Return to kuserok.c CVS log

Up to [CSRG BSD Unix] / 43BSDReno / kerberosIV / krb

Annotation of 43BSDReno/kerberosIV/krb/kuserok.c, revision 1.1.1.1

1.1       root        1: /*
                      2:  * $Source: /usr/src/kerberosIV/krb/RCS/kuserok.c,v $
                      3:  * $Author: kfall $
                      4:  *
                      5:  * Copyright 1987, 1988 by the Massachusetts Institute of Technology.
                      6:  *
                      7:  * For copying and distribution information, please see the file
                      8:  * <mit-copyright.h>.
                      9:  *
                     10:  * kuserok: check if a kerberos principal has
                     11:  * access to a local account
                     12:  */
                     13: 
                     14: #ifndef        lint
                     15: static char rcsid_kuserok_c[] =
                     16: "$Header: /usr/src/kerberosIV/krb/RCS/kuserok.c,v 4.7 90/06/23 03:11:11 kfall Exp $";
                     17: #endif lint
                     18: 
                     19: #include <mit-copyright.h>
                     20: 
                     21: #include <sys/param.h>
                     22: #include <sys/socket.h>
                     23: #include <sys/stat.h>
                     24: #include <sys/file.h>
                     25: #include <des.h>
                     26: #include <krb.h>
                     27: #include <stdio.h>
                     28: #include <pwd.h>
                     29: #include <strings.h>
                     30: 
                     31: #define OK 0
                     32: #define NOTOK 1
                     33: #define MAX_USERNAME 10
                     34: 
                     35: /*
                     36:  * Given a Kerberos principal "kdata", and a local username "luser",
                     37:  * determine whether user is authorized to login according to the
                     38:  * authorization file ("~luser/.klogin" by default).  Returns OK
                     39:  * if authorized, NOTOK if not authorized.
                     40:  *
                     41:  * If there is no account for "luser" on the local machine, returns
                     42:  * NOTOK.  If there is no authorization file, and the given Kerberos
                     43:  * name "kdata" translates to the same name as "luser" (using
                     44:  * krb_kntoln()), returns OK.  Otherwise, if the authorization file
                     45:  * can't be accessed, returns NOTOK.  Otherwise, the file is read for
                     46:  * a matching principal name, instance, and realm.  If one is found,
                     47:  * returns OK, if none is found, returns NOTOK.
                     48:  *
                     49:  * The file entries are in the format:
                     50:  *
                     51:  *     name.instance@realm
                     52:  *
                     53:  * one entry per line.
                     54:  *
                     55:  * The ATHENA_COMPAT code supports old-style Athena ~luser/.klogin
                     56:  * file entries.  See the file "kparse.c".
                     57:  */
                     58: 
                     59: int
                     60: kuserok(kdata, luser)
                     61:     AUTH_DAT *kdata;
                     62:     char   *luser;
                     63: {
                     64:     struct stat sbuf;
                     65:     struct passwd *pwd;
                     66:     char pbuf[MAXPATHLEN];
                     67:     int isok = NOTOK, rc;
                     68:     FILE *fp;
                     69:     char kuser[MAX_USERNAME];
                     70:     char principal[ANAME_SZ], inst[INST_SZ], realm[REALM_SZ];
                     71:     char linebuf[BUFSIZ];
                     72:     char *newline;
                     73:     int gobble;
                     74: 
                     75:     /* no account => no access */
                     76:     if ((pwd = getpwnam(luser)) == NULL) {
                     77:        return(NOTOK);
                     78:     }
                     79:     (void) strcpy(pbuf, pwd->pw_dir);
                     80:     (void) strcat(pbuf, "/.klogin");
                     81: 
                     82:     if (access(pbuf, F_OK)) {   /* not accessible */
                     83:        /*
                     84:         * if he's trying to log in as himself, and there is no .klogin file,
                     85:         * let him.  To find out, call
                     86:         * krb_kntoln to convert the triple in kdata to a name which we can
                     87:         * string compare. 
                     88:         */
                     89:        if (!krb_kntoln(kdata, kuser) && (strcmp(kuser, luser) == 0)) {
                     90:            return(OK);
                     91:        }
                     92:     }
                     93:     /* open ~/.klogin */
                     94:     if ((fp = fopen(pbuf, "r")) == NULL) {
                     95:        return(NOTOK);
                     96:     }
                     97:     /*
                     98:      * security:  if the user does not own his own .klogin file,
                     99:      * do not grant access
                    100:      */
                    101:     if (fstat(fileno(fp), &sbuf)) {
                    102:        fclose(fp);
                    103:        return(NOTOK);
                    104:     }
                    105:     if (sbuf.st_uid != pwd->pw_uid) {
                    106:        fclose(fp);
                    107:        return(NOTOK);
                    108:     }
                    109: 
                    110:     /* check each line */
                    111:     while ((isok != OK) && (fgets(linebuf, BUFSIZ, fp) != NULL)) {
                    112:        /* null-terminate the input string */
                    113:        linebuf[BUFSIZ-1] = '\0';
                    114:        newline = NULL;
                    115:        /* nuke the newline if it exists */
                    116:        if (newline = index(linebuf, '\n'))
                    117:            *newline = '\0';
                    118:        rc = kname_parse(principal, inst, realm, linebuf);
                    119:        if (rc == KSUCCESS) {
                    120:            isok = (strncmp(kdata->pname, principal, ANAME_SZ) ||
                    121:                    strncmp(kdata->pinst, inst, INST_SZ) ||
                    122:                    strncasecmp(kdata->prealm, realm, REALM_SZ));
                    123:        }
                    124:        /* clean up the rest of the line if necessary */
                    125:        if (!newline)
                    126:            while (((gobble = getc(fp)) != EOF) && gobble != '\n');
                    127:     }
                    128:     fclose(fp);
                    129:     return(isok);
                    130: }

This archive runs on limited infrastructure. Preserving old code on modern bandwidth. Automated agents are requested to crawl responsibly.