Initial revision

[become] / src / become.c

/* -*-c-*-
 *
 * $Id: become.c,v 1.1 1997/07/21 13:47:54 mdw Exp $
 *
 * Main code for `become'
 *
 * (c) 1997 EBI
 */

/*----- Licencing notice --------------------------------------------------*
 *
 * This file is part of `become'
 *
 * `Become' is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * `Become' is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with `become'; if not, write to the Free Software
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */

/*----- Revision history --------------------------------------------------*
 *
 * $Log: become.c,v $
 * Revision 1.1  1997/07/21 13:47:54  mdw
 * Initial revision
 *
 */

/*----- Header files ------------------------------------------------------*/

/* --- ANSI headers --- */

#include <ctype.h>
#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

/* --- Unix headers --- */

#include <sys/types.h>
#include <sys/stat.h>
#include <sys/socket.h>
#include <sys/utsname.h>

#include <netinet/in.h>

#include <arpa/inet.h>

#include <netdb.h>
#include <pwd.h>
#include <syslog.h>
#include <unistd.h>

/* --- Local headers --- */

#include "become.h"
#include "config.h"
#include "check.h"
#include "daemon.h"
#include "lexer.h"
#include "mdwopt.h"
#include "name.h"
#include "parser.h"
#include "rule.h"
#include "utils.h"

/*----- Main code ---------------------------------------------------------*/

/* --- @bc__write@ --- *
 *
 * Arguments:	@FILE *fp@ = pointer to a stream to write on
 *		@const char *p@ = pointer to a string
 *
 * Returns:	---
 *
 * Use:		Writes the string to the stream, substituting the program
 *		name (as returned by @quis@) for each occurrence of the
 *		character `$'.
 */

static void bc__write(FILE *fp, const char *p)
{
  const char *n = quis();
  size_t l;
  size_t nl = strlen(n);

  /* --- Try to be a little efficient --- *
   *
   * Gather up non-`$' characters using @strcpn@ and spew them out really
   * quickly.
   */

  for (;;) {
    l = strcspn(p, "$");
    if (l)
      fwrite(p, l, 1, fp);
    p += l;
    if (!*p)
      break;
    fwrite(n, nl, 1, fp);
    p++;
  }
}

/* --- @bc__banner@ --- *
 *
 * Arguments:	@FILE *fp@ = stream to write on
 *
 * Returns:	---
 *
 * Use:		Writes a banner containing copyright information.
 */

static void bc__banner(FILE *fp)
{
  bc__write(fp, "$ version " VERSION "\n");
}

/* --- @bc__usage@ --- *
 *
 * Arguments:	@FILE *fp@ = stream to write on
 *
 * Returns:	---
 *
 * Use:		Writes a terse reminder of command line syntax.
 */

static void bc__usage(FILE *fp)
{
  bc__write(fp,
	    "Usage: \n"
	    "	$ -c <shell-command> <user>\n"
	    "	$ <user> [<command> [<arguments>]...]\n"
	    "	$ -d [-p <port>] [-f <config-file>]\n");
}

/* --- @bc__help@ --- *
 *
 * Arguments:	@FILE *fp@ = stream to write on
 *
 * Returns:	---
 *
 * Use:		Displays a help message for this excellent piece of software.
 */

static void bc__help(FILE *fp)
{
  bc__banner(fp);
  putc('\n', fp);
  bc__usage(fp);
  putc('\n', fp);
  bc__write(fp,
"The `$' program allows you to run a process as another user.\n"
"If a command name is given, this is the process executed.  If the `-c'\n"
"option is used, the process is assumed to be `/bin/sh'.  If no command is\n"
"given, your default login shell is used.\n"
"\n"
"Your user id, the user id you wish to become, the name of the process\n"
"you wish to run, and the identity of the current host are looked up to\n"
"ensure that you have permission to do this.\n"
"\n"
"Note that logs are kept of all uses of this program.\n"
"\n"
"Options available are:\n"
"\n"
"-h, --help		Display this help text\n"
"-v, --version		Display the version number of this copy of $\n"
"-c, --command=CMD	Run the (Bourne) shell command CMD\n"
"-d, --daemon		Start up a daemon, to accept requests from clients\n"
"-p, --port=PORT		In daemon mode, listen on PORT\n"
"-f, --config-file=FILE	In daemon mode, read config from FILE\n"
"--yacc-debug		Dump lots of parser diagnostics (boring)\n");
}

/* --- @main@ --- *
 *
 * Arguments:	@int argc@ = number of command line arguments
 *		@char *argv[]@ = pointer to the various arguments
 *
 * Returns:	Zero if successful.
 *
 * Use:		Allows a user to change UID.
 */

int main(int argc, char *argv[])
{
  char *cmd = 0;
  static char *shell[] = { "/bin/sh", "-c", 0, 0 };
  char **todo;
  request rq;
  char buff[CMDLEN_MAX];
  char *conffile = file_RULES;
  int port = -1;

  enum {
    f_daemon = 1,
    f_duff = 2
  };

  unsigned flags = 0;

  /* --- Set up the program name --- */

  ego(argv[0]);

  /* --- Parse some command line arguments --- */

  for (;;) {
    int i;
    struct option opts[] = {
      { "help",		0,		0,	'h' },
      { "version",	0,		0,	'v' },
      { "command",	gFlag_argReq,	0,	'c' },
      { "daemon",	0,		0,	'd' },
      { "port",		gFlag_argReq,	0,	'p' },
      { "config-file",	gFlag_argReq,	0,	'f' },
      { "yacc-debug",	0,		0,	'Y' },
      { 0,		0,		0,	0 }
    };

    i = mdwopt(argc, argv, "hvc:p:df:", opts, 0, 0, 0);
    if (i < 0)
      break;

    switch (i) {
      case 'h':
	bc__help(stdout);
	exit(0);
	break;
      case 'v':
	bc__banner(stdout);
	exit(0);
	break;
      case 'c':
	cmd = optarg;
	break;
      case 'p':
	port = atoi(optarg);
	break;
      case 'd':
	flags |= f_daemon;
	break;
      case 'f':
	conffile = optarg;
	break;
      case 'Y':
	if (getuid() == geteuid())
	  yydebug = 1;
	else
	  moan("won't set debugging mode when running setuid");
	break;
      case '?':
	flags |= f_duff;
	break;
    }
  }
  if (flags & f_duff) {
    bc__usage(stderr);
    exit(1);
  }

  /* --- Switch to daemon mode if requested --- */

  if (flags & f_daemon) {
    daemon_init(conffile, port);
    exit(0);
  }

  /* --- Open a syslog --- */

  openlog(quis(), 0, LOG_AUTH);

  /* --- Pick out the uid --- */

  {
    const char *u;
    struct passwd *pw;
    if (optind >= argc) {
      bc__usage(stderr);
      exit(1);
    }
    u = argv[optind++];
    pw = getpwnam(u);
    if (!pw && isdigit(u[0]))
      pw = getpwuid(atoi(u));
    if (!pw)
      die("unknown user `%s'", u);
    rq.to = pw->pw_uid;
  }

  /* --- Fill in the easy bits of the request --- */

  rq.from = getuid();

  /* --- Find the local host address --- */

  {
    struct utsname u;
    struct hostent *he;
    uname(&u);
    if ((he = gethostbyname(u.nodename)) == 0)
      die("who am I? (can't resolve `%s')", u.nodename);
    memcpy(&rq.host, he->h_addr, sizeof(struct in_addr));
  }

  /* --- Figure out what command to use --- */

  if (cmd) {
    shell[2] = cmd;
    todo = shell;
  } else if (optind < argc) {
    todo = argv + optind;
  } else {
    struct passwd *pw = getpwuid(rq.from);
    if (!pw)
      die("who are you? (can't find uid %li in database)", (long)rq.from);
    shell[0] = pw->pw_shell;
    shell[1] = 0;
    todo = shell;
  }

  /* --- If necessary, resolve the path to the command --- */

  if (!strchr(todo[0], '/')) {
    char *path;
    char *p;
    struct stat st;
    size_t sz;

    if ((p = getenv("PATH")) == 0)
      p = "/bin:/usr/bin";
    sz = strlen(p) + 1;
    memcpy(path = xmalloc(sz), p, sz);

    for (p = strtok(path, ":"); (p = strtok(0, ":")) != 0; ) {

      /* --- SECURITY: check length of string before copying --- */

      if (strlen(p) + strlen(todo[0]) + 2 > sizeof(buff))
	continue;

      /* --- Now build the pathname and check it --- */

      sprintf(buff, "%s/%s", p, todo[0]);
      if (stat(buff, &st) == 0 &&	/* Check it exists */
	  st.st_mode & 0111 &&		/* Check it's executable */
	  (st.st_mode & S_IFMT) == S_IFREG) /* Check it's a file */
	break;
    }

    if (!p)
      die("couldn't find `%s' in path", todo[0]);
    todo[0] = buff;
    free(path);
  }

  /* --- Canonicalise the path string, if necessary --- */

  {
    char b[CMDLEN_MAX];
    char *p;
    const char *q;

    /* --- Insert current directory name if path not absolute --- */

    p = b;
    q = todo[0];
    if (*q != '/') {
      if (!getcwd(b, sizeof(b)))
	die("couldn't read current directory: %s", strerror(errno));
      p += strlen(p);
      *p++ = '/';
    }

    /* --- Now copy over characters from the path string --- */

    while (*q) {

      /* --- SECURITY: check for buffer overflows here --- *
       *
       * I write at most one byte per iteration so this is OK.  Remember to
       * allow one for the null byte.
       */

      if (p >= b + sizeof(b) - 1)
	die("buffer overflow -- bad things happened");

      /* --- Reduce multiple slashes to just one --- */

      if (*q == '/') {
	while (*q == '/')
	  q++;
	*p++ = '/';
      }

      /* --- Handle dots in filenames --- *
       *
       * @p[-1]@ is valid here, because if @*q@ is not a `/' then either
       * we've just stuck the current directory on the end of the buffer,
       * or we've just put something else on the end.
       */

      else if (*q == '.' && p[-1] == '/') {

	/* --- A simple `./' just gets removed --- */

	if (q[1] == 0 || q[1] == '/') {
	  q++;
	  p--;
	  continue;
	}

	/* --- A `../' needs to be peeled back to the previous `/' --- */

	if (q[1] == '.' && (q[2] == 0 || q[2] == '/')) {
	  q += 2;
	  p--;
	  while (p > b && p[-1] != '/')
	    p--;
	  if (p > b)
	    p--;
	  continue;
	}
      } else
	*p++ = *q++;
    }

    *p++ = 0;
    strcpy(rq.cmd, b);
  }

  /* --- Run the check --- */

  {
    int a = check(&rq);
    char from[16], to[16];
    struct passwd *pw;

    if ((pw = getpwuid(rq.from)) != 0)
      sprintf(from, "%.15s", pw->pw_name);
    else
      sprintf(from, "user %lu", (unsigned long)rq.from);

    if ((pw = getpwuid(rq.to)) != 0)
      sprintf(to, "%.15s", pw->pw_name);
    else
      sprintf(to, "user %lu", (unsigned long)rq.to);

    syslog(LOG_INFO,
	   "permission %s for %s to become %s to run `%s'",
	   a ? "granted" : "denied", from, to, rq.cmd);

    if (!a)
      die("permission denied");
  }

  /* --- Now do the job --- */

#ifdef TEST_RIG
  printf("ok\n");
  return (0);
#else
  if (setuid(rq.to) == -1 || seteuid(rq.to) == -1)
    die("couldn't set uid: %s", strerror(errno));
  execv(rq.cmd, todo);
  die("couldn't exec `%s': %s", rq.cmd, strerror(errno));
  return (127);
#endif
}

/*----- That's all, folks -------------------------------------------------*/