1 /*
2  * Copyright (c) 2016 Martijn van Duren <vias@imperialat.at>
3  * Copyright (c) 2015 Ted Unangst <tedu@openbsd.org>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #include <sys/types.h>
19 #include <sys/stat.h>
20 #include <sys/wait.h>
21 #include <sys/ioctl.h>
22 
23 #include <fcntl.h>
24 #include <limits.h>
25 #include <libgen.h>
26 #include <login_cap.h>
27 #include <bsd_auth.h>
28 #include <readpassphrase.h>
29 #include <string.h>
30 #include <stdio.h>
31 #include <stdlib.h>
32 #include <err.h>
33 #include <unistd.h>
34 #include <pwd.h>
35 #include <grp.h>
36 #include <syslog.h>
37 #include <errno.h>
38 
39 #include "vias.h"
40 
41 static void __dead
42 usage(void)
43 {
44 	fprintf(stderr, "usage: vias [-a style] [-C config] "
45 	    "file [editor args]\n");
46 	exit(1);
47 }
48 
49 size_t
50 arraylen(const char **arr)
51 {
52 	size_t cnt = 0;
53 
54 	while (*arr) {
55 		cnt++;
56 		arr++;
57 	}
58 	return cnt;
59 }
60 
61 static int
62 parseuid(const char *s, uid_t *uid)
63 {
64 	struct passwd *pw;
65 	const char *errstr;
66 
67 	if ((pw = getpwnam(s)) != NULL) {
68 		*uid = pw->pw_uid;
69 		return 0;
70 	}
71 	*uid = strtonum(s, 0, UID_MAX, &errstr);
72 	if (errstr)
73 		return -1;
74 	return 0;
75 }
76 
77 static int
78 uidcheck(const char *s, uid_t desired)
79 {
80 	uid_t uid;
81 
82 	if (parseuid(s, &uid) != 0)
83 		return -1;
84 	if (uid != desired)
85 		return -1;
86 	return 0;
87 }
88 
89 static int
90 parsegid(const char *s, gid_t *gid)
91 {
92 	struct group *gr;
93 	const char *errstr;
94 
95 	if ((gr = getgrnam(s)) != NULL) {
96 		*gid = gr->gr_gid;
97 		return 0;
98 	}
99 	*gid = strtonum(s, 0, GID_MAX, &errstr);
100 	if (errstr)
101 		return -1;
102 	return 0;
103 }
104 
105 static int
106 open_nosym(const char *file)
107 {
108 	static int dep = 0;
109 	struct stat sb;
110 	char dir[PATH_MAX];
111 	int fd, pfd;
112 
113 	dep++;
114 	(void) strlcpy(dir, dirname(file), sizeof(dir));
115 
116 	if (dir[1] == '\0') {
117 		dep--;
118 		if ((pfd = open("/", O_CLOEXEC)) == -1)
119 			return -1;
120 	} else {
121 		pfd = open_nosym(dir);
122 		dep--;
123 		if (pfd == -1)
124 			return -1;
125 	}
126 
127 	do {
128 		if (dep) {
129 			fd = openat(pfd, basename(file),
130 			    O_NOFOLLOW | O_CLOEXEC);
131 		} else {
132 			fd = openat(pfd, basename(file),
133 			    O_RDWR | O_NOFOLLOW | O_CLOEXEC | O_CREAT, 0777);
134 		}
135 	} while (fd == -1 && errno == EINTR);
136 	close(pfd);
137 	if (fd == -1)
138 		return -1;
139 
140 	if (fstat(fd, &sb) == -1)
141 		err(1, "fstat");
142 /*
143  * This should already have been checked in parse.y.
144  * It's only here to test for race-conditions
145  */
146 	if (S_ISLNK(sb.st_mode))
147 		errx(1, "Symbolic links not allowed");
148 	if (dep && !S_ISDIR(sb.st_mode))
149 		errc(1, ENOTDIR, NULL);
150 	if (!dep && !S_ISREG(sb.st_mode))
151 		errx(1, "File is not a regular file");
152 
153 	return fd;
154 }
155 
156 static int
157 match(uid_t uid, gid_t *groups, int ngroups, const char *file, struct rule *r)
158 {
159 	int i;
160 	int flen;
161 
162 	if (r->ident[0] == ':') {
163 		gid_t rgid;
164 		if (parsegid(r->ident + 1, &rgid) == -1)
165 			return 0;
166 		for (i = 0; i < ngroups; i++) {
167 			if (rgid == groups[i])
168 				break;
169 		}
170 		if (i == ngroups)
171 			return 0;
172 	} else {
173 		if (uidcheck(r->ident, uid) != 0)
174 			return 0;
175 	}
176 	if (r->files != NULL) {
177 		for (i = 0; r->files[i] != NULL; i++) {
178 			flen = strlen(r->files[i]);
179 /* Allow access to the entire directory tree */
180 			if (r->files[i][flen-1] == '/') {
181 				if (!strncmp(r->files[i], file, flen))
182 					break;
183 			} else {
184 				if (!strcmp(r->files[i], file))
185 					break;
186 			}
187 		}
188 		if (r->files[i] == NULL)
189 			return 0;
190 	}
191 	return 1;
192 }
193 
194 static int
195 permit(uid_t uid, gid_t *groups, int ngroups, struct rule **lastr,
196     const char *file)
197 {
198 	int i;
199 	int fd = -1, pfd = -1;
200 	int serrno
201 	uid_t suid = -1;
202 	struct rule *r;
203 	char *rfile;
204 
205 	if ((rfile = realpath(file, NULL)) == NULL)
206 		err(1, "Unable to open %s", file);
207 
208 	*lastr = NULL;
209 	for (i = 0; i < nrules; i++) {
210 		r = rules[i];
211 		if (match(uid, groups, ngroups, rfile, r)) {
212 /* Try to open the file, so we know the rule is really permitted */
213 			if (r->target) {
214 				if (parseuid(r->target, &suid) == -1)
215 					err(1, "getpwnam");
216 				if (seteuid(suid) == -1)
217 					err(1, "seteuid");
218 			}
219 			if ((fd = open_nosym(rfile)) != -1) {
220 				if (pfd != -1)
221 					if (close(pfd) == -1)
222 						err(1, "close");
223 				pfd = fd;
224 				*lastr = rules[i];
225 			} else if (errno != EPERM) {
226 				err(1, "open %s", file);
227 			}
228 			if (r->target && seteuid(0))
229 				err(1, "seteuid");
230 		}
231 	}
232 	if (*lastr == NULL || (*lastr)->action != PERMIT) {
233 		if (close(fd) == -1)
234 			err(1, "close");
235 		return -1;
236 	}
237 
238 	return fd;
239 }
240 
241 static void
242 parseconfig(const char *filename, int checkperms)
243 {
244 	extern FILE *yyfp;
245 	extern int yyparse(void);
246 	struct stat sb;
247 
248 	yyfp = fopen(filename, "r");
249 	if (!yyfp)
250 		err(1, checkperms ? "vias is not enabled, %s" :
251 		    "could not open config file %s", filename);
252 
253 	if (checkperms) {
254 		if (fstat(fileno(yyfp), &sb) != 0)
255 			err(1, "fstat(\"%s\")", filename);
256 		if ((sb.st_mode & (S_IWGRP|S_IWOTH)) != 0)
257 			errx(1, "%s is writable by group or other", filename);
258 		if (sb.st_uid != 0)
259 			errx(1, "%s is not owned by root", filename);
260 	}
261 
262 	yyparse();
263 	fclose(yyfp);
264 	if (parse_errors)
265 		exit(1);
266 }
267 
268 static void __dead
269 checkconfig(const char *confpath, uid_t uid, gid_t *groups, int ngroups,
270     const char *file)
271 {
272 	struct rule *rule;
273 
274 	parseconfig(confpath, 0);
275 	if (!file)
276 		exit(0);
277 
278 	if (permit(uid, groups, ngroups, &rule, file) != -1) {
279 		printf("permit%s\n", (rule->options & NOPASS) ? " nopass" : "");
280 		exit(0);
281 	}
282 	printf("deny\n");
283 	exit(1);
284 }
285 
286 static void
287 authuser(char *myname, char *login_style, int persist)
288 {
289 	char *challenge = NULL, *response, rbuf[1024], cbuf[128];
290 	auth_session_t *as;
291 	int fd = -1;
292 
293 	if (persist)
294 		fd = open("/dev/tty", O_RDWR);
295 	if (fd != -1) {
296 		if (ioctl(fd, TIOCCHKVERAUTH) == 0)
297 			goto good;
298 	}
299 
300 	if (!(as = auth_userchallenge(myname, login_style, "auth-doas",
301 	    &challenge)))
302 		errx(1, "Authorization failed");
303 	if (!challenge) {
304 		char host[HOST_NAME_MAX + 1];
305 		if (gethostname(host, sizeof(host)))
306 			snprintf(host, sizeof(host), "?");
307 		snprintf(cbuf, sizeof(cbuf),
308 		    "\rvias (%.32s@%.32s) password: ", myname, host);
309 		challenge = cbuf;
310 	}
311 	response = readpassphrase(challenge, rbuf, sizeof(rbuf),
312 	    RPP_REQUIRE_TTY);
313 	if (response == NULL && errno == ENOTTY) {
314 		syslog(LOG_AUTHPRIV | LOG_NOTICE,
315 		    "tty required for %s", myname);
316 		errx(1, "a tty is required");
317 	}
318 	if (!auth_userresponse(as, response, 0)) {
319 		syslog(LOG_AUTHPRIV | LOG_NOTICE,
320 		    "failed auth for %s", myname);
321 		errc(1, EPERM, NULL);
322 	}
323 	explicit_bzero(rbuf, sizeof(rbuf));
324 good:
325 	if (fd != -1) {
326 		int secs = 5 * 60;
327 		ioctl(fd, TIOCSETVERAUTH, &secs);
328 		close(fd);
329 	}
330 }
331 static int
332 fcpy(int dfd, int sfd)
333 {
334 	unsigned char buf[4096];
335 	int r;
336 
337 	do {
338 		while ((r = read(sfd, buf, sizeof(buf))) > 0) {
339 			if (write(dfd, buf, r) != r)
340 				return 0;
341 		}
342 	} while (r == -1 && errno == EINTR);
343 	if (r == -1)
344 		return 0;
345 	return 1;
346 }
347 
348 int
349 main(int argc, char **argv)
350 {
351 	const char *confpath = NULL;
352 	char tmpfile[] = "/tmp/vias.XXXXXX";
353 	char myname[_PW_NAME_LEN + 1];
354 	struct passwd *pw;
355 	struct rule *rule;
356 	uid_t uid;
357 	gid_t groups[NGROUPS_MAX + 1];
358 	int ngroups;
359 	int i, ch;
360 	int ofd, tfd;
361 	char cwdpath[PATH_MAX];
362 	const char *cwd;
363 	char *login_style = NULL;
364 	char *file;
365 	char **eargv;
366 	int status;
367 	pid_t ret, vipid;
368 
369 	setprogname("vias");
370 
371 	closefrom(STDERR_FILENO + 1);
372 
373 	uid = getuid();
374 
375 	while ((ch = getopt(argc, argv, "a:C:")) != -1) {
376 		switch (ch) {
377 		case 'a':
378 			login_style = optarg;
379 			break;
380 		case 'C':
381 			confpath = optarg;
382 			break;
383 		default:
384 			usage();
385 		}
386 	}
387 	argv += optind;
388 	argc -= optind;
389 
390 	if (argc == 0 && confpath == NULL)
391 		usage();
392 	file = argv[0];
393 	argv++;
394 	argc--;
395 
396 	pw = getpwuid(uid);
397 	if (!pw)
398 		err(1, "getpwuid failed");
399 	if (strlcpy(myname, pw->pw_name, sizeof(myname)) >= sizeof(myname))
400 		errx(1, "pw_name too long");
401 	ngroups = getgroups(NGROUPS_MAX, groups);
402 	if (ngroups == -1)
403 		err(1, "can't get groups");
404 	groups[ngroups++] = getgid();
405 
406 	if (confpath)
407 		checkconfig(confpath, uid, groups, ngroups, file);
408 
409 	if (geteuid())
410 		errx(1, "not installed setuid");
411 
412 	parseconfig("/etc/vias.conf", 1);
413 
414 	if (setuid(0) == -1)
415 		err(1, "setuid");
416 	if ((ofd = permit(uid, groups, ngroups, &rule, file)) == -1) {
417 		syslog(LOG_AUTHPRIV | LOG_NOTICE,
418 		    "failed edit for %s: %s", myname, file);
419 		err(1, "%s", file);
420 	}
421 
422 	if (setreuid(uid, 0) == -1)
423 		err(1, "setreuid failed");
424 	
425 	if (!(rule->options & NOPASS))
426 		authuser(myname, login_style, rule->options & PERSIST);
427 
428 	if (pledge("stdio rpath wpath cpath exec proc id", NULL) == -1)
429 		err(1, "pledge");
430 
431 	if ((setuid(uid)) == -1)
432 		err(1, "setuid failed");
433 
434 	if (pledge("stdio rpath wpath cpath exec proc", NULL) == -1)
435 		err(1, "pledge");
436 
437 	if ((tfd = mkstemp(tmpfile)) == -1)
438 		err(1, "mkstemp failed");
439 
440 	if (pledge("stdio rpath cpath exec proc", NULL) == -1)
441 		err(1, "pledge");
442 
443 	if (!fcpy(tfd, ofd)) {
444 		unlink(tmpfile);
445 		err(1, "temp copy failed");
446 	}
447 
448 	if (getcwd(cwdpath, sizeof(cwdpath)) == NULL)
449 		cwd = "(failed)";
450 	else
451 		cwd = cwdpath;
452 
453 	if (pledge("stdio cpath exec proc", NULL) == -1)
454 		err(1, "pledge");
455 
456 	syslog(LOG_AUTHPRIV | LOG_INFO, "%s edited %s as %s from %s",
457 	    myname, file, pw->pw_name, cwd);
458 
459 	if ((eargv = reallocarray(NULL, arraylen((const char **) argv) + 2,
460 	    sizeof(*eargv))) == NULL) {
461 		unlink(tmpfile);
462 		err(1, NULL);
463 	}
464 	eargv[0] = getenv("EDITOR");
465 	if (eargv[0] == NULL || *(eargv[0]) == '\0')
466 		eargv[0] = "vi";
467 
468 	switch ((vipid = fork())) {
469 	case -1:
470 		unlink(tmpfile);
471 		err(1, "fork failed");
472 	case 0:
473 		if (pledge("stdio exec", NULL) == -1)
474 			err(1, "pledge");
475 
476 		for (i = 0; argv[i] != NULL; i++)
477 			eargv[i+1] = argv[i];
478 		eargv[i+1] = tmpfile;
479 		eargv[i+2] = NULL;
480 		execvp(eargv[0], eargv);
481 		err(1, "execvp failed");
482 	default:
483 		if (pledge("stdio cpath", NULL) == -1)
484 			err(1, "pledge");
485 
486 		while ((ret = waitpid(vipid, &status, 0)) == -1 &&
487 		    errno == EINTR)
488 			;
489 		if (ret == -1)
490 			err(1, "wait failed: Temporary file saved at %s",
491 			    tmpfile);
492 	}
493 
494 	if (WEXITSTATUS(status) != 0) {
495 		errx(1, "%s exited with status %d: Temporary file saved at %s",
496 		    eargv[0], WEXITSTATUS(status), tmpfile);
497 	}
498 
499 	(void) lseek(tfd, 0, SEEK_SET);
500 	if (ftruncate(ofd, 0) == -1)
501 		err(1, "ftruncate failed: Temporary file saved at %s", tmpfile);
502 	(void) lseek(ofd, 0, SEEK_SET);
503 	if (!fcpy(ofd, tfd))
504 		err(1, "restoring failed: Temporary file saved at %s", tmpfile);
505 	if (unlink(tmpfile) == -1)
506 		err(1, "unlink %s", tmpfile);
507 	return 0;
508 }