1 /*
2  * Copyright (c) 2016 Martijn van Duren <vias@imperialat.at>
3  * Copyright (c) 2015 Ted Unangst <tedu@openbsd.org>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #include <sys/types.h>
19 #include <sys/stat.h>
20 #include <sys/wait.h>
21 #include <sys/ioctl.h>
22 
23 #include <fcntl.h>
24 #include <limits.h>
25 #include <libgen.h>
26 #include <login_cap.h>
27 #include <bsd_auth.h>
28 #include <readpassphrase.h>
29 #include <signal.h>
30 #include <string.h>
31 #include <stdio.h>
32 #include <stdlib.h>
33 #include <err.h>
34 #include <unistd.h>
35 #include <pwd.h>
36 #include <grp.h>
37 #include <syslog.h>
38 #include <errno.h>
39 
40 #include "vias.h"
41 
42 static void __dead
43 usage(void)
44 {
45 	fprintf(stderr, "usage: vias [-a style] [-C config] "
46 	    "file [editor args]\n");
47 	exit(1);
48 }
49 
50 size_t
51 arraylen(const char **arr)
52 {
53 	size_t cnt = 0;
54 
55 	while (*arr) {
56 		cnt++;
57 		arr++;
58 	}
59 	return cnt;
60 }
61 
62 static int
63 parseuid(const char *s, uid_t *uid)
64 {
65 	struct passwd *pw;
66 	const char *errstr;
67 
68 	if ((pw = getpwnam(s)) != NULL) {
69 		*uid = pw->pw_uid;
70 		return 0;
71 	}
72 	*uid = strtonum(s, 0, UID_MAX, &errstr);
73 	if (errstr)
74 		return -1;
75 	return 0;
76 }
77 
78 static int
79 uidcheck(const char *s, uid_t desired)
80 {
81 	uid_t uid;
82 
83 	if (parseuid(s, &uid) != 0)
84 		return -1;
85 	if (uid != desired)
86 		return -1;
87 	return 0;
88 }
89 
90 static int
91 parsegid(const char *s, gid_t *gid)
92 {
93 	struct group *gr;
94 	const char *errstr;
95 
96 	if ((gr = getgrnam(s)) != NULL) {
97 		*gid = gr->gr_gid;
98 		return 0;
99 	}
100 	*gid = strtonum(s, 0, GID_MAX, &errstr);
101 	if (errstr)
102 		return -1;
103 	return 0;
104 }
105 
106 static int
107 open_nosym(const char *file)
108 {
109 	static int dep = 0;
110 	struct stat sb;
111 	char dir[PATH_MAX];
112 	int fd, pfd;
113 
114 	dep++;
115 	(void) strlcpy(dir, dirname(file), sizeof(dir));
116 
117 	if (dir[1] == '\0') {
118 		dep--;
119 		if ((pfd = open("/", O_CLOEXEC)) == -1)
120 			return -1;
121 	} else {
122 		pfd = open_nosym(dir);
123 		dep--;
124 		if (pfd == -1)
125 			return -1;
126 	}
127 
128 	do {
129 		if (dep) {
130 			fd = openat(pfd, basename(file),
131 			    O_NOFOLLOW | O_CLOEXEC);
132 		} else {
133 			fd = openat(pfd, basename(file),
134 			    O_RDWR | O_NOFOLLOW | O_CLOEXEC | O_CREAT, 0777);
135 		}
136 	} while (fd == -1 && errno == EINTR);
137 	close(pfd);
138 	if (fd == -1)
139 		return -1;
140 
141 	if (fstat(fd, &sb) == -1)
142 		err(1, "fstat");
143 /*
144  * This should already have been checked in parse.y.
145  * It's only here to test for race-conditions
146  */
147 	if (S_ISLNK(sb.st_mode))
148 		errx(1, "Symbolic links not allowed");
149 	if (dep && !S_ISDIR(sb.st_mode))
150 		errc(1, ENOTDIR, NULL);
151 	if (!dep && !S_ISREG(sb.st_mode))
152 		errx(1, "File is not a regular file");
153 
154 	return fd;
155 }
156 
157 static int
158 match(uid_t uid, gid_t *groups, int ngroups, const char *file, struct rule *r)
159 {
160 	int i;
161 	int flen;
162 
163 	if (r->ident[0] == ':') {
164 		gid_t rgid;
165 		if (parsegid(r->ident + 1, &rgid) == -1)
166 			return 0;
167 		for (i = 0; i < ngroups; i++) {
168 			if (rgid == groups[i])
169 				break;
170 		}
171 		if (i == ngroups)
172 			return 0;
173 	} else {
174 		if (uidcheck(r->ident, uid) != 0)
175 			return 0;
176 	}
177 	if (r->files != NULL) {
178 		for (i = 0; r->files[i] != NULL; i++) {
179 			flen = strlen(r->files[i]);
180 /* Allow access to the entire directory tree */
181 			if (r->files[i][flen-1] == '/') {
182 				if (!strncmp(r->files[i], file, flen))
183 					break;
184 			} else {
185 				if (!strcmp(r->files[i], file))
186 					break;
187 			}
188 		}
189 		if (r->files[i] == NULL)
190 			return 0;
191 	}
192 	return 1;
193 }
194 
195 static int
196 permit(uid_t uid, gid_t *groups, int ngroups, struct rule **lastr,
197     const char *file)
198 {
199 	int i;
200 	int fd = -1, pfd = -1;
201 	uid_t suid = -1;
202 	struct rule *r;
203 	char *rfile;
204 
205 	if ((rfile = realpath(file, NULL)) == NULL)
206 		err(1, "Unable to open %s", file);
207 
208 	*lastr = NULL;
209 	for (i = 0; i < nrules; i++) {
210 		r = rules[i];
211 		if (match(uid, groups, ngroups, rfile, r)) {
212 /* Try to open the file, so we know the rule is really permitted */
213 			if (r->target) {
214 				if (parseuid(r->target, &suid) == -1)
215 					err(1, "getpwnam");
216 				if (seteuid(suid) == -1)
217 					err(1, "seteuid");
218 			}
219 			if ((fd = open_nosym(rfile)) != -1) {
220 				if (pfd != -1)
221 					if (close(pfd) == -1)
222 						err(1, "close");
223 				pfd = fd;
224 				*lastr = rules[i];
225 			} else if (errno != EPERM) {
226 				err(1, "open %s", file);
227 			}
228 			if (r->target && seteuid(0))
229 				err(1, "seteuid");
230 		}
231 	}
232 	if (*lastr == NULL || (*lastr)->action != PERMIT) {
233 		if (fd != -1 && close(fd) == -1)
234 			err(1, "close");
235 		return -1;
236 	}
237 
238 	return fd;
239 }
240 
241 static void
242 parseconfig(const char *filename, int checkperms)
243 {
244 	extern FILE *yyfp;
245 	extern int yyparse(void);
246 	struct stat sb;
247 
248 	yyfp = fopen(filename, "r");
249 	if (!yyfp)
250 		err(1, checkperms ? "vias is not enabled, %s" :
251 		    "could not open config file %s", filename);
252 
253 	if (checkperms) {
254 		if (fstat(fileno(yyfp), &sb) != 0)
255 			err(1, "fstat(\"%s\")", filename);
256 		if ((sb.st_mode & (S_IWGRP|S_IWOTH)) != 0)
257 			errx(1, "%s is writable by group or other", filename);
258 		if (sb.st_uid != 0)
259 			errx(1, "%s is not owned by root", filename);
260 	}
261 
262 	yyparse();
263 	fclose(yyfp);
264 	if (parse_errors)
265 		exit(1);
266 }
267 
268 static void __dead
269 checkconfig(const char *confpath, uid_t uid, gid_t *groups, int ngroups,
270     const char *file)
271 {
272 	struct rule *rule;
273 
274 	parseconfig(confpath, 0);
275 	if (!file)
276 		exit(0);
277 
278 	if (permit(uid, groups, ngroups, &rule, file) != -1) {
279 		printf("permit%s\n", (rule->options & NOPASS) ? " nopass" : "");
280 		exit(0);
281 	}
282 	printf("deny\n");
283 	exit(1);
284 }
285 
286 static void
287 authuser(char *myname, char *login_style, int persist)
288 {
289 	char *challenge = NULL, *response, rbuf[1024], cbuf[128];
290 	auth_session_t *as;
291 	int fd = -1;
292 
293 	if (persist)
294 		fd = open("/dev/tty", O_RDWR);
295 	if (fd != -1) {
296 		if (ioctl(fd, TIOCCHKVERAUTH) == 0)
297 			goto good;
298 	}
299 
300 	if (!(as = auth_userchallenge(myname, login_style, "auth-doas",
301 	    &challenge)))
302 		errx(1, "Authorization failed");
303 	if (!challenge) {
304 		char host[HOST_NAME_MAX + 1];
305 		if (gethostname(host, sizeof(host)))
306 			snprintf(host, sizeof(host), "?");
307 		snprintf(cbuf, sizeof(cbuf),
308 		    "\rvias (%.32s@%.32s) password: ", myname, host);
309 		challenge = cbuf;
310 	}
311 	response = readpassphrase(challenge, rbuf, sizeof(rbuf),
312 	    RPP_REQUIRE_TTY);
313 	if (response == NULL && errno == ENOTTY) {
314 		syslog(LOG_AUTHPRIV | LOG_NOTICE,
315 		    "tty required for %s", myname);
316 		errx(1, "a tty is required");
317 	}
318 	if (!auth_userresponse(as, response, 0)) {
319 		explicit_bzero(rbuf, sizeof(rbuf));
320 		syslog(LOG_AUTHPRIV | LOG_NOTICE,
321 		    "failed auth for %s", myname);
322 		errc(1, EPERM, NULL);
323 	}
324 	explicit_bzero(rbuf, sizeof(rbuf));
325 good:
326 	if (fd != -1) {
327 		int secs = 5 * 60;
328 		ioctl(fd, TIOCSETVERAUTH, &secs);
329 		close(fd);
330 	}
331 }
332 static int
333 fcpy(int dfd, int sfd)
334 {
335 	unsigned char buf[4096];
336 	int r;
337 
338 	do {
339 		while ((r = read(sfd, buf, sizeof(buf))) > 0) {
340 			if (write(dfd, buf, r) != r)
341 				return 0;
342 		}
343 	} while (r == -1 && errno == EINTR);
344 	if (r == -1)
345 		return 0;
346 	return 1;
347 }
348 
349 int
350 main(int argc, char **argv)
351 {
352 	const char *confpath = NULL;
353 	char tmpfile[] = "/tmp/vias.XXXXXX";
354 	char myname[_PW_NAME_LEN + 1];
355 	struct passwd *pw;
356 	struct rule *rule;
357 	uid_t uid;
358 	gid_t groups[NGROUPS_MAX + 1];
359 	int ngroups;
360 	int i, ch;
361 	int ofd, tfd, ttyfd;
362 	char cwdpath[PATH_MAX];
363 	const char *cwd;
364 	char *login_style = NULL;
365 	char *file;
366 	char **eargv;
367 	int status;
368 	pid_t ret, vipid;
369 
370 	setprogname("vias");
371 
372 	closefrom(STDERR_FILENO + 1);
373 
374 	uid = getuid();
375 
376 	while ((ch = getopt(argc, argv, "a:C:")) != -1) {
377 		switch (ch) {
378 		case 'a':
379 			login_style = optarg;
380 			break;
381 		case 'C':
382 			confpath = optarg;
383 			break;
384 		default:
385 			usage();
386 		}
387 	}
388 	argv += optind;
389 	argc -= optind;
390 
391 	if (argc == 0 && confpath == NULL)
392 		usage();
393 	file = argv[0];
394 	argv++;
395 	argc--;
396 
397 	pw = getpwuid(uid);
398 	if (!pw)
399 		err(1, "getpwuid failed");
400 	if (strlcpy(myname, pw->pw_name, sizeof(myname)) >= sizeof(myname))
401 		errx(1, "pw_name too long");
402 	ngroups = getgroups(NGROUPS_MAX, groups);
403 	if (ngroups == -1)
404 		err(1, "can't get groups");
405 	groups[ngroups++] = getgid();
406 
407 	if (confpath)
408 		checkconfig(confpath, uid, groups, ngroups, file);
409 
410 	if (geteuid())
411 		errx(1, "not installed setuid");
412 
413 	parseconfig("/etc/vias.conf", 1);
414 
415 	if (setuid(0) == -1)
416 		err(1, "setuid");
417 	if ((ofd = permit(uid, groups, ngroups, &rule, file)) == -1) {
418 		syslog(LOG_AUTHPRIV | LOG_NOTICE,
419 		    "failed edit for %s: %s", myname, file);
420 		errc(1, EPERM, "%s", file);
421 	}
422 
423 	if (setreuid(uid, 0) == -1)
424 		err(1, "setreuid failed");
425 	
426 	if (!(rule->options & NOPASS))
427 		authuser(myname, login_style, rule->options & PERSIST);
428 
429 	if (pledge("stdio rpath wpath cpath exec proc id tty", NULL) == -1)
430 		err(1, "pledge");
431 
432 	if ((setuid(uid)) == -1)
433 		err(1, "setuid failed");
434 
435 	if (pledge("stdio rpath wpath cpath exec proc tty", NULL) == -1)
436 		err(1, "pledge");
437 
438 	if ((tfd = mkstemp(tmpfile)) == -1)
439 		err(1, "mkstemp failed");
440 
441 	if (pledge("stdio rpath cpath exec proc tty", NULL) == -1)
442 		err(1, "pledge");
443 
444 	if (!fcpy(tfd, ofd)) {
445 		unlink(tmpfile);
446 		err(1, "temp copy failed");
447 	}
448 
449 	if (getcwd(cwdpath, sizeof(cwdpath)) == NULL)
450 		cwd = "(failed)";
451 	else
452 		cwd = cwdpath;
453 
454 	if (pledge("stdio cpath exec proc tty", NULL) == -1)
455 		err(1, "pledge");
456 
457 	syslog(LOG_AUTHPRIV | LOG_INFO, "%s edited %s from %s",
458 	    myname, file, cwd);
459 
460 	if ((eargv = reallocarray(NULL, arraylen((const char **) argv) + 2,
461 	    sizeof(*eargv))) == NULL) {
462 		unlink(tmpfile);
463 		err(1, NULL);
464 	}
465 	eargv[0] = getenv("EDITOR");
466 	if (eargv[0] == NULL || *(eargv[0]) == '\0')
467 		eargv[0] = "vi";
468 
469 	switch ((vipid = fork())) {
470 	case -1:
471 		unlink(tmpfile);
472 		err(1, "fork failed");
473 	case 0:
474 		if (pledge("stdio exec", NULL) == -1)
475 			err(1, "pledge");
476 
477 		for (i = 0; argv[i] != NULL; i++)
478 			eargv[i+1] = argv[i];
479 		eargv[i+1] = tmpfile;
480 		eargv[i+2] = NULL;
481 		execvp(eargv[0], eargv);
482 		err(1, "execvp failed");
483 	default:
484 		if (pledge("stdio cpath proc tty", NULL) == -1)
485 			err(1, "pledge");
486 
487 		(void)setpgid(vipid, 0);
488 		ttyfd = open("/dev/tty", O_RDWR);
489 		if (ttyfd != -1)
490 			(void)tcsetpgrp(ttyfd, vipid);
491 		while ((ret = waitpid(vipid, &status, 0)) == -1 &&
492 		    errno == EINTR)
493 			;
494 		if (ret == -1)
495 			err(1, "wait failed: Temporary file saved at %s",
496 			    tmpfile);
497 	}
498 
499 	if (WEXITSTATUS(status) != 0) {
500 		errx(1, "%s exited with status %d: Temporary file saved at %s",
501 		    eargv[0], WEXITSTATUS(status), tmpfile);
502 	}
503 
504 	(void) lseek(tfd, 0, SEEK_SET);
505 	if (ftruncate(ofd, 0) == -1)
506 		err(1, "ftruncate failed: Temporary file saved at %s", tmpfile);
507 	(void) lseek(ofd, 0, SEEK_SET);
508 	if (!fcpy(ofd, tfd))
509 		err(1, "restoring failed: Temporary file saved at %s", tmpfile);
510 	if (unlink(tmpfile) == -1)
511 		err(1, "unlink %s", tmpfile);
512 	return 0;
513 }