Aren/toaruos
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

sudo: cache success

Browse Source
This commit is contained in:
K. Lange 2018-10-31 11:39:40 +09:00
parent 0762fb30ce
commit 84c171c7ee
1 changed files with 88 additions and 48 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

136
apps/sudo.c
View File

@ -17,10 +17,16 @@
#include <termios.h> #include <termios.h>
#include <errno.h> #include <errno.h>
#include <pwd.h> #include <pwd.h>
#include <sys/wait.h> #include <dirent.h>
#include <sys/utsname.h> #include <sys/utsname.h>
#include <sys/stat.h>
#include <sys/time.h>
#include <toaru/auth.h> #include <toaru/auth.h>
#define MINUTES * 60
#define SUDO_TIME 5 MINUTES
uint32_t child = 0; uint32_t child = 0;
void usage(int argc, char * argv[]) { void usage(int argc, char * argv[]) {
@ -36,9 +42,20 @@ int main(int argc, char ** argv) {
return 1; return 1;
} }
struct stat buf;
if (stat("/var/sudoers", &buf)) {
mkdir("/var/sudoers", 0700);
}
while (1) { while (1) {
int need_password = 1;
int need_sudoers = 1;
uid_t me = getuid(); uid_t me = getuid();
if (me == 0) goto _do_it; if (me == 0) {
need_password = 0;
need_sudoers = 0;
}
struct passwd * p = getpwuid(me); struct passwd * p = getpwuid(me);
if (!p) { if (!p) {
@ -46,64 +63,87 @@ int main(int argc, char ** argv) {
return 1; return 1;
} }
char * username = p->pw_name; char * username = p->pw_name;
char * password = malloc(sizeof(char) * 1024);
fprintf(stderr, "[%s] password for %s: ", argv[0], username); char token_file[64];
fflush(stderr); sprintf(token_file, "/var/sudoers/%d", me); /* TODO: Restrict to this session? */
/* Disable echo */ if (need_password) {
struct termios old, new; struct stat buf;
tcgetattr(fileno(stdin), &old); if (!stat(token_file, &buf)) {
new = old; /* check the time */
new.c_lflag &= (~ECHO); if (buf.st_mtime > (SUDO_TIME) && time(NULL) - buf.st_mtime < (SUDO_TIME)) {
tcsetattr(fileno(stdin), TCSAFLUSH, &new); need_password = 0;
}
fgets(password, 1024, stdin); }
password[strlen(password)-1] = '\0'; }
tcsetattr(fileno(stdin), TCSAFLUSH, &old);
fprintf(stderr, "\n"); if (need_password) {
char * password = malloc(sizeof(char) * 1024);
int uid = toaru_auth_check_pass(username, password); fprintf(stderr, "[%s] password for %s: ", argv[0], username);
fflush(stderr);
if (uid < 0) {
fails++; /* Disable echo */
if (fails == 3) { struct termios old, new;
fprintf(stderr, "%s: %d incorrect password attempts\n", argv[0], fails); tcgetattr(fileno(stdin), &old);
break; new = old;
new.c_lflag &= (~ECHO);
tcsetattr(fileno(stdin), TCSAFLUSH, &new);
fgets(password, 1024, stdin);
password[strlen(password)-1] = '\0';
tcsetattr(fileno(stdin), TCSAFLUSH, &old);
fprintf(stderr, "\n");
int uid = toaru_auth_check_pass(username, password);
if (uid < 0) {
fails++;
if (fails == 3) {
fprintf(stderr, "%s: %d incorrect password attempts\n", argv[0], fails);
break;
}
fprintf(stderr, "Sorry, try again.\n");
continue;
} }
fprintf(stderr, "Sorry, try again.\n");
continue;
} }
/* Determine if this user is in the sudoers file */ /* Determine if this user is in the sudoers file */
FILE * sudoers = fopen("/etc/sudoers","r"); if (need_sudoers) {
if (!sudoers) { FILE * sudoers = fopen("/etc/sudoers","r");
fprintf(stderr, "%s: /etc/sudoers is not available\n", argv[0]); if (!sudoers) {
return 1; fprintf(stderr, "%s: /etc/sudoers is not available\n", argv[0]);
} return 1;
/* Read each line */
int in_sudoers = 0;
while (!feof(sudoers)) {
char line[1024];
fgets(line, 1024, sudoers);
char * nl = strchr(line, '\n');
if (nl) {
*nl = '\0';
} }
if (!strncmp(line,username,1024)) {
in_sudoers = 1; /* Read each line */
break; int in_sudoers = 0;
while (!feof(sudoers)) {
char line[1024];
fgets(line, 1024, sudoers);
char * nl = strchr(line, '\n');
if (nl) {
*nl = '\0';
}
if (!strncmp(line,username,1024)) {
in_sudoers = 1;
break;
}
}
fclose(sudoers);
if (!in_sudoers) {
fprintf(stderr, "%s is not in sudoers file.\n", username);
return 1;
} }
} }
fclose(sudoers);
if (!in_sudoers) { /* Write a timestamp file */
fprintf(stderr, "%s is not in sudoers file.\n", username); FILE * f = fopen(token_file, "a");
return 1; if (!f) {
fprintf(stderr, "%s: (warning) failed to create token file\n", argv[0]);
} }
fclose(f);
_do_it:
/* Set username to root */ /* Set username to root */
putenv("USER=root"); putenv("USER=root");