2 * Copyright (c) 2007-2008 Todd C. Miller <Todd.Miller@courtesan.com>
4 * Permission to use, copy, modify, and distribute this software for any
5 * purpose with or without fee is hereby granted, provided that the above
6 * copyright notice and this permission notice appear in all copies.
8 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 #include <sys/types.h>
20 #include <sys/param.h>
29 #endif /* STDC_HEADERS */
33 # ifdef HAVE_STRINGS_H
36 #endif /* HAVE_STRING_H */
39 #endif /* HAVE_UNISTD_H */
47 __unused static const char rcsid[] = "$Sudo: sudo_nss.c,v 1.6 2008/02/08 13:18:12 millert Exp $";
50 extern struct sudo_nss sudo_nss_file;
52 extern struct sudo_nss sudo_nss_ldap;
55 #if defined(HAVE_LDAP) && defined(_PATH_NSSWITCH_CONF)
57 * Read in /etc/nsswitch.conf
58 * Returns a tail queue of matches.
60 struct sudo_nss_list *
65 int saw_files = FALSE;
67 int got_match = FALSE;
68 static struct sudo_nss_list snl;
70 if ((fp = fopen(_PATH_NSSWITCH_CONF, "r")) == NULL)
73 while ((cp = sudo_parseln(fp)) != NULL) {
74 /* Skip blank or comment lines */
78 /* Look for a line starting with "sudoers:" */
79 if (strncasecmp(cp, "sudoers:", 8) != 0)
83 for ((cp = strtok(cp + 8, " \t")); cp != NULL; (cp = strtok(NULL, " \t"))) {
84 if (strcasecmp(cp, "files") == 0 && !saw_files) {
85 tq_append(&snl, &sudo_nss_file);
87 } else if (strcasecmp(cp, "ldap") == 0 && !saw_ldap) {
88 tq_append(&snl, &sudo_nss_ldap);
90 } else if (strcasecmp(cp, "[NOTFOUND=return]") == 0 && got_match) {
91 /* NOTFOUND affects the most recent entry */
92 tq_last(&snl)->ret_notfound = TRUE;
97 /* Only parse the first "sudoers:" line */
103 /* Default to files only if no matches */
105 tq_append(&snl, &sudo_nss_file);
110 #else /* HAVE_LDAP && _PATH_NSSWITCH_CONF */
113 * Non-nsswitch.conf version with hard-coded order.
115 struct sudo_nss_list *
118 static struct sudo_nss_list snl;
121 tq_append(&snl, &sudo_nss_ldap);
123 tq_append(&snl, &sudo_nss_file);
128 #endif /* HAVE_LDAP && _PATH_NSSWITCH_CONF */
130 /* Reset user_groups based on passwd entry. */
135 #if defined(HAVE_INITGROUPS) && defined(HAVE_GETGROUPS)
136 if (pw != sudo_user.pw) {
137 (void) initgroups(pw->pw_name, pw->pw_gid);
138 if ((user_ngroups = getgroups(0, NULL)) > 0) {
139 user_groups = erealloc3(user_groups, user_ngroups,
140 sizeof(GETGROUPS_T));
141 if (getgroups(user_ngroups, user_groups) < 0)
142 log_error(USE_ERRNO|MSG_ONLY, "can't get group vector");
152 * Print out privileges for the specified user.
153 * We only get here if the user is allowed to run something on this host.
156 display_privs(snl, pw)
157 struct sudo_nss_list *snl;
160 struct sudo_nss *nss;
164 /* Reset group vector so group matching works correctly. */
167 lbuf_init(&lbuf, NULL, 4, 0);
169 /* Display defaults from all sources. */
171 tq_foreach_fwd(snl, nss)
172 count += nss->display_defaults(nss, pw, &lbuf);
174 printf("Matching Defaults entries for %s on this host:\n", pw->pw_name);
179 /* Display Runas and Cmnd-specific defaults from all sources. */
181 tq_foreach_fwd(snl, nss)
182 count += nss->display_bound_defaults(nss, pw, &lbuf);
184 printf("Runas and Command-specific defaults for %s:\n", pw->pw_name);
189 /* Display privileges from all sources. */
190 printf("User %s may run the following commands on this host:\n",
192 tq_foreach_fwd(snl, nss)
193 (void) nss->display_privs(nss, pw, &lbuf);
195 lbuf_print(&lbuf); /* print remainder, if any */
200 * Check user_cmnd against sudoers and print the matching entry if the
201 * command is allowed.
204 display_cmnd(snl, pw)
205 struct sudo_nss_list *snl;
208 struct sudo_nss *nss;
210 /* Reset group vector so group matching works correctly. */
213 tq_foreach_fwd(snl, nss) {
214 if (nss->display_cmnd(nss, pw) == 0)