2 * Copyright (c) 2007-2010 Todd C. Miller <Todd.Miller@courtesan.com>
4 * Permission to use, copy, modify, and distribute this software for any
5 * purpose with or without fee is hereby granted, provided that the above
6 * copyright notice and this permission notice appear in all copies.
8 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 #include <sys/types.h>
20 #include <sys/param.h>
29 #endif /* STDC_HEADERS */
32 #endif /* HAVE_STRING_H */
35 #endif /* HAVE_STRINGS_H */
38 #endif /* HAVE_UNISTD_H */
46 extern struct sudo_nss sudo_nss_file;
48 extern struct sudo_nss sudo_nss_ldap;
51 #if defined(HAVE_LDAP) && defined(_PATH_NSSWITCH_CONF)
53 * Read in /etc/nsswitch.conf
54 * Returns a tail queue of matches.
56 struct sudo_nss_list *
61 int saw_files = FALSE;
63 int got_match = FALSE;
64 static struct sudo_nss_list snl;
66 if ((fp = fopen(_PATH_NSSWITCH_CONF, "r")) == NULL)
69 while ((cp = sudo_parseln(fp)) != NULL) {
70 /* Skip blank or comment lines */
74 /* Look for a line starting with "sudoers:" */
75 if (strncasecmp(cp, "sudoers:", 8) != 0)
79 for ((cp = strtok(cp + 8, " \t")); cp != NULL; (cp = strtok(NULL, " \t"))) {
80 if (strcasecmp(cp, "files") == 0 && !saw_files) {
81 tq_append(&snl, &sudo_nss_file);
83 } else if (strcasecmp(cp, "ldap") == 0 && !saw_ldap) {
84 tq_append(&snl, &sudo_nss_ldap);
86 } else if (strcasecmp(cp, "[NOTFOUND=return]") == 0 && got_match) {
87 /* NOTFOUND affects the most recent entry */
88 tq_last(&snl)->ret_if_notfound = TRUE;
93 /* Only parse the first "sudoers:" line */
99 /* Default to files only if no matches */
101 tq_append(&snl, &sudo_nss_file);
106 #else /* HAVE_LDAP && _PATH_NSSWITCH_CONF */
108 # if defined(HAVE_LDAP) && defined(_PATH_NETSVC_CONF)
111 * Read in /etc/netsvc.conf (like nsswitch.conf on AIX)
112 * Returns a tail queue of matches.
114 struct sudo_nss_list *
119 int saw_files = FALSE;
120 int saw_ldap = FALSE;
121 int got_match = FALSE;
122 static struct sudo_nss_list snl;
124 if ((fp = fopen(_PATH_NETSVC_CONF, "r")) == NULL)
127 while ((cp = sudo_parseln(fp)) != NULL) {
128 /* Skip blank or comment lines */
132 /* Look for a line starting with "sudoers = " */
133 if (strncasecmp(cp, "sudoers", 7) != 0)
136 while (isspace((unsigned char)*cp))
142 for ((cp = strtok(cp, ",")); cp != NULL; (cp = strtok(NULL, ","))) {
143 /* Trim leading whitespace. */
144 while (isspace((unsigned char)*cp))
147 if (!saw_files && strncasecmp(cp, "files", 5) == 0 &&
148 (isspace((unsigned char)cp[5]) || cp[5] == '\0')) {
149 tq_append(&snl, &sudo_nss_file);
152 } else if (!saw_ldap && strncasecmp(cp, "ldap", 4) == 0 &&
153 (isspace((unsigned char)cp[4]) || cp[4] == '\0')) {
154 tq_append(&snl, &sudo_nss_ldap);
161 /* check for = auth qualifier */
162 if (got_match && *ep) {
164 while (isspace((unsigned char)*cp) || *cp == '=')
166 if (strncasecmp(cp, "auth", 4) == 0 &&
167 (isspace((unsigned char)cp[4]) || cp[4] == '\0')) {
168 tq_last(&snl)->ret_if_found = TRUE;
172 /* Only parse the first "sudoers" line */
178 /* Default to files only if no matches */
180 tq_append(&snl, &sudo_nss_file);
185 # else /* !_PATH_NETSVC_CONF && !_PATH_NSSWITCH_CONF */
188 * Non-nsswitch.conf version with hard-coded order.
190 struct sudo_nss_list *
193 static struct sudo_nss_list snl;
196 tq_append(&snl, &sudo_nss_ldap);
198 tq_append(&snl, &sudo_nss_file);
203 # endif /* !HAVE_LDAP || !_PATH_NETSVC_CONF */
205 #endif /* HAVE_LDAP && _PATH_NSSWITCH_CONF */
207 /* Reset user_groups based on passwd entry. */
212 #if defined(HAVE_INITGROUPS) && defined(HAVE_GETGROUPS)
213 if (pw != sudo_user.pw) {
214 # ifdef HAVE_SETAUTHDB
215 aix_setauthdb(pw->pw_name);
217 (void) initgroups(pw->pw_name, pw->pw_gid);
220 if ((user_ngroups = getgroups(0, NULL)) > 0) {
221 user_groups = emalloc2(user_ngroups, sizeof(GETGROUPS_T));
222 if (getgroups(user_ngroups, user_groups) < 0)
223 log_error(USE_ERRNO|MSG_ONLY, "can't get group vector");
225 # ifdef HAVE_SETAUTHDB
229 #endif /* HAVE_INITGROUPS && HAVE_GETGROUPS */
236 return fputs(buf, stdout);
240 * Print out privileges for the specified user.
241 * We only get here if the user is allowed to run something on this host.
244 display_privs(snl, pw)
245 struct sudo_nss_list *snl;
248 struct sudo_nss *nss;
252 /* Reset group vector so group matching works correctly. */
255 lbuf_init(&lbuf, output, 4, NULL);
257 /* Display defaults from all sources. */
258 lbuf_append(&lbuf, "Matching Defaults entries for ", pw->pw_name,
259 " on this host:\n", NULL);
261 tq_foreach_fwd(snl, nss) {
262 count += nss->display_defaults(nss, pw, &lbuf);
265 lbuf_append(&lbuf, "\n\n", NULL);
269 /* Display Runas and Cmnd-specific defaults from all sources. */
271 lbuf_append(&lbuf, "Runas and Command-specific defaults for ", pw->pw_name,
274 tq_foreach_fwd(snl, nss) {
275 count += nss->display_bound_defaults(nss, pw, &lbuf);
278 lbuf_append(&lbuf, "\n\n", NULL);
282 /* Display privileges from all sources. */
284 lbuf_append(&lbuf, "User ", pw->pw_name,
285 " may run the following commands on this host:\n", NULL);
287 tq_foreach_fwd(snl, nss) {
288 count += nss->display_privs(nss, pw, &lbuf);
298 * Check user_cmnd against sudoers and print the matching entry if the
299 * command is allowed.
302 display_cmnd(snl, pw)
303 struct sudo_nss_list *snl;
306 struct sudo_nss *nss;
308 /* Reset group vector so group matching works correctly. */
311 tq_foreach_fwd(snl, nss) {
312 if (nss->display_cmnd(nss, pw) == 0)