libexec/rexecd/rexecd.c

   1 /*      $NetBSD: rexecd.c,v 1.25 2007/12/15 19:44:46 perry Exp $        */
   2
   3 /*
   4  * Copyright (c) 1983, 1993
   5  *      The Regents of the University of California.  All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  * 3. Neither the name of the University nor the names of its contributors
  16  *    may be used to endorse or promote products derived from this software
  17  *    without specific prior written permission.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  29  * SUCH DAMAGE.
  30  */
  31
  32 #include <sys/cdefs.h>
  33 #ifndef lint
  34 __COPYRIGHT("@(#) Copyright (c) 1983, 1993\
  35  The Regents of the University of California.  All rights reserved.");
  36 #if 0
  37 static char sccsid[] = "from: @(#)rexecd.c      8.1 (Berkeley) 6/4/93";
  38 #else
  39 __RCSID("$NetBSD: rexecd.c,v 1.25 2007/12/15 19:44:46 perry Exp $");
  40 #endif
  41 #endif /* not lint */
  42
  43 #include <sys/ioctl.h>
  44 #include <sys/param.h>
  45 #include <sys/socket.h>
  46 #include <sys/syslog.h>
  47 #include <sys/time.h>
  48
  49 #include <netinet/in.h>
  50
  51 #include <err.h>
  52 #include <errno.h>
  53 #include <netdb.h>
  54 #include <paths.h>
  55 #include <poll.h>
  56 #include <pwd.h>
  57 #include <signal.h>
  58 #include <stdarg.h>
  59 #include <stdio.h>
  60 #include <stdlib.h>
  61 #include <string.h>
  62 #include <unistd.h>
  63
  64 #ifdef USE_PAM
  65 #include <security/pam_appl.h>
  66 #include <security/openpam.h>
  67 #endif
  68
  69 int main(int, char *[]);
  70 static void rexecd_errx(int, const char *, ...)
  71      __attribute__((__noreturn__, __format__(__printf__, 2, 3)));
  72 static void doit(struct sockaddr *) __dead;
  73 static void getstr(char *, int, const char *);
  74 static void usage(void) __dead;
  75
  76 #ifdef USE_PAM
  77 static pam_handle_t *pamh;
  78 static struct pam_conv pamc = {
  79         openpam_nullconv,
  80         NULL
  81 };
  82 static int pam_flags = PAM_SILENT|PAM_DISALLOW_NULL_AUTHTOK;
  83 static int pam_err;
  84 #define pam_ok(err) ((pam_err = (err)) == PAM_SUCCESS)
  85 #endif
  86
  87 extern char     **environ;
  88 static int      dolog;
  89 #ifndef USE_PAM
  90 static char     username[32 + 1] = "USER=";
  91 static char     logname[32 + 3 + 1] = "LOGNAME=";
  92 static char     homedir[PATH_MAX + 1] = "HOME=";
  93 static char     shell[PATH_MAX + 1] = "SHELL=";
  94 static char     path[sizeof(_PATH_DEFPATH) + sizeof("PATH=")] = "PATH=";
  95 static char     *envinit[] = { homedir, shell, path, username, logname, 0 };
  96 #endif
  97
  98 /*
  99  * remote execute server:
 100  *      username\0
 101  *      password\0
 102  *      command\0
 103  *      data
 104  */
 105 int
 106 main(int argc, char *argv[])
 107 {
 108         struct sockaddr_storage from;
 109         socklen_t fromlen;
 110         int ch;
 111
 112         while ((ch = getopt(argc, argv, "l")) != -1)
 113                 switch (ch) {
 114                 case 'l':
 115                         dolog = 1;
 116                         openlog("rexecd", LOG_PID, LOG_DAEMON);
 117                         break;
 118                 default:
 119                         usage();
 120                 }
 121
 122         fromlen = sizeof(from);
 123         if (getpeername(STDIN_FILENO, (struct sockaddr *)&from, &fromlen) < 0)
 124                 err(EXIT_FAILURE, "getpeername");
 125
 126         if (((struct sockaddr *)&from)->sa_family == AF_INET6 &&
 127             IN6_IS_ADDR_V4MAPPED(&((struct sockaddr_in6 *)&from)->sin6_addr)) {
 128                 char hbuf[NI_MAXHOST];
 129                 if (getnameinfo((struct sockaddr *)&from, fromlen, hbuf,
 130                     sizeof(hbuf), NULL, 0, NI_NUMERICHOST) != 0) {
 131                         (void)strlcpy(hbuf, "invalid", sizeof(hbuf));
 132                 }
 133                 if (dolog)
 134                         syslog(LOG_ERR,
 135                             "malformed \"from\" address (v4 mapped, %s)",
 136                             hbuf);
 137                 return EXIT_FAILURE;
 138         }
 139
 140         doit((struct sockaddr *)&from);
 141 }
 142
 143 void
 144 doit(struct sockaddr *fromp)
 145 {
 146         struct pollfd fds[2];
 147         char cmdbuf[NCARGS + 1];
 148         const char *cp;
 149         char user[16], pass[16];
 150         char buf[BUFSIZ], sig;
 151         struct passwd *pwd, pwres;
 152         int s = -1; /* XXX gcc */
 153         int pv[2], pid, cc;
 154         int one = 1;
 155         in_port_t port;
 156         char hostname[2 * MAXHOSTNAMELEN + 1];
 157         char pbuf[NI_MAXSERV];
 158         const int niflags = NI_NUMERICHOST | NI_NUMERICSERV;
 159 #ifndef USE_PAM
 160         char *namep;
 161 #endif
 162         char pwbuf[1024];
 163
 164         (void)signal(SIGINT, SIG_DFL);
 165         (void)signal(SIGQUIT, SIG_DFL);
 166         (void)signal(SIGTERM, SIG_DFL);
 167         (void)dup2(STDIN_FILENO, STDOUT_FILENO);
 168         (void)dup2(STDIN_FILENO, STDERR_FILENO);
 169
 170         if (getnameinfo(fromp, fromp->sa_len, hostname, sizeof(hostname),
 171             pbuf, sizeof(pbuf), niflags) != 0) {
 172                 if (dolog)
 173                         syslog(LOG_ERR, "malformed \"from\" address (af %d)",
 174                                fromp->sa_family);
 175                 exit(EXIT_FAILURE);
 176         }
 177
 178         (void)alarm(60);
 179         port = 0;
 180         for (;;) {
 181                 char c;
 182                 if (read(STDIN_FILENO, &c, 1) != 1) {
 183                         if (dolog)
 184                                 syslog(LOG_ERR, "initial read failed");
 185                         exit(EXIT_FAILURE);
 186                 }
 187                 if (c == 0)
 188                         break;
 189                 port = port * 10 + c - '0';
 190         }
 191         if (port != 0) {
 192                 s = socket(fromp->sa_family, SOCK_STREAM, 0);
 193                 if (s < 0) {
 194                         if (dolog)
 195                                 syslog(LOG_ERR, "socket: %m");
 196                         exit(EXIT_FAILURE);
 197                 }
 198                 (void)alarm(60);
 199                 switch (fromp->sa_family) {
 200                 case AF_INET:
 201                         ((struct sockaddr_in *)fromp)->sin_port = htons(port);
 202                         break;
 203                 case AF_INET6:
 204                         ((struct sockaddr_in6 *)fromp)->sin6_port = htons(port);
 205                         break;
 206                 default:
 207                         syslog(LOG_ERR, "unsupported address family");
 208                         exit(EXIT_FAILURE);
 209                 }
 210                 if (connect(s, (struct sockaddr *)fromp, fromp->sa_len) < 0) {
 211                         if (dolog)
 212                                 syslog(LOG_ERR, "connect: %m");
 213                         exit(EXIT_FAILURE);
 214                 }
 215                 (void)alarm(0);
 216         }
 217         (void)alarm(60);
 218         getstr(user, sizeof(user), "username");
 219         getstr(pass, sizeof(pass), "password");
 220         getstr(cmdbuf, sizeof(cmdbuf), "command");
 221         (void)alarm(0);
 222         if (getpwnam_r(user, &pwres, pwbuf, sizeof(pwbuf), &pwd) != 0 ||
 223             pwd == NULL) {
 224                 if (dolog)
 225                         syslog(LOG_ERR, "no such user %s", user);
 226                 rexecd_errx(EXIT_FAILURE, "Login incorrect.");
 227         }
 228 #ifdef USE_PAM
 229         if (!pam_ok(pam_start("rexecd", user, &pamc, &pamh)) ||
 230             !pam_ok(pam_set_item(pamh, PAM_RHOST, hostname)) ||
 231             !pam_ok(pam_set_item(pamh, PAM_AUTHTOK, pass))) {
 232                 if (dolog)
 233                         syslog(LOG_ERR, "PAM ERROR %s@%s (%s)", user,
 234                            hostname, pam_strerror(pamh, pam_err));
 235                 rexecd_errx(EXIT_FAILURE, "Try again.");
 236         }
 237         if (!pam_ok(pam_authenticate(pamh, pam_flags)) ||
 238             !pam_ok(pam_acct_mgmt(pamh, pam_flags))) {
 239                 if (dolog)
 240                         syslog(LOG_ERR, "LOGIN REFUSED for %s@%s (%s)", user,
 241                            hostname, pam_strerror(pamh, pam_err));
 242                 rexecd_errx(EXIT_FAILURE, "Password incorrect.");
 243         }
 244 #else
 245         if (*pwd->pw_passwd != '\0') {
 246                 namep = crypt(pass, pwd->pw_passwd);
 247                 if (strcmp(namep, pwd->pw_passwd) != 0) {
 248                         if (dolog)
 249                                 syslog(LOG_ERR, "incorrect password for %s",
 250                                     user);
 251                         rexecd_errx(EXIT_FAILURE,
 252                                     "Password incorrect.");/* XXX: wrong! */
 253                 }
 254         } else
 255                 (void)crypt("dummy password", "PA");    /* must always crypt */
 256 #endif
 257         if (chdir(pwd->pw_dir) < 0) {
 258                 if (dolog)
 259                         syslog(LOG_ERR, "%s does not exist for %s", pwd->pw_dir,
 260                                user);
 261                 rexecd_errx(EXIT_FAILURE, "No remote directory.");
 262         }
 263
 264         if (dolog)
 265                 syslog(LOG_INFO, "login from %s as %s", hostname, user);
 266         (void)write(STDERR_FILENO, "\0", 1);
 267         if (port) {
 268                 if (pipe(pv) < 0 || (pid = fork()) == -1) {
 269                         if (dolog)
 270                                 syslog(LOG_ERR,"pipe or fork failed for %s: %m",
 271                                     user);
 272                         rexecd_errx(EXIT_FAILURE, "Try again.");
 273                 }
 274                 if (pid) {
 275                         /* parent */
 276 #ifdef USE_PAM
 277                         (void)pam_end(pamh, pam_err);
 278 #endif
 279                         (void)close(STDIN_FILENO);
 280                         (void)close(STDOUT_FILENO);
 281                         (void)close(STDERR_FILENO);
 282                         (void)close(pv[1]);
 283                         fds[0].fd = s;
 284                         fds[1].fd = pv[0];
 285                         fds[0].events = fds[1].events = POLLIN;
 286                         if (ioctl(pv[1], FIONBIO, (char *)&one) < 0)
 287                                 _exit(1);
 288                         /* should set s nbio! */
 289                         do {
 290                                 if (poll(fds, 2, 0) < 0) {
 291                                         (void)close(s);
 292                                         (void)close(pv[0]);
 293                                         _exit(1);
 294                                 }
 295                                 if (fds[0].revents & POLLIN) {
 296                                         if (read(s, &sig, 1) <= 0)
 297                                                 fds[0].events = 0;
 298                                         else
 299                                                 (void)killpg(pid, sig);
 300                                 }
 301                                 if (fds[1].revents & POLLIN) {
 302                                         cc = read(pv[0], buf, sizeof (buf));
 303                                         if (cc <= 0) {
 304                                                 (void)shutdown(s, SHUT_RDWR);
 305                                                 fds[1].events = 0;
 306                                         } else
 307                                                 (void)write(s, buf, cc);
 308                                 }
 309                         } while ((fds[0].events | fds[1].events) & POLLIN);
 310                         _exit(0);
 311                 }
 312                 /* child */
 313                 (void)close(s);
 314                 (void)close(pv[0]);
 315                 if (dup2(pv[1], STDERR_FILENO) < 0) {
 316                         if (dolog)
 317                                 syslog(LOG_ERR, "dup2 failed for %s", user);
 318                         rexecd_errx(EXIT_FAILURE, "Try again.");
 319                 }
 320         }
 321         if (*pwd->pw_shell == '\0')
 322                 pwd->pw_shell = __UNCONST(_PATH_BSHELL);
 323         if (setsid() < 0 ||
 324             setlogin(pwd->pw_name) < 0 ||
 325             initgroups(pwd->pw_name, pwd->pw_gid) < 0 ||
 326 #ifdef USE_PAM
 327             setgid((gid_t)pwd->pw_gid) < 0) {
 328 #else
 329             setgid((gid_t)pwd->pw_gid) < 0 ||
 330             setuid((uid_t)pwd->pw_uid) < 0) {
 331 #endif
 332                 rexecd_errx(EXIT_FAILURE, "Try again.");
 333                 if (dolog)
 334                         syslog(LOG_ERR, "could not set permissions for %s: %m",
 335                             user);
 336                 exit(EXIT_FAILURE);
 337         }
 338 #ifdef USE_PAM
 339         if (!pam_ok(pam_setcred(pamh, PAM_ESTABLISH_CRED)))
 340                 syslog(LOG_ERR, "pam_setcred() failed: %s",
 341                        pam_strerror(pamh, pam_err));
 342         (void)pam_setenv(pamh, "HOME", pwd->pw_dir, 1);
 343         (void)pam_setenv(pamh, "SHELL", pwd->pw_shell, 1);
 344         (void)pam_setenv(pamh, "USER", pwd->pw_name, 1);
 345         (void)pam_setenv(pamh, "LOGNAME", pwd->pw_name, 1);
 346         (void)pam_setenv(pamh, "PATH", _PATH_DEFPATH, 1);
 347         environ = pam_getenvlist(pamh);
 348         (void)pam_end(pamh, pam_err);
 349         if (setuid((uid_t)pwd->pw_uid) < 0) {
 350                 if (dolog)
 351                         syslog(LOG_ERR, "could not set uid for %s: %m",
 352                             user);
 353                 rexecd_errx(EXIT_FAILURE, "Try again.");
 354         }
 355 #else
 356         (void)strlcat(path, _PATH_DEFPATH, sizeof(path));
 357         environ = envinit;
 358         (void)strlcat(homedir, pwd->pw_dir, sizeof(homedir));
 359         (void)strlcat(shell, pwd->pw_shell, sizeof(shell));
 360         (void)strlcat(username, pwd->pw_name, sizeof(username));
 361         (void)strlcat(logname, pwd->pw_name, sizeof(logname));
 362 #endif
 363
 364         cp = strrchr(pwd->pw_shell, '/');
 365         if (cp)
 366                 cp++;
 367         else
 368                 cp = pwd->pw_shell;
 369         if (dolog)
 370                 syslog(LOG_INFO, "running command for %s: %s", user, cmdbuf);
 371         (void)execl(pwd->pw_shell, cp, "-c", cmdbuf, NULL);
 372         if (dolog)
 373                 syslog(LOG_ERR, "execl failed for %s: %m", user);
 374         err(EXIT_FAILURE, "%s", pwd->pw_shell);
 375 }
 376
 377 void
 378 rexecd_errx(int ex, const char *fmt, ...)
 379 {
 380         char buf[BUFSIZ];
 381         va_list ap;
 382         ssize_t len;
 383
 384         va_start(ap, fmt);
 385         buf[0] = 1;
 386         len = vsnprintf(buf + 1, sizeof(buf) - 1, fmt, ap) + 1;
 387         buf[len++] = '\n';
 388         (void)write(STDERR_FILENO, buf, len);
 389         va_end(ap);
 390         exit(ex);
 391 }
 392
 393 void
 394 getstr(char *buf, int cnt, const char *emsg)
 395 {
 396         char c;
 397
 398         do {
 399                 if (read(STDIN_FILENO, &c, 1) != 1)
 400                         exit(EXIT_FAILURE);
 401                 *buf++ = c;
 402                 if (--cnt == 0)
 403                         rexecd_errx(EXIT_FAILURE, "%s too long", emsg);
 404         } while (c != 0);
 405 }
 406
 407 static void
 408 usage(void)
 409 {
 410         (void)fprintf(stderr, "Usage: %s [-l]\n", getprogname());
 411         exit(EXIT_FAILURE);
 412 }