44 |
#include <symtab.h> |
#include <symtab.h> |
45 |
#include <rewrite.h> |
#include <rewrite.h> |
46 |
|
|
|
|
|
47 |
int |
int |
48 |
radius_change_uid(struct passwd *pwd) |
radius_change_uid(struct passwd *pwd) |
49 |
{ |
{ |
50 |
if (pwd->pw_gid != 0 && setgid(pwd->pw_gid)) { |
if (pwd->pw_gid != 0 && setgid(pwd->pw_gid)) { |
51 |
radlog(L_ERR|L_PERROR, |
radlog(L_ERR|L_PERROR, |
52 |
_("setgid(%d) failed"), pwd->pw_gid); |
_("setgid(%d) failed"), pwd->pw_gid); |
53 |
|
return -1; |
54 |
} |
} |
55 |
if (pwd->pw_uid != 0) { |
if (pwd->pw_uid != 0) { |
56 |
#if defined(HAVE_SETEUID) |
#if defined(HAVE_SETEUID) |
57 |
if (seteuid(pwd->pw_uid)) |
if (seteuid(pwd->pw_uid)) { |
58 |
radlog(L_ERR|L_PERROR, |
radlog(L_ERR|L_PERROR, |
59 |
_("seteuid(%d) failed (ruid=%d, euid=%d)"), |
_("seteuid(%d) failed (ruid=%d, euid=%d)"), |
60 |
pwd->pw_uid, getuid(), geteuid()); |
pwd->pw_uid, getuid(), geteuid()); |
61 |
|
return -1; |
62 |
|
} |
63 |
#elif defined(HAVE_SETREUID) |
#elif defined(HAVE_SETREUID) |
64 |
if (setreuid(0, pwd->pw_uid)) |
if (setreuid(0, pwd->pw_uid)) { |
65 |
radlog(L_ERR|L_PERROR, |
radlog(L_ERR|L_PERROR, |
66 |
_("setreuid(0,%d) failed (ruid=%d, euid=%d)"), |
_("setreuid(0,%d) failed (ruid=%d, euid=%d)"), |
67 |
pwd->pw_uid, getuid(), geteuid()); |
pwd->pw_uid, getuid(), geteuid()); |
68 |
|
return -1; |
69 |
|
} |
70 |
#else |
#else |
71 |
# error "*** NO WAY TO SET EFFECTIVE UID IN radius_change_uid() ***" |
# error "*** NO WAY TO SET EFFECTIVE UID IN radius_change_uid() ***" |
72 |
#endif |
#endif |
73 |
} |
} |
74 |
|
return 0; |
75 |
} |
} |
76 |
|
|
77 |
/* Execute a program on successful authentication. |
/* Execute a program on successful authentication. |
148 |
|
|
149 |
chdir("/tmp"); |
chdir("/tmp"); |
150 |
|
|
151 |
radius_change_uid(pwd); |
if (radius_change_uid(pwd)) |
152 |
|
exit(2); |
153 |
|
|
154 |
execvp(argv[0], argv); |
execvp(argv[0], argv); |
155 |
|
|
266 |
for (i = getmaxfd(); i > 2; i--) |
for (i = getmaxfd(); i > 2; i--) |
267 |
close(i); |
close(i); |
268 |
|
|
269 |
radius_change_uid(pwd); |
if (radius_change_uid(pwd)) |
270 |
|
exit(2); |
271 |
execvp(argv[0], argv); |
execvp(argv[0], argv); |
272 |
|
|
273 |
/* Report error via syslog: we might not be able |
/* Report error via syslog: we might not be able |
351 |
buffer, |
buffer, |
352 |
filter->lines_input, filter->lines_output); |
filter->lines_input, filter->lines_output); |
353 |
filter->pid = 0; |
filter->pid = 0; |
354 |
|
return 1; |
355 |
} |
} |
356 |
|
return 0; |
357 |
} |
} |
358 |
|
|
359 |
void |
void |
592 |
Filter *filter; |
Filter *filter; |
593 |
int rc = -1; |
int rc = -1; |
594 |
int err; |
int err; |
|
char *buf = NULL; |
|
|
char *errp; |
|
|
size_t size; |
|
|
VALUE_PAIR *vp = NULL; |
|
|
char buffer[1024]; |
|
595 |
|
|
596 |
filter = filter_open(name, req, R_ACCT, &err); |
filter = filter_open(name, req, R_ACCT, &err); |
597 |
if (!filter) |
if (!filter) |
616 |
filter_close(filter); |
filter_close(filter); |
617 |
} else if (isdigit(buffer[0])) { |
} else if (isdigit(buffer[0])) { |
618 |
char *ptr; |
char *ptr; |
|
char *errp; |
|
619 |
|
|
620 |
debug(1, ("%s > \"%s\"", filter->name, buffer)); |
debug(1, ("%s > \"%s\"", filter->name, buffer)); |
621 |
rc = strtoul(buffer, &ptr, 0); |
rc = strtoul(buffer, &ptr, 0); |
622 |
|
if (!isspace(*ptr)) { |
623 |
|
radlog(L_ERR, |
624 |
|
_("filter %s (acct): bad output: %s"), |
625 |
|
filter->name, buffer); |
626 |
|
return -1; |
627 |
|
} |
628 |
} else { |
} else { |
629 |
radlog(L_ERR, |
radlog(L_ERR, |
630 |
_("filter %s (acct): bad output: %s"), |
_("filter %s (acct): bad output: %s"), |