*
1049: * Only add the separator if there is something to separate from.
1050: * If the last char is a '!', don't apply the separator (XXX).
1051: */
1052: if (separator && dst && dst[*dst_len - 1] != '!')
1053: src_len += strlen(separator);
1054: else
1055: separator = NULL;
1056:
1057: /* Assumes dst will be NULL if not set. */
1058: if (dst == NULL) {
1059: dst = (char *) emalloc(BUFSIZ);
1060: *dst_size = BUFSIZ;
1061: *dst_len = 0;
1062: *dstp = dst;
1063: }
1064:
1065: /* Allocate more space if necessary. */
1066: if (*dst_size <= *dst_len + src_len) {
1067: while (*dst_size <= *dst_len + src_len)
1068: *dst_size += BUFSIZ;
1069:
1070: dst = (char *) erealloc(dst, *dst_size);
1071: *dstp = dst;
1072: }
1073:
1074: /* Copy src -> dst adding a separator if appropriate and adjust len. */
1075: dst += *dst_len;
1076: *dst_len += src_len;
1077: *dst = '\0';
1078: if (separator)
1079: (void) strcat(dst, separator);
1080: (void) strcat(dst, src);
1081: }
1082:
1083: /*
1084: * Frees up space used by the aliases list and resets the associated counters.
1085: */
1086: void
1087: reset_aliases()
1088: {
1089: size_t n;
1090:
1091: if (aliases) {
1092: for (n = 0; n < naliases; n++)
1093: free(aliases[n].name);
1094: free(aliases);
1095: aliases = NULL;
1096: }
1097: naliases = nslots = 0;
1098: }
1099:
1100: /*
1101: * Increments ga_list_len, allocating more space as necessary.
1102: */
1103: static void
1104: expand_ga_list()
1105: {
1106:
1107: if (++ga_list_len >= ga_list_size) {
1108: while ((ga_list_size += STACKINCREMENT) < ga_list_len)
1109: ;
1110: ga_list = (struct generic_alias *)
1111: erealloc(ga_list, sizeof(struct generic_alias) * ga_list_size);
1112: }
1113:
1114: ga_list[ga_list_len - 1].entries = NULL;
1115: }
1116:
1117: /*
1118: * Increments cm_list_len, allocating more space as necessary.
1119: */
1120: static void
1121: expand_match_list()
1122: {
1123:
1124: if (++cm_list_len >= cm_list_size) {
1125: while ((cm_list_size += STACKINCREMENT) < cm_list_len)
1126: ;
1127: if (cm_list == NULL)
1128: cm_list_len = 0; /* start at 0 since it is a subscript */
1129: cm_list = (struct command_match *)
1130: erealloc(cm_list, sizeof(struct command_match) * cm_list_size);
1131: }
1132:
1133: cm_list[cm_list_len].runas = cm_list[cm_list_len].cmnd = NULL;
1134: cm_list[cm_list_len].nopasswd = FALSE;
1135: }
1136:
1137: /*
1138: * Frees up spaced used by a previous parser run and allocates new space
1139: * for various data structures.
1140: */
1141: void
1142: init_parser()
1143: {
1144:
1145: /* Free up old data structures if we run the parser more than once. */
1146: if (match) {
1147: free(match);
1148: match = NULL;
1149: top = 0;
1150: parse_error = FALSE;
1151: errorlineno = -1;
1152: sudolineno = 1;
1153: }
1154:
1155: /* Allocate space for the matching stack. */
1156: stacksize = STACKINCREMENT;
1157: match = (struct matchstack *) emalloc(sizeof(struct matchstack) * stacksize);
1158:
1159: /* Allocate space for the match list (for `sudo -l'). */
1160: if (printmatches == TRUE)
1161: expand_match_list();
1162: }