1 /* 2 * Copyright (c) 2005, PADL Software Pty Ltd. 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * 3. Neither the name of PADL Software nor the names of its contributors 17 * may be used to endorse or promote products derived from this software 18 * without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY PADL SOFTWARE AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL PADL SOFTWARE OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 */ 32 33 #include "kcm_locl.h" 34 35 RCSID("$Id: acl.c 20472 2007-04-20 10:43:25Z lha $"); 36 37 krb5_error_code 38 kcm_access(krb5_context context, 39 kcm_client *client, 40 kcm_operation opcode, 41 kcm_ccache ccache) 42 { 43 int read_p = 0; 44 int write_p = 0; 45 uint16_t mask; 46 krb5_error_code ret; 47 48 KCM_ASSERT_VALID(ccache); 49 50 switch (opcode) { 51 case KCM_OP_INITIALIZE: 52 case KCM_OP_DESTROY: 53 case KCM_OP_STORE: 54 case KCM_OP_REMOVE_CRED: 55 case KCM_OP_SET_FLAGS: 56 case KCM_OP_CHOWN: 57 case KCM_OP_CHMOD: 58 case KCM_OP_GET_INITIAL_TICKET: 59 case KCM_OP_GET_TICKET: 60 write_p = 1; 61 read_p = 0; 62 break; 63 case KCM_OP_NOOP: 64 case KCM_OP_GET_NAME: 65 case KCM_OP_RESOLVE: 66 case KCM_OP_GEN_NEW: 67 case KCM_OP_RETRIEVE: 68 case KCM_OP_GET_PRINCIPAL: 69 case KCM_OP_GET_FIRST: 70 case KCM_OP_GET_NEXT: 71 case KCM_OP_END_GET: 72 case KCM_OP_MAX: 73 write_p = 0; 74 read_p = 1; 75 break; 76 } 77 78 if (ccache->flags & KCM_FLAGS_OWNER_IS_SYSTEM) { 79 /* System caches cannot be reinitialized or destroyed by users */ 80 if (opcode == KCM_OP_INITIALIZE || 81 opcode == KCM_OP_DESTROY || 82 opcode == KCM_OP_REMOVE_CRED) { 83 ret = KRB5_FCC_PERM; 84 goto out; 85 } 86 87 /* Let root always read system caches */ 88 if (client->uid == 0) { 89 ret = 0; 90 goto out; 91 } 92 } 93 94 mask = 0; 95 96 /* Root may do whatever they like */ 97 if (client->uid == ccache->uid || CLIENT_IS_ROOT(client)) { 98 if (read_p) 99 mask |= S_IRUSR; 100 if (write_p) 101 mask |= S_IWUSR; 102 } else if (client->gid == ccache->gid || CLIENT_IS_ROOT(client)) { 103 if (read_p) 104 mask |= S_IRGRP; 105 if (write_p) 106 mask |= S_IWGRP; 107 } else { 108 if (read_p) 109 mask |= S_IROTH; 110 if (write_p) 111 mask |= S_IWOTH; 112 } 113 114 ret = ((ccache->mode & mask) == mask) ? 0 : KRB5_FCC_PERM; 115 116 out: 117 if (ret) { 118 kcm_log(2, "Process %d is not permitted to call %s on cache %s", 119 client->pid, kcm_op2string(opcode), ccache->name); 120 } 121 122 return ret; 123 } 124 125 krb5_error_code 126 kcm_chmod(krb5_context context, 127 kcm_client *client, 128 kcm_ccache ccache, 129 uint16_t mode) 130 { 131 KCM_ASSERT_VALID(ccache); 132 133 /* System cache mode can only be set at startup */ 134 if (ccache->flags & KCM_FLAGS_OWNER_IS_SYSTEM) 135 return KRB5_FCC_PERM; 136 137 if (ccache->uid != client->uid) 138 return KRB5_FCC_PERM; 139 140 if (ccache->gid != client->gid) 141 return KRB5_FCC_PERM; 142 143 HEIMDAL_MUTEX_lock(&ccache->mutex); 144 145 ccache->mode = mode; 146 147 HEIMDAL_MUTEX_unlock(&ccache->mutex); 148 149 return 0; 150 } 151 152 krb5_error_code 153 kcm_chown(krb5_context context, 154 kcm_client *client, 155 kcm_ccache ccache, 156 uid_t uid, 157 gid_t gid) 158 { 159 KCM_ASSERT_VALID(ccache); 160 161 /* System cache owner can only be set at startup */ 162 if (ccache->flags & KCM_FLAGS_OWNER_IS_SYSTEM) 163 return KRB5_FCC_PERM; 164 165 if (ccache->uid != client->uid) 166 return KRB5_FCC_PERM; 167 168 if (ccache->gid != client->gid) 169 return KRB5_FCC_PERM; 170 171 HEIMDAL_MUTEX_lock(&ccache->mutex); 172 173 ccache->uid = uid; 174 ccache->gid = gid; 175 176 HEIMDAL_MUTEX_unlock(&ccache->mutex); 177 178 return 0; 179 } 180 181