/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 * utmp_update          - Update the /var/adm/utmpx file
 *
 *                      As of on28, the utmp interface is obsolete,
 *                      so we only handle updating the utmpx file now.
 *                      The utmpx routines in libc "simulate" calls
 *                      to manipulate utmp entries.
 *
 *                      This program runs set uid root on behalf of
 *                      non-privileged user programs.  Normal programs cannot
 *                      write to /var/adm/utmpx. Non-root callers of pututxline
 *                      will invoke this program to write the utmpx entry.
 */

/*
 * Header files
 */
#include <stdio.h>
#include <sys/param.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <utmpx.h>
#include <errno.h>
#include <fcntl.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
#include <pwd.h>
#include <ctype.h>
#include <stropts.h>
#include <syslog.h>

/*
 * Invocation argument definitions
 */

#define UTMPX_NARGS     14

/*
 * Return codes
 */
#define NORMAL_EXIT             0
#define BAD_ARGS                1
#define PUTUTXLINE_FAILURE      2
#define FORK_FAILURE            3
#define SETSID_FAILURE          4
#define ALREADY_DEAD            5
#define ENTRY_NOTFOUND          6
#define ILLEGAL_ARGUMENT        7
#define DEVICE_ERROR            8

/*
 * Sizes
 */

#define MAX_SYSLEN      257             /* From utmpx.h host length + nul */
#define BUF_SIZE        256

/*
 * Other defines
 */
#define ROOT_UID        0
/*
 * Debugging support
 */
#ifdef DEBUG
#define dprintf printf
#define dprintf3 printf
static void display_args();
#else /* DEBUG */
#define dprintf(x, y)
#define dprintf3(w, x, y, z)
#endif

/*
 * Local functions
 */

static void load_utmpx_struct(struct utmpx *, char **);
static void usage(void);
static void check_utmpx(struct utmpx *);
static int bad_hostname(char *, int);
static int hex2bin(unsigned char);

static int invalid_utmpx(struct utmpx *, struct utmpx *);
static int bad_line(char *);
static void check_id(char *, char *);

int
main(int argc, char *argv[])
{
        int devfd, err;
        struct utmpx *rutmpx;
        struct utmpx entryx;
        struct stat stat_arg, stat_db;
#ifdef  DEBUG
        int     debugger = 1;
        printf("%d\n", getpid());
        /*      Uncomment the following for attaching with dbx(1)       */
        /* while  (debugger) ; */
        display_args(argc, argv);
#endif  /*      DEBUG   */

        /*
         * We will always be called by pututxline, so simply
         * verify the correct number of args
         */

        if (argc != UTMPX_NARGS) {
                usage();
                return (BAD_ARGS);
        }
        /*
         * we should never be called by root the code in libc already
         * updates the file for root so no need to do it here. This
         * assumption simpilfies the rest of code since we nolonger
         * have to do special processing for the case when we are called
         * by root
         *
         */
        if (getuid() == ROOT_UID) {
                usage();
                return (ILLEGAL_ARGUMENT);
        }
        /*
         * Search for matching entry by line name before put operation
         * (scan over the whole file using getutxent(3C) to ensure
         * that the line name is the same. We can not use getutline(3C)
         * because that will return LOGIN_PROCESS and USER_PROCESS
         * records. Also check that the entry is for either a dead
         * process or a current process that is valid (see
         * invalid_utmpx() for details of validation criteria).
         *
         * Match entries using the inode number of the device file.
         */
        load_utmpx_struct(&entryx, argv);
        check_utmpx(&entryx);
        if ((devfd = open("/dev", O_RDONLY)) < 0) {
                usage();
                return (DEVICE_ERROR);
        }

        if (fstatat(devfd, entryx.ut_line, &stat_arg, 0) < 0) {
                (void) close(devfd);
                usage();
                return (DEVICE_ERROR);
        }

        err = 0;
        for (rutmpx = getutxent(); rutmpx != (struct utmpx *)NULL;
            rutmpx = getutxent()) {

                if ((rutmpx->ut_type != USER_PROCESS) &&
                    (rutmpx->ut_type != DEAD_PROCESS))
                        continue;

                if (fstatat(devfd, rutmpx->ut_line, &stat_db, 0) < 0)
                        continue;

                if (stat_arg.st_ino == stat_db.st_ino &&
                    stat_arg.st_dev == stat_db.st_dev) {
                        if (rutmpx->ut_type == USER_PROCESS)
                                err = invalid_utmpx(&entryx, rutmpx);
                        break;
                }
        }
        (void) close(devfd);
        if (err) {
                usage();
                return (ILLEGAL_ARGUMENT);
        }

        if (pututxline(&entryx) == (struct utmpx *)NULL) {
                return (PUTUTXLINE_FAILURE);
        }
        return (NORMAL_EXIT);
}

static int
hex2bin(unsigned char c)
{
        if ('0' <= c && c <= '9')
                return (c - '0');
        else if ('A' <= c && c <= 'F')
                return (10 + c - 'A');
        else if ('a' <= c && c <= 'f')
                return (10 + c - 'a');

        dprintf("Bad hex character: 0x%x\n", c);
        exit(ILLEGAL_ARGUMENT);
        /* NOTREACHED */
}


/*
 * load_utmpx_struct    - Load up the utmpx structure with information supplied
 *                      as arguments in argv.
 */

static void
load_utmpx_struct(struct utmpx *entryx, char *argv[])
{
        char *user, *id, *line, *pid, *type, *term, *time_usec,
            *exitstatus, *xtime, *session, *pad, *syslen, *host;
        int temp, i;
        unsigned char *cp;

        (void) memset(entryx, 0, sizeof (struct utmpx));

        user    = argv[1];
        id      = argv[2];
        line    = argv[3];
        pid     = argv[4];
        type    = argv[5];
        term    = argv[6];
        exitstatus = argv[7];
        xtime   = argv[8];
        time_usec = argv[9 ];
        session = argv[10];
        pad     = argv[11];
        syslen  = argv[12];
        host    = argv[13];

        (void) strncpy(entryx->ut_user, user, sizeof (entryx->ut_user));
        (void) strncpy(entryx->ut_id, id, sizeof (entryx->ut_id));
        (void) strncpy(entryx->ut_line, line, sizeof (entryx->ut_line));

        (void) sscanf(pid, "%d", &temp);
        entryx->ut_pid = temp;

        (void) sscanf(type, "%d", &temp);
        entryx->ut_type = temp;

        (void) sscanf(term, "%d", &temp);
        entryx->ut_exit.e_termination = temp;

        (void) sscanf(exitstatus, "%d", &temp);
        entryx->ut_exit.e_exit = temp;
        /*
         * Here's where we stamp the exit field of a USER_PROCESS
         * record so that we know it was written by a normal user.
         */

        if (entryx->ut_type == USER_PROCESS)
                setuserx(*entryx);

        (void) sscanf(xtime, "%d", &temp);
        entryx->ut_tv.tv_sec = temp;

        (void) sscanf(time_usec, "%d", &temp);
        entryx->ut_tv.tv_usec = temp;

        (void) sscanf(session, "%d", &temp);
        entryx->ut_session = temp;

        temp = strlen(pad);
        cp = (unsigned char *)entryx->pad;
        for (i = 0; i < temp && (i>>1) < sizeof (entryx->pad); i += 2)
                cp[i>>1] = hex2bin(pad[i]) << 4 | hex2bin(pad[i+1]);

        (void) sscanf(syslen, "%d", &temp);
        entryx->ut_syslen = temp;

        (void) strlcpy(entryx->ut_host, host, sizeof (entryx->ut_host));
}

/*
 * usage        - There's no need to say more.  This program isn't supposed to
 *              be executed by normal users directly.
 */

static void
usage()
{
        syslog(LOG_ERR, "Wrong number of arguments or invalid user \n");
}

/*
 * check_utmpx  - Verify the utmpx structure
 */

static void
check_utmpx(struct utmpx *entryx)
{
        char buf[BUF_SIZE];
        char *line = buf;
        struct passwd *pwd;
        int uid;
        int hostlen;
        char    *user;
        uid_t   ruid = getuid();

        (void) memset(buf, 0, BUF_SIZE);
        user = malloc(sizeof (entryx->ut_user) +1);
        (void) strncpy(user, entryx->ut_user, sizeof (entryx->ut_user));
        user[sizeof (entryx->ut_user)] = '\0';
        pwd = getpwnam(user);
        (void) free(user);

        (void) strlcat(strcpy(buf, "/dev/"), entryx->ut_line, sizeof (buf));

        if (pwd != (struct passwd *)NULL) {
                uid = pwd->pw_uid;
                /*
                 * We nolonger permit the UID of the caller to be different
                 * the UID to be written to the utmp file. This was thought
                 * necessary to allow the utmp file to be updated when
                 * logging out from an xterm(1) window after running
                 * exec login. Instead we now rely upon utmpd(8) to update
                 * the utmp file for us.
                 *
                 */

                if (ruid != uid) {
                        dprintf3("Bad uid: user %s  = %d uid = %d \n",
                            entryx->ut_user, uid, getuid());
                        exit(ILLEGAL_ARGUMENT);
                }

        } else if (entryx->ut_type != DEAD_PROCESS) {
                dprintf("Bad user name: %s \n", entryx->ut_user);
                exit(ILLEGAL_ARGUMENT);
        }

        /*
         * Only USER_PROCESS and DEAD_PROCESS entries may be updated
         */
        if (!(entryx->ut_type == USER_PROCESS ||
            entryx->ut_type == DEAD_PROCESS)) {
                dprintf("Bad type type = %d\n", entryx->ut_type);
                exit(ILLEGAL_ARGUMENT);
        }

        /*
         * Verify that the pid of the entry field is the same pid as our
         * parent, who should be the guy writing the entry.  This is commented
         * out for now because this restriction is overkill.
         */
#ifdef  VERIFY_PID
        if (entryx->ut_type == USER_PROCESS && entryx->ut_pid != getppid()) {
                dprintf("Bad pid = %d\n", entryx->ut_pid);
                exit(ILLEGAL_ARGUMENT);
        }
#endif  /* VERIFY_PID */

        if (bad_line(line) == 1) {
                dprintf("Bad line = %s\n", line);
                exit(ILLEGAL_ARGUMENT);
        }

        hostlen = strlen(entryx->ut_host) + 1;
        if (entryx->ut_syslen != hostlen) {
                dprintf3("Bad syslen of \"%s\" = %d - correcting to %d\n",
                    entryx->ut_host, entryx->ut_syslen, hostlen);
                entryx->ut_syslen = hostlen;
        }

        if (bad_hostname(entryx->ut_host, entryx->ut_syslen) == 1) {
                dprintf("Bad hostname name = %s\n", entryx->ut_host);
                exit(ILLEGAL_ARGUMENT);
        }
        check_id(entryx->ut_id, entryx->ut_line);
}

/*
 * bad_hostname         - Previously returned an error if a non alpha numeric
 *                      was in the host field, but now just clears those so
 *                      cmdtool entries will work.
 */

static int
bad_hostname(char *name, int len)
{
        int i;

        if (len < 0 || len > MAX_SYSLEN)
                return (1);
        /*
         * Scan for non-alpha numerics
         * Per utmpx.h, len includes the nul character.
         */
        for (i = 0; i < len; i++)
                if (name[i] != '\0' && isprint(name[i]) == 0)
                        name[i] = ' ';
        return (0);
}

/*
 * Workaround until the window system gets fixed.  Look for id's with
 * a '/' in them.  That means they are probably from libxview.
 * Then create a new id that is unique using the last 4 chars in the line.
 */

static void
check_id(char *id, char *line)
{
        int i, len;

        if (id[1] == '/' && id[2] == 's' && id[3] == 't') {
                len = strlen(line);
                if (len > 0)
                        len--;
                for (i = 0; i < 4; i++)
                        id[i] = len - i < 0 ? 0 : line[len-i];
        }
}


/*
 * The function invalid_utmpx() enforces the requirement that the record
 * being updating in the utmpx file can not have been created by login(1)
 * or friends. Also that the id and username of the record to be written match
 * those found in the utmpx file. We need this both for security and to ensure
 * that pututxline(3C) will NOT reposition the file pointer in the utmpx file,
 * so that the record is updated in place.
 *
 */
static int
invalid_utmpx(struct utmpx *eutmpx, struct utmpx *rutmpx)
{
#define SUTMPX_ID       (sizeof (eutmpx->ut_id))
#define SUTMPX_USER     (sizeof (eutmpx->ut_user))

        return (!nonuserx(*rutmpx) ||
            strncmp(eutmpx->ut_id, rutmpx->ut_id, SUTMPX_ID) != 0 ||
            strncmp(eutmpx->ut_user, rutmpx->ut_user, SUTMPX_USER) != 0);
}

static int
bad_line(char *line)
{
        struct stat statbuf;
        int     fd;

        /*
         * The line field must be a device file that we can write to,
         * it should live under /dev which is enforced by requiring
         * its name not to contain "../" and opening it as the user for
         * writing.
         */
        if (strstr(line, "../") != 0) {
                dprintf("Bad line = %s\n", line);
                return (1);
        }

        /*
         * It has to be a tty. It can't be a bogus file, e.g. ../tmp/bogus.
         */
        if (seteuid(getuid()) != 0)
                return (1);

        /*
         * We need to open the line without blocking so that it does not hang
         */
        if ((fd = open(line, O_WRONLY|O_NOCTTY|O_NONBLOCK)) == -1) {
                dprintf("Bad line (Can't open/write) = %s\n", line);
                return (1);
        }

        /*
         * Check that fd is a tty, if this fails all is not lost see below
         */
        if (isatty(fd) == 1) {
                /*
                 * It really is a tty, so return success
                 */
                (void) close(fd);
                if (seteuid(ROOT_UID) != 0)
                        return (1);
                return (0);
        }

        /*
         * Check that the line refers to a character
         * special device.
         */
        if ((fstat(fd, &statbuf) < 0) || !S_ISCHR(statbuf.st_mode)) {
                dprintf("Bad line (fstat failed) (Not S_IFCHR) = %s\n", line);
                (void) close(fd);
                return (1);
        }

        /*
         * Check that the line refers to a streams device
         */
        if (isastream(fd) != 1) {
                dprintf("Bad line (isastream failed) = %s\n", line);
                (void) close(fd);
                return (1);
        }

        /*
         * if isatty(3C) failed above we assume that the ptem module has
         * been popped already and that caused the failure, so we push it
         * and try again
         */
        if (ioctl(fd, I_PUSH, "ptem") == -1) {
                dprintf("Bad line (I_PUSH of \"ptem\" failed) = %s\n", line);
                (void) close(fd);
                return (1);
        }

        if (isatty(fd) != 1) {
                dprintf("Bad line (isatty failed) = %s\n", line);
                (void) close(fd);
                return (1);
        }

        if (ioctl(fd, I_POP, 0) == -1) {
                dprintf("Bad line (I_POP of \"ptem\" failed) = %s\n", line);
                (void) close(fd);
                return (1);
        }

        (void) close(fd);

        if (seteuid(ROOT_UID) != 0)
                return (1);

        return (0);

}

#ifdef  DEBUG

/*
 * display_args         - This code prints out invocation arguments
 *                      This is helpful since the program is called with
 *                      up to 15 argumments.
 */

static void
display_args(argc, argv)
        int argc;
        char **argv;
{
        int i = 0;

        while (argc--) {
                printf("Argument #%d = %s\n", i, argv[i]);
                i++;
        }
}

fputmpx(struct utmpx *rutmpx)
{
        printf("ut_user = \"%-32.32s\" \n", rutmpx->ut_user);
        printf("ut_id = \"%-4.4s\" \n", rutmpx->ut_id);
        printf("ut_line = \"%-32.32s\" \n", rutmpx->ut_line);
        printf("ut_pid = \"%d\" \n", rutmpx->ut_pid);
        printf("ut_type = \"%d\" \n", rutmpx->ut_type);
        printf("ut_exit.e_termination = \"%d\" \n",
            rutmpx->ut_exit.e_termination);
        printf("ut_exit.e_exit = \"%d\" \n", rutmpx->ut_exit.e_exit);
}

#endif /* DEBUG */