1 /* $NetBSD: su.c,v 1.48 2001/04/23 06:52:22 simonb Exp $ */ 2 3 /* 4 * Copyright (c) 1988 The Regents of the University of California. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. All advertising materials mentioning features or use of this software 16 * must display the following acknowledgement: 17 * This product includes software developed by the University of 18 * California, Berkeley and its contributors. 19 * 4. Neither the name of the University nor the names of its contributors 20 * may be used to endorse or promote products derived from this software 21 * without specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 26 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33 * SUCH DAMAGE. 34 */ 35 36 #include <sys/cdefs.h> 37 #ifndef lint 38 __COPYRIGHT( 39 "@(#) Copyright (c) 1988 The Regents of the University of California.\n\ 40 All rights reserved.\n"); 41 #endif /* not lint */ 42 43 #ifndef lint 44 #if 0 45 static char sccsid[] = "@(#)su.c 8.3 (Berkeley) 4/2/94";*/ 46 #else 47 __RCSID("$NetBSD: su.c,v 1.48 2001/04/23 06:52:22 simonb Exp $"); 48 #endif 49 #endif /* not lint */ 50 51 #include <sys/param.h> 52 #include <sys/time.h> 53 #include <sys/resource.h> 54 #include <err.h> 55 #include <errno.h> 56 #include <grp.h> 57 #include <paths.h> 58 #include <pwd.h> 59 #include <stdio.h> 60 #ifdef SKEY 61 #include <skey.h> 62 #endif 63 #include <stdlib.h> 64 #include <string.h> 65 #include <syslog.h> 66 #include <time.h> 67 #include <tzfile.h> 68 #include <unistd.h> 69 70 #ifdef LOGIN_CAP 71 #include <login_cap.h> 72 #endif 73 74 #ifdef KERBEROS 75 #include <des.h> 76 #include <krb.h> 77 #include <netdb.h> 78 79 static int kerberos __P((char *, char *, int)); 80 static int koktologin __P((char *, char *, char *)); 81 82 #endif 83 84 #ifdef KERBEROS5 85 #include <krb5.h> 86 87 static int kerberos5 __P((char *, char *, int)); 88 89 #endif 90 91 #if defined(KERBEROS) || defined(KERBEROS5) 92 93 #define ARGSTRX "-Kflm" 94 95 int use_kerberos = 1; 96 97 #else 98 #define ARGSTRX "-flm" 99 #endif 100 101 #ifndef SUGROUP 102 #define SUGROUP "wheel" 103 #endif 104 105 #ifdef LOGIN_CAP 106 #define ARGSTR ARGSTRX "c:" 107 #else 108 #define ARGSTR ARGSTRX 109 #endif 110 111 int main __P((int, char **)); 112 113 static int chshell __P((const char *)); 114 static char *ontty __P((void)); 115 static int check_ingroup __P((int, const char *, const char *, int)); 116 117 118 int 119 main(argc, argv) 120 int argc; 121 char **argv; 122 { 123 extern char **environ; 124 struct passwd *pwd; 125 char *p; 126 #ifdef BSD4_4 127 struct timeval tp; 128 #endif 129 uid_t ruid; 130 int asme, ch, asthem, fastlogin, prio; 131 enum { UNSET, YES, NO } iscsh = UNSET; 132 char *user, *shell, *avshell, *username, **np; 133 char *userpass, *class; 134 char shellbuf[MAXPATHLEN], avshellbuf[MAXPATHLEN]; 135 time_t pw_warntime = _PASSWORD_WARNDAYS * SECSPERDAY; 136 #ifdef LOGIN_CAP 137 login_cap_t *lc; 138 #endif 139 140 asme = asthem = fastlogin = 0; 141 shell = class = NULL; 142 while ((ch = getopt(argc, argv, ARGSTR)) != -1) 143 switch((char)ch) { 144 #if defined(KERBEROS) || defined(KERBEROS5) 145 case 'K': 146 use_kerberos = 0; 147 break; 148 #endif 149 #ifdef LOGIN_CAP 150 case 'c': 151 class = optarg; 152 break; 153 #endif 154 case 'f': 155 fastlogin = 1; 156 break; 157 case '-': 158 case 'l': 159 asme = 0; 160 asthem = 1; 161 break; 162 case 'm': 163 asme = 1; 164 asthem = 0; 165 break; 166 case '?': 167 default: 168 (void)fprintf(stderr, 169 "Usage: %s [%s] [login [shell arguments]]\n", 170 getprogname(), ARGSTR); 171 exit(1); 172 } 173 argv += optind; 174 175 /* Lower the priority so su runs faster */ 176 errno = 0; 177 prio = getpriority(PRIO_PROCESS, 0); 178 if (errno) 179 prio = 0; 180 if (prio > -2) 181 (void)setpriority(PRIO_PROCESS, 0, -2); 182 openlog("su", 0, LOG_AUTH); 183 184 /* get current login name and shell */ 185 ruid = getuid(); 186 username = getlogin(); 187 if (username == NULL || (pwd = getpwnam(username)) == NULL || 188 pwd->pw_uid != ruid) 189 pwd = getpwuid(ruid); 190 if (pwd == NULL) 191 errx(1, "who are you?"); 192 username = strdup(pwd->pw_name); 193 userpass = strdup(pwd->pw_passwd); 194 if (username == NULL || userpass == NULL) 195 err(1, "strdup"); 196 197 198 if (asme) { 199 if (pwd->pw_shell && *pwd->pw_shell) { 200 shell = strncpy(shellbuf, pwd->pw_shell, 201 sizeof(shellbuf) - 1); 202 shellbuf[sizeof(shellbuf) - 1] = '\0'; 203 } else { 204 shell = _PATH_BSHELL; 205 iscsh = NO; 206 } 207 } 208 /* get target login information, default to root */ 209 user = *argv ? *argv : "root"; 210 np = *argv ? argv : argv-1; 211 212 if ((pwd = getpwnam(user)) == NULL) 213 errx(1, "unknown login %s", user); 214 215 #ifdef LOGIN_CAP 216 /* force the usage of specified class */ 217 if (class) { 218 if (ruid) 219 errx(1, "Only root may use -c"); 220 221 pwd->pw_class = class; 222 } 223 lc = login_getclass(pwd->pw_class); 224 225 pw_warntime = login_getcaptime(lc, "password-warn", 226 _PASSWORD_WARNDAYS * SECSPERDAY, 227 _PASSWORD_WARNDAYS * SECSPERDAY); 228 #endif 229 230 if (ruid 231 #ifdef KERBEROS5 232 && (!use_kerberos || kerberos5(username, user, pwd->pw_uid)) 233 #endif 234 #ifdef KERBEROS 235 && (!use_kerberos || kerberos(username, user, pwd->pw_uid)) 236 #endif 237 ) { 238 char *pass = pwd->pw_passwd; 239 int ok = pwd->pw_uid != 0; 240 241 #ifdef ROOTAUTH 242 /* 243 * Allow those in group rootauth to su to root, by supplying 244 * their own password. 245 */ 246 if (!ok) { 247 if ((ok = check_ingroup(-1, ROOTAUTH, username, 0))) { 248 pass = userpass; 249 user = username; 250 } 251 } 252 #endif 253 /* 254 * Only allow those in group SUGROUP to su to root, 255 * but only if that group has any members. 256 * If SUGROUP has no members, allow anyone to su root 257 */ 258 if (!ok) { 259 ok = check_ingroup(-1, SUGROUP, username, 1); 260 } 261 if (!ok) 262 errx(1, 263 "you are not listed in the correct secondary group (%s) to su %s.", 264 SUGROUP, user); 265 /* if target requires a password, verify it */ 266 if (*pass) { 267 p = getpass("Password:"); 268 #ifdef SKEY 269 if (strcasecmp(p, "s/key") == 0) { 270 if (skey_haskey(user)) 271 errx(1, "Sorry, you have no s/key."); 272 else { 273 if (skey_authenticate(user)) { 274 goto badlogin; 275 } 276 } 277 278 } else 279 #endif 280 if (strcmp(pass, crypt(p, pass))) { 281 #ifdef SKEY 282 badlogin: 283 #endif 284 fprintf(stderr, "Sorry\n"); 285 syslog(LOG_WARNING, 286 "BAD SU %s to %s%s", username, 287 pwd->pw_name, ontty()); 288 exit(1); 289 } 290 } 291 } 292 293 if (asme) { 294 /* if asme and non-standard target shell, must be root */ 295 if (!chshell(pwd->pw_shell) && ruid) 296 errx(1,"permission denied (shell)."); 297 } else if (pwd->pw_shell && *pwd->pw_shell) { 298 shell = pwd->pw_shell; 299 iscsh = UNSET; 300 } else { 301 shell = _PATH_BSHELL; 302 iscsh = NO; 303 } 304 305 if ((p = strrchr(shell, '/')) != NULL) 306 avshell = p+1; 307 else 308 avshell = shell; 309 310 /* if we're forking a csh, we want to slightly muck the args */ 311 if (iscsh == UNSET) 312 iscsh = strstr(avshell, "csh") ? YES : NO; 313 314 /* set permissions */ 315 #ifdef LOGIN_CAP 316 if (setusercontext(lc, pwd, pwd->pw_uid, 317 (asthem ? (LOGIN_SETPRIORITY | LOGIN_SETUMASK) : 0) | 318 LOGIN_SETRESOURCES | LOGIN_SETGROUP | LOGIN_SETUSER)) 319 err(1, "setting user context"); 320 #else 321 if (setgid(pwd->pw_gid) < 0) 322 err(1, "setgid"); 323 if (initgroups(user, pwd->pw_gid)) 324 errx(1, "initgroups failed"); 325 if (setuid(pwd->pw_uid) < 0) 326 err(1, "setuid"); 327 #endif 328 329 if (!asme) { 330 if (asthem) { 331 p = getenv("TERM"); 332 /* Create an empty environment */ 333 if ((environ = malloc(sizeof(char *))) == NULL) 334 err(1, NULL); 335 environ[0] = NULL; 336 #ifdef LOGIN_CAP 337 if (setusercontext(lc, pwd, pwd->pw_uid, LOGIN_SETPATH)) 338 err(1, "setting user context"); 339 #else 340 (void)setenv("PATH", _PATH_DEFPATH, 1); 341 #endif 342 if (p) 343 (void)setenv("TERM", p, 1); 344 if (chdir(pwd->pw_dir) < 0) 345 errx(1, "no directory"); 346 } 347 348 if (asthem || pwd->pw_uid) 349 (void)setenv("USER", pwd->pw_name, 1); 350 (void)setenv("HOME", pwd->pw_dir, 1); 351 (void)setenv("SHELL", shell, 1); 352 } 353 (void)setenv("SU_FROM", username, 1); 354 355 if (iscsh == YES) { 356 if (fastlogin) 357 *np-- = "-f"; 358 if (asme) 359 *np-- = "-m"; 360 } 361 362 if (asthem) { 363 avshellbuf[0] = '-'; 364 (void)strncpy(avshellbuf+1, avshell, sizeof(avshellbuf) - 2); 365 avshell = avshellbuf; 366 } else if (iscsh == YES) { 367 /* csh strips the first character... */ 368 avshellbuf[0] = '_'; 369 (void)strncpy(avshellbuf+1, avshell, sizeof(avshellbuf) - 2); 370 avshell = avshellbuf; 371 } 372 *np = avshell; 373 374 #ifdef BSD4_4 375 if (pwd->pw_change || pwd->pw_expire) 376 (void)gettimeofday(&tp, (struct timezone *)NULL); 377 if (pwd->pw_change) { 378 if (tp.tv_sec >= pwd->pw_change) { 379 (void)printf("%s -- %s's password has expired.\n", 380 (ruid ? "Sorry" : "Note"), user); 381 if (ruid != 0) 382 exit(1); 383 } else if (pwd->pw_change - tp.tv_sec < pw_warntime) 384 (void)printf("Warning: %s's password expires on %s", 385 user, ctime(&pwd->pw_change)); 386 } 387 if (pwd->pw_expire) { 388 if (tp.tv_sec >= pwd->pw_expire) { 389 (void)printf("%s -- %s's account has expired.\n", 390 (ruid ? "Sorry" : "Note"), user); 391 if (ruid != 0) 392 exit(1); 393 } else if (pwd->pw_expire - tp.tv_sec < 394 _PASSWORD_WARNDAYS * SECSPERDAY) 395 (void)printf("Warning: %s's account expires on %s", 396 user, ctime(&pwd->pw_expire)); 397 } 398 #endif 399 if (ruid != 0) 400 syslog(LOG_NOTICE, "%s to %s%s", 401 username, pwd->pw_name, ontty()); 402 403 /* Raise our priority back to what we had before */ 404 (void)setpriority(PRIO_PROCESS, 0, prio); 405 406 execv(shell, np); 407 err(1, "%s", shell); 408 /* NOTREACHED */ 409 } 410 411 static int 412 chshell(sh) 413 const char *sh; 414 { 415 const char *cp; 416 417 while ((cp = getusershell()) != NULL) 418 if (!strcmp(cp, sh)) 419 return (1); 420 return (0); 421 } 422 423 static char * 424 ontty() 425 { 426 char *p; 427 static char buf[MAXPATHLEN + 4]; 428 429 buf[0] = 0; 430 if ((p = ttyname(STDERR_FILENO)) != NULL) 431 (void)snprintf(buf, sizeof buf, " on %s", p); 432 return (buf); 433 } 434 435 #ifdef KERBEROS5 436 static int 437 kerberos5(username, user, uid) 438 char *username, *user; 439 int uid; 440 { 441 krb5_error_code ret; 442 krb5_context context; 443 krb5_principal princ = NULL; 444 krb5_ccache ccache, ccache2; 445 char *cc_name; 446 const char *filename; 447 448 ret = krb5_init_context(&context); 449 if (ret) 450 return (1); 451 452 if (strcmp (user, "root") == 0) 453 ret = krb5_make_principal(context, &princ, 454 NULL, username, "root", NULL); 455 else 456 ret = krb5_make_principal(context, &princ, 457 NULL, user, NULL); 458 if (ret) 459 goto fail; 460 if (!krb5_kuserok(context, princ, user) && !uid) { 461 warnx ("kerberos5: not in %s's ACL.", user); 462 goto fail; 463 } 464 ret = krb5_cc_gen_new(context, &krb5_mcc_ops, &ccache); 465 if (ret) 466 goto fail; 467 ret = krb5_verify_user_lrealm(context, princ, ccache, NULL, TRUE, 468 NULL); 469 if (ret) { 470 krb5_cc_destroy(context, ccache); 471 switch (ret) { 472 case KRB5_LIBOS_PWDINTR : 473 break; 474 case KRB5KRB_AP_ERR_BAD_INTEGRITY: 475 case KRB5KRB_AP_ERR_MODIFIED: 476 krb5_warnx(context, "Password incorrect"); 477 break; 478 default : 479 krb5_warn(context, ret, "krb5_verify_user"); 480 break; 481 } 482 goto fail; 483 } 484 ret = krb5_cc_gen_new(context, &krb5_fcc_ops, &ccache2); 485 if (ret) { 486 krb5_cc_destroy(context, ccache); 487 goto fail; 488 } 489 ret = krb5_cc_copy_cache(context, ccache, ccache2); 490 if (ret) { 491 krb5_cc_destroy(context, ccache); 492 krb5_cc_destroy(context, ccache2); 493 goto fail; 494 } 495 496 filename = krb5_cc_get_name(context, ccache2); 497 asprintf(&cc_name, "%s:%s", krb5_cc_get_type(context, ccache2), 498 filename); 499 if (chown (filename, uid, -1) < 0) { 500 warn("chown %s", filename); 501 free(cc_name); 502 krb5_cc_destroy(context, ccache); 503 krb5_cc_destroy(context, ccache2); 504 goto fail; 505 } 506 507 setenv("KRB5CCNAME", cc_name, 1); 508 free(cc_name); 509 krb5_cc_close(context, ccache2); 510 krb5_cc_destroy(context, ccache); 511 return (0); 512 513 fail: 514 if (princ != NULL) 515 krb5_free_principal (context, princ); 516 krb5_free_context (context); 517 return (1); 518 } 519 #endif 520 521 #ifdef KERBEROS 522 static int 523 kerberos(username, user, uid) 524 char *username, *user; 525 int uid; 526 { 527 KTEXT_ST ticket; 528 AUTH_DAT authdata; 529 struct hostent *hp; 530 int kerno; 531 u_long faddr; 532 char lrealm[REALM_SZ], krbtkfile[MAXPATHLEN]; 533 char hostname[MAXHOSTNAMELEN + 1], savehost[MAXHOSTNAMELEN + 1]; 534 535 if (krb_get_lrealm(lrealm, 1) != KSUCCESS) 536 return (1); 537 if (koktologin(username, lrealm, user) && !uid) { 538 warnx("kerberos: not in %s's ACL.", user); 539 return (1); 540 } 541 (void)snprintf(krbtkfile, sizeof krbtkfile, "%s_%s_%d", TKT_ROOT, 542 user, getuid()); 543 544 (void)setenv("KRBTKFILE", krbtkfile, 1); 545 (void)krb_set_tkt_string(krbtkfile); 546 /* 547 * Set real as well as effective ID to 0 for the moment, 548 * to make the kerberos library do the right thing. 549 */ 550 if (setuid(0) < 0) { 551 warn("setuid"); 552 return (1); 553 } 554 555 /* 556 * Little trick here -- if we are su'ing to root, 557 * we need to get a ticket for "xxx.root", where xxx represents 558 * the name of the person su'ing. Otherwise (non-root case), 559 * we need to get a ticket for "yyy.", where yyy represents 560 * the name of the person being su'd to, and the instance is null 561 * 562 * We should have a way to set the ticket lifetime, 563 * with a system default for root. 564 */ 565 { 566 char prompt[128]; 567 char passw[256]; 568 569 (void)snprintf (prompt, sizeof(prompt), 570 "%s's Password: ", 571 krb_unparse_name_long ((uid == 0 ? username : user), 572 (uid == 0 ? "root" : ""), 573 lrealm)); 574 if (des_read_pw_string (passw, sizeof (passw), prompt, 0)) { 575 memset (passw, 0, sizeof (passw)); 576 return (1); 577 } 578 if (strlen(passw) == 0) 579 return (1); /* Empty passwords are not allowed */ 580 581 kerno = krb_get_pw_in_tkt((uid == 0 ? username : user), 582 (uid == 0 ? "root" : ""), lrealm, 583 KRB_TICKET_GRANTING_TICKET, 584 lrealm, 585 DEFAULT_TKT_LIFE, 586 passw); 587 memset (passw, 0, strlen (passw)); 588 } 589 590 if (kerno != KSUCCESS) { 591 if (kerno == KDC_PR_UNKNOWN) { 592 warnx("kerberos: principal unknown: %s.%s@%s", 593 (uid == 0 ? username : user), 594 (uid == 0 ? "root" : ""), lrealm); 595 return (1); 596 } 597 warnx("kerberos: unable to su: %s", krb_err_txt[kerno]); 598 syslog(LOG_WARNING, 599 "BAD Kerberos SU: %s to %s%s: %s", 600 username, user, ontty(), krb_err_txt[kerno]); 601 return (1); 602 } 603 604 if (chown(krbtkfile, uid, -1) < 0) { 605 warn("chown"); 606 (void)unlink(krbtkfile); 607 return (1); 608 } 609 610 (void)setpriority(PRIO_PROCESS, 0, -2); 611 612 if (gethostname(hostname, sizeof(hostname)) == -1) { 613 warn("gethostname"); 614 dest_tkt(); 615 return (1); 616 } 617 hostname[sizeof(hostname) - 1] = '\0'; 618 619 (void)strlcpy(savehost, krb_get_phost(hostname), sizeof(savehost)); 620 savehost[sizeof(savehost) - 1] = '\0'; 621 622 kerno = krb_mk_req(&ticket, "rcmd", savehost, lrealm, 33); 623 624 if (kerno == KDC_PR_UNKNOWN) { 625 warnx("Warning: TGT not verified."); 626 syslog(LOG_WARNING, 627 "%s to %s%s, TGT not verified (%s); %s.%s not registered?", 628 username, user, ontty(), krb_err_txt[kerno], 629 "rcmd", savehost); 630 } else if (kerno != KSUCCESS) { 631 warnx("Unable to use TGT: %s", krb_err_txt[kerno]); 632 syslog(LOG_WARNING, "failed su: %s to %s%s: %s", 633 username, user, ontty(), krb_err_txt[kerno]); 634 dest_tkt(); 635 return (1); 636 } else { 637 if (!(hp = gethostbyname(hostname))) { 638 warnx("can't get addr of %s", hostname); 639 dest_tkt(); 640 return (1); 641 } 642 memmove((char *)&faddr, (char *)hp->h_addr, sizeof(faddr)); 643 644 if ((kerno = krb_rd_req(&ticket, "rcmd", savehost, faddr, 645 &authdata, "")) != KSUCCESS) { 646 warnx("kerberos: unable to verify rcmd ticket: %s\n", 647 krb_err_txt[kerno]); 648 syslog(LOG_WARNING, 649 "failed su: %s to %s%s: %s", username, 650 user, ontty(), krb_err_txt[kerno]); 651 dest_tkt(); 652 return (1); 653 } 654 } 655 return (0); 656 } 657 658 static int 659 koktologin(name, realm, toname) 660 char *name, *realm, *toname; 661 { 662 return krb_kuserok(name, 663 strcmp (toname, "root") == 0 ? "root" : "", 664 realm, 665 toname); 666 } 667 #endif 668 669 static int 670 check_ingroup (gid, gname, user, ifempty) 671 int gid; 672 const char *gname; 673 const char *user; 674 int ifempty; 675 { 676 struct group *gr; 677 char **g; 678 #ifdef SU_INDIRECT_GROUP 679 char **gr_mem; 680 int n = 0; 681 int i = 0; 682 #endif 683 int ok = 0; 684 685 if (gname == NULL) 686 gr = getgrgid((gid_t) gid); 687 else 688 gr = getgrnam(gname); 689 690 /* 691 * XXX we are relying on the fact that we only set ifempty when 692 * calling to check for SUGROUP and that is the only time a 693 * missing group is acceptable. 694 */ 695 if (gr == NULL) 696 return ifempty; 697 if (!*gr->gr_mem) /* empty */ 698 return ifempty; 699 700 /* 701 * Ok, first see if user is in gr_mem 702 */ 703 for (g = gr->gr_mem; *g; ++g) { 704 if (strcmp(*g, user) == 0) 705 return 1; /* ok */ 706 #ifdef SU_INDIRECT_GROUP 707 ++n; /* count them */ 708 #endif 709 } 710 #ifdef SU_INDIRECT_GROUP 711 /* 712 * No. 713 * Now we need to duplicate the gr_mem list, and recurse for 714 * each member to see if it is a group, and if so whether user is 715 * in it. 716 */ 717 gr_mem = malloc((n + 1) * sizeof (char *)); 718 for (g = gr->gr_mem, i = 0; *g; ++g) { 719 gr_mem[i++] = strdup(*g); 720 } 721 gr_mem[i++] = NULL; 722 723 for (g = gr_mem; ok == 0 && *g; ++g) { 724 /* 725 * If we get this far we don't accept empty/missing groups. 726 */ 727 ok = check_ingroup(-1, *g, user, 0); 728 } 729 for (g = gr_mem; *g; ++g) { 730 free(*g); 731 } 732 free(gr_mem); 733 #endif 734 return ok; 735 } 736