@ -1311,7 +1311,7 @@
|
|||||||
|
|
||||||
This means that fred's password is valid, it was last changed on
|
This means that fred's password is valid, it was last changed on
|
||||||
03/04/96, it can be changed at any time, it expires after 60 days,
|
03/04/96, it can be changed at any time, it expires after 60 days,
|
||||||
fred will not be warned, and and the account won't be disabled when
|
fred will not be warned, and the account won't be disabled when
|
||||||
the password expires.
|
the password expires.
|
||||||
|
|
||||||
This simply means that if fred logs in after the password expires, he
|
This simply means that if fred logs in after the password expires, he
|
||||||
@ -1487,7 +1487,7 @@
|
|||||||
|
|
||||||
If a user logs into a line that is listed in /etc/dialups, and his
|
If a user logs into a line that is listed in /etc/dialups, and his
|
||||||
shell is listed in the file /etc/d_passwd he will be allowed access
|
shell is listed in the file /etc/d_passwd he will be allowed access
|
||||||
only by suppling the correct password.
|
only by supplying the correct password.
|
||||||
|
|
||||||
Another useful purpose for using dial-up passwords might be to setup a
|
Another useful purpose for using dial-up passwords might be to setup a
|
||||||
line that only allows a certain type of connect (perhaps a PPP or UUCP
|
line that only allows a certain type of connect (perhaps a PPP or UUCP
|
||||||
|
@ -63,4 +63,3 @@ To completely disable limits for a user, a single dash (-) will do.
|
|||||||
Also, please note that all limit settings are set PER LOGIN. They are
|
Also, please note that all limit settings are set PER LOGIN. They are
|
||||||
not global, nor are they permanent. Perhaps global limits will come, but
|
not global, nor are they permanent. Perhaps global limits will come, but
|
||||||
for now this will have to do ;)
|
for now this will have to do ;)
|
||||||
|
|
||||||
|
@ -37,4 +37,3 @@ New ideas to add to this list are welcome, too. --marekm
|
|||||||
per-user configuration, to be executed with run-parts. Some hooks should
|
per-user configuration, to be executed with run-parts. Some hooks should
|
||||||
be executed at package install time for existing users, likewise for
|
be executed at package install time for existing users, likewise for
|
||||||
package removal and possibly modification. (Debian Bug#36019)
|
package removal and possibly modification. (Debian Bug#36019)
|
||||||
|
|
||||||
|
@ -1,4 +1,4 @@
|
|||||||
<HEAD>
|
<head>
|
||||||
<title>shadow - Welcome</title>
|
<title>shadow - Welcome</title>
|
||||||
</head>
|
</head>
|
||||||
<body>
|
<body>
|
||||||
|
@ -465,7 +465,6 @@ USERGROUPS_ENAB yes
|
|||||||
# Set to "yes" to prevent for all accounts
|
# Set to "yes" to prevent for all accounts
|
||||||
# Set to "superuser" to prevent for UID 0 / root (default)
|
# Set to "superuser" to prevent for UID 0 / root (default)
|
||||||
# Set to "no" to not prevent for any account (dangerous, historical default)
|
# Set to "no" to not prevent for any account (dangerous, historical default)
|
||||||
|
|
||||||
PREVENT_NO_AUTH superuser
|
PREVENT_NO_AUTH superuser
|
||||||
|
|
||||||
#
|
#
|
||||||
|
@ -403,11 +403,11 @@ int commonio_lock_nowait (struct commonio_db *db, bool log)
|
|||||||
file_len = strlen(db->filename) + 11;/* %lu max size */
|
file_len = strlen(db->filename) + 11;/* %lu max size */
|
||||||
lock_file_len = strlen(db->filename) + 6; /* sizeof ".lock" */
|
lock_file_len = strlen(db->filename) + 6; /* sizeof ".lock" */
|
||||||
file = (char*)malloc(file_len);
|
file = (char*)malloc(file_len);
|
||||||
if(file == NULL) {
|
if (file == NULL) {
|
||||||
goto cleanup_ENOMEM;
|
goto cleanup_ENOMEM;
|
||||||
}
|
}
|
||||||
lock = (char*)malloc(lock_file_len);
|
lock = (char*)malloc(lock_file_len);
|
||||||
if(lock == NULL) {
|
if (lock == NULL) {
|
||||||
goto cleanup_ENOMEM;
|
goto cleanup_ENOMEM;
|
||||||
}
|
}
|
||||||
snprintf (file, file_len, "%s.%lu",
|
snprintf (file, file_len, "%s.%lu",
|
||||||
@ -419,9 +419,9 @@ int commonio_lock_nowait (struct commonio_db *db, bool log)
|
|||||||
err = 1;
|
err = 1;
|
||||||
}
|
}
|
||||||
cleanup_ENOMEM:
|
cleanup_ENOMEM:
|
||||||
if(file)
|
if (file)
|
||||||
free(file);
|
free(file);
|
||||||
if(lock)
|
if (lock)
|
||||||
free(lock);
|
free(lock);
|
||||||
return err;
|
return err;
|
||||||
}
|
}
|
||||||
|
@ -45,8 +45,8 @@
|
|||||||
struct faillog {
|
struct faillog {
|
||||||
short fail_cnt; /* failures since last success */
|
short fail_cnt; /* failures since last success */
|
||||||
short fail_max; /* failures before turning account off */
|
short fail_max; /* failures before turning account off */
|
||||||
char fail_line[12]; /* last failure occured here */
|
char fail_line[12]; /* last failure occurred here */
|
||||||
time_t fail_time; /* last failure occured then */
|
time_t fail_time; /* last failure occurred then */
|
||||||
/*
|
/*
|
||||||
* If nonzero, the account will be re-enabled if there are no
|
* If nonzero, the account will be re-enabled if there are no
|
||||||
* failures for fail_locktime seconds since last failure.
|
* failures for fail_locktime seconds since last failure.
|
||||||
|
@ -127,7 +127,7 @@ int pw_auth (const char *cipher,
|
|||||||
#ifdef SKEY
|
#ifdef SKEY
|
||||||
/*
|
/*
|
||||||
* If the user has an S/KEY entry show them the pertinent info
|
* If the user has an S/KEY entry show them the pertinent info
|
||||||
* and then we can try validating the created cyphertext and the SKEY.
|
* and then we can try validating the created ciphertext and the SKEY.
|
||||||
* If there is no SKEY information we default to not using SKEY.
|
* If there is no SKEY information we default to not using SKEY.
|
||||||
*/
|
*/
|
||||||
|
|
||||||
|
@ -17,7 +17,7 @@ int run_part (char *script_path, char *name, char *action)
|
|||||||
char *args[] = { script_path, NULL };
|
char *args[] = { script_path, NULL };
|
||||||
|
|
||||||
pid=fork();
|
pid=fork();
|
||||||
if (pid==-1){
|
if (pid==-1) {
|
||||||
perror ("Could not fork");
|
perror ("Could not fork");
|
||||||
return 1;
|
return 1;
|
||||||
}
|
}
|
||||||
|
@ -91,7 +91,7 @@ struct passwd *sgetpwent (const char *buf)
|
|||||||
}
|
}
|
||||||
|
|
||||||
/* something at the end, columns over shot */
|
/* something at the end, columns over shot */
|
||||||
if( cp != NULL ) {
|
if ( cp != NULL ) {
|
||||||
return( NULL );
|
return( NULL );
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -224,7 +224,7 @@ static const struct subordinate_range *find_range(struct commonio_db *db,
|
|||||||
/* Get UID of the username we are looking for */
|
/* Get UID of the username we are looking for */
|
||||||
pwd = getpwnam(owner);
|
pwd = getpwnam(owner);
|
||||||
if (NULL == pwd) {
|
if (NULL == pwd) {
|
||||||
/* Username not defined in /etc/passwd, or error occured during lookup */
|
/* Username not defined in /etc/passwd, or error occurred during lookup */
|
||||||
return NULL;
|
return NULL;
|
||||||
}
|
}
|
||||||
owner_uid = pwd->pw_uid;
|
owner_uid = pwd->pw_uid;
|
||||||
@ -847,7 +847,7 @@ static int append_uids(uid_t **uids, const char *owner, int n)
|
|||||||
} else {
|
} else {
|
||||||
struct passwd *pwd = getpwnam(owner);
|
struct passwd *pwd = getpwnam(owner);
|
||||||
if (NULL == pwd) {
|
if (NULL == pwd) {
|
||||||
/* Username not defined in /etc/passwd, or error occured during lookup */
|
/* Username not defined in /etc/passwd, or error occurred during lookup */
|
||||||
free(*uids);
|
free(*uids);
|
||||||
*uids = NULL;
|
*uids = NULL;
|
||||||
return -1;
|
return -1;
|
||||||
|
@ -202,7 +202,7 @@ static int check_logins (const char *name, const char *maxlogins)
|
|||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* Function setup_user_limits - checks/set limits for the curent login
|
/* Function setup_user_limits - checks/set limits for the current login
|
||||||
* Original idea from Joel Katz's lshell. Ported to shadow-login
|
* Original idea from Joel Katz's lshell. Ported to shadow-login
|
||||||
* by Cristian Gafton - gafton@sorosis.ro
|
* by Cristian Gafton - gafton@sorosis.ro
|
||||||
*
|
*
|
||||||
@ -404,7 +404,7 @@ static bool user_in_group (const char *uname, const char *gname)
|
|||||||
{
|
{
|
||||||
struct group *groupdata;
|
struct group *groupdata;
|
||||||
|
|
||||||
if (uname == NULL || gname == NULL){
|
if (uname == NULL || gname == NULL) {
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -176,10 +176,10 @@ extern struct group *prefix_getgrnam(const char *name)
|
|||||||
struct group * grp = NULL;
|
struct group * grp = NULL;
|
||||||
|
|
||||||
fg = fopen(group_db_file, "rt");
|
fg = fopen(group_db_file, "rt");
|
||||||
if(!fg)
|
if (!fg)
|
||||||
return NULL;
|
return NULL;
|
||||||
while((grp = fgetgrent(fg)) != NULL) {
|
while ((grp = fgetgrent(fg)) != NULL) {
|
||||||
if(!strcmp(name, grp->gr_name))
|
if (!strcmp(name, grp->gr_name))
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
fclose(fg);
|
fclose(fg);
|
||||||
@ -196,10 +196,10 @@ extern struct group *prefix_getgrgid(gid_t gid)
|
|||||||
struct group * grp = NULL;
|
struct group * grp = NULL;
|
||||||
|
|
||||||
fg = fopen(group_db_file, "rt");
|
fg = fopen(group_db_file, "rt");
|
||||||
if(!fg)
|
if (!fg)
|
||||||
return NULL;
|
return NULL;
|
||||||
while((grp = fgetgrent(fg)) != NULL) {
|
while ((grp = fgetgrent(fg)) != NULL) {
|
||||||
if(gid == grp->gr_gid)
|
if (gid == grp->gr_gid)
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
fclose(fg);
|
fclose(fg);
|
||||||
@ -216,10 +216,10 @@ extern struct passwd *prefix_getpwuid(uid_t uid)
|
|||||||
struct passwd *pwd = NULL;
|
struct passwd *pwd = NULL;
|
||||||
|
|
||||||
fg = fopen(passwd_db_file, "rt");
|
fg = fopen(passwd_db_file, "rt");
|
||||||
if(!fg)
|
if (!fg)
|
||||||
return NULL;
|
return NULL;
|
||||||
while((pwd = fgetpwent(fg)) != NULL) {
|
while ((pwd = fgetpwent(fg)) != NULL) {
|
||||||
if(uid == pwd->pw_uid)
|
if (uid == pwd->pw_uid)
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
fclose(fg);
|
fclose(fg);
|
||||||
@ -236,10 +236,10 @@ extern struct passwd *prefix_getpwnam(const char* name)
|
|||||||
struct passwd *pwd = NULL;
|
struct passwd *pwd = NULL;
|
||||||
|
|
||||||
fg = fopen(passwd_db_file, "rt");
|
fg = fopen(passwd_db_file, "rt");
|
||||||
if(!fg)
|
if (!fg)
|
||||||
return NULL;
|
return NULL;
|
||||||
while((pwd = fgetpwent(fg)) != NULL) {
|
while ((pwd = fgetpwent(fg)) != NULL) {
|
||||||
if(!strcmp(name, pwd->pw_name))
|
if (!strcmp(name, pwd->pw_name))
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
fclose(fg);
|
fclose(fg);
|
||||||
@ -256,10 +256,10 @@ extern struct spwd *prefix_getspnam(const char* name)
|
|||||||
struct spwd *sp = NULL;
|
struct spwd *sp = NULL;
|
||||||
|
|
||||||
fg = fopen(spw_db_file, "rt");
|
fg = fopen(spw_db_file, "rt");
|
||||||
if(!fg)
|
if (!fg)
|
||||||
return NULL;
|
return NULL;
|
||||||
while((sp = fgetspent(fg)) != NULL) {
|
while ((sp = fgetspent(fg)) != NULL) {
|
||||||
if(!strcmp(name, sp->sp_namp))
|
if (!strcmp(name, sp->sp_namp))
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
fclose(fg);
|
fclose(fg);
|
||||||
@ -272,7 +272,7 @@ extern struct spwd *prefix_getspnam(const char* name)
|
|||||||
|
|
||||||
extern void prefix_setpwent()
|
extern void prefix_setpwent()
|
||||||
{
|
{
|
||||||
if(!passwd_db_file) {
|
if (!passwd_db_file) {
|
||||||
setpwent();
|
setpwent();
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
@ -280,19 +280,19 @@ extern void prefix_setpwent()
|
|||||||
fclose (fp_pwent);
|
fclose (fp_pwent);
|
||||||
|
|
||||||
fp_pwent = fopen(passwd_db_file, "rt");
|
fp_pwent = fopen(passwd_db_file, "rt");
|
||||||
if(!fp_pwent)
|
if (!fp_pwent)
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
extern struct passwd* prefix_getpwent()
|
extern struct passwd* prefix_getpwent()
|
||||||
{
|
{
|
||||||
if(!passwd_db_file) {
|
if (!passwd_db_file) {
|
||||||
return getpwent();
|
return getpwent();
|
||||||
}
|
}
|
||||||
return fgetpwent(fp_pwent);
|
return fgetpwent(fp_pwent);
|
||||||
}
|
}
|
||||||
extern void prefix_endpwent()
|
extern void prefix_endpwent()
|
||||||
{
|
{
|
||||||
if(!passwd_db_file) {
|
if (!passwd_db_file) {
|
||||||
endpwent();
|
endpwent();
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
@ -303,7 +303,7 @@ extern void prefix_endpwent()
|
|||||||
|
|
||||||
extern void prefix_setgrent()
|
extern void prefix_setgrent()
|
||||||
{
|
{
|
||||||
if(!group_db_file) {
|
if (!group_db_file) {
|
||||||
setgrent();
|
setgrent();
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
@ -311,19 +311,19 @@ extern void prefix_setgrent()
|
|||||||
fclose (fp_grent);
|
fclose (fp_grent);
|
||||||
|
|
||||||
fp_grent = fopen(group_db_file, "rt");
|
fp_grent = fopen(group_db_file, "rt");
|
||||||
if(!fp_grent)
|
if (!fp_grent)
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
extern struct group* prefix_getgrent()
|
extern struct group* prefix_getgrent()
|
||||||
{
|
{
|
||||||
if(!group_db_file) {
|
if (!group_db_file) {
|
||||||
return getgrent();
|
return getgrent();
|
||||||
}
|
}
|
||||||
return fgetgrent(fp_grent);
|
return fgetgrent(fp_grent);
|
||||||
}
|
}
|
||||||
extern void prefix_endgrent()
|
extern void prefix_endgrent()
|
||||||
{
|
{
|
||||||
if(!group_db_file) {
|
if (!group_db_file) {
|
||||||
endgrent();
|
endgrent();
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
@ -263,7 +263,7 @@ static void print_date (time_t date)
|
|||||||
char buf[80];
|
char buf[80];
|
||||||
char format[80];
|
char format[80];
|
||||||
|
|
||||||
if( iflg ) {
|
if (iflg) {
|
||||||
(void) snprintf (format, 80, "%%Y-%%m-%%d");
|
(void) snprintf (format, 80, "%%Y-%%m-%%d");
|
||||||
}
|
}
|
||||||
else {
|
else {
|
||||||
|
@ -515,7 +515,7 @@ int main (int argc, char **argv)
|
|||||||
newpwd = cp;
|
newpwd = cp;
|
||||||
|
|
||||||
#ifdef USE_PAM
|
#ifdef USE_PAM
|
||||||
if (use_pam){
|
if (use_pam) {
|
||||||
if (do_pam_passwd_non_interactive ("chpasswd", name, newpwd) != 0) {
|
if (do_pam_passwd_non_interactive ("chpasswd", name, newpwd) != 0) {
|
||||||
fprintf (stderr,
|
fprintf (stderr,
|
||||||
_("%s: (line %d, user %s) password not changed\n"),
|
_("%s: (line %d, user %s) password not changed\n"),
|
||||||
|
@ -983,12 +983,12 @@ int main (int argc, char **argv)
|
|||||||
|
|
||||||
if (strcmp (user_passwd, "") == 0) {
|
if (strcmp (user_passwd, "") == 0) {
|
||||||
char *prevent_no_auth = getdef_str("PREVENT_NO_AUTH");
|
char *prevent_no_auth = getdef_str("PREVENT_NO_AUTH");
|
||||||
if(prevent_no_auth == NULL) {
|
if (prevent_no_auth == NULL) {
|
||||||
prevent_no_auth = "superuser";
|
prevent_no_auth = "superuser";
|
||||||
}
|
}
|
||||||
if(strcmp(prevent_no_auth, "yes") == 0) {
|
if (strcmp(prevent_no_auth, "yes") == 0) {
|
||||||
failed = true;
|
failed = true;
|
||||||
} else if( (pwd->pw_uid == 0)
|
} else if ((pwd->pw_uid == 0)
|
||||||
&& (strcmp(prevent_no_auth, "superuser") == 0)) {
|
&& (strcmp(prevent_no_auth, "superuser") == 0)) {
|
||||||
failed = true;
|
failed = true;
|
||||||
}
|
}
|
||||||
|
6
src/su.c
6
src/su.c
@ -508,13 +508,13 @@ static void check_perms_nopam (const struct passwd *pw)
|
|||||||
|
|
||||||
if (strcmp (pw->pw_passwd, "") == 0) {
|
if (strcmp (pw->pw_passwd, "") == 0) {
|
||||||
char *prevent_no_auth = getdef_str("PREVENT_NO_AUTH");
|
char *prevent_no_auth = getdef_str("PREVENT_NO_AUTH");
|
||||||
if(prevent_no_auth == NULL) {
|
if (prevent_no_auth == NULL) {
|
||||||
prevent_no_auth = "superuser";
|
prevent_no_auth = "superuser";
|
||||||
}
|
}
|
||||||
if(strcmp(prevent_no_auth, "yes") == 0) {
|
if (strcmp(prevent_no_auth, "yes") == 0) {
|
||||||
fprintf(stderr, _("Password field is empty, this is forbidden for all accounts.\n"));
|
fprintf(stderr, _("Password field is empty, this is forbidden for all accounts.\n"));
|
||||||
exit(1);
|
exit(1);
|
||||||
} else if( (pw->pw_uid == 0)
|
} else if ((pw->pw_uid == 0)
|
||||||
&& (strcmp(prevent_no_auth, "superuser") == 0)) {
|
&& (strcmp(prevent_no_auth, "superuser") == 0)) {
|
||||||
fprintf(stderr, _("Password field is empty, this is forbidden for super-user.\n"));
|
fprintf(stderr, _("Password field is empty, this is forbidden for super-user.\n"));
|
||||||
exit(1);
|
exit(1);
|
||||||
|
@ -360,7 +360,7 @@ static void get_defaults (void)
|
|||||||
char buf[1024];
|
char buf[1024];
|
||||||
char *cp;
|
char *cp;
|
||||||
|
|
||||||
if(prefix[0]) {
|
if (prefix[0]) {
|
||||||
size_t len;
|
size_t len;
|
||||||
int wlen;
|
int wlen;
|
||||||
|
|
||||||
@ -461,7 +461,7 @@ static void get_defaults (void)
|
|||||||
cp = SKEL_DIR; /* XXX warning: const */
|
cp = SKEL_DIR; /* XXX warning: const */
|
||||||
}
|
}
|
||||||
|
|
||||||
if(prefix[0]) {
|
if (prefix[0]) {
|
||||||
size_t len;
|
size_t len;
|
||||||
int wlen;
|
int wlen;
|
||||||
char* _def_template; /* avoid const warning */
|
char* _def_template; /* avoid const warning */
|
||||||
@ -490,7 +490,7 @@ static void get_defaults (void)
|
|||||||
}
|
}
|
||||||
(void) fclose (fp);
|
(void) fclose (fp);
|
||||||
getdef_err:
|
getdef_err:
|
||||||
if(prefix[0]) {
|
if (prefix[0]) {
|
||||||
free(default_file);
|
free(default_file);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@ -551,7 +551,7 @@ static int set_defaults (void)
|
|||||||
wlen = snprintf(new_file, len, "%s%s%s", prefix, prefix[0]?"/":"", NEW_USER_FILE);
|
wlen = snprintf(new_file, len, "%s%s%s", prefix, prefix[0]?"/":"", NEW_USER_FILE);
|
||||||
assert (wlen <= (int) len -1);
|
assert (wlen <= (int) len -1);
|
||||||
|
|
||||||
if(prefix[0]) {
|
if (prefix[0]) {
|
||||||
len = strlen(prefix) + strlen(USER_DEFAULTS_FILE) + 2;
|
len = strlen(prefix) + strlen(USER_DEFAULTS_FILE) + 2;
|
||||||
default_file = malloc(len);
|
default_file = malloc(len);
|
||||||
if (default_file == NULL) {
|
if (default_file == NULL) {
|
||||||
@ -722,7 +722,7 @@ static int set_defaults (void)
|
|||||||
ret = 0;
|
ret = 0;
|
||||||
setdef_err:
|
setdef_err:
|
||||||
free(new_file);
|
free(new_file);
|
||||||
if(prefix[0]) {
|
if (prefix[0]) {
|
||||||
free(default_file);
|
free(default_file);
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -1534,7 +1534,7 @@ static void process_flags (int argc, char **argv)
|
|||||||
|
|
||||||
user_home = uh;
|
user_home = uh;
|
||||||
}
|
}
|
||||||
if(prefix[0]) {
|
if (prefix[0]) {
|
||||||
size_t len = strlen(prefix) + strlen(user_home) + 2;
|
size_t len = strlen(prefix) + strlen(user_home) + 2;
|
||||||
int wlen;
|
int wlen;
|
||||||
char* _prefix_user_home; /* to avoid const warning */
|
char* _prefix_user_home; /* to avoid const warning */
|
||||||
@ -2331,7 +2331,7 @@ static void create_mail (void)
|
|||||||
spool = "/var/mail";
|
spool = "/var/mail";
|
||||||
}
|
}
|
||||||
file = alloca (strlen (prefix) + strlen (spool) + strlen (user_name) + 2);
|
file = alloca (strlen (prefix) + strlen (spool) + strlen (user_name) + 2);
|
||||||
if(prefix[0])
|
if (prefix[0])
|
||||||
sprintf (file, "%s/%s/%s", prefix, spool, user_name);
|
sprintf (file, "%s/%s/%s", prefix, spool, user_name);
|
||||||
else
|
else
|
||||||
sprintf (file, "%s/%s", spool, user_name);
|
sprintf (file, "%s/%s", spool, user_name);
|
||||||
@ -2385,18 +2385,18 @@ static void check_uid_range(int rflg, uid_t user_id)
|
|||||||
{
|
{
|
||||||
uid_t uid_min ;
|
uid_t uid_min ;
|
||||||
uid_t uid_max ;
|
uid_t uid_max ;
|
||||||
if(rflg){
|
if (rflg) {
|
||||||
uid_min = (uid_t)getdef_ulong("SYS_UID_MIN",101UL);
|
uid_min = (uid_t)getdef_ulong("SYS_UID_MIN",101UL);
|
||||||
uid_max = (uid_t)getdef_ulong("SYS_UID_MAX",getdef_ulong("UID_MIN",1000UL)-1);
|
uid_max = (uid_t)getdef_ulong("SYS_UID_MAX",getdef_ulong("UID_MIN",1000UL)-1);
|
||||||
if(uid_min <= uid_max){
|
if (uid_min <= uid_max) {
|
||||||
if(user_id < uid_min || user_id >uid_max)
|
if (user_id < uid_min || user_id >uid_max)
|
||||||
fprintf(stderr, _("%s warning: %s's uid %d outside of the SYS_UID_MIN %d and SYS_UID_MAX %d range.\n"), Prog, user_name, user_id, uid_min, uid_max);
|
fprintf(stderr, _("%s warning: %s's uid %d outside of the SYS_UID_MIN %d and SYS_UID_MAX %d range.\n"), Prog, user_name, user_id, uid_min, uid_max);
|
||||||
}
|
}
|
||||||
}else{
|
}else{
|
||||||
uid_min = (uid_t)getdef_ulong("UID_MIN", 1000UL);
|
uid_min = (uid_t)getdef_ulong("UID_MIN", 1000UL);
|
||||||
uid_max = (uid_t)getdef_ulong("UID_MAX", 6000UL);
|
uid_max = (uid_t)getdef_ulong("UID_MAX", 6000UL);
|
||||||
if(uid_min <= uid_max){
|
if (uid_min <= uid_max) {
|
||||||
if(user_id < uid_min || user_id >uid_max)
|
if (user_id < uid_min || user_id >uid_max)
|
||||||
fprintf(stderr, _("%s warning: %s's uid %d outside of the UID_MIN %d and UID_MAX %d range.\n"), Prog, user_name, user_id, uid_min, uid_max);
|
fprintf(stderr, _("%s warning: %s's uid %d outside of the UID_MIN %d and UID_MAX %d range.\n"), Prog, user_name, user_id, uid_min, uid_max);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@ -2594,7 +2594,7 @@ int main (int argc, char **argv)
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
if(uflg)
|
if (uflg)
|
||||||
check_uid_range(rflg,user_id);
|
check_uid_range(rflg,user_id);
|
||||||
#ifdef WITH_TCB
|
#ifdef WITH_TCB
|
||||||
if (getdef_bool ("USE_TCB")) {
|
if (getdef_bool ("USE_TCB")) {
|
||||||
|
@ -1169,7 +1169,7 @@ int main (int argc, char **argv)
|
|||||||
user_id = pwd->pw_uid;
|
user_id = pwd->pw_uid;
|
||||||
user_gid = pwd->pw_gid;
|
user_gid = pwd->pw_gid;
|
||||||
|
|
||||||
if(prefix[0]) {
|
if (prefix[0]) {
|
||||||
|
|
||||||
size_t len = strlen(prefix) + strlen(pwd->pw_dir) + 2;
|
size_t len = strlen(prefix) + strlen(pwd->pw_dir) + 2;
|
||||||
int wlen;
|
int wlen;
|
||||||
@ -1347,7 +1347,7 @@ int main (int argc, char **argv)
|
|||||||
* Cancel any crontabs or at jobs. Have to do this before we remove
|
* Cancel any crontabs or at jobs. Have to do this before we remove
|
||||||
* the entry from /etc/passwd.
|
* the entry from /etc/passwd.
|
||||||
*/
|
*/
|
||||||
if(prefix[0] == '\0')
|
if (prefix[0] == '\0')
|
||||||
user_cancel (user_name);
|
user_cancel (user_name);
|
||||||
close_files ();
|
close_files ();
|
||||||
|
|
||||||
|
@ -370,7 +370,6 @@ static struct ulong_range getulong_range(const char *str)
|
|||||||
result.last = (unsigned long int)last;
|
result.last = (unsigned long int)last;
|
||||||
out:
|
out:
|
||||||
return result;
|
return result;
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
struct ulong_range_list_entry {
|
struct ulong_range_list_entry {
|
||||||
@ -1281,7 +1280,7 @@ static void process_flags (int argc, char **argv)
|
|||||||
if (!gflg) {
|
if (!gflg) {
|
||||||
user_newgid = user_gid;
|
user_newgid = user_gid;
|
||||||
}
|
}
|
||||||
if(prefix[0]) {
|
if (prefix[0]) {
|
||||||
size_t len = strlen(prefix) + strlen(user_home) + 2;
|
size_t len = strlen(prefix) + strlen(user_home) + 2;
|
||||||
int wlen;
|
int wlen;
|
||||||
prefix_user_home = xmalloc(len);
|
prefix_user_home = xmalloc(len);
|
||||||
|
@ -6,7 +6,7 @@ You should run it on a chroot, or on a secured dedicated system.
|
|||||||
|
|
||||||
To test a Debian system:
|
To test a Debian system:
|
||||||
$ mkdir sid-chroot
|
$ mkdir sid-chroot
|
||||||
$ sudo debootstrap sid sid-chroot/ http://ftp.fr.debian.org/debian/
|
$ sudo debootstrap sid sid-chroot/ http://deb.debian.org/debian/
|
||||||
edit or copy a sources.list
|
edit or copy a sources.list
|
||||||
$ sudo cp /etc/apt/sources.list sid-chroot/etc/apt/
|
$ sudo cp /etc/apt/sources.list sid-chroot/etc/apt/
|
||||||
edit or copy a resolv.conf
|
edit or copy a resolv.conf
|
||||||
@ -17,5 +17,3 @@ edit or copy a resolv.conf
|
|||||||
# aptitude update
|
# aptitude update
|
||||||
# aptitude install expect
|
# aptitude install expect
|
||||||
# cd /dev ; mknod --mode=666 /dev/ptmx c 5 2
|
# cd /dev ; mknod --mode=666 /dev/ptmx c 5 2
|
||||||
|
|
||||||
|
|
||||||
|
@ -51,10 +51,10 @@ echo "-: test failed"
|
|||||||
# Empty the complete log.
|
# Empty the complete log.
|
||||||
> testsuite.log
|
> testsuite.log
|
||||||
|
|
||||||
find ${build_path} -name "*.gcda" -delete
|
find "${build_path}" -name "*.gcda" -delete
|
||||||
run_test ./su/01/su_root.test
|
run_test ./su/01/su_root.test
|
||||||
run_test ./su/01/su_user.test
|
run_test ./su/01/su_user.test
|
||||||
find ${build_path} -name "*.gcda" -exec chmod a+rw {} \;
|
find "${build_path}" -name "*.gcda" -exec chmod a+rw {} \;
|
||||||
run_test ./su/02/env_FOO-options_--login
|
run_test ./su/02/env_FOO-options_--login
|
||||||
run_test ./su/02/env_FOO-options_--login_bash
|
run_test ./su/02/env_FOO-options_--login_bash
|
||||||
run_test ./su/02/env_FOO-options_--preserve-environment
|
run_test ./su/02/env_FOO-options_--preserve-environment
|
||||||
@ -121,7 +121,7 @@ run_test ./su/11_su_sulog_failure/su.test
|
|||||||
run_test ./su/12_su_child_failure/su.test
|
run_test ./su/12_su_child_failure/su.test
|
||||||
run_test ./su/13_su_child_success/su.test
|
run_test ./su/13_su_child_success/su.test
|
||||||
run_test ./chage/01/run
|
run_test ./chage/01/run
|
||||||
find ${build_path} -name "*.gcda" -exec chmod a+rw {} \;
|
find "${build_path}" -name "*.gcda" -exec chmod a+rw {} \;
|
||||||
run_test ./chage/02/run
|
run_test ./chage/02/run
|
||||||
run_test ./chage/03_chsh_usage/chage.test
|
run_test ./chage/03_chsh_usage/chage.test
|
||||||
run_test ./chage/04_chsh_usage_invalid_option/chage.test
|
run_test ./chage/04_chsh_usage_invalid_option/chage.test
|
||||||
@ -1221,7 +1221,7 @@ run_test ./passwd/22_passwd_usage/passwd.test
|
|||||||
run_test ./login/01_login_prompt/login.test
|
run_test ./login/01_login_prompt/login.test
|
||||||
run_test ./login/02_login_user/login.test
|
run_test ./login/02_login_user/login.test
|
||||||
run_test ./login/03_login_check_tty/login.test
|
run_test ./login/03_login_check_tty/login.test
|
||||||
find ${build_path} -name "*.gcda" -exec chmod a+rw {} \;
|
find "${build_path}" -name "*.gcda" -exec chmod a+rw {} \;
|
||||||
run_test ./subids/01_useradd_no_subids/useradd.test
|
run_test ./subids/01_useradd_no_subids/useradd.test
|
||||||
run_test ./subids/02_useradd_with_subids/useradd.test
|
run_test ./subids/02_useradd_with_subids/useradd.test
|
||||||
run_test ./subids/03_useradd_no_subgid/useradd.test
|
run_test ./subids/03_useradd_no_subgid/useradd.test
|
||||||
@ -1301,9 +1301,8 @@ echo
|
|||||||
echo "$succeeded test(s) passed"
|
echo "$succeeded test(s) passed"
|
||||||
echo "$failed test(s) failed"
|
echo "$failed test(s) failed"
|
||||||
echo "log written in 'testsuite.log'"
|
echo "log written in 'testsuite.log'"
|
||||||
if [ "$failed" != "0" ]
|
if [ "$failed" != 0 ]
|
||||||
then
|
then
|
||||||
echo "the following tests failed:"
|
echo "the following tests failed:"
|
||||||
echo $failed_tests
|
echo "$failed_tests"
|
||||||
fi
|
fi
|
||||||
|
|
||||||
|
@ -16,8 +16,8 @@ failed_tests=""
|
|||||||
|
|
||||||
run_test()
|
run_test()
|
||||||
{
|
{
|
||||||
find $build_path -name "*.gcda" -delete
|
find "$build_path" -name "*.gcda" -delete
|
||||||
find $build_path -name "*.gcno" | while read f
|
find "$build_path" -name "*.gcno" | while read f
|
||||||
do
|
do
|
||||||
g=${f%gcno}gcda
|
g=${f%gcno}gcda
|
||||||
touch $g
|
touch $g
|
||||||
@ -1320,9 +1320,8 @@ echo
|
|||||||
echo "$succeeded test(s) passed"
|
echo "$succeeded test(s) passed"
|
||||||
echo "$failed test(s) failed"
|
echo "$failed test(s) failed"
|
||||||
echo "log written in 'testsuite.log'"
|
echo "log written in 'testsuite.log'"
|
||||||
if [ "$failed" != "0" ]
|
if [ "$failed" != 0 ]
|
||||||
then
|
then
|
||||||
echo "the following tests failed:"
|
echo "the following tests failed:"
|
||||||
echo $failed_tests
|
echo "$failed_tests"
|
||||||
fi
|
fi
|
||||||
|
|
||||||
|
@ -51,10 +51,10 @@ echo "-: test failed"
|
|||||||
# Empty the complete log.
|
# Empty the complete log.
|
||||||
> testsuite.log
|
> testsuite.log
|
||||||
|
|
||||||
find ${build_path} -name "*.gcda" -delete
|
find "${build_path}" -name "*.gcda" -delete
|
||||||
run_test ./su/01/su_root.test
|
run_test ./su/01/su_root.test
|
||||||
run_test ./su/01/su_user.test
|
run_test ./su/01/su_user.test
|
||||||
find ${build_path} -name "*.gcda" -exec chmod a+rw {} \;
|
find "${build_path}" -name "*.gcda" -exec chmod a+rw {} \;
|
||||||
run_test ./su/02/env_FOO-options_--login
|
run_test ./su/02/env_FOO-options_--login
|
||||||
run_test ./su/02/env_FOO-options_--login_bash
|
run_test ./su/02/env_FOO-options_--login_bash
|
||||||
run_test ./su/02/env_FOO-options_--preserve-environment
|
run_test ./su/02/env_FOO-options_--preserve-environment
|
||||||
@ -133,9 +133,8 @@ echo
|
|||||||
echo "$succeeded test(s) passed"
|
echo "$succeeded test(s) passed"
|
||||||
echo "$failed test(s) failed"
|
echo "$failed test(s) failed"
|
||||||
echo "log written in 'testsuite.log'"
|
echo "log written in 'testsuite.log'"
|
||||||
if [ "$failed" != "0" ]
|
if [ "$failed" != 0 ]
|
||||||
then
|
then
|
||||||
echo "the following tests failed:"
|
echo "the following tests failed:"
|
||||||
echo $failed_tests
|
echo "$failed_tests"
|
||||||
fi
|
fi
|
||||||
|
|
||||||
|
Reference in New Issue
Block a user