su.c revision 1.67
1 /* $NetBSD: su.c,v 1.67 2008/04/05 15:59:39 christos Exp $ */ 2 3 /* 4 * Copyright (c) 1988 The Regents of the University of California. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. Neither the name of the University nor the names of its contributors 16 * may be used to endorse or promote products derived from this software 17 * without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32 #include <sys/cdefs.h> 33 #ifndef lint 34 __COPYRIGHT( 35 "@(#) Copyright (c) 1988 The Regents of the University of California.\n\ 36 All rights reserved.\n"); 37 #endif /* not lint */ 38 39 #ifndef lint 40 #if 0 41 static char sccsid[] = "@(#)su.c 8.3 (Berkeley) 4/2/94";*/ 42 #else 43 __RCSID("$NetBSD: su.c,v 1.67 2008/04/05 15:59:39 christos Exp $"); 44 #endif 45 #endif /* not lint */ 46 47 #include <sys/param.h> 48 #include <sys/time.h> 49 #include <sys/resource.h> 50 #include <err.h> 51 #include <errno.h> 52 #include <grp.h> 53 #include <paths.h> 54 #include <pwd.h> 55 #include <stdio.h> 56 #ifdef SKEY 57 #include <skey.h> 58 #endif 59 #include <stdlib.h> 60 #include <string.h> 61 #include <syslog.h> 62 #include <time.h> 63 #include <tzfile.h> 64 #include <unistd.h> 65 #include <util.h> 66 67 #ifdef LOGIN_CAP 68 #include <login_cap.h> 69 #endif 70 71 #ifdef KERBEROS5 72 #include <krb5.h> 73 #endif 74 75 #ifdef ALLOW_GROUP_CHANGE 76 #include "grutil.h" 77 #endif 78 #include "suutil.h" 79 80 #ifdef KERBEROS5 81 #define ARGSTRX "-Kdflm" 82 static int kerberos5(char *, const char *, uid_t); 83 int use_kerberos = 1; 84 #else 85 #define ARGSTRX "-dflm" 86 #endif 87 88 #ifndef SU_GROUP 89 #define SU_GROUP "wheel" 90 #endif 91 92 #define GROUP_PASSWORD "Group Password:" 93 94 #ifdef LOGIN_CAP 95 #define ARGSTR ARGSTRX "c:" 96 #else 97 #define ARGSTR ARGSTRX 98 #endif 99 100 static int check_ingroup(int, const char *, const char *, int); 101 102 int 103 main(int argc, char **argv) 104 { 105 extern char **environ; 106 struct passwd *pwd; 107 char *p; 108 #ifdef BSD4_4 109 struct timeval tp; 110 #endif 111 uid_t ruid; 112 int asme, ch, asthem, fastlogin, prio, gohome; 113 enum { UNSET, YES, NO } iscsh = UNSET; 114 const char *user, *shell, *avshell; 115 char *username, **np; 116 char *userpass, *class; 117 char shellbuf[MAXPATHLEN], avshellbuf[MAXPATHLEN]; 118 time_t pw_warntime = _PASSWORD_WARNDAYS * SECSPERDAY; 119 #ifdef LOGIN_CAP 120 login_cap_t *lc; 121 #endif 122 #ifdef ALLOW_GROUP_CHANGE 123 char *gname; 124 #endif 125 126 (void)setprogname(argv[0]); 127 asme = asthem = fastlogin = 0; 128 gohome = 1; 129 shell = class = NULL; 130 while ((ch = getopt(argc, argv, ARGSTR)) != -1) 131 switch((char)ch) { 132 #ifdef KERBEROS5 133 case 'K': 134 use_kerberos = 0; 135 break; 136 #endif 137 #ifdef LOGIN_CAP 138 case 'c': 139 class = optarg; 140 break; 141 #endif 142 case 'd': 143 asme = 0; 144 asthem = 1; 145 gohome = 0; 146 break; 147 case 'f': 148 fastlogin = 1; 149 break; 150 case '-': 151 case 'l': 152 asme = 0; 153 asthem = 1; 154 break; 155 case 'm': 156 asme = 1; 157 asthem = 0; 158 break; 159 case '?': 160 default: 161 (void)fprintf(stderr, 162 #ifdef ALLOW_GROUP_CHANGE 163 "usage: %s [%s] [login[:group] [shell arguments]]\n", 164 #else 165 "usage: %s [%s] [login [shell arguments]]\n", 166 #endif 167 getprogname(), ARGSTR); 168 exit(EXIT_FAILURE); 169 } 170 argv += optind; 171 172 /* Lower the priority so su runs faster */ 173 errno = 0; 174 prio = getpriority(PRIO_PROCESS, 0); 175 if (errno) 176 prio = 0; 177 if (prio > -2) 178 (void)setpriority(PRIO_PROCESS, 0, -2); 179 openlog("su", 0, LOG_AUTH); 180 181 /* get current login name and shell */ 182 ruid = getuid(); 183 username = getlogin(); 184 if (username == NULL || (pwd = getpwnam(username)) == NULL || 185 pwd->pw_uid != ruid) 186 pwd = getpwuid(ruid); 187 if (pwd == NULL) 188 errx(EXIT_FAILURE, "who are you?"); 189 username = estrdup(pwd->pw_name); 190 userpass = estrdup(pwd->pw_passwd); 191 192 if (asme) { 193 if (pwd->pw_shell && *pwd->pw_shell) { 194 (void)estrlcpy(shellbuf, pwd->pw_shell, sizeof(shellbuf)); 195 shell = shellbuf; 196 } else { 197 shell = _PATH_BSHELL; 198 iscsh = NO; 199 } 200 } 201 /* get target login information, default to root */ 202 user = *argv ? *argv : "root"; 203 np = *argv ? argv : argv - 1; 204 205 #ifdef ALLOW_GROUP_CHANGE 206 if ((p = strchr(user, ':')) != NULL) { 207 *p = '\0'; 208 gname = ++p; 209 } 210 else 211 gname = NULL; 212 213 #ifdef ALLOW_EMPTY_USER 214 if (user[0] == '\0' && gname != NULL) 215 user = username; 216 #endif 217 #endif 218 if ((pwd = getpwnam(user)) == NULL) 219 errx(EXIT_FAILURE, "unknown login `%s'", user); 220 221 #ifdef LOGIN_CAP 222 /* force the usage of specified class */ 223 if (class) { 224 if (ruid) 225 errx(EXIT_FAILURE, "Only root may use -c"); 226 227 pwd->pw_class = class; 228 } 229 if ((lc = login_getclass(pwd->pw_class)) == NULL) 230 errx(EXIT_FAILURE, "Unknown class %s\n", pwd->pw_class); 231 232 pw_warntime = (time_t)login_getcaptime(lc, "password-warn", 233 _PASSWORD_WARNDAYS * SECSPERDAY, 234 _PASSWORD_WARNDAYS * SECSPERDAY); 235 #endif 236 237 if (ruid 238 #ifdef KERBEROS5 239 && (!use_kerberos || kerberos5(username, user, pwd->pw_uid)) 240 #endif 241 ) { 242 char *pass = pwd->pw_passwd; 243 int ok = pwd->pw_uid != 0; 244 245 #ifdef SU_ROOTAUTH 246 /* 247 * Allow those in group rootauth to su to root, by supplying 248 * their own password. 249 */ 250 if (!ok) { 251 if ((ok = check_ingroup(-1, SU_ROOTAUTH, username, 0))) { 252 pass = userpass; 253 user = username; 254 } 255 } 256 #endif 257 /* 258 * Only allow those in group SU_GROUP to su to root, 259 * but only if that group has any members. 260 * If SU_GROUP has no members, allow anyone to su root 261 */ 262 if (!ok) 263 ok = check_ingroup(-1, SU_GROUP, username, 1); 264 if (!ok) 265 errx(EXIT_FAILURE, 266 "you are not listed in the correct secondary group (%s) to su %s.", 267 SU_GROUP, user); 268 /* if target requires a password, verify it */ 269 if (*pass && pwd->pw_uid != ruid) { /* XXX - OK? */ 270 p = getpass("Password:"); 271 #ifdef SKEY 272 if (strcasecmp(p, "s/key") == 0) { 273 if (skey_haskey(user)) 274 errx(EXIT_FAILURE, 275 "Sorry, you have no s/key."); 276 else { 277 if (skey_authenticate(user)) { 278 goto badlogin; 279 } 280 } 281 282 } else 283 #endif 284 if (strcmp(pass, crypt(p, pass)) != 0) { 285 #ifdef SKEY 286 badlogin: 287 #endif 288 (void)fprintf(stderr, "Sorry\n"); 289 syslog(LOG_WARNING, 290 "BAD SU %s to %s%s", username, 291 pwd->pw_name, ontty()); 292 exit(EXIT_FAILURE); 293 } 294 } 295 } 296 297 if (asme) { 298 /* if asme and non-standard target shell, must be root */ 299 if (chshell(pwd->pw_shell) == 0 && ruid) 300 errx(EXIT_FAILURE, "permission denied (shell)."); 301 } else if (pwd->pw_shell && *pwd->pw_shell) { 302 shell = pwd->pw_shell; 303 iscsh = UNSET; 304 } else { 305 shell = _PATH_BSHELL; 306 iscsh = NO; 307 } 308 309 if ((p = strrchr(shell, '/')) != NULL) 310 avshell = p+1; 311 else 312 avshell = shell; 313 314 /* if we're forking a csh, we want to slightly muck the args */ 315 if (iscsh == UNSET) 316 iscsh = strstr(avshell, "csh") ? YES : NO; 317 318 /* set permissions */ 319 #ifdef LOGIN_CAP 320 # ifdef ALLOW_GROUP_CHANGE 321 /* if we aren't changing users, keep the current group members */ 322 if (ruid != pwd->pw_uid && 323 setusercontext(lc, pwd, pwd->pw_uid, LOGIN_SETGROUP) == -1) 324 err(EXIT_FAILURE, "setting user context"); 325 326 addgroup(lc, gname, pwd, ruid, GROUP_PASSWORD); 327 328 if (setusercontext(lc, pwd, pwd->pw_uid, 329 (u_int)(asthem ? (LOGIN_SETPRIORITY | LOGIN_SETUMASK) : 0) | 330 LOGIN_SETRESOURCES | LOGIN_SETUSER) == -1) 331 err(EXIT_FAILURE, "setting user context"); 332 # else 333 if (setusercontext(lc, pwd, pwd->pw_uid, 334 (u_int)(asthem ? (LOGIN_SETPRIORITY | LOGIN_SETUMASK) : 0) | 335 LOGIN_SETRESOURCES | LOGIN_SETGROUP | LOGIN_SETUSER) == -1) 336 err(EXIT_FAILURE, "setting user context"); 337 # endif 338 #else 339 if (setgid(pwd->pw_gid) == -1) 340 err(EXIT_FAILURE, "setgid"); 341 /* if we aren't changing users, keep the current group members */ 342 if (ruid != pwd->pw_uid && initgroups(user, pwd->pw_gid) != 0) 343 errx(EXIT_FAILURE, "initgroups failed"); 344 # ifdef ALLOW_GROUP_CHANGE 345 addgroup(/*EMPTY*/, gname, pwd, ruid, GROUP_PASSWORD); 346 # endif 347 if (setuid(pwd->pw_uid) == -1) 348 err(EXIT_FAILURE, "setuid"); 349 #endif 350 351 if (!asme) { 352 if (asthem) { 353 p = getenv("TERM"); 354 /* Create an empty environment */ 355 environ = emalloc(sizeof(char *)); 356 environ[0] = NULL; 357 #ifdef LOGIN_CAP 358 if (setusercontext(lc, pwd, pwd->pw_uid, 359 LOGIN_SETPATH) == -1) 360 err(EXIT_FAILURE, "setting user context"); 361 #else 362 (void)setenv("PATH", _PATH_DEFPATH, 1); 363 #endif 364 if (p) 365 (void)setenv("TERM", p, 1); 366 if (gohome && chdir(pwd->pw_dir) == -1) 367 errx(EXIT_FAILURE, "no directory"); 368 } 369 370 if (asthem || pwd->pw_uid) { 371 (void)setenv("LOGNAME", pwd->pw_name, 1); 372 (void)setenv("USER", pwd->pw_name, 1); 373 } 374 (void)setenv("HOME", pwd->pw_dir, 1); 375 (void)setenv("SHELL", shell, 1); 376 } 377 (void)setenv("SU_FROM", username, 1); 378 379 if (iscsh == YES) { 380 if (fastlogin) 381 *np-- = __UNCONST("-f"); 382 if (asme) 383 *np-- = __UNCONST("-m"); 384 } else { 385 if (fastlogin) 386 (void)unsetenv("ENV"); 387 } 388 389 if (asthem) { 390 avshellbuf[0] = '-'; 391 (void)estrlcpy(avshellbuf + 1, avshell, sizeof(avshellbuf) - 1); 392 avshell = avshellbuf; 393 } else if (iscsh == YES) { 394 /* csh strips the first character... */ 395 avshellbuf[0] = '_'; 396 (void)estrlcpy(avshellbuf + 1, avshell, sizeof(avshellbuf) - 1); 397 avshell = avshellbuf; 398 } 399 *np = __UNCONST(avshell); 400 401 #ifdef BSD4_4 402 if (pwd->pw_change || pwd->pw_expire) 403 (void)gettimeofday(&tp, (struct timezone *)NULL); 404 if (pwd->pw_change) { 405 if (tp.tv_sec >= pwd->pw_change) { 406 (void)printf("%s -- %s's password has expired.\n", 407 (ruid ? "Sorry" : "Note"), user); 408 if (ruid != 0) 409 exit(EXIT_FAILURE); 410 } else if (pwd->pw_change - tp.tv_sec < pw_warntime) 411 (void)printf("Warning: %s's password expires on %s", 412 user, ctime(&pwd->pw_change)); 413 } 414 if (pwd->pw_expire) { 415 if (tp.tv_sec >= pwd->pw_expire) { 416 (void)printf("%s -- %s's account has expired.\n", 417 (ruid ? "Sorry" : "Note"), user); 418 if (ruid != 0) 419 exit(EXIT_FAILURE); 420 } else if (pwd->pw_expire - tp.tv_sec < 421 _PASSWORD_WARNDAYS * SECSPERDAY) 422 (void)printf("Warning: %s's account expires on %s", 423 user, ctime(&pwd->pw_expire)); 424 } 425 #endif 426 if (ruid != 0) 427 syslog(LOG_NOTICE, "%s to %s%s", 428 username, pwd->pw_name, ontty()); 429 430 /* Raise our priority back to what we had before */ 431 (void)setpriority(PRIO_PROCESS, 0, prio); 432 433 (void)execv(shell, np); 434 err(EXIT_FAILURE, "%s", shell); 435 /* NOTREACHED */ 436 } 437 438 439 #ifdef KERBEROS5 440 static int 441 kerberos5(char *username, const char *user, uid_t uid) 442 { 443 krb5_error_code ret; 444 krb5_context context; 445 krb5_principal princ = NULL; 446 krb5_ccache ccache, ccache2; 447 char *cc_name; 448 const char *filename; 449 450 ret = krb5_init_context(&context); 451 if (ret) 452 return 1; 453 454 if (strcmp(user, "root") == 0) 455 ret = krb5_make_principal(context, &princ, 456 NULL, username, "root", NULL); 457 else 458 ret = krb5_make_principal(context, &princ, 459 NULL, user, NULL); 460 if (ret) 461 goto fail; 462 if (!krb5_kuserok(context, princ, user) && !uid) { 463 warnx("kerberos5: not in %s's ACL.", user); 464 goto fail; 465 } 466 ret = krb5_cc_gen_new(context, &krb5_mcc_ops, &ccache); 467 if (ret) 468 goto fail; 469 ret = krb5_verify_user_lrealm(context, princ, ccache, NULL, TRUE, 470 NULL); 471 if (ret) { 472 krb5_cc_destroy(context, ccache); 473 switch (ret) { 474 case KRB5_LIBOS_PWDINTR : 475 break; 476 case KRB5KRB_AP_ERR_BAD_INTEGRITY: 477 case KRB5KRB_AP_ERR_MODIFIED: 478 krb5_warnx(context, "Password incorrect"); 479 break; 480 default : 481 krb5_warn(context, ret, "krb5_verify_user"); 482 break; 483 } 484 goto fail; 485 } 486 ret = krb5_cc_gen_new(context, &krb5_fcc_ops, &ccache2); 487 if (ret) { 488 krb5_cc_destroy(context, ccache); 489 goto fail; 490 } 491 ret = krb5_cc_copy_cache(context, ccache, ccache2); 492 if (ret) { 493 krb5_cc_destroy(context, ccache); 494 krb5_cc_destroy(context, ccache2); 495 goto fail; 496 } 497 498 filename = krb5_cc_get_name(context, ccache2); 499 (void)easprintf(&cc_name, "%s:%s", krb5_cc_get_type(context, ccache2), 500 filename); 501 if (chown(filename, uid, NOGROUP) == -1) { 502 warn("chown %s", filename); 503 free(cc_name); 504 krb5_cc_destroy(context, ccache); 505 krb5_cc_destroy(context, ccache2); 506 goto fail; 507 } 508 509 (void)setenv("KRB5CCNAME", cc_name, 1); 510 free(cc_name); 511 krb5_cc_close(context, ccache2); 512 krb5_cc_destroy(context, ccache); 513 return 0; 514 515 fail: 516 if (princ != NULL) 517 krb5_free_principal(context, princ); 518 krb5_free_context(context); 519 return 1; 520 } 521 #endif /* KERBEROS5 */ 522 523 static int 524 check_ingroup(int gid, const char *gname, const char *user, int ifempty) 525 { 526 struct group *gr; 527 char **g; 528 #ifdef SU_INDIRECT_GROUP 529 char **gr_mem; 530 int n = 0; 531 int i = 0; 532 #endif 533 int ok = 0; 534 535 if (gname == NULL) 536 gr = getgrgid((gid_t) gid); 537 else 538 gr = getgrnam(gname); 539 540 /* 541 * XXX we are relying on the fact that we only set ifempty when 542 * calling to check for SU_GROUP and that is the only time a 543 * missing group is acceptable. 544 */ 545 if (gr == NULL) 546 return ifempty; 547 if (!*gr->gr_mem) /* empty */ 548 return ifempty; 549 550 /* 551 * Ok, first see if user is in gr_mem 552 */ 553 for (g = gr->gr_mem; *g; ++g) { 554 if (strcmp(*g, user) == 0) 555 return 1; /* ok */ 556 #ifdef SU_INDIRECT_GROUP 557 ++n; /* count them */ 558 #endif 559 } 560 #ifdef SU_INDIRECT_GROUP 561 /* 562 * No. 563 * Now we need to duplicate the gr_mem list, and recurse for 564 * each member to see if it is a group, and if so whether user is 565 * in it. 566 */ 567 gr_mem = emalloc((n + 1) * sizeof (char *)); 568 for (g = gr->gr_mem, i = 0; *g; ++g) { 569 gr_mem[i] = estrdup(*g); 570 i++; 571 } 572 gr_mem[i++] = NULL; 573 574 for (g = gr_mem; ok == 0 && *g; ++g) { 575 /* 576 * If we get this far we don't accept empty/missing groups. 577 */ 578 ok = check_ingroup(-1, *g, user, 0); 579 } 580 for (g = gr_mem; *g; ++g) { 581 free(*g); 582 } 583 free(gr_mem); 584 #endif 585 return ok; 586 } 587
Indexes created Fri Sep 26 20:09:58 GMT 2025