contrib/openpam/lib/libpam/openpam_check_owner_perms.c
/*
 * OpenPAM internal
 *
 * Verify that a file or directory and all components of the path leading
 * up to it are owned by either root or the arbitrator and that they are
 * not writable by group or other.
 *
 * Note that openpam_check_desc_owner_perms() should be used instead if
 * possible to avoid a race between the ownership / permission check and
 * the actual open().
 */
OpenPAM internal
Verify that a file or directory and all components of the path leading
up to it are owned by either root or the arbitrator and that they are
not writable by group or other.

Note that openpam_check_desc_owner_perms() should be used instead if
possible to avoid a race between the ownership / permission check and
the actual open().
OpenPAM internal Verify that a file or directory and all components of the path leading up to it are owned by either root or the arbitrator and that they are not writable by group or other . Note that openpam_check_desc_owner_perms () should be used instead if possible to avoid a race between the ownership / permission check and the actual open () .
int
openpam_check_path_owner_perms(const char *path)
{
	uid_t root, arbitrator;
	char pathbuf[PATH_MAX];
	struct stat sb;
	int len, serrno, tip;
	tip = 1;
	root = 0;
	arbitrator = geteuid();
	if (realpath(path, pathbuf) == NULL)
		return (-1);
	len = strlen(pathbuf);
	while (len > 0) {
		if (stat(pathbuf, &sb) != 0) {
			if (errno != ENOENT) {
				serrno = errno;
				openpam_log(PAM_LOG_ERROR, "%s: %m", pathbuf);
				errno = serrno;
			}
			return (-1);
		}
		if (tip && !S_ISREG(sb.st_mode)) {
			openpam_log(PAM_LOG_ERROR,
			    "%s: not a regular file", pathbuf);
			errno = EINVAL;
			return (-1);
		}
		if ((sb.st_uid != root && sb.st_uid != arbitrator) ||
		    (sb.st_mode & (S_IWGRP|S_IWOTH)) != 0) {
			openpam_log(PAM_LOG_ERROR,
			    "%s: insecure ownership or permissions", pathbuf);
			errno = EPERM;
			return (-1);
		}
		while (--len > 0 && pathbuf[len] != '/')
			pathbuf[len] = '\0';
		tip = 0;
	}
	return (0);
}
int openpam_check_path_owner_perms ( const char * path ) { uid_t root , arbitrator ; char pathbuf [ PATH_MAX ] ; struct stat sb ; int len , serrno , tip ; tip = 1 ; root = 0 ; arbitrator = geteuid ( ) ; if ( realpath ( path , pathbuf ) == NULL ) return ( -1 ) ; len = strlen ( pathbuf ) ; while ( len > 0 ) { if ( stat ( pathbuf , & sb ) != 0 ) { if ( errno != ENOENT ) { serrno = errno ; openpam_log ( PAM_LOG_ERROR , " " , pathbuf ) ; errno = serrno ; } return ( -1 ) ; } if ( tip && ! S_ISREG ( sb . st_mode ) ) { openpam_log ( PAM_LOG_ERROR , " " , pathbuf ) ; errno = EINVAL ; return ( -1 ) ; } if ( ( sb . st_uid != root && sb . st_uid != arbitrator ) || ( sb . st_mode & ( S_IWGRP | S_IWOTH ) ) != 0 ) { openpam_log ( PAM_LOG_ERROR , " " , pathbuf ) ; errno = EPERM ; return ( -1 ) ; } while ( -- len > 0 && pathbuf [ len ] != ' ' ) pathbuf [ len ] = ' \0 ' ; tip = 0 ; } return ( 0 ) ; }
OpenPAM internal
 Verify that a file or directory and all components of the path leading
 up to it are owned by either root or the arbitrator and that they are
 not writable by group or other.
OpenPAM internal Verify that a file or directory and all components of the path leading up to it are owned by either root or the arbitrator and that they are not writable by group or other .