Date: Mon, 4 Aug 1997 14:18:52 -0700 From: Alan Batie <batie@aahz.jf.intel.com> To: hackers@freebsd.org Subject: login classes Message-ID: <19970804141852.47074@aahz.jf.intel.com>
next in thread | raw e-mail | index | archive | help
--ew6BAiZeqk4r7MaW
Content-Type: text/plain; charset=us-ascii
FreeBSD 2.2.2-RELEASE
Login classes are a great idea...if they were actually used...
Every time I turn around (ok, twice, so far :-) ), I find something that
doesn't actually use them, which results in "cannot fork" errors (being
an X user with a multitude of windows, I quickly reach the default
per-user process limit). I've already hacked cron to add them in, and
now it looks like I need to hack smrsh so that vacation will run. God
help me if sendmail gives up root before invoking smrsh and I have to
hack *it*. Especially when I have two days left before I leave...
IMHO, user permissions and resource limits should be managed by the kernel,
in one place, not scattered all over creation where they're bound to be
wrong at one time or another... KISS is especially important when it comes
to security matters.
Here's the patch to cron:
*** Makefile.org Thu Jul 24 17:33:03 1997
--- Makefile Thu Jul 24 17:32:29 1997
***************
*** 12,17 ****
DPADD+= ${.CURDIR}/../lib/libcron.a
.endif
! LDADD+= -lcron
.include <bsd.prog.mk>
--- 12,17 ----
DPADD+= ${.CURDIR}/../lib/libcron.a
.endif
! LDADD+= -lcron -lutil
.include <bsd.prog.mk>
*** do_command.c.org Thu Jul 24 17:25:36 1997
--- do_command.c Thu Jul 24 17:31:27 1997
***************
*** 28,33 ****
--- 28,35 ----
#if defined(SYSLOG)
# include <syslog.h>
#endif
+ #include <pwd.h>
+ #include <login_cap.h>
static void child_process __P((entry *, user *)),
***************
*** 77,82 ****
--- 79,86 ----
register char *input_data;
char *usernm, *mailto;
int children = 0;
+ struct passwd *pwd;
+ login_cap_t *lc = NULL;
Debug(DPROC, ("[%d] child_process('%s')\n", getpid(), e->cmd))
***************
*** 212,226 ****
*/
do_univ(u);
! /* set our directory, uid and gid. Set gid first, since once
! * we set uid, we've lost root privledges.
! */
chdir(env_get("HOME", e->envp));
# if defined(BSD)
initgroups(env_get("LOGNAME", e->envp), e->gid);
# endif
! setgid(e->gid);
! setuid(e->uid); /* we aren't root after this... */
/* exec the command.
*/
--- 216,235 ----
*/
do_univ(u);
! /* set our directory and user context */
chdir(env_get("HOME", e->envp));
# if defined(BSD)
initgroups(env_get("LOGNAME", e->envp), e->gid);
# endif
! /* become the user */
! pwd = getpwuid(e->uid);
! lc = login_getpwclass(pwd);
!
! /* we aren't root after this... */
! if (setusercontext(lc, pwd, pwd->pw_uid, LOGIN_SETALL) != 0) {
! fprintf(stderr, "setusercontext() failed - exiting");
! exit(1);
! }
/* exec the command.
*/
--
Alan Batie ------ What goes up, must come down.
batie@aahz.jf.intel.com \ / Ask any system administrator.
+1 503-264-8844 (voice) \ / --unknown
D0 D2 39 0E 02 34 D6 B4 \/ 5A 41 21 8F 23 5F 08 9D
--ew6BAiZeqk4r7MaW
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
iQCVAwUBM+ZHPBCfrckvDwdpAQG88QP7B3J5VKGN5SQ3n60aVjjtb6wOemhIRgi+
yiYcNeKrzAlxEDom4hMFmEReoHN83Z4lPzX+OveA/9rXsBiiAIZ288dek7x/3hAP
Q9QOMNkgWiKFYTKa0MWRbHR2V8L7EkWgbDVPL6rE6N8BNmJkJaHuXZkHgTslpljn
iv85tN4gNXk=
=NOuG
-----END PGP SIGNATURE-----
--ew6BAiZeqk4r7MaW--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?19970804141852.47074>