bsd-auth: add notes

1 files changed, 67 insertions, 26 deletions

diff --git a/content/posts/WIP-how-bsd-authentication-works/index.org b/content/posts/WIP-how-bsd-authentication-works/index.org
index 520c21f..e1aae84 100644
--- a/content/posts/WIP-how-bsd-authentication-works/index.org
+++ b/content/posts/WIP-how-bsd-authentication-works/index.org
@@ -2617,6 +2617,73 @@
 
   It returns =0= if the user is allowed to login, and =-1= otherwise.
 
+* Notes
+
+  - In the man page for [[https://man.openbsd.org/auth_subr.3#auth_call][=auth_call=]] it says
+    #+begin_src text
+    path    The full path name of the login script to run.  The call will
+                 fail if path does not pass the requirements of the secure_path(3)
+                 function.
+    #+end_src
+
+    However I don't see this enforced anywhere, I even wrote a small test
+    script to prove it.
+
+    #+CAPTION: =authfail.c=
+    #+begin_src c
+    #include <sys/types.h>
+    #include <login_cap.h>
+    #include <bsd_auth.h>
+    #include <stdio.h>
+
+    int main(void) {
+        auth_session_t *as;
+
+        as = auth_open();
+        auth_call(as, "/home/dante/auth_tests/authtest/test", "hello", NULL);
+        auth_close(as);
+    }
+    #+end_src
+
+    #+CAPTION: =test.c=
+    #+begin_src c
+    #include <stdio.h>
+
+    int main(void) {
+        printf("Hello! I don't have a secure path!\n");
+        return 0;
+    }
+    #+end_src
+
+    #+CAPTION: =Makefile=
+    #+begin_src makefile
+    CFLAGS = -Wall -Wextra
+
+    run: authfail test
+        ./authfail
+
+    authfail: authfail.c
+        $(CC) -o $@ $(CFLAGS) $<
+
+    test: test.c
+        $(CC) -o $@ $(CFLAGS) $<
+
+    #+end_src
+
+
+
+  - The manpage also says the path is limited to =/bin/= and =/usr/bin=,
+    which is also not the case.
+
+  - The man page describes the interface for =auth_getitem= is in the
+    format of =AUTH_<item>=, but in reality it is =AUTHV_<item>=.
+
+ # Ask jcs about the file descriptor situation, I don't understand it
+ # after reading both the man page and source.
+
+ - The =auth_getchallenge= function in the =auth_subr(3)= man page
+   doesn't seem to exist in the source code.
+
 * Copyright
   :PROPERTIES:
   :CUSTOM_ID: copyright
@@ -2719,29 +2786,3 @@
    ,*/
   #+end_src
   @@html: </details> @@
-
-
-* COMMENT note                                                     :noexport:
-
- ---
- note: In the man page auth_subr it says
- #+begin_quote
- path    The full path name of the login script to run.  The call will
-              fail if path does not pass the requirements of the secure_path(3)
-              function.
- #+end_quote
- However I don't see this enforced anywhere, I even wrote a small test
- script to prove that's the case on =vfwall ~/authtest=.
-
- The manpage also says the path is limited to =/bin/= and =/usr/bin=,
- which is also not the case.
-
- The man page describes the interface for =auth_getitem= is in the
- format of =AUTH_<item>=, but in reality it is =AUTHV_<item>=.
-
- Ask jcs about the file descriptor situation, I don't understand it
- after reading both the man page and source.
-
- The =auth_getchallenge= function us in the =auth_subr(3)= man page
- doesn't seem to exist in the source code.
- ---