man pages with pseudo synopses which list filenames end up creating very ugly output...

[opendoas.git] / doas.c

diff --git a/doas.c b/doas.c
index a63f2e794627c340f0503e4e31abd0b60a5c6c67..b7248f0cf7145276bea201884020519f43a940eb 100644 (file)
--- a/doas.c
+++ b/doas.c
@@ -17,6 +17,7 @@
 
 #include <sys/types.h>
 #include <sys/stat.h>
+#include <sys/ioctl.h>
 
 #include <limits.h>
 #include <string.h>
@@ -46,7 +47,7 @@ version(void)
 static void __dead
 usage(void)
 {
-       fprintf(stderr, "usage: doas [-nsv] "
+       fprintf(stderr, "usage: doas [-Lnsv] "
 #ifdef HAVE_BSD_AUTH_H
            "[-a style] "
 #endif
@@ -54,20 +55,6 @@ usage(void)
        exit(1);
 }
 
-size_t
-arraylen(const char **arr)
-{
-       size_t cnt = 0;
-
-       if (arr) {
-               while (*arr) {
-                       cnt++;
-                       arr++;
-               }
-       }
-       return cnt;
-}
-
 static int
 parseuid(const char *s, uid_t *uid)
 {
@@ -153,7 +140,7 @@ match(uid_t uid, gid_t *groups, int ngroups, uid_t target, const char *cmd,
 }
 
 static int
-permit(uid_t uid, gid_t *groups, int ngroups, struct rule **lastr,
+permit(uid_t uid, gid_t *groups, int ngroups, const struct rule **lastr,
     uid_t target, const char *cmd, const char **cmdargs)
 {
        int i;
@@ -200,7 +187,7 @@ static void __dead
 checkconfig(const char *confpath, int argc, char **argv,
     uid_t uid, gid_t *groups, int ngroups, uid_t target)
 {
-       struct rule *rule;
+       const struct rule *rule;
 
        if (setresuid(uid, uid, uid) != 0)
                err(1, "setresuid");
@@ -221,10 +208,18 @@ checkconfig(const char *confpath, int argc, char **argv,
 
 #ifdef HAVE_BSD_AUTH_H
 static void
-authuser(const char *myname, const char *login_style)
+authuser(char *myname, char *login_style, int persist)
 {
        char *challenge = NULL, *response, rbuf[1024], cbuf[128];
        auth_session_t *as;
+       int fd = -1;
+
+       if (persist)
+               fd = open("/dev/tty", O_RDWR);
+       if (fd != -1) {
+               if (ioctl(fd, TIOCCHKVERAUTH) == 0)
+                       goto good;
+       }
 
        if (!(as = auth_userchallenge(myname, login_style, "auth-doas",
            &challenge)))
@@ -247,13 +242,19 @@ authuser(const char *myname, const char *login_style)
        if (!auth_userresponse(as, response, 0)) {
                syslog(LOG_AUTHPRIV | LOG_NOTICE,
                    "failed auth for %s", myname);
-               errc(1, EPERM, NULL);
+               errx(1, "Authorization failed");
        }
        explicit_bzero(rbuf, sizeof(rbuf));
+good:
+       if (fd != -1) {
+               int secs = 5 * 60;
+               ioctl(fd, TIOCSETVERAUTH, &secs);
+               close(fd);
+       }
 }
 #elif HAVE_SHADOW_H
 static void
-authuser(const char *myname, const char *login_style)
+authuser(const char *myname, const char *login_style, int persist)
 {
        const char *hash;
        char *encrypted;
@@ -310,7 +311,7 @@ main(int argc, char **argv)
        char cmdline[LINE_MAX];
        char myname[_PW_NAME_LEN + 1];
        struct passwd *pw;
-       struct rule *rule;
+       const struct rule *rule;
        uid_t uid;
        uid_t target = 0;
        gid_t groups[NGROUPS_MAX + 1];
@@ -326,17 +327,14 @@ main(int argc, char **argv)
 
        setprogname("doas");
 
-       if (pledge("stdio rpath getpw tty recvfd proc exec id", NULL) == -1)
-               err(1, "pledge");
-
        closefrom(STDERR_FILENO + 1);
 
        uid = getuid();
 
 #ifdef HAVE_BSD_AUTH_H
-# define OPTSTRING "a:C:nsu:v"
+# define OPTSTRING "a:C:Lnsu:v"
 #else
-# define OPTSTRING "+C:nsu:v"
+# define OPTSTRING "+C:Lnsu:v"
 #endif
 
        while ((ch = getopt(argc, argv, OPTSTRING)) != -1) {
@@ -349,6 +347,13 @@ main(int argc, char **argv)
                case 'C':
                        confpath = optarg;
                        break;
+               case 'L':
+#ifdef TIOCCLRVERAUTH
+                       i = open("/dev/tty", O_RDWR);
+                       if (i != -1)
+                               ioctl(i, TIOCCLRVERAUTH);
+                       exit(i == -1);
+#endif
                case 'u':
                        if (parseuid(optarg, &target) != 0)
                                errx(1, "unknown user");
@@ -407,6 +412,9 @@ main(int argc, char **argv)
                exit(1);        /* fail safe */
        }
 
+       if (geteuid())
+               errx(1, "not installed setuid");
+
        parseconfig("/etc/doas.conf", 1);
 
        /* cmdline is used only for logging, no need to abort on truncate */
@@ -431,7 +439,7 @@ main(int argc, char **argv)
                if (nflag)
                        errx(1, "Authorization required");
 
-               authuser(myname, login_style);
+               authuser(myname, login_style, rule->options & PERSIST);
        }
 #elif HAVE_PAM_APPL_H
        pw = getpwuid(target);