openpam_restore_cred.c revision 117610
194209Sdes/*- 2115619Sdes * Copyright (c) 2002-2003 Networks Associates Technology, Inc. 394209Sdes * All rights reserved. 494209Sdes * 594209Sdes * This software was developed for the FreeBSD Project by ThinkSec AS and 699158Sdes * Network Associates Laboratories, the Security Research Division of 799158Sdes * Network Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 899158Sdes * ("CBOSS"), as part of the DARPA CHATS research program. 994209Sdes * 1094209Sdes * Redistribution and use in source and binary forms, with or without 1194209Sdes * modification, are permitted provided that the following conditions 1294209Sdes * are met: 1394209Sdes * 1. Redistributions of source code must retain the above copyright 1494209Sdes * notice, this list of conditions and the following disclaimer. 1594209Sdes * 2. Redistributions in binary form must reproduce the above copyright 1694209Sdes * notice, this list of conditions and the following disclaimer in the 1794209Sdes * documentation and/or other materials provided with the distribution. 1894209Sdes * 3. The name of the author may not be used to endorse or promote 1994209Sdes * products derived from this software without specific prior written 2094209Sdes * permission. 2194209Sdes * 2294209Sdes * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 2394209Sdes * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 2494209Sdes * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 2594209Sdes * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 2694209Sdes * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 2794209Sdes * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 2894209Sdes * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 2994209Sdes * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 3094209Sdes * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 3194209Sdes * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 3294209Sdes * SUCH DAMAGE. 3394209Sdes * 34117610Sdes * $P4: //depot/projects/openpam/lib/openpam_restore_cred.c#9 $ 3594209Sdes */ 3694209Sdes 3794209Sdes#include <sys/param.h> 3894209Sdes 39115619Sdes#include <grp.h> 40117610Sdes#include <limits.h> 4194209Sdes#include <pwd.h> 4294209Sdes#include <stdlib.h> 4394209Sdes#include <unistd.h> 4494209Sdes 4594209Sdes#include <security/pam_appl.h> 4694209Sdes 4794209Sdes#include "openpam_impl.h" 4894209Sdes 4994209Sdes/* 5094209Sdes * OpenPAM extension 5194209Sdes * 5294209Sdes * Restore credentials 5394209Sdes */ 5494209Sdes 5594209Sdesint 5694209Sdesopenpam_restore_cred(pam_handle_t *pamh) 5794209Sdes{ 5894209Sdes struct pam_saved_cred *scred; 5994209Sdes int r; 6094209Sdes 61107937Sdes ENTER(); 6294209Sdes r = pam_get_data(pamh, PAM_SAVED_CRED, (const void **)&scred); 6394209Sdes if (r != PAM_SUCCESS) 64107937Sdes RETURNC(r); 6594209Sdes if (scred == NULL) 66107937Sdes RETURNC(PAM_SYSTEM_ERR); 67110503Sdes if (scred->euid != geteuid()) { 68115619Sdes if (seteuid(scred->euid) < 0 || 69115619Sdes setgroups(scred->ngroups, scred->groups) < 0 || 70115619Sdes setegid(scred->egid) < 0) 71110503Sdes RETURNC(PAM_SYSTEM_ERR); 72110503Sdes } 7394209Sdes pam_set_data(pamh, PAM_SAVED_CRED, NULL, NULL); 74107937Sdes RETURNC(PAM_SUCCESS); 7594209Sdes} 7694209Sdes 7794209Sdes/* 7894209Sdes * Error codes: 7994209Sdes * 8094209Sdes * =pam_get_data 8194209Sdes * PAM_SYSTEM_ERR 8294209Sdes */ 8394209Sdes 8494209Sdes/** 8594209Sdes * The =openpam_restore_cred function restores the credentials saved by 8694209Sdes * =openpam_borrow_cred. 8794209Sdes * 8894209Sdes * >setegid 8994209Sdes * >seteuid 9094209Sdes * >setgroups 9194209Sdes */ 92