d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Never allow a user to use crontab if opening /var/cron/{allow,deny} fails

Browse Source 
for any reason other than ENOENT (think resource limits). Close allow and
deny files before allowed() returns to stop the user's EDITOR being able to
read them.

Obtained from:	OpenBSD (partially)
This commit is contained in:
Tim J. Robbins 2002-08-04 04:32:27 +00:00
parent 10bc1114ce
commit 526b145c23
1 changed files with 23 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
usr.sbin/cron/lib/misc.c
View File

@ -410,31 +410,38 @@ int
allowed(username)
char *username;
{
static int init = FALSE;
static FILE *allow, *deny;
FILE *allow, *deny;
int isallowed;
isallowed = FALSE;
if (!init) {
init = TRUE;
#if defined(ALLOW_FILE) && defined(DENY_FILE)
allow = fopen(ALLOW_FILE, "r");
deny = fopen(DENY_FILE, "r");
Debug(DMISC, ("allow/deny enabled, %d/%d\n", !!allow, !!deny))
if ((allow = fopen(ALLOW_FILE, "r")) == NULL && errno != ENOENT)
goto out;
if ((deny = fopen(DENY_FILE, "r")) == NULL && errno != ENOENT)
goto out;
Debug(DMISC, ("allow/deny enabled, %d/%d\n", !!allow, !!deny))
#else
allow = NULL;
deny = NULL;
allow = NULL;
deny = NULL;
#endif
}
if (allow)
return (in_file(username, allow));
if (deny)
return (!in_file(username, deny));
isallowed = in_file(username, allow);
else if (deny)
isallowed = !in_file(username, deny);
else {
#if defined(ALLOW_ONLY_ROOT)
return (strcmp(username, ROOT_USER) == 0);
isallowed = (strcmp(username, ROOT_USER) == 0);
#else
return TRUE;
isallowed = TRUE;
#endif
}
out: if (allow)
fclose(allow);
if (deny)
fclose(deny);
return (isallowed);
}