1 /*
2 Bacula(R) - The Network Backup Solution
3
4 Copyright (C) 2000-2020 Kern Sibbald
5
6 The original author of Bacula is Kern Sibbald, with contributions
7 from many others, a complete list can be found in the file AUTHORS.
8
9 You may use this file and others of this release according to the
10 license defined in the LICENSE file, which includes the Affero General
11 Public License, v3.0 ("AGPLv3") and some additional permissions and
12 terms pursuant to its AGPLv3 Section 7.
13
14 This notice must be preserved when any source code is
15 conveyed and/or propagated.
16
17 Bacula(R) is a registered trademark of Kern Sibbald.
18 */
19
20 #include "bacula.h"
21
22 #undef ENABLE_KEEP_READALL_CAPS_SUPPORT
23 #if defined(HAVE_SYS_PRCTL_H) && defined(HAVE_SYS_CAPABILITY_H) && \
24 defined(HAVE_PRCTL) && defined(HAVE_SETREUID) && defined(HAVE_LIBCAP)
25 # include <sys/prctl.h>
26 # include <sys/capability.h>
27 # if defined(PR_SET_KEEPCAPS)
28 # define ENABLE_KEEP_READALL_CAPS_SUPPORT
29 # endif
30 #endif
31
32 #ifdef HAVE_AIX_OS
33 # ifndef _AIX51
34 extern "C" int initgroups(const char *,int);
35 # endif
36 #endif
37
38 /*
39 * Lower privileges by switching to new UID and GID if non-NULL.
40 * If requested, keep readall capabilities after switch.
41 */
drop(char * uname,char * gname,bool keep_readall_caps)42 void drop(char *uname, char *gname, bool keep_readall_caps)
43 {
44 #if defined(HAVE_PWD_H) && defined(HAVE_GRP_H)
45 struct passwd *passw = NULL;
46 struct group *group = NULL;
47 gid_t gid;
48 uid_t uid;
49 char username[1000];
50
51 Dmsg2(900, "uname=%s gname=%s\n", uname?uname:"NONE", gname?gname:"NONE");
52 if (!uname && !gname) {
53 return; /* Nothing to do */
54 }
55
56 if (uname) {
57 if ((passw = getpwnam(uname)) == NULL) {
58 berrno be;
59 Emsg2(M_ERROR_TERM, 0, _("Could not find userid=%s: ERR=%s\n"), uname,
60 be.bstrerror());
61 }
62 } else {
63 if ((passw = getpwuid(getuid())) == NULL) {
64 berrno be;
65 Emsg1(M_ERROR_TERM, 0, _("Could not find password entry. ERR=%s\n"),
66 be.bstrerror());
67 } else {
68 uname = passw->pw_name;
69 }
70 }
71 /* Any OS uname pointer may get overwritten, so save name, uid, and gid */
72 bstrncpy(username, uname, sizeof(username));
73 uid = passw->pw_uid;
74 gid = passw->pw_gid;
75 if (gname) {
76 if ((group = getgrnam(gname)) == NULL) {
77 berrno be;
78 Emsg2(M_ERROR_TERM, 0, _("Could not find group=%s: ERR=%s\n"), gname,
79 be.bstrerror());
80 }
81 gid = group->gr_gid;
82 }
83 if (initgroups(username, gid)) {
84 berrno be;
85 if (gname) {
86 Emsg3(M_ERROR_TERM, 0, _("Could not initgroups for group=%s, userid=%s: ERR=%s\n"),
87 gname, username, be.bstrerror());
88 } else {
89 Emsg2(M_ERROR_TERM, 0, _("Could not initgroups for userid=%s: ERR=%s\n"),
90 username, be.bstrerror());
91 }
92 }
93 if (gname) {
94 if (setgid(gid)) {
95 berrno be;
96 Emsg2(M_ERROR_TERM, 0, _("Could not set group=%s: ERR=%s\n"), gname,
97 be.bstrerror());
98 }
99 }
100 if (keep_readall_caps) {
101 #ifdef ENABLE_KEEP_READALL_CAPS_SUPPORT
102 cap_t caps;
103
104 if (prctl(PR_SET_KEEPCAPS, 1)) {
105 berrno be;
106 Emsg1(M_ERROR_TERM, 0, _("prctl failed: ERR=%s\n"), be.bstrerror());
107 }
108 if (setreuid(uid, uid)) {
109 berrno be;
110 Emsg1(M_ERROR_TERM, 0, _("setreuid failed: ERR=%s\n"), be.bstrerror());
111 }
112 if (!(caps = cap_from_text("cap_dac_read_search=ep"))) {
113 berrno be;
114 Emsg1(M_ERROR_TERM, 0, _("cap_from_text failed: ERR=%s\n"), be.bstrerror());
115 }
116 if (cap_set_proc(caps) < 0) {
117 berrno be;
118 Emsg1(M_ERROR_TERM, 0, _("cap_set_proc failed: ERR=%s\n"), be.bstrerror());
119 }
120 cap_free(caps);
121 #else
122 Emsg0(M_ERROR_TERM, 0, _("Keep readall caps not implemented this OS or missing libraries.\n"));
123 #endif
124 } else if (setuid(uid)) {
125 berrno be;
126 Emsg1(M_ERROR_TERM, 0, _("Could not set specified userid: %s\n"), username);
127 }
128 #endif
129 }
130
131