lib/uid_wrapper/uid_wrapper.c

   1 /*
   2  * Copyright (c) 2009      Andrew Tridgell
   3  * Copyright (c) 2011-2013 Andreas Schneider <asn@samba.org>
   4  *
   5  * This program is free software: you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation, either version 3 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License
  16  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  17  */
  18
  19 #include "config.h"
  20
  21 #include <errno.h>
  22 #include <stdarg.h>
  23 #include <stdbool.h>
  24 #include <stdlib.h>
  25 #include <stdio.h>
  26 #include <string.h>
  27 #include <sys/types.h>
  28 #include <unistd.h>
  29 #include <grp.h>
  30 #ifdef HAVE_SYS_SYSCALL_H
  31 #include <sys/syscall.h>
  32 #endif
  33 #ifdef HAVE_SYSCALL_H
  34 #include <syscall.h>
  35 #endif
  36 #include <dlfcn.h>
  37
  38 #include <pthread.h>
  39
  40 #ifdef HAVE_GCC_THREAD_LOCAL_STORAGE
  41 # define UWRAP_THREAD __thread
  42 #else
  43 # define UWRAP_THREAD
  44 #endif
  45
  46 #ifdef HAVE_DESTRUCTOR_ATTRIBUTE
  47 #define DESTRUCTOR_ATTRIBUTE __attribute__ ((destructor))
  48 #else
  49 #define DESTRUCTOR_ATTRIBUTE
  50 #endif /* HAVE_DESTRUCTOR_ATTRIBUTE */
  51
  52 /* GCC have printf type attribute check. */
  53 #ifdef HAVE_FUNCTION_ATTRIBUTE_FORMAT
  54 #define PRINTF_ATTRIBUTE(a,b) __attribute__ ((__format__ (__printf__, a, b)))
  55 #else
  56 #define PRINTF_ATTRIBUTE(a,b)
  57 #endif /* HAVE_FUNCTION_ATTRIBUTE_FORMAT */
  58
  59 #define UWRAP_DLIST_ADD(list,item) do { \
  60         if (!(list)) { \
  61                 (item)->prev    = NULL; \
  62                 (item)->next    = NULL; \
  63                 (list)          = (item); \
  64         } else { \
  65                 (item)->prev    = NULL; \
  66                 (item)->next    = (list); \
  67                 (list)->prev    = (item); \
  68                 (list)          = (item); \
  69         } \
  70 } while (0)
  71
  72 #define UWRAP_DLIST_REMOVE(list,item) do { \
  73         if ((list) == (item)) { \
  74                 (list)          = (item)->next; \
  75                 if (list) { \
  76                         (list)->prev    = NULL; \
  77                 } \
  78         } else { \
  79                 if ((item)->prev) { \
  80                         (item)->prev->next      = (item)->next; \
  81                 } \
  82                 if ((item)->next) { \
  83                         (item)->next->prev      = (item)->prev; \
  84                 } \
  85         } \
  86         (item)->prev    = NULL; \
  87         (item)->next    = NULL; \
  88 } while (0)
  89
  90 #ifndef SAFE_FREE
  91 #define SAFE_FREE(x) do { if ((x) != NULL) {free(x); (x)=NULL;} } while(0)
  92 #endif
  93
  94 /*****************
  95  * LOGGING
  96  *****************/
  97
  98 enum uwrap_dbglvl_e {
  99         UWRAP_LOG_ERROR = 0,
 100         UWRAP_LOG_WARN,
 101         UWRAP_LOG_DEBUG,
 102         UWRAP_LOG_TRACE
 103 };
 104
 105 #ifdef NDEBUG
 106 # define UWRAP_LOG(...)
 107 #else /* NDEBUG */
 108 static void uwrap_log(enum uwrap_dbglvl_e dbglvl, const char *format, ...) PRINTF_ATTRIBUTE(2, 3);
 109 # define UWRAP_LOG(dbglvl, ...) uwrap_log((dbglvl), __VA_ARGS__)
 110
 111 static void uwrap_log(enum uwrap_dbglvl_e dbglvl, const char *format, ...)
 112 {
 113         char buffer[1024];
 114         va_list va;
 115         const char *d;
 116         unsigned int lvl = 0;
 117
 118         d = getenv("UID_WRAPPER_DEBUGLEVEL");
 119         if (d != NULL) {
 120                 lvl = atoi(d);
 121         }
 122
 123         va_start(va, format);
 124         vsnprintf(buffer, sizeof(buffer), format, va);
 125         va_end(va);
 126
 127         if (lvl >= dbglvl) {
 128                 switch (dbglvl) {
 129                         case UWRAP_LOG_ERROR:
 130                                 fprintf(stderr,
 131                                         "UWRAP_ERROR(%d): %s\n",
 132                                         (int)getpid(), buffer);
 133                                 break;
 134                         case UWRAP_LOG_WARN:
 135                                 fprintf(stderr,
 136                                         "UWRAP_WARN(%d): %s\n",
 137                                         (int)getpid(), buffer);
 138                                 break;
 139                         case UWRAP_LOG_DEBUG:
 140                                 fprintf(stderr,
 141                                         "UWRAP_DEBUG(%d): %s\n",
 142                                         (int)getpid(), buffer);
 143                                 break;
 144                         case UWRAP_LOG_TRACE:
 145                                 fprintf(stderr,
 146                                         "UWRAP_TRACE(%d): %s\n",
 147                                         (int)getpid(), buffer);
 148                                 break;
 149                 }
 150         }
 151 }
 152 #endif /* NDEBUG */
 153
 154 /*****************
 155  * LIBC
 156  *****************/
 157
 158 #define LIBC_NAME "libc.so"
 159
 160 struct uwrap_libc_fns {
 161         int (*_libc_setuid)(uid_t uid);
 162         uid_t (*_libc_getuid)(void);
 163
 164 #ifdef HAVE_SETEUID
 165         int (*_libc_seteuid)(uid_t euid);
 166 #endif
 167 #ifdef HAVE_SETREUID
 168         int (*_libc_setreuid)(uid_t ruid, uid_t euid);
 169 #endif
 170 #ifdef HAVE_SETRESUID
 171         int (*_libc_setresuid)(uid_t ruid, uid_t euid, uid_t suid);
 172 #endif
 173         uid_t (*_libc_geteuid)(void);
 174
 175         int (*_libc_setgid)(gid_t gid);
 176         gid_t (*_libc_getgid)(void);
 177 #ifdef HAVE_SETEGID
 178         int (*_libc_setegid)(uid_t egid);
 179 #endif
 180 #ifdef HAVE_SETREGID
 181         int (*_libc_setregid)(uid_t rgid, uid_t egid);
 182 #endif
 183 #ifdef HAVE_SETRESGID
 184         int (*_libc_setresgid)(uid_t rgid, uid_t egid, uid_t sgid);
 185 #endif
 186         gid_t (*_libc_getegid)(void);
 187         int (*_libc_getgroups)(int size, gid_t list[]);
 188         int (*_libc_setgroups)(size_t size, const gid_t *list);
 189 #ifdef HAVE_SYSCALL
 190         long int (*_libc_syscall)(long int sysno, ...);
 191 #endif
 192 };
 193
 194 /*
 195  * We keep the virtualised euid/egid/groups information here
 196  */
 197 struct uwrap_thread {
 198         pthread_t tid;
 199         bool dead;
 200
 201         uid_t ruid;
 202         uid_t euid;
 203         uid_t suid;
 204
 205         gid_t rgid;
 206         gid_t egid;
 207         gid_t sgid;
 208
 209         gid_t *groups;
 210         int ngroups;
 211
 212         struct uwrap_thread *next;
 213         struct uwrap_thread *prev;
 214 };
 215
 216 struct uwrap {
 217         struct {
 218                 void *handle;
 219                 struct uwrap_libc_fns fns;
 220         } libc;
 221
 222         bool initialised;
 223         bool enabled;
 224
 225         uid_t myuid;
 226         uid_t mygid;
 227
 228         struct uwrap_thread *ids;
 229 };
 230
 231 static struct uwrap uwrap;
 232
 233 /* Shortcut to the list item */
 234 static UWRAP_THREAD struct uwrap_thread *uwrap_tls_id;
 235
 236 /* The mutex or accessing the id */
 237 static pthread_mutex_t uwrap_id_mutex = PTHREAD_MUTEX_INITIALIZER;
 238
 239 /*********************************************************
 240  * UWRAP PROTOTYPES
 241  *********************************************************/
 242
 243 bool uid_wrapper_enabled(void);
 244 void uwrap_destructor(void) DESTRUCTOR_ATTRIBUTE;
 245
 246 /*********************************************************
 247  * UWRAP LIBC LOADER FUNCTIONS
 248  *********************************************************/
 249
 250 enum uwrap_lib {
 251     UWRAP_LIBC,
 252     UWRAP_LIBNSL,
 253     UWRAP_LIBSOCKET,
 254 };
 255
 256 static void *uwrap_load_lib_handle(enum uwrap_lib lib)
 257 {
 258         int flags = RTLD_LAZY;
 259         void *handle = NULL;
 260         int i;
 261
 262 #ifdef RTLD_DEEPBIND
 263         flags |= RTLD_DEEPBIND;
 264 #endif
 265
 266         switch (lib) {
 267         case UWRAP_LIBNSL:
 268                 /* FALL TROUGH */
 269         case UWRAP_LIBSOCKET:
 270                 /* FALL TROUGH */
 271         case UWRAP_LIBC:
 272                 handle = uwrap.libc.handle;
 273                 if (handle == NULL) {
 274                         for (handle = NULL, i = 10; handle == NULL && i >= 0; i--) {
 275                                 char soname[256] = {0};
 276
 277                                 snprintf(soname, sizeof(soname), "libc.so.%d", i);
 278                                 handle = dlopen(soname, flags);
 279                         }
 280
 281                         uwrap.libc.handle = handle;
 282                 }
 283                 break;
 284         }
 285
 286         if (handle == NULL) {
 287 #ifdef RTLD_NEXT
 288                 handle = uwrap.libc.handle = RTLD_NEXT;
 289 #else
 290                 fprintf(stderr,
 291                         "Failed to dlopen library: %s\n",
 292                         dlerror());
 293                 exit(-1);
 294 #endif
 295         }
 296
 297         return handle;
 298 }
 299
 300 static void *_uwrap_load_lib_function(enum uwrap_lib lib, const char *fn_name)
 301 {
 302         void *handle;
 303         void *func;
 304
 305         handle = uwrap_load_lib_handle(lib);
 306
 307         func = dlsym(handle, fn_name);
 308         if (func == NULL) {
 309                 fprintf(stderr,
 310                         "Failed to find %s: %s\n",
 311                         fn_name, dlerror());
 312                 exit(-1);
 313         }
 314
 315         return func;
 316 }
 317
 318 #define uwrap_load_lib_function(lib, fn_name) \
 319         if (uwrap.libc.fns._libc_##fn_name == NULL) { \
 320                 *(void **) (&uwrap.libc.fns._libc_##fn_name) = \
 321                         _uwrap_load_lib_function(lib, #fn_name); \
 322         }
 323
 324 /*
 325  * IMPORTANT
 326  *
 327  * Functions expeciall from libc need to be loaded individually, you can't load
 328  * all at once or gdb will segfault at startup. The same applies to valgrind and
 329  * has probably something todo with with the linker.
 330  * So we need load each function at the point it is called the first time.
 331  */
 332 static int libc_setuid(uid_t uid)
 333 {
 334         uwrap_load_lib_function(UWRAP_LIBC, setuid);
 335
 336         return uwrap.libc.fns._libc_setuid(uid);
 337 }
 338
 339 static uid_t libc_getuid(void)
 340 {
 341         uwrap_load_lib_function(UWRAP_LIBC, getuid);
 342
 343         return uwrap.libc.fns._libc_getuid();
 344 }
 345
 346 #ifdef HAVE_SETEUID
 347 static int libc_seteuid(uid_t euid)
 348 {
 349         uwrap_load_lib_function(UWRAP_LIBC, seteuid);
 350
 351         return uwrap.libc.fns._libc_seteuid(euid);
 352 }
 353 #endif
 354
 355 #ifdef HAVE_SETREUID
 356 static int libc_setreuid(uid_t ruid, uid_t euid)
 357 {
 358         uwrap_load_lib_function(UWRAP_LIBC, setreuid);
 359
 360         return uwrap.libc.fns._libc_setreuid(ruid, euid);
 361 }
 362 #endif
 363
 364 #ifdef HAVE_SETRESUID
 365 static int libc_setresuid(uid_t ruid, uid_t euid, uid_t suid)
 366 {
 367         uwrap_load_lib_function(UWRAP_LIBC, setresuid);
 368
 369         return uwrap.libc.fns._libc_setresuid(ruid, euid, suid);
 370 }
 371 #endif
 372
 373 static uid_t libc_geteuid(void)
 374 {
 375         uwrap_load_lib_function(UWRAP_LIBC, geteuid);
 376
 377         return uwrap.libc.fns._libc_geteuid();
 378 }
 379
 380 static int libc_setgid(gid_t gid)
 381 {
 382         uwrap_load_lib_function(UWRAP_LIBC, setgid);
 383
 384         return uwrap.libc.fns._libc_setgid(gid);
 385 }
 386
 387 static gid_t libc_getgid(void)
 388 {
 389         uwrap_load_lib_function(UWRAP_LIBC, getgid);
 390
 391         return uwrap.libc.fns._libc_getgid();
 392 }
 393
 394 #ifdef HAVE_SETEGID
 395 static int libc_setegid(gid_t egid)
 396 {
 397         uwrap_load_lib_function(UWRAP_LIBC, setegid);
 398
 399         return uwrap.libc.fns._libc_setegid(egid);
 400 }
 401 #endif
 402
 403 #ifdef HAVE_SETREGID
 404 static int libc_setregid(gid_t rgid, gid_t egid)
 405 {
 406         uwrap_load_lib_function(UWRAP_LIBC, setregid);
 407
 408         return uwrap.libc.fns._libc_setregid(rgid, egid);
 409 }
 410 #endif
 411
 412 #ifdef HAVE_SETRESGID
 413 static int libc_setresgid(gid_t rgid, gid_t egid, gid_t sgid)
 414 {
 415         uwrap_load_lib_function(UWRAP_LIBC, setresgid);
 416
 417         return uwrap.libc.fns._libc_setresgid(rgid, egid, sgid);
 418 }
 419 #endif
 420
 421 static gid_t libc_getegid(void)
 422 {
 423         uwrap_load_lib_function(UWRAP_LIBC, getegid);
 424
 425         return uwrap.libc.fns._libc_getegid();
 426 }
 427
 428 static int libc_getgroups(int size, gid_t list[])
 429 {
 430         uwrap_load_lib_function(UWRAP_LIBC, getgroups);
 431
 432         return uwrap.libc.fns._libc_getgroups(size, list);
 433 }
 434
 435 static int libc_setgroups(size_t size, const gid_t *list)
 436 {
 437         uwrap_load_lib_function(UWRAP_LIBC, setgroups);
 438
 439         return uwrap.libc.fns._libc_setgroups(size, list);
 440 }
 441
 442 #ifdef HAVE_SYSCALL
 443 static long int libc_vsyscall(long int sysno, va_list va)
 444 {
 445         long int args[8];
 446         long int rc;
 447         int i;
 448
 449         uwrap_load_lib_function(UWRAP_LIBC, syscall);
 450
 451         for (i = 0; i < 8; i++) {
 452                 args[i] = va_arg(va, long int);
 453         }
 454
 455         rc = uwrap.libc.fns._libc_syscall(sysno,
 456                                           args[0],
 457                                           args[1],
 458                                           args[2],
 459                                           args[3],
 460                                           args[4],
 461                                           args[5],
 462                                           args[6],
 463                                           args[7]);
 464
 465         return rc;
 466 }
 467 #endif
 468
 469 /*********************************************************
 470  * UWRAP ID HANDLING
 471  *********************************************************/
 472
 473 static struct uwrap_thread *find_uwrap_id(pthread_t tid)
 474 {
 475         struct uwrap_thread *id;
 476
 477         for (id = uwrap.ids; id; id = id->next) {
 478                 if (pthread_equal(id->tid, tid)) {
 479                         return id;
 480                 }
 481         }
 482
 483         return NULL;
 484 }
 485
 486 static int uwrap_new_id(pthread_t tid, bool do_alloc)
 487 {
 488         struct uwrap_thread *id = uwrap_tls_id;
 489
 490         if (do_alloc) {
 491                 id = malloc(sizeof(struct uwrap_thread));
 492                 if (id == NULL) {
 493                         UWRAP_LOG(UWRAP_LOG_ERROR, "Unable to allocate memory");
 494                         errno = ENOMEM;
 495                         return -1;
 496                 }
 497
 498                 id->groups = malloc(sizeof(gid_t) * 1);
 499                 if (id->groups == NULL) {
 500                         UWRAP_LOG(UWRAP_LOG_ERROR, "Unable to allocate memory");
 501                         SAFE_FREE(id);
 502                         errno = ENOMEM;
 503                         return -1;
 504                 }
 505
 506                 UWRAP_DLIST_ADD(uwrap.ids, id);
 507                 uwrap_tls_id = id;
 508         }
 509
 510         id->tid = tid;
 511         id->dead = false;
 512
 513         id->ruid = id->euid = id->suid = uwrap.myuid;
 514         id->rgid = id->egid = id->sgid = uwrap.mygid;
 515
 516         id->ngroups = 1;
 517         id->groups[0] = uwrap.mygid;
 518
 519         return 0;
 520 }
 521
 522 static void uwrap_thread_prepare(void)
 523 {
 524         pthread_mutex_lock(&uwrap_id_mutex);
 525
 526         /*
 527          * What happens if another atfork prepare functions calls a uwrap
 528          * function? So disable it in case another atfork prepare function
 529          * calls a (s)uid function.
 530          */
 531         uwrap.enabled = false;
 532 }
 533
 534 static void uwrap_thread_parent(void)
 535 {
 536         uwrap.enabled = true;
 537
 538         pthread_mutex_unlock(&uwrap_id_mutex);
 539 }
 540
 541 static void uwrap_thread_child(void)
 542 {
 543         uwrap.enabled = true;
 544
 545         pthread_mutex_unlock(&uwrap_id_mutex);
 546 }
 547
 548 static void uwrap_init(void)
 549 {
 550         const char *env = getenv("UID_WRAPPER");
 551         pthread_t tid = pthread_self();
 552
 553
 554
 555         if (uwrap.initialised) {
 556                 struct uwrap_thread *id = uwrap_tls_id;
 557                 int rc;
 558
 559                 if (id != NULL) {
 560                         return;
 561                 }
 562
 563                 pthread_mutex_lock(&uwrap_id_mutex);
 564                 id = find_uwrap_id(tid);
 565                 if (id == NULL) {
 566                         rc = uwrap_new_id(tid, true);
 567                         if (rc < 0) {
 568                                 exit(-1);
 569                         }
 570                 } else {
 571                         /* We reuse an old thread id */
 572                         uwrap_tls_id = id;
 573
 574                         uwrap_new_id(tid, false);
 575                 }
 576                 pthread_mutex_unlock(&uwrap_id_mutex);
 577
 578                 return;
 579         }
 580
 581         /*
 582          * If we hold a lock and the application forks, then the child
 583          * is not able to unlock the mutex and we are in a deadlock.
 584          * This should prevent such deadlocks.
 585          */
 586         pthread_atfork(&uwrap_thread_prepare,
 587                        &uwrap_thread_parent,
 588                        &uwrap_thread_child);
 589
 590         pthread_mutex_lock(&uwrap_id_mutex);
 591
 592         uwrap.initialised = true;
 593         uwrap.enabled = false;
 594
 595         if (env != NULL && env[0] == '1') {
 596                 const char *root = getenv("UID_WRAPPER_ROOT");
 597                 int rc;
 598
 599                 /* put us in one group */
 600                 if (root != NULL && root[0] == '1') {
 601                         uwrap.myuid = 0;
 602                         uwrap.mygid = 0;
 603                 } else {
 604                         uwrap.myuid = libc_geteuid();
 605                         uwrap.mygid = libc_getegid();
 606                 }
 607
 608                 rc = uwrap_new_id(tid, true);
 609                 if (rc < 0) {
 610                         exit(-1);
 611                 }
 612
 613                 uwrap.enabled = true;
 614         }
 615
 616         pthread_mutex_unlock(&uwrap_id_mutex);
 617 }
 618
 619 bool uid_wrapper_enabled(void)
 620 {
 621         uwrap_init();
 622
 623         return uwrap.enabled ? true : false;
 624 }
 625
 626 static int uwrap_setresuid_thread(uid_t ruid, uid_t euid, uid_t suid)
 627 {
 628         struct uwrap_thread *id = uwrap_tls_id;
 629
 630         if (ruid == (uid_t)-1 && euid == (uid_t)-1 && suid == (uid_t)-1) {
 631                 errno = EINVAL;
 632                 return -1;
 633         }
 634
 635         pthread_mutex_lock(&uwrap_id_mutex);
 636         if (ruid != (uid_t)-1) {
 637                 id->ruid = ruid;
 638         }
 639
 640         if (euid != (uid_t)-1) {
 641                 id->euid = euid;
 642         }
 643
 644         if (suid != (uid_t)-1) {
 645                 id->suid = suid;
 646         }
 647         pthread_mutex_unlock(&uwrap_id_mutex);
 648
 649         return 0;
 650 }
 651
 652 static int uwrap_setresuid(uid_t ruid, uid_t euid, uid_t suid)
 653 {
 654         struct uwrap_thread *id;
 655
 656         if (ruid == (uid_t)-1 && euid == (uid_t)-1 && suid == (uid_t)-1) {
 657                 errno = EINVAL;
 658                 return -1;
 659         }
 660
 661         pthread_mutex_lock(&uwrap_id_mutex);
 662         for (id = uwrap.ids; id; id = id->next) {
 663                 if (id->dead) {
 664                         continue;
 665                 }
 666
 667                 if (ruid != (uid_t)-1) {
 668                         id->ruid = ruid;
 669                 }
 670
 671                 if (euid != (uid_t)-1) {
 672                         id->euid = euid;
 673                 }
 674
 675                 if (suid != (uid_t)-1) {
 676                         id->suid = suid;
 677                 }
 678         }
 679         pthread_mutex_unlock(&uwrap_id_mutex);
 680
 681         return 0;
 682 }
 683
 684 /*
 685  * SETUID
 686  */
 687 int setuid(uid_t uid)
 688 {
 689         if (!uid_wrapper_enabled()) {
 690                 return libc_setuid(uid);
 691         }
 692
 693         return uwrap_setresuid(uid, -1, -1);
 694 }
 695
 696 #ifdef HAVE_SETEUID
 697 int seteuid(uid_t euid)
 698 {
 699         if (euid == (uid_t)-1) {
 700                 errno = EINVAL;
 701                 return -1;
 702         }
 703
 704         if (!uid_wrapper_enabled()) {
 705                 return libc_seteuid(euid);
 706         }
 707
 708         return uwrap_setresuid(-1, euid, -1);
 709 }
 710 #endif
 711
 712 #ifdef HAVE_SETREUID
 713 int setreuid(uid_t ruid, uid_t euid)
 714 {
 715         if (ruid == (uid_t)-1 && euid == (uid_t)-1) {
 716                 errno = EINVAL;
 717                 return -1;
 718         }
 719
 720         if (!uid_wrapper_enabled()) {
 721                 return libc_setreuid(ruid, euid);
 722         }
 723
 724         return uwrap_setresuid(ruid, euid, -1);
 725 }
 726 #endif
 727
 728 #ifdef HAVE_SETRESUID
 729 int setresuid(uid_t ruid, uid_t euid, uid_t suid)
 730 {
 731         if (!uid_wrapper_enabled()) {
 732                 return libc_setresuid(ruid, euid, suid);
 733         }
 734
 735         return uwrap_setresuid(ruid, euid, suid);
 736 }
 737 #endif
 738
 739 /*
 740  * GETUID
 741  */
 742 static uid_t uwrap_getuid(void)
 743 {
 744         struct uwrap_thread *id = uwrap_tls_id;
 745         uid_t uid;
 746
 747         pthread_mutex_lock(&uwrap_id_mutex);
 748         uid = id->ruid;
 749         pthread_mutex_unlock(&uwrap_id_mutex);
 750
 751         return uid;
 752 }
 753
 754 uid_t getuid(void)
 755 {
 756         if (!uid_wrapper_enabled()) {
 757                 return libc_getuid();
 758         }
 759
 760         return uwrap_getuid();
 761 }
 762
 763 /*
 764  * GETEUID
 765  */
 766 static uid_t uwrap_geteuid(void)
 767 {
 768         const char *env = getenv("UID_WRAPPER_MYUID");
 769         struct uwrap_thread *id = uwrap_tls_id;
 770         uid_t uid;
 771
 772         pthread_mutex_lock(&uwrap_id_mutex);
 773         uid = id->euid;
 774         pthread_mutex_unlock(&uwrap_id_mutex);
 775
 776         /* Disable root and return myuid */
 777         if (env != NULL && env[0] == '1') {
 778                 uid = uwrap.myuid;
 779         }
 780
 781         return uid;
 782 }
 783
 784 uid_t geteuid(void)
 785 {
 786         if (!uid_wrapper_enabled()) {
 787                 return libc_geteuid();
 788         }
 789
 790         return uwrap_geteuid();
 791 }
 792
 793 static int uwrap_setresgid_thread(gid_t rgid, gid_t egid, gid_t sgid)
 794 {
 795         struct uwrap_thread *id = uwrap_tls_id;
 796
 797         if (rgid == (gid_t)-1 && egid == (gid_t)-1 && sgid == (gid_t)-1) {
 798                 errno = EINVAL;
 799                 return -1;
 800         }
 801
 802         pthread_mutex_lock(&uwrap_id_mutex);
 803         if (rgid != (gid_t)-1) {
 804                 id->rgid = rgid;
 805         }
 806
 807         if (egid != (gid_t)-1) {
 808                 id->egid = egid;
 809         }
 810
 811         if (sgid != (gid_t)-1) {
 812                 id->sgid = sgid;
 813         }
 814         pthread_mutex_unlock(&uwrap_id_mutex);
 815
 816         return 0;
 817 }
 818
 819 static int uwrap_setresgid(gid_t rgid, gid_t egid, gid_t sgid)
 820 {
 821         struct uwrap_thread *id;
 822
 823         if (rgid == (gid_t)-1 && egid == (gid_t)-1 && sgid == (gid_t)-1) {
 824                 errno = EINVAL;
 825                 return -1;
 826         }
 827
 828         pthread_mutex_lock(&uwrap_id_mutex);
 829         for (id = uwrap.ids; id; id = id->next) {
 830                 if (id->dead) {
 831                         continue;
 832                 }
 833
 834                 if (rgid != (gid_t)-1) {
 835                         id->rgid = rgid;
 836                 }
 837
 838                 if (egid != (gid_t)-1) {
 839                         id->egid = egid;
 840                 }
 841
 842                 if (sgid != (gid_t)-1) {
 843                         id->sgid = sgid;
 844                 }
 845         }
 846         pthread_mutex_unlock(&uwrap_id_mutex);
 847
 848         return 0;
 849 }
 850
 851 /*
 852  * SETGID
 853  */
 854 int setgid(gid_t gid)
 855 {
 856         if (!uid_wrapper_enabled()) {
 857                 return libc_setgid(gid);
 858         }
 859
 860         return uwrap_setresgid(gid, -1, -1);
 861 }
 862
 863 #ifdef HAVE_SETEGID
 864 int setegid(gid_t egid)
 865 {
 866         if (!uid_wrapper_enabled()) {
 867                 return libc_setegid(egid);
 868         }
 869
 870         return uwrap_setresgid(-1, egid, -1);
 871 }
 872 #endif
 873
 874 #ifdef HAVE_SETREGID
 875 int setregid(gid_t rgid, gid_t egid)
 876 {
 877         if (!uid_wrapper_enabled()) {
 878                 return libc_setregid(rgid, egid);
 879         }
 880
 881         return uwrap_setresgid(rgid, egid, -1);
 882 }
 883 #endif
 884
 885 #ifdef HAVE_SETRESGID
 886 int setresgid(gid_t rgid, gid_t egid, gid_t sgid)
 887 {
 888         if (!uid_wrapper_enabled()) {
 889                 return libc_setresgid(rgid, egid, sgid);
 890         }
 891
 892         return uwrap_setresgid(rgid, egid, sgid);
 893 }
 894 #endif
 895
 896 /*
 897  * GETGID
 898  */
 899 static gid_t uwrap_getgid(void)
 900 {
 901         struct uwrap_thread *id = uwrap_tls_id;
 902         gid_t gid;
 903
 904         pthread_mutex_lock(&uwrap_id_mutex);
 905         gid = id->rgid;
 906         pthread_mutex_unlock(&uwrap_id_mutex);
 907
 908         return gid;
 909 }
 910
 911 gid_t getgid(void)
 912 {
 913         if (!uid_wrapper_enabled()) {
 914                 return libc_getgid();
 915         }
 916
 917         return uwrap_getgid();
 918 }
 919
 920 /*
 921  * GETEGID
 922  */
 923 static uid_t uwrap_getegid(void)
 924 {
 925         struct uwrap_thread *id = uwrap_tls_id;
 926         gid_t gid;
 927
 928         pthread_mutex_lock(&uwrap_id_mutex);
 929         gid = id->egid;
 930         pthread_mutex_unlock(&uwrap_id_mutex);
 931
 932         return gid;
 933 }
 934
 935 uid_t getegid(void)
 936 {
 937         if (!uid_wrapper_enabled()) {
 938                 return libc_getegid();
 939         }
 940
 941         return uwrap_getegid();
 942 }
 943
 944 static int uwrap_setgroups_thread(size_t size, const gid_t *list)
 945 {
 946         struct uwrap_thread *id = uwrap_tls_id;
 947         int rc = -1;
 948
 949         pthread_mutex_lock(&uwrap_id_mutex);
 950
 951         if (size > 0) {
 952                 gid_t *tmp;
 953
 954                 tmp = realloc(id->groups, sizeof(gid_t) * size);
 955                 if (tmp == NULL) {
 956                         errno = ENOMEM;
 957                         goto out;
 958                 }
 959                 id->groups = tmp;
 960
 961                 id->ngroups = size;
 962                 memcpy(id->groups, list, size * sizeof(gid_t));
 963         }
 964
 965         rc = 0;
 966 out:
 967         pthread_mutex_unlock(&uwrap_id_mutex);
 968
 969         return rc;
 970 }
 971
 972 static int uwrap_setgroups(size_t size, const gid_t *list)
 973 {
 974         struct uwrap_thread *id;
 975         int rc = -1;
 976
 977         pthread_mutex_lock(&uwrap_id_mutex);
 978
 979         if (size > 0) {
 980                 for (id = uwrap.ids; id; id = id->next) {
 981                         gid_t *tmp;
 982
 983                         tmp = realloc(id->groups, sizeof(gid_t) * size);
 984                         if (tmp == NULL) {
 985                                 errno = ENOMEM;
 986                                 goto out;
 987                         }
 988                         id->groups = tmp;
 989
 990                         id->ngroups = size;
 991                         memcpy(id->groups, list, size * sizeof(gid_t));
 992                 }
 993         }
 994
 995         rc = 0;
 996 out:
 997         pthread_mutex_unlock(&uwrap_id_mutex);
 998
 999         return rc;
1000 }
1001
1002 #ifdef HAVE_SETGROUPS_INT
1003 int setgroups(int size, const gid_t *list)
1004 #else
1005 int setgroups(size_t size, const gid_t *list)
1006 #endif
1007 {
1008         if (!uid_wrapper_enabled()) {
1009                 return libc_setgroups(size, list);
1010         }
1011
1012         return uwrap_setgroups(size, list);
1013 }
1014
1015 static int uwrap_getgroups(int size, gid_t *list)
1016 {
1017         struct uwrap_thread *id = uwrap_tls_id;
1018         int ngroups;
1019
1020         pthread_mutex_lock(&uwrap_id_mutex);
1021         ngroups = id->ngroups;
1022
1023         if (size > ngroups) {
1024                 size = ngroups;
1025         }
1026         if (size == 0) {
1027                 goto out;
1028         }
1029         if (size < ngroups) {
1030                 errno = EINVAL;
1031                 ngroups = -1;
1032         }
1033         memcpy(list, id->groups, size * sizeof(gid_t));
1034
1035 out:
1036         pthread_mutex_unlock(&uwrap_id_mutex);
1037
1038         return ngroups;
1039 }
1040
1041 int getgroups(int size, gid_t *list)
1042 {
1043         if (!uid_wrapper_enabled()) {
1044                 return libc_getgroups(size, list);
1045         }
1046
1047         return uwrap_getgroups(size, list);
1048 }
1049
1050 #if (defined(HAVE_SYS_SYSCALL_H) || defined(HAVE_SYSCALL_H)) \
1051     && (defined(SYS_setreuid) || defined(SYS_setreuid32))
1052 static long int uwrap_syscall (long int sysno, va_list vp)
1053 {
1054         long int rc;
1055
1056         switch (sysno) {
1057                 /* gid */
1058                 case SYS_getgid:
1059 #ifdef HAVE_LINUX_32BIT_SYSCALLS
1060                 case SYS_getgid32:
1061 #endif
1062                         {
1063                                 rc = uwrap_getgid();
1064                         }
1065                         break;
1066 #ifdef SYS_getegid
1067                 case SYS_getegid:
1068 #ifdef HAVE_LINUX_32BIT_SYSCALLS
1069                 case SYS_getegid32:
1070 #endif
1071                         {
1072                                 rc = uwrap_getegid();
1073                         }
1074                         break;
1075 #endif /* SYS_getegid */
1076                 case SYS_setgid:
1077 #ifdef HAVE_LINUX_32BIT_SYSCALLS
1078                 case SYS_setgid32:
1079 #endif
1080                         {
1081                                 gid_t gid = (gid_t) va_arg(vp, int);
1082
1083                                 rc = uwrap_setresgid_thread(gid, -1, -1);
1084                         }
1085                         break;
1086                 case SYS_setregid:
1087 #ifdef HAVE_LINUX_32BIT_SYSCALLS
1088                 case SYS_setregid32:
1089 #endif
1090                         {
1091                                 uid_t rgid = (uid_t) va_arg(vp, int);
1092                                 uid_t egid = (uid_t) va_arg(vp, int);
1093
1094                                 rc = uwrap_setresgid_thread(rgid, egid, -1);
1095                         }
1096                         break;
1097 #ifdef SYS_setresgid
1098                 case SYS_setresgid:
1099 #ifdef HAVE_LINUX_32BIT_SYSCALLS
1100                 case SYS_setresgid32:
1101 #endif
1102                         {
1103                                 uid_t rgid = (uid_t) va_arg(vp, int);
1104                                 uid_t egid = (uid_t) va_arg(vp, int);
1105                                 uid_t sgid = (uid_t) va_arg(vp, int);
1106
1107                                 rc = uwrap_setresgid_thread(rgid, egid, sgid);
1108                         }
1109                         break;
1110 #endif /* SYS_setresgid */
1111
1112                 /* uid */
1113                 case SYS_getuid:
1114 #ifdef HAVE_LINUX_32BIT_SYSCALLS
1115                 case SYS_getuid32:
1116 #endif
1117                         {
1118                                 rc = uwrap_getuid();
1119                         }
1120                         break;
1121 #ifdef SYS_geteuid
1122                 case SYS_geteuid:
1123 #ifdef HAVE_LINUX_32BIT_SYSCALLS
1124                 case SYS_geteuid32:
1125 #endif
1126                         {
1127                                 rc = uwrap_geteuid();
1128                         }
1129                         break;
1130 #endif /* SYS_geteuid */
1131                 case SYS_setuid:
1132 #ifdef HAVE_LINUX_32BIT_SYSCALLS
1133                 case SYS_setuid32:
1134 #endif
1135                         {
1136                                 uid_t uid = (uid_t) va_arg(vp, int);
1137
1138                                 rc = uwrap_setresuid_thread(uid, -1, -1);
1139                         }
1140                         break;
1141                 case SYS_setreuid:
1142 #ifdef HAVE_LINUX_32BIT_SYSCALLS
1143                 case SYS_setreuid32:
1144 #endif
1145                         {
1146                                 uid_t ruid = (uid_t) va_arg(vp, int);
1147                                 uid_t euid = (uid_t) va_arg(vp, int);
1148
1149                                 rc = uwrap_setresuid_thread(ruid, euid, -1);
1150                         }
1151                         break;
1152 #ifdef SYS_setresuid
1153                 case SYS_setresuid:
1154 #ifdef HAVE_LINUX_32BIT_SYSCALLS
1155                 case SYS_setresuid32:
1156 #endif
1157                         {
1158                                 uid_t ruid = (uid_t) va_arg(vp, int);
1159                                 uid_t euid = (uid_t) va_arg(vp, int);
1160                                 uid_t suid = (uid_t) va_arg(vp, int);
1161
1162                                 rc = uwrap_setresuid_thread(ruid, euid, suid);
1163                         }
1164                         break;
1165 #endif /* SYS_setresuid */
1166
1167                 /* groups */
1168                 case SYS_setgroups:
1169 #ifdef HAVE_LINUX_32BIT_SYSCALLS
1170                 case SYS_setgroups32:
1171 #endif
1172                         {
1173                                 size_t size = (size_t) va_arg(vp, size_t);
1174                                 gid_t *list = (gid_t *) va_arg(vp, int *);
1175
1176                                 rc = uwrap_setgroups_thread(size, list);
1177                         }
1178                         break;
1179                 default:
1180                         UWRAP_LOG(UWRAP_LOG_DEBUG,
1181                                   "UID_WRAPPER calling non-wrapped syscall %lu\n",
1182                                   sysno);
1183
1184                         rc = libc_vsyscall(sysno, vp);
1185                         break;
1186         }
1187
1188         return rc;
1189 }
1190
1191 #ifdef HAVE_SYSCALL
1192 #ifdef HAVE_SYSCALL_INT
1193 int syscall (int sysno, ...)
1194 #else
1195 long int syscall (long int sysno, ...)
1196 #endif
1197 {
1198 #ifdef HAVE_SYSCALL_INT
1199         int rc;
1200 #else
1201         long int rc;
1202 #endif
1203         va_list va;
1204
1205         va_start(va, sysno);
1206
1207         if (!uid_wrapper_enabled()) {
1208                 rc = libc_vsyscall(sysno, va);
1209                 va_end(va);
1210                 return rc;
1211         }
1212
1213         rc = uwrap_syscall(sysno, va);
1214         va_end(va);
1215
1216         return rc;
1217 }
1218 #endif /* HAVE_SYSCALL */
1219 #endif /* HAVE_SYS_SYSCALL_H || HAVE_SYSCALL_H */
1220
1221 /****************************
1222  * DESTRUCTOR
1223  ***************************/
1224
1225 /*
1226  * This function is called when the library is unloaded and makes sure that
1227  * resources are freed.
1228  */
1229 void uwrap_destructor(void)
1230 {
1231         struct uwrap_thread *u = uwrap.ids;
1232
1233         pthread_mutex_lock(&uwrap_id_mutex);
1234         while (u != NULL) {
1235                 UWRAP_DLIST_REMOVE(uwrap.ids, u);
1236
1237                 SAFE_FREE(u->groups);
1238                 SAFE_FREE(u);
1239
1240                 u = uwrap.ids;
1241         }
1242         pthread_mutex_unlock(&uwrap_id_mutex);
1243
1244         if (uwrap.libc.handle != NULL) {
1245                 dlclose(uwrap.libc.handle);
1246         }
1247 }