/*
- * Copyright (c) 1994-1996,1998-2004 Todd C. Miller <Todd.Miller@courtesan.com>
+ * Copyright (c) 1994-1996,1998-2010 Todd C. Miller <Todd.Miller@courtesan.com>
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* Materiel Command, USAF, under agreement number F39502-99-1-0512.
*/
-#include "config.h"
+#include <config.h>
#include <sys/types.h>
#include <sys/param.h>
#endif /* STDC_HEADERS */
#ifdef HAVE_STRING_H
# include <string.h>
-#else
-# ifdef HAVE_STRINGS_H
-# include <strings.h>
-# endif
#endif /* HAVE_STRING_H */
+#ifdef HAVE_STRINGS_H
+# include <strings.h>
+#endif /* HAVE_STRINGS_H */
#ifdef HAVE_UNISTD_H
# include <unistd.h>
#endif /* HAVE_UNISTD_H */
#include "sudo.h"
-#ifndef lint
-static const char rcsid[] = "$Sudo: set_perms.c,v 1.30 2004/05/27 23:12:02 millert Exp $";
-#endif /* lint */
-
#ifdef __TANDEM
# define ROOT_UID 65535
#else
* Prototypes
*/
static void runas_setup __P((void));
-static void fatal __P((char *, int));
-
-#if !defined(HAVE_SETRESUID) && !defined(HAVE_SETREUID) && \
- !defined(NO_SAVED_IDS) && defined(_SC_SAVED_IDS) && defined(_SC_VERSION)
-/*
- * Set real and effective uids and gids based on perm.
- * Since we have POSIX saved IDs we can get away with just
- * toggling the effective uid/gid unless we are headed for an exec().
- */
-void
-set_perms_posix(perm)
- int perm;
-{
- int error;
-
- switch (perm) {
- case PERM_ROOT:
- if (seteuid(ROOT_UID))
- fatal("seteuid(ROOT_UID) failed, your operating system may have broken POSIX saved ID support\nTry running configure with --disable-saved-ids", 0);
- break;
-
- case PERM_FULL_ROOT:
- /* headed for exec() */
- (void) seteuid(ROOT_UID);
- if (setuid(ROOT_UID))
- fatal("setuid(ROOT_UID)", 1);
- break;
-
- case PERM_USER:
- (void) setegid(user_gid);
- if (seteuid(user_uid))
- fatal("seteuid(user_uid)", 1);
- break;
-
- case PERM_FULL_USER:
- /* headed for exec() */
- (void) setgid(user_gid);
- if (setuid(user_uid))
- fatal("setuid(user_uid)", 1);
- break;
-
- case PERM_RUNAS:
- if (seteuid(runas_pw->pw_uid))
- fatal("unable to change to runas uid", 1);
- break;
-
- case PERM_FULL_RUNAS:
- /* headed for exec(), assume euid == ROOT_UID */
- runas_setup();
- if (def_stay_setuid)
- error = seteuid(runas_pw->pw_uid);
- else
- error = setuid(runas_pw->pw_uid);
- if (error)
- fatal("unable to change to runas uid", 1);
- break;
-
- case PERM_SUDOERS:
- /* assume euid == ROOT_UID, ruid == user */
- if (setegid(SUDOERS_GID))
- fatal("unable to change to sudoers gid", 1);
+static void runas_setgroups __P((void));
+static void restore_groups __P((void));
- /*
- * If SUDOERS_UID == ROOT_UID and SUDOERS_MODE
- * is group readable we use a non-zero
- * uid in order to avoid NFS lossage.
- * Using uid 1 is a bit bogus but should
- * work on all OS's.
- */
- if (SUDOERS_UID == ROOT_UID) {
- if ((SUDOERS_MODE & 040) && seteuid(1))
- fatal("seteuid(1)", 1);
- } else {
- if (seteuid(SUDOERS_UID))
- fatal("seteuid(SUDOERS_UID)", 1);
- }
- break;
- case PERM_TIMESTAMP:
- if (seteuid(timestamp_uid))
- fatal("seteuid(timestamp_uid)", 1);
- break;
-
- }
-}
-#endif /* !NO_SAVED_IDS && _SC_SAVED_IDS && _SC_VERSION */
+static int current_perm = -1;
#ifdef HAVE_SETRESUID
/*
* We only flip the effective gid since it only changes for PERM_SUDOERS.
* This version of set_perms() works fine with the "stay_setuid" option.
*/
-void
-set_perms_suid(perm)
+int
+set_perms(perm)
int perm;
{
- int error;
+ const char *errstr;
+ int noexit;
+
+ noexit = ISSET(perm, PERM_NOEXIT);
+ CLR(perm, PERM_MASK);
+
+ if (perm == current_perm)
+ return(1);
switch (perm) {
- case PERM_FULL_ROOT:
case PERM_ROOT:
- if (setresuid(ROOT_UID, ROOT_UID, ROOT_UID))
- fatal("setresuid(ROOT_UID, ROOT_UID, ROOT_UID) failed, your operating system may have a broken setresuid() function\nTry running configure with --disable-setresuid", 0);
+ if (setresuid(ROOT_UID, ROOT_UID, ROOT_UID)) {
+ errstr = "setresuid(ROOT_UID, ROOT_UID, ROOT_UID)";
+ goto bad;
+ }
+ (void) setresgid(-1, user_gid, -1);
+ if (current_perm == PERM_RUNAS)
+ restore_groups();
break;
case PERM_USER:
(void) setresgid(-1, user_gid, -1);
- if (setresuid(user_uid, user_uid, ROOT_UID))
- fatal("setresuid(user_uid, user_uid, ROOT_UID)", 1);
+ if (setresuid(user_uid, user_uid, ROOT_UID)) {
+ errstr = "setresuid(user_uid, user_uid, ROOT_UID)";
+ goto bad;
+ }
break;
case PERM_FULL_USER:
/* headed for exec() */
(void) setgid(user_gid);
- if (setresuid(user_uid, user_uid, user_uid))
- fatal("setresuid(user_uid, user_uid, user_uid)", 1);
+ if (setresuid(user_uid, user_uid, user_uid)) {
+ errstr = "setresuid(user_uid, user_uid, user_uid)";
+ goto bad;
+ }
break;
case PERM_RUNAS:
- if (setresuid(-1, runas_pw->pw_uid, -1))
- fatal("unable to change to runas uid", 1);
+ runas_setgroups();
+ (void) setresgid(-1, runas_gr ?
+ runas_gr->gr_gid : runas_pw->pw_gid, -1);
+ if (setresuid(-1, runas_pw ? runas_pw->pw_uid :
+ user_uid, -1)) {
+ errstr = "unable to change to runas uid";
+ goto bad;
+ }
break;
case PERM_FULL_RUNAS:
/* headed for exec(), assume euid == ROOT_UID */
runas_setup();
- error = setresuid(def_stay_setuid ?
+ if (setresuid(def_stay_setuid ?
user_uid : runas_pw->pw_uid,
- runas_pw->pw_uid, runas_pw->pw_uid);
- if (error)
- fatal("unable to change to runas uid", 1);
+ runas_pw->pw_uid, runas_pw->pw_uid)) {
+ errstr = "unable to change to runas uid";
+ goto bad;
+ }
break;
case PERM_SUDOERS:
/* assume euid == ROOT_UID, ruid == user */
if (setresgid(-1, SUDOERS_GID, -1))
- fatal("unable to change to sudoers gid", 1);
+ error(1, "unable to change to sudoers gid");
/*
* If SUDOERS_UID == ROOT_UID and SUDOERS_MODE
* work on all OS's.
*/
if (SUDOERS_UID == ROOT_UID) {
- if ((SUDOERS_MODE & 040) && setresuid(ROOT_UID, 1, ROOT_UID))
- fatal("setresuid(ROOT_UID, 1, ROOT_UID)", 1);
+ if ((SUDOERS_MODE & 040) && setresuid(ROOT_UID, 1, ROOT_UID)) {
+ errstr = "setresuid(ROOT_UID, 1, ROOT_UID)";
+ goto bad;
+ }
} else {
- if (setresuid(ROOT_UID, SUDOERS_UID, ROOT_UID))
- fatal("setresuid(ROOT_UID, SUDOERS_UID, ROOT_UID)", 1);
+ if (setresuid(ROOT_UID, SUDOERS_UID, ROOT_UID)) {
+ errstr = "setresuid(ROOT_UID, SUDOERS_UID, ROOT_UID)";
+ goto bad;
+ }
}
break;
case PERM_TIMESTAMP:
- if (setresuid(ROOT_UID, timestamp_uid, ROOT_UID))
- fatal("setresuid(ROOT_UID, timestamp_uid, ROOT_UID)", 1);
+ if (setresuid(ROOT_UID, timestamp_uid, ROOT_UID)) {
+ errstr = "setresuid(ROOT_UID, timestamp_uid, ROOT_UID)";
+ goto bad;
+ }
break;
}
+
+ current_perm = perm;
+ return(1);
+bad:
+ warningx("%s: %s", errstr,
+ errno == EAGAIN ? "too many processes" : strerror(errno));
+ if (noexit)
+ return(0);
+ exit(1);
}
#else
* we are headed for an exec().
* This version of set_perms() works fine with the "stay_setuid" option.
*/
-void
-set_perms_suid(perm)
+int
+set_perms(perm)
int perm;
{
- int error;
+ const char *errstr;
+ int noexit;
+
+ noexit = ISSET(perm, PERM_NOEXIT);
+ CLR(perm, PERM_MASK);
+
+ if (perm == current_perm)
+ return(1);
switch (perm) {
- case PERM_FULL_ROOT:
case PERM_ROOT:
- if (setreuid(-1, ROOT_UID))
- fatal("setreuid(-1, ROOT_UID) failed, your operating system may have a broken setreuid() function\nTry running configure with --disable-setreuid", 0);
- if (setuid(ROOT_UID))
- fatal("setuid(ROOT_UID)", 1);
+ if (setreuid(-1, ROOT_UID)) {
+ errstr = "setreuid(-1, ROOT_UID)";
+ goto bad;
+ }
+ if (setuid(ROOT_UID)) {
+ errstr = "setuid(ROOT_UID)";
+ goto bad;
+ }
+ (void) setregid(-1, user_gid);
+ if (current_perm == PERM_RUNAS)
+ restore_groups();
break;
case PERM_USER:
(void) setregid(-1, user_gid);
- if (setreuid(ROOT_UID, user_uid))
- fatal("setreuid(ROOT_UID, user_uid)", 1);
+ if (setreuid(ROOT_UID, user_uid)) {
+ errstr = "setreuid(ROOT_UID, user_uid)";
+ goto bad;
+ }
break;
case PERM_FULL_USER:
/* headed for exec() */
(void) setgid(user_gid);
- if (setreuid(user_uid, user_uid))
- fatal("setreuid(user_uid, user_uid)", 1);
+ if (setreuid(user_uid, user_uid)) {
+ errstr = "setreuid(user_uid, user_uid)";
+ goto bad;
+ }
break;
case PERM_RUNAS:
- if (setreuid(-1, runas_pw->pw_uid))
- fatal("unable to change to runas uid", 1);
+ runas_setgroups();
+ (void) setregid(-1, runas_gr ?
+ runas_gr->gr_gid : runas_pw->pw_gid);
+ if (setreuid(-1,
+ runas_pw ? runas_pw->pw_uid : user_uid)) {
+ errstr = "unable to change to runas uid";
+ goto bad;
+ }
break;
case PERM_FULL_RUNAS:
/* headed for exec(), assume euid == ROOT_UID */
runas_setup();
- error = setreuid(def_stay_setuid ?
- user_uid : runas_pw->pw_uid,
- runas_pw->pw_uid);
- if (error)
- fatal("unable to change to runas uid", 1);
+ if (setreuid(def_stay_setuid ? user_uid :
+ runas_pw->pw_uid, runas_pw->pw_uid)) {
+ errstr = "unable to change to runas uid";
+ goto bad;
+ }
break;
case PERM_SUDOERS:
/* assume euid == ROOT_UID, ruid == user */
if (setregid(-1, SUDOERS_GID))
- fatal("unable to change to sudoers gid", 1);
+ error(1, "unable to change to sudoers gid");
/*
* If SUDOERS_UID == ROOT_UID and SUDOERS_MODE
* work on all OS's.
*/
if (SUDOERS_UID == ROOT_UID) {
- if ((SUDOERS_MODE & 040) && setreuid(ROOT_UID, 1))
- fatal("setreuid(ROOT_UID, 1)", 1);
+ if ((SUDOERS_MODE & 040) && setreuid(ROOT_UID, 1)) {
+ errstr = "setreuid(ROOT_UID, 1)";
+ goto bad;
+ }
} else {
- if (setreuid(ROOT_UID, SUDOERS_UID))
- fatal("setreuid(ROOT_UID, SUDOERS_UID)", 1);
+ if (setreuid(ROOT_UID, SUDOERS_UID)) {
+ errstr = "setreuid(ROOT_UID, SUDOERS_UID)";
+ goto bad;
+ }
}
break;
case PERM_TIMESTAMP:
- if (setreuid(ROOT_UID, timestamp_uid))
- fatal("setreuid(ROOT_UID, timestamp_uid)", 1);
+ if (setreuid(ROOT_UID, timestamp_uid)) {
+ errstr = "setreuid(ROOT_UID, timestamp_uid)";
+ goto bad;
+ }
break;
}
+
+ current_perm = perm;
+ return(1);
+bad:
+ warningx("%s: %s", errstr,
+ errno == EAGAIN ? "too many processes" : strerror(errno));
+ if (noexit)
+ return(0);
+ exit(1);
}
-# else
-# ifdef HAVE_SETREUID
+# else /* !HAVE_SETRESUID && !HAVE_SETREUID */
+# ifdef HAVE_SETEUID
/*
* Set real and effective uids and gids based on perm.
* NOTE: does not support the "stay_setuid" option.
*/
-void
-set_perms_nosuid(perm)
+int
+set_perms(perm)
int perm;
{
+ const char *errstr;
+ int noexit;
+
+ noexit = ISSET(perm, PERM_NOEXIT);
+ CLR(perm, PERM_MASK);
+
+ if (perm == current_perm)
+ return(1);
/*
- * Since we only have setuid() and seteuid() we have to set
- * real and effective uids to ROOT_UID initially.
+ * Since we only have setuid() and seteuid() and semantics
+ * for these calls differ on various systems, we set
+ * real and effective uids to ROOT_UID initially to be safe.
*/
- if (setuid(ROOT_UID))
- fatal("setuid(ROOT_UID)", 1);
+ if (seteuid(ROOT_UID)) {
+ errstr = "seteuid(ROOT_UID)";
+ goto bad;
+ }
+ if (setuid(ROOT_UID)) {
+ errstr = "setuid(ROOT_UID)";
+ goto bad;
+ }
switch (perm) {
+ case PERM_ROOT:
+ /* uid set above */
+ (void) setegid(user_gid);
+ if (current_perm == PERM_RUNAS)
+ restore_groups();
+ break;
+
case PERM_USER:
(void) setegid(user_gid);
- if (seteuid(user_uid))
- fatal("seteuid(user_uid)", 1);
+ if (seteuid(user_uid)) {
+ errstr = "seteuid(user_uid)";
+ goto bad;
+ }
break;
case PERM_FULL_USER:
/* headed for exec() */
(void) setgid(user_gid);
- if (setuid(user_uid))
- fatal("setuid(user_uid)", 1);
+ if (setuid(user_uid)) {
+ errstr = "setuid(user_uid)";
+ goto bad;
+ }
break;
case PERM_RUNAS:
- if (seteuid(runas_pw->pw_uid))
- fatal("unable to change to runas uid", 1);
+ runas_setgroups();
+ (void) setegid(runas_gr ?
+ runas_gr->gr_gid : runas_pw->pw_gid);
+ if (seteuid(runas_pw ? runas_pw->pw_uid : user_uid)) {
+ errstr = "unable to change to runas uid";
+ goto bad;
+ }
break;
case PERM_FULL_RUNAS:
- /* headed for exec(), assume euid == ROOT_UID */
+ /* headed for exec() */
runas_setup();
- if (setuid(runas_pw->pw_uid))
- fatal("unable to change to runas uid", 1);
+ if (setuid(runas_pw->pw_uid)) {
+ errstr = "unable to change to runas uid";
+ goto bad;
+ }
break;
case PERM_SUDOERS:
- /* assume euid == ROOT_UID, ruid == user */
if (setegid(SUDOERS_GID))
- fatal("unable to change to sudoers gid", 1);
+ error(1, "unable to change to sudoers gid");
/*
* If SUDOERS_UID == ROOT_UID and SUDOERS_MODE
* work on all OS's.
*/
if (SUDOERS_UID == ROOT_UID) {
- if ((SUDOERS_MODE & 040) && seteuid(1))
- fatal("seteuid(1)", 1);
+ if ((SUDOERS_MODE & 040) && seteuid(1)) {
+ errstr = "seteuid(1)";
+ goto bad;
+ }
} else {
- if (seteuid(SUDOERS_UID))
- fatal("seteuid(SUDOERS_UID)", 1);
+ if (seteuid(SUDOERS_UID)) {
+ errstr = "seteuid(SUDOERS_UID)";
+ goto bad;
+ }
}
break;
case PERM_TIMESTAMP:
- if (seteuid(timestamp_uid))
- fatal("seteuid(timestamp_uid)", 1);
+ if (seteuid(timestamp_uid)) {
+ errstr = "seteuid(timestamp_uid)";
+ goto bad;
+ }
break;
}
+
+ current_perm = perm;
+ return(1);
+bad:
+ warningx("%s: %s", errstr,
+ errno == EAGAIN ? "too many processes" : strerror(errno));
+ if (noexit)
+ return(0);
+ exit(1);
}
-# else
+# else /* !HAVE_SETRESUID && !HAVE_SETREUID && !HAVE_SETEUID */
/*
* Set uids and gids based on perm via setuid() and setgid().
* NOTE: does not support the "stay_setuid" or timestampowner options.
* Also, SUDOERS_UID and SUDOERS_GID are not used.
*/
-void
-set_perms_nosuid(perm)
+int
+set_perms(perm)
int perm;
{
+ const char *errstr;
+ int noexit;
+
+ noexit = ISSET(perm, PERM_NOEXIT);
+ CLR(perm, PERM_MASK);
+
+ if (perm == current_perm)
+ return(1);
switch (perm) {
- case PERM_FULL_ROOT:
case PERM_ROOT:
- if (setuid(ROOT_UID))
- fatal("setuid(ROOT_UID)", 1);
+ if (setuid(ROOT_UID)) {
+ errstr = "setuid(ROOT_UID)";
+ goto bad;
+ }
+ if (current_perm == PERM_RUNAS)
+ restore_groups();
break;
case PERM_FULL_USER:
(void) setgid(user_gid);
- if (setuid(user_uid))
- fatal("setuid(user_uid)", 1);
+ if (setuid(user_uid)) {
+ errstr = "setuid(user_uid)";
+ goto bad;
+ }
break;
case PERM_FULL_RUNAS:
runas_setup();
- if (setuid(runas_pw->pw_uid))
- fatal("unable to change to runas uid", 1);
+ if (setuid(runas_pw->pw_uid)) {
+ errstr = "unable to change to runas uid";
+ goto bad;
+ }
break;
case PERM_USER:
/* Unsupported since we can't set euid. */
break;
}
+
+ current_perm = perm;
+ return(1);
+bad:
+ warningx("%s: %s", errstr,
+ errno == EAGAIN ? "too many processes" : strerror(errno));
+ if (noexit)
+ return(0);
+ exit(1);
}
# endif /* HAVE_SETEUID */
# endif /* HAVE_SETREUID */
#endif /* HAVE_SETRESUID */
+#ifdef HAVE_INITGROUPS
+static void
+runas_setgroups()
+{
+ static int ngroups = -1;
+# ifdef HAVE_GETGROUPS
+ static GETGROUPS_T *groups;
+# endif
+ static struct passwd *pw;
+ struct passwd *opw = pw;
+
+ if (def_preserve_groups)
+ return;
+
+ /*
+ * Use stashed copy of runas groups if available, else initgroups and stash.
+ */
+ pw = runas_pw ? runas_pw : sudo_user.pw;
+ if (pw != opw) {
+# ifdef HAVE_SETAUTHDB
+ aix_setauthdb(pw->pw_name);
+# endif
+ if (initgroups(pw->pw_name, pw->pw_gid) < 0)
+ log_error(USE_ERRNO|MSG_ONLY, "can't set runas group vector");
+# ifdef HAVE_GETGROUPS
+ if (groups) {
+ efree(groups);
+ groups = NULL;
+ }
+ if ((ngroups = getgroups(0, NULL)) > 0) {
+ groups = emalloc2(ngroups, sizeof(GETGROUPS_T));
+ if (getgroups(ngroups, groups) < 0)
+ log_error(USE_ERRNO|MSG_ONLY, "can't get runas group vector");
+ }
+# ifdef HAVE_SETAUTHDB
+ aix_restoreauthdb();
+# endif
+ } else {
+ if (setgroups(ngroups, groups) < 0)
+ log_error(USE_ERRNO|MSG_ONLY, "can't set runas group vector");
+# endif /* HAVE_GETGROUPS */
+ }
+}
+
+static void
+restore_groups()
+{
+ if (user_ngroups >= 0 && setgroups(user_ngroups, user_groups) < 0)
+ log_error(USE_ERRNO|MSG_ONLY, "can't reset user group vector");
+}
+
+#else
+
+static void
+runas_setgroups()
+{
+ /* STUB */
+}
+
+static void
+restore_groups()
+{
+ /* STUB */
+}
+
+#endif /* HAVE_INITGROUPS */
+
static void
runas_setup()
{
+ gid_t gid;
#ifdef HAVE_LOGIN_CAP_H
- int error, flags;
+ int flags;
extern login_cap_t *lc;
#endif
if (runas_pw->pw_name != NULL) {
+ gid = runas_gr ? runas_gr->gr_gid : runas_pw->pw_gid;
+#ifdef HAVE_GETUSERATTR
+ aix_prep_user(runas_pw->pw_name, user_ttypath);
+#endif
#ifdef HAVE_PAM
- pam_prep_user(runas_pw);
+ pam_begin_session(runas_pw);
#endif /* HAVE_PAM */
#ifdef HAVE_LOGIN_CAP_H
if (def_use_loginclass) {
/*
- * We don't have setusercontext() set the user since we
- * may only want to set the effective uid. Depending on
- * sudoers and/or command line arguments we may not want
- * setusercontext() to call initgroups().
+ * We only use setusercontext() to set the nice value and rlimits.
*/
flags = LOGIN_SETRESOURCES|LOGIN_SETPRIORITY;
- if (!def_preserve_groups)
- SET(flags, LOGIN_SETGROUP);
- else if (setgid(runas_pw->pw_gid))
- perror("cannot set gid to runas gid");
- error = setusercontext(lc, runas_pw,
- runas_pw->pw_uid, flags);
- if (error) {
+ if (setusercontext(lc, runas_pw, runas_pw->pw_uid, flags)) {
if (runas_pw->pw_uid != ROOT_UID)
- fatal("unable to set user context", 1);
+ error(1, "unable to set user context");
else
- perror("unable to set user context");
+ warning("unable to set user context");
}
- } else
-#endif /* HAVE_LOGIN_CAP_H */
- {
- if (setgid(runas_pw->pw_gid))
- perror("cannot set gid to runas gid");
-#ifdef HAVE_INITGROUPS
- /*
- * Initialize group vector unless asked not to.
- */
- if (!def_preserve_groups &&
- initgroups(*user_runas, runas_pw->pw_gid) < 0)
- perror("cannot set group vector");
-#endif /* HAVE_INITGROUPS */
- }
- }
-}
-
-static void
-fatal(str, printerr)
- char *str;
- int printerr;
-{
-
- if (str) {
- if (printerr)
- perror(str);
- else {
- fputs(str, stderr);
- fputc('\n', stderr);
}
+#endif /* HAVE_LOGIN_CAP_H */
+ /*
+ * Initialize group vector
+ */
+ runas_setgroups();
+#ifdef HAVE_SETEUID
+ if (setegid(gid))
+ warning("cannot set egid to runas gid");
+#endif
+ if (setgid(gid))
+ warning("cannot set gid to runas gid");
}
- exit(1);
}