1 /* 2 * Copyright (c) 1980, 1987, 1993 3 * The Regents of the University of California. All rights reserved. 4 * 5 * This code is derived from software contributed to Berkeley by 6 * Bob Toxen. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. All advertising materials mentioning features or use of this software 17 * must display the following acknowledgement: 18 * This product includes software developed by the University of 19 * California, Berkeley and its contributors. 20 * 4. Neither the name of the University nor the names of its contributors 21 * may be used to endorse or promote products derived from this software 22 * without specific prior written permission. 23 * 24 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 34 * SUCH DAMAGE. 35 * 36 * @(#) Copyright (c) 1980, 1987, 1993 The Regents of the University of California. All rights reserved. 37 * @(#)lock.c 8.1 (Berkeley) 6/6/93 38 * $FreeBSD: src/usr.bin/lock/lock.c,v 1.8.2.1 2002/09/15 22:32:56 dd Exp $ 39 */ 40 41 /* 42 * Lock a terminal up until the given key is entered or the given 43 * interval times out. 44 * 45 * Timeout interval is by default TIMEOUT, it can be changed with 46 * an argument of the form -time where time is in minutes 47 */ 48 49 #include <sys/param.h> 50 #include <sys/time.h> 51 #include <sys/consio.h> 52 53 #include <err.h> 54 #include <pwd.h> 55 #include <errno.h> 56 #include <stdint.h> 57 #include <signal.h> 58 #include <stdio.h> 59 #include <stdlib.h> 60 #include <string.h> 61 #include <syslog.h> 62 #include <termios.h> 63 #include <unistd.h> 64 65 #define TIMEOUT 15 66 67 static void quit(int); 68 static void bye(int); 69 static void hi(int); 70 static void usage(void); 71 72 static struct timeval timeout; 73 static struct timeval zerotime; 74 static struct termios tty, ntty; 75 static long nexttime; /* keep the timeout time */ 76 static int no_timeout; /* lock terminal forever */ 77 static int vtyunlock; /* Unlock flag and code. */ 78 79 /*ARGSUSED*/ 80 int 81 main(int argc, char **argv) 82 { 83 struct passwd *pw; 84 time_t timval; 85 struct itimerval ntimer, otimer; 86 struct tm *timp; 87 int ch, failures, sectimeout, usemine, vtylock; 88 long tmp; 89 char *ap, *ep, *mypw, *cryptpw, *ttynam, *tzn; 90 char hostname[MAXHOSTNAMELEN + 1], s[BUFSIZ], s1[BUFSIZ]; 91 92 openlog("lock", LOG_ODELAY, LOG_AUTH); 93 94 sectimeout = TIMEOUT; 95 pw = NULL; 96 mypw = NULL; 97 usemine = 0; 98 no_timeout = 0; 99 vtylock = 0; 100 while ((ch = getopt(argc, argv, "npt:v")) != -1) 101 switch(ch) { 102 case 't': 103 tmp = strtol(optarg, &ep, 10); 104 if (*ep != '\0' || tmp > INT_MAX || tmp < INT_MIN) 105 errx(1, "illegal timeout value"); 106 sectimeout = (int)tmp; 107 break; 108 case 'p': 109 usemine = 1; 110 if (!(pw = getpwuid(getuid()))) 111 errx(1, "unknown uid %d", getuid()); 112 mypw = strdup(pw->pw_passwd); 113 break; 114 case 'n': 115 no_timeout = 1; 116 break; 117 case 'v': 118 vtylock = 1; 119 break; 120 case '?': 121 default: 122 usage(); 123 } 124 timeout.tv_sec = sectimeout * 60; 125 126 if (setuid(getuid()) != 0) /* discard privs */ 127 errx(1, "setuid failed"); 128 129 if (tcgetattr(STDIN_FILENO, &tty)) /* get information for header */ 130 err(1, "tcgetattr failed"); 131 132 gethostname(hostname, sizeof(hostname)); 133 if (!(ttynam = ttyname(STDIN_FILENO))) 134 errx(1, "not a terminal?"); 135 timval = time(NULL); 136 nexttime = timval + (sectimeout * 60); 137 timp = localtime(&timval); 138 ap = asctime(timp); 139 tzn = timp->tm_zone; 140 141 signal(SIGINT, quit); 142 signal(SIGQUIT, quit); 143 ntty = tty; ntty.c_lflag &= ~ECHO; 144 tcsetattr(STDIN_FILENO, TCSADRAIN|TCSASOFT, &ntty); 145 146 if (!mypw) { 147 /* get key and check again */ 148 printf("Key: "); 149 if (!fgets(s, sizeof(s), stdin) || *s == '\n') 150 quit(0); 151 printf("\nAgain: "); 152 /* 153 * Don't need EOF test here, if we get EOF, then s1 != s 154 * and the right things will happen. 155 */ 156 fgets(s1, sizeof(s1), stdin); 157 putchar('\n'); 158 if (strcmp(s1, s)) { 159 printf("\07lock: passwords didn't match.\n"); 160 tcsetattr(STDIN_FILENO, TCSADRAIN|TCSASOFT, &tty); 161 exit(1); 162 } 163 s[0] = '\0'; 164 mypw = s1; 165 } 166 167 /* set signal handlers */ 168 signal(SIGINT, hi); 169 signal(SIGQUIT, hi); 170 signal(SIGTSTP, hi); 171 signal(SIGALRM, bye); 172 173 ntimer.it_interval = zerotime; 174 ntimer.it_value = timeout; 175 if (!no_timeout) 176 setitimer(ITIMER_REAL, &ntimer, &otimer); 177 if (vtylock) { 178 /* 179 * If this failed, we want to err out; warn isn't good 180 * enough, since we don't want the user to think that 181 * everything is nice and locked because they got a 182 * "Key:" prompt. 183 */ 184 if (ioctl(STDIN_FILENO, VT_LOCKSWITCH, &vtylock) == -1) { 185 tcsetattr(0, TCSADRAIN|TCSASOFT, &tty); 186 err(1, "locking vty"); 187 } 188 vtyunlock = 0x2; 189 } 190 191 /* header info */ 192 if (pw != NULL) 193 printf("lock: %s using %s on %s.", pw->pw_name, 194 ttynam, hostname); 195 else 196 printf("lock: %s on %s.", ttynam, hostname); 197 if (no_timeout) 198 printf(" no timeout."); 199 else 200 printf(" timeout in %d minute%s.", sectimeout, 201 sectimeout != 1 ? "s" : ""); 202 if (vtylock) 203 printf(" vty locked."); 204 printf("\ntime now is %.20s%s%s", ap, tzn, ap + 19); 205 206 failures = 0; 207 208 for (;;) { 209 printf("Key: "); 210 if (!fgets(s, sizeof(s), stdin)) { 211 clearerr(stdin); 212 hi(0); 213 goto tryagain; 214 } 215 if (usemine) { 216 s[strlen(s) - 1] = '\0'; 217 cryptpw = crypt(s, mypw); 218 if (cryptpw == NULL || !strcmp(mypw, cryptpw)) 219 break; 220 } 221 else if (!strcmp(s, s1)) 222 break; 223 printf("\07\n"); 224 failures++; 225 if (getuid() == 0) 226 syslog(LOG_NOTICE, "%d ROOT UNLOCK FAILURE%s (%s on %s)", 227 failures, failures > 1 ? "S": "", ttynam, hostname); 228 tryagain: 229 if (tcgetattr(0, &ntty) && (errno != EINTR)) 230 exit(1); 231 sleep(1); /* to discourage guessing */ 232 } 233 if (getuid() == 0) 234 syslog(LOG_NOTICE, "ROOT UNLOCK ON hostname %s port %s", 235 hostname, ttynam); 236 quit(0); 237 return(0); /* not reached */ 238 } 239 240 241 static void 242 usage(void) 243 { 244 fprintf(stderr, "usage: lock [-npv] [-t timeout]\n"); 245 exit(1); 246 } 247 248 static void 249 hi(int signo __unused) 250 { 251 time_t timval; 252 253 if ((timval = time(NULL)) != (time_t)-1) { 254 printf("lock: type in the unlock key. "); 255 if (no_timeout) { 256 putchar('\n'); 257 } else { 258 printf("timeout in %jd:%jd minutes\n", 259 (intmax_t)(nexttime - timval) / 60, 260 (intmax_t)(nexttime - timval) % 60); 261 } 262 } 263 } 264 265 static void 266 quit(int signo __unused) 267 { 268 putchar('\n'); 269 tcsetattr(STDIN_FILENO, TCSADRAIN|TCSASOFT, &tty); 270 if (vtyunlock) 271 ioctl(STDIN_FILENO, VT_LOCKSWITCH, &vtyunlock); 272 exit(0); 273 } 274 275 static void 276 bye(int signo __unused) 277 { 278 if (!no_timeout) { 279 tcsetattr(STDIN_FILENO, TCSADRAIN|TCSASOFT, &tty); 280 if (vtyunlock) 281 ioctl(STDIN_FILENO, VT_LOCKSWITCH, &vtyunlock); 282 printf("lock: timeout\n"); 283 exit(1); 284 } 285 } 286