diff options
| -rw-r--r-- | src/providers/krb5/krb5_become_user.c | 33 |
1 files changed, 18 insertions, 15 deletions
diff --git a/src/providers/krb5/krb5_become_user.c b/src/providers/krb5/krb5_become_user.c index 082d1415..70bc5630 100644 --- a/src/providers/krb5/krb5_become_user.c +++ b/src/providers/krb5/krb5_become_user.c @@ -22,45 +22,48 @@ along with this program. If not, see <http://www.gnu.org/licenses/>. */ -#include <sys/types.h> -#include <unistd.h> - #include "util/util.h" +#include <grp.h> errno_t become_user(uid_t uid, gid_t gid) { + uid_t cuid; int ret; DEBUG(SSSDBG_FUNC_DATA, ("Trying to become user [%d][%d].\n", uid, gid)); - ret = setgid(gid); - if (ret == -1) { - ret = errno; - DEBUG(SSSDBG_CRIT_FAILURE, - ("setgid failed [%d][%s].\n", ret, strerror(ret))); - return ret; + + /* skip call if we already are the requested user */ + cuid = geteuid(); + if (uid == cuid) { + DEBUG(SSSDBG_FUNC_DATA, ("Already user [%d].\n", uid)); + return EOK; } - ret = setuid(uid); + /* drop supplmentary groups first */ + ret = setgroups(0, NULL); if (ret == -1) { ret = errno; DEBUG(SSSDBG_CRIT_FAILURE, - ("setuid failed [%d][%s].\n", ret, strerror(ret))); + ("setgroups failed [%d][%s].\n", ret, strerror(ret))); return ret; } - ret = setegid(gid); + /* change gid so that root cannot be regained (changes saved gid too) */ + ret = setresgid(gid, gid, gid); if (ret == -1) { ret = errno; DEBUG(SSSDBG_CRIT_FAILURE, - ("setegid failed [%d][%s].\n", ret, strerror(ret))); + ("setresgid failed [%d][%s].\n", ret, strerror(ret))); return ret; } - ret = seteuid(uid); + /* change uid so that root cannot be regained (changes saved uid too) */ + /* this call also takes care of dropping CAP_SETUID, so this is a PNR */ + ret = setresuid(uid, uid, uid); if (ret == -1) { ret = errno; DEBUG(SSSDBG_CRIT_FAILURE, - ("seteuid failed [%d][%s].\n", ret, strerror(ret))); + ("setresuid failed [%d][%s].\n", ret, strerror(ret))); return ret; } |