su.c revision 1.20
1 /* $NetBSD: su.c,v 1.20 1997/10/24 14:44:35 christos Exp $ */ 2 3 /* 4 * Copyright (c) 1988 The Regents of the University of California. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. All advertising materials mentioning features or use of this software 16 * must display the following acknowledgement: 17 * This product includes software developed by the University of 18 * California, Berkeley and its contributors. 19 * 4. Neither the name of the University nor the names of its contributors 20 * may be used to endorse or promote products derived from this software 21 * without specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 26 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33 * SUCH DAMAGE. 34 */ 35 36 #include <sys/cdefs.h> 37 #ifndef lint 38 __COPYRIGHT( 39 "@(#) Copyright (c) 1988 The Regents of the University of California.\n\ 40 All rights reserved.\n"); 41 #endif /* not lint */ 42 43 #ifndef lint 44 #if 0 45 static char sccsid[] = "@(#)su.c 8.3 (Berkeley) 4/2/94";*/ 46 #else 47 __RCSID("$NetBSD: su.c,v 1.20 1997/10/24 14:44:35 christos Exp $"); 48 #endif 49 #endif /* not lint */ 50 51 #include <sys/param.h> 52 #include <sys/time.h> 53 #include <sys/resource.h> 54 #include <err.h> 55 #include <errno.h> 56 #include <grp.h> 57 #include <paths.h> 58 #include <pwd.h> 59 #include <stdio.h> 60 #include <skey.h> 61 #include <stdlib.h> 62 #include <string.h> 63 #include <syslog.h> 64 #include <tzfile.h> 65 #include <unistd.h> 66 67 #ifdef KERBEROS 68 #include <kerberosIV/des.h> 69 #include <kerberosIV/krb.h> 70 #include <netdb.h> 71 72 #define ARGSTR "-Kflm" 73 74 int use_kerberos = 1; 75 76 static int kerberos __P((char *, char *, int)); 77 static int koktologin __P((char *, char *, char *)); 78 79 #else 80 #define ARGSTR "-flm" 81 #endif 82 83 #ifndef SUGROUP 84 #define SUGROUP "wheel" 85 #endif 86 87 88 int main __P((int, char **)); 89 90 static int chshell __P((char *)); 91 static char *ontty __P((void)); 92 93 94 int 95 main(argc, argv) 96 int argc; 97 char **argv; 98 { 99 extern char *__progname; 100 extern char **environ; 101 struct passwd *pwd; 102 char *p; 103 struct group *gr; 104 struct timeval tp; 105 uid_t ruid; 106 int asme, ch, asthem, fastlogin, prio; 107 enum { UNSET, YES, NO } iscsh = UNSET; 108 char *user, *shell, *avshell, *username, *cleanenv[10], **np; 109 char shellbuf[MAXPATHLEN], avshellbuf[MAXPATHLEN]; 110 111 asme = asthem = fastlogin = 0; 112 shell = NULL; 113 while ((ch = getopt(argc, argv, ARGSTR)) != -1) 114 switch((char)ch) { 115 #ifdef KERBEROS 116 case 'K': 117 use_kerberos = 0; 118 break; 119 #endif 120 case 'f': 121 fastlogin = 1; 122 break; 123 case '-': 124 case 'l': 125 asme = 0; 126 asthem = 1; 127 break; 128 case 'm': 129 asme = 1; 130 asthem = 0; 131 break; 132 case '?': 133 default: 134 (void)fprintf(stderr, 135 "Usage: %s [%s] [login [shell arguments]]\n", 136 __progname, ARGSTR); 137 exit(1); 138 } 139 argv += optind; 140 141 errno = 0; 142 prio = getpriority(PRIO_PROCESS, 0); 143 if (errno) 144 prio = 0; 145 (void)setpriority(PRIO_PROCESS, 0, -2); 146 openlog("su", LOG_CONS, 0); 147 148 /* get current login name and shell */ 149 ruid = getuid(); 150 username = getlogin(); 151 if (username == NULL || (pwd = getpwnam(username)) == NULL || 152 pwd->pw_uid != ruid) 153 pwd = getpwuid(ruid); 154 if (pwd == NULL) { 155 errx(1, "who are you?"); 156 } 157 username = strdup(pwd->pw_name); 158 if (asme) 159 if (pwd->pw_shell && *pwd->pw_shell) 160 shell = strncpy(shellbuf, pwd->pw_shell, 161 sizeof(shellbuf) + 1); 162 else { 163 shell = _PATH_BSHELL; 164 iscsh = NO; 165 } 166 167 /* get target login information, default to root */ 168 user = *argv ? *argv : "root"; 169 np = *argv ? argv : argv-1; 170 171 if ((pwd = getpwnam(user)) == NULL) { 172 errx(1, "unknown login %s", user); 173 } 174 175 if (ruid) { 176 #ifdef KERBEROS 177 if (!use_kerberos || kerberos(username, user, pwd->pw_uid)) 178 #endif 179 { 180 /* Only allow those in group SUGROUP to su to root, 181 but only if that group has any members. 182 If SUGROUP has no members, allow anyone to su root */ 183 if (pwd->pw_uid == 0 && 184 (gr = getgrnam(SUGROUP)) && *gr->gr_mem) { 185 char **g; 186 187 for (g = gr->gr_mem; ; g++) { 188 if (*g == NULL) 189 errx(1, 190 "you are not listed in the correct secondary group (%s) to su %s.", 191 SUGROUP, user); 192 if (strcmp(username, *g) == 0) 193 break; 194 } 195 } 196 /* if target requires a password, verify it */ 197 if (*pwd->pw_passwd) { 198 p = getpass("Password:"); 199 #ifdef SKEY 200 if (strcasecmp(p, "s/key") == 0) { 201 if (skey_haskey(user)) 202 errx(1, "Sorry, you have no s/key."); 203 else { 204 if (skey_authenticate(user)) { 205 goto badlogin; 206 } 207 } 208 209 } else 210 #endif 211 if (strcmp(pwd->pw_passwd, crypt(p, pwd->pw_passwd))) { 212 badlogin: 213 fprintf(stderr, "Sorry\n"); 214 syslog(LOG_AUTH|LOG_WARNING, 215 "BAD SU %s to %s%s", username, 216 user, ontty()); 217 exit(1); 218 } 219 } 220 } 221 } 222 223 if (asme) { 224 /* if asme and non-standard target shell, must be root */ 225 if (!chshell(pwd->pw_shell) && ruid) 226 errx(1,"permission denied (shell)."); 227 } else if (pwd->pw_shell && *pwd->pw_shell) { 228 shell = pwd->pw_shell; 229 iscsh = UNSET; 230 } else { 231 shell = _PATH_BSHELL; 232 iscsh = NO; 233 } 234 235 if ((p = strrchr(shell, '/')) != NULL) 236 avshell = p+1; 237 else 238 avshell = shell; 239 240 /* if we're forking a csh, we want to slightly muck the args */ 241 if (iscsh == UNSET) 242 iscsh = strstr(avshell, "csh") ? YES : NO; 243 244 /* set permissions */ 245 if (setgid(pwd->pw_gid) < 0) 246 err(1, "setgid"); 247 if (initgroups(user, pwd->pw_gid)) 248 errx(1, "initgroups failed"); 249 if (setuid(pwd->pw_uid) < 0) 250 err(1, "setuid"); 251 252 if (!asme) { 253 if (asthem) { 254 p = getenv("TERM"); 255 cleanenv[0] = NULL; 256 environ = cleanenv; 257 (void)setenv("PATH", _PATH_DEFPATH, 1); 258 if (p) 259 (void)setenv("TERM", p, 1); 260 if (chdir(pwd->pw_dir) < 0) 261 errx(1, "no directory"); 262 } 263 if (asthem || pwd->pw_uid) 264 (void)setenv("USER", pwd->pw_name, 1); 265 (void)setenv("HOME", pwd->pw_dir, 1); 266 (void)setenv("SHELL", shell, 1); 267 } 268 269 if (iscsh == YES) { 270 if (fastlogin) 271 *np-- = "-f"; 272 if (asme) 273 *np-- = "-m"; 274 } 275 276 if (asthem) { 277 avshellbuf[0] = '-'; 278 (void)strncpy(avshellbuf+1, avshell, sizeof(avshellbuf) - 2); 279 avshell = avshellbuf; 280 } else if (iscsh == YES) { 281 /* csh strips the first character... */ 282 avshellbuf[0] = '_'; 283 (void)strncpy(avshellbuf+1, avshell, sizeof(avshellbuf) - 2); 284 avshell = avshellbuf; 285 } 286 *np = avshell; 287 288 if (pwd->pw_change || pwd->pw_expire) 289 (void)gettimeofday(&tp, (struct timezone *)NULL); 290 if (pwd->pw_change) 291 if (tp.tv_sec >= pwd->pw_change) { 292 (void)printf("%s -- %s's password has expired.\n", 293 (ruid ? "Sorry" : "Note"), user); 294 if (ruid != 0) 295 exit(1); 296 } else if (pwd->pw_change - tp.tv_sec < 297 _PASSWORD_WARNDAYS * SECSPERDAY) 298 (void)printf("Warning: %s's password expires on %s", 299 user, ctime(&pwd->pw_change)); 300 if (pwd->pw_expire) 301 if (tp.tv_sec >= pwd->pw_expire) { 302 (void)printf("%s -- %s's account has expired.\n", 303 (ruid ? "Sorry" : "Note"), user); 304 if (ruid != 0) 305 exit(1); 306 } else if (pwd->pw_expire - tp.tv_sec < 307 _PASSWORD_WARNDAYS * SECSPERDAY) 308 (void)printf("Warning: %s's account expires on %s", 309 user, ctime(&pwd->pw_expire)); 310 311 if (ruid != 0) 312 syslog(LOG_NOTICE|LOG_AUTH, "%s to %s%s", 313 username, user, ontty()); 314 315 (void)setpriority(PRIO_PROCESS, 0, prio); 316 317 execv(shell, np); 318 err(1, "%s", shell); 319 } 320 321 static int 322 chshell(sh) 323 char *sh; 324 { 325 char *cp; 326 327 while ((cp = getusershell()) != NULL) 328 if (!strcmp(cp, sh)) 329 return (1); 330 return (0); 331 } 332 333 static char * 334 ontty() 335 { 336 char *p; 337 static char buf[MAXPATHLEN + 4]; 338 339 buf[0] = 0; 340 if ((p = ttyname(STDERR_FILENO)) != NULL) 341 (void)snprintf(buf, sizeof buf, " on %s", p); 342 return (buf); 343 } 344 345 #ifdef KERBEROS 346 static int 347 kerberos(username, user, uid) 348 char *username, *user; 349 int uid; 350 { 351 KTEXT_ST ticket; 352 AUTH_DAT authdata; 353 struct hostent *hp; 354 int kerno; 355 u_long faddr; 356 char lrealm[REALM_SZ], krbtkfile[MAXPATHLEN]; 357 char hostname[MAXHOSTNAMELEN], savehost[MAXHOSTNAMELEN]; 358 359 if (krb_get_lrealm(lrealm, 1) != KSUCCESS) 360 return (1); 361 if (koktologin(username, lrealm, user) && !uid) { 362 warnx("kerberos: not in %s's ACL.", user); 363 return (1); 364 } 365 (void)(void)snprintf(krbtkfile, sizeof krbtkfile, "%s_%s_%d", TKT_ROOT, 366 user, getuid()); 367 368 (void)setenv("KRBTKFILE", krbtkfile, 1); 369 (void)krb_set_tkt_string(krbtkfile); 370 /* 371 * Set real as well as effective ID to 0 for the moment, 372 * to make the kerberos library do the right thing. 373 */ 374 if (setuid(0) < 0) { 375 warn("setuid"); 376 return (1); 377 } 378 379 /* 380 * Little trick here -- if we are su'ing to root, 381 * we need to get a ticket for "xxx.root", where xxx represents 382 * the name of the person su'ing. Otherwise (non-root case), 383 * we need to get a ticket for "yyy.", where yyy represents 384 * the name of the person being su'd to, and the instance is null 385 * 386 * We should have a way to set the ticket lifetime, 387 * with a system default for root. 388 */ 389 kerno = krb_get_pw_in_tkt((uid == 0 ? username : user), 390 (uid == 0 ? "root" : ""), lrealm, 391 "krbtgt", lrealm, DEFAULT_TKT_LIFE, 0); 392 393 if (kerno != KSUCCESS) { 394 if (kerno == KDC_PR_UNKNOWN) { 395 warnx("kerberos: principal unknown: %s.%s@%s", 396 (uid == 0 ? username : user), 397 (uid == 0 ? "root" : ""), lrealm); 398 return (1); 399 } 400 warnx("kerberos: unable to su: %s", krb_err_txt[kerno]); 401 syslog(LOG_NOTICE|LOG_AUTH, 402 "BAD Kerberos SU: %s to %s%s: %s", 403 username, user, ontty(), krb_err_txt[kerno]); 404 return (1); 405 } 406 407 if (chown(krbtkfile, uid, -1) < 0) { 408 warn("chown"); 409 (void)unlink(krbtkfile); 410 return (1); 411 } 412 413 (void)setpriority(PRIO_PROCESS, 0, -2); 414 415 if (gethostname(hostname, sizeof(hostname)) == -1) { 416 warn("gethostname"); 417 dest_tkt(); 418 return (1); 419 } 420 421 (void)strncpy(savehost, krb_get_phost(hostname), sizeof(savehost)); 422 savehost[sizeof(savehost) - 1] = '\0'; 423 424 kerno = krb_mk_req(&ticket, "rcmd", savehost, lrealm, 33); 425 426 if (kerno == KDC_PR_UNKNOWN) { 427 warnx("Warning: TGT not verified."); 428 syslog(LOG_NOTICE|LOG_AUTH, 429 "%s to %s%s, TGT not verified (%s); %s.%s not registered?", 430 username, user, ontty(), krb_err_txt[kerno], 431 "rcmd", savehost); 432 } else if (kerno != KSUCCESS) { 433 warnx("Unable to use TGT: %s", krb_err_txt[kerno]); 434 syslog(LOG_NOTICE|LOG_AUTH, "failed su: %s to %s%s: %s", 435 username, user, ontty(), krb_err_txt[kerno]); 436 dest_tkt(); 437 return (1); 438 } else { 439 if (!(hp = gethostbyname(hostname))) { 440 warnx("can't get addr of %s", hostname); 441 dest_tkt(); 442 return (1); 443 } 444 memmove((char *)&faddr, (char *)hp->h_addr, sizeof(faddr)); 445 446 if ((kerno = krb_rd_req(&ticket, "rcmd", savehost, faddr, 447 &authdata, "")) != KSUCCESS) { 448 warnx("kerberos: unable to verify rcmd ticket: %s\n", 449 krb_err_txt[kerno]); 450 syslog(LOG_NOTICE|LOG_AUTH, 451 "failed su: %s to %s%s: %s", username, 452 user, ontty(), krb_err_txt[kerno]); 453 dest_tkt(); 454 return (1); 455 } 456 } 457 return (0); 458 } 459 460 static int 461 koktologin(name, realm, toname) 462 char *name, *realm, *toname; 463 { 464 AUTH_DAT *kdata; 465 AUTH_DAT kdata_st; 466 467 kdata = &kdata_st; 468 memset((char *)kdata, 0, sizeof(*kdata)); 469 (void)strncpy(kdata->pname, name, sizeof(kdata->pname) - 1); 470 (void)strncpy(kdata->pinst, 471 ((strcmp(toname, "root") == 0) ? "root" : ""), sizeof(kdata->pinst) - 1); 472 (void)strncpy(kdata->prealm, realm, sizeof(kdata->prealm) - 1); 473 return (kuserok(kdata, toname)); 474 } 475 #endif 476
Indexes created Mon Oct 27 04:09:48 GMT 2025