From f32e054fe56c493c34d734aa7b8272b43b471fc7 Mon Sep 17 00:00:00 2001
From: "Todd C. Miller" <Todd.Miller@courtesan.com>
Date: Fri, 24 Mar 2000 20:13:12 +0000
Subject: [PATCH] Make login class support work on BSD/OS

---
 CHANGES | 10 +++++-----
 INSTALL | 11 ++++++-----
 sudo.c  | 36 ++++++++++++++++++++++++------------
 3 files changed, 35 insertions(+), 22 deletions(-)

diff --git a/CHANGES b/CHANGES
index 7db0c84ff..58bc0a6fe 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1275,11 +1275,11 @@ Sudo 1.6.2 released.
 
 402) Fixed a typo/thinko that broke secureware support for long passwords.
 
-403) Added a new command line switch '-c' to support FreeBSD style login
-     classes.  The '-c' option can be used to sudo a command with specific
-     resource limits in the login.conf database.  This feature is optionally
-     enabled via the --with-logincap configure switch.  Based on a patch
-     from Michael D. Marchionna.
+403) Added a new command line switch '-c' to support BSD login classes.
+     The '-c' option can be used to sudo a command with specific resource
+     limits in the login.conf database.  This feature is optionally enabled
+     via the --with-logincap configure switch.  Based on a patch from
+     Michael D. Marchionna.
 
 404) Fixed a bug where sudo would hang around and consume CPU if we spawn
      a long-running process.
diff --git a/INSTALL b/INSTALL
index 300c9ba47..ac64197e2 100644
--- a/INSTALL
+++ b/INSTALL
@@ -187,11 +187,12 @@ Special features/options:
 	access DCE via PAM before using this option.
 
   --with-logincap
-	Enable support for BSD login classes on FreeBSD.  This adds support
-	for the login classes specified in /etc/login.conf.  By default,
-	a login class is not applied unless the 'use_loginclass' option
-	is defined in sudoers or the user specifies a class on the command
-	line.
+	Enable support for BSD login classes on FreeBSD and BSD/OS.  This
+	adds support for the login classes specified in /etc/login.conf.
+	By default, a login class is not applied unless the 'use_loginclass'
+	option is defined in sudoers or the user specifies a class on the
+	command line.  It does *not*, however cause sudo to use BSD
+	authentication.
 
   --disable-sia
 	Disable SIA support.  This is the "Security Integration Architecture"
diff --git a/sudo.c b/sudo.c
index f8061dafd..4c2572ecf 100644
--- a/sudo.c
+++ b/sudo.c
@@ -78,6 +78,9 @@
 #endif /* HAVE_GETPRPWNAM && HAVE_SET_AUTH_PARAMETERS */
 #ifdef HAVE_LOGINCAP
 # include <login_cap.h>
+# ifndef LOGIN_DEFROOTCLASS
+#  define LOGIN_DEFROOTCLASS	"daemon"
+# endif
 #endif
 
 #include "sudo.h"
@@ -1085,6 +1088,17 @@ set_loginclass(pw)
     struct passwd *pw;
 {
     login_cap_t *lc;
+    int errflags;
+
+    /*
+     * Don't make it a fatal error if the user didn't specify the login
+     * class themselves.  We do this because if login.conf gets
+     * corrupted we want the admin to be able to use sudo to fix it.
+     */
+    if (login_class)
+	errflags = NO_MAIL|MSG_ONLY;
+    else
+	errflags = NO_MAIL|MSG_ONLY|NO_EXIT;
 
     if (login_class && strcmp(login_class, "-") != 0) {
 	if (strcmp(*user_runas, "root") != 0 && user_uid != 0) {
@@ -1092,18 +1106,16 @@ set_loginclass(pw)
 		Argv[0], login_class);
 	    exit(1);
 	}
+    } else {
+	login_class = pw->pw_class;
+	if (!login_class || !*login_class)
+	    login_class =
+		(pw->pw_uid == 0) ? LOGIN_DEFROOTCLASS : LOGIN_DEFCLASS;
+    }
 
-	lc = login_getclass(login_class);
-	if (!lc || !lc->lc_class || strcmp(lc->lc_class, login_class) != 0)
-	    log_error(NO_MAIL|MSG_ONLY, "unknown login class: %s", login_class);
-    } else if (!(lc = login_getpwclass(pw))) {
-	/*
-	 * This is not a fatal error if the user didn't specify the login
-	 * class themselves.  We do this because if login.conf gets
-	 * corrupted we want the admin to be able to use sudo to fix it.
-	 */
-	log_error(login_class ? NO_MAIL|MSG_ONLY : NO_MAIL|NO_EXIT|MSG_ONLY,
-	    "can't get class for user: %s", user_runas);
+    lc = login_getclass(login_class);
+    if (!lc || !lc->lc_class || strcmp(lc->lc_class, login_class) != 0) {
+	log_error(errflags, "unknown login class: %s", login_class);
 	return(0);
     }
     
@@ -1111,7 +1123,7 @@ set_loginclass(pw)
     if (setusercontext(lc, pw, pw->pw_uid,
 	LOGIN_SETUSER|LOGIN_SETGROUP|LOGIN_SETRESOURCES|LOGIN_SETPRIORITY) < 0)
 	log_error(NO_MAIL|USE_ERRNO|MSG_ONLY,
-	    "setusercontext() failed for login class %s", lc);
+	    "setusercontext() failed for login class %s", login_class);
 
     login_close(lc);
     return(1);
-- 
2.40.0