Home | History | Annotate | Line # | Download | only in pam_login_access
login_access.c revision 1.3
      1 /*	$NetBSD: login_access.c,v 1.3 2005/04/19 13:04:38 christos Exp $	*/
      2 
      3 /*
      4  * This module implements a simple but effective form of login access
      5  * control based on login names and on host (or domain) names, internet
      6  * addresses (or network numbers), or on terminal line names in case of
      7  * non-networked logins. Diagnostics are reported through syslog(3).
      8  *
      9  * Author: Wietse Venema, Eindhoven University of Technology, The Netherlands.
     10  */
     11 
     12 #if 0
     13 #ifndef lint
     14 static char sccsid[] = "%Z% %M% %I% %E% %U%";
     15 #endif
     16 #endif
     17 
     18 #include <sys/cdefs.h>
     19 #ifdef __FreeBSD__
     20 __FBSDID("$FreeBSD: src/lib/libpam/modules/pam_login_access/login_access.c,v 1.12 2004/03/05 08:10:18 markm Exp $");
     21 #else
     22 __RCSID("$NetBSD: login_access.c,v 1.3 2005/04/19 13:04:38 christos Exp $");
     23 #endif
     24 
     25 #include <sys/types.h>
     26 #include <ctype.h>
     27 #include <errno.h>
     28 #include <grp.h>
     29 #include <stdio.h>
     30 #include <stdlib.h>
     31 #include <string.h>
     32 #include <syslog.h>
     33 #include <unistd.h>
     34 
     35 #include "pam_login_access.h"
     36 
     37 #define _PATH_LOGACCESS		"/etc/login.access"
     38 
     39  /* Delimiters for fields and for lists of users, ttys or hosts. */
     40 
     41 static char fs[] = ":";			/* field separator */
     42 static char sep[] = ", \t";		/* list-element separator */
     43 
     44  /* Constants to be used in assignments only, not in comparisons... */
     45 
     46 #define YES             1
     47 #define NO              0
     48 
     49 static int	from_match(const char *, const char *);
     50 static int	list_match(char *, const char *,
     51 				int (*)(const char *, const char *));
     52 static int	netgroup_match(const char *, const char *, const char *);
     53 static int	string_match(const char *, const char *);
     54 static int	user_match(const char *, const char *);
     55 
     56 /* login_access - match username/group and host/tty with access control file */
     57 
     58 int
     59 login_access(const char *user, const char *from)
     60 {
     61     FILE   *fp;
     62     char    line[BUFSIZ];
     63     char   *perm;			/* becomes permission field */
     64     char   *users;			/* becomes list of login names */
     65     char   *froms;			/* becomes list of terminals or hosts */
     66     int     match = NO;
     67     int     end;
     68     int     lineno = 0;			/* for diagnostics */
     69 
     70     /*
     71      * Process the table one line at a time and stop at the first match.
     72      * Blank lines and lines that begin with a '#' character are ignored.
     73      * Non-comment lines are broken at the ':' character. All fields are
     74      * mandatory. The first field should be a "+" or "-" character. A
     75      * non-existing table means no access control.
     76      */
     77 
     78     if ((fp = fopen(_PATH_LOGACCESS, "r")) != NULL) {
     79 	while (!match && fgets(line, sizeof(line), fp)) {
     80 	    lineno++;
     81 	    if (line[end = strlen(line) - 1] != '\n') {
     82 		syslog(LOG_ERR, "%s: line %d: missing newline or line too long",
     83 		       _PATH_LOGACCESS, lineno);
     84 		continue;
     85 	    }
     86 	    if (line[0] == '#')
     87 		continue;			/* comment line */
     88 	    while (end > 0 && isspace((unsigned char)line[end - 1]))
     89 		end--;
     90 	    line[end] = 0;			/* strip trailing whitespace */
     91 	    if (line[0] == 0)			/* skip blank lines */
     92 		continue;
     93 	    if (!(perm = strtok(line, fs))
     94 		|| !(users = strtok((char *) 0, fs))
     95 		|| !(froms = strtok((char *) 0, fs))
     96 		|| strtok((char *) 0, fs)) {
     97 		syslog(LOG_ERR, "%s: line %d: bad field count", _PATH_LOGACCESS,
     98 		       lineno);
     99 		continue;
    100 	    }
    101 	    if (perm[0] != '+' && perm[0] != '-') {
    102 		syslog(LOG_ERR, "%s: line %d: bad first field", _PATH_LOGACCESS,
    103 		       lineno);
    104 		continue;
    105 	    }
    106 	    match = (list_match(froms, from, from_match)
    107 		     && list_match(users, user, user_match));
    108 	}
    109 	(void) fclose(fp);
    110     } else if (errno != ENOENT) {
    111 	syslog(LOG_ERR, "cannot open %s: %m", _PATH_LOGACCESS);
    112     }
    113     return (match == 0 || (line[0] == '+'));
    114 }
    115 
    116 /* list_match - match an item against a list of tokens with exceptions */
    117 
    118 static int
    119 list_match(char *list, const char *item,
    120     int (*match_fn)(const char *, const char *))
    121 {
    122     char   *tok;
    123     int     match = NO;
    124 
    125     /*
    126      * Process tokens one at a time. We have exhausted all possible matches
    127      * when we reach an "EXCEPT" token or the end of the list. If we do find
    128      * a match, look for an "EXCEPT" list and recurse to determine whether
    129      * the match is affected by any exceptions.
    130      */
    131 
    132     for (tok = strtok(list, sep); tok != 0; tok = strtok((char *) 0, sep)) {
    133 	if (strcasecmp(tok, "EXCEPT") == 0)	/* EXCEPT: give up */
    134 	    break;
    135 	if ((match = (*match_fn)(tok, item)) != 0)	/* YES */
    136 	    break;
    137     }
    138     /* Process exceptions to matches. */
    139 
    140     if (match != NO) {
    141 	while ((tok = strtok((char *) 0, sep)) && strcasecmp(tok, "EXCEPT"))
    142 	     /* VOID */ ;
    143 	if (tok == 0 || list_match((char *) 0, item, match_fn) == NO)
    144 	    return (match);
    145     }
    146     return (NO);
    147 }
    148 
    149 /* netgroup_match - match group against machine or user */
    150 
    151 static int
    152 netgroup_match(const char *group __unused,
    153     const char *machine __unused, const char *user __unused)
    154 {
    155     syslog(LOG_ERR, "NIS netgroup support not configured");
    156     return 0;
    157 }
    158 
    159 /* user_match - match a username against one token */
    160 
    161 static int
    162 user_match(const char *tok, const char *string)
    163 {
    164     struct group grres, *group;
    165     char grbuf[1024];
    166     int     i;
    167 
    168     /*
    169      * If a token has the magic value "ALL" the match always succeeds.
    170      * Otherwise, return YES if the token fully matches the username, or if
    171      * the token is a group that contains the username.
    172      */
    173 
    174     if (tok[0] == '@') {			/* netgroup */
    175 	return (netgroup_match(tok + 1, (char *) 0, string));
    176     } else if (string_match(tok, string)) {	/* ALL or exact match */
    177 	return (YES);
    178     } else if (getgrnam_r(tok, &grres, grbuf, sizeof(grbuf), &group) == 0 &&
    179 	group != NULL) {/* try group membership */
    180 	for (i = 0; group->gr_mem[i]; i++)
    181 	    if (strcasecmp(string, group->gr_mem[i]) == 0)
    182 		return (YES);
    183     }
    184     return (NO);
    185 }
    186 
    187 /* from_match - match a host or tty against a list of tokens */
    188 
    189 static int
    190 from_match(const char *tok, const char *string)
    191 {
    192     int     tok_len;
    193     int     str_len;
    194 
    195     /*
    196      * If a token has the magic value "ALL" the match always succeeds. Return
    197      * YES if the token fully matches the string. If the token is a domain
    198      * name, return YES if it matches the last fields of the string. If the
    199      * token has the magic value "LOCAL", return YES if the string does not
    200      * contain a "." character. If the token is a network number, return YES
    201      * if it matches the head of the string.
    202      */
    203 
    204     if (tok[0] == '@') {			/* netgroup */
    205 	return (netgroup_match(tok + 1, string, (char *) 0));
    206     } else if (string_match(tok, string)) {	/* ALL or exact match */
    207 	return (YES);
    208     } else if (tok[0] == '.') {			/* domain: match last fields */
    209 	if ((str_len = strlen(string)) > (tok_len = strlen(tok))
    210 	    && strcasecmp(tok, string + str_len - tok_len) == 0)
    211 	    return (YES);
    212     } else if (strcasecmp(tok, "LOCAL") == 0) {	/* local: no dots */
    213 	if (strchr(string, '.') == 0)
    214 	    return (YES);
    215     } else if (tok[(tok_len = strlen(tok)) - 1] == '.'	/* network */
    216 	       && strncmp(tok, string, tok_len) == 0) {
    217 	return (YES);
    218     }
    219     return (NO);
    220 }
    221 
    222 /* string_match - match a string against one token */
    223 
    224 static int
    225 string_match(const char *tok, const char *string)
    226 {
    227 
    228     /*
    229      * If the token has the magic value "ALL" the match always succeeds.
    230      * Otherwise, return YES if the token fully matches the string.
    231      */
    232 
    233     if (strcasecmp(tok, "ALL") == 0) {		/* all: always matches */
    234 	return (YES);
    235     } else if (strcasecmp(tok, string) == 0) {	/* try exact match */
    236 	return (YES);
    237     }
    238     return (NO);
    239 }
    240