From patchwork Wed Feb 15 16:15:20 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jeff Layton X-Patchwork-Id: 9574393 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 02DEF60493 for ; Wed, 15 Feb 2017 16:15:39 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E759728489 for ; Wed, 15 Feb 2017 16:15:38 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id DC86F284CD; Wed, 15 Feb 2017 16:15:38 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8BE9E2846B for ; Wed, 15 Feb 2017 16:15:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752144AbdBOQPh (ORCPT ); Wed, 15 Feb 2017 11:15:37 -0500 Received: from hr2.samba.org ([144.76.82.148]:34121 "EHLO hr2.samba.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752141AbdBOQPh (ORCPT ); Wed, 15 Feb 2017 11:15:37 -0500 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=samba.org; s=42627210; h=Message-Id:Date:Cc:To:From; bh=c+tGL5GQZvhcURo3uFfSYIH//w+8z75sRl+0gZi64AE=; b=BXG9MCGlU7nsssx6o5lOGMWH4O aExz2O8wtgyKQ1mIOrhXt0Q966hHVXF9hF8ubFGTcyZs7Hx17PXkpY9xVBmrlV7V3EoEcHCqdfKCn 29VwyrcRfMQnuby8SBD3l5l8f03Z3lHmYkgfLq+FdDFQHaTXctrq6qT6N8dF7eWbeBWo=; Received: from [127.0.0.2] (localhost [127.0.0.1]) by hr2.samba.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim) id 1ce2Ex-0006hm-Tc; Wed, 15 Feb 2017 16:15:36 +0000 From: Jeff Layton To: linux-cifs@vger.kernel.org, samba-technical@lists.samba.org Cc: cwseys@physics.wisc.edu, simo@redhat.com, samba@lists.samba.org Subject: [cifs-utils PATCH v4 2/4] cifs.upcall: switch group IDs when handling an upcall Date: Wed, 15 Feb 2017 11:15:20 -0500 Message-Id: <20170215161522.17063-3-jlayton@samba.org> X-Mailer: git-send-email 2.9.3 In-Reply-To: <20170215161522.17063-1-jlayton@samba.org> References: <20170215161522.17063-1-jlayton@samba.org> Sender: linux-cifs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-cifs@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Currently, we leave the group ID alone, but in a later patch we'll be changing cifs.upcall to scrape $KRB5CCNAME out of the originating process. At that point, we want to be a little more careful with the process credentials we'll be using. After we get the uid, do a getpwuid and grab the default gid for the user. Then use setgid to set it before calling setuid. Signed-off-by: Jeff Layton --- cifs.upcall.c | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) diff --git a/cifs.upcall.c b/cifs.upcall.c index 418b179d7f29..2b535a133a30 100644 --- a/cifs.upcall.c +++ b/cifs.upcall.c @@ -46,6 +46,8 @@ #include #include #include +#include +#include #include "replace.h" #include "data_blob.h" @@ -694,6 +696,7 @@ int main(const int argc, char *const argv[]) uid_t uid; char *keytab_name = NULL; krb5_ccache ccache = NULL; + struct passwd *pw; hostbuf[0] = '\0'; memset(&arg, 0, sizeof(arg)); @@ -795,15 +798,49 @@ int main(const int argc, char *const argv[]) goto out; } + /* + * The kernel doesn't pass down the gid, so we resort here to scraping + * one out of the passwd nss db. Note that this might not reflect the + * actual gid of the process that initiated the upcall. While we could + * scrape that out of /proc, relying on that is a bit more risky. + */ + pw = getpwuid(uid); + if (!pw) { + syslog(LOG_ERR, "Unable to find pw entry for uid %d: %s\n", + uid, strerror(errno)); + rc = 1; + goto out; + } + + /* + * The kernel should send down a zero-length grouplist already, but + * just to be on the safe side... + */ + rc = setgroups(0, NULL); + if (rc == -1) { + syslog(LOG_ERR, "setgroups: %s", strerror(errno)); + rc = 1; + goto out; + } + + rc = setgid(pw->pw_gid); + if (rc == -1) { + syslog(LOG_ERR, "setgid: %s", strerror(errno)); + rc = 1; + goto out; + } + rc = setuid(uid); if (rc == -1) { syslog(LOG_ERR, "setuid: %s", strerror(errno)); + rc = 1; goto out; } rc = krb5_init_context(&context); if (rc) { syslog(LOG_ERR, "unable to init krb5 context: %ld", rc); + rc = 1; goto out; }