su.c revision 1.31
1 /* $NetBSD: su.c,v 1.31 1999/03/15 09:30:51 christos Exp $ */ 2 3 /* 4 * Copyright (c) 1988 The Regents of the University of California. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. All advertising materials mentioning features or use of this software 16 * must display the following acknowledgement: 17 * This product includes software developed by the University of 18 * California, Berkeley and its contributors. 19 * 4. Neither the name of the University nor the names of its contributors 20 * may be used to endorse or promote products derived from this software 21 * without specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 26 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33 * SUCH DAMAGE. 34 */ 35 36 #include <sys/cdefs.h> 37 #ifndef lint 38 __COPYRIGHT( 39 "@(#) Copyright (c) 1988 The Regents of the University of California.\n\ 40 All rights reserved.\n"); 41 #endif /* not lint */ 42 43 #ifndef lint 44 #if 0 45 static char sccsid[] = "@(#)su.c 8.3 (Berkeley) 4/2/94";*/ 46 #else 47 __RCSID("$NetBSD: su.c,v 1.31 1999/03/15 09:30:51 christos Exp $"); 48 #endif 49 #endif /* not lint */ 50 51 #include <sys/param.h> 52 #include <sys/time.h> 53 #include <sys/resource.h> 54 #include <err.h> 55 #include <errno.h> 56 #include <grp.h> 57 #include <paths.h> 58 #include <pwd.h> 59 #include <stdio.h> 60 #ifdef SKEY 61 #include <skey.h> 62 #endif 63 #include <stdlib.h> 64 #include <string.h> 65 #include <syslog.h> 66 #include <time.h> 67 #include <tzfile.h> 68 #include <unistd.h> 69 70 #ifdef KERBEROS 71 #include <kerberosIV/des.h> 72 #include <kerberosIV/krb.h> 73 #include <netdb.h> 74 75 #define ARGSTR "-Kflm" 76 77 int use_kerberos = 1; 78 79 static int kerberos __P((char *, char *, int)); 80 static int koktologin __P((char *, char *, char *)); 81 82 #else 83 #define ARGSTR "-flm" 84 #endif 85 86 #ifndef SUGROUP 87 #define SUGROUP "wheel" 88 #endif 89 90 int main __P((int, char **)); 91 92 static int chshell __P((const char *)); 93 static char *ontty __P((void)); 94 95 96 int 97 main(argc, argv) 98 int argc; 99 char **argv; 100 { 101 extern char *__progname; 102 extern char **environ; 103 struct passwd *pwd; 104 char *p; 105 struct group *gr; 106 #ifdef BSD4_4 107 struct timeval tp; 108 #endif 109 uid_t ruid; 110 int asme, ch, asthem, fastlogin, prio; 111 enum { UNSET, YES, NO } iscsh = UNSET; 112 char *user, *shell, *avshell, *username, *cleanenv[10], **np; 113 char *userpass; 114 char shellbuf[MAXPATHLEN], avshellbuf[MAXPATHLEN]; 115 116 asme = asthem = fastlogin = 0; 117 shell = NULL; 118 while ((ch = getopt(argc, argv, ARGSTR)) != -1) 119 switch((char)ch) { 120 #ifdef KERBEROS 121 case 'K': 122 use_kerberos = 0; 123 break; 124 #endif 125 case 'f': 126 fastlogin = 1; 127 break; 128 case '-': 129 case 'l': 130 asme = 0; 131 asthem = 1; 132 break; 133 case 'm': 134 asme = 1; 135 asthem = 0; 136 break; 137 case '?': 138 default: 139 (void)fprintf(stderr, 140 "Usage: %s [%s] [login [shell arguments]]\n", 141 __progname, ARGSTR); 142 exit(1); 143 } 144 argv += optind; 145 146 #ifndef BSD4_4 147 if (*argv && strcmp(*argv, "-") == 0) { 148 asme = 0; 149 asthem = 1; 150 argv++; 151 } 152 #endif 153 154 errno = 0; 155 prio = getpriority(PRIO_PROCESS, 0); 156 if (errno) 157 prio = 0; 158 (void)setpriority(PRIO_PROCESS, 0, -2); 159 openlog("su", LOG_CONS, 0); 160 161 /* get current login name and shell */ 162 ruid = getuid(); 163 username = getlogin(); 164 if (username == NULL || (pwd = getpwnam(username)) == NULL || 165 pwd->pw_uid != ruid) 166 pwd = getpwuid(ruid); 167 if (pwd == NULL) 168 errx(1, "who are you?"); 169 username = strdup(pwd->pw_name); 170 userpass = strdup(pwd->pw_passwd); 171 if (username == NULL || userpass == NULL) 172 err(1, "strdup"); 173 174 if (asme) { 175 if (pwd->pw_shell && *pwd->pw_shell) { 176 shell = strncpy(shellbuf, pwd->pw_shell, 177 sizeof(shellbuf) - 1); 178 shellbuf[sizeof(shellbuf) - 1] = '\0'; 179 } else { 180 shell = _PATH_BSHELL; 181 iscsh = NO; 182 } 183 } 184 /* get target login information, default to root */ 185 user = *argv ? *argv : "root"; 186 np = *argv ? argv : argv-1; 187 188 if ((pwd = getpwnam(user)) == NULL) 189 errx(1, "unknown login %s", user); 190 191 if (ruid 192 #ifdef KERBEROS 193 && (!use_kerberos || kerberos(username, user, pwd->pw_uid)) 194 #endif 195 ) { 196 char *pass = pwd->pw_passwd; 197 int ok = pwd->pw_uid != 0; 198 char **g; 199 200 /* 201 * Only allow those in group SUGROUP to su to root, 202 * but only if that group has any members. 203 * If SUGROUP has no members, allow anyone to su root 204 */ 205 if (!ok && 206 (gr = getgrnam(SUGROUP)) && *gr->gr_mem) { 207 208 for (g = gr->gr_mem; ; g++) { 209 if (*g == NULL) { 210 ok = 0; 211 break; 212 } 213 if (strcmp(username, *g) == 0) { 214 ok = 1; 215 break; 216 } 217 } 218 } 219 #ifdef ROOTAUTH 220 /* 221 * Allow those in group rootauth to su to root, by supplying 222 * their own password. 223 */ 224 if (!ok && (gr = getgrnam(ROOTAUTH))) 225 for (g = gr->gr_mem;; ++g) { 226 if (!*g) { 227 ok = 0; 228 break; 229 } 230 if (!strcmp(username, *g)) { 231 pass = userpass; 232 user = username; 233 ok = 1; 234 break; 235 } 236 } 237 #endif 238 if (!ok) 239 errx(1, 240 "you are not listed in the correct secondary group (%s) to su %s.", 241 SUGROUP, user); 242 /* if target requires a password, verify it */ 243 if (*pass) { 244 p = getpass("Password:"); 245 #ifdef SKEY 246 if (strcasecmp(p, "s/key") == 0) { 247 if (skey_haskey(user)) 248 errx(1, "Sorry, you have no s/key."); 249 else { 250 if (skey_authenticate(user)) { 251 goto badlogin; 252 } 253 } 254 255 } else 256 #endif 257 if (strcmp(pass, crypt(p, pass))) { 258 #ifdef SKEY 259 badlogin: 260 #endif 261 fprintf(stderr, "Sorry\n"); 262 syslog(LOG_AUTH|LOG_WARNING, 263 "BAD SU %s to %s%s", username, 264 pwd->pw_name, ontty()); 265 exit(1); 266 } 267 } 268 } 269 270 if (asme) { 271 /* if asme and non-standard target shell, must be root */ 272 if (!chshell(pwd->pw_shell) && ruid) 273 errx(1,"permission denied (shell)."); 274 } else if (pwd->pw_shell && *pwd->pw_shell) { 275 shell = pwd->pw_shell; 276 iscsh = UNSET; 277 } else { 278 shell = _PATH_BSHELL; 279 iscsh = NO; 280 } 281 282 if ((p = strrchr(shell, '/')) != NULL) 283 avshell = p+1; 284 else 285 avshell = shell; 286 287 /* if we're forking a csh, we want to slightly muck the args */ 288 if (iscsh == UNSET) 289 iscsh = strstr(avshell, "csh") ? YES : NO; 290 291 /* set permissions */ 292 if (setgid(pwd->pw_gid) < 0) 293 err(1, "setgid"); 294 if (initgroups(user, pwd->pw_gid)) 295 errx(1, "initgroups failed"); 296 if (setuid(pwd->pw_uid) < 0) 297 err(1, "setuid"); 298 299 if (!asme) { 300 if (asthem) { 301 p = getenv("TERM"); 302 cleanenv[0] = NULL; 303 environ = cleanenv; 304 (void)setenv("PATH", _PATH_DEFPATH, 1); 305 if (p) 306 (void)setenv("TERM", p, 1); 307 if (chdir(pwd->pw_dir) < 0) 308 errx(1, "no directory"); 309 } 310 if (asthem || pwd->pw_uid) 311 (void)setenv("USER", pwd->pw_name, 1); 312 (void)setenv("HOME", pwd->pw_dir, 1); 313 (void)setenv("SHELL", shell, 1); 314 } 315 316 if (iscsh == YES) { 317 if (fastlogin) 318 *np-- = "-f"; 319 if (asme) 320 *np-- = "-m"; 321 } 322 323 if (asthem) { 324 avshellbuf[0] = '-'; 325 (void)strncpy(avshellbuf+1, avshell, sizeof(avshellbuf) - 2); 326 avshell = avshellbuf; 327 } else if (iscsh == YES) { 328 /* csh strips the first character... */ 329 avshellbuf[0] = '_'; 330 (void)strncpy(avshellbuf+1, avshell, sizeof(avshellbuf) - 2); 331 avshell = avshellbuf; 332 } 333 *np = avshell; 334 335 #ifdef BSD4_4 336 if (pwd->pw_change || pwd->pw_expire) 337 (void)gettimeofday(&tp, (struct timezone *)NULL); 338 if (pwd->pw_change) { 339 if (tp.tv_sec >= pwd->pw_change) { 340 (void)printf("%s -- %s's password has expired.\n", 341 (ruid ? "Sorry" : "Note"), user); 342 if (ruid != 0) 343 exit(1); 344 } else if (pwd->pw_change - tp.tv_sec < 345 _PASSWORD_WARNDAYS * SECSPERDAY) 346 (void)printf("Warning: %s's password expires on %s", 347 user, ctime(&pwd->pw_change)); 348 } 349 if (pwd->pw_expire) { 350 if (tp.tv_sec >= pwd->pw_expire) { 351 (void)printf("%s -- %s's account has expired.\n", 352 (ruid ? "Sorry" : "Note"), user); 353 if (ruid != 0) 354 exit(1); 355 } else if (pwd->pw_expire - tp.tv_sec < 356 _PASSWORD_WARNDAYS * SECSPERDAY) 357 (void)printf("Warning: %s's account expires on %s", 358 user, ctime(&pwd->pw_expire)); 359 } 360 #endif 361 if (ruid != 0) 362 syslog(LOG_NOTICE|LOG_AUTH, "%s to %s%s", 363 username, pwd->pw_name, ontty()); 364 365 (void)setpriority(PRIO_PROCESS, 0, prio); 366 367 execv(shell, np); 368 err(1, "%s", shell); 369 /* NOTREACHED */ 370 } 371 372 static int 373 chshell(sh) 374 const char *sh; 375 { 376 const char *cp; 377 378 while ((cp = getusershell()) != NULL) 379 if (!strcmp(cp, sh)) 380 return (1); 381 return (0); 382 } 383 384 static char * 385 ontty() 386 { 387 char *p; 388 static char buf[MAXPATHLEN + 4]; 389 390 buf[0] = 0; 391 if ((p = ttyname(STDERR_FILENO)) != NULL) 392 (void)snprintf(buf, sizeof buf, " on %s", p); 393 return (buf); 394 } 395 396 #ifdef KERBEROS 397 static int 398 kerberos(username, user, uid) 399 char *username, *user; 400 int uid; 401 { 402 KTEXT_ST ticket; 403 AUTH_DAT authdata; 404 struct hostent *hp; 405 int kerno; 406 u_long faddr; 407 char lrealm[REALM_SZ], krbtkfile[MAXPATHLEN]; 408 char hostname[MAXHOSTNAMELEN + 1], savehost[MAXHOSTNAMELEN + 1]; 409 410 if (krb_get_lrealm(lrealm, 1) != KSUCCESS || 411 strcmp(lrealm, KRB_REALM) == 0) 412 return (1); 413 if (koktologin(username, lrealm, user) && !uid) { 414 warnx("kerberos: not in %s's ACL.", user); 415 return (1); 416 } 417 (void)snprintf(krbtkfile, sizeof krbtkfile, "%s_%s_%d", TKT_ROOT, 418 user, getuid()); 419 420 (void)setenv("KRBTKFILE", krbtkfile, 1); 421 (void)krb_set_tkt_string(krbtkfile); 422 /* 423 * Set real as well as effective ID to 0 for the moment, 424 * to make the kerberos library do the right thing. 425 */ 426 if (setuid(0) < 0) { 427 warn("setuid"); 428 return (1); 429 } 430 431 /* 432 * Little trick here -- if we are su'ing to root, 433 * we need to get a ticket for "xxx.root", where xxx represents 434 * the name of the person su'ing. Otherwise (non-root case), 435 * we need to get a ticket for "yyy.", where yyy represents 436 * the name of the person being su'd to, and the instance is null 437 * 438 * We should have a way to set the ticket lifetime, 439 * with a system default for root. 440 */ 441 kerno = krb_get_pw_in_tkt((uid == 0 ? username : user), 442 (uid == 0 ? "root" : ""), lrealm, 443 "krbtgt", lrealm, DEFAULT_TKT_LIFE, 0); 444 445 if (kerno != KSUCCESS) { 446 if (kerno == KDC_PR_UNKNOWN) { 447 warnx("kerberos: principal unknown: %s.%s@%s", 448 (uid == 0 ? username : user), 449 (uid == 0 ? "root" : ""), lrealm); 450 return (1); 451 } 452 warnx("kerberos: unable to su: %s", krb_err_txt[kerno]); 453 syslog(LOG_NOTICE|LOG_AUTH, 454 "BAD Kerberos SU: %s to %s%s: %s", 455 username, user, ontty(), krb_err_txt[kerno]); 456 return (1); 457 } 458 459 if (chown(krbtkfile, uid, -1) < 0) { 460 warn("chown"); 461 (void)unlink(krbtkfile); 462 return (1); 463 } 464 465 (void)setpriority(PRIO_PROCESS, 0, -2); 466 467 if (gethostname(hostname, sizeof(hostname)) == -1) { 468 warn("gethostname"); 469 dest_tkt(); 470 return (1); 471 } 472 hostname[sizeof(hostname) - 1] = '\0'; 473 474 (void)strncpy(savehost, krb_get_phost(hostname), sizeof(savehost)); 475 savehost[sizeof(savehost) - 1] = '\0'; 476 477 kerno = krb_mk_req(&ticket, "rcmd", savehost, lrealm, 33); 478 479 if (kerno == KDC_PR_UNKNOWN) { 480 warnx("Warning: TGT not verified."); 481 syslog(LOG_NOTICE|LOG_AUTH, 482 "%s to %s%s, TGT not verified (%s); %s.%s not registered?", 483 username, user, ontty(), krb_err_txt[kerno], 484 "rcmd", savehost); 485 } else if (kerno != KSUCCESS) { 486 warnx("Unable to use TGT: %s", krb_err_txt[kerno]); 487 syslog(LOG_NOTICE|LOG_AUTH, "failed su: %s to %s%s: %s", 488 username, user, ontty(), krb_err_txt[kerno]); 489 dest_tkt(); 490 return (1); 491 } else { 492 if (!(hp = gethostbyname(hostname))) { 493 warnx("can't get addr of %s", hostname); 494 dest_tkt(); 495 return (1); 496 } 497 memmove((char *)&faddr, (char *)hp->h_addr, sizeof(faddr)); 498 499 if ((kerno = krb_rd_req(&ticket, "rcmd", savehost, faddr, 500 &authdata, "")) != KSUCCESS) { 501 warnx("kerberos: unable to verify rcmd ticket: %s\n", 502 krb_err_txt[kerno]); 503 syslog(LOG_NOTICE|LOG_AUTH, 504 "failed su: %s to %s%s: %s", username, 505 user, ontty(), krb_err_txt[kerno]); 506 dest_tkt(); 507 return (1); 508 } 509 } 510 return (0); 511 } 512 513 static int 514 koktologin(name, realm, toname) 515 char *name, *realm, *toname; 516 { 517 AUTH_DAT *kdata; 518 AUTH_DAT kdata_st; 519 520 kdata = &kdata_st; 521 memset((char *)kdata, 0, sizeof(*kdata)); 522 (void)strncpy(kdata->pname, name, sizeof(kdata->pname) - 1); 523 (void)strncpy(kdata->pinst, 524 ((strcmp(toname, "root") == 0) ? "root" : ""), sizeof(kdata->pinst) - 1); 525 (void)strncpy(kdata->prealm, realm, sizeof(kdata->prealm) - 1); 526 return (kuserok(kdata, toname)); 527 } 528 #endif 529
Indexes created Mon Sep 29 03:10:08 GMT 2025