#include "config.h"
#include <sys/types.h>
#include <sys/param.h>
#include <sys/stat.h>
#include <stdio.h>
#ifdef STDC_HEADERS
# include <stdlib.h>
# include <stddef.h>
#else
# ifdef HAVE_STDLIB_H
# include <stdlib.h>
# endif
#endif
#ifdef HAVE_STRING_H
# include <string.h>
#else
# ifdef HAVE_STRINGS_H
# include <strings.h>
# endif
#endif
#ifdef HAVE_UNISTD_H
# include <unistd.h>
#endif
#ifdef HAVE_FNMATCH
# include <fnmatch.h>
#endif
#ifdef HAVE_NETGROUP_H
# include <netgroup.h>
#endif
#include <ctype.h>
#include <pwd.h>
#include <grp.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>
#ifdef HAVE_DIRENT_H
# include <dirent.h>
# define NAMLEN(dirent) strlen((dirent)->d_name)
#else
# define dirent direct
# define NAMLEN(dirent) (dirent)->d_namlen
# ifdef HAVE_SYS_NDIR_H
# include <sys/ndir.h>
# endif
# ifdef HAVE_SYS_DIR_H
# include <sys/dir.h>
# endif
# ifdef HAVE_NDIR_H
# include <ndir.h>
# endif
#endif
#include "sudo.h"
#include "parse.h"
#include "interfaces.h"
#ifndef HAVE_FNMATCH
# include "emul/fnmatch.h"
#endif
#ifndef lint
static const char rcsid[] = "$Sudo: parse.c,v 1.161 2004/08/24 18:01:13 millert Exp $";
#endif
int parse_error = FALSE;
extern int keepall;
extern FILE *yyin, *yyout;
static int has_meta __P((char *));
void init_parser __P((void));
int
sudoers_lookup(pwflag)
int pwflag;
{
int error, nopass;
enum def_tupple pwcheck;
rewind(sudoers_fp);
yyin = sudoers_fp;
yyout = stdout;
init_parser();
if (pwflag > 0)
keepall = TRUE;
set_perms(PERM_RUNAS);
error = yyparse();
(void) fclose(sudoers_fp);
sudoers_fp = NULL;
if (error || parse_error) {
set_perms(PERM_ROOT);
return(VALIDATE_ERROR);
}
if (pwflag)
pwcheck = (pwflag == -1) ? never : sudo_defs_table[pwflag].sd_un.tuple;
else
pwcheck = 0;
if (def_authenticate)
error = VALIDATE_NOT_OK;
else
error = VALIDATE_NOT_OK | FLAG_NOPASS;
if (pwcheck) {
SET(error, FLAG_NO_CHECK);
} else {
SET(error, FLAG_NO_HOST);
if (!top)
SET(error, FLAG_NO_USER);
}
nopass = -1;
if (pwflag) {
int found;
if (pwcheck == always && def_authenticate)
nopass = FLAG_CHECK_USER;
else if (pwcheck == never || !def_authenticate)
nopass = FLAG_NOPASS;
found = 0;
while (top) {
if (host_matches == TRUE) {
found = 1;
if (pwcheck == any && no_passwd == TRUE)
nopass = FLAG_NOPASS;
else if (pwcheck == all && nopass != 0)
nopass = (no_passwd == TRUE) ? FLAG_NOPASS : 0;
}
top--;
}
if (found) {
set_perms(PERM_ROOT);
if (nopass == -1)
nopass = 0;
return(VALIDATE_OK | nopass);
}
} else {
while (top) {
if (host_matches == TRUE) {
CLR(error, FLAG_NO_HOST);
if (runas_matches == TRUE && cmnd_matches == TRUE) {
set_perms(PERM_ROOT);
return(VALIDATE_OK |
(no_passwd == TRUE ? FLAG_NOPASS : 0) |
(no_execve == TRUE ? FLAG_NOEXEC : 0));
} else if ((runas_matches == TRUE && cmnd_matches == FALSE) ||
(runas_matches == FALSE && cmnd_matches == TRUE)) {
set_perms(PERM_ROOT);
return(VALIDATE_NOT_OK |
(no_passwd == TRUE ? FLAG_NOPASS : 0) |
(no_execve == TRUE ? FLAG_NOEXEC : 0));
}
}
top--;
}
}
set_perms(PERM_ROOT);
if (nopass == -1)
nopass = 0;
return(error | nopass);
}
int
command_matches(sudoers_cmnd, sudoers_args)
char *sudoers_cmnd;
char *sudoers_args;
{
struct stat sudoers_stat;
struct dirent *dent;
char buf[PATH_MAX];
DIR *dirp;
if (strchr(user_cmnd, '/') == NULL) {
if (strcmp(sudoers_cmnd, "sudoedit") != 0 ||
strcmp(user_cmnd, "sudoedit") != 0)
return(FALSE);
if (!sudoers_args ||
(!user_args && sudoers_args && !strcmp("\"\"", sudoers_args)) ||
(sudoers_args &&
fnmatch(sudoers_args, user_args ? user_args : "", 0) == 0)) {
if (safe_cmnd)
free(safe_cmnd);
safe_cmnd = estrdup(sudoers_cmnd);
return(TRUE);
} else
return(FALSE);
}
if (has_meta(sudoers_cmnd)) {
if (fnmatch(sudoers_cmnd, user_cmnd, FNM_PATHNAME) != 0)
return(FALSE);
if (!sudoers_args ||
(!user_args && sudoers_args && !strcmp("\"\"", sudoers_args)) ||
(sudoers_args &&
fnmatch(sudoers_args, user_args ? user_args : "", 0) == 0)) {
if (safe_cmnd)
free(safe_cmnd);
safe_cmnd = estrdup(user_cmnd);
return(TRUE);
} else
return(FALSE);
} else {
size_t dlen = strlen(sudoers_cmnd);
if (sudoers_cmnd[dlen - 1] != '/') {
char *base;
if ((base = strrchr(sudoers_cmnd, '/')) == NULL)
base = sudoers_cmnd;
else
base++;
if (strcmp(user_base, base) != 0 ||
stat(sudoers_cmnd, &sudoers_stat) == -1)
return(FALSE);
if (user_stat->st_dev != sudoers_stat.st_dev ||
user_stat->st_ino != sudoers_stat.st_ino)
return(FALSE);
if (!sudoers_args ||
(!user_args && sudoers_args && !strcmp("\"\"", sudoers_args)) ||
(sudoers_args &&
fnmatch(sudoers_args, user_args ? user_args : "", 0) == 0)) {
if (safe_cmnd)
free(safe_cmnd);
safe_cmnd = estrdup(sudoers_cmnd);
return(TRUE);
} else
return(FALSE);
}
dirp = opendir(sudoers_cmnd);
if (dirp == NULL)
return(FALSE);
if (strlcpy(buf, sudoers_cmnd, sizeof(buf)) >= sizeof(buf))
return(FALSE);
while ((dent = readdir(dirp)) != NULL) {
buf[dlen] = '\0';
if (strlcat(buf, dent->d_name, sizeof(buf)) >= sizeof(buf))
continue;
if (strcmp(user_base, dent->d_name) != 0 ||
stat(buf, &sudoers_stat) == -1)
continue;
if (user_stat->st_dev == sudoers_stat.st_dev &&
user_stat->st_ino == sudoers_stat.st_ino) {
if (safe_cmnd)
free(safe_cmnd);
safe_cmnd = estrdup(buf);
break;
}
}
closedir(dirp);
return(dent != NULL);
}
}
int
addr_matches(n)
char *n;
{
int i;
char *m;
struct in_addr addr, mask;
if ((m = strchr(n, '/'))) {
*m++ = '\0';
addr.s_addr = inet_addr(n);
if (strchr(m, '.'))
mask.s_addr = inet_addr(m);
else {
i = 32 - atoi(m);
mask.s_addr = 0xffffffff;
mask.s_addr >>= i;
mask.s_addr <<= i;
mask.s_addr = htonl(mask.s_addr);
}
*(m - 1) = '/';
for (i = 0; i < num_interfaces; i++)
if ((interfaces[i].addr.s_addr & mask.s_addr) == addr.s_addr)
return(TRUE);
} else {
addr.s_addr = inet_addr(n);
for (i = 0; i < num_interfaces; i++)
if (interfaces[i].addr.s_addr == addr.s_addr ||
(interfaces[i].addr.s_addr & interfaces[i].netmask.s_addr)
== addr.s_addr)
return(TRUE);
}
return(FALSE);
}
int
hostname_matches(shost, lhost, pattern)
char *shost;
char *lhost;
char *pattern;
{
if (has_meta(pattern)) {
if (strchr(pattern, '.'))
return(fnmatch(pattern, lhost, FNM_CASEFOLD));
else
return(fnmatch(pattern, shost, FNM_CASEFOLD));
} else {
if (strchr(pattern, '.'))
return(strcasecmp(lhost, pattern));
else
return(strcasecmp(shost, pattern));
}
}
int
userpw_matches(sudoers_user, user, pw)
char *sudoers_user;
char *user;
struct passwd *pw;
{
if (pw != NULL && *sudoers_user == '#') {
uid_t uid = atoi(sudoers_user + 1);
if (uid == pw->pw_uid)
return(1);
}
return(strcmp(sudoers_user, user) == 0);
}
int
usergr_matches(group, user, pw)
char *group;
char *user;
struct passwd *pw;
{
struct group *grp;
gid_t pw_gid;
char **cur;
if (*group++ != '%')
return(FALSE);
if (pw == NULL && (pw = getpwnam(user)) == NULL)
return(FALSE);
pw_gid = pw->pw_gid;
if ((grp = getgrnam(group)) == NULL)
return(FALSE);
if (grp->gr_gid == pw_gid)
return(TRUE);
for (cur = grp->gr_mem; *cur; cur++) {
if (strcmp(*cur, user) == 0)
return(TRUE);
}
return(FALSE);
}
int
netgr_matches(netgr, host, shost, user)
char *netgr;
char *host;
char *shost;
char *user;
{
#ifdef HAVE_GETDOMAINNAME
static char *domain = (char *) -1;
#else
static char *domain = NULL;
#endif
if (*netgr++ != '+')
return(FALSE);
#ifdef HAVE_GETDOMAINNAME
if (domain == (char *) -1) {
domain = (char *) emalloc(MAXHOSTNAMELEN);
if (getdomainname(domain, MAXHOSTNAMELEN) == -1 || *domain == '\0') {
free(domain);
domain = NULL;
}
}
#endif
#ifdef HAVE_INNETGR
if (innetgr(netgr, host, user, domain))
return(TRUE);
else if (host != shost && innetgr(netgr, shost, user, domain))
return(TRUE);
#endif
return(FALSE);
}
static int
has_meta(s)
char *s;
{
char *t;
for (t = s; *t; t++) {
if (*t == '\\' || *t == '?' || *t == '*' || *t == '[' || *t == ']')
return(TRUE);
}
return(FALSE);
}