[2529] 2009-08-25 Vladimir Serbinenko <[email protected]>
Vladimir Serbinenko <[email protected]> Mon, 24 Aug 2009 23:55:07 +0000
| Newsgroups | gmane.comp.boot-loaders.grub.cvs |
|---|---|
| Message-ID | <[email protected]> |
Revision: 2529
http://svn.sv.gnu.org/viewvc/?view=rev&root=grub&revision=2529
Author: phcoder
Date: 2009-08-24 23:55:06 +0000 (Mon, 24 Aug 2009)
Log Message:
-----------
2009-08-25 Vladimir Serbinenko <[email protected]>
Authentication support.
* commands/password.c: New file.
* conf/common.rmk (pkglib_MODULES): Add password.mod.
(password_mod_SOURCES): New variable.
(password_mod_CFLAGS): Likewise.
(password_mod_LDFLAGS): Likewise.
(normal_mod_SOURCES): Add normal/auth.c.
* conf/i386-coreboot.rmk (grub_emu_SOURCES): Add commands/password.c and
normal/auth.c.
* conf/i386-efi.rmk (grub_emu_SOURCES): Likewise.
* conf/i386-ieee1275.rmk (grub_emu_SOURCES): Likewise.
* conf/i386-pc.rmk (grub_emu_SOURCES): Likewise.
* conf/powerpc-ieee1275.rmk (grub_emu_SOURCES): Likewise.
* conf/sparc64-ieee1275.rmk (grub_emu_SOURCES): Likewise.
* conf/x86_64-efi.rmk (grub_emu_SOURCES): Likewise.
* include/grub/auth.h: New file.
* include/grub/err.h (grub_err_t): New enum value
GRUB_ERR_ACCESS_DENIED.
* include/grub/menu.h (grub_menu_entry): New fields 'restricted' and
'users'.
* include/grub/normal.h (grub_cmdline_get): New argument 'history'.
* normal/cmdline.c (grub_cmdline_get): New argument 'history'. All
users updated.
* normal/auth.c: New file.
* normal/main.c (grub_normal_add_menu_entry): Handle --users option.
(grub_cmdline_run): Don't allow to go to command line without
authentication.
* normal/menu.c (grub_menu_execute_entry): Handle restricted entries.
* normal/menu_entry.c (grub_menu_entry_run): Don't allow editing
menuentry without superuser rights.
* normal/menu_viewer.c (grub_menu_viewer_show_menu): Don't exit if
user isn't a superuser.
Modified Paths:
--------------
trunk/grub2/ChangeLog
trunk/grub2/conf/common.rmk
trunk/grub2/conf/i386-coreboot.rmk
trunk/grub2/conf/i386-efi.rmk
trunk/grub2/conf/i386-ieee1275.rmk
trunk/grub2/conf/i386-pc.rmk
trunk/grub2/conf/powerpc-ieee1275.rmk
trunk/grub2/conf/sparc64-ieee1275.rmk
trunk/grub2/conf/x86_64-efi.rmk
trunk/grub2/include/grub/err.h
trunk/grub2/include/grub/menu.h
trunk/grub2/include/grub/normal.h
trunk/grub2/normal/cmdline.c
trunk/grub2/normal/main.c
trunk/grub2/normal/menu.c
trunk/grub2/normal/menu_entry.c
trunk/grub2/normal/menu_viewer.c
Added Paths:
-----------
trunk/grub2/commands/password.c
trunk/grub2/include/grub/auth.h
trunk/grub2/normal/auth.c
Modified: trunk/grub2/ChangeLog
===================================================================
--- trunk/grub2/ChangeLog 2009-08-24 19:40:40 UTC (rev 2528)
+++ trunk/grub2/ChangeLog 2009-08-24 23:55:06 UTC (rev 2529)
@@ -1,3 +1,39 @@
+2009-08-25 Vladimir Serbinenko <[email protected]>
+
+ Authentication support.
+
+ * commands/password.c: New file.
+ * conf/common.rmk (pkglib_MODULES): Add password.mod.
+ (password_mod_SOURCES): New variable.
+ (password_mod_CFLAGS): Likewise.
+ (password_mod_LDFLAGS): Likewise.
+ (normal_mod_SOURCES): Add normal/auth.c.
+ * conf/i386-coreboot.rmk (grub_emu_SOURCES): Add commands/password.c and
+ normal/auth.c.
+ * conf/i386-efi.rmk (grub_emu_SOURCES): Likewise.
+ * conf/i386-ieee1275.rmk (grub_emu_SOURCES): Likewise.
+ * conf/i386-pc.rmk (grub_emu_SOURCES): Likewise.
+ * conf/powerpc-ieee1275.rmk (grub_emu_SOURCES): Likewise.
+ * conf/sparc64-ieee1275.rmk (grub_emu_SOURCES): Likewise.
+ * conf/x86_64-efi.rmk (grub_emu_SOURCES): Likewise.
+ * include/grub/auth.h: New file.
+ * include/grub/err.h (grub_err_t): New enum value
+ GRUB_ERR_ACCESS_DENIED.
+ * include/grub/menu.h (grub_menu_entry): New fields 'restricted' and
+ 'users'.
+ * include/grub/normal.h (grub_cmdline_get): New argument 'history'.
+ * normal/cmdline.c (grub_cmdline_get): New argument 'history'. All
+ users updated.
+ * normal/auth.c: New file.
+ * normal/main.c (grub_normal_add_menu_entry): Handle --users option.
+ (grub_cmdline_run): Don't allow to go to command line without
+ authentication.
+ * normal/menu.c (grub_menu_execute_entry): Handle restricted entries.
+ * normal/menu_entry.c (grub_menu_entry_run): Don't allow editing
+ menuentry without superuser rights.
+ * normal/menu_viewer.c (grub_menu_viewer_show_menu): Don't exit if
+ user isn't a superuser.
+
2009-08-24 Vladimir Serbinenko <[email protected]>
Save space by inlining misc.c functions.
Added: trunk/grub2/commands/password.c
===================================================================
--- trunk/grub2/commands/password.c (rev 0)
+++ trunk/grub2/commands/password.c 2009-08-24 23:55:06 UTC (rev 2529)
@@ -0,0 +1,86 @@
+/*
+ * GRUB -- GRand Unified Bootloader
+ * Copyright (C) 2009 Free Software Foundation, Inc.
+ *
+ * GRUB is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GRUB is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with GRUB. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <grub/auth.h>
+#include <grub/list.h>
+#include <grub/mm.h>
+#include <grub/misc.h>
+#include <grub/env.h>
+#include <grub/normal.h>
+#include <grub/dl.h>
+
+static grub_dl_t my_mod;
+
+static grub_err_t
+check_password (const char *user,
+ void *password)
+{
+ char entered[1024];
+
+ grub_memset (entered, 0, sizeof (entered));
+
+ if (!GRUB_GET_PASSWORD (entered, sizeof (entered) - 1))
+ return GRUB_ACCESS_DENIED;
+
+ if (grub_auth_strcmp (entered, password) != 0)
+ return GRUB_ACCESS_DENIED;
+
+ grub_auth_authenticate (user);
+
+ return GRUB_ERR_NONE;
+}
+
+static grub_err_t
+grub_cmd_password (grub_command_t cmd __attribute__ ((unused)),
+ int argc, char **args)
+{
+ grub_err_t err;
+ char *pass;
+
+ if (argc != 2)
+ return grub_error (GRUB_ERR_BAD_ARGUMENT, "Two arguments expected.");
+
+ pass = grub_strdup (args[1]);
+ if (!pass)
+ return grub_errno;
+
+ err = grub_auth_register_authentication (args[0], check_password, pass);
+ if (err)
+ {
+ grub_free (pass);
+ return err;
+ }
+ grub_dl_ref (my_mod);
+ return GRUB_ERR_NONE;
+}
+
+static grub_command_t cmd;
+
+GRUB_MOD_INIT(password)
+{
+ my_mod = mod;
+ cmd = grub_register_command ("password", grub_cmd_password,
+ "password USER PASSWORD",
+ "Set user password (plaintext). "
+ "Unrecommended and insecure.");
+}
+
+GRUB_MOD_FINI(password)
+{
+ grub_unregister_command (cmd);
+}
Modified: trunk/grub2/conf/common.rmk
===================================================================
--- trunk/grub2/conf/common.rmk 2009-08-24 19:40:40 UTC (rev 2528)
+++ trunk/grub2/conf/common.rmk 2009-08-24 23:55:06 UTC (rev 2529)
@@ -363,8 +363,13 @@
terminfo.mod test.mod blocklist.mod hexdump.mod \
read.mod sleep.mod loadenv.mod crc.mod parttool.mod \
msdospart.mod memrw.mod normal.mod sh.mod lua.mod \
- gptsync.mod true.mod probe.mod
+ gptsync.mod true.mod probe.mod password.mod
+# For password.mod.
+password_mod_SOURCES = commands/password.c
+password_mod_CFLAGS = $(COMMON_CFLAGS)
+password_mod_LDFLAGS = $(COMMON_LDFLAGS)
+
# For gptsync.mod.
gptsync_mod_SOURCES = commands/gptsync.c
gptsync_mod_CFLAGS = $(COMMON_CFLAGS)
@@ -507,7 +512,7 @@
# For normal.mod.
normal_mod_SOURCES = normal/main.c normal/cmdline.c normal/dyncmd.c \
- normal/autofs.c normal/handler.c \
+ normal/auth.c normal/autofs.c normal/handler.c \
normal/color.c normal/completion.c normal/datetime.c normal/menu.c \
normal/menu_entry.c normal/menu_text.c normal/menu_viewer.c \
normal/misc.c
Modified: trunk/grub2/conf/i386-coreboot.rmk
===================================================================
--- trunk/grub2/conf/i386-coreboot.rmk 2009-08-24 19:40:40 UTC (rev 2528)
+++ trunk/grub2/conf/i386-coreboot.rmk 2009-08-24 23:55:06 UTC (rev 2529)
@@ -110,6 +110,7 @@
commands/handler.c commands/ls.c commands/test.c \
commands/search.c commands/blocklist.c commands/hexdump.c \
commands/gptsync.c commands/probe.c commands/xnu_uuid.c \
+ commands/password.c \
lib/hexdump.c commands/i386/cpuid.c \
disk/host.c disk/loopback.c \
\
@@ -127,7 +128,7 @@
kern/partition.c kern/reader.c kern/term.c \
kern/rescue_reader.c kern/rescue_parser.c \
lib/arg.c normal/cmdline.c normal/misc.c \
- normal/handler.c normal/autofs.c \
+ normal/handler.c normal/auth.c normal/autofs.c \
normal/completion.c normal/datetime.c normal/main.c \
normal/menu_text.c \
normal/menu.c normal/menu_entry.c normal/menu_viewer.c \
Modified: trunk/grub2/conf/i386-efi.rmk
===================================================================
--- trunk/grub2/conf/i386-efi.rmk 2009-08-24 19:40:40 UTC (rev 2528)
+++ trunk/grub2/conf/i386-efi.rmk 2009-08-24 23:55:06 UTC (rev 2529)
@@ -39,6 +39,7 @@
commands/search.c commands/hexdump.c lib/hexdump.c \
commands/halt.c commands/reboot.c \
commands/i386/cpuid.c \
+ commands/password.c \
disk/loopback.c \
\
fs/affs.c fs/cpio.c fs/ext2.c fs/fat.c fs/hfs.c \
@@ -54,7 +55,7 @@
kern/partition.c kern/reader.c kern/term.c \
kern/rescue_reader.c kern/rescue_parser.c \
lib/arg.c normal/cmdline.c normal/command.c normal/datetime.c \
- normal/autofs.c \
+ normal/auth.c normal/autofs.c \
normal/completion.c normal/context.c normal/main.c \
normal/menu.c normal/menu_entry.c normal/menu_viewer.c \
normal/menu_text.c \
Modified: trunk/grub2/conf/i386-ieee1275.rmk
===================================================================
--- trunk/grub2/conf/i386-ieee1275.rmk 2009-08-24 19:40:40 UTC (rev 2528)
+++ trunk/grub2/conf/i386-ieee1275.rmk 2009-08-24 23:55:06 UTC (rev 2529)
@@ -66,6 +66,7 @@
lib/hexdump.c commands/halt.c commands/reboot.c \
commands/gptsync.c commands/probe.c commands/xnu_uuid.c \
commands/i386/cpuid.c \
+ commands/password.c \
disk/host.c disk/loopback.c \
\
fs/affs.c fs/cpio.c fs/fat.c fs/ext2.c fs/hfs.c \
@@ -82,7 +83,7 @@
kern/partition.c kern/reader.c kern/term.c \
kern/rescue_reader.c kern/rescue_parser.c \
lib/arg.c normal/cmdline.c normal/datetime.c normal/misc.c \
- normal/handler.c normal/autofs.c \
+ normal/handler.c normal/auth.c normal/autofs.c \
normal/completion.c normal/main.c normal/menu_text.c \
normal/menu.c normal/menu_entry.c normal/menu_viewer.c \
normal/color.c \
Modified: trunk/grub2/conf/i386-pc.rmk
===================================================================
--- trunk/grub2/conf/i386-pc.rmk 2009-08-24 19:40:40 UTC (rev 2528)
+++ trunk/grub2/conf/i386-pc.rmk 2009-08-24 23:55:06 UTC (rev 2529)
@@ -123,6 +123,7 @@
lib/hexdump.c commands/i386/pc/halt.c commands/reboot.c \
commands/gptsync.c commands/probe.c commands/xnu_uuid.c \
commands/i386/cpuid.c \
+ commands/password.c \
disk/host.c disk/loopback.c disk/scsi.c \
fs/fshelp.c \
\
@@ -134,7 +135,7 @@
kern/partition.c kern/reader.c kern/term.c \
kern/rescue_reader.c kern/rescue_parser.c \
lib/arg.c normal/cmdline.c normal/datetime.c normal/misc.c \
- normal/handler.c normal/autofs.c \
+ normal/handler.c normal/auth.c normal/autofs.c \
normal/completion.c normal/main.c normal/color.c \
normal/menu.c normal/menu_entry.c normal/menu_viewer.c \
normal/menu_text.c \
Modified: trunk/grub2/conf/powerpc-ieee1275.rmk
===================================================================
--- trunk/grub2/conf/powerpc-ieee1275.rmk 2009-08-24 19:40:40 UTC (rev 2528)
+++ trunk/grub2/conf/powerpc-ieee1275.rmk 2009-08-24 23:55:06 UTC (rev 2529)
@@ -46,6 +46,7 @@
commands/ls.c commands/blocklist.c commands/hexdump.c \
lib/hexdump.c commands/halt.c commands/reboot.c \
commands/gptsync.c commands/probe.c commands/xnu_uuid.c \
+ commands/password.c \
disk/loopback.c \
\
fs/affs.c fs/cpio.c fs/fat.c fs/ext2.c fs/hfs.c \
@@ -62,7 +63,7 @@
kern/command.c kern/corecmd.c commands/extcmd.c \
lib/arg.c normal/cmdline.c normal/datetime.c \
normal/completion.c normal/misc.c \
- normal/handler.c normal/autofs.c normal/main.c \
+ normal/handler.c normal/auth.c normal/autofs.c normal/main.c \
normal/menu.c \
normal/menu_text.c \
normal/menu_entry.c normal/menu_viewer.c \
Modified: trunk/grub2/conf/sparc64-ieee1275.rmk
===================================================================
--- trunk/grub2/conf/sparc64-ieee1275.rmk 2009-08-24 19:40:40 UTC (rev 2528)
+++ trunk/grub2/conf/sparc64-ieee1275.rmk 2009-08-24 23:55:06 UTC (rev 2529)
@@ -103,6 +103,7 @@
commands/ls.c commands/blocklist.c commands/hexdump.c \
lib/hexdump.c commands/halt.c commands/reboot.c \
commands/gptsync.c commands/probe.c commands/xnu_uuid.c \
+ commands/password.c \
disk/loopback.c \
\
fs/affs.c fs/cpio.c fs/fat.c fs/ext2.c fs/hfs.c \
@@ -119,7 +120,7 @@
kern/command.c kern/corecmd.c commands/extcmd.c \
lib/arg.c normal/cmdline.c normal/datetime.c \
normal/completion.c normal/misc.c \
- normal/handler.c normal/autofs.c normal/main.c \
+ normal/handler.c normal/auth.c normal/autofs.c normal/main.c \
normal/menu.c \
normal/menu_text.c \
normal/menu_entry.c normal/menu_viewer.c \
Modified: trunk/grub2/conf/x86_64-efi.rmk
===================================================================
--- trunk/grub2/conf/x86_64-efi.rmk 2009-08-24 19:40:40 UTC (rev 2528)
+++ trunk/grub2/conf/x86_64-efi.rmk 2009-08-24 23:55:06 UTC (rev 2529)
@@ -37,6 +37,7 @@
commands/search.c commands/hexdump.c lib/hexdump.c \
commands/halt.c commands/reboot.c \
commands/i386/cpuid.c \
+ commands/password.c \
disk/loopback.c \
\
fs/affs.c fs/cpio.c fs/fat.c fs/ext2.c fs/hfs.c \
@@ -50,7 +51,8 @@
kern/command.c kern/corecmd.c commands/extcmd.c kern/file.c \
kern/fs.c commands/boot.c kern/main.c kern/misc.c kern/parser.c \
kern/partition.c kern/readerescue.c kern/term.c \
- lib/arg.c normal/cmdline.c normal/misc.c normal/autofs.c \
+ lib/arg.c normal/cmdline.c normal/misc.c normal/auth.c \
+ normal/autofs.c \
normal/completion.c normal/datetime.c normal/context.c \
normal/main.c \
normal/menu.c normal/menu_entry.c normal/menu_viewer.c \
Added: trunk/grub2/include/grub/auth.h
===================================================================
--- trunk/grub2/include/grub/auth.h (rev 0)
+++ trunk/grub2/include/grub/auth.h 2009-08-24 23:55:06 UTC (rev 2529)
@@ -0,0 +1,45 @@
+/*
+ * GRUB -- GRand Unified Bootloader
+ * Copyright (C) 2009 Free Software Foundation, Inc.
+ *
+ * GRUB is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GRUB is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with GRUB. If not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef GRUB_AURH_HEADER
+#define GRUB_AUTH_HEADER 1
+
+#include <grub/err.h>
+
+/* Macros for indistinguishibility. */
+#define GRUB_ACCESS_DENIED grub_error (GRUB_ERR_ACCESS_DENIED, "Access denied.")
+#define GRUB_GET_PASSWORD(string, len) grub_cmdline_get ("Enter password: ", \
+ string, len, \
+ '*', 0, 0)
+
+/* Like strcmp but untimeable. Accepts NULL as second argument. */
+int grub_auth_strcmp (const char *user_input, const char *template);
+/* Like strcmp but untimeable and ignores commas in needle. */
+int grub_auth_strword (const char *haystack, const char *needle);
+
+typedef grub_err_t (*grub_auth_callback_t) (const char*, void *);
+
+grub_err_t grub_auth_register_authentication (const char *user,
+ grub_auth_callback_t callback,
+ void *arg);
+grub_err_t grub_auth_unregister_authentication (const char *user);
+
+grub_err_t grub_auth_authenticate (const char *user);
+grub_err_t grub_auth_deauthenticate (const char *user);
+grub_err_t grub_auth_check_authentication (const char *userlist);
+
+#endif /* ! GRUB_AUTH_HEADER */
Modified: trunk/grub2/include/grub/err.h
===================================================================
--- trunk/grub2/include/grub/err.h 2009-08-24 19:40:40 UTC (rev 2528)
+++ trunk/grub2/include/grub/err.h 2009-08-24 23:55:06 UTC (rev 2529)
@@ -53,7 +53,8 @@
GRUB_ERR_BAD_GZIP_DATA,
GRUB_ERR_MENU,
GRUB_ERR_TIMEOUT,
- GRUB_ERR_IO
+ GRUB_ERR_IO,
+ GRUB_ERR_ACCESS_DENIED
}
grub_err_t;
Modified: trunk/grub2/include/grub/menu.h
===================================================================
--- trunk/grub2/include/grub/menu.h 2009-08-24 19:40:40 UTC (rev 2528)
+++ trunk/grub2/include/grub/menu.h 2009-08-24 23:55:06 UTC (rev 2529)
@@ -32,6 +32,12 @@
/* The title name. */
const char *title;
+ /* If set means not everybody is allowed to boot this entry. */
+ int restricted;
+
+ /* Allowed users. */
+ const char *users;
+
/* The classes associated with the menu entry:
used to choose an icon or other style attributes.
This is a dummy head node for the linked list, so for an entry E,
Modified: trunk/grub2/include/grub/normal.h
===================================================================
--- trunk/grub2/include/grub/normal.h 2009-08-24 19:40:40 UTC (rev 2528)
+++ trunk/grub2/include/grub/normal.h 2009-08-24 23:55:06 UTC (rev 2529)
@@ -56,7 +56,7 @@
/* Defined in `cmdline.c'. */
int grub_cmdline_get (const char *prompt, char cmdline[], unsigned max_len,
- int echo_char, int readline);
+ int echo_char, int readline, int history);
grub_err_t grub_set_history (int newsize);
/* Defined in `completion.c'. */
Added: trunk/grub2/normal/auth.c
===================================================================
--- trunk/grub2/normal/auth.c (rev 0)
+++ trunk/grub2/normal/auth.c 2009-08-24 23:55:06 UTC (rev 2529)
@@ -0,0 +1,250 @@
+/*
+ * GRUB -- GRand Unified Bootloader
+ * Copyright (C) 2009 Free Software Foundation, Inc.
+ *
+ * GRUB is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GRUB is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with GRUB. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <grub/auth.h>
+#include <grub/list.h>
+#include <grub/mm.h>
+#include <grub/misc.h>
+#include <grub/env.h>
+#include <grub/normal.h>
+
+struct grub_auth_user
+{
+ struct grub_auth_user *next;
+ char *name;
+ grub_auth_callback_t callback;
+ void *arg;
+ int authenticated;
+};
+
+struct grub_auth_user *users = NULL;
+
+int
+grub_auth_strcmp (const char *user_input, const char *template)
+{
+ int ok = 1;
+ const char *ptr1, *ptr2;
+ for (ptr1 = user_input, ptr2 = template; *ptr1; ptr1++)
+ if (*ptr1 == (ptr2 ? *ptr2 : ptr1[1]) && ok && ptr2 != NULL)
+ ptr2++;
+ else
+ ok = 0;
+
+ return !ok;
+}
+
+int
+grub_auth_strword (const char *haystack, const char *needle)
+{
+ const char *n_pos = needle;
+ int found = 0;
+
+ while (grub_iswordseparator (*haystack))
+ haystack++;
+
+ while (*haystack)
+ {
+ int ok = 1;
+ /* Crawl both the needle and the haystack word we're on. */
+ while(*haystack && !grub_iswordseparator (*haystack))
+ {
+ if (*haystack == *n_pos && ok)
+ n_pos++;
+ else
+ ok = 0;
+
+ haystack++;
+ }
+
+ if (ok)
+ found = 1;
+ }
+
+ return found;
+}
+
+grub_err_t
+grub_auth_register_authentication (const char *user,
+ grub_auth_callback_t callback,
+ void *arg)
+{
+ struct grub_auth_user *cur;
+
+ cur = grub_named_list_find (GRUB_AS_NAMED_LIST (users), user);
+ if (!cur)
+ cur = grub_zalloc (sizeof (*cur));
+ if (!cur)
+ return grub_errno;
+ cur->callback = callback;
+ cur->arg = arg;
+ if (! cur->name)
+ {
+ cur->name = grub_strdup (user);
+ if (!cur->name)
+ {
+ grub_free (cur);
+ return grub_errno;
+ }
+ grub_list_push (GRUB_AS_LIST_P (&users), GRUB_AS_LIST (cur));
+ }
+ return GRUB_ERR_NONE;
+}
+
+grub_err_t
+grub_auth_unregister_authentication (const char *user)
+{
+ struct grub_auth_user *cur;
+ cur = grub_named_list_find (GRUB_AS_NAMED_LIST (users), user);
+ if (!cur)
+ return grub_error (GRUB_ERR_BAD_ARGUMENT, "user '%s' not found", user);
+ if (!cur->authenticated)
+ {
+ grub_free (cur->name);
+ grub_list_remove (GRUB_AS_LIST_P (&users), GRUB_AS_LIST (cur));
+ grub_free (cur);
+ }
+ else
+ {
+ cur->callback = NULL;
+ cur->arg = NULL;
+ }
+ return GRUB_ERR_NONE;
+}
+
+grub_err_t
+grub_auth_authenticate (const char *user)
+{
+ struct grub_auth_user *cur;
+
+ cur = grub_named_list_find (GRUB_AS_NAMED_LIST (users), user);
+ if (!cur)
+ cur = grub_zalloc (sizeof (*cur));
+ if (!cur)
+ return grub_errno;
+
+ cur->authenticated = 1;
+
+ if (! cur->name)
+ {
+ cur->name = grub_strdup (user);
+ if (!cur->name)
+ {
+ grub_free (cur);
+ return grub_errno;
+ }
+ grub_list_push (GRUB_AS_LIST_P (&users), GRUB_AS_LIST (cur));
+ }
+
+ return GRUB_ERR_NONE;
+}
+
+grub_err_t
+grub_auth_deauthenticate (const char *user)
+{
+ struct grub_auth_user *cur;
+ cur = grub_named_list_find (GRUB_AS_NAMED_LIST (users), user);
+ if (!cur)
+ return grub_error (GRUB_ERR_BAD_ARGUMENT, "user '%s' not found", user);
+ if (!cur->callback)
+ {
+ grub_free (cur->name);
+ grub_list_remove (GRUB_AS_LIST_P (&users), GRUB_AS_LIST (cur));
+ grub_free (cur);
+ }
+ else
+ cur->authenticated = 0;
+ return GRUB_ERR_NONE;
+}
+
+static int
+is_authenticated (const char *userlist)
+{
+ const char *superusers;
+
+ auto int hook (grub_list_t item);
+ int hook (grub_list_t item)
+ {
+ const char *name;
+ if (!((struct grub_auth_user *) item)->authenticated)
+ return 0;
+ name = ((struct grub_auth_user *) item)->name;
+
+ return (userlist && grub_auth_strword (userlist, name))
+ || grub_auth_strword (superusers, name);
+ }
+
+ superusers = grub_env_get ("superusers");
+
+ if (!superusers)
+ return 1;
+
+ return grub_list_iterate (GRUB_AS_LIST (users), hook);
+}
+
+grub_err_t
+grub_auth_check_authentication (const char *userlist)
+{
+ char login[1024];
+ struct grub_auth_user *cur = NULL;
+ grub_err_t err;
+
+ auto int hook (grub_list_t item);
+ int hook (grub_list_t item)
+ {
+ if (grub_auth_strcmp (login, ((struct grub_auth_user *) item)->name) == 0)
+ cur = (struct grub_auth_user *) item;
+ return 0;
+ }
+
+ auto int hook_any (grub_list_t item);
+ int hook_any (grub_list_t item)
+ {
+ if (((struct grub_auth_user *) item)->callback)
+ cur = (struct grub_auth_user *) item;
+ return 0;
+ }
+
+ grub_memset (login, 0, sizeof (login));
+
+ if (is_authenticated (userlist))
+ return GRUB_ERR_NONE;
+
+ if (!grub_cmdline_get ("Enter username: ", login, sizeof (login) - 1,
+ 0, 0, 0))
+ return GRUB_ACCESS_DENIED;
+
+ grub_list_iterate (GRUB_AS_LIST (users), hook);
+
+ if (!cur || ! cur->callback)
+ {
+ grub_list_iterate (GRUB_AS_LIST (users), hook_any);
+
+ /* No users present at all. */
+ if (!cur)
+ return GRUB_ACCESS_DENIED;
+
+ /* Display any of available authentication schemes. */
+ err = cur->callback (login, 0);
+
+ return GRUB_ACCESS_DENIED;
+ }
+ err = cur->callback (login, cur->arg);
+ if (is_authenticated (userlist))
+ return GRUB_ERR_NONE;
+ return GRUB_ACCESS_DENIED;
+}
Modified: trunk/grub2/normal/cmdline.c
===================================================================
--- trunk/grub2/normal/cmdline.c 2009-08-24 19:40:40 UTC (rev 2528)
+++ trunk/grub2/normal/cmdline.c 2009-08-24 23:55:06 UTC (rev 2529)
@@ -181,7 +181,7 @@
/* FIXME: The dumb interface is not supported yet. */
int
grub_cmdline_get (const char *prompt, char cmdline[], unsigned max_len,
- int echo_char, int readline)
+ int echo_char, int readline, int history)
{
unsigned xpos, ypos, ystart;
grub_size_t lpos, llen;
@@ -280,7 +280,7 @@
cl_insert (cmdline);
- if (hist_used == 0)
+ if (history && hist_used == 0)
grub_history_add (buf);
while ((key = GRUB_TERM_ASCII_CHAR (grub_getkey ())) != '\n' && key != '\r')
@@ -468,11 +468,14 @@
while (buf[lpos] == ' ')
lpos++;
- histpos = 0;
- if (grub_strlen (buf) > 0)
+ if (history)
{
- grub_history_replace (histpos, buf);
- grub_history_add ("");
+ histpos = 0;
+ if (grub_strlen (buf) > 0)
+ {
+ grub_history_replace (histpos, buf);
+ grub_history_add ("");
+ }
}
grub_memcpy (cmdline, buf + lpos, llen - lpos + 1);
Modified: trunk/grub2/normal/main.c
===================================================================
--- trunk/grub2/normal/main.c 2009-08-24 19:40:40 UTC (rev 2528)
+++ trunk/grub2/normal/main.c 2009-08-24 23:55:06 UTC (rev 2529)
@@ -28,6 +28,7 @@
#include <grub/parser.h>
#include <grub/reader.h>
#include <grub/menu_viewer.h>
+#include <grub/auth.h>
#define GRUB_DEFAULT_HISTORY_SIZE 50
@@ -164,6 +165,7 @@
int i;
struct grub_menu_entry_class *classes_head; /* Dummy head node for list. */
struct grub_menu_entry_class *classes_tail;
+ char *users = NULL;
/* Allocate dummy head node for class list. */
classes_head = grub_zalloc (sizeof (struct grub_menu_entry_class));
@@ -218,6 +220,18 @@
classes_tail = new_class;
continue;
}
+ else if (grub_strcmp(arg, "users") == 0)
+ {
+ i++;
+ users = grub_strdup (args[i]);
+ if (! users)
+ {
+ failed = 1;
+ break;
+ }
+
+ continue;
+ }
else
{
/* Handle invalid argument. */
@@ -275,6 +289,9 @@
(*last)->title = menutitle;
(*last)->classes = classes_head;
+ if (users)
+ (*last)->restricted = 1;
+ (*last)->users = users;
(*last)->sourcecode = menusourcecode;
menu->size++;
@@ -465,8 +482,20 @@
void
grub_cmdline_run (int nested)
{
- grub_reader_t reader = grub_reader_get_current ();
+ grub_reader_t reader;
+ grub_err_t err = GRUB_ERR_NONE;
+ err = grub_auth_check_authentication (NULL);
+
+ if (err)
+ {
+ grub_print_error ();
+ grub_errno = GRUB_ERR_NONE;
+ return;
+ }
+
+ reader = grub_reader_get_current ();
+
reader_nested = nested;
if (reader->init)
reader->init ();
@@ -501,7 +530,7 @@
while (1)
{
cmdline[0] = 0;
- if (grub_cmdline_get (prompt, cmdline, sizeof (cmdline), 0, 1))
+ if (grub_cmdline_get (prompt, cmdline, sizeof (cmdline), 0, 1, 1))
break;
if ((reader_nested) || (cont))
Modified: trunk/grub2/normal/menu.c
===================================================================
--- trunk/grub2/normal/menu.c 2009-08-24 19:40:40 UTC (rev 2528)
+++ trunk/grub2/normal/menu.c 2009-08-24 23:55:06 UTC (rev 2529)
@@ -26,6 +26,7 @@
#include <grub/menu_viewer.h>
#include <grub/command.h>
#include <grub/parser.h>
+#include <grub/auth.h>
/* Get a menu entry by its index in the entry list. */
grub_menu_entry_t
@@ -124,6 +125,18 @@
void
grub_menu_execute_entry(grub_menu_entry_t entry)
{
+ grub_err_t err = GRUB_ERR_NONE;
+
+ if (entry->restricted)
+ err = grub_auth_check_authentication (entry->users);
+
+ if (err)
+ {
+ grub_print_error ();
+ grub_errno = GRUB_ERR_NONE;
+ return;
+ }
+
grub_parser_execute ((char *) entry->sourcecode);
if (grub_errno == GRUB_ERR_NONE && grub_loader_is_loaded ())
Modified: trunk/grub2/normal/menu_entry.c
===================================================================
--- trunk/grub2/normal/menu_entry.c 2009-08-24 19:40:40 UTC (rev 2528)
+++ trunk/grub2/normal/menu_entry.c 2009-08-24 23:55:06 UTC (rev 2529)
@@ -23,6 +23,7 @@
#include <grub/loader.h>
#include <grub/command.h>
#include <grub/parser.h>
+#include <grub/auth.h>
enum update_mode
{
@@ -1026,7 +1027,17 @@
{
struct screen *screen;
int prev_c;
+ grub_err_t err = GRUB_ERR_NONE;
+ err = grub_auth_check_authentication (NULL);
+
+ if (err)
+ {
+ grub_print_error ();
+ grub_errno = GRUB_ERR_NONE;
+ return;
+ }
+
screen = make_screen (entry);
if (! screen)
return;
Modified: trunk/grub2/normal/menu_viewer.c
===================================================================
--- trunk/grub2/normal/menu_viewer.c 2009-08-24 19:40:40 UTC (rev 2528)
+++ trunk/grub2/normal/menu_viewer.c 2009-08-24 23:55:06 UTC (rev 2529)
@@ -21,6 +21,7 @@
#include <grub/env.h>
#include <grub/menu_viewer.h>
#include <grub/menu.h>
+#include <grub/auth.h>
/* The list of menu viewers. */
static grub_menu_viewer_t menu_viewer_list;
@@ -55,9 +56,26 @@
grub_menu_viewer_show_menu (grub_menu_t menu, int nested)
{
grub_menu_viewer_t cur = get_current_menu_viewer ();
+ grub_err_t err1, err2;
if (!cur)
return grub_error (GRUB_ERR_BAD_ARGUMENT, "No menu viewer available.");
- return cur->show_menu (menu, nested);
+ while (1)
+ {
+ err1 = cur->show_menu (menu, nested);
+ grub_print_error ();
+
+ err2 = grub_auth_check_authentication (NULL);
+ if (err2)
+ {
+ grub_print_error ();
+ grub_errno = GRUB_ERR_NONE;
+ continue;
+ }
+
+ break;
+ }
+
+ return err1;
}