Group Check

Index: e_sys_main.c===================================================================RCS file: /var/cvs/e/e17/apps/e/src/bin/e_sys_main.c,vretrieving revision 1.4diff -u -r1.4 e_sys_main.c--- e_sys_main.c	3 Sep 2006 23:14:01 -0000	1.4+++ e_sys_main.c	28 Sep 2006 07:39:39 -0000@@ -11,9 +11,11 @@ #include <fnmatch.h> #include <Evas.h> +#define MAX_GROUPS 255+ /* local subsystem functions */-static int auth_action_ok(char *a, uid_t uid, gid_t gid);-static int auth_etc_enlightenment_sysactions(char *a, char *u, char *g);+static int auth_action_ok(char *a, uid_t uid, gid_t * gid_list, int gid_size);+static int auth_etc_enlightenment_sysactions(char *a, char *u, char **g, int g_size); static char *get_word(char *s, char *d);  /* local subsystem globals */@@ -27,7 +29,8 @@    int test = 0;    char *action, *cmd;    uid_t uid;-   gid_t gid;+   gid_t gid_list[MAX_GROUPS];+   int gid_size = 0;     for (i = 1; i < argc; i++)      {@@ -57,7 +60,7 @@      }     uid = getuid();-   gid = getgid();+   gid_size = getgroups(MAX_GROUPS, gid_list);        if (setuid(0) != 0)      {@@ -72,7 +75,7 @@        evas_init(); -   if (!auth_action_ok(action, uid, gid))+   if (!auth_action_ok(action, uid, gid_list, gid_size))      { 	printf("ERROR: ACTION NOT ALLOWED: %s\n", action); 	exit(10);@@ -94,23 +97,39 @@  /* local subsystem functions */ static int-auth_action_ok(char *a, uid_t uid, gid_t gid)+auth_action_ok(char *a, uid_t uid, gid_t * gid_list, int gid_size) {    struct passwd *pw;    struct group *gp;    char *usr = NULL, *grp;+   char *grp_names[MAX_GROUPS];    int ret;+   int i;+   int name_count = 0;     pw = getpwuid(uid);    if (!pw) return 0;    usr = pw->pw_name;    if (!usr) return 0;-   gp = getgrgid(gid);-   if (gp) grp = gp->gr_name;++   /* Need to do it like this because getgrgid can return a pointer to+    * static mem or possibly reuse the mem on the next call. */+   for (i = 0; i < gid_size; i++) +     {+	gp = getgrgid(gid_list[i]);+	if(gp) +	     grp_names[name_count++] = strdup(gp->gr_name);+     }+    /* first stage - check:     * PREFIX/etc/enlightenment/sysactions.conf     */-   ret = auth_etc_enlightenment_sysactions(a, usr, grp);+   ret = auth_etc_enlightenment_sysactions(a, usr, grp_names, name_count);++   /* Free all the mem we used. */+   for (i = 0; i < name_count; i++) +	free(grp_names[i]);+    if (ret == 1) return 1;    else if (ret == -1) return 0;    /* the DEFAULT - allow */@@ -118,7 +137,7 @@ }  static int-auth_etc_enlightenment_sysactions(char *a, char *u, char *g)+auth_etc_enlightenment_sysactions(char *a, char *u, char **g, int g_size) {    FILE *f;    char file[4096], buf[4096], id[4096], ugname[4096], perm[4096], act[4096];@@ -126,6 +145,8 @@    int len, line = 0, ok = 0;    int allow = 0;    int deny = 0;+   int g_item = 0;+   int g_match = 0;        snprintf(file, sizeof(file), "/etc/enlightenment/sysactions.conf");    f = fopen(file, "r");@@ -169,15 +190,25 @@ 	  } 	else if (!strcmp(id, "group:")) 	  {-	     if (!fnmatch(ugname, g, 0))+	     for(g_item = 0; g_item < g_size; g_item++) 	       {-		  if (!strcmp(perm, "allow:")) allow = 1;-		  else if (!strcmp(perm, "deny:")) deny = 1;-		  else-		    goto malformed;+		  if (g[g_item] && !fnmatch(ugname, g[g_item], 0))+		    {+		       if (!strcmp(perm, "allow:")) +			 {+			    allow = 1;+			    break;+			 }+		       else if (!strcmp(perm, "deny:")) +			 {+			    deny = 1;+			    break;+			 }+		       else+			 goto malformed;+		    } 	       }-	     else-	       continue;+	     if (!allow && !deny) continue; 	  } 	else if (!strcmp(id, "action:")) 	  {