1 /* $NetBSD: su.c,v 1.65 2005/07/05 20:15:13 kleink Exp $ */ 2 3 /* 4 * Copyright (c) 1988 The Regents of the University of California. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. Neither the name of the University nor the names of its contributors 16 * may be used to endorse or promote products derived from this software 17 * without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32 #include <sys/cdefs.h> 33 #ifndef lint 34 __COPYRIGHT( 35 "@(#) Copyright (c) 1988 The Regents of the University of California.\n\ 36 All rights reserved.\n"); 37 #endif /* not lint */ 38 39 #ifndef lint 40 #if 0 41 static char sccsid[] = "@(#)su.c 8.3 (Berkeley) 4/2/94";*/ 42 #else 43 __RCSID("$NetBSD: su.c,v 1.65 2005/07/05 20:15:13 kleink Exp $"); 44 #endif 45 #endif /* not lint */ 46 47 #include <sys/param.h> 48 #include <sys/time.h> 49 #include <sys/resource.h> 50 #include <err.h> 51 #include <errno.h> 52 #include <grp.h> 53 #include <paths.h> 54 #include <pwd.h> 55 #include <stdio.h> 56 #ifdef SKEY 57 #include <skey.h> 58 #endif 59 #include <stdlib.h> 60 #include <string.h> 61 #include <syslog.h> 62 #include <time.h> 63 #include <tzfile.h> 64 #include <unistd.h> 65 66 #ifdef LOGIN_CAP 67 #include <login_cap.h> 68 #endif 69 70 #ifdef KERBEROS 71 #include <des.h> 72 #include <krb.h> 73 #include <netdb.h> 74 75 static int kerberos(char *, char *, int); 76 static int koktologin(char *, char *, char *); 77 78 #endif 79 80 #ifdef KERBEROS5 81 #include <krb5.h> 82 83 static int kerberos5(char *, char *, int); 84 85 #endif 86 87 #if defined(KERBEROS) || defined(KERBEROS5) 88 89 #define ARGSTRX "-Kdflm" 90 91 int use_kerberos = 1; 92 93 #else 94 #define ARGSTRX "-dflm" 95 #endif 96 97 #ifndef SU_GROUP 98 #define SU_GROUP "wheel" 99 #endif 100 101 #ifdef LOGIN_CAP 102 #define ARGSTR ARGSTRX "c:" 103 #else 104 #define ARGSTR ARGSTRX 105 #endif 106 107 static int chshell(const char *); 108 static char *ontty(void); 109 static int check_ingroup(int, const char *, const char *, int); 110 111 int main(int, char **); 112 113 int 114 main(int argc, char **argv) 115 { 116 extern char **environ; 117 struct passwd *pwd; 118 char *p; 119 #ifdef BSD4_4 120 struct timeval tp; 121 #endif 122 uid_t ruid; 123 int asme, ch, asthem, fastlogin, prio, gohome; 124 enum { UNSET, YES, NO } iscsh = UNSET; 125 char *user, *shell, *avshell, *username, **np; 126 char *userpass, *class; 127 char shellbuf[MAXPATHLEN], avshellbuf[MAXPATHLEN]; 128 time_t pw_warntime = _PASSWORD_WARNDAYS * SECSPERDAY; 129 #ifdef LOGIN_CAP 130 login_cap_t *lc; 131 #endif 132 133 asme = asthem = fastlogin = 0; 134 gohome = 1; 135 shell = class = NULL; 136 while ((ch = getopt(argc, argv, ARGSTR)) != -1) 137 switch((char)ch) { 138 #if defined(KERBEROS) || defined(KERBEROS5) 139 case 'K': 140 use_kerberos = 0; 141 break; 142 #endif 143 #ifdef LOGIN_CAP 144 case 'c': 145 class = optarg; 146 break; 147 #endif 148 case 'd': 149 asme = 0; 150 asthem = 1; 151 gohome = 0; 152 break; 153 case 'f': 154 fastlogin = 1; 155 break; 156 case '-': 157 case 'l': 158 asme = 0; 159 asthem = 1; 160 break; 161 case 'm': 162 asme = 1; 163 asthem = 0; 164 break; 165 case '?': 166 default: 167 (void)fprintf(stderr, 168 "usage: %s [%s] [login [shell arguments]]\n", 169 getprogname(), ARGSTR); 170 exit(1); 171 } 172 argv += optind; 173 174 /* Lower the priority so su runs faster */ 175 errno = 0; 176 prio = getpriority(PRIO_PROCESS, 0); 177 if (errno) 178 prio = 0; 179 if (prio > -2) 180 (void)setpriority(PRIO_PROCESS, 0, -2); 181 openlog("su", 0, LOG_AUTH); 182 183 /* get current login name and shell */ 184 ruid = getuid(); 185 username = getlogin(); 186 if (username == NULL || (pwd = getpwnam(username)) == NULL || 187 pwd->pw_uid != ruid) 188 pwd = getpwuid(ruid); 189 if (pwd == NULL) 190 errx(1, "who are you?"); 191 username = strdup(pwd->pw_name); 192 userpass = strdup(pwd->pw_passwd); 193 if (username == NULL || userpass == NULL) 194 err(1, "strdup"); 195 196 197 if (asme) { 198 if (pwd->pw_shell && *pwd->pw_shell) { 199 strlcpy(shellbuf, pwd->pw_shell, sizeof(shellbuf)); 200 shell = shellbuf; 201 } else { 202 shell = _PATH_BSHELL; 203 iscsh = NO; 204 } 205 } 206 /* get target login information, default to root */ 207 user = *argv ? *argv : "root"; 208 np = *argv ? argv : argv-1; 209 210 if ((pwd = getpwnam(user)) == NULL) 211 errx(1, "unknown login %s", user); 212 213 #ifdef LOGIN_CAP 214 /* force the usage of specified class */ 215 if (class) { 216 if (ruid) 217 errx(1, "Only root may use -c"); 218 219 pwd->pw_class = class; 220 } 221 if ((lc = login_getclass(pwd->pw_class)) == NULL) 222 errx(1, "Unknown class %s\n", pwd->pw_class); 223 224 pw_warntime = login_getcaptime(lc, "password-warn", 225 _PASSWORD_WARNDAYS * SECSPERDAY, 226 _PASSWORD_WARNDAYS * SECSPERDAY); 227 #endif 228 229 if (ruid 230 #ifdef KERBEROS5 231 && (!use_kerberos || kerberos5(username, user, pwd->pw_uid)) 232 #endif 233 #ifdef KERBEROS 234 && (!use_kerberos || kerberos(username, user, pwd->pw_uid)) 235 #endif 236 ) { 237 char *pass = pwd->pw_passwd; 238 int ok = pwd->pw_uid != 0; 239 240 #ifdef SU_ROOTAUTH 241 /* 242 * Allow those in group rootauth to su to root, by supplying 243 * their own password. 244 */ 245 if (!ok) { 246 if ((ok = check_ingroup(-1, SU_ROOTAUTH, username, 0))) { 247 pass = userpass; 248 user = username; 249 } 250 } 251 #endif 252 /* 253 * Only allow those in group SU_GROUP to su to root, 254 * but only if that group has any members. 255 * If SU_GROUP has no members, allow anyone to su root 256 */ 257 if (!ok) { 258 ok = check_ingroup(-1, SU_GROUP, username, 1); 259 } 260 if (!ok) 261 errx(1, 262 "you are not listed in the correct secondary group (%s) to su %s.", 263 SU_GROUP, user); 264 /* if target requires a password, verify it */ 265 if (*pass) { 266 p = getpass("Password:"); 267 #ifdef SKEY 268 if (strcasecmp(p, "s/key") == 0) { 269 if (skey_haskey(user)) 270 errx(1, "Sorry, you have no s/key."); 271 else { 272 if (skey_authenticate(user)) { 273 goto badlogin; 274 } 275 } 276 277 } else 278 #endif 279 if (strcmp(pass, crypt(p, pass))) { 280 #ifdef SKEY 281 badlogin: 282 #endif 283 fprintf(stderr, "Sorry\n"); 284 syslog(LOG_WARNING, 285 "BAD SU %s to %s%s", username, 286 pwd->pw_name, ontty()); 287 exit(1); 288 } 289 } 290 } 291 292 if (asme) { 293 /* if asme and non-standard target shell, must be root */ 294 if (!chshell(pwd->pw_shell) && ruid) 295 errx(1,"permission denied (shell)."); 296 } else if (pwd->pw_shell && *pwd->pw_shell) { 297 shell = pwd->pw_shell; 298 iscsh = UNSET; 299 } else { 300 shell = _PATH_BSHELL; 301 iscsh = NO; 302 } 303 304 if ((p = strrchr(shell, '/')) != NULL) 305 avshell = p+1; 306 else 307 avshell = shell; 308 309 /* if we're forking a csh, we want to slightly muck the args */ 310 if (iscsh == UNSET) 311 iscsh = strstr(avshell, "csh") ? YES : NO; 312 313 /* set permissions */ 314 #ifdef LOGIN_CAP 315 if (setusercontext(lc, pwd, pwd->pw_uid, 316 (asthem ? (LOGIN_SETPRIORITY | LOGIN_SETUMASK) : 0) | 317 LOGIN_SETRESOURCES | LOGIN_SETGROUP | LOGIN_SETUSER)) 318 err(1, "setting user context"); 319 #else 320 if (setgid(pwd->pw_gid) < 0) 321 err(1, "setgid"); 322 if (initgroups(user, pwd->pw_gid)) 323 errx(1, "initgroups failed"); 324 if (setuid(pwd->pw_uid) < 0) 325 err(1, "setuid"); 326 #endif 327 328 if (!asme) { 329 if (asthem) { 330 p = getenv("TERM"); 331 /* Create an empty environment */ 332 if ((environ = malloc(sizeof(char *))) == NULL) 333 err(1, NULL); 334 environ[0] = NULL; 335 #ifdef LOGIN_CAP 336 if (setusercontext(lc, pwd, pwd->pw_uid, LOGIN_SETPATH)) 337 err(1, "setting user context"); 338 #else 339 (void)setenv("PATH", _PATH_DEFPATH, 1); 340 #endif 341 if (p) 342 (void)setenv("TERM", p, 1); 343 if (gohome && chdir(pwd->pw_dir) < 0) 344 errx(1, "no directory"); 345 } 346 347 if (asthem || pwd->pw_uid) { 348 (void)setenv("LOGNAME", pwd->pw_name, 1); 349 (void)setenv("USER", pwd->pw_name, 1); 350 } 351 (void)setenv("HOME", pwd->pw_dir, 1); 352 (void)setenv("SHELL", shell, 1); 353 } 354 (void)setenv("SU_FROM", username, 1); 355 356 if (iscsh == YES) { 357 if (fastlogin) 358 *np-- = "-f"; 359 if (asme) 360 *np-- = "-m"; 361 } else { 362 if (fastlogin) 363 unsetenv("ENV"); 364 } 365 366 if (asthem) { 367 avshellbuf[0] = '-'; 368 (void)strlcpy(avshellbuf+1, avshell, sizeof(avshellbuf) - 1); 369 avshell = avshellbuf; 370 } else if (iscsh == YES) { 371 /* csh strips the first character... */ 372 avshellbuf[0] = '_'; 373 (void)strlcpy(avshellbuf+1, avshell, sizeof(avshellbuf) - 1); 374 avshell = avshellbuf; 375 } 376 *np = avshell; 377 378 #ifdef BSD4_4 379 if (pwd->pw_change || pwd->pw_expire) 380 (void)gettimeofday(&tp, (struct timezone *)NULL); 381 if (pwd->pw_change) { 382 if (tp.tv_sec >= pwd->pw_change) { 383 (void)printf("%s -- %s's password has expired.\n", 384 (ruid ? "Sorry" : "Note"), user); 385 if (ruid != 0) 386 exit(1); 387 } else if (pwd->pw_change - tp.tv_sec < pw_warntime) 388 (void)printf("Warning: %s's password expires on %s", 389 user, ctime(&pwd->pw_change)); 390 } 391 if (pwd->pw_expire) { 392 if (tp.tv_sec >= pwd->pw_expire) { 393 (void)printf("%s -- %s's account has expired.\n", 394 (ruid ? "Sorry" : "Note"), user); 395 if (ruid != 0) 396 exit(1); 397 } else if (pwd->pw_expire - tp.tv_sec < 398 _PASSWORD_WARNDAYS * SECSPERDAY) 399 (void)printf("Warning: %s's account expires on %s", 400 user, ctime(&pwd->pw_expire)); 401 } 402 #endif 403 if (ruid != 0) 404 syslog(LOG_NOTICE, "%s to %s%s", 405 username, pwd->pw_name, ontty()); 406 407 /* Raise our priority back to what we had before */ 408 (void)setpriority(PRIO_PROCESS, 0, prio); 409 410 execv(shell, np); 411 err(1, "%s", shell); 412 /* NOTREACHED */ 413 } 414 415 416 static int 417 chshell(const char *sh) 418 { 419 const char *cp; 420 421 setusershell(); 422 while ((cp = getusershell()) != NULL) 423 if (!strcmp(cp, sh)) 424 return 1; 425 return 0; 426 } 427 428 static char * 429 ontty(void) 430 { 431 char *p; 432 static char buf[MAXPATHLEN + 4]; 433 434 buf[0] = 0; 435 if ((p = ttyname(STDERR_FILENO)) != NULL) 436 (void)snprintf(buf, sizeof buf, " on %s", p); 437 return buf; 438 } 439 440 #ifdef KERBEROS5 441 static int 442 kerberos5(char *username, char *user, int uid) 443 { 444 krb5_error_code ret; 445 krb5_context context; 446 krb5_principal princ = NULL; 447 krb5_ccache ccache, ccache2; 448 char *cc_name; 449 const char *filename; 450 451 ret = krb5_init_context(&context); 452 if (ret) 453 return (1); 454 455 if (strcmp (user, "root") == 0) 456 ret = krb5_make_principal(context, &princ, 457 NULL, username, "root", NULL); 458 else 459 ret = krb5_make_principal(context, &princ, 460 NULL, user, NULL); 461 if (ret) 462 goto fail; 463 if (!krb5_kuserok(context, princ, user) && !uid) { 464 warnx ("kerberos5: not in %s's ACL.", user); 465 goto fail; 466 } 467 ret = krb5_cc_gen_new(context, &krb5_mcc_ops, &ccache); 468 if (ret) 469 goto fail; 470 ret = krb5_verify_user_lrealm(context, princ, ccache, NULL, TRUE, 471 NULL); 472 if (ret) { 473 krb5_cc_destroy(context, ccache); 474 switch (ret) { 475 case KRB5_LIBOS_PWDINTR : 476 break; 477 case KRB5KRB_AP_ERR_BAD_INTEGRITY: 478 case KRB5KRB_AP_ERR_MODIFIED: 479 krb5_warnx(context, "Password incorrect"); 480 break; 481 default : 482 krb5_warn(context, ret, "krb5_verify_user"); 483 break; 484 } 485 goto fail; 486 } 487 ret = krb5_cc_gen_new(context, &krb5_fcc_ops, &ccache2); 488 if (ret) { 489 krb5_cc_destroy(context, ccache); 490 goto fail; 491 } 492 ret = krb5_cc_copy_cache(context, ccache, ccache2); 493 if (ret) { 494 krb5_cc_destroy(context, ccache); 495 krb5_cc_destroy(context, ccache2); 496 goto fail; 497 } 498 499 filename = krb5_cc_get_name(context, ccache2); 500 asprintf(&cc_name, "%s:%s", krb5_cc_get_type(context, ccache2), 501 filename); 502 if (chown (filename, uid, -1) < 0) { 503 warn("chown %s", filename); 504 free(cc_name); 505 krb5_cc_destroy(context, ccache); 506 krb5_cc_destroy(context, ccache2); 507 goto fail; 508 } 509 510 setenv("KRB5CCNAME", cc_name, 1); 511 free(cc_name); 512 krb5_cc_close(context, ccache2); 513 krb5_cc_destroy(context, ccache); 514 return (0); 515 516 fail: 517 if (princ != NULL) 518 krb5_free_principal (context, princ); 519 krb5_free_context (context); 520 return (1); 521 } 522 #endif 523 524 #ifdef KERBEROS 525 static int 526 kerberos(char *username, char *user, int uid) 527 { 528 KTEXT_ST ticket; 529 AUTH_DAT authdata; 530 struct hostent *hp; 531 int kerno; 532 u_long faddr; 533 char lrealm[REALM_SZ], krbtkfile[MAXPATHLEN]; 534 char hostname[MAXHOSTNAMELEN + 1], savehost[MAXHOSTNAMELEN + 1]; 535 536 if (krb_get_lrealm(lrealm, 1) != KSUCCESS) 537 return (1); 538 if (koktologin(username, lrealm, user) && !uid) { 539 warnx("kerberos: not in %s's ACL.", user); 540 return (1); 541 } 542 (void)snprintf(krbtkfile, sizeof krbtkfile, "%s_%s_%d", TKT_ROOT, 543 user, getuid()); 544 545 (void)setenv("KRBTKFILE", krbtkfile, 1); 546 (void)krb_set_tkt_string(krbtkfile); 547 /* 548 * Set real as well as effective ID to 0 for the moment, 549 * to make the kerberos library do the right thing. 550 */ 551 if (setuid(0) < 0) { 552 warn("setuid"); 553 return (1); 554 } 555 556 /* 557 * Little trick here -- if we are su'ing to root, 558 * we need to get a ticket for "xxx.root", where xxx represents 559 * the name of the person su'ing. Otherwise (non-root case), 560 * we need to get a ticket for "yyy.", where yyy represents 561 * the name of the person being su'd to, and the instance is null 562 * 563 * We should have a way to set the ticket lifetime, 564 * with a system default for root. 565 */ 566 { 567 char prompt[128]; 568 char passw[256]; 569 570 (void)snprintf (prompt, sizeof(prompt), 571 "%s's Password: ", 572 krb_unparse_name_long ((uid == 0 ? username : user), 573 (uid == 0 ? "root" : ""), 574 lrealm)); 575 if (des_read_pw_string (passw, sizeof (passw), prompt, 0)) { 576 memset (passw, 0, sizeof (passw)); 577 return (1); 578 } 579 if (strlen(passw) == 0) 580 return (1); /* Empty passwords are not allowed */ 581 582 kerno = krb_get_pw_in_tkt((uid == 0 ? username : user), 583 (uid == 0 ? "root" : ""), lrealm, 584 KRB_TICKET_GRANTING_TICKET, 585 lrealm, 586 DEFAULT_TKT_LIFE, 587 passw); 588 memset (passw, 0, strlen (passw)); 589 } 590 591 if (kerno != KSUCCESS) { 592 if (kerno == KDC_PR_UNKNOWN) { 593 warnx("kerberos: principal unknown: %s.%s@%s", 594 (uid == 0 ? username : user), 595 (uid == 0 ? "root" : ""), lrealm); 596 return (1); 597 } 598 warnx("kerberos: unable to su: %s", krb_err_txt[kerno]); 599 syslog(LOG_WARNING, 600 "BAD Kerberos SU: %s to %s%s: %s", 601 username, user, ontty(), krb_err_txt[kerno]); 602 return (1); 603 } 604 605 if (chown(krbtkfile, uid, -1) < 0) { 606 warn("chown"); 607 (void)unlink(krbtkfile); 608 return (1); 609 } 610 611 (void)setpriority(PRIO_PROCESS, 0, -2); 612 613 if (gethostname(hostname, sizeof(hostname)) == -1) { 614 warn("gethostname"); 615 dest_tkt(); 616 return (1); 617 } 618 hostname[sizeof(hostname) - 1] = '\0'; 619 620 (void)strlcpy(savehost, krb_get_phost(hostname), sizeof(savehost)); 621 savehost[sizeof(savehost) - 1] = '\0'; 622 623 kerno = krb_mk_req(&ticket, "rcmd", savehost, lrealm, 33); 624 625 if (kerno == KDC_PR_UNKNOWN) { 626 warnx("Warning: TGT not verified."); 627 syslog(LOG_WARNING, 628 "%s to %s%s, TGT not verified (%s); %s.%s not registered?", 629 username, user, ontty(), krb_err_txt[kerno], 630 "rcmd", savehost); 631 } else if (kerno != KSUCCESS) { 632 warnx("Unable to use TGT: %s", krb_err_txt[kerno]); 633 syslog(LOG_WARNING, "failed su: %s to %s%s: %s", 634 username, user, ontty(), krb_err_txt[kerno]); 635 dest_tkt(); 636 return (1); 637 } else { 638 if (!(hp = gethostbyname(hostname))) { 639 warnx("can't get addr of %s", hostname); 640 dest_tkt(); 641 return (1); 642 } 643 memmove((char *)&faddr, (char *)hp->h_addr, sizeof(faddr)); 644 645 if ((kerno = krb_rd_req(&ticket, "rcmd", savehost, faddr, 646 &authdata, "")) != KSUCCESS) { 647 warnx("kerberos: unable to verify rcmd ticket: %s", 648 krb_err_txt[kerno]); 649 syslog(LOG_WARNING, 650 "failed su: %s to %s%s: %s", username, 651 user, ontty(), krb_err_txt[kerno]); 652 dest_tkt(); 653 return (1); 654 } 655 } 656 return (0); 657 } 658 659 static int 660 koktologin(char *name, char *realm, char *toname) 661 { 662 return krb_kuserok(name, 663 strcmp (toname, "root") == 0 ? "root" : "", 664 realm, 665 toname); 666 } 667 #endif 668 669 static int 670 check_ingroup (int gid, const char *gname, const char *user, int ifempty) 671 { 672 struct group *gr; 673 char **g; 674 #ifdef SU_INDIRECT_GROUP 675 char **gr_mem; 676 int n = 0; 677 int i = 0; 678 #endif 679 int ok = 0; 680 681 if (gname == NULL) 682 gr = getgrgid((gid_t) gid); 683 else 684 gr = getgrnam(gname); 685 686 /* 687 * XXX we are relying on the fact that we only set ifempty when 688 * calling to check for SU_GROUP and that is the only time a 689 * missing group is acceptable. 690 */ 691 if (gr == NULL) 692 return ifempty; 693 if (!*gr->gr_mem) /* empty */ 694 return ifempty; 695 696 /* 697 * Ok, first see if user is in gr_mem 698 */ 699 for (g = gr->gr_mem; *g; ++g) { 700 if (strcmp(*g, user) == 0) 701 return 1; /* ok */ 702 #ifdef SU_INDIRECT_GROUP 703 ++n; /* count them */ 704 #endif 705 } 706 #ifdef SU_INDIRECT_GROUP 707 /* 708 * No. 709 * Now we need to duplicate the gr_mem list, and recurse for 710 * each member to see if it is a group, and if so whether user is 711 * in it. 712 */ 713 gr_mem = malloc((n + 1) * sizeof (char *)); 714 for (g = gr->gr_mem, i = 0; *g; ++g) { 715 gr_mem[i] = strdup(*g); 716 if (!gr_mem[i]) 717 err(1, "strdup"); 718 i++; 719 } 720 gr_mem[i++] = NULL; 721 722 for (g = gr_mem; ok == 0 && *g; ++g) { 723 /* 724 * If we get this far we don't accept empty/missing groups. 725 */ 726 ok = check_ingroup(-1, *g, user, 0); 727 } 728 for (g = gr_mem; *g; ++g) { 729 free(*g); 730 } 731 free(gr_mem); 732 #endif 733 return ok; 734 } 735