[PATCH 3/3] Stop using $USER for shadow entries

From: FRIGN <dev_AT_frign.de>
Date: Sun, 11 Sep 2016 23:17:53 +0200

This was extremely bad practice, effectively making the program behave
different depending on which architecture you are running it on.

OpenBSD offers getpwuid_shadow, but there is no getspuid for getspnam,
so we resort to using the pw_name entry in the struct passwd we filled
earlier.

This prevents slock from crashing when $USER is empty (easy to do). If
you want to run slock as a different user, don't use

        $ USER="tom" slock

but doas or sudo which were designed for this purpose.

---
 slock.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)
diff --git a/slock.c b/slock.c
index e231ce6..5348863 100644
--- a/slock.c
+++ b/slock.c
_AT_@ -87,7 +87,7 @@ dontkillme(void)
 static const char *
 gethash(void)
 {
-	const char *rval;
+	const char *hash;
 	struct passwd *pw;
 
 	/* Check if the current user has a password entry */
_AT_@ -98,28 +98,28 @@ gethash(void)
 		else
 			die("slock: cannot retrieve password entry\n");
 	}
-	rval = pw->pw_passwd;
+	hash = pw->pw_passwd;
 
 #if HAVE_SHADOW_H
-	if (rval[0] == 'x' && rval[1] == '\0') {
+	if (hash[0] == 'x' && hash[1] == '\0') {
 		struct spwd *sp;
-		if (!(sp = getspnam(getenv("USER"))))
+		if (!(sp = getspnam(pw->pw_name)))
 			die("slock: getspnam: cannot retrieve shadow entry (make sure to suid or sgid slock)\n");
-		rval = sp->sp_pwdp;
+		hash = sp->sp_pwdp;
 	}
 #else
-	if (rval[0] == '*' && rval[1] == '\0') {
+	if (hash[0] == '*' && hash[1] == '\0') {
 #ifdef __OpenBSD__
-		if (!(pw = getpwnam_shadow(getenv("USER"))))
+		if (!(pw = getpwuid_shadow(getuid())))
 			die("slock: getpwnam_shadow: cannot retrieve shadow entry (make sure to suid or sgid slock)\n");
-		rval = pw->pw_passwd;
+		hash = pw->pw_passwd;
 #else
 		die("slock: getpwuid: cannot retrieve shadow entry (make sure to suid or sgid slock)\n");
 #endif /* __OpenBSD__ */
 	}
 #endif /* HAVE_SHADOW_H */
 
-	return rval;
+	return hash;
 }
 
 static void
-- 
2.7.3
--Multipart=_Sun__11_Sep_2016_23_24_20_+0200_yLsZjR=N1XirPpcZ--

Received on Mon Sep 17 2001 - 00:00:00 CEST