>From 6d07c64d07a6dd0a712a97c7b208baebba752767 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Mon, 6 Oct 2014 16:28:13 +0200 Subject: [PATCH 1/4] SSSD: Add the options to specify a UID and GID to run as Adds new command line options --uid and --gid to all SSSD servers, making it possible to switch to another user ID if needed. So far all code still runs as root. --- Makefile.am | 7 +++++-- src/monitor/monitor.c | 3 ++- src/providers/data_provider_be.c | 5 ++++- src/providers/proxy/proxy_child.c | 5 ++++- src/responder/autofs/autofssrv.c | 6 +++++- src/responder/ifp/ifpsrv.c | 3 ++- src/responder/nss/nsssrv.c | 5 ++++- src/responder/pac/pacsrv.c | 5 ++++- src/responder/pam/pamsrv.c | 5 ++++- src/responder/ssh/sshsrv.c | 5 ++++- src/responder/sudo/sudosrv.c | 6 +++++- src/util/server.c | 8 ++++++++ src/util/util.h | 7 +++++++ 13 files changed, 58 insertions(+), 12 deletions(-) diff --git a/Makefile.am b/Makefile.am index ee6e39ba7f818524884ab9e4efc4e78791af1122..3e37608daf46070f3a861d73605eb4cb0edbcc0d 100644 --- a/Makefile.am +++ b/Makefile.am @@ -709,14 +709,17 @@ libsss_util_la_SOURCES = \ src/util/util_sss_idmap.c \ src/util/well_known_sids.c \ src/util/string_utils.c \ + src/util/become_user.c \ $(NULL) libsss_util_la_CFLAGS = \ $(AM_CFLAGS) \ - $(SYSTEMD_LOGIN_CFLAGS) + $(SYSTEMD_LOGIN_CFLAGS) \ + $(NULL) libsss_util_la_LIBADD = \ $(SSSD_LIBS) \ $(SYSTEMD_LOGIN_LIBS) \ - $(UNICODE_LIBS) + $(UNICODE_LIBS) \ + $(NULL) if BUILD_SUDO libsss_util_la_SOURCES += src/db/sysdb_sudo.c endif diff --git a/src/monitor/monitor.c b/src/monitor/monitor.c index 624e45026b01842ab81d8c37d50751977185d20c..edd1c2dfc674d8a7ca9d069d6499c0dcc959f210 100644 --- a/src/monitor/monitor.c +++ b/src/monitor/monitor.c @@ -2855,7 +2855,8 @@ int main(int argc, const char *argv[]) ret = close(STDIN_FILENO); if (ret != EOK) return 6; - ret = server_setup(MONITOR_NAME, flags, monitor->conf_path, &main_ctx); + ret = server_setup(MONITOR_NAME, flags, 0, 0, + monitor->conf_path, &main_ctx); if (ret != EOK) return 2; monitor->is_daemon = !opt_interactive; diff --git a/src/providers/data_provider_be.c b/src/providers/data_provider_be.c index e7f345f922361b60775e149c1b28f45cf16ed00e..18b50214b0795709d583d5891bf4f6fd220bcb11 100644 --- a/src/providers/data_provider_be.c +++ b/src/providers/data_provider_be.c @@ -2804,10 +2804,13 @@ int main(int argc, const char *argv[]) struct main_context *main_ctx; char *confdb_path; int ret; + uid_t uid; + gid_t gid; struct poptOption long_options[] = { POPT_AUTOHELP SSSD_MAIN_OPTS + SSSD_SERVER_OPTS(uid, gid) {"domain", 0, POPT_ARG_STRING, &be_domain, 0, _("Domain of the information provider (mandatory)"), NULL }, POPT_TABLEEND @@ -2847,7 +2850,7 @@ int main(int argc, const char *argv[]) confdb_path = talloc_asprintf(NULL, CONFDB_DOMAIN_PATH_TMPL, be_domain); if (!confdb_path) return 2; - ret = server_setup(srv_name, 0, confdb_path, &main_ctx); + ret = server_setup(srv_name, 0, 0, 0, confdb_path, &main_ctx); if (ret != EOK) { DEBUG(SSSDBG_FATAL_FAILURE, "Could not set up mainloop [%d]\n", ret); return 2; diff --git a/src/providers/proxy/proxy_child.c b/src/providers/proxy/proxy_child.c index 6bee1c7f63c4bb5b33f11601c2be32df05206756..e261b2f588a89a27ed6fe78f7fc5cfa053b49833 100644 --- a/src/providers/proxy/proxy_child.c +++ b/src/providers/proxy/proxy_child.c @@ -504,10 +504,13 @@ int main(int argc, const char *argv[]) int ret; long id; char *pam_target = NULL; + uid_t uid; + gid_t gid; struct poptOption long_options[] = { POPT_AUTOHELP SSSD_MAIN_OPTS + SSSD_SERVER_OPTS(uid, gid) {"domain", 0, POPT_ARG_STRING, &domain, 0, _("Domain of the information provider (mandatory)"), NULL }, {"id", 0, POPT_ARG_LONG, &id, 0, @@ -557,7 +560,7 @@ int main(int argc, const char *argv[]) conf_entry = talloc_asprintf(NULL, CONFDB_DOMAIN_PATH_TMPL, domain); if (!conf_entry) return 2; - ret = server_setup(srv_name, 0, conf_entry, &main_ctx); + ret = server_setup(srv_name, 0, 0, 0, conf_entry, &main_ctx); if (ret != EOK) { DEBUG(SSSDBG_FATAL_FAILURE, "Could not set up mainloop [%d]\n", ret); return 2; diff --git a/src/responder/autofs/autofssrv.c b/src/responder/autofs/autofssrv.c index bd5aa135a3fb64a020e74a9dd39fa1b67dc76533..931cf018bfe15b37bf8e5f93a21c7ab61d238c18 100644 --- a/src/responder/autofs/autofssrv.c +++ b/src/responder/autofs/autofssrv.c @@ -207,10 +207,13 @@ int main(int argc, const char *argv[]) poptContext pc; struct main_context *main_ctx; int ret; + uid_t uid; + gid_t gid; struct poptOption long_options[] = { POPT_AUTOHELP SSSD_MAIN_OPTS + SSSD_SERVER_OPTS(uid, gid) POPT_TABLEEND }; @@ -235,7 +238,8 @@ int main(int argc, const char *argv[]) /* set up things like debug, signals, daemonization, etc... */ debug_log_file = "sssd_autofs"; - ret = server_setup("sssd[autofs]", 0, CONFDB_AUTOFS_CONF_ENTRY, &main_ctx); + ret = server_setup("sssd[autofs]", 0, 0, 0, + CONFDB_AUTOFS_CONF_ENTRY, &main_ctx); if (ret != EOK) { return 2; } diff --git a/src/responder/ifp/ifpsrv.c b/src/responder/ifp/ifpsrv.c index 4af836543d3945603d22099b7ab98a90588bce35..6413c18c8943f1d8bb213605073acc50996210ca 100644 --- a/src/responder/ifp/ifpsrv.c +++ b/src/responder/ifp/ifpsrv.c @@ -469,7 +469,8 @@ int main(int argc, const char *argv[]) /* set up things like debug, signals, daemonization, etc... */ debug_log_file = "sssd_ifp"; - ret = server_setup("sssd[ifp]", 0, CONFDB_IFP_CONF_ENTRY, &main_ctx); + ret = server_setup("sssd[ifp]", 0, 0, 0, + CONFDB_IFP_CONF_ENTRY, &main_ctx); if (ret != EOK) return 2; ret = die_if_parent_died(); diff --git a/src/responder/nss/nsssrv.c b/src/responder/nss/nsssrv.c index 84a6b7fedd096a7d4159b7ac6670820c1d8fd941..420fd3d316959a67737f23e9a8b3d1c797583ea3 100644 --- a/src/responder/nss/nsssrv.c +++ b/src/responder/nss/nsssrv.c @@ -537,10 +537,13 @@ int main(int argc, const char *argv[]) poptContext pc; struct main_context *main_ctx; int ret; + uid_t uid; + gid_t gid; struct poptOption long_options[] = { POPT_AUTOHELP SSSD_MAIN_OPTS + SSSD_SERVER_OPTS(uid, gid) POPT_TABLEEND }; @@ -565,7 +568,7 @@ int main(int argc, const char *argv[]) /* set up things like debug, signals, daemonization, etc... */ debug_log_file = "sssd_nss"; - ret = server_setup("sssd[nss]", 0, CONFDB_NSS_CONF_ENTRY, &main_ctx); + ret = server_setup("sssd[nss]", 0, 0, 0, CONFDB_NSS_CONF_ENTRY, &main_ctx); if (ret != EOK) return 2; ret = die_if_parent_died(); diff --git a/src/responder/pac/pacsrv.c b/src/responder/pac/pacsrv.c index 47a9d1a68fbf1615277af41cef297b4955e7f7c3..b76691de829b4f40937a07ea83825a606950aa1e 100644 --- a/src/responder/pac/pacsrv.c +++ b/src/responder/pac/pacsrv.c @@ -216,10 +216,13 @@ int main(int argc, const char *argv[]) poptContext pc; struct main_context *main_ctx; int ret; + uid_t uid; + gid_t gid; struct poptOption long_options[] = { POPT_AUTOHELP SSSD_MAIN_OPTS + SSSD_SERVER_OPTS(uid, gid) POPT_TABLEEND }; @@ -244,7 +247,7 @@ int main(int argc, const char *argv[]) /* set up things like debug, signals, daemonization, etc... */ debug_log_file = "sssd_pac"; - ret = server_setup("sssd[pac]", 0, CONFDB_PAC_CONF_ENTRY, &main_ctx); + ret = server_setup("sssd[pac]", 0, 0, 0, CONFDB_PAC_CONF_ENTRY, &main_ctx); if (ret != EOK) return 2; ret = die_if_parent_died(); diff --git a/src/responder/pam/pamsrv.c b/src/responder/pam/pamsrv.c index 428b252acb56406291e3cac5d2a13e6f6b581c36..91b395080820b27f5d57341e59dd739e674be31a 100644 --- a/src/responder/pam/pamsrv.c +++ b/src/responder/pam/pamsrv.c @@ -316,10 +316,13 @@ int main(int argc, const char *argv[]) poptContext pc; struct main_context *main_ctx; int ret; + uid_t uid; + gid_t gid; struct poptOption long_options[] = { POPT_AUTOHELP SSSD_MAIN_OPTS + SSSD_SERVER_OPTS(uid, gid) POPT_TABLEEND }; @@ -344,7 +347,7 @@ int main(int argc, const char *argv[]) /* set up things like debug, signals, daemonization, etc... */ debug_log_file = "sssd_pam"; - ret = server_setup("sssd[pam]", 0, CONFDB_PAM_CONF_ENTRY, &main_ctx); + ret = server_setup("sssd[pam]", 0, 0, 0, CONFDB_PAM_CONF_ENTRY, &main_ctx); if (ret != EOK) return 2; ret = die_if_parent_died(); diff --git a/src/responder/ssh/sshsrv.c b/src/responder/ssh/sshsrv.c index 8aa603d79dddb327606f02d9e7ddf2b18a98e700..1328d1746b9e2d6474d6c2f8ce2825be463ca3e7 100644 --- a/src/responder/ssh/sshsrv.c +++ b/src/responder/ssh/sshsrv.c @@ -184,10 +184,13 @@ int main(int argc, const char *argv[]) poptContext pc; struct main_context *main_ctx; int ret; + uid_t uid; + gid_t gid; struct poptOption long_options[] = { POPT_AUTOHELP SSSD_MAIN_OPTS + SSSD_SERVER_OPTS(uid, gid) POPT_TABLEEND }; @@ -212,7 +215,7 @@ int main(int argc, const char *argv[]) /* set up things like debug, signals, daemonization, etc... */ debug_log_file = "sssd_ssh"; - ret = server_setup("sssd[ssh]", 0, CONFDB_SSH_CONF_ENTRY, &main_ctx); + ret = server_setup("sssd[ssh]", 0, 0, 0, CONFDB_SSH_CONF_ENTRY, &main_ctx); if (ret != EOK) { return 2; } diff --git a/src/responder/sudo/sudosrv.c b/src/responder/sudo/sudosrv.c index 8a197159b23abde45953b65121ff2e3fc3f2f67a..30752c9dacdc390b24fe837c0630333b5e171448 100644 --- a/src/responder/sudo/sudosrv.c +++ b/src/responder/sudo/sudosrv.c @@ -164,10 +164,13 @@ int main(int argc, const char *argv[]) poptContext pc; struct main_context *main_ctx; int ret; + uid_t uid; + gid_t gid; struct poptOption long_options[] = { POPT_AUTOHELP SSSD_MAIN_OPTS + SSSD_SERVER_OPTS(uid, gid) POPT_TABLEEND }; @@ -192,7 +195,8 @@ int main(int argc, const char *argv[]) /* set up things like debug, signals, daemonization, etc... */ debug_log_file = "sssd_sudo"; - ret = server_setup("sssd[sudo]", 0, CONFDB_SUDO_CONF_ENTRY, &main_ctx); + ret = server_setup("sssd[sudo]", 0, 0, 0, CONFDB_SUDO_CONF_ENTRY, + &main_ctx); if (ret != EOK) { return 2; } diff --git a/src/util/server.c b/src/util/server.c index 51934f8ba287d6f6e395231ed893753e10b4c9b0..3a84dee0cee06cb98c94a1d57209c2bcf7c4340a 100644 --- a/src/util/server.c +++ b/src/util/server.c @@ -412,6 +412,7 @@ errno_t server_common_rotate_logs(struct confdb_ctx *confdb, } int server_setup(const char *name, int flags, + uid_t uid, gid_t gid, const char *conf_entry, struct main_context **main_ctx) { @@ -426,6 +427,13 @@ int server_setup(const char *name, int flags, struct tevent_signal *tes; struct logrotate_ctx *lctx; + ret = become_user(uid, gid); + if (ret != EOK) { + DEBUG(SSSDBG_FUNC_DATA, + "Cannot become user [%"SPRIuid"][%"SPRIgid"].\n", uid, gid); + return ret; + } + debug_prg_name = strdup(name); if (!debug_prg_name) { return ENOMEM; diff --git a/src/util/util.h b/src/util/util.h index c497f605bb58a6acba45c64399a05cc3539b4263..0d7a2daa3bbcc9b8a86681c119bec8d556fcde49 100644 --- a/src/util/util.h +++ b/src/util/util.h @@ -175,6 +175,12 @@ errno_t set_debug_file_from_fd(const int fd); #define SSSD_MAIN_OPTS SSSD_DEBUG_OPTS +#define SSSD_SERVER_OPTS(uid, gid) \ + {"uid", 0, POPT_ARG_INT, &uid, 0, \ + _("The user ID to run the server as"), NULL}, \ + {"gid", 0, POPT_ARG_INT, &gid, 0, \ + _("The group ID to run the server as"), NULL}, + #define FLAGS_NONE 0x0000 #define FLAGS_DAEMON 0x0001 #define FLAGS_INTERACTIVE 0x0002 @@ -242,6 +248,7 @@ errno_t server_common_rotate_logs(struct confdb_ctx *confdb, int die_if_parent_died(void); int pidfile(const char *path, const char *name); int server_setup(const char *name, int flags, + uid_t uid, gid_t gid, const char *conf_entry, struct main_context **main_ctx); void server_loop(struct main_context *main_ctx); -- 1.9.3