]>
Commit | Line | Data |
---|---|---|
536c14e8 | 1 | /* $OpenBSD: uidswap.c,v 1.34 2006/07/26 02:35:17 stevesk Exp $ */ |
8efc0c15 | 2 | /* |
5260325f | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | |
5 | * All rights reserved | |
5260325f | 6 | * Code for uid-swapping. |
bcbf86ec | 7 | * |
8 | * As far as I am concerned, the code I have written for this software | |
9 | * can be used freely for any purpose. Any derived versions of this | |
10 | * software must be clearly marked as such, and if the derived work is | |
11 | * incompatible with the protocol description in the RFC file, it must be | |
12 | * called by a name other than "ssh" or "Secure Shell". | |
5260325f | 13 | */ |
8efc0c15 | 14 | |
15 | #include "includes.h" | |
8efc0c15 | 16 | |
b1842393 | 17 | #include <sys/types.h> |
536c14e8 | 18 | #include <sys/param.h> |
b1842393 | 19 | |
028094f4 | 20 | #include <errno.h> |
b1842393 | 21 | #include <pwd.h> |
00146caa | 22 | #include <string.h> |
5188ba17 | 23 | #include <unistd.h> |
b1842393 | 24 | |
16fbe330 | 25 | #include <grp.h> |
26 | ||
42f11eb2 | 27 | #include "log.h" |
8efc0c15 | 28 | #include "uidswap.h" |
13dff404 | 29 | #include "xmalloc.h" |
8efc0c15 | 30 | |
5260325f | 31 | /* |
32 | * Note: all these functions must work in all of the following cases: | |
33 | * 1. euid=0, ruid=0 | |
34 | * 2. euid=0, ruid!=0 | |
35 | * 3. euid!=0, ruid!=0 | |
36 | * Additionally, they must work regardless of whether the system has | |
37 | * POSIX saved uids or not. | |
38 | */ | |
8efc0c15 | 39 | |
0096ac62 | 40 | #if defined(_POSIX_SAVED_IDS) && !defined(BROKEN_SAVED_UIDS) |
8efc0c15 | 41 | /* Lets assume that posix saved ids also work with seteuid, even though that |
42 | is not part of the posix specification. */ | |
0096ac62 | 43 | #define SAVED_IDS_WORK_WITH_SETEUID |
44 | /* Saved effective uid. */ | |
45 | static uid_t saved_euid = 0; | |
46 | static gid_t saved_egid = 0; | |
47 | #endif | |
f8252c48 | 48 | |
8efc0c15 | 49 | /* Saved effective uid. */ |
63bd8c36 | 50 | static int privileged = 0; |
51 | static int temporarily_use_uid_effective = 0; | |
13dff404 | 52 | static gid_t *saved_egroups = NULL, *user_groups = NULL; |
63bd8c36 | 53 | static int saved_egroupslen = -1, user_groupslen = -1; |
f8252c48 | 54 | |
5260325f | 55 | /* |
56 | * Temporarily changes to the given uid. If the effective user | |
57 | * id is not root, this does nothing. This call cannot be nested. | |
58 | */ | |
6ae2364d | 59 | void |
63bd8c36 | 60 | temporarily_use_uid(struct passwd *pw) |
8efc0c15 | 61 | { |
f8252c48 | 62 | /* Save the current euid, and egroups. */ |
0096ac62 | 63 | #ifdef SAVED_IDS_WORK_WITH_SETEUID |
f8252c48 | 64 | saved_euid = geteuid(); |
0096ac62 | 65 | saved_egid = getegid(); |
0df3a240 | 66 | debug("temporarily_use_uid: %u/%u (e=%u/%u)", |
67 | (u_int)pw->pw_uid, (u_int)pw->pw_gid, | |
68 | (u_int)saved_euid, (u_int)saved_egid); | |
c2736f7f | 69 | #ifndef HAVE_CYGWIN |
f8252c48 | 70 | if (saved_euid != 0) { |
71 | privileged = 0; | |
72 | return; | |
73 | } | |
c2736f7f | 74 | #endif |
0096ac62 | 75 | #else |
76 | if (geteuid() != 0) { | |
77 | privileged = 0; | |
78 | return; | |
79 | } | |
80 | #endif /* SAVED_IDS_WORK_WITH_SETEUID */ | |
81 | ||
f8252c48 | 82 | privileged = 1; |
83 | temporarily_use_uid_effective = 1; | |
13dff404 | 84 | |
85 | saved_egroupslen = getgroups(0, NULL); | |
f8252c48 | 86 | if (saved_egroupslen < 0) |
87 | fatal("getgroups: %.100s", strerror(errno)); | |
13dff404 | 88 | if (saved_egroupslen > 0) { |
89 | saved_egroups = xrealloc(saved_egroups, | |
c5d10563 | 90 | saved_egroupslen, sizeof(gid_t)); |
13dff404 | 91 | if (getgroups(saved_egroupslen, saved_egroups) < 0) |
92 | fatal("getgroups: %.100s", strerror(errno)); | |
93 | } else { /* saved_egroupslen == 0 */ | |
972fc531 | 94 | if (saved_egroups != NULL) |
13dff404 | 95 | xfree(saved_egroups); |
96 | } | |
f8252c48 | 97 | |
98 | /* set and save the user's groups */ | |
99 | if (user_groupslen == -1) { | |
100 | if (initgroups(pw->pw_name, pw->pw_gid) < 0) | |
101 | fatal("initgroups: %s: %.100s", pw->pw_name, | |
102 | strerror(errno)); | |
13dff404 | 103 | |
104 | user_groupslen = getgroups(0, NULL); | |
f8252c48 | 105 | if (user_groupslen < 0) |
106 | fatal("getgroups: %.100s", strerror(errno)); | |
13dff404 | 107 | if (user_groupslen > 0) { |
108 | user_groups = xrealloc(user_groups, | |
c5d10563 | 109 | user_groupslen, sizeof(gid_t)); |
13dff404 | 110 | if (getgroups(user_groupslen, user_groups) < 0) |
111 | fatal("getgroups: %.100s", strerror(errno)); | |
112 | } else { /* user_groupslen == 0 */ | |
113 | if (user_groups) | |
114 | xfree(user_groups); | |
115 | } | |
f8252c48 | 116 | } |
117 | /* Set the effective uid to the given (unprivileged) uid. */ | |
d98d029a | 118 | if (setgroups(user_groupslen, user_groups) < 0) |
63bd8c36 | 119 | fatal("setgroups: %.100s", strerror(errno)); |
0096ac62 | 120 | #ifndef SAVED_IDS_WORK_WITH_SETEUID |
121 | /* Propagate the privileged gid to all of our gids. */ | |
122 | if (setgid(getegid()) < 0) | |
123 | debug("setgid %u: %.100s", (u_int) getegid(), strerror(errno)); | |
124 | /* Propagate the privileged uid to all of our uids. */ | |
125 | if (setuid(geteuid()) < 0) | |
126 | debug("setuid %u: %.100s", (u_int) geteuid(), strerror(errno)); | |
127 | #endif /* SAVED_IDS_WORK_WITH_SETEUID */ | |
d98d029a | 128 | if (setegid(pw->pw_gid) < 0) |
caa49784 | 129 | fatal("setegid %u: %.100s", (u_int)pw->pw_gid, |
f8252c48 | 130 | strerror(errno)); |
131 | if (seteuid(pw->pw_uid) == -1) | |
caa49784 | 132 | fatal("seteuid %u: %.100s", (u_int)pw->pw_uid, |
f8252c48 | 133 | strerror(errno)); |
8efc0c15 | 134 | } |
f8252c48 | 135 | |
3c33c1b6 | 136 | void |
137 | permanently_drop_suid(uid_t uid) | |
138 | { | |
139 | uid_t old_uid = getuid(); | |
140 | ||
141 | debug("permanently_drop_suid: %u", (u_int)uid); | |
142 | #if defined(HAVE_SETRESUID) && !defined(BROKEN_SETRESUID) | |
143 | if (setresuid(uid, uid, uid) < 0) | |
144 | fatal("setresuid %u: %.100s", (u_int)uid, strerror(errno)); | |
145 | #elif defined(HAVE_SETREUID) && !defined(BROKEN_SETREUID) | |
146 | if (setreuid(uid, uid) < 0) | |
147 | fatal("setreuid %u: %.100s", (u_int)uid, strerror(errno)); | |
148 | #else | |
149 | # ifndef SETEUID_BREAKS_SETUID | |
150 | if (seteuid(uid) < 0) | |
151 | fatal("seteuid %u: %.100s", (u_int)uid, strerror(errno)); | |
152 | # endif | |
153 | if (setuid(uid) < 0) | |
154 | fatal("setuid %u: %.100s", (u_int)uid, strerror(errno)); | |
155 | #endif | |
156 | ||
157 | #ifndef HAVE_CYGWIN | |
158 | /* Try restoration of UID if changed (test clearing of saved uid) */ | |
159 | if (old_uid != uid && | |
160 | (setuid(old_uid) != -1 || seteuid(old_uid) != -1)) | |
161 | fatal("%s: was able to restore old [e]uid", __func__); | |
162 | #endif | |
163 | ||
164 | /* Verify UID drop was successful */ | |
165 | if (getuid() != uid || geteuid() != uid) { | |
166 | fatal("%s: euid incorrect uid:%u euid:%u (should be %u)", | |
167 | __func__, (u_int)getuid(), (u_int)geteuid(), (u_int)uid); | |
168 | } | |
169 | } | |
170 | ||
5260325f | 171 | /* |
a3626e12 | 172 | * Restores to the original (privileged) uid. |
5260325f | 173 | */ |
6ae2364d | 174 | void |
1e3b8b07 | 175 | restore_uid(void) |
8efc0c15 | 176 | { |
63bd8c36 | 177 | /* it's a no-op unless privileged */ |
0df3a240 | 178 | if (!privileged) { |
179 | debug("restore_uid: (unprivileged)"); | |
63bd8c36 | 180 | return; |
0df3a240 | 181 | } |
63bd8c36 | 182 | if (!temporarily_use_uid_effective) |
183 | fatal("restore_uid: temporarily_use_uid not effective"); | |
0096ac62 | 184 | |
185 | #ifdef SAVED_IDS_WORK_WITH_SETEUID | |
13979d47 | 186 | debug("restore_uid: %u/%u", (u_int)saved_euid, (u_int)saved_egid); |
a3626e12 | 187 | /* Set the effective uid back to the saved privileged uid. */ |
5260325f | 188 | if (seteuid(saved_euid) < 0) |
caa49784 | 189 | fatal("seteuid %u: %.100s", (u_int)saved_euid, strerror(errno)); |
0096ac62 | 190 | if (setegid(saved_egid) < 0) |
caa49784 | 191 | fatal("setegid %u: %.100s", (u_int)saved_egid, strerror(errno)); |
0096ac62 | 192 | #else /* SAVED_IDS_WORK_WITH_SETEUID */ |
193 | /* | |
194 | * We are unable to restore the real uid to its unprivileged value. | |
195 | * Propagate the real uid (usually more privileged) to effective uid | |
196 | * as well. | |
197 | */ | |
198 | setuid(getuid()); | |
199 | setgid(getgid()); | |
200 | #endif /* SAVED_IDS_WORK_WITH_SETEUID */ | |
201 | ||
d98d029a | 202 | if (setgroups(saved_egroupslen, saved_egroups) < 0) |
63bd8c36 | 203 | fatal("setgroups: %.100s", strerror(errno)); |
63bd8c36 | 204 | temporarily_use_uid_effective = 0; |
8efc0c15 | 205 | } |
206 | ||
5260325f | 207 | /* |
208 | * Permanently sets all uids to the given uid. This cannot be | |
209 | * called while temporarily_use_uid is effective. | |
210 | */ | |
6ae2364d | 211 | void |
63bd8c36 | 212 | permanently_set_uid(struct passwd *pw) |
8efc0c15 | 213 | { |
688eed4a | 214 | uid_t old_uid = getuid(); |
215 | gid_t old_gid = getgid(); | |
216 | ||
82aeee5d | 217 | if (pw == NULL) |
218 | fatal("permanently_set_uid: no user given"); | |
63bd8c36 | 219 | if (temporarily_use_uid_effective) |
95f20fe8 | 220 | fatal("permanently_set_uid: temporarily_use_uid effective"); |
0df3a240 | 221 | debug("permanently_set_uid: %u/%u", (u_int)pw->pw_uid, |
222 | (u_int)pw->pw_gid); | |
688eed4a | 223 | |
9a3fe0e2 | 224 | #if defined(HAVE_SETRESGID) && !defined(BROKEN_SETRESGID) |
688eed4a | 225 | if (setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) < 0) |
226 | fatal("setresgid %u: %.100s", (u_int)pw->pw_gid, strerror(errno)); | |
3b8dff69 | 227 | #elif defined(HAVE_SETREGID) && !defined(BROKEN_SETREGID) |
688eed4a | 228 | if (setregid(pw->pw_gid, pw->pw_gid) < 0) |
229 | fatal("setregid %u: %.100s", (u_int)pw->pw_gid, strerror(errno)); | |
230 | #else | |
fa5120a0 | 231 | if (setegid(pw->pw_gid) < 0) |
232 | fatal("setegid %u: %.100s", (u_int)pw->pw_gid, strerror(errno)); | |
63bd8c36 | 233 | if (setgid(pw->pw_gid) < 0) |
caa49784 | 234 | fatal("setgid %u: %.100s", (u_int)pw->pw_gid, strerror(errno)); |
688eed4a | 235 | #endif |
236 | ||
9a3fe0e2 | 237 | #if defined(HAVE_SETRESUID) && !defined(BROKEN_SETRESUID) |
688eed4a | 238 | if (setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid) < 0) |
239 | fatal("setresuid %u: %.100s", (u_int)pw->pw_uid, strerror(errno)); | |
3b8dff69 | 240 | #elif defined(HAVE_SETREUID) && !defined(BROKEN_SETREUID) |
f5db6a03 | 241 | if (setreuid(pw->pw_uid, pw->pw_uid) < 0) |
242 | fatal("setreuid %u: %.100s", (u_int)pw->pw_uid, strerror(errno)); | |
688eed4a | 243 | #else |
244 | # ifndef SETEUID_BREAKS_SETUID | |
fa5120a0 | 245 | if (seteuid(pw->pw_uid) < 0) |
246 | fatal("seteuid %u: %.100s", (u_int)pw->pw_uid, strerror(errno)); | |
688eed4a | 247 | # endif |
a3626e12 | 248 | if (setuid(pw->pw_uid) < 0) |
caa49784 | 249 | fatal("setuid %u: %.100s", (u_int)pw->pw_uid, strerror(errno)); |
688eed4a | 250 | #endif |
251 | ||
8f817407 | 252 | #ifndef HAVE_CYGWIN |
688eed4a | 253 | /* Try restoration of GID if changed (test clearing of saved gid) */ |
8f817407 | 254 | if (old_gid != pw->pw_gid && pw->pw_uid != 0 && |
688eed4a | 255 | (setgid(old_gid) != -1 || setegid(old_gid) != -1)) |
f5db6a03 | 256 | fatal("%s: was able to restore old [e]gid", __func__); |
8f817407 | 257 | #endif |
688eed4a | 258 | |
259 | /* Verify GID drop was successful */ | |
260 | if (getgid() != pw->pw_gid || getegid() != pw->pw_gid) { | |
aff51935 | 261 | fatal("%s: egid incorrect gid:%u egid:%u (should be %u)", |
262 | __func__, (u_int)getgid(), (u_int)getegid(), | |
688eed4a | 263 | (u_int)pw->pw_gid); |
264 | } | |
265 | ||
51e7d820 | 266 | #ifndef HAVE_CYGWIN |
688eed4a | 267 | /* Try restoration of UID if changed (test clearing of saved uid) */ |
aff51935 | 268 | if (old_uid != pw->pw_uid && |
688eed4a | 269 | (setuid(old_uid) != -1 || seteuid(old_uid) != -1)) |
f5db6a03 | 270 | fatal("%s: was able to restore old [e]uid", __func__); |
51e7d820 | 271 | #endif |
688eed4a | 272 | |
273 | /* Verify UID drop was successful */ | |
274 | if (getuid() != pw->pw_uid || geteuid() != pw->pw_uid) { | |
aff51935 | 275 | fatal("%s: euid incorrect uid:%u euid:%u (should be %u)", |
276 | __func__, (u_int)getuid(), (u_int)geteuid(), | |
688eed4a | 277 | (u_int)pw->pw_uid); |
278 | } | |
8efc0c15 | 279 | } |