lib/libutil/login_auth.c

   1 /*-
   2  * Copyright (c) 1996 by
   3  * Sean Eric Fagan <sef@kithrup.com>
   4  * David Nugent <davidn@blaze.net.au>
   5  * All rights reserved.
   6  *
   7  * Portions copyright (c) 1995,1997 by
   8  * Berkeley Software Design, Inc.
   9  * All rights reserved.
  10  *
  11  * Redistribution and use in source and binary forms, with or without
  12  * modification, is permitted provided that the following conditions
  13  * are met:
  14  * 1. Redistributions of source code must retain the above copyright
  15  *    notice immediately at the beginning of the file, without modification,
  16  *    this list of conditions, and the following disclaimer.
  17  * 2. Redistributions in binary form must reproduce the above copyright
  18  *    notice, this list of conditions and the following disclaimer in the
  19  *    documentation and/or other materials provided with the distribution.
  20  * 3. This work was done expressly for inclusion into FreeBSD.  Other use
  21  *    is permitted provided this notation is included.
  22  * 4. Absolutely no warranty of function or purpose is made by the authors.
  23  * 5. Modifications may be freely made to this file providing the above
  24  *    conditions are met.
  25  *
  26  * Low-level routines relating to the user capabilities database
  27  */
  28
  29 #include <sys/cdefs.h>
  30 __FBSDID("$FreeBSD$");
  31
  32 #include <sys/types.h>
  33 #include <sys/time.h>
  34 #include <sys/resource.h>
  35 #include <sys/stat.h>
  36 #include <sys/param.h>
  37 #include <sys/socket.h>
  38 #include <sys/wait.h>
  39 #include <ctype.h>
  40 #include <err.h>
  41 #include <errno.h>
  42 #include <fcntl.h>
  43 #include <libutil.h>
  44 #include <limits.h>
  45 #include <login_cap.h>
  46 #include <paths.h>
  47 #include <pwd.h>
  48 #include <stdarg.h>
  49 #include <stdio.h>
  50 #include <stdlib.h>
  51 #include <string.h>
  52 #include <syslog.h>
  53 #include <unistd.h>
  54
  55
  56 /*
  57  * auth_checknologin()
  58  * Checks for the existance of a nologin file in the login_cap
  59  * capability <lc>.  If there isn't one specified, then it checks
  60  * to see if this class should just ignore nologin files.  Lastly,
  61  * it tries to print out the default nologin file, and, if such
  62  * exists, it exits.
  63  */
  64
  65 void
  66 auth_checknologin(login_cap_t *lc)
  67 {
  68   const char *file;
  69
  70   /* Do we ignore a nologin file? */
  71   if (login_getcapbool(lc, "ignorenologin", 0))
  72     return;
  73
  74   /* Note that <file> will be "" if there is no nologin capability */
  75   if ((file = login_getcapstr(lc, "nologin", "", NULL)) == NULL)
  76     exit(1);
  77
  78   /*
  79    * *file is true IFF there was a "nologin" capability
  80    * Note that auth_cat() returns 1 only if the specified
  81    * file exists, and is readable.  E.g., /.nologin exists.
  82    */
  83   if ((*file && auth_cat(file)) || auth_cat(_PATH_NOLOGIN))
  84     exit(1);
  85 }
  86
  87
  88 /*
  89  * auth_cat()
  90  * Checks for the readability of <file>; if it can be opened for
  91  * reading, it prints it out to stdout, and then exits.  Otherwise,
  92  * it returns 0 (meaning no nologin file).
  93  */
  94
  95 int
  96 auth_cat(const char *file)
  97 {
  98   int fd, count;
  99   char buf[BUFSIZ];
 100
 101   if ((fd = open(file, O_RDONLY)) < 0)
 102     return 0;
 103   while ((count = read(fd, buf, sizeof(buf))) > 0)
 104     (void)write(fileno(stdout), buf, count);
 105   close(fd);
 106   sleep(5);     /* wait an arbitrary time to drain */
 107   return 1;
 108 }