src/basic/user-util.c

   1 /***
   2   This file is part of systemd.
   3
   4   Copyright 2010 Lennart Poettering
   5
   6   systemd is free software; you can redistribute it and/or modify it
   7   under the terms of the GNU Lesser General Public License as published by
   8   the Free Software Foundation; either version 2.1 of the License, or
   9   (at your option) any later version.
  10
  11   systemd is distributed in the hope that it will be useful, but
  12   WITHOUT ANY WARRANTY; without even the implied warranty of
  13   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14   Lesser General Public License for more details.
  15
  16   You should have received a copy of the GNU Lesser General Public License
  17   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  18 ***/
  19
  20 #include <alloca.h>
  21 #include <errno.h>
  22 #include <fcntl.h>
  23 #include <grp.h>
  24 #include <pwd.h>
  25 #include <stddef.h>
  26 #include <stdint.h>
  27 #include <stdio.h>
  28 #include <stdlib.h>
  29 #include <string.h>
  30 #include <sys/stat.h>
  31 #include <unistd.h>
  32 #include <utmp.h>
  33
  34 #include "alloc-util.h"
  35 #include "fd-util.h"
  36 #include "fileio.h"
  37 #include "formats-util.h"
  38 #include "macro.h"
  39 #include "missing.h"
  40 #include "parse-util.h"
  41 #include "path-util.h"
  42 #include "string-util.h"
  43 #include "strv.h"
  44 #include "user-util.h"
  45 #include "utf8.h"
  46
  47 bool uid_is_valid(uid_t uid) {
  48
  49         /* Some libc APIs use UID_INVALID as special placeholder */
  50         if (uid == (uid_t) UINT32_C(0xFFFFFFFF))
  51                 return false;
  52
  53         /* A long time ago UIDs where 16bit, hence explicitly avoid the 16bit -1 too */
  54         if (uid == (uid_t) UINT32_C(0xFFFF))
  55                 return false;
  56
  57         return true;
  58 }
  59
  60 int parse_uid(const char *s, uid_t *ret) {
  61         uint32_t uid = 0;
  62         int r;
  63
  64         assert(s);
  65
  66         assert_cc(sizeof(uid_t) == sizeof(uint32_t));
  67         r = safe_atou32(s, &uid);
  68         if (r < 0)
  69                 return r;
  70
  71         if (!uid_is_valid(uid))
  72                 return -ENXIO; /* we return ENXIO instead of EINVAL
  73                                 * here, to make it easy to distuingish
  74                                 * invalid numeric uids from invalid
  75                                 * strings. */
  76
  77         if (ret)
  78                 *ret = uid;
  79
  80         return 0;
  81 }
  82
  83 char* getlogname_malloc(void) {
  84         uid_t uid;
  85         struct stat st;
  86
  87         if (isatty(STDIN_FILENO) && fstat(STDIN_FILENO, &st) >= 0)
  88                 uid = st.st_uid;
  89         else
  90                 uid = getuid();
  91
  92         return uid_to_name(uid);
  93 }
  94
  95 char *getusername_malloc(void) {
  96         const char *e;
  97
  98         e = getenv("USER");
  99         if (e)
 100                 return strdup(e);
 101
 102         return uid_to_name(getuid());
 103 }
 104
 105 int get_user_creds(
 106                 const char **username,
 107                 uid_t *uid, gid_t *gid,
 108                 const char **home,
 109                 const char **shell) {
 110
 111         struct passwd *p;
 112         uid_t u;
 113
 114         assert(username);
 115         assert(*username);
 116
 117         /* We enforce some special rules for uid=0: in order to avoid
 118          * NSS lookups for root we hardcode its data. */
 119
 120         if (streq(*username, "root") || streq(*username, "0")) {
 121                 *username = "root";
 122
 123                 if (uid)
 124                         *uid = 0;
 125
 126                 if (gid)
 127                         *gid = 0;
 128
 129                 if (home)
 130                         *home = "/root";
 131
 132                 if (shell)
 133                         *shell = "/bin/sh";
 134
 135                 return 0;
 136         }
 137
 138         if (parse_uid(*username, &u) >= 0) {
 139                 errno = 0;
 140                 p = getpwuid(u);
 141
 142                 /* If there are multiple users with the same id, make
 143                  * sure to leave $USER to the configured value instead
 144                  * of the first occurrence in the database. However if
 145                  * the uid was configured by a numeric uid, then let's
 146                  * pick the real username from /etc/passwd. */
 147                 if (p)
 148                         *username = p->pw_name;
 149         } else {
 150                 errno = 0;
 151                 p = getpwnam(*username);
 152         }
 153
 154         if (!p)
 155                 return errno > 0 ? -errno : -ESRCH;
 156
 157         if (uid) {
 158                 if (!uid_is_valid(p->pw_uid))
 159                         return -EBADMSG;
 160
 161                 *uid = p->pw_uid;
 162         }
 163
 164         if (gid) {
 165                 if (!gid_is_valid(p->pw_gid))
 166                         return -EBADMSG;
 167
 168                 *gid = p->pw_gid;
 169         }
 170
 171         if (home)
 172                 *home = p->pw_dir;
 173
 174         if (shell)
 175                 *shell = p->pw_shell;
 176
 177         return 0;
 178 }
 179
 180 int get_user_creds_clean(
 181                 const char **username,
 182                 uid_t *uid, gid_t *gid,
 183                 const char **home,
 184                 const char **shell) {
 185
 186         int r;
 187
 188         /* Like get_user_creds(), but resets home/shell to NULL if they don't contain anything relevant. */
 189
 190         r = get_user_creds(username, uid, gid, home, shell);
 191         if (r < 0)
 192                 return r;
 193
 194         if (shell &&
 195             (isempty(*shell) || PATH_IN_SET(*shell,
 196                                             "/bin/nologin",
 197                                             "/sbin/nologin",
 198                                             "/usr/bin/nologin",
 199                                             "/usr/sbin/nologin")))
 200                 *shell = NULL;
 201
 202         if (home &&
 203             (isempty(*home) || path_equal(*home, "/")))
 204                 *home = NULL;
 205
 206         return 0;
 207 }
 208
 209 int get_group_creds(const char **groupname, gid_t *gid) {
 210         struct group *g;
 211         gid_t id;
 212
 213         assert(groupname);
 214
 215         /* We enforce some special rules for gid=0: in order to avoid
 216          * NSS lookups for root we hardcode its data. */
 217
 218         if (streq(*groupname, "root") || streq(*groupname, "0")) {
 219                 *groupname = "root";
 220
 221                 if (gid)
 222                         *gid = 0;
 223
 224                 return 0;
 225         }
 226
 227         if (parse_gid(*groupname, &id) >= 0) {
 228                 errno = 0;
 229                 g = getgrgid(id);
 230
 231                 if (g)
 232                         *groupname = g->gr_name;
 233         } else {
 234                 errno = 0;
 235                 g = getgrnam(*groupname);
 236         }
 237
 238         if (!g)
 239                 return errno > 0 ? -errno : -ESRCH;
 240
 241         if (gid) {
 242                 if (!gid_is_valid(g->gr_gid))
 243                         return -EBADMSG;
 244
 245                 *gid = g->gr_gid;
 246         }
 247
 248         return 0;
 249 }
 250
 251 char* uid_to_name(uid_t uid) {
 252         char *ret;
 253         int r;
 254
 255         /* Shortcut things to avoid NSS lookups */
 256         if (uid == 0)
 257                 return strdup("root");
 258
 259         if (uid_is_valid(uid)) {
 260                 long bufsize;
 261
 262                 bufsize = sysconf(_SC_GETPW_R_SIZE_MAX);
 263                 if (bufsize <= 0)
 264                         bufsize = 4096;
 265
 266                 for (;;) {
 267                         struct passwd pwbuf, *pw = NULL;
 268                         _cleanup_free_ char *buf = NULL;
 269
 270                         buf = malloc(bufsize);
 271                         if (!buf)
 272                                 return NULL;
 273
 274                         r = getpwuid_r(uid, &pwbuf, buf, (size_t) bufsize, &pw);
 275                         if (r == 0 && pw)
 276                                 return strdup(pw->pw_name);
 277                         if (r != ERANGE)
 278                                 break;
 279
 280                         bufsize *= 2;
 281                 }
 282         }
 283
 284         if (asprintf(&ret, UID_FMT, uid) < 0)
 285                 return NULL;
 286
 287         return ret;
 288 }
 289
 290 char* gid_to_name(gid_t gid) {
 291         char *ret;
 292         int r;
 293
 294         if (gid == 0)
 295                 return strdup("root");
 296
 297         if (gid_is_valid(gid)) {
 298                 long bufsize;
 299
 300                 bufsize = sysconf(_SC_GETGR_R_SIZE_MAX);
 301                 if (bufsize <= 0)
 302                         bufsize = 4096;
 303
 304                 for (;;) {
 305                         struct group grbuf, *gr = NULL;
 306                         _cleanup_free_ char *buf = NULL;
 307
 308                         buf = malloc(bufsize);
 309                         if (!buf)
 310                                 return NULL;
 311
 312                         r = getgrgid_r(gid, &grbuf, buf, (size_t) bufsize, &gr);
 313                         if (r == 0 && gr)
 314                                 return strdup(gr->gr_name);
 315                         if (r != ERANGE)
 316                                 break;
 317
 318                         bufsize *= 2;
 319                 }
 320         }
 321
 322         if (asprintf(&ret, GID_FMT, gid) < 0)
 323                 return NULL;
 324
 325         return ret;
 326 }
 327
 328 int in_gid(gid_t gid) {
 329         gid_t *gids;
 330         int ngroups_max, r, i;
 331
 332         if (getgid() == gid)
 333                 return 1;
 334
 335         if (getegid() == gid)
 336                 return 1;
 337
 338         if (!gid_is_valid(gid))
 339                 return -EINVAL;
 340
 341         ngroups_max = sysconf(_SC_NGROUPS_MAX);
 342         assert(ngroups_max > 0);
 343
 344         gids = alloca(sizeof(gid_t) * ngroups_max);
 345
 346         r = getgroups(ngroups_max, gids);
 347         if (r < 0)
 348                 return -errno;
 349
 350         for (i = 0; i < r; i++)
 351                 if (gids[i] == gid)
 352                         return 1;
 353
 354         return 0;
 355 }
 356
 357 int in_group(const char *name) {
 358         int r;
 359         gid_t gid;
 360
 361         r = get_group_creds(&name, &gid);
 362         if (r < 0)
 363                 return r;
 364
 365         return in_gid(gid);
 366 }
 367
 368 int get_home_dir(char **_h) {
 369         struct passwd *p;
 370         const char *e;
 371         char *h;
 372         uid_t u;
 373
 374         assert(_h);
 375
 376         /* Take the user specified one */
 377         e = secure_getenv("HOME");
 378         if (e && path_is_absolute(e)) {
 379                 h = strdup(e);
 380                 if (!h)
 381                         return -ENOMEM;
 382
 383                 *_h = h;
 384                 return 0;
 385         }
 386
 387         /* Hardcode home directory for root to avoid NSS */
 388         u = getuid();
 389         if (u == 0) {
 390                 h = strdup("/root");
 391                 if (!h)
 392                         return -ENOMEM;
 393
 394                 *_h = h;
 395                 return 0;
 396         }
 397
 398         /* Check the database... */
 399         errno = 0;
 400         p = getpwuid(u);
 401         if (!p)
 402                 return errno > 0 ? -errno : -ESRCH;
 403
 404         if (!path_is_absolute(p->pw_dir))
 405                 return -EINVAL;
 406
 407         h = strdup(p->pw_dir);
 408         if (!h)
 409                 return -ENOMEM;
 410
 411         *_h = h;
 412         return 0;
 413 }
 414
 415 int get_shell(char **_s) {
 416         struct passwd *p;
 417         const char *e;
 418         char *s;
 419         uid_t u;
 420
 421         assert(_s);
 422
 423         /* Take the user specified one */
 424         e = getenv("SHELL");
 425         if (e) {
 426                 s = strdup(e);
 427                 if (!s)
 428                         return -ENOMEM;
 429
 430                 *_s = s;
 431                 return 0;
 432         }
 433
 434         /* Hardcode home directory for root to avoid NSS */
 435         u = getuid();
 436         if (u == 0) {
 437                 s = strdup("/bin/sh");
 438                 if (!s)
 439                         return -ENOMEM;
 440
 441                 *_s = s;
 442                 return 0;
 443         }
 444
 445         /* Check the database... */
 446         errno = 0;
 447         p = getpwuid(u);
 448         if (!p)
 449                 return errno > 0 ? -errno : -ESRCH;
 450
 451         if (!path_is_absolute(p->pw_shell))
 452                 return -EINVAL;
 453
 454         s = strdup(p->pw_shell);
 455         if (!s)
 456                 return -ENOMEM;
 457
 458         *_s = s;
 459         return 0;
 460 }
 461
 462 int reset_uid_gid(void) {
 463         int r;
 464
 465         r = maybe_setgroups(0, NULL);
 466         if (r < 0)
 467                 return r;
 468
 469         if (setresgid(0, 0, 0) < 0)
 470                 return -errno;
 471
 472         if (setresuid(0, 0, 0) < 0)
 473                 return -errno;
 474
 475         return 0;
 476 }
 477
 478 int take_etc_passwd_lock(const char *root) {
 479
 480         struct flock flock = {
 481                 .l_type = F_WRLCK,
 482                 .l_whence = SEEK_SET,
 483                 .l_start = 0,
 484                 .l_len = 0,
 485         };
 486
 487         const char *path;
 488         int fd, r;
 489
 490         /* This is roughly the same as lckpwdf(), but not as awful. We
 491          * don't want to use alarm() and signals, hence we implement
 492          * our own trivial version of this.
 493          *
 494          * Note that shadow-utils also takes per-database locks in
 495          * addition to lckpwdf(). However, we don't given that they
 496          * are redundant as they invoke lckpwdf() first and keep
 497          * it during everything they do. The per-database locks are
 498          * awfully racy, and thus we just won't do them. */
 499
 500         if (root)
 501                 path = prefix_roota(root, "/etc/.pwd.lock");
 502         else
 503                 path = "/etc/.pwd.lock";
 504
 505         fd = open(path, O_WRONLY|O_CREAT|O_CLOEXEC|O_NOCTTY|O_NOFOLLOW, 0600);
 506         if (fd < 0)
 507                 return -errno;
 508
 509         r = fcntl(fd, F_SETLKW, &flock);
 510         if (r < 0) {
 511                 safe_close(fd);
 512                 return -errno;
 513         }
 514
 515         return fd;
 516 }
 517
 518 bool valid_user_group_name(const char *u) {
 519         const char *i;
 520         long sz;
 521
 522         /* Checks if the specified name is a valid user/group name. */
 523
 524         if (isempty(u))
 525                 return false;
 526
 527         if (!(u[0] >= 'a' && u[0] <= 'z') &&
 528             !(u[0] >= 'A' && u[0] <= 'Z') &&
 529             u[0] != '_')
 530                 return false;
 531
 532         for (i = u+1; *i; i++) {
 533                 if (!(*i >= 'a' && *i <= 'z') &&
 534                     !(*i >= 'A' && *i <= 'Z') &&
 535                     !(*i >= '0' && *i <= '9') &&
 536                     *i != '_' &&
 537                     *i != '-')
 538                         return false;
 539         }
 540
 541         sz = sysconf(_SC_LOGIN_NAME_MAX);
 542         assert_se(sz > 0);
 543
 544         if ((size_t) (i-u) > (size_t) sz)
 545                 return false;
 546
 547         if ((size_t) (i-u) > UT_NAMESIZE - 1)
 548                 return false;
 549
 550         return true;
 551 }
 552
 553 bool valid_user_group_name_or_id(const char *u) {
 554
 555         /* Similar as above, but is also fine with numeric UID/GID specifications, as long as they are in the right
 556          * range, and not the invalid user ids. */
 557
 558         if (isempty(u))
 559                 return false;
 560
 561         if (valid_user_group_name(u))
 562                 return true;
 563
 564         return parse_uid(u, NULL) >= 0;
 565 }
 566
 567 bool valid_gecos(const char *d) {
 568
 569         if (!d)
 570                 return false;
 571
 572         if (!utf8_is_valid(d))
 573                 return false;
 574
 575         if (string_has_cc(d, NULL))
 576                 return false;
 577
 578         /* Colons are used as field separators, and hence not OK */
 579         if (strchr(d, ':'))
 580                 return false;
 581
 582         return true;
 583 }
 584
 585 bool valid_home(const char *p) {
 586
 587         if (isempty(p))
 588                 return false;
 589
 590         if (!utf8_is_valid(p))
 591                 return false;
 592
 593         if (string_has_cc(p, NULL))
 594                 return false;
 595
 596         if (!path_is_absolute(p))
 597                 return false;
 598
 599         if (!path_is_safe(p))
 600                 return false;
 601
 602         /* Colons are used as field separators, and hence not OK */
 603         if (strchr(p, ':'))
 604                 return false;
 605
 606         return true;
 607 }
 608
 609 int maybe_setgroups(size_t size, const gid_t *list) {
 610         int r;
 611
 612         /* Check if setgroups is allowed before we try to drop all the auxiliary groups */
 613         if (size == 0) { /* Dropping all aux groups? */
 614                 _cleanup_free_ char *setgroups_content = NULL;
 615                 bool can_setgroups;
 616
 617                 r = read_one_line_file("/proc/self/setgroups", &setgroups_content);
 618                 if (r == -ENOENT)
 619                         /* Old kernels don't have /proc/self/setgroups, so assume we can use setgroups */
 620                         can_setgroups = true;
 621                 else if (r < 0)
 622                         return r;
 623                 else
 624                         can_setgroups = streq(setgroups_content, "allow");
 625
 626                 if (!can_setgroups) {
 627                         log_debug("Skipping setgroups(), /proc/self/setgroups is set to 'deny'");
 628                         return 0;
 629                 }
 630         }
 631
 632         if (setgroups(size, list) < 0)
 633                 return -errno;
 634
 635         return 0;
 636 }