blob: 5bec4bc8b3129f919bca343cb4625790a2fbdbee [file] [log] [blame]
Robert Griebl1fca5582002-06-04 20:45:46 +00001/* vi: set sw=4 ts=4: */
Bernhard Reutner-Fischer5a620ea2006-01-19 18:04:15 +00002/*
Denys Vlasenko0ef64bd2010-08-16 20:14:46 +02003 * Mini su implementation for busybox
Rob Landley3bfcf3c2006-07-10 03:05:46 +00004 *
Denys Vlasenko0ef64bd2010-08-16 20:14:46 +02005 * Licensed under GPLv2 or later, see file LICENSE in this source tree.
Rob Landley3bfcf3c2006-07-10 03:05:46 +00006 */
Robert Griebl1fca5582002-06-04 20:45:46 +00007
Denis Vlasenkob6adbf12007-05-26 19:00:18 +00008#include "libbb.h"
Rob Landley3bfcf3c2006-07-10 03:05:46 +00009#include <syslog.h>
Robert Griebl1fca5582002-06-04 20:45:46 +000010
Denys Vlasenko26ffe812010-02-26 10:01:18 +010011#if ENABLE_FEATURE_SU_CHECKS_SHELLS
12/* Return 1 if SHELL is a restricted shell (one not returned by
Ladislav Michla73b87e2010-06-27 03:23:31 +020013 * getusershell), else 0, meaning it is a standard shell. */
Denys Vlasenko26ffe812010-02-26 10:01:18 +010014static int restricted_shell(const char *shell)
15{
16 char *line;
Ladislav Michla73b87e2010-06-27 03:23:31 +020017 int result = 1;
Denys Vlasenko26ffe812010-02-26 10:01:18 +010018
19 /*setusershell(); - getusershell does it itself*/
20 while ((line = getusershell()) != NULL) {
Ladislav Michla73b87e2010-06-27 03:23:31 +020021 if (/* *line != '#' && */ strcmp(line, shell) == 0) {
22 result = 0;
23 break;
24 }
Denys Vlasenko26ffe812010-02-26 10:01:18 +010025 }
Ladislav Michla73b87e2010-06-27 03:23:31 +020026 if (ENABLE_FEATURE_CLEAN_UP)
27 endusershell();
28 return result;
Denys Vlasenko26ffe812010-02-26 10:01:18 +010029}
30#endif
31
Bernhard Reutner-Fischer359d7ca2006-12-19 08:55:38 +000032#define SU_OPT_mp (3)
Ladislav Michla73b87e2010-06-27 03:23:31 +020033#define SU_OPT_l (4)
Bernhard Reutner-Fischer359d7ca2006-12-19 08:55:38 +000034
Denis Vlasenko9b49a5e2007-10-11 10:05:36 +000035int su_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
Denis Vlasenkoa60f84e2008-07-05 09:18:54 +000036int su_main(int argc UNUSED_PARAM, char **argv)
Robert Griebl1fca5582002-06-04 20:45:46 +000037{
Denis Vlasenko15b213e2006-12-19 00:20:20 +000038 unsigned flags;
Denis Vlasenko06c0a712007-01-29 22:51:44 +000039 char *opt_shell = NULL;
40 char *opt_command = NULL;
41 const char *opt_username = "root";
Glenn L McGratha6b7bdc2003-08-29 07:38:56 +000042 struct passwd *pw;
43 uid_t cur_uid = getuid();
Glenn L McGratha6b7bdc2003-08-29 07:38:56 +000044 const char *tty;
Ladislav Michla73b87e2010-06-27 03:23:31 +020045 char user_buf[64];
46 const char *old_user;
Robert Griebl1fca5582002-06-04 20:45:46 +000047
Denis Vlasenkofe7cd642007-08-18 15:32:12 +000048 flags = getopt32(argv, "mplc:s:", &opt_command, &opt_shell);
Denis Vlasenko62a90cd2008-03-17 09:07:36 +000049 //argc -= optind;
Denis Vlasenkoe13a5372006-12-23 02:59:06 +000050 argv += optind;
Robert Griebl1fca5582002-06-04 20:45:46 +000051
Denis Vlasenko62a90cd2008-03-17 09:07:36 +000052 if (argv[0] && LONE_DASH(argv[0])) {
Bernhard Reutner-Fischerdf798b72006-06-14 16:36:45 +000053 flags |= SU_OPT_l;
Denis Vlasenko9f739442006-12-16 23:49:13 +000054 argv++;
Denis Vlasenkoa9801652006-09-07 16:20:03 +000055 }
Robert Griebl1fca5582002-06-04 20:45:46 +000056
57 /* get user if specified */
Denis Vlasenko62a90cd2008-03-17 09:07:36 +000058 if (argv[0]) {
Denis Vlasenko9f739442006-12-16 23:49:13 +000059 opt_username = argv[0];
Denis Vlasenko9f739442006-12-16 23:49:13 +000060 argv++;
61 }
Eric Andersenc7bda1c2004-03-15 08:29:22 +000062
Bernhard Reutner-Fischer359d7ca2006-12-19 08:55:38 +000063 if (ENABLE_FEATURE_SU_SYSLOG) {
Ladislav Michla73b87e2010-06-27 03:23:31 +020064 /* The utmp entry (via getlogin) is probably the best way to
65 * identify the user, especially if someone su's from a su-shell.
Denys Vlasenkod069e532009-09-09 23:12:10 +020066 * But getlogin can fail -- usually due to lack of utmp entry.
67 * in this case resort to getpwuid. */
Denys Vlasenkod069e532009-09-09 23:12:10 +020068#if ENABLE_FEATURE_UTMP
Ladislav Michla73b87e2010-06-27 03:23:31 +020069 old_user = user_buf;
Denys Vlasenkod069e532009-09-09 23:12:10 +020070 if (getlogin_r(user_buf, sizeof(user_buf)) != 0)
71#endif
72 {
73 pw = getpwuid(cur_uid);
Ladislav Michla73b87e2010-06-27 03:23:31 +020074 old_user = pw ? xstrdup(pw->pw_name) : "";
Denys Vlasenkod069e532009-09-09 23:12:10 +020075 }
Denys Vlasenkod069e532009-09-09 23:12:10 +020076 tty = xmalloc_ttyname(2);
77 if (!tty) {
78 tty = "none";
79 }
Denis Vlasenko8f8f2682006-10-03 21:00:43 +000080 openlog(applet_name, 0, LOG_AUTH);
Glenn L McGratha6b7bdc2003-08-29 07:38:56 +000081 }
Glenn L McGratha6b7bdc2003-08-29 07:38:56 +000082
Denis Vlasenkod7a805e2008-12-03 19:05:55 +000083 pw = xgetpwnam(opt_username);
Eric Andersenc7bda1c2004-03-15 08:29:22 +000084
Ladislav Michla73b87e2010-06-27 03:23:31 +020085 if (cur_uid == 0 || correct_password(pw)) {
Bernhard Reutner-Fischer359d7ca2006-12-19 08:55:38 +000086 if (ENABLE_FEATURE_SU_SYSLOG)
Denis Vlasenko15b213e2006-12-19 00:20:20 +000087 syslog(LOG_NOTICE, "%c %s %s:%s",
88 '+', tty, old_user, opt_username);
Glenn L McGratha6b7bdc2003-08-29 07:38:56 +000089 } else {
Bernhard Reutner-Fischer359d7ca2006-12-19 08:55:38 +000090 if (ENABLE_FEATURE_SU_SYSLOG)
Denis Vlasenko15b213e2006-12-19 00:20:20 +000091 syslog(LOG_NOTICE, "%c %s %s:%s",
92 '-', tty, old_user, opt_username);
Rob Landley3bfcf3c2006-07-10 03:05:46 +000093 bb_error_msg_and_die("incorrect password");
Robert Griebl1fca5582002-06-04 20:45:46 +000094 }
95
Bernhard Reutner-Fischer359d7ca2006-12-19 08:55:38 +000096 if (ENABLE_FEATURE_CLEAN_UP && ENABLE_FEATURE_SU_SYSLOG) {
Rob Landley3bfcf3c2006-07-10 03:05:46 +000097 closelog();
Rob Landley3bfcf3c2006-07-10 03:05:46 +000098 }
Glenn L McGratha6b7bdc2003-08-29 07:38:56 +000099
Ladislav Michla73b87e2010-06-27 03:23:31 +0200100 if (!opt_shell && (flags & SU_OPT_mp)) {
101 /* -s SHELL is not given, but "preserve env" opt is */
Denis Vlasenko15b213e2006-12-19 00:20:20 +0000102 opt_shell = getenv("SHELL");
Ladislav Michla73b87e2010-06-27 03:23:31 +0200103 }
104
105 /* Make sure pw->pw_shell is non-NULL. It may be NULL when NEW_USER
106 * is a username that is retrieved via NIS (YP), that doesn't have
107 * a default shell listed. */
108 if (!pw->pw_shell || !pw->pw_shell[0])
109 pw->pw_shell = (char *)DEFAULT_SHELL;
Robert Griebl1fca5582002-06-04 20:45:46 +0000110
Denis Vlasenko15b213e2006-12-19 00:20:20 +0000111#if ENABLE_FEATURE_SU_CHECKS_SHELLS
Denys Vlasenko26ffe812010-02-26 10:01:18 +0100112 if (opt_shell && cur_uid != 0 && restricted_shell(pw->pw_shell)) {
Robert Griebl1fca5582002-06-04 20:45:46 +0000113 /* The user being su'd to has a nonstandard shell, and so is
Ladislav Michla73b87e2010-06-27 03:23:31 +0200114 * probably a uucp account or has restricted access. Don't
115 * compromise the account by allowing access with a standard
116 * shell. */
Rob Landley3bfcf3c2006-07-10 03:05:46 +0000117 bb_error_msg("using restricted shell");
Denis Vlasenkoa2f61012007-09-10 13:15:28 +0000118 opt_shell = NULL;
Robert Griebl1fca5582002-06-04 20:45:46 +0000119 }
Ladislav Michla73b87e2010-06-27 03:23:31 +0200120 /* else: user can run whatever he wants via "su -s PROG USER".
121 * This is safe since PROG is run under user's uid/gid. */
Denis Vlasenko15b213e2006-12-19 00:20:20 +0000122#endif
123 if (!opt_shell)
124 opt_shell = pw->pw_shell;
Robert Griebl1fca5582002-06-04 20:45:46 +0000125
Rob Landley3bfcf3c2006-07-10 03:05:46 +0000126 change_identity(pw);
Denys Vlasenkofd686a22010-02-26 09:52:45 +0100127 setup_environment(opt_shell,
128 ((flags & SU_OPT_l) / SU_OPT_l * SETUP_ENV_CLEARENV)
129 + (!(flags & SU_OPT_mp) * SETUP_ENV_CHANGEENV),
130 pw);
Denis Vlasenko5e34ff22009-04-21 11:09:40 +0000131 IF_SELINUX(set_current_security_context(NULL);)
Rob Landley3bfcf3c2006-07-10 03:05:46 +0000132
Rob Landley18707372006-07-15 19:46:46 +0000133 /* Never returns */
Denis Vlasenko9f739442006-12-16 23:49:13 +0000134 run_shell(opt_shell, flags & SU_OPT_l, opt_command, (const char**)argv);
Eric Andersenc7bda1c2004-03-15 08:29:22 +0000135
Denis Vlasenkoa2f61012007-09-10 13:15:28 +0000136 /* return EXIT_FAILURE; - not reached */
Robert Griebl1fca5582002-06-04 20:45:46 +0000137}