17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * CDDL HEADER START 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the 57c478bd9Sstevel@tonic-gate * Common Development and Distribution License, Version 1.0 only 67c478bd9Sstevel@tonic-gate * (the "License"). You may not use this file except in compliance 77c478bd9Sstevel@tonic-gate * with the License. 87c478bd9Sstevel@tonic-gate * 97c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 107c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 117c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions 127c478bd9Sstevel@tonic-gate * and limitations under the License. 137c478bd9Sstevel@tonic-gate * 147c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 157c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 167c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 177c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 187c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 197c478bd9Sstevel@tonic-gate * 207c478bd9Sstevel@tonic-gate * CDDL HEADER END 217c478bd9Sstevel@tonic-gate */ 227c478bd9Sstevel@tonic-gate /* 237c478bd9Sstevel@tonic-gate * Copyright 2005 Sun Microsystems, Inc. All rights reserved. 247c478bd9Sstevel@tonic-gate * Use is subject to license terms. 257c478bd9Sstevel@tonic-gate */ 267c478bd9Sstevel@tonic-gate 277c478bd9Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 287c478bd9Sstevel@tonic-gate 297c478bd9Sstevel@tonic-gate #define _POSIX_PTHREAD_SEMANTICS /* for readdir_r */ 307c478bd9Sstevel@tonic-gate #ifdef lint 317c478bd9Sstevel@tonic-gate #define _REENTRANT /* for strtok_r */ 327c478bd9Sstevel@tonic-gate #endif 337c478bd9Sstevel@tonic-gate 347c478bd9Sstevel@tonic-gate #include <stdio.h> 357c478bd9Sstevel@tonic-gate #include <stdlib.h> 367c478bd9Sstevel@tonic-gate #include <string.h> 377c478bd9Sstevel@tonic-gate #include <unistd.h> 387c478bd9Sstevel@tonic-gate #include <dirent.h> 397c478bd9Sstevel@tonic-gate #include <errno.h> 407c478bd9Sstevel@tonic-gate #include <grp.h> 417c478bd9Sstevel@tonic-gate #include <pwd.h> 427c478bd9Sstevel@tonic-gate #include <alloca.h> 437c478bd9Sstevel@tonic-gate #include <nss_dbdefs.h> 447c478bd9Sstevel@tonic-gate #include <stdarg.h> 457c478bd9Sstevel@tonic-gate #include <syslog.h> 467c478bd9Sstevel@tonic-gate #include <sys/acl.h> 477c478bd9Sstevel@tonic-gate #include <sys/types.h> 487c478bd9Sstevel@tonic-gate #include <sys/stat.h> 497c478bd9Sstevel@tonic-gate #include <sys/ddi.h> 507c478bd9Sstevel@tonic-gate #include <sys/sunddi.h> 517c478bd9Sstevel@tonic-gate #include <sys/devinfo_impl.h> 527c478bd9Sstevel@tonic-gate #include <sys/hwconf.h> 537c478bd9Sstevel@tonic-gate #include <sys/modctl.h> 547c478bd9Sstevel@tonic-gate #include <libnvpair.h> 557c478bd9Sstevel@tonic-gate #include <device_info.h> 567c478bd9Sstevel@tonic-gate #include <regex.h> 577c478bd9Sstevel@tonic-gate #include <strings.h> 587c478bd9Sstevel@tonic-gate #include <libdevinfo.h> 597c478bd9Sstevel@tonic-gate 607c478bd9Sstevel@tonic-gate extern int is_minor_node(const char *, const char **); 617c478bd9Sstevel@tonic-gate 627c478bd9Sstevel@tonic-gate static int logindevperm(const char *, uid_t, gid_t, void (*)()); 637c478bd9Sstevel@tonic-gate static int dir_dev_acc(char *, char *, uid_t, gid_t, mode_t, char *line, 647c478bd9Sstevel@tonic-gate void (*)()); 657c478bd9Sstevel@tonic-gate static int setdevaccess(char *, uid_t, gid_t, mode_t, void (*)()); 667c478bd9Sstevel@tonic-gate static void logerror(char *); 677c478bd9Sstevel@tonic-gate 687c478bd9Sstevel@tonic-gate #define MAX_LINELEN 256 697c478bd9Sstevel@tonic-gate #define LOGINDEVPERM "/etc/logindevperm" 707c478bd9Sstevel@tonic-gate #define DIRWILD "/*" /* directory wildcard */ 717c478bd9Sstevel@tonic-gate #define DIRWLDLEN 2 /* strlen(DIRWILD) */ 727c478bd9Sstevel@tonic-gate 737c478bd9Sstevel@tonic-gate /* 747c478bd9Sstevel@tonic-gate * Revoke all access to a device node and make sure that there are 757c478bd9Sstevel@tonic-gate * no interposed streams devices attached. Must be called before a 767c478bd9Sstevel@tonic-gate * device is actually opened. 777c478bd9Sstevel@tonic-gate * When fdetach is called, the underlying device node is revealed; it 787c478bd9Sstevel@tonic-gate * will have the previous owner and that owner can re-attach; so we 797c478bd9Sstevel@tonic-gate * retry until we win. 807c478bd9Sstevel@tonic-gate * Ignore non-existent devices. 817c478bd9Sstevel@tonic-gate */ 827c478bd9Sstevel@tonic-gate static int 837c478bd9Sstevel@tonic-gate setdevaccess(char *dev, uid_t uid, gid_t gid, mode_t mode, 847c478bd9Sstevel@tonic-gate void (*errmsg)(char *)) 857c478bd9Sstevel@tonic-gate { 867c478bd9Sstevel@tonic-gate int err = 0, local_errno; 877c478bd9Sstevel@tonic-gate char errstring[MAX_LINELEN]; 887c478bd9Sstevel@tonic-gate 897c478bd9Sstevel@tonic-gate if (chown(dev, uid, gid) == -1) { 907c478bd9Sstevel@tonic-gate if (errno == ENOENT) /* no such file */ 917c478bd9Sstevel@tonic-gate return (0); 927c478bd9Sstevel@tonic-gate err = -1; 937c478bd9Sstevel@tonic-gate } 947c478bd9Sstevel@tonic-gate 957c478bd9Sstevel@tonic-gate while (fdetach(dev) == 0) { 967c478bd9Sstevel@tonic-gate if (chown(dev, uid, gid) == -1) { 977c478bd9Sstevel@tonic-gate err = -1; 987c478bd9Sstevel@tonic-gate local_errno = errno; 997c478bd9Sstevel@tonic-gate } 1007c478bd9Sstevel@tonic-gate } 1017c478bd9Sstevel@tonic-gate if (err && errmsg) { 1027c478bd9Sstevel@tonic-gate (void) snprintf(errstring, MAX_LINELEN, 1037c478bd9Sstevel@tonic-gate "failed to chown device %s: %s\n", 1047c478bd9Sstevel@tonic-gate dev, strerror(local_errno)); 1057c478bd9Sstevel@tonic-gate (*errmsg)(errstring); 1067c478bd9Sstevel@tonic-gate } 1077c478bd9Sstevel@tonic-gate 108*fa9e4066Sahrens /* 109*fa9e4066Sahrens * strip_acl sets an acl and changes the files owner/group 110*fa9e4066Sahrens */ 111*fa9e4066Sahrens err = acl_strip(dev, uid, gid, mode); 1127c478bd9Sstevel@tonic-gate 113*fa9e4066Sahrens if (err != 0) { 1147c478bd9Sstevel@tonic-gate /* 1157c478bd9Sstevel@tonic-gate * If the file system returned ENOSYS, we know that it 1167c478bd9Sstevel@tonic-gate * doesn't support ACLs, therefore, we must assume that 1177c478bd9Sstevel@tonic-gate * there were no ACLs to remove in the first place. 1187c478bd9Sstevel@tonic-gate */ 1197c478bd9Sstevel@tonic-gate if (errno != ENOSYS) { 1207c478bd9Sstevel@tonic-gate err = -1; 1217c478bd9Sstevel@tonic-gate 1227c478bd9Sstevel@tonic-gate if (errmsg) { 1237c478bd9Sstevel@tonic-gate (void) snprintf(errstring, MAX_LINELEN, 1247c478bd9Sstevel@tonic-gate "failed to set acl on device %s: %s\n", 1257c478bd9Sstevel@tonic-gate dev, strerror(errno)); 1267c478bd9Sstevel@tonic-gate (*errmsg)(errstring); 1277c478bd9Sstevel@tonic-gate } 1287c478bd9Sstevel@tonic-gate } 1297c478bd9Sstevel@tonic-gate if (chmod(dev, mode) == -1) { 1307c478bd9Sstevel@tonic-gate err = -1; 1317c478bd9Sstevel@tonic-gate if (errmsg) { 1327c478bd9Sstevel@tonic-gate (void) snprintf(errstring, MAX_LINELEN, 1337c478bd9Sstevel@tonic-gate "failed to chmod device %s: %s\n", 1347c478bd9Sstevel@tonic-gate dev, strerror(errno)); 1357c478bd9Sstevel@tonic-gate (*errmsg)(errstring); 1367c478bd9Sstevel@tonic-gate } 1377c478bd9Sstevel@tonic-gate } 138*fa9e4066Sahrens } 1397c478bd9Sstevel@tonic-gate 1407c478bd9Sstevel@tonic-gate return (err); 1417c478bd9Sstevel@tonic-gate } 1427c478bd9Sstevel@tonic-gate 1437c478bd9Sstevel@tonic-gate /* 1447c478bd9Sstevel@tonic-gate * logindevperm - change owner/group/permissions of devices 1457c478bd9Sstevel@tonic-gate * list in /etc/logindevperm. 1467c478bd9Sstevel@tonic-gate */ 1477c478bd9Sstevel@tonic-gate static int 1487c478bd9Sstevel@tonic-gate logindevperm(const char *ttyn, uid_t uid, gid_t gid, void (*errmsg)(char *)) 1497c478bd9Sstevel@tonic-gate { 1507c478bd9Sstevel@tonic-gate int err = 0, lineno = 0; 1517c478bd9Sstevel@tonic-gate const char *field_delims = " \t\n"; 1527c478bd9Sstevel@tonic-gate char line[MAX_LINELEN], errstring[MAX_LINELEN]; 1537c478bd9Sstevel@tonic-gate char saveline[MAX_LINELEN]; 1547c478bd9Sstevel@tonic-gate char *console; 1557c478bd9Sstevel@tonic-gate char *mode_str; 1567c478bd9Sstevel@tonic-gate char *dev_list; 1577c478bd9Sstevel@tonic-gate char *device; 1587c478bd9Sstevel@tonic-gate char *ptr; 1597c478bd9Sstevel@tonic-gate int mode; 1607c478bd9Sstevel@tonic-gate FILE *fp; 1617c478bd9Sstevel@tonic-gate 1627c478bd9Sstevel@tonic-gate if ((fp = fopen(LOGINDEVPERM, "r")) == NULL) { 1637c478bd9Sstevel@tonic-gate if (errmsg) { 1647c478bd9Sstevel@tonic-gate (void) snprintf(errstring, MAX_LINELEN, 1657c478bd9Sstevel@tonic-gate LOGINDEVPERM ": open failed: %s\n", 1667c478bd9Sstevel@tonic-gate strerror(errno)); 1677c478bd9Sstevel@tonic-gate (*errmsg)(errstring); 1687c478bd9Sstevel@tonic-gate } 1697c478bd9Sstevel@tonic-gate return (-1); 1707c478bd9Sstevel@tonic-gate } 1717c478bd9Sstevel@tonic-gate 1727c478bd9Sstevel@tonic-gate while (fgets(line, MAX_LINELEN, fp) != NULL) { 1737c478bd9Sstevel@tonic-gate char *last; 1747c478bd9Sstevel@tonic-gate lineno++; 1757c478bd9Sstevel@tonic-gate 1767c478bd9Sstevel@tonic-gate if ((ptr = strchr(line, '#')) != NULL) 1777c478bd9Sstevel@tonic-gate *ptr = '\0'; /* handle comments */ 1787c478bd9Sstevel@tonic-gate 1797c478bd9Sstevel@tonic-gate (void) strcpy(saveline, line); 1807c478bd9Sstevel@tonic-gate 1817c478bd9Sstevel@tonic-gate console = strtok_r(line, field_delims, &last); 1827c478bd9Sstevel@tonic-gate if (console == NULL) 1837c478bd9Sstevel@tonic-gate continue; /* ignore blank lines */ 1847c478bd9Sstevel@tonic-gate 1857c478bd9Sstevel@tonic-gate if (strcmp(console, ttyn) != 0) 1867c478bd9Sstevel@tonic-gate continue; /* not our tty, skip */ 1877c478bd9Sstevel@tonic-gate 1887c478bd9Sstevel@tonic-gate mode_str = strtok_r(last, field_delims, &last); 1897c478bd9Sstevel@tonic-gate if (mode_str == NULL) { 1907c478bd9Sstevel@tonic-gate err = -1; /* invalid entry, skip */ 1917c478bd9Sstevel@tonic-gate if (errmsg) { 1927c478bd9Sstevel@tonic-gate (void) snprintf(errstring, MAX_LINELEN, 1937c478bd9Sstevel@tonic-gate LOGINDEVPERM 1947c478bd9Sstevel@tonic-gate ": line %d, invalid entry -- %s\n", 1957c478bd9Sstevel@tonic-gate lineno, line); 1967c478bd9Sstevel@tonic-gate (*errmsg)(errstring); 1977c478bd9Sstevel@tonic-gate } 1987c478bd9Sstevel@tonic-gate continue; 1997c478bd9Sstevel@tonic-gate } 2007c478bd9Sstevel@tonic-gate 2017c478bd9Sstevel@tonic-gate /* convert string to octal value */ 2027c478bd9Sstevel@tonic-gate mode = strtol(mode_str, &ptr, 8); 2037c478bd9Sstevel@tonic-gate if (mode < 0 || mode > 0777 || *ptr != '\0') { 2047c478bd9Sstevel@tonic-gate err = -1; /* invalid mode, skip */ 2057c478bd9Sstevel@tonic-gate if (errmsg) { 2067c478bd9Sstevel@tonic-gate (void) snprintf(errstring, MAX_LINELEN, 2077c478bd9Sstevel@tonic-gate LOGINDEVPERM 2087c478bd9Sstevel@tonic-gate ": line %d, invalid mode -- %s\n", 2097c478bd9Sstevel@tonic-gate lineno, mode_str); 2107c478bd9Sstevel@tonic-gate (*errmsg)(errstring); 2117c478bd9Sstevel@tonic-gate } 2127c478bd9Sstevel@tonic-gate continue; 2137c478bd9Sstevel@tonic-gate } 2147c478bd9Sstevel@tonic-gate 2157c478bd9Sstevel@tonic-gate dev_list = strtok_r(last, field_delims, &last); 2167c478bd9Sstevel@tonic-gate if (dev_list == NULL) { 2177c478bd9Sstevel@tonic-gate err = -1; /* empty device list, skip */ 2187c478bd9Sstevel@tonic-gate if (errmsg) { 2197c478bd9Sstevel@tonic-gate (void) snprintf(errstring, MAX_LINELEN, 2207c478bd9Sstevel@tonic-gate LOGINDEVPERM 2217c478bd9Sstevel@tonic-gate ": line %d, empty device list -- %s\n", 2227c478bd9Sstevel@tonic-gate lineno, line); 2237c478bd9Sstevel@tonic-gate (*errmsg)(errstring); 2247c478bd9Sstevel@tonic-gate } 2257c478bd9Sstevel@tonic-gate continue; 2267c478bd9Sstevel@tonic-gate } 2277c478bd9Sstevel@tonic-gate 2287c478bd9Sstevel@tonic-gate device = strtok_r(dev_list, ":", &last); 2297c478bd9Sstevel@tonic-gate while (device != NULL) { 2307c478bd9Sstevel@tonic-gate if ((device[0] != '/') || (strlen(device) <= 1)) { 2317c478bd9Sstevel@tonic-gate err = -1; 2327c478bd9Sstevel@tonic-gate } else if (dir_dev_acc("/", &device[1], uid, gid, mode, 2337c478bd9Sstevel@tonic-gate saveline, errmsg)) { 2347c478bd9Sstevel@tonic-gate err = -1; 2357c478bd9Sstevel@tonic-gate } 2367c478bd9Sstevel@tonic-gate device = strtok_r(last, ":", &last); 2377c478bd9Sstevel@tonic-gate } 2387c478bd9Sstevel@tonic-gate } 2397c478bd9Sstevel@tonic-gate (void) fclose(fp); 2407c478bd9Sstevel@tonic-gate return (err); 2417c478bd9Sstevel@tonic-gate } 2427c478bd9Sstevel@tonic-gate 2437c478bd9Sstevel@tonic-gate /* 2447c478bd9Sstevel@tonic-gate * returns 0 if resolved, -1 otherwise. 2457c478bd9Sstevel@tonic-gate * devpath: Absolute path to /dev link 2467c478bd9Sstevel@tonic-gate * devfs_path: Returns malloced string: /devices path w/out "/devices" 2477c478bd9Sstevel@tonic-gate */ 2487c478bd9Sstevel@tonic-gate static int 2497c478bd9Sstevel@tonic-gate resolve_link(char *devpath, char **devfs_path) 2507c478bd9Sstevel@tonic-gate { 2517c478bd9Sstevel@tonic-gate char contents[PATH_MAX + 1]; 2527c478bd9Sstevel@tonic-gate char stage_link[PATH_MAX + 1]; 2537c478bd9Sstevel@tonic-gate char *ptr; 2547c478bd9Sstevel@tonic-gate int linksize; 2557c478bd9Sstevel@tonic-gate char *slashdev = "/dev/"; 2567c478bd9Sstevel@tonic-gate 2577c478bd9Sstevel@tonic-gate if (devfs_path) { 2587c478bd9Sstevel@tonic-gate *devfs_path = NULL; 2597c478bd9Sstevel@tonic-gate } 2607c478bd9Sstevel@tonic-gate 2617c478bd9Sstevel@tonic-gate linksize = readlink(devpath, contents, PATH_MAX); 2627c478bd9Sstevel@tonic-gate 2637c478bd9Sstevel@tonic-gate if (linksize <= 0) { 2647c478bd9Sstevel@tonic-gate return (-1); 2657c478bd9Sstevel@tonic-gate } else { 2667c478bd9Sstevel@tonic-gate contents[linksize] = '\0'; 2677c478bd9Sstevel@tonic-gate } 2687c478bd9Sstevel@tonic-gate 2697c478bd9Sstevel@tonic-gate /* 2707c478bd9Sstevel@tonic-gate * if the link contents is not a minor node assume 2717c478bd9Sstevel@tonic-gate * that link contents is really a pointer to another 2727c478bd9Sstevel@tonic-gate * link, and if so recurse and read its link contents. 2737c478bd9Sstevel@tonic-gate */ 2747c478bd9Sstevel@tonic-gate if (is_minor_node((const char *)contents, (const char **)&ptr) != 2757c478bd9Sstevel@tonic-gate 1) { 2767c478bd9Sstevel@tonic-gate if (strncmp(contents, slashdev, strlen(slashdev)) == 0) { 2777c478bd9Sstevel@tonic-gate /* absolute path, starting with /dev */ 2787c478bd9Sstevel@tonic-gate (void) strcpy(stage_link, contents); 2797c478bd9Sstevel@tonic-gate } else { 2807c478bd9Sstevel@tonic-gate /* relative path, prefix devpath */ 2817c478bd9Sstevel@tonic-gate if ((ptr = strrchr(devpath, '/')) == NULL) { 2827c478bd9Sstevel@tonic-gate /* invalid link */ 2837c478bd9Sstevel@tonic-gate return (-1); 2847c478bd9Sstevel@tonic-gate } 2857c478bd9Sstevel@tonic-gate *ptr = '\0'; 2867c478bd9Sstevel@tonic-gate (void) strcpy(stage_link, devpath); 2877c478bd9Sstevel@tonic-gate *ptr = '/'; 2887c478bd9Sstevel@tonic-gate (void) strcat(stage_link, "/"); 2897c478bd9Sstevel@tonic-gate (void) strcat(stage_link, contents); 2907c478bd9Sstevel@tonic-gate 2917c478bd9Sstevel@tonic-gate } 2927c478bd9Sstevel@tonic-gate return (resolve_link(stage_link, devfs_path)); 2937c478bd9Sstevel@tonic-gate } 2947c478bd9Sstevel@tonic-gate 2957c478bd9Sstevel@tonic-gate if (devfs_path) { 2967c478bd9Sstevel@tonic-gate *devfs_path = strdup(ptr); 2977c478bd9Sstevel@tonic-gate if (*devfs_path == NULL) { 2987c478bd9Sstevel@tonic-gate return (-1); 2997c478bd9Sstevel@tonic-gate } 3007c478bd9Sstevel@tonic-gate } 3017c478bd9Sstevel@tonic-gate 3027c478bd9Sstevel@tonic-gate return (0); 3037c478bd9Sstevel@tonic-gate } 3047c478bd9Sstevel@tonic-gate 3057c478bd9Sstevel@tonic-gate /* 3067c478bd9Sstevel@tonic-gate * check a logindevperm line for a driver list and match this against 3077c478bd9Sstevel@tonic-gate * the driver of the minor node 3087c478bd9Sstevel@tonic-gate * returns 0 if no drivers were specified or a driver match 3097c478bd9Sstevel@tonic-gate */ 3107c478bd9Sstevel@tonic-gate static int 3117c478bd9Sstevel@tonic-gate check_driver_match(char *path, char *line) 3127c478bd9Sstevel@tonic-gate { 3137c478bd9Sstevel@tonic-gate char *drv, *driver, *lasts; 3147c478bd9Sstevel@tonic-gate char *devfs_path = NULL; 3157c478bd9Sstevel@tonic-gate char saveline[MAX_LINELEN]; 3167c478bd9Sstevel@tonic-gate char *p; 3177c478bd9Sstevel@tonic-gate 3187c478bd9Sstevel@tonic-gate if (resolve_link(path, &devfs_path) == 0) { 3197c478bd9Sstevel@tonic-gate char *p; 3207c478bd9Sstevel@tonic-gate char pwd_buf[PATH_MAX]; 3217c478bd9Sstevel@tonic-gate di_node_t node; 3227c478bd9Sstevel@tonic-gate 3237c478bd9Sstevel@tonic-gate /* truncate on : so we can take a snapshot */ 3247c478bd9Sstevel@tonic-gate (void) strcpy(pwd_buf, devfs_path); 3257c478bd9Sstevel@tonic-gate p = strrchr(pwd_buf, ':'); 3267c478bd9Sstevel@tonic-gate *p = '\0'; 3277c478bd9Sstevel@tonic-gate 3287c478bd9Sstevel@tonic-gate node = di_init(pwd_buf, DINFOMINOR); 3297c478bd9Sstevel@tonic-gate free(devfs_path); 3307c478bd9Sstevel@tonic-gate 3317c478bd9Sstevel@tonic-gate if (node) { 3327c478bd9Sstevel@tonic-gate drv = di_driver_name(node); 3337c478bd9Sstevel@tonic-gate di_fini(node); 3347c478bd9Sstevel@tonic-gate } else { 3357c478bd9Sstevel@tonic-gate return (0); 3367c478bd9Sstevel@tonic-gate } 3377c478bd9Sstevel@tonic-gate } else { 3387c478bd9Sstevel@tonic-gate return (0); 3397c478bd9Sstevel@tonic-gate } 3407c478bd9Sstevel@tonic-gate 3417c478bd9Sstevel@tonic-gate (void) strcpy(saveline, line); 3427c478bd9Sstevel@tonic-gate 3437c478bd9Sstevel@tonic-gate p = strstr(saveline, "driver"); 3447c478bd9Sstevel@tonic-gate if (p == NULL) { 3457c478bd9Sstevel@tonic-gate return (0); 3467c478bd9Sstevel@tonic-gate } 3477c478bd9Sstevel@tonic-gate 3487c478bd9Sstevel@tonic-gate driver = strtok_r(p, "=", &lasts); 3497c478bd9Sstevel@tonic-gate if (driver) { 3507c478bd9Sstevel@tonic-gate if (strcmp(driver, "driver") == 0) { 3517c478bd9Sstevel@tonic-gate driver = strtok_r(NULL, ", \t\n", &lasts); 3527c478bd9Sstevel@tonic-gate while (driver) { 3537c478bd9Sstevel@tonic-gate if (strcmp(driver, drv) == 0) { 3547c478bd9Sstevel@tonic-gate return (0); 3557c478bd9Sstevel@tonic-gate } 3567c478bd9Sstevel@tonic-gate driver = strtok_r(NULL, ", \t\n", &lasts); 3577c478bd9Sstevel@tonic-gate } 3587c478bd9Sstevel@tonic-gate } 3597c478bd9Sstevel@tonic-gate } 3607c478bd9Sstevel@tonic-gate 3617c478bd9Sstevel@tonic-gate return (-1); 3627c478bd9Sstevel@tonic-gate } 3637c478bd9Sstevel@tonic-gate 3647c478bd9Sstevel@tonic-gate /* 3657c478bd9Sstevel@tonic-gate * Apply owner/group/perms to all files (except "." and "..") 3667c478bd9Sstevel@tonic-gate * in a directory. 3677c478bd9Sstevel@tonic-gate * This function is recursive. We start with "/" and the rest of the pathname 3687c478bd9Sstevel@tonic-gate * in left_to_do argument, and we walk the entire pathname which may contain 3697c478bd9Sstevel@tonic-gate * regular expressions or '*' for each directory name or basename. 3707c478bd9Sstevel@tonic-gate */ 3717c478bd9Sstevel@tonic-gate static int 3727c478bd9Sstevel@tonic-gate dir_dev_acc(char *path, char *left_to_do, uid_t uid, gid_t gid, mode_t mode, 3737c478bd9Sstevel@tonic-gate char *line, void (*errmsg)(char *)) 3747c478bd9Sstevel@tonic-gate { 3757c478bd9Sstevel@tonic-gate struct stat stat_buf; 3767c478bd9Sstevel@tonic-gate int err = 0; 3777c478bd9Sstevel@tonic-gate DIR *dirp; 3787c478bd9Sstevel@tonic-gate struct dirent *direntp, *result; 3797c478bd9Sstevel@tonic-gate 3807c478bd9Sstevel@tonic-gate /* path must be a valid name */ 3817c478bd9Sstevel@tonic-gate if (stat(path, &stat_buf) == -1) { 3827c478bd9Sstevel@tonic-gate return (-1); 3837c478bd9Sstevel@tonic-gate } else { 3847c478bd9Sstevel@tonic-gate if (!S_ISDIR(stat_buf.st_mode)) { 3857c478bd9Sstevel@tonic-gate if (strlen(left_to_do) == 0) { 3867c478bd9Sstevel@tonic-gate /* finally check the driver matches */ 3877c478bd9Sstevel@tonic-gate if (check_driver_match(path, line) == 0) { 3887c478bd9Sstevel@tonic-gate /* we are done, set the permissions */ 3897c478bd9Sstevel@tonic-gate if (setdevaccess(path, 3907c478bd9Sstevel@tonic-gate uid, gid, mode, errmsg)) { 3917c478bd9Sstevel@tonic-gate 3927c478bd9Sstevel@tonic-gate return (-1); 3937c478bd9Sstevel@tonic-gate } 3947c478bd9Sstevel@tonic-gate } 3957c478bd9Sstevel@tonic-gate } 3967c478bd9Sstevel@tonic-gate return (0); 3977c478bd9Sstevel@tonic-gate } 3987c478bd9Sstevel@tonic-gate } 3997c478bd9Sstevel@tonic-gate 4007c478bd9Sstevel@tonic-gate dirp = opendir(path); 4017c478bd9Sstevel@tonic-gate if (dirp == NULL) { 4027c478bd9Sstevel@tonic-gate return (0); 4037c478bd9Sstevel@tonic-gate } else { 4047c478bd9Sstevel@tonic-gate char *p = strchr(left_to_do, '/'); 4057c478bd9Sstevel@tonic-gate regex_t regex; 4067c478bd9Sstevel@tonic-gate int alwaysmatch = 0; 4077c478bd9Sstevel@tonic-gate char *match; 4087c478bd9Sstevel@tonic-gate char *name, *newpath, *remainder_path; 4097c478bd9Sstevel@tonic-gate 4107c478bd9Sstevel@tonic-gate newpath = (char *)malloc(MAXPATHLEN); 4117c478bd9Sstevel@tonic-gate if (newpath == NULL) { 4127c478bd9Sstevel@tonic-gate return (-1); 4137c478bd9Sstevel@tonic-gate } 4147c478bd9Sstevel@tonic-gate match = (char *)calloc(MAXPATHLEN, 1); 4157c478bd9Sstevel@tonic-gate if (match == NULL) { 4167c478bd9Sstevel@tonic-gate free(newpath); 4177c478bd9Sstevel@tonic-gate return (-1); 4187c478bd9Sstevel@tonic-gate } 4197c478bd9Sstevel@tonic-gate 4207c478bd9Sstevel@tonic-gate if (p) { 4217c478bd9Sstevel@tonic-gate (void) strncpy(match, left_to_do, p - left_to_do); 4227c478bd9Sstevel@tonic-gate } else { 4237c478bd9Sstevel@tonic-gate (void) strcpy(match, left_to_do); 4247c478bd9Sstevel@tonic-gate } 4257c478bd9Sstevel@tonic-gate 4267c478bd9Sstevel@tonic-gate if (strcmp(match, "*") == 0) { 4277c478bd9Sstevel@tonic-gate alwaysmatch = 1; 4287c478bd9Sstevel@tonic-gate } else { 4297c478bd9Sstevel@tonic-gate if (regcomp(®ex, match, REG_EXTENDED) != 0) { 4307c478bd9Sstevel@tonic-gate free(newpath); 4317c478bd9Sstevel@tonic-gate free(match); 4327c478bd9Sstevel@tonic-gate return (-1); 4337c478bd9Sstevel@tonic-gate } 4347c478bd9Sstevel@tonic-gate } 4357c478bd9Sstevel@tonic-gate 4367c478bd9Sstevel@tonic-gate direntp = alloca(sizeof (struct dirent) + MAXPATHLEN); 4377c478bd9Sstevel@tonic-gate while (readdir_r(dirp, direntp, &result) == 0) { 4387c478bd9Sstevel@tonic-gate if (result == NULL) 4397c478bd9Sstevel@tonic-gate break; 4407c478bd9Sstevel@tonic-gate 4417c478bd9Sstevel@tonic-gate name = direntp->d_name; 4427c478bd9Sstevel@tonic-gate if ((strcmp(name, ".") == 0) || 4437c478bd9Sstevel@tonic-gate (strcmp(name, "..") == 0)) 4447c478bd9Sstevel@tonic-gate continue; 4457c478bd9Sstevel@tonic-gate 4467c478bd9Sstevel@tonic-gate if (alwaysmatch || 4477c478bd9Sstevel@tonic-gate regexec(®ex, name, 0, NULL, 0) == 0) { 4487c478bd9Sstevel@tonic-gate if (strcmp(path, "/") == 0) { 4497c478bd9Sstevel@tonic-gate (void) snprintf(newpath, 4507c478bd9Sstevel@tonic-gate MAXPATHLEN, "%s%s", path, name); 4517c478bd9Sstevel@tonic-gate } else { 4527c478bd9Sstevel@tonic-gate (void) snprintf(newpath, 4537c478bd9Sstevel@tonic-gate MAXPATHLEN, "%s/%s", path, name); 4547c478bd9Sstevel@tonic-gate } 4557c478bd9Sstevel@tonic-gate 4567c478bd9Sstevel@tonic-gate /* 4577c478bd9Sstevel@tonic-gate * recurse but adjust what is still left to do 4587c478bd9Sstevel@tonic-gate */ 4597c478bd9Sstevel@tonic-gate remainder_path = (p ? 4607c478bd9Sstevel@tonic-gate left_to_do + (p - left_to_do) + 1 : 4617c478bd9Sstevel@tonic-gate &left_to_do[strlen(left_to_do)]); 4627c478bd9Sstevel@tonic-gate if (dir_dev_acc(newpath, remainder_path, 4637c478bd9Sstevel@tonic-gate uid, gid, mode, line, errmsg)) { 4647c478bd9Sstevel@tonic-gate err = -1; 4657c478bd9Sstevel@tonic-gate break; 4667c478bd9Sstevel@tonic-gate } 4677c478bd9Sstevel@tonic-gate } 4687c478bd9Sstevel@tonic-gate } 4697c478bd9Sstevel@tonic-gate (void) closedir(dirp); 4707c478bd9Sstevel@tonic-gate free(newpath); 4717c478bd9Sstevel@tonic-gate free(match); 4727c478bd9Sstevel@tonic-gate if (!alwaysmatch) { 4737c478bd9Sstevel@tonic-gate regfree(®ex); 4747c478bd9Sstevel@tonic-gate } 4757c478bd9Sstevel@tonic-gate } 4767c478bd9Sstevel@tonic-gate 4777c478bd9Sstevel@tonic-gate return (err); 4787c478bd9Sstevel@tonic-gate } 4797c478bd9Sstevel@tonic-gate 4807c478bd9Sstevel@tonic-gate /* 4817c478bd9Sstevel@tonic-gate * di_devperm_login - modify access of devices in /etc/logindevperm 4827c478bd9Sstevel@tonic-gate * by changing owner/group/permissions to that of ttyn. 4837c478bd9Sstevel@tonic-gate */ 4847c478bd9Sstevel@tonic-gate int 4857c478bd9Sstevel@tonic-gate di_devperm_login(const char *ttyn, uid_t uid, gid_t gid, 4867c478bd9Sstevel@tonic-gate void (*errmsg)(char *)) 4877c478bd9Sstevel@tonic-gate { 4887c478bd9Sstevel@tonic-gate int err; 4897c478bd9Sstevel@tonic-gate struct group grp, *grpp; 4907c478bd9Sstevel@tonic-gate gid_t tty_gid; 4917c478bd9Sstevel@tonic-gate char grbuf[NSS_BUFLEN_GROUP]; 4927c478bd9Sstevel@tonic-gate 4937c478bd9Sstevel@tonic-gate if (errmsg == NULL) 4947c478bd9Sstevel@tonic-gate errmsg = logerror; 4957c478bd9Sstevel@tonic-gate 4967c478bd9Sstevel@tonic-gate if (ttyn == NULL) { 4977c478bd9Sstevel@tonic-gate (*errmsg)("di_devperm_login: NULL tty device\n"); 4987c478bd9Sstevel@tonic-gate return (-1); 4997c478bd9Sstevel@tonic-gate } 5007c478bd9Sstevel@tonic-gate 5017c478bd9Sstevel@tonic-gate if (getgrnam_r("tty", &grp, grbuf, NSS_BUFLEN_GROUP, &grpp) != 0) { 5027c478bd9Sstevel@tonic-gate tty_gid = grpp->gr_gid; 5037c478bd9Sstevel@tonic-gate } else { 5047c478bd9Sstevel@tonic-gate /* 5057c478bd9Sstevel@tonic-gate * this should never happen, but if it does set 5067c478bd9Sstevel@tonic-gate * group to tty's traditional value. 5077c478bd9Sstevel@tonic-gate */ 5087c478bd9Sstevel@tonic-gate tty_gid = 7; 5097c478bd9Sstevel@tonic-gate } 5107c478bd9Sstevel@tonic-gate 5117c478bd9Sstevel@tonic-gate /* set the login console device permission */ 5127c478bd9Sstevel@tonic-gate err = setdevaccess((char *)ttyn, uid, tty_gid, 5137c478bd9Sstevel@tonic-gate S_IRUSR|S_IWUSR|S_IWGRP, errmsg); 5147c478bd9Sstevel@tonic-gate if (err) { 5157c478bd9Sstevel@tonic-gate return (err); 5167c478bd9Sstevel@tonic-gate } 5177c478bd9Sstevel@tonic-gate 5187c478bd9Sstevel@tonic-gate /* set the device permissions */ 5197c478bd9Sstevel@tonic-gate return (logindevperm(ttyn, uid, gid, errmsg)); 5207c478bd9Sstevel@tonic-gate } 5217c478bd9Sstevel@tonic-gate 5227c478bd9Sstevel@tonic-gate /* 5237c478bd9Sstevel@tonic-gate * di_devperm_logout - clean up access of devices in /etc/logindevperm 5247c478bd9Sstevel@tonic-gate * by resetting owner/group/permissions. 5257c478bd9Sstevel@tonic-gate */ 5267c478bd9Sstevel@tonic-gate int 5277c478bd9Sstevel@tonic-gate di_devperm_logout(const char *ttyn) 5287c478bd9Sstevel@tonic-gate { 5297c478bd9Sstevel@tonic-gate struct passwd *pwd; 5307c478bd9Sstevel@tonic-gate uid_t root_uid; 5317c478bd9Sstevel@tonic-gate gid_t root_gid; 5327c478bd9Sstevel@tonic-gate 5337c478bd9Sstevel@tonic-gate if (ttyn == NULL) 5347c478bd9Sstevel@tonic-gate return (-1); 5357c478bd9Sstevel@tonic-gate 5367c478bd9Sstevel@tonic-gate pwd = getpwnam("root"); 5377c478bd9Sstevel@tonic-gate if (pwd != NULL) { 5387c478bd9Sstevel@tonic-gate root_uid = pwd->pw_uid; 5397c478bd9Sstevel@tonic-gate root_gid = pwd->pw_gid; 5407c478bd9Sstevel@tonic-gate } else { 5417c478bd9Sstevel@tonic-gate /* 5427c478bd9Sstevel@tonic-gate * this should never happen, but if it does set user 5437c478bd9Sstevel@tonic-gate * and group to root's traditional values. 5447c478bd9Sstevel@tonic-gate */ 5457c478bd9Sstevel@tonic-gate root_uid = 0; 5467c478bd9Sstevel@tonic-gate root_gid = 0; 5477c478bd9Sstevel@tonic-gate } 5487c478bd9Sstevel@tonic-gate 5497c478bd9Sstevel@tonic-gate return (logindevperm(ttyn, root_uid, root_gid, NULL)); 5507c478bd9Sstevel@tonic-gate } 5517c478bd9Sstevel@tonic-gate 5527c478bd9Sstevel@tonic-gate static void 5537c478bd9Sstevel@tonic-gate logerror(char *errstring) 5547c478bd9Sstevel@tonic-gate { 5557c478bd9Sstevel@tonic-gate syslog(LOG_AUTH | LOG_CRIT, "%s", errstring); 5567c478bd9Sstevel@tonic-gate } 5577c478bd9Sstevel@tonic-gate 5587c478bd9Sstevel@tonic-gate 5597c478bd9Sstevel@tonic-gate /* 5607c478bd9Sstevel@tonic-gate * Tokens are separated by ' ', '\t', ':', '=', '&', '|', ';', '\n', or '\0' 5617c478bd9Sstevel@tonic-gate */ 5627c478bd9Sstevel@tonic-gate static int 5637c478bd9Sstevel@tonic-gate getnexttoken(char *next, char **nextp, char **tokenpp, char *tchar) 5647c478bd9Sstevel@tonic-gate { 5657c478bd9Sstevel@tonic-gate char *cp; 5667c478bd9Sstevel@tonic-gate char *cp1; 5677c478bd9Sstevel@tonic-gate char *tokenp; 5687c478bd9Sstevel@tonic-gate 5697c478bd9Sstevel@tonic-gate cp = next; 5707c478bd9Sstevel@tonic-gate while (*cp == ' ' || *cp == '\t') { 5717c478bd9Sstevel@tonic-gate cp++; /* skip leading spaces */ 5727c478bd9Sstevel@tonic-gate } 5737c478bd9Sstevel@tonic-gate tokenp = cp; /* start of token */ 5747c478bd9Sstevel@tonic-gate while (*cp != '\0' && *cp != '\n' && *cp != ' ' && *cp != '\t' && 5757c478bd9Sstevel@tonic-gate *cp != ':' && *cp != '=' && *cp != '&' && 5767c478bd9Sstevel@tonic-gate *cp != '|' && *cp != ';') { 5777c478bd9Sstevel@tonic-gate cp++; /* point to next character */ 5787c478bd9Sstevel@tonic-gate } 5797c478bd9Sstevel@tonic-gate /* 5807c478bd9Sstevel@tonic-gate * If terminating character is a space or tab, look ahead to see if 5817c478bd9Sstevel@tonic-gate * there's another terminator that's not a space or a tab. 5827c478bd9Sstevel@tonic-gate * (This code handles trailing spaces.) 5837c478bd9Sstevel@tonic-gate */ 5847c478bd9Sstevel@tonic-gate if (*cp == ' ' || *cp == '\t') { 5857c478bd9Sstevel@tonic-gate cp1 = cp; 5867c478bd9Sstevel@tonic-gate while (*++cp1 == ' ' || *cp1 == '\t') 5877c478bd9Sstevel@tonic-gate ; 5887c478bd9Sstevel@tonic-gate if (*cp1 == '=' || *cp1 == ':' || *cp1 == '&' || *cp1 == '|' || 5897c478bd9Sstevel@tonic-gate *cp1 == ';' || *cp1 == '\n' || *cp1 == '\0') { 5907c478bd9Sstevel@tonic-gate *cp = NULL; /* terminate token */ 5917c478bd9Sstevel@tonic-gate cp = cp1; 5927c478bd9Sstevel@tonic-gate } 5937c478bd9Sstevel@tonic-gate } 5947c478bd9Sstevel@tonic-gate if (tchar != NULL) { 5957c478bd9Sstevel@tonic-gate *tchar = *cp; /* save terminating character */ 5967c478bd9Sstevel@tonic-gate if (*tchar == '\0') { 5977c478bd9Sstevel@tonic-gate *tchar = '\n'; 5987c478bd9Sstevel@tonic-gate } 5997c478bd9Sstevel@tonic-gate } 6007c478bd9Sstevel@tonic-gate *cp++ = '\0'; /* terminate token, point to next */ 6017c478bd9Sstevel@tonic-gate *nextp = cp; /* set pointer to next character */ 6027c478bd9Sstevel@tonic-gate if (cp - tokenp - 1 == 0) { 6037c478bd9Sstevel@tonic-gate return (0); 6047c478bd9Sstevel@tonic-gate } 6057c478bd9Sstevel@tonic-gate *tokenpp = tokenp; 6067c478bd9Sstevel@tonic-gate return (1); 6077c478bd9Sstevel@tonic-gate } 6087c478bd9Sstevel@tonic-gate 6097c478bd9Sstevel@tonic-gate /* 6107c478bd9Sstevel@tonic-gate * get a decimal octal or hex number. Handle '~' for one's complement. 6117c478bd9Sstevel@tonic-gate */ 6127c478bd9Sstevel@tonic-gate static int 6137c478bd9Sstevel@tonic-gate getvalue(char *token, int *valuep) 6147c478bd9Sstevel@tonic-gate { 6157c478bd9Sstevel@tonic-gate int radix; 6167c478bd9Sstevel@tonic-gate int retval = 0; 6177c478bd9Sstevel@tonic-gate int onescompl = 0; 6187c478bd9Sstevel@tonic-gate int negate = 0; 6197c478bd9Sstevel@tonic-gate char c; 6207c478bd9Sstevel@tonic-gate 6217c478bd9Sstevel@tonic-gate if (*token == '~') { 6227c478bd9Sstevel@tonic-gate onescompl++; /* perform one's complement on result */ 6237c478bd9Sstevel@tonic-gate token++; 6247c478bd9Sstevel@tonic-gate } else if (*token == '-') { 6257c478bd9Sstevel@tonic-gate negate++; 6267c478bd9Sstevel@tonic-gate token++; 6277c478bd9Sstevel@tonic-gate } 6287c478bd9Sstevel@tonic-gate if (*token == '0') { 6297c478bd9Sstevel@tonic-gate token++; 6307c478bd9Sstevel@tonic-gate c = *token; 6317c478bd9Sstevel@tonic-gate 6327c478bd9Sstevel@tonic-gate if (c == '\0') { 6337c478bd9Sstevel@tonic-gate *valuep = 0; /* value is 0 */ 6347c478bd9Sstevel@tonic-gate return (0); 6357c478bd9Sstevel@tonic-gate } 6367c478bd9Sstevel@tonic-gate 6377c478bd9Sstevel@tonic-gate if (c == 'x' || c == 'X') { 6387c478bd9Sstevel@tonic-gate radix = 16; 6397c478bd9Sstevel@tonic-gate token++; 6407c478bd9Sstevel@tonic-gate } else { 6417c478bd9Sstevel@tonic-gate radix = 8; 6427c478bd9Sstevel@tonic-gate } 6437c478bd9Sstevel@tonic-gate } else 6447c478bd9Sstevel@tonic-gate radix = 10; 6457c478bd9Sstevel@tonic-gate 6467c478bd9Sstevel@tonic-gate while ((c = *token++)) { 6477c478bd9Sstevel@tonic-gate switch (radix) { 6487c478bd9Sstevel@tonic-gate case 8: 6497c478bd9Sstevel@tonic-gate if (c >= '0' && c <= '7') { 6507c478bd9Sstevel@tonic-gate c -= '0'; 6517c478bd9Sstevel@tonic-gate } else { 6527c478bd9Sstevel@tonic-gate /* invalid number */ 6537c478bd9Sstevel@tonic-gate return (0); 6547c478bd9Sstevel@tonic-gate } 6557c478bd9Sstevel@tonic-gate retval = (retval << 3) + c; 6567c478bd9Sstevel@tonic-gate break; 6577c478bd9Sstevel@tonic-gate case 10: 6587c478bd9Sstevel@tonic-gate if (c >= '0' && c <= '9') { 6597c478bd9Sstevel@tonic-gate c -= '0'; 6607c478bd9Sstevel@tonic-gate } else { 6617c478bd9Sstevel@tonic-gate /* invalid number */ 6627c478bd9Sstevel@tonic-gate return (0); 6637c478bd9Sstevel@tonic-gate } 6647c478bd9Sstevel@tonic-gate retval = (retval * 10) + c; 6657c478bd9Sstevel@tonic-gate break; 6667c478bd9Sstevel@tonic-gate case 16: 6677c478bd9Sstevel@tonic-gate if (c >= 'a' && c <= 'f') { 6687c478bd9Sstevel@tonic-gate c = c - 'a' + 10; 6697c478bd9Sstevel@tonic-gate } else if (c >= 'A' && c <= 'F') { 6707c478bd9Sstevel@tonic-gate c = c - 'A' + 10; 6717c478bd9Sstevel@tonic-gate } else if (c >= '0' && c <= '9') { 6727c478bd9Sstevel@tonic-gate c -= '0'; 6737c478bd9Sstevel@tonic-gate } else { 6747c478bd9Sstevel@tonic-gate /* invalid number */ 6757c478bd9Sstevel@tonic-gate return (0); 6767c478bd9Sstevel@tonic-gate } 6777c478bd9Sstevel@tonic-gate retval = (retval << 4) + c; 6787c478bd9Sstevel@tonic-gate break; 6797c478bd9Sstevel@tonic-gate } 6807c478bd9Sstevel@tonic-gate } 6817c478bd9Sstevel@tonic-gate if (onescompl) { 6827c478bd9Sstevel@tonic-gate retval = ~retval; 6837c478bd9Sstevel@tonic-gate } 6847c478bd9Sstevel@tonic-gate if (negate) { 6857c478bd9Sstevel@tonic-gate retval = -retval; 6867c478bd9Sstevel@tonic-gate } 6877c478bd9Sstevel@tonic-gate *valuep = retval; 6887c478bd9Sstevel@tonic-gate return (1); 6897c478bd9Sstevel@tonic-gate } 6907c478bd9Sstevel@tonic-gate 6917c478bd9Sstevel@tonic-gate /* 6927c478bd9Sstevel@tonic-gate * Read /etc/minor_perm, return mperm list of entries 6937c478bd9Sstevel@tonic-gate */ 6947c478bd9Sstevel@tonic-gate struct mperm * 6957c478bd9Sstevel@tonic-gate i_devfs_read_minor_perm(char *drvname, void (*errcb)(minorperm_err_t, int)) 6967c478bd9Sstevel@tonic-gate { 6977c478bd9Sstevel@tonic-gate FILE *pfd; 6987c478bd9Sstevel@tonic-gate struct mperm *mp; 6997c478bd9Sstevel@tonic-gate char line[MAX_MINOR_PERM_LINE]; 7007c478bd9Sstevel@tonic-gate char *cp, *p, t; 7017c478bd9Sstevel@tonic-gate struct mperm *minor_perms = NULL; 7027c478bd9Sstevel@tonic-gate struct mperm *mptail = NULL; 7037c478bd9Sstevel@tonic-gate struct passwd *pw; 7047c478bd9Sstevel@tonic-gate struct group *gp; 7057c478bd9Sstevel@tonic-gate uid_t root_uid; 7067c478bd9Sstevel@tonic-gate gid_t sys_gid; 7077c478bd9Sstevel@tonic-gate int ln = 0; 7087c478bd9Sstevel@tonic-gate 7097c478bd9Sstevel@tonic-gate /* 7107c478bd9Sstevel@tonic-gate * Get root/sys ids, these being the most common 7117c478bd9Sstevel@tonic-gate */ 7127c478bd9Sstevel@tonic-gate if ((pw = getpwnam(DEFAULT_DEV_USER)) != NULL) { 7137c478bd9Sstevel@tonic-gate root_uid = pw->pw_uid; 7147c478bd9Sstevel@tonic-gate } else { 7157c478bd9Sstevel@tonic-gate (*errcb)(MP_CANT_FIND_USER_ERR, 0); 7167c478bd9Sstevel@tonic-gate root_uid = (uid_t)0; /* assume 0 is root */ 7177c478bd9Sstevel@tonic-gate } 7187c478bd9Sstevel@tonic-gate if ((gp = getgrnam(DEFAULT_DEV_GROUP)) != NULL) { 7197c478bd9Sstevel@tonic-gate sys_gid = gp->gr_gid; 7207c478bd9Sstevel@tonic-gate } else { 7217c478bd9Sstevel@tonic-gate (*errcb)(MP_CANT_FIND_GROUP_ERR, 0); 7227c478bd9Sstevel@tonic-gate sys_gid = (gid_t)3; /* assume 3 is sys */ 7237c478bd9Sstevel@tonic-gate } 7247c478bd9Sstevel@tonic-gate 7257c478bd9Sstevel@tonic-gate if ((pfd = fopen(MINOR_PERM_FILE, "r")) == NULL) { 7267c478bd9Sstevel@tonic-gate (*errcb)(MP_FOPEN_ERR, errno); 7277c478bd9Sstevel@tonic-gate return (NULL); 7287c478bd9Sstevel@tonic-gate } 7297c478bd9Sstevel@tonic-gate while (fgets(line, MAX_MINOR_PERM_LINE - 1, pfd) != NULL) { 7307c478bd9Sstevel@tonic-gate ln++; 7317c478bd9Sstevel@tonic-gate mp = (struct mperm *)calloc(1, sizeof (struct mperm)); 7327c478bd9Sstevel@tonic-gate if (mp == NULL) { 7337c478bd9Sstevel@tonic-gate (*errcb)(MP_ALLOC_ERR, sizeof (struct mperm)); 7347c478bd9Sstevel@tonic-gate continue; 7357c478bd9Sstevel@tonic-gate } 7367c478bd9Sstevel@tonic-gate cp = line; 7377c478bd9Sstevel@tonic-gate if (getnexttoken(cp, &cp, &p, &t) == 0) { 7387c478bd9Sstevel@tonic-gate (*errcb)(MP_IGNORING_LINE_ERR, ln); 7397c478bd9Sstevel@tonic-gate devfs_free_minor_perm(mp); 7407c478bd9Sstevel@tonic-gate continue; 7417c478bd9Sstevel@tonic-gate } 7427c478bd9Sstevel@tonic-gate mp->mp_drvname = strdup(p); 7437c478bd9Sstevel@tonic-gate if (mp->mp_drvname == NULL) { 7447c478bd9Sstevel@tonic-gate (*errcb)(MP_ALLOC_ERR, strlen(p)+1); 7457c478bd9Sstevel@tonic-gate devfs_free_minor_perm(mp); 7467c478bd9Sstevel@tonic-gate continue; 7477c478bd9Sstevel@tonic-gate } else if (t == '\n' || t == '\0') { 7487c478bd9Sstevel@tonic-gate (*errcb)(MP_IGNORING_LINE_ERR, ln); 7497c478bd9Sstevel@tonic-gate devfs_free_minor_perm(mp); 7507c478bd9Sstevel@tonic-gate continue; 7517c478bd9Sstevel@tonic-gate } 7527c478bd9Sstevel@tonic-gate if (t == ':') { 7537c478bd9Sstevel@tonic-gate if (getnexttoken(cp, &cp, &p, &t) == 0) { 7547c478bd9Sstevel@tonic-gate (*errcb)(MP_IGNORING_LINE_ERR, ln); 7557c478bd9Sstevel@tonic-gate devfs_free_minor_perm(mp); 7567c478bd9Sstevel@tonic-gate } 7577c478bd9Sstevel@tonic-gate mp->mp_minorname = strdup(p); 7587c478bd9Sstevel@tonic-gate if (mp->mp_minorname == NULL) { 7597c478bd9Sstevel@tonic-gate (*errcb)(MP_ALLOC_ERR, strlen(p)+1); 7607c478bd9Sstevel@tonic-gate devfs_free_minor_perm(mp); 7617c478bd9Sstevel@tonic-gate continue; 7627c478bd9Sstevel@tonic-gate } 7637c478bd9Sstevel@tonic-gate } else { 7647c478bd9Sstevel@tonic-gate mp->mp_minorname = NULL; 7657c478bd9Sstevel@tonic-gate } 7667c478bd9Sstevel@tonic-gate 7677c478bd9Sstevel@tonic-gate if (t == '\n' || t == '\0') { 7687c478bd9Sstevel@tonic-gate devfs_free_minor_perm(mp); 7697c478bd9Sstevel@tonic-gate (*errcb)(MP_IGNORING_LINE_ERR, ln); 7707c478bd9Sstevel@tonic-gate continue; 7717c478bd9Sstevel@tonic-gate } 7727c478bd9Sstevel@tonic-gate if (getnexttoken(cp, &cp, &p, &t) == 0) { 7737c478bd9Sstevel@tonic-gate goto link; 7747c478bd9Sstevel@tonic-gate } 7757c478bd9Sstevel@tonic-gate if (getvalue(p, (int *)&mp->mp_mode) == 0) { 7767c478bd9Sstevel@tonic-gate goto link; 7777c478bd9Sstevel@tonic-gate } 7787c478bd9Sstevel@tonic-gate if (t == '\n' || t == '\0') { /* no owner or group */ 7797c478bd9Sstevel@tonic-gate goto link; 7807c478bd9Sstevel@tonic-gate } 7817c478bd9Sstevel@tonic-gate if (getnexttoken(cp, &cp, &p, &t) == 0) { 7827c478bd9Sstevel@tonic-gate goto link; 7837c478bd9Sstevel@tonic-gate } 7847c478bd9Sstevel@tonic-gate mp->mp_owner = strdup(p); 7857c478bd9Sstevel@tonic-gate if (mp->mp_owner == NULL) { 7867c478bd9Sstevel@tonic-gate (*errcb)(MP_ALLOC_ERR, strlen(p)+1); 7877c478bd9Sstevel@tonic-gate devfs_free_minor_perm(mp); 7887c478bd9Sstevel@tonic-gate continue; 7897c478bd9Sstevel@tonic-gate } else if (t == '\n' || t == '\0') { /* no group */ 7907c478bd9Sstevel@tonic-gate goto link; 7917c478bd9Sstevel@tonic-gate } 7927c478bd9Sstevel@tonic-gate if (getnexttoken(cp, &cp, &p, 0) == 0) { 7937c478bd9Sstevel@tonic-gate goto link; 7947c478bd9Sstevel@tonic-gate } 7957c478bd9Sstevel@tonic-gate mp->mp_group = strdup(p); 7967c478bd9Sstevel@tonic-gate if (mp->mp_group == NULL) { 7977c478bd9Sstevel@tonic-gate (*errcb)(MP_ALLOC_ERR, strlen(p)+1); 7987c478bd9Sstevel@tonic-gate devfs_free_minor_perm(mp); 7997c478bd9Sstevel@tonic-gate continue; 8007c478bd9Sstevel@tonic-gate } 8017c478bd9Sstevel@tonic-gate link: 8027c478bd9Sstevel@tonic-gate if (drvname != NULL) { 8037c478bd9Sstevel@tonic-gate /* 8047c478bd9Sstevel@tonic-gate * We only want the minor perm entry for a 8057c478bd9Sstevel@tonic-gate * the named driver. The driver name is the 8067c478bd9Sstevel@tonic-gate * minor in the clone case. 8077c478bd9Sstevel@tonic-gate */ 8087c478bd9Sstevel@tonic-gate if (strcmp(mp->mp_drvname, "clone") == 0) { 8097c478bd9Sstevel@tonic-gate if (mp->mp_minorname == NULL || 8107c478bd9Sstevel@tonic-gate strcmp(drvname, mp->mp_minorname) != 0) { 8117c478bd9Sstevel@tonic-gate devfs_free_minor_perm(mp); 8127c478bd9Sstevel@tonic-gate continue; 8137c478bd9Sstevel@tonic-gate } 8147c478bd9Sstevel@tonic-gate } else { 8157c478bd9Sstevel@tonic-gate if (strcmp(drvname, mp->mp_drvname) != 0) { 8167c478bd9Sstevel@tonic-gate devfs_free_minor_perm(mp); 8177c478bd9Sstevel@tonic-gate continue; 8187c478bd9Sstevel@tonic-gate } 8197c478bd9Sstevel@tonic-gate } 8207c478bd9Sstevel@tonic-gate } 8217c478bd9Sstevel@tonic-gate if (minor_perms == NULL) { 8227c478bd9Sstevel@tonic-gate minor_perms = mp; 8237c478bd9Sstevel@tonic-gate } else { 8247c478bd9Sstevel@tonic-gate mptail->mp_next = mp; 8257c478bd9Sstevel@tonic-gate } 8267c478bd9Sstevel@tonic-gate mptail = mp; 8277c478bd9Sstevel@tonic-gate 8287c478bd9Sstevel@tonic-gate /* 8297c478bd9Sstevel@tonic-gate * Compute the uid's and gid's here - there are 8307c478bd9Sstevel@tonic-gate * fewer lines in the /etc/minor_perm file than there 8317c478bd9Sstevel@tonic-gate * are devices to be stat(2)ed. And almost every 8327c478bd9Sstevel@tonic-gate * device is 'root sys'. See 1135520. 8337c478bd9Sstevel@tonic-gate */ 8347c478bd9Sstevel@tonic-gate if (mp->mp_owner == NULL || 8357c478bd9Sstevel@tonic-gate strcmp(mp->mp_owner, DEFAULT_DEV_USER) == 0 || 8367c478bd9Sstevel@tonic-gate (pw = getpwnam(mp->mp_owner)) == NULL) { 8377c478bd9Sstevel@tonic-gate mp->mp_uid = root_uid; 8387c478bd9Sstevel@tonic-gate } else { 8397c478bd9Sstevel@tonic-gate mp->mp_uid = pw->pw_uid; 8407c478bd9Sstevel@tonic-gate } 8417c478bd9Sstevel@tonic-gate 8427c478bd9Sstevel@tonic-gate if (mp->mp_group == NULL || 8437c478bd9Sstevel@tonic-gate strcmp(mp->mp_group, DEFAULT_DEV_GROUP) == 0 || 8447c478bd9Sstevel@tonic-gate (gp = getgrnam(mp->mp_group)) == NULL) { 8457c478bd9Sstevel@tonic-gate mp->mp_gid = sys_gid; 8467c478bd9Sstevel@tonic-gate } else { 8477c478bd9Sstevel@tonic-gate mp->mp_gid = gp->gr_gid; 8487c478bd9Sstevel@tonic-gate } 8497c478bd9Sstevel@tonic-gate } 8507c478bd9Sstevel@tonic-gate 8517c478bd9Sstevel@tonic-gate if (fclose(pfd) == EOF) { 8527c478bd9Sstevel@tonic-gate (*errcb)(MP_FCLOSE_ERR, errno); 8537c478bd9Sstevel@tonic-gate } 8547c478bd9Sstevel@tonic-gate 8557c478bd9Sstevel@tonic-gate return (minor_perms); 8567c478bd9Sstevel@tonic-gate } 8577c478bd9Sstevel@tonic-gate 8587c478bd9Sstevel@tonic-gate struct mperm * 8597c478bd9Sstevel@tonic-gate devfs_read_minor_perm(void (*errcb)(minorperm_err_t, int)) 8607c478bd9Sstevel@tonic-gate { 8617c478bd9Sstevel@tonic-gate return (i_devfs_read_minor_perm(NULL, errcb)); 8627c478bd9Sstevel@tonic-gate } 8637c478bd9Sstevel@tonic-gate 8647c478bd9Sstevel@tonic-gate static struct mperm * 8657c478bd9Sstevel@tonic-gate i_devfs_read_minor_perm_by_driver(char *drvname, 8667c478bd9Sstevel@tonic-gate void (*errcb)(minorperm_err_t mp_err, int key)) 8677c478bd9Sstevel@tonic-gate { 8687c478bd9Sstevel@tonic-gate return (i_devfs_read_minor_perm(drvname, errcb)); 8697c478bd9Sstevel@tonic-gate } 8707c478bd9Sstevel@tonic-gate 8717c478bd9Sstevel@tonic-gate /* 8727c478bd9Sstevel@tonic-gate * Free mperm list of entries 8737c478bd9Sstevel@tonic-gate */ 8747c478bd9Sstevel@tonic-gate void 8757c478bd9Sstevel@tonic-gate devfs_free_minor_perm(struct mperm *mplist) 8767c478bd9Sstevel@tonic-gate { 8777c478bd9Sstevel@tonic-gate struct mperm *mp, *next; 8787c478bd9Sstevel@tonic-gate 8797c478bd9Sstevel@tonic-gate for (mp = mplist; mp != NULL; mp = next) { 8807c478bd9Sstevel@tonic-gate next = mp->mp_next; 8817c478bd9Sstevel@tonic-gate 8827c478bd9Sstevel@tonic-gate if (mp->mp_drvname) 8837c478bd9Sstevel@tonic-gate free(mp->mp_drvname); 8847c478bd9Sstevel@tonic-gate if (mp->mp_minorname) 8857c478bd9Sstevel@tonic-gate free(mp->mp_minorname); 8867c478bd9Sstevel@tonic-gate if (mp->mp_owner) 8877c478bd9Sstevel@tonic-gate free(mp->mp_owner); 8887c478bd9Sstevel@tonic-gate if (mp->mp_group) 8897c478bd9Sstevel@tonic-gate free(mp->mp_group); 8907c478bd9Sstevel@tonic-gate free(mp); 8917c478bd9Sstevel@tonic-gate } 8927c478bd9Sstevel@tonic-gate } 8937c478bd9Sstevel@tonic-gate 8947c478bd9Sstevel@tonic-gate static int 8957c478bd9Sstevel@tonic-gate i_devfs_add_perm_entry(nvlist_t *nvl, struct mperm *mp) 8967c478bd9Sstevel@tonic-gate { 8977c478bd9Sstevel@tonic-gate int err; 8987c478bd9Sstevel@tonic-gate 8997c478bd9Sstevel@tonic-gate err = nvlist_add_string(nvl, mp->mp_drvname, mp->mp_minorname); 9007c478bd9Sstevel@tonic-gate if (err != 0) 9017c478bd9Sstevel@tonic-gate return (err); 9027c478bd9Sstevel@tonic-gate 9037c478bd9Sstevel@tonic-gate err = nvlist_add_int32(nvl, "mode", (int32_t)mp->mp_mode); 9047c478bd9Sstevel@tonic-gate if (err != 0) 9057c478bd9Sstevel@tonic-gate return (err); 9067c478bd9Sstevel@tonic-gate 9077c478bd9Sstevel@tonic-gate err = nvlist_add_int32(nvl, "uid", (int32_t)mp->mp_uid); 9087c478bd9Sstevel@tonic-gate if (err != 0) 9097c478bd9Sstevel@tonic-gate return (err); 9107c478bd9Sstevel@tonic-gate 9117c478bd9Sstevel@tonic-gate err = nvlist_add_int32(nvl, "gid", (int32_t)mp->mp_gid); 9127c478bd9Sstevel@tonic-gate return (err); 9137c478bd9Sstevel@tonic-gate } 9147c478bd9Sstevel@tonic-gate 9157c478bd9Sstevel@tonic-gate static nvlist_t * 9167c478bd9Sstevel@tonic-gate i_devfs_minor_perm_nvlist(struct mperm *mplist, 9177c478bd9Sstevel@tonic-gate void (*errcb)(minorperm_err_t, int)) 9187c478bd9Sstevel@tonic-gate { 9197c478bd9Sstevel@tonic-gate int err; 9207c478bd9Sstevel@tonic-gate struct mperm *mp; 9217c478bd9Sstevel@tonic-gate nvlist_t *nvl = NULL; 9227c478bd9Sstevel@tonic-gate 9237c478bd9Sstevel@tonic-gate if ((err = nvlist_alloc(&nvl, 0, 0)) != 0) { 9247c478bd9Sstevel@tonic-gate (*errcb)(MP_NVLIST_ERR, err); 9257c478bd9Sstevel@tonic-gate return (NULL); 9267c478bd9Sstevel@tonic-gate } 9277c478bd9Sstevel@tonic-gate 9287c478bd9Sstevel@tonic-gate for (mp = mplist; mp != NULL; mp = mp->mp_next) { 9297c478bd9Sstevel@tonic-gate if ((err = i_devfs_add_perm_entry(nvl, mp)) != 0) { 9307c478bd9Sstevel@tonic-gate (*errcb)(MP_NVLIST_ERR, err); 9317c478bd9Sstevel@tonic-gate nvlist_free(nvl); 9327c478bd9Sstevel@tonic-gate return (NULL); 9337c478bd9Sstevel@tonic-gate } 9347c478bd9Sstevel@tonic-gate } 9357c478bd9Sstevel@tonic-gate 9367c478bd9Sstevel@tonic-gate return (nvl); 9377c478bd9Sstevel@tonic-gate } 9387c478bd9Sstevel@tonic-gate 9397c478bd9Sstevel@tonic-gate /* 9407c478bd9Sstevel@tonic-gate * Load all minor perm entries into the kernel 9417c478bd9Sstevel@tonic-gate * Done at boot time via devfsadm 9427c478bd9Sstevel@tonic-gate */ 9437c478bd9Sstevel@tonic-gate int 9447c478bd9Sstevel@tonic-gate devfs_load_minor_perm(struct mperm *mplist, 9457c478bd9Sstevel@tonic-gate void (*errcb)(minorperm_err_t, int)) 9467c478bd9Sstevel@tonic-gate { 9477c478bd9Sstevel@tonic-gate int err; 9487c478bd9Sstevel@tonic-gate char *buf = NULL; 9497c478bd9Sstevel@tonic-gate size_t buflen; 9507c478bd9Sstevel@tonic-gate nvlist_t *nvl; 9517c478bd9Sstevel@tonic-gate 9527c478bd9Sstevel@tonic-gate nvl = i_devfs_minor_perm_nvlist(mplist, errcb); 9537c478bd9Sstevel@tonic-gate if (nvl == NULL) 9547c478bd9Sstevel@tonic-gate return (-1); 9557c478bd9Sstevel@tonic-gate 9567c478bd9Sstevel@tonic-gate if (nvlist_pack(nvl, &buf, &buflen, NV_ENCODE_NATIVE, 0) != 0) { 9577c478bd9Sstevel@tonic-gate nvlist_free(nvl); 9587c478bd9Sstevel@tonic-gate return (-1); 9597c478bd9Sstevel@tonic-gate } 9607c478bd9Sstevel@tonic-gate 9617c478bd9Sstevel@tonic-gate err = modctl(MODLOADMINORPERM, buf, buflen); 9627c478bd9Sstevel@tonic-gate nvlist_free(nvl); 9637c478bd9Sstevel@tonic-gate free(buf); 9647c478bd9Sstevel@tonic-gate 9657c478bd9Sstevel@tonic-gate return (err); 9667c478bd9Sstevel@tonic-gate } 9677c478bd9Sstevel@tonic-gate 9687c478bd9Sstevel@tonic-gate /* 9697c478bd9Sstevel@tonic-gate * Add/remove minor perm entry for a driver 9707c478bd9Sstevel@tonic-gate */ 9717c478bd9Sstevel@tonic-gate static int 9727c478bd9Sstevel@tonic-gate i_devfs_update_minor_perm(char *drv, int ctl, 9737c478bd9Sstevel@tonic-gate void (*errcb)(minorperm_err_t, int)) 9747c478bd9Sstevel@tonic-gate { 9757c478bd9Sstevel@tonic-gate int err; 9767c478bd9Sstevel@tonic-gate char *buf; 9777c478bd9Sstevel@tonic-gate size_t buflen; 9787c478bd9Sstevel@tonic-gate nvlist_t *nvl; 9797c478bd9Sstevel@tonic-gate struct mperm *mplist; 9807c478bd9Sstevel@tonic-gate 9817c478bd9Sstevel@tonic-gate mplist = i_devfs_read_minor_perm_by_driver(drv, errcb); 9827c478bd9Sstevel@tonic-gate 9837c478bd9Sstevel@tonic-gate nvl = i_devfs_minor_perm_nvlist(mplist, errcb); 9847c478bd9Sstevel@tonic-gate if (nvl == NULL) 9857c478bd9Sstevel@tonic-gate return (-1); 9867c478bd9Sstevel@tonic-gate 9877c478bd9Sstevel@tonic-gate buf = NULL; 9887c478bd9Sstevel@tonic-gate if (nvlist_pack(nvl, &buf, &buflen, NV_ENCODE_NATIVE, 0) != 0) { 9897c478bd9Sstevel@tonic-gate nvlist_free(nvl); 9907c478bd9Sstevel@tonic-gate return (-1); 9917c478bd9Sstevel@tonic-gate } 9927c478bd9Sstevel@tonic-gate 9937c478bd9Sstevel@tonic-gate err = modctl(ctl, buf, buflen); 9947c478bd9Sstevel@tonic-gate nvlist_free(nvl); 9957c478bd9Sstevel@tonic-gate devfs_free_minor_perm(mplist); 9967c478bd9Sstevel@tonic-gate free(buf); 9977c478bd9Sstevel@tonic-gate 9987c478bd9Sstevel@tonic-gate return (err); 9997c478bd9Sstevel@tonic-gate } 10007c478bd9Sstevel@tonic-gate 10017c478bd9Sstevel@tonic-gate int 10027c478bd9Sstevel@tonic-gate devfs_add_minor_perm(char *drv, 10037c478bd9Sstevel@tonic-gate void (*errcb)(minorperm_err_t, int)) 10047c478bd9Sstevel@tonic-gate { 10057c478bd9Sstevel@tonic-gate return (i_devfs_update_minor_perm(drv, MODADDMINORPERM, errcb)); 10067c478bd9Sstevel@tonic-gate } 10077c478bd9Sstevel@tonic-gate 10087c478bd9Sstevel@tonic-gate int 10097c478bd9Sstevel@tonic-gate devfs_rm_minor_perm(char *drv, 10107c478bd9Sstevel@tonic-gate void (*errcb)(minorperm_err_t, int)) 10117c478bd9Sstevel@tonic-gate { 10127c478bd9Sstevel@tonic-gate return (i_devfs_update_minor_perm(drv, MODREMMINORPERM, errcb)); 10137c478bd9Sstevel@tonic-gate } 1014