knub=$KEYS/nub/$kowner/$klabel
}
+runas () {
+ user=$1 service=$2; shift 2
+ ## If the current (effective) user is not USER then reinvoke via `userv',
+ ## as the specified service, with the remaining arguments.
+
+ case $(id -un) in
+ "$user") ;;
+ *) exec userv "$user" "$service" "$@" ;;
+ esac
+}
+
###--------------------------------------------------------------------------
### Input validation functions.
## Regular expressions for validating input.
R_IDENTCHARS="A-Za-z0-9_"
-R_WORDCHARS="-$R_IDENTCHARS!%@+="
+R_GOODPUNCT="!%@+="
+R_WORDCHARS="-$R_IDENTCHARS$R_GOODPUNCT"
R_IDENT="[$R_IDENTCHARS][$R_IDENTCHARS]*"
R_WORD="[$R_WORDCHARS][$R_WORDCHARS]*"
+R_ACLCHARS="][$R_IDENTCHARS$R_GOODPUNCT*?:.#"
R_WORDSEQ="[$R_WORDCHARS[:space:]][$R_WORDCHARS[:space:]]*"
+R_ACL="[$R_ACLCHARS[:space:]-][$R_ACLCHARS[:space:]-]*"
R_NUMERIC='\(\([1-9][0-9]*\)\{0,1\}0\{0,1\}\)'
R_LABEL="\($R_WORD\(/$R_WORD\)*\)"
R_LINE=".*"
nub_hash t $R_WORD
nubid_hash t $R_WORD
nub_random_bytes t $R_NUMERIC
+acl_encrypt t $R_ACL
+acl_decrypt t $R_ACL
+acl_sign t $R_ACL
+acl_verify t $R_ACL
+acl_info t $R_ACL
EOF
readprops () {