Group Check

Index: e_sys_main.c
===================================================================
RCS file: /var/cvs/e/e17/apps/e/src/bin/e_sys_main.c,v
retrieving revision 1.4
diff -u -r1.4 e_sys_main.c
--- e_sys_main.c	3 Sep 2006 23:14:01 -0000	1.4
+++ e_sys_main.c	28 Sep 2006 07:39:39 -0000
@@ -11,9 +11,11 @@
 #include <fnmatch.h>
 #include <Evas.h>
 
+#define MAX_GROUPS 255
+
 /* local subsystem functions */
-static int auth_action_ok(char *a, uid_t uid, gid_t gid);
-static int auth_etc_enlightenment_sysactions(char *a, char *u, char *g);
+static int auth_action_ok(char *a, uid_t uid, gid_t * gid_list, int gid_size);
+static int auth_etc_enlightenment_sysactions(char *a, char *u, char **g, int g_size);
 static char *get_word(char *s, char *d);
 
 /* local subsystem globals */
@@ -27,7 +29,8 @@
    int test = 0;
    char *action, *cmd;
    uid_t uid;
-   gid_t gid;
+   gid_t gid_list[MAX_GROUPS];
+   int gid_size = 0;
 
    for (i = 1; i < argc; i++)
      {
@@ -57,7 +60,7 @@
      }
 
    uid = getuid();
-   gid = getgid();
+   gid_size = getgroups(MAX_GROUPS, gid_list);
    
    if (setuid(0) != 0)
      {
@@ -72,7 +75,7 @@
    
    evas_init();
 
-   if (!auth_action_ok(action, uid, gid))
+   if (!auth_action_ok(action, uid, gid_list, gid_size))
      {
 	printf("ERROR: ACTION NOT ALLOWED: %s\n", action);
 	exit(10);
@@ -94,23 +97,39 @@
 
 /* local subsystem functions */
 static int
-auth_action_ok(char *a, uid_t uid, gid_t gid)
+auth_action_ok(char *a, uid_t uid, gid_t * gid_list, int gid_size)
 {
    struct passwd *pw;
    struct group *gp;
    char *usr = NULL, *grp;
+   char *grp_names[MAX_GROUPS];
    int ret;
+   int i;
+   int name_count = 0;
 
    pw = getpwuid(uid);
    if (!pw) return 0;
    usr = pw->pw_name;
    if (!usr) return 0;
-   gp = getgrgid(gid);
-   if (gp) grp = gp->gr_name;
+
+   /* Need to do it like this because getgrgid can return a pointer to
+    * static mem or possibly reuse the mem on the next call. */
+   for (i = 0; i < gid_size; i++) 
+     {
+	gp = getgrgid(gid_list[i]);
+	if(gp) 
+	     grp_names[name_count++] = strdup(gp->gr_name);
+     }
+
    /* first stage - check:
     * PREFIX/etc/enlightenment/sysactions.conf
     */
-   ret = auth_etc_enlightenment_sysactions(a, usr, grp);
+   ret = auth_etc_enlightenment_sysactions(a, usr, grp_names, name_count);
+
+   /* Free all the mem we used. */
+   for (i = 0; i < name_count; i++) 
+	free(grp_names[i]);
+
    if (ret == 1) return 1;
    else if (ret == -1) return 0;
    /* the DEFAULT - allow */
@@ -118,7 +137,7 @@
 }
 
 static int
-auth_etc_enlightenment_sysactions(char *a, char *u, char *g)
+auth_etc_enlightenment_sysactions(char *a, char *u, char **g, int g_size)
 {
    FILE *f;
    char file[4096], buf[4096], id[4096], ugname[4096], perm[4096], act[4096];
@@ -126,6 +145,8 @@
    int len, line = 0, ok = 0;
    int allow = 0;
    int deny = 0;
+   int g_item = 0;
+   int g_match = 0;
    
    snprintf(file, sizeof(file), "/etc/enlightenment/sysactions.conf");
    f = fopen(file, "r");
@@ -169,15 +190,25 @@
 	  }
 	else if (!strcmp(id, "group:"))
 	  {
-	     if (!fnmatch(ugname, g, 0))
+	     for(g_item = 0; g_item < g_size; g_item++)
 	       {
-		  if (!strcmp(perm, "allow:")) allow = 1;
-		  else if (!strcmp(perm, "deny:")) deny = 1;
-		  else
-		    goto malformed;
+		  if (g[g_item] && !fnmatch(ugname, g[g_item], 0))
+		    {
+		       if (!strcmp(perm, "allow:")) 
+			 {
+			    allow = 1;
+			    break;
+			 }
+		       else if (!strcmp(perm, "deny:")) 
+			 {
+			    deny = 1;
+			    break;
+			 }
+		       else
+			 goto malformed;
+		    }
 	       }
-	     else
-	       continue;
+	     if (!allow && !deny) continue;
 	  }
 	else if (!strcmp(id, "action:"))
 	  {