1 /* $NetBSD: su.c,v 1.75 2023/03/24 16:58:24 kre Exp $ */
2
3 /*
4 * Copyright (c) 1988 The Regents of the University of California.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 3. Neither the name of the University nor the names of its contributors
16 * may be used to endorse or promote products derived from this software
17 * without specific prior written permission.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
30 */
31
32 #include <sys/cdefs.h>
33 #ifndef lint
34 __COPYRIGHT("@(#) Copyright (c) 1988\
35 The Regents of the University of California. All rights reserved.");
36 #endif /* not lint */
37
38 #ifndef lint
39 #if 0
40 static char sccsid[] = "@(#)su.c 8.3 (Berkeley) 4/2/94";*/
41 #else
42 __RCSID("$NetBSD: su.c,v 1.75 2023/03/24 16:58:24 kre Exp $");
43 #endif
44 #endif /* not lint */
45
46 #include <sys/param.h>
47 #include <sys/time.h>
48 #include <sys/resource.h>
49 #include <err.h>
50 #include <errno.h>
51 #include <grp.h>
52 #include <paths.h>
53 #include <pwd.h>
54 #include <stdio.h>
55 #ifdef SKEY
56 #include <skey.h>
57 #endif
58 #include <stdlib.h>
59 #include <string.h>
60 #include <syslog.h>
61 #include <time.h>
62 #include <tzfile.h>
63 #include <unistd.h>
64 #include <util.h>
65
66 #ifdef LOGIN_CAP
67 #include <login_cap.h>
68 #endif
69
70 #ifdef KERBEROS5
71 #include <krb5.h>
72 #endif
73
74 #ifdef ALLOW_GROUP_CHANGE
75 #include "grutil.h"
76 #endif
77 #include "suutil.h"
78
79 #ifdef KERBEROS5
80 #define ARGSTRX "-Kdflm"
81 static int kerberos5(char *, const char *, uid_t);
82 int use_kerberos = 1;
83 #else
84 #define ARGSTRX "-dflm"
85 #endif
86
87 #ifndef SU_GROUP
88 #define SU_GROUP "wheel"
89 #endif
90
91 #define GROUP_PASSWORD "Group Password:"
92
93 #ifdef LOGIN_CAP
94 #define ARGSTR ARGSTRX "c:"
95 #else
96 #define ARGSTR ARGSTRX
97 #endif
98
99 static int check_ingroup(int, const char *, const char *, int);
100
101 int
main(int argc,char ** argv)102 main(int argc, char **argv)
103 {
104 extern char **environ;
105 struct passwd *pwd;
106 char *p;
107 #ifdef BSD4_4
108 struct timeval tp;
109 #endif
110 uid_t ruid;
111 int asme, ch, asthem, fastlogin, prio, gohome;
112 enum { UNSET, YES, NO } iscsh = UNSET;
113 const char *user, *shell, *avshell;
114 char *username, **np;
115 #ifdef SU_ROOTAUTH
116 char *userpass;
117 #endif
118 char *class;
119 char shellbuf[MAXPATHLEN], avshellbuf[MAXPATHLEN];
120 time_t pw_warntime = _PASSWORD_WARNDAYS * SECSPERDAY;
121 #ifdef LOGIN_CAP
122 login_cap_t *lc;
123 #endif
124 #ifdef ALLOW_GROUP_CHANGE
125 char *gname;
126 #endif
127
128 (void)setprogname(argv[0]);
129 asme = asthem = fastlogin = 0;
130 gohome = 1;
131 shell = class = NULL;
132 while ((ch = getopt(argc, argv, ARGSTR)) != -1)
133 switch((char)ch) {
134 #ifdef KERBEROS5
135 case 'K':
136 use_kerberos = 0;
137 break;
138 #endif
139 #ifdef LOGIN_CAP
140 case 'c':
141 class = optarg;
142 break;
143 #endif
144 case 'd':
145 asme = 0;
146 asthem = 1;
147 gohome = 0;
148 break;
149 case 'f':
150 fastlogin = 1;
151 break;
152 case '-':
153 case 'l':
154 asme = 0;
155 asthem = 1;
156 break;
157 case 'm':
158 asme = 1;
159 asthem = 0;
160 break;
161 case '?':
162 default:
163 (void)fprintf(stderr,
164 #ifdef ALLOW_GROUP_CHANGE
165 "usage: %s [%s] [login[:group] [shell arguments]]\n",
166 #else
167 "usage: %s [%s] [login [shell arguments]]\n",
168 #endif
169 getprogname(), ARGSTR);
170 exit(EXIT_FAILURE);
171 }
172 argv += optind;
173
174 /* Lower the priority so su runs faster */
175 errno = 0;
176 prio = getpriority(PRIO_PROCESS, 0);
177 if (errno)
178 prio = 0;
179 if (prio > -2)
180 (void)setpriority(PRIO_PROCESS, 0, -2);
181 openlog("su", 0, LOG_AUTH);
182
183 /* get current login name and shell */
184 ruid = getuid();
185 username = getlogin();
186 if (username == NULL || (pwd = getpwnam(username)) == NULL ||
187 pwd->pw_uid != ruid)
188 pwd = getpwuid(ruid);
189 if (pwd == NULL)
190 errx(EXIT_FAILURE, "who are you?");
191 username = estrdup(pwd->pw_name);
192 #ifdef SU_ROOTAUTH
193 userpass = estrdup(pwd->pw_passwd);
194 #endif
195
196 if (asme) {
197 if (pwd->pw_shell && *pwd->pw_shell) {
198 (void)estrlcpy(shellbuf, pwd->pw_shell, sizeof(shellbuf));
199 shell = shellbuf;
200 } else {
201 shell = _PATH_BSHELL;
202 iscsh = NO;
203 }
204 }
205 /* get target login information, default to root */
206 user = *argv ? *argv : "root";
207 np = *argv ? argv : argv - 1;
208
209 #ifdef ALLOW_GROUP_CHANGE
210 if ((p = strchr(user, ':')) != NULL) {
211 *p = '\0';
212 gname = ++p;
213 if (*gname == '\0')
214 errx(EXIT_FAILURE, "missing 'group' after ':'");
215 } else
216 gname = NULL;
217
218 #ifdef ALLOW_EMPTY_USER
219 if (user[0] == '\0' && gname != NULL)
220 user = username;
221 #endif
222 #endif
223 if ((pwd = getpwnam(user)) == NULL)
224 errx(EXIT_FAILURE, "unknown login `%s'", user);
225
226 #ifdef LOGIN_CAP
227 /* force the usage of specified class */
228 if (class) {
229 if (ruid)
230 errx(EXIT_FAILURE, "Only root may use -c");
231
232 pwd->pw_class = class;
233 }
234 if ((lc = login_getclass(pwd->pw_class)) == NULL)
235 errx(EXIT_FAILURE, "Unknown class %s", pwd->pw_class);
236
237 pw_warntime = (time_t)login_getcaptime(lc, "password-warn",
238 _PASSWORD_WARNDAYS * SECSPERDAY,
239 _PASSWORD_WARNDAYS * SECSPERDAY);
240 #endif
241
242 if (ruid
243 #ifdef KERBEROS5
244 && (!use_kerberos || kerberos5(username, user, pwd->pw_uid))
245 #endif
246 ) {
247 char *pass = pwd->pw_passwd;
248 int ok = pwd->pw_uid != 0;
249
250 #ifdef SU_ROOTAUTH
251 /*
252 * Allow those in group rootauth to su to root, by supplying
253 * their own password.
254 */
255 if (!ok) {
256 if ((ok = check_ingroup(-1, SU_ROOTAUTH, username, 0))) {
257 pass = userpass;
258 user = username;
259 }
260 }
261 #endif
262 /*
263 * Only allow those in group SU_GROUP to su to root,
264 * but only if that group has any members.
265 * If SU_GROUP has no members, allow anyone to su root
266 */
267 if (!ok)
268 ok = check_ingroup(-1, SU_GROUP, username, 1);
269 if (!ok)
270 errx(EXIT_FAILURE,
271 "you are not listed in the correct secondary group (%s) to su %s.",
272 SU_GROUP, user);
273 /* if target requires a password, verify it */
274 if (*pass && pwd->pw_uid != ruid) { /* XXX - OK? */
275 p = getpass("Password:");
276 #ifdef SKEY
277 if (strcasecmp(p, "s/key") == 0) {
278 if (skey_haskey(user))
279 errx(EXIT_FAILURE,
280 "Sorry, you have no s/key.");
281 else {
282 if (skey_authenticate(user)) {
283 goto badlogin;
284 }
285 }
286
287 } else
288 #endif
289 if (consttime_memequal(pass,
290 crypt(p, pass), strlen(pass)) == 0) {
291 #ifdef SKEY
292 badlogin:
293 #endif
294 (void)fprintf(stderr, "Sorry\n");
295 syslog(LOG_WARNING,
296 "BAD SU %s to %s%s", username,
297 pwd->pw_name, ontty());
298 exit(EXIT_FAILURE);
299 }
300 }
301 }
302
303 if (asme) {
304 /* if asme and non-standard target shell, must be root */
305 if (chshell(pwd->pw_shell) == 0 && ruid)
306 errx(EXIT_FAILURE, "permission denied (shell).");
307 } else if (pwd->pw_shell && *pwd->pw_shell) {
308 shell = pwd->pw_shell;
309 iscsh = UNSET;
310 } else {
311 shell = _PATH_BSHELL;
312 iscsh = NO;
313 }
314
315 if ((p = strrchr(shell, '/')) != NULL)
316 avshell = p+1;
317 else
318 avshell = shell;
319
320 /* if we're forking a csh, we want to slightly muck the args */
321 if (iscsh == UNSET)
322 iscsh = strstr(avshell, "csh") ? YES : NO;
323
324 /* set permissions */
325 #ifdef LOGIN_CAP
326 # ifdef ALLOW_GROUP_CHANGE
327 /* if we aren't changing users, keep the current group members */
328 if (ruid != pwd->pw_uid &&
329 setusercontext(lc, pwd, pwd->pw_uid, LOGIN_SETGROUP) == -1)
330 err(EXIT_FAILURE, "setting user context");
331
332 addgroup(lc, gname, pwd, ruid, GROUP_PASSWORD);
333
334 if (setusercontext(lc, pwd, pwd->pw_uid,
335 (u_int)(asthem ? (LOGIN_SETPRIORITY | LOGIN_SETUMASK) : 0) |
336 LOGIN_SETRESOURCES | LOGIN_SETUSER) == -1)
337 err(EXIT_FAILURE, "setting user context");
338 # else
339 if (setusercontext(lc, pwd, pwd->pw_uid,
340 (u_int)(asthem ? (LOGIN_SETPRIORITY | LOGIN_SETUMASK) : 0) |
341 LOGIN_SETRESOURCES | LOGIN_SETGROUP | LOGIN_SETUSER) == -1)
342 err(EXIT_FAILURE, "setting user context");
343 # endif
344 #else
345 if (setgid(pwd->pw_gid) == -1)
346 err(EXIT_FAILURE, "setgid");
347 /* if we aren't changing users, keep the current group members */
348 if (ruid != pwd->pw_uid && initgroups(user, pwd->pw_gid) != 0)
349 errx(EXIT_FAILURE, "initgroups failed");
350 # ifdef ALLOW_GROUP_CHANGE
351 addgroup(/*EMPTY*/, gname, pwd, ruid, GROUP_PASSWORD);
352 # endif
353 if (setuid(pwd->pw_uid) == -1)
354 err(EXIT_FAILURE, "setuid");
355 #endif
356
357 if (!asme) {
358 if (asthem) {
359 p = getenv("TERM");
360 /* Create an empty environment */
361 environ = emalloc(sizeof(char *));
362 environ[0] = NULL;
363 #ifdef LOGIN_CAP
364 if (setusercontext(lc, pwd, pwd->pw_uid,
365 LOGIN_SETPATH) == -1)
366 err(EXIT_FAILURE, "setting user context");
367 #else
368 (void)setenv("PATH", _PATH_DEFPATH, 1);
369 #endif
370 if (p)
371 (void)setenv("TERM", p, 1);
372 if (gohome && chdir(pwd->pw_dir) == -1)
373 errx(EXIT_FAILURE, "no directory");
374 }
375
376 if (asthem || pwd->pw_uid) {
377 (void)setenv("LOGNAME", pwd->pw_name, 1);
378 (void)setenv("USER", pwd->pw_name, 1);
379 }
380 (void)setenv("HOME", pwd->pw_dir, 1);
381 (void)setenv("SHELL", shell, 1);
382 }
383 (void)setenv("SU_FROM", username, 1);
384
385 if (iscsh == YES) {
386 if (fastlogin)
387 *np-- = __UNCONST("-f");
388 if (asme)
389 *np-- = __UNCONST("-m");
390 } else {
391 if (fastlogin)
392 (void)unsetenv("ENV");
393 }
394
395 if (asthem) {
396 avshellbuf[0] = '-';
397 (void)estrlcpy(avshellbuf + 1, avshell, sizeof(avshellbuf) - 1);
398 avshell = avshellbuf;
399 } else if (iscsh == YES) {
400 /* csh strips the first character... */
401 avshellbuf[0] = '_';
402 (void)estrlcpy(avshellbuf + 1, avshell, sizeof(avshellbuf) - 1);
403 avshell = avshellbuf;
404 }
405 *np = __UNCONST(avshell);
406
407 #ifdef BSD4_4
408 if (pwd->pw_change || pwd->pw_expire)
409 (void)gettimeofday(&tp, NULL);
410 if (pwd->pw_change) {
411 if (tp.tv_sec >= pwd->pw_change) {
412 (void)printf("%s -- %s's password has expired.\n",
413 (ruid ? "Sorry" : "Note"), user);
414 if (ruid != 0)
415 exit(EXIT_FAILURE);
416 } else if (pwd->pw_change - tp.tv_sec < pw_warntime)
417 (void)printf("Warning: %s's password expires on %s",
418 user, ctime(&pwd->pw_change));
419 }
420 if (pwd->pw_expire) {
421 if (tp.tv_sec >= pwd->pw_expire) {
422 (void)printf("%s -- %s's account has expired.\n",
423 (ruid ? "Sorry" : "Note"), user);
424 if (ruid != 0)
425 exit(EXIT_FAILURE);
426 } else if (pwd->pw_expire - tp.tv_sec <
427 _PASSWORD_WARNDAYS * SECSPERDAY)
428 (void)printf("Warning: %s's account expires on %s",
429 user, ctime(&pwd->pw_expire));
430 }
431 #endif
432 if (ruid != 0)
433 syslog(LOG_NOTICE, "%s to %s%s",
434 username, pwd->pw_name, ontty());
435
436 /* Raise our priority back to what we had before */
437 (void)setpriority(PRIO_PROCESS, 0, prio);
438
439 (void)execv(shell, np);
440 err(EXIT_FAILURE, "%s", shell);
441 /* NOTREACHED */
442 }
443
444
445 #ifdef KERBEROS5
446 static int
kerberos5(char * username,const char * user,uid_t uid)447 kerberos5(char *username, const char *user, uid_t uid)
448 {
449 krb5_error_code ret;
450 krb5_context context;
451 krb5_principal princ = NULL;
452 krb5_ccache ccache, ccache2;
453 char *cc_name;
454 const char *filename;
455
456 ret = krb5_init_context(&context);
457 if (ret)
458 return 1;
459
460 if (strcmp(user, "root") == 0)
461 ret = krb5_make_principal(context, &princ,
462 NULL, username, "root", NULL);
463 else
464 ret = krb5_make_principal(context, &princ,
465 NULL, user, NULL);
466 if (ret)
467 goto fail;
468 if (!krb5_kuserok(context, princ, user) && !uid) {
469 warnx("kerberos5: not in %s's ACL.", user);
470 goto fail;
471 }
472 ret = krb5_cc_new_unique(context, krb5_mcc_ops.prefix, NULL, &ccache);
473 if (ret)
474 goto fail;
475 ret = krb5_verify_user_lrealm(context, princ, ccache, NULL, TRUE,
476 NULL);
477 if (ret) {
478 krb5_cc_destroy(context, ccache);
479 switch (ret) {
480 case KRB5_LIBOS_PWDINTR :
481 break;
482 case KRB5KRB_AP_ERR_BAD_INTEGRITY:
483 case KRB5KRB_AP_ERR_MODIFIED:
484 krb5_warnx(context, "Password incorrect");
485 break;
486 default :
487 krb5_warn(context, ret, "krb5_verify_user");
488 break;
489 }
490 goto fail;
491 }
492 ret = krb5_cc_new_unique(context, krb5_mcc_ops.prefix, NULL, &ccache2);
493 if (ret) {
494 krb5_cc_destroy(context, ccache);
495 goto fail;
496 }
497 ret = krb5_cc_copy_cache(context, ccache, ccache2);
498 if (ret) {
499 krb5_cc_destroy(context, ccache);
500 krb5_cc_destroy(context, ccache2);
501 goto fail;
502 }
503
504 filename = krb5_cc_get_name(context, ccache2);
505 (void)easprintf(&cc_name, "%s:%s", krb5_cc_get_type(context, ccache2),
506 filename);
507 if (chown(filename, uid, NOGROUP) == -1) {
508 warn("chown %s", filename);
509 free(cc_name);
510 krb5_cc_destroy(context, ccache);
511 krb5_cc_destroy(context, ccache2);
512 goto fail;
513 }
514
515 (void)setenv("KRB5CCNAME", cc_name, 1);
516 free(cc_name);
517 krb5_cc_close(context, ccache2);
518 krb5_cc_destroy(context, ccache);
519 return 0;
520
521 fail:
522 if (princ != NULL)
523 krb5_free_principal(context, princ);
524 krb5_free_context(context);
525 return 1;
526 }
527 #endif /* KERBEROS5 */
528
529 static int
check_ingroup(int gid,const char * gname,const char * user,int ifempty)530 check_ingroup(int gid, const char *gname, const char *user, int ifempty)
531 {
532 struct group *gr;
533 char **g;
534 #ifdef SU_INDIRECT_GROUP
535 char **gr_mem;
536 int n = 0;
537 int i = 0;
538 #endif
539 int ok = 0;
540
541 if (gname == NULL)
542 gr = getgrgid((gid_t) gid);
543 else
544 gr = getgrnam(gname);
545
546 /*
547 * XXX we are relying on the fact that we only set ifempty when
548 * calling to check for SU_GROUP and that is the only time a
549 * missing group is acceptable.
550 */
551 if (gr == NULL)
552 return ifempty;
553 if (!*gr->gr_mem) /* empty */
554 return ifempty;
555
556 /*
557 * Ok, first see if user is in gr_mem
558 */
559 for (g = gr->gr_mem; *g; ++g) {
560 if (strcmp(*g, user) == 0)
561 return 1; /* ok */
562 #ifdef SU_INDIRECT_GROUP
563 ++n; /* count them */
564 #endif
565 }
566 #ifdef SU_INDIRECT_GROUP
567 /*
568 * No.
569 * Now we need to duplicate the gr_mem list, and recurse for
570 * each member to see if it is a group, and if so whether user is
571 * in it.
572 */
573 gr_mem = NULL;
574 ereallocarr(&gr_mem, n + 1, sizeof(char *));
575 for (g = gr->gr_mem, i = 0; *g; ++g) {
576 gr_mem[i] = estrdup(*g);
577 i++;
578 }
579 gr_mem[i++] = NULL;
580
581 for (g = gr_mem; ok == 0 && *g; ++g) {
582 /*
583 * If we get this far we don't accept empty/missing groups.
584 */
585 ok = check_ingroup(-1, *g, user, 0);
586 }
587 for (g = gr_mem; *g; ++g) {
588 free(*g);
589 }
590 free(gr_mem);
591 #endif
592 return ok;
593 }
594