1 /* $NetBSD: su_pam.c,v 1.20 2015/08/09 09:39:21 shm Exp $ */
2
3 /*
4 * Copyright (c) 1988 The Regents of the University of California.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 3. Neither the name of the University nor the names of its contributors
16 * may be used to endorse or promote products derived from this software
17 * without specific prior written permission.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
30 */
31
32 #include <sys/cdefs.h>
33 #ifndef lint
34 __COPYRIGHT("@(#) Copyright (c) 1988\
35 The Regents of the University of California. All rights reserved.");
36 #endif /* not lint */
37
38 #ifndef lint
39 #if 0
40 static char sccsid[] = "@(#)su.c 8.3 (Berkeley) 4/2/94";*/
41 #else
42 __RCSID("$NetBSD: su_pam.c,v 1.20 2015/08/09 09:39:21 shm Exp $");
43 #endif
44 #endif /* not lint */
45
46 #include <sys/param.h>
47 #include <sys/time.h>
48 #include <sys/resource.h>
49 #include <sys/wait.h>
50 #include <err.h>
51 #include <errno.h>
52 #include <grp.h>
53 #include <paths.h>
54 #include <pwd.h>
55 #include <signal.h>
56 #include <stdio.h>
57 #include <stdlib.h>
58 #include <string.h>
59 #include <syslog.h>
60 #include <time.h>
61 #include <tzfile.h>
62 #include <unistd.h>
63 #include <util.h>
64 #include <login_cap.h>
65
66 #include <security/pam_appl.h>
67 #include <security/openpam.h> /* for openpam_ttyconv() */
68
69 #ifdef ALLOW_GROUP_CHANGE
70 #include "grutil.h"
71 #endif
72 #include "suutil.h"
73
74 static const struct pam_conv pamc = { &openpam_ttyconv, NULL };
75
76 #define ARGSTRX "-dflm"
77
78 #ifdef LOGIN_CAP
79 #define ARGSTR ARGSTRX "c:"
80 #else
81 #define ARGSTR ARGSTRX
82 #endif
83
84 static void logit(const char *, ...) __printflike(1, 2);
85
86 static const char *
safe_pam_strerror(pam_handle_t * pamh,int pam_err)87 safe_pam_strerror(pam_handle_t *pamh, int pam_err) {
88 const char *msg;
89
90 if ((msg = pam_strerror(pamh, pam_err)) != NULL)
91 return msg;
92
93 static char buf[1024];
94 snprintf(buf, sizeof(buf), "Unknown pam error %d", pam_err);
95 return buf;
96 }
97
98 int
main(int argc,char ** argv)99 main(int argc, char **argv)
100 {
101 extern char **environ;
102 struct passwd *pwd, pwres;
103 char *p;
104 uid_t ruid;
105 int asme, ch, asthem, fastlogin, prio, gohome;
106 u_int setwhat;
107 enum { UNSET, YES, NO } iscsh = UNSET;
108 const char *user, *shell, *avshell;
109 char *username, *class;
110 char **np;
111 char shellbuf[MAXPATHLEN], avshellbuf[MAXPATHLEN];
112 int pam_err;
113 char hostname[MAXHOSTNAMELEN];
114 char *tty;
115 const char *func;
116 const void *newuser;
117 login_cap_t *lc;
118 pam_handle_t *pamh = NULL;
119 char pwbuf[1024];
120 #ifdef PAM_DEBUG
121 extern int _openpam_debug;
122
123 _openpam_debug = 1;
124 #endif
125 #ifdef ALLOW_GROUP_CHANGE
126 char *gname;
127 #endif
128
129 (void)setprogname(argv[0]);
130 asme = asthem = fastlogin = 0;
131 gohome = 1;
132 shell = class = NULL;
133 while ((ch = getopt(argc, argv, ARGSTR)) != -1)
134 switch((char)ch) {
135 case 'c':
136 class = optarg;
137 break;
138 case 'd':
139 asme = 0;
140 asthem = 1;
141 gohome = 0;
142 break;
143 case 'f':
144 fastlogin = 1;
145 break;
146 case '-':
147 case 'l':
148 asme = 0;
149 asthem = 1;
150 break;
151 case 'm':
152 asme = 1;
153 asthem = 0;
154 break;
155 case '?':
156 default:
157 (void)fprintf(stderr,
158 #ifdef ALLOW_GROUP_CHANGE
159 "Usage: %s [%s] [login[:group] [shell arguments]]\n",
160 #else
161 "Usage: %s [%s] [login [shell arguments]]\n",
162 #endif
163 getprogname(), ARGSTR);
164 exit(EXIT_FAILURE);
165 }
166 argv += optind;
167
168 /* Lower the priority so su runs faster */
169 errno = 0;
170 prio = getpriority(PRIO_PROCESS, 0);
171 if (errno)
172 prio = 0;
173 if (prio > -2)
174 (void)setpriority(PRIO_PROCESS, 0, -2);
175 openlog("su", 0, LOG_AUTH);
176
177 /* get current login name and shell */
178 ruid = getuid();
179 username = getlogin();
180 if (username == NULL ||
181 getpwnam_r(username, &pwres, pwbuf, sizeof(pwbuf), &pwd) != 0 ||
182 pwd == NULL || pwd->pw_uid != ruid) {
183 if (getpwuid_r(ruid, &pwres, pwbuf, sizeof(pwbuf), &pwd) != 0)
184 pwd = NULL;
185 }
186 if (pwd == NULL)
187 errx(EXIT_FAILURE, "who are you?");
188 username = estrdup(pwd->pw_name);
189
190 if (asme) {
191 if (pwd->pw_shell && *pwd->pw_shell) {
192 (void)estrlcpy(shellbuf, pwd->pw_shell, sizeof(shellbuf));
193 shell = shellbuf;
194 } else {
195 shell = _PATH_BSHELL;
196 iscsh = NO;
197 }
198 }
199 /* get target login information, default to root */
200 user = *argv ? *argv : "root";
201 np = *argv ? argv : argv - 1;
202
203 #ifdef ALLOW_GROUP_CHANGE
204 if ((p = strchr(user, ':')) != NULL) {
205 *p = '\0';
206 gname = ++p;
207 }
208 else
209 gname = NULL;
210
211 #ifdef ALLOW_EMPTY_USER
212 if (user[0] == '\0')
213 user = username;
214 #endif
215 #endif
216 if (getpwnam_r(user, &pwres, pwbuf, sizeof(pwbuf), &pwd) != 0 ||
217 pwd == NULL)
218 errx(EXIT_FAILURE, "unknown login %s", user);
219
220 /*
221 * PAM initialization
222 */
223 #define PAM_END(msg) do { func = msg; goto done;} /* NOTREACHED */ while (/*CONSTCOND*/0)
224
225 if ((pam_err = pam_start("su", user, &pamc, &pamh)) != PAM_SUCCESS) {
226 if (pamh != NULL)
227 PAM_END("pam_start");
228 /* Things went really bad... */
229 syslog(LOG_ERR, "pam_start failed: %s",
230 safe_pam_strerror(pamh, pam_err));
231 errx(EXIT_FAILURE, "pam_start failed");
232 }
233
234 #define PAM_END_ITEM(item) PAM_END("pam_set_item(" # item ")")
235 #define PAM_SET_ITEM(item, var) \
236 if ((pam_err = pam_set_item(pamh, (item), (var))) != PAM_SUCCESS) \
237 PAM_END_ITEM(item)
238
239 /*
240 * Fill hostname, username and tty
241 */
242 PAM_SET_ITEM(PAM_RUSER, username);
243 if (gethostname(hostname, sizeof(hostname)) != -1)
244 PAM_SET_ITEM(PAM_RHOST, hostname);
245
246 if ((tty = ttyname(STDERR_FILENO)) != NULL)
247 PAM_SET_ITEM(PAM_TTY, tty);
248
249 /*
250 * Authentication
251 */
252 if ((pam_err = pam_authenticate(pamh, 0)) != PAM_SUCCESS) {
253 syslog(LOG_WARNING, "BAD SU %s to %s%s: %s",
254 username, user, ontty(), safe_pam_strerror(pamh, pam_err));
255 (void)pam_end(pamh, pam_err);
256 errx(EXIT_FAILURE, "Sorry: %s", safe_pam_strerror(NULL, pam_err));
257 }
258
259 /*
260 * Authorization
261 */
262 switch(pam_err = pam_acct_mgmt(pamh, 0)) {
263 case PAM_NEW_AUTHTOK_REQD:
264 pam_err = pam_chauthtok(pamh, PAM_CHANGE_EXPIRED_AUTHTOK);
265 if (pam_err != PAM_SUCCESS)
266 PAM_END("pam_chauthok");
267 break;
268 case PAM_SUCCESS:
269 break;
270 default:
271 PAM_END("pam_acct_mgmt");
272 break;
273 }
274
275 /*
276 * pam_authenticate might have changed the target user.
277 * refresh pwd and user
278 */
279 pam_err = pam_get_item(pamh, PAM_USER, &newuser);
280 if (pam_err != PAM_SUCCESS) {
281 syslog(LOG_WARNING,
282 "pam_get_item(PAM_USER): %s", safe_pam_strerror(pamh, pam_err));
283 } else {
284 user = (char *)__UNCONST(newuser);
285 if (getpwnam_r(user, &pwres, pwbuf, sizeof(pwbuf), &pwd) != 0 ||
286 pwd == NULL) {
287 (void)pam_end(pamh, pam_err);
288 syslog(LOG_ERR, "unknown login: %s", username);
289 errx(EXIT_FAILURE, "unknown login: %s", username);
290 }
291 }
292
293 #define ERRX_PAM_END(args) do { \
294 (void)pam_end(pamh, pam_err); \
295 errx args; \
296 } while (/* CONSTCOND */0)
297
298 #define ERR_PAM_END(args) do { \
299 (void)pam_end(pamh, pam_err); \
300 err args; \
301 } while (/* CONSTCOND */0)
302
303 /* force the usage of specified class */
304 if (class) {
305 if (ruid)
306 ERRX_PAM_END((EXIT_FAILURE, "Only root may use -c"));
307
308 pwd->pw_class = class;
309 }
310
311 if ((lc = login_getclass(pwd->pw_class)) == NULL)
312 ERRX_PAM_END((EXIT_FAILURE,
313 "Unknown class %s\n", pwd->pw_class));
314
315 if (asme) {
316 /* if asme and non-standard target shell, must be root */
317 if (chshell(pwd->pw_shell) == 0 && ruid)
318 ERRX_PAM_END((EXIT_FAILURE,
319 "permission denied (shell)."));
320 } else if (pwd->pw_shell && *pwd->pw_shell) {
321 shell = pwd->pw_shell;
322 iscsh = UNSET;
323 } else {
324 shell = _PATH_BSHELL;
325 iscsh = NO;
326 }
327
328 if ((p = strrchr(shell, '/')) != NULL)
329 avshell = p + 1;
330 else
331 avshell = shell;
332
333 /* if we're forking a csh, we want to slightly muck the args */
334 if (iscsh == UNSET)
335 iscsh = strstr(avshell, "csh") ? YES : NO;
336
337 /*
338 * Initialize the supplemental groups before pam gets to them,
339 * so that other pam modules get a chance to add more when
340 * we do setcred. Note, we don't relinguish our set-userid yet
341 */
342 /* if we aren't changing users, keep the current group members */
343 if (ruid != pwd->pw_uid &&
344 setusercontext(lc, pwd, pwd->pw_uid, LOGIN_SETGROUP) == -1)
345 ERR_PAM_END((EXIT_FAILURE, "setting user context"));
346
347 #ifdef ALLOW_GROUP_CHANGE
348 addgroup(lc, gname, pwd, ruid, "Group Password:");
349 #endif
350 if ((pam_err = pam_setcred(pamh, PAM_ESTABLISH_CRED)) != PAM_SUCCESS)
351 PAM_END("pam_setcred");
352
353 /*
354 * Manage session.
355 */
356 if (asthem) {
357 pid_t pid, xpid;
358 int status = 1;
359 struct sigaction sa, sa_int, sa_pipe, sa_quit;
360 int fds[2];
361
362 if ((pam_err = pam_open_session(pamh, 0)) != PAM_SUCCESS)
363 PAM_END("pam_open_session");
364
365 /*
366 * In order to call pam_close_session after the
367 * command terminates, we need to fork.
368 */
369 sa.sa_flags = SA_RESTART;
370 sa.sa_handler = SIG_IGN;
371 (void)sigemptyset(&sa.sa_mask);
372 (void)sigaction(SIGINT, &sa, &sa_int);
373 (void)sigaction(SIGQUIT, &sa, &sa_quit);
374 (void)sigaction(SIGPIPE, &sa, &sa_pipe);
375 sa.sa_handler = SIG_DFL;
376 (void)sigaction(SIGTSTP, &sa, NULL);
377 /*
378 * Use a pipe to guarantee the order of execution of
379 * the parent and the child.
380 */
381 if (pipe(fds) == -1) {
382 warn("pipe failed");
383 goto out;
384 }
385
386 switch (pid = fork()) {
387 case -1:
388 logit("fork failed (%s)", strerror(errno));
389 goto out;
390
391 case 0: /* Child */
392 (void)close(fds[1]);
393 (void)read(fds[0], &status, 1);
394 (void)close(fds[0]);
395 (void)sigaction(SIGINT, &sa_int, NULL);
396 (void)sigaction(SIGQUIT, &sa_quit, NULL);
397 (void)sigaction(SIGPIPE, &sa_pipe, NULL);
398 break;
399
400 default:
401 sa.sa_handler = SIG_IGN;
402 (void)sigaction(SIGTTOU, &sa, NULL);
403 (void)close(fds[0]);
404 (void)setpgid(pid, pid);
405 (void)tcsetpgrp(STDERR_FILENO, pid);
406 (void)close(fds[1]);
407 (void)sigaction(SIGPIPE, &sa_pipe, NULL);
408 /*
409 * Parent: wait for the child to terminate
410 * and call pam_close_session.
411 */
412 while ((xpid = waitpid(pid, &status, WUNTRACED))
413 == pid) {
414 if (WIFSTOPPED(status)) {
415 (void)kill(getpid(), SIGSTOP);
416 (void)tcsetpgrp(STDERR_FILENO,
417 getpgid(pid));
418 (void)kill(pid, SIGCONT);
419 status = 1;
420 continue;
421 }
422 break;
423 }
424
425 (void)tcsetpgrp(STDERR_FILENO, getpgid(0));
426
427 if (xpid == -1) {
428 logit("Error waiting for pid %d (%s)", pid,
429 strerror(errno));
430 } else if (xpid != pid) {
431 /* Can't happen. */
432 logit("Wrong PID: %d != %d", pid, xpid);
433 }
434 out:
435 pam_err = pam_setcred(pamh, PAM_DELETE_CRED);
436 if (pam_err != PAM_SUCCESS)
437 logit("pam_setcred: %s",
438 safe_pam_strerror(pamh, pam_err));
439 pam_err = pam_close_session(pamh, 0);
440 if (pam_err != PAM_SUCCESS)
441 logit("pam_close_session: %s",
442 safe_pam_strerror(pamh, pam_err));
443 (void)pam_end(pamh, pam_err);
444 exit(WEXITSTATUS(status));
445 break;
446 }
447 }
448
449 /*
450 * The child: starting here, we don't have to care about
451 * handling PAM issues if we exit, the parent will do the
452 * job when we exit.
453 */
454 #undef PAM_END
455 #undef ERR_PAM_END
456 #undef ERRX_PAM_END
457
458 if (!asme) {
459 if (asthem) {
460 char **pamenv;
461
462 p = getenv("TERM");
463 /*
464 * Create an empty environment
465 */
466 environ = emalloc(sizeof(char *));
467 environ[0] = NULL;
468
469 /*
470 * Add PAM environement, before the LOGIN_CAP stuff:
471 * if the login class is unspecified, we'll get the
472 * same data from PAM, if -c was used, the specified
473 * class must override PAM.
474 */
475 if ((pamenv = pam_getenvlist(pamh)) != NULL) {
476 char **envitem;
477
478 /*
479 * XXX Here FreeBSD filters out
480 * SHELL, LOGNAME, MAIL, CDPATH, IFS, PATH
481 * how could we get untrusted data here?
482 */
483 for (envitem = pamenv; *envitem; envitem++) {
484 if (putenv(*envitem) == -1)
485 free(*envitem);
486 }
487
488 free(pamenv);
489 }
490
491 if (setusercontext(lc, pwd, pwd->pw_uid, LOGIN_SETPATH |
492 LOGIN_SETENV | LOGIN_SETUMASK) == -1)
493 err(EXIT_FAILURE, "setting user context");
494 if (p)
495 (void)setenv("TERM", p, 1);
496 }
497
498 if (asthem || pwd->pw_uid) {
499 (void)setenv("LOGNAME", pwd->pw_name, 1);
500 (void)setenv("USER", pwd->pw_name, 1);
501 }
502 (void)setenv("HOME", pwd->pw_dir, 1);
503 (void)setenv("SHELL", shell, 1);
504 }
505 (void)setenv("SU_FROM", username, 1);
506
507 if (iscsh == YES) {
508 if (fastlogin)
509 *np-- = __UNCONST("-f");
510 if (asme)
511 *np-- = __UNCONST("-m");
512 } else {
513 if (fastlogin)
514 (void)unsetenv("ENV");
515 }
516
517 if (asthem) {
518 avshellbuf[0] = '-';
519 (void)estrlcpy(avshellbuf + 1, avshell, sizeof(avshellbuf) - 1);
520 avshell = avshellbuf;
521 } else if (iscsh == YES) {
522 /* csh strips the first character... */
523 avshellbuf[0] = '_';
524 (void)estrlcpy(avshellbuf + 1, avshell, sizeof(avshellbuf) - 1);
525 avshell = avshellbuf;
526 }
527 *np = __UNCONST(avshell);
528
529 if (ruid != 0)
530 syslog(LOG_NOTICE, "%s to %s%s",
531 username, pwd->pw_name, ontty());
532
533 /* Raise our priority back to what we had before */
534 (void)setpriority(PRIO_PROCESS, 0, prio);
535
536 /*
537 * Set user context, except for umask, and the stuff
538 * we have done before.
539 */
540 setwhat = LOGIN_SETALL & ~(LOGIN_SETENV | LOGIN_SETUMASK |
541 LOGIN_SETLOGIN | LOGIN_SETPATH | LOGIN_SETGROUP);
542
543 /*
544 * Don't touch resource/priority settings if -m has been used
545 * or -l and -c hasn't, and we're not su'ing to root.
546 */
547 if ((asme || (!asthem && class == NULL)) && pwd->pw_uid)
548 setwhat &= ~(LOGIN_SETPRIORITY | LOGIN_SETRESOURCES);
549
550 if (setusercontext(lc, pwd, pwd->pw_uid, setwhat) == -1)
551 err(EXIT_FAILURE, "setusercontext");
552
553 if (!asme) {
554 if (asthem) {
555 if (gohome && chdir(pwd->pw_dir) == -1)
556 errx(EXIT_FAILURE, "no directory");
557 }
558 }
559
560 (void)execv(shell, np);
561 err(EXIT_FAILURE, "%s", shell);
562 done:
563 logit("%s: %s", func, safe_pam_strerror(pamh, pam_err));
564 (void)pam_end(pamh, pam_err);
565 return EXIT_FAILURE;
566 }
567
568 static void
logit(const char * fmt,...)569 logit(const char *fmt, ...)
570 {
571 va_list ap;
572
573 va_start(ap, fmt);
574 vwarnx(fmt, ap);
575 va_end(ap);
576 va_start(ap, fmt);
577 vsyslog(LOG_ERR, fmt, ap);
578 va_end(ap);
579 }
580