src/su.c

   1 /* su for GNU.  Run a shell with substitute user and group IDs.
   2    Copyright (C) 1992-1999 Free Software Foundation, Inc.
   3
   4    This program is free software; you can redistribute it and/or modify
   5    it under the terms of the GNU General Public License as published by
   6    the Free Software Foundation; either version 2, or (at your option)
   7    any later version.
   8
   9    This program is distributed in the hope that it will be useful,
  10    but WITHOUT ANY WARRANTY; without even the implied warranty of
  11    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12    GNU General Public License for more details.
  13
  14    You should have received a copy of the GNU General Public License
  15    along with this program; if not, write to the Free Software Foundation,
  16    Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.  */
  17
  18 /* Run a shell with the real and effective UID and GID and groups
  19    of USER, default `root'.
  20
  21    The shell run is taken from USER's password entry, /bin/sh if
  22    none is specified there.  If the account has a password, su
  23    prompts for a password unless run by a user with real UID 0.
  24
  25    Does not change the current directory.
  26    Sets `HOME' and `SHELL' from the password entry for USER, and if
  27    USER is not root, sets `USER' and `LOGNAME' to USER.
  28    The subshell is not a login shell.
  29
  30    If one or more ARGs are given, they are passed as additional
  31    arguments to the subshell.
  32
  33    Does not handle /bin/sh or other shells specially
  34    (setting argv[0] to "-su", passing -c only to certain shells, etc.).
  35    I don't see the point in doing that, and it's ugly.
  36
  37    This program intentionally does not support a "wheel group" that
  38    restricts who can su to UID 0 accounts.  RMS considers that to
  39    be fascist.
  40
  41    Options:
  42    -, -l, --login       Make the subshell a login shell.
  43                         Unset all environment variables except
  44                         TERM, HOME and SHELL (set as above), and USER
  45                         and LOGNAME (set unconditionally as above), and
  46                         set PATH to a default value.
  47                         Change to USER's home directory.
  48                         Prepend "-" to the shell's name.
  49    -c, --commmand=COMMAND
  50                         Pass COMMAND to the subshell with a -c option
  51                         instead of starting an interactive shell.
  52    -f, --fast           Pass the -f option to the subshell.
  53    -m, -p, --preserve-environment
  54                         Do not change HOME, USER, LOGNAME, SHELL.
  55                         Run $SHELL instead of USER's shell from /etc/passwd
  56                         unless not the superuser and USER's shell is
  57                         restricted.
  58                         Overridden by --login and --shell.
  59    -s, --shell=shell    Run SHELL instead of USER's shell from /etc/passwd
  60                         unless not the superuser and USER's shell is
  61                         restricted.
  62
  63    Compile-time options:
  64    -DSYSLOG_SUCCESS     Log successful su's (by default, to root) with syslog.
  65    -DSYSLOG_FAILURE     Log failed su's (by default, to root) with syslog.
  66
  67    -DSYSLOG_NON_ROOT    Log all su's, not just those to root (UID 0).
  68    Never logs attempted su's to nonexistent accounts.
  69
  70    Written by David MacKenzie <djm@gnu.ai.mit.edu>.  */
  71
  72 #include <config.h>
  73 #include <stdio.h>
  74 #include <getopt.h>
  75 #include <sys/types.h>
  76 #include <pwd.h>
  77 #include <grp.h>
  78
  79 /* Hide any system prototype for getusershell.
  80    This is necessary because some Cray systems have a conflicting
  81    prototype (returning `int') in <unistd.h>.  */
  82 #define getusershell _getusershell_sys_proto_
  83
  84 #include "system.h"
  85
  86 #undef getusershell
  87
  88 #if HAVE_SYSLOG_H && HAVE_SYSLOG
  89 # include <syslog.h>
  90 #else
  91 # undef SYSLOG_SUCCESS
  92 # undef SYSLOG_FAILURE
  93 # undef SYSLOG_NON_ROOT
  94 #endif
  95
  96 #ifndef _POSIX_VERSION
  97 struct passwd *getpwuid ();
  98 struct group *getgrgid ();
  99 uid_t getuid ();
 100 # include <sys/param.h>
 101 #endif /* not _POSIX_VERSION */
 102
 103 #ifndef HAVE_ENDGRENT
 104 # define endgrent() ((void) 0)
 105 #endif
 106
 107 #ifndef HAVE_ENDPWENT
 108 # define endpwent() ((void) 0)
 109 #endif
 110
 111 #if HAVE_SHADOW_H
 112 # include <shadow.h>
 113 #endif
 114
 115 #include "error.h"
 116
 117 /* The official name of this program (e.g., no `g' prefix).  */
 118 #define PROGRAM_NAME "su"
 119
 120 #define AUTHORS "David MacKenzie"
 121
 122 #if HAVE_PATHS_H
 123 # include <paths.h>
 124 #endif
 125
 126 /* The default PATH for simulated logins to non-superuser accounts.  */
 127 #ifdef _PATH_DEFPATH
 128 # define DEFAULT_LOGIN_PATH _PATH_DEFPATH
 129 #else
 130 # define DEFAULT_LOGIN_PATH ":/usr/ucb:/bin:/usr/bin"
 131 #endif
 132
 133 /* The default PATH for simulated logins to superuser accounts.  */
 134 #ifdef _PATH_DEFPATH_ROOT
 135 # define DEFAULT_ROOT_LOGIN_PATH _PATH_DEFPATH_ROOT
 136 #else
 137 # define DEFAULT_ROOT_LOGIN_PATH "/usr/ucb:/bin:/usr/bin:/etc"
 138 #endif
 139
 140 /* The shell to run if none is given in the user's passwd entry.  */
 141 #define DEFAULT_SHELL "/bin/sh"
 142
 143 /* The user to become if none is specified.  */
 144 #define DEFAULT_USER "root"
 145
 146 char *crypt ();
 147 char *getpass ();
 148 char *getusershell ();
 149 void endusershell ();
 150 void setusershell ();
 151
 152 char *base_name ();
 153 char *xstrdup ();
 154
 155 extern char **environ;
 156
 157 /* The name this program was run with.  */
 158 char *program_name;
 159
 160 /* If nonzero, pass the `-f' option to the subshell.  */
 161 static int fast_startup;
 162
 163 /* If nonzero, simulate a login instead of just starting a shell.  */
 164 static int simulate_login;
 165
 166 /* If nonzero, change some environment vars to indicate the user su'd to.  */
 167 static int change_environment;
 168
 169 static struct option const longopts[] =
 170 {
 171   {"command", required_argument, 0, 'c'},
 172   {"fast", no_argument, NULL, 'f'},
 173   {"login", no_argument, NULL, 'l'},
 174   {"preserve-environment", no_argument, &change_environment, 0},
 175   {"shell", required_argument, 0, 's'},
 176   {GETOPT_HELP_OPTION_DECL},
 177   {GETOPT_VERSION_OPTION_DECL},
 178   {0, 0, 0, 0}
 179 };
 180
 181 /* Add VAL to the environment, checking for out of memory errors.  */
 182
 183 static void
 184 xputenv (const char *val)
 185 {
 186   if (putenv (val))
 187     error (1, 0, _("virtual memory exhausted"));
 188 }
 189
 190 /* Return a newly-allocated string whose contents concatenate
 191    those of S1, S2, S3.  */
 192
 193 static char *
 194 concat (const char *s1, const char *s2, const char *s3)
 195 {
 196   int len1 = strlen (s1), len2 = strlen (s2), len3 = strlen (s3);
 197   char *result = (char *) xmalloc (len1 + len2 + len3 + 1);
 198
 199   strcpy (result, s1);
 200   strcpy (result + len1, s2);
 201   strcpy (result + len1 + len2, s3);
 202   result[len1 + len2 + len3] = 0;
 203
 204   return result;
 205 }
 206
 207 /* Return the number of elements in ARR, a null-terminated array.  */
 208
 209 static int
 210 elements (char **arr)
 211 {
 212   int n = 0;
 213
 214   for (n = 0; *arr; ++arr)
 215     ++n;
 216   return n;
 217 }
 218
 219 #if defined (SYSLOG_SUCCESS) || defined (SYSLOG_FAILURE)
 220 /* Log the fact that someone has run su to the user given by PW;
 221    if SUCCESSFUL is nonzero, they gave the correct password, etc.  */
 222
 223 static void
 224 log_su (const struct passwd *pw, int successful)
 225 {
 226   const char *new_user, *old_user, *tty;
 227
 228 # ifndef SYSLOG_NON_ROOT
 229   if (pw->pw_uid)
 230     return;
 231 # endif
 232   new_user = pw->pw_name;
 233   /* The utmp entry (via getlogin) is probably the best way to identify
 234      the user, especially if someone su's from a su-shell.  */
 235   old_user = getlogin ();
 236   if (old_user == NULL)
 237     {
 238       /* getlogin can fail -- usually due to lack of utmp entry.
 239          Resort to getpwuid.  */
 240       struct passwd *pwd = getpwuid (getuid ());
 241       old_user = (pwd ? pwd->pw_name : "");
 242     }
 243   tty = ttyname (2);
 244   if (tty == NULL)
 245     tty = "none";
 246   /* 4.2BSD openlog doesn't have the third parameter.  */
 247   openlog (base_name (program_name), 0
 248 # ifdef LOG_AUTH
 249            , LOG_AUTH
 250 # endif
 251            );
 252   syslog (LOG_NOTICE,
 253 # ifdef SYSLOG_NON_ROOT
 254           "%s(to %s) %s on %s",
 255 # else
 256           "%s%s on %s",
 257 # endif
 258           successful ? "" : "FAILED SU ",
 259 # ifdef SYSLOG_NON_ROOT
 260           new_user,
 261 # endif
 262           old_user, tty);
 263   closelog ();
 264 }
 265 #endif
 266
 267 /* Ask the user for a password.
 268    Return 1 if the user gives the correct password for entry PW,
 269    0 if not.  Return 1 without asking for a password if run by UID 0
 270    or if PW has an empty password.  */
 271
 272 static int
 273 correct_password (const struct passwd *pw)
 274 {
 275   char *unencrypted, *encrypted, *correct;
 276 #ifdef HAVE_SHADOW_H
 277   /* Shadow passwd stuff for SVR3 and maybe other systems.  */
 278   struct spwd *sp = getspnam (pw->pw_name);
 279
 280   endspent ();
 281   if (sp)
 282     correct = sp->sp_pwdp;
 283   else
 284 #endif
 285     correct = pw->pw_passwd;
 286
 287   if (getuid () == 0 || correct == 0 || correct[0] == '\0')
 288     return 1;
 289
 290   unencrypted = getpass (_("Password:"));
 291   if (unencrypted == NULL)
 292     {
 293       error (0, 0, _("getpass: cannot open /dev/tty"));
 294       return 0;
 295     }
 296   encrypted = crypt (unencrypted, correct);
 297   memset (unencrypted, 0, strlen (unencrypted));
 298   return strcmp (encrypted, correct) == 0;
 299 }
 300
 301 /* Update `environ' for the new shell based on PW, with SHELL being
 302    the value for the SHELL environment variable.  */
 303
 304 static void
 305 modify_environment (const struct passwd *pw, const char *shell)
 306 {
 307   char *term;
 308
 309   if (simulate_login)
 310     {
 311       /* Leave TERM unchanged.  Set HOME, SHELL, USER, LOGNAME, PATH.
 312          Unset all other environment variables.  */
 313       term = getenv ("TERM");
 314       environ = (char **) xmalloc (2 * sizeof (char *));
 315       environ[0] = 0;
 316       if (term)
 317         xputenv (concat ("TERM", "=", term));
 318       xputenv (concat ("HOME", "=", pw->pw_dir));
 319       xputenv (concat ("SHELL", "=", shell));
 320       xputenv (concat ("USER", "=", pw->pw_name));
 321       xputenv (concat ("LOGNAME", "=", pw->pw_name));
 322       xputenv (concat ("PATH", "=", (pw->pw_uid
 323                                      ? DEFAULT_LOGIN_PATH
 324                                      : DEFAULT_ROOT_LOGIN_PATH)));
 325     }
 326   else
 327     {
 328       /* Set HOME, SHELL, and if not becoming a super-user,
 329          USER and LOGNAME.  */
 330       if (change_environment)
 331         {
 332           xputenv (concat ("HOME", "=", pw->pw_dir));
 333           xputenv (concat ("SHELL", "=", shell));
 334           if (pw->pw_uid)
 335             {
 336               xputenv (concat ("USER", "=", pw->pw_name));
 337               xputenv (concat ("LOGNAME", "=", pw->pw_name));
 338             }
 339         }
 340     }
 341 }
 342
 343 /* Become the user and group(s) specified by PW.  */
 344
 345 static void
 346 change_identity (const struct passwd *pw)
 347 {
 348 #ifdef HAVE_INITGROUPS
 349   errno = 0;
 350   if (initgroups (pw->pw_name, pw->pw_gid) == -1)
 351     error (1, errno, _("cannot set groups"));
 352   endgrent ();
 353 #endif
 354   if (setgid (pw->pw_gid))
 355     error (1, errno, _("cannot set group id"));
 356   if (setuid (pw->pw_uid))
 357     error (1, errno, _("cannot set user id"));
 358 }
 359
 360 /* Run SHELL, or DEFAULT_SHELL if SHELL is empty.
 361    If COMMAND is nonzero, pass it to the shell with the -c option.
 362    If ADDITIONAL_ARGS is nonzero, pass it to the shell as more
 363    arguments.  */
 364
 365 static void
 366 run_shell (const char *shell, const char *command, char **additional_args)
 367 {
 368   const char **args;
 369   int argno = 1;
 370
 371   if (additional_args)
 372     args = (const char **) xmalloc (sizeof (char *)
 373                                     * (10 + elements (additional_args)));
 374   else
 375     args = (const char **) xmalloc (sizeof (char *) * 10);
 376   if (simulate_login)
 377     {
 378       char *arg0;
 379       char *shell_basename;
 380
 381       shell_basename = base_name (shell);
 382       arg0 = xmalloc (strlen (shell_basename) + 2);
 383       arg0[0] = '-';
 384       strcpy (arg0 + 1, shell_basename);
 385       args[0] = arg0;
 386     }
 387   else
 388     args[0] = base_name (shell);
 389   if (fast_startup)
 390     args[argno++] = "-f";
 391   if (command)
 392     {
 393       args[argno++] = "-c";
 394       args[argno++] = command;
 395     }
 396   if (additional_args)
 397     for (; *additional_args; ++additional_args)
 398       args[argno++] = *additional_args;
 399   args[argno] = NULL;
 400   execv (shell, (char **) args);
 401   error (1, errno, _("cannot run %s"), shell);
 402 }
 403
 404 /* Return 1 if SHELL is a restricted shell (one not returned by
 405    getusershell), else 0, meaning it is a standard shell.  */
 406
 407 static int
 408 restricted_shell (const char *shell)
 409 {
 410   char *line;
 411
 412   setusershell ();
 413   while ((line = getusershell ()) != NULL)
 414     {
 415       if (*line != '#' && strcmp (line, shell) == 0)
 416         {
 417           endusershell ();
 418           return 0;
 419         }
 420     }
 421   endusershell ();
 422   return 1;
 423 }
 424
 425 void
 426 usage (int status)
 427 {
 428   if (status != 0)
 429     fprintf (stderr, _("Try `%s --help' for more information.\n"),
 430              program_name);
 431   else
 432     {
 433       printf (_("Usage: %s [OPTION]... [-] [USER [ARG]...]\n"), program_name);
 434       printf (_("\
 435 Change the effective user id and group id to that of USER.\n\
 436 \n\
 437   -, -l, --login               make the shell a login shell\n\
 438   -c, --commmand=COMMAND       pass a single COMMAND to the shell with -c\n\
 439   -f, --fast                   pass -f to the shell (for csh or tcsh)\n\
 440   -m, --preserve-environment   do not reset environment variables\n\
 441   -p                           same as -m\n\
 442   -s, --shell=SHELL            run SHELL if /etc/shells allows it\n\
 443       --help                   display this help and exit\n\
 444       --version                output version information and exit\n\
 445 \n\
 446 A mere - implies -l.   If USER not given, assume root.\n\
 447 "));
 448       puts (_("\nReport bugs to <bug-sh-utils@gnu.org>."));
 449     }
 450   exit (status);
 451 }
 452
 453 int
 454 main (int argc, char **argv)
 455 {
 456   int optc;
 457   const char *new_user = DEFAULT_USER;
 458   char *command = 0;
 459   char **additional_args = 0;
 460   char *shell = 0;
 461   struct passwd *pw;
 462   struct passwd pw_copy;
 463
 464   program_name = argv[0];
 465   setlocale (LC_ALL, "");
 466   bindtextdomain (PACKAGE, LOCALEDIR);
 467   textdomain (PACKAGE);
 468
 469   fast_startup = 0;
 470   simulate_login = 0;
 471   change_environment = 1;
 472
 473   while ((optc = getopt_long (argc, argv, "c:flmps:", longopts, NULL)) != -1)
 474     {
 475       switch (optc)
 476         {
 477         case 0:
 478           break;
 479
 480         case 'c':
 481           command = optarg;
 482           break;
 483
 484         case 'f':
 485           fast_startup = 1;
 486           break;
 487
 488         case 'l':
 489           simulate_login = 1;
 490           break;
 491
 492         case 'm':
 493         case 'p':
 494           change_environment = 0;
 495           break;
 496
 497         case 's':
 498           shell = optarg;
 499           break;
 500
 501         case_GETOPT_HELP_CHAR;
 502
 503         case_GETOPT_VERSION_CHAR (PROGRAM_NAME, AUTHORS);
 504
 505         default:
 506           usage (1);
 507         }
 508     }
 509
 510   if (optind < argc && !strcmp (argv[optind], "-"))
 511     {
 512       simulate_login = 1;
 513       ++optind;
 514     }
 515   if (optind < argc)
 516     new_user = argv[optind++];
 517   if (optind < argc)
 518     additional_args = argv + optind;
 519
 520   pw = getpwnam (new_user);
 521   if (pw == 0)
 522     error (1, 0, _("user %s does not exist"), new_user);
 523   endpwent ();
 524
 525   /* Make sure pw->pw_shell is non-NULL.  It may be NULL when NEW_USER
 526      is a username that is retrieved via NIS (YP), but that doesn't have
 527      a default shell listed.  */
 528   if (pw->pw_shell == NULL || pw->pw_shell[0] == '\0')
 529     pw->pw_shell = (char *) DEFAULT_SHELL;
 530
 531   /* Make a copy of the password information and point pw at the local
 532      copy instead.  Otherwise, some systems (e.g. Linux) would clobber
 533      the static data through the getlogin call from log_su.  */
 534   pw_copy = *pw;
 535   pw = &pw_copy;
 536   pw->pw_name = xstrdup (pw->pw_name);
 537   pw->pw_dir = xstrdup (pw->pw_dir);
 538   pw->pw_shell = xstrdup (pw->pw_shell);
 539
 540   if (!correct_password (pw))
 541     {
 542 #ifdef SYSLOG_FAILURE
 543       log_su (pw, 0);
 544 #endif
 545       error (1, 0, _("incorrect password"));
 546     }
 547 #ifdef SYSLOG_SUCCESS
 548   else
 549     {
 550       log_su (pw, 1);
 551     }
 552 #endif
 553
 554   if (shell == 0 && change_environment == 0)
 555     shell = getenv ("SHELL");
 556   if (shell != 0 && getuid () && restricted_shell (pw->pw_shell))
 557     {
 558       /* The user being su'd to has a nonstandard shell, and so is
 559          probably a uucp account or has restricted access.  Don't
 560          compromise the account by allowing access with a standard
 561          shell.  */
 562       error (0, 0, _("using restricted shell %s"), pw->pw_shell);
 563       shell = 0;
 564     }
 565   if (shell == 0)
 566     {
 567       shell = xstrdup (pw->pw_shell);
 568     }
 569   modify_environment (pw, shell);
 570
 571   change_identity (pw);
 572   if (simulate_login && chdir (pw->pw_dir))
 573     error (0, errno, _("warning: cannot change directory to %s"), pw->pw_dir);
 574
 575   run_shell (shell, command, additional_args);
 576 }