Restrict read permissions of doas binary.

[opendoas.git] / doas.c

diff --git a/doas.c b/doas.c
index be48957753e0b86992341573886cdb5c58b442b9..9862520852a4bd1be6bf285e958820368aef7d6f 100644 (file)
--- a/doas.c
+++ b/doas.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: doas.c,v 1.23 2015/07/26 19:08:17 zhuk Exp $ */
+/* $OpenBSD: doas.c,v 1.32 2015/07/29 00:00:31 tedu Exp $ */
 /*
  * Copyright (c) 2015 Ted Unangst <tedu@openbsd.org>
  *
@@ -19,8 +19,6 @@
 #include <sys/stat.h>
 
 #include <limits.h>
-#include <login_cap.h>
-#include <bsd_auth.h>
 #include <string.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -31,12 +29,14 @@
 #include <syslog.h>
 #include <errno.h>
 
+#include "openbsd.h"
+
 #include "doas.h"
 
 static void __dead
 usage(void)
 {
-       fprintf(stderr, "usage: doas [-s] [-C config] [-u user] command [args]\n");
+       fprintf(stderr, "usage: doas [-ns] [-C config] [-u user] command [args]\n");
        exit(1);
 }
 
@@ -80,19 +80,20 @@ uidcheck(const char *s, uid_t desired)
        return 0;
 }
 
-static gid_t
-strtogid(const char *s)
+static int
+parsegid(const char *s, gid_t *gid)
 {
        struct group *gr;
        const char *errstr;
-       gid_t gid;
 
-       if ((gr = getgrnam(s)) != NULL)
-               return gr->gr_gid;
-       gid = strtonum(s, 0, GID_MAX, &errstr);
+       if ((gr = getgrnam(s)) != NULL) {
+               *gid = gr->gr_gid;
+               return 0;
+       }
+       *gid = strtonum(s, 0, GID_MAX, &errstr);
        if (errstr)
                return -1;
-       return gid;
+       return 0;
 }
 
 static int
@@ -102,8 +103,8 @@ match(uid_t uid, gid_t *groups, int ngroups, uid_t target, const char *cmd,
        int i;
 
        if (r->ident[0] == ':') {
-               gid_t rgid = strtogid(r->ident + 1);
-               if (rgid == -1)
+               gid_t rgid;
+               if (parsegid(r->ident + 1, &rgid) == -1)
                        return 0;
                for (i = 0; i < ngroups; i++) {
                        if (rgid == groups[i])
@@ -143,7 +144,8 @@ permit(uid_t uid, gid_t *groups, int ngroups, struct rule **lastr,
 
        *lastr = NULL;
        for (i = 0; i < nrules; i++) {
-               if (match(uid, groups, ngroups, target, cmd, cmdargs, rules[i]))
+               if (match(uid, groups, ngroups, target, cmd,
+                   cmdargs, rules[i]))
                        *lastr = rules[i];
        }
        if (!*lastr)
@@ -182,11 +184,14 @@ parseconfig(const char *filename, int checkperms)
                exit(1);
 }
 
+/*
+ * Copy the environment variables in safeset from oldenvp to envp.
+ */
 static int
-copyenvhelper(const char **oldenvp, const char **safeset, int nsafe,
+copyenvhelper(const char **oldenvp, const char **safeset, size_t nsafe,
     char **envp, int ei)
 {
-       int i;
+       size_t i;
 
        for (i = 0; i < nsafe; i++) {
                const char **oe = oldenvp;
@@ -219,45 +224,48 @@ copyenv(const char **oldenvp, struct rule *rule)
        char **envp;
        const char **extra;
        int ei;
-       int nsafe, nbad;
-       int nextras = 0;
+       size_t nsafe, nbad;
+       size_t nextras = 0;
 
+       /* if there was no envvar whitelist, pass all except badset ones */
        nbad = arraylen(badset);
        if ((rule->options & KEEPENV) && !rule->envlist) {
-               size_t i, ii;
+               size_t iold, inew;
                size_t oldlen = arraylen(oldenvp);
                envp = reallocarray(NULL, oldlen + 1, sizeof(char *));
                if (!envp)
                        err(1, "reallocarray");
-               for (ii = i = 0; i < oldlen; i++) {
-                       size_t j;
-                       for (j = 0; j < nbad; j++) {
-                               size_t len = strlen(badset[j]);
-                               if (strncmp(oldenvp[i], badset[j], len) == 0 &&
-                                   oldenvp[i][len] == '=') {
+               for (inew = iold = 0; iold < oldlen; iold++) {
+                       size_t ibad;
+                       for (ibad = 0; ibad < nbad; ibad++) {
+                               size_t len = strlen(badset[ibad]);
+                               if (strncmp(oldenvp[iold], badset[ibad], len) == 0 &&
+                                   oldenvp[iold][len] == '=') {
                                        break;
                                }
                        }
-                       if (j == nbad) {
-                               if (!(envp[ii] = strdup(oldenvp[i])))
+                       if (ibad == nbad) {
+                               if (!(envp[inew] = strdup(oldenvp[iold])))
                                        err(1, "strdup");
-                               ii++;
+                               inew++;
                        }
                }
-               envp[ii] = NULL;
+               envp[inew] = NULL;
                return envp;
        }
 
        nsafe = arraylen(safeset);
        if ((extra = rule->envlist)) {
-               size_t i;
+               size_t isafe;
                nextras = arraylen(extra);
-               for (i = 0; i < nsafe; i++) {
-                       size_t j;
-                       for (j = 0; j < nextras; j++) {
-                               if (strcmp(extra[j], safeset[i]) == 0) {
-                                       extra[j--] = extra[nextras--];
+               for (isafe = 0; isafe < nsafe; isafe++) {
+                       size_t iextras;
+                       for (iextras = 0; iextras < nextras; iextras++) {
+                               if (strcmp(extra[iextras], safeset[isafe]) == 0) {
+                                       nextras--;
+                                       extra[iextras] = extra[nextras];
                                        extra[nextras] = NULL;
+                                       iextras--;
                                }
                        }
                }
@@ -282,7 +290,7 @@ fail(void)
        exit(1);
 }
 
-static int
+static void __dead
 checkconfig(const char *confpath, int argc, char **argv,
     uid_t uid, gid_t *groups, int ngroups, uid_t target)
 {
@@ -322,8 +330,10 @@ main(int argc, char **argv, char **envp)
        int ngroups;
        int i, ch;
        int sflag = 0;
+       int nflag = 0;
 
-       while ((ch = getopt(argc, argv, "C:su:")) != -1) {
+       uid = getuid();
+       while ((ch = getopt(argc, argv, "C:nsu:")) != -1) {
                switch (ch) {
                case 'C':
                        confpath = optarg;
@@ -332,6 +342,9 @@ main(int argc, char **argv, char **envp)
                        if (parseuid(optarg, &target) != 0)
                                errx(1, "unknown user");
                        break;
+               case 'n':
+                       nflag = 1;
+                       break;
                case 's':
                        sflag = 1;
                        break;
@@ -379,9 +392,7 @@ main(int argc, char **argv, char **envp)
        parseconfig("/etc/doas.conf", 1);
 
        /* cmdline is used only for logging, no need to abort on truncate */
-       (void) strlcpy(cmdline, argv[0], sizeof(cmdline)) < sizeof(cmdline);
-       if (strlcpy(cmdline, argv[0], sizeof(cmdline)) >= sizeof(cmdline))
-               errx(1, "command line too long");
+       (void) strlcpy(cmdline, argv[0], sizeof(cmdline));
        for (i = 1; i < argc; i++) {
                if (strlcat(cmdline, " ", sizeof(cmdline)) >= sizeof(cmdline))
                        break;
@@ -398,6 +409,8 @@ main(int argc, char **argv, char **envp)
        }
 
        if (!(rule->options & NOPASS)) {
+               if (nflag)
+                       errx(1, "Authorization required");
                if (!auth_userokay(myname, NULL, NULL, NULL)) {
                        syslog(LOG_AUTHPRIV | LOG_NOTICE,
                            "failed password for %s", myname);