2 Unix SMB/CIFS implementation.
3 Copyright (C) Jeremy Allison 1998.
4 rewritten for version 2.0.6 by Tridge
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "system/passwd.h" /* uid_wrapper */
23 #include "../lib/util/setid.h"
26 /* we are running this code in autoconf test mode to see which type of setuid
28 #if defined(HAVE_UNISTD_H)
34 #include <sys/types.h>
37 #ifdef HAVE_SYS_PRIV_H
44 #define DEBUG(x, y) printf y
45 #define smb_panic(x) exit(1)
48 /* are we running as non-root? This is used by the regresison test code,
49 and potentially also for sites that want non-root smbd */
50 static uid_t initial_uid;
51 static gid_t initial_gid;
53 /****************************************************************************
54 remember what uid we got started as - this allows us to run correctly
55 as non-root while catching trapdoor systems
56 ****************************************************************************/
60 static int initialized;
65 if (uid_wrapper_enabled()) {
66 setenv("UID_WRAPPER_MYUID", "1", 1);
70 initial_uid = geteuid();
71 initial_gid = getegid();
74 if (uid_wrapper_enabled()) {
75 unsetenv("UID_WRAPPER_MYUID");
83 /****************************************************************************
84 some code (eg. winbindd) needs to know what uid we started as
85 ****************************************************************************/
86 uid_t sec_initial_uid(void)
91 /****************************************************************************
92 some code (eg. winbindd, profiling shm) needs to know what gid we started as
93 ****************************************************************************/
94 gid_t sec_initial_gid(void)
100 * @brief Check if we are running in root mode.
102 * @return If we samba root privileges it returns true, false otehrwise.
110 #ifndef AUTOCONF_TEST
111 if (uid_wrapper_enabled()) {
112 return (euid == initial_uid || euid == (uid_t)0);
116 return (initial_uid == euid);
119 /****************************************************************************
120 are we running in non-root mode?
121 ****************************************************************************/
122 bool non_root_mode(void)
124 return (initial_uid != (uid_t)0);
127 /****************************************************************************
128 abort if we haven't set the uid correctly
129 ****************************************************************************/
130 static void assert_uid(uid_t ruid, uid_t euid)
132 if ((euid != (uid_t)-1 && geteuid() != euid) ||
133 (ruid != (uid_t)-1 && getuid() != ruid)) {
134 if (!non_root_mode()) {
135 DEBUG(0,("Failed to set uid privileges to (%d,%d) now set to (%d,%d)\n",
136 (int)ruid, (int)euid,
137 (int)getuid(), (int)geteuid()));
138 smb_panic("failed to set uid\n");
144 /****************************************************************************
145 abort if we haven't set the gid correctly
146 ****************************************************************************/
147 static void assert_gid(gid_t rgid, gid_t egid)
149 if ((egid != (gid_t)-1 && getegid() != egid) ||
150 (rgid != (gid_t)-1 && getgid() != rgid)) {
151 if (!non_root_mode()) {
152 DEBUG(0,("Failed to set gid privileges to (%d,%d) now set to (%d,%d) uid=(%d,%d)\n",
153 (int)rgid, (int)egid,
154 (int)getgid(), (int)getegid(),
155 (int)getuid(), (int)geteuid()));
156 smb_panic("failed to set gid\n");
162 /****************************************************************************
163 Gain root privilege before doing something.
164 We want to end up with ruid==euid==0
165 ****************************************************************************/
166 void gain_root_privilege(void)
168 #if defined(USE_SETRESUID) || defined(HAVE_LINUX_THREAD_CREDENTIALS)
169 samba_setresuid(0,0,0);
177 samba_setreuid(0, 0);
181 samba_setuidx(ID_EFFECTIVE, 0);
182 samba_setuidx(ID_REAL, 0);
185 /* this is needed on some systems */
192 /****************************************************************************
193 Ensure our real and effective groups are zero.
194 we want to end up with rgid==egid==0
195 ****************************************************************************/
196 void gain_root_group_privilege(void)
198 #if defined(USE_SETRESUID) || defined(HAVE_LINUX_THREAD_CREDENTIALS)
199 samba_setresgid(0,0,0);
211 samba_setgidx(ID_EFFECTIVE, 0);
212 samba_setgidx(ID_REAL, 0);
221 /****************************************************************************
222 Set effective uid, and possibly the real uid too.
223 We want to end up with either:
225 ruid==uid and euid==uid
229 ruid==0 and euid==uid
231 depending on what the local OS will allow us to regain root from.
232 ****************************************************************************/
233 void set_effective_uid(uid_t uid)
235 #if defined(USE_SETRESUID) || defined(HAVE_LINUX_THREAD_CREDENTIALS)
236 /* Set the effective as well as the real uid. */
237 if (samba_setresuid(uid,uid,-1) == -1) {
238 if (errno == EAGAIN) {
239 DEBUG(0, ("samba_setresuid failed with EAGAIN. uid(%d) "
240 "might be over its NPROC limit\n",
247 samba_setreuid(-1,uid);
255 samba_setuidx(ID_EFFECTIVE, uid);
261 /****************************************************************************
262 Set *only* the effective gid.
263 we want to end up with rgid==0 and egid==gid
264 ****************************************************************************/
265 void set_effective_gid(gid_t gid)
267 #if defined(USE_SETRESUID) || defined(HAVE_LINUX_THREAD_CREDENTIALS)
268 samba_setresgid(-1,gid,-1);
272 samba_setregid(-1,gid);
280 samba_setgidx(ID_EFFECTIVE, gid);
286 static uid_t saved_euid, saved_ruid;
287 static gid_t saved_egid, saved_rgid;
289 /****************************************************************************
290 save the real and effective uid for later restoration. Used by the quotas
292 ****************************************************************************/
293 void save_re_uid(void)
295 saved_ruid = getuid();
296 saved_euid = geteuid();
300 /****************************************************************************
302 ****************************************************************************/
304 void restore_re_uid_fromroot(void)
306 #if defined(USE_SETRESUID) || defined(HAVE_LINUX_THREAD_CREDENTIALS)
307 samba_setresuid(saved_ruid, saved_euid, -1);
309 samba_setreuid(saved_ruid, -1);
310 samba_setreuid(-1,saved_euid);
312 samba_setuidx(ID_REAL, saved_ruid);
313 samba_setuidx(ID_EFFECTIVE, saved_euid);
315 set_effective_uid(saved_euid);
316 if (getuid() != saved_ruid)
317 samba_setuid(saved_ruid);
318 set_effective_uid(saved_euid);
321 assert_uid(saved_ruid, saved_euid);
324 void restore_re_uid(void)
326 set_effective_uid(0);
327 restore_re_uid_fromroot();
330 /****************************************************************************
331 save the real and effective gid for later restoration. Used by the
333 ****************************************************************************/
334 void save_re_gid(void)
336 saved_rgid = getgid();
337 saved_egid = getegid();
340 /****************************************************************************
342 ****************************************************************************/
343 void restore_re_gid(void)
345 #if defined(USE_SETRESUID) || defined(HAVE_LINUX_THREAD_CREDENTIALS)
346 samba_setresgid(saved_rgid, saved_egid, -1);
348 samba_setregid(saved_rgid, -1);
349 samba_setregid(-1,saved_egid);
351 samba_setgidx(ID_REAL, saved_rgid);
352 samba_setgidx(ID_EFFECTIVE, saved_egid);
354 set_effective_gid(saved_egid);
355 if (getgid() != saved_rgid)
356 samba_setgid(saved_rgid);
357 set_effective_gid(saved_egid);
360 assert_gid(saved_rgid, saved_egid);
364 /****************************************************************************
365 set the real AND effective uid to the current effective uid in a way that
366 allows root to be regained.
367 This is only possible on some platforms.
368 ****************************************************************************/
371 uid_t uid = geteuid();
373 #if defined(USE_SETRESUID) || defined(HAVE_LINUX_THREAD_CREDENTIALS)
374 samba_setresuid(uid, uid, -1);
378 samba_setreuid(0, 0);
379 samba_setreuid(uid, -1);
380 samba_setreuid(-1, uid);
393 assert_uid(uid, uid);
398 /****************************************************************************
399 Become the specified uid and gid - permanently !
400 there should be no way back if possible
401 ****************************************************************************/
402 void become_user_permanently(uid_t uid, gid_t gid)
405 * First - gain root privilege. We do this to ensure
406 * we can lose it again.
409 gain_root_privilege();
410 gain_root_group_privilege();
412 #if defined(USE_SETRESUID) || defined(HAVE_LINUX_THREAD_CREDENTIALS)
413 samba_setresgid(gid,gid,gid);
415 samba_setresuid(uid,uid,uid);
420 samba_setregid(gid,gid);
422 samba_setreuid(uid,uid);
435 samba_setgidx(ID_REAL, gid);
436 samba_setgidx(ID_EFFECTIVE, gid);
438 samba_setuidx(ID_REAL, uid);
439 samba_setuidx(ID_EFFECTIVE, uid);
443 assert_uid(uid, uid);
444 assert_gid(gid, gid);
447 /**********************************************************
448 Function to set thread specific credentials. Leave
449 saved-set uid/gid alone.Must be thread-safe code.
450 **********************************************************/
452 int set_thread_credentials(uid_t uid,
457 #if defined(HAVE_LINUX_THREAD_CREDENTIALS)
459 * With Linux thread-specific credentials
460 * we know we have setresuid/setresgid
475 cache.setlen == setlen &&
476 (const gid_t *)cache.gidset == gidset)
480 #endif /* HAVE___THREAD */
484 if (samba_setresuid(0, 0, -1) != 0) {
487 /* Set our primary gid. */
488 /* Set rg=gid, eg=gid */
489 if (samba_setresgid(gid, gid, -1) != 0) {
492 /* Set extra groups list. */
493 if (samba_setgroups(setlen, gidset) != 0) {
496 /* Become the requested user. */
497 /* Set ru=uid, eu=uid */
498 if (samba_setresuid(uid, uid, -1) != 0) {
501 if (geteuid() != uid || getuid() != uid ||
502 getegid() != gid || getgid() != gid) {
503 smb_panic("set_thread_credentials failed\n");
511 cache.setlen = setlen;
512 cache.gidset = (uintptr_t)gidset;
513 #endif /* HAVE___THREAD */
524 /****************************************************************************
525 this function just checks that we don't get ENOSYS back
526 ****************************************************************************/
527 static int have_syscall(void)
531 #if defined(USE_SETRESUID) || defined(HAVE_LINUX_THREAD_CREDENTIALS)
532 samba_setresuid(-1,-1,-1);
536 samba_setreuid(-1,-1);
544 samba_setuidx(ID_EFFECTIVE, -1);
547 if (errno == ENOSYS) {
556 #if (defined(AIX) && defined(USE_SETREUID))
557 /* setreuid is badly broken on AIX 4.1, we avoid it completely */
558 fprintf(stderr,"avoiding possibly broken setreuid\n");
562 /* if not running as root then at least check to see if we get ENOSYS - this
563 handles Linux 2.0.x with glibc 2.1 */
564 fprintf(stderr,"not running as root: checking for ENOSYS\n");
565 exit(have_syscall());
568 gain_root_privilege();
569 gain_root_group_privilege();
570 set_effective_gid(1);
571 set_effective_uid(1);
574 gain_root_privilege();
575 gain_root_group_privilege();
576 become_user_permanently(1, 1);
579 fprintf(stderr,"uid not set permanently\n");
589 /****************************************************************************
590 Check if we are setuid root. Used in libsmb and smbpasswd paranoia checks.
591 ****************************************************************************/
592 bool is_setuid_root(void)
594 return (geteuid() == (uid_t)0) && (getuid() != (uid_t)0);