4 * Copyright (C) 2003 Paul Jakma.
5 * Copyright (c) 2005, 2011, Oracle and/or its affiliates. All rights reserved.
7 * This file is part of GNU Zebra.
9 * GNU Zebra is free software; you can redistribute it and/or modify it
10 * under the terms of the GNU General Public License as published by the
11 * Free Software Foundation; either version 2, or (at your option) any
14 * GNU Zebra is distributed in the hope that it will be useful, but
15 * WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17 * General Public License for more details.
19 * You should have received a copy of the GNU General Public License along
20 * with this program; see the file COPYING; if not, write to the Free Software
21 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
27 #include "lib_errors.h"
28 #include "lib/queue.h"
30 DEFINE_MTYPE_STATIC(LIB
, PRIVS
, "Privilege information")
33 * Different capabilities/privileges apis have different characteristics: some
34 * are process-wide, and some are per-thread.
36 #ifdef HAVE_CAPABILITIES
38 static const bool privs_per_process
; /* = false */
39 #elif defined(HAVE_SOLARIS_CAPABILITIES)
40 static const bool privs_per_process
= true;
43 static const bool privs_per_process
= true;
44 #endif /* HAVE_CAPABILITIES */
46 #ifdef HAVE_CAPABILITIES
48 /* sort out some generic internal types for:
50 * privilege values (cap_value_t, priv_t) -> pvalue_t
51 * privilege set (..., priv_set_t) -> pset_t
52 * privilege working storage (cap_t, ...) -> pstorage_t
54 * values we think of as numeric (they're ints really, but we dont know)
55 * sets are mostly opaque, to hold a set of privileges, related in some way.
56 * storage binds together a set of sets we're interested in.
57 * (in reality: cap_value_t and priv_t are ints)
60 /* Linux doesn't have a 'set' type: a set of related privileges */
65 typedef cap_value_t pvalue_t
;
66 typedef struct _pset pset_t
;
67 typedef cap_t pstorage_t
;
69 #elif defined(HAVE_SOLARIS_CAPABILITIES)
70 typedef priv_t pvalue_t
;
71 typedef priv_set_t pset_t
;
72 typedef priv_set_t
*pstorage_t
;
73 #else /* neither LCAPS nor SOLARIS_CAPABILITIES */
74 #error "HAVE_CAPABILITIES defined, but neither LCAPS nor Solaris Capabilties!"
75 #endif /* HAVE_LCAPS */
76 #endif /* HAVE_CAPABILITIES */
78 /* the default NULL state we report is RAISED, but could be LOWERED if
79 * zprivs_terminate is called and the NULL handler is installed.
81 static zebra_privs_current_t zprivs_null_state
= ZPRIVS_RAISED
;
83 /* internal privileges state */
84 static struct _zprivs_t
{
85 #ifdef HAVE_CAPABILITIES
86 pstorage_t caps
; /* working storage */
87 pset_t
*syscaps_p
; /* system-type requested permitted caps */
88 pset_t
*syscaps_i
; /* system-type requested inheritable caps */
89 #endif /* HAVE_CAPABILITIES */
90 uid_t zuid
, /* uid to run as */
91 zsuid
; /* saved uid */
92 gid_t zgid
; /* gid to run as */
93 gid_t vtygrp
; /* gid for vty sockets */
96 /* externally exported but not directly accessed functions */
97 #ifdef HAVE_CAPABILITIES
98 int zprivs_change_caps(zebra_privs_ops_t
);
99 zebra_privs_current_t
zprivs_state_caps(void);
100 #endif /* HAVE_CAPABILITIES */
101 int zprivs_change_uid(zebra_privs_ops_t
);
102 zebra_privs_current_t
zprivs_state_uid(void);
103 int zprivs_change_null(zebra_privs_ops_t
);
104 zebra_privs_current_t
zprivs_state_null(void);
106 #ifdef HAVE_CAPABILITIES
107 /* internal capability API */
108 static pset_t
*zcaps2sys(zebra_capabilities_t
*, int);
109 static void zprivs_caps_init(struct zebra_privs_t
*);
110 static void zprivs_caps_terminate(void);
112 /* Map of Quagga abstract capabilities to system capabilities */
115 pvalue_t
*system_caps
;
116 } cap_map
[ZCAP_MAX
] = {
117 #ifdef HAVE_LCAPS /* Quagga -> Linux capabilities mappings */
120 2, (pvalue_t
[]){CAP_SETGID
, CAP_SETUID
},
124 1, (pvalue_t
[]){CAP_NET_BIND_SERVICE
},
128 1, (pvalue_t
[]){CAP_NET_ADMIN
},
132 1, (pvalue_t
[]){CAP_NET_RAW
},
143 1, (pvalue_t
[]){CAP_SYS_NICE
},
147 1, (pvalue_t
[]){CAP_SYS_PTRACE
},
149 [ZCAP_DAC_OVERRIDE
] =
151 1, (pvalue_t
[]){CAP_DAC_OVERRIDE
},
155 1, (pvalue_t
[]){CAP_DAC_READ_SEARCH
},
159 1, (pvalue_t
[]){CAP_SYS_ADMIN
},
163 1, (pvalue_t
[]){CAP_FOWNER
},
165 #elif defined(HAVE_SOLARIS_CAPABILITIES) /* HAVE_LCAPS */
166 /* Quagga -> Solaris privilege mappings */
169 1, (pvalue_t
[]){PRIV_PROC_SETID
},
173 1, (pvalue_t
[]){PRIV_NET_PRIVADDR
},
175 /* IP_CONFIG is a subset of NET_CONFIG and is allowed in zones */
176 #ifdef PRIV_SYS_IP_CONFIG
179 1, (pvalue_t
[]){PRIV_SYS_IP_CONFIG
},
184 1, (pvalue_t
[]){PRIV_SYS_NET_CONFIG
},
189 2, (pvalue_t
[]){PRIV_NET_RAWACCESS
,
190 PRIV_NET_ICMPACCESS
},
194 1, (pvalue_t
[]){PRIV_PROC_CHROOT
},
198 1, (pvalue_t
[]){PRIV_PROC_PRIOCNTL
},
202 1, (pvalue_t
[]){PRIV_PROC_SESSION
},
204 [ZCAP_DAC_OVERRIDE
] =
206 5, (pvalue_t
[]){PRIV_FILE_DAC_EXECUTE
,
208 PRIV_FILE_DAC_SEARCH
,
210 PRIV_FILE_DAC_SEARCH
},
214 2, (pvalue_t
[]){PRIV_FILE_DAC_SEARCH
,
219 1, (pvalue_t
[]){PRIV_SYS_ADMIN
},
223 1, (pvalue_t
[]){PRIV_FILE_OWNER
},
225 #endif /* HAVE_SOLARIS_CAPABILITIES */
229 /* Linux forms of capabilities methods */
230 /* convert zebras privileges to system capabilities */
231 static pset_t
*zcaps2sys(zebra_capabilities_t
*zcaps
, int num
)
234 int i
, j
= 0, count
= 0;
239 /* first count up how many system caps we have */
240 for (i
= 0; i
< num
; i
++)
241 count
+= cap_map
[zcaps
[i
]].num
;
243 if ((syscaps
= XCALLOC(MTYPE_PRIVS
, (sizeof(pset_t
) * num
))) == NULL
) {
244 fprintf(stderr
, "%s: could not allocate syscaps!", __func__
);
248 syscaps
->caps
= XCALLOC(MTYPE_PRIVS
, (sizeof(pvalue_t
) * count
));
250 if (!syscaps
->caps
) {
251 fprintf(stderr
, "%s: could not XCALLOC caps!", __func__
);
255 /* copy the capabilities over */
257 for (i
= 0; i
< num
; i
++)
258 for (j
= 0; j
< cap_map
[zcaps
[i
]].num
; j
++)
259 syscaps
->caps
[count
++] =
260 cap_map
[zcaps
[i
]].system_caps
[j
];
262 /* iterations above should be exact same as previous count, obviously..
264 syscaps
->num
= count
;
269 /* set or clear the effective capabilities to/from permitted */
270 int zprivs_change_caps(zebra_privs_ops_t op
)
272 cap_flag_value_t cflag
;
274 /* should be no possibility of being called without valid caps */
275 assert(zprivs_state
.syscaps_p
&& zprivs_state
.caps
);
276 if (!(zprivs_state
.syscaps_p
&& zprivs_state
.caps
))
279 if (op
== ZPRIVS_RAISE
)
281 else if (op
== ZPRIVS_LOWER
)
286 if (!cap_set_flag(zprivs_state
.caps
, CAP_EFFECTIVE
,
287 zprivs_state
.syscaps_p
->num
,
288 zprivs_state
.syscaps_p
->caps
, cflag
))
289 return cap_set_proc(zprivs_state
.caps
);
293 zebra_privs_current_t
zprivs_state_caps(void)
296 cap_flag_value_t val
;
298 /* should be no possibility of being called without valid caps */
299 assert(zprivs_state
.syscaps_p
&& zprivs_state
.caps
);
300 if (!(zprivs_state
.syscaps_p
&& zprivs_state
.caps
))
303 for (i
= 0; i
< zprivs_state
.syscaps_p
->num
; i
++) {
304 if (cap_get_flag(zprivs_state
.caps
,
305 zprivs_state
.syscaps_p
->caps
[i
], CAP_EFFECTIVE
,
309 "zprivs_state_caps: could not cap_get_flag, %s",
310 safe_strerror(errno
));
311 return ZPRIVS_UNKNOWN
;
314 return ZPRIVS_RAISED
;
316 return ZPRIVS_LOWERED
;
319 static void zprivs_caps_init(struct zebra_privs_t
*zprivs
)
321 zprivs_state
.syscaps_p
= zcaps2sys(zprivs
->caps_p
, zprivs
->cap_num_p
);
322 zprivs_state
.syscaps_i
= zcaps2sys(zprivs
->caps_i
, zprivs
->cap_num_i
);
324 /* Tell kernel we want caps maintained across uid changes */
325 if (prctl(PR_SET_KEEPCAPS
, 1, 0, 0, 0) == -1) {
327 "privs_init: could not set PR_SET_KEEPCAPS, %s\n",
328 safe_strerror(errno
));
332 /* we have caps, we have no need to ever change back the original user
334 /* only change uid if we don't have the correct one */
335 if ((zprivs_state
.zuid
) && (zprivs_state
.zsuid
!= zprivs_state
.zuid
)) {
336 if (setreuid(zprivs_state
.zuid
, zprivs_state
.zuid
)) {
338 "zprivs_init (cap): could not setreuid, %s\n",
339 safe_strerror(errno
));
344 if (!zprivs_state
.syscaps_p
)
347 if (!(zprivs_state
.caps
= cap_init())) {
348 fprintf(stderr
, "privs_init: failed to cap_init, %s\n",
349 safe_strerror(errno
));
353 if (cap_clear(zprivs_state
.caps
)) {
354 fprintf(stderr
, "privs_init: failed to cap_clear, %s\n",
355 safe_strerror(errno
));
359 /* set permitted caps */
360 cap_set_flag(zprivs_state
.caps
, CAP_PERMITTED
,
361 zprivs_state
.syscaps_p
->num
, zprivs_state
.syscaps_p
->caps
,
364 /* set inheritable caps, if any */
365 if (zprivs_state
.syscaps_i
&& zprivs_state
.syscaps_i
->num
) {
366 cap_set_flag(zprivs_state
.caps
, CAP_INHERITABLE
,
367 zprivs_state
.syscaps_i
->num
,
368 zprivs_state
.syscaps_i
->caps
, CAP_SET
);
371 /* apply caps. CAP_EFFECTIVE is cleared. we'll raise the caps as
372 * and when, and only when, they are needed.
374 if (cap_set_proc(zprivs_state
.caps
)) {
376 char *current_caps_text
= NULL
;
377 char *wanted_caps_text
= NULL
;
379 fprintf(stderr
, "privs_init: initial cap_set_proc failed: %s\n",
380 safe_strerror(errno
));
382 current_caps
= cap_get_proc();
384 current_caps_text
= cap_to_text(current_caps
, NULL
);
385 cap_free(current_caps
);
388 wanted_caps_text
= cap_to_text(zprivs_state
.caps
, NULL
);
389 fprintf(stderr
, "Wanted caps: %s\n",
390 wanted_caps_text
? wanted_caps_text
: "???");
391 fprintf(stderr
, "Have caps: %s\n",
392 current_caps_text
? current_caps_text
: "???");
393 if (current_caps_text
)
394 cap_free(current_caps_text
);
395 if (wanted_caps_text
)
396 cap_free(wanted_caps_text
);
401 /* set methods for the caller to use */
402 zprivs
->change
= zprivs_change_caps
;
403 zprivs
->current_state
= zprivs_state_caps
;
406 static void zprivs_caps_terminate(void)
408 /* clear all capabilities */
409 if (zprivs_state
.caps
)
410 cap_clear(zprivs_state
.caps
);
412 /* and boom, capabilities are gone forever */
413 if (cap_set_proc(zprivs_state
.caps
)) {
414 fprintf(stderr
, "privs_terminate: cap_set_proc failed, %s",
415 safe_strerror(errno
));
419 /* free up private state */
420 if (zprivs_state
.syscaps_p
->num
) {
421 XFREE(MTYPE_PRIVS
, zprivs_state
.syscaps_p
->caps
);
422 XFREE(MTYPE_PRIVS
, zprivs_state
.syscaps_p
);
425 if (zprivs_state
.syscaps_i
&& zprivs_state
.syscaps_i
->num
) {
426 XFREE(MTYPE_PRIVS
, zprivs_state
.syscaps_i
->caps
);
427 XFREE(MTYPE_PRIVS
, zprivs_state
.syscaps_i
);
430 cap_free(zprivs_state
.caps
);
432 #elif defined(HAVE_SOLARIS_CAPABILITIES) /* !HAVE_LCAPS */
434 /* Solaris specific capability/privilege methods
437 * - the 'privileges' man page
438 * - http://cvs.opensolaris.org
440 * http://blogs.sun.com/roller/page/gbrunett?entry=privilege_enabling_set_id_programs1
443 static pset_t
*zprivs_caps_minimal()
447 if ((minimal
= priv_str_to_set("basic", ",", NULL
)) == NULL
) {
448 fprintf(stderr
, "%s: couldn't get basic set!\n", __func__
);
452 /* create a minimal privilege set from the basic set */
453 (void)priv_delset(minimal
, PRIV_PROC_EXEC
);
454 (void)priv_delset(minimal
, PRIV_PROC_INFO
);
455 (void)priv_delset(minimal
, PRIV_PROC_SESSION
);
456 (void)priv_delset(minimal
, PRIV_FILE_LINK_ANY
);
461 /* convert zebras privileges to system capabilities */
462 static pset_t
*zcaps2sys(zebra_capabilities_t
*zcaps
, int num
)
467 if ((syscaps
= priv_allocset()) == NULL
) {
468 fprintf(stderr
, "%s: could not allocate syscaps!\n", __func__
);
472 priv_emptyset(syscaps
);
474 for (i
= 0; i
< num
; i
++)
475 for (j
= 0; j
< cap_map
[zcaps
[i
]].num
; j
++)
476 priv_addset(syscaps
, cap_map
[zcaps
[i
]].system_caps
[j
]);
481 /* callback exported to users to RAISE and LOWER effective privileges
482 * from nothing to the given permitted set and back down
484 int zprivs_change_caps(zebra_privs_ops_t op
)
488 /* should be no possibility of being called without valid caps */
489 assert(zprivs_state
.syscaps_p
);
490 if (!zprivs_state
.syscaps_p
) {
491 fprintf(stderr
, "%s: Eek, missing privileged caps!", __func__
);
495 assert(zprivs_state
.caps
);
496 if (!zprivs_state
.caps
) {
497 fprintf(stderr
, "%s: Eek, missing caps!", __func__
);
501 /* to raise: copy original permitted as our working effective set
502 * to lower: copy regular effective set stored in zprivs_state.caps
504 if (op
== ZPRIVS_RAISE
)
505 privset
= zprivs_state
.syscaps_p
;
506 else if (op
== ZPRIVS_LOWER
)
507 privset
= zprivs_state
.caps
;
511 if (setppriv(PRIV_SET
, PRIV_EFFECTIVE
, privset
) != 0)
517 /* Retrieve current privilege state, is it RAISED or LOWERED? */
518 zebra_privs_current_t
zprivs_state_caps(void)
520 zebra_privs_current_t result
;
523 if ((effective
= priv_allocset()) == NULL
) {
524 fprintf(stderr
, "%s: failed to get priv_allocset! %s\n",
525 __func__
, safe_strerror(errno
));
526 return ZPRIVS_UNKNOWN
;
529 if (getppriv(PRIV_EFFECTIVE
, effective
)) {
530 fprintf(stderr
, "%s: failed to get state! %s\n", __func__
,
531 safe_strerror(errno
));
532 result
= ZPRIVS_UNKNOWN
;
534 if (priv_isequalset(effective
, zprivs_state
.syscaps_p
))
535 result
= ZPRIVS_RAISED
;
536 else if (priv_isequalset(effective
, zprivs_state
.caps
))
537 result
= ZPRIVS_LOWERED
;
539 result
= ZPRIVS_UNKNOWN
;
542 priv_freeset(effective
);
546 static void zprivs_caps_init(struct zebra_privs_t
*zprivs
)
551 /* the specified sets */
552 zprivs_state
.syscaps_p
= zcaps2sys(zprivs
->caps_p
, zprivs
->cap_num_p
);
553 zprivs_state
.syscaps_i
= zcaps2sys(zprivs
->caps_i
, zprivs
->cap_num_i
);
555 /* nonsensical to have gotten here but not have capabilities */
556 if (!zprivs_state
.syscaps_p
) {
558 "%s: capabilities enabled, "
559 "but no valid capabilities supplied\n",
563 /* We retain the basic set in our permitted set, as Linux has no
564 * equivalent. The basic set on Linux hence is implicit, always
567 if ((basic
= priv_str_to_set("basic", ",", NULL
)) == NULL
) {
568 fprintf(stderr
, "%s: couldn't get basic set!\n", __func__
);
572 /* Add the basic set to the permitted set */
573 priv_union(basic
, zprivs_state
.syscaps_p
);
576 /* Hey kernel, we know about privileges!
577 * this isn't strictly required, use of setppriv should have same effect
579 if (setpflags(PRIV_AWARE
, 1)) {
580 fprintf(stderr
, "%s: error setting PRIV_AWARE!, %s\n", __func__
,
581 safe_strerror(errno
));
585 /* need either valid or empty sets for both p and i.. */
586 assert(zprivs_state
.syscaps_i
&& zprivs_state
.syscaps_p
);
588 /* we have caps, we have no need to ever change back the original user
589 * change real, effective and saved to the specified user.
591 /* only change uid if we don't have the correct one */
592 if ((zprivs_state
.zuid
) && (zprivs_state
.zsuid
!= zprivs_state
.zuid
)) {
593 if (setreuid(zprivs_state
.zuid
, zprivs_state
.zuid
)) {
594 fprintf(stderr
, "%s: could not setreuid, %s\n",
595 __func__
, safe_strerror(errno
));
600 /* set the permitted set */
601 if (setppriv(PRIV_SET
, PRIV_PERMITTED
, zprivs_state
.syscaps_p
)) {
602 fprintf(stderr
, "%s: error setting permitted set!, %s\n",
603 __func__
, safe_strerror(errno
));
607 /* set the inheritable set */
608 if (setppriv(PRIV_SET
, PRIV_INHERITABLE
, zprivs_state
.syscaps_i
)) {
609 fprintf(stderr
, "%s: error setting inheritable set!, %s\n",
610 __func__
, safe_strerror(errno
));
614 /* we need a minimal basic set for 'effective', potentially for
616 minimal
= zprivs_caps_minimal();
618 /* now set the effective set with a subset of basic privileges */
619 if (setppriv(PRIV_SET
, PRIV_EFFECTIVE
, minimal
)) {
620 fprintf(stderr
, "%s: error setting effective set!, %s\n",
621 __func__
, safe_strerror(errno
));
625 /* we'll use the minimal set as our working-storage privset */
626 zprivs_state
.caps
= minimal
;
628 /* set methods for the caller to use */
629 zprivs
->change
= zprivs_change_caps
;
630 zprivs
->current_state
= zprivs_state_caps
;
633 static void zprivs_caps_terminate(void)
635 assert(zprivs_state
.caps
);
637 /* clear all capabilities by using working-storage privset */
638 setppriv(PRIV_SET
, PRIV_EFFECTIVE
, zprivs_state
.caps
);
639 setppriv(PRIV_SET
, PRIV_PERMITTED
, zprivs_state
.caps
);
640 setppriv(PRIV_SET
, PRIV_INHERITABLE
, zprivs_state
.caps
);
642 /* free up private state */
643 if (zprivs_state
.syscaps_p
)
644 priv_freeset(zprivs_state
.syscaps_p
);
645 if (zprivs_state
.syscaps_i
)
646 priv_freeset(zprivs_state
.syscaps_i
);
648 priv_freeset(zprivs_state
.caps
);
650 #else /* !HAVE_LCAPS && ! HAVE_SOLARIS_CAPABILITIES */
651 #error "Neither Solaris nor Linux capabilities, dazed and confused..."
652 #endif /* HAVE_LCAPS */
653 #endif /* HAVE_CAPABILITIES */
655 int zprivs_change_uid(zebra_privs_ops_t op
)
657 if (zprivs_state
.zsuid
== zprivs_state
.zuid
)
659 if (op
== ZPRIVS_RAISE
)
660 return seteuid(zprivs_state
.zsuid
);
661 else if (op
== ZPRIVS_LOWER
)
662 return seteuid(zprivs_state
.zuid
);
667 zebra_privs_current_t
zprivs_state_uid(void)
669 return ((zprivs_state
.zuid
== geteuid()) ? ZPRIVS_LOWERED
673 int zprivs_change_null(zebra_privs_ops_t op
)
678 zebra_privs_current_t
zprivs_state_null(void)
680 return zprivs_null_state
;
683 #ifndef HAVE_GETGROUPLIST
684 /* Solaris 11 has no getgrouplist() */
685 static int getgrouplist(const char *user
, gid_t group
, gid_t
*groups
,
697 while ((grp
= getgrent())) {
698 if (grp
->gr_gid
== group
)
700 for (usridx
= 0; grp
->gr_mem
[usridx
] != NULL
; usridx
++)
701 if (!strcmp(grp
->gr_mem
[usridx
], user
)) {
703 groups
[pos
] = grp
->gr_gid
;
710 ret
= (pos
<= *ngroups
) ? pos
: -1;
714 #endif /* HAVE_GETGROUPLIST */
717 * Helper function that locates a refcounting object to use: a process-wide
718 * object or a per-pthread object.
720 static struct zebra_privs_refs_t
*get_privs_refs(struct zebra_privs_t
*privs
)
722 struct zebra_privs_refs_t
*temp
, *refs
= NULL
;
725 if (privs_per_process
)
726 refs
= &(privs
->process_refs
);
728 /* Locate - or create - the object for the current pthread. */
729 tid
= pthread_self();
731 STAILQ_FOREACH(temp
, &(privs
->thread_refs
), entry
) {
732 if (pthread_equal(temp
->tid
, tid
)) {
738 /* Need to create a new refcounting object. */
740 refs
= XCALLOC(MTYPE_PRIVS
,
741 sizeof(struct zebra_privs_refs_t
));
743 STAILQ_INSERT_TAIL(&(privs
->thread_refs
), refs
, entry
);
750 struct zebra_privs_t
*_zprivs_raise(struct zebra_privs_t
*privs
,
751 const char *funcname
)
753 int save_errno
= errno
;
754 struct zebra_privs_refs_t
*refs
;
760 * Serialize 'raise' operations; particularly important for
761 * OSes where privs are process-wide.
763 pthread_mutex_lock(&(privs
->mutex
));
765 /* Locate ref-counting object to use */
766 refs
= get_privs_refs(privs
);
768 if (++(refs
->refcount
) == 1) {
770 if (privs
->change(ZPRIVS_RAISE
)) {
771 zlog_err("%s: Failed to raise privileges (%s)",
772 funcname
, safe_strerror(errno
));
775 refs
->raised_in_funcname
= funcname
;
778 pthread_mutex_unlock(&(privs
->mutex
));
783 void _zprivs_lower(struct zebra_privs_t
**privs
)
785 int save_errno
= errno
;
786 struct zebra_privs_refs_t
*refs
;
791 /* Serialize 'lower privs' operation - particularly important
792 * when OS privs are process-wide.
794 pthread_mutex_lock(&(*privs
)->mutex
);
796 refs
= get_privs_refs(*privs
);
798 if (--(refs
->refcount
) == 0) {
800 if ((*privs
)->change(ZPRIVS_LOWER
)) {
801 zlog_err("%s: Failed to lower privileges (%s)",
802 refs
->raised_in_funcname
,
803 safe_strerror(errno
));
806 refs
->raised_in_funcname
= NULL
;
809 pthread_mutex_unlock(&(*privs
)->mutex
);
814 void zprivs_preinit(struct zebra_privs_t
*zprivs
)
816 struct passwd
*pwentry
= NULL
;
817 struct group
*grentry
= NULL
;
820 fprintf(stderr
, "zprivs_init: called with NULL arg!\n");
824 pthread_mutex_init(&(zprivs
->mutex
), NULL
);
825 zprivs
->process_refs
.refcount
= 0;
826 zprivs
->process_refs
.raised_in_funcname
= NULL
;
827 STAILQ_INIT(&zprivs
->thread_refs
);
829 if (zprivs
->vty_group
) {
830 /* in a "NULL" setup, this is allowed to fail too, but still
832 if ((grentry
= getgrnam(zprivs
->vty_group
)))
833 zprivs_state
.vtygrp
= grentry
->gr_gid
;
835 zprivs_state
.vtygrp
= (gid_t
)-1;
839 if (!(zprivs
->user
|| zprivs
->group
|| zprivs
->cap_num_p
840 || zprivs
->cap_num_i
)) {
841 zprivs
->change
= zprivs_change_null
;
842 zprivs
->current_state
= zprivs_state_null
;
847 if ((pwentry
= getpwnam(zprivs
->user
)) == NULL
) {
848 /* cant use log.h here as it depends on vty */
850 "privs_init: could not lookup user %s\n",
855 zprivs_state
.zuid
= pwentry
->pw_uid
;
856 zprivs_state
.zgid
= pwentry
->pw_gid
;
862 if ((grentry
= getgrnam(zprivs
->group
)) == NULL
) {
864 "privs_init: could not lookup group %s\n",
869 zprivs_state
.zgid
= grentry
->gr_gid
;
873 void zprivs_init(struct zebra_privs_t
*zprivs
)
875 gid_t groups
[NGROUPS_MAX
] = {};
880 if (!(zprivs
->user
|| zprivs
->group
|| zprivs
->cap_num_p
881 || zprivs
->cap_num_i
))
885 ngroups
= array_size(groups
);
886 if (getgrouplist(zprivs
->user
, zprivs_state
.zgid
, groups
,
889 /* cant use log.h here as it depends on vty */
891 "privs_init: could not getgrouplist for user %s\n",
897 if (zprivs
->vty_group
)
898 /* Add the vty_group to the supplementary groups so it can be chowned to
901 if (zprivs_state
.vtygrp
== (gid_t
)-1) {
903 "privs_init: could not lookup vty group %s\n",
908 for (i
= 0; i
< ngroups
; i
++)
909 if (groups
[i
] == zprivs_state
.vtygrp
) {
916 "privs_init: user(%s) is not part of vty group specified(%s)\n",
917 zprivs
->user
, zprivs
->vty_group
);
920 if (i
>= ngroups
&& ngroups
< (int)array_size(groups
)) {
921 groups
[i
] = zprivs_state
.vtygrp
;
925 zprivs_state
.zsuid
= geteuid(); /* initial uid */
926 /* add groups only if we changed uid - otherwise skip */
927 if ((ngroups
) && (zprivs_state
.zsuid
!= zprivs_state
.zuid
)) {
928 if (setgroups(ngroups
, groups
)) {
929 fprintf(stderr
, "privs_init: could not setgroups, %s\n",
930 safe_strerror(errno
));
935 /* change gid only if we changed uid - otherwise skip */
936 if ((zprivs_state
.zgid
) && (zprivs_state
.zsuid
!= zprivs_state
.zuid
)) {
937 /* change group now, forever. uid we do later */
938 if (setregid(zprivs_state
.zgid
, zprivs_state
.zgid
)) {
939 fprintf(stderr
, "zprivs_init: could not setregid, %s\n",
940 safe_strerror(errno
));
945 #ifdef HAVE_CAPABILITIES
946 zprivs_caps_init(zprivs
);
949 * If we have initialized the system with no requested
950 * capabilities, change will not have been set
951 * to anything by zprivs_caps_init, As such
952 * we should make sure that when we attempt
953 * to raize privileges that we actually have
954 * a do nothing function to call instead of a
958 zprivs
->change
= zprivs_change_null
;
960 #else /* !HAVE_CAPABILITIES */
961 /* we dont have caps. we'll need to maintain rid and saved uid
962 * and change euid back to saved uid (who we presume has all neccessary
963 * privileges) whenever we are asked to raise our privileges.
965 * This is not worth that much security wise, but all we can do.
967 zprivs_state
.zsuid
= geteuid();
968 /* only change uid if we don't have the correct one */
969 if ((zprivs_state
.zuid
) && (zprivs_state
.zsuid
!= zprivs_state
.zuid
)) {
970 if (setreuid(-1, zprivs_state
.zuid
)) {
972 "privs_init (uid): could not setreuid, %s\n",
973 safe_strerror(errno
));
978 zprivs
->change
= zprivs_change_uid
;
979 zprivs
->current_state
= zprivs_state_uid
;
980 #endif /* HAVE_CAPABILITIES */
983 void zprivs_terminate(struct zebra_privs_t
*zprivs
)
985 struct zebra_privs_refs_t
*refs
;
988 fprintf(stderr
, "%s: no privs struct given, terminating",
993 #ifdef HAVE_CAPABILITIES
994 if (zprivs
->user
|| zprivs
->group
|| zprivs
->cap_num_p
995 || zprivs
->cap_num_i
)
996 zprivs_caps_terminate();
997 #else /* !HAVE_CAPABILITIES */
998 /* only change uid if we don't have the correct one */
999 if ((zprivs_state
.zuid
) && (zprivs_state
.zsuid
!= zprivs_state
.zuid
)) {
1000 if (setreuid(zprivs_state
.zuid
, zprivs_state
.zuid
)) {
1002 "privs_terminate: could not setreuid, %s",
1003 safe_strerror(errno
));
1007 #endif /* HAVE_LCAPS */
1009 while ((refs
= STAILQ_FIRST(&(zprivs
->thread_refs
))) != NULL
) {
1010 STAILQ_REMOVE_HEAD(&(zprivs
->thread_refs
), entry
);
1011 XFREE(MTYPE_PRIVS
, refs
);
1014 zprivs
->change
= zprivs_change_null
;
1015 zprivs
->current_state
= zprivs_state_null
;
1016 zprivs_null_state
= ZPRIVS_LOWERED
;
1020 void zprivs_get_ids(struct zprivs_ids_t
*ids
)
1023 ids
->uid_priv
= getuid();
1024 (zprivs_state
.zuid
) ? (ids
->uid_normal
= zprivs_state
.zuid
)
1025 : (ids
->uid_normal
= -1);
1026 (zprivs_state
.zgid
) ? (ids
->gid_normal
= zprivs_state
.zgid
)
1027 : (ids
->gid_normal
= -1);
1028 (zprivs_state
.vtygrp
) ? (ids
->gid_vty
= zprivs_state
.vtygrp
)
1029 : (ids
->gid_vty
= -1);