1/*	$NetBSD: su.c,v 1.75 2023/03/24 16:58:24 kre Exp $	*/
2
3/*
4 * Copyright (c) 1988 The Regents of the University of California.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 *    notice, this list of conditions and the following disclaimer in the
14 *    documentation and/or other materials provided with the distribution.
15 * 3. Neither the name of the University nor the names of its contributors
16 *    may be used to endorse or promote products derived from this software
17 *    without specific prior written permission.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
30 */
31
32#include <sys/cdefs.h>
33#ifndef lint
34__COPYRIGHT("@(#) Copyright (c) 1988\
35 The Regents of the University of California.  All rights reserved.");
36#endif /* not lint */
37
38#ifndef lint
39#if 0
40static char sccsid[] = "@(#)su.c	8.3 (Berkeley) 4/2/94";*/
41#else
42__RCSID("$NetBSD: su.c,v 1.75 2023/03/24 16:58:24 kre Exp $");
43#endif
44#endif /* not lint */
45
46#include <sys/param.h>
47#include <sys/time.h>
48#include <sys/resource.h>
49#include <err.h>
50#include <errno.h>
51#include <grp.h>
52#include <paths.h>
53#include <pwd.h>
54#include <stdio.h>
55#ifdef SKEY
56#include <skey.h>
57#endif
58#include <stdlib.h>
59#include <string.h>
60#include <syslog.h>
61#include <time.h>
62#include <tzfile.h>
63#include <unistd.h>
64#include <util.h>
65
66#ifdef LOGIN_CAP
67#include <login_cap.h>
68#endif
69
70#ifdef KERBEROS5
71#include <krb5.h>
72#endif
73
74#ifdef ALLOW_GROUP_CHANGE
75#include "grutil.h"
76#endif
77#include "suutil.h"
78
79#ifdef KERBEROS5
80#define	ARGSTRX	"-Kdflm"
81static int kerberos5(char *, const char *, uid_t);
82int use_kerberos = 1;
83#else
84#define	ARGSTRX	"-dflm"
85#endif
86
87#ifndef	SU_GROUP
88#define	SU_GROUP	"wheel"
89#endif
90
91#define GROUP_PASSWORD	"Group Password:"
92
93#ifdef LOGIN_CAP
94#define ARGSTR	ARGSTRX "c:"
95#else
96#define ARGSTR ARGSTRX
97#endif
98
99static int check_ingroup(int, const char *, const char *, int);
100
101int
102main(int argc, char **argv)
103{
104	extern char **environ;
105	struct passwd *pwd;
106	char *p;
107#ifdef BSD4_4
108	struct timeval tp;
109#endif
110	uid_t ruid;
111	int asme, ch, asthem, fastlogin, prio, gohome;
112	enum { UNSET, YES, NO } iscsh = UNSET;
113	const char *user, *shell, *avshell;
114	char *username, **np;
115#ifdef SU_ROOTAUTH
116	char *userpass;
117#endif
118	char *class;
119	char shellbuf[MAXPATHLEN], avshellbuf[MAXPATHLEN];
120	time_t pw_warntime = _PASSWORD_WARNDAYS * SECSPERDAY;
121#ifdef LOGIN_CAP
122	login_cap_t *lc;
123#endif
124#ifdef ALLOW_GROUP_CHANGE
125	char *gname;
126#endif
127
128	(void)setprogname(argv[0]);
129	asme = asthem = fastlogin = 0;
130	gohome = 1;
131	shell = class = NULL;
132	while ((ch = getopt(argc, argv, ARGSTR)) != -1)
133		switch((char)ch) {
134#ifdef KERBEROS5
135		case 'K':
136			use_kerberos = 0;
137			break;
138#endif
139#ifdef LOGIN_CAP
140		case 'c':
141			class = optarg;
142			break;
143#endif
144		case 'd':
145			asme = 0;
146			asthem = 1;
147			gohome = 0;
148			break;
149		case 'f':
150			fastlogin = 1;
151			break;
152		case '-':
153		case 'l':
154			asme = 0;
155			asthem = 1;
156			break;
157		case 'm':
158			asme = 1;
159			asthem = 0;
160			break;
161		case '?':
162		default:
163			(void)fprintf(stderr,
164#ifdef ALLOW_GROUP_CHANGE
165			    "usage: %s [%s] [login[:group] [shell arguments]]\n",
166#else
167			    "usage: %s [%s] [login [shell arguments]]\n",
168#endif
169			    getprogname(), ARGSTR);
170			exit(EXIT_FAILURE);
171		}
172	argv += optind;
173
174	/* Lower the priority so su runs faster */
175	errno = 0;
176	prio = getpriority(PRIO_PROCESS, 0);
177	if (errno)
178		prio = 0;
179	if (prio > -2)
180		(void)setpriority(PRIO_PROCESS, 0, -2);
181	openlog("su", 0, LOG_AUTH);
182
183	/* get current login name and shell */
184	ruid = getuid();
185	username = getlogin();
186	if (username == NULL || (pwd = getpwnam(username)) == NULL ||
187	    pwd->pw_uid != ruid)
188		pwd = getpwuid(ruid);
189	if (pwd == NULL)
190		errx(EXIT_FAILURE, "who are you?");
191	username = estrdup(pwd->pw_name);
192#ifdef SU_ROOTAUTH
193	userpass = estrdup(pwd->pw_passwd);
194#endif
195
196	if (asme) {
197		if (pwd->pw_shell && *pwd->pw_shell) {
198			(void)estrlcpy(shellbuf, pwd->pw_shell, sizeof(shellbuf));
199			shell = shellbuf;
200		} else {
201			shell = _PATH_BSHELL;
202			iscsh = NO;
203		}
204	}
205	/* get target login information, default to root */
206	user = *argv ? *argv : "root";
207	np = *argv ? argv : argv - 1;
208
209#ifdef ALLOW_GROUP_CHANGE
210	if ((p = strchr(user, ':')) != NULL) {
211		*p = '\0';
212		gname = ++p;
213		if (*gname == '\0')
214			errx(EXIT_FAILURE, "missing 'group' after ':'");
215	} else
216		gname = NULL;
217
218#ifdef ALLOW_EMPTY_USER
219	if (user[0] == '\0' && gname != NULL)
220		user = username;
221#endif
222#endif
223	if ((pwd = getpwnam(user)) == NULL)
224		errx(EXIT_FAILURE, "unknown login `%s'", user);
225
226#ifdef LOGIN_CAP
227	/* force the usage of specified class */
228	if (class) {
229		if (ruid)
230			errx(EXIT_FAILURE, "Only root may use -c");
231
232		pwd->pw_class = class;
233	}
234	if ((lc = login_getclass(pwd->pw_class)) == NULL)
235		errx(EXIT_FAILURE, "Unknown class %s", pwd->pw_class);
236
237	pw_warntime = (time_t)login_getcaptime(lc, "password-warn",
238	    _PASSWORD_WARNDAYS * SECSPERDAY,
239	    _PASSWORD_WARNDAYS * SECSPERDAY);
240#endif
241
242	if (ruid
243#ifdef KERBEROS5
244	    && (!use_kerberos || kerberos5(username, user, pwd->pw_uid))
245#endif
246	    ) {
247		char *pass = pwd->pw_passwd;
248		int ok = pwd->pw_uid != 0;
249
250#ifdef SU_ROOTAUTH
251		/*
252		 * Allow those in group rootauth to su to root, by supplying
253		 * their own password.
254		 */
255		if (!ok) {
256			if ((ok = check_ingroup(-1, SU_ROOTAUTH, username, 0))) {
257				pass = userpass;
258				user = username;
259			}
260		}
261#endif
262		/*
263		 * Only allow those in group SU_GROUP to su to root,
264		 * but only if that group has any members.
265		 * If SU_GROUP has no members, allow anyone to su root
266		 */
267		if (!ok)
268			ok = check_ingroup(-1, SU_GROUP, username, 1);
269		if (!ok)
270			errx(EXIT_FAILURE,
271	    "you are not listed in the correct secondary group (%s) to su %s.",
272					    SU_GROUP, user);
273		/* if target requires a password, verify it */
274		if (*pass && pwd->pw_uid != ruid) {	/* XXX - OK? */
275			p = getpass("Password:");
276#ifdef SKEY
277			if (strcasecmp(p, "s/key") == 0) {
278				if (skey_haskey(user))
279					errx(EXIT_FAILURE,
280					    "Sorry, you have no s/key.");
281				else {
282					if (skey_authenticate(user)) {
283						goto badlogin;
284					}
285				}
286
287			} else
288#endif
289			if (consttime_memequal(pass,
290			    crypt(p, pass), strlen(pass)) == 0) {
291#ifdef SKEY
292 badlogin:
293#endif
294				(void)fprintf(stderr, "Sorry\n");
295				syslog(LOG_WARNING,
296					"BAD SU %s to %s%s", username,
297					pwd->pw_name, ontty());
298				exit(EXIT_FAILURE);
299			}
300		}
301	}
302
303	if (asme) {
304		/* if asme and non-standard target shell, must be root */
305		if (chshell(pwd->pw_shell) == 0 && ruid)
306			errx(EXIT_FAILURE, "permission denied (shell).");
307	} else if (pwd->pw_shell && *pwd->pw_shell) {
308		shell = pwd->pw_shell;
309		iscsh = UNSET;
310	} else {
311		shell = _PATH_BSHELL;
312		iscsh = NO;
313	}
314
315	if ((p = strrchr(shell, '/')) != NULL)
316		avshell = p+1;
317	else
318		avshell = shell;
319
320	/* if we're forking a csh, we want to slightly muck the args */
321	if (iscsh == UNSET)
322		iscsh = strstr(avshell, "csh") ? YES : NO;
323
324	/* set permissions */
325#ifdef LOGIN_CAP
326# ifdef ALLOW_GROUP_CHANGE
327	/* if we aren't changing users, keep the current group members */
328	if (ruid != pwd->pw_uid &&
329	    setusercontext(lc, pwd, pwd->pw_uid, LOGIN_SETGROUP) == -1)
330		err(EXIT_FAILURE, "setting user context");
331
332	addgroup(lc, gname, pwd, ruid, GROUP_PASSWORD);
333
334	if (setusercontext(lc, pwd, pwd->pw_uid,
335		(u_int)(asthem ? (LOGIN_SETPRIORITY | LOGIN_SETUMASK) : 0) |
336		LOGIN_SETRESOURCES | LOGIN_SETUSER) == -1)
337		err(EXIT_FAILURE, "setting user context");
338# else
339	if (setusercontext(lc, pwd, pwd->pw_uid,
340		(u_int)(asthem ? (LOGIN_SETPRIORITY | LOGIN_SETUMASK) : 0) |
341		LOGIN_SETRESOURCES | LOGIN_SETGROUP | LOGIN_SETUSER) == -1)
342		err(EXIT_FAILURE, "setting user context");
343# endif
344#else
345	if (setgid(pwd->pw_gid) == -1)
346		err(EXIT_FAILURE, "setgid");
347	/* if we aren't changing users, keep the current group members */
348	if (ruid != pwd->pw_uid && initgroups(user, pwd->pw_gid) != 0)
349		errx(EXIT_FAILURE, "initgroups failed");
350# ifdef ALLOW_GROUP_CHANGE
351	addgroup(/*EMPTY*/, gname, pwd, ruid, GROUP_PASSWORD);
352# endif
353	if (setuid(pwd->pw_uid) == -1)
354		err(EXIT_FAILURE, "setuid");
355#endif
356
357	if (!asme) {
358		if (asthem) {
359			p = getenv("TERM");
360			/* Create an empty environment */
361			environ = emalloc(sizeof(char *));
362			environ[0] = NULL;
363#ifdef LOGIN_CAP
364			if (setusercontext(lc, pwd, pwd->pw_uid,
365				LOGIN_SETPATH) == -1)
366				err(EXIT_FAILURE, "setting user context");
367#else
368			(void)setenv("PATH", _PATH_DEFPATH, 1);
369#endif
370			if (p)
371				(void)setenv("TERM", p, 1);
372			if (gohome && chdir(pwd->pw_dir) == -1)
373				errx(EXIT_FAILURE, "no directory");
374		}
375
376		if (asthem || pwd->pw_uid) {
377			(void)setenv("LOGNAME", pwd->pw_name, 1);
378			(void)setenv("USER", pwd->pw_name, 1);
379		}
380		(void)setenv("HOME", pwd->pw_dir, 1);
381		(void)setenv("SHELL", shell, 1);
382	}
383	(void)setenv("SU_FROM", username, 1);
384
385	if (iscsh == YES) {
386		if (fastlogin)
387			*np-- = __UNCONST("-f");
388		if (asme)
389			*np-- = __UNCONST("-m");
390	} else {
391		if (fastlogin)
392			(void)unsetenv("ENV");
393	}
394
395	if (asthem) {
396		avshellbuf[0] = '-';
397		(void)estrlcpy(avshellbuf + 1, avshell, sizeof(avshellbuf) - 1);
398		avshell = avshellbuf;
399	} else if (iscsh == YES) {
400		/* csh strips the first character... */
401		avshellbuf[0] = '_';
402		(void)estrlcpy(avshellbuf + 1, avshell, sizeof(avshellbuf) - 1);
403		avshell = avshellbuf;
404	}
405	*np = __UNCONST(avshell);
406
407#ifdef BSD4_4
408	if (pwd->pw_change || pwd->pw_expire)
409		(void)gettimeofday(&tp, NULL);
410	if (pwd->pw_change) {
411		if (tp.tv_sec >= pwd->pw_change) {
412			(void)printf("%s -- %s's password has expired.\n",
413				     (ruid ? "Sorry" : "Note"), user);
414			if (ruid != 0)
415				exit(EXIT_FAILURE);
416		} else if (pwd->pw_change - tp.tv_sec < pw_warntime)
417			(void)printf("Warning: %s's password expires on %s",
418				     user, ctime(&pwd->pw_change));
419	}
420	if (pwd->pw_expire) {
421		if (tp.tv_sec >= pwd->pw_expire) {
422			(void)printf("%s -- %s's account has expired.\n",
423				     (ruid ? "Sorry" : "Note"), user);
424			if (ruid != 0)
425				exit(EXIT_FAILURE);
426		} else if (pwd->pw_expire - tp.tv_sec <
427		    _PASSWORD_WARNDAYS * SECSPERDAY)
428			(void)printf("Warning: %s's account expires on %s",
429				     user, ctime(&pwd->pw_expire));
430	}
431#endif
432	if (ruid != 0)
433		syslog(LOG_NOTICE, "%s to %s%s",
434		    username, pwd->pw_name, ontty());
435
436	/* Raise our priority back to what we had before */
437	(void)setpriority(PRIO_PROCESS, 0, prio);
438
439	(void)execv(shell, np);
440	err(EXIT_FAILURE, "%s", shell);
441	/* NOTREACHED */
442}
443
444
445#ifdef KERBEROS5
446static int
447kerberos5(char *username, const char *user, uid_t uid)
448{
449	krb5_error_code ret;
450	krb5_context context;
451	krb5_principal princ = NULL;
452	krb5_ccache ccache, ccache2;
453	char *cc_name;
454	const char *filename;
455
456	ret = krb5_init_context(&context);
457	if (ret)
458		return 1;
459
460	if (strcmp(user, "root") == 0)
461		ret = krb5_make_principal(context, &princ,
462					  NULL, username, "root", NULL);
463	else
464		ret = krb5_make_principal(context, &princ,
465					  NULL, user, NULL);
466	if (ret)
467		goto fail;
468	if (!krb5_kuserok(context, princ, user) && !uid) {
469		warnx("kerberos5: not in %s's ACL.", user);
470		goto fail;
471	}
472	ret = krb5_cc_new_unique(context, krb5_mcc_ops.prefix, NULL, &ccache);
473	if (ret)
474		goto fail;
475	ret = krb5_verify_user_lrealm(context, princ, ccache, NULL, TRUE,
476				      NULL);
477	if (ret) {
478		krb5_cc_destroy(context, ccache);
479		switch (ret) {
480		case KRB5_LIBOS_PWDINTR :
481			break;
482		case KRB5KRB_AP_ERR_BAD_INTEGRITY:
483		case KRB5KRB_AP_ERR_MODIFIED:
484			krb5_warnx(context, "Password incorrect");
485			break;
486		default :
487			krb5_warn(context, ret, "krb5_verify_user");
488			break;
489		}
490		goto fail;
491	}
492	ret = krb5_cc_new_unique(context, krb5_mcc_ops.prefix, NULL, &ccache2);
493	if (ret) {
494		krb5_cc_destroy(context, ccache);
495		goto fail;
496	}
497	ret = krb5_cc_copy_cache(context, ccache, ccache2);
498	if (ret) {
499		krb5_cc_destroy(context, ccache);
500		krb5_cc_destroy(context, ccache2);
501		goto fail;
502	}
503
504	filename = krb5_cc_get_name(context, ccache2);
505	(void)easprintf(&cc_name, "%s:%s", krb5_cc_get_type(context, ccache2),
506		 filename);
507	if (chown(filename, uid, NOGROUP) == -1) {
508		warn("chown %s", filename);
509		free(cc_name);
510		krb5_cc_destroy(context, ccache);
511		krb5_cc_destroy(context, ccache2);
512		goto fail;
513	}
514
515	(void)setenv("KRB5CCNAME", cc_name, 1);
516	free(cc_name);
517	krb5_cc_close(context, ccache2);
518	krb5_cc_destroy(context, ccache);
519	return 0;
520
521 fail:
522	if (princ != NULL)
523		krb5_free_principal(context, princ);
524	krb5_free_context(context);
525	return 1;
526}
527#endif /* KERBEROS5 */
528
529static int
530check_ingroup(int gid, const char *gname, const char *user, int ifempty)
531{
532	struct group *gr;
533	char **g;
534#ifdef SU_INDIRECT_GROUP
535	char **gr_mem;
536	int n = 0;
537	int i = 0;
538#endif
539	int ok = 0;
540
541	if (gname == NULL)
542		gr = getgrgid((gid_t) gid);
543	else
544		gr = getgrnam(gname);
545
546	/*
547	 * XXX we are relying on the fact that we only set ifempty when
548	 * calling to check for SU_GROUP and that is the only time a
549	 * missing group is acceptable.
550	 */
551	if (gr == NULL)
552		return ifempty;
553	if (!*gr->gr_mem)		/* empty */
554		return ifempty;
555
556	/*
557	 * Ok, first see if user is in gr_mem
558	 */
559	for (g = gr->gr_mem; *g; ++g) {
560		if (strcmp(*g, user) == 0)
561			return 1;	/* ok */
562#ifdef SU_INDIRECT_GROUP
563		++n;			/* count them */
564#endif
565	}
566#ifdef SU_INDIRECT_GROUP
567	/*
568	 * No.
569	 * Now we need to duplicate the gr_mem list, and recurse for
570	 * each member to see if it is a group, and if so whether user is
571	 * in it.
572	 */
573	gr_mem = NULL;
574	ereallocarr(&gr_mem, n + 1, sizeof(char *));
575	for (g = gr->gr_mem, i = 0; *g; ++g) {
576		gr_mem[i] = estrdup(*g);
577		i++;
578	}
579	gr_mem[i++] = NULL;
580
581	for (g = gr_mem; ok == 0 && *g; ++g) {
582		/*
583		 * If we get this far we don't accept empty/missing groups.
584		 */
585		ok = check_ingroup(-1, *g, user, 0);
586	}
587	for (g = gr_mem; *g; ++g) {
588		free(*g);
589	}
590	free(gr_mem);
591#endif
592	return ok;
593}
594