1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
|
/*
* ProFTPD - FTP server daemon
* Copyright (c) 1997, 1998 Public Flood Software
* Copyright (c) 1999, 2000 MacGyver aka Habeeb J. Dihu <macgyver@tos.net>
* Copyright (c) 2001-2005 The ProFTPD Project team
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307, USA.
*
* As a special exemption, Public Flood Software/MacGyver aka Habeeb J. Dihu
* and other respective copyright holders give permission to link this program
* with OpenSSL, and distribute the resulting executable, without including
* the source code for OpenSSL in the source distribution.
*/
/* $Id: privs.h,v 1.31 2006/03/12 00:16:29 castaglia Exp $
*/
#ifndef PR_PRIVS_H
#define PR_PRIVS_H
/* Macros for manipulating saved, real and effective uid for easy
* switching from/to root.
*
* Note: In version 1.1.5, all of this changed. We USED to play games
* with the saved-uid/gid _and_ setreuid()/setregid(), however this
* appears to be slightly non-portable (i.e. w/ BSDs). However, since
* POSIX.1 saved-uids are pretty much useless without setre* (in the
* case of root), so we now use basic uid swapping if we have seteuid(),
* and setreuid() swapping if not.
*/
/* Porters, please put the most reasonable and secure method of
* doing this in here:
*/
#if defined(HPUX10) || defined(HPUX11)
# define setreuid(r, e) setresuid((r), (e), 0)
#endif /* HPUX */
#ifdef PR_DEVEL_COREDUMP
/* Unix kernels can be notoriously picky about dumping the core for
* processes that have fiddled with their effective/actual UID and GID.
* So, to make it possible for people to have their proftpd processes
* actually be able to coredump, these PRIVS macros, which switch
* privileges, are effectively disabled.
*
* Hence it is not a Good Idea to run a proftpd built with PR_DEVEL_COREDUMP
* defined in production.
*/
# define PRIVS_SETUP(u, g)
# define PRIVS_ROOT
# define PRIVS_USER
# define PRIVS_RELINQUISH
# define PRIVS_REVOKE
#else
# if !defined(HAVE_SETEUID)
/* Use setreuid() to perform uid swapping.
*/
# define PRIVS_SETUP(u, g) { \
pr_log_debug(DEBUG9, "SETUP PRIVS at %s:%d", __FILE__, __LINE__); \
pr_signals_block(); \
if (getuid() != PR_ROOT_UID) { \
session.ouid = session.uid = getuid(); \
session.gid = getgid(); \
if (setgid(session.gid)) \
pr_log_pri(PR_LOG_ERR, "PRIVS_SETUP: unable to setgid(): %s", \
strerror(errno)); \
if (setreuid(session.uid, session.uid)) \
pr_log_pri(PR_LOG_ERR, "PRIVS_SETUP: unable to setreuid(): %s", \
strerror(errno)); \
} else { \
session.ouid = getuid(); \
session.uid = (u); \
session.gid = (g); \
if (setgid(session.gid)) \
pr_log_pri(PR_LOG_ERR, "PRIVS_SETUP: unable to setgid(): %s", \
strerror(errno)); \
if (setreuid(PR_ROOT_UID, session.uid)) \
pr_log_pri(PR_LOG_ERR, "PRIVS_SETUP: unable to setreuid(): %s", \
strerror(errno)); \
} \
pr_signals_unblock(); \
}
# define PRIVS_ROOT { \
pr_log_debug(DEBUG9, "ROOT PRIVS at %s:%d", __FILE__, __LINE__); \
pr_signals_block(); \
if (!session.disable_id_switching) { \
if (setreuid(session.uid, PR_ROOT_UID)) \
pr_log_pri(PR_LOG_ERR, "PRIVS_ROOT: unable to setreuid(): %s", \
strerror(errno)); \
if (setregid(session.gid, PR_ROOT_GID)) \
pr_log_pri(PR_LOG_ERR, "PRIVS_ROOT: unable to setregid(): %s", \
strerror(errno)); \
} else { \
pr_log_debug(DEBUG9, "PRIVS_ROOT: ID switching disabled"); \
} \
pr_signals_unblock(); \
}
# define PRIVS_USER { \
pr_log_debug(DEBUG9, "USER PRIVS %d at %s:%d", (int) session.login_uid, \
__FILE__, __LINE__); \
pr_signals_block(); \
if (!session.disable_id_switching) { \
if (setreuid(session.uid, PR_ROOT_UID)) \
pr_log_pri(PR_LOG_ERR, "PRIVS_USER: unable to setreuid(session.uid, PR_ROOT_UID): %s", \
strerror(errno)); \
if (setregid(session.gid, session.login_gid)) \
pr_log_pri(PR_LOG_ERR, "PRIVS_USER: unable to setregid(session.gid, " \
"session.login_gid): %s", strerror(errno)); \
if (setreuid(session.uid, session.login_uid)) \
pr_log_pri(PR_LOG_ERR, "PRIVS_USER: unable to setreuid(session.uid, " \
"session.login_uid): %s", strerror(errno)); \
} else { \
pr_log_debug(DEBUG9, "PRIVS_USER: ID switching disabled"); \
} \
pr_signals_unblock(); \
}
# define PRIVS_RELINQUISH { \
pr_signals_block(); \
if (!session.disable_id_switching) { \
pr_log_debug(DEBUG9, "RELINQUISH PRIVS at %s:%d", __FILE__, __LINE__); \
if (geteuid() != PR_ROOT_UID) { \
if (setreuid(session.uid, PR_ROOT_UID)) \
pr_log_pri(PR_LOG_ERR, "PRIVS_RELINQUISH: unable to " \
"setreuid(session.uid, PR_ROOT_UID): %s", strerror(errno)); \
} \
if (getegid() != PR_ROOT_GID) { \
if (setregid(session.gid, PR_ROOT_GID)) \
pr_log_pri(PR_LOG_ERR, "PRIVS_RELINQUISH: unable to " \
"setregid(session.gid, PR_ROOT_GID): %s", strerror(errno)); \
} \
if (setregid(session.gid, session.gid)) \
pr_log_pri(PR_LOG_ERR, "PRIVS_RELINQUISH: unable to setregid(session.gid, " \
"session.gid): %s", strerror(errno)); \
if (setreuid(session.uid, session.uid)) \
pr_log_pri(PR_LOG_ERR, "PRIVS_RELINQUISH: unable to setreuid(session.uid, " \
"session.uid): %s", strerror(errno)); \
} else { \
pr_log_debug(DEBUG9, "PRIVS_RELINQUISH: ID switching disabled"); \
} \
pr_signals_unblock(); \
}
# define PRIVS_REVOKE { \
pr_log_debug(DEBUG9, "REVOKE PRIVS at %s:%d", __FILE__, __LINE__); \
pr_signals_block(); \
if (setreuid(PR_ROOT_UID, PR_ROOT_UID)) \
pr_log_pri(PR_LOG_ERR, "PRIVS_REVOKE: unable to setreuid(PR_ROOT_UID, PR_ROOT_UID): %s", \
strerror(errno)); \
if (setgid(session.gid)) \
pr_log_pri(PR_LOG_ERR, "PRIVS_REVOKE: unable to setgid(): %s", \
strerror(errno)); \
if (setuid(session.uid)) \
pr_log_pri(PR_LOG_ERR, "PRIVS_REVOKE: unable to setuid(): %s", \
strerror(errno)); \
pr_signals_unblock(); \
}
# else /* HAVE_SETEUID */
/* Set the saved uid/gid using setuid/seteuid(). setreuid() is
* no longer used as it is considered obsolete on many systems.
* gids are also no longer swapped, as they are unnecessary.
* If run as root, proftpd now normally runs as:
* real user : root
* effective user : <user>
* saved user : root
* real/eff/saved group : <group>
*/
# define PRIVS_SETUP(u, g) { \
pr_log_debug(DEBUG9, "SETUP PRIVS at %s:%d", __FILE__, __LINE__); \
pr_signals_block(); \
if (getuid() != PR_ROOT_UID) { \
session.ouid = session.uid = getuid(); \
session.gid = getgid(); \
if (setgid(session.gid)) \
pr_log_pri(PR_LOG_ERR, "PRIVS_SETUP: unable to setgid(): %s", \
strerror(errno)); \
if (setuid(session.uid)) \
pr_log_pri(PR_LOG_ERR, "PRIVS_SETUP: unable to setuid(): %s", \
strerror(errno)); \
if (seteuid(session.uid)) \
pr_log_pri(PR_LOG_ERR, "PRIVS_SETUP: unable to seteuid(): %s", \
strerror(errno)); \
} else { \
session.ouid = getuid(); \
session.uid = (u); \
session.gid = (g); \
if (setuid(PR_ROOT_UID)) \
pr_log_pri(PR_LOG_ERR, "PRIVS_SETUP: unable to setuid(): %s", \
strerror(errno)); \
if (setgid((g))) \
pr_log_pri(PR_LOG_ERR, "PRIVS_SETUP: unable to setgid(): %s", \
strerror(errno)); \
if (seteuid((u))) \
pr_log_pri(PR_LOG_ERR, "PRIVS_SETUP: unable to seteuid(): %s", \
strerror(errno)); \
} \
pr_signals_unblock(); \
}
/* Switch back to root privs.
*/
# define PRIVS_ROOT { \
pr_log_debug(DEBUG9, "ROOT PRIVS at %s:%d", __FILE__, __LINE__); \
pr_signals_block(); \
if (!session.disable_id_switching) { \
if (seteuid(PR_ROOT_UID)) \
pr_log_pri(PR_LOG_ERR, "PRIVS_ROOT: unable to seteuid(): %s", \
strerror(errno)); \
if (setegid(PR_ROOT_GID)) \
pr_log_pri(PR_LOG_ERR, "PRIVS_ROOT: unable to setegid(): %s", \
strerror(errno)); \
} else { \
pr_log_debug(DEBUG9, "ROOT PRIVS: ID switching disabled"); \
} \
pr_signals_unblock(); \
}
/* Switch to the privs of the login user.
*/
# define PRIVS_USER { \
pr_log_debug(DEBUG9, "USER PRIVS %d at %s:%d", (int) session.login_uid, \
__FILE__, __LINE__); \
pr_signals_block(); \
if (!session.disable_id_switching) { \
if (seteuid(PR_ROOT_UID)) \
pr_log_pri(PR_LOG_ERR, "PRIVS_USER: unable to seteuid(PR_ROOT_UID): %s", \
strerror(errno)); \
if (setegid(session.login_gid)) \
pr_log_pri(PR_LOG_ERR, "PRIVS_USER: unable to setegid(session.login_gid): " \
"%s", strerror(errno)); \
if (seteuid(session.login_uid)) \
pr_log_pri(PR_LOG_ERR, "PRIVS_USER: unable to seteuid(session.login_uid): " \
"%s", strerror(errno)); \
} else { \
pr_log_debug(DEBUG9, "PRIVS_USER: ID switching disabled"); \
} \
pr_signals_unblock(); \
}
/* Relinquish privs granted by PRIVS_ROOT or PRIVS_USER.
*/
# define PRIVS_RELINQUISH { \
pr_signals_block(); \
if (!session.disable_id_switching) { \
pr_log_debug(DEBUG9, "RELINQUISH PRIVS at %s:%d", __FILE__, __LINE__); \
if (geteuid() != PR_ROOT_UID) { \
if (seteuid(PR_ROOT_UID)) \
pr_log_pri(PR_LOG_ERR, "PRIVS_RELINQUISH: unable to seteuid(PR_ROOT_UID): %s", strerror(errno)); \
} \
if (setegid(session.gid)) \
pr_log_pri(PR_LOG_ERR, "PRIVS_RELINQUISH: unable to setegid(session.gid): %s", strerror(errno)); \
if (seteuid(session.uid)) \
pr_log_pri(PR_LOG_ERR, "PRIVS_RELINQUISH: unable to seteuid(session.uid): %s", strerror(errno)); \
} else { \
pr_log_debug(DEBUG9, "PRIVS_RELINQUISH: ID switching disabled"); \
} \
pr_signals_unblock(); \
}
/* Revoke all privs.
*/
# define PRIVS_REVOKE { \
pr_log_debug(DEBUG9, "REVOKE PRIVS at %s:%d", __FILE__, __LINE__); \
pr_signals_block(); \
if (seteuid(PR_ROOT_UID)) \
pr_log_pri(PR_LOG_ERR, "PRIVS_REVOKE: unable to seteuid(): %s", \
strerror(errno)); \
if (setgid(session.gid)) \
pr_log_pri(PR_LOG_ERR, "PRIVS_REVOKE: unable to setgid(): %s", \
strerror(errno)); \
if (setuid(session.uid)) \
pr_log_pri(PR_LOG_ERR, "PRIVS_REVOKE: unable to setuid(): %s", \
strerror(errno)); \
pr_signals_unblock(); \
}
# endif /* HAVE_SETEUID */
#endif /* PR_DEVEL_COREDUMP */
#endif /* PR_PRIVS_H */
|
