]>
Commit | Line | Data |
---|---|---|
3c0ef626 | 1 | /* |
2 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | |
3 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | |
4 | * All rights reserved | |
5 | * Code for uid-swapping. | |
6 | * | |
7 | * As far as I am concerned, the code I have written for this software | |
8 | * can be used freely for any purpose. Any derived versions of this | |
9 | * software must be clearly marked as such, and if the derived work is | |
10 | * incompatible with the protocol description in the RFC file, it must be | |
11 | * called by a name other than "ssh" or "Secure Shell". | |
12 | */ | |
13 | ||
14 | #include "includes.h" | |
0fff78ff | 15 | RCSID("$OpenBSD: uidswap.c,v 1.24 2003/05/29 16:58:45 deraadt Exp $"); |
3c0ef626 | 16 | |
17 | #include "log.h" | |
18 | #include "uidswap.h" | |
19 | ||
20 | /* | |
21 | * Note: all these functions must work in all of the following cases: | |
22 | * 1. euid=0, ruid=0 | |
23 | * 2. euid=0, ruid!=0 | |
24 | * 3. euid!=0, ruid!=0 | |
25 | * Additionally, they must work regardless of whether the system has | |
26 | * POSIX saved uids or not. | |
27 | */ | |
28 | ||
29 | #if defined(_POSIX_SAVED_IDS) && !defined(BROKEN_SAVED_UIDS) | |
30 | /* Lets assume that posix saved ids also work with seteuid, even though that | |
31 | is not part of the posix specification. */ | |
32 | #define SAVED_IDS_WORK_WITH_SETEUID | |
33 | /* Saved effective uid. */ | |
34 | static uid_t saved_euid = 0; | |
35 | static gid_t saved_egid = 0; | |
36 | #endif | |
37 | ||
38 | /* Saved effective uid. */ | |
39 | static int privileged = 0; | |
40 | static int temporarily_use_uid_effective = 0; | |
41 | static gid_t saved_egroups[NGROUPS_MAX], user_groups[NGROUPS_MAX]; | |
42 | static int saved_egroupslen = -1, user_groupslen = -1; | |
43 | ||
44 | /* | |
45 | * Temporarily changes to the given uid. If the effective user | |
46 | * id is not root, this does nothing. This call cannot be nested. | |
47 | */ | |
48 | void | |
49 | temporarily_use_uid(struct passwd *pw) | |
50 | { | |
51 | /* Save the current euid, and egroups. */ | |
52 | #ifdef SAVED_IDS_WORK_WITH_SETEUID | |
53 | saved_euid = geteuid(); | |
54 | saved_egid = getegid(); | |
41b2f314 | 55 | debug("temporarily_use_uid: %u/%u (e=%u/%u)", |
56 | (u_int)pw->pw_uid, (u_int)pw->pw_gid, | |
57 | (u_int)saved_euid, (u_int)saved_egid); | |
3c0ef626 | 58 | if (saved_euid != 0) { |
59 | privileged = 0; | |
60 | return; | |
61 | } | |
62 | #else | |
63 | if (geteuid() != 0) { | |
64 | privileged = 0; | |
65 | return; | |
66 | } | |
67 | #endif /* SAVED_IDS_WORK_WITH_SETEUID */ | |
68 | ||
69 | privileged = 1; | |
70 | temporarily_use_uid_effective = 1; | |
e9a17296 | 71 | saved_egroupslen = getgroups(NGROUPS_MAX, saved_egroups); |
3c0ef626 | 72 | if (saved_egroupslen < 0) |
73 | fatal("getgroups: %.100s", strerror(errno)); | |
74 | ||
75 | /* set and save the user's groups */ | |
76 | if (user_groupslen == -1) { | |
77 | if (initgroups(pw->pw_name, pw->pw_gid) < 0) | |
78 | fatal("initgroups: %s: %.100s", pw->pw_name, | |
79 | strerror(errno)); | |
e9a17296 | 80 | user_groupslen = getgroups(NGROUPS_MAX, user_groups); |
3c0ef626 | 81 | if (user_groupslen < 0) |
82 | fatal("getgroups: %.100s", strerror(errno)); | |
83 | } | |
3c0ef626 | 84 | /* Set the effective uid to the given (unprivileged) uid. */ |
85 | if (setgroups(user_groupslen, user_groups) < 0) | |
86 | fatal("setgroups: %.100s", strerror(errno)); | |
3c0ef626 | 87 | #ifndef SAVED_IDS_WORK_WITH_SETEUID |
88 | /* Propagate the privileged gid to all of our gids. */ | |
89 | if (setgid(getegid()) < 0) | |
90 | debug("setgid %u: %.100s", (u_int) getegid(), strerror(errno)); | |
91 | /* Propagate the privileged uid to all of our uids. */ | |
92 | if (setuid(geteuid()) < 0) | |
93 | debug("setuid %u: %.100s", (u_int) geteuid(), strerror(errno)); | |
94 | #endif /* SAVED_IDS_WORK_WITH_SETEUID */ | |
95 | if (setegid(pw->pw_gid) < 0) | |
f5799ae1 | 96 | fatal("setegid %u: %.100s", (u_int)pw->pw_gid, |
3c0ef626 | 97 | strerror(errno)); |
98 | if (seteuid(pw->pw_uid) == -1) | |
f5799ae1 | 99 | fatal("seteuid %u: %.100s", (u_int)pw->pw_uid, |
3c0ef626 | 100 | strerror(errno)); |
101 | } | |
102 | ||
103 | /* | |
104 | * Restores to the original (privileged) uid. | |
105 | */ | |
106 | void | |
107 | restore_uid(void) | |
108 | { | |
3c0ef626 | 109 | /* it's a no-op unless privileged */ |
41b2f314 | 110 | if (!privileged) { |
111 | debug("restore_uid: (unprivileged)"); | |
3c0ef626 | 112 | return; |
41b2f314 | 113 | } |
3c0ef626 | 114 | if (!temporarily_use_uid_effective) |
115 | fatal("restore_uid: temporarily_use_uid not effective"); | |
116 | ||
117 | #ifdef SAVED_IDS_WORK_WITH_SETEUID | |
41b2f314 | 118 | debug("restore_uid: %u/%u", (u_int)saved_euid, (u_int)saved_egid); |
3c0ef626 | 119 | /* Set the effective uid back to the saved privileged uid. */ |
120 | if (seteuid(saved_euid) < 0) | |
f5799ae1 | 121 | fatal("seteuid %u: %.100s", (u_int)saved_euid, strerror(errno)); |
3c0ef626 | 122 | if (setegid(saved_egid) < 0) |
f5799ae1 | 123 | fatal("setegid %u: %.100s", (u_int)saved_egid, strerror(errno)); |
3c0ef626 | 124 | #else /* SAVED_IDS_WORK_WITH_SETEUID */ |
125 | /* | |
126 | * We are unable to restore the real uid to its unprivileged value. | |
127 | * Propagate the real uid (usually more privileged) to effective uid | |
128 | * as well. | |
129 | */ | |
130 | setuid(getuid()); | |
131 | setgid(getgid()); | |
132 | #endif /* SAVED_IDS_WORK_WITH_SETEUID */ | |
133 | ||
3c0ef626 | 134 | if (setgroups(saved_egroupslen, saved_egroups) < 0) |
135 | fatal("setgroups: %.100s", strerror(errno)); | |
3c0ef626 | 136 | temporarily_use_uid_effective = 0; |
137 | } | |
138 | ||
139 | /* | |
140 | * Permanently sets all uids to the given uid. This cannot be | |
141 | * called while temporarily_use_uid is effective. | |
142 | */ | |
143 | void | |
144 | permanently_set_uid(struct passwd *pw) | |
145 | { | |
0fff78ff | 146 | uid_t old_uid = getuid(); |
147 | gid_t old_gid = getgid(); | |
148 | ||
3c0ef626 | 149 | if (temporarily_use_uid_effective) |
f5799ae1 | 150 | fatal("permanently_set_uid: temporarily_use_uid effective"); |
41b2f314 | 151 | debug("permanently_set_uid: %u/%u", (u_int)pw->pw_uid, |
152 | (u_int)pw->pw_gid); | |
0fff78ff | 153 | |
9cb1827b | 154 | #if defined(HAVE_SETRESGID) |
0fff78ff | 155 | if (setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) < 0) |
156 | fatal("setresgid %u: %.100s", (u_int)pw->pw_gid, strerror(errno)); | |
157 | #elif defined(HAVE_SETREGID) && !defined(BROKEN_SETREGID) | |
158 | if (setregid(pw->pw_gid, pw->pw_gid) < 0) | |
159 | fatal("setregid %u: %.100s", (u_int)pw->pw_gid, strerror(errno)); | |
160 | #else | |
161 | if (setegid(pw->pw_gid) < 0) | |
162 | fatal("setegid %u: %.100s", (u_int)pw->pw_gid, strerror(errno)); | |
3c0ef626 | 163 | if (setgid(pw->pw_gid) < 0) |
f5799ae1 | 164 | fatal("setgid %u: %.100s", (u_int)pw->pw_gid, strerror(errno)); |
0fff78ff | 165 | #endif |
166 | ||
9cb1827b | 167 | #if defined(HAVE_SETRESUID) |
0fff78ff | 168 | if (setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid) < 0) |
169 | fatal("setresuid %u: %.100s", (u_int)pw->pw_uid, strerror(errno)); | |
170 | #elif defined(HAVE_SETREUID) && !defined(BROKEN_SETREUID) | |
171 | if (setreuid(pw->pw_uid, pw->pw_uid) < 0) | |
172 | fatal("setreuid %u: %.100s", (u_int)pw->pw_uid, strerror(errno)); | |
173 | #else | |
174 | # ifndef SETEUID_BREAKS_SETUID | |
175 | if (seteuid(pw->pw_uid) < 0) | |
176 | fatal("seteuid %u: %.100s", (u_int)pw->pw_uid, strerror(errno)); | |
177 | # endif | |
3c0ef626 | 178 | if (setuid(pw->pw_uid) < 0) |
f5799ae1 | 179 | fatal("setuid %u: %.100s", (u_int)pw->pw_uid, strerror(errno)); |
0fff78ff | 180 | #endif |
181 | ||
182 | /* Try restoration of GID if changed (test clearing of saved gid) */ | |
9cb1827b | 183 | if (old_gid != pw->pw_gid && |
0fff78ff | 184 | (setgid(old_gid) != -1 || setegid(old_gid) != -1)) |
185 | fatal("%s: was able to restore old [e]gid", __func__); | |
186 | ||
187 | /* Verify GID drop was successful */ | |
188 | if (getgid() != pw->pw_gid || getegid() != pw->pw_gid) { | |
9cb1827b | 189 | fatal("%s: egid incorrect gid:%u egid:%u (should be %u)", |
190 | __func__, (u_int)getgid(), (u_int)getegid(), | |
0fff78ff | 191 | (u_int)pw->pw_gid); |
192 | } | |
193 | ||
acc3d05e | 194 | #ifndef HAVE_CYGWIN |
0fff78ff | 195 | /* Try restoration of UID if changed (test clearing of saved uid) */ |
9cb1827b | 196 | if (old_uid != pw->pw_uid && |
0fff78ff | 197 | (setuid(old_uid) != -1 || seteuid(old_uid) != -1)) |
198 | fatal("%s: was able to restore old [e]uid", __func__); | |
acc3d05e | 199 | #endif |
0fff78ff | 200 | |
201 | /* Verify UID drop was successful */ | |
202 | if (getuid() != pw->pw_uid || geteuid() != pw->pw_uid) { | |
9cb1827b | 203 | fatal("%s: euid incorrect uid:%u euid:%u (should be %u)", |
204 | __func__, (u_int)getuid(), (u_int)geteuid(), | |
0fff78ff | 205 | (u_int)pw->pw_uid); |
206 | } | |
3c0ef626 | 207 | } |