2 * Copyright (c) 2007-2009 Todd C. Miller <Todd.Miller@courtesan.com>
4 * Permission to use, copy, modify, and distribute this software for any
5 * purpose with or without fee is hereby granted, provided that the above
6 * copyright notice and this permission notice appear in all copies.
8 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 #include <sys/types.h>
20 #include <sys/param.h>
29 #endif /* STDC_HEADERS */
33 # ifdef HAVE_STRINGS_H
36 #endif /* HAVE_STRING_H */
39 #endif /* HAVE_UNISTD_H */
47 extern struct sudo_nss sudo_nss_file;
49 extern struct sudo_nss sudo_nss_ldap;
52 #if defined(HAVE_LDAP) && defined(_PATH_NSSWITCH_CONF)
54 * Read in /etc/nsswitch.conf
55 * Returns a tail queue of matches.
57 struct sudo_nss_list *
62 int saw_files = FALSE;
64 int got_match = FALSE;
65 static struct sudo_nss_list snl;
67 if ((fp = fopen(_PATH_NSSWITCH_CONF, "r")) == NULL)
70 while ((cp = sudo_parseln(fp)) != NULL) {
71 /* Skip blank or comment lines */
75 /* Look for a line starting with "sudoers:" */
76 if (strncasecmp(cp, "sudoers:", 8) != 0)
80 for ((cp = strtok(cp + 8, " \t")); cp != NULL; (cp = strtok(NULL, " \t"))) {
81 if (strcasecmp(cp, "files") == 0 && !saw_files) {
82 tq_append(&snl, &sudo_nss_file);
84 } else if (strcasecmp(cp, "ldap") == 0 && !saw_ldap) {
85 tq_append(&snl, &sudo_nss_ldap);
87 } else if (strcasecmp(cp, "[NOTFOUND=return]") == 0 && got_match) {
88 /* NOTFOUND affects the most recent entry */
89 tq_last(&snl)->ret_if_notfound = TRUE;
94 /* Only parse the first "sudoers:" line */
100 /* Default to files only if no matches */
102 tq_append(&snl, &sudo_nss_file);
107 #else /* HAVE_LDAP && _PATH_NSSWITCH_CONF */
109 # if defined(HAVE_LDAP) && defined(_PATH_NETSVC_CONF)
112 * Read in /etc/netsvc.conf (like nsswitch.conf on AIX)
113 * Returns a tail queue of matches.
115 struct sudo_nss_list *
120 int saw_files = FALSE;
121 int saw_ldap = FALSE;
122 int got_match = FALSE;
123 static struct sudo_nss_list snl;
125 if ((fp = fopen(_PATH_NETSVC_CONF, "r")) == NULL)
128 while ((cp = sudo_parseln(fp)) != NULL) {
129 /* Skip blank or comment lines */
133 /* Look for a line starting with "sudoers = " */
134 if (strncasecmp(cp, "sudoers", 7) != 0)
137 while (isspace((unsigned char)*cp))
143 for ((cp = strtok(cp, ",")); cp != NULL; (cp = strtok(NULL, ","))) {
144 /* Trim leading whitespace. */
145 while (isspace((unsigned char)*cp))
148 if (!saw_files && strncasecmp(cp, "files", 5) == 0 &&
149 (isspace((unsigned char)cp[5]) || cp[5] == '\0')) {
150 tq_append(&snl, &sudo_nss_file);
153 } else if (!saw_ldap && strncasecmp(cp, "ldap", 4) == 0 &&
154 (isspace((unsigned char)cp[4]) || cp[4] == '\0')) {
155 tq_append(&snl, &sudo_nss_ldap);
162 /* check for = auth qualifier */
163 if (got_match && *ep) {
165 while (isspace((unsigned char)*cp) || *cp == '=')
167 if (strncasecmp(cp, "auth", 4) == 0 &&
168 (isspace((unsigned char)cp[4]) || cp[4] == '\0')) {
169 tq_last(&snl)->ret_if_found = TRUE;
173 /* Only parse the first "sudoers" line */
179 /* Default to files only if no matches */
181 tq_append(&snl, &sudo_nss_file);
186 # else /* !_PATH_NETSVC_CONF && !_PATH_NSSWITCH_CONF */
189 * Non-nsswitch.conf version with hard-coded order.
191 struct sudo_nss_list *
194 static struct sudo_nss_list snl;
197 tq_append(&snl, &sudo_nss_ldap);
199 tq_append(&snl, &sudo_nss_file);
204 # endif /* !HAVE_LDAP || !_PATH_NETSVC_CONF */
206 #endif /* HAVE_LDAP && _PATH_NSSWITCH_CONF */
208 /* Reset user_groups based on passwd entry. */
213 #if defined(HAVE_INITGROUPS) && defined(HAVE_GETGROUPS)
214 if (pw != sudo_user.pw) {
215 (void) initgroups(pw->pw_name, pw->pw_gid);
216 if ((user_ngroups = getgroups(0, NULL)) > 0) {
217 user_groups = erealloc3(user_groups, user_ngroups,
218 sizeof(GETGROUPS_T));
219 if (getgroups(user_ngroups, user_groups) < 0)
220 log_error(USE_ERRNO|MSG_ONLY, "can't get group vector");
230 * Print out privileges for the specified user.
231 * We only get here if the user is allowed to run something on this host.
234 display_privs(snl, pw)
235 struct sudo_nss_list *snl;
238 struct sudo_nss *nss;
242 /* Reset group vector so group matching works correctly. */
245 lbuf_init(&lbuf, NULL, 4, 0);
247 /* Display defaults from all sources. */
249 tq_foreach_fwd(snl, nss)
250 count += nss->display_defaults(nss, pw, &lbuf);
252 printf("Matching Defaults entries for %s on this host:\n", pw->pw_name);
257 /* Display Runas and Cmnd-specific defaults from all sources. */
259 tq_foreach_fwd(snl, nss)
260 count += nss->display_bound_defaults(nss, pw, &lbuf);
262 printf("Runas and Command-specific defaults for %s:\n", pw->pw_name);
267 /* Display privileges from all sources. */
268 printf("User %s may run the following commands on this host:\n",
270 tq_foreach_fwd(snl, nss)
271 (void) nss->display_privs(nss, pw, &lbuf);
273 lbuf_print(&lbuf); /* print remainder, if any */
278 * Check user_cmnd against sudoers and print the matching entry if the
279 * command is allowed.
282 display_cmnd(snl, pw)
283 struct sudo_nss_list *snl;
286 struct sudo_nss *nss;
288 /* Reset group vector so group matching works correctly. */
291 tq_foreach_fwd(snl, nss) {
292 if (nss->display_cmnd(nss, pw) == 0)