2 * Copyright (c) 2007-2011 Todd C. Miller <Todd.Miller@courtesan.com>
4 * Permission to use, copy, modify, and distribute this software for any
5 * purpose with or without fee is hereby granted, provided that the above
6 * copyright notice and this permission notice appear in all copies.
8 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 #include <sys/types.h>
20 #include <sys/param.h>
29 #endif /* STDC_HEADERS */
32 #endif /* HAVE_STRING_H */
35 #endif /* HAVE_STRINGS_H */
38 #endif /* HAVE_UNISTD_H */
46 extern struct sudo_nss sudo_nss_file;
48 extern struct sudo_nss sudo_nss_ldap;
51 #if defined(HAVE_LDAP) && defined(_PATH_NSSWITCH_CONF)
53 * Read in /etc/nsswitch.conf
54 * Returns a tail queue of matches.
56 struct sudo_nss_list *
61 int saw_files = FALSE;
63 int got_match = FALSE;
64 static struct sudo_nss_list snl;
66 if ((fp = fopen(_PATH_NSSWITCH_CONF, "r")) == NULL)
69 while ((cp = sudo_parseln(fp)) != NULL) {
70 /* Skip blank or comment lines */
74 /* Look for a line starting with "sudoers:" */
75 if (strncasecmp(cp, "sudoers:", 8) != 0)
79 for ((cp = strtok(cp + 8, " \t")); cp != NULL; (cp = strtok(NULL, " \t"))) {
80 if (strcasecmp(cp, "files") == 0 && !saw_files) {
81 tq_append(&snl, &sudo_nss_file);
83 } else if (strcasecmp(cp, "ldap") == 0 && !saw_ldap) {
84 tq_append(&snl, &sudo_nss_ldap);
86 } else if (strcasecmp(cp, "[NOTFOUND=return]") == 0 && got_match) {
87 /* NOTFOUND affects the most recent entry */
88 tq_last(&snl)->ret_if_notfound = TRUE;
93 /* Only parse the first "sudoers:" line */
99 /* Default to files only if no matches */
101 tq_append(&snl, &sudo_nss_file);
106 #else /* HAVE_LDAP && _PATH_NSSWITCH_CONF */
108 # if defined(HAVE_LDAP) && defined(_PATH_NETSVC_CONF)
111 * Read in /etc/netsvc.conf (like nsswitch.conf on AIX)
112 * Returns a tail queue of matches.
114 struct sudo_nss_list *
119 int saw_files = FALSE;
120 int saw_ldap = FALSE;
121 int got_match = FALSE;
122 static struct sudo_nss_list snl;
124 if ((fp = fopen(_PATH_NETSVC_CONF, "r")) == NULL)
127 while ((cp = sudo_parseln(fp)) != NULL) {
128 /* Skip blank or comment lines */
132 /* Look for a line starting with "sudoers = " */
133 if (strncasecmp(cp, "sudoers", 7) != 0)
136 while (isspace((unsigned char)*cp))
142 for ((cp = strtok(cp, ",")); cp != NULL; (cp = strtok(NULL, ","))) {
143 /* Trim leading whitespace. */
144 while (isspace((unsigned char)*cp))
147 if (!saw_files && strncasecmp(cp, "files", 5) == 0 &&
148 (isspace((unsigned char)cp[5]) || cp[5] == '\0')) {
149 tq_append(&snl, &sudo_nss_file);
152 } else if (!saw_ldap && strncasecmp(cp, "ldap", 4) == 0 &&
153 (isspace((unsigned char)cp[4]) || cp[4] == '\0')) {
154 tq_append(&snl, &sudo_nss_ldap);
161 /* check for = auth qualifier */
162 if (got_match && *ep) {
164 while (isspace((unsigned char)*cp) || *cp == '=')
166 if (strncasecmp(cp, "auth", 4) == 0 &&
167 (isspace((unsigned char)cp[4]) || cp[4] == '\0')) {
168 tq_last(&snl)->ret_if_found = TRUE;
172 /* Only parse the first "sudoers" line */
178 /* Default to files only if no matches */
180 tq_append(&snl, &sudo_nss_file);
185 # else /* !_PATH_NETSVC_CONF && !_PATH_NSSWITCH_CONF */
188 * Non-nsswitch.conf version with hard-coded order.
190 struct sudo_nss_list *
193 static struct sudo_nss_list snl;
196 tq_append(&snl, &sudo_nss_ldap);
198 tq_append(&snl, &sudo_nss_file);
203 # endif /* !HAVE_LDAP || !_PATH_NETSVC_CONF */
205 #endif /* HAVE_LDAP && _PATH_NSSWITCH_CONF */
208 output(const char *buf)
210 struct sudo_conv_message msg;
211 struct sudo_conv_reply repl;
213 /* Call conversation function */
214 memset(&msg, 0, sizeof(msg));
215 msg.msg_type = SUDO_CONV_INFO_MSG;
217 memset(&repl, 0, sizeof(repl));
218 if (sudo_conv(1, &msg, &repl) == -1)
220 return (int)strlen(buf);
224 * Print out privileges for the specified user.
225 * We only get here if the user is allowed to run something on this host.
228 display_privs(struct sudo_nss_list *snl, struct passwd *pw)
230 struct sudo_nss *nss;
231 struct lbuf defs, privs;
234 lbuf_init(&defs, output, 4, NULL, sudo_user.cols);
235 lbuf_init(&privs, output, 4, NULL, sudo_user.cols);
237 /* Display defaults from all sources. */
238 lbuf_append(&defs, _("Matching Defaults entries for %s on this host:\n"),
241 tq_foreach_fwd(snl, nss) {
242 count += nss->display_defaults(nss, pw, &defs);
245 lbuf_append(&defs, "\n\n");
249 /* Display Runas and Cmnd-specific defaults from all sources. */
251 lbuf_append(&defs, _("Runas and Command-specific defaults for %s:\n"),
254 tq_foreach_fwd(snl, nss) {
255 count += nss->display_bound_defaults(nss, pw, &defs);
258 lbuf_append(&defs, "\n\n");
262 /* Display privileges from all sources. */
264 _("User %s may run the following commands on this host:\n"),
267 tq_foreach_fwd(snl, nss) {
268 count += nss->display_privs(nss, pw, &privs);
274 printf(_("User %s is not allowed to run sudo on %s.\n"), pw->pw_name,
279 lbuf_destroy(&privs);
283 * Check user_cmnd against sudoers and print the matching entry if the
284 * command is allowed.
285 * Returns TRUE if the command is allowed, else FALSE.
288 display_cmnd(struct sudo_nss_list *snl, struct passwd *pw)
290 struct sudo_nss *nss;
292 tq_foreach_fwd(snl, nss) {
293 if (nss->display_cmnd(nss, pw) == 0)