1 /*- 2 * Copyright (c) 2003 Mike Barcroft <mike@FreeBSD.org> 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24 * SUCH DAMAGE. 25 * 26 * $FreeBSD$ 27 */ 28 29 #include <sys/param.h> 30 #include <sys/jail.h> 31 32 #include <err.h> 33 #include <errno.h> 34 #include <login_cap.h> 35 #include <stdio.h> 36 #include <stdlib.h> 37 #include <pwd.h> 38 #include <unistd.h> 39 40 static void usage(void); 41 42 #define GET_USER_INFO do { \ 43 pwd = getpwnam(username); \ 44 if (pwd == NULL) { \ 45 if (errno) \ 46 err(1, "getpwnam: %s", username); \ 47 else \ 48 errx(1, "%s: no such user", username); \ 49 } \ 50 lcap = login_getpwclass(pwd); \ 51 if (lcap == NULL) \ 52 err(1, "getpwclass: %s", username); \ 53 ngroups = NGROUPS; \ 54 if (getgrouplist(username, pwd->pw_gid, groups, &ngroups) != 0) \ 55 err(1, "getgrouplist: %s", username); \ 56 } while (0) 57 58 int 59 main(int argc, char *argv[]) 60 { 61 int jid; 62 login_cap_t *lcap = NULL; 63 struct passwd *pwd = NULL; 64 gid_t groups[NGROUPS]; 65 int ch, ngroups, uflag, Uflag; 66 char *username; 67 ch = uflag = Uflag = 0; 68 username = NULL; 69 70 while ((ch = getopt(argc, argv, "u:U:")) != -1) { 71 switch (ch) { 72 case 'u': 73 username = optarg; 74 uflag = 1; 75 break; 76 case 'U': 77 username = optarg; 78 Uflag = 1; 79 break; 80 default: 81 usage(); 82 } 83 } 84 argc -= optind; 85 argv += optind; 86 if (argc < 2) 87 usage(); 88 if (uflag && Uflag) 89 usage(); 90 if (uflag) 91 GET_USER_INFO; 92 jid = (int)strtol(argv[0], NULL, 10); 93 if (jail_attach(jid) == -1) 94 err(1, "jail_attach(): %d", jid); 95 if (chdir("/") == -1) 96 err(1, "chdir(): /"); 97 if (username != NULL) { 98 if (Uflag) 99 GET_USER_INFO; 100 if (setgroups(ngroups, groups) != 0) 101 err(1, "setgroups"); 102 if (setgid(pwd->pw_gid) != 0) 103 err(1, "setgid"); 104 if (setusercontext(lcap, pwd, pwd->pw_uid, 105 LOGIN_SETALL & ~LOGIN_SETGROUP & ~LOGIN_SETLOGIN) != 0) 106 err(1, "setusercontext"); 107 login_close(lcap); 108 } 109 if (execvp(argv[1], argv + 1) == -1) 110 err(1, "execvp(): %s", argv[1]); 111 exit(0); 112 } 113 114 static void 115 usage(void) 116 { 117 118 fprintf(stderr, "%s%s\n", 119 "usage: jexec [-u username | -U username]", 120 " jid command ..."); 121 exit(1); 122 } 123