xref: /freebsd/contrib/openbsm/bin/auditdistd/sandbox.c (revision 389e4940069316fe667ffa263fa7d6390d0a960f)
1 /*-
2  * Copyright (c) 2012 The FreeBSD Foundation
3  * All rights reserved.
4  *
5  * This software was developed by Pawel Jakub Dawidek under sponsorship from
6  * the FreeBSD Foundation.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  */
29 
30 #include <config/config.h>
31 
32 #include <sys/param.h>
33 #ifdef HAVE_JAIL
34 #include <sys/jail.h>
35 #endif
36 #ifdef HAVE_CAP_ENTER
37 #include <sys/capsicum.h>
38 #endif
39 
40 #include <errno.h>
41 #include <pwd.h>
42 #include <stdarg.h>
43 #include <stdbool.h>
44 #include <stdio.h>
45 #include <stdlib.h>
46 #include <strings.h>
47 #include <unistd.h>
48 
49 #include "pjdlog.h"
50 #include "sandbox.h"
51 
52 static int
53 groups_compare(const void *grp0, const void *grp1)
54 {
55 	gid_t gr0 = *(const gid_t *)grp0;
56 	gid_t gr1 = *(const gid_t *)grp1;
57 
58 	return (gr0 <= gr1 ? (gr0 < gr1 ? -1 : 0) : 1);
59 
60 }
61 
62 int
63 sandbox(const char *user, bool capsicum, const char *fmt, ...)
64 {
65 #ifdef HAVE_JAIL
66 	struct jail jailst;
67 	char *jailhost;
68 	va_list ap;
69 #endif
70 	struct passwd *pw;
71 	uid_t ruid, euid;
72 	gid_t rgid, egid;
73 #ifdef HAVE_GETRESUID
74 	uid_t suid;
75 #endif
76 #ifdef HAVE_GETRESGID
77 	gid_t sgid;
78 #endif
79 	gid_t *groups, *ggroups;
80 	bool jailed;
81 	int ngroups, ret;
82 
83 	PJDLOG_ASSERT(user != NULL);
84 	PJDLOG_ASSERT(fmt != NULL);
85 
86 	ret = -1;
87 	groups = NULL;
88 	ggroups = NULL;
89 
90 	/*
91 	 * According to getpwnam(3) we have to clear errno before calling the
92 	 * function to be able to distinguish between an error and missing
93 	 * entry (with is not treated as error by getpwnam(3)).
94 	 */
95 	errno = 0;
96 	pw = getpwnam(user);
97 	if (pw == NULL) {
98 		if (errno != 0) {
99 			pjdlog_errno(LOG_ERR,
100 			    "Unable to find info about '%s' user", user);
101 			goto out;
102 		} else {
103 			pjdlog_error("'%s' user doesn't exist.", user);
104 			errno = ENOENT;
105 			goto out;
106 		}
107 	}
108 
109 	ngroups = sysconf(_SC_NGROUPS_MAX);
110 	if (ngroups == -1) {
111 		pjdlog_errno(LOG_WARNING,
112 		    "Unable to obtain maximum number of groups");
113 		ngroups = NGROUPS_MAX;
114 	}
115 	ngroups++;	/* For base gid. */
116 	groups = malloc(sizeof(groups[0]) * ngroups);
117 	if (groups == NULL) {
118 		pjdlog_error("Unable to allocate memory for %d groups.",
119 		    ngroups);
120 		goto out;
121 	}
122 	if (getgrouplist(user, pw->pw_gid, groups, &ngroups) == -1) {
123 		pjdlog_error("Unable to obtain groups of user %s.", user);
124 		goto out;
125 	}
126 
127 #ifdef HAVE_JAIL
128 	va_start(ap, fmt);
129 	(void)vasprintf(&jailhost, fmt, ap);
130 	va_end(ap);
131 	if (jailhost == NULL) {
132 		pjdlog_error("Unable to allocate memory for jail host name.");
133 		goto out;
134 	}
135 	bzero(&jailst, sizeof(jailst));
136 	jailst.version = JAIL_API_VERSION;
137 	jailst.path = pw->pw_dir;
138 	jailst.hostname = jailhost;
139 	if (jail(&jailst) >= 0) {
140 		jailed = true;
141 	} else {
142 		jailed = false;
143 		pjdlog_errno(LOG_WARNING,
144 		    "Unable to jail to directory %s", pw->pw_dir);
145 	}
146 	free(jailhost);
147 #else	/* !HAVE_JAIL */
148 	jailed = false;
149 #endif	/* !HAVE_JAIL */
150 
151 	if (!jailed) {
152 		if (chroot(pw->pw_dir) == -1) {
153 			pjdlog_errno(LOG_ERR,
154 			    "Unable to change root directory to %s",
155 			    pw->pw_dir);
156 			goto out;
157 		}
158 	}
159 	PJDLOG_VERIFY(chdir("/") == 0);
160 
161 	if (setgroups(ngroups, groups) == -1) {
162 		pjdlog_errno(LOG_ERR, "Unable to set groups");
163 		goto out;
164 	}
165 	if (setgid(pw->pw_gid) == -1) {
166 		pjdlog_errno(LOG_ERR, "Unable to set gid to %u",
167 		    (unsigned int)pw->pw_gid);
168 		goto out;
169 	}
170 	if (setuid(pw->pw_uid) == -1) {
171 		pjdlog_errno(LOG_ERR, "Unable to set uid to %u",
172 		    (unsigned int)pw->pw_uid);
173 		goto out;
174 	}
175 
176 #ifdef HAVE_CAP_ENTER
177 	if (capsicum) {
178 		capsicum = (cap_enter() == 0);
179 		if (!capsicum) {
180 			pjdlog_common(LOG_DEBUG, 1, errno,
181 			    "Unable to sandbox using capsicum");
182 		}
183 	}
184 #else	/* !HAVE_CAP_ENTER */
185 	capsicum = false;
186 #endif	/* !HAVE_CAP_ENTER */
187 
188 	/*
189 	 * Better be sure that everything succeeded.
190 	 */
191 #ifdef HAVE_GETRESUID
192 	PJDLOG_VERIFY(getresuid(&ruid, &euid, &suid) == 0);
193 	PJDLOG_VERIFY(suid == pw->pw_uid);
194 #else
195 	ruid = getuid();
196 	euid = geteuid();
197 #endif
198 	PJDLOG_VERIFY(ruid == pw->pw_uid);
199 	PJDLOG_VERIFY(euid == pw->pw_uid);
200 #ifdef HAVE_GETRESGID
201 	PJDLOG_VERIFY(getresgid(&rgid, &egid, &sgid) == 0);
202 	PJDLOG_VERIFY(sgid == pw->pw_gid);
203 #else
204 	rgid = getgid();
205 	egid = getegid();
206 #endif
207 	PJDLOG_VERIFY(rgid == pw->pw_gid);
208 	PJDLOG_VERIFY(egid == pw->pw_gid);
209 	PJDLOG_VERIFY(getgroups(0, NULL) == ngroups);
210 	ggroups = malloc(sizeof(ggroups[0]) * ngroups);
211 	if (ggroups == NULL) {
212 		pjdlog_error("Unable to allocate memory for %d groups.",
213 		    ngroups);
214 		goto out;
215 	}
216 	PJDLOG_VERIFY(getgroups(ngroups, ggroups) == ngroups);
217 	qsort(groups, (size_t)ngroups, sizeof(groups[0]), groups_compare);
218 	qsort(ggroups, (size_t)ngroups, sizeof(ggroups[0]), groups_compare);
219 	PJDLOG_VERIFY(bcmp(groups, ggroups, sizeof(groups[0]) * ngroups) == 0);
220 
221 	pjdlog_debug(1,
222 	    "Privileges successfully dropped using %s%s+setgid+setuid.",
223 	    capsicum ? "capsicum+" : "", jailed ? "jail" : "chroot");
224 
225 	ret = 0;
226 out:
227 	if (groups != NULL)
228 		free(groups);
229 	if (ggroups != NULL)
230 		free(ggroups);
231 	return (ret);
232 }
233