not necessarily the same name, but the indicated name

[opendoas.git] / doas.c

diff --git a/doas.c b/doas.c
index 7feaafc771af07a87ce54763b224a3c4ec0ae719..7c682cfed17e313ca90385e94bad9b9e90b7411a 100644 (file)
--- a/doas.c
+++ b/doas.c
@@ -55,20 +55,6 @@ usage(void)
        exit(1);
 }
 
-size_t
-arraylen(const char **arr)
-{
-       size_t cnt = 0;
-
-       if (arr) {
-               while (*arr) {
-                       cnt++;
-                       arr++;
-               }
-       }
-       return cnt;
-}
-
 static int
 parseuid(const char *s, uid_t *uid)
 {
@@ -154,7 +140,7 @@ match(uid_t uid, gid_t *groups, int ngroups, uid_t target, const char *cmd,
 }
 
 static int
-permit(uid_t uid, gid_t *groups, int ngroups, struct rule **lastr,
+permit(uid_t uid, gid_t *groups, int ngroups, const struct rule **lastr,
     uid_t target, const char *cmd, const char **cmdargs)
 {
        int i;
@@ -174,6 +160,7 @@ static void
 parseconfig(const char *filename, int checkperms)
 {
        extern FILE *yyfp;
+       extern int yyparse(void);
        struct stat sb;
 
        yyfp = fopen(filename, "r");
@@ -200,7 +187,7 @@ static void __dead
 checkconfig(const char *confpath, int argc, char **argv,
     uid_t uid, gid_t *groups, int ngroups, uid_t target)
 {
-       struct rule *rule;
+       const struct rule *rule;
 
        if (setresuid(uid, uid, uid) != 0)
                err(1, "setresuid");
@@ -255,7 +242,7 @@ authuser(char *myname, char *login_style, int persist)
        if (!auth_userresponse(as, response, 0)) {
                syslog(LOG_AUTHPRIV | LOG_NOTICE,
                    "failed auth for %s", myname);
-               errc(1, EPERM, NULL);
+               errx(1, "Authorization failed");
        }
        explicit_bzero(rbuf, sizeof(rbuf));
 good:
@@ -274,7 +261,17 @@ authuser(const char *myname, const char *login_style, int persist)
        struct passwd *pw;
 
        (void)login_style;
+
+#ifdef PERSIST_TIMESTAMP
+       int fd = -1;
+       int valid;
+       if (persist)
+               fd = persist_open(&valid, 5 * 60);
+       if (fd != -1 && valid)
+               goto good;
+#else
        (void)persist;
+#endif
 
        if (!(pw = getpwnam(myname)))
                err(1, "getpwnam");
@@ -309,6 +306,13 @@ authuser(const char *myname, const char *login_style, int persist)
                errx(1, "Authorization failed");
        }
        explicit_bzero(rbuf, sizeof(rbuf));
+#ifdef PERSIST_TIMESTAMP
+good:
+       if (fd != -1) {
+               persist_set(fd, 5 * 60);
+               close(fd);
+       }
+#endif
 }
 #endif /* HAVE_BSD_AUTH_H */
 
@@ -324,7 +328,7 @@ main(int argc, char **argv)
        char cmdline[LINE_MAX];
        char myname[_PW_NAME_LEN + 1];
        struct passwd *pw;
-       struct rule *rule;
+       const struct rule *rule;
        uid_t uid;
        uid_t target = 0;
        gid_t groups[NGROUPS_MAX + 1];
@@ -366,6 +370,8 @@ main(int argc, char **argv)
                        if (i != -1)
                                ioctl(i, TIOCCLRVERAUTH);
                        exit(i == -1);
+#elif PERSIST_TIMESTAMP
+                       exit(persist_clear() != 0);
 #endif
                case 'u':
                        if (parseuid(optarg, &target) != 0)
@@ -425,6 +431,9 @@ main(int argc, char **argv)
                exit(1);        /* fail safe */
        }
 
+       if (geteuid())
+               errx(1, "not installed setuid");
+
        parseconfig("/etc/doas.conf", 1);
 
        /* cmdline is used only for logging, no need to abort on truncate */