su.c revision 1.58.2.1
1 /* $NetBSD: su.c,v 1.58.2.1 2005/07/18 03:45:40 riz Exp $ */ 2 3 /* 4 * Copyright (c) 1988 The Regents of the University of California. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. Neither the name of the University nor the names of its contributors 16 * may be used to endorse or promote products derived from this software 17 * without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32 #include <sys/cdefs.h> 33 #ifndef lint 34 __COPYRIGHT( 35 "@(#) Copyright (c) 1988 The Regents of the University of California.\n\ 36 All rights reserved.\n"); 37 #endif /* not lint */ 38 39 #ifndef lint 40 #if 0 41 static char sccsid[] = "@(#)su.c 8.3 (Berkeley) 4/2/94";*/ 42 #else 43 __RCSID("$NetBSD: su.c,v 1.58.2.1 2005/07/18 03:45:40 riz Exp $"); 44 #endif 45 #endif /* not lint */ 46 47 #include <sys/param.h> 48 #include <sys/time.h> 49 #include <sys/resource.h> 50 #include <err.h> 51 #include <errno.h> 52 #include <grp.h> 53 #include <paths.h> 54 #include <pwd.h> 55 #include <stdio.h> 56 #ifdef SKEY 57 #include <skey.h> 58 #endif 59 #include <stdlib.h> 60 #include <string.h> 61 #include <syslog.h> 62 #include <time.h> 63 #include <tzfile.h> 64 #include <unistd.h> 65 66 #ifdef LOGIN_CAP 67 #include <login_cap.h> 68 #endif 69 70 #ifdef KERBEROS 71 #include <des.h> 72 #include <krb.h> 73 #include <netdb.h> 74 75 static int kerberos __P((char *, char *, int)); 76 static int koktologin __P((char *, char *, char *)); 77 78 #endif 79 80 #ifdef KERBEROS5 81 #include <krb5.h> 82 83 static int kerberos5 __P((char *, char *, int)); 84 85 #endif 86 87 #if defined(KERBEROS) || defined(KERBEROS5) 88 89 #define ARGSTRX "-Kdflm" 90 91 int use_kerberos = 1; 92 93 #else 94 #define ARGSTRX "-dflm" 95 #endif 96 97 #ifndef SU_GROUP 98 #define SU_GROUP "wheel" 99 #endif 100 101 #ifdef LOGIN_CAP 102 #define ARGSTR ARGSTRX "c:" 103 #else 104 #define ARGSTR ARGSTRX 105 #endif 106 107 int main __P((int, char **)); 108 109 static int chshell __P((const char *)); 110 static char *ontty __P((void)); 111 static int check_ingroup __P((int, const char *, const char *, int)); 112 113 114 int 115 main(argc, argv) 116 int argc; 117 char **argv; 118 { 119 extern char **environ; 120 struct passwd *pwd; 121 char *p; 122 #ifdef BSD4_4 123 struct timeval tp; 124 #endif 125 uid_t ruid; 126 int asme, ch, asthem, fastlogin, prio, gohome; 127 enum { UNSET, YES, NO } iscsh = UNSET; 128 char *user, *shell, *avshell, *username, **np; 129 char *userpass, *class; 130 char shellbuf[MAXPATHLEN], avshellbuf[MAXPATHLEN]; 131 time_t pw_warntime = _PASSWORD_WARNDAYS * SECSPERDAY; 132 #ifdef LOGIN_CAP 133 login_cap_t *lc; 134 #endif 135 136 asme = asthem = fastlogin = 0; 137 gohome = 1; 138 shell = class = NULL; 139 while ((ch = getopt(argc, argv, ARGSTR)) != -1) 140 switch((char)ch) { 141 #if defined(KERBEROS) || defined(KERBEROS5) 142 case 'K': 143 use_kerberos = 0; 144 break; 145 #endif 146 #ifdef LOGIN_CAP 147 case 'c': 148 class = optarg; 149 break; 150 #endif 151 case 'd': 152 asme = 0; 153 asthem = 1; 154 gohome = 0; 155 break; 156 case 'f': 157 fastlogin = 1; 158 break; 159 case '-': 160 case 'l': 161 asme = 0; 162 asthem = 1; 163 break; 164 case 'm': 165 asme = 1; 166 asthem = 0; 167 break; 168 case '?': 169 default: 170 (void)fprintf(stderr, 171 "usage: %s [%s] [login [shell arguments]]\n", 172 getprogname(), ARGSTR); 173 exit(1); 174 } 175 argv += optind; 176 177 /* Lower the priority so su runs faster */ 178 errno = 0; 179 prio = getpriority(PRIO_PROCESS, 0); 180 if (errno) 181 prio = 0; 182 if (prio > -2) 183 (void)setpriority(PRIO_PROCESS, 0, -2); 184 openlog("su", 0, LOG_AUTH); 185 186 /* get current login name and shell */ 187 ruid = getuid(); 188 username = getlogin(); 189 if (username == NULL || (pwd = getpwnam(username)) == NULL || 190 pwd->pw_uid != ruid) 191 pwd = getpwuid(ruid); 192 if (pwd == NULL) 193 errx(1, "who are you?"); 194 username = strdup(pwd->pw_name); 195 userpass = strdup(pwd->pw_passwd); 196 if (username == NULL || userpass == NULL) 197 err(1, "strdup"); 198 199 200 if (asme) { 201 if (pwd->pw_shell && *pwd->pw_shell) { 202 strlcpy(shellbuf, pwd->pw_shell, sizeof(shellbuf)); 203 shell = shellbuf; 204 } else { 205 shell = _PATH_BSHELL; 206 iscsh = NO; 207 } 208 } 209 /* get target login information, default to root */ 210 user = *argv ? *argv : "root"; 211 np = *argv ? argv : argv-1; 212 213 if ((pwd = getpwnam(user)) == NULL) 214 errx(1, "unknown login %s", user); 215 216 #ifdef LOGIN_CAP 217 /* force the usage of specified class */ 218 if (class) { 219 if (ruid) 220 errx(1, "Only root may use -c"); 221 222 pwd->pw_class = class; 223 } 224 lc = login_getclass(pwd->pw_class); 225 226 pw_warntime = login_getcaptime(lc, "password-warn", 227 _PASSWORD_WARNDAYS * SECSPERDAY, 228 _PASSWORD_WARNDAYS * SECSPERDAY); 229 #endif 230 231 if (ruid 232 #ifdef KERBEROS5 233 && (!use_kerberos || kerberos5(username, user, pwd->pw_uid)) 234 #endif 235 #ifdef KERBEROS 236 && (!use_kerberos || kerberos(username, user, pwd->pw_uid)) 237 #endif 238 ) { 239 char *pass = pwd->pw_passwd; 240 int ok = pwd->pw_uid != 0; 241 242 #ifdef SU_ROOTAUTH 243 /* 244 * Allow those in group rootauth to su to root, by supplying 245 * their own password. 246 */ 247 if (!ok) { 248 if ((ok = check_ingroup(-1, SU_ROOTAUTH, username, 0))) { 249 pass = userpass; 250 user = username; 251 } 252 } 253 #endif 254 /* 255 * Only allow those in group SU_GROUP to su to root, 256 * but only if that group has any members. 257 * If SU_GROUP has no members, allow anyone to su root 258 */ 259 if (!ok) { 260 ok = check_ingroup(-1, SU_GROUP, username, 1); 261 } 262 if (!ok) 263 errx(1, 264 "you are not listed in the correct secondary group (%s) to su %s.", 265 SU_GROUP, user); 266 /* if target requires a password, verify it */ 267 if (*pass) { 268 p = getpass("Password:"); 269 #ifdef SKEY 270 if (strcasecmp(p, "s/key") == 0) { 271 if (skey_haskey(user)) 272 errx(1, "Sorry, you have no s/key."); 273 else { 274 if (skey_authenticate(user)) { 275 goto badlogin; 276 } 277 } 278 279 } else 280 #endif 281 if (strcmp(pass, crypt(p, pass))) { 282 #ifdef SKEY 283 badlogin: 284 #endif 285 fprintf(stderr, "Sorry\n"); 286 syslog(LOG_WARNING, 287 "BAD SU %s to %s%s", username, 288 pwd->pw_name, ontty()); 289 exit(1); 290 } 291 } 292 } 293 294 if (asme) { 295 /* if asme and non-standard target shell, must be root */ 296 if (!chshell(pwd->pw_shell) && ruid) 297 errx(1,"permission denied (shell)."); 298 } else if (pwd->pw_shell && *pwd->pw_shell) { 299 shell = pwd->pw_shell; 300 iscsh = UNSET; 301 } else { 302 shell = _PATH_BSHELL; 303 iscsh = NO; 304 } 305 306 if ((p = strrchr(shell, '/')) != NULL) 307 avshell = p+1; 308 else 309 avshell = shell; 310 311 /* if we're forking a csh, we want to slightly muck the args */ 312 if (iscsh == UNSET) 313 iscsh = strstr(avshell, "csh") ? YES : NO; 314 315 /* set permissions */ 316 #ifdef LOGIN_CAP 317 if (setusercontext(lc, pwd, pwd->pw_uid, 318 (asthem ? (LOGIN_SETPRIORITY | LOGIN_SETUMASK) : 0) | 319 LOGIN_SETRESOURCES | LOGIN_SETGROUP | LOGIN_SETUSER)) 320 err(1, "setting user context"); 321 #else 322 if (setgid(pwd->pw_gid) < 0) 323 err(1, "setgid"); 324 if (initgroups(user, pwd->pw_gid)) 325 errx(1, "initgroups failed"); 326 if (setuid(pwd->pw_uid) < 0) 327 err(1, "setuid"); 328 #endif 329 330 if (!asme) { 331 if (asthem) { 332 p = getenv("TERM"); 333 /* Create an empty environment */ 334 if ((environ = malloc(sizeof(char *))) == NULL) 335 err(1, NULL); 336 environ[0] = NULL; 337 #ifdef LOGIN_CAP 338 if (setusercontext(lc, pwd, pwd->pw_uid, LOGIN_SETPATH)) 339 err(1, "setting user context"); 340 #else 341 (void)setenv("PATH", _PATH_DEFPATH, 1); 342 #endif 343 if (p) 344 (void)setenv("TERM", p, 1); 345 if (gohome && chdir(pwd->pw_dir) < 0) 346 errx(1, "no directory"); 347 } 348 349 if (asthem || pwd->pw_uid) { 350 (void)setenv("LOGNAME", pwd->pw_name, 1); 351 (void)setenv("USER", pwd->pw_name, 1); 352 } 353 (void)setenv("HOME", pwd->pw_dir, 1); 354 (void)setenv("SHELL", shell, 1); 355 } 356 (void)setenv("SU_FROM", username, 1); 357 358 if (iscsh == YES) { 359 if (fastlogin) 360 *np-- = "-f"; 361 if (asme) 362 *np-- = "-m"; 363 } else { 364 if (fastlogin) 365 unsetenv("ENV"); 366 } 367 368 if (asthem) { 369 avshellbuf[0] = '-'; 370 (void)strlcpy(avshellbuf+1, avshell, sizeof(avshellbuf) - 1); 371 avshell = avshellbuf; 372 } else if (iscsh == YES) { 373 /* csh strips the first character... */ 374 avshellbuf[0] = '_'; 375 (void)strlcpy(avshellbuf+1, avshell, sizeof(avshellbuf) - 1); 376 avshell = avshellbuf; 377 } 378 *np = avshell; 379 380 #ifdef BSD4_4 381 if (pwd->pw_change || pwd->pw_expire) 382 (void)gettimeofday(&tp, (struct timezone *)NULL); 383 if (pwd->pw_change) { 384 if (tp.tv_sec >= pwd->pw_change) { 385 (void)printf("%s -- %s's password has expired.\n", 386 (ruid ? "Sorry" : "Note"), user); 387 if (ruid != 0) 388 exit(1); 389 } else if (pwd->pw_change - tp.tv_sec < pw_warntime) 390 (void)printf("Warning: %s's password expires on %s", 391 user, ctime(&pwd->pw_change)); 392 } 393 if (pwd->pw_expire) { 394 if (tp.tv_sec >= pwd->pw_expire) { 395 (void)printf("%s -- %s's account has expired.\n", 396 (ruid ? "Sorry" : "Note"), user); 397 if (ruid != 0) 398 exit(1); 399 } else if (pwd->pw_expire - tp.tv_sec < 400 _PASSWORD_WARNDAYS * SECSPERDAY) 401 (void)printf("Warning: %s's account expires on %s", 402 user, ctime(&pwd->pw_expire)); 403 } 404 #endif 405 if (ruid != 0) 406 syslog(LOG_NOTICE, "%s to %s%s", 407 username, pwd->pw_name, ontty()); 408 409 /* Raise our priority back to what we had before */ 410 (void)setpriority(PRIO_PROCESS, 0, prio); 411 412 execv(shell, np); 413 err(1, "%s", shell); 414 /* NOTREACHED */ 415 } 416 417 static int 418 chshell(sh) 419 const char *sh; 420 { 421 const char *cp; 422 423 setusershell(); 424 while ((cp = getusershell()) != NULL) 425 if (!strcmp(cp, sh)) 426 return (1); 427 return (0); 428 } 429 430 static char * 431 ontty() 432 { 433 char *p; 434 static char buf[MAXPATHLEN + 4]; 435 436 buf[0] = 0; 437 if ((p = ttyname(STDERR_FILENO)) != NULL) 438 (void)snprintf(buf, sizeof buf, " on %s", p); 439 return (buf); 440 } 441 442 #ifdef KERBEROS5 443 static int 444 kerberos5(username, user, uid) 445 char *username, *user; 446 int uid; 447 { 448 krb5_error_code ret; 449 krb5_context context; 450 krb5_principal princ = NULL; 451 krb5_ccache ccache, ccache2; 452 char *cc_name; 453 const char *filename; 454 455 ret = krb5_init_context(&context); 456 if (ret) 457 return (1); 458 459 if (strcmp (user, "root") == 0) 460 ret = krb5_make_principal(context, &princ, 461 NULL, username, "root", NULL); 462 else 463 ret = krb5_make_principal(context, &princ, 464 NULL, user, NULL); 465 if (ret) 466 goto fail; 467 if (!krb5_kuserok(context, princ, user) && !uid) { 468 warnx ("kerberos5: not in %s's ACL.", user); 469 goto fail; 470 } 471 ret = krb5_cc_gen_new(context, &krb5_mcc_ops, &ccache); 472 if (ret) 473 goto fail; 474 ret = krb5_verify_user_lrealm(context, princ, ccache, NULL, TRUE, 475 NULL); 476 if (ret) { 477 krb5_cc_destroy(context, ccache); 478 switch (ret) { 479 case KRB5_LIBOS_PWDINTR : 480 break; 481 case KRB5KRB_AP_ERR_BAD_INTEGRITY: 482 case KRB5KRB_AP_ERR_MODIFIED: 483 krb5_warnx(context, "Password incorrect"); 484 break; 485 default : 486 krb5_warn(context, ret, "krb5_verify_user"); 487 break; 488 } 489 goto fail; 490 } 491 ret = krb5_cc_gen_new(context, &krb5_fcc_ops, &ccache2); 492 if (ret) { 493 krb5_cc_destroy(context, ccache); 494 goto fail; 495 } 496 ret = krb5_cc_copy_cache(context, ccache, ccache2); 497 if (ret) { 498 krb5_cc_destroy(context, ccache); 499 krb5_cc_destroy(context, ccache2); 500 goto fail; 501 } 502 503 filename = krb5_cc_get_name(context, ccache2); 504 asprintf(&cc_name, "%s:%s", krb5_cc_get_type(context, ccache2), 505 filename); 506 if (chown (filename, uid, -1) < 0) { 507 warn("chown %s", filename); 508 free(cc_name); 509 krb5_cc_destroy(context, ccache); 510 krb5_cc_destroy(context, ccache2); 511 goto fail; 512 } 513 514 setenv("KRB5CCNAME", cc_name, 1); 515 free(cc_name); 516 krb5_cc_close(context, ccache2); 517 krb5_cc_destroy(context, ccache); 518 return (0); 519 520 fail: 521 if (princ != NULL) 522 krb5_free_principal (context, princ); 523 krb5_free_context (context); 524 return (1); 525 } 526 #endif 527 528 #ifdef KERBEROS 529 static int 530 kerberos(username, user, uid) 531 char *username, *user; 532 int uid; 533 { 534 KTEXT_ST ticket; 535 AUTH_DAT authdata; 536 struct hostent *hp; 537 int kerno; 538 u_long faddr; 539 char lrealm[REALM_SZ], krbtkfile[MAXPATHLEN]; 540 char hostname[MAXHOSTNAMELEN + 1], savehost[MAXHOSTNAMELEN + 1]; 541 542 if (krb_get_lrealm(lrealm, 1) != KSUCCESS) 543 return (1); 544 if (koktologin(username, lrealm, user) && !uid) { 545 warnx("kerberos: not in %s's ACL.", user); 546 return (1); 547 } 548 (void)snprintf(krbtkfile, sizeof krbtkfile, "%s_%s_%d", TKT_ROOT, 549 user, getuid()); 550 551 (void)setenv("KRBTKFILE", krbtkfile, 1); 552 (void)krb_set_tkt_string(krbtkfile); 553 /* 554 * Set real as well as effective ID to 0 for the moment, 555 * to make the kerberos library do the right thing. 556 */ 557 if (setuid(0) < 0) { 558 warn("setuid"); 559 return (1); 560 } 561 562 /* 563 * Little trick here -- if we are su'ing to root, 564 * we need to get a ticket for "xxx.root", where xxx represents 565 * the name of the person su'ing. Otherwise (non-root case), 566 * we need to get a ticket for "yyy.", where yyy represents 567 * the name of the person being su'd to, and the instance is null 568 * 569 * We should have a way to set the ticket lifetime, 570 * with a system default for root. 571 */ 572 { 573 char prompt[128]; 574 char passw[256]; 575 576 (void)snprintf (prompt, sizeof(prompt), 577 "%s's Password: ", 578 krb_unparse_name_long ((uid == 0 ? username : user), 579 (uid == 0 ? "root" : ""), 580 lrealm)); 581 if (des_read_pw_string (passw, sizeof (passw), prompt, 0)) { 582 memset (passw, 0, sizeof (passw)); 583 return (1); 584 } 585 if (strlen(passw) == 0) 586 return (1); /* Empty passwords are not allowed */ 587 588 kerno = krb_get_pw_in_tkt((uid == 0 ? username : user), 589 (uid == 0 ? "root" : ""), lrealm, 590 KRB_TICKET_GRANTING_TICKET, 591 lrealm, 592 DEFAULT_TKT_LIFE, 593 passw); 594 memset (passw, 0, strlen (passw)); 595 } 596 597 if (kerno != KSUCCESS) { 598 if (kerno == KDC_PR_UNKNOWN) { 599 warnx("kerberos: principal unknown: %s.%s@%s", 600 (uid == 0 ? username : user), 601 (uid == 0 ? "root" : ""), lrealm); 602 return (1); 603 } 604 warnx("kerberos: unable to su: %s", krb_err_txt[kerno]); 605 syslog(LOG_WARNING, 606 "BAD Kerberos SU: %s to %s%s: %s", 607 username, user, ontty(), krb_err_txt[kerno]); 608 return (1); 609 } 610 611 if (chown(krbtkfile, uid, -1) < 0) { 612 warn("chown"); 613 (void)unlink(krbtkfile); 614 return (1); 615 } 616 617 (void)setpriority(PRIO_PROCESS, 0, -2); 618 619 if (gethostname(hostname, sizeof(hostname)) == -1) { 620 warn("gethostname"); 621 dest_tkt(); 622 return (1); 623 } 624 hostname[sizeof(hostname) - 1] = '\0'; 625 626 (void)strlcpy(savehost, krb_get_phost(hostname), sizeof(savehost)); 627 savehost[sizeof(savehost) - 1] = '\0'; 628 629 kerno = krb_mk_req(&ticket, "rcmd", savehost, lrealm, 33); 630 631 if (kerno == KDC_PR_UNKNOWN) { 632 warnx("Warning: TGT not verified."); 633 syslog(LOG_WARNING, 634 "%s to %s%s, TGT not verified (%s); %s.%s not registered?", 635 username, user, ontty(), krb_err_txt[kerno], 636 "rcmd", savehost); 637 } else if (kerno != KSUCCESS) { 638 warnx("Unable to use TGT: %s", krb_err_txt[kerno]); 639 syslog(LOG_WARNING, "failed su: %s to %s%s: %s", 640 username, user, ontty(), krb_err_txt[kerno]); 641 dest_tkt(); 642 return (1); 643 } else { 644 if (!(hp = gethostbyname(hostname))) { 645 warnx("can't get addr of %s", hostname); 646 dest_tkt(); 647 return (1); 648 } 649 memmove((char *)&faddr, (char *)hp->h_addr, sizeof(faddr)); 650 651 if ((kerno = krb_rd_req(&ticket, "rcmd", savehost, faddr, 652 &authdata, "")) != KSUCCESS) { 653 warnx("kerberos: unable to verify rcmd ticket: %s", 654 krb_err_txt[kerno]); 655 syslog(LOG_WARNING, 656 "failed su: %s to %s%s: %s", username, 657 user, ontty(), krb_err_txt[kerno]); 658 dest_tkt(); 659 return (1); 660 } 661 } 662 return (0); 663 } 664 665 static int 666 koktologin(name, realm, toname) 667 char *name, *realm, *toname; 668 { 669 return krb_kuserok(name, 670 strcmp (toname, "root") == 0 ? "root" : "", 671 realm, 672 toname); 673 } 674 #endif 675 676 static int 677 check_ingroup (gid, gname, user, ifempty) 678 int gid; 679 const char *gname; 680 const char *user; 681 int ifempty; 682 { 683 struct group *gr; 684 char **g; 685 #ifdef SU_INDIRECT_GROUP 686 char **gr_mem; 687 int n = 0; 688 int i = 0; 689 #endif 690 int ok = 0; 691 692 if (gname == NULL) 693 gr = getgrgid((gid_t) gid); 694 else 695 gr = getgrnam(gname); 696 697 /* 698 * XXX we are relying on the fact that we only set ifempty when 699 * calling to check for SU_GROUP and that is the only time a 700 * missing group is acceptable. 701 */ 702 if (gr == NULL) 703 return ifempty; 704 if (!*gr->gr_mem) /* empty */ 705 return ifempty; 706 707 /* 708 * Ok, first see if user is in gr_mem 709 */ 710 for (g = gr->gr_mem; *g; ++g) { 711 if (strcmp(*g, user) == 0) 712 return 1; /* ok */ 713 #ifdef SU_INDIRECT_GROUP 714 ++n; /* count them */ 715 #endif 716 } 717 #ifdef SU_INDIRECT_GROUP 718 /* 719 * No. 720 * Now we need to duplicate the gr_mem list, and recurse for 721 * each member to see if it is a group, and if so whether user is 722 * in it. 723 */ 724 gr_mem = malloc((n + 1) * sizeof (char *)); 725 for (g = gr->gr_mem, i = 0; *g; ++g) { 726 gr_mem[i] = strdup(*g); 727 if (!gr_mem[i]) 728 err(1, "strdup"); 729 i++; 730 } 731 gr_mem[i++] = NULL; 732 733 for (g = gr_mem; ok == 0 && *g; ++g) { 734 /* 735 * If we get this far we don't accept empty/missing groups. 736 */ 737 ok = check_ingroup(-1, *g, user, 0); 738 } 739 for (g = gr_mem; *g; ++g) { 740 free(*g); 741 } 742 free(gr_mem); 743 #endif 744 return ok; 745 } 746
Indexes created Tue Oct 28 02:10:10 GMT 2025