openpam_restore_cred.c revision 94209
194209Sdes/*- 294209Sdes * Copyright (c) 2002 Networks Associates Technology, Inc. 394209Sdes * All rights reserved. 494209Sdes * 594209Sdes * This software was developed for the FreeBSD Project by ThinkSec AS and 694209Sdes * NAI Labs, the Security Research Division of Network Associates, Inc. 794209Sdes * under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the 894209Sdes * DARPA CHATS research program. 994209Sdes * 1094209Sdes * Redistribution and use in source and binary forms, with or without 1194209Sdes * modification, are permitted provided that the following conditions 1294209Sdes * are met: 1394209Sdes * 1. Redistributions of source code must retain the above copyright 1494209Sdes * notice, this list of conditions and the following disclaimer. 1594209Sdes * 2. Redistributions in binary form must reproduce the above copyright 1694209Sdes * notice, this list of conditions and the following disclaimer in the 1794209Sdes * documentation and/or other materials provided with the distribution. 1894209Sdes * 3. The name of the author may not be used to endorse or promote 1994209Sdes * products derived from this software without specific prior written 2094209Sdes * permission. 2194209Sdes * 2294209Sdes * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 2394209Sdes * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 2494209Sdes * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 2594209Sdes * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 2694209Sdes * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 2794209Sdes * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 2894209Sdes * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 2994209Sdes * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 3094209Sdes * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 3194209Sdes * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 3294209Sdes * SUCH DAMAGE. 3394209Sdes * 3494209Sdes * $P4: //depot/projects/openpam/lib/openpam_restore_cred.c#1 $ 3594209Sdes */ 3694209Sdes 3794209Sdes#include <sys/param.h> 3894209Sdes 3994209Sdes#include <pwd.h> 4094209Sdes#include <stdlib.h> 4194209Sdes#include <unistd.h> 4294209Sdes 4394209Sdes#include <security/pam_appl.h> 4494209Sdes 4594209Sdes#include "openpam_impl.h" 4694209Sdes 4794209Sdes/* 4894209Sdes * OpenPAM extension 4994209Sdes * 5094209Sdes * Restore credentials 5194209Sdes */ 5294209Sdes 5394209Sdesint 5494209Sdesopenpam_restore_cred(pam_handle_t *pamh) 5594209Sdes{ 5694209Sdes struct pam_saved_cred *scred; 5794209Sdes int r; 5894209Sdes 5994209Sdes r = pam_get_data(pamh, PAM_SAVED_CRED, (const void **)&scred); 6094209Sdes if (r != PAM_SUCCESS) 6194209Sdes return (r); 6294209Sdes if (scred == NULL) 6394209Sdes return (PAM_SYSTEM_ERR); 6494209Sdes if (seteuid(scred->euid) == -1 || 6594209Sdes setgroups(scred->ngroups, scred->groups) == -1 || 6694209Sdes setegid(scred->egid) == -1) 6794209Sdes return (PAM_SYSTEM_ERR); 6894209Sdes pam_set_data(pamh, PAM_SAVED_CRED, NULL, NULL); 6994209Sdes return (PAM_SUCCESS); 7094209Sdes} 7194209Sdes 7294209Sdes/* 7394209Sdes * Error codes: 7494209Sdes * 7594209Sdes * =pam_get_data 7694209Sdes * PAM_SYSTEM_ERR 7794209Sdes */ 7894209Sdes 7994209Sdes/** 8094209Sdes * The =openpam_restore_cred function restores the credentials saved by 8194209Sdes * =openpam_borrow_cred. 8294209Sdes * 8394209Sdes * >setegid 8494209Sdes * >seteuid 8594209Sdes * >setgroups 8694209Sdes */ 87