1 /* $OpenBSD: setresgid.c,v 1.3 2021/12/15 18:42:38 anton Exp $ */
2 /*
3 * Written by Bret Stephen Lambert <blambert@openbsd.org> 2014
4 * Public Domain.
5 */
6
7 #include <sys/types.h>
8 #include <sys/signal.h>
9 #include <sys/proc.h>
10 #include <sys/sysctl.h>
11 #include <sys/wait.h>
12
13 #include <err.h>
14 #include <stdio.h>
15 #include <stdlib.h>
16 #include <pwd.h>
17 #include <unistd.h>
18
19 #include "setuid_regress.h"
20
21 int
main(int argc,const char * argv[])22 main(int argc, const char *argv[])
23 {
24 struct kinfo_proc kproc;
25 struct passwd *pw;
26 gid_t gid;
27
28 if ((pw = getpwnam(_SETUID_REGRESS_USER)) == NULL)
29 err(1, "unknown user \"%s\"", _SETUID_REGRESS_USER);
30
31 gid = getgid();
32
33 if (setresgid(pw->pw_gid, -1, -1) == -1)
34 err(1, "setgid 0");
35 checkgids(pw->pw_gid, gid, gid, "0");
36
37 /* should only respond to setgid upon exec */
38 if (issetugid())
39 errx(1, "process incorrectly marked as issetugid()");
40
41 if (read_kproc_pid(&kproc, getpid()) == -1)
42 err(1, "kproc read failed");
43
44 if (!(kproc.p_psflags & PS_SUGID))
45 errx(1, "PS_SUGID not set");
46 if (kproc.p_psflags & PS_SUGIDEXEC)
47 errx(1, "PS_SUGIDEXEC incorrectly set");
48
49 /* we should be able to roll back our gids for now */
50 if (setresgid(gid, -1, -1) == -1)
51 err(1, "setgid 1");
52 checkgids(gid, gid, gid, "1");
53
54 if (setresgid(-1, pw->pw_gid, -1) == -1)
55 err(1, "setgid 2");
56 checkgids(gid, pw->pw_gid, gid, "2");
57
58 /* we should be able to roll back our gids for now */
59 if (setresgid(-1, gid, -1) == -1)
60 err(1, "setgid 3");
61 checkgids(gid, gid, gid, "3");
62
63 /*
64 * after changing our saved gid and dropping superuser privs,
65 * we should be able to change our real and effective gids to
66 * that of our saved gid, but not to anything else
67 */
68
69 if (setresgid(-1, -1, pw->pw_gid) == -1)
70 err(1, "setgid 4");
71 checkgids(gid, gid, pw->pw_gid, "4");
72
73 if (setresuid(pw->pw_gid, pw->pw_gid, pw->pw_gid) == -1)
74 err(1, "setresuid 4");
75
76 if (setresgid(pw->pw_gid, -1, -1) == -1)
77 err(1, "setgid 5");
78 checkgids(pw->pw_gid, gid, pw->pw_gid, "5");
79
80 if (setresgid(-1, pw->pw_gid, -1) == -1)
81 err(1, "setgid 6");
82 checkgids(pw->pw_gid, pw->pw_gid, pw->pw_gid, "6");
83
84 if (setresgid(gid, -1, -1) != -1)
85 errx(1, "incorrectly capable of setting real gid");
86 checkgids(pw->pw_gid, pw->pw_gid, pw->pw_gid, "7");
87
88 if (setresgid(-1, gid, -1) != -1)
89 errx(1, "incorrectly capable of setting effective gid");
90 checkgids(pw->pw_gid, pw->pw_gid, pw->pw_gid, "9");
91
92 if (setresgid(-1, -1, gid) != -1)
93 errx(1, "incorrectly capable of setting saved gid");
94 checkgids(pw->pw_gid, pw->pw_gid, pw->pw_gid, "9");
95
96 /* sanity-check use of -1 as noop */
97 if (setresgid(-1, -1, -1) == -1)
98 errx(1, "-1 not properly recognized as noop");
99 checkgids(pw->pw_gid, pw->pw_gid, pw->pw_gid, "9");
100
101 exit(0);
102 }
103