source/lib/smbrun.c

   1 /*
   2    Unix SMB/Netbios implementation.
   3    Version 1.9.
   4    run a command as a specified user
   5    Copyright (C) Andrew Tridgell 1992-1998
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 2 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program; if not, write to the Free Software
  19    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  20 */
  21
  22 #include "includes.h"
  23
  24 /* need to move this from here!! need some sleep ... */
  25 struct current_user current_user;
  26
  27 extern int DEBUGLEVEL;
  28
  29 /****************************************************************************
  30 This is a utility function of smbrun(). It must be called only from
  31 the child as it may leave the caller in a privilaged state.
  32 ****************************************************************************/
  33 static BOOL setup_stdout_file(char *outfile,BOOL shared)
  34 {
  35   int fd;
  36   struct stat st;
  37   mode_t mode = S_IWUSR|S_IRUSR|S_IRGRP|S_IROTH;
  38   int flags = O_RDWR|O_CREAT|O_TRUNC|O_EXCL;
  39
  40   close(1);
  41
  42   if (shared) {
  43           /* become root - unprivilaged users can't delete these files */
  44 #ifdef HAVE_SETRESUID
  45           setresgid(0,0,0);
  46           setresuid(0,0,0);
  47 #else
  48           setuid(0);
  49           seteuid(0);
  50 #endif
  51   }
  52
  53   if(stat(outfile, &st) == 0) {
  54     /* Check we're not deleting a device file. */
  55     if(st.st_mode & S_IFREG)
  56       unlink(outfile);
  57     else
  58       flags = O_RDWR;
  59   }
  60   /* now create the file */
  61   fd = open(outfile,flags,mode);
  62
  63   if (fd == -1) return False;
  64
  65   if (fd != 1) {
  66     if (dup2(fd,1) != 0) {
  67       DEBUG(2,("Failed to create stdout file descriptor\n"));
  68       close(fd);
  69       return False;
  70     }
  71     close(fd);
  72   }
  73   return True;
  74 }
  75
  76
  77 /****************************************************************************
  78 run a command being careful about uid/gid handling and putting the output in
  79 outfile (or discard it if outfile is NULL).
  80
  81 if shared is True then ensure the file will be writeable by all users
  82 but created such that its owned by root. This overcomes a security hole.
  83
  84 if shared is not set then open the file with O_EXCL set
  85 ****************************************************************************/
  86 int smbrun(char *cmd,char *outfile,BOOL shared)
  87 {
  88         extern struct current_user current_user;
  89         int fd,pid;
  90         int uid = current_user.uid;
  91         int gid = current_user.gid;
  92
  93 #ifndef HAVE_EXECL
  94         int ret;
  95         pstring syscmd;
  96         char *path = lp_smbrun();
  97
  98         /* in the old method we use system() to execute smbrun which then
  99            executes the command (using system() again!). This involves lots
 100            of shell launches and is very slow. It also suffers from a
 101            potential security hole */
 102         if (!file_exist(path,NULL)) {
 103                 DEBUG(0,("SMBRUN ERROR: Can't find %s. Installation problem?\n",path));
 104                 return(1);
 105         }
 106
 107         slprintf(syscmd,sizeof(syscmd)-1,"%s %d %d \"(%s 2>&1) > %s\"",
 108                  path,uid,gid,cmd,
 109                  outfile?outfile:"/dev/null");
 110
 111         DEBUG(5,("smbrun - running %s ",syscmd));
 112         ret = system(syscmd);
 113         DEBUG(5,("gave %d\n",ret));
 114         return(ret);
 115 #else
 116         /* in this newer method we will exec /bin/sh with the correct
 117            arguments, after first setting stdout to point at the file */
 118
 119         if ((pid=fork())) {
 120                 int status=0;
 121                 /* the parent just waits for the child to exit */
 122                 if (sys_waitpid(pid,&status,0) != pid) {
 123                         DEBUG(2,("waitpid(%d) : %s\n",pid,strerror(errno)));
 124                         return -1;
 125                 }
 126                 return status;
 127         }
 128
 129
 130         /* we are in the child. we exec /bin/sh to do the work for us. we
 131            don't directly exec the command we want because it may be a
 132            pipeline or anything else the config file specifies */
 133
 134         /* point our stdout at the file we want output to go into */
 135         if (outfile && !setup_stdout_file(outfile,shared)) {
 136                 exit(80);
 137         }
 138
 139         /* now completely lose our privilages. This is a fairly paranoid
 140            way of doing it, but it does work on all systems that I know of */
 141 #ifdef HAVE_SETRESUID
 142         setresgid(0,0,0);
 143         setresuid(0,0,0);
 144         setresgid(gid,gid,gid);
 145         setresuid(uid,uid,uid);
 146 #else
 147         setuid(0);
 148         seteuid(0);
 149         setgid(gid);
 150         setegid(gid);
 151         setuid(uid);
 152         seteuid(uid);
 153 #endif
 154
 155         if (getuid() != uid || geteuid() != uid ||
 156             getgid() != gid || getegid() != gid) {
 157                 /* we failed to lose our privilages - do not execute
 158                    the command */
 159                 exit(81); /* we can't print stuff at this stage,
 160                              instead use exit codes for debugging */
 161         }
 162
 163         /* close all other file descriptors, leaving only 0, 1 and 2. 0 and
 164            2 point to /dev/null from the startup code */
 165         for (fd=3;fd<256;fd++) close(fd);
 166
 167         execl("/bin/sh","sh","-c",cmd,NULL);
 168
 169         /* not reached */
 170         exit(82);
 171 #endif
 172         return 1;
 173 }