lib/privs.c

   1 /*
   2  * Zebra privileges.
   3  *
   4  * Copyright (C) 2003 Paul Jakma.
   5  * Copyright (c) 2005, 2011, Oracle and/or its affiliates. All rights reserved.
   6  *
   7  * This file is part of GNU Zebra.
   8  *
   9  * GNU Zebra is free software; you can redistribute it and/or modify it
  10  * under the terms of the GNU General Public License as published by the
  11  * Free Software Foundation; either version 2, or (at your option) any
  12  * later version.
  13  *
  14  * GNU Zebra is distributed in the hope that it will be useful, but
  15  * WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17  * General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU General Public License along
  20  * with this program; see the file COPYING; if not, write to the Free Software
  21  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
  22  */
  23 #include <zebra.h>
  24 #include "log.h"
  25 #include "privs.h"
  26 #include "memory.h"
  27 #include "frr_pthread.h"
  28 #include "lib_errors.h"
  29 #include "lib/queue.h"
  30
  31 DEFINE_MTYPE_STATIC(LIB, PRIVS, "Privilege information")
  32
  33 /*
  34  * Different capabilities/privileges apis have different characteristics: some
  35  * are process-wide, and some are per-thread.
  36  */
  37 #ifdef HAVE_CAPABILITIES
  38 #ifdef HAVE_LCAPS
  39 static const bool privs_per_process;  /* = false */
  40 #elif defined(HAVE_SOLARIS_CAPABILITIES)
  41 static const bool privs_per_process = true;
  42 #endif
  43 #else
  44 static const bool privs_per_process = true;
  45 #endif  /* HAVE_CAPABILITIES */
  46
  47 #ifdef HAVE_CAPABILITIES
  48
  49 /* sort out some generic internal types for:
  50  *
  51  * privilege values (cap_value_t, priv_t)       -> pvalue_t
  52  * privilege set (..., priv_set_t)              -> pset_t
  53  * privilege working storage (cap_t, ...)       -> pstorage_t
  54  *
  55  * values we think of as numeric (they're ints really, but we dont know)
  56  * sets are mostly opaque, to hold a set of privileges, related in some way.
  57  * storage binds together a set of sets we're interested in.
  58  * (in reality: cap_value_t and priv_t are ints)
  59  */
  60 #ifdef HAVE_LCAPS
  61 /* Linux doesn't have a 'set' type: a set of related privileges */
  62 struct _pset {
  63         int num;
  64         cap_value_t *caps;
  65 };
  66 typedef cap_value_t pvalue_t;
  67 typedef struct _pset pset_t;
  68 typedef cap_t pstorage_t;
  69
  70 #elif defined(HAVE_SOLARIS_CAPABILITIES)
  71 typedef priv_t pvalue_t;
  72 typedef priv_set_t pset_t;
  73 typedef priv_set_t *pstorage_t;
  74 #else /* neither LCAPS nor SOLARIS_CAPABILITIES */
  75 #error "HAVE_CAPABILITIES defined, but neither LCAPS nor Solaris Capabilties!"
  76 #endif /* HAVE_LCAPS */
  77 #endif /* HAVE_CAPABILITIES */
  78
  79 /* the default NULL state we report is RAISED, but could be LOWERED if
  80  * zprivs_terminate is called and the NULL handler is installed.
  81  */
  82 static zebra_privs_current_t zprivs_null_state = ZPRIVS_RAISED;
  83
  84 /* internal privileges state */
  85 static struct _zprivs_t {
  86 #ifdef HAVE_CAPABILITIES
  87         pstorage_t caps;   /* working storage        */
  88         pset_t *syscaps_p; /* system-type requested permitted caps    */
  89         pset_t *syscaps_i; /* system-type requested inheritable caps  */
  90 #endif                     /* HAVE_CAPABILITIES */
  91         uid_t zuid,     /* uid to run as            */
  92                 zsuid;     /* saved uid                */
  93         gid_t zgid;     /* gid to run as            */
  94         gid_t vtygrp;      /* gid for vty sockets      */
  95 } zprivs_state;
  96
  97 /* externally exported but not directly accessed functions */
  98 #ifdef HAVE_CAPABILITIES
  99 int zprivs_change_caps(zebra_privs_ops_t);
 100 zebra_privs_current_t zprivs_state_caps(void);
 101 #endif /* HAVE_CAPABILITIES */
 102 int zprivs_change_uid(zebra_privs_ops_t);
 103 zebra_privs_current_t zprivs_state_uid(void);
 104 int zprivs_change_null(zebra_privs_ops_t);
 105 zebra_privs_current_t zprivs_state_null(void);
 106
 107 #ifdef HAVE_CAPABILITIES
 108 /* internal capability API */
 109 static pset_t *zcaps2sys(zebra_capabilities_t *, int);
 110 static void zprivs_caps_init(struct zebra_privs_t *);
 111 static void zprivs_caps_terminate(void);
 112
 113 /* Map of Quagga abstract capabilities to system capabilities */
 114 static struct {
 115         int num;
 116         pvalue_t *system_caps;
 117 } cap_map[ZCAP_MAX] = {
 118 #ifdef HAVE_LCAPS /* Quagga -> Linux capabilities mappings */
 119                 [ZCAP_SETID] =
 120                         {
 121                                 2, (pvalue_t[]){CAP_SETGID, CAP_SETUID},
 122                         },
 123                 [ZCAP_BIND] =
 124                         {
 125                                 1, (pvalue_t[]){CAP_NET_BIND_SERVICE},
 126                         },
 127                 [ZCAP_NET_ADMIN] =
 128                         {
 129                                 1, (pvalue_t[]){CAP_NET_ADMIN},
 130                         },
 131                 [ZCAP_NET_RAW] =
 132                         {
 133                                 1, (pvalue_t[]){CAP_NET_RAW},
 134                         },
 135                 [ZCAP_CHROOT] =
 136                         {
 137                                 1,
 138                                 (pvalue_t[]){
 139                                         CAP_SYS_CHROOT,
 140                                 },
 141                         },
 142                 [ZCAP_NICE] =
 143                         {
 144                                 1, (pvalue_t[]){CAP_SYS_NICE},
 145                         },
 146                 [ZCAP_PTRACE] =
 147                         {
 148                                 1, (pvalue_t[]){CAP_SYS_PTRACE},
 149                         },
 150                 [ZCAP_DAC_OVERRIDE] =
 151                         {
 152                                 1, (pvalue_t[]){CAP_DAC_OVERRIDE},
 153                         },
 154                 [ZCAP_READ_SEARCH] =
 155                         {
 156                                 1, (pvalue_t[]){CAP_DAC_READ_SEARCH},
 157                         },
 158                 [ZCAP_SYS_ADMIN] =
 159                         {
 160                                 1, (pvalue_t[]){CAP_SYS_ADMIN},
 161                         },
 162                 [ZCAP_FOWNER] =
 163                         {
 164                                 1, (pvalue_t[]){CAP_FOWNER},
 165                         },
 166 #elif defined(HAVE_SOLARIS_CAPABILITIES) /* HAVE_LCAPS */
 167                 /* Quagga -> Solaris privilege mappings */
 168                 [ZCAP_SETID] =
 169                         {
 170                                 1, (pvalue_t[]){PRIV_PROC_SETID},
 171                         },
 172                 [ZCAP_BIND] =
 173                         {
 174                                 1, (pvalue_t[]){PRIV_NET_PRIVADDR},
 175                         },
 176 /* IP_CONFIG is a subset of NET_CONFIG and is allowed in zones */
 177 #ifdef PRIV_SYS_IP_CONFIG
 178                 [ZCAP_NET_ADMIN] =
 179                         {
 180                                 1, (pvalue_t[]){PRIV_SYS_IP_CONFIG},
 181                         },
 182 #else
 183                 [ZCAP_NET_ADMIN] =
 184                         {
 185                                 1, (pvalue_t[]){PRIV_SYS_NET_CONFIG},
 186                         },
 187 #endif
 188                 [ZCAP_NET_RAW] =
 189                         {
 190                                 2, (pvalue_t[]){PRIV_NET_RAWACCESS,
 191                                                 PRIV_NET_ICMPACCESS},
 192                         },
 193                 [ZCAP_CHROOT] =
 194                         {
 195                                 1, (pvalue_t[]){PRIV_PROC_CHROOT},
 196                         },
 197                 [ZCAP_NICE] =
 198                         {
 199                                 1, (pvalue_t[]){PRIV_PROC_PRIOCNTL},
 200                         },
 201                 [ZCAP_PTRACE] =
 202                         {
 203                                 1, (pvalue_t[]){PRIV_PROC_SESSION},
 204                         },
 205                 [ZCAP_DAC_OVERRIDE] =
 206                         {
 207                                 5, (pvalue_t[]){PRIV_FILE_DAC_EXECUTE,
 208                                                 PRIV_FILE_DAC_READ,
 209                                                 PRIV_FILE_DAC_SEARCH,
 210                                                 PRIV_FILE_DAC_WRITE,
 211                                                 PRIV_FILE_DAC_SEARCH},
 212                         },
 213                 [ZCAP_READ_SEARCH] =
 214                         {
 215                                 2, (pvalue_t[]){PRIV_FILE_DAC_SEARCH,
 216                                                 PRIV_FILE_DAC_READ},
 217                         },
 218                 [ZCAP_SYS_ADMIN] =
 219                         {
 220                                 1, (pvalue_t[]){PRIV_SYS_ADMIN},
 221                         },
 222                 [ZCAP_FOWNER] =
 223                         {
 224                                 1, (pvalue_t[]){PRIV_FILE_OWNER},
 225                         },
 226 #endif /* HAVE_SOLARIS_CAPABILITIES */
 227 };
 228
 229 #ifdef HAVE_LCAPS
 230 /* Linux forms of capabilities methods */
 231 /* convert zebras privileges to system capabilities */
 232 static pset_t *zcaps2sys(zebra_capabilities_t *zcaps, int num)
 233 {
 234         pset_t *syscaps;
 235         int i, j = 0, count = 0;
 236
 237         if (!num)
 238                 return NULL;
 239
 240         /* first count up how many system caps we have */
 241         for (i = 0; i < num; i++)
 242                 count += cap_map[zcaps[i]].num;
 243
 244         if ((syscaps = XCALLOC(MTYPE_PRIVS, (sizeof(pset_t) * num))) == NULL) {
 245                 fprintf(stderr, "%s: could not allocate syscaps!", __func__);
 246                 return NULL;
 247         }
 248
 249         syscaps->caps = XCALLOC(MTYPE_PRIVS, (sizeof(pvalue_t) * count));
 250
 251         if (!syscaps->caps) {
 252                 fprintf(stderr, "%s: could not XCALLOC caps!", __func__);
 253                 return NULL;
 254         }
 255
 256         /* copy the capabilities over */
 257         count = 0;
 258         for (i = 0; i < num; i++)
 259                 for (j = 0; j < cap_map[zcaps[i]].num; j++)
 260                         syscaps->caps[count++] =
 261                                 cap_map[zcaps[i]].system_caps[j];
 262
 263         /* iterations above should be exact same as previous count, obviously..
 264          */
 265         syscaps->num = count;
 266
 267         return syscaps;
 268 }
 269
 270 /* set or clear the effective capabilities to/from permitted */
 271 int zprivs_change_caps(zebra_privs_ops_t op)
 272 {
 273         cap_flag_value_t cflag;
 274
 275         /* should be no possibility of being called without valid caps */
 276         assert(zprivs_state.syscaps_p && zprivs_state.caps);
 277         if (!(zprivs_state.syscaps_p && zprivs_state.caps))
 278                 exit(1);
 279
 280         if (op == ZPRIVS_RAISE)
 281                 cflag = CAP_SET;
 282         else if (op == ZPRIVS_LOWER)
 283                 cflag = CAP_CLEAR;
 284         else
 285                 return -1;
 286
 287         if (!cap_set_flag(zprivs_state.caps, CAP_EFFECTIVE,
 288                           zprivs_state.syscaps_p->num,
 289                           zprivs_state.syscaps_p->caps, cflag))
 290                 return cap_set_proc(zprivs_state.caps);
 291         return -1;
 292 }
 293
 294 zebra_privs_current_t zprivs_state_caps(void)
 295 {
 296         int i;
 297         cap_flag_value_t val;
 298
 299         /* should be no possibility of being called without valid caps */
 300         assert(zprivs_state.syscaps_p && zprivs_state.caps);
 301         if (!(zprivs_state.syscaps_p && zprivs_state.caps))
 302                 exit(1);
 303
 304         for (i = 0; i < zprivs_state.syscaps_p->num; i++) {
 305                 if (cap_get_flag(zprivs_state.caps,
 306                                  zprivs_state.syscaps_p->caps[i], CAP_EFFECTIVE,
 307                                  &val)) {
 308                         flog_err(
 309                                 EC_LIB_SYSTEM_CALL,
 310                                 "zprivs_state_caps: could not cap_get_flag, %s",
 311                                 safe_strerror(errno));
 312                         return ZPRIVS_UNKNOWN;
 313                 }
 314                 if (val == CAP_SET)
 315                         return ZPRIVS_RAISED;
 316         }
 317         return ZPRIVS_LOWERED;
 318 }
 319
 320 static void zprivs_caps_init(struct zebra_privs_t *zprivs)
 321 {
 322         zprivs_state.syscaps_p = zcaps2sys(zprivs->caps_p, zprivs->cap_num_p);
 323         zprivs_state.syscaps_i = zcaps2sys(zprivs->caps_i, zprivs->cap_num_i);
 324
 325         /* Tell kernel we want caps maintained across uid changes */
 326         if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) == -1) {
 327                 fprintf(stderr,
 328                         "privs_init: could not set PR_SET_KEEPCAPS, %s\n",
 329                         safe_strerror(errno));
 330                 exit(1);
 331         }
 332
 333         /* we have caps, we have no need to ever change back the original user
 334          */
 335         /* only change uid if we don't have the correct one */
 336         if ((zprivs_state.zuid) && (zprivs_state.zsuid != zprivs_state.zuid)) {
 337                 if (setreuid(zprivs_state.zuid, zprivs_state.zuid)) {
 338                         fprintf(stderr,
 339                                 "zprivs_init (cap): could not setreuid, %s\n",
 340                                 safe_strerror(errno));
 341                         exit(1);
 342                 }
 343         }
 344
 345         if (!zprivs_state.syscaps_p)
 346                 return;
 347
 348         if (!(zprivs_state.caps = cap_init())) {
 349                 fprintf(stderr, "privs_init: failed to cap_init, %s\n",
 350                         safe_strerror(errno));
 351                 exit(1);
 352         }
 353
 354         if (cap_clear(zprivs_state.caps)) {
 355                 fprintf(stderr, "privs_init: failed to cap_clear, %s\n",
 356                         safe_strerror(errno));
 357                 exit(1);
 358         }
 359
 360         /* set permitted caps */
 361         cap_set_flag(zprivs_state.caps, CAP_PERMITTED,
 362                      zprivs_state.syscaps_p->num, zprivs_state.syscaps_p->caps,
 363                      CAP_SET);
 364
 365         /* set inheritable caps, if any */
 366         if (zprivs_state.syscaps_i && zprivs_state.syscaps_i->num) {
 367                 cap_set_flag(zprivs_state.caps, CAP_INHERITABLE,
 368                              zprivs_state.syscaps_i->num,
 369                              zprivs_state.syscaps_i->caps, CAP_SET);
 370         }
 371
 372         /* apply caps. CAP_EFFECTIVE is cleared. we'll raise the caps as
 373          * and when, and only when, they are needed.
 374          */
 375         if (cap_set_proc(zprivs_state.caps)) {
 376                 cap_t current_caps;
 377                 char *current_caps_text = NULL;
 378                 char *wanted_caps_text = NULL;
 379
 380                 fprintf(stderr, "privs_init: initial cap_set_proc failed: %s\n",
 381                         safe_strerror(errno));
 382
 383                 current_caps = cap_get_proc();
 384                 if (current_caps) {
 385                         current_caps_text = cap_to_text(current_caps, NULL);
 386                         cap_free(current_caps);
 387                 }
 388
 389                 wanted_caps_text = cap_to_text(zprivs_state.caps, NULL);
 390                 fprintf(stderr, "Wanted caps: %s\n",
 391                         wanted_caps_text ? wanted_caps_text : "???");
 392                 fprintf(stderr, "Have   caps: %s\n",
 393                         current_caps_text ? current_caps_text : "???");
 394                 if (current_caps_text)
 395                         cap_free(current_caps_text);
 396                 if (wanted_caps_text)
 397                         cap_free(wanted_caps_text);
 398
 399                 exit(1);
 400         }
 401
 402         /* set methods for the caller to use */
 403         zprivs->change = zprivs_change_caps;
 404         zprivs->current_state = zprivs_state_caps;
 405 }
 406
 407 static void zprivs_caps_terminate(void)
 408 {
 409         /* Clear all capabilities, if we have any. */
 410         if (zprivs_state.caps)
 411                 cap_clear(zprivs_state.caps);
 412         else
 413                 return;
 414
 415         /* and boom, capabilities are gone forever */
 416         if (cap_set_proc(zprivs_state.caps)) {
 417                 fprintf(stderr, "privs_terminate: cap_set_proc failed, %s",
 418                         safe_strerror(errno));
 419                 exit(1);
 420         }
 421
 422         /* free up private state */
 423         if (zprivs_state.syscaps_p->num) {
 424                 XFREE(MTYPE_PRIVS, zprivs_state.syscaps_p->caps);
 425                 XFREE(MTYPE_PRIVS, zprivs_state.syscaps_p);
 426         }
 427
 428         if (zprivs_state.syscaps_i && zprivs_state.syscaps_i->num) {
 429                 XFREE(MTYPE_PRIVS, zprivs_state.syscaps_i->caps);
 430                 XFREE(MTYPE_PRIVS, zprivs_state.syscaps_i);
 431         }
 432
 433         cap_free(zprivs_state.caps);
 434 }
 435 #elif defined(HAVE_SOLARIS_CAPABILITIES) /* !HAVE_LCAPS */
 436
 437 /* Solaris specific capability/privilege methods
 438  *
 439  * Resources:
 440  * - the 'privileges' man page
 441  * - http://cvs.opensolaris.org
 442  * -
 443  * http://blogs.sun.com/roller/page/gbrunett?entry=privilege_enabling_set_id_programs1
 444  */
 445
 446 static pset_t *zprivs_caps_minimal()
 447 {
 448         pset_t *minimal;
 449
 450         if ((minimal = priv_str_to_set("basic", ",", NULL)) == NULL) {
 451                 fprintf(stderr, "%s: couldn't get basic set!\n", __func__);
 452                 exit(1);
 453         }
 454
 455         /* create a minimal privilege set from the basic set */
 456         (void)priv_delset(minimal, PRIV_PROC_EXEC);
 457         (void)priv_delset(minimal, PRIV_PROC_INFO);
 458         (void)priv_delset(minimal, PRIV_PROC_SESSION);
 459         (void)priv_delset(minimal, PRIV_FILE_LINK_ANY);
 460
 461         return minimal;
 462 }
 463
 464 /* convert zebras privileges to system capabilities */
 465 static pset_t *zcaps2sys(zebra_capabilities_t *zcaps, int num)
 466 {
 467         pset_t *syscaps;
 468         int i, j = 0;
 469
 470         if ((syscaps = priv_allocset()) == NULL) {
 471                 fprintf(stderr, "%s: could not allocate syscaps!\n", __func__);
 472                 exit(1);
 473         }
 474
 475         priv_emptyset(syscaps);
 476
 477         for (i = 0; i < num; i++)
 478                 for (j = 0; j < cap_map[zcaps[i]].num; j++)
 479                         priv_addset(syscaps, cap_map[zcaps[i]].system_caps[j]);
 480
 481         return syscaps;
 482 }
 483
 484 /* callback exported to users to RAISE and LOWER effective privileges
 485  * from nothing to the given permitted set and back down
 486  */
 487 int zprivs_change_caps(zebra_privs_ops_t op)
 488 {
 489         pset_t *privset;
 490
 491         /* should be no possibility of being called without valid caps */
 492         assert(zprivs_state.syscaps_p);
 493         if (!zprivs_state.syscaps_p) {
 494                 fprintf(stderr, "%s: Eek, missing privileged caps!", __func__);
 495                 exit(1);
 496         }
 497
 498         assert(zprivs_state.caps);
 499         if (!zprivs_state.caps) {
 500                 fprintf(stderr, "%s: Eek, missing caps!", __func__);
 501                 exit(1);
 502         }
 503
 504         /* to raise: copy original permitted as our working effective set
 505          * to lower: copy regular effective set stored in zprivs_state.caps
 506          */
 507         if (op == ZPRIVS_RAISE)
 508                 privset = zprivs_state.syscaps_p;
 509         else if (op == ZPRIVS_LOWER)
 510                 privset = zprivs_state.caps;
 511         else
 512                 return -1;
 513
 514         if (setppriv(PRIV_SET, PRIV_EFFECTIVE, privset) != 0)
 515                 return -1;
 516
 517         return 0;
 518 }
 519
 520 /* Retrieve current privilege state, is it RAISED or LOWERED? */
 521 zebra_privs_current_t zprivs_state_caps(void)
 522 {
 523         zebra_privs_current_t result;
 524         pset_t *effective;
 525
 526         if ((effective = priv_allocset()) == NULL) {
 527                 fprintf(stderr, "%s: failed to get priv_allocset! %s\n",
 528                         __func__, safe_strerror(errno));
 529                 return ZPRIVS_UNKNOWN;
 530         }
 531
 532         if (getppriv(PRIV_EFFECTIVE, effective)) {
 533                 fprintf(stderr, "%s: failed to get state! %s\n", __func__,
 534                         safe_strerror(errno));
 535                 result = ZPRIVS_UNKNOWN;
 536         } else {
 537                 if (priv_isequalset(effective, zprivs_state.syscaps_p))
 538                         result = ZPRIVS_RAISED;
 539                 else if (priv_isequalset(effective, zprivs_state.caps))
 540                         result = ZPRIVS_LOWERED;
 541                 else
 542                         result = ZPRIVS_UNKNOWN;
 543         }
 544
 545         priv_freeset(effective);
 546         return result;
 547 }
 548
 549 static void zprivs_caps_init(struct zebra_privs_t *zprivs)
 550 {
 551         pset_t *basic;
 552         pset_t *minimal;
 553
 554         /* the specified sets */
 555         zprivs_state.syscaps_p = zcaps2sys(zprivs->caps_p, zprivs->cap_num_p);
 556         zprivs_state.syscaps_i = zcaps2sys(zprivs->caps_i, zprivs->cap_num_i);
 557
 558         /* nonsensical to have gotten here but not have capabilities */
 559         if (!zprivs_state.syscaps_p) {
 560                 fprintf(stderr,
 561                         "%s: capabilities enabled, "
 562                         "but no valid capabilities supplied\n",
 563                         __func__);
 564         }
 565
 566         /* We retain the basic set in our permitted set, as Linux has no
 567          * equivalent. The basic set on Linux hence is implicit, always
 568          * there.
 569          */
 570         if ((basic = priv_str_to_set("basic", ",", NULL)) == NULL) {
 571                 fprintf(stderr, "%s: couldn't get basic set!\n", __func__);
 572                 exit(1);
 573         }
 574
 575         /* Add the basic set to the permitted set */
 576         priv_union(basic, zprivs_state.syscaps_p);
 577         priv_freeset(basic);
 578
 579         /* Hey kernel, we know about privileges!
 580          * this isn't strictly required, use of setppriv should have same effect
 581          */
 582         if (setpflags(PRIV_AWARE, 1)) {
 583                 fprintf(stderr, "%s: error setting PRIV_AWARE!, %s\n", __func__,
 584                         safe_strerror(errno));
 585                 exit(1);
 586         }
 587
 588         /* need either valid or empty sets for both p and i.. */
 589         assert(zprivs_state.syscaps_i && zprivs_state.syscaps_p);
 590
 591         /* we have caps, we have no need to ever change back the original user
 592          * change real, effective and saved to the specified user.
 593          */
 594         /* only change uid if we don't have the correct one */
 595         if ((zprivs_state.zuid) && (zprivs_state.zsuid != zprivs_state.zuid)) {
 596                 if (setreuid(zprivs_state.zuid, zprivs_state.zuid)) {
 597                         fprintf(stderr, "%s: could not setreuid, %s\n",
 598                                 __func__, safe_strerror(errno));
 599                         exit(1);
 600                 }
 601         }
 602
 603         /* set the permitted set */
 604         if (setppriv(PRIV_SET, PRIV_PERMITTED, zprivs_state.syscaps_p)) {
 605                 fprintf(stderr, "%s: error setting permitted set!, %s\n",
 606                         __func__, safe_strerror(errno));
 607                 exit(1);
 608         }
 609
 610         /* set the inheritable set */
 611         if (setppriv(PRIV_SET, PRIV_INHERITABLE, zprivs_state.syscaps_i)) {
 612                 fprintf(stderr, "%s: error setting inheritable set!, %s\n",
 613                         __func__, safe_strerror(errno));
 614                 exit(1);
 615         }
 616
 617         /* we need a minimal basic set for 'effective', potentially for
 618          * inheritable too */
 619         minimal = zprivs_caps_minimal();
 620
 621         /* now set the effective set with a subset of basic privileges */
 622         if (setppriv(PRIV_SET, PRIV_EFFECTIVE, minimal)) {
 623                 fprintf(stderr, "%s: error setting effective set!, %s\n",
 624                         __func__, safe_strerror(errno));
 625                 exit(1);
 626         }
 627
 628         /* we'll use the minimal set as our working-storage privset */
 629         zprivs_state.caps = minimal;
 630
 631         /* set methods for the caller to use */
 632         zprivs->change = zprivs_change_caps;
 633         zprivs->current_state = zprivs_state_caps;
 634 }
 635
 636 static void zprivs_caps_terminate(void)
 637 {
 638         assert(zprivs_state.caps);
 639
 640         /* clear all capabilities by using working-storage privset */
 641         setppriv(PRIV_SET, PRIV_EFFECTIVE, zprivs_state.caps);
 642         setppriv(PRIV_SET, PRIV_PERMITTED, zprivs_state.caps);
 643         setppriv(PRIV_SET, PRIV_INHERITABLE, zprivs_state.caps);
 644
 645         /* free up private state */
 646         if (zprivs_state.syscaps_p)
 647                 priv_freeset(zprivs_state.syscaps_p);
 648         if (zprivs_state.syscaps_i)
 649                 priv_freeset(zprivs_state.syscaps_i);
 650
 651         priv_freeset(zprivs_state.caps);
 652 }
 653 #else /* !HAVE_LCAPS && ! HAVE_SOLARIS_CAPABILITIES */
 654 #error "Neither Solaris nor Linux capabilities, dazed and confused..."
 655 #endif /* HAVE_LCAPS */
 656 #endif /* HAVE_CAPABILITIES */
 657
 658 int zprivs_change_uid(zebra_privs_ops_t op)
 659 {
 660         if (zprivs_state.zsuid == zprivs_state.zuid)
 661                 return 0;
 662         if (op == ZPRIVS_RAISE)
 663                 return seteuid(zprivs_state.zsuid);
 664         else if (op == ZPRIVS_LOWER)
 665                 return seteuid(zprivs_state.zuid);
 666         else
 667                 return -1;
 668 }
 669
 670 zebra_privs_current_t zprivs_state_uid(void)
 671 {
 672         return ((zprivs_state.zuid == geteuid()) ? ZPRIVS_LOWERED
 673                                                  : ZPRIVS_RAISED);
 674 }
 675
 676 int zprivs_change_null(zebra_privs_ops_t op)
 677 {
 678         return 0;
 679 }
 680
 681 zebra_privs_current_t zprivs_state_null(void)
 682 {
 683         return zprivs_null_state;
 684 }
 685
 686 #ifndef HAVE_GETGROUPLIST
 687 /* Solaris 11 has no getgrouplist() */
 688 static int getgrouplist(const char *user, gid_t group, gid_t *groups,
 689                         int *ngroups)
 690 {
 691         struct group *grp;
 692         size_t usridx;
 693         int pos = 0, ret;
 694
 695         if (pos < *ngroups)
 696                 groups[pos] = group;
 697         pos++;
 698
 699         setgrent();
 700         while ((grp = getgrent())) {
 701                 if (grp->gr_gid == group)
 702                         continue;
 703                 for (usridx = 0; grp->gr_mem[usridx] != NULL; usridx++)
 704                         if (!strcmp(grp->gr_mem[usridx], user)) {
 705                                 if (pos < *ngroups)
 706                                         groups[pos] = grp->gr_gid;
 707                                 pos++;
 708                                 break;
 709                         }
 710         }
 711         endgrent();
 712
 713         ret = (pos <= *ngroups) ? pos : -1;
 714         *ngroups = pos;
 715         return ret;
 716 }
 717 #endif /* HAVE_GETGROUPLIST */
 718
 719 /*
 720  * Helper function that locates a refcounting object to use: a process-wide
 721  * object or a per-pthread object.
 722  */
 723 static struct zebra_privs_refs_t *get_privs_refs(struct zebra_privs_t *privs)
 724 {
 725         struct zebra_privs_refs_t *temp, *refs = NULL;
 726         pthread_t tid;
 727
 728         if (privs_per_process)
 729                 refs = &(privs->process_refs);
 730         else {
 731                 /* Locate - or create - the object for the current pthread. */
 732                 tid = pthread_self();
 733
 734                 STAILQ_FOREACH(temp, &(privs->thread_refs), entry) {
 735                         if (pthread_equal(temp->tid, tid)) {
 736                                 refs = temp;
 737                                 break;
 738                         }
 739                 }
 740
 741                 /* Need to create a new refcounting object. */
 742                 if (refs == NULL) {
 743                         refs = XCALLOC(MTYPE_PRIVS,
 744                                        sizeof(struct zebra_privs_refs_t));
 745                         refs->tid = tid;
 746                         STAILQ_INSERT_TAIL(&(privs->thread_refs), refs, entry);
 747                 }
 748         }
 749
 750         return refs;
 751 }
 752
 753 struct zebra_privs_t *_zprivs_raise(struct zebra_privs_t *privs,
 754                                     const char *funcname)
 755 {
 756         int save_errno = errno;
 757         struct zebra_privs_refs_t *refs;
 758
 759         if (!privs)
 760                 return NULL;
 761
 762         /*
 763          * Serialize 'raise' operations; particularly important for
 764          * OSes where privs are process-wide.
 765          */
 766         frr_with_mutex(&(privs->mutex)) {
 767                 /* Locate ref-counting object to use */
 768                 refs = get_privs_refs(privs);
 769
 770                 if (++(refs->refcount) == 1) {
 771                         errno = 0;
 772                         if (privs->change(ZPRIVS_RAISE)) {
 773                                 zlog_err("%s: Failed to raise privileges (%s)",
 774                                          funcname, safe_strerror(errno));
 775                         }
 776                         errno = save_errno;
 777                         refs->raised_in_funcname = funcname;
 778                 }
 779         }
 780
 781         return privs;
 782 }
 783
 784 void _zprivs_lower(struct zebra_privs_t **privs)
 785 {
 786         int save_errno = errno;
 787         struct zebra_privs_refs_t *refs;
 788
 789         if (!*privs)
 790                 return;
 791
 792         /* Serialize 'lower privs' operation - particularly important
 793          * when OS privs are process-wide.
 794          */
 795         frr_with_mutex(&(*privs)->mutex) {
 796                 refs = get_privs_refs(*privs);
 797
 798                 if (--(refs->refcount) == 0) {
 799                         errno = 0;
 800                         if ((*privs)->change(ZPRIVS_LOWER)) {
 801                                 zlog_err("%s: Failed to lower privileges (%s)",
 802                                          refs->raised_in_funcname,
 803                                          safe_strerror(errno));
 804                         }
 805                         errno = save_errno;
 806                         refs->raised_in_funcname = NULL;
 807                 }
 808         }
 809
 810         *privs = NULL;
 811 }
 812
 813 void zprivs_preinit(struct zebra_privs_t *zprivs)
 814 {
 815         struct passwd *pwentry = NULL;
 816         struct group *grentry = NULL;
 817
 818         if (!zprivs) {
 819                 fprintf(stderr, "zprivs_init: called with NULL arg!\n");
 820                 exit(1);
 821         }
 822
 823         pthread_mutex_init(&(zprivs->mutex), NULL);
 824         zprivs->process_refs.refcount = 0;
 825         zprivs->process_refs.raised_in_funcname = NULL;
 826         STAILQ_INIT(&zprivs->thread_refs);
 827
 828         if (zprivs->vty_group) {
 829                 /* in a "NULL" setup, this is allowed to fail too, but still
 830                  * try. */
 831                 if ((grentry = getgrnam(zprivs->vty_group)))
 832                         zprivs_state.vtygrp = grentry->gr_gid;
 833                 else
 834                         zprivs_state.vtygrp = (gid_t)-1;
 835         }
 836
 837         /* NULL privs */
 838         if (!(zprivs->user || zprivs->group || zprivs->cap_num_p
 839               || zprivs->cap_num_i)) {
 840                 zprivs->change = zprivs_change_null;
 841                 zprivs->current_state = zprivs_state_null;
 842                 return;
 843         }
 844
 845         if (zprivs->user) {
 846                 if ((pwentry = getpwnam(zprivs->user)) == NULL) {
 847                         /* cant use log.h here as it depends on vty */
 848                         fprintf(stderr,
 849                                 "privs_init: could not lookup user %s\n",
 850                                 zprivs->user);
 851                         exit(1);
 852                 }
 853
 854                 zprivs_state.zuid = pwentry->pw_uid;
 855                 zprivs_state.zgid = pwentry->pw_gid;
 856         }
 857
 858         grentry = NULL;
 859
 860         if (zprivs->group) {
 861                 if ((grentry = getgrnam(zprivs->group)) == NULL) {
 862                         fprintf(stderr,
 863                                 "privs_init: could not lookup group %s\n",
 864                                 zprivs->group);
 865                         exit(1);
 866                 }
 867
 868                 zprivs_state.zgid = grentry->gr_gid;
 869         }
 870 }
 871
 872 void zprivs_init(struct zebra_privs_t *zprivs)
 873 {
 874         gid_t groups[NGROUPS_MAX] = {};
 875         int i, ngroups = 0;
 876         int found = 0;
 877
 878         /* NULL privs */
 879         if (!(zprivs->user || zprivs->group || zprivs->cap_num_p
 880               || zprivs->cap_num_i))
 881                 return;
 882
 883         if (zprivs->user) {
 884                 ngroups = array_size(groups);
 885                 if (getgrouplist(zprivs->user, zprivs_state.zgid, groups,
 886                                  &ngroups)
 887                     < 0) {
 888                         /* cant use log.h here as it depends on vty */
 889                         fprintf(stderr,
 890                                 "privs_init: could not getgrouplist for user %s\n",
 891                                 zprivs->user);
 892                         exit(1);
 893                 }
 894         }
 895
 896         if (zprivs->vty_group)
 897         /* Add the vty_group to the supplementary groups so it can be chowned to
 898            */
 899         {
 900                 if (zprivs_state.vtygrp == (gid_t)-1) {
 901                         fprintf(stderr,
 902                                 "privs_init: could not lookup vty group %s\n",
 903                                 zprivs->vty_group);
 904                         exit(1);
 905                 }
 906
 907                 for (i = 0; i < ngroups; i++)
 908                         if (groups[i] == zprivs_state.vtygrp) {
 909                                 found++;
 910                                 break;
 911                         }
 912
 913                 if (!found) {
 914                         fprintf(stderr,
 915                                 "privs_init: user(%s) is not part of vty group specified(%s)\n",
 916                                 zprivs->user, zprivs->vty_group);
 917                         exit(1);
 918                 }
 919                 if (i >= ngroups && ngroups < (int)array_size(groups)) {
 920                         groups[i] = zprivs_state.vtygrp;
 921                 }
 922         }
 923
 924         zprivs_state.zsuid = geteuid(); /* initial uid */
 925         /* add groups only if we changed uid - otherwise skip */
 926         if ((ngroups) && (zprivs_state.zsuid != zprivs_state.zuid)) {
 927                 if (setgroups(ngroups, groups)) {
 928                         fprintf(stderr, "privs_init: could not setgroups, %s\n",
 929                                 safe_strerror(errno));
 930                         exit(1);
 931                 }
 932         }
 933
 934         /* change gid only if we changed uid - otherwise skip */
 935         if ((zprivs_state.zgid) && (zprivs_state.zsuid != zprivs_state.zuid)) {
 936                 /* change group now, forever. uid we do later */
 937                 if (setregid(zprivs_state.zgid, zprivs_state.zgid)) {
 938                         fprintf(stderr, "zprivs_init: could not setregid, %s\n",
 939                                 safe_strerror(errno));
 940                         exit(1);
 941                 }
 942         }
 943
 944 #ifdef HAVE_CAPABILITIES
 945         zprivs_caps_init(zprivs);
 946
 947         /*
 948          * If we have initialized the system with no requested
 949          * capabilities, change will not have been set
 950          * to anything by zprivs_caps_init, As such
 951          * we should make sure that when we attempt
 952          * to raize privileges that we actually have
 953          * a do nothing function to call instead of a
 954          * crash :).
 955          */
 956         if (!zprivs->change)
 957                 zprivs->change = zprivs_change_null;
 958
 959 #else  /* !HAVE_CAPABILITIES */
 960         /* we dont have caps. we'll need to maintain rid and saved uid
 961          * and change euid back to saved uid (who we presume has all neccessary
 962          * privileges) whenever we are asked to raise our privileges.
 963          *
 964          * This is not worth that much security wise, but all we can do.
 965          */
 966         zprivs_state.zsuid = geteuid();
 967         /* only change uid if we don't have the correct one */
 968         if ((zprivs_state.zuid) && (zprivs_state.zsuid != zprivs_state.zuid)) {
 969                 if (setreuid(-1, zprivs_state.zuid)) {
 970                         fprintf(stderr,
 971                                 "privs_init (uid): could not setreuid, %s\n",
 972                                 safe_strerror(errno));
 973                         exit(1);
 974                 }
 975         }
 976
 977         zprivs->change = zprivs_change_uid;
 978         zprivs->current_state = zprivs_state_uid;
 979 #endif /* HAVE_CAPABILITIES */
 980 }
 981
 982 void zprivs_terminate(struct zebra_privs_t *zprivs)
 983 {
 984         struct zebra_privs_refs_t *refs;
 985
 986         if (!zprivs) {
 987                 fprintf(stderr, "%s: no privs struct given, terminating",
 988                         __func__);
 989                 exit(0);
 990         }
 991
 992 #ifdef HAVE_CAPABILITIES
 993         if (zprivs->user || zprivs->group || zprivs->cap_num_p
 994             || zprivs->cap_num_i)
 995                 zprivs_caps_terminate();
 996 #else  /* !HAVE_CAPABILITIES */
 997         /* only change uid if we don't have the correct one */
 998         if ((zprivs_state.zuid) && (zprivs_state.zsuid != zprivs_state.zuid)) {
 999                 if (setreuid(zprivs_state.zuid, zprivs_state.zuid)) {
1000                         fprintf(stderr,
1001                                 "privs_terminate: could not setreuid, %s",
1002                                 safe_strerror(errno));
1003                         exit(1);
1004                 }
1005         }
1006 #endif /* HAVE_LCAPS */
1007
1008         while ((refs = STAILQ_FIRST(&(zprivs->thread_refs))) != NULL) {
1009                 STAILQ_REMOVE_HEAD(&(zprivs->thread_refs), entry);
1010                 XFREE(MTYPE_PRIVS, refs);
1011         }
1012
1013         zprivs->change = zprivs_change_null;
1014         zprivs->current_state = zprivs_state_null;
1015         zprivs_null_state = ZPRIVS_LOWERED;
1016         return;
1017 }
1018
1019 void zprivs_get_ids(struct zprivs_ids_t *ids)
1020 {
1021
1022         ids->uid_priv = getuid();
1023         (zprivs_state.zuid) ? (ids->uid_normal = zprivs_state.zuid)
1024                             : (ids->uid_normal = -1);
1025         (zprivs_state.zgid) ? (ids->gid_normal = zprivs_state.zgid)
1026                             : (ids->gid_normal = -1);
1027         (zprivs_state.vtygrp) ? (ids->gid_vty = zprivs_state.vtygrp)
1028                               : (ids->gid_vty = -1);
1029
1030         return;
1031 }