1 /* $NetBSD: su.c,v 1.75 2023/03/24 16:58:24 kre Exp $ */ 2 3 /* 4 * Copyright (c) 1988 The Regents of the University of California. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. Neither the name of the University nor the names of its contributors 16 * may be used to endorse or promote products derived from this software 17 * without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32 #include <sys/cdefs.h> 33 #ifndef lint 34 __COPYRIGHT("@(#) Copyright (c) 1988\ 35 The Regents of the University of California. All rights reserved."); 36 #endif /* not lint */ 37 38 #ifndef lint 39 #if 0 40 static char sccsid[] = "@(#)su.c 8.3 (Berkeley) 4/2/94";*/ 41 #else 42 __RCSID("$NetBSD: su.c,v 1.75 2023/03/24 16:58:24 kre Exp $"); 43 #endif 44 #endif /* not lint */ 45 46 #include <sys/param.h> 47 #include <sys/time.h> 48 #include <sys/resource.h> 49 #include <err.h> 50 #include <errno.h> 51 #include <grp.h> 52 #include <paths.h> 53 #include <pwd.h> 54 #include <stdio.h> 55 #ifdef SKEY 56 #include <skey.h> 57 #endif 58 #include <stdlib.h> 59 #include <string.h> 60 #include <syslog.h> 61 #include <time.h> 62 #include <tzfile.h> 63 #include <unistd.h> 64 #include <util.h> 65 66 #ifdef LOGIN_CAP 67 #include <login_cap.h> 68 #endif 69 70 #ifdef KERBEROS5 71 #include <krb5.h> 72 #endif 73 74 #ifdef ALLOW_GROUP_CHANGE 75 #include "grutil.h" 76 #endif 77 #include "suutil.h" 78 79 #ifdef KERBEROS5 80 #define ARGSTRX "-Kdflm" 81 static int kerberos5(char *, const char *, uid_t); 82 int use_kerberos = 1; 83 #else 84 #define ARGSTRX "-dflm" 85 #endif 86 87 #ifndef SU_GROUP 88 #define SU_GROUP "wheel" 89 #endif 90 91 #define GROUP_PASSWORD "Group Password:" 92 93 #ifdef LOGIN_CAP 94 #define ARGSTR ARGSTRX "c:" 95 #else 96 #define ARGSTR ARGSTRX 97 #endif 98 99 static int check_ingroup(int, const char *, const char *, int); 100 101 int 102 main(int argc, char **argv) 103 { 104 extern char **environ; 105 struct passwd *pwd; 106 char *p; 107 #ifdef BSD4_4 108 struct timeval tp; 109 #endif 110 uid_t ruid; 111 int asme, ch, asthem, fastlogin, prio, gohome; 112 enum { UNSET, YES, NO } iscsh = UNSET; 113 const char *user, *shell, *avshell; 114 char *username, **np; 115 #ifdef SU_ROOTAUTH 116 char *userpass; 117 #endif 118 char *class; 119 char shellbuf[MAXPATHLEN], avshellbuf[MAXPATHLEN]; 120 time_t pw_warntime = _PASSWORD_WARNDAYS * SECSPERDAY; 121 #ifdef LOGIN_CAP 122 login_cap_t *lc; 123 #endif 124 #ifdef ALLOW_GROUP_CHANGE 125 char *gname; 126 #endif 127 128 (void)setprogname(argv[0]); 129 asme = asthem = fastlogin = 0; 130 gohome = 1; 131 shell = class = NULL; 132 while ((ch = getopt(argc, argv, ARGSTR)) != -1) 133 switch((char)ch) { 134 #ifdef KERBEROS5 135 case 'K': 136 use_kerberos = 0; 137 break; 138 #endif 139 #ifdef LOGIN_CAP 140 case 'c': 141 class = optarg; 142 break; 143 #endif 144 case 'd': 145 asme = 0; 146 asthem = 1; 147 gohome = 0; 148 break; 149 case 'f': 150 fastlogin = 1; 151 break; 152 case '-': 153 case 'l': 154 asme = 0; 155 asthem = 1; 156 break; 157 case 'm': 158 asme = 1; 159 asthem = 0; 160 break; 161 case '?': 162 default: 163 (void)fprintf(stderr, 164 #ifdef ALLOW_GROUP_CHANGE 165 "usage: %s [%s] [login[:group] [shell arguments]]\n", 166 #else 167 "usage: %s [%s] [login [shell arguments]]\n", 168 #endif 169 getprogname(), ARGSTR); 170 exit(EXIT_FAILURE); 171 } 172 argv += optind; 173 174 /* Lower the priority so su runs faster */ 175 errno = 0; 176 prio = getpriority(PRIO_PROCESS, 0); 177 if (errno) 178 prio = 0; 179 if (prio > -2) 180 (void)setpriority(PRIO_PROCESS, 0, -2); 181 openlog("su", 0, LOG_AUTH); 182 183 /* get current login name and shell */ 184 ruid = getuid(); 185 username = getlogin(); 186 if (username == NULL || (pwd = getpwnam(username)) == NULL || 187 pwd->pw_uid != ruid) 188 pwd = getpwuid(ruid); 189 if (pwd == NULL) 190 errx(EXIT_FAILURE, "who are you?"); 191 username = estrdup(pwd->pw_name); 192 #ifdef SU_ROOTAUTH 193 userpass = estrdup(pwd->pw_passwd); 194 #endif 195 196 if (asme) { 197 if (pwd->pw_shell && *pwd->pw_shell) { 198 (void)estrlcpy(shellbuf, pwd->pw_shell, sizeof(shellbuf)); 199 shell = shellbuf; 200 } else { 201 shell = _PATH_BSHELL; 202 iscsh = NO; 203 } 204 } 205 /* get target login information, default to root */ 206 user = *argv ? *argv : "root"; 207 np = *argv ? argv : argv - 1; 208 209 #ifdef ALLOW_GROUP_CHANGE 210 if ((p = strchr(user, ':')) != NULL) { 211 *p = '\0'; 212 gname = ++p; 213 if (*gname == '\0') 214 errx(EXIT_FAILURE, "missing 'group' after ':'"); 215 } else 216 gname = NULL; 217 218 #ifdef ALLOW_EMPTY_USER 219 if (user[0] == '\0' && gname != NULL) 220 user = username; 221 #endif 222 #endif 223 if ((pwd = getpwnam(user)) == NULL) 224 errx(EXIT_FAILURE, "unknown login `%s'", user); 225 226 #ifdef LOGIN_CAP 227 /* force the usage of specified class */ 228 if (class) { 229 if (ruid) 230 errx(EXIT_FAILURE, "Only root may use -c"); 231 232 pwd->pw_class = class; 233 } 234 if ((lc = login_getclass(pwd->pw_class)) == NULL) 235 errx(EXIT_FAILURE, "Unknown class %s", pwd->pw_class); 236 237 pw_warntime = (time_t)login_getcaptime(lc, "password-warn", 238 _PASSWORD_WARNDAYS * SECSPERDAY, 239 _PASSWORD_WARNDAYS * SECSPERDAY); 240 #endif 241 242 if (ruid 243 #ifdef KERBEROS5 244 && (!use_kerberos || kerberos5(username, user, pwd->pw_uid)) 245 #endif 246 ) { 247 char *pass = pwd->pw_passwd; 248 int ok = pwd->pw_uid != 0; 249 250 #ifdef SU_ROOTAUTH 251 /* 252 * Allow those in group rootauth to su to root, by supplying 253 * their own password. 254 */ 255 if (!ok) { 256 if ((ok = check_ingroup(-1, SU_ROOTAUTH, username, 0))) { 257 pass = userpass; 258 user = username; 259 } 260 } 261 #endif 262 /* 263 * Only allow those in group SU_GROUP to su to root, 264 * but only if that group has any members. 265 * If SU_GROUP has no members, allow anyone to su root 266 */ 267 if (!ok) 268 ok = check_ingroup(-1, SU_GROUP, username, 1); 269 if (!ok) 270 errx(EXIT_FAILURE, 271 "you are not listed in the correct secondary group (%s) to su %s.", 272 SU_GROUP, user); 273 /* if target requires a password, verify it */ 274 if (*pass && pwd->pw_uid != ruid) { /* XXX - OK? */ 275 p = getpass("Password:"); 276 #ifdef SKEY 277 if (strcasecmp(p, "s/key") == 0) { 278 if (skey_haskey(user)) 279 errx(EXIT_FAILURE, 280 "Sorry, you have no s/key."); 281 else { 282 if (skey_authenticate(user)) { 283 goto badlogin; 284 } 285 } 286 287 } else 288 #endif 289 if (consttime_memequal(pass, 290 crypt(p, pass), strlen(pass)) == 0) { 291 #ifdef SKEY 292 badlogin: 293 #endif 294 (void)fprintf(stderr, "Sorry\n"); 295 syslog(LOG_WARNING, 296 "BAD SU %s to %s%s", username, 297 pwd->pw_name, ontty()); 298 exit(EXIT_FAILURE); 299 } 300 } 301 } 302 303 if (asme) { 304 /* if asme and non-standard target shell, must be root */ 305 if (chshell(pwd->pw_shell) == 0 && ruid) 306 errx(EXIT_FAILURE, "permission denied (shell)."); 307 } else if (pwd->pw_shell && *pwd->pw_shell) { 308 shell = pwd->pw_shell; 309 iscsh = UNSET; 310 } else { 311 shell = _PATH_BSHELL; 312 iscsh = NO; 313 } 314 315 if ((p = strrchr(shell, '/')) != NULL) 316 avshell = p+1; 317 else 318 avshell = shell; 319 320 /* if we're forking a csh, we want to slightly muck the args */ 321 if (iscsh == UNSET) 322 iscsh = strstr(avshell, "csh") ? YES : NO; 323 324 /* set permissions */ 325 #ifdef LOGIN_CAP 326 # ifdef ALLOW_GROUP_CHANGE 327 /* if we aren't changing users, keep the current group members */ 328 if (ruid != pwd->pw_uid && 329 setusercontext(lc, pwd, pwd->pw_uid, LOGIN_SETGROUP) == -1) 330 err(EXIT_FAILURE, "setting user context"); 331 332 addgroup(lc, gname, pwd, ruid, GROUP_PASSWORD); 333 334 if (setusercontext(lc, pwd, pwd->pw_uid, 335 (u_int)(asthem ? (LOGIN_SETPRIORITY | LOGIN_SETUMASK) : 0) | 336 LOGIN_SETRESOURCES | LOGIN_SETUSER) == -1) 337 err(EXIT_FAILURE, "setting user context"); 338 # else 339 if (setusercontext(lc, pwd, pwd->pw_uid, 340 (u_int)(asthem ? (LOGIN_SETPRIORITY | LOGIN_SETUMASK) : 0) | 341 LOGIN_SETRESOURCES | LOGIN_SETGROUP | LOGIN_SETUSER) == -1) 342 err(EXIT_FAILURE, "setting user context"); 343 # endif 344 #else 345 if (setgid(pwd->pw_gid) == -1) 346 err(EXIT_FAILURE, "setgid"); 347 /* if we aren't changing users, keep the current group members */ 348 if (ruid != pwd->pw_uid && initgroups(user, pwd->pw_gid) != 0) 349 errx(EXIT_FAILURE, "initgroups failed"); 350 # ifdef ALLOW_GROUP_CHANGE 351 addgroup(/*EMPTY*/, gname, pwd, ruid, GROUP_PASSWORD); 352 # endif 353 if (setuid(pwd->pw_uid) == -1) 354 err(EXIT_FAILURE, "setuid"); 355 #endif 356 357 if (!asme) { 358 if (asthem) { 359 p = getenv("TERM"); 360 /* Create an empty environment */ 361 environ = emalloc(sizeof(char *)); 362 environ[0] = NULL; 363 #ifdef LOGIN_CAP 364 if (setusercontext(lc, pwd, pwd->pw_uid, 365 LOGIN_SETPATH) == -1) 366 err(EXIT_FAILURE, "setting user context"); 367 #else 368 (void)setenv("PATH", _PATH_DEFPATH, 1); 369 #endif 370 if (p) 371 (void)setenv("TERM", p, 1); 372 if (gohome && chdir(pwd->pw_dir) == -1) 373 errx(EXIT_FAILURE, "no directory"); 374 } 375 376 if (asthem || pwd->pw_uid) { 377 (void)setenv("LOGNAME", pwd->pw_name, 1); 378 (void)setenv("USER", pwd->pw_name, 1); 379 } 380 (void)setenv("HOME", pwd->pw_dir, 1); 381 (void)setenv("SHELL", shell, 1); 382 } 383 (void)setenv("SU_FROM", username, 1); 384 385 if (iscsh == YES) { 386 if (fastlogin) 387 *np-- = __UNCONST("-f"); 388 if (asme) 389 *np-- = __UNCONST("-m"); 390 } else { 391 if (fastlogin) 392 (void)unsetenv("ENV"); 393 } 394 395 if (asthem) { 396 avshellbuf[0] = '-'; 397 (void)estrlcpy(avshellbuf + 1, avshell, sizeof(avshellbuf) - 1); 398 avshell = avshellbuf; 399 } else if (iscsh == YES) { 400 /* csh strips the first character... */ 401 avshellbuf[0] = '_'; 402 (void)estrlcpy(avshellbuf + 1, avshell, sizeof(avshellbuf) - 1); 403 avshell = avshellbuf; 404 } 405 *np = __UNCONST(avshell); 406 407 #ifdef BSD4_4 408 if (pwd->pw_change || pwd->pw_expire) 409 (void)gettimeofday(&tp, NULL); 410 if (pwd->pw_change) { 411 if (tp.tv_sec >= pwd->pw_change) { 412 (void)printf("%s -- %s's password has expired.\n", 413 (ruid ? "Sorry" : "Note"), user); 414 if (ruid != 0) 415 exit(EXIT_FAILURE); 416 } else if (pwd->pw_change - tp.tv_sec < pw_warntime) 417 (void)printf("Warning: %s's password expires on %s", 418 user, ctime(&pwd->pw_change)); 419 } 420 if (pwd->pw_expire) { 421 if (tp.tv_sec >= pwd->pw_expire) { 422 (void)printf("%s -- %s's account has expired.\n", 423 (ruid ? "Sorry" : "Note"), user); 424 if (ruid != 0) 425 exit(EXIT_FAILURE); 426 } else if (pwd->pw_expire - tp.tv_sec < 427 _PASSWORD_WARNDAYS * SECSPERDAY) 428 (void)printf("Warning: %s's account expires on %s", 429 user, ctime(&pwd->pw_expire)); 430 } 431 #endif 432 if (ruid != 0) 433 syslog(LOG_NOTICE, "%s to %s%s", 434 username, pwd->pw_name, ontty()); 435 436 /* Raise our priority back to what we had before */ 437 (void)setpriority(PRIO_PROCESS, 0, prio); 438 439 (void)execv(shell, np); 440 err(EXIT_FAILURE, "%s", shell); 441 /* NOTREACHED */ 442 } 443 444 445 #ifdef KERBEROS5 446 static int 447 kerberos5(char *username, const char *user, uid_t uid) 448 { 449 krb5_error_code ret; 450 krb5_context context; 451 krb5_principal princ = NULL; 452 krb5_ccache ccache, ccache2; 453 char *cc_name; 454 const char *filename; 455 456 ret = krb5_init_context(&context); 457 if (ret) 458 return 1; 459 460 if (strcmp(user, "root") == 0) 461 ret = krb5_make_principal(context, &princ, 462 NULL, username, "root", NULL); 463 else 464 ret = krb5_make_principal(context, &princ, 465 NULL, user, NULL); 466 if (ret) 467 goto fail; 468 if (!krb5_kuserok(context, princ, user) && !uid) { 469 warnx("kerberos5: not in %s's ACL.", user); 470 goto fail; 471 } 472 ret = krb5_cc_new_unique(context, krb5_mcc_ops.prefix, NULL, &ccache); 473 if (ret) 474 goto fail; 475 ret = krb5_verify_user_lrealm(context, princ, ccache, NULL, TRUE, 476 NULL); 477 if (ret) { 478 krb5_cc_destroy(context, ccache); 479 switch (ret) { 480 case KRB5_LIBOS_PWDINTR : 481 break; 482 case KRB5KRB_AP_ERR_BAD_INTEGRITY: 483 case KRB5KRB_AP_ERR_MODIFIED: 484 krb5_warnx(context, "Password incorrect"); 485 break; 486 default : 487 krb5_warn(context, ret, "krb5_verify_user"); 488 break; 489 } 490 goto fail; 491 } 492 ret = krb5_cc_new_unique(context, krb5_mcc_ops.prefix, NULL, &ccache2); 493 if (ret) { 494 krb5_cc_destroy(context, ccache); 495 goto fail; 496 } 497 ret = krb5_cc_copy_cache(context, ccache, ccache2); 498 if (ret) { 499 krb5_cc_destroy(context, ccache); 500 krb5_cc_destroy(context, ccache2); 501 goto fail; 502 } 503 504 filename = krb5_cc_get_name(context, ccache2); 505 (void)easprintf(&cc_name, "%s:%s", krb5_cc_get_type(context, ccache2), 506 filename); 507 if (chown(filename, uid, NOGROUP) == -1) { 508 warn("chown %s", filename); 509 free(cc_name); 510 krb5_cc_destroy(context, ccache); 511 krb5_cc_destroy(context, ccache2); 512 goto fail; 513 } 514 515 (void)setenv("KRB5CCNAME", cc_name, 1); 516 free(cc_name); 517 krb5_cc_close(context, ccache2); 518 krb5_cc_destroy(context, ccache); 519 return 0; 520 521 fail: 522 if (princ != NULL) 523 krb5_free_principal(context, princ); 524 krb5_free_context(context); 525 return 1; 526 } 527 #endif /* KERBEROS5 */ 528 529 static int 530 check_ingroup(int gid, const char *gname, const char *user, int ifempty) 531 { 532 struct group *gr; 533 char **g; 534 #ifdef SU_INDIRECT_GROUP 535 char **gr_mem; 536 int n = 0; 537 int i = 0; 538 #endif 539 int ok = 0; 540 541 if (gname == NULL) 542 gr = getgrgid((gid_t) gid); 543 else 544 gr = getgrnam(gname); 545 546 /* 547 * XXX we are relying on the fact that we only set ifempty when 548 * calling to check for SU_GROUP and that is the only time a 549 * missing group is acceptable. 550 */ 551 if (gr == NULL) 552 return ifempty; 553 if (!*gr->gr_mem) /* empty */ 554 return ifempty; 555 556 /* 557 * Ok, first see if user is in gr_mem 558 */ 559 for (g = gr->gr_mem; *g; ++g) { 560 if (strcmp(*g, user) == 0) 561 return 1; /* ok */ 562 #ifdef SU_INDIRECT_GROUP 563 ++n; /* count them */ 564 #endif 565 } 566 #ifdef SU_INDIRECT_GROUP 567 /* 568 * No. 569 * Now we need to duplicate the gr_mem list, and recurse for 570 * each member to see if it is a group, and if so whether user is 571 * in it. 572 */ 573 gr_mem = NULL; 574 ereallocarr(&gr_mem, n + 1, sizeof(char *)); 575 for (g = gr->gr_mem, i = 0; *g; ++g) { 576 gr_mem[i] = estrdup(*g); 577 i++; 578 } 579 gr_mem[i++] = NULL; 580 581 for (g = gr_mem; ok == 0 && *g; ++g) { 582 /* 583 * If we get this far we don't accept empty/missing groups. 584 */ 585 ok = check_ingroup(-1, *g, user, 0); 586 } 587 for (g = gr_mem; *g; ++g) { 588 free(*g); 589 } 590 free(gr_mem); 591 #endif 592 return ok; 593 } 594
Indexes created Sat Sep 20 22:09:52 GMT 2025