2 Unix SMB/CIFS implementation.
3 run a command as a specified user
4 Copyright (C) Andrew Tridgell 1992-1998
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 /* need to move this from here!! need some sleep ... */
23 struct current_user current_user;
25 /****************************************************************************
26 This is a utility function of smbrun().
27 ****************************************************************************/
29 static int setup_out_fd(void)
32 TALLOC_CTX *ctx = talloc_stackframe();
35 path = talloc_asprintf(ctx,
44 /* now create the file */
48 DEBUG(0,("setup_out_fd: Failed to create file %s. (%s)\n",
49 path, strerror(errno) ));
54 DEBUG(10,("setup_out_fd: Created tmp file %s\n", path ));
56 /* Ensure file only kept around by open fd. */
62 /****************************************************************************
63 run a command being careful about uid/gid handling and putting the output in
64 outfd (or discard it if outfd is NULL).
65 ****************************************************************************/
67 static int smbrun_internal(const char *cmd, int *outfd, bool sanitize)
70 uid_t uid = current_user.ut.uid;
71 gid_t gid = current_user.ut.gid;
74 * Lose any elevated privileges.
76 drop_effective_capability(KERNEL_OPLOCK_CAPABILITY);
77 drop_effective_capability(DMAPI_ACCESS_CAPABILITY);
79 /* point our stdout at the file we want output to go into */
81 if (outfd && ((*outfd = setup_out_fd()) == -1)) {
85 /* in this method we will exec /bin/sh with the correct
86 arguments, after first setting stdout to point at the file */
89 * We need to temporarily stop CatchChild from eating
90 * SIGCLD signals as it also eats the exit status code. JRA.
93 CatchChildLeaveStatus();
95 if ((pid=sys_fork()) < 0) {
96 DEBUG(0,("smbrun: fork failed with error %s\n", strerror(errno) ));
113 /* the parent just waits for the child to exit */
114 while((wpid = sys_waitpid(pid,&status,0)) < 0) {
125 DEBUG(2,("waitpid(%d) : %s\n",(int)pid,strerror(errno)));
133 /* Reset the seek pointer. */
135 sys_lseek(*outfd, 0, SEEK_SET);
138 #if defined(WIFEXITED) && defined(WEXITSTATUS)
139 if (WIFEXITED(status)) {
140 return WEXITSTATUS(status);
149 /* we are in the child. we exec /bin/sh to do the work for us. we
150 don't directly exec the command we want because it may be a
151 pipeline or anything else the config file specifies */
153 /* point our stdout at the file we want output to go into */
156 if (dup2(*outfd,1) != 1) {
157 DEBUG(2,("Failed to create stdout file descriptor\n"));
163 /* now completely lose our privileges. This is a fairly paranoid
164 way of doing it, but it does work on all systems that I know of */
166 become_user_permanently(uid, gid);
168 if (!non_root_mode()) {
169 if (getuid() != uid || geteuid() != uid ||
170 getgid() != gid || getegid() != gid) {
171 /* we failed to lose our privileges - do not execute
173 exit(81); /* we can't print stuff at this stage,
174 instead use exit codes for debugging */
179 /* close all other file descriptors, leaving only 0, 1 and 2. 0 and
180 2 point to /dev/null from the startup code */
183 for (fd=3;fd<256;fd++) close(fd);
190 newcmd = escape_shell_string(cmd);
195 execl("/bin/sh","sh","-c",
196 newcmd ? (const char *)newcmd : cmd, NULL);
206 /****************************************************************************
207 Use only in known safe shell calls (printing).
208 ****************************************************************************/
210 int smbrun_no_sanitize(const char *cmd, int *outfd)
212 return smbrun_internal(cmd, outfd, False);
215 /****************************************************************************
216 By default this now sanitizes shell expansion.
217 ****************************************************************************/
219 int smbrun(const char *cmd, int *outfd)
221 return smbrun_internal(cmd, outfd, True);
224 /****************************************************************************
225 run a command being careful about uid/gid handling and putting the output in
226 outfd (or discard it if outfd is NULL).
227 sends the provided secret to the child stdin.
228 ****************************************************************************/
230 int smbrunsecret(const char *cmd, const char *secret)
233 uid_t uid = current_user.ut.uid;
234 gid_t gid = current_user.ut.gid;
238 * Lose any elevated privileges.
240 drop_effective_capability(KERNEL_OPLOCK_CAPABILITY);
241 drop_effective_capability(DMAPI_ACCESS_CAPABILITY);
243 /* build up an input pipe */
248 /* in this method we will exec /bin/sh with the correct
249 arguments, after first setting stdout to point at the file */
252 * We need to temporarily stop CatchChild from eating
253 * SIGCLD signals as it also eats the exit status code. JRA.
256 CatchChildLeaveStatus();
258 if ((pid=sys_fork()) < 0) {
259 DEBUG(0, ("smbrunsecret: fork failed with error %s\n", strerror(errno)));
274 /* send the secret */
275 towrite = strlen(secret);
276 wrote = write(ifd[1], secret, towrite);
277 if ( wrote != towrite ) {
278 DEBUG(0,("smbrunsecret: wrote %ld of %lu bytes\n",(long)wrote,(unsigned long)towrite));
283 /* the parent just waits for the child to exit */
284 while((wpid = sys_waitpid(pid, &status, 0)) < 0) {
295 DEBUG(2, ("waitpid(%d) : %s\n", (int)pid, strerror(errno)));
299 #if defined(WIFEXITED) && defined(WEXITSTATUS)
300 if (WIFEXITED(status)) {
301 return WEXITSTATUS(status);
310 /* we are in the child. we exec /bin/sh to do the work for us. we
311 don't directly exec the command we want because it may be a
312 pipeline or anything else the config file specifies */
316 if (dup2(ifd[0], 0) != 0) {
317 DEBUG(2,("Failed to create stdin file descriptor\n"));
322 /* now completely lose our privileges. This is a fairly paranoid
323 way of doing it, but it does work on all systems that I know of */
325 become_user_permanently(uid, gid);
327 if (!non_root_mode()) {
328 if (getuid() != uid || geteuid() != uid ||
329 getgid() != gid || getegid() != gid) {
330 /* we failed to lose our privileges - do not execute
332 exit(81); /* we can't print stuff at this stage,
333 instead use exit codes for debugging */
338 /* close all other file descriptors, leaving only 0, 1 and 2. 0 and
339 2 point to /dev/null from the startup code */
342 for (fd = 3; fd < 256; fd++) close(fd);
346 execl("/bin/sh", "sh", "-c", cmd, NULL);