]>
Commit | Line | Data |
---|---|---|
1 | /* $OpenBSD: uidswap.c,v 1.35 2006/08/03 03:34:42 deraadt Exp $ */ | |
2 | /* | |
3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | |
4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | |
5 | * All rights reserved | |
6 | * Code for uid-swapping. | |
7 | * | |
8 | * As far as I am concerned, the code I have written for this software | |
9 | * can be used freely for any purpose. Any derived versions of this | |
10 | * software must be clearly marked as such, and if the derived work is | |
11 | * incompatible with the protocol description in the RFC file, it must be | |
12 | * called by a name other than "ssh" or "Secure Shell". | |
13 | */ | |
14 | ||
15 | #include "includes.h" | |
16 | ||
17 | #include <sys/param.h> | |
18 | #include <errno.h> | |
19 | #include <pwd.h> | |
20 | #include <string.h> | |
21 | #include <unistd.h> | |
22 | #include <stdarg.h> | |
23 | ||
24 | #include <grp.h> | |
25 | ||
26 | #include "log.h" | |
27 | #include "uidswap.h" | |
28 | #include "xmalloc.h" | |
29 | ||
30 | /* | |
31 | * Note: all these functions must work in all of the following cases: | |
32 | * 1. euid=0, ruid=0 | |
33 | * 2. euid=0, ruid!=0 | |
34 | * 3. euid!=0, ruid!=0 | |
35 | * Additionally, they must work regardless of whether the system has | |
36 | * POSIX saved uids or not. | |
37 | */ | |
38 | ||
39 | #if defined(_POSIX_SAVED_IDS) && !defined(BROKEN_SAVED_UIDS) | |
40 | /* Lets assume that posix saved ids also work with seteuid, even though that | |
41 | is not part of the posix specification. */ | |
42 | #define SAVED_IDS_WORK_WITH_SETEUID | |
43 | /* Saved effective uid. */ | |
44 | static uid_t saved_euid = 0; | |
45 | static gid_t saved_egid = 0; | |
46 | #endif | |
47 | ||
48 | /* Saved effective uid. */ | |
49 | static int privileged = 0; | |
50 | static int temporarily_use_uid_effective = 0; | |
51 | static gid_t *saved_egroups = NULL, *user_groups = NULL; | |
52 | static int saved_egroupslen = -1, user_groupslen = -1; | |
53 | ||
54 | /* | |
55 | * Temporarily changes to the given uid. If the effective user | |
56 | * id is not root, this does nothing. This call cannot be nested. | |
57 | */ | |
58 | void | |
59 | temporarily_use_uid(struct passwd *pw) | |
60 | { | |
61 | /* Save the current euid, and egroups. */ | |
62 | #ifdef SAVED_IDS_WORK_WITH_SETEUID | |
63 | saved_euid = geteuid(); | |
64 | saved_egid = getegid(); | |
65 | debug("temporarily_use_uid: %u/%u (e=%u/%u)", | |
66 | (u_int)pw->pw_uid, (u_int)pw->pw_gid, | |
67 | (u_int)saved_euid, (u_int)saved_egid); | |
68 | #ifndef HAVE_CYGWIN | |
69 | if (saved_euid != 0) { | |
70 | privileged = 0; | |
71 | return; | |
72 | } | |
73 | #endif | |
74 | #else | |
75 | if (geteuid() != 0) { | |
76 | privileged = 0; | |
77 | return; | |
78 | } | |
79 | #endif /* SAVED_IDS_WORK_WITH_SETEUID */ | |
80 | ||
81 | privileged = 1; | |
82 | temporarily_use_uid_effective = 1; | |
83 | ||
84 | saved_egroupslen = getgroups(0, NULL); | |
85 | if (saved_egroupslen < 0) | |
86 | fatal("getgroups: %.100s", strerror(errno)); | |
87 | if (saved_egroupslen > 0) { | |
88 | saved_egroups = xrealloc(saved_egroups, | |
89 | saved_egroupslen, sizeof(gid_t)); | |
90 | if (getgroups(saved_egroupslen, saved_egroups) < 0) | |
91 | fatal("getgroups: %.100s", strerror(errno)); | |
92 | } else { /* saved_egroupslen == 0 */ | |
93 | if (saved_egroups != NULL) | |
94 | xfree(saved_egroups); | |
95 | } | |
96 | ||
97 | /* set and save the user's groups */ | |
98 | if (user_groupslen == -1) { | |
99 | if (initgroups(pw->pw_name, pw->pw_gid) < 0) | |
100 | fatal("initgroups: %s: %.100s", pw->pw_name, | |
101 | strerror(errno)); | |
102 | ||
103 | user_groupslen = getgroups(0, NULL); | |
104 | if (user_groupslen < 0) | |
105 | fatal("getgroups: %.100s", strerror(errno)); | |
106 | if (user_groupslen > 0) { | |
107 | user_groups = xrealloc(user_groups, | |
108 | user_groupslen, sizeof(gid_t)); | |
109 | if (getgroups(user_groupslen, user_groups) < 0) | |
110 | fatal("getgroups: %.100s", strerror(errno)); | |
111 | } else { /* user_groupslen == 0 */ | |
112 | if (user_groups) | |
113 | xfree(user_groups); | |
114 | } | |
115 | } | |
116 | /* Set the effective uid to the given (unprivileged) uid. */ | |
117 | if (setgroups(user_groupslen, user_groups) < 0) | |
118 | fatal("setgroups: %.100s", strerror(errno)); | |
119 | #ifndef SAVED_IDS_WORK_WITH_SETEUID | |
120 | /* Propagate the privileged gid to all of our gids. */ | |
121 | if (setgid(getegid()) < 0) | |
122 | debug("setgid %u: %.100s", (u_int) getegid(), strerror(errno)); | |
123 | /* Propagate the privileged uid to all of our uids. */ | |
124 | if (setuid(geteuid()) < 0) | |
125 | debug("setuid %u: %.100s", (u_int) geteuid(), strerror(errno)); | |
126 | #endif /* SAVED_IDS_WORK_WITH_SETEUID */ | |
127 | if (setegid(pw->pw_gid) < 0) | |
128 | fatal("setegid %u: %.100s", (u_int)pw->pw_gid, | |
129 | strerror(errno)); | |
130 | if (seteuid(pw->pw_uid) == -1) | |
131 | fatal("seteuid %u: %.100s", (u_int)pw->pw_uid, | |
132 | strerror(errno)); | |
133 | } | |
134 | ||
135 | void | |
136 | permanently_drop_suid(uid_t uid) | |
137 | { | |
138 | uid_t old_uid = getuid(); | |
139 | ||
140 | debug("permanently_drop_suid: %u", (u_int)uid); | |
141 | #if defined(HAVE_SETRESUID) && !defined(BROKEN_SETRESUID) | |
142 | if (setresuid(uid, uid, uid) < 0) | |
143 | fatal("setresuid %u: %.100s", (u_int)uid, strerror(errno)); | |
144 | #elif defined(HAVE_SETREUID) && !defined(BROKEN_SETREUID) | |
145 | if (setreuid(uid, uid) < 0) | |
146 | fatal("setreuid %u: %.100s", (u_int)uid, strerror(errno)); | |
147 | #else | |
148 | # ifndef SETEUID_BREAKS_SETUID | |
149 | if (seteuid(uid) < 0) | |
150 | fatal("seteuid %u: %.100s", (u_int)uid, strerror(errno)); | |
151 | # endif | |
152 | if (setuid(uid) < 0) | |
153 | fatal("setuid %u: %.100s", (u_int)uid, strerror(errno)); | |
154 | #endif | |
155 | ||
156 | #ifndef HAVE_CYGWIN | |
157 | /* Try restoration of UID if changed (test clearing of saved uid) */ | |
158 | if (old_uid != uid && | |
159 | (setuid(old_uid) != -1 || seteuid(old_uid) != -1)) | |
160 | fatal("%s: was able to restore old [e]uid", __func__); | |
161 | #endif | |
162 | ||
163 | /* Verify UID drop was successful */ | |
164 | if (getuid() != uid || geteuid() != uid) { | |
165 | fatal("%s: euid incorrect uid:%u euid:%u (should be %u)", | |
166 | __func__, (u_int)getuid(), (u_int)geteuid(), (u_int)uid); | |
167 | } | |
168 | } | |
169 | ||
170 | /* | |
171 | * Restores to the original (privileged) uid. | |
172 | */ | |
173 | void | |
174 | restore_uid(void) | |
175 | { | |
176 | /* it's a no-op unless privileged */ | |
177 | if (!privileged) { | |
178 | debug("restore_uid: (unprivileged)"); | |
179 | return; | |
180 | } | |
181 | if (!temporarily_use_uid_effective) | |
182 | fatal("restore_uid: temporarily_use_uid not effective"); | |
183 | ||
184 | #ifdef SAVED_IDS_WORK_WITH_SETEUID | |
185 | debug("restore_uid: %u/%u", (u_int)saved_euid, (u_int)saved_egid); | |
186 | /* Set the effective uid back to the saved privileged uid. */ | |
187 | if (seteuid(saved_euid) < 0) | |
188 | fatal("seteuid %u: %.100s", (u_int)saved_euid, strerror(errno)); | |
189 | if (setegid(saved_egid) < 0) | |
190 | fatal("setegid %u: %.100s", (u_int)saved_egid, strerror(errno)); | |
191 | #else /* SAVED_IDS_WORK_WITH_SETEUID */ | |
192 | /* | |
193 | * We are unable to restore the real uid to its unprivileged value. | |
194 | * Propagate the real uid (usually more privileged) to effective uid | |
195 | * as well. | |
196 | */ | |
197 | setuid(getuid()); | |
198 | setgid(getgid()); | |
199 | #endif /* SAVED_IDS_WORK_WITH_SETEUID */ | |
200 | ||
201 | if (setgroups(saved_egroupslen, saved_egroups) < 0) | |
202 | fatal("setgroups: %.100s", strerror(errno)); | |
203 | temporarily_use_uid_effective = 0; | |
204 | } | |
205 | ||
206 | /* | |
207 | * Permanently sets all uids to the given uid. This cannot be | |
208 | * called while temporarily_use_uid is effective. | |
209 | */ | |
210 | void | |
211 | permanently_set_uid(struct passwd *pw) | |
212 | { | |
213 | uid_t old_uid = getuid(); | |
214 | gid_t old_gid = getgid(); | |
215 | ||
216 | if (pw == NULL) | |
217 | fatal("permanently_set_uid: no user given"); | |
218 | if (temporarily_use_uid_effective) | |
219 | fatal("permanently_set_uid: temporarily_use_uid effective"); | |
220 | debug("permanently_set_uid: %u/%u", (u_int)pw->pw_uid, | |
221 | (u_int)pw->pw_gid); | |
222 | ||
223 | #if defined(HAVE_SETRESGID) && !defined(BROKEN_SETRESGID) | |
224 | if (setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) < 0) | |
225 | fatal("setresgid %u: %.100s", (u_int)pw->pw_gid, strerror(errno)); | |
226 | #elif defined(HAVE_SETREGID) && !defined(BROKEN_SETREGID) | |
227 | if (setregid(pw->pw_gid, pw->pw_gid) < 0) | |
228 | fatal("setregid %u: %.100s", (u_int)pw->pw_gid, strerror(errno)); | |
229 | #else | |
230 | if (setegid(pw->pw_gid) < 0) | |
231 | fatal("setegid %u: %.100s", (u_int)pw->pw_gid, strerror(errno)); | |
232 | if (setgid(pw->pw_gid) < 0) | |
233 | fatal("setgid %u: %.100s", (u_int)pw->pw_gid, strerror(errno)); | |
234 | #endif | |
235 | ||
236 | #ifdef __APPLE__ | |
237 | /* | |
238 | * OS X requires initgroups after setgid to opt back into | |
239 | * memberd support for >16 supplemental groups. | |
240 | */ | |
241 | if (initgroups(pw->pw_name, pw->pw_gid) < 0) | |
242 | fatal("initgroups %.100s %u: %.100s", | |
243 | pw->pw_name, (u_int)pw->pw_gid, strerror(errno)); | |
244 | #endif | |
245 | ||
246 | #if defined(HAVE_SETRESUID) && !defined(BROKEN_SETRESUID) | |
247 | if (setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid) < 0) | |
248 | fatal("setresuid %u: %.100s", (u_int)pw->pw_uid, strerror(errno)); | |
249 | #elif defined(HAVE_SETREUID) && !defined(BROKEN_SETREUID) | |
250 | if (setreuid(pw->pw_uid, pw->pw_uid) < 0) | |
251 | fatal("setreuid %u: %.100s", (u_int)pw->pw_uid, strerror(errno)); | |
252 | #else | |
253 | # ifndef SETEUID_BREAKS_SETUID | |
254 | if (seteuid(pw->pw_uid) < 0) | |
255 | fatal("seteuid %u: %.100s", (u_int)pw->pw_uid, strerror(errno)); | |
256 | # endif | |
257 | if (setuid(pw->pw_uid) < 0) | |
258 | fatal("setuid %u: %.100s", (u_int)pw->pw_uid, strerror(errno)); | |
259 | #endif | |
260 | ||
261 | #ifndef HAVE_CYGWIN | |
262 | /* Try restoration of GID if changed (test clearing of saved gid) */ | |
263 | if (old_gid != pw->pw_gid && pw->pw_uid != 0 && | |
264 | (setgid(old_gid) != -1 || setegid(old_gid) != -1)) | |
265 | fatal("%s: was able to restore old [e]gid", __func__); | |
266 | #endif | |
267 | ||
268 | /* Verify GID drop was successful */ | |
269 | if (getgid() != pw->pw_gid || getegid() != pw->pw_gid) { | |
270 | fatal("%s: egid incorrect gid:%u egid:%u (should be %u)", | |
271 | __func__, (u_int)getgid(), (u_int)getegid(), | |
272 | (u_int)pw->pw_gid); | |
273 | } | |
274 | ||
275 | #ifndef HAVE_CYGWIN | |
276 | /* Try restoration of UID if changed (test clearing of saved uid) */ | |
277 | if (old_uid != pw->pw_uid && | |
278 | (setuid(old_uid) != -1 || seteuid(old_uid) != -1)) | |
279 | fatal("%s: was able to restore old [e]uid", __func__); | |
280 | #endif | |
281 | ||
282 | /* Verify UID drop was successful */ | |
283 | if (getuid() != pw->pw_uid || geteuid() != pw->pw_uid) { | |
284 | fatal("%s: euid incorrect uid:%u euid:%u (should be %u)", | |
285 | __func__, (u_int)getuid(), (u_int)geteuid(), | |
286 | (u_int)pw->pw_uid); | |
287 | } | |
288 | } |