1*10b5fe87SSascha Wildner /*-
2*10b5fe87SSascha Wildner * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
3*10b5fe87SSascha Wildner * Copyright (c) 2004-2011 Dag-Erling Smørgrav
4*10b5fe87SSascha Wildner * All rights reserved.
5*10b5fe87SSascha Wildner *
6*10b5fe87SSascha Wildner * This software was developed for the FreeBSD Project by ThinkSec AS and
7*10b5fe87SSascha Wildner * Network Associates Laboratories, the Security Research Division of
8*10b5fe87SSascha Wildner * Network Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035
9*10b5fe87SSascha Wildner * ("CBOSS"), as part of the DARPA CHATS research program.
10*10b5fe87SSascha Wildner *
11*10b5fe87SSascha Wildner * Redistribution and use in source and binary forms, with or without
12*10b5fe87SSascha Wildner * modification, are permitted provided that the following conditions
13*10b5fe87SSascha Wildner * are met:
14*10b5fe87SSascha Wildner * 1. Redistributions of source code must retain the above copyright
15*10b5fe87SSascha Wildner * notice, this list of conditions and the following disclaimer.
16*10b5fe87SSascha Wildner * 2. Redistributions in binary form must reproduce the above copyright
17*10b5fe87SSascha Wildner * notice, this list of conditions and the following disclaimer in the
18*10b5fe87SSascha Wildner * documentation and/or other materials provided with the distribution.
19*10b5fe87SSascha Wildner * 3. The name of the author may not be used to endorse or promote
20*10b5fe87SSascha Wildner * products derived from this software without specific prior written
21*10b5fe87SSascha Wildner * permission.
22*10b5fe87SSascha Wildner *
23*10b5fe87SSascha Wildner * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
24*10b5fe87SSascha Wildner * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25*10b5fe87SSascha Wildner * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26*10b5fe87SSascha Wildner * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
27*10b5fe87SSascha Wildner * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28*10b5fe87SSascha Wildner * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29*10b5fe87SSascha Wildner * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30*10b5fe87SSascha Wildner * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31*10b5fe87SSascha Wildner * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32*10b5fe87SSascha Wildner * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33*10b5fe87SSascha Wildner * SUCH DAMAGE.
34*10b5fe87SSascha Wildner *
35*10b5fe87SSascha Wildner * $OpenPAM: openpam_restore_cred.c 938 2017-04-30 21:34:42Z des $
36*10b5fe87SSascha Wildner */
37*10b5fe87SSascha Wildner
38*10b5fe87SSascha Wildner #ifdef HAVE_CONFIG_H
39*10b5fe87SSascha Wildner # include "config.h"
40*10b5fe87SSascha Wildner #endif
41*10b5fe87SSascha Wildner
42*10b5fe87SSascha Wildner #include <sys/param.h>
43*10b5fe87SSascha Wildner
44*10b5fe87SSascha Wildner #include <grp.h>
45*10b5fe87SSascha Wildner #include <limits.h>
46*10b5fe87SSascha Wildner #include <pwd.h>
47*10b5fe87SSascha Wildner #include <stdlib.h>
48*10b5fe87SSascha Wildner #include <unistd.h>
49*10b5fe87SSascha Wildner
50*10b5fe87SSascha Wildner #include <security/pam_appl.h>
51*10b5fe87SSascha Wildner
52*10b5fe87SSascha Wildner #include "openpam_impl.h"
53*10b5fe87SSascha Wildner #include "openpam_cred.h"
54*10b5fe87SSascha Wildner
55*10b5fe87SSascha Wildner /*
56*10b5fe87SSascha Wildner * OpenPAM extension
57*10b5fe87SSascha Wildner *
58*10b5fe87SSascha Wildner * Restore credentials
59*10b5fe87SSascha Wildner */
60*10b5fe87SSascha Wildner
61*10b5fe87SSascha Wildner int
openpam_restore_cred(pam_handle_t * pamh)62*10b5fe87SSascha Wildner openpam_restore_cred(pam_handle_t *pamh)
63*10b5fe87SSascha Wildner {
64*10b5fe87SSascha Wildner const struct pam_saved_cred *scred;
65*10b5fe87SSascha Wildner const void *scredp;
66*10b5fe87SSascha Wildner int r;
67*10b5fe87SSascha Wildner
68*10b5fe87SSascha Wildner ENTER();
69*10b5fe87SSascha Wildner r = pam_get_data(pamh, PAM_SAVED_CRED, &scredp);
70*10b5fe87SSascha Wildner if (r != PAM_SUCCESS)
71*10b5fe87SSascha Wildner RETURNC(r);
72*10b5fe87SSascha Wildner if (scredp == NULL)
73*10b5fe87SSascha Wildner RETURNC(PAM_SYSTEM_ERR);
74*10b5fe87SSascha Wildner scred = scredp;
75*10b5fe87SSascha Wildner if (scred->euid != geteuid()) {
76*10b5fe87SSascha Wildner if (seteuid(scred->euid) < 0 ||
77*10b5fe87SSascha Wildner setgroups(scred->ngroups, scred->groups) < 0 ||
78*10b5fe87SSascha Wildner setegid(scred->egid) < 0)
79*10b5fe87SSascha Wildner RETURNC(PAM_SYSTEM_ERR);
80*10b5fe87SSascha Wildner }
81*10b5fe87SSascha Wildner pam_set_data(pamh, PAM_SAVED_CRED, NULL, NULL);
82*10b5fe87SSascha Wildner RETURNC(PAM_SUCCESS);
83*10b5fe87SSascha Wildner }
84*10b5fe87SSascha Wildner
85*10b5fe87SSascha Wildner /*
86*10b5fe87SSascha Wildner * Error codes:
87*10b5fe87SSascha Wildner *
88*10b5fe87SSascha Wildner * =pam_get_data
89*10b5fe87SSascha Wildner * PAM_SYSTEM_ERR
90*10b5fe87SSascha Wildner */
91*10b5fe87SSascha Wildner
92*10b5fe87SSascha Wildner /**
93*10b5fe87SSascha Wildner * The =openpam_restore_cred function restores the credentials saved by
94*10b5fe87SSascha Wildner * =openpam_borrow_cred.
95*10b5fe87SSascha Wildner *
96*10b5fe87SSascha Wildner * >setegid 2
97*10b5fe87SSascha Wildner * >seteuid 2
98*10b5fe87SSascha Wildner * >setgroups 2
99*10b5fe87SSascha Wildner */
100