source3/smbd/sec_ctx.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    uid/user handling
   4    Copyright (C) Tim Potter 2000
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "system/passwd.h"
  22 #include "smbd/smbd.h"
  23 #include "smbd/globals.h"
  24 #include "libcli/security/security_token.h"
  25 #include "auth.h"
  26 #include "smbprofile.h"
  27 #include "../lib/util/setid.h"
  28
  29 extern struct current_user current_user;
  30
  31 /****************************************************************************
  32  Are two UNIX tokens equal ?
  33 ****************************************************************************/
  34
  35 bool unix_token_equal(const struct security_unix_token *t1, const struct security_unix_token *t2)
  36 {
  37         if (t1->uid != t2->uid || t1->gid != t2->gid ||
  38                         t1->ngroups != t2->ngroups) {
  39                 return false;
  40         }
  41         if (memcmp(t1->groups, t2->groups,
  42                         t1->ngroups*sizeof(gid_t)) != 0) {
  43                 return false;
  44         }
  45         return true;
  46 }
  47
  48 /****************************************************************************
  49  Become the specified uid.
  50 ****************************************************************************/
  51
  52 static bool become_uid(uid_t uid)
  53 {
  54         /* Check for dodgy uid values */
  55
  56         if (uid == (uid_t)-1 ||
  57             ((sizeof(uid_t) == 2) && (uid == (uid_t)65535))) {
  58                 if (!become_uid_done) {
  59                         DEBUG(1,("WARNING: using uid %d is a security risk\n",
  60                                  (int)uid));
  61                         become_uid_done = true;
  62                 }
  63         }
  64
  65         /* Set effective user id */
  66
  67         set_effective_uid(uid);
  68
  69         return True;
  70 }
  71
  72 /****************************************************************************
  73  Become the specified gid.
  74 ****************************************************************************/
  75
  76 static bool become_gid(gid_t gid)
  77 {
  78         /* Check for dodgy gid values */
  79
  80         if (gid == (gid_t)-1 || ((sizeof(gid_t) == 2) &&
  81                                  (gid == (gid_t)65535))) {
  82                 if (!become_gid_done) {
  83                         DEBUG(1,("WARNING: using gid %d is a security risk\n",
  84                                  (int)gid));
  85                         become_gid_done = true;
  86                 }
  87         }
  88
  89         /* Set effective group id */
  90
  91         set_effective_gid(gid);
  92         return True;
  93 }
  94
  95 /****************************************************************************
  96  Become the specified uid and gid.
  97 ****************************************************************************/
  98
  99 static bool become_id(uid_t uid, gid_t gid)
 100 {
 101         return become_gid(gid) && become_uid(uid);
 102 }
 103
 104 /****************************************************************************
 105  Drop back to root privileges in order to change to another user.
 106 ****************************************************************************/
 107
 108 static void gain_root(void)
 109 {
 110         if (non_root_mode()) {
 111                 return;
 112         }
 113
 114         if (geteuid() != 0) {
 115                 set_effective_uid(0);
 116
 117                 if (geteuid() != 0) {
 118                         DEBUG(0,
 119                               ("Warning: You appear to have a trapdoor "
 120                                "uid system\n"));
 121                 }
 122         }
 123
 124         if (getegid() != 0) {
 125                 set_effective_gid(0);
 126
 127                 if (getegid() != 0) {
 128                         DEBUG(0,
 129                               ("Warning: You appear to have a trapdoor "
 130                                "gid system\n"));
 131                 }
 132         }
 133 }
 134
 135 /****************************************************************************
 136  Get the list of current groups.
 137 ****************************************************************************/
 138
 139 static int get_current_groups(gid_t gid, uint32_t *p_ngroups, gid_t **p_groups)
 140 {
 141         int i;
 142         int ngroups;
 143         gid_t *groups = NULL;
 144
 145         (*p_ngroups) = 0;
 146         (*p_groups) = NULL;
 147
 148         /* this looks a little strange, but is needed to cope with
 149            systems that put the current egid in the group list
 150            returned from getgroups() (tridge) */
 151         save_re_gid();
 152         set_effective_gid(gid);
 153         samba_setgid(gid);
 154
 155         ngroups = sys_getgroups(0, NULL);
 156         if (ngroups <= 0) {
 157                 goto fail;
 158         }
 159
 160         if((groups = SMB_MALLOC_ARRAY(gid_t, ngroups+1)) == NULL) {
 161                 DEBUG(0,("setup_groups malloc fail !\n"));
 162                 goto fail;
 163         }
 164
 165         if ((ngroups = sys_getgroups(ngroups,groups)) == -1) {
 166                 goto fail;
 167         }
 168
 169         restore_re_gid();
 170
 171         (*p_ngroups) = ngroups;
 172         (*p_groups) = groups;
 173
 174         DEBUG( 4, ( "get_current_groups: user is in %u groups: ", ngroups));
 175         for (i = 0; i < ngroups; i++ ) {
 176                 DEBUG( 4, ( "%s%d", (i ? ", " : ""), (int)groups[i] ) );
 177         }
 178         DEBUG( 4, ( "\n" ) );
 179
 180         return ngroups;
 181
 182 fail:
 183         SAFE_FREE(groups);
 184         restore_re_gid();
 185         return -1;
 186 }
 187
 188 /****************************************************************************
 189  Create a new security context on the stack.  It is the same as the old
 190  one.  User changes are done using the set_sec_ctx() function.
 191 ****************************************************************************/
 192
 193 bool push_sec_ctx(void)
 194 {
 195         struct sec_ctx *ctx_p;
 196
 197         START_PROFILE(push_sec_ctx);
 198
 199         /* Check we don't overflow our stack */
 200
 201         if (sec_ctx_stack_ndx == MAX_SEC_CTX_DEPTH) {
 202                 DEBUG(0, ("Security context stack overflow!\n"));
 203                 smb_panic("Security context stack overflow!");
 204         }
 205
 206         /* Store previous user context */
 207
 208         sec_ctx_stack_ndx++;
 209
 210         ctx_p = &sec_ctx_stack[sec_ctx_stack_ndx];
 211
 212         ctx_p->ut.uid = geteuid();
 213         ctx_p->ut.gid = getegid();
 214
 215         DEBUG(4, ("push_sec_ctx(%u, %u) : sec_ctx_stack_ndx = %d\n",
 216                   (unsigned int)ctx_p->ut.uid, (unsigned int)ctx_p->ut.gid, sec_ctx_stack_ndx ));
 217
 218         ctx_p->token = dup_nt_token(NULL,
 219                                     sec_ctx_stack[sec_ctx_stack_ndx-1].token);
 220
 221         ctx_p->ut.ngroups = sys_getgroups(0, NULL);
 222
 223         if (ctx_p->ut.ngroups != 0) {
 224                 if (!(ctx_p->ut.groups = SMB_MALLOC_ARRAY(gid_t, ctx_p->ut.ngroups))) {
 225                         DEBUG(0, ("Out of memory in push_sec_ctx()\n"));
 226                         TALLOC_FREE(ctx_p->token);
 227                         return False;
 228                 }
 229
 230                 sys_getgroups(ctx_p->ut.ngroups, ctx_p->ut.groups);
 231         } else {
 232                 ctx_p->ut.groups = NULL;
 233         }
 234
 235         END_PROFILE(push_sec_ctx);
 236
 237         return True;
 238 }
 239
 240 /****************************************************************************
 241  Change UNIX security context. Calls panic if not successful so no return value.
 242 ****************************************************************************/
 243
 244 #ifndef HAVE_DARWIN_INITGROUPS
 245
 246 /* Normal credential switch path. */
 247
 248 static void set_unix_security_ctx(uid_t uid, gid_t gid, int ngroups, gid_t *groups)
 249 {
 250         /* Start context switch */
 251         gain_root();
 252 #ifdef HAVE_SETGROUPS
 253         if (sys_setgroups(gid, ngroups, groups) != 0 && !non_root_mode()) {
 254                 smb_panic("sys_setgroups failed");
 255         }
 256 #endif
 257         become_id(uid, gid);
 258         /* end context switch */
 259 }
 260
 261 #else /* HAVE_DARWIN_INITGROUPS */
 262
 263 /* The Darwin groups implementation is a little unusual. The list of
 264 * groups in the kernel credential is not exhaustive, but more like
 265 * a cache. The full group list is held in userspace and checked
 266 * dynamically.
 267 *
 268 * This is an optional mechanism, and setgroups(2) opts out
 269 * of it. That is, if you call setgroups, then the list of groups you
 270 * set are the only groups that are ever checked. This is not what we
 271 * want. We want to opt in to the dynamic resolution mechanism, so we
 272 * need to specify the uid of the user whose group list (cache) we are
 273 * setting.
 274 *
 275 * The Darwin rules are:
 276 *  1. Thou shalt setegid, initgroups and seteuid IN THAT ORDER
 277 *  2. Thou shalt not pass more that NGROUPS_MAX to initgroups
 278 *  3. Thou shalt leave the first entry in the groups list well alone
 279 */
 280
 281 #include <sys/syscall.h>
 282
 283 static void set_unix_security_ctx(uid_t uid, gid_t gid, int ngroups, gid_t *groups)
 284 {
 285         int max = groups_max();
 286
 287         /* Start context switch */
 288         gain_root();
 289
 290         become_gid(gid);
 291
 292
 293         if (syscall(SYS_initgroups, (ngroups > max) ? max : ngroups,
 294                         groups, uid) == -1 && !non_root_mode()) {
 295                 DEBUG(0, ("WARNING: failed to set group list "
 296                         "(%d groups) for UID %d: %s\n",
 297                         ngroups, uid, strerror(errno)));
 298                 smb_panic("sys_setgroups failed");
 299         }
 300
 301         become_uid(uid);
 302         /* end context switch */
 303 }
 304
 305 #endif /* HAVE_DARWIN_INITGROUPS */
 306
 307 /****************************************************************************
 308  Set the current security context to a given user.
 309 ****************************************************************************/
 310
 311 static void set_sec_ctx_internal(uid_t uid, gid_t gid,
 312                                  int ngroups, gid_t *groups,
 313                                  const struct security_token *token)
 314 {
 315         struct sec_ctx *ctx_p = &sec_ctx_stack[sec_ctx_stack_ndx];
 316
 317         /* Set the security context */
 318
 319         DEBUG(4, ("setting sec ctx (%u, %u) - sec_ctx_stack_ndx = %d\n",
 320                 (unsigned int)uid, (unsigned int)gid, sec_ctx_stack_ndx));
 321
 322         security_token_debug(DBGC_CLASS, 5, token);
 323         debug_unix_user_token(DBGC_CLASS, 5, uid, gid, ngroups, groups);
 324
 325         /* Change uid, gid and supplementary group list. */
 326         set_unix_security_ctx(uid, gid, ngroups, groups);
 327
 328         ctx_p->ut.ngroups = ngroups;
 329
 330         SAFE_FREE(ctx_p->ut.groups);
 331         if (token && (token == ctx_p->token)) {
 332                 smb_panic("DUPLICATE_TOKEN");
 333         }
 334
 335         TALLOC_FREE(ctx_p->token);
 336
 337         if (ngroups) {
 338                 ctx_p->ut.groups = (gid_t *)smb_xmemdup(groups,
 339                                                         sizeof(gid_t) * ngroups);
 340         } else {
 341                 ctx_p->ut.groups = NULL;
 342         }
 343
 344         if (token) {
 345                 ctx_p->token = dup_nt_token(NULL, token);
 346                 if (!ctx_p->token) {
 347                         smb_panic("dup_nt_token failed");
 348                 }
 349         } else {
 350                 ctx_p->token = NULL;
 351         }
 352
 353         ctx_p->ut.uid = uid;
 354         ctx_p->ut.gid = gid;
 355
 356         /* Update current_user stuff */
 357
 358         current_user.ut.uid = uid;
 359         current_user.ut.gid = gid;
 360         current_user.ut.ngroups = ngroups;
 361         current_user.ut.groups = groups;
 362         current_user.nt_user_token = ctx_p->token;
 363 }
 364
 365 void set_sec_ctx(uid_t uid, gid_t gid, int ngroups, gid_t *groups, const struct security_token *token)
 366 {
 367         START_PROFILE(set_sec_ctx);
 368         set_sec_ctx_internal(uid, gid, ngroups, groups, token);
 369         END_PROFILE(set_sec_ctx);
 370 }
 371
 372 /****************************************************************************
 373  Become root context.
 374 ****************************************************************************/
 375
 376 void set_root_sec_ctx(void)
 377 {
 378         /* May need to worry about supplementary groups at some stage */
 379
 380         START_PROFILE(set_root_sec_ctx);
 381         set_sec_ctx_internal(0, 0, 0, NULL, NULL);
 382         END_PROFILE(set_root_sec_ctx);
 383 }
 384
 385 /****************************************************************************
 386  Pop a security context from the stack.
 387 ****************************************************************************/
 388
 389 bool pop_sec_ctx(void)
 390 {
 391         struct sec_ctx *ctx_p;
 392         struct sec_ctx *prev_ctx_p;
 393
 394         START_PROFILE(pop_sec_ctx);
 395
 396         /* Check for stack underflow */
 397
 398         if (sec_ctx_stack_ndx == 0) {
 399                 DEBUG(0, ("Security context stack underflow!\n"));
 400                 smb_panic("Security context stack underflow!");
 401         }
 402
 403         ctx_p = &sec_ctx_stack[sec_ctx_stack_ndx];
 404
 405         /* Clear previous user info */
 406
 407         ctx_p->ut.uid = (uid_t)-1;
 408         ctx_p->ut.gid = (gid_t)-1;
 409
 410         SAFE_FREE(ctx_p->ut.groups);
 411         ctx_p->ut.ngroups = 0;
 412
 413         TALLOC_FREE(ctx_p->token);
 414
 415         /* Pop back previous user */
 416
 417         sec_ctx_stack_ndx--;
 418
 419         prev_ctx_p = &sec_ctx_stack[sec_ctx_stack_ndx];
 420
 421         /* Change uid, gid and supplementary group list. */
 422         set_unix_security_ctx(prev_ctx_p->ut.uid,
 423                         prev_ctx_p->ut.gid,
 424                         prev_ctx_p->ut.ngroups,
 425                         prev_ctx_p->ut.groups);
 426
 427         /* Update current_user stuff */
 428
 429         current_user.ut.uid = prev_ctx_p->ut.uid;
 430         current_user.ut.gid = prev_ctx_p->ut.gid;
 431         current_user.ut.ngroups = prev_ctx_p->ut.ngroups;
 432         current_user.ut.groups = prev_ctx_p->ut.groups;
 433         current_user.nt_user_token = prev_ctx_p->token;
 434
 435         END_PROFILE(pop_sec_ctx);
 436
 437         DEBUG(4, ("pop_sec_ctx (%u, %u) - sec_ctx_stack_ndx = %d\n",
 438                 (unsigned int)geteuid(), (unsigned int)getegid(), sec_ctx_stack_ndx));
 439
 440         return True;
 441 }
 442
 443 /* Initialise the security context system */
 444
 445 void init_sec_ctx(void)
 446 {
 447         int i;
 448         struct sec_ctx *ctx_p;
 449
 450         /* Initialise security context stack */
 451
 452         memset(sec_ctx_stack, 0, sizeof(struct sec_ctx) * MAX_SEC_CTX_DEPTH);
 453
 454         for (i = 0; i < MAX_SEC_CTX_DEPTH; i++) {
 455                 sec_ctx_stack[i].ut.uid = (uid_t)-1;
 456                 sec_ctx_stack[i].ut.gid = (gid_t)-1;
 457         }
 458
 459         /* Initialise first level of stack.  It is the current context */
 460         ctx_p = &sec_ctx_stack[0];
 461
 462         ctx_p->ut.uid = geteuid();
 463         ctx_p->ut.gid = getegid();
 464
 465         get_current_groups(ctx_p->ut.gid, &ctx_p->ut.ngroups, &ctx_p->ut.groups);
 466
 467         ctx_p->token = NULL; /* Maps to guest user. */
 468
 469         /* Initialise current_user global */
 470
 471         current_user.ut.uid = ctx_p->ut.uid;
 472         current_user.ut.gid = ctx_p->ut.gid;
 473         current_user.ut.ngroups = ctx_p->ut.ngroups;
 474         current_user.ut.groups = ctx_p->ut.groups;
 475
 476         /* The conn and vuid are usually taken care of by other modules.
 477            We initialise them here. */
 478
 479         current_user.conn = NULL;
 480         current_user.vuid = UID_FIELD_INVALID;
 481         current_user.nt_user_token = NULL;
 482 }
 483
 484 /*************************************************************
 485  Called when we're inside a become_root() temporary escalation
 486  of privileges and the nt_user_token is NULL. Return the last
 487  active token on the context stack. We know there is at least
 488  one valid non-NULL token on the stack so panic if we underflow.
 489 *************************************************************/
 490
 491 const struct security_token *sec_ctx_active_token(void)
 492 {
 493         int stack_index = sec_ctx_stack_ndx;
 494         struct sec_ctx *ctx_p = &sec_ctx_stack[stack_index];
 495
 496         while (ctx_p->token == NULL) {
 497                 stack_index--;
 498                 if (stack_index < 0) {
 499                         DEBUG(0, ("Security context active token "
 500                                   "stack underflow!\n"));
 501                         smb_panic("Security context active token "
 502                                   "stack underflow!");
 503                 }
 504                 ctx_p = &sec_ctx_stack[stack_index];
 505         }
 506         return ctx_p->token;
 507 }