2 Unix SMB/CIFS implementation.
3 run a command as a specified user
4 Copyright (C) Andrew Tridgell 1992-1998
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 2 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program; if not, write to the Free Software
18 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
20 modified for netatalk dgautheron@magic.fr
25 #endif /* HAVE_CONFIG_H */
30 #include <sys/types.h>
36 #ifdef HAVE_SYS_WAIT_H
40 #include <sys/param.h>
46 #define USE_SETRESUID 1
54 #include <atalk/logger.h>
56 /**************************************************************************n
57 Find a suitable temporary directory. The result should be copied immediately
58 as it may be overwritten by a subsequent call.
59 ****************************************************************************/
61 static const char *tmpdir(void)
65 if ((p = getenv("TMPDIR")))
70 /****************************************************************************
71 This is a utility function of afprun().
72 ****************************************************************************/
74 static int setup_out_fd(void)
77 char path[MAXPATHLEN +1];
79 snprintf(path, sizeof(path)-1, "%s/afp.XXXXXX", tmpdir());
81 /* now create the file */
85 LOG(log_error, logtype_afpd, "setup_out_fd: Failed to create file %s. (%s)",path, strerror(errno) );
89 /* Ensure file only kept around by open fd. */
94 /****************************************************************************
95 Gain root privilege before doing something.
96 We want to end up with ruid==euid==0
97 ****************************************************************************/
98 static void gain_root_privilege(void)
103 /****************************************************************************
104 Ensure our real and effective groups are zero.
105 we want to end up with rgid==egid==0
106 ****************************************************************************/
107 static void gain_root_group_privilege(void)
112 /****************************************************************************
113 Become the specified uid and gid - permanently !
114 there should be no way back if possible
115 ****************************************************************************/
116 static void become_user_permanently(uid_t uid, gid_t gid)
119 * First - gain root privilege. We do this to ensure
120 * we can lose it again.
123 gain_root_privilege();
124 gain_root_group_privilege();
127 setresgid(gid,gid,gid);
129 setresuid(uid,uid,uid);
149 setgidx(ID_REAL, gid);
150 setgidx(ID_EFFECTIVE, gid);
152 setuidx(ID_REAL, uid);
153 setuidx(ID_EFFECTIVE, uid);
158 /****************************************************************************
159 run a command being careful about uid/gid handling and putting the output in
160 outfd (or discard it if outfd is NULL).
161 ****************************************************************************/
163 int afprun(int root, char *cmd, int *outfd)
166 uid_t uid = geteuid();
167 gid_t gid = getegid();
169 /* point our stdout at the file we want output to go into */
170 if (outfd && ((*outfd = setup_out_fd()) == -1)) {
173 LOG(log_debug, logtype_afpd, "running %s as user %d", cmd, root?0:uid);
174 /* in this method we will exec /bin/sh with the correct
175 arguments, after first setting stdout to point at the file */
177 if ((pid=fork()) < 0) {
178 LOG(log_error, logtype_afpd, "afprun: fork failed with error %s", strerror(errno) );
193 /* the parent just waits for the child to exit */
194 while((wpid = waitpid(pid,&status,0)) < 0) {
195 if (errno == EINTR) {
202 LOG(log_error, logtype_afpd, "waitpid(%d) : %s",(int)pid, strerror(errno) );
209 /* Reset the seek pointer. */
211 lseek(*outfd, 0, SEEK_SET);
214 #if defined(WIFEXITED) && defined(WEXITSTATUS)
215 if (WIFEXITED(status)) {
216 return WEXITSTATUS(status);
222 /* we are in the child. we exec /bin/sh to do the work for us. we
223 don't directly exec the command we want because it may be a
224 pipeline or anything else the config file specifies */
226 /* point our stdout at the file we want output to go into */
229 if (dup2(*outfd,1) != 1) {
230 LOG(log_error, logtype_afpd, "Failed to create stdout file descriptor");
236 if (chdir("/") < 0) {
237 LOG(log_error, logtype_afpd, "afprun: can't change directory to \"/\" %s", strerror(errno) );
241 /* now completely lose our privileges. This is a fairly paranoid
242 way of doing it, but it does work on all systems that I know of */
244 become_user_permanently(0, 0);
248 become_user_permanently(uid, gid);
250 if (getuid() != uid || geteuid() != uid || getgid() != gid || getegid() != gid) {
251 /* we failed to lose our privileges - do not execute the command */
252 exit(81); /* we can't print stuff at this stage, instead use exit codes for debugging */
255 /* close all other file descriptors, leaving only 0, 1 and 2. 0 and
256 2 point to /dev/null from the startup code */
259 for (fd=3;fd<256;fd++) close(fd);
262 execl("/bin/sh","sh","-c",cmd,NULL);