1 /* $OpenBSD: getgrouplist.c,v 1.27 2015/12/01 15:08:25 deraadt Exp $ */ 2 /* 3 * Copyright (c) 2008 Ingo Schwarze <schwarze@usta.de> 4 * Copyright (c) 1991, 1993 5 * The Regents of the University of California. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. Neither the name of the University nor the names of its contributors 16 * may be used to endorse or promote products derived from this software 17 * without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32 /* 33 * get credential 34 */ 35 #include <sys/types.h> 36 #include <sys/limits.h> 37 #include <string.h> 38 #include <unistd.h> 39 #include <stdio.h> 40 #include <stdlib.h> 41 #include <grp.h> 42 #include <pwd.h> 43 44 #include <rpc/rpc.h> 45 #include <rpcsvc/yp.h> 46 #include <rpcsvc/ypclnt.h> 47 48 #ifdef YP 49 #define _PATH_NETID "/etc/netid" 50 #define MAXLINELENGTH 1024 51 52 static int _parse_netid(char*, uid_t, gid_t*, int*, int); 53 static int _read_netid(const char *, uid_t, gid_t*, int*, int); 54 55 /* 56 * Parse one string of the form "uid:gid[,gid[,...]]". 57 * If the uid matches, add the groups to the group list. 58 * If the groups fit, return 1, otherwise return -1. 59 * If the uid does not match, return 0. 60 */ 61 static int 62 _parse_netid(char *netid, uid_t uid, gid_t *groups, int *ngroups, 63 int maxgroups) 64 { 65 const char *errstr = NULL; 66 char *start, *p; 67 uid_t tuid; 68 gid_t gid; 69 int i; 70 71 /* Check the uid. */ 72 p = strchr(netid, ':'); 73 if (!p) 74 return (0); 75 *p++ = '\0'; 76 tuid = (uid_t)strtonum(netid, 0, UID_MAX, &errstr); 77 if (errstr || tuid != uid) 78 return (0); 79 80 /* Loop over the gids. */ 81 while (p && *p) { 82 start = p; 83 p = strchr(start, ','); 84 if (p) 85 *p++ = '\0'; 86 gid = (gid_t)strtonum(start, 0, GID_MAX, &errstr); 87 if (errstr) 88 continue; 89 90 /* Skip this group if it is already in the list. */ 91 for (i = 0; i < *ngroups; i++) 92 if (groups[i] == gid) 93 break; 94 95 /* Try to add this new group to the list. */ 96 if (i == *ngroups) { 97 if (*ngroups >= maxgroups) 98 return (-1); 99 groups[(*ngroups)++] = gid; 100 } 101 } 102 return (1); 103 } 104 105 /* 106 * Search /etc/netid for a particular uid and process that line. 107 * See _parse_netid for details, including return values. 108 */ 109 static int 110 _read_netid(const char *key, uid_t uid, gid_t *groups, int *ngroups, 111 int maxgroups) 112 { 113 FILE *fp; 114 char line[MAXLINELENGTH], *p; 115 int found = 0; 116 117 fp = fopen(_PATH_NETID, "re"); 118 if (!fp) 119 return (0); 120 while (!found && fgets(line, sizeof(line), fp)) { 121 p = strchr(line, '\n'); 122 if (p) 123 *p = '\0'; 124 else { /* Skip lines that are too long. */ 125 int ch; 126 while ((ch = getc_unlocked(fp)) != '\n' && ch != EOF) 127 ; 128 continue; 129 } 130 p = strchr(line, ' '); 131 if (!p) 132 continue; 133 *p++ = '\0'; 134 if (strcmp(line, key)) 135 continue; 136 found = _parse_netid(p, uid, groups, ngroups, maxgroups); 137 } 138 (void)fclose(fp); 139 return (found); 140 } 141 #endif /* YP */ 142 143 int 144 getgrouplist(const char *uname, gid_t agroup, gid_t *groups, int *grpcnt) 145 { 146 int i, ngroups = 0, ret = 0, maxgroups = *grpcnt, bail; 147 int needyp = 0, foundyp = 0; 148 int *skipyp = &foundyp; 149 extern struct group *_getgrent_yp(int *); 150 struct group *grp; 151 152 /* 153 * install primary group 154 */ 155 if (ngroups >= maxgroups) { 156 *grpcnt = ngroups; 157 return (-1); 158 } 159 groups[ngroups++] = agroup; 160 161 #ifdef YP 162 /* 163 * Hint to the kernel that a passwd database operation is happening. 164 */ 165 (void)access("/var/run/ypbind.lock", R_OK); 166 #endif 167 168 /* 169 * Scan the group file to find additional groups. 170 */ 171 setgrent(); 172 while ((grp = _getgrent_yp(skipyp)) || foundyp) { 173 if (foundyp) { 174 if (foundyp > 0) 175 needyp = 1; 176 else 177 skipyp = NULL; 178 foundyp = 0; 179 continue; 180 } 181 if (grp->gr_gid == agroup) 182 continue; 183 for (bail = 0, i = 0; bail == 0 && i < ngroups; i++) 184 if (groups[i] == grp->gr_gid) 185 bail = 1; 186 if (bail) 187 continue; 188 for (i = 0; grp->gr_mem[i]; i++) { 189 if (!strcmp(grp->gr_mem[i], uname)) { 190 if (ngroups >= maxgroups) { 191 ret = -1; 192 goto out; 193 } 194 groups[ngroups++] = grp->gr_gid; 195 break; 196 } 197 } 198 } 199 200 #ifdef YP 201 /* 202 * If we were told that there is a YP marker, look at netid data. 203 */ 204 if (skipyp && needyp) { 205 char buf[MAXLINELENGTH], *ypdata = NULL, *key; 206 static char *__ypdomain; 207 struct passwd pwstore; 208 int ypdatalen; 209 210 /* Construct the netid key to look up. */ 211 if (getpwnam_r(uname, &pwstore, buf, sizeof buf, NULL) || 212 (!__ypdomain && yp_get_default_domain(&__ypdomain))) 213 goto out; 214 i = asprintf(&key, "unix.%u@%s", pwstore.pw_uid, __ypdomain); 215 if (i == -1) 216 goto out; 217 218 /* First scan the static netid file. */ 219 switch (_read_netid(key, pwstore.pw_uid, 220 groups, &ngroups, maxgroups)) { 221 case -1: 222 ret = -1; 223 /* FALLTHROUGH */ 224 case 1: 225 free(key); 226 goto out; 227 default: 228 break; 229 } 230 231 /* Only access YP when there is no static entry. */ 232 if (!yp_bind(__ypdomain) && 233 !yp_match(__ypdomain, "netid.byname", key, 234 (int)strlen(key), &ypdata, &ypdatalen)) 235 if (_parse_netid(ypdata, pwstore.pw_uid, 236 groups, &ngroups, maxgroups) == -1) 237 ret = -1; 238 239 free(key); 240 free(ypdata); 241 } 242 #endif /* YP */ 243 244 out: 245 endgrent(); 246 *grpcnt = ngroups; 247 return (ret); 248 } 249 DEF_WEAK(getgrouplist); 250