1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright (c) 1999, 2010, Oracle and/or its affiliates. All rights reserved.
23 */
24
25 #include <stdio.h>
26 #include <stdlib.h>
27 #include <strings.h>
28 #include <auth_attr.h>
29 #include <prof_attr.h>
30 #include <user_attr.h>
31 #include <project.h>
32 #include <secdb.h>
33 #include <pwd.h>
34 #include <unistd.h>
35 #include <priv.h>
36 #include <errno.h>
37 #include <ctype.h>
38 #include <nss.h>
39 #include <bsm/libbsm.h>
40 #include <tsol/label.h>
41 #include "funcs.h"
42 #include "messages.h"
43 #undef GROUP
44 #include "userdefs.h"
45
46 typedef struct ua_key {
47 const char *key;
48 const char *(*check)(const char *);
49 const char *errstr;
50 char *newvalue;
51 } ua_key_t;
52
53 static const char role[] = "role name";
54 static const char prof[] = "profile name";
55 static const char proj[] = "project name";
56 static const char priv[] = "privilege set";
57 static const char auth[] = "authorization";
58 static const char type[] = "user type";
59 static const char lock[] = "lock_after_retries value";
60 static const char label[] = "label";
61 static const char idlecmd[] = "idlecmd value";
62 static const char idletime[] = "idletime value";
63 static const char auditflags[] = "audit mask";
64 static char auditerr[256];
65
66
67 static const char *check_auth(const char *);
68 static const char *check_prof(const char *);
69 static const char *check_role(const char *);
70 static const char *check_proj(const char *);
71 static const char *check_privset(const char *);
72 static const char *check_type(const char *);
73 static const char *check_lock_after_retries(const char *);
74 static const char *check_label(const char *);
75 static const char *check_idlecmd(const char *);
76 static const char *check_idletime(const char *);
77 static const char *check_auditflags(const char *);
78
79 int nkeys;
80
81 static ua_key_t keys[] = {
82 /* First entry is always set correctly in main() */
83 { USERATTR_TYPE_KW, check_type, type },
84 { USERATTR_AUTHS_KW, check_auth, auth },
85 { USERATTR_PROFILES_KW, check_prof, prof },
86 { USERATTR_ROLES_KW, check_role, role },
87 { USERATTR_DEFAULTPROJ_KW, check_proj, proj },
88 { USERATTR_LIMPRIV_KW, check_privset, priv },
89 { USERATTR_DFLTPRIV_KW, check_privset, priv },
90 { USERATTR_LOCK_AFTER_RETRIES_KW, check_lock_after_retries, lock },
91 { USERATTR_CLEARANCE, check_label, label },
92 { USERATTR_MINLABEL, check_label, label },
93 { USERATTR_IDLECMD_KW, check_idlecmd, idlecmd },
94 { USERATTR_IDLETIME_KW, check_idletime, idletime },
95 { USERATTR_AUDIT_FLAGS_KW, check_auditflags, auditflags },
96 };
97
98 #define NKEYS (sizeof (keys)/sizeof (ua_key_t))
99
100 /*
101 * Change a key, there are three different call sequences:
102 *
103 * key, value - key with option letter, value.
104 * NULL, value - -K key=value option.
105 */
106
107 void
108 change_key(const char *key, char *value)
109 {
110 int i;
111 const char *res;
112
113 if (key == NULL) {
114 key = value;
115 value = strchr(value, '=');
116 /* Bad value */
117 if (value == NULL) {
118 errmsg(M_INVALID_VALUE);
119 exit(EX_BADARG);
120 }
121 *value++ = '\0';
122 }
123
124 for (i = 0; i < NKEYS; i++) {
125 if (strcmp(key, keys[i].key) == 0) {
126 if (keys[i].newvalue != NULL) {
127 /* Can't set a value twice */
128 errmsg(M_REDEFINED_KEY, key);
129 exit(EX_BADARG);
130 }
131
132 if (keys[i].check != NULL &&
133 (res = keys[i].check(value)) != NULL) {
134 errmsg(M_INVALID, res, keys[i].errstr);
135 exit(EX_BADARG);
136 }
137 keys[i].newvalue = value;
138 nkeys++;
139 return;
140 }
141 }
142 errmsg(M_INVALID_KEY, key);
143 exit(EX_BADARG);
144 }
145
146 /*
147 * Add the keys to the argument vector.
148 */
149 void
150 addkey_args(char **argv, int *index)
151 {
152 int i;
153
154 for (i = 0; i < NKEYS; i++) {
155 const char *key = keys[i].key;
156 char *val = keys[i].newvalue;
157 size_t len;
158 char *arg;
159
160 if (val == NULL)
161 continue;
162
163 len = strlen(key) + strlen(val) + 2;
164 arg = malloc(len);
165
166 (void) snprintf(arg, len, "%s=%s", key, val);
167 argv[(*index)++] = "-K";
168 argv[(*index)++] = arg;
169 }
170 }
171
172 /*
173 * Propose a default value for a key and get the actual value back.
174 * If the proposed default value is NULL, return the actual value set.
175 * The key argument is the user_attr key.
176 */
177 char *
178 getsetdefval(const char *key, char *dflt)
179 {
180 int i;
181
182 for (i = 0; i < NKEYS; i++)
183 if (strcmp(keys[i].key, key) == 0)
184 if (keys[i].newvalue != NULL)
185 return (keys[i].newvalue);
186 else
187 return (keys[i].newvalue = dflt);
188 return (NULL);
189 }
190
191 char *
192 getusertype(char *cmdname)
193 {
194 static char usertype[MAX_TYPE_LENGTH];
195 char *cmd;
196
197 if (cmd = strrchr(cmdname, '/'))
198 ++cmd;
199 else
200 cmd = cmdname;
201
202 /* get user type based on the program name */
203 if (strncmp(cmd, CMD_PREFIX_USER,
204 strlen(CMD_PREFIX_USER)) == 0)
205 strcpy(usertype, USERATTR_TYPE_NORMAL_KW);
206 else
207 strcpy(usertype, USERATTR_TYPE_NONADMIN_KW);
208
209 return (usertype);
210 }
211
212 int
213 is_role(char *usertype)
214 {
215 if (strcmp(usertype, USERATTR_TYPE_NONADMIN_KW) == 0)
216 return (1);
217 /* not a role */
218 return (0);
219 }
220
221 /*
222 * Verifies the provided list of authorizations are all valid.
223 *
224 * Returns NULL if all authorization names are valid.
225 * Otherwise, returns the invalid authorization name
226 *
227 */
228 static const char *
229 check_auth(const char *auths)
230 {
231 char *authname;
232 authattr_t *result;
233 char *tmp;
234 struct passwd *pw;
235 int have_grant = 0;
236
237 tmp = strdup(auths);
238 if (tmp == NULL) {
239 errmsg(M_NOSPACE);
240 exit(EX_FAILURE);
241 }
242
243 authname = strtok(tmp, AUTH_SEP);
244 pw = getpwuid(getuid());
245 if (pw == NULL) {
246 return (authname);
247 }
248
249 while (authname != NULL) {
250 char *suffix;
251 char *authtoks;
252
253 /* Check if user has been granted this authorization */
254 if (!chkauthattr(authname, pw->pw_name))
255 return (authname);
256
257 /* Remove named object after slash */
258 if ((suffix = index(authname, KV_OBJECTCHAR)) != NULL)
259 *suffix = '\0';
260
261 /* Find the suffix */
262 if ((suffix = rindex(authname, '.')) == NULL)
263 return (authname);
264
265 /* Check for existence in auth_attr */
266 suffix++;
267 if (strcmp(suffix, KV_WILDCARD)) { /* Not a wildcard */
268 result = getauthnam(authname);
269 if (result == NULL) {
270 /* can't find the auth */
271 free_authattr(result);
272 return (authname);
273 }
274 free_authattr(result);
275 }
276
277 /* Check if user can delegate this authorization */
278 if (strcmp(suffix, "grant")) { /* Not a grant option */
279 authtoks = malloc(strlen(authname) + sizeof ("grant"));
280 strcpy(authtoks, authname);
281 have_grant = 0;
282 while ((suffix = rindex(authtoks, '.')) &&
283 !have_grant) {
284 strcpy(suffix, ".grant");
285 if (chkauthattr(authtoks, pw->pw_name))
286 have_grant = 1;
287 else
288 *suffix = '\0';
289 }
290 if (!have_grant)
291 return (authname);
292 }
293 authname = strtok(NULL, AUTH_SEP);
294 }
295 free(tmp);
296 return (NULL);
297 }
298
299 /*
300 * Verifies the provided list of profile names are valid.
301 *
302 * Returns NULL if all profile names are valid.
303 * Otherwise, returns the invalid profile name
304 *
305 */
306 static const char *
307 check_prof(const char *profs)
308 {
309 char *profname;
310 profattr_t *result;
311 char *tmp;
312
313 tmp = strdup(profs);
314 if (tmp == NULL) {
315 errmsg(M_NOSPACE);
316 exit(EX_FAILURE);
317 }
318
319 profname = strtok(tmp, PROF_SEP);
320 while (profname != NULL) {
321 result = getprofnam(profname);
322 if (result == NULL) {
323 /* can't find the profile */
324 return (profname);
325 }
326 free_profattr(result);
327 profname = strtok(NULL, PROF_SEP);
328 }
329 free(tmp);
330 return (NULL);
331 }
332
333
334 /*
335 * Verifies the provided list of role names are valid.
336 *
337 * Returns NULL if all role names are valid.
338 * Otherwise, returns the invalid role name
339 *
340 */
341 static const char *
342 check_role(const char *roles)
343 {
344 char *rolename;
345 userattr_t *result;
346 char *utype;
347 char *tmp;
348
349 tmp = strdup(roles);
350 if (tmp == NULL) {
351 errmsg(M_NOSPACE);
352 exit(EX_FAILURE);
353 }
354
355 rolename = strtok(tmp, ROLE_SEP);
356 while (rolename != NULL) {
357 result = getusernam(rolename);
358 if (result == NULL) {
359 /* can't find the rolename */
360 return (rolename);
361 }
362 /* Now, make sure it is a role */
363 utype = kva_match(result->attr, USERATTR_TYPE_KW);
364 if (utype == NULL) {
365 /* no user type defined. not a role */
366 free_userattr(result);
367 return (rolename);
368 }
369 if (strcmp(utype, USERATTR_TYPE_NONADMIN_KW) != 0) {
370 free_userattr(result);
371 return (rolename);
372 }
373 free_userattr(result);
374 rolename = strtok(NULL, ROLE_SEP);
375 }
376 free(tmp);
377 return (NULL);
378 }
379
380 static const char *
381 check_proj(const char *proj)
382 {
383 if (getprojidbyname(proj) < 0) {
384 return (proj);
385 } else {
386 return (NULL);
387 }
388 }
389
390 static const char *
391 check_privset(const char *pset)
392 {
393 priv_set_t *tmp;
394 const char *res;
395
396 tmp = priv_str_to_set(pset, ",", &res);
397
398 if (tmp != NULL) {
399 res = NULL;
400 priv_freeset(tmp);
401 } else if (res == NULL)
402 res = strerror(errno);
403
404 return (res);
405 }
406
407 static const char *
408 check_type(const char *type)
409 {
410 if (strcmp(type, USERATTR_TYPE_NONADMIN_KW) != 0 &&
411 strcmp(type, USERATTR_TYPE_NORMAL_KW) != 0)
412 return (type);
413
414 return (NULL);
415 }
416
417 static const char *
418 check_lock_after_retries(const char *keyval)
419 {
420 if (keyval != NULL) {
421 if ((strcasecmp(keyval, "no") != 0) &&
422 (strcasecmp(keyval, "yes") != 0) &&
423 (*keyval != '\0')) {
424 return (keyval);
425 }
426 }
427 return (NULL);
428 }
429
430 static const char *
431 check_label(const char *labelstr)
432 {
433 int err;
434 m_label_t *lbl = NULL;
435
436 if (!is_system_labeled())
437 return (NULL);
438
439 err = str_to_label(labelstr, &lbl, MAC_LABEL, L_NO_CORRECTION, NULL);
440 m_label_free(lbl);
441
442 if (err == -1)
443 return (labelstr);
444
445 return (NULL);
446 }
447
448 static const char *
449 check_idlecmd(const char *cmd)
450 {
451 if ((strcmp(cmd, USERATTR_IDLECMD_LOCK_KW) != 0) &&
452 (strcmp(cmd, USERATTR_IDLECMD_LOGOUT_KW) != 0)) {
453 return (cmd);
454 }
455
456 return (NULL);
457 }
458
459 static const char *
460 check_idletime(const char *time)
461 {
462 int c;
463 unsigned char *up = (unsigned char *)time;
464
465 c = *up;
466 while (c != '\0') {
467 if (!isdigit(c))
468 return (time);
469 c = *++up;
470 }
471
472 return (NULL);
473 }
474
475 static const char *
476 check_auditflags(const char *auditflags)
477 {
478 au_mask_t mask;
479 char *flags;
480 char *last = NULL;
481 char *err = "NULL";
482
483 /* if deleting audit_flags */
484 if (*auditflags == '\0') {
485 return (NULL);
486 }
487
488 if ((flags = _strdup_null((char *)auditflags)) == NULL) {
489 errmsg(M_NOSPACE);
490 exit(EX_FAILURE);
491 }
492
493 if (!__chkflags(_strtok_escape(flags, KV_AUDIT_DELIMIT, &last), &mask,
494 B_FALSE, &err)) {
495 (void) snprintf(auditerr, sizeof (auditerr),
496 "always mask \"%s\"", err);
497 free(flags);
498 return (auditerr);
499 }
500 if (!__chkflags(_strtok_escape(NULL, KV_AUDIT_DELIMIT, &last), &mask,
501 B_FALSE, &err)) {
502 (void) snprintf(auditerr, sizeof (auditerr),
503 "never mask \"%s\"", err);
504 free(flags);
505 return (auditerr);
506 }
507 if (last != NULL) {
508 (void) snprintf(auditerr, sizeof (auditerr), "\"%s\"",
509 auditflags);
510 free(flags);
511 return (auditerr);
512 }
513 free(flags);
514
515 return (NULL);
516 }