Annotation of src/usr.bin/sudo/testsudoers.c, Revision 1.1
1.1 ! millert 1: /*
! 2: * Copyright (c) 1996, 1998, 1999 Todd C. Miller <Todd.Miller@courtesan.com>
! 3: * All rights reserved.
! 4: *
! 5: * This code is derived from software contributed by Chris Jepeway
! 6: * <jepeway@cs.utk.edu>.
! 7: *
! 8: * Redistribution and use in source and binary forms, with or without
! 9: * modification, are permitted provided that the following conditions
! 10: * are met:
! 11: *
! 12: * 1. Redistributions of source code must retain the above copyright
! 13: * notice, this list of conditions and the following disclaimer.
! 14: *
! 15: * 2. Redistributions in binary form must reproduce the above copyright
! 16: * notice, this list of conditions and the following disclaimer in the
! 17: * documentation and/or other materials provided with the distribution.
! 18: *
! 19: * 3. The name of the author may not be used to endorse or promote products
! 20: * derived from this software without specific prior written permission.
! 21: *
! 22: * 4. Products derived from this software may not be called "Sudo" nor
! 23: * may "Sudo" appear in their names without specific prior written
! 24: * permission from the author.
! 25: *
! 26: * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
! 27: * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
! 28: * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
! 29: * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
! 30: * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
! 31: * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
! 32: * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
! 33: * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
! 34: * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
! 35: * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
! 36: */
! 37:
! 38: #include "config.h"
! 39:
! 40: #include <stdio.h>
! 41: #ifdef STDC_HEADERS
! 42: # include <stdlib.h>
! 43: #endif /* STDC_HEADERS */
! 44: #ifdef HAVE_UNISTD_H
! 45: # include <unistd.h>
! 46: #endif /* HAVE_UNISTD_H */
! 47: #ifdef HAVE_STRING_H
! 48: # include <string.h>
! 49: #endif /* HAVE_STRING_H */
! 50: #ifdef HAVE_STRINGS_H
! 51: # include <strings.h>
! 52: #endif /* HAVE_STRINGS_H */
! 53: #if defined(HAVE_FNMATCH) && defined(HAVE_FNMATCH_H)
! 54: # include <fnmatch.h>
! 55: #endif /* HAVE_FNMATCH_H */
! 56: #ifdef HAVE_NETGROUP_H
! 57: # include <netgroup.h>
! 58: #endif /* HAVE_NETGROUP_H */
! 59: #include <ctype.h>
! 60: #include <pwd.h>
! 61: #include <grp.h>
! 62: #include <sys/param.h>
! 63: #include <sys/types.h>
! 64: #include <sys/socket.h>
! 65: #include <netinet/in.h>
! 66: #include <arpa/inet.h>
! 67: #include <netdb.h>
! 68: #include <sys/stat.h>
! 69: #include <dirent.h>
! 70:
! 71: #include "sudo.h"
! 72: #include "parse.h"
! 73: #include "interfaces.h"
! 74:
! 75: #ifndef HAVE_FNMATCH
! 76: # include "emul/fnmatch.h"
! 77: #endif /* HAVE_FNMATCH */
! 78:
! 79: #ifndef lint
! 80: static const char rcsid[] = "$Sudo: testsudoers.c,v 1.64 1999/09/08 08:06:19 millert Exp $";
! 81: #endif /* lint */
! 82:
! 83: /*
! 84: * Globals
! 85: */
! 86: char **Argv, **NewArgv;
! 87: int Argc, NewArgc;
! 88: int parse_error = FALSE;
! 89: int num_interfaces;
! 90: struct interface *interfaces;
! 91: struct sudo_user sudo_user;
! 92: extern int clearaliases;
! 93: extern int pedantic;
! 94:
! 95: /*
! 96: * Prototypes for external functions
! 97: */
! 98: void init_parser __P((void));
! 99: void dumpaliases __P((void));
! 100:
! 101: /*
! 102: * Returns TRUE if "s" has shell meta characters in it,
! 103: * else returns FALSE.
! 104: */
! 105: int
! 106: has_meta(s)
! 107: char *s;
! 108: {
! 109: register char *t;
! 110:
! 111: for (t = s; *t; t++) {
! 112: if (*t == '\\' || *t == '?' || *t == '*' || *t == '[' || *t == ']')
! 113: return(TRUE);
! 114: }
! 115: return(FALSE);
! 116: }
! 117:
! 118: /*
! 119: * Returns TRUE if cmnd matches, in the sudo sense,
! 120: * the pathname in path; otherwise, return FALSE
! 121: */
! 122: int
! 123: command_matches(cmnd, cmnd_args, path, sudoers_args)
! 124: char *cmnd;
! 125: char *cmnd_args;
! 126: char *path;
! 127: char *sudoers_args;
! 128: {
! 129: int clen, plen;
! 130: char *args;
! 131:
! 132: if (cmnd == NULL)
! 133: return(FALSE);
! 134:
! 135: if ((args = strchr(path, ' ')))
! 136: *args++ = '\0';
! 137:
! 138: if (has_meta(path)) {
! 139: if (fnmatch(path, cmnd, FNM_PATHNAME))
! 140: return(FALSE);
! 141: if (!sudoers_args)
! 142: return(TRUE);
! 143: else if (!cmnd_args && sudoers_args && !strcmp("\"\"", sudoers_args))
! 144: return(TRUE);
! 145: else if (sudoers_args)
! 146: return((fnmatch(sudoers_args, cmnd_args ? cmnd_args : "", 0) == 0));
! 147: else
! 148: return(FALSE);
! 149: } else {
! 150: plen = strlen(path);
! 151: if (path[plen - 1] != '/') {
! 152: if (strcmp(cmnd, path))
! 153: return(FALSE);
! 154: if (!sudoers_args)
! 155: return(TRUE);
! 156: else if (!cmnd_args && sudoers_args && !strcmp("\"\"", sudoers_args))
! 157: return(TRUE);
! 158: else if (sudoers_args)
! 159: return((fnmatch(sudoers_args, cmnd_args ? cmnd_args : "", 0) == 0));
! 160: else
! 161: return(FALSE);
! 162: }
! 163:
! 164: clen = strlen(cmnd);
! 165: if (clen < plen + 1)
! 166: /* path cannot be the parent dir of cmnd */
! 167: return(FALSE);
! 168:
! 169: if (strchr(cmnd + plen + 1, '/') != NULL)
! 170: /* path could only be an anscestor of cmnd -- */
! 171: /* ignoring, of course, things like // & /./ */
! 172: return(FALSE);
! 173:
! 174: /* see whether path is the prefix of cmnd */
! 175: return((strncmp(cmnd, path, plen) == 0));
! 176: }
! 177: }
! 178:
! 179: int
! 180: addr_matches(n)
! 181: char *n;
! 182: {
! 183: int i;
! 184: char *m;
! 185: struct in_addr addr, mask;
! 186:
! 187: /* If there's an explicit netmask, use it. */
! 188: if ((m = strchr(n, '/'))) {
! 189: *m++ = '\0';
! 190: addr.s_addr = inet_addr(n);
! 191: if (strchr(m, '.'))
! 192: mask.s_addr = inet_addr(m);
! 193: else
! 194: mask.s_addr = (1 << atoi(m)) - 1; /* XXX - better way? */
! 195: *(m - 1) = '/';
! 196:
! 197: for (i = 0; i < num_interfaces; i++)
! 198: if ((interfaces[i].addr.s_addr & mask.s_addr) == addr.s_addr)
! 199: return(TRUE);
! 200: } else {
! 201: addr.s_addr = inet_addr(n);
! 202:
! 203: for (i = 0; i < num_interfaces; i++)
! 204: if (interfaces[i].addr.s_addr == addr.s_addr ||
! 205: (interfaces[i].addr.s_addr & interfaces[i].netmask.s_addr)
! 206: == addr.s_addr)
! 207: return(TRUE);
! 208: }
! 209:
! 210: return(FALSE);
! 211: }
! 212:
! 213: int
! 214: usergr_matches(group, user)
! 215: char *group;
! 216: char *user;
! 217: {
! 218: struct group *grp;
! 219: char **cur;
! 220:
! 221: /* Make sure we have a valid usergroup, sudo style. */
! 222: if (*group++ != '%')
! 223: return(FALSE);
! 224:
! 225: if ((grp = getgrnam(group)) == NULL)
! 226: return(FALSE);
! 227:
! 228: /*
! 229: * Check against user's real gid as well as group's user list
! 230: */
! 231: if (getgid() == grp->gr_gid)
! 232: return(TRUE);
! 233:
! 234: for (cur=grp->gr_mem; *cur; cur++) {
! 235: if (strcmp(*cur, user) == 0)
! 236: return(TRUE);
! 237: }
! 238:
! 239: return(FALSE);
! 240: }
! 241:
! 242: int
! 243: netgr_matches(netgr, host, user)
! 244: char *netgr;
! 245: char *host;
! 246: char *user;
! 247: {
! 248: #ifdef HAVE_GETDOMAINNAME
! 249: static char *domain = (char *) -1;
! 250: #else
! 251: static char *domain = NULL;
! 252: #endif /* HAVE_GETDOMAINNAME */
! 253:
! 254: /* Make sure we have a valid netgroup, sudo style. */
! 255: if (*netgr++ != '+')
! 256: return(FALSE);
! 257:
! 258: #ifdef HAVE_GETDOMAINNAME
! 259: /* Get the domain name (if any). */
! 260: if (domain == (char *) -1) {
! 261: domain = (char *) emalloc(MAXHOSTNAMELEN);
! 262:
! 263: if (getdomainname(domain, MAXHOSTNAMELEN) != 0 || *domain == '\0') {
! 264: free(domain);
! 265: domain = NULL;
! 266: }
! 267: }
! 268: #endif /* HAVE_GETDOMAINNAME */
! 269:
! 270: #ifdef HAVE_INNETGR
! 271: return(innetgr(netgr, host, user, domain));
! 272: #else
! 273: return(FALSE);
! 274: #endif /* HAVE_INNETGR */
! 275: }
! 276:
! 277: void
! 278: set_perms(i, j)
! 279: int i, j;
! 280: {
! 281: return;
! 282: }
! 283:
! 284: int
! 285: main(argc, argv)
! 286: int argc;
! 287: char **argv;
! 288: {
! 289: struct passwd pw;
! 290: char *p;
! 291: #ifdef YYDEBUG
! 292: extern int yydebug;
! 293: yydebug = 1;
! 294: #endif
! 295:
! 296: Argv = argv;
! 297: Argc = argc;
! 298:
! 299: if (Argc >= 6 && strcmp(Argv[1], "-u") == 0) {
! 300: user_runas = &Argv[2];
! 301: pw.pw_name = Argv[3];
! 302: user_host = Argv[4];
! 303: user_cmnd = Argv[5];
! 304:
! 305: NewArgv = &Argv[5];
! 306: NewArgc = Argc - 5;
! 307: } else if (Argc >= 4) {
! 308: pw.pw_name = Argv[1];
! 309: user_host = Argv[2];
! 310: user_cmnd = Argv[3];
! 311:
! 312: NewArgv = &Argv[3];
! 313: NewArgc = Argc - 3;
! 314: } else {
! 315: (void) fprintf(stderr,
! 316: "usage: %s [-u user] <user> <host> <command> [args]\n", Argv[0]);
! 317: exit(1);
! 318: }
! 319:
! 320: sudo_user.pw = &pw; /* user_name needs to be defined */
! 321:
! 322: if ((p = strchr(user_host, '.'))) {
! 323: *p = '\0';
! 324: user_shost = estrdup(user_host);
! 325: *p = '.';
! 326: } else {
! 327: user_shost = user_host;
! 328: }
! 329:
! 330: /* Fill in cmnd_args from NewArgv. */
! 331: if (NewArgc > 1) {
! 332: size_t size;
! 333: char *to, **from;
! 334:
! 335: size = (size_t) NewArgv[NewArgc-1] + strlen(NewArgv[NewArgc-1]) -
! 336: (size_t) NewArgv[1] + 1;
! 337: user_args = (char *) emalloc(size);
! 338: for (to = user_args, from = &NewArgv[1]; *from; from++) {
! 339: *to++ = ' ';
! 340: (void) strcpy(to, *from);
! 341: to += strlen(*from);
! 342: }
! 343: }
! 344:
! 345: /* Initialize default values. */
! 346: init_defaults();
! 347:
! 348: /* Warn about aliases that are used before being defined. */
! 349: pedantic = TRUE;
! 350:
! 351: /* Need to keep aliases around for dumpaliases(). */
! 352: clearaliases = FALSE;
! 353:
! 354: /* Load ip addr/mask for each interface. */
! 355: load_interfaces();
! 356:
! 357: /* Allocate space for data structures in the parser. */
! 358: init_parser();
! 359:
! 360: if (yyparse() || parse_error) {
! 361: (void) printf("doesn't parse.\n");
! 362: } else {
! 363: (void) printf("parses OK.\n\n");
! 364: if (top == 0)
! 365: (void) printf("User %s not found\n", pw.pw_name);
! 366: else while (top) {
! 367: (void) printf("[%d]\n", top-1);
! 368: (void) printf("user_match : %d\n", user_matches);
! 369: (void) printf("host_match : %d\n", host_matches);
! 370: (void) printf("cmnd_match : %d\n", cmnd_matches);
! 371: (void) printf("no_passwd : %d\n", no_passwd);
! 372: (void) printf("runas_match: %d\n", runas_matches);
! 373: (void) printf("runas : %s\n", *user_runas);
! 374: top--;
! 375: }
! 376: }
! 377:
! 378: /* Dump aliases. */
! 379: (void) printf("Matching Aliases --\n");
! 380: dumpaliases();
! 381:
! 382: exit(0);
! 383: }
![[BACK]](/icons/back.gif){kind=icon}
Return to testsudoers.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / sudo