Sam Noble's ADMIN_GRP patch, removed Marc's old ADMIN_GRP patch.

diff --git a/etc/Makefile b/etc/Makefile
index 2bd17cdb3dfc9f0fac41fde462d624ea0e30273e..f6b1ee4e7d0e39e725de991b589523c610e16d38 100644 (file)
--- a/etc/Makefile
+++ b/etc/Makefile
@@ -7,7 +7,6 @@ all:    ${ALL}
 
 ${ALL}: FRC
        cd $@; ${MAKE} ${MFLAGS} CC="${CC}" \
-            ADMIN_GRP="${ADMIN_GRP}" \
             MSGDIR="${MSGDIR}" \
            ADDLIBS="${ADDLIBS}" DEFS="${DEFS}" OPTOPTS="${OPTOPTS}" \
            SBINDIR="${SBINDIR}" BINDIR="${BINDIR}" RESDIR="${RESDIR}" \

diff --git a/etc/afpd/Makefile b/etc/afpd/Makefile
index bccc68da58c8cc4a6c13c4080b484303b8f93d13..dfad3650773148da58c32cf4d266baa4a156e2a0 100644 (file)
--- a/etc/afpd/Makefile
+++ b/etc/afpd/Makefile
@@ -13,8 +13,7 @@ OBJ = unix.o ofork.o main.o switch.o auth.o volume.o directory.o file.o \
 
 INCPATH=       -I../../include ${AFSINCPATH}
 CFLAGS=        ${DEFS} ${AFSDEFS} ${CAPDEFS} ${OPTOPTS} ${INCPATH} -DAPPLCNAME \
-        -DADMIN_GRP=\"${ADMIN_GRP}\" -DSERVERTEXT=\"${MSGDIR}\"
-
+        -DSERVERTEXT=\"${MSGDIR}\" -DDROPKLUDGE -DADMIN_GRP 
 LIBS = -latalk ${AFSLIBS} ${ADDLIBS} ${TCPWRAPLIBS} ${DB2LIBS} \
        ${RPCSVCLIB} ${AFPLIBS} ${PAMLIBS} ${LIBSHARED} 
 LIBDIRS=       -L../../libatalk ${AFSLIBDIRS} ${TCPWRAPLIBDIRS} \

diff --git a/etc/afpd/afp_options.c b/etc/afpd/afp_options.c
index 134bbf0d9ffe9ade0c5ed4eba5b28f83bd073c61..547db4a4bf0b83c1564bbf4a8e31746d3d3fd8d1 100644 (file)
--- a/etc/afpd/afp_options.c
+++ b/etc/afpd/afp_options.c
@@ -30,6 +30,11 @@
 
 #include <atalk/compat.h>
 
+#ifdef ADMIN_GRP
+#include <grp.h>
+#include <sys/types.h>
+#endif
+
 #ifndef MIN
 #define MIN(a, b)  ((a) < (b) ? (a) : (b))
 #endif
@@ -114,6 +119,9 @@ void afp_options_init(struct afp_options *options)
   options->transports = AFPTRANS_ALL;
   options->passwdfile = _PATH_AFPDPWFILE;
   options->tickleval = 30;
+#ifdef ADMIN_GRP
+  options->admingid = 0;
+#endif ADMIN_GRP
 }
 
 /* parse an afpd.conf line. i'm doing it this way because it's
@@ -198,6 +206,14 @@ int afp_options_parseline(char *buf, struct afp_options *options)
     options->server_quantum = strtoul(c, NULL, 0);
 
 
+#ifdef ADMIN_GRP
+  if ((c = getoption(buf, "-admingroup"))) {
+    struct group *gr = getgrnam(c);
+    if (gr != NULL) { 
+      options->admingid = gr->gr_gid;
+    }
+  } 
+#endif
   if ((c = getoption(buf, "-uampath")) && (opt = strdup(c)))
     options->uampath = opt;
   if ((c = getoption(buf, "-uamlist")) && (opt = strdup(c)))
@@ -329,7 +345,7 @@ int afp_options_parse(int ac, char **av, struct afp_options *options)
 #ifdef ultrix
     openlog( p, LOG_PID );
 #else ultrix
-    openlog( p, LOG_NDELAY|LOG_PID, LOG_DAEMON );
+    openlog( p, LOG_NDELAY|LOG_PID, LOG_LOCAL0 );
 #endif ultrix
 
     return 1;

diff --git a/etc/afpd/auth.c b/etc/afpd/auth.c
index 9a406a0e61e817f0bc02483b03dc78d88f2c26be..0a8afbe76ebff34d2959e6d2668a6d245d0401e7 100644 (file)
--- a/etc/afpd/auth.c
+++ b/etc/afpd/auth.c
@@ -145,7 +145,8 @@ static int login(AFPObj *obj, struct passwd *pwd, void (*logout)(void))
     FILE *fp;
 #endif /* CAPDIR */
 #ifdef ADMIN_GRP
-    struct group *grps;
+    int admin = 0;
+    struct afp_options *options = &obj->options;
 #endif ADMIN_GRP
 
     if ( pwd->pw_uid == 0 ) {  /* don't allow root login */
@@ -176,33 +177,38 @@ static int login(AFPObj *obj, struct passwd *pwd, void (*logout)(void))
       syslog(LOG_ERR, "login: %m");
       return AFPERR_BADUAM;
 #endif
-#ifdef ADMIN_GRP
-    if ((grps = getgrnam(ADMIN_GRP)) != NULL) {
-      while (*(grps->gr_mem) != NULL) {
-        if (strcmp(pwd->pw_name, *grps->gr_mem) == 0) {
-          syslog(LOG_INFO, "User %s has admin privs, logging in as superuser.",
-            pwd->pw_name);
-          pwd->pw_gid = grps->gr_gid;
-          pwd->pw_uid = 0;
-          strcpy (pwd->pw_name, "root");
-          break;
-        }
-        *(grps->gr_mem)++;
-      }
-    }
-#endif ADMIN_GRP
 
     }
-    
-    if (setegid( pwd->pw_gid ) < 0 || seteuid( pwd->pw_uid ) < 0) {
-       syslog( LOG_ERR, "login: %m" );
-       return AFPERR_BADUAM;
-    }
+
+    /* Basically if the user is in the admin group, we stay root */
 
     if (( ngroups = getgroups( NGROUPS, groups )) < 0 ) {
        syslog( LOG_ERR, "login: getgroups: %m" );
        return AFPERR_BADUAM;
     }
+#ifdef ADMIN_GRP
+    syslog(LOG_DEBUG, "options->admingid == %d", options->admingid);
+    if (options->admingid != 0) {
+       int i;
+       for (i = 0; i < ngroups; i++) {
+           if (groups[i] == options->admingid) admin = 1;
+        }
+    }
+    if (admin) syslog( LOG_INFO, "login: admin -- %s", pwd->pw_name );
+    if (!admin)
+#endif
+       if (setegid( pwd->pw_gid ) < 0 || seteuid( pwd->pw_uid ) < 0) {
+           syslog( LOG_ERR, "login: %m" );
+           return AFPERR_BADUAM;
+       }
+
+    /* There's probably a better way to do this, but for now, we just 
+       play root */
+
+#ifdef ADMIN_GRP
+    if (admin) uuid = 0;
+    else
+#endif ADMIN_GRP
     uuid = pwd->pw_uid;
 
     afp_switch = postauth_switch;

diff --git a/etc/afpd/directory.c b/etc/afpd/directory.c
index 25ac5004811eec73922258088aa4999665aa89a5..81640c46ff50595f45e2d8850382b6f885751ec5 100644 (file)
--- a/etc/afpd/directory.c
+++ b/etc/afpd/directory.c
@@ -1154,7 +1154,45 @@ int setdirparams(vol, path, bitmap, buf )
            break;
 
        case DIRPBIT_UID :      /* What kind of loser mounts as root? */
-           buf += sizeof( int );
+           memcpy( &aint, buf, sizeof(aint));
+           buf += sizeof( aint );
+           if ( (curdir->d_did == DIRDID_ROOT) &&
+                (setdeskowner( aint, -1 ) < 0)) {
+               switch ( errno ) {
+               case EPERM :
+               case EACCES :
+                   err = AFPERR_ACCESS;
+                   goto setdirparam_done;
+                   break;
+               case EROFS :
+                   err = AFPERR_VLOCK;
+                   goto setdirparam_done;
+                   break;
+               default :
+                   syslog( LOG_ERR, "setdirparam: setdeskowner: %m" );
+                   if (!isad) {
+                   err = AFPERR_PARAM;
+                   goto setdirparam_done;
+                   }
+                   break;
+               }
+           }
+           if ( setdirowner( aint, -1, vol_noadouble(vol) ) < 0 ) {
+               switch ( errno ) {
+               case EPERM :
+               case EACCES :
+                   err = AFPERR_ACCESS;
+                   goto setdirparam_done;
+                   break;
+               case EROFS :
+                   err = AFPERR_VLOCK;
+                   goto setdirparam_done;
+                   break;
+               default :
+                   syslog( LOG_ERR, "setdirparam: setdirowner: %m" );
+                   break;
+               }
+           }
            break;
 
        case DIRPBIT_GID :

diff --git a/etc/afpd/globals.h b/etc/afpd/globals.h
index 0b07ac219557b62632dad0e6c61529e87d825b50..b3312ac06d64aaebde803ccddf7b201593c83e1a 100644 (file)
--- a/etc/afpd/globals.h
+++ b/etc/afpd/globals.h
@@ -8,6 +8,12 @@
 
 #include <sys/param.h>
 #include <sys/cdefs.h>
+
+#ifdef ADMIN_GRP
+#include <grp.h>
+#include <sys/types.h>
+#endif
+
 #include <netdb.h>  /* this isn't header-protected under ultrix */
 #include <netatalk/at.h>
 #include <atalk/afp.h>
@@ -39,6 +45,9 @@ struct afp_options {
   char *pidfile, *defaultvol, *systemvol;
   char *guest, *loginmesg, *keyfile, *passwdfile;
   char *uamlist;
+#ifdef ADMIN_GRP
+  gid_t admingid;
+#endif ADMIN_GRP
 };
 
 #define AFPOBJ_TMPSIZ (MAXPATHLEN)

diff --git a/etc/afpd/main.c b/etc/afpd/main.c
index c521ce5ffce0453ac2d8ff0631283f23c71b69a8..7f273c23abdd84f769f0579c452bff565ba57b5f 100644 (file)
--- a/etc/afpd/main.c
+++ b/etc/afpd/main.c
@@ -44,7 +44,7 @@
 
 unsigned char  nologin = 0;
 
-static struct afp_options default_options;
+struct afp_options default_options;
 static AFPConfig *configs;
 static server_child *server_children;
 static fd_set save_rfds;

diff --git a/etc/afpd/unix.c b/etc/afpd/unix.c
index f960b59e7fc7504a2bedbf0fadedc583c4033cd5..3bef4fcc3075c71d31a60ccd5ac9855719f51e3e 100644 (file)
--- a/etc/afpd/unix.c
+++ b/etc/afpd/unix.c
@@ -103,13 +103,7 @@ void utommode( stat, ma )
 
     ma->ma_owner = utombits( mode );
 
-#ifdef ADMIN_GRP
-    if ( uuid == 0 )
-        ma->ma_user = AR_UWRITE | AR_UREAD | AR_USEARCH | AR_UOWN;
-    else
-#endif
-
-    if ( uuid == stat->st_uid ) {
+    if ( (uuid == stat->st_uid) || (uuid == 0)) {
        ma->ma_user = ma->ma_owner | AR_UOWN;
     } else if ( gmem( stat->st_gid )) {
        ma->ma_user = ma->ma_group;