17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * CDDL HEADER START 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the 5*3bf5ae9eSrica * Common Development and Distribution License (the "License"). 6*3bf5ae9eSrica * You may not use this file except in compliance with the License. 77c478bd9Sstevel@tonic-gate * 87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions 117c478bd9Sstevel@tonic-gate * and limitations under the License. 127c478bd9Sstevel@tonic-gate * 137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 187c478bd9Sstevel@tonic-gate * 197c478bd9Sstevel@tonic-gate * CDDL HEADER END 207c478bd9Sstevel@tonic-gate */ 217c478bd9Sstevel@tonic-gate /* 22*3bf5ae9eSrica * Copyright 2006 Sun Microsystems, Inc. All rights reserved. 237c478bd9Sstevel@tonic-gate * Use is subject to license terms. 247c478bd9Sstevel@tonic-gate */ 257c478bd9Sstevel@tonic-gate 267c478bd9Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 277c478bd9Sstevel@tonic-gate 287c478bd9Sstevel@tonic-gate #include <stdio.h> 297c478bd9Sstevel@tonic-gate #include <stdlib.h> 307c478bd9Sstevel@tonic-gate #include <strings.h> 317c478bd9Sstevel@tonic-gate #include <auth_attr.h> 327c478bd9Sstevel@tonic-gate #include <prof_attr.h> 337c478bd9Sstevel@tonic-gate #include <user_attr.h> 347c478bd9Sstevel@tonic-gate #include <project.h> 357c478bd9Sstevel@tonic-gate #include <secdb.h> 367c478bd9Sstevel@tonic-gate #include <pwd.h> 377c478bd9Sstevel@tonic-gate #include <unistd.h> 387c478bd9Sstevel@tonic-gate #include <priv.h> 397c478bd9Sstevel@tonic-gate #include <errno.h> 40*3bf5ae9eSrica #include <ctype.h> 41*3bf5ae9eSrica #include <tsol/label.h> 427c478bd9Sstevel@tonic-gate #include "funcs.h" 437c478bd9Sstevel@tonic-gate #include "messages.h" 447c478bd9Sstevel@tonic-gate #include "userdefs.h" 457c478bd9Sstevel@tonic-gate 467c478bd9Sstevel@tonic-gate typedef struct ua_key { 477c478bd9Sstevel@tonic-gate const char *key; 487c478bd9Sstevel@tonic-gate const char *(*check)(const char *); 497c478bd9Sstevel@tonic-gate const char *errstr; 507c478bd9Sstevel@tonic-gate char *newvalue; 517c478bd9Sstevel@tonic-gate } ua_key_t; 527c478bd9Sstevel@tonic-gate 537c478bd9Sstevel@tonic-gate static const char role[] = "role name"; 547c478bd9Sstevel@tonic-gate static const char prof[] = "profile name"; 557c478bd9Sstevel@tonic-gate static const char proj[] = "project name"; 567c478bd9Sstevel@tonic-gate static const char priv[] = "privilege set"; 577c478bd9Sstevel@tonic-gate static const char auth[] = "authorization"; 587c478bd9Sstevel@tonic-gate static const char type[] = "user type"; 597c478bd9Sstevel@tonic-gate static const char lock[] = "lock_after_retries value"; 60*3bf5ae9eSrica static const char label[] = "label"; 61*3bf5ae9eSrica static const char idlecmd[] = "idlecmd value"; 62*3bf5ae9eSrica static const char idletime[] = "idletime value"; 637c478bd9Sstevel@tonic-gate 647c478bd9Sstevel@tonic-gate 657c478bd9Sstevel@tonic-gate static const char *check_auth(const char *); 667c478bd9Sstevel@tonic-gate static const char *check_prof(const char *); 677c478bd9Sstevel@tonic-gate static const char *check_role(const char *); 687c478bd9Sstevel@tonic-gate static const char *check_proj(const char *); 697c478bd9Sstevel@tonic-gate static const char *check_privset(const char *); 707c478bd9Sstevel@tonic-gate static const char *check_type(const char *); 717c478bd9Sstevel@tonic-gate static const char *check_lock_after_retries(const char *); 72*3bf5ae9eSrica static const char *check_label(const char *); 73*3bf5ae9eSrica static const char *check_idlecmd(const char *); 74*3bf5ae9eSrica static const char *check_idletime(const char *); 757c478bd9Sstevel@tonic-gate 767c478bd9Sstevel@tonic-gate int nkeys; 777c478bd9Sstevel@tonic-gate 787c478bd9Sstevel@tonic-gate static ua_key_t keys[] = { 797c478bd9Sstevel@tonic-gate /* First entry is always set correctly in main() */ 807c478bd9Sstevel@tonic-gate { USERATTR_TYPE_KW, check_type, type }, 817c478bd9Sstevel@tonic-gate { USERATTR_AUTHS_KW, check_auth, auth }, 827c478bd9Sstevel@tonic-gate { USERATTR_PROFILES_KW, check_prof, prof }, 837c478bd9Sstevel@tonic-gate { USERATTR_ROLES_KW, check_role, role }, 847c478bd9Sstevel@tonic-gate { USERATTR_DEFAULTPROJ_KW, check_proj, proj }, 857c478bd9Sstevel@tonic-gate { USERATTR_LIMPRIV_KW, check_privset, priv }, 867c478bd9Sstevel@tonic-gate { USERATTR_DFLTPRIV_KW, check_privset, priv }, 877c478bd9Sstevel@tonic-gate { USERATTR_LOCK_AFTER_RETRIES_KW, check_lock_after_retries, lock }, 88*3bf5ae9eSrica { USERATTR_CLEARANCE, check_label, label }, 89*3bf5ae9eSrica { USERATTR_MINLABEL, check_label, label }, 90*3bf5ae9eSrica { USERATTR_IDLECMD_KW, check_idlecmd, idlecmd }, 91*3bf5ae9eSrica { USERATTR_IDLETIME_KW, check_idletime, idletime }, 927c478bd9Sstevel@tonic-gate }; 937c478bd9Sstevel@tonic-gate 947c478bd9Sstevel@tonic-gate #define NKEYS (sizeof (keys)/sizeof (ua_key_t)) 957c478bd9Sstevel@tonic-gate 967c478bd9Sstevel@tonic-gate /* 977c478bd9Sstevel@tonic-gate * Change a key, there are three different call sequences: 987c478bd9Sstevel@tonic-gate * 997c478bd9Sstevel@tonic-gate * key, value - key with option letter, value. 1007c478bd9Sstevel@tonic-gate * NULL, value - -K key=value option. 1017c478bd9Sstevel@tonic-gate */ 1027c478bd9Sstevel@tonic-gate 1037c478bd9Sstevel@tonic-gate void 1047c478bd9Sstevel@tonic-gate change_key(const char *key, char *value) 1057c478bd9Sstevel@tonic-gate { 1067c478bd9Sstevel@tonic-gate int i; 1077c478bd9Sstevel@tonic-gate const char *res; 1087c478bd9Sstevel@tonic-gate 1097c478bd9Sstevel@tonic-gate if (key == NULL) { 1107c478bd9Sstevel@tonic-gate key = value; 1117c478bd9Sstevel@tonic-gate value = strchr(value, '='); 1127c478bd9Sstevel@tonic-gate /* Bad value */ 1137c478bd9Sstevel@tonic-gate if (value == NULL) { 1147c478bd9Sstevel@tonic-gate errmsg(M_INVALID_VALUE); 1157c478bd9Sstevel@tonic-gate exit(EX_BADARG); 1167c478bd9Sstevel@tonic-gate } 1177c478bd9Sstevel@tonic-gate *value++ = '\0'; 1187c478bd9Sstevel@tonic-gate } 1197c478bd9Sstevel@tonic-gate 1207c478bd9Sstevel@tonic-gate for (i = 0; i < NKEYS; i++) { 1217c478bd9Sstevel@tonic-gate if (strcmp(key, keys[i].key) == 0) { 1227c478bd9Sstevel@tonic-gate if (keys[i].newvalue != NULL) { 1237c478bd9Sstevel@tonic-gate /* Can't set a value twice */ 1247c478bd9Sstevel@tonic-gate errmsg(M_REDEFINED_KEY, key); 1257c478bd9Sstevel@tonic-gate exit(EX_BADARG); 1267c478bd9Sstevel@tonic-gate } 1277c478bd9Sstevel@tonic-gate 1287c478bd9Sstevel@tonic-gate if (keys[i].check != NULL && 1297c478bd9Sstevel@tonic-gate (res = keys[i].check(value)) != NULL) { 1307c478bd9Sstevel@tonic-gate errmsg(M_INVALID, res, keys[i].errstr); 1317c478bd9Sstevel@tonic-gate exit(EX_BADARG); 1327c478bd9Sstevel@tonic-gate } 1337c478bd9Sstevel@tonic-gate keys[i].newvalue = value; 1347c478bd9Sstevel@tonic-gate nkeys++; 1357c478bd9Sstevel@tonic-gate return; 1367c478bd9Sstevel@tonic-gate } 1377c478bd9Sstevel@tonic-gate } 1387c478bd9Sstevel@tonic-gate errmsg(M_INVALID_KEY, key); 1397c478bd9Sstevel@tonic-gate exit(EX_BADARG); 1407c478bd9Sstevel@tonic-gate } 1417c478bd9Sstevel@tonic-gate 1427c478bd9Sstevel@tonic-gate /* 1437c478bd9Sstevel@tonic-gate * Add the keys to the argument vector. 1447c478bd9Sstevel@tonic-gate */ 1457c478bd9Sstevel@tonic-gate void 1467c478bd9Sstevel@tonic-gate addkey_args(char **argv, int *index) 1477c478bd9Sstevel@tonic-gate { 1487c478bd9Sstevel@tonic-gate int i; 1497c478bd9Sstevel@tonic-gate 1507c478bd9Sstevel@tonic-gate for (i = 0; i < NKEYS; i++) { 1517c478bd9Sstevel@tonic-gate const char *key = keys[i].key; 1527c478bd9Sstevel@tonic-gate char *val = keys[i].newvalue; 1537c478bd9Sstevel@tonic-gate size_t len; 1547c478bd9Sstevel@tonic-gate char *arg; 1557c478bd9Sstevel@tonic-gate 1567c478bd9Sstevel@tonic-gate if (val == NULL) 1577c478bd9Sstevel@tonic-gate continue; 1587c478bd9Sstevel@tonic-gate 1597c478bd9Sstevel@tonic-gate len = strlen(key) + strlen(val) + 2; 1607c478bd9Sstevel@tonic-gate arg = malloc(len); 1617c478bd9Sstevel@tonic-gate 1627c478bd9Sstevel@tonic-gate (void) snprintf(arg, len, "%s=%s", key, val); 1637c478bd9Sstevel@tonic-gate argv[(*index)++] = "-K"; 1647c478bd9Sstevel@tonic-gate argv[(*index)++] = arg; 1657c478bd9Sstevel@tonic-gate } 1667c478bd9Sstevel@tonic-gate } 1677c478bd9Sstevel@tonic-gate 1687c478bd9Sstevel@tonic-gate /* 1697c478bd9Sstevel@tonic-gate * Propose a default value for a key and get the actual value back. 1707c478bd9Sstevel@tonic-gate * If the proposed default value is NULL, return the actual value set. 1717c478bd9Sstevel@tonic-gate * The key argument is the user_attr key. 1727c478bd9Sstevel@tonic-gate */ 1737c478bd9Sstevel@tonic-gate char * 1747c478bd9Sstevel@tonic-gate getsetdefval(const char *key, char *dflt) 1757c478bd9Sstevel@tonic-gate { 1767c478bd9Sstevel@tonic-gate int i; 1777c478bd9Sstevel@tonic-gate 1787c478bd9Sstevel@tonic-gate for (i = 0; i < NKEYS; i++) 1797c478bd9Sstevel@tonic-gate if (strcmp(keys[i].key, key) == 0) 1807c478bd9Sstevel@tonic-gate if (keys[i].newvalue != NULL) 1817c478bd9Sstevel@tonic-gate return (keys[i].newvalue); 1827c478bd9Sstevel@tonic-gate else 1837c478bd9Sstevel@tonic-gate return (keys[i].newvalue = dflt); 1847c478bd9Sstevel@tonic-gate return (NULL); 1857c478bd9Sstevel@tonic-gate } 1867c478bd9Sstevel@tonic-gate 1877c478bd9Sstevel@tonic-gate char * 1887c478bd9Sstevel@tonic-gate getusertype(char *cmdname) 1897c478bd9Sstevel@tonic-gate { 1907c478bd9Sstevel@tonic-gate static char usertype[MAX_TYPE_LENGTH]; 1917c478bd9Sstevel@tonic-gate char *cmd; 1927c478bd9Sstevel@tonic-gate 1937c478bd9Sstevel@tonic-gate if (cmd = strrchr(cmdname, '/')) 1947c478bd9Sstevel@tonic-gate ++cmd; 1957c478bd9Sstevel@tonic-gate else 1967c478bd9Sstevel@tonic-gate cmd = cmdname; 1977c478bd9Sstevel@tonic-gate 1987c478bd9Sstevel@tonic-gate /* get user type based on the program name */ 1997c478bd9Sstevel@tonic-gate if (strncmp(cmd, CMD_PREFIX_USER, 2007c478bd9Sstevel@tonic-gate strlen(CMD_PREFIX_USER)) == 0) 2017c478bd9Sstevel@tonic-gate strcpy(usertype, USERATTR_TYPE_NORMAL_KW); 2027c478bd9Sstevel@tonic-gate else 2037c478bd9Sstevel@tonic-gate strcpy(usertype, USERATTR_TYPE_NONADMIN_KW); 2047c478bd9Sstevel@tonic-gate 2057c478bd9Sstevel@tonic-gate return (usertype); 2067c478bd9Sstevel@tonic-gate } 2077c478bd9Sstevel@tonic-gate 2087c478bd9Sstevel@tonic-gate int 2097c478bd9Sstevel@tonic-gate is_role(char *usertype) 2107c478bd9Sstevel@tonic-gate { 2117c478bd9Sstevel@tonic-gate if (strcmp(usertype, USERATTR_TYPE_NONADMIN_KW) == 0) 2127c478bd9Sstevel@tonic-gate return (1); 2137c478bd9Sstevel@tonic-gate /* not a role */ 2147c478bd9Sstevel@tonic-gate return (0); 2157c478bd9Sstevel@tonic-gate } 2167c478bd9Sstevel@tonic-gate 2177c478bd9Sstevel@tonic-gate /* 2187c478bd9Sstevel@tonic-gate * Verifies the provided list of authorizations are all valid. 2197c478bd9Sstevel@tonic-gate * 2207c478bd9Sstevel@tonic-gate * Returns NULL if all authorization names are valid. 2217c478bd9Sstevel@tonic-gate * Otherwise, returns the invalid authorization name 2227c478bd9Sstevel@tonic-gate * 2237c478bd9Sstevel@tonic-gate */ 2247c478bd9Sstevel@tonic-gate static const char * 2257c478bd9Sstevel@tonic-gate check_auth(const char *auths) 2267c478bd9Sstevel@tonic-gate { 2277c478bd9Sstevel@tonic-gate char *authname; 2287c478bd9Sstevel@tonic-gate authattr_t *result; 2297c478bd9Sstevel@tonic-gate char *tmp; 2307c478bd9Sstevel@tonic-gate struct passwd *pw; 2317c478bd9Sstevel@tonic-gate int have_grant = 0; 2327c478bd9Sstevel@tonic-gate 2337c478bd9Sstevel@tonic-gate tmp = strdup(auths); 2347c478bd9Sstevel@tonic-gate 2357c478bd9Sstevel@tonic-gate authname = strtok(tmp, AUTH_SEP); 2367c478bd9Sstevel@tonic-gate pw = getpwuid(getuid()); 2377c478bd9Sstevel@tonic-gate if (pw == NULL) { 2387c478bd9Sstevel@tonic-gate return (authname); 2397c478bd9Sstevel@tonic-gate } 2407c478bd9Sstevel@tonic-gate 2417c478bd9Sstevel@tonic-gate while (authname != NULL) { 2427c478bd9Sstevel@tonic-gate char *suffix; 2437c478bd9Sstevel@tonic-gate char *authtoks; 2447c478bd9Sstevel@tonic-gate 2457c478bd9Sstevel@tonic-gate /* Find the suffix */ 2467c478bd9Sstevel@tonic-gate if ((suffix = rindex(authname, '.')) == NULL) 2477c478bd9Sstevel@tonic-gate return (authname); 2487c478bd9Sstevel@tonic-gate 2497c478bd9Sstevel@tonic-gate /* Check for existence in auth_attr */ 2507c478bd9Sstevel@tonic-gate suffix++; 2517c478bd9Sstevel@tonic-gate if (strcmp(suffix, KV_WILDCARD)) { /* Not a wildcard */ 2527c478bd9Sstevel@tonic-gate result = getauthnam(authname); 2537c478bd9Sstevel@tonic-gate if (result == NULL) { 2547c478bd9Sstevel@tonic-gate /* can't find the auth */ 2557c478bd9Sstevel@tonic-gate free_authattr(result); 2567c478bd9Sstevel@tonic-gate return (authname); 2577c478bd9Sstevel@tonic-gate } 2587c478bd9Sstevel@tonic-gate free_authattr(result); 2597c478bd9Sstevel@tonic-gate } 2607c478bd9Sstevel@tonic-gate 2617c478bd9Sstevel@tonic-gate /* Check if user has been granted this authorization */ 2627c478bd9Sstevel@tonic-gate if (!chkauthattr(authname, pw->pw_name)) { 2637c478bd9Sstevel@tonic-gate return (authname); 2647c478bd9Sstevel@tonic-gate } 2657c478bd9Sstevel@tonic-gate 2667c478bd9Sstevel@tonic-gate /* Check if user can delegate this authorization */ 2677c478bd9Sstevel@tonic-gate if (strcmp(suffix, "grant")) { /* Not a grant option */ 2687c478bd9Sstevel@tonic-gate authtoks = malloc(strlen(authname) + sizeof ("grant")); 2697c478bd9Sstevel@tonic-gate strcpy(authtoks, authname); 2707c478bd9Sstevel@tonic-gate have_grant = 0; 2717c478bd9Sstevel@tonic-gate while ((suffix = rindex(authtoks, '.')) && 2727c478bd9Sstevel@tonic-gate !have_grant) { 2737c478bd9Sstevel@tonic-gate strcpy(suffix, ".grant"); 2747c478bd9Sstevel@tonic-gate if (chkauthattr(authtoks, pw->pw_name)) 2757c478bd9Sstevel@tonic-gate have_grant = 1; 2767c478bd9Sstevel@tonic-gate else 2777c478bd9Sstevel@tonic-gate *suffix = '\0'; 2787c478bd9Sstevel@tonic-gate } 2797c478bd9Sstevel@tonic-gate if (!have_grant) 2807c478bd9Sstevel@tonic-gate return (authname); 2817c478bd9Sstevel@tonic-gate } 2827c478bd9Sstevel@tonic-gate authname = strtok(NULL, AUTH_SEP); 2837c478bd9Sstevel@tonic-gate } 2847c478bd9Sstevel@tonic-gate return (NULL); 2857c478bd9Sstevel@tonic-gate } 2867c478bd9Sstevel@tonic-gate 2877c478bd9Sstevel@tonic-gate /* 2887c478bd9Sstevel@tonic-gate * Verifies the provided list of profile names are valid. 2897c478bd9Sstevel@tonic-gate * 2907c478bd9Sstevel@tonic-gate * Returns NULL if all profile names are valid. 2917c478bd9Sstevel@tonic-gate * Otherwise, returns the invalid profile name 2927c478bd9Sstevel@tonic-gate * 2937c478bd9Sstevel@tonic-gate */ 2947c478bd9Sstevel@tonic-gate static const char * 2957c478bd9Sstevel@tonic-gate check_prof(const char *profs) 2967c478bd9Sstevel@tonic-gate { 2977c478bd9Sstevel@tonic-gate char *profname; 2987c478bd9Sstevel@tonic-gate profattr_t *result; 2997c478bd9Sstevel@tonic-gate char *tmp; 3007c478bd9Sstevel@tonic-gate 3017c478bd9Sstevel@tonic-gate tmp = strdup(profs); 3027c478bd9Sstevel@tonic-gate 3037c478bd9Sstevel@tonic-gate profname = strtok(tmp, PROF_SEP); 3047c478bd9Sstevel@tonic-gate while (profname != NULL) { 3057c478bd9Sstevel@tonic-gate result = getprofnam(profname); 3067c478bd9Sstevel@tonic-gate if (result == NULL) { 3077c478bd9Sstevel@tonic-gate /* can't find the profile */ 3087c478bd9Sstevel@tonic-gate return (profname); 3097c478bd9Sstevel@tonic-gate } 3107c478bd9Sstevel@tonic-gate free_profattr(result); 3117c478bd9Sstevel@tonic-gate profname = strtok(NULL, PROF_SEP); 3127c478bd9Sstevel@tonic-gate } 3137c478bd9Sstevel@tonic-gate return (NULL); 3147c478bd9Sstevel@tonic-gate } 3157c478bd9Sstevel@tonic-gate 3167c478bd9Sstevel@tonic-gate 3177c478bd9Sstevel@tonic-gate /* 3187c478bd9Sstevel@tonic-gate * Verifies the provided list of role names are valid. 3197c478bd9Sstevel@tonic-gate * 3207c478bd9Sstevel@tonic-gate * Returns NULL if all role names are valid. 3217c478bd9Sstevel@tonic-gate * Otherwise, returns the invalid role name 3227c478bd9Sstevel@tonic-gate * 3237c478bd9Sstevel@tonic-gate */ 3247c478bd9Sstevel@tonic-gate static const char * 3257c478bd9Sstevel@tonic-gate check_role(const char *roles) 3267c478bd9Sstevel@tonic-gate { 3277c478bd9Sstevel@tonic-gate char *rolename; 3287c478bd9Sstevel@tonic-gate userattr_t *result; 3297c478bd9Sstevel@tonic-gate char *utype; 3307c478bd9Sstevel@tonic-gate char *tmp; 3317c478bd9Sstevel@tonic-gate 3327c478bd9Sstevel@tonic-gate tmp = strdup(roles); 3337c478bd9Sstevel@tonic-gate 3347c478bd9Sstevel@tonic-gate rolename = strtok(tmp, ROLE_SEP); 3357c478bd9Sstevel@tonic-gate while (rolename != NULL) { 3367c478bd9Sstevel@tonic-gate result = getusernam(rolename); 3377c478bd9Sstevel@tonic-gate if (result == NULL) { 3387c478bd9Sstevel@tonic-gate /* can't find the rolename */ 3397c478bd9Sstevel@tonic-gate return (rolename); 3407c478bd9Sstevel@tonic-gate } 3417c478bd9Sstevel@tonic-gate /* Now, make sure it is a role */ 3427c478bd9Sstevel@tonic-gate utype = kva_match(result->attr, USERATTR_TYPE_KW); 3437c478bd9Sstevel@tonic-gate if (utype == NULL) { 3447c478bd9Sstevel@tonic-gate /* no user type defined. not a role */ 3457c478bd9Sstevel@tonic-gate free_userattr(result); 3467c478bd9Sstevel@tonic-gate return (rolename); 3477c478bd9Sstevel@tonic-gate } 3487c478bd9Sstevel@tonic-gate if (strcmp(utype, USERATTR_TYPE_NONADMIN_KW) != 0) { 3497c478bd9Sstevel@tonic-gate free_userattr(result); 3507c478bd9Sstevel@tonic-gate return (rolename); 3517c478bd9Sstevel@tonic-gate } 3527c478bd9Sstevel@tonic-gate free_userattr(result); 3537c478bd9Sstevel@tonic-gate rolename = strtok(NULL, ROLE_SEP); 3547c478bd9Sstevel@tonic-gate } 3557c478bd9Sstevel@tonic-gate return (NULL); 3567c478bd9Sstevel@tonic-gate } 3577c478bd9Sstevel@tonic-gate 3587c478bd9Sstevel@tonic-gate static const char * 3597c478bd9Sstevel@tonic-gate check_proj(const char *proj) 3607c478bd9Sstevel@tonic-gate { 3617c478bd9Sstevel@tonic-gate if (getprojidbyname(proj) < 0) { 3627c478bd9Sstevel@tonic-gate return (proj); 3637c478bd9Sstevel@tonic-gate } else { 3647c478bd9Sstevel@tonic-gate return (NULL); 3657c478bd9Sstevel@tonic-gate } 3667c478bd9Sstevel@tonic-gate } 3677c478bd9Sstevel@tonic-gate 3687c478bd9Sstevel@tonic-gate static const char * 3697c478bd9Sstevel@tonic-gate check_privset(const char *pset) 3707c478bd9Sstevel@tonic-gate { 3717c478bd9Sstevel@tonic-gate priv_set_t *tmp; 3727c478bd9Sstevel@tonic-gate const char *res; 3737c478bd9Sstevel@tonic-gate 3747c478bd9Sstevel@tonic-gate tmp = priv_str_to_set(pset, ",", &res); 3757c478bd9Sstevel@tonic-gate 3767c478bd9Sstevel@tonic-gate if (tmp != NULL) { 3777c478bd9Sstevel@tonic-gate res = NULL; 3787c478bd9Sstevel@tonic-gate priv_freeset(tmp); 3797c478bd9Sstevel@tonic-gate } else if (res == NULL) 3807c478bd9Sstevel@tonic-gate res = strerror(errno); 3817c478bd9Sstevel@tonic-gate 3827c478bd9Sstevel@tonic-gate return (res); 3837c478bd9Sstevel@tonic-gate } 3847c478bd9Sstevel@tonic-gate 3857c478bd9Sstevel@tonic-gate static const char * 3867c478bd9Sstevel@tonic-gate check_type(const char *type) 3877c478bd9Sstevel@tonic-gate { 3887c478bd9Sstevel@tonic-gate if (strcmp(type, USERATTR_TYPE_NONADMIN_KW) != 0 && 3897c478bd9Sstevel@tonic-gate strcmp(type, USERATTR_TYPE_NORMAL_KW) != 0) 3907c478bd9Sstevel@tonic-gate return (type); 3917c478bd9Sstevel@tonic-gate 3927c478bd9Sstevel@tonic-gate return (NULL); 3937c478bd9Sstevel@tonic-gate } 3947c478bd9Sstevel@tonic-gate 3957c478bd9Sstevel@tonic-gate static const char * 3967c478bd9Sstevel@tonic-gate check_lock_after_retries(const char *keyval) 3977c478bd9Sstevel@tonic-gate { 3987c478bd9Sstevel@tonic-gate if (keyval != NULL) { 3997c478bd9Sstevel@tonic-gate if ((strcasecmp(keyval, "no") != 0) && 4007c478bd9Sstevel@tonic-gate (strcasecmp(keyval, "yes") != 0) && 4017c478bd9Sstevel@tonic-gate (*keyval != '\0')) { 4027c478bd9Sstevel@tonic-gate return (keyval); 4037c478bd9Sstevel@tonic-gate } 4047c478bd9Sstevel@tonic-gate } 4057c478bd9Sstevel@tonic-gate return (NULL); 4067c478bd9Sstevel@tonic-gate } 407*3bf5ae9eSrica 408*3bf5ae9eSrica static const char * 409*3bf5ae9eSrica check_label(const char *labelstr) 410*3bf5ae9eSrica { 411*3bf5ae9eSrica int err; 412*3bf5ae9eSrica m_label_t *lbl = NULL; 413*3bf5ae9eSrica 414*3bf5ae9eSrica if (!is_system_labeled()) 415*3bf5ae9eSrica return (NULL); 416*3bf5ae9eSrica 417*3bf5ae9eSrica err = str_to_label(labelstr, &lbl, MAC_LABEL, L_NO_CORRECTION, NULL); 418*3bf5ae9eSrica m_label_free(lbl); 419*3bf5ae9eSrica 420*3bf5ae9eSrica if (err == -1) 421*3bf5ae9eSrica return (labelstr); 422*3bf5ae9eSrica 423*3bf5ae9eSrica return (NULL); 424*3bf5ae9eSrica } 425*3bf5ae9eSrica 426*3bf5ae9eSrica static const char * 427*3bf5ae9eSrica check_idlecmd(const char *cmd) 428*3bf5ae9eSrica { 429*3bf5ae9eSrica if ((strcmp(cmd, USERATTR_IDLECMD_LOCK_KW) != 0) && 430*3bf5ae9eSrica (strcmp(cmd, USERATTR_IDLECMD_LOGOUT_KW) != 0)) { 431*3bf5ae9eSrica return (cmd); 432*3bf5ae9eSrica } 433*3bf5ae9eSrica 434*3bf5ae9eSrica return (NULL); 435*3bf5ae9eSrica } 436*3bf5ae9eSrica 437*3bf5ae9eSrica static const char * 438*3bf5ae9eSrica check_idletime(const char *time) 439*3bf5ae9eSrica { 440*3bf5ae9eSrica int c; 441*3bf5ae9eSrica unsigned char *up = (unsigned char *)time; 442*3bf5ae9eSrica 443*3bf5ae9eSrica c = *up; 444*3bf5ae9eSrica while (c != '\0') { 445*3bf5ae9eSrica if (!isdigit(c)) 446*3bf5ae9eSrica return (time); 447*3bf5ae9eSrica c = *++up; 448*3bf5ae9eSrica } 449*3bf5ae9eSrica 450*3bf5ae9eSrica return (NULL); 451*3bf5ae9eSrica } 452