ADMIN_GRP support added (allows a group of people to have superuser access)

diff --git a/Makefile b/Makefile
index 9c88ea87481f47c0dcea0fe0e76b93ef1aedd96f..272bd760d287bc6f79560a352d4474dcaf373afb 100644 (file)
--- a/Makefile
+++ b/Makefile
@@ -14,6 +14,8 @@ RESDIR=$(DESTDIR)/etc
 ETCDIR=$(DESTDIR)/etc
 # for include files
 INCDIR=$(DESTDIR)/include
+# Group that will have "root" access
+ADMIN_GRP=macadmin
 # Root of man pages.  Subdirectories will be
 # ${MANDIR}/man1, ${MANDIR}/man4, and ${MANDIR}/man8.
 MANDIR=$(DESTDIR)/man
@@ -40,7 +42,7 @@ MANDIR=$(DESTDIR)/man
 # dh.h, and bn.h in $CRYPTODIR/include with -lcrypto in
 # $CRYPTODIR/lib. NOTE: os x server will complain if you use both
 # randnum exchange and DHX.
-CRYPTODIR=/usr/local/ssl
+# CRYPTODIR=/usr/local/ssl
 
 # Location of the DES library and include files. Uncomment this out if
 # you want Randnum Exchange and 2-Way Randnum Exchange as allowable
@@ -55,7 +57,7 @@ TCPWRAPDIR=/usr
 
 # Location of PAM support library and include files. Uncomment this if
 # you want to enable PAM support.
-#PAMDIR=/usr
+PAMDIR=/usr
 
 # Location of cracklib support library and include files. This is used
 # in the password changing routines. Uncomment this out if you want to
@@ -105,6 +107,7 @@ all install depend clean tags kernel kinstall kpatch:       FRC
        esac; \
        echo "Making $@ for $$ARCH..."; \
        cd sys/$$ARCH && ${MAKE} ${MFLAGS} \
+            ADMIN_GRP="${ADMIN_GRP}" \
            SBINDIR="${SBINDIR}" BINDIR="${BINDIR}" RESDIR="${RESDIR}"\
            ETCDIR="${ETCDIR}" LIBDIR="${LIBDIR}" INCDIR="${INCDIR}" \
            DESTDIR="${DESTDIR}" MANDIR="${MANDIR}" \

diff --git a/etc/Makefile b/etc/Makefile
index 7988bcb39e33b87f634d89047ab1f87f574fa21e..e8d46669959c273f011632687bf5fcb895169a86 100644 (file)
--- a/etc/Makefile
+++ b/etc/Makefile
@@ -7,6 +7,7 @@ all:    ${ALL}
 
 ${ALL}: FRC
        cd $@; ${MAKE} ${MFLAGS} CC="${CC}" \
+            ADMIN_GRP="${ADMIN_GRP}" \
            ADDLIBS="${ADDLIBS}" DEFS="${DEFS}" OPTOPTS="${OPTOPTS}" \
            SBINDIR="${SBINDIR}" BINDIR="${BINDIR}" RESDIR="${RESDIR}" \
            ETCDIR="${ETCDIR}" LIBDIR="${LIBDIR}" INCDIR="${INCDIR}" \

diff --git a/etc/afpd/Makefile b/etc/afpd/Makefile
index 47a2dda28ecb732d9af4798da09eb0658ed11bc8..86ec4444cd5c10b06112a5157c464910264d0ea3 100644 (file)
--- a/etc/afpd/Makefile
+++ b/etc/afpd/Makefile
@@ -12,7 +12,9 @@ OBJ = unix.o ofork.o main.o switch.o auth.o volume.o directory.o file.o \
        nfsquota.o codepage.o quota.o uam.o afs.o
 
 INCPATH=       -I../../include ${AFSINCPATH}
-CFLAGS=        ${DEFS} ${AFSDEFS} ${CAPDEFS} ${OPTOPTS} ${INCPATH} -DAPPLCNAME
+CFLAGS=        ${DEFS} ${AFSDEFS} ${CAPDEFS} ${OPTOPTS} ${INCPATH} -DAPPLCNAME \
+        -DADMIN_GRP=\"${ADMIN_GRP}\"
+
 LIBS = -latalk ${AFSLIBS} ${ADDLIBS} ${TCPWRAPLIBS} ${DB2LIBS} \
        ${RPCSVCLIB} ${AFPLIBS} ${PAMLIBS} ${LIBSHARED} 
 LIBDIRS=       -L../../libatalk ${AFSLIBDIRS} ${TCPWRAPLIBDIRS} \

diff --git a/etc/afpd/auth.c b/etc/afpd/auth.c
index 01ce135b0475bfa9e54e00c4b3b548b4d32ac990..9a406a0e61e817f0bc02483b03dc78d88f2c26be 100644 (file)
--- a/etc/afpd/auth.c
+++ b/etc/afpd/auth.c
@@ -144,6 +144,9 @@ static int login(AFPObj *obj, struct passwd *pwd, void (*logout)(void))
     char nodename[256];
     FILE *fp;
 #endif /* CAPDIR */
+#ifdef ADMIN_GRP
+    struct group *grps;
+#endif ADMIN_GRP
 
     if ( pwd->pw_uid == 0 ) {  /* don't allow root login */
        syslog( LOG_ERR, "login: root login denied!" );
@@ -173,6 +176,22 @@ static int login(AFPObj *obj, struct passwd *pwd, void (*logout)(void))
       syslog(LOG_ERR, "login: %m");
       return AFPERR_BADUAM;
 #endif
+#ifdef ADMIN_GRP
+    if ((grps = getgrnam(ADMIN_GRP)) != NULL) {
+      while (*(grps->gr_mem) != NULL) {
+        if (strcmp(pwd->pw_name, *grps->gr_mem) == 0) {
+          syslog(LOG_INFO, "User %s has admin privs, logging in as superuser.",
+            pwd->pw_name);
+          pwd->pw_gid = grps->gr_gid;
+          pwd->pw_uid = 0;
+          strcpy (pwd->pw_name, "root");
+          break;
+        }
+        *(grps->gr_mem)++;
+      }
+    }
+#endif ADMIN_GRP
+
     }
     
     if (setegid( pwd->pw_gid ) < 0 || seteuid( pwd->pw_uid ) < 0) {