summaryrefslogtreecommitdiffstats
path: root/crypto/heimdal/appl/su/su.c
diff options
context:
space:
mode:
Diffstat (limited to 'crypto/heimdal/appl/su/su.c')
-rw-r--r--crypto/heimdal/appl/su/su.c91
1 files changed, 57 insertions, 34 deletions
diff --git a/crypto/heimdal/appl/su/su.c b/crypto/heimdal/appl/su/su.c
index 049a4d7..a5fd442 100644
--- a/crypto/heimdal/appl/su/su.c
+++ b/crypto/heimdal/appl/su/su.c
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 1999 Kungliga Tekniska Högskolan
+ * Copyright (c) 1999 - 2001 Kungliga Tekniska Högskolan
* (Royal Institute of Technology, Stockholm, Sweden).
* All rights reserved.
*
@@ -32,7 +32,7 @@
#include <config.h>
-RCSID("$Id: su.c,v 1.10 1999/09/28 02:34:17 assar Exp $");
+RCSID("$Id: su.c,v 1.18 2001/01/26 16:02:49 joda Exp $");
#include <stdio.h>
#include <stdlib.h>
@@ -50,6 +50,7 @@ RCSID("$Id: su.c,v 1.10 1999/09/28 02:34:17 assar Exp $");
#include <pwd.h>
+#include <des.h>
#include <krb5.h>
#include <kafs.h>
#include <err.h>
@@ -137,7 +138,7 @@ krb5_verify(struct passwd *login_info, struct passwd *su_info,
ret = krb5_init_context (&context);
if (ret) {
#if 0
- warnx("krb5_init_context failed: %u", ret);
+ warnx("krb5_init_context failed: %d", ret);
#endif
return 1;
}
@@ -160,13 +161,16 @@ krb5_verify(struct passwd *login_info, struct passwd *su_info,
#if 1
krb5_warn(context, ret, "krb5_cc_gen_new");
#endif
+ krb5_free_principal (context, p);
return 1;
}
ret = krb5_verify_user_lrealm(context, p, ccache, NULL, TRUE, NULL);
+ krb5_free_principal (context, p);
if(ret) {
- krb5_free_principal (context, p);
krb5_cc_destroy(context, ccache);
switch (ret) {
+ case KRB5_LIBOS_PWDINTR :
+ break;
case KRB5KRB_AP_ERR_BAD_INTEGRITY:
case KRB5KRB_AP_ERR_MODIFIED:
krb5_warnx(context, "Password incorrect");
@@ -179,6 +183,7 @@ krb5_verify(struct passwd *login_info, struct passwd *su_info,
}
return 0;
}
+ krb5_free_principal (context, p);
#endif
return 1;
}
@@ -201,9 +206,26 @@ krb5_start_session(void)
asprintf(&cc_name, "%s:%s", krb5_cc_get_type(context, ccache2),
krb5_cc_get_name(context, ccache2));
- setenv("KRB5CCNAME", cc_name, 1);
+ esetenv("KRB5CCNAME", cc_name, 1);
+
+ /* we want to export this even if we don't directly support KRB4 */
+ {
+#ifndef TKT_ROOT
+#define TKT_ROOT "/tmp/tkt"
+#endif
+ int fd;
+ char tkfile[256];
+ strlcpy(tkfile, TKT_ROOT, sizeof(tkfile));
+ strlcat(tkfile, "_XXXXXX", sizeof(tkfile));
+ fd = mkstemp(tkfile);
+ if(fd >= 0) {
+ close(fd);
+ esetenv("KRBTKFILE", tkfile, 1);
+ }
+ }
#ifdef KRB4
+ /* convert creds? */
if(k_hasafs()) {
if (k_setpag() == 0)
krb5_afslog(context, ccache2, NULL, NULL);
@@ -224,7 +246,7 @@ verify_unix(struct passwd *su)
char *pw;
int r;
if(su->pw_passwd != NULL && *su->pw_passwd != '\0') {
- sprintf(prompt, "%s's password: ", su->pw_name);
+ snprintf(prompt, sizeof(prompt), "%s's password: ", su->pw_name);
r = des_read_pw_string(pw_buf, sizeof(pw_buf), prompt, 0);
if(r != 0)
exit(0);
@@ -311,31 +333,31 @@ main(int argc, char **argv)
{ struct spwd *sp;
long today;
- sp=getspnam(su_info->pw_name);
- if (sp==NULL)
- errx(1,"Have not rights to read shadow passwords!");
- today = time(0)/(24L * 60 * 60);
- if (sp->sp_expire > 0) {
- if (today >= sp->sp_expire) {
- if (login_info->pw_uid)
- errx(1,"Your account has expired.");
- else
- printf("Your account has expired.");
+ sp = getspnam(su_info->pw_name);
+ if (sp != NULL) {
+ today = time(0)/(24L * 60 * 60);
+ if (sp->sp_expire > 0) {
+ if (today >= sp->sp_expire) {
+ if (login_info->pw_uid)
+ errx(1,"Your account has expired.");
+ else
+ printf("Your account has expired.");
}
else if (sp->sp_expire - today < 14)
printf("Your account will expire in %d days.\n",
- (int)(sp->sp_expire - today));
- }
- if (sp->sp_max > 0) {
- if (today >= sp->sp_lstchg + sp->sp_max) {
- if (login_info->pw_uid)
- errx(1,"Your password has expired. Choose a new one.");
- else
- printf("Your password has expired. Choose a new one.");
- }
- else if (today >= sp->sp_lstchg + sp->sp_max - sp->sp_warn)
- printf("Your account will expire in %d days.\n",
- (int)(sp->sp_lstchg + sp->sp_max -today));
+ (int)(sp->sp_expire - today));
+ }
+ if (sp->sp_max > 0) {
+ if (today >= sp->sp_lstchg + sp->sp_max) {
+ if (login_info->pw_uid)
+ errx(1,"Your password has expired. Choose a new one.");
+ else
+ printf("Your password has expired. Choose a new one.");
+ }
+ else if (today >= sp->sp_lstchg + sp->sp_max - sp->sp_warn)
+ printf("Your account will expire in %d days.\n",
+ (int)(sp->sp_lstchg + sp->sp_max -today));
+ }
}
}
#endif
@@ -354,16 +376,16 @@ main(int argc, char **argv)
if (environ == NULL)
err (1, "malloc");
environ[0] = NULL;
- setenv ("PATH", _PATH_DEFPATH, 1);
+ esetenv ("PATH", _PATH_DEFPATH, 1);
if (t)
- setenv ("TERM", t, 1);
+ esetenv ("TERM", t, 1);
if (chdir (su_info->pw_dir) < 0)
errx (1, "no directory");
}
if (full_login || su_info->pw_uid)
- setenv ("USER", su_info->pw_name, 1);
- setenv("HOME", su_info->pw_dir, 1);
- setenv("SHELL", shell, 1);
+ esetenv ("USER", su_info->pw_name, 1);
+ esetenv("HOME", su_info->pw_dir, 1);
+ esetenv("SHELL", shell, 1);
}
{
@@ -404,7 +426,8 @@ main(int argc, char **argv)
err(1, "setgid");
if (initgroups (su_info->pw_name, su_info->pw_gid) < 0)
err (1, "initgroups");
- if(setuid(su_info->pw_uid) < 0)
+ if(setuid(su_info->pw_uid) < 0
+ || (su_info->pw_uid != 0 && setuid(0) == 0))
err(1, "setuid");
#ifdef KRB5
OpenPOWER on IntegriCloud