Never allow a user to use crontab if opening /var/cron/{allow,deny} fails
for any reason other than ENOENT (think resource limits). Close allow and deny files before allowed() returns to stop the user's EDITOR being able to read them. Obtained from: OpenBSD (partially)
This commit is contained in:
parent
10bc1114ce
commit
526b145c23
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=101293
@ -410,31 +410,38 @@ int
|
||||
allowed(username)
|
||||
char *username;
|
||||
{
|
||||
static int init = FALSE;
|
||||
static FILE *allow, *deny;
|
||||
FILE *allow, *deny;
|
||||
int isallowed;
|
||||
|
||||
isallowed = FALSE;
|
||||
|
||||
if (!init) {
|
||||
init = TRUE;
|
||||
#if defined(ALLOW_FILE) && defined(DENY_FILE)
|
||||
allow = fopen(ALLOW_FILE, "r");
|
||||
deny = fopen(DENY_FILE, "r");
|
||||
Debug(DMISC, ("allow/deny enabled, %d/%d\n", !!allow, !!deny))
|
||||
if ((allow = fopen(ALLOW_FILE, "r")) == NULL && errno != ENOENT)
|
||||
goto out;
|
||||
if ((deny = fopen(DENY_FILE, "r")) == NULL && errno != ENOENT)
|
||||
goto out;
|
||||
Debug(DMISC, ("allow/deny enabled, %d/%d\n", !!allow, !!deny))
|
||||
#else
|
||||
allow = NULL;
|
||||
deny = NULL;
|
||||
allow = NULL;
|
||||
deny = NULL;
|
||||
#endif
|
||||
}
|
||||
|
||||
if (allow)
|
||||
return (in_file(username, allow));
|
||||
if (deny)
|
||||
return (!in_file(username, deny));
|
||||
|
||||
isallowed = in_file(username, allow);
|
||||
else if (deny)
|
||||
isallowed = !in_file(username, deny);
|
||||
else {
|
||||
#if defined(ALLOW_ONLY_ROOT)
|
||||
return (strcmp(username, ROOT_USER) == 0);
|
||||
isallowed = (strcmp(username, ROOT_USER) == 0);
|
||||
#else
|
||||
return TRUE;
|
||||
isallowed = TRUE;
|
||||
#endif
|
||||
}
|
||||
out: if (allow)
|
||||
fclose(allow);
|
||||
if (deny)
|
||||
fclose(deny);
|
||||
return (isallowed);
|
||||
}
|
||||
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user