Significant security fixes to ksu

* Use source euid all throughout procedure of opening source ccache,
Richard's code had a race condition.

* Use target euid while looking up .k5login and constructing target ccache.

* Avoid chowns completely; they create race conditions.  Fchown could
have been used if we wanted to be really careful, but they aren't
necessary and we would have to violate abstractions.

* Clean up several conditions that would allow users to delete
arbitrary files of the user they were ksuing to without authorization.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@8049 dc483132-0cff-0310-8789-dd5450dbe970

1 files changed, 31 insertions, 3 deletions

diff --git a/src/clients/ksu/ccache.c b/src/clients/ksu/ccache.c
index 95cbe84c4..69975204e 100644
--- a/src/clients/ksu/ccache.c
+++ b/src/clients/ksu/ccache.c
@@ -44,12 +44,13 @@ void show_credential();
 */
 
 krb5_error_code krb5_ccache_copy (context, cc_def, cc_other_tag, 
-				  primary_principal, cc_out, stored)
+				  primary_principal, cc_out, stored, target_uid)
     /* IN */
     krb5_context context;
     krb5_ccache cc_def;
     char *cc_other_tag;
     krb5_principal primary_principal;
+uid_t target_uid;
     /* OUT */
     krb5_ccache *cc_out;
     krb5_boolean *stored;
@@ -74,6 +75,7 @@ struct stat st_temp;
     cc_def_name = krb5_cc_get_name(context, cc_def);    
     cc_other_name = krb5_cc_get_name(context, *cc_other);    
 
+
     if ( ! stat(cc_def_name, &st_temp)){
 	if((retval = krb5_get_nonexp_tkts(context,cc_def,&cc_def_creds_arr))){
 		return retval;
@@ -83,7 +85,19 @@ struct stat st_temp;
     *stored = krb5_find_princ_in_cred_list(context, cc_def_creds_arr,
 					   primary_principal);
 
-
+#ifdef HAVE_LSTAT
+    if (!lstat( cc_other_name, &st_temp)) {
+#else /*HAVE_LSTAT*/
+    if (!stat( cc_other_name, &st_temp)) {
+#endif
+      return EINVAL;
+    }
+    
+      if (krb5_seteuid(0)||krb5_seteuid(target_uid)) {
+	return errno;
+      }
+      
+      
     if ((retval = krb5_cc_initialize(context, *cc_other, primary_principal))){
 	return retval; 
     }
@@ -621,11 +635,12 @@ with k5 beta 3 release.
 ************************************************************************/
 
 krb5_error_code krb5_ccache_copy_restricted (context, cc_def, cc_other_tag, 
-					     prst, cc_out, stored)
+					     prst, cc_out, stored, target_uid)
     krb5_context context;
     krb5_ccache cc_def;
     char *cc_other_tag;
     krb5_principal prst;
+uid_t target_uid;
     /* OUT */
     krb5_ccache *cc_out;
     krb5_boolean *stored;
@@ -658,6 +673,19 @@ struct stat st_temp;
 
     }
 
+#ifdef HAVE_LSTAT
+    if (!lstat( cc_other_name, &st_temp)) {
+#else /*HAVE_LSTAT*/
+    if (!stat( cc_other_name, &st_temp)) {
+#endif
+      return EINVAL;
+    }
+    
+      if (krb5_seteuid(0)||krb5_seteuid(target_uid)) {
+	return errno;
+      }
+      
+    
     if ((retval = krb5_cc_initialize(context, *cc_other, prst))){
 	return retval; 
     }