1 /* $OpenBSD: uidswap.c,v 1.35 2006/08/03 03:34:42 deraadt Exp $ */
2 /*
3 * Author: Tatu Ylonen <ylo@cs.hut.fi>
4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5 * All rights reserved
6 * Code for uid-swapping.
7 *
8 * As far as I am concerned, the code I have written for this software
9 * can be used freely for any purpose. Any derived versions of this
10 * software must be clearly marked as such, and if the derived work is
11 * incompatible with the protocol description in the RFC file, it must be
12 * called by a name other than "ssh" or "Secure Shell".
13 */
14
15 #include <sys/param.h>
16 #include <errno.h>
17 #include <pwd.h>
18 #include <string.h>
19 #include <unistd.h>
20 #include <stdarg.h>
21
22 #include "log.h"
23 #include "uidswap.h"
24
25 /*
26 * Note: all these functions must work in all of the following cases:
27 * 1. euid=0, ruid=0
28 * 2. euid=0, ruid!=0
29 * 3. euid!=0, ruid!=0
30 * Additionally, they must work regardless of whether the system has
31 * POSIX saved uids or not.
32 */
33
34 /* Lets assume that posix saved ids also work with seteuid, even though that
35 is not part of the posix specification. */
36
37 /* Saved effective uid. */
38 static int privileged = 0;
39 static int temporarily_use_uid_effective = 0;
40 static uid_t saved_euid = 0;
41 static gid_t saved_egid;
42 static gid_t saved_egroups[NGROUPS_MAX], user_groups[NGROUPS_MAX];
43 static int saved_egroupslen = -1, user_groupslen = -1;
44
45 /*
46 * Temporarily changes to the given uid. If the effective user
47 * id is not root, this does nothing. This call cannot be nested.
48 */
49 void
temporarily_use_uid(struct passwd * pw)50 temporarily_use_uid(struct passwd *pw)
51 {
52 /* Save the current euid, and egroups. */
53 saved_euid = geteuid();
54 saved_egid = getegid();
55 debug("temporarily_use_uid: %u/%u (e=%u/%u)",
56 (u_int)pw->pw_uid, (u_int)pw->pw_gid,
57 (u_int)saved_euid, (u_int)saved_egid);
58 if (saved_euid != 0) {
59 privileged = 0;
60 return;
61 }
62 privileged = 1;
63 temporarily_use_uid_effective = 1;
64 saved_egroupslen = getgroups(NGROUPS_MAX, saved_egroups);
65 if (saved_egroupslen < 0)
66 fatal("getgroups: %.100s", strerror(errno));
67
68 /* set and save the user's groups */
69 if (user_groupslen == -1) {
70 if (initgroups(pw->pw_name, pw->pw_gid) < 0)
71 fatal("initgroups: %s: %.100s", pw->pw_name,
72 strerror(errno));
73 user_groupslen = getgroups(NGROUPS_MAX, user_groups);
74 if (user_groupslen < 0)
75 fatal("getgroups: %.100s", strerror(errno));
76 }
77 /* Set the effective uid to the given (unprivileged) uid. */
78 if (setgroups(user_groupslen, user_groups) < 0)
79 fatal("setgroups: %.100s", strerror(errno));
80 if (setegid(pw->pw_gid) < 0)
81 fatal("setegid %u: %.100s", (u_int)pw->pw_gid,
82 strerror(errno));
83 if (seteuid(pw->pw_uid) == -1)
84 fatal("seteuid %u: %.100s", (u_int)pw->pw_uid,
85 strerror(errno));
86 }
87
88 /*
89 * Restores to the original (privileged) uid.
90 */
91 void
restore_uid(void)92 restore_uid(void)
93 {
94 /* it's a no-op unless privileged */
95 if (!privileged) {
96 debug("restore_uid: (unprivileged)");
97 return;
98 }
99 if (!temporarily_use_uid_effective)
100 fatal("restore_uid: temporarily_use_uid not effective");
101 debug("restore_uid: %u/%u", (u_int)saved_euid, (u_int)saved_egid);
102 /* Set the effective uid back to the saved privileged uid. */
103 if (seteuid(saved_euid) < 0)
104 fatal("seteuid %u: %.100s", (u_int)saved_euid, strerror(errno));
105 if (setgroups(saved_egroupslen, saved_egroups) < 0)
106 fatal("setgroups: %.100s", strerror(errno));
107 if (setegid(saved_egid) < 0)
108 fatal("setegid %u: %.100s", (u_int)saved_egid, strerror(errno));
109 temporarily_use_uid_effective = 0;
110 }
111
112 /*
113 * Permanently sets all uids to the given uid. This cannot be
114 * called while temporarily_use_uid is effective.
115 */
116 void
permanently_set_uid(struct passwd * pw)117 permanently_set_uid(struct passwd *pw)
118 {
119 if (temporarily_use_uid_effective)
120 fatal("permanently_set_uid: temporarily_use_uid effective");
121 debug("permanently_set_uid: %u/%u", (u_int)pw->pw_uid,
122 (u_int)pw->pw_gid);
123 if (setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) != 0)
124 fatal("setresgid %u: %s", (u_int)pw->pw_gid, strerror(errno));
125 if (setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid) != 0)
126 fatal("setresuid %u: %s", (u_int)pw->pw_uid, strerror(errno));
127 }
128
129 void
permanently_drop_suid(uid_t uid)130 permanently_drop_suid(uid_t uid)
131 {
132 debug("permanently_drop_suid: %u", (u_int)uid);
133 if (setresuid(uid, uid, uid) != 0)
134 fatal("setresuid %u: %s", (u_int)uid, strerror(errno));
135 }
136