1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
|
/*
Copyright (C) Andrew Tridgell 2009
Copyright (c) 2011 Andreas Schneider <asn@samba.org>
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#ifdef _SAMBA_BUILD_
#define UID_WRAPPER_NOT_REPLACE
#include "replace.h"
#include "system/passwd.h"
#include <talloc.h>
#include "../lib/util/setid.h"
#else /* _SAMBA_BUILD_ */
#error uid_wrapper_only_supported_in_samba_yet
#endif
#ifndef _PUBLIC_
#define _PUBLIC_
#endif
/*
we keep the virtualised euid/egid/groups information here
*/
static struct {
bool initialised;
bool enabled;
uid_t myuid;
uid_t euid;
uid_t mygid;
gid_t egid;
gid_t *groups;
} uwrap;
static void uwrap_init(void)
{
if (uwrap.initialised) return;
uwrap.initialised = true;
if (getenv("UID_WRAPPER")) {
uwrap.enabled = true;
/* put us in one group */
uwrap.myuid = uwrap.euid = geteuid();
uwrap.mygid = uwrap.egid = getegid();
uwrap.groups = talloc_array(NULL, gid_t, 1);
uwrap.groups[0] = 0;
}
}
#undef uwrap_enabled
_PUBLIC_ int uwrap_enabled(void)
{
uwrap_init();
return uwrap.enabled?1:0;
}
#ifdef HAVE_SETEUID
_PUBLIC_ int uwrap_seteuid(uid_t euid)
{
uwrap_init();
if (!uwrap.enabled) {
return samba_seteuid(euid);
}
/* assume for now that the ruid stays as root */
if (euid == 0) {
uwrap.euid = uwrap.myuid;
} else {
uwrap.euid = euid;
}
return 0;
}
#endif
#ifdef HAVE_SETREUID
_PUBLIC_ int uwrap_setreuid(uid_t ruid, uid_t euid)
{
uwrap_init();
if (!uwrap.enabled) {
return samba_setreuid(ruid, euid);
}
/* assume for now that the ruid stays as root */
if (euid == 0) {
uwrap.euid = uwrap.myuid;
} else {
uwrap.euid = euid;
}
return 0;
}
#endif
#ifdef HAVE_SETRESUID
_PUBLIC_ int uwrap_setresuid(uid_t ruid, uid_t euid, uid_t suid)
{
uwrap_init();
if (!uwrap.enabled) {
return samba_setresuid(ruid, euid, suid);
}
/* assume for now that the ruid stays as root */
if (euid == 0) {
uwrap.euid = uwrap.myuid;
} else {
uwrap.euid = euid;
}
return 0;
}
#endif
_PUBLIC_ uid_t uwrap_geteuid(void)
{
uwrap_init();
if (!uwrap.enabled) {
return geteuid();
}
return uwrap.euid;
}
#ifdef HAVE_SETEGID
_PUBLIC_ int uwrap_setegid(gid_t egid)
{
uwrap_init();
if (!uwrap.enabled) {
return samba_setegid(egid);
}
/* assume for now that the ruid stays as root */
if (egid == 0) {
uwrap.egid = uwrap.mygid;
} else {
uwrap.egid = egid;
}
return 0;
}
#endif
#ifdef HAVE_SETREGID
_PUBLIC_ int uwrap_setregid(gid_t rgid, gid_t egid)
{
uwrap_init();
if (!uwrap.enabled) {
return samba_setregid(rgid, egid);
}
/* assume for now that the ruid stays as root */
if (egid == 0) {
uwrap.egid = uwrap.mygid;
} else {
uwrap.egid = egid;
}
return 0;
}
#endif
#ifdef HAVE_SETRESGID
_PUBLIC_ int uwrap_setresgid(gid_t rgid, gid_t egid, gid_t sgid)
{
uwrap_init();
if (!uwrap.enabled) {
return samba_setresgid(rgid, egid, sgid);
}
/* assume for now that the ruid stays as root */
if (egid == 0) {
uwrap.egid = uwrap.mygid;
} else {
uwrap.egid = egid;
}
return 0;
}
#endif
_PUBLIC_ uid_t uwrap_getegid(void)
{
uwrap_init();
if (!uwrap.enabled) {
return getegid();
}
return uwrap.egid;
}
_PUBLIC_ int uwrap_setgroups(size_t size, const gid_t *list)
{
uwrap_init();
if (!uwrap.enabled) {
return samba_setgroups(size, list);
}
talloc_free(uwrap.groups);
uwrap.groups = NULL;
if (size != 0) {
uwrap.groups = talloc_array(NULL, gid_t, size);
if (uwrap.groups == NULL) {
errno = ENOMEM;
return -1;
}
memcpy(uwrap.groups, list, size*sizeof(gid_t));
}
return 0;
}
_PUBLIC_ int uwrap_getgroups(int size, gid_t *list)
{
size_t ngroups;
uwrap_init();
if (!uwrap.enabled) {
return getgroups(size, list);
}
ngroups = talloc_array_length(uwrap.groups);
if (size > ngroups) {
size = ngroups;
}
if (size == 0) {
return ngroups;
}
if (size < ngroups) {
errno = EINVAL;
return -1;
}
memcpy(list, uwrap.groups, size*sizeof(gid_t));
return ngroups;
}
_PUBLIC_ uid_t uwrap_getuid(void)
{
uwrap_init();
if (!uwrap.enabled) {
return getuid();
}
/* we don't simulate ruid changing */
return 0;
}
_PUBLIC_ gid_t uwrap_getgid(void)
{
uwrap_init();
if (!uwrap.enabled) {
return getgid();
}
/* we don't simulate rgid changing */
return 0;
}
|
