diff options
Diffstat (limited to 'auth.c')
-rw-r--r-- | auth.c | 15 |
1 files changed, 13 insertions, 2 deletions
@@ -23,7 +23,7 @@ | |||
23 | */ | 23 | */ |
24 | 24 | ||
25 | #include "includes.h" | 25 | #include "includes.h" |
26 | RCSID("$OpenBSD: auth.c,v 1.24 2001/06/23 00:20:57 markus Exp $"); | 26 | RCSID("$OpenBSD: auth.c,v 1.25 2001/06/25 17:54:48 provos Exp $"); |
27 | 27 | ||
28 | #ifdef HAVE_LOGIN_H | 28 | #ifdef HAVE_LOGIN_H |
29 | #include <login.h> | 29 | #include <login.h> |
@@ -351,12 +351,17 @@ check_key_in_hostfiles(struct passwd *pw, Key *key, const char *host, | |||
351 | * Returns 0 on success and -1 on failure | 351 | * Returns 0 on success and -1 on failure |
352 | */ | 352 | */ |
353 | int | 353 | int |
354 | secure_filename(FILE *f, const char *file, uid_t uid, char *err, size_t errlen) | 354 | secure_filename(FILE *f, const char *file, struct passwd *pw, |
355 | char *err, size_t errlen) | ||
355 | { | 356 | { |
357 | uid_t uid = pw->pw_uid; | ||
358 | char homedir[MAXPATHLEN]; | ||
356 | char buf[MAXPATHLEN]; | 359 | char buf[MAXPATHLEN]; |
357 | char *cp; | 360 | char *cp; |
358 | struct stat st; | 361 | struct stat st; |
359 | 362 | ||
363 | strlcpy(homedir, dirname(pw->pw_dir), sizeof(homedir)); | ||
364 | |||
360 | if (realpath(file, buf) == NULL) { | 365 | if (realpath(file, buf) == NULL) { |
361 | snprintf(err, errlen, "realpath %s failed: %s", file, | 366 | snprintf(err, errlen, "realpath %s failed: %s", file, |
362 | strerror(errno)); | 367 | strerror(errno)); |
@@ -372,6 +377,8 @@ secure_filename(FILE *f, const char *file, uid_t uid, char *err, size_t errlen) | |||
372 | return -1; | 377 | return -1; |
373 | } | 378 | } |
374 | 379 | ||
380 | debug3("secure_filename: terminating check at '%s'", homedir); | ||
381 | |||
375 | /* for each component of the canonical path, walking upwards */ | 382 | /* for each component of the canonical path, walking upwards */ |
376 | for (;;) { | 383 | for (;;) { |
377 | if ((cp = dirname(buf)) == NULL) { | 384 | if ((cp = dirname(buf)) == NULL) { |
@@ -380,6 +387,10 @@ secure_filename(FILE *f, const char *file, uid_t uid, char *err, size_t errlen) | |||
380 | } | 387 | } |
381 | strlcpy(buf, cp, sizeof(buf)); | 388 | strlcpy(buf, cp, sizeof(buf)); |
382 | 389 | ||
390 | /* If are passed the homedir then we can stop */ | ||
391 | if (strcmp(buf, homedir) == 0) | ||
392 | break; | ||
393 | |||
383 | debug3("secure_filename: checking '%s'", buf); | 394 | debug3("secure_filename: checking '%s'", buf); |
384 | if (stat(buf, &st) < 0 || | 395 | if (stat(buf, &st) < 0 || |
385 | (st.st_uid != 0 && st.st_uid != uid) || | 396 | (st.st_uid != 0 && st.st_uid != uid) || |