1 /*- 2 * Copyright (c) 2002-2003 Networks Associates Technology, Inc. 3 * Copyright (c) 2004-2011 Dag-Erling Smørgrav 4 * All rights reserved. 5 * 6 * This software was developed for the FreeBSD Project by ThinkSec AS and 7 * Network Associates Laboratories, the Security Research Division of 8 * Network Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 9 * ("CBOSS"), as part of the DARPA CHATS research program. 10 * 11 * Redistribution and use in source and binary forms, with or without 12 * modification, are permitted provided that the following conditions 13 * are met: 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in the 18 * documentation and/or other materials provided with the distribution. 19 * 3. The name of the author may not be used to endorse or promote 20 * products derived from this software without specific prior written 21 * permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 26 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33 * SUCH DAMAGE. 34 * 35 * $Id: su.c 648 2013-03-05 17:54:27Z des $ 36 */ 37 38 #ifdef HAVE_CONFIG_H 39 # include "config.h" 40 #endif 41 42 #include <sys/param.h> 43 #include <sys/wait.h> 44 45 #include <err.h> 46 #include <grp.h> 47 #include <pwd.h> 48 #include <stdio.h> 49 #include <stdlib.h> 50 #include <string.h> 51 #include <syslog.h> 52 #include <unistd.h> 53 54 #include <security/pam_appl.h> 55 #include <security/openpam.h> /* for openpam_ttyconv() */ 56 57 extern char **environ; 58 59 static pam_handle_t *pamh; 60 static struct pam_conv pamc; 61 62 static void 63 usage(void) 64 { 65 66 fprintf(stderr, "usage: su [login [args]]\n"); 67 exit(1); 68 } 69 70 int 71 main(int argc, char *argv[]) 72 { 73 char hostname[MAXHOSTNAMELEN]; 74 const char *user, *tty; 75 const void *item; 76 char **args, **pam_envlist, **pam_env; 77 struct passwd *pwd; 78 int o, pam_err, status; 79 pid_t pid; 80 81 while ((o = getopt(argc, argv, "")) != -1) 82 switch (o) { 83 default: 84 usage(); 85 } 86 87 argc -= optind; 88 argv += optind; 89 90 if (argc > 0) { 91 user = *argv; 92 --argc; 93 ++argv; 94 } else { 95 user = "root"; 96 } 97 98 /* initialize PAM */ 99 pamc.conv = &openpam_ttyconv; 100 pam_start("su", user, &pamc, &pamh); 101 102 /* set some items */ 103 gethostname(hostname, sizeof(hostname)); 104 if ((pam_err = pam_set_item(pamh, PAM_RHOST, hostname)) != PAM_SUCCESS) 105 goto pamerr; 106 user = getlogin(); 107 if ((pam_err = pam_set_item(pamh, PAM_RUSER, user)) != PAM_SUCCESS) 108 goto pamerr; 109 tty = ttyname(STDERR_FILENO); 110 if ((pam_err = pam_set_item(pamh, PAM_TTY, tty)) != PAM_SUCCESS) 111 goto pamerr; 112 113 /* authenticate the applicant */ 114 if ((pam_err = pam_authenticate(pamh, 0)) != PAM_SUCCESS) 115 goto pamerr; 116 if ((pam_err = pam_acct_mgmt(pamh, 0)) == PAM_NEW_AUTHTOK_REQD) 117 pam_err = pam_chauthtok(pamh, PAM_CHANGE_EXPIRED_AUTHTOK); 118 if (pam_err != PAM_SUCCESS) 119 goto pamerr; 120 121 /* establish the requested credentials */ 122 if ((pam_err = pam_setcred(pamh, PAM_ESTABLISH_CRED)) != PAM_SUCCESS) 123 goto pamerr; 124 125 /* authentication succeeded; open a session */ 126 if ((pam_err = pam_open_session(pamh, 0)) != PAM_SUCCESS) 127 goto pamerr; 128 129 /* get mapped user name; PAM may have changed it */ 130 pam_err = pam_get_item(pamh, PAM_USER, &item); 131 if (pam_err != PAM_SUCCESS || (pwd = getpwnam(user = item)) == NULL) 132 goto pamerr; 133 134 /* export PAM environment */ 135 if ((pam_envlist = pam_getenvlist(pamh)) != NULL) { 136 for (pam_env = pam_envlist; *pam_env != NULL; ++pam_env) { 137 putenv(*pam_env); 138 free(*pam_env); 139 } 140 free(pam_envlist); 141 } 142 143 /* build argument list */ 144 if ((args = calloc(argc + 2, sizeof *args)) == NULL) { 145 warn("calloc()"); 146 goto err; 147 } 148 *args = pwd->pw_shell; 149 memcpy(args + 1, argv, argc * sizeof *args); 150 151 /* fork and exec */ 152 switch ((pid = fork())) { 153 case -1: 154 warn("fork()"); 155 goto err; 156 case 0: 157 /* child: give up privs and start a shell */ 158 159 /* set uid and groups */ 160 if (initgroups(pwd->pw_name, pwd->pw_gid) == -1) { 161 warn("initgroups()"); 162 _exit(1); 163 } 164 if (setgid(pwd->pw_gid) == -1) { 165 warn("setgid()"); 166 _exit(1); 167 } 168 if (setuid(pwd->pw_uid) == -1) { 169 warn("setuid()"); 170 _exit(1); 171 } 172 execve(*args, args, environ); 173 warn("execve()"); 174 _exit(1); 175 default: 176 /* parent: wait for child to exit */ 177 waitpid(pid, &status, 0); 178 179 /* close the session and release PAM resources */ 180 pam_err = pam_close_session(pamh, 0); 181 pam_end(pamh, pam_err); 182 183 exit(WEXITSTATUS(status)); 184 } 185 186 pamerr: 187 fprintf(stderr, "Sorry\n"); 188 err: 189 pam_end(pamh, pam_err); 190 exit(1); 191 } 192