Commit Graph

90 Commits

Author SHA1 Message Date
delphij
b963db4652 Remove unneeded header includes from usr.bin/ except contributed code.
Tested with:	make universe
2009-12-11 23:35:38 +00:00
csjp
049dc5709e Fixup the parameters to audit_submit(3) the order is errno then return
value.  This bug went un-noticed for so long because EPERM == 1

MFC after:	1 week
Spotted by:	sson, rwatson
2009-04-04 20:58:18 +00:00
dwmalone
b04619598b Fix a strict aliasing warning - I think it is really telling us
that the way char * and void * pointers may not be stored in the
same way.
2008-06-04 19:16:54 +00:00
davidxu
3d81878b1f The upper while loop has already recycled child process, so the if
statement has never executed as expected, fix it.

MFC after: 3 days
2007-10-18 11:05:30 +00:00
scf
196b6346ba Significantly reduce the memory leak as noted in BUGS section for
setenv(3) by tracking the size of the memory allocated instead of using
strlen() on the current value.

Convert all calls to POSIX from historic BSD API:
 - unsetenv returns an int.
 - putenv takes a char * instead of const char *.
 - putenv no longer makes a copy of the input string.
 - errno is set appropriately for POSIX.  Exceptions involve bad environ
   variable and internal initialization code.  These both set errno to
   EFAULT.

Several patches to base utilities to handle the POSIX changes from
Andrey Chernov's previous commit.  A few I re-wrote to use setenv()
instead of putenv().

New regression module for tools/regression/environ to test these
functions.  It also can be used to test the performance.

Bump __FreeBSD_version to 700050 due to API change.

PR:		kern/99826
Approved by:	wes
Approved by:	re (kensmith)
2007-07-04 00:00:41 +00:00
ache
6ccaf050cc Back out all POSIXified *env() changes.
Not because I admit they are technically wrong and not because of bug
reports (I receive nothing). But because I surprisingly meets so
strong opposition and resistance so lost any desire to continue that.

Anyone who interested in POSIX can dig out what changes and how
through cvs diffs.
2007-05-01 16:02:44 +00:00
ache
123c99294b Prepare for upcoming POSIXed putenv() rewrite:
don't free memory after putenv()
2007-04-30 12:51:02 +00:00
sobomax
19094a2bf3 Backout previous change (SIGSYS related). The fix has been applied to the
proper place.

Pointed out by:	rwatson
2006-10-24 17:41:28 +00:00
sobomax
1d06416b30 Ignore SIGSYS when BSM is compiled in. Otherwise, attempt to invoke su on
system that don't have audit framefork compiled into kernel or ia32 binary
on amd64 system will result in SIGSYS. There is one place in su.c itself
where it tries to check for errno != ENOSYS, but it has been a nop since su
does not catch SIGSYS anyway. There are few other places in libbsm,
where attempt to invoke audit syscal would result in SIGSYS if no audit
support is present in the kernel, so that the only reliable method for
now is to disable SIGSYS completely in the case when BSM is compiled in.

In the long run, both direct invocation of audit-related syscalls and
libbsm should be made more intellegent to handle the case when BSM is not
compiled into the kernel gracefully.

MFC after: 3 days
           (provided re@ approval)
2006-10-24 08:18:10 +00:00
luoqi
16c630b2da Do not chdir(2) until after setuid(2), otherwise "su - username" would fail
when root doesn't have the permission to enter target user's home directory.
If set, PAM environment variable HOME will be used in chdir(2) instead of
pwd->pw_dir, this allows pam_chroot module to continue to function.
2006-09-29 04:41:37 +00:00
csjp
5c107d0b0f Integrate audit_submit(3) bits into su. This means that records for
successful and failed su attempts will be recorded using the AUE_su
event type (login or lo class) if auditing is present in the system.
Currently, the records will have a header, subject, text (with the
actual diagnostics), a return and trailer token.

See audit_submit(3) for more information.

Reviewed by:	rwatson
Obtained from:	TrustedBSD Project
2006-09-01 13:39:02 +00:00
brian
75107ac807 Fix the other su bug reintroduced two commits ago, namely
$ su
    % kill -STOP $$

where su is executing (t)csh.  csh's job handling is a little more
special than that of (a)sh, bash and even zsh and blows up a little
more spectacularly.  This modification restores the original mucking
about with the tty pgrp, but is careful to only do it when su (or
su's child) is the foreground process.

While I'm here, fix a STDERR_FILENO spelling as suggested by bde.
2006-01-03 09:17:04 +00:00
brian
6e6de63b65 Handle the case (that I just broke) where the following hangs:
$ su
    # kill -STOP $$

Pointed out by:	David Xu <davidxu@freebsd.org>
2006-01-02 09:46:38 +00:00
brian
9866b0b749 Remove broken code that mucks about with tcsetpgrp() -- even if
su isn't the foreground process.  Hopefully this won't break PAM,
but I couldn't find any useful information about ache's theory
that it will.

Specifically, this change fixes the following:

    # sh
    # echo $$
    # su - root -c id &
    # echo $$

The PID output changes as su seems to be kill -STOP'ing itself
and catching the parent shell in the process.  This is especially
bad if you add a ``su - user -c command &'' to an rc script!

Sponsored by:		Sophos/Activestate
Not objected to by:	des
2006-01-02 08:51:21 +00:00
rwatson
0012bc8f92 If su(1) is run without an effective uid of 0, generate an error to
the user indicating that su is not running setuid, which may help
suggest to the user that it should be setuid, or should not be
running from a file system mounted nosuid.

Suggsted by:	Ivan Voras <ivoras at fer dot hr>
MFC after:	2 weeks
2005-01-17 19:57:59 +00:00
markm
e7ed8bc0a8 Oops. My last commit included a bug that would make "su -m" always
use /bin/sh. Fix this.
2004-06-15 20:23:02 +00:00
markm
ea8442f9ea Paranoia, WARNS fixes and lint. 2004-06-13 11:21:06 +00:00
charnier
055112142a Add FBSDID. Do not dot terminate errx(3) string. 2004-04-04 18:56:53 +00:00
des
77da48ef10 When root tries to su to a non-existent user, pam_authenticate() will
normally succeed (because root can su to anyone), but pam_acct_mgmt()
will most likely fail, causing su to log a confusing "pam_acct_mgmt:
error in service module" message.  To avoid this, call getpwnam()
before pam_acct_mgmt().

Sponsored by:	registrar.no
2004-01-06 09:47:24 +00:00
davidxu
b5882bdf82 Be sure to restore foreground group to parent su before parent su
exits, otherwise shell will be confused and does not set foreground
group correctly for next su command. This sounds like a bug in sh.
2003-11-04 14:51:34 +00:00
davidxu
8792262eee It seems when su executes in a shell scripts, there is a timing race,
sometimes, su will receive a SIGTTOU when parent su tries to set child
su's process group as foreground group, and su will be stopped unexpectly,
ignoring SIGTTOU fixes the problem.

Noticed by: fjoe
2003-11-03 23:54:55 +00:00
cognet
eb4121cb0d Fix broken su -m behaviour :
chshell must return 0 if the shell is not a standard shell, or else it is
possible to use an account without a valid shell.

Reviewed by:	des
2003-10-19 02:09:36 +00:00
des
e3a20d4e48 PAM-related improvements:
- if operating "as them" (su -l), use pam_{open,close}_session()
 - allow PAM to override $HOME (pam_chroot needs this)
 - chdir early, because later on we may be chrooted and chdir will fail

Also use pid_t instead of int where applicable.
2003-04-08 16:59:53 +00:00
davidxu
e173b93e2a Put child process in a different process group, ensure that the broadcast
signal never affects su directly, some shells changes its pgrp at running
or suspended time, so a broadcast SIGTSTP from child will mess up su's job
control.

Discussed with: bde
2003-03-27 01:32:51 +00:00
des
118ffeb10c Fix style bugs in the previous commit (which weren't in bde's patch) 2003-03-11 11:35:24 +00:00
davidxu
59af771a3e Reset SIGTSTP handler to default both for parent and child process.
Submitted by: bde
2003-03-11 09:16:51 +00:00
davidxu
5bae8e4c5d Fix long standing job control bug. SIGTSTP shouldn't be ignored.
Special instructions tested:
suspend
stop $$
2003-03-11 00:10:22 +00:00
des
c4a7a7ecc1 Pass the correct, verified username to PAM instead of getlogin(). 2003-02-06 14:29:28 +00:00
rwatson
22d94f8404 Add a new '-s' option to su(1): if the flag is present, attempt to
also set the user's MAC label as part of the user credential setup
by setting setusercontext(3)'s SETMAC flag.  By default, change only
traditional process properties.

Approved by:	re
Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, Network Associates Laboratories
2002-10-23 03:19:34 +00:00
markm
c955f36e2f When a user gets refused because the password is wrong, use the
older "BAD SU" syslog message that folks prefer. There is quite
a bit more tweaking that can be done with other similar messages.

Asked for by:	tjr
2002-10-18 08:23:24 +00:00
tjr
a09fdd84e6 Style: use sa_handler instead of __sigaction_u.__sa_handler. 2002-10-17 23:32:44 +00:00
phk
95d3ce583e Remove an unused variable. 2002-10-14 08:54:08 +00:00
ache
d95ba53c2b Fix typing error in prev. commit 2002-08-12 17:24:42 +00:00
ache
54c34d65e7 Fix style bug in prev. commit 2002-08-12 17:23:06 +00:00
ache
3ad9cb5821 Fix su job control (recently introduced for PAM cleanup purposes) to not
kill login shell on either "suspend/fg" or "stop $$/fg" for tcsh. Since
this bug occurse on -stable too, it is not kernel threads bug.

Submitted by:	 David Xu <bsddiy@yahoo.com>
2002-08-12 10:49:01 +00:00
ache
376dbc34ba Back out workaround of fixing "suspend/fg" by price of breaking "stop $$/fg".
This is real kernel bug (threads) and don't attempt to mask it by
workarounds to increase chances to fix it in the kernel.
2002-08-07 05:44:50 +00:00
ache
d9db561695 Remove tcsetpgrp() stuff across suspend/continue because it cause upper level
tcsh killed on resume (fg). It is because tcsh is interactive itself and
do its own things with terminal group.
2002-07-09 19:11:12 +00:00
dillon
ccc122e85a This is Alexander Kabaev's patch to solve the signal problem with su
(see 'zsh exits upon ^C' thread).  This may be temporary be he's been
running it for a year without incident so we should be golden with it.

Approved by:	des
2002-06-26 00:42:40 +00:00
dillon
ed0d76e1e4 Backout 1.51 on DES's request.
Approved by:	des
2002-06-26 00:38:39 +00:00
des
4ba107a215 Make our child the leader of its own process group to avoid receiving
signals in its stead.  This fixes the dread "zsh exits upon ^C" bug.
2002-05-29 03:32:17 +00:00
des
0b10af209d Drive-by whitespace cleanup & add NAI copyright 2002-05-28 06:47:32 +00:00
des
912fe80624 Belatedly OpenPAMify. I forgot this patch in last night's megacommit.
Sponsored by:	DARPA, NAI Labs
2002-03-06 12:46:56 +00:00
des
9816fc1afb Don't set PAM_RHOST, this is a local login.
Sponsored by:	DARPA, NAI Labs
2002-01-24 16:20:17 +00:00
markm
12c7e49b74 Reinstate complete (and now correctly functioning) WARNS=2. 2001-09-12 19:15:02 +00:00
markm
0c5fbd643b Back out (with prejudice) the last WARNS=2 fix. I cannot understand
its failure mode, and will revisit it later.
2001-09-07 16:20:38 +00:00
markm
8fd9133a9f WARNS=2 fixes.
The remaining problem of converting highly incompatible pointer types
is done by "laundering" the value through a union.

This solves the problem (in my own mind) of how a "const char *" _ever_
actually gets a value in a WARNS=2 world.
2001-09-04 17:10:57 +00:00
markm
3812f01803 Very minor stylistic nit.
Discussed with:	ru
2001-08-20 12:46:11 +00:00
ru
d26a0abd70 Substitute ARGSTR in-place.
Forgot trailing newline in usage().
2001-08-15 15:24:08 +00:00
ru
1d3bb7d67f Fixed the usage() string.
This also reverts change in rev. 1.36 to the documented
style of writing usage().

PR:		bin/29730
Submitted by:	Joseph Mallett <jmallett@xMach.org>
2001-08-15 15:11:52 +00:00
markm
77f1de760e Set the RUSER for PAM so that (eg) kerberos can set up tickets properly. 2001-08-11 14:24:13 +00:00