1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
|
/* vi: set sw=4 ts=4: */
/*
* Mini su implementation for busybox
*
* Licensed under GPLv2 or later, see file LICENSE in this source tree.
*/
//config:config SU
//config: bool "su"
//config: default y
//config: select FEATURE_SYSLOG
//config: help
//config: su is used to become another user during a login session.
//config: Invoked without a username, su defaults to becoming the super user.
//config:
//config: Note that Busybox binary must be setuid root for this applet to
//config: work properly.
//config:
//config:config FEATURE_SU_SYSLOG
//config: bool "Enable su to write to syslog"
//config: default y
//config: depends on SU
//config:
//config:config FEATURE_SU_CHECKS_SHELLS
//config: bool "Enable su to check user's shell to be listed in /etc/shells"
//config: depends on SU
//config: default y
//applet:/* Needs to be run by root or be suid root - needs to change uid and gid: */
//applet:IF_SU(APPLET(su, BB_DIR_BIN, BB_SUID_REQUIRE))
//kbuild:lib-$(CONFIG_SU) += su.o
//usage:#define su_trivial_usage
//usage: "[-lmp] [-] [-s SH] [USER [SCRIPT ARGS / -c 'CMD' ARG0 ARGS]]"
//usage:#define su_full_usage "\n\n"
//usage: "Run shell under USER (by default, root)\n"
//usage: "\n -,-l Clear environment, go to home dir, run shell as login shell"
//usage: "\n -p,-m Do not set new $HOME, $SHELL, $USER, $LOGNAME"
//usage: "\n -c CMD Command to pass to 'sh -c'"
//usage: "\n -s SH Shell to use instead of user's default"
#include "libbb.h"
#include <syslog.h>
#if ENABLE_FEATURE_SU_CHECKS_SHELLS
/* Return 1 if SHELL is a restricted shell (one not returned by
* getusershell), else 0, meaning it is a standard shell. */
static int restricted_shell(const char *shell)
{
char *line;
int result = 1;
/*setusershell(); - getusershell does it itself*/
while ((line = getusershell()) != NULL) {
if (/* *line != '#' && */ strcmp(line, shell) == 0) {
result = 0;
break;
}
}
if (ENABLE_FEATURE_CLEAN_UP)
endusershell();
return result;
}
#endif
#define SU_OPT_mp (3)
#define SU_OPT_l (4)
int su_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
int su_main(int argc UNUSED_PARAM, char **argv)
{
unsigned flags;
char *opt_shell = NULL;
char *opt_command = NULL;
const char *opt_username = "root";
struct passwd *pw;
uid_t cur_uid = getuid();
const char *tty;
#if ENABLE_FEATURE_UTMP
char user_buf[64];
#endif
const char *old_user;
/* Note: we don't use "'+': stop at first non-option" idiom here.
* For su, "SCRIPT ARGS" or "-c CMD ARGS" do not stop option parsing:
* ARGS starting with dash will be treated as su options,
* not passed to shell. (Tested on util-linux 2.28).
*/
flags = getopt32(argv, "mplc:s:", &opt_command, &opt_shell);
argv += optind;
if (argv[0] && LONE_DASH(argv[0])) {
flags |= SU_OPT_l;
argv++;
}
/* get user if specified */
if (argv[0]) {
opt_username = argv[0];
argv++;
}
if (ENABLE_FEATURE_SU_SYSLOG) {
/* The utmp entry (via getlogin) is probably the best way to
* identify the user, especially if someone su's from a su-shell.
* But getlogin can fail -- usually due to lack of utmp entry.
* in this case resort to getpwuid. */
#if ENABLE_FEATURE_UTMP
old_user = user_buf;
if (getlogin_r(user_buf, sizeof(user_buf)) != 0)
#endif
{
pw = getpwuid(cur_uid);
old_user = pw ? xstrdup(pw->pw_name) : "";
}
tty = xmalloc_ttyname(2);
if (!tty) {
tty = "none";
}
openlog(applet_name, 0, LOG_AUTH);
}
pw = xgetpwnam(opt_username);
if (cur_uid == 0 || ask_and_check_password(pw) > 0) {
if (ENABLE_FEATURE_SU_SYSLOG)
syslog(LOG_NOTICE, "%c %s %s:%s",
'+', tty, old_user, opt_username);
} else {
if (ENABLE_FEATURE_SU_SYSLOG)
syslog(LOG_NOTICE, "%c %s %s:%s",
'-', tty, old_user, opt_username);
bb_do_delay(LOGIN_FAIL_DELAY);
bb_error_msg_and_die("incorrect password");
}
if (ENABLE_FEATURE_CLEAN_UP && ENABLE_FEATURE_SU_SYSLOG) {
closelog();
}
if (!opt_shell && (flags & SU_OPT_mp)) {
/* -s SHELL is not given, but "preserve env" opt is */
opt_shell = getenv("SHELL");
}
#if ENABLE_FEATURE_SU_CHECKS_SHELLS
if (opt_shell && cur_uid != 0 && pw->pw_shell && restricted_shell(pw->pw_shell)) {
/* The user being su'd to has a nonstandard shell, and so is
* probably a uucp account or has restricted access. Don't
* compromise the account by allowing access with a standard
* shell. */
bb_error_msg("using restricted shell");
opt_shell = NULL; /* ignore -s PROG */
}
/* else: user can run whatever he wants via "su -s PROG USER".
* This is safe since PROG is run under user's uid/gid. */
#endif
if (!opt_shell)
opt_shell = pw->pw_shell;
change_identity(pw);
setup_environment(opt_shell,
((flags & SU_OPT_l) / SU_OPT_l * SETUP_ENV_CLEARENV)
+ (!(flags & SU_OPT_mp) * SETUP_ENV_CHANGEENV)
+ (!(flags & SU_OPT_l) * SETUP_ENV_NO_CHDIR),
pw);
IF_SELINUX(set_current_security_context(NULL);)
if (opt_command) {
*--argv = opt_command;
*--argv = (char*)"-c";
}
/* A nasty ioctl exists which can stuff data into input queue:
* #include <sys/ioctl.h>
* int main() {
* const char *msg = "echo $UID\n";
* while (*msg) ioctl(0, TIOCSTI, *msg++);
* return 0;
* }
* With "su USER -c EXPLOIT" run by root, exploit can make root shell
* read as input and execute arbitrary command.
* It's debatable whether we need to protect against this
* (root may hesitate to run unknown scripts interactively).
*
* Some versions of su run -c CMD in a different session:
* ioctl(TIOCSTI) works only on the controlling tty.
*/
/* Never returns */
run_shell(opt_shell, flags & SU_OPT_l, (const char**)argv);
/* return EXIT_FAILURE; - not reached */
}
|
