login_cap_sys/lib.rs
1#![allow(non_upper_case_globals)]
2#![allow(non_camel_case_types)]
3#![allow(non_snake_case)]
4
5///! From `login_getclass(3)`:
6///!
7///! ```no_build
8///! HISTORY
9///! The login_getclass function first appeared in OpenBSD 2.8.
10///!
11///! CAVEATS
12///! The string returned by login_getcapstr() is allocated via malloc(3) when
13///! the specified capability is present and thus it is the responsibility of
14///! the caller to free() this space. However, if the capability was not
15///! found or an error occurred and def or err (whichever is relevant) are
16///! non-NULL the returned value is simply what was passed in to
17///! login_getcapstr(). Therefore it is not possible to blindly free() the
18///! return value without first checking it against def and err.
19///!
20///! The same warnings set forth in setlogin(2) apply to setusercontext() when
21///! the LOGIN_SETLOGIN flag is used. Specifically, changing the login name
22///! affects all processes in the current session, not just the current
23///! process. See setlogin(2) for more information.
24
25use std::os::raw::{c_char, c_int, c_uint};
26
27/// Set the group ID and call initgroups(3).
28/// Requires the pwd field be specified.
29pub const LOGIN_SETGROUP: c_uint = 0x0001;
30
31/// Set the login name set by setlogin(2).
32/// Requires the pwd field be specified.
33pub const LOGIN_SETLOGIN: c_uint = 0x0002;
34
35/// Sets the PATH environment variable.
36pub const LOGIN_SETPATH: c_uint = 0x0004;
37
38/// Swets the priority by setpriority(2).
39pub const LOGIN_SETPRIORITY: c_uint = 0x0008;
40
41/// Sets the various system resources by setrlimit(2).
42pub const LOGIN_SETRESOURCES: c_uint = 0x0010;
43
44/// Sets the umask by umask(2).
45pub const LOGIN_SETUMASK: c_uint = 0x0020;
46
47/// Sets the user ID to uid by setuid(2).
48pub const LOGIN_SETUSER: c_uint = 0x0040;
49
50/// Sets environment variables specified by the setenv keyword.
51pub const LOGIN_SETENV: c_uint = 0x0080;
52
53/// Sets all of the above.
54pub const LOGIN_SETALL: c_uint = 0x00ff;
55
56/// Accepted authentication
57pub const BI_AUTH: &'static [u8; 9] = b"authorize";
58
59/// Rejected authentication
60pub const BI_REJECT: &'static [u8; 6] = b"reject";
61
62/// Reject with a challenge
63pub const BI_CHALLENGE: &'static [u8; 16] = b"reject challenge";
64
65/// Reject silently
66pub const BI_SILENT: &'static [u8; 13] = b"reject silent";
67
68/// Remove file on error
69pub const BI_REMOVE: &'static [u8; 6] = b"remove";
70
71/// Root authenticated
72pub const BI_ROOTOKAY: &'static [u8; 14] = b"authorize root";
73
74/// Ok on non-secure line
75pub const BI_SECURE: &'static [u8; 16] = b"authorize secure";
76
77/// Set environment variable
78pub const BI_SETENV: &'static [u8; 6] = b"setenv";
79
80/// Unset environment variable
81pub const BI_UNSETENV: &'static [u8; 8] = b"unsetenv";
82
83/// Set local variable
84pub const BI_VALUE: &'static [u8; 5] = b"value";
85
86/// Account expired
87pub const BI_EXPIRED: &'static [u8; 14] = b"reject expired";
88
89/// Password expired
90pub const BI_PWEXPIRED: &'static [u8; 16] = b"reject pwexpired";
91
92/// Child is passing an fd
93pub const BI_FDPASS: &'static [u8; 2] = b"fd";
94
95// Bits which can be returned by authenticate()/auth_scan()
96
97/// User authenticated
98pub const AUTH_OKAY: c_uint = 0x01;
99
100/// Authenticated as root
101pub const AUTH_ROOTOKAY: c_uint = 0x02;
102
103/// Secure login
104pub const AUTH_SECURE: c_uint = 0x04;
105
106/// Silent rejection
107pub const AUTH_SILENT: c_uint = 0x08;
108
109/// A challenge was given
110pub const AUTH_CHALLENGE: c_uint = 0x10;
111
112/// Account expired
113pub const AUTH_EXPIRED: c_uint = 0x20;
114
115/// Password expired
116pub const AUTH_PWEXPIRED: c_uint = 0x40;
117
118/// Bitwise OR (AUTH_OKAY | AUTH_ROOTOKAY | AUTH_SECURE)
119pub const AUTH_ALLOW: c_uint = AUTH_OKAY | AUTH_ROOTOKAY | AUTH_SECURE;
120
121/// Raw type for login capability, aliased as `login_cap_t`
122#[repr(C)]
123#[derive(Debug, Copy, Clone)]
124pub struct login_cap {
125 pub lc_class: *mut c_char,
126 pub lc_cap: *mut c_char,
127 pub lc_style: *mut c_char,
128}
129
130/// Alias for the login capability type `login_cap`
131pub type login_cap_t = login_cap;
132
133pub type quad_t = i64;
134
135extern "C" {
136 /// From `login_getclass(3)`:
137 ///
138 /// ```no_build
139 /// The login_getclass() function extracts the entry specified by class (or
140 /// default if class is NULL or the empty string) from /etc/login.conf (see
141 /// login.conf(5)). If the entry is found, a login_cap_t pointer is
142 /// returned. NULL is returned if the user class is not found. When the
143 /// login_cap_t structure is no longer needed, it should be freed by the
144 /// login_close() function.
145 /// ```
146 pub fn login_getclass(_class: *mut c_char) -> *mut login_cap_t;
147
148 /// From `login_getclass(3)`:
149 ///
150 /// ```no_build
151 /// The login_getstyle() function is used to obtain
152 /// the style of authentication that should be used for this user class. The
153 /// style argument may either be NULL or the desired style of authentication.
154 /// If NULL, the first available authentication style will be used. The type
155 /// argument refers to the type of authentication being performed. This is
156 /// used to override the standard auth entry in the database. By convention
157 /// this should be of the form "auth-type". Future releases may remove the
158 /// requirement for the "auth-" prefix and add it if it is missing. If type
159 /// is NULL then only "auth" will be looked at (see login.conf(5)). The
160 /// login_getstyle() function will return NULL if the desired style of
161 /// authentication is not available, or if no style is available.
162 /// ```
163 pub fn login_getstyle(_lc: *mut login_cap_t, _style: *mut c_char, _type: *mut c_char) -> *mut c_char;
164
165 /// From `login_getclass(3)`:
166 ///
167 /// ```no_build
168 /// The login_getcapbool() function returns def if no capabilities were found for
169 /// this class (typically meaning that the default class was used and the /etc/login.conf file is missing).
170 /// It returns a non-zero value if cap, with no value, was found, zero otherwise.
171 /// ```
172 pub fn login_getcapbool(_lc: *mut login_cap_t, _cap: *mut c_char, _def: c_uint) -> c_int;
173
174 /// From `login_getclass(3)`:
175 ///
176 /// ```no_build
177 /// The login_getcapnum() function queries the database entry for a field
178 /// named cap. If the field is found, its value is returned. If the field
179 /// is not found, the value specified by def is returned. If an error is
180 /// encountered while trying to find the field, err is returned. See
181 /// login.conf(5) for a discussion of the various textual forms the value may
182 /// take.
183 /// ```
184 pub fn login_getcapnum(_lc: *mut login_cap_t, _cap: *mut c_char, _def: quad_t, _err: quad_t) -> quad_t;
185
186 /// From `login_getclass(3)`:
187 ///
188 /// ```no_build
189 /// The login_getcapsize() function queries the database entry for a field
190 /// named cap. If the field is found, its value is returned. If the field
191 /// is not found, the value specified by def is returned. If an error is
192 /// encountered while trying to find the field, err is returned. See
193 /// login.conf(5) for a discussion of the various textual forms the value may
194 /// take.
195 /// ```
196 pub fn login_getcapsize(_lc: *mut login_cap_t, _cap: *mut c_char, _def: quad_t, _err: quad_t) -> quad_t;
197
198 /// From `login_getclass(3)`:
199 ///
200 /// ```no_build
201 /// The login_getcapstr() function queries the database entry for a field
202 /// named cap. If the field is found, its value is returned. If the field
203 /// is not found, the value specified by def is returned. If an error is
204 /// encountered while trying to find the field, err is returned. See
205 /// login.conf(5) for a discussion of the various textual forms the value may
206 /// take.
207 /// ```
208 pub fn login_getcapstr(_lc: *mut login_cap_t, _cap: *mut c_char, _def: *mut c_char, _err: *mut c_char) -> *mut c_char;
209
210 /// From `login_getclass(3)`:
211 ///
212 /// ```no_build
213 /// The login_getcaptime() function queries the database entry for a field
214 /// named cap. If the field is found, its value is returned. If the field
215 /// is not found, the value specified by def is returned. If an error is
216 /// encountered while trying to find the field, err is returned. See
217 /// login.conf(5) for a discussion of the various textual forms the value may
218 /// take.
219 /// ```
220 pub fn login_getcaptime(_lc: *mut login_cap_t, _cap: *mut c_char, _def: quad_t, _err: quad_t) -> quad_t;
221
222 /// From `login_getclass(3)`:
223 ///
224 /// ```no_build
225 /// When the login_cap_t structure is no longer needed, it should be freed by the
226 /// login_close() function.
227 /// ```
228 pub fn login_close(_lc: *mut login_cap_t);
229
230 /// From `login_getclass(3)`:
231 ///
232 /// ```no_build
233 /// The secure_path() function takes a path name and returns 0 if the path
234 /// name is secure, -1 if not. To be secure a path must exist, be a regular
235 /// file (and not a directory), owned by root, and only writable by the owner
236 /// (root).
237 /// ```
238 pub fn secure_path(_path: *mut c_char) -> c_int;
239
240 /// From `login_getclass(3)`:
241 ///
242 /// ```no_build
243 /// The setclasscontext() function takes class, the name of a user class, and
244 /// sets the resources defined by that class according to flags. Only the
245 /// LOGIN_SETPATH, LOGIN_SETPRIORITY, LOGIN_SETRESOURCES, and LOGIN_SETUMASK
246 /// bits are used (see setusercontext() below). It returns 0 on success and
247 /// -1 on failure.
248 /// ```
249 pub fn setclasscontext(_class: *mut c_char, _flags: c_uint) -> c_int;
250
251 /// From `login_getclass(3)`:
252 ///
253 /// ```no_build
254 /// The setusercontext() function sets the resources according to flags. The
255 /// lc argument, if not NULL, contains the class information that should be
256 /// used. The pwd argument, if not NULL, provides information about the
257 /// user. Both lc and pwd cannot be NULL. The uid argument is used in place
258 /// of the user ID contained in the pwd structure when calling setuid(2).
259 /// The setusercontext() function returns 0 on success and -1 on failure.
260 /// The various bits available to be or-ed together to make up flags are:
261 ///
262 /// LOGIN_SETENV Sets environment variables specified by the setenv
263 /// keyword.
264 /// LOGIN_SETGROUP Set the group ID and call initgroups(3). Requires
265 /// the pwd field be specified.
266 ///
267 /// LOGIN_SETLOGIN Sets the login name by setlogin(2). Requires the
268 /// pwd field be specified.
269 ///
270 /// LOGIN_SETPATH Sets the PATH environment variable.
271 ///
272 /// LOGIN_SETPRIORITY Sets the priority by setpriority(2).
273 ///
274 /// LOGIN_SETRESOURCES Sets the various system resources by setrlimit(2).
275 ///
276 /// LOGIN_SETUMASK Sets the umask by umask(2).
277 ///
278 /// LOGIN_SETUSER Sets the user ID to uid by setuid(2).
279 ///
280 /// LOGIN_SETALL Sets all of the above.
281 /// ```
282 pub fn setusercontext(_lc: *mut login_cap_t, _pwd: *mut libc::passwd, _uid: libc::uid_t, _flags: c_uint) -> c_int;
283}