lock.c revision 216696
1/* 2 * Copyright (c) 1980, 1987, 1993 3 * The Regents of the University of California. All rights reserved. 4 * 5 * This code is derived from software contributed to Berkeley by 6 * Bob Toxen. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 4. Neither the name of the University nor the names of its contributors 17 * may be used to endorse or promote products derived from this software 18 * without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 */ 32 33#ifndef lint 34static const char copyright[] = 35"@(#) Copyright (c) 1980, 1987, 1993\n\ 36 The Regents of the University of California. All rights reserved.\n"; 37#endif /* not lint */ 38 39#ifndef lint 40#if 0 41static char sccsid[] = "@(#)lock.c 8.1 (Berkeley) 6/6/93"; 42#endif 43#endif /* not lint */ 44#include <sys/cdefs.h> 45__FBSDID("$FreeBSD: head/usr.bin/lock/lock.c 216696 2010-12-25 11:24:27Z ed $"); 46 47/* 48 * Lock a terminal up until the given key is entered or the given 49 * interval times out. 50 * 51 * Timeout interval is by default TIMEOUT, it can be changed with 52 * an argument of the form -time where time is in minutes 53 */ 54 55#include <sys/param.h> 56#include <sys/stat.h> 57#include <sys/time.h> 58#include <sys/signal.h> 59#include <sys/consio.h> 60#include <err.h> 61#include <ctype.h> 62#include <errno.h> 63#include <paths.h> 64#include <pwd.h> 65#include <stdint.h> 66#include <stdio.h> 67#include <stdlib.h> 68#include <string.h> 69#include <syslog.h> 70#include <termios.h> 71#include <unistd.h> 72 73#define TIMEOUT 15 74 75void quit(int); 76void bye(int); 77void hi(int); 78static void usage(void); 79 80struct timeval timeout; 81struct timeval zerotime; 82struct termios tty, ntty; 83long nexttime; /* keep the timeout time */ 84int no_timeout; /* lock terminal forever */ 85int vtyunlock; /* Unlock flag and code. */ 86 87/*ARGSUSED*/ 88int 89main(int argc, char **argv) 90{ 91 struct passwd *pw; 92 struct timeval timval; 93 time_t timval_sec; 94 struct itimerval ntimer, otimer; 95 struct tm *timp; 96 int ch, failures, sectimeout, usemine, vtylock; 97 char *ap, *mypw, *ttynam, *tzn; 98 char hostname[MAXHOSTNAMELEN], s[BUFSIZ], s1[BUFSIZ]; 99 100 openlog("lock", LOG_ODELAY, LOG_AUTH); 101 102 sectimeout = TIMEOUT; 103 pw = NULL; 104 mypw = NULL; 105 usemine = 0; 106 no_timeout = 0; 107 vtylock = 0; 108 while ((ch = getopt(argc, argv, "npt:v")) != -1) 109 switch((char)ch) { 110 case 't': 111 if ((sectimeout = atoi(optarg)) <= 0) 112 errx(1, "illegal timeout value"); 113 break; 114 case 'p': 115 usemine = 1; 116 if (!(pw = getpwuid(getuid()))) 117 errx(1, "unknown uid %d", getuid()); 118 mypw = strdup(pw->pw_passwd); 119 break; 120 case 'n': 121 no_timeout = 1; 122 break; 123 case 'v': 124 vtylock = 1; 125 break; 126 case '?': 127 default: 128 usage(); 129 } 130 timeout.tv_sec = sectimeout * 60; 131 132 setuid(getuid()); /* discard privs */ 133 134 if (tcgetattr(0, &tty)) /* get information for header */ 135 exit(1); 136 gethostname(hostname, sizeof(hostname)); 137 if (!(ttynam = ttyname(0))) 138 errx(1, "not a terminal?"); 139 if (strncmp(ttynam, _PATH_DEV, strlen(_PATH_DEV)) == 0) 140 ttynam += strlen(_PATH_DEV); 141 if (gettimeofday(&timval, (struct timezone *)NULL)) 142 err(1, "gettimeofday"); 143 nexttime = timval.tv_sec + (sectimeout * 60); 144 timval_sec = timval.tv_sec; 145 timp = localtime(&timval_sec); 146 ap = asctime(timp); 147 tzn = timp->tm_zone; 148 149 (void)signal(SIGINT, quit); 150 (void)signal(SIGQUIT, quit); 151 ntty = tty; ntty.c_lflag &= ~ECHO; 152 (void)tcsetattr(0, TCSADRAIN|TCSASOFT, &ntty); 153 154 if (!mypw) { 155 /* get key and check again */ 156 (void)printf("Key: "); 157 if (!fgets(s, sizeof(s), stdin) || *s == '\n') 158 quit(0); 159 (void)printf("\nAgain: "); 160 /* 161 * Don't need EOF test here, if we get EOF, then s1 != s 162 * and the right things will happen. 163 */ 164 (void)fgets(s1, sizeof(s1), stdin); 165 (void)putchar('\n'); 166 if (strcmp(s1, s)) { 167 (void)printf("\07lock: passwords didn't match.\n"); 168 (void)tcsetattr(0, TCSADRAIN|TCSASOFT, &tty); 169 exit(1); 170 } 171 s[0] = '\0'; 172 mypw = s1; 173 } 174 175 /* set signal handlers */ 176 (void)signal(SIGINT, hi); 177 (void)signal(SIGQUIT, hi); 178 (void)signal(SIGTSTP, hi); 179 (void)signal(SIGALRM, bye); 180 181 ntimer.it_interval = zerotime; 182 ntimer.it_value = timeout; 183 if (!no_timeout) 184 setitimer(ITIMER_REAL, &ntimer, &otimer); 185 if (vtylock) { 186 /* 187 * If this failed, we want to err out; warn isn't good 188 * enough, since we don't want the user to think that 189 * everything is nice and locked because they got a 190 * "Key:" prompt. 191 */ 192 if (ioctl(0, VT_LOCKSWITCH, &vtylock) == -1) { 193 (void)tcsetattr(0, TCSADRAIN|TCSASOFT, &tty); 194 err(1, "locking vty"); 195 } 196 vtyunlock = 0x2; 197 } 198 199 /* header info */ 200 if (pw != NULL) 201 (void)printf("lock: %s using %s on %s.", pw->pw_name, ttynam, hostname); 202 else 203 (void)printf("lock: %s on %s.", ttynam, hostname); 204 if (no_timeout) 205 (void)printf(" no timeout."); 206 else 207 (void)printf(" timeout in %d minute%s.", sectimeout, 208 sectimeout != 1 ? "s" : ""); 209 if (vtylock) 210 (void)printf(" vty locked."); 211 (void)printf("\ntime now is %.20s%s%s", ap, tzn, ap + 19); 212 213 failures = 0; 214 215 for (;;) { 216 (void)printf("Key: "); 217 if (!fgets(s, sizeof(s), stdin)) { 218 clearerr(stdin); 219 hi(0); 220 goto tryagain; 221 } 222 if (usemine) { 223 s[strlen(s) - 1] = '\0'; 224 if (!strcmp(mypw, crypt(s, mypw))) 225 break; 226 } 227 else if (!strcmp(s, s1)) 228 break; 229 (void)printf("\07\n"); 230 failures++; 231 if (getuid() == 0) 232 syslog(LOG_NOTICE, "%d ROOT UNLOCK FAILURE%s (%s on %s)", 233 failures, failures > 1 ? "S": "", ttynam, hostname); 234tryagain: 235 if (tcgetattr(0, &ntty) && (errno != EINTR)) 236 exit(1); 237 sleep(1); /* to discourage guessing */ 238 } 239 if (getuid() == 0) 240 syslog(LOG_NOTICE, "ROOT UNLOCK ON hostname %s port %s", 241 hostname, ttynam); 242 quit(0); 243 return(0); /* not reached */ 244} 245 246 247static void 248usage(void) 249{ 250 (void)fprintf(stderr, "usage: lock [-npv] [-t timeout]\n"); 251 exit(1); 252} 253 254void 255hi(int signo __unused) 256{ 257 struct timeval timval; 258 259 if (!gettimeofday(&timval, (struct timezone *)NULL)) { 260 (void)printf("lock: type in the unlock key. "); 261 if (no_timeout) { 262 (void)putchar('\n'); 263 } else { 264 (void)printf("timeout in %jd:%jd minutes\n", 265 (intmax_t)(nexttime - timval.tv_sec) / 60, 266 (intmax_t)(nexttime - timval.tv_sec) % 60); 267 } 268 } 269} 270 271void 272quit(int signo __unused) 273{ 274 (void)putchar('\n'); 275 (void)tcsetattr(0, TCSADRAIN|TCSASOFT, &tty); 276 if (vtyunlock) 277 (void)ioctl(0, VT_LOCKSWITCH, &vtyunlock); 278 exit(0); 279} 280 281void 282bye(int signo __unused) 283{ 284 if (!no_timeout) { 285 (void)tcsetattr(0, TCSADRAIN|TCSASOFT, &tty); 286 if (vtyunlock) 287 (void)ioctl(0, VT_LOCKSWITCH, &vtyunlock); 288 (void)printf("lock: timeout\n"); 289 exit(1); 290 } 291} 292