2 * Copyright 2000, International Business Machines Corporation and others.
5 * This software has been released under the terms of the IBM Public
6 * License. For details, see the LICENSE file in the top-level source
7 * directory or online at http://www.openafs.org/dl/license10.html
14 /* These two needed for rxgen output to work */
15 #include <afsconfig.h>
16 #include <afs/param.h>
20 #include <sys/types.h>
25 #include <afs/fs_utils.h>
28 #include <netinet/in.h>
29 #include <afs/venus.h>
34 #include <afs/prs_fs.h>
37 #include <afs/sys_prototypes.h>
38 #include <afs/afs_consts.h>
44 static int using_child = 0;
45 static FILE *childin, *childout; /* file pointers on pipe to kpwvalid */
47 /* this removes symlinks from the tail end of path names.
48 * PRECONDITION: name must be either absolute ('/something') or
49 * explictly relative to current directory ('./something')
52 simplify_name(char *orig_name, char *true_name)
60 if (stat(orig_name, &statbuff) < 0) {
64 strcpy(true_name, orig_name);
71 if (lstat(orig_name, &statbuff) < 0) {
72 /* if lstat fails, it's possible that it's transient, but
73 * unlikely. Let's hope it isn't, and continue... */
79 * The lstat succeeded. If the given file is a symlink, substitute
80 * the contents of the link for the file name.
82 if ((statbuff.st_mode & S_IFMT) == S_IFLNK) {
84 link_chars_read = readlink(orig_name, true_name, 1024);
85 if (link_chars_read <= 0) {
90 true_name[link_chars_read++] = '\0';
93 * If the symlink is an absolute pathname, we're fine. Otherwise, we
94 * have to create a full pathname using the original name and the
95 * relative symlink name. Find the rightmost slash in the original
96 * name (we know there is one) and splice in the symlink contents.
98 if (true_name[0] != '/') {
99 last_component = (char *)strrchr(orig_name, '/');
100 strcpy(++last_component, true_name);
101 strcpy(true_name, orig_name);
104 strcpy(true_name, orig_name);
106 return 1; /* found it */
112 /* We find our own location by:
113 * 1. checking for an absolute or relative path name in argv[0]
114 * this is moderately system-dependant: argv[0] is just a convention.
115 * 2. successively checking each component of PATH, and concatenating argv[0]
116 * onto it, then stating the result.
117 * if it exists, it must be us, eh?
118 * NB there may be possible security implications involving
119 * symlinks; I think they are only relevant if the symlink points
120 * directly at kpasswd, not when it points at kpasswd's parent directory.
123 find_me(char *arg, char *parent_dir)
125 char *bp; /* basename pointer */
126 char *dp; /* dirname pointer */
127 char *pathelt, orig_name[1024], truename[1022];
129 #define explicitname(a,b,c) \
133 ( ((b) == '.') && ((c) == '/') ) \
138 if (strlen(arg) > 510) /* just give up */
144 if (explicitname(arg[0], arg[1], arg[2])) {
145 strcpy(orig_name, arg);
146 simplify_name(orig_name, truename);
148 bp = (char *)strrchr(arg, '/');
152 strcpy(orig_name + 2, arg);
153 simplify_name(orig_name, truename);
157 if (!truename[0]) { /* didn't find it */
163 strncpy(path, dp, 2045);
165 for (pathelt = strtok(path, ":"); pathelt;
166 pathelt = strtok(NULL, ":")) {
167 strncpy(orig_name, pathelt, 510);
169 bp = orig_name + strlen(orig_name);
170 *bp = '/'; /* replace NUL with / */
171 strncpy(bp + 1, arg, 510);
173 if (simplify_name(orig_name, truename))
177 if (!truename[0]) /* didn't find it */
178 return 0; /* give up */
182 * Find rightmost slash, if any.
184 bp = (char *)strrchr(truename, '/');
187 * Found it. Designate everything before it as the parent directory,
188 * everything after it as the final component.
190 strncpy(parent_dir, truename, bp - truename);
191 parent_dir[bp - truename] = 0;
192 bp++; /*Skip the slash */
195 * No slash appears in the given file name. Set parent_dir to the current
196 * directory, and the last component as the given name.
198 strcpy(parent_dir, ".");
202 return 1; /* found it */
205 #define SkipLine(str) { while (*str !='\n') str++; str++; }
207 /* this function returns TRUE (1) if the file is in AFS, otherwise false (0) */
211 struct ViceIoctl blob;
213 char space[AFS_PIOCTL_MAXSIZE];
216 blob.out_size = AFS_PIOCTL_MAXSIZE;
219 code = pioctl(apath, VIOC_FILE_CELL_NAME, &blob, 1);
221 if ((errno == EINVAL) || (errno == ENOENT))
230 struct AclEntry *pluslist;
231 struct AclEntry *minuslist;
235 struct AclEntry *next;
243 int nplus, nminus, i, trights;
245 struct AclEntry *first, *last, *tl;
247 sscanf(astr, "%d", &nplus);
249 sscanf(astr, "%d", &nminus);
252 ta = (struct Acl *)malloc(sizeof(struct Acl));
257 for (i = 0; i < nplus; i++) {
258 sscanf(astr, "%100s %d", tname, &trights);
260 tl = (struct AclEntry *)malloc(sizeof(struct AclEntry));
263 strcpy(tl->name, tname);
264 tl->rights = trights;
270 ta->pluslist = first;
276 safestrtok(char *str, char *tok)
281 return (strtok(str, tok));
283 temp = strtok(NULL, tok);
292 /* If it exists, we do some fussing about whether or not this
293 * is a reasonably secure path - not that it makes *much* difference, since
294 * there's not much point in being more secure than the kpasswd executable.
296 /* 1. is this directory in AFS?
297 * 2. Is every component of the pathname secure
298 * (ie, only system:administrators have w or a rights)?
304 struct ViceIoctl blob;
310 if (!InAFS(dir)) /* final component *must* be in AFS */
314 for (temp = safestrtok(dir, "/"); temp; temp = safestrtok(NULL, "/")) {
315 /* strtok keeps sticking NUL in place of /, so we can look at
316 * ever-longer chunks of the path.
321 blob.out_size = AFS_PIOCTL_MAXSIZE;
324 code = pioctl(dir, VIOCGETAL, &blob, 1);
328 ta = ParseAcl(space);
332 for (te = ta->pluslist; te; te = te->next) {
333 if (((te->rights & PRSFS_INSERT) && (te->rights & PRSFS_DELETE))
334 || (te->rights & (PRSFS_WRITE | PRSFS_ADMINISTER)))
335 if (strcmp(te->name, "system:administrators"))
336 return 0; /* somebody who we can't trust has got power */
339 #endif /* INSECURE */
344 /* Then, once we've found our own location, we look for a program named
348 /* look for a password-checking program named kpwvalid.
349 * It has to be in a secure place (same place as this executable)
352 kpwvalid_is(char *dir)
354 struct stat statbuff;
357 len = (int)strlen(dir);
358 strcpy(dir + len, "/kpwvalid");
360 if (stat(dir, &statbuff) < 0) {
361 /* if lstat fails, it's possible that it's transient, but
362 * unlikely. Let's hope it isn't, and continue... */
372 /* We don't allow the use of kpwvalid executable scripts to set policy
373 * for passwd changes.
376 init_child(char *myname)
385 init_child(char *myname)
387 int pipe1[2], pipe2[2];
392 if (!(find_me(myname, dirpath) && is_secure(dirpath)
393 && kpwvalid_is(dirpath))) {
398 /* make a couple of pipes, one for the child's stdin, and the other
399 * for the child's stdout. The parent writes to the former, and
400 * reads from the latter, the child reads from the former, and
401 * writes to the latter.
410 perror("kpasswd: can't fork because ");
411 return (using_child);
413 if (pid == 0) { /* in child process */
414 /* tie stdin and stdout to these pipes */
415 /* if dup2 doesn't exist everywhere, close and then dup, but make */
416 /* sure that you really get stdin or stdout from the dup. */
417 if ((-1 == dup2(pipe1[0], 0)) || (-1 == dup2(pipe2[1], 1))) {
418 perror("kpasswd: can't exec kpwvalid because ");
422 strcat(dirpath, "/kpwvalid");
425 execv(dirpath, argv);
428 using_child = pid; /* save it for later */
429 childin = fdopen(pipe1[1], "w");
430 childout = fdopen(pipe2[0], "r");
431 return (using_child);
434 #endif /* not NT40 */
437 password_bad(char *pw)
443 fprintf(childin, "%s\n", pw);
445 fscanf(childout, "%d", &rc);
451 /* this is originally only used to give the child the old password, so she
452 * can compare putative new passwords against it.
455 give_to_child(char *pw)
461 fprintf(childin, "%s\n", pw);
468 /* quickly and painlessly
471 terminate_child(void)
478 rc = kill(using_child, SIGKILL);