summaryrefslogtreecommitdiff
path: root/src/providers/krb5/krb5_become_user.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/providers/krb5/krb5_become_user.c')
-rw-r--r--src/providers/krb5/krb5_become_user.c33
1 files changed, 18 insertions, 15 deletions
diff --git a/src/providers/krb5/krb5_become_user.c b/src/providers/krb5/krb5_become_user.c
index 082d1415..70bc5630 100644
--- a/src/providers/krb5/krb5_become_user.c
+++ b/src/providers/krb5/krb5_become_user.c
@@ -22,45 +22,48 @@
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
-#include <sys/types.h>
-#include <unistd.h>
-
#include "util/util.h"
+#include <grp.h>
errno_t become_user(uid_t uid, gid_t gid)
{
+ uid_t cuid;
int ret;
DEBUG(SSSDBG_FUNC_DATA, ("Trying to become user [%d][%d].\n", uid, gid));
- ret = setgid(gid);
- if (ret == -1) {
- ret = errno;
- DEBUG(SSSDBG_CRIT_FAILURE,
- ("setgid failed [%d][%s].\n", ret, strerror(ret)));
- return ret;
+
+ /* skip call if we already are the requested user */
+ cuid = geteuid();
+ if (uid == cuid) {
+ DEBUG(SSSDBG_FUNC_DATA, ("Already user [%d].\n", uid));
+ return EOK;
}
- ret = setuid(uid);
+ /* drop supplmentary groups first */
+ ret = setgroups(0, NULL);
if (ret == -1) {
ret = errno;
DEBUG(SSSDBG_CRIT_FAILURE,
- ("setuid failed [%d][%s].\n", ret, strerror(ret)));
+ ("setgroups failed [%d][%s].\n", ret, strerror(ret)));
return ret;
}
- ret = setegid(gid);
+ /* change gid so that root cannot be regained (changes saved gid too) */
+ ret = setresgid(gid, gid, gid);
if (ret == -1) {
ret = errno;
DEBUG(SSSDBG_CRIT_FAILURE,
- ("setegid failed [%d][%s].\n", ret, strerror(ret)));
+ ("setresgid failed [%d][%s].\n", ret, strerror(ret)));
return ret;
}
- ret = seteuid(uid);
+ /* change uid so that root cannot be regained (changes saved uid too) */
+ /* this call also takes care of dropping CAP_SETUID, so this is a PNR */
+ ret = setresuid(uid, uid, uid);
if (ret == -1) {
ret = errno;
DEBUG(SSSDBG_CRIT_FAILURE,
- ("seteuid failed [%d][%s].\n", ret, strerror(ret)));
+ ("setresuid failed [%d][%s].\n", ret, strerror(ret)));
return ret;
}