1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright (c) 1999, 2010, Oracle and/or its affiliates. All rights reserved. 23 * Copyright (c) 2013 RackTop Systems. 24 */ 25 26 #include <stdio.h> 27 #include <stdlib.h> 28 #include <strings.h> 29 #include <auth_attr.h> 30 #include <prof_attr.h> 31 #include <user_attr.h> 32 #include <project.h> 33 #include <secdb.h> 34 #include <pwd.h> 35 #include <unistd.h> 36 #include <priv.h> 37 #include <errno.h> 38 #include <ctype.h> 39 #include <nss.h> 40 #include <bsm/libbsm.h> 41 #include <tsol/label.h> 42 #include "funcs.h" 43 #include "messages.h" 44 #undef GROUP 45 #include "userdefs.h" 46 47 typedef struct ua_key { 48 const char *key; 49 const char *(*check)(const char *); 50 const char *errstr; 51 char *newvalue; 52 } ua_key_t; 53 54 static const char role[] = "role name"; 55 static const char prof[] = "profile name"; 56 static const char proj[] = "project name"; 57 static const char priv[] = "privilege set"; 58 static const char auth[] = "authorization"; 59 static const char type[] = "user type"; 60 static const char lock[] = "lock_after_retries value"; 61 static const char label[] = "label"; 62 static const char idlecmd[] = "idlecmd value"; 63 static const char idletime[] = "idletime value"; 64 static const char auditflags[] = "audit mask"; 65 static char auditerr[256]; 66 67 68 static const char *check_auth(const char *); 69 static const char *check_prof(const char *); 70 static const char *check_role(const char *); 71 static const char *check_proj(const char *); 72 static const char *check_privset(const char *); 73 static const char *check_type(const char *); 74 static const char *check_lock_after_retries(const char *); 75 static const char *check_label(const char *); 76 static const char *check_idlecmd(const char *); 77 static const char *check_idletime(const char *); 78 static const char *check_auditflags(const char *); 79 80 int nkeys; 81 82 static ua_key_t keys[] = { 83 /* First entry is always set correctly in main() */ 84 { USERATTR_TYPE_KW, check_type, type }, 85 { USERATTR_AUTHS_KW, check_auth, auth }, 86 { USERATTR_PROFILES_KW, check_prof, prof }, 87 { USERATTR_ROLES_KW, check_role, role }, 88 { USERATTR_DEFAULTPROJ_KW, check_proj, proj }, 89 { USERATTR_LIMPRIV_KW, check_privset, priv }, 90 { USERATTR_DFLTPRIV_KW, check_privset, priv }, 91 { USERATTR_LOCK_AFTER_RETRIES_KW, check_lock_after_retries, lock }, 92 { USERATTR_CLEARANCE, check_label, label }, 93 { USERATTR_MINLABEL, check_label, label }, 94 { USERATTR_IDLECMD_KW, check_idlecmd, idlecmd }, 95 { USERATTR_IDLETIME_KW, check_idletime, idletime }, 96 { USERATTR_AUDIT_FLAGS_KW, check_auditflags, auditflags }, 97 }; 98 99 #define NKEYS (sizeof (keys)/sizeof (ua_key_t)) 100 101 /* 102 * Change a key, there are three different call sequences: 103 * 104 * key, value - key with option letter, value. 105 * NULL, value - -K key=value option. 106 */ 107 108 void 109 change_key(const char *key, char *value) 110 { 111 int i; 112 const char *res; 113 114 if (key == NULL) { 115 key = value; 116 value = strchr(value, '='); 117 /* Bad value */ 118 if (value == NULL) { 119 errmsg(M_INVALID_VALUE); 120 exit(EX_BADARG); 121 } 122 *value++ = '\0'; 123 } 124 125 for (i = 0; i < NKEYS; i++) { 126 if (strcmp(key, keys[i].key) == 0) { 127 if (keys[i].newvalue != NULL) { 128 /* Can't set a value twice */ 129 errmsg(M_REDEFINED_KEY, key); 130 exit(EX_BADARG); 131 } 132 133 if (keys[i].check != NULL && 134 (res = keys[i].check(value)) != NULL) { 135 errmsg(M_INVALID, res, keys[i].errstr); 136 exit(EX_BADARG); 137 } 138 keys[i].newvalue = value; 139 nkeys++; 140 return; 141 } 142 } 143 errmsg(M_INVALID_KEY, key); 144 exit(EX_BADARG); 145 } 146 147 /* 148 * Add the keys to the argument vector. 149 */ 150 void 151 addkey_args(char **argv, int *index) 152 { 153 int i; 154 155 for (i = 0; i < NKEYS; i++) { 156 const char *key = keys[i].key; 157 char *val = keys[i].newvalue; 158 size_t len; 159 char *arg; 160 161 if (val == NULL) 162 continue; 163 164 len = strlen(key) + strlen(val) + 2; 165 arg = malloc(len); 166 167 (void) snprintf(arg, len, "%s=%s", key, val); 168 argv[(*index)++] = "-K"; 169 argv[(*index)++] = arg; 170 } 171 } 172 173 /* 174 * Propose a default value for a key and get the actual value back. 175 * If the proposed default value is NULL, return the actual value set. 176 * The key argument is the user_attr key. 177 */ 178 char * 179 getsetdefval(const char *key, char *dflt) 180 { 181 int i; 182 183 for (i = 0; i < NKEYS; i++) 184 if (strcmp(keys[i].key, key) == 0) { 185 if (keys[i].newvalue != NULL) 186 return (keys[i].newvalue); 187 else 188 return (keys[i].newvalue = dflt); 189 } 190 return (NULL); 191 } 192 193 char * 194 getusertype(char *cmdname) 195 { 196 static char usertype[MAX_TYPE_LENGTH]; 197 char *cmd; 198 199 if ((cmd = strrchr(cmdname, '/'))) 200 ++cmd; 201 else 202 cmd = cmdname; 203 204 /* get user type based on the program name */ 205 if (strncmp(cmd, CMD_PREFIX_USER, 206 strlen(CMD_PREFIX_USER)) == 0) 207 strcpy(usertype, USERATTR_TYPE_NORMAL_KW); 208 else 209 strcpy(usertype, USERATTR_TYPE_NONADMIN_KW); 210 211 return (usertype); 212 } 213 214 int 215 is_role(char *usertype) 216 { 217 if (strcmp(usertype, USERATTR_TYPE_NONADMIN_KW) == 0) 218 return (1); 219 /* not a role */ 220 return (0); 221 } 222 223 /* 224 * Verifies the provided list of authorizations are all valid. 225 * 226 * Returns NULL if all authorization names are valid. 227 * Otherwise, returns the invalid authorization name 228 * 229 */ 230 static const char * 231 check_auth(const char *auths) 232 { 233 char *authname; 234 authattr_t *result; 235 char *tmp; 236 struct passwd *pw; 237 int have_grant = 0; 238 239 tmp = strdup(auths); 240 if (tmp == NULL) { 241 errmsg(M_NOSPACE); 242 exit(EX_FAILURE); 243 } 244 245 authname = strtok(tmp, AUTH_SEP); 246 pw = getpwuid(getuid()); 247 if (pw == NULL) { 248 return (authname); 249 } 250 251 while (authname != NULL) { 252 char *suffix; 253 char *authtoks; 254 255 /* Check if user has been granted this authorization */ 256 if (!chkauthattr(authname, pw->pw_name)) 257 return (authname); 258 259 /* Remove named object after slash */ 260 if ((suffix = index(authname, KV_OBJECTCHAR)) != NULL) 261 *suffix = '\0'; 262 263 /* Find the suffix */ 264 if ((suffix = rindex(authname, '.')) == NULL) 265 return (authname); 266 267 /* Check for existence in auth_attr */ 268 suffix++; 269 if (strcmp(suffix, KV_WILDCARD)) { /* Not a wildcard */ 270 result = getauthnam(authname); 271 if (result == NULL) { 272 /* can't find the auth */ 273 free_authattr(result); 274 return (authname); 275 } 276 free_authattr(result); 277 } 278 279 /* Check if user can delegate this authorization */ 280 if (strcmp(suffix, "grant")) { /* Not a grant option */ 281 authtoks = malloc(strlen(authname) + sizeof ("grant")); 282 strcpy(authtoks, authname); 283 have_grant = 0; 284 while ((suffix = rindex(authtoks, '.')) && 285 !have_grant) { 286 strcpy(suffix, ".grant"); 287 if (chkauthattr(authtoks, pw->pw_name)) 288 have_grant = 1; 289 else 290 *suffix = '\0'; 291 } 292 if (!have_grant) 293 return (authname); 294 } 295 authname = strtok(NULL, AUTH_SEP); 296 } 297 free(tmp); 298 return (NULL); 299 } 300 301 /* 302 * Verifies the provided list of profile names are valid. 303 * 304 * Returns NULL if all profile names are valid. 305 * Otherwise, returns the invalid profile name 306 * 307 */ 308 static const char * 309 check_prof(const char *profs) 310 { 311 char *profname; 312 profattr_t *result; 313 char *tmp; 314 315 tmp = strdup(profs); 316 if (tmp == NULL) { 317 errmsg(M_NOSPACE); 318 exit(EX_FAILURE); 319 } 320 321 profname = strtok(tmp, PROF_SEP); 322 while (profname != NULL) { 323 result = getprofnam(profname); 324 if (result == NULL) { 325 /* can't find the profile */ 326 return (profname); 327 } 328 free_profattr(result); 329 profname = strtok(NULL, PROF_SEP); 330 } 331 free(tmp); 332 return (NULL); 333 } 334 335 336 /* 337 * Verifies the provided list of role names are valid. 338 * 339 * Returns NULL if all role names are valid. 340 * Otherwise, returns the invalid role name 341 * 342 */ 343 static const char * 344 check_role(const char *roles) 345 { 346 char *rolename; 347 userattr_t *result; 348 char *utype; 349 char *tmp; 350 351 tmp = strdup(roles); 352 if (tmp == NULL) { 353 errmsg(M_NOSPACE); 354 exit(EX_FAILURE); 355 } 356 357 rolename = strtok(tmp, ROLE_SEP); 358 while (rolename != NULL) { 359 result = getusernam(rolename); 360 if (result == NULL) { 361 /* can't find the rolename */ 362 return (rolename); 363 } 364 /* Now, make sure it is a role */ 365 utype = kva_match(result->attr, USERATTR_TYPE_KW); 366 if (utype == NULL) { 367 /* no user type defined. not a role */ 368 free_userattr(result); 369 return (rolename); 370 } 371 if (strcmp(utype, USERATTR_TYPE_NONADMIN_KW) != 0) { 372 free_userattr(result); 373 return (rolename); 374 } 375 free_userattr(result); 376 rolename = strtok(NULL, ROLE_SEP); 377 } 378 free(tmp); 379 return (NULL); 380 } 381 382 static const char * 383 check_proj(const char *proj) 384 { 385 if (getprojidbyname(proj) < 0) { 386 return (proj); 387 } else { 388 return (NULL); 389 } 390 } 391 392 static const char * 393 check_privset(const char *pset) 394 { 395 priv_set_t *tmp; 396 const char *res; 397 398 tmp = priv_str_to_set(pset, ",", &res); 399 400 if (tmp != NULL) { 401 res = NULL; 402 priv_freeset(tmp); 403 } else if (res == NULL) 404 res = strerror(errno); 405 406 return (res); 407 } 408 409 static const char * 410 check_type(const char *type) 411 { 412 if (strcmp(type, USERATTR_TYPE_NONADMIN_KW) != 0 && 413 strcmp(type, USERATTR_TYPE_NORMAL_KW) != 0) 414 return (type); 415 416 return (NULL); 417 } 418 419 static const char * 420 check_lock_after_retries(const char *keyval) 421 { 422 if (keyval != NULL) { 423 if ((strcasecmp(keyval, "no") != 0) && 424 (strcasecmp(keyval, "yes") != 0) && 425 (*keyval != '\0')) { 426 return (keyval); 427 } 428 } 429 return (NULL); 430 } 431 432 static const char * 433 check_label(const char *labelstr) 434 { 435 int err; 436 m_label_t *lbl = NULL; 437 438 if (!is_system_labeled()) 439 return (NULL); 440 441 err = str_to_label(labelstr, &lbl, MAC_LABEL, L_NO_CORRECTION, NULL); 442 m_label_free(lbl); 443 444 if (err == -1) 445 return (labelstr); 446 447 return (NULL); 448 } 449 450 static const char * 451 check_idlecmd(const char *cmd) 452 { 453 if ((strcmp(cmd, USERATTR_IDLECMD_LOCK_KW) != 0) && 454 (strcmp(cmd, USERATTR_IDLECMD_LOGOUT_KW) != 0)) { 455 return (cmd); 456 } 457 458 return (NULL); 459 } 460 461 static const char * 462 check_idletime(const char *time) 463 { 464 int c; 465 unsigned char *up = (unsigned char *)time; 466 467 c = *up; 468 while (c != '\0') { 469 if (!isdigit(c)) 470 return (time); 471 c = *++up; 472 } 473 474 return (NULL); 475 } 476 477 static const char * 478 check_auditflags(const char *auditflags) 479 { 480 au_mask_t mask; 481 char *flags; 482 char *last = NULL; 483 char *err = "NULL"; 484 485 /* if deleting audit_flags */ 486 if (*auditflags == '\0') { 487 return (NULL); 488 } 489 490 if ((flags = _strdup_null((char *)auditflags)) == NULL) { 491 errmsg(M_NOSPACE); 492 exit(EX_FAILURE); 493 } 494 495 if (!__chkflags(_strtok_escape(flags, KV_AUDIT_DELIMIT, &last), &mask, 496 B_FALSE, &err)) { 497 (void) snprintf(auditerr, sizeof (auditerr), 498 "always mask \"%s\"", err); 499 free(flags); 500 return (auditerr); 501 } 502 if (!__chkflags(_strtok_escape(NULL, KV_AUDIT_DELIMIT, &last), &mask, 503 B_FALSE, &err)) { 504 (void) snprintf(auditerr, sizeof (auditerr), 505 "never mask \"%s\"", err); 506 free(flags); 507 return (auditerr); 508 } 509 if (last != NULL) { 510 (void) snprintf(auditerr, sizeof (auditerr), "\"%s\"", 511 auditflags); 512 free(flags); 513 return (auditerr); 514 } 515 free(flags); 516 517 return (NULL); 518 } 519