source3/smbd/sec_ctx.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    uid/user handling
   4    Copyright (C) Tim Potter 2000
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "smbd/smbd.h"
  22 #include "smbd/globals.h"
  23 #include "libcli/security/security_token.h"
  24 #include "auth.h"
  25 #include "smbprofile.h"
  26
  27 extern struct current_user current_user;
  28
  29 /****************************************************************************
  30  Are two UNIX tokens equal ?
  31 ****************************************************************************/
  32
  33 bool unix_token_equal(const struct security_unix_token *t1, const struct security_unix_token *t2)
  34 {
  35         if (t1->uid != t2->uid || t1->gid != t2->gid ||
  36                         t1->ngroups != t2->ngroups) {
  37                 return false;
  38         }
  39         if (memcmp(t1->groups, t2->groups,
  40                         t1->ngroups*sizeof(gid_t)) != 0) {
  41                 return false;
  42         }
  43         return true;
  44 }
  45
  46 /****************************************************************************
  47  Become the specified uid.
  48 ****************************************************************************/
  49
  50 static bool become_uid(uid_t uid)
  51 {
  52         /* Check for dodgy uid values */
  53
  54         if (uid == (uid_t)-1 ||
  55             ((sizeof(uid_t) == 2) && (uid == (uid_t)65535))) {
  56                 if (!become_uid_done) {
  57                         DEBUG(1,("WARNING: using uid %d is a security risk\n",
  58                                  (int)uid));
  59                         become_uid_done = true;
  60                 }
  61         }
  62
  63         /* Set effective user id */
  64
  65         set_effective_uid(uid);
  66
  67         DO_PROFILE_INC(uid_changes);
  68         return True;
  69 }
  70
  71 /****************************************************************************
  72  Become the specified gid.
  73 ****************************************************************************/
  74
  75 static bool become_gid(gid_t gid)
  76 {
  77         /* Check for dodgy gid values */
  78
  79         if (gid == (gid_t)-1 || ((sizeof(gid_t) == 2) &&
  80                                  (gid == (gid_t)65535))) {
  81                 if (!become_gid_done) {
  82                         DEBUG(1,("WARNING: using gid %d is a security risk\n",
  83                                  (int)gid));
  84                         become_gid_done = true;
  85                 }
  86         }
  87
  88         /* Set effective group id */
  89
  90         set_effective_gid(gid);
  91         return True;
  92 }
  93
  94 /****************************************************************************
  95  Become the specified uid and gid.
  96 ****************************************************************************/
  97
  98 static bool become_id(uid_t uid, gid_t gid)
  99 {
 100         return become_gid(gid) && become_uid(uid);
 101 }
 102
 103 /****************************************************************************
 104  Drop back to root privileges in order to change to another user.
 105 ****************************************************************************/
 106
 107 static void gain_root(void)
 108 {
 109         if (non_root_mode()) {
 110                 return;
 111         }
 112
 113         if (geteuid() != 0) {
 114                 set_effective_uid(0);
 115
 116                 if (geteuid() != 0) {
 117                         DEBUG(0,
 118                               ("Warning: You appear to have a trapdoor "
 119                                "uid system\n"));
 120                 }
 121         }
 122
 123         if (getegid() != 0) {
 124                 set_effective_gid(0);
 125
 126                 if (getegid() != 0) {
 127                         DEBUG(0,
 128                               ("Warning: You appear to have a trapdoor "
 129                                "gid system\n"));
 130                 }
 131         }
 132 }
 133
 134 /****************************************************************************
 135  Get the list of current groups.
 136 ****************************************************************************/
 137
 138 static int get_current_groups(gid_t gid, uint32_t *p_ngroups, gid_t **p_groups)
 139 {
 140         int i;
 141         gid_t grp;
 142         int ngroups;
 143         gid_t *groups = NULL;
 144
 145         (*p_ngroups) = 0;
 146         (*p_groups) = NULL;
 147
 148         /* this looks a little strange, but is needed to cope with
 149            systems that put the current egid in the group list
 150            returned from getgroups() (tridge) */
 151         save_re_gid();
 152         set_effective_gid(gid);
 153         setgid(gid);
 154
 155         ngroups = sys_getgroups(0,&grp);
 156         if (ngroups <= 0) {
 157                 goto fail;
 158         }
 159
 160         if((groups = SMB_MALLOC_ARRAY(gid_t, ngroups+1)) == NULL) {
 161                 DEBUG(0,("setup_groups malloc fail !\n"));
 162                 goto fail;
 163         }
 164
 165         if ((ngroups = sys_getgroups(ngroups,groups)) == -1) {
 166                 goto fail;
 167         }
 168
 169         restore_re_gid();
 170
 171         (*p_ngroups) = ngroups;
 172         (*p_groups) = groups;
 173
 174         DEBUG( 4, ( "get_current_groups: user is in %u groups: ", ngroups));
 175         for (i = 0; i < ngroups; i++ ) {
 176                 DEBUG( 4, ( "%s%d", (i ? ", " : ""), (int)groups[i] ) );
 177         }
 178         DEBUG( 4, ( "\n" ) );
 179
 180         return ngroups;
 181
 182 fail:
 183         SAFE_FREE(groups);
 184         restore_re_gid();
 185         return -1;
 186 }
 187
 188 /****************************************************************************
 189  Create a new security context on the stack.  It is the same as the old
 190  one.  User changes are done using the set_sec_ctx() function.
 191 ****************************************************************************/
 192
 193 bool push_sec_ctx(void)
 194 {
 195         struct sec_ctx *ctx_p;
 196
 197         /* Check we don't overflow our stack */
 198
 199         if (sec_ctx_stack_ndx == MAX_SEC_CTX_DEPTH) {
 200                 DEBUG(0, ("Security context stack overflow!\n"));
 201                 smb_panic("Security context stack overflow!");
 202         }
 203
 204         /* Store previous user context */
 205
 206         sec_ctx_stack_ndx++;
 207
 208         ctx_p = &sec_ctx_stack[sec_ctx_stack_ndx];
 209
 210         ctx_p->ut.uid = geteuid();
 211         ctx_p->ut.gid = getegid();
 212
 213         DEBUG(4, ("push_sec_ctx(%u, %u) : sec_ctx_stack_ndx = %d\n",
 214                   (unsigned int)ctx_p->ut.uid, (unsigned int)ctx_p->ut.gid, sec_ctx_stack_ndx ));
 215
 216         ctx_p->token = dup_nt_token(NULL,
 217                                     sec_ctx_stack[sec_ctx_stack_ndx-1].token);
 218
 219         ctx_p->ut.ngroups = sys_getgroups(0, NULL);
 220
 221         if (ctx_p->ut.ngroups != 0) {
 222                 if (!(ctx_p->ut.groups = SMB_MALLOC_ARRAY(gid_t, ctx_p->ut.ngroups))) {
 223                         DEBUG(0, ("Out of memory in push_sec_ctx()\n"));
 224                         TALLOC_FREE(ctx_p->token);
 225                         return False;
 226                 }
 227
 228                 sys_getgroups(ctx_p->ut.ngroups, ctx_p->ut.groups);
 229         } else {
 230                 ctx_p->ut.groups = NULL;
 231         }
 232
 233         return True;
 234 }
 235
 236 /****************************************************************************
 237  Change UNIX security context. Calls panic if not successful so no return value.
 238 ****************************************************************************/
 239
 240 #ifndef HAVE_DARWIN_INITGROUPS
 241
 242 /* Normal credential switch path. */
 243
 244 static void set_unix_security_ctx(uid_t uid, gid_t gid, int ngroups, gid_t *groups)
 245 {
 246         /* Start context switch */
 247         gain_root();
 248 #ifdef HAVE_SETGROUPS
 249         if (sys_setgroups(gid, ngroups, groups) != 0 && !non_root_mode()) {
 250                 smb_panic("sys_setgroups failed");
 251         }
 252 #endif
 253         become_id(uid, gid);
 254         /* end context switch */
 255 }
 256
 257 #else /* HAVE_DARWIN_INITGROUPS */
 258
 259 /* The Darwin groups implementation is a little unusual. The list of
 260 * groups in the kernel credential is not exhaustive, but more like
 261 * a cache. The full group list is held in userspace and checked
 262 * dynamically.
 263 *
 264 * This is an optional mechanism, and setgroups(2) opts out
 265 * of it. That is, if you call setgroups, then the list of groups you
 266 * set are the only groups that are ever checked. This is not what we
 267 * want. We want to opt in to the dynamic resolution mechanism, so we
 268 * need to specify the uid of the user whose group list (cache) we are
 269 * setting.
 270 *
 271 * The Darwin rules are:
 272 *  1. Thou shalt setegid, initgroups and seteuid IN THAT ORDER
 273 *  2. Thou shalt not pass more that NGROUPS_MAX to initgroups
 274 *  3. Thou shalt leave the first entry in the groups list well alone
 275 */
 276
 277 #include <sys/syscall.h>
 278
 279 static void set_unix_security_ctx(uid_t uid, gid_t gid, int ngroups, gid_t *groups)
 280 {
 281         int max = groups_max();
 282
 283         /* Start context switch */
 284         gain_root();
 285
 286         become_gid(gid);
 287
 288
 289         if (syscall(SYS_initgroups, (ngroups > max) ? max : ngroups,
 290                         groups, uid) == -1 && !non_root_mode()) {
 291                 DEBUG(0, ("WARNING: failed to set group list "
 292                         "(%d groups) for UID %ld: %s\n",
 293                         ngroups, uid, strerror(errno)));
 294                 smb_panic("sys_setgroups failed");
 295         }
 296
 297         become_uid(uid);
 298         /* end context switch */
 299 }
 300
 301 #endif /* HAVE_DARWIN_INITGROUPS */
 302
 303 /****************************************************************************
 304  Set the current security context to a given user.
 305 ****************************************************************************/
 306
 307 void set_sec_ctx(uid_t uid, gid_t gid, int ngroups, gid_t *groups, struct security_token *token)
 308 {
 309         struct sec_ctx *ctx_p = &sec_ctx_stack[sec_ctx_stack_ndx];
 310
 311         /* Set the security context */
 312
 313         DEBUG(4, ("setting sec ctx (%u, %u) - sec_ctx_stack_ndx = %d\n",
 314                 (unsigned int)uid, (unsigned int)gid, sec_ctx_stack_ndx));
 315
 316         security_token_debug(DBGC_CLASS, 5, token);
 317         debug_unix_user_token(DBGC_CLASS, 5, uid, gid, ngroups, groups);
 318
 319         /* Change uid, gid and supplementary group list. */
 320         set_unix_security_ctx(uid, gid, ngroups, groups);
 321
 322         ctx_p->ut.ngroups = ngroups;
 323
 324         SAFE_FREE(ctx_p->ut.groups);
 325         if (token && (token == ctx_p->token)) {
 326                 smb_panic("DUPLICATE_TOKEN");
 327         }
 328
 329         TALLOC_FREE(ctx_p->token);
 330
 331         if (ngroups) {
 332                 ctx_p->ut.groups = (gid_t *)memdup(groups,
 333                                                    sizeof(gid_t) * ngroups);
 334                 if (!ctx_p->ut.groups) {
 335                         smb_panic("memdup failed");
 336                 }
 337         } else {
 338                 ctx_p->ut.groups = NULL;
 339         }
 340
 341         if (token) {
 342                 ctx_p->token = dup_nt_token(NULL, token);
 343                 if (!ctx_p->token) {
 344                         smb_panic("dup_nt_token failed");
 345                 }
 346         } else {
 347                 ctx_p->token = NULL;
 348         }
 349
 350         ctx_p->ut.uid = uid;
 351         ctx_p->ut.gid = gid;
 352
 353         /* Update current_user stuff */
 354
 355         current_user.ut.uid = uid;
 356         current_user.ut.gid = gid;
 357         current_user.ut.ngroups = ngroups;
 358         current_user.ut.groups = groups;
 359         current_user.nt_user_token = ctx_p->token;
 360 }
 361
 362 /****************************************************************************
 363  Become root context.
 364 ****************************************************************************/
 365
 366 void set_root_sec_ctx(void)
 367 {
 368         /* May need to worry about supplementary groups at some stage */
 369
 370         set_sec_ctx(0, 0, 0, NULL, NULL);
 371 }
 372
 373 /****************************************************************************
 374  Pop a security context from the stack.
 375 ****************************************************************************/
 376
 377 bool pop_sec_ctx(void)
 378 {
 379         struct sec_ctx *ctx_p;
 380         struct sec_ctx *prev_ctx_p;
 381
 382         /* Check for stack underflow */
 383
 384         if (sec_ctx_stack_ndx == 0) {
 385                 DEBUG(0, ("Security context stack underflow!\n"));
 386                 smb_panic("Security context stack underflow!");
 387         }
 388
 389         ctx_p = &sec_ctx_stack[sec_ctx_stack_ndx];
 390
 391         /* Clear previous user info */
 392
 393         ctx_p->ut.uid = (uid_t)-1;
 394         ctx_p->ut.gid = (gid_t)-1;
 395
 396         SAFE_FREE(ctx_p->ut.groups);
 397         ctx_p->ut.ngroups = 0;
 398
 399         TALLOC_FREE(ctx_p->token);
 400
 401         /* Pop back previous user */
 402
 403         sec_ctx_stack_ndx--;
 404
 405         prev_ctx_p = &sec_ctx_stack[sec_ctx_stack_ndx];
 406
 407         /* Change uid, gid and supplementary group list. */
 408         set_unix_security_ctx(prev_ctx_p->ut.uid,
 409                         prev_ctx_p->ut.gid,
 410                         prev_ctx_p->ut.ngroups,
 411                         prev_ctx_p->ut.groups);
 412
 413         /* Update current_user stuff */
 414
 415         current_user.ut.uid = prev_ctx_p->ut.uid;
 416         current_user.ut.gid = prev_ctx_p->ut.gid;
 417         current_user.ut.ngroups = prev_ctx_p->ut.ngroups;
 418         current_user.ut.groups = prev_ctx_p->ut.groups;
 419         current_user.nt_user_token = prev_ctx_p->token;
 420
 421         DEBUG(4, ("pop_sec_ctx (%u, %u) - sec_ctx_stack_ndx = %d\n",
 422                 (unsigned int)geteuid(), (unsigned int)getegid(), sec_ctx_stack_ndx));
 423
 424         return True;
 425 }
 426
 427 /* Initialise the security context system */
 428
 429 void init_sec_ctx(void)
 430 {
 431         int i;
 432         struct sec_ctx *ctx_p;
 433
 434         /* Initialise security context stack */
 435
 436         memset(sec_ctx_stack, 0, sizeof(struct sec_ctx) * MAX_SEC_CTX_DEPTH);
 437
 438         for (i = 0; i < MAX_SEC_CTX_DEPTH; i++) {
 439                 sec_ctx_stack[i].ut.uid = (uid_t)-1;
 440                 sec_ctx_stack[i].ut.gid = (gid_t)-1;
 441         }
 442
 443         /* Initialise first level of stack.  It is the current context */
 444         ctx_p = &sec_ctx_stack[0];
 445
 446         ctx_p->ut.uid = geteuid();
 447         ctx_p->ut.gid = getegid();
 448
 449         get_current_groups(ctx_p->ut.gid, &ctx_p->ut.ngroups, &ctx_p->ut.groups);
 450
 451         ctx_p->token = NULL; /* Maps to guest user. */
 452
 453         /* Initialise current_user global */
 454
 455         current_user.ut.uid = ctx_p->ut.uid;
 456         current_user.ut.gid = ctx_p->ut.gid;
 457         current_user.ut.ngroups = ctx_p->ut.ngroups;
 458         current_user.ut.groups = ctx_p->ut.groups;
 459
 460         /* The conn and vuid are usually taken care of by other modules.
 461            We initialise them here. */
 462
 463         current_user.conn = NULL;
 464         current_user.vuid = UID_FIELD_INVALID;
 465         current_user.nt_user_token = NULL;
 466 }