1/* 2 * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan 3 * (Royal Institute of Technology, Stockholm, Sweden). 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * 3. Neither the name of the Institute nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34#include "krb5_locl.h" 35#include <dirent.h> 36 37#ifndef _WIN32 38 39/* see if principal is mentioned in the filename access file, return 40 TRUE (in result) if so, FALSE otherwise */ 41 42static krb5_error_code 43check_one_file(krb5_context context, 44 const char *filename, 45 struct passwd *pwd, 46 krb5_principal principal, 47 krb5_boolean *result) 48{ 49 FILE *f; 50 char buf[BUFSIZ]; 51 krb5_error_code ret; 52 struct stat st; 53 54 *result = FALSE; 55 56 f = fopen (filename, "r"); 57 if (f == NULL) 58 return errno; 59 rk_cloexec_file(f); 60 61 /* check type and mode of file */ 62 if (fstat(fileno(f), &st) != 0) { 63 fclose (f); 64 return errno; 65 } 66 if (S_ISDIR(st.st_mode)) { 67 fclose (f); 68 return EISDIR; 69 } 70 if (st.st_uid != pwd->pw_uid && st.st_uid != 0) { 71 fclose (f); 72 return EACCES; 73 } 74 if ((st.st_mode & (S_IWGRP | S_IWOTH)) != 0) { 75 fclose (f); 76 return EACCES; 77 } 78 79 while (fgets (buf, sizeof(buf), f) != NULL) { 80 krb5_principal tmp; 81 char *newline = buf + strcspn(buf, "\n"); 82 83 if(*newline != '\n') { 84 int c; 85 c = fgetc(f); 86 if(c != EOF) { 87 while(c != EOF && c != '\n') 88 c = fgetc(f); 89 /* line was too long, so ignore it */ 90 continue; 91 } 92 } 93 *newline = '\0'; 94 ret = krb5_parse_name (context, buf, &tmp); 95 if (ret) 96 continue; 97 *result = krb5_principal_compare (context, principal, tmp); 98 krb5_free_principal (context, tmp); 99 if (*result) { 100 fclose (f); 101 return 0; 102 } 103 } 104 fclose (f); 105 return 0; 106} 107 108static krb5_error_code 109check_directory(krb5_context context, 110 const char *dirname, 111 struct passwd *pwd, 112 krb5_principal principal, 113 krb5_boolean *result) 114{ 115 DIR *d; 116 struct dirent *dent; 117 char filename[MAXPATHLEN]; 118 krb5_error_code ret = 0; 119 struct stat st; 120 121 *result = FALSE; 122 123 if(lstat(dirname, &st) < 0) 124 return errno; 125 126 if (!S_ISDIR(st.st_mode)) 127 return ENOTDIR; 128 129 if (st.st_uid != pwd->pw_uid && st.st_uid != 0) 130 return EACCES; 131 if ((st.st_mode & (S_IWGRP | S_IWOTH)) != 0) 132 return EACCES; 133 134 if((d = opendir(dirname)) == NULL) 135 return errno; 136 137 { 138 int fd; 139 struct stat st2; 140 141 fd = dirfd(d); 142 if(fstat(fd, &st2) < 0) { 143 closedir(d); 144 return errno; 145 } 146 if(st.st_dev != st2.st_dev || st.st_ino != st2.st_ino) { 147 closedir(d); 148 return EACCES; 149 } 150 } 151 152 while((dent = readdir(d)) != NULL) { 153 if(strcmp(dent->d_name, ".") == 0 || 154 strcmp(dent->d_name, "..") == 0 || 155 dent->d_name[0] == '#' || /* emacs autosave */ 156 dent->d_name[strlen(dent->d_name) - 1] == '~') /* emacs backup */ 157 continue; 158 snprintf(filename, sizeof(filename), "%s/%s", dirname, dent->d_name); 159 ret = check_one_file(context, filename, pwd, principal, result); 160 if(ret == 0 && *result == TRUE) 161 break; 162 ret = 0; /* don't propagate errors upstream */ 163 } 164 closedir(d); 165 return ret; 166} 167 168#endif /* !_WIN32 */ 169 170static krb5_boolean 171match_local_principals(krb5_context context, 172 krb5_principal principal, 173 const char *luser) 174{ 175 krb5_error_code ret; 176 krb5_realm *realms, *r; 177 krb5_boolean result = FALSE; 178 179 /* multi-component principals can never match */ 180 if(krb5_principal_get_comp_string(context, principal, 1) != NULL) 181 return FALSE; 182 183 ret = krb5_get_default_realms (context, &realms); 184 if (ret) 185 return FALSE; 186 187 for (r = realms; *r != NULL; ++r) { 188 if(strcmp(krb5_principal_get_realm(context, principal), 189 *r) != 0) 190 continue; 191 if(strcmp(krb5_principal_get_comp_string(context, principal, 0), 192 luser) == 0) { 193 result = TRUE; 194 break; 195 } 196 } 197 krb5_free_host_realm (context, realms); 198 return result; 199} 200 201/** 202 * This function takes the name of a local user and checks if 203 * principal is allowed to log in as that user. 204 * 205 * The user may have a ~/.k5login file listing principals that are 206 * allowed to login as that user. If that file does not exist, all 207 * principals with a first component identical to the username, and a 208 * realm considered local, are allowed access. 209 * 210 * The .k5login file must contain one principal per line, be owned by 211 * user and not be writable by group or other (but must be readable by 212 * anyone). 213 * 214 * Note that if the file exists, no implicit access rights are given 215 * to user@@LOCALREALM. 216 * 217 * Optionally, a set of files may be put in ~/.k5login.d (a 218 * directory), in which case they will all be checked in the same 219 * manner as .k5login. The files may be called anything, but files 220 * starting with a hash (#) , or ending with a tilde (~) are 221 * ignored. Subdirectories are not traversed. Note that this directory 222 * may not be checked by other Kerberos implementations. 223 * 224 * If no configuration file exists, match user against local domains, 225 * ie luser@@LOCAL-REALMS-IN-CONFIGURATION-FILES. 226 * 227 * @param context Kerberos 5 context. 228 * @param principal principal to check if allowed to login 229 * @param luser local user id 230 * 231 * @return returns TRUE if access should be granted, FALSE otherwise. 232 * 233 * @ingroup krb5_support 234 */ 235 236KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL 237krb5_kuserok (krb5_context context, 238 krb5_principal principal, 239 const char *luser) 240{ 241#ifndef _WIN32 242 char *buf; 243 size_t buflen; 244 struct passwd *pwd = NULL; 245 char *profile_dir = NULL; 246 krb5_error_code ret; 247 krb5_boolean result = FALSE; 248 249 krb5_boolean found_file = FALSE; 250 251#ifdef POSIX_GETPWNAM_R 252 char pwbuf[2048]; 253 struct passwd pw; 254 255 if(getpwnam_r(luser, &pw, pwbuf, sizeof(pwbuf), &pwd) != 0) 256 return FALSE; 257#else 258 pwd = getpwnam (luser); 259#endif 260 if (pwd == NULL) 261 return FALSE; 262 profile_dir = pwd->pw_dir; 263 264#define KLOGIN "/.k5login" 265 buflen = strlen(profile_dir) + sizeof(KLOGIN) + 2; /* 2 for .d */ 266 buf = malloc(buflen); 267 if(buf == NULL) 268 return FALSE; 269 /* check user's ~/.k5login */ 270 strlcpy(buf, profile_dir, buflen); 271 strlcat(buf, KLOGIN, buflen); 272 ret = check_one_file(context, buf, pwd, principal, &result); 273 274 if(ret == 0 && result == TRUE) { 275 free(buf); 276 return TRUE; 277 } 278 279 if(ret != ENOENT) 280 found_file = TRUE; 281 282 strlcat(buf, ".d", buflen); 283 ret = check_directory(context, buf, pwd, principal, &result); 284 free(buf); 285 if(ret == 0 && result == TRUE) 286 return TRUE; 287 288 if(ret != ENOENT && ret != ENOTDIR) 289 found_file = TRUE; 290 291 /* finally if no files exist, allow all principals matching 292 <localuser>@<LOCALREALM> */ 293 if(found_file == FALSE) 294 return match_local_principals(context, principal, luser); 295 296 return FALSE; 297#else 298 /* The .k5login file may be on a remote profile and we don't have 299 access to the profile until we have a token handle for the 300 user's credentials. */ 301 return match_local_principals(context, principal, luser); 302#endif 303} 304