1 /* 2 * Copyright (c) 1980, 1987, 1993 3 * The Regents of the University of California. All rights reserved. 4 * 5 * This code is derived from software contributed to Berkeley by 6 * Bob Toxen. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 4. Neither the name of the University nor the names of its contributors 17 * may be used to endorse or promote products derived from this software 18 * without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 */ 32 33 #ifndef lint 34 static const char copyright[] = 35 "@(#) Copyright (c) 1980, 1987, 1993\n\ 36 The Regents of the University of California. All rights reserved.\n"; 37 #endif /* not lint */ 38 39 #ifndef lint 40 #if 0 41 static char sccsid[] = "@(#)lock.c 8.1 (Berkeley) 6/6/93"; 42 #endif 43 #endif /* not lint */ 44 #include <sys/cdefs.h> 45 __FBSDID("$FreeBSD$"); 46 47 /* 48 * Lock a terminal up until the given key is entered or the given 49 * interval times out. 50 * 51 * Timeout interval is by default TIMEOUT, it can be changed with 52 * an argument of the form -time where time is in minutes 53 */ 54 55 #include <sys/param.h> 56 #include <sys/stat.h> 57 #include <sys/time.h> 58 #include <sys/signal.h> 59 #include <sys/consio.h> 60 #include <err.h> 61 #include <ctype.h> 62 #include <errno.h> 63 #include <pwd.h> 64 #include <stdint.h> 65 #include <stdio.h> 66 #include <stdlib.h> 67 #include <string.h> 68 #include <syslog.h> 69 #include <termios.h> 70 #include <unistd.h> 71 72 #define TIMEOUT 15 73 74 void quit(int); 75 void bye(int); 76 void hi(int); 77 static void usage(void); 78 79 struct timeval timeout; 80 struct timeval zerotime; 81 struct termios tty, ntty; 82 long nexttime; /* keep the timeout time */ 83 int no_timeout; /* lock terminal forever */ 84 int vtyunlock; /* Unlock flag and code. */ 85 86 /*ARGSUSED*/ 87 int 88 main(int argc, char **argv) 89 { 90 struct passwd *pw; 91 struct timeval timval; 92 time_t timval_sec; 93 struct itimerval ntimer, otimer; 94 struct tm *timp; 95 int ch, failures, sectimeout, usemine, vtylock; 96 char *ap, *mypw, *ttynam, *tzn; 97 char hostname[MAXHOSTNAMELEN], s[BUFSIZ], s1[BUFSIZ]; 98 99 openlog("lock", LOG_ODELAY, LOG_AUTH); 100 101 sectimeout = TIMEOUT; 102 mypw = NULL; 103 usemine = 0; 104 no_timeout = 0; 105 vtylock = 0; 106 while ((ch = getopt(argc, argv, "npt:v")) != -1) 107 switch((char)ch) { 108 case 't': 109 if ((sectimeout = atoi(optarg)) <= 0) 110 errx(1, "illegal timeout value"); 111 break; 112 case 'p': 113 usemine = 1; 114 if (!(pw = getpwuid(getuid()))) 115 errx(1, "unknown uid %d", getuid()); 116 mypw = strdup(pw->pw_passwd); 117 break; 118 case 'n': 119 no_timeout = 1; 120 break; 121 case 'v': 122 vtylock = 1; 123 break; 124 case '?': 125 default: 126 usage(); 127 } 128 timeout.tv_sec = sectimeout * 60; 129 130 setuid(getuid()); /* discard privs */ 131 132 if (tcgetattr(0, &tty)) /* get information for header */ 133 exit(1); 134 gethostname(hostname, sizeof(hostname)); 135 if (!(ttynam = ttyname(0))) 136 errx(1, "not a terminal?"); 137 if (gettimeofday(&timval, (struct timezone *)NULL)) 138 err(1, "gettimeofday"); 139 nexttime = timval.tv_sec + (sectimeout * 60); 140 timval_sec = timval.tv_sec; 141 timp = localtime(&timval_sec); 142 ap = asctime(timp); 143 tzn = timp->tm_zone; 144 145 (void)signal(SIGINT, quit); 146 (void)signal(SIGQUIT, quit); 147 ntty = tty; ntty.c_lflag &= ~ECHO; 148 (void)tcsetattr(0, TCSADRAIN|TCSASOFT, &ntty); 149 150 if (!mypw) { 151 /* get key and check again */ 152 (void)printf("Key: "); 153 if (!fgets(s, sizeof(s), stdin) || *s == '\n') 154 quit(0); 155 (void)printf("\nAgain: "); 156 /* 157 * Don't need EOF test here, if we get EOF, then s1 != s 158 * and the right things will happen. 159 */ 160 (void)fgets(s1, sizeof(s1), stdin); 161 (void)putchar('\n'); 162 if (strcmp(s1, s)) { 163 (void)printf("\07lock: passwords didn't match.\n"); 164 (void)tcsetattr(0, TCSADRAIN|TCSASOFT, &tty); 165 exit(1); 166 } 167 s[0] = '\0'; 168 mypw = s1; 169 } 170 171 /* set signal handlers */ 172 (void)signal(SIGINT, hi); 173 (void)signal(SIGQUIT, hi); 174 (void)signal(SIGTSTP, hi); 175 (void)signal(SIGALRM, bye); 176 177 ntimer.it_interval = zerotime; 178 ntimer.it_value = timeout; 179 if (!no_timeout) 180 setitimer(ITIMER_REAL, &ntimer, &otimer); 181 if (vtylock) { 182 /* 183 * If this failed, we want to err out; warn isn't good 184 * enough, since we don't want the user to think that 185 * everything is nice and locked because they got a 186 * "Key:" prompt. 187 */ 188 if (ioctl(0, VT_LOCKSWITCH, &vtylock) == -1) { 189 (void)tcsetattr(0, TCSADRAIN|TCSASOFT, &tty); 190 err(1, "locking vty"); 191 } 192 vtyunlock = 0x2; 193 } 194 195 /* header info */ 196 (void)printf("lock: %s on %s.", ttynam, hostname); 197 if (no_timeout) 198 (void)printf(" no timeout."); 199 else 200 (void)printf(" timeout in %d minute%s.", sectimeout, 201 sectimeout != 1 ? "s" : ""); 202 if (vtylock) 203 (void)printf(" vty locked."); 204 (void)printf("\ntime now is %.20s%s%s", ap, tzn, ap + 19); 205 206 failures = 0; 207 208 for (;;) { 209 (void)printf("Key: "); 210 if (!fgets(s, sizeof(s), stdin)) { 211 clearerr(stdin); 212 hi(0); 213 goto tryagain; 214 } 215 if (usemine) { 216 s[strlen(s) - 1] = '\0'; 217 if (!strcmp(mypw, crypt(s, mypw))) 218 break; 219 } 220 else if (!strcmp(s, s1)) 221 break; 222 (void)printf("\07\n"); 223 failures++; 224 if (getuid() == 0) 225 syslog(LOG_NOTICE, "%d ROOT UNLOCK FAILURE%s (%s on %s)", 226 failures, failures > 1 ? "S": "", ttynam, hostname); 227 tryagain: 228 if (tcgetattr(0, &ntty) && (errno != EINTR)) 229 exit(1); 230 sleep(1); /* to discourage guessing */ 231 } 232 if (getuid() == 0) 233 syslog(LOG_NOTICE, "ROOT UNLOCK ON hostname %s port %s", 234 hostname, ttynam); 235 quit(0); 236 return(0); /* not reached */ 237 } 238 239 240 static void 241 usage(void) 242 { 243 (void)fprintf(stderr, "usage: lock [-npv] [-t timeout]\n"); 244 exit(1); 245 } 246 247 void 248 hi(int signo __unused) 249 { 250 struct timeval timval; 251 252 if (!gettimeofday(&timval, (struct timezone *)NULL)) { 253 (void)printf("lock: type in the unlock key. "); 254 if (no_timeout) { 255 (void)putchar('\n'); 256 } else { 257 (void)printf("timeout in %jd:%jd minutes\n", 258 (intmax_t)(nexttime - timval.tv_sec) / 60, 259 (intmax_t)(nexttime - timval.tv_sec) % 60); 260 } 261 } 262 } 263 264 void 265 quit(int signo __unused) 266 { 267 (void)putchar('\n'); 268 (void)tcsetattr(0, TCSADRAIN|TCSASOFT, &tty); 269 if (vtyunlock) 270 (void)ioctl(0, VT_LOCKSWITCH, &vtyunlock); 271 exit(0); 272 } 273 274 void 275 bye(int signo __unused) 276 { 277 if (!no_timeout) { 278 (void)tcsetattr(0, TCSADRAIN|TCSASOFT, &tty); 279 if (vtyunlock) 280 (void)ioctl(0, VT_LOCKSWITCH, &vtyunlock); 281 (void)printf("lock: timeout\n"); 282 exit(1); 283 } 284 } 285