lib/colon/passwd/slurp/check.cc

Go to the documentation of this file.

//
// nis-util - NIS Administration Utilities
// Copyright (C) 2001, 2008, 2009, 2011, 2012 Peter Miller
//
// This program is free software; you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation; either version 2 of the License, or (at
// your option) any later version.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
// General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// along with this program. If not, see <http://www.gnu.org/licenses/>.
//

#include <lib/ac/errno.h>
#include <lib/ac/string.h>
#include <lib/ac/sys/types.h>
#include <lib/ac/sys/stat.h>
#include <lib/ac/unistd.h>
#include <libexplain/lstat.h>

#include <lib/colon/group/slurp.h>
#include <lib/colon/passwd/slurp/check.h>
#include <lib/path_join.h>


colon_passwd_slurp_check::~colon_passwd_slurp_check()
{
}


colon_passwd_slurp_check::colon_passwd_slurp_check(
    const rcstring &a_filename,
    const colon_group_slurp::pointer &a_group
) :
    colon_passwd_slurp(a_filename),
    group(a_group)
{
}


colon_passwd_slurp_check::pointer
colon_passwd_slurp_check::create(const rcstring &a_filename,
    const colon_group_slurp::pointer &a_group)
{
    return pointer(new colon_passwd_slurp_check(a_filename, a_group));
}


bool
colon_passwd_slurp_check::process(const record::pointer &rp)
{
    // Do all the base class's processing first.
    if (!colon_passwd_slurp::process(rp))
        return false;

    //
    // Check the GID field
    //
    {
        const colon_group::record::pointer gp =
            group->query_by_gid(rp->get_gid());
        if (!gp)
        {
            error
            (
                rp->get_source_location(),
                "user %s: group id %s unknown",
                rp->get_name().quote_c().c_str(),
                rp->get_gid().quote_c().c_str()
            );
            return false;
        }

        if (!gp->get_use_instead().empty())
        {
            const colon_group::record::pointer gp2 =
                group->query_by_name(gp->get_use_instead());
            if (gp2)
            {
                error
                (
                    rp->get_source_location(),
                    "user %s: default group %s (gid %s) is not suitable, "
                        "use group %s (gid %s) instead",
                    rp->get_name().quote_c().c_str(),
                    gp->get_name().quote_c().c_str(),
                    rp->get_gid().c_str(),
                    gp2->get_name().quote_c().c_str(),
                    gp2->get_gid().c_str()
                );
            }
            else
            {
                error
                (
                    rp->get_source_location(),
                    "user %s: default group %s (gid %s) is not suitable, "
                        "use group %s instead",
                    rp->get_name().quote_c().c_str(),
                    gp->get_name().quote_c().c_str(),
                    rp->get_gid().c_str(),
                    gp->get_use_instead().quote_c().c_str()
                );
            }
            return false;
        }
        else if (gp->is_members_only())
        {
            //
            // Groups marked "MEMBERS-ONLY" may only be used by the user
            // of the same name, or group members.
            //
            if
            (
                gp->get_name() != rp->get_name()
            &&
                !gp->is_member(rp->get_name())
            )
            {
                error
                (
                    rp->get_source_location(),
                    "user %s: default group %s (gid %s) is reserved, and may "
                        "not be used as this user's default group",
                    rp->get_name().quote_c().c_str(),
                    gp->get_name().quote_c().c_str(),
                    rp->get_gid().c_str()
                );
                return false;
            }
        }
    }

    //
    // Check full name field.
    //

    //
    // Check home directory
    //
    // FIXME: make sure the home directory is in an automount map.
    //
    if (!check_home(rp))
        return false;

    //
    // Check shell.
    //
    // FIXME: check against the /etc/shell file (or some similar
    // command line argument).

    //
    // Looks good so far.
    //
    return true;
}


bool
colon_passwd_slurp_check::check_home(const record::pointer &rp)
{
    // Note: this makes the bold assumption that the server building
    // the NIS maps is itself using those same NIS maps.
    // Otherwise this check is always going to fail.

    struct stat st;
    if (lstat(rp->get_home().c_str(), &st) < 0)
    {
        if (errno != ENOENT)
        {
            error
            (
                rp->get_source_location(),
                "%s",
                explain_lstat(rp->get_home().c_str(), &st)
            );
        }
#if 1
        return false;
#else
        // make a fake ok status
        memset(&st, 0, sizeof(st));
        st.st_mode = S_IFDIR | 02755;
        st.st_uid = rp->get_uid_binary();
        st.st_gid = rp->get_gid_binary();
#endif
    }

    if (S_ISLNK(st.st_mode))
    {
        // Note: The sun automounter uses symbolic links when it automounts
        // a file system, fromthe use point to the actual mount point.
        // This is especially true when the auto mount is actually
        // local to the NIS client using the passwd map.
        // Thus, symbolic links usually mean a mistake.

        rcstring link_destination;
        {
            char buffer[2000];
            int n = readlink(rp->get_home().c_str(), buffer, sizeof(buffer));
            if (n <= 0)
            {
                error
                (
                    rp->get_source_location(),
                    "user %s home directory %s may not be a symbolic link",
                    rp->get_name().quote_c().c_str(),
                    rp->get_home().quote_c().c_str()
                );
                return false;
            }
            link_destination = rcstring(buffer, n);
        }

        rcstring suggest;
        if (link_destination.front() == '/')
            suggest = link_destination;
        else
        {
            rcstring dir = rp->get_home().dirname();
            suggest = path_join(dir, link_destination);
        }
        error
        (
            rp->get_source_location(),
            "user %s home directory %s may not be a symbolic link, "
            "suggest %s instead",
            rp->get_name().quote_c().c_str(),
            rp->get_home().quote_c().c_str(),
            suggest.quote_c().c_str()
        );
        return false;
    }
    if (!S_ISDIR(st.st_mode))
    {
        error
        (
            rp->get_source_location(),
            "user %s home directory %s must be a directory",
            rp->get_name().quote_c().c_str(),
            rp->get_home().c_str()
        );
        return false;
    }

    if ((st.st_mode & 05733) != 00711)
    {
        error
        (
            rp->get_source_location(),
            "user %s home directory %s is mode %#o, it should be 02755, "
                "suggest...",
            rp->get_name().quote_c().c_str(),
            rp->get_home().c_str(),
            (st.st_mode & 07777)
        );
        error
        (
            rp->get_source_location(),
            "sudo chmod %#o %s",
            ((st.st_mode & 02755) | 00711),
            rp->get_home().quote_shell().c_str()
        );
    }

    {
        long uid = rp->get_uid_binary();
        if (uid >= 0)
        {
            if ((long)st.st_uid != uid)
            {
                rcstring old_uid;
                record::pointer oup = query_by_uid(st.st_uid);
                if (oup)
                    old_uid = oup->get_uid();
                else
                    old_uid = rcstring::format("%ld", (long)st.st_uid);

                rcstring new_owner = rp->get_name();
                long gid = rp->get_gid_binary();
                if (gid >= 0)
                {
                    if (gid != (long)st.st_gid)
                    {
                        colon_group::record::pointer grp =
                            group->query_by_gid(rp->get_gid());
                        if (grp)
                            new_owner += "." + grp->get_name();
                        else
                            new_owner += rcstring::format(".%ld", gid);
                    }
                }

                warning
                (
                    rp->get_source_location(),
                    "user %s home directory %s is owned by %s, it "
                        "should be %s, suggest...",
                    rp->get_name().quote_c().c_str(),
                    rp->get_home().quote_c().c_str(),
                    old_uid.quote_c().c_str(),
                    rp->get_name().quote_c().c_str()
                );
                warning
                (
                    rp->get_source_location(),
                    "sudo chown %s %s",
                    new_owner.quote_shell().c_str(),
                    rp->get_home().quote_shell().c_str()
                );
                return false;
            }
        }
    }

    {
        long gid = rp->get_gid_binary();
        if (gid >= 0)
        {
            if ((long)st.st_gid != gid)
            {
                // determine the name of the old group
                rcstring old_group;
                {
                    colon_group::record::pointer grp =
                        group->query_by_gid(st.st_gid);
                    if (grp)
                        old_group = grp->get_name();
                    else
                        old_group = rcstring::format("%ld", (long)st.st_gid);
                }

                // determine the name of the new group
                rcstring new_group;
                {
                    colon_group::record::pointer grp =
                        group->query_by_gid(rp->get_gid());
                    if (grp)
                        new_group = grp->get_name();
                    else
                        new_group = rp->get_gid();
                }

                warning
                (
                    rp->get_source_location(),
                    "user %s home directory \"%s\" is group %s, it "
                        "should be %s, suggest...",
                    rp->get_name().quote_c().c_str(),
                    rp->get_home().quote_c().c_str(),
                    old_group.quote_c().c_str(),
                    new_group.quote_c().c_str()
                );
                warning
                (
                    rp->get_source_location(),
                    "sudo chgrp %s %s",
                    new_group.quote_shell().c_str(),
                    rp->get_home().quote_shell().c_str()
                );
            }
        }
    }

    return true;
}


// vim: set ts=8 sw=4 et :