lib/privs.c

   1 /*
   2  * Zebra privileges.
   3  *
   4  * Copyright (C) 2003 Paul Jakma.
   5  * Copyright (c) 2005, 2011, Oracle and/or its affiliates. All rights reserved.
   6  *
   7  * This file is part of GNU Zebra.
   8  *
   9  * GNU Zebra is free software; you can redistribute it and/or modify it
  10  * under the terms of the GNU General Public License as published by the
  11  * Free Software Foundation; either version 2, or (at your option) any
  12  * later version.
  13  *
  14  * GNU Zebra is distributed in the hope that it will be useful, but
  15  * WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17  * General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU General Public License
  20  * along with GNU Zebra; see the file COPYING.  If not, write to the Free
  21  * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
  22  * 02111-1307, USA.
  23  */
  24 #include <zebra.h>
  25 #include "log.h"
  26 #include "privs.h"
  27 #include "memory.h"
  28
  29 #ifdef HAVE_CAPABILITIES
  30
  31 DEFINE_MTYPE_STATIC(LIB, PRIVS, "Privilege information")
  32
  33 /* sort out some generic internal types for:
  34  *
  35  * privilege values (cap_value_t, priv_t)       -> pvalue_t
  36  * privilege set (..., priv_set_t)              -> pset_t
  37  * privilege working storage (cap_t, ...)       -> pstorage_t
  38  *
  39  * values we think of as numeric (they're ints really, but we dont know)
  40  * sets are mostly opaque, to hold a set of privileges, related in some way.
  41  * storage binds together a set of sets we're interested in.
  42  * (in reality: cap_value_t and priv_t are ints)
  43  */
  44 #ifdef HAVE_LCAPS
  45 /* Linux doesn't have a 'set' type: a set of related privileges */
  46 struct _pset {
  47   int num;
  48   cap_value_t *caps;
  49 };
  50 typedef cap_value_t pvalue_t;
  51 typedef struct _pset pset_t;
  52 typedef cap_t pstorage_t;
  53
  54 #elif defined (HAVE_SOLARIS_CAPABILITIES)
  55 typedef priv_t pvalue_t;
  56 typedef priv_set_t pset_t;
  57 typedef priv_set_t *pstorage_t;
  58 #else /* neither LCAPS nor SOLARIS_CAPABILITIES */
  59 #error "HAVE_CAPABILITIES defined, but neither LCAPS nor Solaris Capabilties!"
  60 #endif /* HAVE_LCAPS */
  61 #endif /* HAVE_CAPABILITIES */
  62
  63 /* the default NULL state we report is RAISED, but could be LOWERED if
  64  * zprivs_terminate is called and the NULL handler is installed.
  65  */
  66 static zebra_privs_current_t zprivs_null_state = ZPRIVS_RAISED;
  67
  68 /* internal privileges state */
  69 static struct _zprivs_t
  70 {
  71 #ifdef HAVE_CAPABILITIES
  72   pstorage_t caps;              /* working storage        */
  73   pset_t *syscaps_p;            /* system-type requested permitted caps    */
  74   pset_t *syscaps_i;            /* system-type requested inheritable caps  */
  75 #endif /* HAVE_CAPABILITIES */
  76   uid_t zuid,                 /* uid to run as            */
  77         zsuid;                /* saved uid                */
  78   gid_t zgid;                 /* gid to run as            */
  79   gid_t vtygrp;               /* gid for vty sockets      */
  80 } zprivs_state;
  81
  82 /* externally exported but not directly accessed functions */
  83 #ifdef HAVE_CAPABILITIES
  84 int zprivs_change_caps (zebra_privs_ops_t);
  85 zebra_privs_current_t zprivs_state_caps (void);
  86 #endif /* HAVE_CAPABILITIES */
  87 int zprivs_change_uid (zebra_privs_ops_t);
  88 zebra_privs_current_t zprivs_state_uid (void);
  89 int zprivs_change_null (zebra_privs_ops_t);
  90 zebra_privs_current_t zprivs_state_null (void);
  91
  92 #ifdef HAVE_CAPABILITIES
  93 /* internal capability API */
  94 static pset_t *zcaps2sys (zebra_capabilities_t *, int);
  95 static void zprivs_caps_init (struct zebra_privs_t *);
  96 static void zprivs_caps_terminate (void);
  97
  98 /* Map of Quagga abstract capabilities to system capabilities */
  99 static struct
 100 {
 101   int num;
 102   pvalue_t *system_caps;
 103 } cap_map [ZCAP_MAX] =
 104 {
 105 #ifdef HAVE_LCAPS /* Quagga -> Linux capabilities mappings */
 106   [ZCAP_SETID] =        { 2, (pvalue_t []) { CAP_SETGID,
 107                                              CAP_SETUID                 }, },
 108   [ZCAP_BIND] =         { 2, (pvalue_t []) { CAP_NET_BIND_SERVICE       }, },
 109   [ZCAP_NET_ADMIN] =    { 1, (pvalue_t []) { CAP_NET_ADMIN              }, },
 110   [ZCAP_NET_RAW] =      { 1, (pvalue_t []) { CAP_NET_RAW                }, },
 111   [ZCAP_CHROOT] =       { 1, (pvalue_t []) { CAP_SYS_CHROOT,            }, },
 112   [ZCAP_NICE] =         { 1, (pvalue_t []) { CAP_SYS_NICE               }, },
 113   [ZCAP_PTRACE] =       { 1, (pvalue_t []) { CAP_SYS_PTRACE             }, },
 114   [ZCAP_DAC_OVERRIDE] = { 1, (pvalue_t []) { CAP_DAC_OVERRIDE           }, },
 115   [ZCAP_READ_SEARCH] =  { 1, (pvalue_t []) { CAP_DAC_READ_SEARCH        }, },
 116   [ZCAP_SYS_ADMIN] =    { 1, (pvalue_t []) { CAP_SYS_ADMIN              }, },
 117   [ZCAP_FOWNER] =       { 1, (pvalue_t []) { CAP_FOWNER                 }, },
 118 #elif defined(HAVE_SOLARIS_CAPABILITIES) /* HAVE_LCAPS */
 119   /* Quagga -> Solaris privilege mappings */
 120   [ZCAP_SETID] =        { 1, (pvalue_t []) { PRIV_PROC_SETID            }, },
 121   [ZCAP_BIND] =         { 1, (pvalue_t []) { PRIV_NET_PRIVADDR          }, },
 122   /* IP_CONFIG is a subset of NET_CONFIG and is allowed in zones */
 123 #ifdef PRIV_SYS_IP_CONFIG
 124   [ZCAP_NET_ADMIN] =    { 1, (pvalue_t []) { PRIV_SYS_IP_CONFIG }, },
 125 #else
 126   [ZCAP_NET_ADMIN] =    { 1, (pvalue_t []) { PRIV_SYS_NET_CONFIG        }, },
 127 #endif
 128   [ZCAP_NET_RAW] =      { 2, (pvalue_t []) { PRIV_NET_RAWACCESS,
 129                                              PRIV_NET_ICMPACCESS        }, },
 130   [ZCAP_CHROOT] =       { 1, (pvalue_t []) { PRIV_PROC_CHROOT           }, },
 131   [ZCAP_NICE] =         { 1, (pvalue_t []) { PRIV_PROC_PRIOCNTL         }, },
 132   [ZCAP_PTRACE] =       { 1, (pvalue_t []) { PRIV_PROC_SESSION          }, },
 133   [ZCAP_DAC_OVERRIDE] = { 2, (pvalue_t []) { PRIV_FILE_DAC_EXECUTE,
 134                                              PRIV_FILE_DAC_READ,
 135                                              PRIV_FILE_DAC_SEARCH,
 136                                              PRIV_FILE_DAC_WRITE,
 137                                              PRIV_FILE_DAC_SEARCH       }, },
 138   [ZCAP_READ_SEARCH] =  { 2, (pvalue_t []) { PRIV_FILE_DAC_SEARCH,
 139                                              PRIV_FILE_DAC_READ         }, },
 140   [ZCAP_SYS_ADMIN] =    { 1, (pvalue_t []) { PRIV_SYS_ADMIN             }, },
 141   [ZCAP_FOWNER] =       { 1, (pvalue_t []) { PRIV_FILE_OWNER            }, },
 142 #endif /* HAVE_SOLARIS_CAPABILITIES */
 143 };
 144
 145 #ifdef HAVE_LCAPS
 146 /* Linux forms of capabilities methods */
 147 /* convert zebras privileges to system capabilities */
 148 static pset_t *
 149 zcaps2sys (zebra_capabilities_t *zcaps, int num)
 150 {
 151   pset_t *syscaps;
 152   int i, j = 0, count = 0;
 153
 154   if (!num)
 155     return NULL;
 156
 157   /* first count up how many system caps we have */
 158   for (i= 0; i < num; i++)
 159     count += cap_map[zcaps[i]].num;
 160
 161   if ( (syscaps = XCALLOC (MTYPE_PRIVS, (sizeof(pset_t) * num))) == NULL)
 162     {
 163       fprintf (stderr, "%s: could not allocate syscaps!", __func__);
 164       return NULL;
 165     }
 166
 167   syscaps->caps = XCALLOC (MTYPE_PRIVS, (sizeof (pvalue_t) * count));
 168
 169   if (!syscaps->caps)
 170     {
 171       fprintf (stderr, "%s: could not XCALLOC caps!", __func__);
 172       return NULL;
 173     }
 174
 175   /* copy the capabilities over */
 176   count = 0;
 177   for (i=0; i < num; i++)
 178     for (j = 0; j < cap_map[zcaps[i]].num; j++)
 179       syscaps->caps[count++] = cap_map[zcaps[i]].system_caps[j];
 180
 181   /* iterations above should be exact same as previous count, obviously.. */
 182   syscaps->num = count;
 183
 184   return syscaps;
 185 }
 186
 187 /* set or clear the effective capabilities to/from permitted */
 188 int
 189 zprivs_change_caps (zebra_privs_ops_t op)
 190 {
 191   cap_flag_value_t cflag;
 192
 193   /* should be no possibility of being called without valid caps */
 194   assert (zprivs_state.syscaps_p && zprivs_state.caps);
 195   if (! (zprivs_state.syscaps_p && zprivs_state.caps))
 196     exit (1);
 197
 198   if (op == ZPRIVS_RAISE)
 199     cflag = CAP_SET;
 200   else if (op == ZPRIVS_LOWER)
 201     cflag = CAP_CLEAR;
 202   else
 203     return -1;
 204
 205   if ( !cap_set_flag (zprivs_state.caps, CAP_EFFECTIVE,
 206                        zprivs_state.syscaps_p->num,
 207                        zprivs_state.syscaps_p->caps,
 208                        cflag))
 209     return cap_set_proc (zprivs_state.caps);
 210   return -1;
 211 }
 212
 213 zebra_privs_current_t
 214 zprivs_state_caps (void)
 215 {
 216   int i;
 217   cap_flag_value_t val;
 218
 219   /* should be no possibility of being called without valid caps */
 220   assert (zprivs_state.syscaps_p && zprivs_state.caps);
 221   if (! (zprivs_state.syscaps_p && zprivs_state.caps))
 222     exit (1);
 223
 224   for (i=0; i < zprivs_state.syscaps_p->num; i++)
 225     {
 226       if ( cap_get_flag (zprivs_state.caps, zprivs_state.syscaps_p->caps[i],
 227                          CAP_EFFECTIVE, &val) )
 228         {
 229           zlog_warn ("zprivs_state_caps: could not cap_get_flag, %s",
 230                      safe_strerror (errno) );
 231           return ZPRIVS_UNKNOWN;
 232         }
 233       if (val == CAP_SET)
 234         return ZPRIVS_RAISED;
 235     }
 236   return ZPRIVS_LOWERED;
 237 }
 238
 239 static void
 240 zprivs_caps_init (struct zebra_privs_t *zprivs)
 241 {
 242   zprivs_state.syscaps_p = zcaps2sys (zprivs->caps_p, zprivs->cap_num_p);
 243   zprivs_state.syscaps_i = zcaps2sys (zprivs->caps_i, zprivs->cap_num_i);
 244
 245   /* Tell kernel we want caps maintained across uid changes */
 246   if ( prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) == -1 )
 247     {
 248       fprintf (stderr, "privs_init: could not set PR_SET_KEEPCAPS, %s\n",
 249                 safe_strerror (errno) );
 250       exit(1);
 251     }
 252
 253   if ( !zprivs_state.syscaps_p )
 254     {
 255       fprintf (stderr, "privs_init: capabilities enabled, "
 256                        "but no capabilities supplied\n");
 257     }
 258
 259   /* we have caps, we have no need to ever change back the original user */
 260   if (zprivs_state.zuid)
 261     {
 262       if ( setreuid (zprivs_state.zuid, zprivs_state.zuid) )
 263         {
 264           fprintf (stderr, "zprivs_init (cap): could not setreuid, %s\n",
 265                      safe_strerror (errno));
 266           exit (1);
 267         }
 268     }
 269
 270   if ( !(zprivs_state.caps = cap_init()) )
 271     {
 272       fprintf (stderr, "privs_init: failed to cap_init, %s\n",
 273                safe_strerror (errno));
 274       exit (1);
 275     }
 276
 277   if ( cap_clear (zprivs_state.caps) )
 278     {
 279       fprintf (stderr, "privs_init: failed to cap_clear, %s\n",
 280                safe_strerror (errno));
 281       exit (1);
 282     }
 283
 284   /* set permitted caps */
 285   cap_set_flag(zprivs_state.caps, CAP_PERMITTED,
 286                zprivs_state.syscaps_p->num,
 287                zprivs_state.syscaps_p->caps,
 288                CAP_SET);
 289
 290   /* set inheritable caps, if any */
 291   if (zprivs_state.syscaps_i && zprivs_state.syscaps_i->num)
 292     {
 293       cap_set_flag(zprivs_state.caps, CAP_INHERITABLE,
 294                    zprivs_state.syscaps_i->num,
 295                    zprivs_state.syscaps_i->caps,
 296                    CAP_SET);
 297     }
 298
 299   /* apply caps. CAP_EFFECTIVE is cleared. we'll raise the caps as
 300    * and when, and only when, they are needed.
 301    */
 302   if ( cap_set_proc (zprivs_state.caps) )
 303     {
 304       cap_t current_caps;
 305       char *current_caps_text = NULL;
 306       char *wanted_caps_text = NULL;
 307
 308       fprintf(stderr, "privs_init: initial cap_set_proc failed: %s\n",
 309               safe_strerror(errno));
 310
 311       current_caps = cap_get_proc();
 312       if (current_caps)
 313         {
 314           current_caps_text = cap_to_text(current_caps, NULL);
 315           cap_free(current_caps);
 316         }
 317
 318       wanted_caps_text = cap_to_text(zprivs_state.caps, NULL);
 319       fprintf(stderr, "Wanted caps: %s\n", wanted_caps_text ? wanted_caps_text : "???");
 320       fprintf(stderr, "Have   caps: %s\n", current_caps_text ? current_caps_text : "???");
 321       if (current_caps_text)
 322           cap_free(current_caps_text);
 323       if (wanted_caps_text)
 324           cap_free(wanted_caps_text);
 325
 326       exit (1);
 327     }
 328
 329   /* set methods for the caller to use */
 330   zprivs->change = zprivs_change_caps;
 331   zprivs->current_state = zprivs_state_caps;
 332 }
 333
 334 static void
 335 zprivs_caps_terminate (void)
 336 {
 337   /* clear all capabilities */
 338   if (zprivs_state.caps)
 339       cap_clear (zprivs_state.caps);
 340
 341   /* and boom, capabilities are gone forever */
 342   if ( cap_set_proc (zprivs_state.caps) )
 343     {
 344       fprintf (stderr, "privs_terminate: cap_set_proc failed, %s",
 345                 safe_strerror (errno) );
 346       exit (1);
 347     }
 348
 349   /* free up private state */
 350   if (zprivs_state.syscaps_p->num)
 351     {
 352       XFREE (MTYPE_PRIVS, zprivs_state.syscaps_p->caps);
 353       XFREE (MTYPE_PRIVS, zprivs_state.syscaps_p);
 354     }
 355
 356   if (zprivs_state.syscaps_i && zprivs_state.syscaps_i->num)
 357     {
 358       XFREE (MTYPE_PRIVS, zprivs_state.syscaps_i->caps);
 359       XFREE (MTYPE_PRIVS, zprivs_state.syscaps_i);
 360     }
 361
 362   cap_free (zprivs_state.caps);
 363 }
 364 #elif defined (HAVE_SOLARIS_CAPABILITIES) /* !HAVE_LCAPS */
 365
 366 /* Solaris specific capability/privilege methods
 367  *
 368  * Resources:
 369  * - the 'privileges' man page
 370  * - http://cvs.opensolaris.org
 371  * - http://blogs.sun.com/roller/page/gbrunett?entry=privilege_enabling_set_id_programs1
 372  */
 373
 374 static pset_t *
 375 zprivs_caps_minimal ()
 376 {
 377   pset_t *minimal;
 378
 379   if ((minimal = priv_str_to_set("basic", ",", NULL)) == NULL)
 380     {
 381       fprintf (stderr, "%s: couldn't get basic set!\n", __func__);
 382       exit (1);
 383     }
 384
 385    /* create a minimal privilege set from the basic set */
 386   (void) priv_delset(minimal, PRIV_PROC_EXEC);
 387   (void) priv_delset(minimal, PRIV_PROC_INFO);
 388   (void) priv_delset(minimal, PRIV_PROC_SESSION);
 389   (void) priv_delset(minimal, PRIV_FILE_LINK_ANY);
 390
 391   return  minimal;
 392 }
 393
 394 /* convert zebras privileges to system capabilities */
 395 static pset_t *
 396 zcaps2sys (zebra_capabilities_t *zcaps, int num)
 397 {
 398   pset_t *syscaps;
 399   int i, j = 0;
 400
 401   if ((syscaps = priv_allocset()) == NULL)
 402     {
 403       fprintf (stderr, "%s: could not allocate syscaps!\n", __func__);
 404       exit (1);
 405     }
 406
 407   priv_emptyset (syscaps);
 408
 409   for (i=0; i < num; i++)
 410     for (j = 0; j < cap_map[zcaps[i]].num; j++)
 411       priv_addset (syscaps, cap_map[zcaps[i]].system_caps[j]);
 412
 413   return syscaps;
 414 }
 415
 416 /* callback exported to users to RAISE and LOWER effective privileges
 417  * from nothing to the given permitted set and back down
 418  */
 419 int
 420 zprivs_change_caps (zebra_privs_ops_t op)
 421 {
 422   pset_t *privset;
 423
 424   /* should be no possibility of being called without valid caps */
 425   assert (zprivs_state.syscaps_p);
 426   if (!zprivs_state.syscaps_p)
 427     {
 428       fprintf (stderr, "%s: Eek, missing privileged caps!", __func__);
 429       exit (1);
 430     }
 431
 432   assert (zprivs_state.caps);
 433   if (!zprivs_state.caps)
 434     {
 435       fprintf (stderr, "%s: Eek, missing caps!", __func__);
 436       exit (1);
 437     }
 438
 439   /* to raise: copy original permitted as our working effective set
 440    * to lower: copy regular effective set stored in zprivs_state.caps
 441    */
 442   if (op == ZPRIVS_RAISE)
 443     privset = zprivs_state.syscaps_p;
 444   else if (op == ZPRIVS_LOWER)
 445     privset = zprivs_state.caps;
 446   else
 447     return -1;
 448
 449   if (setppriv (PRIV_SET, PRIV_EFFECTIVE, privset) != 0)
 450     return -1;
 451
 452   return 0;
 453 }
 454
 455 /* Retrieve current privilege state, is it RAISED or LOWERED? */
 456 zebra_privs_current_t
 457 zprivs_state_caps (void)
 458 {
 459   zebra_privs_current_t result;
 460   pset_t *effective;
 461
 462   if ( (effective = priv_allocset()) == NULL)
 463     {
 464       fprintf (stderr, "%s: failed to get priv_allocset! %s\n", __func__,
 465                safe_strerror (errno));
 466       return ZPRIVS_UNKNOWN;
 467     }
 468
 469   if (getppriv (PRIV_EFFECTIVE, effective))
 470     {
 471       fprintf (stderr, "%s: failed to get state! %s\n", __func__,
 472                safe_strerror (errno));
 473       result = ZPRIVS_UNKNOWN;
 474     }
 475   else
 476     {
 477       if (priv_isequalset (effective, zprivs_state.syscaps_p))
 478         result = ZPRIVS_RAISED;
 479       else if (priv_isequalset (effective, zprivs_state.caps))
 480         result = ZPRIVS_LOWERED;
 481       else
 482         result = ZPRIVS_UNKNOWN;
 483     }
 484
 485   priv_freeset (effective);
 486   return result;
 487 }
 488
 489 static void
 490 zprivs_caps_init (struct zebra_privs_t *zprivs)
 491 {
 492   pset_t *basic;
 493   pset_t *minimal;
 494
 495   /* the specified sets */
 496   zprivs_state.syscaps_p = zcaps2sys (zprivs->caps_p, zprivs->cap_num_p);
 497   zprivs_state.syscaps_i = zcaps2sys (zprivs->caps_i, zprivs->cap_num_i);
 498
 499   /* nonsensical to have gotten here but not have capabilities */
 500   if (!zprivs_state.syscaps_p)
 501     {
 502       fprintf (stderr, "%s: capabilities enabled, "
 503                        "but no valid capabilities supplied\n",
 504                        __func__);
 505     }
 506
 507   /* We retain the basic set in our permitted set, as Linux has no
 508    * equivalent. The basic set on Linux hence is implicit, always
 509    * there.
 510    */
 511   if ((basic = priv_str_to_set("basic", ",", NULL)) == NULL)
 512     {
 513       fprintf (stderr, "%s: couldn't get basic set!\n", __func__);
 514       exit (1);
 515     }
 516
 517   /* Add the basic set to the permitted set */
 518   priv_union (basic, zprivs_state.syscaps_p);
 519   priv_freeset (basic);
 520
 521   /* Hey kernel, we know about privileges!
 522    * this isn't strictly required, use of setppriv should have same effect
 523    */
 524   if (setpflags (PRIV_AWARE, 1))
 525     {
 526       fprintf (stderr, "%s: error setting PRIV_AWARE!, %s\n", __func__,
 527                safe_strerror (errno) );
 528       exit (1);
 529     }
 530
 531   /* need either valid or empty sets for both p and i.. */
 532   assert (zprivs_state.syscaps_i && zprivs_state.syscaps_p);
 533
 534   /* we have caps, we have no need to ever change back the original user
 535    * change real, effective and saved to the specified user.
 536    */
 537   if (zprivs_state.zuid)
 538     {
 539       if ( setreuid (zprivs_state.zuid, zprivs_state.zuid) )
 540         {
 541           fprintf (stderr, "%s: could not setreuid, %s\n",
 542                    __func__, safe_strerror (errno));
 543           exit (1);
 544         }
 545     }
 546
 547   /* set the permitted set */
 548   if (setppriv (PRIV_SET, PRIV_PERMITTED, zprivs_state.syscaps_p))
 549     {
 550       fprintf (stderr, "%s: error setting permitted set!, %s\n", __func__,
 551                safe_strerror (errno) );
 552       exit (1);
 553     }
 554
 555   /* set the inheritable set */
 556   if (setppriv (PRIV_SET, PRIV_INHERITABLE, zprivs_state.syscaps_i))
 557     {
 558       fprintf (stderr, "%s: error setting inheritable set!, %s\n", __func__,
 559                safe_strerror (errno) );
 560       exit (1);
 561     }
 562
 563   /* we need a minimal basic set for 'effective', potentially for inheritable too */
 564   minimal = zprivs_caps_minimal();
 565
 566   /* now set the effective set with a subset of basic privileges */
 567   if (setppriv (PRIV_SET, PRIV_EFFECTIVE, minimal))
 568     {
 569       fprintf (stderr, "%s: error setting effective set!, %s\n", __func__,
 570                safe_strerror (errno) );
 571       exit (1);
 572     }
 573
 574   /* we'll use the minimal set as our working-storage privset */
 575   zprivs_state.caps = minimal;
 576
 577   /* set methods for the caller to use */
 578   zprivs->change = zprivs_change_caps;
 579   zprivs->current_state = zprivs_state_caps;
 580 }
 581
 582 static void
 583 zprivs_caps_terminate (void)
 584 {
 585   assert (zprivs_state.caps);
 586
 587   /* clear all capabilities by using working-storage privset */
 588   setppriv (PRIV_SET, PRIV_EFFECTIVE, zprivs_state.caps);
 589   setppriv (PRIV_SET, PRIV_PERMITTED, zprivs_state.caps);
 590   setppriv (PRIV_SET, PRIV_INHERITABLE, zprivs_state.caps);
 591
 592   /* free up private state */
 593   if (zprivs_state.syscaps_p)
 594     priv_freeset (zprivs_state.syscaps_p);
 595   if (zprivs_state.syscaps_i)
 596     priv_freeset (zprivs_state.syscaps_i);
 597
 598   priv_freeset (zprivs_state.caps);
 599 }
 600 #else /* !HAVE_LCAPS && ! HAVE_SOLARIS_CAPABILITIES */
 601 #error "Neither Solaris nor Linux capabilities, dazed and confused..."
 602 #endif /* HAVE_LCAPS */
 603 #endif /* HAVE_CAPABILITIES */
 604
 605 int
 606 zprivs_change_uid (zebra_privs_ops_t op)
 607 {
 608
 609   if (op == ZPRIVS_RAISE)
 610     return seteuid (zprivs_state.zsuid);
 611   else if (op == ZPRIVS_LOWER)
 612     return seteuid (zprivs_state.zuid);
 613   else
 614     return -1;
 615 }
 616
 617 zebra_privs_current_t
 618 zprivs_state_uid (void)
 619 {
 620   return ( (zprivs_state.zuid == geteuid()) ? ZPRIVS_LOWERED : ZPRIVS_RAISED);
 621 }
 622
 623 int
 624 zprivs_change_null (zebra_privs_ops_t op)
 625 {
 626   return 0;
 627 }
 628
 629 zebra_privs_current_t
 630 zprivs_state_null (void)
 631 {
 632   return zprivs_null_state;
 633 }
 634
 635 #ifndef HAVE_GETGROUPLIST
 636 /* Solaris 11 has no getgrouplist() */
 637 static int
 638 getgrouplist(const char *user, gid_t group, gid_t *groups, int *ngroups)
 639 {
 640   struct group *grp;
 641   size_t usridx;
 642   int pos = 0, ret;
 643
 644   if (pos < *ngroups)
 645     groups[pos] = group;
 646   pos++;
 647
 648   setgrent();
 649   while ((grp = getgrent()))
 650     {
 651       if (grp->gr_gid == group)
 652         continue;
 653       for (usridx = 0; grp->gr_mem[usridx] != NULL; usridx++)
 654         if (!strcmp (grp->gr_mem[usridx], user))
 655           {
 656             if (pos < *ngroups)
 657               groups[pos] = grp->gr_gid;
 658             pos++;
 659             break;
 660           }
 661     }
 662   endgrent();
 663
 664   ret = (pos <= *ngroups) ? pos : -1;
 665   *ngroups = pos;
 666   return ret;
 667 }
 668 #endif /* HAVE_GETGROUPLIST */
 669
 670 void
 671 zprivs_init(struct zebra_privs_t *zprivs)
 672 {
 673   struct passwd *pwentry = NULL;
 674   struct group *grentry = NULL;
 675   gid_t groups[NGROUPS_MAX];
 676   int i, ngroups = 0;
 677   int found = 0;
 678
 679   if (!zprivs)
 680     {
 681       fprintf (stderr, "zprivs_init: called with NULL arg!\n");
 682       exit (1);
 683     }
 684
 685   /* NULL privs */
 686   if (! (zprivs->user || zprivs->group
 687          || zprivs->cap_num_p || zprivs->cap_num_i) )
 688     {
 689       zprivs->change = zprivs_change_null;
 690       zprivs->current_state = zprivs_state_null;
 691       return;
 692     }
 693
 694   if (zprivs->user)
 695     {
 696       if ( (pwentry = getpwnam (zprivs->user)) == NULL )
 697         {
 698           /* cant use log.h here as it depends on vty */
 699           fprintf (stderr, "privs_init: could not lookup user %s\n",
 700                    zprivs->user);
 701           exit (1);
 702         }
 703
 704       zprivs_state.zuid = pwentry->pw_uid;
 705       zprivs_state.zgid = pwentry->pw_gid;
 706     }
 707
 708   grentry = NULL;
 709
 710   if (zprivs->group)
 711     {
 712       if ( (grentry = getgrnam (zprivs->group)) == NULL )
 713         {
 714           fprintf (stderr, "privs_init: could not lookup group %s\n",
 715                    zprivs->group);
 716           exit (1);
 717         }
 718
 719       zprivs_state.zgid = grentry->gr_gid;
 720     }
 721
 722   if (zprivs->user)
 723     {
 724       ngroups = sizeof(groups);
 725       if ( (ngroups = getgrouplist (zprivs->user, zprivs_state.zgid, groups, &ngroups )) < 0 )
 726         {
 727           /* cant use log.h here as it depends on vty */
 728           fprintf (stderr, "privs_init: could not getgrouplist for user %s\n",
 729                    zprivs->user);
 730           exit (1);
 731         }
 732     }
 733
 734   if (zprivs->vty_group)
 735     /* Add the vty_group to the supplementary groups so it can be chowned to */
 736     {
 737       if ( (grentry = getgrnam (zprivs->vty_group)) )
 738         {
 739           zprivs_state.vtygrp = grentry->gr_gid;
 740
 741           for ( i = 0; i < ngroups; i++ )
 742             if ( groups[i] == zprivs_state.vtygrp )
 743               {
 744                 found++;
 745                 break;
 746               }
 747
 748           if (!found)
 749             {
 750               fprintf (stderr, "privs_init: user(%s) is not part of vty group specified(%s)\n",
 751                        zprivs->user, zprivs->vty_group);
 752               exit (1);
 753             }
 754           if ( i >= ngroups && ngroups < (int) ZEBRA_NUM_OF(groups) )
 755             {
 756               groups[i] = zprivs_state.vtygrp;
 757             }
 758         }
 759       else
 760         {
 761           fprintf (stderr, "privs_init: could not lookup vty group %s\n",
 762                    zprivs->vty_group);
 763           exit (1);
 764         }
 765     }
 766
 767   if (ngroups)
 768     {
 769       if ( setgroups (ngroups, groups) )
 770         {
 771           fprintf (stderr, "privs_init: could not setgroups, %s\n",
 772                    safe_strerror (errno) );
 773           exit (1);
 774         }
 775     }
 776
 777   if (zprivs_state.zgid)
 778     {
 779       /* change group now, forever. uid we do later */
 780       if ( setregid (zprivs_state.zgid, zprivs_state.zgid) )
 781         {
 782           fprintf (stderr, "zprivs_init: could not setregid, %s\n",
 783                     safe_strerror (errno) );
 784           exit (1);
 785         }
 786     }
 787
 788 #ifdef HAVE_CAPABILITIES
 789   zprivs_caps_init (zprivs);
 790 #else /* !HAVE_CAPABILITIES */
 791   /* we dont have caps. we'll need to maintain rid and saved uid
 792    * and change euid back to saved uid (who we presume has all neccessary
 793    * privileges) whenever we are asked to raise our privileges.
 794    *
 795    * This is not worth that much security wise, but all we can do.
 796    */
 797   zprivs_state.zsuid = geteuid();
 798   if ( zprivs_state.zuid )
 799     {
 800       if ( setreuid (-1, zprivs_state.zuid) )
 801         {
 802           fprintf (stderr, "privs_init (uid): could not setreuid, %s\n",
 803                    safe_strerror (errno));
 804           exit (1);
 805         }
 806     }
 807
 808   zprivs->change = zprivs_change_uid;
 809   zprivs->current_state = zprivs_state_uid;
 810 #endif /* HAVE_CAPABILITIES */
 811 }
 812
 813 void
 814 zprivs_terminate (struct zebra_privs_t *zprivs)
 815 {
 816   if (!zprivs)
 817     {
 818       fprintf (stderr, "%s: no privs struct given, terminating", __func__);
 819       exit (0);
 820     }
 821
 822 #ifdef HAVE_CAPABILITIES
 823   zprivs_caps_terminate();
 824 #else /* !HAVE_CAPABILITIES */
 825   if (zprivs_state.zuid)
 826     {
 827       if ( setreuid (zprivs_state.zuid, zprivs_state.zuid) )
 828         {
 829           fprintf (stderr, "privs_terminate: could not setreuid, %s",
 830                      safe_strerror (errno) );
 831           exit (1);
 832         }
 833      }
 834 #endif /* HAVE_LCAPS */
 835
 836   zprivs->change = zprivs_change_null;
 837   zprivs->current_state = zprivs_state_null;
 838   zprivs_null_state = ZPRIVS_LOWERED;
 839   return;
 840 }
 841
 842 void
 843 zprivs_get_ids(struct zprivs_ids_t *ids)
 844 {
 845
 846    ids->uid_priv = getuid();
 847    (zprivs_state.zuid) ? (ids->uid_normal = zprivs_state.zuid)
 848                      : (ids->uid_normal = -1);
 849    (zprivs_state.zgid) ? (ids->gid_normal = zprivs_state.zgid)
 850                      : (ids->gid_normal = -1);
 851    (zprivs_state.vtygrp) ? (ids->gid_vty = zprivs_state.vtygrp)
 852                        : (ids->gid_vty = -1);
 853
 854    return;
 855 }