---
src/base/osaf_secutil.c | 21 ++++++++++++++++++++-
src/base/osaf_secutil.h | 2 +-
src/imm/immnd/immnd_evt.c | 4 ++--
src/log/logd/lgs_config.cc | 2 +-
4 files changed, 24 insertions(+), 5 deletions(-)
diff --git a/src/base/osaf_secutil.c b/src/base/osaf_secutil.c
index 0e175c915..2ad14db7e 100644
--- a/src/base/osaf_secutil.c
+++ b/src/base/osaf_secutil.c
@@ -42,6 +42,7 @@
#include <pwd.h>
#include <grp.h>
#include <pthread.h>
+#include <stdio.h>
#include "base/osaf_poll.h"
#include "base/logtrace.h"
@@ -184,6 +185,18 @@ static void *auth_server_main(void *_fd)
return 0;
}
+bool osaf_pid_is_member_of_group(pid_t pid, gid_t gid_auth)
+{
+ char str[256];
+
+ snprintf(str, sizeof(str),
+ "grep \"^Groups\" /proc/%d/status | grep -w -q \"%d\"", pid,
+ gid_auth);
+ if (system(str) != 0)
+ return false;
+ return true;
+}
+
/*************** public interface follows*************************** */
int osaf_auth_server_create(const char *pathname,
@@ -220,7 +233,7 @@ int osaf_auth_server_create(const char *pathname,
}
/* used by server, logging is OK */
-bool osaf_user_is_member_of_group(uid_t uid, const char *groupname)
+bool osaf_user_is_member_of_group(uid_t uid, const char *groupname, pid_t pid)
{
long grpmembufsize = sysconf(_SC_GETGR_R_SIZE_MAX);
if (grpmembufsize < 0)
@@ -263,6 +276,12 @@ bool osaf_user_is_member_of_group(uid_t uid, const char
*groupname)
return false;
}
+ if (osaf_pid_is_member_of_group(pid, client_grp->gr_gid)) {
+ free(pwdmembuf);
+ free(grpmembuf);
+ return true;
+ }
+
// get password file entry for user
struct passwd pbuf;
struct passwd *client_pwd;
diff --git a/src/base/osaf_secutil.h b/src/base/osaf_secutil.h
index a2389241c..d60cafac7 100644
--- a/src/base/osaf_secutil.h
+++ b/src/base/osaf_secutil.h
@@ -86,7 +86,7 @@ int osaf_auth_server_create(const char *_pathname,
* @param groupname
* @return true if member
*/
-bool osaf_user_is_member_of_group(uid_t uid, const char *groupname);
+bool osaf_user_is_member_of_group(uid_t uid, const char *groupname, pid_t pid);
/**
* Get list of groups that a user belong to
diff --git a/src/imm/immnd/immnd_evt.c b/src/imm/immnd/immnd_evt.c
index 3bd56fe34..5e7c1fe5c 100644
--- a/src/imm/immnd/immnd_evt.c
+++ b/src/imm/immnd/immnd_evt.c
@@ -894,8 +894,8 @@ static uint32_t immnd_evt_proc_imm_init(IMMND_CB *cb,
IMMND_EVT *evt,
const char *authorized_group =
immModel_authorizedGroup(immnd_cb);
if ((authorized_group != NULL) &&
- (osaf_user_is_member_of_group(sinfo->uid,
- authorized_group))) {
+ (osaf_user_is_member_of_group(
+ sinfo->uid, authorized_group, sinfo->pid))) {
TRACE("configured group");
} else {
if (mode == ACCESS_CONTROL_PERMISSIVE) {
diff --git a/src/log/logd/lgs_config.cc b/src/log/logd/lgs_config.cc
index e09ba35ae..1fe6c9f87 100644
--- a/src/log/logd/lgs_config.cc
+++ b/src/log/logd/lgs_config.cc
@@ -595,7 +595,7 @@ int lgs_cfg_verify_log_data_groupname(char *group_name) {
rc = -1;
} else {
uid_t uid = getuid();
- if (osaf_user_is_member_of_group(uid, group_name) == false) {
+ if (osaf_user_is_member_of_group(uid, group_name, 0) == false) {
LOG_WA("%s: osaf_user_is_member_of_group() Fail", __FUNCTION__);
rc = -1;
}
--
2.17.1
_______________________________________________
Opensaf-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/opensaf-devel
