From patchwork Mon Feb 13 14:00:38 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jeff Layton X-Patchwork-Id: 9569795 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 113676045D for ; Mon, 13 Feb 2017 14:01:22 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 14BDF27B81 for ; Mon, 13 Feb 2017 14:01:22 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 09A6527F8C; Mon, 13 Feb 2017 14:01:22 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 72FE627EED for ; Mon, 13 Feb 2017 14:01:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752961AbdBMOBU (ORCPT ); Mon, 13 Feb 2017 09:01:20 -0500 Received: from hr2.samba.org ([144.76.82.148]:58838 "EHLO hr2.samba.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752748AbdBMOBT (ORCPT ); Mon, 13 Feb 2017 09:01:19 -0500 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=samba.org; s=42627210; h=Message-Id:Date:Cc:To:From; bh=j4SQgags3dct1bpHkcOK+CwQQt05pnsF83K29WQ7Tkc=; b=bUXgn3Al/UnpdP9UvNoz0uV/Dy RhEZ+fz5RDGwQT2+1qG0PD/zybQk3nbppVb9RU66YEt8riTIRfyEjO2BeflaxAoKgrldKzbfo9hRB wrg+Jw1SoefVQZqcoDDx5x8nIxWttqI0EPIREW6WRzD1m9XWMDeorpTe7a6GOluIE1cQ=; Received: from [127.0.0.2] (localhost [127.0.0.1]) by hr2.samba.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim) id 1cdHBn-0006zs-06; Mon, 13 Feb 2017 14:01:11 +0000 From: Jeff Layton To: linux-cifs@vger.kernel.org, samba-technical@lists.samba.org Cc: cwseys@physics.wisc.edu, simo@redhat.com, samba@lists.samba.org Subject: [cifs-utils PATCH] cifs.upcall: switch group IDs when handling an upcall Date: Mon, 13 Feb 2017 09:00:38 -0500 Message-Id: <20170213140038.7300-1-jlayton@samba.org> X-Mailer: git-send-email 2.9.3 Sender: linux-cifs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-cifs@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Currently, we leave the group ID alone, but now that we're looking at KRB5CCNAME, we need to be a little more careful with credentials. After we get the uid, do a getpwuid and grab the default gid for the user. Then use setgid to set it before calling setuid. Signed-off-by: Jeff Layton --- cifs.upcall.c | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) diff --git a/cifs.upcall.c b/cifs.upcall.c index ee3449d4555d..3328bbdd34ca 100644 --- a/cifs.upcall.c +++ b/cifs.upcall.c @@ -47,6 +47,8 @@ #include #include #include +#include +#include #include "replace.h" #include "data_blob.h" @@ -818,6 +820,7 @@ int main(const int argc, char *const argv[]) char *keytab_name = NULL; char *env_cachename = NULL; krb5_ccache ccache = NULL; + struct passwd *pw; hostbuf[0] = '\0'; memset(&arg, 0, sizeof(arg)); @@ -924,20 +927,54 @@ int main(const int argc, char *const argv[]) } /* + * The kernel doesn't pass down the gid, so we resort here to scraping + * one out of /etc/passwd (or the equivalent). Note that this might + * not reflect the actual gid of the process that initiated the + * upcall, but it's safer than relying on the current creds. + */ + pw = getpwuid(uid); + if (!pw) { + syslog(LOG_ERR, "Unable to find pw entry for uid %d: %s\n", + uid, strerror(errno)); + rc = 1; + goto out; + } + + /* * Must do this before setuid, as we need ptrace perms to look at * environ file. */ env_cachename = get_cachename_from_process_env(env_probe ? arg.pid : 0); + /* + * The kernel should send down a zero-length grouplist already, but + * just to be on the safe side... + */ + rc = setgroups(0, NULL); + if (rc == -1) { + syslog(LOG_ERR, "setgroups: %s", strerror(errno)); + rc = 1; + goto out; + } + + rc = setgid(pw->pw_gid); + if (rc == -1) { + syslog(LOG_ERR, "setgid: %s", strerror(errno)); + rc = 1; + goto out; + } + rc = setuid(uid); if (rc == -1) { syslog(LOG_ERR, "setuid: %s", strerror(errno)); + rc = 1; goto out; } rc = krb5_init_context(&context); if (rc) { syslog(LOG_ERR, "unable to init krb5 context: %ld", rc); + rc = 1; goto out; }