--- src/base/osaf_secutil.c | 21 ++++++++++++++++++++- src/base/osaf_secutil.h | 2 +- src/imm/immnd/immnd_evt.c | 4 ++-- src/log/logd/lgs_config.cc | 2 +- 4 files changed, 24 insertions(+), 5 deletions(-)
diff --git a/src/base/osaf_secutil.c b/src/base/osaf_secutil.c index 0e175c915..2ad14db7e 100644 --- a/src/base/osaf_secutil.c +++ b/src/base/osaf_secutil.c @@ -42,6 +42,7 @@ #include <pwd.h> #include <grp.h> #include <pthread.h> +#include <stdio.h> #include "base/osaf_poll.h" #include "base/logtrace.h" @@ -184,6 +185,18 @@ static void *auth_server_main(void *_fd) return 0; } +bool osaf_pid_is_member_of_group(pid_t pid, gid_t gid_auth) +{ + char str[256]; + + snprintf(str, sizeof(str), + "grep \"^Groups\" /proc/%d/status | grep -w -q \"%d\"", pid, + gid_auth); + if (system(str) != 0) + return false; + return true; +} + /*************** public interface follows*************************** */ int osaf_auth_server_create(const char *pathname, @@ -220,7 +233,7 @@ int osaf_auth_server_create(const char *pathname, } /* used by server, logging is OK */ -bool osaf_user_is_member_of_group(uid_t uid, const char *groupname) +bool osaf_user_is_member_of_group(uid_t uid, const char *groupname, pid_t pid) { long grpmembufsize = sysconf(_SC_GETGR_R_SIZE_MAX); if (grpmembufsize < 0) @@ -263,6 +276,12 @@ bool osaf_user_is_member_of_group(uid_t uid, const char *groupname) return false; } + if (osaf_pid_is_member_of_group(pid, client_grp->gr_gid)) { + free(pwdmembuf); + free(grpmembuf); + return true; + } + // get password file entry for user struct passwd pbuf; struct passwd *client_pwd; diff --git a/src/base/osaf_secutil.h b/src/base/osaf_secutil.h index a2389241c..d60cafac7 100644 --- a/src/base/osaf_secutil.h +++ b/src/base/osaf_secutil.h @@ -86,7 +86,7 @@ int osaf_auth_server_create(const char *_pathname, * @param groupname * @return true if member */ -bool osaf_user_is_member_of_group(uid_t uid, const char *groupname); +bool osaf_user_is_member_of_group(uid_t uid, const char *groupname, pid_t pid); /** * Get list of groups that a user belong to diff --git a/src/imm/immnd/immnd_evt.c b/src/imm/immnd/immnd_evt.c index 3bd56fe34..5e7c1fe5c 100644 --- a/src/imm/immnd/immnd_evt.c +++ b/src/imm/immnd/immnd_evt.c @@ -894,8 +894,8 @@ static uint32_t immnd_evt_proc_imm_init(IMMND_CB *cb, IMMND_EVT *evt, const char *authorized_group = immModel_authorizedGroup(immnd_cb); if ((authorized_group != NULL) && - (osaf_user_is_member_of_group(sinfo->uid, - authorized_group))) { + (osaf_user_is_member_of_group( + sinfo->uid, authorized_group, sinfo->pid))) { TRACE("configured group"); } else { if (mode == ACCESS_CONTROL_PERMISSIVE) { diff --git a/src/log/logd/lgs_config.cc b/src/log/logd/lgs_config.cc index e09ba35ae..1fe6c9f87 100644 --- a/src/log/logd/lgs_config.cc +++ b/src/log/logd/lgs_config.cc @@ -595,7 +595,7 @@ int lgs_cfg_verify_log_data_groupname(char *group_name) { rc = -1; } else { uid_t uid = getuid(); - if (osaf_user_is_member_of_group(uid, group_name) == false) { + if (osaf_user_is_member_of_group(uid, group_name, 0) == false) { LOG_WA("%s: osaf_user_is_member_of_group() Fail", __FUNCTION__); rc = -1; } -- 2.17.1 _______________________________________________ Opensaf-devel mailing list Opensaf-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/opensaf-devel