From b5a945d648ccb6b49829c6e6ea6f93c5ab65ab10 Mon Sep 17 00:00:00 2001 From: Ingo Weinhold Date: Thu, 17 Apr 2008 17:58:51 +0000 Subject: [PATCH] Allow only root access to the shadow password DB. git-svn-id: file:///srv/svn/repos/haiku/haiku/trunk@25005 a95241bf-73f2-0310-859d-f6bbb57e9c96 --- src/servers/registrar/AuthenticationManager.cpp | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/src/servers/registrar/AuthenticationManager.cpp b/src/servers/registrar/AuthenticationManager.cpp index e3a1759411..e34eb6bd15 100644 --- a/src/servers/registrar/AuthenticationManager.cpp +++ b/src/servers/registrar/AuthenticationManager.cpp @@ -542,7 +542,8 @@ AuthenticationManager::_RequestThread() // request loop while (true) { KMessage message; - status_t error = message.ReceiveFrom(fRequestPort); + port_message_info messageInfo; + status_t error = message.ReceiveFrom(fRequestPort, -1, &messageInfo); if (error != B_OK) return B_OK; @@ -612,10 +613,13 @@ AuthenticationManager::_RequestThread() case B_REG_GET_SHADOW_PASSWD_DB: { -// TODO: Check permissions! + // only root may see the shadow passwd + if (messageInfo.sender != 0) + error = EPERM; + // lazily build the reply try { - if (fShadowPwdDBReply->What() == 1) { + if (error == B_OK && fShadowPwdDBReply->What() == 1) { FlatStore store; int32 count = fUserDB->WriteFlatShadowDB(store); if (fShadowPwdDBReply->AddInt32("count", count) != B_OK @@ -661,9 +665,12 @@ AuthenticationManager::_RequestThread() if (error == B_OK && user == NULL) error = ENOENT; - // TODO: Check permissions! bool getShadowPwd = message.GetBool("shadow", false); + // only root may see the shadow passwd + if (error == B_OK && getShadowPwd && messageInfo.sender != 0) + error = EPERM; + // add user to message KMessage reply; if (error == B_OK)