From owner-freebsd-bugs Sun Oct 20 16:30: 7 2002 Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 18FC937B401 for ; Sun, 20 Oct 2002 16:30:03 -0700 (PDT) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 498CB43E8A for ; Sun, 20 Oct 2002 16:30:02 -0700 (PDT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.12.6/8.12.6) with ESMTP id g9KNU2x3061430 for ; Sun, 20 Oct 2002 16:30:02 -0700 (PDT) (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.12.6/8.12.6/Submit) id g9KNU2s0061429; Sun, 20 Oct 2002 16:30:02 -0700 (PDT) Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id EE81737B401 for ; Sun, 20 Oct 2002 16:27:46 -0700 (PDT) Received: from aaz.links.ru (aaz.links.ru [193.125.152.37]) by mx1.FreeBSD.org (Postfix) with ESMTP id 3AF2143E88 for ; Sun, 20 Oct 2002 16:27:46 -0700 (PDT) (envelope-from babolo@aaz.links.ru) Received: from aaz.links.ru (aaz.links.ru [193.125.152.37]) by aaz.links.ru (8.12.6/8.12.6) with ESMTP id g9KNRsDh088969 for ; Mon, 21 Oct 2002 03:27:54 +0400 (MSD) (envelope-from babolo@aaz.links.ru) Received: (from babolo@localhost) by aaz.links.ru (8.12.6/8.12.6/Submit) id g9KNRr2G088968; Mon, 21 Oct 2002 03:27:53 +0400 (MSD) Message-Id: <200210202327.g9KNRr2G088968@aaz.links.ru> Date: Mon, 21 Oct 2002 03:27:53 +0400 (MSD) From: "Aleksandr A. Babaylov" Reply-To: "Aleksandr A. Babaylov" To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Subject: bin/44320: jail(1) change for set{uid|gid} Sender: owner-freebsd-bugs@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org >Number: 44320 >Category: bin >Synopsis: jail(1) change for set{uid|gid} >Confidential: no >Severity: serious >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: change-request >Submitter-Id: current-users >Arrival-Date: Sun Oct 20 16:30:01 PDT 2002 >Closed-Date: >Last-Modified: >Originator: Aleksandr A. Babaylov >Release: FreeBSD 4.7-PRERELEASE i386 >Organization: home >Environment: System: FreeBSD 4.7-PRERELEASE i386 >Description: It is impossible to start jailed daemon with lowered privileges in jail without some tools in that jail, when daemon has no option to do it itself. >How-To-Repeat: try start ports/www/junkbuster in jail without su(1) or somethig similar in jail with uid www >Fix: I know English bad, so my patch to man may need correction --- usr.sbin/jail/jail.8 21 May 2002 04:42:25 -0000 1.13.2.14 +++ usr.sbin/jail/jail.8 20 Oct 2002 15:44:38 -0000 @@ -41,11 +41,14 @@ .Nd "imprison process and its descendants" .Sh SYNOPSIS .Nm +.Op Fl u Ar user +.Oo Fl g Ar group Oc ... .Ar path hostname ip-number command ... .Sh DESCRIPTION The .Nm command imprisons a process and all future descendants. +Command executes with user, group and group access list privilegies. .Pp Please see the .Xr jail 2 --- usr.sbin/jail/jail.c 30 Jul 2001 10:19:54 -0000 1.5.2.1 +++ usr.sbin/jail/jail.c 20 Oct 2002 15:50:09 -0000 @@ -5,6 +5,7 @@ * can do whatever you want with this stuff. If we meet some day, and you think * this stuff is worth it, you can buy me a beer in return. Poul-Henning Kamp * ---------------------------------------------------------------------------- + * -g -u by babolo. No beer!! * * $FreeBSD: src/usr.sbin/jail/jail.c,v 1.5.2.1 2001/07/30 10:19:54 dd Exp $ * @@ -12,11 +13,22 @@ #include #include +#include #include +#include +#include #include #include #include #include +#include +#include + +#define J_PATH argv[0] +#define J_HOSTNAME argv[1] +#define J_HOSTADDR argv[2] +#define J_EXEC_N 3 +#define J_EXEC argv[J_EXEC_N] int main(int argc, char **argv) @@ -24,26 +36,72 @@ struct jail j; int i; struct in_addr in; + uid_t chuser; + gid_t gidset[NGROUPS], chgrp, tgrp; + int uset = 0, gset = 0, gnumset = 0; + char *end; + struct passwd *chuserp = NULL; + struct group *chgrpp = NULL; - if (argc < 5) - errx(1, "Usage: %s path hostname ip-number command ...\n", + while ((i = getopt(argc, argv, "g:u:")) != -1) { + switch (i) { + case 'g': + if ((chgrpp = getgrnam(optarg)) == NULL) { + /* Try if group is by number, not by name */ + tgrp = (gid_t)strtol(optarg, &end, 10); + if (*end) + errx(1, "%s: no such group", optarg); + } else { + tgrp = chgrpp->gr_gid; + } + if (gset) { + if (gnumset >= NGROUPS) + errx(1, "group number > %d", NGROUPS + 1); + gidset[gnumset++] = tgrp; + } else { + chgrp = tgrp; + gset = 1; + } + break; + case 'u': + if ((chuserp = getpwnam(optarg)) == NULL) { + /* Try if user is by number, not by name */ + chuser = (uid_t)strtol(optarg, &end, 10); + if (*end) + errx(1, "%s: no such user", optarg); + } else { + chuser = chuserp->pw_uid; + } + uset = 1; + break; + default: + errx(1, "unknown option -%c", i); + } + } + argc -= optind; + if (argc < 4) + errx(1, "Usage: %s [-u user ][-g group ]... path hostname ip-number command ...\n", argv[0]); - i = chdir(argv[1]); - if (i) - err(1, "chdir %s", argv[1]); + argv += optind; + if (chdir(J_PATH)) + err(1, "chdir %s", J_PATH); memset(&j, 0, sizeof(j)); j.version = 0; - j.path = argv[1]; - j.hostname = argv[2]; - i = inet_aton(argv[3], &in); - if (!i) + j.path = J_PATH; + j.hostname = J_HOSTNAME; + if (!inet_aton(J_HOSTADDR, &in)) errx(1, "Couldn't make sense of ip-number\n"); j.ip_number = ntohl(in.s_addr); - i = jail(&j); - if (i) + if (jail(&j)) err(1, "Imprisonment failed"); - i = execv(argv[4], argv + 4); - if (i) - err(1, "execv(%s)", argv[4]); + if (gset) { + setgid(chgrp); + if (setgroups(gnumset, gidset) == -1) + err(1, "group access list failed"); + } + if (uset) + setuid(chuser); + if (execv(J_EXEC, argv + J_EXEC_N)) + err(1, "execv(%s)", J_EXEC); exit (0); } >Release-Note: >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message