1 /*
2  * Copyright (c) 2016 Martijn van Duren <vias@imperialat.at>
3  * Copyright (c) 2015 Ted Unangst <tedu@openbsd.org>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #include <sys/types.h>
19 #include <sys/stat.h>
20 #include <sys/wait.h>
21 #include <sys/ioctl.h>
22 
23 #include <fcntl.h>
24 #include <limits.h>
25 #include <libgen.h>
26 #include <login_cap.h>
27 #include <bsd_auth.h>
28 #include <readpassphrase.h>
29 #include <string.h>
30 #include <stdio.h>
31 #include <stdlib.h>
32 #include <err.h>
33 #include <unistd.h>
34 #include <pwd.h>
35 #include <grp.h>
36 #include <syslog.h>
37 #include <errno.h>
38 
39 #include "vias.h"
40 
41 static void __dead
42 usage(void)
43 {
44 	fprintf(stderr, "usage: vias [-a style] [-C config] "
45 	    "file [editor args]\n");
46 	exit(1);
47 }
48 
49 size_t
50 arraylen(const char **arr)
51 {
52 	size_t cnt = 0;
53 
54 	while (*arr) {
55 		cnt++;
56 		arr++;
57 	}
58 	return cnt;
59 }
60 
61 static int
62 parseuid(const char *s, uid_t *uid)
63 {
64 	struct passwd *pw;
65 	const char *errstr;
66 
67 	if ((pw = getpwnam(s)) != NULL) {
68 		*uid = pw->pw_uid;
69 		return 0;
70 	}
71 	*uid = strtonum(s, 0, UID_MAX, &errstr);
72 	if (errstr)
73 		return -1;
74 	return 0;
75 }
76 
77 static int
78 uidcheck(const char *s, uid_t desired)
79 {
80 	uid_t uid;
81 
82 	if (parseuid(s, &uid) != 0)
83 		return -1;
84 	if (uid != desired)
85 		return -1;
86 	return 0;
87 }
88 
89 static int
90 parsegid(const char *s, gid_t *gid)
91 {
92 	struct group *gr;
93 	const char *errstr;
94 
95 	if ((gr = getgrnam(s)) != NULL) {
96 		*gid = gr->gr_gid;
97 		return 0;
98 	}
99 	*gid = strtonum(s, 0, GID_MAX, &errstr);
100 	if (errstr)
101 		return -1;
102 	return 0;
103 }
104 
105 static int
106 open_nosym(const char *file)
107 {
108 	static int dep = 0;
109 	struct stat sb;
110 	char dir[PATH_MAX];
111 	int fd, pfd;
112 
113 	dep++;
114 	(void) strlcpy(dir, dirname(file), sizeof(dir));
115 
116 	if (dir[1] == '\0') {
117 		dep--;
118 		if ((pfd = open("/", O_CLOEXEC)) == -1)
119 			return -1;
120 	} else {
121 		pfd = open_nosym(dir);
122 		dep--;
123 		if (pfd == -1)
124 			return -1;
125 	}
126 
127 	do {
128 		if (dep) {
129 			fd = openat(pfd, basename(file),
130 			    O_NOFOLLOW | O_CLOEXEC);
131 		} else {
132 			fd = openat(pfd, basename(file),
133 			    O_RDWR | O_NOFOLLOW | O_CLOEXEC | O_CREAT, 0777);
134 		}
135 	} while (fd == -1 && errno == EINTR);
136 	close(pfd);
137 	if (fd == -1)
138 		return -1;
139 
140 	if (fstat(fd, &sb) == -1)
141 		err(1, "fstat");
142 /*
143  * This should already have been checked in parse.y.
144  * It's only here to test for race-conditions
145  */
146 	if (S_ISLNK(sb.st_mode))
147 		errx(1, "Symbolic links not allowed");
148 	if (dep && !S_ISDIR(sb.st_mode))
149 		errc(1, ENOTDIR, NULL);
150 	if (!dep && !S_ISREG(sb.st_mode))
151 		errx(1, "File is not a regular file");
152 
153 	return fd;
154 }
155 
156 static int
157 match(uid_t uid, gid_t *groups, int ngroups, const char *file, struct rule *r)
158 {
159 	int i;
160 	int flen;
161 
162 	if (r->ident[0] == ':') {
163 		gid_t rgid;
164 		if (parsegid(r->ident + 1, &rgid) == -1)
165 			return 0;
166 		for (i = 0; i < ngroups; i++) {
167 			if (rgid == groups[i])
168 				break;
169 		}
170 		if (i == ngroups)
171 			return 0;
172 	} else {
173 		if (uidcheck(r->ident, uid) != 0)
174 			return 0;
175 	}
176 	if (r->files != NULL) {
177 		for (i = 0; r->files[i] != NULL; i++) {
178 			flen = strlen(r->files[i]);
179 /* Allow access to the entire directory tree */
180 			if (r->files[i][flen-1] == '/') {
181 				if (!strncmp(r->files[i], file, flen))
182 					break;
183 			} else {
184 				if (!strcmp(r->files[i], file))
185 					break;
186 			}
187 		}
188 		if (r->files[i] == NULL)
189 			return 0;
190 	}
191 	return 1;
192 }
193 
194 static int
195 permit(uid_t uid, gid_t *groups, int ngroups, struct rule **lastr,
196     const char *file)
197 {
198 	int i;
199 	int fd = -1, pfd = -1;
200 	uid_t suid = -1;
201 	struct rule *r;
202 	char *rfile;
203 
204 	if ((rfile = realpath(file, NULL)) == NULL)
205 		err(1, "Unable to open %s", file);
206 
207 	*lastr = NULL;
208 	for (i = 0; i < nrules; i++) {
209 		r = rules[i];
210 		if (match(uid, groups, ngroups, rfile, r)) {
211 /* Try to open the file, so we know the rule is really permitted */
212 			if (r->target) {
213 				if (parseuid(r->target, &suid) == -1)
214 					err(1, "getpwnam");
215 				if (seteuid(suid) == -1)
216 					err(1, "seteuid");
217 			}
218 			if ((fd = open_nosym(rfile)) != -1) {
219 				if (pfd != -1)
220 					if (close(pfd) == -1)
221 						err(1, "close");
222 				pfd = fd;
223 				*lastr = rules[i];
224 			} else if (errno != EPERM) {
225 				err(1, "open %s", file);
226 			}
227 			if (r->target && seteuid(0))
228 				err(1, "seteuid");
229 		}
230 	}
231 	if (*lastr == NULL || (*lastr)->action != PERMIT) {
232 		if (fd != -1 && close(fd) == -1)
233 			err(1, "close");
234 		return -1;
235 	}
236 
237 	return fd;
238 }
239 
240 static void
241 parseconfig(const char *filename, int checkperms)
242 {
243 	extern FILE *yyfp;
244 	extern int yyparse(void);
245 	struct stat sb;
246 
247 	yyfp = fopen(filename, "r");
248 	if (!yyfp)
249 		err(1, checkperms ? "vias is not enabled, %s" :
250 		    "could not open config file %s", filename);
251 
252 	if (checkperms) {
253 		if (fstat(fileno(yyfp), &sb) != 0)
254 			err(1, "fstat(\"%s\")", filename);
255 		if ((sb.st_mode & (S_IWGRP|S_IWOTH)) != 0)
256 			errx(1, "%s is writable by group or other", filename);
257 		if (sb.st_uid != 0)
258 			errx(1, "%s is not owned by root", filename);
259 	}
260 
261 	yyparse();
262 	fclose(yyfp);
263 	if (parse_errors)
264 		exit(1);
265 }
266 
267 static void __dead
268 checkconfig(const char *confpath, uid_t uid, gid_t *groups, int ngroups,
269     const char *file)
270 {
271 	struct rule *rule;
272 
273 	parseconfig(confpath, 0);
274 	if (!file)
275 		exit(0);
276 
277 	if (permit(uid, groups, ngroups, &rule, file) != -1) {
278 		printf("permit%s\n", (rule->options & NOPASS) ? " nopass" : "");
279 		exit(0);
280 	}
281 	printf("deny\n");
282 	exit(1);
283 }
284 
285 static void
286 authuser(char *myname, char *login_style, int persist)
287 {
288 	char *challenge = NULL, *response, rbuf[1024], cbuf[128];
289 	auth_session_t *as;
290 	int fd = -1;
291 
292 	if (persist)
293 		fd = open("/dev/tty", O_RDWR);
294 	if (fd != -1) {
295 		if (ioctl(fd, TIOCCHKVERAUTH) == 0)
296 			goto good;
297 	}
298 
299 	if (!(as = auth_userchallenge(myname, login_style, "auth-doas",
300 	    &challenge)))
301 		errx(1, "Authorization failed");
302 	if (!challenge) {
303 		char host[HOST_NAME_MAX + 1];
304 		if (gethostname(host, sizeof(host)))
305 			snprintf(host, sizeof(host), "?");
306 		snprintf(cbuf, sizeof(cbuf),
307 		    "\rvias (%.32s@%.32s) password: ", myname, host);
308 		challenge = cbuf;
309 	}
310 	response = readpassphrase(challenge, rbuf, sizeof(rbuf),
311 	    RPP_REQUIRE_TTY);
312 	if (response == NULL && errno == ENOTTY) {
313 		syslog(LOG_AUTHPRIV | LOG_NOTICE,
314 		    "tty required for %s", myname);
315 		errx(1, "a tty is required");
316 	}
317 	if (!auth_userresponse(as, response, 0)) {
318 		syslog(LOG_AUTHPRIV | LOG_NOTICE,
319 		    "failed auth for %s", myname);
320 		errc(1, EPERM, NULL);
321 	}
322 	explicit_bzero(rbuf, sizeof(rbuf));
323 good:
324 	if (fd != -1) {
325 		int secs = 5 * 60;
326 		ioctl(fd, TIOCSETVERAUTH, &secs);
327 		close(fd);
328 	}
329 }
330 static int
331 fcpy(int dfd, int sfd)
332 {
333 	unsigned char buf[4096];
334 	int r;
335 
336 	do {
337 		while ((r = read(sfd, buf, sizeof(buf))) > 0) {
338 			if (write(dfd, buf, r) != r)
339 				return 0;
340 		}
341 	} while (r == -1 && errno == EINTR);
342 	if (r == -1)
343 		return 0;
344 	return 1;
345 }
346 
347 int
348 main(int argc, char **argv)
349 {
350 	const char *confpath = NULL;
351 	char tmpfile[] = "/tmp/vias.XXXXXX";
352 	char myname[_PW_NAME_LEN + 1];
353 	struct passwd *pw;
354 	struct rule *rule;
355 	uid_t uid;
356 	gid_t groups[NGROUPS_MAX + 1];
357 	int ngroups;
358 	int i, ch;
359 	int ofd, tfd;
360 	char cwdpath[PATH_MAX];
361 	const char *cwd;
362 	char *login_style = NULL;
363 	char *file;
364 	char **eargv;
365 	int status;
366 	pid_t ret, vipid;
367 
368 	setprogname("vias");
369 
370 	closefrom(STDERR_FILENO + 1);
371 
372 	uid = getuid();
373 
374 	while ((ch = getopt(argc, argv, "a:C:")) != -1) {
375 		switch (ch) {
376 		case 'a':
377 			login_style = optarg;
378 			break;
379 		case 'C':
380 			confpath = optarg;
381 			break;
382 		default:
383 			usage();
384 		}
385 	}
386 	argv += optind;
387 	argc -= optind;
388 
389 	if (argc == 0 && confpath == NULL)
390 		usage();
391 	file = argv[0];
392 	argv++;
393 	argc--;
394 
395 	pw = getpwuid(uid);
396 	if (!pw)
397 		err(1, "getpwuid failed");
398 	if (strlcpy(myname, pw->pw_name, sizeof(myname)) >= sizeof(myname))
399 		errx(1, "pw_name too long");
400 	ngroups = getgroups(NGROUPS_MAX, groups);
401 	if (ngroups == -1)
402 		err(1, "can't get groups");
403 	groups[ngroups++] = getgid();
404 
405 	if (confpath)
406 		checkconfig(confpath, uid, groups, ngroups, file);
407 
408 	if (geteuid())
409 		errx(1, "not installed setuid");
410 
411 	parseconfig("/etc/vias.conf", 1);
412 
413 	if (setuid(0) == -1)
414 		err(1, "setuid");
415 	if ((ofd = permit(uid, groups, ngroups, &rule, file)) == -1) {
416 		syslog(LOG_AUTHPRIV | LOG_NOTICE,
417 		    "failed edit for %s: %s", myname, file);
418 		errc(1, EPERM, "%s", file);
419 	}
420 
421 	if (setreuid(uid, 0) == -1)
422 		err(1, "setreuid failed");
423 	
424 	if (!(rule->options & NOPASS))
425 		authuser(myname, login_style, rule->options & PERSIST);
426 
427 	if (pledge("stdio rpath wpath cpath exec proc id", NULL) == -1)
428 		err(1, "pledge");
429 
430 	if ((setuid(uid)) == -1)
431 		err(1, "setuid failed");
432 
433 	if (pledge("stdio rpath wpath cpath exec proc", NULL) == -1)
434 		err(1, "pledge");
435 
436 	if ((tfd = mkstemp(tmpfile)) == -1)
437 		err(1, "mkstemp failed");
438 
439 	if (pledge("stdio rpath cpath exec proc", NULL) == -1)
440 		err(1, "pledge");
441 
442 	if (!fcpy(tfd, ofd)) {
443 		unlink(tmpfile);
444 		err(1, "temp copy failed");
445 	}
446 
447 	if (getcwd(cwdpath, sizeof(cwdpath)) == NULL)
448 		cwd = "(failed)";
449 	else
450 		cwd = cwdpath;
451 
452 	if (pledge("stdio cpath exec proc", NULL) == -1)
453 		err(1, "pledge");
454 
455 	syslog(LOG_AUTHPRIV | LOG_INFO, "%s edited %s as %s from %s",
456 	    myname, file, pw->pw_name, cwd);
457 
458 	if ((eargv = reallocarray(NULL, arraylen((const char **) argv) + 2,
459 	    sizeof(*eargv))) == NULL) {
460 		unlink(tmpfile);
461 		err(1, NULL);
462 	}
463 	eargv[0] = getenv("EDITOR");
464 	if (eargv[0] == NULL || *(eargv[0]) == '\0')
465 		eargv[0] = "vi";
466 
467 	switch ((vipid = fork())) {
468 	case -1:
469 		unlink(tmpfile);
470 		err(1, "fork failed");
471 	case 0:
472 		if (pledge("stdio exec", NULL) == -1)
473 			err(1, "pledge");
474 
475 		for (i = 0; argv[i] != NULL; i++)
476 			eargv[i+1] = argv[i];
477 		eargv[i+1] = tmpfile;
478 		eargv[i+2] = NULL;
479 		execvp(eargv[0], eargv);
480 		err(1, "execvp failed");
481 	default:
482 		if (pledge("stdio cpath", NULL) == -1)
483 			err(1, "pledge");
484 
485 		while ((ret = waitpid(vipid, &status, 0)) == -1 &&
486 		    errno == EINTR)
487 			;
488 		if (ret == -1)
489 			err(1, "wait failed: Temporary file saved at %s",
490 			    tmpfile);
491 	}
492 
493 	if (WEXITSTATUS(status) != 0) {
494 		errx(1, "%s exited with status %d: Temporary file saved at %s",
495 		    eargv[0], WEXITSTATUS(status), tmpfile);
496 	}
497 
498 	(void) lseek(tfd, 0, SEEK_SET);
499 	if (ftruncate(ofd, 0) == -1)
500 		err(1, "ftruncate failed: Temporary file saved at %s", tmpfile);
501 	(void) lseek(ofd, 0, SEEK_SET);
502 	if (!fcpy(ofd, tfd))
503 		err(1, "restoring failed: Temporary file saved at %s", tmpfile);
504 	if (unlink(tmpfile) == -1)
505 		err(1, "unlink %s", tmpfile);
506 	return 0;
507 }