1 /*- 2 * Copyright (c) 2006 nCircle Network Security, Inc. 3 * All rights reserved. 4 * 5 * This software was developed by Robert N. M. Watson for the TrustedBSD 6 * Project under contract to nCircle Network Security, Inc. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR, NCIRCLE NETWORK SECURITY, 21 * INC., OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 22 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 23 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 24 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 25 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 26 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 27 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 28 * 29 * $FreeBSD$ 30 */ 31 32 /* 33 * Test that privilege is required to set the sgid bit on a file with a group 34 * that isn't in the process credential. The file uid owner is set to the 35 * uid being tested with, as we are not interested in testing privileges 36 * associated with file ownership. 37 */ 38 39 #include <sys/stat.h> 40 41 #include <err.h> 42 #include <errno.h> 43 #include <fcntl.h> 44 #include <unistd.h> 45 46 #include "main.h" 47 48 static const gid_t gidset_without[] = {GID_WHEEL}; 49 static const gid_t gidset_with[] = {GID_WHEEL, GID_OWNER}; 50 51 void 52 priv_vfs_setgid(void) 53 { 54 char fpath[1024]; 55 int error, fd; 56 57 assert_root(); 58 59 setup_file(fpath, UID_ROOT, GID_OWNER, 0644); 60 61 if (setgroups(1, gidset_without) < 0) { 62 warn("setgroups(1, {%d})", gidset_without[0]); 63 goto out; 64 } 65 66 fd = open(fpath, O_RDWR); 67 if (fd < 0) { 68 warn("open(%s, O_RDWR)", fpath); 69 goto out; 70 } 71 72 /* 73 * With privilege, set mode on file. 74 */ 75 if (fchmod(fd, 0600 | S_ISGID) < 0) { 76 warn("fchmod(%s, 0600 | S_ISGID) as root", fpath); 77 goto out; 78 } 79 80 /* 81 * Reset mode and chown file before dropping privilege. 82 */ 83 if (fchmod(fd, 0600) < 0) { 84 warn("fchmod(%s, 0600) as root", fpath); 85 goto out; 86 } 87 88 if (fchown(fd, UID_OWNER, GID_OWNER) < 0) { 89 warn("fchown(%s, %d, %d) as root", fpath, UID_OWNER, 90 GID_OTHER); 91 goto out; 92 } 93 94 /* 95 * Drop privilege. 96 */ 97 set_euid(UID_OWNER); 98 99 /* 100 * Without privilege, set mode on file. 101 */ 102 error = fchmod(fd, 0600 | S_ISGID); 103 if (error == 0) { 104 warnx("fchmod(%s, 0600 | S_ISGID) succeeded as !root", 105 fpath); 106 goto out; 107 } 108 if (errno != EPERM) { 109 warn("fchmod(%s, 0600 | S_ISGID) wrong errno %d as !root", 110 fpath, errno); 111 goto out; 112 } 113 114 /* 115 * Turn privilege back on so that we confirm privilege isn't required 116 * if we are a group member of the file's group. 117 */ 118 set_euid(UID_ROOT); 119 120 if (setgroups(2, gidset_with) < 0) { 121 warn("setgroups(2, {%d, %d})", gidset_with[0], 122 gidset_with[1]); 123 goto out; 124 } 125 126 if (seteuid(UID_OWNER) < 0) { 127 warn("seteuid(%d) pass 2", UID_OWNER); 128 goto out; 129 } 130 131 /* 132 * Without privilege, set mode on file (this time with right gid). 133 */ 134 if (fchmod(fd, 0600 | S_ISGID) < 0) { 135 warnx("fchmod(%s, 0600 | S_ISGID) pass 2 as !root", fpath); 136 sleep(10); 137 goto out; 138 } 139 140 out: 141 seteuid(UID_ROOT); 142 (void)unlink(fpath); 143 } 144