summaryrefslogtreecommitdiff
path: root/usr.bin/su/su.c
diff options
context:
space:
mode:
authorchristos <christos@NetBSD.org>1999-03-15 08:05:07 +0000
committerchristos <christos@NetBSD.org>1999-03-15 08:05:07 +0000
commit024eb1b8d7c52d83bf034383f9cdfa5dc7bd3806 (patch)
treed6c415f96edebe02618e12df0f643328a117e49d /usr.bin/su/su.c
parente2d0bfbb09f1b8e240d74adad13dbe1e873ffd1d (diff)
- Add support for Solaris style shadow password files
- Enable su - option if BSD4_4 is not defined - Add compile time option ROOTAUTH (not enabled), where people belonging to the ROOTAUTH group can su to root by supplying their own password.
Diffstat (limited to 'usr.bin/su/su.c')
-rw-r--r--usr.bin/su/su.c87
1 files changed, 71 insertions, 16 deletions
diff --git a/usr.bin/su/su.c b/usr.bin/su/su.c
index b308259c656..d2088c1bea6 100644
--- a/usr.bin/su/su.c
+++ b/usr.bin/su/su.c
@@ -1,4 +1,4 @@
-/* $NetBSD: su.c,v 1.29 1999/02/20 00:20:59 scottr Exp $ */
+/* $NetBSD: su.c,v 1.30 1999/03/15 08:05:07 christos Exp $ */
/*
* Copyright (c) 1988 The Regents of the University of California.
@@ -44,7 +44,7 @@ __COPYRIGHT(
#if 0
static char sccsid[] = "@(#)su.c 8.3 (Berkeley) 4/2/94";*/
#else
-__RCSID("$NetBSD: su.c,v 1.29 1999/02/20 00:20:59 scottr Exp $");
+__RCSID("$NetBSD: su.c,v 1.30 1999/03/15 08:05:07 christos Exp $");
#endif
#endif /* not lint */
@@ -56,6 +56,9 @@ __RCSID("$NetBSD: su.c,v 1.29 1999/02/20 00:20:59 scottr Exp $");
#include <grp.h>
#include <paths.h>
#include <pwd.h>
+#ifdef SHADOWPASSWORDS
+#include <shadow.h>
+#endif
#include <stdio.h>
#ifdef SKEY
#include <skey.h>
@@ -87,7 +90,6 @@ static int koktologin __P((char *, char *, char *));
#define SUGROUP "wheel"
#endif
-
int main __P((int, char **));
static int chshell __P((const char *));
@@ -102,6 +104,9 @@ main(argc, argv)
extern char *__progname;
extern char **environ;
struct passwd *pwd;
+#ifdef SHADOWPASSWORDS
+ struct spwd *shapwd;
+#endif
char *p;
struct group *gr;
#ifdef BSD4_4
@@ -111,6 +116,7 @@ main(argc, argv)
int asme, ch, asthem, fastlogin, prio;
enum { UNSET, YES, NO } iscsh = UNSET;
char *user, *shell, *avshell, *username, *cleanenv[10], **np;
+ char *userpass;
char shellbuf[MAXPATHLEN], avshellbuf[MAXPATHLEN];
asme = asthem = fastlogin = 0;
@@ -143,6 +149,14 @@ main(argc, argv)
}
argv += optind;
+#ifndef BSD4_4
+ if (*argv && strcmp(*argv, "-") == 0) {
+ asme = 0;
+ asthem = 1;
+ argv++;
+ }
+#endif
+
errno = 0;
prio = getpriority(PRIO_PROCESS, 0);
if (errno)
@@ -159,7 +173,8 @@ main(argc, argv)
if (pwd == NULL)
errx(1, "who are you?");
username = strdup(pwd->pw_name);
- if (username == NULL)
+ userpass = strdup(pwd->pw_passwd);
+ if (username == NULL || userpass == NULL)
err(1, "strdup");
if (asme) {
@@ -184,26 +199,54 @@ main(argc, argv)
&& (!use_kerberos || kerberos(username, user, pwd->pw_uid))
#endif
) {
+ char *pass = pwd->pw_passwd;
+ int ok = pwd->pw_uid != 0;
+ char **g;
+
/*
* Only allow those in group SUGROUP to su to root,
* but only if that group has any members.
* If SUGROUP has no members, allow anyone to su root
*/
- if (pwd->pw_uid == 0 &&
+ if (!ok &&
(gr = getgrnam(SUGROUP)) && *gr->gr_mem) {
- char **g;
for (g = gr->gr_mem; ; g++) {
- if (*g == NULL)
- errx(1,
- "you are not listed in the correct secondary group (%s) to su %s.",
- SUGROUP, user);
- if (strcmp(username, *g) == 0)
+ if (*g == NULL) {
+ ok = 0;
break;
+ }
+ if (strcmp(username, *g) == 0) {
+ ok = 1;
+ break;
+ }
}
}
+#ifdef ROOTAUTH
+ /*
+ * Allow those in group rootauth to su to root, by supplying
+ * their own password.
+ */
+ if (!ok && (gr = getgrnam(ROOTAUTH)))
+ for (g = gr->gr_mem;; ++g) {
+ if (!*g) {
+ ok = 0;
+ break;
+ }
+ if (!strcmp(username, *g)) {
+ pass = userpass;
+ user = username;
+ ok = 1;
+ break;
+ }
+ }
+#endif
+ if (!ok)
+ errx(1,
+ "you are not listed in the correct secondary group (%s) to su %s.",
+ SUGROUP, user);
/* if target requires a password, verify it */
- if (*pwd->pw_passwd) {
+ if (*pass) {
p = getpass("Password:");
#ifdef SKEY
if (strcasecmp(p, "s/key") == 0) {
@@ -217,14 +260,26 @@ main(argc, argv)
} else
#endif
- if (strcmp(pwd->pw_passwd, crypt(p, pwd->pw_passwd))) {
-#ifdef SKEY
+#ifdef SHADOWPASSWORDS
+ if (strcmp(pass, "x") == 0) {
+ if ((shapwd = getspnam(user)) == NULL)
+ errx(1,
+ "Could not find shadow passwd entry for %s",
+ user);
+ if (strcmp(shapwd->sp_pwdp,
+ crypt(p, shapwd->sp_pwdp))) {
+ goto badlogin;
+ }
+ } else
+#endif
+ if (strcmp(pass, crypt(p, pass))) {
+#if defined(SKEY) || defined(SHADOWPASSWORDS)
badlogin:
#endif
fprintf(stderr, "Sorry\n");
syslog(LOG_AUTH|LOG_WARNING,
"BAD SU %s to %s%s", username,
- user, ontty());
+ pwd->pw_name, ontty());
exit(1);
}
}
@@ -323,7 +378,7 @@ badlogin:
#endif
if (ruid != 0)
syslog(LOG_NOTICE|LOG_AUTH, "%s to %s%s",
- username, user, ontty());
+ username, pwd->pw_name, ontty());
(void)setpriority(PRIO_PROCESS, 0, prio);