Change criteria for expunging items from the user's PATH: instead of

[become] / src / become.c

/* -*-c-*-
 *
 * $Id: become.c,v 1.8 1997/09/08 13:56:24 mdw Exp $
 *
 * Main code for `become'
 *
 * (c) 1997 EBI
 */

/*----- Licensing notice --------------------------------------------------*
 *
 * This file is part of `become'
 *
 * `Become' is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * `Become' is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with `become'; if not, write to the Free Software Foundation,
 * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 */

/*----- Revision history --------------------------------------------------*
 *
 * $Log: become.c,v $
 * Revision 1.8  1997/09/08 13:56:24  mdw
 * Change criteria for expunging items from the user's PATH: instead of
 * removing things starting with `.', remove things not starting with `/'.
 *
 * Revision 1.7  1997/09/08  13:43:20  mdw
 * Change userid when creating tracefiles rather than fiddling with
 * `access': it works rather better.  Also, insert some stdio buffer
 * flushing to ensure tracedumps are completely written.
 *
 * Revision 1.6  1997/09/05  13:47:44  mdw
 * Make the `-L' (trace-level) option's argument optional, like the long
 * version is.
 *
 * Revision 1.5  1997/09/05  11:45:19  mdw
 * Add support for different login styles, and environment variable
 * manipulation in a safe and useful way.
 *
 * Revision 1.4  1997/08/20  16:15:13  mdw
 * Overhaul of environment handling.  Fix daft bug in path search code.
 *
 * Revision 1.3  1997/08/07 16:28:59  mdw
 * Do something useful when users attempt to become themselves.
 *
 * Revision 1.2  1997/08/04 10:24:20  mdw
 * Sources placed under CVS control.
 *
 * Revision 1.1  1997/07/21  13:47:54  mdw
 * Initial revision
 *
 */

/*----- Header files ------------------------------------------------------*/

/* --- ANSI headers --- */

#include <ctype.h>
#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>

/* --- Unix headers --- */

#include <sys/types.h>
#include <sys/stat.h>
#include <sys/socket.h>
#include <sys/utsname.h>

#include <netinet/in.h>

#include <arpa/inet.h>

#include <netdb.h>
#include <pwd.h>
#include <syslog.h>
#include <unistd.h>

extern char **environ;

/* --- Local headers --- */

#include "become.h"
#include "config.h"
#include "check.h"
#include "daemon.h"
#include "lexer.h"
#include "mdwopt.h"
#include "name.h"
#include "parser.h"
#include "rule.h"
#include "sym.h"
#include "utils.h"
#include "userdb.h"

/*----- Type definitions --------------------------------------------------*/

/* --- Symbol table entry for an environment variable --- */

typedef struct sym_env {
  sym_base _base;			/* Symbol table information */
  unsigned f;				/* Flags word (see below) */
  char *val;				/* Pointer to variable value */
} sym_env;

/* --- Environment variable flags --- */

enum {
  envFlag_preserve = 1
};

/* --- Login behaviour types --- */

enum {
  l_preserve,				/* Preserve the environment */
  l_user,				/* Update who I am */
  l_login				/* Do a full login */
};

/*----- Static variables --------------------------------------------------*/

static sym_table bc__env;

/*----- Main code ---------------------------------------------------------*/

/* --- @bc__write@ --- *
 *
 * Arguments:	@FILE *fp@ = pointer to a stream to write on
 *		@const char *p@ = pointer to a string
 *
 * Returns:	---
 *
 * Use:		Writes the string to the stream, substituting the program
 *		name (as returned by @quis@) for each occurrence of the
 *		character `$'.
 */

static void bc__write(FILE *fp, const char *p)
{
  const char *n = quis();
  size_t l;
  size_t nl = strlen(n);

  /* --- Try to be a little efficient --- *
   *
   * Gather up non-`$' characters using @strcspn@ and spew them out really
   * quickly.
   */

  for (;;) {
    l = strcspn(p, "$");
    if (l)
      fwrite(p, l, 1, fp);
    p += l;
    if (!*p)
      break;
    fwrite(n, nl, 1, fp);
    p++;
  }
}

/* --- @bc__setenv@ --- *
 *
 * Arguments:	@sym_env *e@ = pointer to environment variable block
 *		@const char *val@ = value to set
 *
 * Returns:	---
 *
 * Use:		Sets an environment variable block to the right value.
 */

static void bc__setenv(sym_env *e, const char *val)
{
  e->val = xmalloc(strlen(e->_base.name) + 1 + strlen(val) + 1);
  sprintf(e->val, "%s=%s", e->_base.name, val);
}

/* --- @bc__putenv@ --- *
 *
 * Arguments:	@const char *var@ = name of the variable to set, or 0 if
 *			this is embedded in the value string
 *		@const char *val@ = value to set, or 0 if the variable must
 *			be removed
 *		@unsigned int fl@ = flags to set
 *		@unsigned int force@ = force overwrite of preserved variables
 *
 * Returns:	Pointer to symbol block, or zero if it was deleted.
 *
 * Use:		Puts an item into the environment.
 */

static sym_env *bc__putenv(const char *var, const char *val,
			   unsigned int fl, unsigned int force)
{
  unsigned int f;
  sym_env *e;
  char *q = 0;
  size_t sz;

  /* --- Sort out embedded variable names --- */

  if (!var) {
    const char *p = strchr(val, '=');

    if (p) {
      sz = p - val;
      q = xmalloc(sz + 1);
      memcpy(q, val, sz);
      q[sz] = 0;
      var = q;
      val = p + 1;
    } else {
      var = val;
      val = 0;
    }
  }

  /* --- Find the variable block --- */

  if (val) {
    e = sym_find(&bc__env, var, -1, sizeof(*e), &f);
    if (~e->f & envFlag_preserve || force) {
      if (f)
	free(e->val);
      bc__setenv(e, val);
    }
  } else {
    e = sym_find(&bc__env, var, -1, 0, 0);
    if (e && (force || ~e->f & envFlag_preserve))
      sym_remove(&bc__env, e);
    e = 0;
  }

  /* --- Tidy up and return --- */

  if (q)
    free(q);
  if (e)
    e->f = fl;
  return (e);
}

/* --- @bc__banner@ --- *
 *
 * Arguments:	@FILE *fp@ = stream to write on
 *
 * Returns:	---
 *
 * Use:		Writes a banner containing copyright information.
 */

static void bc__banner(FILE *fp)
{
  bc__write(fp, "$ version " VERSION "\n");
}

/* --- @bc__usage@ --- *
 *
 * Arguments:	@FILE *fp@ = stream to write on
 *
 * Returns:	---
 *
 * Use:		Writes a terse reminder of command line syntax.
 */

static void bc__usage(FILE *fp)
{
  bc__write(fp,
	    "Usage: \n"
	    "	$ -c <shell-command> <user>\n"
	    "	$ [<env-var>] <user> [<command> [<arguments>]...]\n"
	    "	$ -d [-p <port>] [-f <config-file>]\n");
}

/* --- @bc__help@ --- *
 *
 * Arguments:	@FILE *fp@ = stream to write on
 *		@int suid@ = whether we're running set-uid
 *
 * Returns:	---
 *
 * Use:		Displays a help message for this excellent piece of software.
 */

static void bc__help(FILE *fp, int suid)
{
  bc__banner(fp);
  putc('\n', fp);
  bc__usage(fp);
  putc('\n', fp);
  bc__write(fp,
"The `$' program allows you to run a process as another user.\n"
"If a command name is given, this is the process executed.  If the `-c'\n"
"option is used, the process is assumed to be `/bin/sh'.  If no command is\n"
"given, your default login shell is used.\n"
"\n"
"Your user id, the user id you wish to become, the name of the process\n"
"you wish to run, and the identity of the current host are looked up to\n"
"ensure that you have permission to do this.\n"
"\n"
"Note that logs are kept of all uses of this program.\n"
"\n"
"Options available are:\n"
"\n"
"-h, --help			Display this help text\n"
"-u, --usage			Display a short usage summary\n"
"-v, --version			Display $'s version number\n"
"\n"
"-e, --preserve-environment	Try to preserve the current environment\n"
"-s, --su, --set-user		Set environment variables to reflect USER\n"
"-l, --login			Really log in as USER\n"
"\n"
"-c CMD, --command=CMD		Run the (Bourne) shell command CMD\n"
"\n"
"-d, --daemon			Start a daemon\n"
"-p PORT, --port=PORT		In daemon mode, listen on PORT\n"
"-f FILE, --config-file=FILE	In daemon mode, read config from FILE\n");
#ifdef TRACING
  bc__write(fp, "\n");
  if (!suid) {
    bc__write(fp,
"-I USER, --impersonate=USER	Claim to be USER when asking the server\n");
  }
  bc__write(fp,
"-T FILE, --trace=FILE		Dump trace information to FILE (boring)\n"
"-L OPTS, --trace-level=OPTS	Set level of tracing information\n");
#endif
}

/* --- @main@ --- *
 *
 * Arguments:	@int argc@ = number of command line arguments
 *		@char *argv[]@ = pointer to the various arguments
 *
 * Returns:	Zero if successful.
 *
 * Use:		Allows a user to change UID.
 */

int main(int argc, char *argv[])
{
  /* --- Request block setup parameters --- */

  request rq;				/* Request buffer to build */
  char *cmd = 0;			/* Shell command to execute */
  char *binary = "/bin/sh";		/* Default binary to execute */
  char **env = environ;			/* Default environment to pass */
  char **todo = 0;			/* Pointer to argument list */
  char *who = 0;			/* Who we're meant to become */
  struct passwd *from_pw = 0;		/* User we are right now */
  struct passwd *to_pw = 0;		/* User we want to become */

  /* --- Become server setup parameters --- */

  char *conffile = file_RULES;		/* Default config file for daemon */
  int port = -1;			/* Default port for daemon */

  /* --- Miscellanous shared variables --- */

  unsigned flags = 0;			/* Various useful flags */
  int style = DEFAULT_LOGIN_STYLE;	/* Login style */

  /* --- Default argument list executes a shell command --- */

  static char *shell[] = {
    "/bin/sh",				/* Bourne shell */
    "-c",				/* Read from command line */
    0,					/* Pointer to shell command */
    0					/* Terminator */
  };

  /* --- Definitions for the various flags --- */

  enum {
    f_daemon = 1,			/* Start up in daemon mode */
    f_duff = 2,				/* Fault in arguments */
    f_login = 4,			/* Execute as a login shell */
    f_dummy = 8,			/* Don't actually do anything */
    f_setuid = 16			/* We're running setuid */
  };

  /* --- Set up the program name --- */

  ego(argv[0]);
  clock();
  if (getuid() != geteuid())
    flags |= f_setuid;

  /* --- Read the environment into a hashtable --- */

  {
    char **p;

    sym_createTable(&bc__env);
    for (p = environ; *p; p++)
      bc__putenv(0, *p, 0, 0);
  }

  /* --- Parse some command line arguments --- */

  for (;;) {
    int i;
    static struct option opts[] = {

      /* --- Asking for help --- */

      { "help",		0,		0,	'h' },
      { "usage",	0,		0,	'u' },
      { "version",	0,		0,	'v' },

      /* --- Login style options --- */

      { "preserve-environment", 0,	0,	'e' },
      { "su",		0,		0,	's' },
      { "set-user",	0,		0,	's' },
      { "login",	0,		0,	'l' },

      /* --- Command to run options --- */

      { "command",	gFlag_argReq,	0,	'c' },

      /* --- Server options --- */

      { "daemon",	0,		0,	'd' },
      { "port",		gFlag_argReq,	0,	'p' },
      { "config-file",	gFlag_argReq,	0,	'f' },

      /* --- Tracing options --- */

#ifdef TRACING
      { "impersonate",	gFlag_argReq,	0,	'I' },
      { "trace",	gFlag_argOpt,	0,	'T' },
      { "trace-level",	gFlag_argOpt,	0,	'L' },
#endif

      { 0,		0,		0,	0 }
    };

    i = mdwopt(argc, argv,
	       "-" "huv" "esl" "c:" "dp:f:" T("I:T::L::"),
	       opts, 0, 0, gFlag_envVar);
    if (i < 0)
      goto done_options;

    switch (i) {

      /* --- Asking for help --- */

      case 'h':
	bc__help(stdout, flags & f_setuid);
	exit(0);
	break;
      case 'u':
	bc__usage(stdout);
	exit(0);
	break;
      case 'v':
	bc__banner(stdout);
	exit(0);
	break;

      /* --- Login style options --- */

      case 'e':
	style = l_preserve;
	break;
      case 's':
	style = l_user;
	break;
      case 'l':
	style = l_login;
	break;

      /* --- Command to run options --- */

      case 'c':
	cmd = optarg;
	break;

      /* --- Server options --- */

      case 'p':
	port = atoi(optarg);
	break;
      case 'd':
	flags |= f_daemon;
	break;
      case 'f':
	conffile = optarg;
	break;

      /* --- Pretend to be a different user --- *
       *
       * There are all sorts of nasty implications for this option.  Don't
       * allow it if we're running setuid.  Disable the actual login anyway.
       */

#ifdef TRACING

      case 'I':
	if (flags & f_setuid)
	  moan("shan't allow impersonation while running setuid");
	else {
	  struct passwd *pw;
	  if (isdigit((unsigned char)optarg[0]))
	    pw = getpwuid(atoi(optarg));
	  else
	    pw = getpwnam(optarg);
	  if (!pw)
	    die("can't impersonate unknown user `%s'", optarg);
	  from_pw = userdb_copyUser(pw);
	  rq.from = from_pw->pw_uid;
	  flags |= f_dummy;
	}
	break;

#endif

      /* --- Tracing support --- *
       *
       * Be careful not to zap a file I wouldn't normally be allowed to write
       * to!
       */

#ifdef TRACING

      case 'T': {
	FILE *fp;

	if (optarg == 0 || strcmp(optarg, "-") == 0)
	  fp = stdout;
	else {
	  uid_t eu = geteuid(), ru = getuid();

#ifdef HAVE_SETREUID
	  if (setreuid(eu, ru))
#else
	  if (seteuid(ru))
#endif
	  {
	    die("couldn't temporarily give up privileges: %s",
		strerror(errno));
	  }

	  if ((fp = fopen(optarg, "w")) == 0) {
	    die("couldn't open trace file `%s' for writing: %s",
		optarg, strerror(errno));
	  }

#ifdef HAVE_SETREUID
          if (setreuid(ru, eu))
#else
          if (seteuid(eu))
#endif
	    die("couldn't regain privileges: %s", strerror(errno));
	}
	traceon(fp, TRACE_DFL);
	trace(TRACE_MISC, "become: tracing enabled");
      } break;

#endif

      /* --- Setting trace levels --- */

#ifdef TRACING

      case 'L': {
	int sense = 1;
	unsigned int lvl = 0, l;
	const char *p = optarg;

	/* --- Table of tracing facilities --- */

	typedef struct tr {
	  char ch;
	  unsigned int l;
	  const char *help;
	} tr;

	static tr lvltbl[] = {
	  { 'm', TRACE_MISC,	"miscellaneous messages" },
	  { 's', TRACE_SETUP,	"building the request block" },
	  { 'd', TRACE_DAEMON,	"server process" },
	  { 'r', TRACE_RULE,	"ruleset scanning" },
	  { 'c', TRACE_CHECK,	"request checking" },
	  { 'l', TRACE_CLIENT,	"client process" },
	  { 'R', TRACE_RAND,	"random number generator" },
	  { 'C', TRACE_CRYPTO,	"cryptographic processing of requests" },
	  { 'y', TRACE_YACC,	"parsing configuration file" },
	  { 'D', TRACE_DFL,	"default tracing options" },
	  { 'A', TRACE_ALL,	"all tracing options" },
	  { 0,   0,		0 }
	};
	tr *tp;

	/* --- Output some help if there's no arguemnt --- */

	if (!optarg) {
	  bc__banner(stdout);
	  bc__write(stdout,
		    "\n"
		    "Tracing options:\n"
		    "\n");
	  for (tp = lvltbl; tp->l; tp++) {
	    if ((flags & f_setuid) == 0 || tp->l & ~TRACE_PRIV)
	      printf("%c -- %s\n", tp->ch, tp->help);
	  }
	  bc__write(stdout,
"\n"
"Also, `+' and `-' options are recognised to turn on and off vavrious\n"
"tracing options.  For example, `A-r' enables everything except ruleset\n"
"tracing, and `A-D+c' is everything except the defaults, but with request\n"
"check tracing.\n"
);
	  exit(0);
	}

	while (*p) {
	  if (*p == '+')
	    sense = 1;
	  else if (*p == '-')
	    sense = 0;
	  else {
	    for (tp = lvltbl; tp->l && *p != tp->ch; tp++)
	      ;
	    l = tp->l;
	    if (flags & f_setuid)
	      l &= ~TRACE_PRIV;
	    if (l)
	      lvl = sense ? (lvl | l) : (lvl & ~l);
	    else
	      moan("unknown trace option `%c'", *p);
	  }
	  p++;
	}

	tracesetlvl(lvl);
	yydebug = ((lvl & TRACE_YACC) != 0);
      } break;

#endif

      /* --- Something that wasn't an option --- *
       *
       * The following nasties are supported:
       *
       *   * NAME=VALUE		-- preserve NAME, and give it a VALUE
       *   * NAME=		-- preserve NAME, and give it an empty value
       *   * NAME-		-- delete NAME
       *   * NAME!		-- preserve NAME with existing value
       *
       * Anything else is either the user name (which is OK) or the start of
       * the command (in which case I stop and read the rest of the command).
       */

      case 0: {
	size_t sz = strcspn(optarg, "=-!");
	sym_env *e;

	/* --- None of the above --- */

	if (optarg[sz] == 0 || (optarg[sz] != '=' && optarg[sz + 1] != 0)) {
	  if (who == 0)
	    who = optarg;
	  else {
	    optind--;
	    goto done_options;
	  }
	}

	/* --- Do the appropriate thing --- */

	switch (optarg[sz]) {
	  case '=':
	    bc__putenv(0, optarg, envFlag_preserve, 1);
	    break;
	  case '-':
	    optarg[sz] = 0;
	    bc__putenv(optarg, 0, 0, 1);
	    break;
	  case '!':
	    optarg[sz] = 0;
	    if ((e = sym_find(&bc__env, optarg, -1, 0, 0)) != 0)
	      e->f |= envFlag_preserve;
	    break;
	}
      } break;

      /* --- Something I didn't understand has occurred --- */

      case '?':
	flags |= f_duff;
	break;
    }
  }

done_options:
  if (flags & f_duff) {
    bc__usage(stderr);
    exit(1);
  }

  /* --- Switch to daemon mode if requested --- */

  if (flags & f_daemon) {
    T( trace(TRACE_MISC, "become: daemon mode requested"); )
    daemon_init(conffile, port);
    exit(0);
  }

  /* --- Open a syslog --- */

  openlog(quis(), 0, LOG_AUTH);

  /* --- Pick out the uid --- */

  {
    struct passwd *pw;

    if (!who) {
      bc__usage(stderr);
      exit(1);
    }

    if (isdigit((unsigned char)who[0]))
      pw = getpwuid(atoi(who));
    else
      pw = getpwnam(who);
    if (!pw)
      die("unknown user `%s'", who);
    to_pw = userdb_copyUser(pw);
    rq.to = pw->pw_uid;
  }

  /* --- Fill in the easy bits of the request --- */

  if (!from_pw) {
    struct passwd *pw;

    rq.from = getuid();
    pw = getpwuid(rq.from);
    if (!pw)
      die("who are you? (can't find user %li)", (long)rq.from);
    from_pw = userdb_copyUser(pw);
  }

  /* --- Find the local host address --- */

  {
    struct utsname u;
    struct hostent *he;
    uname(&u);
    if ((he = gethostbyname(u.nodename)) == 0)
      die("who am I? (can't resolve `%s')", u.nodename);
    memcpy(&rq.host, he->h_addr, sizeof(struct in_addr));
  }

  /* --- Shell commands are easy --- */

  if (cmd) {
    shell[2] = cmd;
    todo = shell;
  }

  /* --- A command given on the command line isn't too hard --- */

  else if (optind < argc) {
    todo = argv + optind;
    binary = todo[0];
  }

  else switch (style) {

    /* --- An unadorned becoming requires little work --- */

    case l_preserve:
      shell[0] = getenv("SHELL");
      if (!shell[0])
	shell[0] = from_pw->pw_shell;
      shell[1] = 0;
      todo = shell;
      binary = todo[0];
      break;

    /* --- An su-like login needs slightly less effort --- */

    case l_user:
      shell[0] = to_pw->pw_shell;
      shell[1] = 0;
      todo = shell;
      binary = todo[0];
      break;

    /* --- A login request needs a little bit of work --- */

    case l_login: {
      const char *p = strrchr(to_pw->pw_shell, '/');

      if (p)
	p++;
      else
	p = to_pw->pw_shell;
      shell[0] = xmalloc(strlen(p) + 2);
      shell[0][0] = '-';
      strcpy(shell[0] + 1, p);
      shell[1] = 0;
      todo = shell;
      binary = to_pw->pw_shell;
      chdir(to_pw->pw_dir);
    } break;
  }

  /* --- Mangle the environment --- *
   *
   * This keeps getting more complicated all the time.  (How true.  Now I've
   * got all sorts of nasty environment mangling to do.)
   *
   * The environment stuff now happens in seven phases:
   *
   *   1. Mark very special variables to be preserved.  Currently only TERM
   *      and DISPLAY are treated in this way.
   *
   *   2. Set and preserve Become's own environment variables.
   *
   *   3. Set and preserve the user identity variables (USER, LOGNAME, HOME,
   *      SHELL and MAIL) if we're being `su'-like or `login'-like.
   *
   *   4. If we're preserving the environment or being `su'-like, process the
   *      PATH variable a little.  Otherwise reset it to something
   *      appropriate.
   *
   *   5. If we're being `login'-like, expunge all unpreserved variables.
   *
   *   6. Expunge any security-critical variables.
   *
   *   7. Build a new environment table to pass to child processes.
   */

  {
    /* --- Variables to be preserved always --- *
     *
     * A user can explicitly expunge a variable in this list, in which case
     * we never get to see it here.
     */

    static char *preserve[] = {
      "TERM", "DISPLAY", 0
    };

    /* --- Variables to be expunged --- *
     *
     * Any environment string which has one of the following as a prefix will
     * be expunged from the environment passed to the called process.  The
     * first line lists variables which have been used to list search paths
     * for shared libraries: by manipulating these, an attacker could replace
     * a standard library with one of his own.  The second line lists other
     * well-known dangerous environment variables.
     */

    static char *banned[] = {
      "-LD_", "SHLIB_PATH", "LIBPATH", "-_RLD_",
      "IFS", "ENV", "BASH_ENV", "KRB_CONF",
      0
    };

    /* --- Other useful variables --- */

    sym_env *e;
    char *p, *q, *r;
    char **pp, **qq;
    size_t sz;
    unsigned f;
    sym_iter i;

    /* --- Stage one.  Preserve display-specific variables --- */

    for (pp = preserve; *pp; pp++) {
      if ((e = sym_find(&bc__env, *pp, -1, 0, 0)) != 0)
	e->f |= envFlag_preserve;
    }

    /* --- Stage two.  Set Become's own variables --- */

    e = sym_find(&bc__env, "BECOME_ORIGINAL_USER", -1, sizeof(*e), &f);
    if (!f)
      bc__setenv(e, from_pw->pw_name);
    e->f |= envFlag_preserve;

    e = sym_find(&bc__env, "BECOME_ORIGINAL_HOME", -1, sizeof(*e), &f);
    if (!f)
      bc__setenv(e, from_pw->pw_dir);
    e->f |= envFlag_preserve;

    bc__putenv("BECOME_OLD_USER", from_pw->pw_name, envFlag_preserve, 0);
    bc__putenv("BECOME_OLD_HOME", from_pw->pw_dir, envFlag_preserve, 0);
    bc__putenv("BECOME_USER", to_pw->pw_name, envFlag_preserve, 0);
    bc__putenv("BECOME_HOME", to_pw->pw_dir, envFlag_preserve, 0);

    /* --- Stage three.  Set user identity --- */

    switch (style) {
      case l_login: {
	static char *maildirs[] = {
	  "/var/spool/mail", "/var/mail",
	  "/usr/spool/mail", "/usr/mail",
	  0
	};
	struct stat s;
	char b[128];

	for (pp = maildirs; *pp; pp++) {
	  if (stat(*pp, &s) == 0 && S_ISDIR(s.st_mode)) {
	    sprintf(b, "%s/%s", *pp, to_pw->pw_name);
	    bc__putenv("MAIL", b, envFlag_preserve, 0);
	    break;
	  }
	}
      } /* Fall through */

      case l_user:
	bc__putenv("USER", to_pw->pw_name, envFlag_preserve, 0);
	bc__putenv("LOGNAME", to_pw->pw_name, envFlag_preserve, 0);
	bc__putenv("HOME", to_pw->pw_dir, envFlag_preserve, 0);
	bc__putenv("SHELL", to_pw->pw_shell, envFlag_preserve, 0);
	break;
    }

    /* --- Stage four.  Set the user's PATH properly --- */

    {
      /* --- Find an existing path --- *
       *
       * If there's no path, or this is a login, then set a default path,
       * unless we're meant to preserve the existing one.  Whew!
       */

      e = sym_find(&bc__env, "PATH", -1, sizeof(*e), &f);

      if (!f || (style == l_login && ~e->f & envFlag_preserve)) {
	bc__putenv("PATH",
		   rq.to ? "/usr/bin:/bin" : "/usr/bin:/usr/sbin:/bin:/sbin",
		   envFlag_preserve, 0);
      } else {

	/* --- Find the string --- */

	e->f = envFlag_preserve;
	p = strchr(e->val, '=') + 1;
	r = e->val;

	/* --- Write the new version to a dynamically allocated buffer --- */

	e->val = xmalloc(4 + 1 + strlen(p) + 1);
	strcpy(e->val, "PATH=");
	q = e->val + 5;

	for (p = strtok(p, ":"); p; p = strtok(0, ":")) {
	  if (p[0] != '/')
	    continue;
	  while (*p)
	    *q++ = *p++;
	  *q++ = ':';
	}
	q[-1] = 0;

	/* --- Done! --- */

	free(r);
      }
    }

    /* --- Stages five and six.  Expunge variables and count numbers --- *
     *
     * Folded together, so I only need one pass through the table.  Also
     * count the number of variables needed at this time.
     */

    sz = 0;

    for (sym_createIter(&i, &bc__env); (e = sym_next(&i)) != 0; ) {

      /* --- Login style expunges all unpreserved variables --- */

      if (style == l_login && ~e->f & envFlag_preserve)
	goto expunge;

      /* --- Otherwise just check the name against the list --- */

      for (pp = banned; *pp; pp++) {
	if (**pp == '-') {
	  p = *pp + 1;
	  if (memcmp(e->_base.name, p, strlen(p)) == 0)
	    goto expunge;
	} else if (strcmp(e->_base.name, p) == 0)
	  goto expunge;
      }

      sz++;
      continue;

    expunge:
      sym_remove(&bc__env, e);
    }

    /* --- Stage seven.  Build the new environment block --- */

    env = qq = xmalloc((sz + 1) * sizeof(*qq));

    for (sym_createIter(&i, &bc__env); (e = sym_next(&i)) != 0; )
      *qq++ = e->val;
    *qq++ = 0;
  }

  /* --- Trace the command --- */

  IF_TRACING(TRACE_SETUP, {
    int i;

    trace(TRACE_SETUP, "setup: from user %s to user %s",
	  from_pw->pw_name, to_pw->pw_name);
    trace(TRACE_SETUP, "setup: binary == `%s'", binary);
    for (i = 0; todo[i]; i++)
      trace(TRACE_SETUP, "setup: arg %i == `%s'", i, todo[i]);
    for (i = 0; env[i]; i++)
      trace(TRACE_SETUP, "setup: env %i == `%s'", i, env[i]);
  })

  /* --- If necessary, resolve the path to the command --- */

  if (!strchr(binary, '/')) {
    char *path, *p;
    struct stat st;

    if ((p = getenv("PATH")) == 0)
      p = "/bin:/usr/bin";
    path = xstrdup(p);

    for (p = strtok(path, ":"); p; p = strtok(0, ":")) {

      /* --- Check length of string before copying --- */

      if (strlen(p) + strlen(binary) + 2 > sizeof(rq.cmd))
	continue;

      /* --- Now build the pathname and check it --- */

      sprintf(rq.cmd, "%s/%s", p, todo[0]);
      if (stat(rq.cmd, &st) == 0 &&	/* Check it exists */
	  st.st_mode & 0111 &&		/* Check it's executable */
	  S_ISREG(st.st_mode))		/* Check it's a file */
	break;
    }

    if (!p)
      die("couldn't find `%s' in path", todo[0]);
    binary = rq.cmd;
    free(path);
  }
  T( trace(TRACE_SETUP, "setup: resolve binary to `%s'", binary); )

  /* --- Canonicalise the path string, if necessary --- */

  {
    char b[CMDLEN_MAX];
    char *p;
    const char *q;

    /* --- Insert current directory name if path not absolute --- */

    p = b;
    q = binary;
    if (*q != '/') {
      if (!getcwd(b, sizeof(b)))
	die("couldn't read current directory: %s", strerror(errno));
      p += strlen(p);
      *p++ = '/';
    }

    /* --- Now copy over characters from the path string --- */

    while (*q) {

      /* --- Check for buffer overflows here --- *
       *
       * I write at most one byte per iteration so this is OK.  Remember to
       * allow one for the null byte.
       */

      if (p >= b + sizeof(b) - 1)
	die("internal error: buffer overflow while canonifying path");

      /* --- Reduce multiple slashes to just one --- */

      if (*q == '/') {
	while (*q == '/')
	  q++;
	*p++ = '/';
      }

      /* --- Handle dots in filenames --- *
       *
       * @p[-1]@ is valid here, because if @*q@ is not a `/' then either
       * we've just stuck the current directory on the end of the buffer,
       * or we've just put something else on the end.
       */

      else if (*q == '.' && p[-1] == '/') {

	/* --- A simple `./' just gets removed --- */

	if (q[1] == 0 || q[1] == '/') {
	  q++;
	  p--;
	  continue;
	}

	/* --- A `../' needs to be peeled back to the previous `/' --- */

	if (q[1] == '.' && (q[2] == 0 || q[2] == '/')) {
	  q += 2;
	  p--;
	  while (p > b && p[-1] != '/')
	    p--;
	  if (p > b)
	    p--;
	  continue;
	}
      } else
	*p++ = *q++;
    }

    *p++ = 0;
    strcpy(rq.cmd, b);
  }
  T( trace(TRACE_SETUP, "setup: canonify binary to `%s'", rq.cmd); )

  /* --- Run the check --- *
   *
   * If the user is already what she wants to be, then print a warning.
   * Then, if I was just going to spawn a shell, quit, to reduce user
   * confusion.  Otherwise, do what was wanted anyway.
   */

  if (rq.from == rq.to) {
    moan("you already are `%s'!", to_pw->pw_name);
    if (!cmd && todo == shell) {
      moan("(to prevent confusion, I'm not spawning a shell)");
      exit(0);
    }
  } else {
    int a = check(&rq);

    syslog(LOG_INFO,
	   "permission %s for %s to become %s to run `%s'",
	   a ? "granted" : "denied", from_pw->pw_name, to_pw->pw_name,
	   rq.cmd);

    if (!a)
      die("permission denied");
  }

  /* --- Now do the job --- */

  T( trace(TRACE_MISC, "become: permission granted"); )

  if (flags & f_dummy) {
    puts("permission granted");
    return (0);
  } else {
    if (setuid(rq.to) == -1)
      die("couldn't set uid: %s", strerror(errno));
    fflush(0);
    execve(rq.cmd, todo, env);
    die("couldn't exec `%s': %s", rq.cmd, strerror(errno));
    return (127);
  }
}

/*----- That's all, folks -------------------------------------------------*/