1/* 2 * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan 3 * (Royal Institute of Technology, Stockholm, Sweden). 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * 3. Neither the name of the Institute nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34#include "krb5_locl.h" 35#include <dirent.h> 36 37#ifndef _WIN32 38 39/* see if principal is mentioned in the filename access file, return 40 TRUE (in result) if so, FALSE otherwise */ 41 42static krb5_error_code 43check_one_file(krb5_context context, 44 const char *filename, 45 struct passwd *pwd, 46 krb5_principal principal, 47 krb5_boolean *result) 48{ 49 FILE *f; 50 char buf[BUFSIZ]; 51 krb5_error_code ret; 52 struct stat st; 53 54 *result = FALSE; 55 56 f = fopen (filename, "r"); 57 if (f == NULL) 58 return errno; 59 rk_cloexec_file(f); 60 61 /* check type and mode of file */ 62 if (fstat(fileno(f), &st) != 0) { 63 fclose (f); 64 return errno; 65 } 66 if (S_ISDIR(st.st_mode)) { 67 fclose (f); 68 return EISDIR; 69 } 70 if (st.st_uid != pwd->pw_uid && st.st_uid != 0) { 71 fclose (f); 72 return EACCES; 73 } 74 if ((st.st_mode & (S_IWGRP | S_IWOTH)) != 0) { 75 fclose (f); 76 return EACCES; 77 } 78 79 while (fgets (buf, sizeof(buf), f) != NULL) { 80 krb5_principal tmp; 81 char *newline = buf + strcspn(buf, "\n"); 82 83 if(*newline != '\n') { 84 int c; 85 c = fgetc(f); 86 if(c != EOF) { 87 while(c != EOF && c != '\n') 88 c = fgetc(f); 89 /* line was too long, so ignore it */ 90 continue; 91 } 92 } 93 *newline = '\0'; 94 ret = krb5_parse_name (context, buf, &tmp); 95 if (ret) 96 continue; 97 *result = krb5_principal_compare (context, principal, tmp); 98 krb5_free_principal (context, tmp); 99 if (*result) { 100 fclose (f); 101 return 0; 102 } 103 } 104 fclose (f); 105 return 0; 106} 107 108static krb5_error_code 109check_directory(krb5_context context, 110 const char *dirname, 111 struct passwd *pwd, 112 krb5_principal principal, 113 krb5_boolean *result) 114{ 115 DIR *d; 116 struct dirent *dent; 117 char filename[MAXPATHLEN]; 118 krb5_error_code ret = 0; 119 struct stat st; 120 121 *result = FALSE; 122 123 if(lstat(dirname, &st) < 0) 124 return errno; 125 126 if (!S_ISDIR(st.st_mode)) 127 return ENOTDIR; 128 129 if (st.st_uid != pwd->pw_uid && st.st_uid != 0) 130 return EACCES; 131 if ((st.st_mode & (S_IWGRP | S_IWOTH)) != 0) 132 return EACCES; 133 134 if((d = opendir(dirname)) == NULL) 135 return errno; 136 137 { 138 int fd; 139 struct stat st2; 140 141 fd = dirfd(d); 142 if(fstat(fd, &st2) < 0) { 143 closedir(d); 144 return errno; 145 } 146 if(st.st_dev != st2.st_dev || st.st_ino != st2.st_ino) { 147 closedir(d); 148 return EACCES; 149 } 150 } 151 152 while((dent = readdir(d)) != NULL) { 153 if(strcmp(dent->d_name, ".") == 0 || 154 strcmp(dent->d_name, "..") == 0 || 155 dent->d_name[0] == '#' || /* emacs autosave */ 156 dent->d_name[strlen(dent->d_name) - 1] == '~') /* emacs backup */ 157 continue; 158 snprintf(filename, sizeof(filename), "%s/%s", dirname, dent->d_name); 159 ret = check_one_file(context, filename, pwd, principal, result); 160 if(ret == 0 && *result == TRUE) 161 break; 162 ret = 0; /* don't propagate errors upstream */ 163 } 164 closedir(d); 165 return ret; 166} 167 168#endif /* !_WIN32 */ 169 170static krb5_boolean 171match_local_principals(krb5_context context, 172 krb5_principal principal, 173 const char *luser) 174{ 175 krb5_error_code ret; 176 krb5_realm *realms, *r; 177 krb5_boolean result = FALSE; 178 179 /* multi-component principals can never match */ 180 if(krb5_principal_get_comp_string(context, principal, 1) != NULL) 181 return FALSE; 182 183 ret = krb5_get_default_realms (context, &realms); 184 if (ret) 185 return FALSE; 186 187 for (r = realms; *r != NULL; ++r) { 188 if(strcmp(krb5_principal_get_realm(context, principal), 189 *r) != 0) 190 continue; 191 if(strcmp(krb5_principal_get_comp_string(context, principal, 0), 192 luser) == 0) { 193 result = TRUE; 194 break; 195 } 196 } 197 krb5_free_host_realm (context, realms); 198 return result; 199} 200 201static krb5_error_code 202check_unix(krb5_context context, 203 krb5_principal principal, 204 const char *luser) 205{ 206 char *buf; 207 size_t buflen; 208 struct passwd *pwd = NULL; 209 char *profile_dir = NULL; 210 krb5_error_code ret; 211 krb5_boolean result = FALSE; 212 213 krb5_boolean found_file = FALSE; 214 215#ifdef POSIX_GETPWNAM_R 216 char pwbuf[2048]; 217 struct passwd pw; 218 219 if(getpwnam_r(luser, &pw, pwbuf, sizeof(pwbuf), &pwd) != 0) 220 return FALSE; 221#else 222 pwd = getpwnam (luser); 223#endif 224 if (pwd == NULL) 225 return FALSE; 226 profile_dir = pwd->pw_dir; 227 228#define KLOGIN "/.k5login" 229 buflen = strlen(profile_dir) + sizeof(KLOGIN) + 2; /* 2 for .d */ 230 buf = malloc(buflen); 231 if(buf == NULL) 232 return FALSE; 233 /* check user's ~/.k5login */ 234 strlcpy(buf, profile_dir, buflen); 235 strlcat(buf, KLOGIN, buflen); 236 ret = check_one_file(context, buf, pwd, principal, &result); 237 238 if(ret == 0 && result == TRUE) { 239 free(buf); 240 return TRUE; 241 } 242 243 if(ret != ENOENT) 244 found_file = TRUE; 245 246 strlcat(buf, ".d", buflen); 247 ret = check_directory(context, buf, pwd, principal, &result); 248 free(buf); 249 if(ret == 0 && result == TRUE) 250 return TRUE; 251 252 if(ret != ENOENT && ret != ENOTDIR) 253 found_file = TRUE; 254 255 /* finally if no files exist, allow all principals matching 256 <localuser>@<LOCALREALM> */ 257 if(found_file == FALSE) 258 return match_local_principals(context, principal, luser); 259 260 return FALSE; 261} 262 263#ifdef __APPLE__ 264#include <membership.h> 265 266static krb5_error_code 267check_od(krb5_context context, 268 krb5_principal principal, 269 const char *luser) 270{ 271 krb5_boolean match = FALSE; 272 uuid_t krb_uuid, un_uuid; 273 char *kprinc = NULL; 274 int ret = 0; 275 276 ret = krb5_unparse_name(context, principal, &kprinc); 277 if (ret) 278 goto out; 279 280 ret = mbr_identifier_to_uuid(ID_TYPE_USERNAME, luser, strlen(luser), un_uuid); 281 if (!ret) 282 goto out; 283 284 ret = mbr_identifier_to_uuid(ID_TYPE_KERBEROS, kprinc, strlen(kprinc), krb_uuid); 285 if (!ret) 286 goto out; 287 288 ret = uuid_compare(krb_uuid, un_uuid); 289 if (0 == ret) 290 match = TRUE; 291 292 out: 293 if (kprinc) 294 free(kprinc); 295 296 return match; 297} 298#endif 299 300/** 301 * This function takes the name of a local user and checks if 302 * principal is allowed to log in as that user. 303 * 304 * The user may have a ~/.k5login file listing principals that are 305 * allowed to login as that user. If that file does not exist, all 306 * principals with a first component identical to the username, and a 307 * realm considered local, are allowed access. 308 * 309 * The .k5login file must contain one principal per line, be owned by 310 * user and not be writable by group or other (but must be readable by 311 * anyone). 312 * 313 * Note that if the file exists, no implicit access rights are given 314 * to user@@LOCALREALM. 315 * 316 * Optionally, a set of files may be put in ~/.k5login.d (a 317 * directory), in which case they will all be checked in the same 318 * manner as .k5login. The files may be called anything, but files 319 * starting with a hash (#) , or ending with a tilde (~) are 320 * ignored. Subdirectories are not traversed. Note that this directory 321 * may not be checked by other Kerberos implementations. 322 * 323 * If no configuration file exists, match user against local domains, 324 * ie luser@@LOCAL-REALMS-IN-CONFIGURATION-FILES. 325 * 326 * @param context Kerberos 5 context. 327 * @param principal principal to check if allowed to login 328 * @param luser local user id 329 * 330 * @return returns TRUE if access should be granted, FALSE otherwise. 331 * 332 * @ingroup krb5_support 333 */ 334 335KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL 336krb5_kuserok (krb5_context context, 337 krb5_principal principal, 338 const char *luser) 339{ 340 krb5_boolean match; 341 342#ifndef _WIN32 343 match = check_unix(context, principal, luser); 344#else 345 /* The .k5login file may be on a remote profile and we don't have 346 access to the profile until we have a token handle for the 347 user's credentials. */ 348 match = match_local_principals(context, principal, luser); 349#endif 350 351#ifdef __APPLE__ 352 if (!match) 353 match = check_od(context, principal, luser); 354#endif 355 return match; 356} 357