1*0Sstevel@tonic-gate /* 2*0Sstevel@tonic-gate * Copyright 2004 Sun Microsystems, Inc. All rights reserved. 3*0Sstevel@tonic-gate * Use is subject to license terms. 4*0Sstevel@tonic-gate */ 5*0Sstevel@tonic-gate /* 6*0Sstevel@tonic-gate * Author: Tatu Ylonen <ylo@cs.hut.fi> 7*0Sstevel@tonic-gate * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 8*0Sstevel@tonic-gate * All rights reserved 9*0Sstevel@tonic-gate * Code for uid-swapping. 10*0Sstevel@tonic-gate * 11*0Sstevel@tonic-gate * As far as I am concerned, the code I have written for this software 12*0Sstevel@tonic-gate * can be used freely for any purpose. Any derived versions of this 13*0Sstevel@tonic-gate * software must be clearly marked as such, and if the derived work is 14*0Sstevel@tonic-gate * incompatible with the protocol description in the RFC file, it must be 15*0Sstevel@tonic-gate * called by a name other than "ssh" or "Secure Shell". 16*0Sstevel@tonic-gate */ 17*0Sstevel@tonic-gate 18*0Sstevel@tonic-gate #include "includes.h" 19*0Sstevel@tonic-gate RCSID("$OpenBSD: uidswap.c,v 1.23 2002/07/15 17:15:31 stevesk Exp $"); 20*0Sstevel@tonic-gate 21*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 22*0Sstevel@tonic-gate 23*0Sstevel@tonic-gate #include "log.h" 24*0Sstevel@tonic-gate #include "uidswap.h" 25*0Sstevel@tonic-gate 26*0Sstevel@tonic-gate /* 27*0Sstevel@tonic-gate * Note: all these functions must work in all of the following cases: 28*0Sstevel@tonic-gate * 1. euid=0, ruid=0 29*0Sstevel@tonic-gate * 2. euid=0, ruid!=0 30*0Sstevel@tonic-gate * 3. euid!=0, ruid!=0 31*0Sstevel@tonic-gate * Additionally, they must work regardless of whether the system has 32*0Sstevel@tonic-gate * POSIX saved uids or not. 33*0Sstevel@tonic-gate */ 34*0Sstevel@tonic-gate 35*0Sstevel@tonic-gate #if defined(_POSIX_SAVED_IDS) && !defined(BROKEN_SAVED_UIDS) 36*0Sstevel@tonic-gate /* Lets assume that posix saved ids also work with seteuid, even though that 37*0Sstevel@tonic-gate is not part of the posix specification. */ 38*0Sstevel@tonic-gate #define SAVED_IDS_WORK 39*0Sstevel@tonic-gate /* Saved effective uid. */ 40*0Sstevel@tonic-gate static uid_t saved_euid = 0; 41*0Sstevel@tonic-gate static gid_t saved_egid = 0; 42*0Sstevel@tonic-gate #endif 43*0Sstevel@tonic-gate 44*0Sstevel@tonic-gate /* Saved effective uid. */ 45*0Sstevel@tonic-gate static int privileged = 0; 46*0Sstevel@tonic-gate static int temporarily_use_uid_effective = 0; 47*0Sstevel@tonic-gate static gid_t saved_egroups[NGROUPS_MAX], user_groups[NGROUPS_MAX]; 48*0Sstevel@tonic-gate static int saved_egroupslen = -1, user_groupslen = -1; 49*0Sstevel@tonic-gate 50*0Sstevel@tonic-gate /* 51*0Sstevel@tonic-gate * Temporarily changes to the given uid. If the effective user 52*0Sstevel@tonic-gate * id is not root, this does nothing. This call cannot be nested. 53*0Sstevel@tonic-gate */ 54*0Sstevel@tonic-gate void 55*0Sstevel@tonic-gate temporarily_use_uid(struct passwd *pw) 56*0Sstevel@tonic-gate { 57*0Sstevel@tonic-gate /* Save the current euid, and egroups. */ 58*0Sstevel@tonic-gate #ifdef SAVED_IDS_WORK 59*0Sstevel@tonic-gate saved_euid = geteuid(); 60*0Sstevel@tonic-gate saved_egid = getegid(); 61*0Sstevel@tonic-gate debug("temporarily_use_uid: %u/%u (e=%u/%u)", 62*0Sstevel@tonic-gate (u_int)pw->pw_uid, (u_int)pw->pw_gid, 63*0Sstevel@tonic-gate (u_int)saved_euid, (u_int)saved_egid); 64*0Sstevel@tonic-gate if (saved_euid != 0) { 65*0Sstevel@tonic-gate privileged = 0; 66*0Sstevel@tonic-gate return; 67*0Sstevel@tonic-gate } 68*0Sstevel@tonic-gate #else 69*0Sstevel@tonic-gate if (geteuid() != 0) { 70*0Sstevel@tonic-gate privileged = 0; 71*0Sstevel@tonic-gate return; 72*0Sstevel@tonic-gate } 73*0Sstevel@tonic-gate #endif /* SAVED_IDS_WORK */ 74*0Sstevel@tonic-gate 75*0Sstevel@tonic-gate privileged = 1; 76*0Sstevel@tonic-gate temporarily_use_uid_effective = 1; 77*0Sstevel@tonic-gate saved_egroupslen = getgroups(NGROUPS_MAX, saved_egroups); 78*0Sstevel@tonic-gate if (saved_egroupslen < 0) 79*0Sstevel@tonic-gate fatal("getgroups: %.100s", strerror(errno)); 80*0Sstevel@tonic-gate 81*0Sstevel@tonic-gate /* set and save the user's groups */ 82*0Sstevel@tonic-gate if (user_groupslen == -1) { 83*0Sstevel@tonic-gate if (initgroups(pw->pw_name, pw->pw_gid) < 0) 84*0Sstevel@tonic-gate fatal("initgroups: %s: %.100s", pw->pw_name, 85*0Sstevel@tonic-gate strerror(errno)); 86*0Sstevel@tonic-gate user_groupslen = getgroups(NGROUPS_MAX, user_groups); 87*0Sstevel@tonic-gate if (user_groupslen < 0) 88*0Sstevel@tonic-gate fatal("getgroups: %.100s", strerror(errno)); 89*0Sstevel@tonic-gate } 90*0Sstevel@tonic-gate /* Set the effective uid to the given (unprivileged) uid. */ 91*0Sstevel@tonic-gate if (setgroups(user_groupslen, user_groups) < 0) 92*0Sstevel@tonic-gate fatal("setgroups: %.100s", strerror(errno)); 93*0Sstevel@tonic-gate #ifdef SAVED_IDS_WORK 94*0Sstevel@tonic-gate /* Set saved gid and set real gid */ 95*0Sstevel@tonic-gate if (setregid(pw->pw_gid, -1) == -1) 96*0Sstevel@tonic-gate debug("setregid(%u, -1): %.100s", (uint_t)pw->pw_gid, strerror(errno)); 97*0Sstevel@tonic-gate /* Set saved uid and set real uid */ 98*0Sstevel@tonic-gate if (setreuid(pw->pw_uid, -1) == -1) 99*0Sstevel@tonic-gate debug("setreuid(%u, -1): %.100s", (uint_t)pw->pw_uid, strerror(errno)); 100*0Sstevel@tonic-gate #else 101*0Sstevel@tonic-gate /* Propagate the privileged gid to all of our gids. */ 102*0Sstevel@tonic-gate if (setgid(getegid()) < 0) 103*0Sstevel@tonic-gate debug("setgid %u: %.100s", (u_int) getegid(), strerror(errno)); 104*0Sstevel@tonic-gate /* Propagate the privileged uid to all of our uids. */ 105*0Sstevel@tonic-gate if (setuid(geteuid()) < 0) 106*0Sstevel@tonic-gate debug("setuid %u: %.100s", (u_int) geteuid(), strerror(errno)); 107*0Sstevel@tonic-gate #endif /* SAVED_IDS_WORK */ 108*0Sstevel@tonic-gate /* Set effective gid */ 109*0Sstevel@tonic-gate if (setegid(pw->pw_gid) == -1) 110*0Sstevel@tonic-gate fatal("setegid %u: %.100s", (u_int)pw->pw_uid, 111*0Sstevel@tonic-gate strerror(errno)); 112*0Sstevel@tonic-gate /* Set effective uid */ 113*0Sstevel@tonic-gate if (seteuid(pw->pw_uid) == -1) 114*0Sstevel@tonic-gate fatal("seteuid %u: %.100s", (u_int)pw->pw_uid, 115*0Sstevel@tonic-gate strerror(errno)); 116*0Sstevel@tonic-gate /* 117*0Sstevel@tonic-gate * If saved set ids work then 118*0Sstevel@tonic-gate * 119*0Sstevel@tonic-gate * ruid == euid == pw->pw_uid 120*0Sstevel@tonic-gate * saved uid = previous euid 121*0Sstevel@tonic-gate * rgid == egid == pw->pw_gid 122*0Sstevel@tonic-gate * saved gid = previous egid 123*0Sstevel@tonic-gate */ 124*0Sstevel@tonic-gate } 125*0Sstevel@tonic-gate 126*0Sstevel@tonic-gate /* 127*0Sstevel@tonic-gate * Restores to the original (privileged) uid. 128*0Sstevel@tonic-gate */ 129*0Sstevel@tonic-gate void 130*0Sstevel@tonic-gate restore_uid(void) 131*0Sstevel@tonic-gate { 132*0Sstevel@tonic-gate /* it's a no-op unless privileged */ 133*0Sstevel@tonic-gate if (!privileged) { 134*0Sstevel@tonic-gate debug("restore_uid: (unprivileged)"); 135*0Sstevel@tonic-gate return; 136*0Sstevel@tonic-gate } 137*0Sstevel@tonic-gate if (!temporarily_use_uid_effective) 138*0Sstevel@tonic-gate fatal("restore_uid: temporarily_use_uid not effective"); 139*0Sstevel@tonic-gate 140*0Sstevel@tonic-gate #ifdef SAVED_IDS_WORK 141*0Sstevel@tonic-gate debug("restore_uid: %u/%u", (u_int)saved_euid, (u_int)saved_egid); 142*0Sstevel@tonic-gate /* Set the effective uid back to the saved privileged uid. */ 143*0Sstevel@tonic-gate if (seteuid(saved_euid) < 0) 144*0Sstevel@tonic-gate fatal("seteuid %u: %.100s", (u_int)saved_euid, strerror(errno)); 145*0Sstevel@tonic-gate if (setuid(saved_euid) < 0) 146*0Sstevel@tonic-gate fatal("setuid %u: %.100s", (u_int)saved_euid, strerror(errno)); 147*0Sstevel@tonic-gate if (setegid(saved_egid) < 0) 148*0Sstevel@tonic-gate fatal("setegid %u: %.100s", (u_int)saved_egid, strerror(errno)); 149*0Sstevel@tonic-gate if (setgid(saved_egid) < 0) 150*0Sstevel@tonic-gate fatal("setgid %u: %.100s", (u_int)saved_egid, strerror(errno)); 151*0Sstevel@tonic-gate #else /* SAVED_IDS_WORK */ 152*0Sstevel@tonic-gate /* 153*0Sstevel@tonic-gate * We are unable to restore the real uid to its unprivileged value. 154*0Sstevel@tonic-gate * Propagate the real uid (usually more privileged) to effective uid 155*0Sstevel@tonic-gate * as well. 156*0Sstevel@tonic-gate */ 157*0Sstevel@tonic-gate setuid(getuid()); 158*0Sstevel@tonic-gate setgid(getgid()); 159*0Sstevel@tonic-gate #endif /* SAVED_IDS_WORK */ 160*0Sstevel@tonic-gate 161*0Sstevel@tonic-gate if (setgroups(saved_egroupslen, saved_egroups) < 0) 162*0Sstevel@tonic-gate fatal("setgroups: %.100s", strerror(errno)); 163*0Sstevel@tonic-gate temporarily_use_uid_effective = 0; 164*0Sstevel@tonic-gate } 165*0Sstevel@tonic-gate 166*0Sstevel@tonic-gate /* 167*0Sstevel@tonic-gate * Permanently sets all uids to the given uid. This cannot be 168*0Sstevel@tonic-gate * called while temporarily_use_uid is effective. 169*0Sstevel@tonic-gate */ 170*0Sstevel@tonic-gate void 171*0Sstevel@tonic-gate permanently_set_uid(struct passwd *pw) 172*0Sstevel@tonic-gate { 173*0Sstevel@tonic-gate if (temporarily_use_uid_effective) 174*0Sstevel@tonic-gate fatal("permanently_set_uid: temporarily_use_uid effective"); 175*0Sstevel@tonic-gate debug("permanently_set_uid: %u/%u", (u_int)pw->pw_uid, 176*0Sstevel@tonic-gate (u_int)pw->pw_gid); 177*0Sstevel@tonic-gate if (initgroups(pw->pw_name, pw->pw_gid) < 0) 178*0Sstevel@tonic-gate fatal("initgroups: %s: %.100s", pw->pw_name, 179*0Sstevel@tonic-gate strerror(errno)); 180*0Sstevel@tonic-gate if (setgid(pw->pw_gid) < 0) 181*0Sstevel@tonic-gate fatal("setgid %u: %.100s", (u_int)pw->pw_gid, strerror(errno)); 182*0Sstevel@tonic-gate if (setuid(pw->pw_uid) < 0) 183*0Sstevel@tonic-gate fatal("setuid %u: %.100s", (u_int)pw->pw_uid, strerror(errno)); 184*0Sstevel@tonic-gate } 185