su.c

   1 /* (C) 2013 rofl0r, based on design ideas of Rich Felker.
   2
   3 Permission is hereby granted, free of charge, to any person obtaining
   4 a copy of this software and associated documentation files (the
   5 "Software"), to deal in the Software without restriction, including
   6 without limitation the rights to use, copy, modify, merge, publish,
   7 distribute, sublicense, and/or sell copies of the Software, and to
   8 permit persons to whom the Software is furnished to do so, subject to
   9 the following conditions:
  10
  11 The above copyright notice and this permission notice shall be
  12 included in all copies or substantial portions of the Software.
  13
  14 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  15 EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  16 MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
  17 IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
  18 CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
  19 TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
  20 SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  21
  22 */
  23
  24 #define _BSD_SOURCE
  25 #include <unistd.h>
  26 #include <pwd.h>
  27 #include <stdio.h>
  28 #include <stdlib.h>
  29 #include <crypt.h>
  30 #include <string.h>
  31 #include <grp.h>
  32 #include <fcntl.h>
  33 #include <time.h>
  34 #include <sys/stat.h>
  35
  36 #if 1 || defined(IN_KDEVELOP_PARSER)
  37 #define HAVE_SHADOW
  38 #endif
  39 #ifdef HAVE_SHADOW
  40 #include <shadow.h>
  41 #else
  42 #warning "shadow support disabled, did you forget to pass -DHAVE_SHADOW ?"
  43 #endif
  44
  45 #if !defined(_Noreturn) && __STDC_VERSION__+0 < 201112L
  46 #ifdef __GNUC__
  47 #define _Noreturn __attribute__((noreturn))
  48 #else
  49 #define _Noreturn
  50 #endif
  51 #endif
  52
  53 static const char usage_text[] =
  54 "Usage: su [OPTION] name\n"
  55 "available options:\n"
  56 "- : start login shell\n"
  57 "-c command : run command and return\n"
  58 "-s shell   : use shell provided as argument (root only)\n"
  59 "if name is omitted, root is assumed.\n";
  60
  61 static _Noreturn void usage(void) {
  62         dprintf(1, usage_text);
  63         exit(1);
  64 }
  65
  66 static _Noreturn void perror_exit(const char* msg) {
  67         perror(msg);
  68         exit(1);
  69 }
  70
  71 static int directory_exists(const char* dir) {
  72         struct stat st;
  73         return stat(dir, &st) == 0 && S_ISDIR(st.st_mode);
  74 }
  75
  76 static time_t get_mtime(const char *fn) {
  77         struct stat st;
  78         if(stat(fn, &st)) return -1;
  79         return st.st_mtime;
  80 }
  81
  82 static void touch(const char* fn) {
  83         int fd = open(fn, O_RDWR | O_CREAT | O_TRUNC, 0600);
  84         if(fd != -1) close(fd);
  85 }
  86
  87 /* returns index of username argument, 0 if no username passed, -1 on syntax error
  88  * cmd_index will be set to the index of a -c argument, or 0 if its missing
  89  * shell_index will be set to the index of a -s argument, or 0 if its missing
  90  * login_shell will be set to 1 if the login shell option - was passed, 0 otherwise */
  91 static int parse_args(int argc, char** argv,
  92                      int *login_shell, int* cmd_index, int *shell_index) {
  93
  94         *login_shell = 0;
  95         *cmd_index   = 0;
  96         *shell_index = 0;
  97
  98         int i, wantarg = 0, res = 0;
  99         char *p;
 100
 101         for(i = 1; i < argc; i++) {
 102                 if(wantarg) {
 103                         wantarg = 0;
 104                         continue;
 105                 }
 106                 p = argv[i];
 107                 if(p[0] != '-') {
 108                         if(res) return -1;
 109                         res = i;
 110                 } else if(!p[1]) {
 111                         *login_shell = 1;
 112                 } else if((p[1] == 'c' || p[1] == 's') && !p[2]) {
 113                         if(i == argc - 1) return -1;
 114                         wantarg = 1;
 115                         if(p[1] == 'c') *cmd_index = i + 1;
 116                         else *shell_index = i + 1;
 117                 } else {
 118                         return -1;
 119                 }
 120         }
 121         if(wantarg) return -1;
 122         return res;
 123 }
 124
 125 /* return 1 if the password check succeeded, 0 otherwise */
 126 int check_pass(const char* name, const char *pass, struct passwd *pwd) {
 127         const char *encpw;
 128 #ifdef HAVE_SHADOW
 129         struct spwd *shpwd = getspnam(name);
 130         if(!shpwd) return 0;
 131         encpw = shpwd->sp_pwdp;
 132 #else
 133         (void) name;
 134         encpw = pwd->pw_passwd;
 135 #endif
 136         if(!encpw || !strcmp(encpw, "x")) return 0;
 137         const char* actpw = crypt(pass, encpw);
 138         if(!actpw) perror_exit("crypt");
 139         if(strcmp(actpw, encpw)) return 0;
 140         return 1;
 141 }
 142
 143 extern char** environ;
 144
 145 #define SU_DIR "/var/lib/su"
 146 #define LOGIN_DELAY_SECS 1
 147 #define STRIFY2(x) #x
 148 #define STRIFY(x) STRIFY2(x)
 149 #define LOGIN_DELAY_SECS_STR STRIFY(LOGIN_DELAY_SECS)
 150
 151 int main(int argc, char** argv) {
 152         int login_shell, cmd_index, shell_index, name_index;
 153         name_index = parse_args(argc, argv, &login_shell, &cmd_index, &shell_index);
 154         if(name_index == -1) usage();
 155
 156         int uid = getuid();
 157         int is_root = (uid == 0);
 158         if(shell_index && !is_root) usage();
 159
 160         const char* name = name_index ? argv[name_index] : "root";
 161
 162         char uidfn[256];
 163         snprintf(uidfn, sizeof uidfn, "%s/%d", SU_DIR, uid);
 164
 165         if(!directory_exists(SU_DIR)) {
 166                 if(geteuid() == 0 && mkdir(SU_DIR, 0700) == -1)
 167                         dprintf(2, "creation of directory " SU_DIR
 168                                    " for bruteforce prevention failed, consider creating it manually\n");
 169         }
 170
 171         char* pass = 0;
 172
 173         if(!is_root) {
 174                 time_t mtime = get_mtime(uidfn), now = time(0);
 175                 if(mtime != -1 && mtime + LOGIN_DELAY_SECS > now) {
 176                         if(now < mtime)
 177                                 dprintf(2, "warning: your system clock is in the past, check your CMOS battery.\n");
 178
 179                         dprintf(2, "you need to wait for " LOGIN_DELAY_SECS_STR
 180                                    " seconds before retrying.\n");
 181
 182                         if(now < mtime) goto failed;
 183
 184                         return 1;
 185                 }
 186                 pass = getpass("enter password:");
 187                 dprintf(1, "\n");
 188                 if(!pass) perror_exit("getpass");
 189         }
 190
 191         struct passwd *pwd = getpwnam(name);
 192         if(!pwd) goto failed;
 193         if(!is_root && !check_pass(name, pass, pwd)) {
 194                 failed:
 195                 touch(uidfn);
 196                 dprintf(2, "login failed\n");
 197                 return 1;
 198         }
 199
 200         if(initgroups(name, pwd->pw_gid)) perror_exit("initgroups");
 201         if(setgid(pwd->pw_gid)) perror_exit("setgid");
 202         if(setuid(pwd->pw_uid)) perror_exit("setuid");
 203
 204         char* const* new_argv;
 205         char shellbuf[256];
 206         char* shell = shell_index ? argv[shell_index] : pwd->pw_shell;
 207         char* shell_argv0 = shell;
 208         if(login_shell) {
 209                 snprintf(shellbuf, sizeof shellbuf, "-%s", shell);
 210                 shell_argv0 = shellbuf;
 211                 setenv("LOGNAME", name, 1);
 212                 if(getenv("USER")) setenv("USER", name, 1);
 213         }
 214         if(cmd_index) {
 215                 new_argv = (char* const[]) {shell_argv0, argv[cmd_index-1], argv[cmd_index], 0};
 216         } else {
 217                 new_argv = (char* const[]) {shell_argv0, 0};
 218         }
 219
 220         setenv("HOME", pwd->pw_dir, 1);
 221         if(login_shell) chdir(pwd->pw_dir);
 222
 223         if(execve(shell, new_argv, environ)) perror_exit("execve");
 224         return 1;
 225 }