2 Unix SMB/CIFS implementation.
4 Copyright (C) Tim Potter 2000
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 #include "system/passwd.h"
22 #include "smbd/smbd.h"
23 #include "smbd/globals.h"
24 #include "libcli/security/security_token.h"
26 #include "smbprofile.h"
27 #include "../lib/util/setid.h"
29 extern struct current_user current_user
;
31 /****************************************************************************
32 Are two UNIX tokens equal ?
33 ****************************************************************************/
35 bool unix_token_equal(const struct security_unix_token
*t1
, const struct security_unix_token
*t2
)
37 if (t1
->uid
!= t2
->uid
|| t1
->gid
!= t2
->gid
||
38 t1
->ngroups
!= t2
->ngroups
) {
41 if (memcmp(t1
->groups
, t2
->groups
,
42 t1
->ngroups
*sizeof(gid_t
)) != 0) {
48 /****************************************************************************
49 Become the specified uid.
50 ****************************************************************************/
52 static bool become_uid(uid_t uid
)
54 /* Check for dodgy uid values */
56 if (uid
== (uid_t
)-1 ||
57 ((sizeof(uid_t
) == 2) && (uid
== (uid_t
)65535))) {
58 if (!become_uid_done
) {
59 DEBUG(1,("WARNING: using uid %d is a security risk\n",
61 become_uid_done
= true;
65 /* Set effective user id */
67 set_effective_uid(uid
);
72 /****************************************************************************
73 Become the specified gid.
74 ****************************************************************************/
76 static bool become_gid(gid_t gid
)
78 /* Check for dodgy gid values */
80 if (gid
== (gid_t
)-1 || ((sizeof(gid_t
) == 2) &&
81 (gid
== (gid_t
)65535))) {
82 if (!become_gid_done
) {
83 DEBUG(1,("WARNING: using gid %d is a security risk\n",
85 become_gid_done
= true;
89 /* Set effective group id */
91 set_effective_gid(gid
);
95 /****************************************************************************
96 Become the specified uid and gid.
97 ****************************************************************************/
99 static bool become_id(uid_t uid
, gid_t gid
)
101 return become_gid(gid
) && become_uid(uid
);
104 /****************************************************************************
105 Drop back to root privileges in order to change to another user.
106 ****************************************************************************/
108 static void gain_root(void)
110 if (non_root_mode()) {
114 if (geteuid() != 0) {
115 set_effective_uid(0);
117 if (geteuid() != 0) {
119 ("Warning: You appear to have a trapdoor "
124 if (getegid() != 0) {
125 set_effective_gid(0);
127 if (getegid() != 0) {
129 ("Warning: You appear to have a trapdoor "
135 /****************************************************************************
136 Get the list of current groups.
137 ****************************************************************************/
139 static int get_current_groups(gid_t gid
, uint32_t *p_ngroups
, gid_t
**p_groups
)
143 gid_t
*groups
= NULL
;
148 /* this looks a little strange, but is needed to cope with
149 systems that put the current egid in the group list
150 returned from getgroups() (tridge) */
152 set_effective_gid(gid
);
155 ngroups
= sys_getgroups(0, NULL
);
160 if((groups
= SMB_MALLOC_ARRAY(gid_t
, ngroups
+1)) == NULL
) {
161 DEBUG(0,("setup_groups malloc fail !\n"));
165 if ((ngroups
= sys_getgroups(ngroups
,groups
)) == -1) {
171 (*p_ngroups
) = ngroups
;
172 (*p_groups
) = groups
;
174 DEBUG( 4, ( "get_current_groups: user is in %u groups: ", ngroups
));
175 for (i
= 0; i
< ngroups
; i
++ ) {
176 DEBUG( 4, ( "%s%d", (i
? ", " : ""), (int)groups
[i
] ) );
178 DEBUG( 4, ( "\n" ) );
188 /****************************************************************************
189 Create a new security context on the stack. It is the same as the old
190 one. User changes are done using the set_sec_ctx() function.
191 ****************************************************************************/
193 bool push_sec_ctx(void)
195 struct sec_ctx
*ctx_p
;
197 START_PROFILE(push_sec_ctx
);
199 /* Check we don't overflow our stack */
201 if (sec_ctx_stack_ndx
== MAX_SEC_CTX_DEPTH
) {
202 DEBUG(0, ("Security context stack overflow!\n"));
203 smb_panic("Security context stack overflow!");
206 /* Store previous user context */
210 ctx_p
= &sec_ctx_stack
[sec_ctx_stack_ndx
];
212 ctx_p
->ut
.uid
= geteuid();
213 ctx_p
->ut
.gid
= getegid();
215 DEBUG(4, ("push_sec_ctx(%u, %u) : sec_ctx_stack_ndx = %d\n",
216 (unsigned int)ctx_p
->ut
.uid
, (unsigned int)ctx_p
->ut
.gid
, sec_ctx_stack_ndx
));
218 ctx_p
->token
= dup_nt_token(NULL
,
219 sec_ctx_stack
[sec_ctx_stack_ndx
-1].token
);
221 ctx_p
->ut
.ngroups
= sys_getgroups(0, NULL
);
223 if (ctx_p
->ut
.ngroups
!= 0) {
224 if (!(ctx_p
->ut
.groups
= SMB_MALLOC_ARRAY(gid_t
, ctx_p
->ut
.ngroups
))) {
225 DEBUG(0, ("Out of memory in push_sec_ctx()\n"));
226 TALLOC_FREE(ctx_p
->token
);
230 sys_getgroups(ctx_p
->ut
.ngroups
, ctx_p
->ut
.groups
);
232 ctx_p
->ut
.groups
= NULL
;
235 END_PROFILE(push_sec_ctx
);
240 /****************************************************************************
241 Change UNIX security context. Calls panic if not successful so no return value.
242 ****************************************************************************/
244 #ifndef HAVE_DARWIN_INITGROUPS
246 /* Normal credential switch path. */
248 static void set_unix_security_ctx(uid_t uid
, gid_t gid
, int ngroups
, gid_t
*groups
)
250 /* Start context switch */
252 #ifdef HAVE_SETGROUPS
253 if (sys_setgroups(gid
, ngroups
, groups
) != 0 && !non_root_mode()) {
254 smb_panic("sys_setgroups failed");
258 /* end context switch */
261 #else /* HAVE_DARWIN_INITGROUPS */
263 /* The Darwin groups implementation is a little unusual. The list of
264 * groups in the kernel credential is not exhaustive, but more like
265 * a cache. The full group list is held in userspace and checked
268 * This is an optional mechanism, and setgroups(2) opts out
269 * of it. That is, if you call setgroups, then the list of groups you
270 * set are the only groups that are ever checked. This is not what we
271 * want. We want to opt in to the dynamic resolution mechanism, so we
272 * need to specify the uid of the user whose group list (cache) we are
275 * The Darwin rules are:
276 * 1. Thou shalt setegid, initgroups and seteuid IN THAT ORDER
277 * 2. Thou shalt not pass more that NGROUPS_MAX to initgroups
278 * 3. Thou shalt leave the first entry in the groups list well alone
281 #include <sys/syscall.h>
283 static void set_unix_security_ctx(uid_t uid
, gid_t gid
, int ngroups
, gid_t
*groups
)
285 int max
= groups_max();
287 /* Start context switch */
293 if (syscall(SYS_initgroups
, (ngroups
> max
) ? max
: ngroups
,
294 groups
, uid
) == -1 && !non_root_mode()) {
295 DEBUG(0, ("WARNING: failed to set group list "
296 "(%d groups) for UID %d: %s\n",
297 ngroups
, uid
, strerror(errno
)));
298 smb_panic("sys_setgroups failed");
302 /* end context switch */
305 #endif /* HAVE_DARWIN_INITGROUPS */
307 /****************************************************************************
308 Set the current security context to a given user.
309 ****************************************************************************/
311 static void set_sec_ctx_internal(uid_t uid
, gid_t gid
,
312 int ngroups
, gid_t
*groups
,
313 const struct security_token
*token
)
315 struct sec_ctx
*ctx_p
= &sec_ctx_stack
[sec_ctx_stack_ndx
];
317 /* Set the security context */
319 DEBUG(4, ("setting sec ctx (%u, %u) - sec_ctx_stack_ndx = %d\n",
320 (unsigned int)uid
, (unsigned int)gid
, sec_ctx_stack_ndx
));
322 security_token_debug(DBGC_CLASS
, 5, token
);
323 debug_unix_user_token(DBGC_CLASS
, 5, uid
, gid
, ngroups
, groups
);
325 /* Change uid, gid and supplementary group list. */
326 set_unix_security_ctx(uid
, gid
, ngroups
, groups
);
328 ctx_p
->ut
.ngroups
= ngroups
;
330 SAFE_FREE(ctx_p
->ut
.groups
);
331 if (token
&& (token
== ctx_p
->token
)) {
332 smb_panic("DUPLICATE_TOKEN");
335 TALLOC_FREE(ctx_p
->token
);
338 ctx_p
->ut
.groups
= (gid_t
*)smb_xmemdup(groups
,
339 sizeof(gid_t
) * ngroups
);
341 ctx_p
->ut
.groups
= NULL
;
345 ctx_p
->token
= dup_nt_token(NULL
, token
);
347 smb_panic("dup_nt_token failed");
356 /* Update current_user stuff */
358 current_user
.ut
.uid
= uid
;
359 current_user
.ut
.gid
= gid
;
360 current_user
.ut
.ngroups
= ngroups
;
361 current_user
.ut
.groups
= groups
;
362 current_user
.nt_user_token
= ctx_p
->token
;
365 void set_sec_ctx(uid_t uid
, gid_t gid
, int ngroups
, gid_t
*groups
, const struct security_token
*token
)
367 START_PROFILE(set_sec_ctx
);
368 set_sec_ctx_internal(uid
, gid
, ngroups
, groups
, token
);
369 END_PROFILE(set_sec_ctx
);
372 /****************************************************************************
374 ****************************************************************************/
376 void set_root_sec_ctx(void)
378 /* May need to worry about supplementary groups at some stage */
380 START_PROFILE(set_root_sec_ctx
);
381 set_sec_ctx_internal(0, 0, 0, NULL
, NULL
);
382 END_PROFILE(set_root_sec_ctx
);
385 /****************************************************************************
386 Pop a security context from the stack.
387 ****************************************************************************/
389 bool pop_sec_ctx(void)
391 struct sec_ctx
*ctx_p
;
392 struct sec_ctx
*prev_ctx_p
;
394 START_PROFILE(pop_sec_ctx
);
396 /* Check for stack underflow */
398 if (sec_ctx_stack_ndx
== 0) {
399 DEBUG(0, ("Security context stack underflow!\n"));
400 smb_panic("Security context stack underflow!");
403 ctx_p
= &sec_ctx_stack
[sec_ctx_stack_ndx
];
405 /* Clear previous user info */
407 ctx_p
->ut
.uid
= (uid_t
)-1;
408 ctx_p
->ut
.gid
= (gid_t
)-1;
410 SAFE_FREE(ctx_p
->ut
.groups
);
411 ctx_p
->ut
.ngroups
= 0;
413 TALLOC_FREE(ctx_p
->token
);
415 /* Pop back previous user */
419 prev_ctx_p
= &sec_ctx_stack
[sec_ctx_stack_ndx
];
421 /* Change uid, gid and supplementary group list. */
422 set_unix_security_ctx(prev_ctx_p
->ut
.uid
,
424 prev_ctx_p
->ut
.ngroups
,
425 prev_ctx_p
->ut
.groups
);
427 /* Update current_user stuff */
429 current_user
.ut
.uid
= prev_ctx_p
->ut
.uid
;
430 current_user
.ut
.gid
= prev_ctx_p
->ut
.gid
;
431 current_user
.ut
.ngroups
= prev_ctx_p
->ut
.ngroups
;
432 current_user
.ut
.groups
= prev_ctx_p
->ut
.groups
;
433 current_user
.nt_user_token
= prev_ctx_p
->token
;
435 END_PROFILE(pop_sec_ctx
);
437 DEBUG(4, ("pop_sec_ctx (%u, %u) - sec_ctx_stack_ndx = %d\n",
438 (unsigned int)geteuid(), (unsigned int)getegid(), sec_ctx_stack_ndx
));
443 /* Initialise the security context system */
445 void init_sec_ctx(void)
448 struct sec_ctx
*ctx_p
;
450 /* Initialise security context stack */
452 memset(sec_ctx_stack
, 0, sizeof(struct sec_ctx
) * MAX_SEC_CTX_DEPTH
);
454 for (i
= 0; i
< MAX_SEC_CTX_DEPTH
; i
++) {
455 sec_ctx_stack
[i
].ut
.uid
= (uid_t
)-1;
456 sec_ctx_stack
[i
].ut
.gid
= (gid_t
)-1;
459 /* Initialise first level of stack. It is the current context */
460 ctx_p
= &sec_ctx_stack
[0];
462 ctx_p
->ut
.uid
= geteuid();
463 ctx_p
->ut
.gid
= getegid();
465 get_current_groups(ctx_p
->ut
.gid
, &ctx_p
->ut
.ngroups
, &ctx_p
->ut
.groups
);
467 ctx_p
->token
= NULL
; /* Maps to guest user. */
469 /* Initialise current_user global */
471 current_user
.ut
.uid
= ctx_p
->ut
.uid
;
472 current_user
.ut
.gid
= ctx_p
->ut
.gid
;
473 current_user
.ut
.ngroups
= ctx_p
->ut
.ngroups
;
474 current_user
.ut
.groups
= ctx_p
->ut
.groups
;
476 /* The conn and vuid are usually taken care of by other modules.
477 We initialise them here. */
479 current_user
.conn
= NULL
;
480 current_user
.vuid
= UID_FIELD_INVALID
;
481 current_user
.nt_user_token
= NULL
;
484 /*************************************************************
485 Called when we're inside a become_root() temporary escalation
486 of privileges and the nt_user_token is NULL. Return the last
487 active token on the context stack. We know there is at least
488 one valid non-NULL token on the stack so panic if we underflow.
489 *************************************************************/
491 const struct security_token
*sec_ctx_active_token(void)
493 int stack_index
= sec_ctx_stack_ndx
;
494 struct sec_ctx
*ctx_p
= &sec_ctx_stack
[stack_index
];
496 while (ctx_p
->token
== NULL
) {
498 if (stack_index
< 0) {
499 DEBUG(0, ("Security context active token "
500 "stack underflow!\n"));
501 smb_panic("Security context active token "
504 ctx_p
= &sec_ctx_stack
[stack_index
];