lock.c revision 200462
1/* 2 * Copyright (c) 1980, 1987, 1993 3 * The Regents of the University of California. All rights reserved. 4 * 5 * This code is derived from software contributed to Berkeley by 6 * Bob Toxen. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. All advertising materials mentioning features or use of this software 17 * must display the following acknowledgement: 18 * This product includes software developed by the University of 19 * California, Berkeley and its contributors. 20 * 4. Neither the name of the University nor the names of its contributors 21 * may be used to endorse or promote products derived from this software 22 * without specific prior written permission. 23 * 24 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 34 * SUCH DAMAGE. 35 */ 36 37#ifndef lint 38static const char copyright[] = 39"@(#) Copyright (c) 1980, 1987, 1993\n\ 40 The Regents of the University of California. All rights reserved.\n"; 41#endif /* not lint */ 42 43#ifndef lint 44#if 0 45static char sccsid[] = "@(#)lock.c 8.1 (Berkeley) 6/6/93"; 46#endif 47#endif /* not lint */ 48#include <sys/cdefs.h> 49__FBSDID("$FreeBSD: head/usr.bin/lock/lock.c 200462 2009-12-13 03:14:06Z delphij $"); 50 51/* 52 * Lock a terminal up until the given key is entered or the given 53 * interval times out. 54 * 55 * Timeout interval is by default TIMEOUT, it can be changed with 56 * an argument of the form -time where time is in minutes 57 */ 58 59#include <sys/param.h> 60#include <sys/stat.h> 61#include <sys/time.h> 62#include <sys/signal.h> 63#include <sys/consio.h> 64#include <err.h> 65#include <ctype.h> 66#include <errno.h> 67#include <pwd.h> 68#include <stdio.h> 69#include <stdlib.h> 70#include <string.h> 71#include <syslog.h> 72#include <termios.h> 73#include <unistd.h> 74 75#define TIMEOUT 15 76 77void quit(int); 78void bye(int); 79void hi(int); 80static void usage(void); 81 82struct timeval timeout; 83struct timeval zerotime; 84struct termios tty, ntty; 85long nexttime; /* keep the timeout time */ 86int no_timeout; /* lock terminal forever */ 87int vtyunlock; /* Unlock flag and code. */ 88 89/*ARGSUSED*/ 90int 91main(int argc, char **argv) 92{ 93 struct passwd *pw; 94 struct timeval timval; 95 time_t timval_sec; 96 struct itimerval ntimer, otimer; 97 struct tm *timp; 98 int ch, failures, sectimeout, usemine, vtylock; 99 char *ap, *mypw, *ttynam, *tzn; 100 char hostname[MAXHOSTNAMELEN], s[BUFSIZ], s1[BUFSIZ]; 101 102 openlog("lock", LOG_ODELAY, LOG_AUTH); 103 104 sectimeout = TIMEOUT; 105 mypw = NULL; 106 usemine = 0; 107 no_timeout = 0; 108 vtylock = 0; 109 while ((ch = getopt(argc, argv, "npt:v")) != -1) 110 switch((char)ch) { 111 case 't': 112 if ((sectimeout = atoi(optarg)) <= 0) 113 errx(1, "illegal timeout value"); 114 break; 115 case 'p': 116 usemine = 1; 117 if (!(pw = getpwuid(getuid()))) 118 errx(1, "unknown uid %d", getuid()); 119 mypw = strdup(pw->pw_passwd); 120 break; 121 case 'n': 122 no_timeout = 1; 123 break; 124 case 'v': 125 vtylock = 1; 126 break; 127 case '?': 128 default: 129 usage(); 130 } 131 timeout.tv_sec = sectimeout * 60; 132 133 setuid(getuid()); /* discard privs */ 134 135 if (tcgetattr(0, &tty)) /* get information for header */ 136 exit(1); 137 gethostname(hostname, sizeof(hostname)); 138 if (!(ttynam = ttyname(0))) 139 errx(1, "not a terminal?"); 140 if (gettimeofday(&timval, (struct timezone *)NULL)) 141 err(1, "gettimeofday"); 142 nexttime = timval.tv_sec + (sectimeout * 60); 143 timval_sec = timval.tv_sec; 144 timp = localtime(&timval_sec); 145 ap = asctime(timp); 146 tzn = timp->tm_zone; 147 148 (void)signal(SIGINT, quit); 149 (void)signal(SIGQUIT, quit); 150 ntty = tty; ntty.c_lflag &= ~ECHO; 151 (void)tcsetattr(0, TCSADRAIN|TCSASOFT, &ntty); 152 153 if (!mypw) { 154 /* get key and check again */ 155 (void)printf("Key: "); 156 if (!fgets(s, sizeof(s), stdin) || *s == '\n') 157 quit(0); 158 (void)printf("\nAgain: "); 159 /* 160 * Don't need EOF test here, if we get EOF, then s1 != s 161 * and the right things will happen. 162 */ 163 (void)fgets(s1, sizeof(s1), stdin); 164 (void)putchar('\n'); 165 if (strcmp(s1, s)) { 166 (void)printf("\07lock: passwords didn't match.\n"); 167 (void)tcsetattr(0, TCSADRAIN|TCSASOFT, &tty); 168 exit(1); 169 } 170 s[0] = '\0'; 171 mypw = s1; 172 } 173 174 /* set signal handlers */ 175 (void)signal(SIGINT, hi); 176 (void)signal(SIGQUIT, hi); 177 (void)signal(SIGTSTP, hi); 178 (void)signal(SIGALRM, bye); 179 180 ntimer.it_interval = zerotime; 181 ntimer.it_value = timeout; 182 if (!no_timeout) 183 setitimer(ITIMER_REAL, &ntimer, &otimer); 184 if (vtylock) { 185 /* 186 * If this failed, we want to err out; warn isn't good 187 * enough, since we don't want the user to think that 188 * everything is nice and locked because they got a 189 * "Key:" prompt. 190 */ 191 if (ioctl(0, VT_LOCKSWITCH, &vtylock) == -1) { 192 (void)tcsetattr(0, TCSADRAIN|TCSASOFT, &tty); 193 err(1, "locking vty"); 194 } 195 vtyunlock = 0x2; 196 } 197 198 /* header info */ 199 (void)printf("lock: %s on %s.", ttynam, hostname); 200 if (no_timeout) 201 (void)printf(" no timeout."); 202 else 203 (void)printf(" timeout in %d minute%s.", sectimeout, 204 sectimeout != 1 ? "s" : ""); 205 if (vtylock) 206 (void)printf(" vty locked."); 207 (void)printf("\ntime now is %.20s%s%s", ap, tzn, ap + 19); 208 209 failures = 0; 210 211 for (;;) { 212 (void)printf("Key: "); 213 if (!fgets(s, sizeof(s), stdin)) { 214 clearerr(stdin); 215 hi(0); 216 goto tryagain; 217 } 218 if (usemine) { 219 s[strlen(s) - 1] = '\0'; 220 if (!strcmp(mypw, crypt(s, mypw))) 221 break; 222 } 223 else if (!strcmp(s, s1)) 224 break; 225 (void)printf("\07\n"); 226 failures++; 227 if (getuid() == 0) 228 syslog(LOG_NOTICE, "%d ROOT UNLOCK FAILURE%s (%s on %s)", 229 failures, failures > 1 ? "S": "", ttynam, hostname); 230tryagain: 231 if (tcgetattr(0, &ntty) && (errno != EINTR)) 232 exit(1); 233 sleep(1); /* to discourage guessing */ 234 } 235 if (getuid() == 0) 236 syslog(LOG_NOTICE, "ROOT UNLOCK ON hostname %s port %s", 237 hostname, ttynam); 238 quit(0); 239 return(0); /* not reached */ 240} 241 242 243static void 244usage(void) 245{ 246 (void)fprintf(stderr, "usage: lock [-npv] [-t timeout]\n"); 247 exit(1); 248} 249 250void 251hi(int signo __unused) 252{ 253 struct timeval timval; 254 255 if (!gettimeofday(&timval, (struct timezone *)NULL)) { 256 (void)printf("lock: type in the unlock key. "); 257 if (no_timeout) { 258 (void)putchar('\n'); 259 } else { 260 (void)printf("timeout in %ld:%ld minutes\n", 261 (nexttime - timval.tv_sec) / 60, 262 (nexttime - timval.tv_sec) % 60); 263 } 264 } 265} 266 267void 268quit(int signo __unused) 269{ 270 (void)putchar('\n'); 271 (void)tcsetattr(0, TCSADRAIN|TCSASOFT, &tty); 272 if (vtyunlock) 273 (void)ioctl(0, VT_LOCKSWITCH, &vtyunlock); 274 exit(0); 275} 276 277void 278bye(int signo __unused) 279{ 280 if (!no_timeout) { 281 (void)tcsetattr(0, TCSADRAIN|TCSASOFT, &tty); 282 if (vtyunlock) 283 (void)ioctl(0, VT_LOCKSWITCH, &vtyunlock); 284 (void)printf("lock: timeout\n"); 285 exit(1); 286 } 287} 288