1 /* getpeereid.c */ 2 /* $OpenLDAP: pkg/ldap/libraries/liblutil/getpeereid.c,v 1.24.2.4 2008/07/15 18:29:53 quanah Exp $ */ 3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>. 4 * 5 * Copyright 2000-2008 The OpenLDAP Foundation. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted only as authorized by the OpenLDAP 10 * Public License. 11 * 12 * A copy of this license is available in the file LICENSE in the 13 * top-level directory of the distribution or, alternatively, at 14 * <http://www.OpenLDAP.org/license.html>. 15 */ 16 17 #include "portable.h" 18 19 #ifndef HAVE_GETPEEREID 20 21 #include <sys/types.h> 22 #include <ac/unistd.h> 23 24 #include <ac/socket.h> 25 #include <ac/errno.h> 26 27 #ifdef HAVE_GETPEERUCRED 28 #include <ucred.h> 29 #endif 30 31 #ifdef LDAP_PF_LOCAL_SENDMSG 32 #include <lber.h> 33 #ifdef HAVE_SYS_UIO_H 34 #include <sys/uio.h> 35 #endif 36 #include <sys/stat.h> 37 #endif 38 39 #ifdef HAVE_SYS_UCRED_H 40 #ifdef HAVE_GRP_H 41 #include <grp.h> /* for NGROUPS on Tru64 5.1 */ 42 #endif 43 #include <sys/ucred.h> 44 #endif 45 46 #include <stdlib.h> 47 48 int lutil_getpeereid( int s, uid_t *euid, gid_t *egid 49 #ifdef LDAP_PF_LOCAL_SENDMSG 50 , struct berval *peerbv 51 #endif 52 ) 53 { 54 #ifdef LDAP_PF_LOCAL 55 #if defined( HAVE_GETPEERUCRED ) 56 ucred_t *uc = NULL; 57 if( getpeerucred( s, &uc ) == 0 ) { 58 *euid = ucred_geteuid( uc ); 59 *egid = ucred_getegid( uc ); 60 ucred_free( uc ); 61 return 0; 62 } 63 64 #elif defined( SO_PEERCRED ) 65 struct ucred peercred; 66 ber_socklen_t peercredlen = sizeof peercred; 67 68 if(( getsockopt( s, SOL_SOCKET, SO_PEERCRED, 69 (void *)&peercred, &peercredlen ) == 0 ) 70 && ( peercredlen == sizeof peercred )) 71 { 72 *euid = peercred.uid; 73 *egid = peercred.gid; 74 return 0; 75 } 76 77 #elif defined( LOCAL_PEERCRED ) 78 struct xucred peercred; 79 ber_socklen_t peercredlen = sizeof peercred; 80 81 if(( getsockopt( s, LOCAL_PEERCRED, 1, 82 (void *)&peercred, &peercredlen ) == 0 ) 83 && ( peercred.cr_version == XUCRED_VERSION )) 84 { 85 *euid = peercred.cr_uid; 86 *egid = peercred.cr_gid; 87 return 0; 88 } 89 #elif defined( LDAP_PF_LOCAL_SENDMSG ) && defined( MSG_WAITALL ) 90 int err, fd; 91 struct iovec iov; 92 struct msghdr msg = {0}; 93 # ifdef HAVE_STRUCT_MSGHDR_MSG_CONTROL 94 # ifndef CMSG_SPACE 95 # define CMSG_SPACE(len) (_CMSG_ALIGN(sizeof(struct cmsghdr)) + _CMSG_ALIGN(len)) 96 # endif 97 # ifndef CMSG_LEN 98 # define CMSG_LEN(len) (_CMSG_ALIGN(sizeof(struct cmsghdr)) + (len)) 99 # endif 100 struct { 101 struct cmsghdr cm; 102 int fd; 103 } control_st; 104 struct cmsghdr *cmsg; 105 # endif /* HAVE_STRUCT_MSGHDR_MSG_CONTROL */ 106 struct stat st; 107 struct sockaddr_un lname, rname; 108 ber_socklen_t llen, rlen; 109 110 rlen = sizeof(rname); 111 llen = sizeof(lname); 112 memset( &lname, 0, sizeof( lname )); 113 getsockname(s, (struct sockaddr *)&lname, &llen); 114 115 iov.iov_base = peerbv->bv_val; 116 iov.iov_len = peerbv->bv_len; 117 msg.msg_iov = &iov; 118 msg.msg_iovlen = 1; 119 peerbv->bv_len = 0; 120 121 # ifdef HAVE_STRUCT_MSGHDR_MSG_CONTROL 122 msg.msg_control = &control_st; 123 msg.msg_controllen = sizeof( struct cmsghdr ) + sizeof( int ); /* no padding! */ 124 125 cmsg = CMSG_FIRSTHDR( &msg ); 126 # else 127 msg.msg_accrights = (char *)&fd; 128 msg.msg_accrightslen = sizeof(fd); 129 # endif 130 131 /* 132 * AIX returns a bogus file descriptor if recvmsg() is 133 * called with MSG_PEEK (is this a bug?). Hence we need 134 * to receive the Abandon PDU. 135 */ 136 err = recvmsg( s, &msg, MSG_WAITALL ); 137 if( err >= 0 && 138 # ifdef HAVE_STRUCT_MSGHDR_MSG_CONTROL 139 cmsg->cmsg_len == CMSG_LEN( sizeof(int) ) && 140 cmsg->cmsg_level == SOL_SOCKET && 141 cmsg->cmsg_type == SCM_RIGHTS 142 # else 143 msg.msg_accrightslen == sizeof(int) 144 # endif /* HAVE_STRUCT_MSGHDR_MSG_CONTROL*/ 145 ) { 146 int mode = S_IFIFO|S_ISUID|S_IRWXU; 147 148 /* We must receive a valid descriptor, it must be a pipe, 149 * it must only be accessible by its owner, and it must 150 * have the name of our socket written on it. 151 */ 152 peerbv->bv_len = err; 153 # ifdef HAVE_STRUCT_MSGHDR_MSG_CONTROL 154 fd = (*(int *)CMSG_DATA( cmsg )); 155 # endif 156 err = fstat( fd, &st ); 157 if ( err == 0 ) 158 rlen = read(fd, &rname, rlen); 159 close(fd); 160 if( err == 0 && st.st_mode == mode && 161 llen == rlen && !memcmp(&lname, &rname, llen)) 162 { 163 *euid = st.st_uid; 164 *egid = st.st_gid; 165 return 0; 166 } 167 } 168 #elif defined(SOCKCREDSIZE) 169 struct msghdr msg; 170 ber_socklen_t crmsgsize; 171 void *crmsg; 172 struct cmsghdr *cmp; 173 struct sockcred *sc; 174 175 memset(&msg, 0, sizeof msg); 176 crmsgsize = CMSG_SPACE(SOCKCREDSIZE(NGROUPS)); 177 if (crmsgsize == 0) goto sc_err; 178 crmsg = malloc(crmsgsize); 179 if (crmsg == NULL) goto sc_err; 180 memset(crmsg, 0, crmsgsize); 181 182 msg.msg_control = crmsg; 183 msg.msg_controllen = crmsgsize; 184 185 if (recvmsg(s, &msg, 0) < 0) { 186 free(crmsg); 187 goto sc_err; 188 } 189 190 if (msg.msg_controllen == 0 || (msg.msg_flags & MSG_CTRUNC) != 0) { 191 free(crmsg); 192 goto sc_err; 193 } 194 195 cmp = CMSG_FIRSTHDR(&msg); 196 if (cmp->cmsg_level != SOL_SOCKET || cmp->cmsg_type != SCM_CREDS) { 197 printf("nocreds\n"); 198 goto sc_err; 199 } 200 201 sc = (struct sockcred *)(void *)CMSG_DATA(cmp); 202 203 *euid = sc->sc_euid; 204 *egid = sc->sc_egid; 205 206 free(crmsg); 207 return 0; 208 209 sc_err: 210 #endif 211 #endif /* LDAP_PF_LOCAL */ 212 213 return -1; 214 } 215 216 #endif /* HAVE_GETPEEREID */ 217