1 /*-
2 * Copyright (c) 1996 by
3 * Sean Eric Fagan <[email protected]>
4 * David Nugent <[email protected]>
5 * All rights reserved.
6 *
7 * Portions copyright (c) 1995,1997 by
8 * Berkeley Software Design, Inc.
9 * All rights reserved.
10 *
11 * Redistribution and use in source and binary forms, with or without
12 * modification, is permitted provided that the following conditions
13 * are met:
14 * 1. Redistributions of source code must retain the above copyright
15 * notice immediately at the beginning of the file, without modification,
16 * this list of conditions, and the following disclaimer.
17 * 2. Redistributions in binary form must reproduce the above copyright
18 * notice, this list of conditions and the following disclaimer in the
19 * documentation and/or other materials provided with the distribution.
20 * 3. This work was done expressly for inclusion into FreeBSD. Other use
21 * is permitted provided this notation is included.
22 * 4. Absolutely no warranty of function or purpose is made by the authors.
23 * 5. Modifications may be freely made to this file providing the above
24 * conditions are met.
25 *
26 * Low-level routines relating to the user capabilities database
27 */
28
29 #include <sys/cdefs.h>
30 __FBSDID("$FreeBSD$");
31
32 #include <sys/types.h>
33 #include <sys/time.h>
34 #include <sys/resource.h>
35 #include <sys/stat.h>
36 #include <sys/param.h>
37 #include <sys/socket.h>
38 #include <sys/wait.h>
39 #include <ctype.h>
40 #include <err.h>
41 #include <errno.h>
42 #include <fcntl.h>
43 #include <libutil.h>
44 #include <limits.h>
45 #include <login_cap.h>
46 #include <paths.h>
47 #include <pwd.h>
48 #include <stdarg.h>
49 #include <stdio.h>
50 #include <stdlib.h>
51 #include <string.h>
52 #include <syslog.h>
53 #include <unistd.h>
54
55
56 /*
57 * auth_checknologin()
58 * Checks for the existence of a nologin file in the login_cap
59 * capability <lc>. If there isn't one specified, then it checks
60 * to see if this class should just ignore nologin files. Lastly,
61 * it tries to print out the default nologin file, and, if such
62 * exists, it exits.
63 */
64
65 void
auth_checknologin(login_cap_t * lc)66 auth_checknologin(login_cap_t *lc)
67 {
68 const char *file;
69
70 /* Do we ignore a nologin file? */
71 if (login_getcapbool(lc, "ignorenologin", 0))
72 return;
73
74 /* Note that <file> will be "" if there is no nologin capability */
75 if ((file = login_getcapstr(lc, "nologin", "", NULL)) == NULL)
76 exit(1);
77
78 /*
79 * *file is true IFF there was a "nologin" capability
80 * Note that auth_cat() returns 1 only if the specified
81 * file exists, and is readable. E.g., /.nologin exists.
82 */
83 if ((*file && auth_cat(file)) || auth_cat(_PATH_NOLOGIN))
84 exit(1);
85 }
86
87
88 /*
89 * auth_cat()
90 * Checks for the readability of <file>; if it can be opened for
91 * reading, it prints it out to stdout, and then exits. Otherwise,
92 * it returns 0 (meaning no nologin file).
93 */
94
95 int
auth_cat(const char * file)96 auth_cat(const char *file)
97 {
98 int fd, count;
99 char buf[BUFSIZ];
100
101 if ((fd = open(file, O_RDONLY | O_CLOEXEC)) < 0)
102 return 0;
103 while ((count = read(fd, buf, sizeof(buf))) > 0)
104 (void)write(fileno(stdout), buf, count);
105 close(fd);
106 sleep(5); /* wait an arbitrary time to drain */
107 return 1;
108 }
109