1 /*
2 * libwebsockets - small server side websockets and web server implementation
3 *
4 * Copyright (C) 2010 - 2019 Andy Green <andy@warmcat.com>
5 *
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to
8 * deal in the Software without restriction, including without limitation the
9 * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
10 * sell copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
12 *
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
15 *
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
19 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
21 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
22 * IN THE SOFTWARE.
23 */
24
25 #if !defined(_GNU_SOURCE)
26 #define _GNU_SOURCE
27 #endif
28 #include "private-lib-core.h"
29
30 #include <pwd.h>
31 #include <grp.h>
32
33 #if defined(LWS_HAVE_SYS_CAPABILITY_H) && defined(LWS_HAVE_LIBCAP)
34 static void
_lws_plat_apply_caps(int mode,const cap_value_t * cv,int count)35 _lws_plat_apply_caps(int mode, const cap_value_t *cv, int count)
36 {
37 cap_t caps;
38
39 if (!count)
40 return;
41
42 caps = cap_get_proc();
43
44 cap_set_flag(caps, mode, count, cv, CAP_SET);
45 cap_set_proc(caps);
46 prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0);
47 cap_free(caps);
48 }
49 #endif
50
51 int
lws_plat_user_colon_group_to_ids(const char * u_colon_g,uid_t * puid,gid_t * pgid)52 lws_plat_user_colon_group_to_ids(const char *u_colon_g, uid_t *puid, gid_t *pgid)
53 {
54 char *colon = strchr(u_colon_g, ':'), u[33];
55 struct passwd *p;
56 struct group *g;
57 int ulen;
58
59 if (!colon)
60 return 1;
61
62 ulen = lws_ptr_diff(colon, u_colon_g);
63 if (ulen < 2 || ulen > (int)sizeof(u) - 1)
64 return 1;
65
66 memcpy(u, u_colon_g, ulen);
67 u[ulen] = '\0';
68
69 colon++;
70
71 g = getgrnam(colon);
72 if (!g) {
73 lwsl_err("%s: unknown group '%s'\n", __func__, colon);
74
75 return 1;
76 }
77 *pgid = g->gr_gid;
78
79 p = getpwnam(u);
80 if (!p) {
81 lwsl_err("%s: unknown group '%s'\n", __func__, u);
82
83 return 1;
84 }
85 *puid = p->pw_uid;
86
87 return 0;
88 }
89
90 int
lws_plat_drop_app_privileges(struct lws_context * context,int actually_drop)91 lws_plat_drop_app_privileges(struct lws_context *context, int actually_drop)
92 {
93 struct passwd *p;
94 struct group *g;
95
96 /* if he gave us the groupname, align gid to match it */
97
98 if (context->groupname) {
99 g = getgrnam(context->groupname);
100
101 if (g) {
102 lwsl_info("%s: group %s -> gid %u\n", __func__,
103 context->groupname, g->gr_gid);
104 context->gid = g->gr_gid;
105 } else {
106 lwsl_err("%s: unknown groupname '%s'\n", __func__,
107 context->groupname);
108
109 return 1;
110 }
111 }
112
113 /* if he gave us the username, align uid to match it */
114
115 if (context->username) {
116 p = getpwnam(context->username);
117
118 if (p) {
119 context->uid = p->pw_uid;
120
121 lwsl_info("%s: username %s -> uid %u\n", __func__,
122 context->username, (unsigned int)p->pw_uid);
123 } else {
124 lwsl_err("%s: unknown username %s\n", __func__,
125 context->username);
126
127 return 1;
128 }
129 }
130
131 if (!actually_drop)
132 return 0;
133
134 /* if he gave us the gid or we have it from the groupname, set it */
135
136 if (context->gid && context->gid != -1) {
137 g = getgrgid(context->gid);
138
139 if (!g) {
140 lwsl_err("%s: cannot find name for gid %d\n",
141 __func__, context->gid);
142
143 return 1;
144 }
145
146 if (setgid(context->gid)) {
147 lwsl_err("%s: setgid: %s failed\n", __func__,
148 strerror(LWS_ERRNO));
149
150 return 1;
151 }
152
153 lwsl_notice("%s: effective group '%s'\n", __func__,
154 g->gr_name);
155 } else
156 lwsl_info("%s: not changing group\n", __func__);
157
158
159 /* if he gave us the uid or we have it from the username, set it */
160
161 if (context->uid && context->uid != -1) {
162 p = getpwuid(context->uid);
163
164 if (!p) {
165 lwsl_err("%s: getpwuid: unable to find uid %d\n",
166 __func__, context->uid);
167 return 1;
168 }
169
170 #if defined(LWS_HAVE_SYS_CAPABILITY_H) && defined(LWS_HAVE_LIBCAP)
171 _lws_plat_apply_caps(CAP_PERMITTED, context->caps,
172 context->count_caps);
173 #endif
174
175 initgroups(p->pw_name, context->gid);
176 if (setuid(context->uid)) {
177 lwsl_err("%s: setuid: %s failed\n", __func__,
178 strerror(LWS_ERRNO));
179
180 return 1;
181 } else
182 lwsl_notice("%s: effective user '%s'\n",
183 __func__, p->pw_name);
184
185 #if defined(LWS_HAVE_SYS_CAPABILITY_H) && defined(LWS_HAVE_LIBCAP)
186 _lws_plat_apply_caps(CAP_EFFECTIVE, context->caps,
187 context->count_caps);
188
189 if (context->count_caps) {
190 int n;
191 for (n = 0; n < context->count_caps; n++)
192 lwsl_notice(" RETAINING CAP %d\n",
193 (int)context->caps[n]);
194 }
195 #endif
196 } else
197 lwsl_info("%s: not changing user\n", __func__);
198
199 return 0;
200 }
201