oysteikt/heimdal
0
0
Fork 0
Code Issues5 Pull Requests Releases Activity
Files
heimdal/lib/krb5/kuserok.c
Taylor R Campbell 1f870603a4 krb5/kuserok.c: Constify plugin stuff.
2023-06-20 12:19:48 -05:00

754 lines
21 KiB
C
Raw Permalink Blame History

/*
* Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
* (Royal Institute of Technology, Stockholm, Sweden).
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* 3. Neither the name of the Institute nor the names of its contributors
* may be used to endorse or promote products derived from this software
* without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/
#include "krb5_locl.h"
#include "kuserok_plugin.h"
#include <dirent.h>
#ifndef SYSTEM_K5LOGIN_DIR
/*
* System k5login location. File namess in this directory are expected
* to be usernames and to contain a list of principals allowed to login
* as the user named the same as the file.
*/
#define SYSTEM_K5LOGIN_DIR SYSCONFDIR "/k5login.d"
#endif
/* Plugin framework bits */
struct plctx {
const char *rule;
const char *k5login_dir;
const char *luser;
krb5_const_principal principal;
unsigned int flags;
krb5_boolean result;
};
static krb5_error_code KRB5_LIB_CALL
plcallback(krb5_context context, const void *plug, void *plugctx, void *userctx)
{
const krb5plugin_kuserok_ftable *locate = plug;
struct plctx *plctx = userctx;
return locate->kuserok(plugctx, context, plctx->rule, plctx->flags,
plctx->k5login_dir, plctx->luser, plctx->principal,
&plctx->result);
}
static krb5_error_code plugin_reg_ret;
static const krb5plugin_kuserok_ftable kuserok_simple_plug;
static const krb5plugin_kuserok_ftable kuserok_sys_k5login_plug;
static const krb5plugin_kuserok_ftable kuserok_user_k5login_plug;
static const krb5plugin_kuserok_ftable kuserok_deny_plug;
static void
reg_def_plugins_once(void *ctx)
{
krb5_error_code ret;
krb5_context context = ctx;
plugin_reg_ret = krb5_plugin_register(context, PLUGIN_TYPE_DATA,
KRB5_PLUGIN_KUSEROK,
&kuserok_simple_plug);
ret = krb5_plugin_register(context, PLUGIN_TYPE_DATA,
KRB5_PLUGIN_KUSEROK, &kuserok_sys_k5login_plug);
if (!plugin_reg_ret)
plugin_reg_ret = ret;
ret = krb5_plugin_register(context, PLUGIN_TYPE_DATA,
KRB5_PLUGIN_KUSEROK, &kuserok_user_k5login_plug);
if (!plugin_reg_ret)
plugin_reg_ret = ret;
ret = krb5_plugin_register(context, PLUGIN_TYPE_DATA,
KRB5_PLUGIN_KUSEROK, &kuserok_deny_plug);
if (!plugin_reg_ret)
plugin_reg_ret = ret;
}
/**
* This function is designed to be portable for Win32 and POSIX. The
* design does lead to multiple getpwnam_r() calls, but this is probably
* not a big deal.
*
* Inputs:
*
* @param context A krb5_context
* @param filename Name of item to introspection
* @param is_system_location TRUE if the dir/file are system locations or
* FALSE if they are user home directory locations
* @param dir Directory (optional)
* @param dirlstat A pointer to struct stat for the directory (optional)
* @param file File (optional)
* @param owner Name of user that is expected to own the file
*/
static krb5_error_code
check_owner_dir(krb5_context context,
const char *filename,
krb5_boolean is_system_location,
DIR *dir,
struct stat *dirlstat,
const char *owner)
{
#ifdef _WIN32
/*
* XXX Implement this!
*
* The thing to do is to call _get_osfhandle() on fileno(file) and
* dirfd(dir) to get HANDLEs to the same, then call
* GetSecurityInfo() on those HANDLEs to get the security descriptor
* (SD), then check the owner and DACL. Checking the DACL sounds
* like a lot of work (what, derive a mode from the ACL the way
* NFSv4 servers do?). Checking the owner means doing an LSARPC
* lookup at least (to get the user's SID).
*/
if (is_system_location || owner == NULL)
return 0;
krb5_set_error_message(context, EACCES,
"User k5login files not supported on Windows");
return EACCES;
#else
struct passwd pw, *pwd = NULL;
char pwbuf[2048];
struct stat st;
heim_assert(owner != NULL, "no directory owner ?");
if (getpwnam_r(owner, &pw, pwbuf, sizeof(pwbuf), &pwd) != 0) {
krb5_set_error_message(context, errno,
"User unknown %s (getpwnam_r())", owner);
return EACCES;
}
if (pwd == NULL) {
krb5_set_error_message(context, EACCES, "no user %s", owner);
return EACCES;
}
if (fstat(dirfd(dir), &st) == -1) {
krb5_set_error_message(context, EACCES,
"fstat(%s) of k5login.d failed",
filename);
return EACCES;
}
if (!S_ISDIR(st.st_mode)) {
krb5_set_error_message(context, ENOTDIR, "%s not a directory",
filename);
return ENOTDIR;
}
if (st.st_dev != dirlstat->st_dev || st.st_ino != dirlstat->st_ino) {
krb5_set_error_message(context, EACCES,
"%s was renamed during kuserok "
"operation", filename);
return EACCES;
}
if ((st.st_mode & (S_IWGRP | S_IWOTH)) != 0) {
krb5_set_error_message(context, EACCES,
"%s has world and/or group write "
"permissions", filename);
return EACCES;
}
if (pwd->pw_uid != st.st_uid && st.st_uid != 0) {
krb5_set_error_message(context, EACCES,
"%s not owned by the user (%s) or root",
filename, owner);
return EACCES;
}
return 0;
#endif
}
static krb5_error_code
check_owner_file(krb5_context context,
const char *filename,
FILE *file, const char *owner)
{
#ifdef _WIN32
/*
* XXX Implement this!
*
* The thing to do is to call _get_osfhandle() on fileno(file) and
* dirfd(dir) to get HANDLEs to the same, then call
* GetSecurityInfo() on those HANDLEs to get the security descriptor
* (SD), then check the owner and DACL. Checking the DACL sounds
* like a lot of work (what, derive a mode from the ACL the way
* NFSv4 servers do?). Checking the owner means doing an LSARPC
* lookup at least (to get the user's SID).
*/
if (owner == NULL)
return 0;
krb5_set_error_message(context, EACCES,
"User k5login files not supported on Windows");
return EACCES;
#else
struct passwd pw, *pwd = NULL;
char pwbuf[2048];
struct stat st;
if (owner == NULL)
return 0;
if (getpwnam_r(owner, &pw, pwbuf, sizeof(pwbuf), &pwd) != 0) {
krb5_set_error_message(context, errno,
"User unknown %s (getpwnam_r())", owner);
return EACCES;
}
if (pwd == NULL) {
krb5_set_error_message(context, EACCES, "no user %s", owner);
return EACCES;
}
if (fstat(fileno(file), &st) == -1) {
krb5_set_error_message(context, EACCES, "fstat(%s) of k5login failed",
filename);
return EACCES;
}
if (S_ISDIR(st.st_mode)) {
krb5_set_error_message(context, EISDIR, "k5login: %s is a directory",
filename);
return EISDIR;
}
if ((st.st_mode & (S_IWGRP | S_IWOTH)) != 0) {
krb5_set_error_message(context, EISDIR,
"k5login %s has world and/or group write "
"permissions", filename);
return EACCES;
}
if (pwd->pw_uid != st.st_uid && st.st_uid != 0) {
krb5_set_error_message(context, EACCES,
"k5login %s not owned by the user or root",
filename);
return EACCES;
}
return 0;
#endif
}
/* see if principal is mentioned in the filename access file, return
TRUE (in result) if so, FALSE otherwise */
static krb5_error_code
check_one_file(krb5_context context,
const char *filename,
const char *owner,
krb5_boolean is_system_location,
krb5_const_principal principal,
krb5_boolean *result)
{
FILE *f;
char buf[BUFSIZ];
krb5_error_code ret;
*result = FALSE;
f = fopen(filename, "r");
if (f == NULL)
return errno;
rk_cloexec_file(f);
ret = check_owner_file(context, filename, f, owner);
if (ret)
goto out;
while (fgets(buf, sizeof(buf), f) != NULL) {
krb5_principal tmp;
char *newline = buf + strcspn(buf, "\n");
if (*newline != '\n') {
int c;
c = fgetc(f);
if (c != EOF) {
while (c != EOF && c != '\n')
c = fgetc(f);
/* line was too long, so ignore it */
continue;
}
}
*newline = '\0';
ret = krb5_parse_name(context, buf, &tmp);
if (ret)
continue;
*result = krb5_principal_compare(context, principal, tmp);
krb5_free_principal(context, tmp);
if (*result) {
fclose (f);
return 0;
}
}
out:
fclose(f);
return 0;
}
static krb5_error_code
check_directory(krb5_context context,
const char *dirname,
const char *owner,
krb5_boolean is_system_location,
krb5_const_principal principal,
krb5_boolean *result)
{
DIR *d;
struct dirent *dent;
char filename[MAXPATHLEN];
size_t len;
krb5_error_code ret = 0;
struct stat st;
*result = FALSE;
if (lstat(dirname, &st) < 0)
return errno;
if (!S_ISDIR(st.st_mode)) {
krb5_set_error_message(context, ENOTDIR, "k5login.d not a directory");
return ENOTDIR;
}
if ((d = opendir(dirname)) == NULL) {
krb5_set_error_message(context, ENOTDIR, "Could not open k5login.d");
return errno;
}
ret = check_owner_dir(context, dirname, is_system_location, d, &st, owner);
if (ret)
goto out;
while ((dent = readdir(d)) != NULL) {
/*
* XXX: Should we also skip files whose names start with "."?
* Vim ".filename.swp" files are also good candidates to skip.
* Once we ignore "#*" and "*~", it is not clear what other
* heuristics to apply.
*/
if (strcmp(dent->d_name, ".") == 0 ||
strcmp(dent->d_name, "..") == 0 ||
dent->d_name[0] == '#' || /* emacs autosave */
dent->d_name[strlen(dent->d_name) - 1] == '~') /* emacs backup */
continue;
len = snprintf(filename, sizeof(filename), "%s/%s", dirname, dent->d_name);
/* Skip too-long filenames that got truncated by snprintf() */
if (len < sizeof(filename)) {
ret = check_one_file(context, filename, owner, is_system_location,
principal, result);
if (ret == 0 && *result == TRUE)
break;
}
ret = 0; /* don't propagate errors upstream */
}
out:
closedir(d);
return ret;
}
static krb5_error_code
check_an2ln(krb5_context context,
krb5_const_principal principal,
const char *luser,
krb5_boolean *result)
{
krb5_error_code ret;
char *lname;
#if 0
/* XXX Should we make this an option? */
/* multi-component principals can never match */
if (krb5_principal_get_comp_string(context, principal, 1) != NULL) {
*result = FALSE;
return 0;
}
#endif
lname = malloc(strlen(luser) + 1);
if (lname == NULL)
return krb5_enomem(context);
ret = krb5_aname_to_localname(context, principal, strlen(luser)+1, lname);
if (ret)
goto out;
if (strcmp(lname, luser) == 0)
*result = TRUE;
else
*result = FALSE;
out:
free(lname);
return 0;
}
/**
* This function takes the name of a local user and checks if
* principal is allowed to log in as that user.
*
* The user may have a ~/.k5login file listing principals that are
* allowed to login as that user. If that file does not exist, all
* principals with a only one component that is identical to the
* username, and a realm considered local, are allowed access.
*
* The .k5login file must contain one principal per line, be owned by
* user and not be writable by group or other (but must be readable by
* anyone).
*
* Note that if the file exists, no implicit access rights are given
* to user@@LOCALREALM.
*
* Optionally, a set of files may be put in ~/.k5login.d (a
* directory), in which case they will all be checked in the same
* manner as .k5login. The files may be called anything, but files
* starting with a hash (#) , or ending with a tilde (~) are
* ignored. Subdirectories are not traversed. Note that this directory
* may not be checked by other Kerberos implementations.
*
* If no configuration file exists, match user against local domains,
* ie luser@@LOCAL-REALMS-IN-CONFIGURATION-FILES.
*
* @param context Kerberos 5 context.
* @param principal principal to check if allowed to login
* @param luser local user id
*
* @return returns TRUE if access should be granted, FALSE otherwise.
*
* @ingroup krb5_support
*/
KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
krb5_kuserok(krb5_context context,
krb5_principal principal,
const char *luser)
{
return _krb5_kuserok(context, principal, luser, TRUE);
}
static const char *const kuserok_plugin_deps[] = { "krb5", NULL };
static const struct heim_plugin_data
kuserok_plugin_data = {
"krb5",
KRB5_PLUGIN_KUSEROK,
KRB5_PLUGIN_KUSEROK_VERSION_0,
kuserok_plugin_deps,
krb5_get_instance
};
KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
_krb5_kuserok(krb5_context context,
krb5_principal principal,
const char *luser,
krb5_boolean an2ln_ok)
{
static heim_base_once_t reg_def_plugins = HEIM_BASE_ONCE_INIT;
krb5_error_code ret;
struct plctx ctx;
char **rules;
/*
* XXX we should have a struct with a krb5_context field and a
* krb5_error_code fied and pass the address of that as the ctx
* argument of heim_base_once_f(). For now we use a static to
* communicate failures. Actually, we ignore failures anyways,
* since we can't return them.
*/
heim_base_once_f(&reg_def_plugins, context, reg_def_plugins_once);
ctx.flags = 0;
ctx.luser = luser;
ctx.principal = principal;
ctx.result = FALSE;
ctx.k5login_dir = krb5_config_get_string(context, NULL, "libdefaults",
"k5login_directory", NULL);
if (an2ln_ok)
ctx.flags |= KUSEROK_ANAME_TO_LNAME_OK;
if (krb5_config_get_bool_default(context, NULL, FALSE, "libdefaults",
"k5login_authoritative", NULL))
ctx.flags |= KUSEROK_K5LOGIN_IS_AUTHORITATIVE;
if ((ctx.flags & KUSEROK_K5LOGIN_IS_AUTHORITATIVE) && plugin_reg_ret)
return plugin_reg_ret; /* fail safe */
rules = krb5_config_get_strings(context, NULL, "libdefaults",
"kuserok", NULL);
if (rules == NULL) {
/* Default: check ~/.k5login */
ctx.rule = "USER-K5LOGIN";
ret = plcallback(context, &kuserok_user_k5login_plug, NULL, &ctx);
if (ret == 0)
goto out;
ctx.rule = "SIMPLE";
ret = plcallback(context, &kuserok_simple_plug, NULL, &ctx);
if (ret == 0)
goto out;
ctx.result = FALSE;
} else {
size_t n;
for (n = 0; rules[n]; n++) {
ctx.rule = rules[n];
ret = _krb5_plugin_run_f(context, &kuserok_plugin_data,
0, &ctx, plcallback);
if (ret != KRB5_PLUGIN_NO_HANDLE)
goto out;
}
}
out:
krb5_config_free_strings(rules);
return ctx.result;
}
/*
* Simple kuserok: check that the lname for the aname matches luser.
*/
static krb5_error_code KRB5_LIB_CALL
kuserok_simple_plug_f(void *plug_ctx, krb5_context context, const char *rule,
unsigned int flags, const char *k5login_dir,
const char *luser, krb5_const_principal principal,
krb5_boolean *result)
{
krb5_error_code ret;
if (strcmp(rule, "SIMPLE") != 0 || (flags & KUSEROK_ANAME_TO_LNAME_OK) == 0)
return KRB5_PLUGIN_NO_HANDLE;
ret = check_an2ln(context, principal, luser, result);
if (ret == 0 && *result == FALSE)
return KRB5_PLUGIN_NO_HANDLE;
return 0;
}
/*
* Check k5login files in a system location, rather than in home
* directories.
*/
static krb5_error_code KRB5_LIB_CALL
kuserok_sys_k5login_plug_f(void *plug_ctx, krb5_context context,
const char *rule, unsigned int flags,
const char *k5login_dir, const char *luser,
krb5_const_principal principal, krb5_boolean *result)
{
char filename[MAXPATHLEN];
size_t len;
const char *profile_dir = NULL;
krb5_error_code ret;
*result = FALSE;
if (strcmp(rule, "SYSTEM-K5LOGIN") != 0 &&
strncmp(rule, "SYSTEM-K5LOGIN:", strlen("SYSTEM-K5LOGIN:")) != 0)
return KRB5_PLUGIN_NO_HANDLE;
profile_dir = strchr(rule, ':');
if (profile_dir == NULL)
profile_dir = k5login_dir ? k5login_dir : SYSTEM_K5LOGIN_DIR;
else
profile_dir++;
len = snprintf(filename, sizeof(filename), "%s/%s", profile_dir, luser);
if (len < sizeof(filename)) {
ret = check_one_file(context, filename, NULL, TRUE, principal, result);
if (ret == 0 &&
((flags & KUSEROK_K5LOGIN_IS_AUTHORITATIVE) || *result == TRUE))
return 0;
}
*result = FALSE;
return KRB5_PLUGIN_NO_HANDLE;
}
/*
* Check ~luser/.k5login and/or ~/luser/.k5login.d
*/
static krb5_error_code KRB5_LIB_CALL
kuserok_user_k5login_plug_f(void *plug_ctx, krb5_context context,
const char *rule, unsigned int flags,
const char *k5login_dir, const char *luser,
krb5_const_principal principal,
krb5_boolean *result)
{
#ifdef _WIN32
return KRB5_PLUGIN_NO_HANDLE;
#else
char *path;
char *path_exp;
const char *profile_dir = NULL;
krb5_error_code ret;
krb5_boolean found_file = FALSE;
struct passwd pw, *pwd = NULL;
char pwbuf[2048];
if (strcmp(rule, "USER-K5LOGIN") != 0)
return KRB5_PLUGIN_NO_HANDLE;
profile_dir = k5login_dir;
if (profile_dir == NULL) {
/* Don't deadlock with gssd or anything of the sort */
if (!_krb5_homedir_access(context))
return KRB5_PLUGIN_NO_HANDLE;
if (getpwnam_r(luser, &pw, pwbuf, sizeof(pwbuf), &pwd) != 0) {
krb5_set_error_message(context, errno, "User unknown (getpwnam_r())");
return KRB5_PLUGIN_NO_HANDLE;
}
if (pwd == NULL) {
krb5_set_error_message(context, errno, "User unknown (getpwnam())");
return KRB5_PLUGIN_NO_HANDLE;
}
profile_dir = pwd->pw_dir;
}
#define KLOGIN "/.k5login"
if (asprintf(&path, "%s/.k5login.d", profile_dir) == -1)
return krb5_enomem(context);
ret = _krb5_expand_path_tokensv(context, path, 1, &path_exp,
"luser", luser, NULL);
free(path);
if (ret)
return ret;
path = path_exp;
/* check user's ~/.k5login */
path[strlen(path) - strlen(".d")] = '\0';
ret = check_one_file(context, path, luser, FALSE, principal, result);
/*
* A match in ~/.k5login is sufficient. A non-match, falls through to the
* .k5login.d code below.
*/
if (ret == 0 && *result == TRUE) {
free(path);
return 0;
}
if (ret != ENOENT)
found_file = TRUE;
/*
* A match in ~/.k5login.d/somefile is sufficient. A non-match, falls
* through to the code below that handles negative results.
*
* XXX: put back the .d; clever|hackish? you decide
*/
path[strlen(path)] = '.';
ret = check_directory(context, path, luser, FALSE, principal, result);
free(path);
if (ret == 0 && *result == TRUE)
return 0;
if (ret != ENOENT && ret != ENOTDIR)
found_file = TRUE;
/*
* When either ~/.k5login or ~/.k5login.d/ exists, but neither matches
* and we're authoritative, we're done. Otherwise, give other plugins
* a chance.
*/
*result = FALSE;
if (found_file && (flags & KUSEROK_K5LOGIN_IS_AUTHORITATIVE))
return 0;
return KRB5_PLUGIN_NO_HANDLE;
#endif
}
static krb5_error_code KRB5_LIB_CALL
kuserok_deny_plug_f(void *plug_ctx, krb5_context context, const char *rule,
unsigned int flags, const char *k5login_dir,
const char *luser, krb5_const_principal principal,
krb5_boolean *result)
{
if (strcmp(rule, "DENY") != 0)
return KRB5_PLUGIN_NO_HANDLE;
*result = FALSE;
return 0;
}
static krb5_error_code KRB5_LIB_CALL
kuser_ok_null_plugin_init(krb5_context context, void **ctx)
{
*ctx = NULL;
return 0;
}
static void KRB5_LIB_CALL
kuser_ok_null_plugin_fini(void *ctx)
{
return;
}
static const krb5plugin_kuserok_ftable kuserok_simple_plug = {
KRB5_PLUGIN_KUSEROK_VERSION_0,
kuser_ok_null_plugin_init,
kuser_ok_null_plugin_fini,
kuserok_simple_plug_f,
};
static const krb5plugin_kuserok_ftable kuserok_sys_k5login_plug = {
KRB5_PLUGIN_KUSEROK_VERSION_0,
kuser_ok_null_plugin_init,
kuser_ok_null_plugin_fini,
kuserok_sys_k5login_plug_f,
};
static const krb5plugin_kuserok_ftable kuserok_user_k5login_plug = {
KRB5_PLUGIN_KUSEROK_VERSION_0,
kuser_ok_null_plugin_init,
kuser_ok_null_plugin_fini,
kuserok_user_k5login_plug_f,
};
static const krb5plugin_kuserok_ftable kuserok_deny_plug = {
KRB5_PLUGIN_KUSEROK_VERSION_0,
kuser_ok_null_plugin_init,
kuser_ok_null_plugin_fini,
kuserok_deny_plug_f,
};
Reference in New Issue View Git Blame Copy Permalink