Commit Graph

141 Commits

Author SHA1 Message Date
Christian S.J. Peron
ce8c6d71f5 Fixup the parameters to audit_submit(3) the order is errno then return
value.  This bug went un-noticed for so long because EPERM == 1

MFC after:	1 week
Spotted by:	sson, rwatson
2009-04-04 20:58:18 +00:00
Daniel Gerzo
9ea29562d9 - add the -m option to the example commands because they would fail w/o it
as the ``man'' user does not have a valid shell by default.

PR:		docs/121713
Approved by:	trhodes
MFC after:	3 days
2008-07-01 20:56:23 +00:00
David Malone
f258a139d3 Fix a strict aliasing warning - I think it is really telling us
that the way char * and void * pointers may not be stored in the
same way.
2008-06-04 19:16:54 +00:00
David Xu
a964714f51 The upper while loop has already recycled child process, so the if
statement has never executed as expected, fix it.

MFC after: 3 days
2007-10-18 11:05:30 +00:00
Xin LI
9a0e6be26a Stop mentioning /usr/X11R6.
Approved by:	re (hrs)
2007-07-24 06:41:07 +00:00
Sean Farley
2966d28c32 Significantly reduce the memory leak as noted in BUGS section for
setenv(3) by tracking the size of the memory allocated instead of using
strlen() on the current value.

Convert all calls to POSIX from historic BSD API:
 - unsetenv returns an int.
 - putenv takes a char * instead of const char *.
 - putenv no longer makes a copy of the input string.
 - errno is set appropriately for POSIX.  Exceptions involve bad environ
   variable and internal initialization code.  These both set errno to
   EFAULT.

Several patches to base utilities to handle the POSIX changes from
Andrey Chernov's previous commit.  A few I re-wrote to use setenv()
instead of putenv().

New regression module for tools/regression/environ to test these
functions.  It also can be used to test the performance.

Bump __FreeBSD_version to 700050 due to API change.

PR:		kern/99826
Approved by:	wes
Approved by:	re (kensmith)
2007-07-04 00:00:41 +00:00
Andrey A. Chernov
ba174a5e38 Back out all POSIXified *env() changes.
Not because I admit they are technically wrong and not because of bug
reports (I receive nothing). But because I surprisingly meets so
strong opposition and resistance so lost any desire to continue that.

Anyone who interested in POSIX can dig out what changes and how
through cvs diffs.
2007-05-01 16:02:44 +00:00
Andrey A. Chernov
9e461e53cc Prepare for upcoming POSIXed putenv() rewrite:
don't free memory after putenv()
2007-04-30 12:51:02 +00:00
Maxim Sobolev
e7d4bf18db Backout previous change (SIGSYS related). The fix has been applied to the
proper place.

Pointed out by:	rwatson
2006-10-24 17:41:28 +00:00
Maxim Sobolev
a88ab48624 Ignore SIGSYS when BSM is compiled in. Otherwise, attempt to invoke su on
system that don't have audit framefork compiled into kernel or ia32 binary
on amd64 system will result in SIGSYS. There is one place in su.c itself
where it tries to check for errno != ENOSYS, but it has been a nop since su
does not catch SIGSYS anyway. There are few other places in libbsm,
where attempt to invoke audit syscal would result in SIGSYS if no audit
support is present in the kernel, so that the only reliable method for
now is to disable SIGSYS completely in the case when BSM is compiled in.

In the long run, both direct invocation of audit-related syscalls and
libbsm should be made more intellegent to handle the case when BSM is not
compiled into the kernel gracefully.

MFC after: 3 days
           (provided re@ approval)
2006-10-24 08:18:10 +00:00
Ruslan Ermilov
cb29445a92 Markup fixes. 2006-09-29 15:20:48 +00:00
Luoqi Chen
5a8e64ee60 Do not chdir(2) until after setuid(2), otherwise "su - username" would fail
when root doesn't have the permission to enter target user's home directory.
If set, PAM environment variable HOME will be used in chdir(2) instead of
pwd->pw_dir, this allows pam_chroot module to continue to function.
2006-09-29 04:41:37 +00:00
Joel Dahl
3e1f331553 Remove references to the pam(8) manual page. It does not exist.
Requested by:	novel
Discussed with:	brueffer, simon
2006-09-13 17:46:20 +00:00
Christian S.J. Peron
6319ad282f Integrate audit_submit(3) bits into su. This means that records for
successful and failed su attempts will be recorded using the AUE_su
event type (login or lo class) if auditing is present in the system.
Currently, the records will have a header, subject, text (with the
actual diagnostics), a return and trailer token.

See audit_submit(3) for more information.

Reviewed by:	rwatson
Obtained from:	TrustedBSD Project
2006-09-01 13:39:02 +00:00
Brad Davis
52a3a1928e - Mention that users need to be in the wheel group to `su - root' by default, and how to change it.
PR:		docs/70616
Submitted by:	Jilles Tjoelker <jilles at stack dot nl>
Reviewed by:	ru@
Approved by:	ceri@
MFC after:	3 days
2006-01-28 01:11:11 +00:00
Brian Somers
cd17a1f7ba Fix the other su bug reintroduced two commits ago, namely
$ su
    % kill -STOP $$

where su is executing (t)csh.  csh's job handling is a little more
special than that of (a)sh, bash and even zsh and blows up a little
more spectacularly.  This modification restores the original mucking
about with the tty pgrp, but is careful to only do it when su (or
su's child) is the foreground process.

While I'm here, fix a STDERR_FILENO spelling as suggested by bde.
2006-01-03 09:17:04 +00:00
Brian Somers
d039c62baa Handle the case (that I just broke) where the following hangs:
$ su
    # kill -STOP $$

Pointed out by:	David Xu <davidxu@freebsd.org>
2006-01-02 09:46:38 +00:00
Brian Somers
d43e192e7d Remove broken code that mucks about with tcsetpgrp() -- even if
su isn't the foreground process.  Hopefully this won't break PAM,
but I couldn't find any useful information about ache's theory
that it will.

Specifically, this change fixes the following:

    # sh
    # echo $$
    # su - root -c id &
    # echo $$

The PID output changes as su seems to be kill -STOP'ing itself
and catching the parent shell in the process.  This is especially
bad if you add a ``su - user -c command &'' to an rc script!

Sponsored by:		Sophos/Activestate
Not objected to by:	des
2006-01-02 08:51:21 +00:00
Ruslan Ermilov
6c7216df78 Sort sections. 2005-01-18 13:43:56 +00:00
Robert Watson
c8fbd1ec9b If su(1) is run without an effective uid of 0, generate an error to
the user indicating that su is not running setuid, which may help
suggest to the user that it should be setuid, or should not be
running from a file system mounted nosuid.

Suggsted by:	Ivan Voras <ivoras at fer dot hr>
MFC after:	2 weeks
2005-01-17 19:57:59 +00:00
Ruslan Ermilov
dee651eb15 Introduce the PRECIOUSPROG knob in bsd.prog.mk, similar
to PRECIOUSLIB from bsd.lib.mk.  The side effect of this
is making installing the world under jail(8) possible by
using another knob, NOFSCHG.

Reviewed by:	oliver
2004-11-03 18:01:21 +00:00
Simon L. B. Nielsen
a0b2be3918 Bump document date for last commit.
Noticed by:	ru
2004-10-04 12:06:05 +00:00
Simon L. B. Nielsen
d4b85942ac PAM configuration is now in /etc/pam.d/su.
Submitted by:	Jilles Tjoelker <jilles@stack.nl> (original version)
PR:		docs/70616 (part of)
MFC after:	1 week
2004-10-03 21:44:42 +00:00
Ruslan Ermilov
557b7fa148 Deal with double whitespace. 2004-07-03 00:24:45 +00:00
Ruslan Ermilov
6a3e8b0adc Mechanically kill hard sentence breaks. 2004-07-02 22:22:35 +00:00
Mark Murray
b90e600892 Oops. My last commit included a bug that would make "su -m" always
use /bin/sh. Fix this.
2004-06-15 20:23:02 +00:00
Mark Murray
953cb3ecc8 Paranoia, WARNS fixes and lint. 2004-06-13 11:21:06 +00:00
Ruslan Ermilov
47a49bc2b5 Bumped the document date.
Fixed the grammar nit.
2004-05-19 09:53:41 +00:00
Philippe Charnier
d6d62d8d63 Add FBSDID. Do not dot terminate errx(3) string. 2004-04-04 18:56:53 +00:00
Ruslan Ermilov
6ec2f175f9 Fixed style of assignments. 2004-02-02 18:01:19 +00:00
Dag-Erling Smørgrav
60f4b54d8f When root tries to su to a non-existent user, pam_authenticate() will
normally succeed (because root can su to anyone), but pam_acct_mgmt()
will most likely fail, causing su to log a confusing "pam_acct_mgmt:
error in service module" message.  To avoid this, call getpwnam()
before pam_acct_mgmt().

Sponsored by:	registrar.no
2004-01-06 09:47:24 +00:00
David Xu
7430623f55 Be sure to restore foreground group to parent su before parent su
exits, otherwise shell will be confused and does not set foreground
group correctly for next su command. This sounds like a bug in sh.
2003-11-04 14:51:34 +00:00
David Xu
bcf123b3f6 It seems when su executes in a shell scripts, there is a timing race,
sometimes, su will receive a SIGTTOU when parent su tries to set child
su's process group as foreground group, and su will be stopped unexpectly,
ignoring SIGTTOU fixes the problem.

Noticed by: fjoe
2003-11-03 23:54:55 +00:00
Olivier Houchard
f6a43a2b50 Fix broken su -m behaviour :
chshell must return 0 if the shell is not a standard shell, or else it is
possible to use an account without a valid shell.

Reviewed by:	des
2003-10-19 02:09:36 +00:00
Ken Smith
bec725403c - Clarification to how command line arguments are processed.
PR:		docs/55613
Submitted by:	gshapiro@freebsd.org
Approved by:	blackend (mentor)
2003-09-28 17:54:48 +00:00
Philippe Charnier
196604d77e typo 2003-06-08 13:51:40 +00:00
Dag-Erling Smørgrav
60b28daa8d PAM-related improvements:
- if operating "as them" (su -l), use pam_{open,close}_session()
 - allow PAM to override $HOME (pam_chroot needs this)
 - chdir early, because later on we may be chrooted and chdir will fail

Also use pid_t instead of int where applicable.
2003-04-08 16:59:53 +00:00
David Xu
a75fd4bf6e Put child process in a different process group, ensure that the broadcast
signal never affects su directly, some shells changes its pgrp at running
or suspended time, so a broadcast SIGTSTP from child will mess up su's job
control.

Discussed with: bde
2003-03-27 01:32:51 +00:00
Dag-Erling Smørgrav
7a179eb40f Fix style bugs in the previous commit (which weren't in bde's patch) 2003-03-11 11:35:24 +00:00
David Xu
658d3a6bf5 Reset SIGTSTP handler to default both for parent and child process.
Submitted by: bde
2003-03-11 09:16:51 +00:00
David Xu
e9da86cbbe Fix long standing job control bug. SIGTSTP shouldn't be ignored.
Special instructions tested:
suspend
stop $$
2003-03-11 00:10:22 +00:00
Dag-Erling Smørgrav
84c03427b4 Pass the correct, verified username to PAM instead of getlogin(). 2003-02-06 14:29:28 +00:00
Ruslan Ermilov
06e482e60a mdoc(7) police: markup polishing.
Approved by:	re
2002-11-26 17:33:37 +00:00
Robert Watson
1494905bb6 Add a new '-s' option to su(1): if the flag is present, attempt to
also set the user's MAC label as part of the user credential setup
by setting setusercontext(3)'s SETMAC flag.  By default, change only
traditional process properties.

Approved by:	re
Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, Network Associates Laboratories
2002-10-23 03:19:34 +00:00
Mark Murray
ed5fc39f22 When a user gets refused because the password is wrong, use the
older "BAD SU" syslog message that folks prefer. There is quite
a bit more tweaking that can be done with other similar messages.

Asked for by:	tjr
2002-10-18 08:23:24 +00:00
Tim J. Robbins
505b28166c Style: use sa_handler instead of __sigaction_u.__sa_handler. 2002-10-17 23:32:44 +00:00
Poul-Henning Kamp
81af0b570e Remove an unused variable. 2002-10-14 08:54:08 +00:00
Andrey A. Chernov
3e2322fcff Fix typing error in prev. commit 2002-08-12 17:24:42 +00:00
Andrey A. Chernov
09d932cf40 Fix style bug in prev. commit 2002-08-12 17:23:06 +00:00
Andrey A. Chernov
54c93e4f4d Fix su job control (recently introduced for PAM cleanup purposes) to not
kill login shell on either "suspend/fg" or "stop $$/fg" for tcsh. Since
this bug occurse on -stable too, it is not kernel threads bug.

Submitted by:	 David Xu <bsddiy@yahoo.com>
2002-08-12 10:49:01 +00:00