skeud

suc.c (4818B)

// SPDX-FileCopyrightText: 2022-2023 Haelwenn (lanodan) Monnier <contact+skeud@hacktivis.me>
// SPDX-License-Identifier: MPL-2.0
#define _POSIX_C_SOURCE 202405L
// for explicit_bzero, initgroups
#define _DEFAULT_SOURCE
#ifdef __linux__
// I love linux extensions (no)
#include <shadow.h> /* getspnam */
#endif
#include "common.h" // skeud_getpass, skeud_crypt_check
#include <assert.h>  // assert
#include <errno.h>   // errno
#include <grp.h>     // initgroups
#include <limits.h>  // NAME_MAX
#include <pwd.h>     // getpwnam
#include <stdbool.h> // bool
#include <stdio.h>   // fprintf, perror
#include <stdlib.h>  // abort, setenv
#include <string.h>  // strcmp, explicit_bzero
#include <unistd.h>  // getuid, getopt, opt*, chdir, setuid, setgid
extern char **environ;
char *envclear[]  = {NULL};
const char *argv0 = "suc";
int
main(int argc, char *argv[])
{
	bool opt_l           = false;
	bool opt_p           = false;
	const char *username = "root";
	struct passwd *pwent = NULL;
	char *shell          = NULL;
	if(geteuid() != 0)
	{
		fputs("suc: error: Not effectively super-user. Missing setuid?\n", stderr);
		return 1;
	}
	int c = EOF;
	/* flawfinder: ignore CWE-120, CWE-20 */
	while((c = getopt(argc, argv, ":ls:pu:")) != EOF)
	{
		switch(c)
		{
		case 'l': // login-mode
			opt_l = true;
			break;
		case 's': // shell
			if(getuid() != 0)
			{
				fputs("suc: error: Only the super-user can override the target shell\n", stderr);
				return 1;
			}
			shell = optarg;
			break;
		case 'p': // preserve environment
			if(getuid() != 0)
			{
				fputs("suc: error: Only the super-user can preserve the environment\n", stderr);
				return 1;
			}
			opt_p = true;
			break;
		case 'u': // username
			username = optarg;
			break;
		case ':':
			fprintf(stderr, "suc: error: Option -%c requires an operand\n", optopt);
			return 1;
		case '?':
			fprintf(stderr, "suc: error: Unrecognized option: '-%c'\n", optopt);
			return 1;
		default:
			fputs("suc: error: Unknown getopt state, aborting\n", stderr);
			abort();
		}
	}
	argc -= optind;
	argv += optind;
	errno = 0;
	pwent = getpwnam(username);
	if(pwent == NULL)
	{
		if(errno != 0)
		{
			perror("suc: error: Failed getting passwd entry");
		}
		else
		{
			fprintf(stderr, "suc: error: getpwnam: No entry found for user %s\n", username);
		}
		return 1;
	}
	if(shell == NULL)
	{
		if(pwent->pw_shell)
		{
			shell = pwent->pw_shell;
		}
		else
		{
			fprintf(stderr, "suc: error: No shell entry for user %s\n", username);
			return 1;
		}
	}
	fprintf(stderr, "suc: info: Authenticating as %s\n", username);
	if(getuid() != 0)
	{
		char *pw_hash = NULL;
		if(pwent->pw_passwd)
		{
			pw_hash = pwent->pw_passwd;
		}
#ifdef __linux__
		// Always fetched to avoid potentially leaking passwd contents
		errno              = 0;
		struct spwd *swent = getspnam(username);
		if(errno != 0)
		{
			perror("suc: warning: getspnam");
		}
		else
		{
			if(pw_hash && pw_hash[0] == 'x' && pw_hash[1] == 0)
			{
				pw_hash = swent->sp_pwdp;
			}
			explicit_bzero(swent, sizeof(swent));
			swent = NULL;
		}
#endif /* __linux__ */
		char *password = NULL;
		ssize_t got    = skeud_getpass(&password);
		if(got < 0)
		{
			free(password);
			return 1;
		}
		bool valid_p = skeud_crypt_check(pw_hash, password);
		explicit_bzero(password, got);
		free(password);
		if(pw_hash) explicit_bzero(pw_hash, sizeof(pw_hash));
		if(!valid_p)
		{
			sleep(2);
			fprintf(stderr, "suc: error: Invalid username or password\n");
			return 1;
		}
	}
	if(!opt_p)
	{
		char *term = getenv("TERM");
		environ    = envclear;
		if(term)
		{
			setenv("TERM", term, 1);
		}
	}
	if(setgid(pwent->pw_gid) < 0)
	{
		perror("suc: error: setgid");
		return 1;
	}
	if(initgroups(username, pwent->pw_gid) < 0)
	{
		perror("suc: error: initgroups");
		return 1;
	}
	if(setuid(pwent->pw_uid) < 0)
	{
		perror("suc: error: setuid");
		return 1;
	}
	const char *home = pwent->pw_dir ? pwent->pw_dir : "/";
	setenv("HOME", home, 1);
	static char shell0[NAME_MAX] = "sh";
	if(opt_l)
	{
		const char *sh_basename = strrchr(shell, '/');
		sh_basename = sh_basename ? sh_basename + 1 : shell;
		strlcpy(shell0, "-sh", NAME_MAX - 1);
		strlcpy(shell0 + 1, sh_basename, NAME_MAX - 1);
		if(chdir(home) != 0) perror("suc: chdir");
	}
	explicit_bzero(pwent, sizeof(pwent));
	pwent = NULL;
	setenv("USER", username, 1);
	setenv("LOGNAME", username, 1);
	setenv("SHELL", shell, 1);
	setenv("IFS", " \t\n", 1);
	static char *args_shell0[] = {shell0, NULL};
	char **args = argc > 0 ? argv : args_shell0;
	char *arg0  = argc > 0 ? argv[0] : shell;
	errno = 0;
	/* flawfinder: ignore CWE-78 */
	int ret = execvp(arg0, args);
	if(ret < 0)
	{
		if(errno == ENOENT)
		{
			perror("suc: execve");
			return 127;
		}
		else
		{
			perror("suc: execve");
			return 126;
		}
	}
}