003 File Manager
Current Path:
/usr/src/crypto/heimdal/lib/kadm5
usr
/
src
/
crypto
/
heimdal
/
lib
/
kadm5
/
π
..
π
ChangeLog
(38.93 KB)
π
Makefile.am
(4.54 KB)
π
Makefile.in
(52.12 KB)
π
acl.c
(5.6 KB)
π
ad.c
(32.74 KB)
π
admin.h
(7.96 KB)
π
bump_pw_expire.c
(2.05 KB)
π
check-cracklib.pl
(2.79 KB)
π
chpass_c.c
(3.88 KB)
π
chpass_s.c
(5.58 KB)
π
client_glue.c
(4.39 KB)
π
common_glue.c
(3.82 KB)
π
context_s.c
(5.49 KB)
π
create_c.c
(2.76 KB)
π
create_s.c
(5.7 KB)
π
default_keys.c
(3.34 KB)
π
delete_c.c
(2.63 KB)
π
delete_s.c
(2.67 KB)
π
destroy_c.c
(2.11 KB)
π
destroy_s.c
(2.6 KB)
π
ent_setup.c
(6.71 KB)
π
error.c
(1.82 KB)
π
flush.c
(1.77 KB)
π
flush_c.c
(1.68 KB)
π
flush_s.c
(1.68 KB)
π
free.c
(2.93 KB)
π
get_c.c
(2.79 KB)
π
get_princs_c.c
(2.87 KB)
π
get_princs_s.c
(3.42 KB)
π
get_s.c
(9.63 KB)
π
init_c.c
(18.89 KB)
π
init_s.c
(6.66 KB)
π
iprop-commands.in
(3.28 KB)
π
iprop-log.8
(3.79 KB)
π
iprop-log.c
(12.01 KB)
π
iprop.8
(5.43 KB)
π
iprop.h
(2.17 KB)
π
ipropd_common.c
(2.21 KB)
π
ipropd_master.c
(26.06 KB)
π
ipropd_slave.c
(20.02 KB)
π
kadm5-private.h
(10.7 KB)
π
kadm5-protos.h
(5.09 KB)
π
kadm5-pwcheck.h
(2.48 KB)
π
kadm5_err.et
(3.43 KB)
π
kadm5_locl.h
(2.43 KB)
π
kadm5_pwcheck.3
(5.21 KB)
π
keys.c
(3.03 KB)
π
log.c
(24.91 KB)
π
marshall.c
(9.05 KB)
π
modify_c.c
(2.69 KB)
π
modify_s.c
(3.28 KB)
π
password_quality.c
(12.52 KB)
π
private.h
(4.47 KB)
π
privs_c.c
(2.66 KB)
π
privs_s.c
(1.81 KB)
π
randkey_c.c
(2.95 KB)
π
randkey_s.c
(3.29 KB)
π
rename_c.c
(2.57 KB)
π
rename_s.c
(3.64 KB)
π
sample_passwd_check.c
(2.94 KB)
π
send_recv.c
(3.14 KB)
π
server_glue.c
(4.39 KB)
π
set_keys.c
(6.81 KB)
π
set_modifier.c
(2.08 KB)
π
test_pw_quality.c
(3.08 KB)
π
version-script.map
(1.55 KB)
Editing: acl.c
/* * Copyright (c) 1997 - 2001 Kungliga Tekniska HΓΆgskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * * 3. Neither the name of the Institute nor the names of its contributors * may be used to endorse or promote products derived from this software * without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. */ #include "kadm5_locl.h" RCSID("$Id$"); static struct units acl_units[] = { { "all", KADM5_PRIV_ALL }, { "change-password",KADM5_PRIV_CPW }, { "cpw", KADM5_PRIV_CPW }, { "list", KADM5_PRIV_LIST }, { "delete", KADM5_PRIV_DELETE }, { "modify", KADM5_PRIV_MODIFY }, { "add", KADM5_PRIV_ADD }, { "get", KADM5_PRIV_GET }, { NULL, 0 } }; kadm5_ret_t _kadm5_string_to_privs(const char *s, uint32_t* privs) { int flags; flags = parse_flags(s, acl_units, 0); if(flags < 0) return KADM5_FAILURE; *privs = flags; return 0; } kadm5_ret_t _kadm5_privs_to_string(uint32_t privs, char *string, size_t len) { if(privs == 0) strlcpy(string, "none", len); else unparse_flags(privs, acl_units + 1, string, len); return 0; } /* * retrieve the right for the current caller on `princ' (NULL means all) * and store them in `ret_flags' * return 0 or an error. */ static kadm5_ret_t fetch_acl (kadm5_server_context *context, krb5_const_principal princ, unsigned *ret_flags) { FILE *f; krb5_error_code ret = 0; char buf[256]; *ret_flags = 0; /* no acl file -> no rights */ f = fopen(context->config.acl_file, "r"); if (f == NULL) return 0; while(fgets(buf, sizeof(buf), f) != NULL) { char *foo = NULL, *p; krb5_principal this_princ; unsigned flags = 0; p = strtok_r(buf, " \t\n", &foo); if(p == NULL) continue; if (*p == '#') /* comment */ continue; ret = krb5_parse_name(context->context, p, &this_princ); if(ret) break; if(!krb5_principal_compare(context->context, context->caller, this_princ)) { krb5_free_principal(context->context, this_princ); continue; } krb5_free_principal(context->context, this_princ); p = strtok_r(NULL, " \t\n", &foo); if(p == NULL) continue; ret = _kadm5_string_to_privs(p, &flags); if (ret) break; p = strtok_r(NULL, " \t\n", &foo); if (p == NULL) { *ret_flags = flags; break; } if (princ != NULL) { krb5_principal pattern_princ; krb5_boolean match; ret = krb5_parse_name (context->context, p, &pattern_princ); if (ret) break; match = krb5_principal_match (context->context, princ, pattern_princ); krb5_free_principal (context->context, pattern_princ); if (match) { *ret_flags = flags; break; } } } fclose(f); return ret; } /* * set global acl flags in `context' for the current caller. * return 0 on success or an error */ kadm5_ret_t _kadm5_acl_init(kadm5_server_context *context) { krb5_principal princ; krb5_error_code ret; ret = krb5_parse_name(context->context, KADM5_ADMIN_SERVICE, &princ); if (ret) return ret; ret = krb5_principal_compare(context->context, context->caller, princ); krb5_free_principal(context->context, princ); if(ret != 0) { context->acl_flags = KADM5_PRIV_ALL; return 0; } return fetch_acl (context, NULL, &context->acl_flags); } /* * check if `flags' allows `op' * return 0 if OK or an error */ static kadm5_ret_t check_flags (unsigned op, unsigned flags) { unsigned res = ~flags & op; if(res & KADM5_PRIV_GET) return KADM5_AUTH_GET; if(res & KADM5_PRIV_ADD) return KADM5_AUTH_ADD; if(res & KADM5_PRIV_MODIFY) return KADM5_AUTH_MODIFY; if(res & KADM5_PRIV_DELETE) return KADM5_AUTH_DELETE; if(res & KADM5_PRIV_CPW) return KADM5_AUTH_CHANGEPW; if(res & KADM5_PRIV_LIST) return KADM5_AUTH_LIST; if(res) return KADM5_AUTH_INSUFFICIENT; return 0; } /* * return 0 if the current caller in `context' is allowed to perform * `op' on `princ' and otherwise an error * princ == NULL if it's not relevant. */ kadm5_ret_t _kadm5_acl_check_permission(kadm5_server_context *context, unsigned op, krb5_const_principal princ) { kadm5_ret_t ret; unsigned princ_flags; ret = check_flags (op, context->acl_flags); if (ret == 0) return ret; ret = fetch_acl (context, princ, &princ_flags); if (ret) return ret; return check_flags (op, princ_flags); }
Upload File
Create Folder