src/nspawn/nspawn-setuid.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2 /***
   3   This file is part of systemd.
   4
   5   Copyright 2015 Lennart Poettering
   6
   7   systemd is free software; you can redistribute it and/or modify it
   8   under the terms of the GNU Lesser General Public License as published by
   9   the Free Software Foundation; either version 2.1 of the License, or
  10   (at your option) any later version.
  11
  12   systemd is distributed in the hope that it will be useful, but
  13   WITHOUT ANY WARRANTY; without even the implied warranty of
  14   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  15   Lesser General Public License for more details.
  16
  17   You should have received a copy of the GNU Lesser General Public License
  18   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  19 ***/
  20
  21 #include <grp.h>
  22 #include <sys/types.h>
  23 #include <unistd.h>
  24
  25 #include "alloc-util.h"
  26 #include "fd-util.h"
  27 #include "mkdir.h"
  28 #include "nspawn-setuid.h"
  29 #include "process-util.h"
  30 #include "signal-util.h"
  31 #include "string-util.h"
  32 #include "user-util.h"
  33 #include "util.h"
  34
  35 static int spawn_getent(const char *database, const char *key, pid_t *rpid) {
  36         int pipe_fds[2], r;
  37         pid_t pid;
  38
  39         assert(database);
  40         assert(key);
  41         assert(rpid);
  42
  43         if (pipe2(pipe_fds, O_CLOEXEC) < 0)
  44                 return log_error_errno(errno, "Failed to allocate pipe: %m");
  45
  46         r = safe_fork("(getent)", FORK_RESET_SIGNALS|FORK_DEATHSIG|FORK_LOG, &pid);
  47         if (r < 0)
  48                 return r;
  49         if (r == 0) {
  50                 int nullfd;
  51                 char *empty_env = NULL;
  52
  53                 if (dup3(pipe_fds[1], STDOUT_FILENO, 0) < 0)
  54                         _exit(EXIT_FAILURE);
  55
  56                 if (pipe_fds[0] > 2)
  57                         safe_close(pipe_fds[0]);
  58                 if (pipe_fds[1] > 2)
  59                         safe_close(pipe_fds[1]);
  60
  61                 nullfd = open("/dev/null", O_RDWR);
  62                 if (nullfd < 0)
  63                         _exit(EXIT_FAILURE);
  64
  65                 if (dup3(nullfd, STDIN_FILENO, 0) < 0)
  66                         _exit(EXIT_FAILURE);
  67
  68                 if (dup3(nullfd, STDERR_FILENO, 0) < 0)
  69                         _exit(EXIT_FAILURE);
  70
  71                 if (nullfd > 2)
  72                         safe_close(nullfd);
  73
  74                 close_all_fds(NULL, 0);
  75
  76                 execle("/usr/bin/getent", "getent", database, key, NULL, &empty_env);
  77                 execle("/bin/getent", "getent", database, key, NULL, &empty_env);
  78                 _exit(EXIT_FAILURE);
  79         }
  80
  81         pipe_fds[1] = safe_close(pipe_fds[1]);
  82
  83         *rpid = pid;
  84
  85         return pipe_fds[0];
  86 }
  87
  88 int change_uid_gid(const char *user, char **_home) {
  89         char line[LINE_MAX], *x, *u, *g, *h;
  90         const char *word, *state;
  91         _cleanup_free_ uid_t *uids = NULL;
  92         _cleanup_free_ char *home = NULL;
  93         _cleanup_fclose_ FILE *f = NULL;
  94         _cleanup_close_ int fd = -1;
  95         unsigned n_uids = 0;
  96         size_t sz = 0, l;
  97         uid_t uid;
  98         gid_t gid;
  99         pid_t pid;
 100         int r;
 101
 102         assert(_home);
 103
 104         if (!user || streq(user, "root") || streq(user, "0")) {
 105                 /* Reset everything fully to 0, just in case */
 106
 107                 r = reset_uid_gid();
 108                 if (r < 0)
 109                         return log_error_errno(r, "Failed to become root: %m");
 110
 111                 *_home = NULL;
 112                 return 0;
 113         }
 114
 115         /* First, get user credentials */
 116         fd = spawn_getent("passwd", user, &pid);
 117         if (fd < 0)
 118                 return fd;
 119
 120         f = fdopen(fd, "r");
 121         if (!f)
 122                 return log_oom();
 123         fd = -1;
 124
 125         if (!fgets(line, sizeof(line), f)) {
 126                 if (!ferror(f)) {
 127                         log_error("Failed to resolve user %s.", user);
 128                         return -ESRCH;
 129                 }
 130
 131                 return log_error_errno(errno, "Failed to read from getent: %m");
 132         }
 133
 134         truncate_nl(line);
 135
 136         (void) wait_for_terminate_and_check("getent passwd", pid, WAIT_LOG);
 137
 138         x = strchr(line, ':');
 139         if (!x) {
 140                 log_error("/etc/passwd entry has invalid user field.");
 141                 return -EIO;
 142         }
 143
 144         u = strchr(x+1, ':');
 145         if (!u) {
 146                 log_error("/etc/passwd entry has invalid password field.");
 147                 return -EIO;
 148         }
 149
 150         u++;
 151         g = strchr(u, ':');
 152         if (!g) {
 153                 log_error("/etc/passwd entry has invalid UID field.");
 154                 return -EIO;
 155         }
 156
 157         *g = 0;
 158         g++;
 159         x = strchr(g, ':');
 160         if (!x) {
 161                 log_error("/etc/passwd entry has invalid GID field.");
 162                 return -EIO;
 163         }
 164
 165         *x = 0;
 166         h = strchr(x+1, ':');
 167         if (!h) {
 168                 log_error("/etc/passwd entry has invalid GECOS field.");
 169                 return -EIO;
 170         }
 171
 172         h++;
 173         x = strchr(h, ':');
 174         if (!x) {
 175                 log_error("/etc/passwd entry has invalid home directory field.");
 176                 return -EIO;
 177         }
 178
 179         *x = 0;
 180
 181         r = parse_uid(u, &uid);
 182         if (r < 0) {
 183                 log_error("Failed to parse UID of user.");
 184                 return -EIO;
 185         }
 186
 187         r = parse_gid(g, &gid);
 188         if (r < 0) {
 189                 log_error("Failed to parse GID of user.");
 190                 return -EIO;
 191         }
 192
 193         home = strdup(h);
 194         if (!home)
 195                 return log_oom();
 196
 197         /* Second, get group memberships */
 198         fd = spawn_getent("initgroups", user, &pid);
 199         if (fd < 0)
 200                 return fd;
 201
 202         fclose(f);
 203         f = fdopen(fd, "r");
 204         if (!f)
 205                 return log_oom();
 206         fd = -1;
 207
 208         if (!fgets(line, sizeof(line), f)) {
 209                 if (!ferror(f)) {
 210                         log_error("Failed to resolve user %s.", user);
 211                         return -ESRCH;
 212                 }
 213
 214                 return log_error_errno(errno, "Failed to read from getent: %m");
 215         }
 216
 217         truncate_nl(line);
 218
 219         (void) wait_for_terminate_and_check("getent initgroups", pid, WAIT_LOG);
 220
 221         /* Skip over the username and subsequent separator whitespace */
 222         x = line;
 223         x += strcspn(x, WHITESPACE);
 224         x += strspn(x, WHITESPACE);
 225
 226         FOREACH_WORD(word, l, x, state) {
 227                 char c[l+1];
 228
 229                 memcpy(c, word, l);
 230                 c[l] = 0;
 231
 232                 if (!GREEDY_REALLOC(uids, sz, n_uids+1))
 233                         return log_oom();
 234
 235                 r = parse_uid(c, &uids[n_uids++]);
 236                 if (r < 0) {
 237                         log_error("Failed to parse group data from getent.");
 238                         return -EIO;
 239                 }
 240         }
 241
 242         r = mkdir_parents(home, 0775);
 243         if (r < 0)
 244                 return log_error_errno(r, "Failed to make home root directory: %m");
 245
 246         r = mkdir_safe(home, 0755, uid, gid, false);
 247         if (r < 0 && r != -EEXIST)
 248                 return log_error_errno(r, "Failed to make home directory: %m");
 249
 250         (void) fchown(STDIN_FILENO, uid, gid);
 251         (void) fchown(STDOUT_FILENO, uid, gid);
 252         (void) fchown(STDERR_FILENO, uid, gid);
 253
 254         if (setgroups(n_uids, uids) < 0)
 255                 return log_error_errno(errno, "Failed to set auxiliary groups: %m");
 256
 257         if (setresgid(gid, gid, gid) < 0)
 258                 return log_error_errno(errno, "setresgid() failed: %m");
 259
 260         if (setresuid(uid, uid, uid) < 0)
 261                 return log_error_errno(errno, "setresuid() failed: %m");
 262
 263         if (_home) {
 264                 *_home = home;
 265                 home = NULL;
 266         }
 267
 268         return 0;
 269 }