/* -*- mode: C; c-file-style: "gnu"; indent-tabs-mode: nil; -*- */
/* activation-helper.c Setuid helper for launching programs as a custom
* user. This file is security sensitive.
*
* Copyright (C) 2007 Red Hat, Inc.
*
* Licensed under the Academic Free License version 2.1
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*
*/
#include <config.h>
#include "bus.h"
#include "driver.h"
#include "utils.h"
#include "desktop-file.h"
#include "config-parser-trivial.h"
#include "activation-helper.h"
#include "activation-exit-codes.h"
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/types.h>
#include <pwd.h>
#include <grp.h>
#include <dbus/dbus-shell.h>
#include <dbus/dbus-marshal-validate.h>
static BusDesktopFile *
desktop_file_for_name (BusConfigParser *parser,
const char *name,
DBusError *error)
{
BusDesktopFile *desktop_file;
DBusList **service_dirs;
DBusList *link;
DBusError tmp_error;
DBusString full_path;
DBusString filename;
const char *dir;
_DBUS_ASSERT_ERROR_IS_CLEAR (error);
desktop_file = NULL;
if (!_dbus_string_init (&filename))
{
BUS_SET_OOM (error);
goto out_all;
}
if (!_dbus_string_init (&full_path))
{
BUS_SET_OOM (error);
goto out_filename;
}
if (!_dbus_string_append (&filename, name) ||
!_dbus_string_append (&filename, ".service"))
{
BUS_SET_OOM (error);
goto out;
}
service_dirs = bus_config_parser_get_service_dirs (parser);
for (link = _dbus_list_get_first_link (service_dirs);
link != NULL;
link = _dbus_list_get_next_link (service_dirs, link))
{
dir = link->data;
_dbus_verbose ("Looking at '%s'\n", dir);
dbus_error_init (&tmp_error);
/* clear the path from last time */
_dbus_string_set_length (&full_path, 0);
/* build the full path */
if (!_dbus_string_append (&full_path, dir) ||
!_dbus_concat_dir_and_file (&full_path, &filename))
{
BUS_SET_OOM (error);
goto out;
}
_dbus_verbose ("Trying to load file '%s'\n", _dbus_string_get_data (&full_path));
desktop_file = bus_desktop_file_load (&full_path, &tmp_error);
if (desktop_file == NULL)
{
_DBUS_ASSERT_ERROR_IS_SET (&tmp_error);
_dbus_verbose ("Could not load %s: %s: %s\n",
_dbus_string_get_const_data (&full_path),
tmp_error.name, tmp_error.message);
/* we may have failed if the file is not found; this is not fatal */
if (dbus_error_has_name (&tmp_error, DBUS_ERROR_NO_MEMORY))
{
dbus_move_error (&tmp_error, error);
/* we only bail out on OOM */
goto out;
}
dbus_error_free (&tmp_error);
}
/* did we find the desktop file we want? */
if (desktop_file != NULL)
break;
}
/* Didn't find desktop file; set error */
if (desktop_file == NULL)
{
dbus_set_error (error, DBUS_ERROR_SPAWN_SERVICE_NOT_FOUND,
"The name %s was not provided by any .service files",
name);
}
out:
_dbus_string_free (&full_path);
out_filename:
_dbus_string_free (&filename);
out_all:
return desktop_file;
}
/* Cleares the environment, except for DBUS_VERBOSE and DBUS_STARTER_x */
static dbus_bool_t
clear_environment (DBusError *error)
{
const char *debug_env = NULL;
const char *starter_env = NULL;
#ifdef DBUS_ENABLE_VERBOSE_MODE
/* are we debugging */
debug_env = _dbus_getenv ("DBUS_VERBOSE");
#endif
/* we save the starter */
starter_env = _dbus_getenv ("DBUS_STARTER_ADDRESS");
#ifndef ACTIVATION_LAUNCHER_TEST
/* totally clear the environment */
if (!_dbus_clearenv ())
{
dbus_set_error (error, DBUS_ERROR_SPAWN_SETUP_FAILED,
"could not clear environment\n");
return FALSE;
}
#endif
#ifdef DBUS_ENABLE_VERBOSE_MODE
/* restore the debugging environment setting if set */
if (debug_env)
_dbus_setenv ("DBUS_VERBOSE", debug_env);
#endif
/* restore the starter */
if (starter_env)
_dbus_setenv ("DBUS_STARTER_ADDRESS", starter_env);
/* set the type, which must be system if we got this far */
_dbus_setenv ("DBUS_STARTER_BUS_TYPE", "system");
return TRUE;
}
static dbus_bool_t
check_permissions (const char *dbus_user, DBusError *error)
{
uid_t uid, euid;
struct passwd *pw;
pw = NULL;
uid = 0;
euid = 0;
#ifndef ACTIVATION_LAUNCHER_TEST
/* bail out unless the dbus user is invoking the helper */
pw = getpwnam(dbus_user);
if (!pw)
{
dbus_set_error (error, DBUS_ERROR_SPAWN_PERMISSIONS_INVALID,
"cannot find user '%s'", dbus_user);
return FALSE;
}
uid = getuid();
if (pw->pw_uid != uid)
{
dbus_set_error (error, DBUS_ERROR_SPAWN_PERMISSIONS_INVALID,
"not invoked from user '%s'", dbus_user);
return FALSE;
}
/* bail out unless we are setuid to user root */
euid = geteuid();
if (euid != 0)
{
dbus_set_error (error, DBUS_ERROR_SPAWN_PERMISSIONS_INVALID,
"not setuid root");
return FALSE;
}
#endif
return TRUE;
}
static dbus_bool_t
check_service_name (BusDesktopFile *desktop_file,
const char *service_name,
DBusError *error)
{
char *name_tmp;
dbus_bool_t retval;
retval = FALSE;
/* try to get Name */
if (!bus_desktop_file_get_string (desktop_file,
DBUS_SERVICE_SECTION,
DBUS_SERVICE_NAME,
&name_tmp,
error))
goto failed;
/* verify that the name is the same as the file service name */
if (strcmp (service_name, name_tmp) != 0)
{
dbus_set_error (error, DBUS_ERROR_SPAWN_FILE_INVALID,
"Service '%s' does not match expected value", name_tmp);
goto failed_free;
}
retval = TRUE;
failed_free:
/* we don't return the name, so free it here */
dbus_free (name_tmp);
failed:
return retval;
}
static dbus_bool_t
get_parameters_for_service (BusDesktopFile *desktop_file,
const char *service_name,
char **exec,
char **user,
DBusError *error)
{
char *exec_tmp;
char *user_tmp;
exec_tmp = NULL;
user_tmp = NULL;
/* check the name of the service */
if (!check_service_name (desktop_file, service_name, error))
goto failed;
/* get the complete path of the executable */
if (!bus_desktop_file_get_string (desktop_file,
DBUS_SERVICE_SECTION,
DBUS_SERVICE_EXEC,
&exec_tmp,
error))
{
_DBUS_ASSERT_ERROR_IS_SET (error);
goto failed;
}
/* get the user that should run this service - user is compulsary for system activation */
if (!bus_desktop_file_get_string (desktop_file,
DBUS_SERVICE_SECTION,
DBUS_SERVICE_USER,
&user_tmp,
error))
{
_DBUS_ASSERT_ERROR_IS_SET (error);
goto failed;
}
/* only assign if all the checks passed */
*exec = exec_tmp;
*user = user_tmp;
return TRUE;
failed:
dbus_free (exec_tmp);
dbus_free (user_tmp);
return FALSE;
}
static dbus_bool_t
switch_user (char *user, DBusError *error)
{
#ifndef ACTIVATION_LAUNCHER_TEST
struct passwd *pw;
/* find user */
pw = getpwnam (user);
if (!pw)
{
dbus_set_error (error, DBUS_ERROR_SPAWN_SETUP_FAILED,
"cannot find user '%s'\n", user);
return FALSE;
}
/* initialize the group access list */
if (initgroups (user, pw->pw_gid))
{
dbus_set_error (error, DBUS_ERROR_SPAWN_SETUP_FAILED,
"could not initialize groups");
return FALSE;
}
/* change to the primary group for the user */
if (setgid (pw->pw_gid))
{
dbus_set_error (error, DBUS_ERROR_SPAWN_SETUP_FAILED,
"cannot setgid group %i", pw->pw_gid);
return FALSE;
}
/* change to the user specified */
if (setuid (pw->pw_uid) < 0)
{
dbus_set_error (error, DBUS_ERROR_SPAWN_SETUP_FAILED,
"cannot setuid user %i", pw->pw_uid);
return FALSE;
}
#endif
return TRUE;
}
static dbus_bool_t
exec_for_correct_user (char *exec, char *user, DBusError *error)
{
char **argv;
int argc;
dbus_bool_t retval;
argc = 0;
retval = TRUE;
argv = NULL;
if (!switch_user (user, error))
return FALSE;
/* convert command into arguments */
if (!_dbus_shell_parse_argv (exec, &argc, &argv, error))
return FALSE;
#ifndef ACTIVATION_LAUNCHER_DO_OOM
/* replace with new binary, with no environment */
if (execv (argv[0], argv) < 0)
{
dbus_set_error (error, DBUS_ERROR_SPAWN_EXEC_FAILED,
"Failed to exec: %s", argv[0]);
retval = FALSE;
}
#endif
dbus_free_string_array (argv);
return retval;
}
static dbus_bool_t
check_bus_name (const char *bus_name,
DBusError *error)
{
DBusString str;
_dbus_string_init_const (&str, bus_name);
if (!_dbus_validate_bus_name (&str, 0, _dbus_string_get_length (&str)))
{
dbus_set_error (error, DBUS_ERROR_SPAWN_SERVICE_NOT_FOUND,
"bus name '%s' is not a valid bus name\n",
bus_name);
return FALSE;
}
return TRUE;
}
static dbus_bool_t
get_correct_parser (BusConfigParser **parser, DBusError *error)
{
DBusString config_file;
dbus_bool_t retval;
const char *test_config_file;
retval = FALSE;
test_config_file = NULL;
#ifdef ACTIVATION_LAUNCHER_TEST
/* there is no _way_ we should be setuid if this define is set.
* but we should be doubly paranoid and check... */
if (getuid() != geteuid())
_dbus_assert_not_reached ("dbus-daemon-launch-helper-test binary is setuid!");
/* this is not a security hole. The environment variable is only passed in the
* dbus-daemon-lauch-helper-test NON-SETUID launcher */
test_config_file = _dbus_getenv ("TEST_LAUNCH_HELPER_CONFIG");
if (test_config_file == NULL)
{
dbus_set_error (error, DBUS_ERROR_SPAWN_SETUP_FAILED,
"the TEST_LAUNCH_HELPER_CONFIG env variable is not set");
goto out;
}
#endif
/* we _only_ use the predefined system config file */
if (!_dbus_string_init (&config_file))
{
BUS_SET_OOM (error);
goto out;
}
#ifndef ACTIVATION_LAUNCHER_TEST
if (!_dbus_string_append (&config_file, DBUS_SYSTEM_CONFIG_FILE))
{
BUS_SET_OOM (error);
goto out_free_config;
}
#else
if (!_dbus_string_append (&config_file, test_config_file))
{
BUS_SET_OOM (error);
goto out_free_config;
}
#endif
/* where are we pointing.... */
_dbus_verbose ("dbus-daemon-activation-helper: using config file: %s\n",
_dbus_string_get_const_data (&config_file));
/* get the dbus user */
*parser = bus_config_load (&config_file, TRUE, NULL, error);
if (*parser == NULL)
{
goto out_free_config;
}
/* woot */
retval = TRUE;
out_free_config:
_dbus_string_free (&config_file);
out:
return retval;
}
static dbus_bool_t
launch_bus_name (const char *bus_name, BusConfigParser *parser, DBusError *error)
{
BusDesktopFile *desktop_file;
char *exec, *user;
dbus_bool_t retval;
exec = NULL;
user = NULL;
retval = FALSE;
/* get the correct service file for the name we are trying to activate */
desktop_file = desktop_file_for_name (parser, bus_name, error);
if (desktop_file == NULL)
return FALSE;
/* get exec and user for service name */
if (!get_parameters_for_service (desktop_file, bus_name, &exec, &user, error))
goto finish;
_dbus_verbose ("dbus-daemon-activation-helper: Name='%s'\n", bus_name);
_dbus_verbose ("dbus-daemon-activation-helper: Exec='%s'\n", exec);
_dbus_verbose ("dbus-daemon-activation-helper: User='%s'\n", user);
/* actually execute */
if (!exec_for_correct_user (exec, user, error))
goto finish;
retval = TRUE;
finish:
dbus_free (exec);
dbus_free (user);
bus_desktop_file_free (desktop_file);
return retval;
}
static dbus_bool_t
check_dbus_user (BusConfigParser *parser, DBusError *error)
{
const char *dbus_user;
dbus_user = bus_config_parser_get_user (parser);
if (dbus_user == NULL)
{
dbus_set_error (error, DBUS_ERROR_SPAWN_CONFIG_INVALID,
"could not get user from config file\n");
return FALSE;
}
/* check to see if permissions are correct */
if (!check_permissions (dbus_user, error))
return FALSE;
return TRUE;
}
dbus_bool_t
run_launch_helper (const char *bus_name,
DBusError *error)
{
BusConfigParser *parser;
dbus_bool_t retval;
parser = NULL;
retval = FALSE;
/* clear the environment, apart from a few select settings */
if (!clear_environment (error))
goto error;
/* check to see if we have a valid bus name */
if (!check_bus_name (bus_name, error))
goto error;
/* get the correct parser, either the test or default parser */
if (!get_correct_parser (&parser, error))
goto error;
/* check we are being invoked by the correct dbus user */
if (!check_dbus_user (parser, error))
goto error_free_parser;
/* launch the bus with the service defined user */
if (!launch_bus_name (bus_name, parser, error))
goto error_free_parser;
/* woohoo! */
retval = TRUE;
error_free_parser:
bus_config_parser_unref (parser);
error:
return retval;
}