420 lines
12 KiB
C
420 lines
12 KiB
C
/*
|
|
* Copyright (c) 1998 - 2017 Kungliga Tekniska Högskolan
|
|
* (Royal Institute of Technology, Stockholm, Sweden).
|
|
* All rights reserved.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions
|
|
* are met:
|
|
*
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
*
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
* documentation and/or other materials provided with the distribution.
|
|
*
|
|
* 3. Neither the name of the Institute nor the names of its contributors
|
|
* may be used to endorse or promote products derived from this software
|
|
* without specific prior written permission.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
* SUCH DAMAGE.
|
|
*/
|
|
|
|
#include <config.h>
|
|
|
|
#ifdef HAVE_SYS_AUXV_H
|
|
#include <sys/auxv.h>
|
|
#endif
|
|
|
|
#include <errno.h>
|
|
|
|
#include "roken.h"
|
|
|
|
/* NetBSD calls AT_UID AT_RUID. Everyone else calls it AT_UID. */
|
|
#if defined(AT_EUID) && defined(AT_RUID) && !defined(AT_UID)
|
|
#define AT_UID AT_RUID
|
|
#endif
|
|
#if defined(AT_EGID) && defined(AT_RGID) && !defined(AT_GID)
|
|
#define AT_GID AT_RGID
|
|
#endif
|
|
|
|
#ifdef __GLIBC__
|
|
#ifdef __GLIBC_PREREQ
|
|
#define HAVE_GLIBC_API_VERSION_SUPPORT(maj, min) __GLIBC_PREREQ(maj, min)
|
|
#else
|
|
#define HAVE_GLIBC_API_VERSION_SUPPORT(maj, min) \
|
|
((__GLIBC << 16) + GLIBC_MINOR >= ((maj) << 16) + (min))
|
|
#endif
|
|
|
|
/*
|
|
* Do change this check in order to manually test rk_getauxval() for
|
|
* older glibcs.
|
|
*/
|
|
#if HAVE_GLIBC_API_VERSION_SUPPORT(2, 19)
|
|
#define GETAUXVAL_SETS_ERRNO
|
|
#endif
|
|
#endif
|
|
|
|
/**
|
|
* Like the nearly-standard getauxval(), but reads through
|
|
* /proc/self/auxv if it exists (this works on Linux, and, by code
|
|
* inspection, on FreeBSD, but not Solaris/Illumos, where the auxv type
|
|
* is an int and the value is a union of long, data pointer, and
|
|
* function pointer), otherwise it sets errno to ENOENT and returns
|
|
* zero. If the auxval is not found returns zero and always sets errno
|
|
* to ENOENT. Otherwise if auxval is found it leaves errno as it was,
|
|
* even if the value is zero.
|
|
*
|
|
* @return The value of the ELF auxiliary value for the given type.
|
|
*/
|
|
ROKEN_LIB_FUNCTION unsigned long ROKEN_LIB_CALL
|
|
rk_getprocauxval(unsigned long type)
|
|
{
|
|
static int has_proc_auxv = 1;
|
|
unsigned long a[2];
|
|
ssize_t bytes;
|
|
int save_errno = errno;
|
|
int fd;
|
|
|
|
if (!has_proc_auxv) {
|
|
errno = ENOENT;
|
|
return 0;
|
|
}
|
|
|
|
if ((fd = open("/proc/self/auxv", O_RDONLY)) == -1) {
|
|
if (errno == ENOENT)
|
|
has_proc_auxv = 0;
|
|
errno = ENOENT;
|
|
return 0;
|
|
}
|
|
|
|
/* FIXME: Make this work on Illumos */
|
|
do {
|
|
if ((bytes = read(fd, a, sizeof(a))) != sizeof(a))
|
|
break;
|
|
if (a[0] == type) {
|
|
(void) close(fd);
|
|
errno = save_errno;
|
|
return a[1];
|
|
}
|
|
} while (bytes == sizeof(a) && (a[0] != 0 || a[1] != 0));
|
|
|
|
(void) close(fd);
|
|
errno = ENOENT;
|
|
return 0;
|
|
}
|
|
|
|
/**
|
|
* Like the nearly-standard getauxval(). If the auxval is not found
|
|
* returns zero and always sets errno to ENOENT. Otherwise if auxval is
|
|
* found it leaves errno as it was, even if the value is zero.
|
|
*
|
|
* @return The value of the ELF auxiliary value for the given type.
|
|
*/
|
|
ROKEN_LIB_FUNCTION unsigned long ROKEN_LIB_CALL
|
|
rk_getauxval(unsigned long type)
|
|
{
|
|
#ifdef HAVE_GETAUXVAL
|
|
#ifdef GETAUXVAL_SETS_ERRNO
|
|
return getauxval(type);
|
|
#else
|
|
unsigned long ret;
|
|
unsigned long ret2;
|
|
static int getauxval_sets_errno = -1;
|
|
int save_errno = errno;
|
|
|
|
errno = 0;
|
|
ret = getauxval(type);
|
|
if (ret != 0 || errno == ENOENT || getauxval_sets_errno == 1) {
|
|
if (ret != 0)
|
|
errno = save_errno;
|
|
else if (getauxval_sets_errno && errno == 0)
|
|
errno = save_errno;
|
|
return ret;
|
|
}
|
|
|
|
if (!getauxval_sets_errno) {
|
|
errno = save_errno;
|
|
return rk_getprocauxval(type);
|
|
}
|
|
|
|
errno = 0;
|
|
ret2 = getauxval(~type); /* Hacky, quite hacky */
|
|
if (ret2 == 0 && errno == ENOENT) {
|
|
getauxval_sets_errno = 1;
|
|
errno = save_errno;
|
|
return ret; /* Oh, it does set errno. Good! */
|
|
}
|
|
|
|
errno = save_errno;
|
|
getauxval_sets_errno = 0;
|
|
return rk_getprocauxval(type);
|
|
#endif
|
|
#else
|
|
return rk_getprocauxval(type);
|
|
#endif
|
|
}
|
|
|
|
/**
|
|
* Returns non-zero if the caller's process started as set-uid or
|
|
* set-gid (and therefore the environment cannot be trusted).
|
|
*
|
|
* @return Non-zero if the environment is not trusted.
|
|
*/
|
|
ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
|
|
issuid(void)
|
|
{
|
|
/*
|
|
* We want to use issetugid(), but issetugid() is not the same on
|
|
* all OSes.
|
|
*
|
|
* On Illumos derivatives, OpenBSD, and Solaris issetugid() returns
|
|
* true IFF the program exec()ed was set-uid or set-gid.
|
|
*
|
|
* On NetBSD and FreeBSD issetugid() returns true if the program
|
|
* exec()ed was set-uid or set-gid, or if the process has switched
|
|
* UIDs/GIDs or otherwise changed privileges or is a descendant of
|
|
* such a process and has not exec()ed since.
|
|
*
|
|
* What we want here is to know only if the program exec()ed was
|
|
* set-uid or set-gid, so we can decide whether to trust the
|
|
* enviroment variables. We don't care if this was a process that
|
|
* started as root and later changed UIDs/privs whatever: since it
|
|
* started out as privileged, it inherited an environment from a
|
|
* privileged pre-exec self, and so on, so the environment is
|
|
* trusted.
|
|
*
|
|
* Therefore the FreeBSD/NetBSD issetugid() does us no good.
|
|
*
|
|
* Linux, meanwhile, has no issetugid() (at least glibc doesn't
|
|
* anyways).
|
|
*
|
|
* Systems that support ELF put an "auxilliary vector" on the stack
|
|
* prior to starting the RTLD, and this vector includes (optionally)
|
|
* information about the process' EUID, RUID, EGID, RGID, and so on
|
|
* at the time of exec(), which we can use to construct proper
|
|
* issetugid() functionality. Other useful (and used here) auxv
|
|
* types include: AT_SECURE (Linux) and the path to the program
|
|
* exec'ed. None of this applies to statically-linked programs
|
|
* though.
|
|
*
|
|
* Where available, we use the ELF auxilliary vector before trying
|
|
* issetugid().
|
|
*
|
|
* All of this is as of late March 2017, and might become stale in
|
|
* the future.
|
|
*/
|
|
static int we_are_suid = -1;
|
|
int save_errno = errno;
|
|
#if (defined(AT_EUID) && defined(AT_UID)) || (defined(AT_EGID) && defined(AT_GID))
|
|
int seen = 0;
|
|
#endif
|
|
|
|
if (we_are_suid >= 0)
|
|
return we_are_suid;
|
|
|
|
#ifdef AT_SECURE
|
|
/*
|
|
* AT_SECURE is set if the program was set-id or gained any kind of
|
|
* privilege in a similar way.
|
|
*/
|
|
errno = 0;
|
|
if (rk_getauxval(AT_SECURE) != 0) {
|
|
errno = save_errno;
|
|
return we_are_suid = 1;
|
|
}
|
|
else if (errno == 0) {
|
|
errno = save_errno;
|
|
return we_are_suid = 0;
|
|
}
|
|
#endif
|
|
|
|
#if defined(AT_EUID) && defined(AT_UID)
|
|
{
|
|
unsigned long euid;
|
|
unsigned long uid;
|
|
|
|
errno = 0;
|
|
euid = rk_getauxval(AT_EUID);
|
|
if (errno == 0)
|
|
seen |= 1;
|
|
errno = 0;
|
|
uid = rk_getauxval(AT_UID);
|
|
if (errno == 0)
|
|
seen |= 2;
|
|
if (euid != uid) {
|
|
errno = save_errno;
|
|
return we_are_suid = 1;
|
|
}
|
|
}
|
|
#endif
|
|
#if defined(AT_EGID) && defined(AT_GID)
|
|
{
|
|
unsigned long egid;
|
|
unsigned long gid;
|
|
|
|
errno = 0;
|
|
egid = rk_getauxval(AT_EGID);
|
|
if (errno == 0)
|
|
seen |= 4;
|
|
errno = 0;
|
|
gid = rk_getauxval(AT_GID);
|
|
if (errno == 0)
|
|
seen |= 8;
|
|
if (egid != gid) {
|
|
errno = save_errno;
|
|
return we_are_suid = 1;
|
|
}
|
|
}
|
|
#endif
|
|
errno = save_errno;
|
|
|
|
/*
|
|
* This pre-processor condition could be all &&s, but that could
|
|
* cause a warning that seen is set but never used.
|
|
*
|
|
* In practice if any one of these four macros is defined then all
|
|
* of them will be.
|
|
*/
|
|
#if (defined(AT_EUID) && defined(AT_UID)) || (defined(AT_EGID) && defined(AT_GID))
|
|
if (seen == 15) {
|
|
errno = save_errno;
|
|
return we_are_suid = 0;
|
|
}
|
|
#endif
|
|
|
|
#if defined(HAVE_ISSETUGID)
|
|
/*
|
|
* If we have issetugid(), use it. Illumos' and OpenBSD's
|
|
* issetugid() works correctly.
|
|
*
|
|
* On NetBSD and FreeBSD, however, issetugid() returns non-zero even
|
|
* if the process started as root, not-set-uid, and then later
|
|
* called seteuid(), for example, but in that case we'd want to
|
|
* trust the environ! So if issetugid() > 0 we want to do something
|
|
* else. See below.
|
|
*/
|
|
if (issetugid() == 0)
|
|
return we_are_suid = 0;
|
|
#endif /* USE_RK_GETAUXVAL */
|
|
|
|
#if defined(AT_EXECFN) || defined(AT_EXECPATH)
|
|
|
|
/*
|
|
* There's an auxval by which to find the path of the program this
|
|
* process exec'ed.
|
|
*
|
|
* Linux calls this AT_EXECFN. FreeBSD calls it AT_EXECPATH. NetBSD
|
|
* and Illumos call it AT_SUN_EXECNAME.
|
|
*
|
|
* We can stat it. If the program did a chroot() and the chroot has
|
|
* a program with the same path but not set-uid/set-gid, of course,
|
|
* we lose here. But a) that's a bit of a stretch, b) there's not
|
|
* much more we can do here.
|
|
*/
|
|
#if defined(AT_EXECFN) && !defined(AT_EXECPATH)
|
|
#define AT_EXECPATH AT_EXECFN
|
|
#endif
|
|
#if defined(AT_SUN_EXECNAME) && !defined(AT_EXECPATH)
|
|
#define AT_EXECPATH AT_EXECFN
|
|
#endif
|
|
{
|
|
unsigned long p = getauxval(AT_EXECPATH);
|
|
struct stat st;
|
|
|
|
if (p != 0 && *(const char *)p == '/' &&
|
|
stat((const char *)p, &st) == 0) {
|
|
if ((st.st_mode & S_ISUID) || (st.st_mode & S_ISGID)) {
|
|
errno = save_errno;
|
|
return we_are_suid = 1;
|
|
}
|
|
errno = save_errno;
|
|
return we_are_suid = 0;
|
|
}
|
|
}
|
|
#endif
|
|
|
|
/*
|
|
* Fall through if we have rk_getauxval() but we didn't have (or
|
|
* don't know if we don't have) the aux entries that we needed.
|
|
* We're done with it.
|
|
*/
|
|
|
|
#if defined(HAVE_ISSETUGID)
|
|
errno = save_errno;
|
|
return we_are_suid = 1;
|
|
#else
|
|
|
|
/*
|
|
* Paranoia: for extra safety we ought to default to returning 1.
|
|
*
|
|
* But who knows what that might break where users link statically
|
|
* (so no auxv), say. Also, on Windows we should always return 0.
|
|
*
|
|
* For now we stick to returning zero by default. We've been rather
|
|
* heroic above trying to find out if we're suid.
|
|
*/
|
|
|
|
#if defined(HAVE_GETRESUID)
|
|
/*
|
|
* If r/e/suid are all the same then chances are very good we did
|
|
* not start as set-uid. Though this could be a login program that
|
|
* started out as privileged and is calling Heimdal "as the user".
|
|
*
|
|
* Again, such a program would have to be statically linked to get
|
|
* here.
|
|
*/
|
|
{
|
|
uid_t r, e, s;
|
|
if (getresuid(&r, &e, &s) == 0) {
|
|
if (r != e || r != s) {
|
|
errno = save_errno;
|
|
return we_are_suid = 1;
|
|
}
|
|
}
|
|
}
|
|
#endif
|
|
#if defined(HAVE_GETRESGID)
|
|
{
|
|
gid_t r, e, s;
|
|
if (getresgid(&r, &e, &s) == 0) {
|
|
if (r != e || r != s) {
|
|
errno = save_errno;
|
|
return we_are_suid = 1;
|
|
}
|
|
}
|
|
}
|
|
#endif
|
|
#if defined(HAVE_GETRESUID) && defined(HAVE_GETRESGID)
|
|
errno = save_errno;
|
|
return we_are_suid = 0;
|
|
|
|
#else /* avoid compiler warnings about dead code */
|
|
|
|
#if defined(HAVE_GETUID) && defined(HAVE_GETEUID)
|
|
if (getuid() != geteuid())
|
|
return we_are_suid = 1;
|
|
#endif
|
|
#if defined(HAVE_GETGID) && defined(HAVE_GETEGID)
|
|
if (getgid() != getegid())
|
|
return we_are_suid = 1;
|
|
#endif
|
|
|
|
#endif /* !defined(HAVE_GETRESUID) || !defined(HAVE_GETRESGID) */
|
|
|
|
errno = save_errno;
|
|
return we_are_suid = 0;
|
|
#endif /* !defined(HAVE_ISSETUGID) */
|
|
}
|