2 * Copyright 2000, International Business Machines Corporation and others.
5 * This software has been released under the terms of the IBM Public
6 * License. For details, see the LICENSE file in the top-level source
7 * directory or online at http://www.openafs.org/dl/license10.html
14 /* These two needed for rxgen output to work */
15 #include <afsconfig.h>
16 #include <afs/param.h>
22 #include <sys/types.h>
27 #include <afs/fs_utils.h>
29 #include <netinet/in.h>
30 #include <afs/venus.h>
35 #include <afs/prs_fs.h>
42 static int using_child = 0;
43 static FILE *childin, *childout; /* file pointers on pipe to kpwvalid */
45 /* this removes symlinks from the tail end of path names.
46 * PRECONDITION: name must be either absolute ('/something') or
47 * explictly relative to current directory ('./something')
50 simplify_name(char *orig_name, char *true_name)
58 if (stat(orig_name, &statbuff) < 0) {
62 strcpy(true_name, orig_name);
69 if (lstat(orig_name, &statbuff) < 0) {
70 /* if lstat fails, it's possible that it's transient, but
71 * unlikely. Let's hope it isn't, and continue... */
77 * The lstat succeeded. If the given file is a symlink, substitute
78 * the contents of the link for the file name.
80 if ((statbuff.st_mode & S_IFMT) == S_IFLNK) {
82 link_chars_read = readlink(orig_name, true_name, 1024);
83 if (link_chars_read <= 0) {
88 true_name[link_chars_read++] = '\0';
91 * If the symlink is an absolute pathname, we're fine. Otherwise, we
92 * have to create a full pathname using the original name and the
93 * relative symlink name. Find the rightmost slash in the original
94 * name (we know there is one) and splice in the symlink contents.
96 if (true_name[0] != '/') {
97 last_component = (char *)strrchr(orig_name, '/');
98 strcpy(++last_component, true_name);
99 strcpy(true_name, orig_name);
102 strcpy(true_name, orig_name);
104 return 1; /* found it */
110 /* We find our own location by:
111 * 1. checking for an absolute or relative path name in argv[0]
112 * this is moderately system-dependant: argv[0] is just a convention.
113 * 2. successively checking each component of PATH, and concatenating argv[0]
114 * onto it, then stating the result.
115 * if it exists, it must be us, eh?
116 * NB there may be possible security implications involving
117 * symlinks; I think they are only relevant if the symlink points
118 * directly at kpasswd, not when it points at kpasswd's parent directory.
121 find_me(char *arg, char *parent_dir)
123 char *bp; /* basename pointer */
124 char *dp; /* dirname pointer */
125 char *pathelt, orig_name[1024], truename[1022];
127 #define explicitname(a,b,c) \
131 ( ((b) == '.') && ((c) == '/') ) \
136 if (strlen(arg) > 510) /* just give up */
142 if (explicitname(arg[0], arg[1], arg[2])) {
143 strcpy(orig_name, arg);
144 simplify_name(orig_name, truename);
146 bp = (char *)strrchr(arg, '/');
150 strcpy(orig_name + 2, arg);
151 simplify_name(orig_name, truename);
155 if (!truename[0]) { /* didn't find it */
161 strncpy(path, dp, 2045);
163 for (pathelt = strtok(path, ":"); pathelt;
164 pathelt = strtok(NULL, ":")) {
165 strncpy(orig_name, pathelt, 510);
167 bp = orig_name + strlen(orig_name);
168 *bp = '/'; /* replace NUL with / */
169 strncpy(bp + 1, arg, 510);
171 if (simplify_name(orig_name, truename))
175 if (!truename[0]) /* didn't find it */
176 return 0; /* give up */
180 * Find rightmost slash, if any.
182 bp = (char *)strrchr(truename, '/');
185 * Found it. Designate everything before it as the parent directory,
186 * everything after it as the final component.
188 strncpy(parent_dir, truename, bp - truename);
189 parent_dir[bp - truename] = 0;
190 bp++; /*Skip the slash */
193 * No slash appears in the given file name. Set parent_dir to the current
194 * directory, and the last component as the given name.
196 strcpy(parent_dir, ".");
200 return 1; /* found it */
203 #define SkipLine(str) { while (*str !='\n') str++; str++; }
205 /* this function returns TRUE (1) if the file is in AFS, otherwise false (0) */
207 InAFS(register char *apath)
209 struct ViceIoctl blob;
210 register afs_int32 code;
214 blob.out_size = MAXSIZE;
217 code = pioctl(apath, VIOC_FILE_CELL_NAME, &blob, 1);
219 if ((errno == EINVAL) || (errno == ENOENT))
228 struct AclEntry *pluslist;
229 struct AclEntry *minuslist;
233 struct AclEntry *next;
241 int nplus, nminus, i, trights;
243 struct AclEntry *first, *last, *tl;
245 sscanf(astr, "%d", &nplus);
247 sscanf(astr, "%d", &nminus);
250 ta = (struct Acl *)malloc(sizeof(struct Acl));
255 for (i = 0; i < nplus; i++) {
256 sscanf(astr, "%100s %d", tname, &trights);
258 tl = (struct AclEntry *)malloc(sizeof(struct AclEntry));
261 strcpy(tl->name, tname);
262 tl->rights = trights;
268 ta->pluslist = first;
274 safestrtok(char *str, char *tok)
279 return (strtok(str, tok));
281 temp = strtok(NULL, tok);
290 /* If it exists, we do some fussing about whether or not this
291 * is a reasonably secure path - not that it makes *much* difference, since
292 * there's not much point in being more secure than the kpasswd executable.
294 /* 1. is this directory in AFS?
295 * 2. Is every component of the pathname secure
296 * (ie, only system:administrators have w or a rights)?
302 struct ViceIoctl blob;
309 if (!InAFS(dir)) /* final component *must* be in AFS */
313 for (temp = safestrtok(dir, "/"); temp; temp = safestrtok(NULL, "/")) {
314 /* strtok keeps sticking NUL in place of /, so we can look at
315 * ever-longer chunks of the path.
320 blob.out_size = MAXSIZE;
323 code = pioctl(dir, VIOCGETAL, &blob, 1);
327 ta = ParseAcl(space);
331 for (te = ta->pluslist; te; te = te->next) {
332 if (((te->rights & PRSFS_INSERT) && (te->rights & PRSFS_DELETE))
333 || (te->rights & (PRSFS_WRITE | PRSFS_ADMINISTER)))
334 if (strcmp(te->name, "system:administrators"))
335 return 0; /* somebody who we can't trust has got power */
338 #endif /* INSECURE */
343 /* Then, once we've found our own location, we look for a program named
347 /* look for a password-checking program named kpwvalid.
348 * It has to be in a secure place (same place as this executable)
351 kpwvalid_is(char *dir)
353 struct stat statbuff;
356 len = (int)strlen(dir);
357 strcpy(dir + len, "/kpwvalid");
359 if (stat(dir, &statbuff) < 0) {
360 /* if lstat fails, it's possible that it's transient, but
361 * unlikely. Let's hope it isn't, and continue... */
371 /* We don't allow the use of kpwvalid executable scripts to set policy
372 * for passwd changes.
375 init_child(char *myname)
384 init_child(char *myname)
386 int pipe1[2], pipe2[2];
391 if (!(find_me(myname, dirpath) && is_secure(dirpath)
392 && kpwvalid_is(dirpath))) {
397 /* make a couple of pipes, one for the child's stdin, and the other
398 * for the child's stdout. The parent writes to the former, and
399 * reads from the latter, the child reads from the former, and
400 * writes to the latter.
409 perror("kpasswd: can't fork because ");
410 return (using_child);
412 if (pid == 0) { /* in child process */
413 /* tie stdin and stdout to these pipes */
414 /* if dup2 doesn't exist everywhere, close and then dup, but make */
415 /* sure that you really get stdin or stdout from the dup. */
416 if ((-1 == dup2(pipe1[0], 0)) || (-1 == dup2(pipe2[1], 1))) {
417 perror("kpasswd: can't exec kpwvalid because ");
421 strcat(dirpath, "/kpwvalid");
424 execv(dirpath, argv);
427 using_child = pid; /* save it for later */
428 childin = fdopen(pipe1[1], "w");
429 childout = fdopen(pipe2[0], "r");
430 return (using_child);
433 #endif /* not NT40 */
436 password_bad(char *pw)
442 fprintf(childin, "%s\n", pw);
444 fscanf(childout, "%d", &rc);
450 /* this is originally only used to give the child the old password, so she
451 * can compare putative new passwords against it.
454 give_to_child(char *pw)
460 fprintf(childin, "%s\n", pw);
467 /* quickly and painlessly
470 terminate_child(char *pw)
477 rc = kill(using_child, SIGKILL);