1/* $OpenBSD: groupaccess.c,v 1.13 2008/07/04 03:44:59 djm Exp $ */ 2/* 3 * Copyright (c) 2001 Kevin Steves. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 17 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 24 */ 25 26#include "includes.h" 27 28#include <sys/types.h> 29#include <sys/param.h> 30 31#include <grp.h> 32#include <unistd.h> 33#include <stdarg.h> 34#include <string.h> 35 36#include "xmalloc.h" 37#include "groupaccess.h" 38#include "match.h" 39#include "log.h" 40 41static int ngroups; 42static char **groups_byname; 43 44/* 45 * Initialize group access list for user with primary (base) and 46 * supplementary groups. Return the number of groups in the list. 47 */ 48int 49ga_init(const char *user, gid_t base) 50{ 51#ifdef ANDROID 52 return 0; 53#else 54 gid_t *groups_bygid; 55 int i, j; 56 struct group *gr; 57 58 if (ngroups > 0) 59 ga_free(); 60 61 ngroups = NGROUPS_MAX; 62#if defined(HAVE_SYSCONF) && defined(_SC_NGROUPS_MAX) 63 ngroups = MAX(NGROUPS_MAX, sysconf(_SC_NGROUPS_MAX)); 64#endif 65 66 groups_bygid = xcalloc(ngroups, sizeof(*groups_bygid)); 67 groups_byname = xcalloc(ngroups, sizeof(*groups_byname)); 68 69 if (getgrouplist(user, base, groups_bygid, &ngroups) == -1) 70 logit("getgrouplist: groups list too small"); 71 for (i = 0, j = 0; i < ngroups; i++) 72 if ((gr = getgrgid(groups_bygid[i])) != NULL) 73 groups_byname[j++] = xstrdup(gr->gr_name); 74 xfree(groups_bygid); 75 return (ngroups = j); 76#endif 77} 78 79/* 80 * Return 1 if one of user's groups is contained in groups. 81 * Return 0 otherwise. Use match_pattern() for string comparison. 82 */ 83int 84ga_match(char * const *groups, int n) 85{ 86 int i, j; 87 88 for (i = 0; i < ngroups; i++) 89 for (j = 0; j < n; j++) 90 if (match_pattern(groups_byname[i], groups[j])) 91 return 1; 92 return 0; 93} 94 95/* 96 * Return 1 if one of user's groups matches group_pattern list. 97 * Return 0 on negated or no match. 98 */ 99int 100ga_match_pattern_list(const char *group_pattern) 101{ 102 int i, found = 0; 103 size_t len = strlen(group_pattern); 104 105 for (i = 0; i < ngroups; i++) { 106 switch (match_pattern_list(groups_byname[i], 107 group_pattern, len, 0)) { 108 case -1: 109 return 0; /* Negated match wins */ 110 case 0: 111 continue; 112 case 1: 113 found = 1; 114 } 115 } 116 return found; 117} 118 119/* 120 * Free memory allocated for group access list. 121 */ 122void 123ga_free(void) 124{ 125 int i; 126 127 if (ngroups > 0) { 128 for (i = 0; i < ngroups; i++) 129 xfree(groups_byname[i]); 130 ngroups = 0; 131 xfree(groups_byname); 132 } 133} 134