usr.bin/su/su.c

   1 /*      $NetBSD: su.c,v 1.72 2015/06/16 22:54:11 christos Exp $ */
   2
   3 /*
   4  * Copyright (c) 1988 The Regents of the University of California.
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  * 3. Neither the name of the University nor the names of its contributors
  16  *    may be used to endorse or promote products derived from this software
  17  *    without specific prior written permission.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  29  * SUCH DAMAGE.
  30  */
  31
  32 #include <sys/cdefs.h>
  33 #ifndef lint
  34 __COPYRIGHT("@(#) Copyright (c) 1988\
  35  The Regents of the University of California.  All rights reserved.");
  36 #endif /* not lint */
  37
  38 #ifndef lint
  39 #if 0
  40 static char sccsid[] = "@(#)su.c        8.3 (Berkeley) 4/2/94";*/
  41 #else
  42 __RCSID("$NetBSD: su.c,v 1.72 2015/06/16 22:54:11 christos Exp $");
  43 #endif
  44 #endif /* not lint */
  45
  46 #include <sys/param.h>
  47 #include <sys/time.h>
  48 #include <sys/resource.h>
  49 #include <err.h>
  50 #include <errno.h>
  51 #include <grp.h>
  52 #include <paths.h>
  53 #include <pwd.h>
  54 #include <stdio.h>
  55 #ifdef SKEY
  56 #include <skey.h>
  57 #endif
  58 #include <stdlib.h>
  59 #include <string.h>
  60 #include <syslog.h>
  61 #include <time.h>
  62 #include <tzfile.h>
  63 #include <unistd.h>
  64 #include <util.h>
  65
  66 #ifdef LOGIN_CAP
  67 #include <login_cap.h>
  68 #endif
  69
  70 #ifdef KERBEROS5
  71 #include <krb5.h>
  72 #endif
  73
  74 #ifdef ALLOW_GROUP_CHANGE
  75 #include "grutil.h"
  76 #endif
  77 #include "suutil.h"
  78
  79 #ifdef KERBEROS5
  80 #define ARGSTRX "-Kdflm"
  81 static int kerberos5(char *, const char *, uid_t);
  82 int use_kerberos = 1;
  83 #else
  84 #define ARGSTRX "-dflm"
  85 #endif
  86
  87 #ifndef SU_GROUP
  88 #define SU_GROUP        "wheel"
  89 #endif
  90
  91 #define GROUP_PASSWORD  "Group Password:"
  92
  93 #ifdef LOGIN_CAP
  94 #define ARGSTR  ARGSTRX "c:"
  95 #else
  96 #define ARGSTR ARGSTRX
  97 #endif
  98
  99 static int check_ingroup(int, const char *, const char *, int);
 100
 101 int
 102 main(int argc, char **argv)
 103 {
 104         extern char **environ;
 105         struct passwd *pwd;
 106         char *p;
 107 #ifdef BSD4_4
 108         struct timeval tp;
 109 #endif
 110         uid_t ruid;
 111         int asme, ch, asthem, fastlogin, prio, gohome;
 112         enum { UNSET, YES, NO } iscsh = UNSET;
 113         const char *user, *shell, *avshell;
 114         char *username, **np;
 115 #ifdef SU_ROOTAUTH
 116         char *userpass;
 117 #endif
 118         char *class;
 119         char shellbuf[MAXPATHLEN], avshellbuf[MAXPATHLEN];
 120         time_t pw_warntime = _PASSWORD_WARNDAYS * SECSPERDAY;
 121 #ifdef LOGIN_CAP
 122         login_cap_t *lc;
 123 #endif
 124 #ifdef ALLOW_GROUP_CHANGE
 125         char *gname;
 126 #endif
 127
 128         (void)setprogname(argv[0]);
 129         asme = asthem = fastlogin = 0;
 130         gohome = 1;
 131         shell = class = NULL;
 132         while ((ch = getopt(argc, argv, ARGSTR)) != -1)
 133                 switch((char)ch) {
 134 #ifdef KERBEROS5
 135                 case 'K':
 136                         use_kerberos = 0;
 137                         break;
 138 #endif
 139 #ifdef LOGIN_CAP
 140                 case 'c':
 141                         class = optarg;
 142                         break;
 143 #endif
 144                 case 'd':
 145                         asme = 0;
 146                         asthem = 1;
 147                         gohome = 0;
 148                         break;
 149                 case 'f':
 150                         fastlogin = 1;
 151                         break;
 152                 case '-':
 153                 case 'l':
 154                         asme = 0;
 155                         asthem = 1;
 156                         break;
 157                 case 'm':
 158                         asme = 1;
 159                         asthem = 0;
 160                         break;
 161                 case '?':
 162                 default:
 163                         (void)fprintf(stderr,
 164 #ifdef ALLOW_GROUP_CHANGE
 165                             "usage: %s [%s] [login[:group] [shell arguments]]\n",
 166 #else
 167                             "usage: %s [%s] [login [shell arguments]]\n",
 168 #endif
 169                             getprogname(), ARGSTR);
 170                         exit(EXIT_FAILURE);
 171                 }
 172         argv += optind;
 173
 174         /* Lower the priority so su runs faster */
 175         errno = 0;
 176         prio = getpriority(PRIO_PROCESS, 0);
 177         if (errno)
 178                 prio = 0;
 179         if (prio > -2)
 180                 (void)setpriority(PRIO_PROCESS, 0, -2);
 181         openlog("su", 0, LOG_AUTH);
 182
 183         /* get current login name and shell */
 184         ruid = getuid();
 185         username = getlogin();
 186         if (username == NULL || (pwd = getpwnam(username)) == NULL ||
 187             pwd->pw_uid != ruid)
 188                 pwd = getpwuid(ruid);
 189         if (pwd == NULL)
 190                 errx(EXIT_FAILURE, "who are you?");
 191         username = estrdup(pwd->pw_name);
 192 #ifdef SU_ROOTAUTH
 193         userpass = estrdup(pwd->pw_passwd);
 194 #endif
 195
 196         if (asme) {
 197                 if (pwd->pw_shell && *pwd->pw_shell) {
 198                         (void)estrlcpy(shellbuf, pwd->pw_shell, sizeof(shellbuf));
 199                         shell = shellbuf;
 200                 } else {
 201                         shell = _PATH_BSHELL;
 202                         iscsh = NO;
 203                 }
 204         }
 205         /* get target login information, default to root */
 206         user = *argv ? *argv : "root";
 207         np = *argv ? argv : argv - 1;
 208
 209 #ifdef ALLOW_GROUP_CHANGE
 210         if ((p = strchr(user, ':')) != NULL) {
 211                 *p = '\0';
 212                 gname = ++p;
 213         }
 214         else
 215                 gname = NULL;
 216
 217 #ifdef ALLOW_EMPTY_USER
 218         if (user[0] == '\0' && gname != NULL)
 219                 user = username;
 220 #endif
 221 #endif
 222         if ((pwd = getpwnam(user)) == NULL)
 223                 errx(EXIT_FAILURE, "unknown login `%s'", user);
 224
 225 #ifdef LOGIN_CAP
 226         /* force the usage of specified class */
 227         if (class) {
 228                 if (ruid)
 229                         errx(EXIT_FAILURE, "Only root may use -c");
 230
 231                 pwd->pw_class = class;
 232         }
 233         if ((lc = login_getclass(pwd->pw_class)) == NULL)
 234                 errx(EXIT_FAILURE, "Unknown class %s", pwd->pw_class);
 235
 236         pw_warntime = (time_t)login_getcaptime(lc, "password-warn",
 237             _PASSWORD_WARNDAYS * SECSPERDAY,
 238             _PASSWORD_WARNDAYS * SECSPERDAY);
 239 #endif
 240
 241         if (ruid
 242 #ifdef KERBEROS5
 243             && (!use_kerberos || kerberos5(username, user, pwd->pw_uid))
 244 #endif
 245             ) {
 246                 char *pass = pwd->pw_passwd;
 247                 int ok = pwd->pw_uid != 0;
 248
 249 #ifdef SU_ROOTAUTH
 250                 /*
 251                  * Allow those in group rootauth to su to root, by supplying
 252                  * their own password.
 253                  */
 254                 if (!ok) {
 255                         if ((ok = check_ingroup(-1, SU_ROOTAUTH, username, 0))) {
 256                                 pass = userpass;
 257                                 user = username;
 258                         }
 259                 }
 260 #endif
 261                 /*
 262                  * Only allow those in group SU_GROUP to su to root,
 263                  * but only if that group has any members.
 264                  * If SU_GROUP has no members, allow anyone to su root
 265                  */
 266                 if (!ok)
 267                         ok = check_ingroup(-1, SU_GROUP, username, 1);
 268                 if (!ok)
 269                         errx(EXIT_FAILURE,
 270             "you are not listed in the correct secondary group (%s) to su %s.",
 271                                             SU_GROUP, user);
 272                 /* if target requires a password, verify it */
 273                 if (*pass && pwd->pw_uid != ruid) {     /* XXX - OK? */
 274                         p = getpass("Password:");
 275 #ifdef SKEY
 276                         if (strcasecmp(p, "s/key") == 0) {
 277                                 if (skey_haskey(user))
 278                                         errx(EXIT_FAILURE,
 279                                             "Sorry, you have no s/key.");
 280                                 else {
 281                                         if (skey_authenticate(user)) {
 282                                                 goto badlogin;
 283                                         }
 284                                 }
 285
 286                         } else
 287 #endif
 288                         if (strcmp(pass, crypt(p, pass)) != 0) {
 289 #ifdef SKEY
 290  badlogin:
 291 #endif
 292                                 (void)fprintf(stderr, "Sorry\n");
 293                                 syslog(LOG_WARNING,
 294                                         "BAD SU %s to %s%s", username,
 295                                         pwd->pw_name, ontty());
 296                                 exit(EXIT_FAILURE);
 297                         }
 298                 }
 299         }
 300
 301         if (asme) {
 302                 /* if asme and non-standard target shell, must be root */
 303                 if (chshell(pwd->pw_shell) == 0 && ruid)
 304                         errx(EXIT_FAILURE, "permission denied (shell).");
 305         } else if (pwd->pw_shell && *pwd->pw_shell) {
 306                 shell = pwd->pw_shell;
 307                 iscsh = UNSET;
 308         } else {
 309                 shell = _PATH_BSHELL;
 310                 iscsh = NO;
 311         }
 312
 313         if ((p = strrchr(shell, '/')) != NULL)
 314                 avshell = p+1;
 315         else
 316                 avshell = shell;
 317
 318         /* if we're forking a csh, we want to slightly muck the args */
 319         if (iscsh == UNSET)
 320                 iscsh = strstr(avshell, "csh") ? YES : NO;
 321
 322         /* set permissions */
 323 #ifdef LOGIN_CAP
 324 # ifdef ALLOW_GROUP_CHANGE
 325         /* if we aren't changing users, keep the current group members */
 326         if (ruid != pwd->pw_uid &&
 327             setusercontext(lc, pwd, pwd->pw_uid, LOGIN_SETGROUP) == -1)
 328                 err(EXIT_FAILURE, "setting user context");
 329
 330         addgroup(lc, gname, pwd, ruid, GROUP_PASSWORD);
 331
 332         if (setusercontext(lc, pwd, pwd->pw_uid,
 333                 (u_int)(asthem ? (LOGIN_SETPRIORITY | LOGIN_SETUMASK) : 0) |
 334                 LOGIN_SETRESOURCES | LOGIN_SETUSER) == -1)
 335                 err(EXIT_FAILURE, "setting user context");
 336 # else
 337         if (setusercontext(lc, pwd, pwd->pw_uid,
 338                 (u_int)(asthem ? (LOGIN_SETPRIORITY | LOGIN_SETUMASK) : 0) |
 339                 LOGIN_SETRESOURCES | LOGIN_SETGROUP | LOGIN_SETUSER) == -1)
 340                 err(EXIT_FAILURE, "setting user context");
 341 # endif
 342 #else
 343         if (setgid(pwd->pw_gid) == -1)
 344                 err(EXIT_FAILURE, "setgid");
 345         /* if we aren't changing users, keep the current group members */
 346         if (ruid != pwd->pw_uid && initgroups(user, pwd->pw_gid) != 0)
 347                 errx(EXIT_FAILURE, "initgroups failed");
 348 # ifdef ALLOW_GROUP_CHANGE
 349         addgroup(/*EMPTY*/, gname, pwd, ruid, GROUP_PASSWORD);
 350 # endif
 351         if (setuid(pwd->pw_uid) == -1)
 352                 err(EXIT_FAILURE, "setuid");
 353 #endif
 354
 355         if (!asme) {
 356                 if (asthem) {
 357                         p = getenv("TERM");
 358                         /* Create an empty environment */
 359                         environ = emalloc(sizeof(char *));
 360                         environ[0] = NULL;
 361 #ifdef LOGIN_CAP
 362                         if (setusercontext(lc, pwd, pwd->pw_uid,
 363                                 LOGIN_SETPATH) == -1)
 364                                 err(EXIT_FAILURE, "setting user context");
 365 #else
 366                         (void)setenv("PATH", _PATH_DEFPATH, 1);
 367 #endif
 368                         if (p)
 369                                 (void)setenv("TERM", p, 1);
 370                         if (gohome && chdir(pwd->pw_dir) == -1)
 371                                 errx(EXIT_FAILURE, "no directory");
 372                 }
 373
 374                 if (asthem || pwd->pw_uid) {
 375                         (void)setenv("LOGNAME", pwd->pw_name, 1);
 376                         (void)setenv("USER", pwd->pw_name, 1);
 377                 }
 378                 (void)setenv("HOME", pwd->pw_dir, 1);
 379                 (void)setenv("SHELL", shell, 1);
 380         }
 381         (void)setenv("SU_FROM", username, 1);
 382
 383         if (iscsh == YES) {
 384                 if (fastlogin)
 385                         *np-- = __UNCONST("-f");
 386                 if (asme)
 387                         *np-- = __UNCONST("-m");
 388         } else {
 389                 if (fastlogin)
 390                         (void)unsetenv("ENV");
 391         }
 392
 393         if (asthem) {
 394                 avshellbuf[0] = '-';
 395                 (void)estrlcpy(avshellbuf + 1, avshell, sizeof(avshellbuf) - 1);
 396                 avshell = avshellbuf;
 397         } else if (iscsh == YES) {
 398                 /* csh strips the first character... */
 399                 avshellbuf[0] = '_';
 400                 (void)estrlcpy(avshellbuf + 1, avshell, sizeof(avshellbuf) - 1);
 401                 avshell = avshellbuf;
 402         }
 403         *np = __UNCONST(avshell);
 404
 405 #ifdef BSD4_4
 406         if (pwd->pw_change || pwd->pw_expire)
 407                 (void)gettimeofday(&tp, NULL);
 408         if (pwd->pw_change) {
 409                 if (tp.tv_sec >= pwd->pw_change) {
 410                         (void)printf("%s -- %s's password has expired.\n",
 411                                      (ruid ? "Sorry" : "Note"), user);
 412                         if (ruid != 0)
 413                                 exit(EXIT_FAILURE);
 414                 } else if (pwd->pw_change - tp.tv_sec < pw_warntime)
 415                         (void)printf("Warning: %s's password expires on %s",
 416                                      user, ctime(&pwd->pw_change));
 417         }
 418         if (pwd->pw_expire) {
 419                 if (tp.tv_sec >= pwd->pw_expire) {
 420                         (void)printf("%s -- %s's account has expired.\n",
 421                                      (ruid ? "Sorry" : "Note"), user);
 422                         if (ruid != 0)
 423                                 exit(EXIT_FAILURE);
 424                 } else if (pwd->pw_expire - tp.tv_sec <
 425                     _PASSWORD_WARNDAYS * SECSPERDAY)
 426                         (void)printf("Warning: %s's account expires on %s",
 427                                      user, ctime(&pwd->pw_expire));
 428         }
 429 #endif
 430         if (ruid != 0)
 431                 syslog(LOG_NOTICE, "%s to %s%s",
 432                     username, pwd->pw_name, ontty());
 433
 434         /* Raise our priority back to what we had before */
 435         (void)setpriority(PRIO_PROCESS, 0, prio);
 436
 437         (void)execv(shell, np);
 438         err(EXIT_FAILURE, "%s", shell);
 439         /* NOTREACHED */
 440 }
 441
 442
 443 #ifdef KERBEROS5
 444 static int
 445 kerberos5(char *username, const char *user, uid_t uid)
 446 {
 447         krb5_error_code ret;
 448         krb5_context context;
 449         krb5_principal princ = NULL;
 450         krb5_ccache ccache, ccache2;
 451         char *cc_name;
 452         const char *filename;
 453
 454         ret = krb5_init_context(&context);
 455         if (ret)
 456                 return 1;
 457
 458         if (strcmp(user, "root") == 0)
 459                 ret = krb5_make_principal(context, &princ,
 460                                           NULL, username, "root", NULL);
 461         else
 462                 ret = krb5_make_principal(context, &princ,
 463                                           NULL, user, NULL);
 464         if (ret)
 465                 goto fail;
 466         if (!krb5_kuserok(context, princ, user) && !uid) {
 467                 warnx("kerberos5: not in %s's ACL.", user);
 468                 goto fail;
 469         }
 470         ret = krb5_cc_new_unique(context, krb5_mcc_ops.prefix, NULL, &ccache);
 471         if (ret)
 472                 goto fail;
 473         ret = krb5_verify_user_lrealm(context, princ, ccache, NULL, TRUE,
 474                                       NULL);
 475         if (ret) {
 476                 krb5_cc_destroy(context, ccache);
 477                 switch (ret) {
 478                 case KRB5_LIBOS_PWDINTR :
 479                         break;
 480                 case KRB5KRB_AP_ERR_BAD_INTEGRITY:
 481                 case KRB5KRB_AP_ERR_MODIFIED:
 482                         krb5_warnx(context, "Password incorrect");
 483                         break;
 484                 default :
 485                         krb5_warn(context, ret, "krb5_verify_user");
 486                         break;
 487                 }
 488                 goto fail;
 489         }
 490         ret = krb5_cc_new_unique(context, krb5_mcc_ops.prefix, NULL, &ccache2);
 491         if (ret) {
 492                 krb5_cc_destroy(context, ccache);
 493                 goto fail;
 494         }
 495         ret = krb5_cc_copy_cache(context, ccache, ccache2);
 496         if (ret) {
 497                 krb5_cc_destroy(context, ccache);
 498                 krb5_cc_destroy(context, ccache2);
 499                 goto fail;
 500         }
 501
 502         filename = krb5_cc_get_name(context, ccache2);
 503         (void)easprintf(&cc_name, "%s:%s", krb5_cc_get_type(context, ccache2),
 504                  filename);
 505         if (chown(filename, uid, NOGROUP) == -1) {
 506                 warn("chown %s", filename);
 507                 free(cc_name);
 508                 krb5_cc_destroy(context, ccache);
 509                 krb5_cc_destroy(context, ccache2);
 510                 goto fail;
 511         }
 512
 513         (void)setenv("KRB5CCNAME", cc_name, 1);
 514         free(cc_name);
 515         krb5_cc_close(context, ccache2);
 516         krb5_cc_destroy(context, ccache);
 517         return 0;
 518
 519  fail:
 520         if (princ != NULL)
 521                 krb5_free_principal(context, princ);
 522         krb5_free_context(context);
 523         return 1;
 524 }
 525 #endif /* KERBEROS5 */
 526
 527 static int
 528 check_ingroup(int gid, const char *gname, const char *user, int ifempty)
 529 {
 530         struct group *gr;
 531         char **g;
 532 #ifdef SU_INDIRECT_GROUP
 533         char **gr_mem;
 534         int n = 0;
 535         int i = 0;
 536 #endif
 537         int ok = 0;
 538
 539         if (gname == NULL)
 540                 gr = getgrgid((gid_t) gid);
 541         else
 542                 gr = getgrnam(gname);
 543
 544         /*
 545          * XXX we are relying on the fact that we only set ifempty when
 546          * calling to check for SU_GROUP and that is the only time a
 547          * missing group is acceptable.
 548          */
 549         if (gr == NULL)
 550                 return ifempty;
 551         if (!*gr->gr_mem)               /* empty */
 552                 return ifempty;
 553
 554         /*
 555          * Ok, first see if user is in gr_mem
 556          */
 557         for (g = gr->gr_mem; *g; ++g) {
 558                 if (strcmp(*g, user) == 0)
 559                         return 1;       /* ok */
 560 #ifdef SU_INDIRECT_GROUP
 561                 ++n;                    /* count them */
 562 #endif
 563         }
 564 #ifdef SU_INDIRECT_GROUP
 565         /*
 566          * No.
 567          * Now we need to duplicate the gr_mem list, and recurse for
 568          * each member to see if it is a group, and if so whether user is
 569          * in it.
 570          */
 571         gr_mem = emalloc((n + 1) * sizeof (char *));
 572         for (g = gr->gr_mem, i = 0; *g; ++g) {
 573                 gr_mem[i] = estrdup(*g);
 574                 i++;
 575         }
 576         gr_mem[i++] = NULL;
 577
 578         for (g = gr_mem; ok == 0 && *g; ++g) {
 579                 /*
 580                  * If we get this far we don't accept empty/missing groups.
 581                  */
 582                 ok = check_ingroup(-1, *g, user, 0);
 583         }
 584         for (g = gr_mem; *g; ++g) {
 585                 free(*g);
 586         }
 587         free(gr_mem);
 588 #endif
 589         return ok;
 590 }