summaryrefslogtreecommitdiff
path: root/Src
diff options
context:
space:
mode:
Diffstat (limited to 'Src')
-rw-r--r--Src/openssh_bsd_setres_id.c129
-rw-r--r--Src/options.c141
-rw-r--r--Src/patchlevel.h.release1
-rw-r--r--Src/zsh.mdd3
-rw-r--r--Src/zsh_system.h94
5 files changed, 316 insertions, 52 deletions
diff --git a/Src/openssh_bsd_setres_id.c b/Src/openssh_bsd_setres_id.c
new file mode 100644
index 000000000..65e91a40c
--- /dev/null
+++ b/Src/openssh_bsd_setres_id.c
@@ -0,0 +1,129 @@
+/*
+ * Copyright (c) 2012 Darren Tucker (dtucker at zip com au).
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+/*
+ * openssh_bsd_setres_id.c - setresuid() and setresgid() wrappers
+ *
+ * This file is part of zsh, the Z shell.
+ *
+ * It is based on the file openbsd-compat/bsd-setres_id.c in OpenSSH 7.9p1,
+ * which is subject to the copyright notice above. The zsh modifications are
+ * licensed as follows:
+ *
+ * Copyright (c) 2019 Daniel Shahaf
+ * All rights reserved.
+ *
+ * Permission is hereby granted, without written agreement and without
+ * license or royalty fees, to use, copy, modify, and distribute this
+ * software and to distribute modified versions of this software for any
+ * purpose, provided that the above copyright notice and the following
+ * two paragraphs appear in all copies of this software.
+ *
+ * In no event shall Daniel Shahaf or the Zsh Development Group be liable
+ * to any party for direct, indirect, special, incidental, or consequential
+ * damages arising out of the use of this software and its documentation,
+ * even if Daniel Shahaf and the Zsh Development Group have been advised of
+ * the possibility of such damage.
+ *
+ * Daniel Shahaf and the Zsh Development Group specifically disclaim any
+ * warranties, including, but not limited to, the implied warranties of
+ * merchantability and fitness for a particular purpose. The software
+ * provided hereunder is on an "as is" basis, and Daniel Shahaf and the
+ * Zsh Development Group have no obligation to provide maintenance,
+ * support, updates, enhancements, or modifications.
+ *
+ */
+
+
+#include <sys/types.h>
+
+#include <stdarg.h>
+#include <unistd.h>
+#include <string.h>
+
+#include "zsh.mdh"
+
+#if defined(ZSH_IMPLEMENT_SETRESGID) || defined(BROKEN_SETRESGID)
+int
+setresgid(gid_t rgid, gid_t egid, gid_t sgid)
+{
+ int ret = 0, saved_errno;
+
+ if (rgid != sgid) {
+ errno = ENOSYS;
+ return -1;
+ }
+#if defined(ZSH_HAVE_NATIVE_SETREGID) && !defined(BROKEN_SETREGID)
+ if (setregid(rgid, egid) < 0) {
+ saved_errno = errno;
+ zwarnnam("setregid", "to gid %L: %e", (long)rgid, errno);
+ errno = saved_errno;
+ ret = -1;
+ }
+#else
+ if (setegid(egid) < 0) {
+ saved_errno = errno;
+ zwarnnam("setegid", "to gid %L: %e", (long)(unsigned int)egid, errno);
+ errno = saved_errno;
+ ret = -1;
+ }
+ if (setgid(rgid) < 0) {
+ saved_errno = errno;
+ zwarnnam("setgid", "to gid %L: %e", (long)rgid, errno);
+ errno = saved_errno;
+ ret = -1;
+ }
+#endif
+ return ret;
+}
+#endif
+
+#if defined(ZSH_IMPLEMENT_SETRESUID) || defined(BROKEN_SETRESUID)
+int
+setresuid(uid_t ruid, uid_t euid, uid_t suid)
+{
+ int ret = 0, saved_errno;
+
+ if (ruid != suid) {
+ errno = ENOSYS;
+ return -1;
+ }
+#if defined(ZSH_HAVE_NATIVE_SETREUID) && !defined(BROKEN_SETREUID)
+ if (setreuid(ruid, euid) < 0) {
+ saved_errno = errno;
+ zwarnnam("setreuid", "to uid %L: %e", (long)ruid, errno);
+ errno = saved_errno;
+ ret = -1;
+ }
+#else
+
+# ifndef SETEUID_BREAKS_SETUID
+ if (seteuid(euid) < 0) {
+ saved_errno = errno;
+ zwarnnam("seteuid", "to uid %L: %e", (long)euid, errno);
+ errno = saved_errno;
+ ret = -1;
+ }
+# endif
+ if (setuid(ruid) < 0) {
+ saved_errno = errno;
+ zwarnnam("setuid", "to uid %L: %e", (long)ruid, errno);
+ errno = saved_errno;
+ ret = -1;
+ }
+#endif
+ return ret;
+}
+#endif
diff --git a/Src/options.c b/Src/options.c
index 48c14c179..08ba71917 100644
--- a/Src/options.c
+++ b/Src/options.c
@@ -577,6 +577,7 @@ int
bin_setopt(char *nam, char **args, UNUSED(Options ops), int isun)
{
int action, optno, match = 0;
+ int retval = 0;
/* With no arguments or options, display options. */
if (!*args) {
@@ -604,18 +605,24 @@ bin_setopt(char *nam, char **args, UNUSED(Options ops), int isun)
inittyptab();
return 1;
}
- if(!(optno = optlookup(*args)))
+ if(!(optno = optlookup(*args))) {
zwarnnam(nam, "no such option: %s", *args);
- else if(dosetopt(optno, action, 0, opts))
+ retval |= 1;
+ } else if (dosetopt(optno, action, 0, opts)) {
zwarnnam(nam, "can't change option: %s", *args);
+ retval |= 1;
+ }
break;
} else if(**args == 'm') {
match = 1;
} else {
- if (!(optno = optlookupc(**args)))
+ if (!(optno = optlookupc(**args))) {
zwarnnam(nam, "bad option: -%c", **args);
- else if(dosetopt(optno, action, 0, opts))
+ retval |= 1;
+ } else if (dosetopt(optno, action, 0, opts)) {
zwarnnam(nam, "can't change option: -%c", **args);
+ retval |= 1;
+ }
}
}
args++;
@@ -625,10 +632,13 @@ bin_setopt(char *nam, char **args, UNUSED(Options ops), int isun)
if (!match) {
/* Not globbing the arguments -- arguments are simply option names. */
while (*args) {
- if(!(optno = optlookup(*args++)))
+ if(!(optno = optlookup(*args++))) {
zwarnnam(nam, "no such option: %s", args[-1]);
- else if(dosetopt(optno, !isun, 0, opts))
+ retval |= 1;
+ } else if (dosetopt(optno, !isun, 0, opts)) {
zwarnnam(nam, "can't change option: %s", args[-1]);
+ retval |= 1;
+ }
}
} else {
/* Globbing option (-m) set. */
@@ -651,7 +661,8 @@ bin_setopt(char *nam, char **args, UNUSED(Options ops), int isun)
tokenize(s);
if (!(pprog = patcompile(s, PAT_HEAPDUP, NULL))) {
zwarnnam(nam, "bad pattern: %s", *args);
- continue;
+ retval |= 1;
+ break;
}
/* Loop over expansions. */
scanmatchtable(optiontab, pprog, 0, 0, OPT_ALIAS,
@@ -660,7 +671,7 @@ bin_setopt(char *nam, char **args, UNUSED(Options ops), int isun)
}
}
inittyptab();
- return 0;
+ return retval;
}
/* Identify an option name */
@@ -769,37 +780,99 @@ dosetopt(int optno, int value, int force, char *new_opts)
return -1;
} else if(optno == PRIVILEGED && !value) {
/* unsetting PRIVILEGED causes the shell to make itself unprivileged */
-#ifdef HAVE_SETUID
- int ignore_err;
- errno = 0;
+
+/* For simplicity's sake, require both setresgid() and setresuid() up-front. */
+#if !defined(HAVE_SETRESGID)
+ zwarnnam("unsetopt",
+ "PRIVILEGED: can't drop privileges; setresgid() and friends not available");
+ return -1;
+#elif !defined(HAVE_SETRESUID)
+ zwarnnam("unsetopt",
+ "PRIVILEGED: can't drop privileges; setresuid() and friends not available");
+ return -1;
+#else
+ /* If set, return -1 so lastval will be non-zero. */
+ int failed = 0;
+ const int orig_euid = geteuid();
+ const int orig_egid = getegid();
+
/*
* Set the GID first as if we set the UID to non-privileged it
* might be impossible to restore the GID.
- *
- * Some OSes (possibly no longer around) have been known to
- * fail silently the first time, so we attempt the change twice.
- * If it fails we are guaranteed to pick this up the second
- * time, so ignore the first time.
- *
- * Some versions of gcc make it hard to ignore the results the
- * first time, hence the following. (These are probably not
- * systems that require the doubled calls.)
*/
- ignore_err = setgid(getgid());
- (void)ignore_err;
- ignore_err = setuid(getuid());
- (void)ignore_err;
- if (setgid(getgid())) {
- zwarn("failed to change group ID: %e", errno);
- return -1;
- } else if (setuid(getuid())) {
- zwarn("failed to change user ID: %e", errno);
- return -1;
+ if (setresgid(getgid(), getgid(), getgid())) {
+ zwarnnam("unsetopt",
+ "PRIVILEGED: can't drop privileges; failed to change group ID: %e",
+ errno);
+ return -1;
}
-#else
- zwarn("setuid not available");
- return -1;
-#endif /* not HAVE_SETUID */
+
+# ifdef HAVE_INITGROUPS
+ /* Set the supplementary groups list.
+ *
+ * Note that on macOS, FreeBSD, and possibly some other platforms,
+ * initgroups() resets the EGID to its second argument (see setgroups(2) for
+ * details). This has the potential to leave the EGID in an unexpected
+ * state. However, it seems common in other projects that do this dance to
+ * simply re-use the same GID that's going to become the EGID anyway, in
+ * which case it doesn't matter. That's what we do here. It's therefore
+ * possible, in some probably uncommon cases, that the shell ends up not
+ * having the privileges of the RUID user's primary/passwd group. */
+ if (geteuid() == 0) {
+ struct passwd *pw = getpwuid(getuid());
+ if (pw == NULL) {
+ zwarnnam("unsetopt",
+ "can't drop privileges; failed to get user information for uid %L: %e",
+ (long)getuid(), errno);
+ failed = 1;
+ /* This may behave strangely in the unlikely event that the same user
+ * name appears with multiple UIDs in the passwd database */
+ } else if (initgroups(pw->pw_name, getgid())) {
+ zwarnnam("unsetopt",
+ "can't drop privileges; failed to set supplementary group list: %e",
+ errno);
+ return -1;
+ }
+ } else if (getuid() != 0 &&
+ (geteuid() != getuid() || orig_egid != getegid())) {
+ zwarnnam("unsetopt",
+ "PRIVILEGED: supplementary group list not changed due to lack of permissions: EUID=%L",
+ (long)geteuid());
+ failed = 1;
+ }
+# else
+ /* initgroups() isn't in POSIX. If it's not available on the system,
+ * we silently skip it. */
+# endif
+
+ /* Set the UID second. */
+ if (setresuid(getuid(), getuid(), getuid())) {
+ zwarnnam("unsetopt",
+ "PRIVILEGED: can't drop privileges; failed to change user ID: %e",
+ errno);
+ return -1;
+ }
+
+ if (getuid() != 0 && orig_egid != getegid() &&
+ (setgid(orig_egid) != -1 || setegid(orig_egid) != -1)) {
+ zwarnnam("unsetopt",
+ "PRIVILEGED: can't drop privileges; was able to restore the egid");
+ return -1;
+ }
+
+ if (getuid() != 0 && orig_euid != geteuid() &&
+ (setuid(orig_euid) != -1 || seteuid(orig_euid) != -1)) {
+ zwarnnam("unsetopt",
+ "PRIVILEGED: can't drop privileges; was able to restore the euid");
+ return -1;
+ }
+
+ if (failed) {
+ /* A warning message has been printed. */
+ return -1;
+ }
+#endif /* HAVE_SETRESGID && HAVE_SETRESUID */
+
#ifdef JOB_CONTROL
} else if (!force && optno == MONITOR && value) {
if (new_opts[optno] == value)
diff --git a/Src/patchlevel.h.release b/Src/patchlevel.h.release
new file mode 100644
index 000000000..229e2e564
--- /dev/null
+++ b/Src/patchlevel.h.release
@@ -0,0 +1 @@
+#define ZSH_PATCHLEVEL "zsh-5.8-0-g77d203f"
diff --git a/Src/zsh.mdd b/Src/zsh.mdd
index 3e5788af5..9bcaccae5 100644
--- a/Src/zsh.mdd
+++ b/Src/zsh.mdd
@@ -13,7 +13,8 @@ objects="builtin.o compat.o cond.o context.o \
exec.o glob.o hashtable.o hashnameddir.o \
hist.o init.o input.o jobs.o lex.o linklist.o loop.o math.o \
mem.o module.o options.o params.o parse.o pattern.o prompt.o signals.o \
-signames.o sort.o string.o subst.o text.o utils.o watch.o"
+signames.o sort.o string.o subst.o text.o utils.o watch.o \
+openssh_bsd_setres_id.o"
headers="../config.h zsh_system.h zsh.h sigcount.h signals.h \
prototypes.h hashtable.h ztype.h"
diff --git a/Src/zsh_system.h b/Src/zsh_system.h
index 85e198f2e..161b073b4 100644
--- a/Src/zsh_system.h
+++ b/Src/zsh_system.h
@@ -468,30 +468,90 @@ struct timespec {
# define setpgrp setpgid
#endif
-/* can we set the user/group id of a process */
+/* compatibility wrappers */
-#ifndef HAVE_SETUID
+/* Our strategy is as follows:
+ *
+ * - Ensure that either setre[ug]id() or set{e,}[ug]id() is available.
+ * - If setres[ug]id() are missing, provide them in terms of either
+ * setre[ug]id() or set{e,}[ug]id(), whichever is available.
+ * - Provide replacement setre[ug]id() or set{e,}[ug]id() if they are not
+ * available natively.
+ *
+ * There isn't a circular dependency because, right off the bat, we check that
+ * there's an end condition, and #error out otherwise.
+ */
+#if !defined(HAVE_SETREUID) && !(defined(HAVE_SETEUID) && defined(HAVE_SETUID))
+ /*
+ * If you run into this error, you have two options:
+ * - Teach zsh how to do the equivalent of setreuid() on your system
+ * - Remove support for PRIVILEGED option, and then remove the #error.
+ */
+# error "Don't know how to change UID"
+#endif
+#if !defined(HAVE_SETREGID) && !(defined(HAVE_SETEGID) && defined(HAVE_SETGID))
+ /* See above comment. */
+# error "Don't know how to change GID"
+#endif
+
+/* Provide setresuid(). */
+#ifndef HAVE_SETRESUID
+int setresuid(uid_t, uid_t, uid_t);
+# define HAVE_SETRESUID
+# define ZSH_IMPLEMENT_SETRESUID
# ifdef HAVE_SETREUID
-# define setuid(X) setreuid(X,X)
-# define setgid(X) setregid(X,X)
-# define HAVE_SETUID
+# define ZSH_HAVE_NATIVE_SETREUID
# endif
#endif
-/* can we set the effective user/group id of a process */
+/* Provide setresgid(). */
+#ifndef HAVE_SETRESGID
+int setresgid(gid_t, gid_t, gid_t);
+# define HAVE_SETRESGID
+# define ZSH_IMPLEMENT_SETRESGID
+# ifdef HAVE_SETREGID
+# define ZSH_HAVE_NATIVE_SETREGID
+# endif
+#endif
+/* Provide setreuid(). */
+#ifndef HAVE_SETREUID
+# define setreuid(X, Y) setresuid((X), (Y), -1)
+# define HAVE_SETREUID
+#endif
+
+/* Provide setregid(). */
+#ifndef HAVE_SETREGID
+# define setregid(X, Y) setresgid((X), (Y), -1)
+# define HAVE_SETREGID
+#endif
+
+/* Provide setuid(). */
+/* ### TODO: Either remove this (this function has been standard since 1985),
+ * ### or rewrite this without multiply-evaluating the argument */
+#ifndef HAVE_SETUID
+# define setuid(X) setreuid((X), (X))
+# define HAVE_SETUID
+#endif
+
+/* Provide setgid(). */
+#ifndef HAVE_SETGID
+/* ### TODO: Either remove this (this function has been standard since 1985),
+ * ### or rewrite this without multiply-evaluating the argument */
+# define setgid(X) setregid((X), (X))
+# define HAVE_SETGID
+#endif
+
+/* Provide seteuid(). */
#ifndef HAVE_SETEUID
-# ifdef HAVE_SETREUID
-# define seteuid(X) setreuid(-1,X)
-# define setegid(X) setregid(-1,X)
-# define HAVE_SETEUID
-# else
-# ifdef HAVE_SETRESUID
-# define seteuid(X) setresuid(-1,X,-1)
-# define setegid(X) setresgid(-1,X,-1)
-# define HAVE_SETEUID
-# endif
-# endif
+# define seteuid(X) setreuid(-1, (X))
+# define HAVE_SETEUID
+#endif
+
+/* Provide setegid(). */
+#ifndef HAVE_SETEGID
+# define setegid(X) setregid(-1, (X))
+# define HAVE_SETEGID
#endif
#ifdef HAVE_SYS_RESOURCE_H
generated by cgit v1.2.3 (git 2.39.1) at 2025-06-08 09:43:01 +0000