Date: Mon, 21 Oct 2002 03:27:53 +0400 (MSD) From: "Aleksandr A. Babaylov" <babolo@aaz.links.ru> To: FreeBSD-gnats-submit@FreeBSD.org Subject: bin/44320: jail(1) change for set{uid|gid} Message-ID: <200210202327.g9KNRr2G088968@aaz.links.ru>
next in thread | raw e-mail | index | archive | help
>Number: 44320 >Category: bin >Synopsis: jail(1) change for set{uid|gid} >Confidential: no >Severity: serious >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: change-request >Submitter-Id: current-users >Arrival-Date: Sun Oct 20 16:30:01 PDT 2002 >Closed-Date: >Last-Modified: >Originator: Aleksandr A. Babaylov >Release: FreeBSD 4.7-PRERELEASE i386 >Organization: home >Environment: System: FreeBSD 4.7-PRERELEASE i386 >Description: It is impossible to start jailed daemon with lowered privileges in jail without some tools in that jail, when daemon has no option to do it itself. >How-To-Repeat: try start ports/www/junkbuster in jail without su(1) or somethig similar in jail with uid www >Fix: I know English bad, so my patch to man may need correction --- usr.sbin/jail/jail.8 21 May 2002 04:42:25 -0000 1.13.2.14 +++ usr.sbin/jail/jail.8 20 Oct 2002 15:44:38 -0000 @@ -41,11 +41,14 @@ .Nd "imprison process and its descendants" .Sh SYNOPSIS .Nm +.Op Fl u Ar user +.Oo Fl g Ar group Oc ... .Ar path hostname ip-number command ... .Sh DESCRIPTION The .Nm command imprisons a process and all future descendants. +Command executes with user, group and group access list privilegies. .Pp Please see the .Xr jail 2 --- usr.sbin/jail/jail.c 30 Jul 2001 10:19:54 -0000 1.5.2.1 +++ usr.sbin/jail/jail.c 20 Oct 2002 15:50:09 -0000 @@ -5,6 +5,7 @@ * can do whatever you want with this stuff. If we meet some day, and you think * this stuff is worth it, you can buy me a beer in return. Poul-Henning Kamp * ---------------------------------------------------------------------------- + * -g -u by babolo. No beer!! * * $FreeBSD: src/usr.sbin/jail/jail.c,v 1.5.2.1 2001/07/30 10:19:54 dd Exp $ * @@ -12,11 +13,22 @@ #include <stdio.h> #include <stdlib.h> +#include <limits.h> #include <string.h> +#include <sys/param.h> +#include <unistd.h> #include <err.h> #include <sys/types.h> #include <sys/jail.h> #include <netinet/in.h> +#include <pwd.h> +#include <grp.h> + +#define J_PATH argv[0] +#define J_HOSTNAME argv[1] +#define J_HOSTADDR argv[2] +#define J_EXEC_N 3 +#define J_EXEC argv[J_EXEC_N] int main(int argc, char **argv) @@ -24,26 +36,72 @@ struct jail j; int i; struct in_addr in; + uid_t chuser; + gid_t gidset[NGROUPS], chgrp, tgrp; + int uset = 0, gset = 0, gnumset = 0; + char *end; + struct passwd *chuserp = NULL; + struct group *chgrpp = NULL; - if (argc < 5) - errx(1, "Usage: %s path hostname ip-number command ...\n", + while ((i = getopt(argc, argv, "g:u:")) != -1) { + switch (i) { + case 'g': + if ((chgrpp = getgrnam(optarg)) == NULL) { + /* Try if group is by number, not by name */ + tgrp = (gid_t)strtol(optarg, &end, 10); + if (*end) + errx(1, "%s: no such group", optarg); + } else { + tgrp = chgrpp->gr_gid; + } + if (gset) { + if (gnumset >= NGROUPS) + errx(1, "group number > %d", NGROUPS + 1); + gidset[gnumset++] = tgrp; + } else { + chgrp = tgrp; + gset = 1; + } + break; + case 'u': + if ((chuserp = getpwnam(optarg)) == NULL) { + /* Try if user is by number, not by name */ + chuser = (uid_t)strtol(optarg, &end, 10); + if (*end) + errx(1, "%s: no such user", optarg); + } else { + chuser = chuserp->pw_uid; + } + uset = 1; + break; + default: + errx(1, "unknown option -%c", i); + } + } + argc -= optind; + if (argc < 4) + errx(1, "Usage: %s [-u user ][-g group ]... path hostname ip-number command ...\n", argv[0]); - i = chdir(argv[1]); - if (i) - err(1, "chdir %s", argv[1]); + argv += optind; + if (chdir(J_PATH)) + err(1, "chdir %s", J_PATH); memset(&j, 0, sizeof(j)); j.version = 0; - j.path = argv[1]; - j.hostname = argv[2]; - i = inet_aton(argv[3], &in); - if (!i) + j.path = J_PATH; + j.hostname = J_HOSTNAME; + if (!inet_aton(J_HOSTADDR, &in)) errx(1, "Couldn't make sense of ip-number\n"); j.ip_number = ntohl(in.s_addr); - i = jail(&j); - if (i) + if (jail(&j)) err(1, "Imprisonment failed"); - i = execv(argv[4], argv + 4); - if (i) - err(1, "execv(%s)", argv[4]); + if (gset) { + setgid(chgrp); + if (setgroups(gnumset, gidset) == -1) + err(1, "group access list failed"); + } + if (uset) + setuid(chuser); + if (execv(J_EXEC, argv + J_EXEC_N)) + err(1, "execv(%s)", J_EXEC); exit (0); } >Release-Note: >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200210202327.g9KNRr2G088968>