emo/busybox
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

libbb: Enable support for !CONFIG_MULTIUSER

Browse Source 
Linux recently gained a new config option, CONFIG_MULTIUSER, that makes
support for non-root users optional. This results in a number of syscalls
being disabled: setuid, setregid, setgid, setreuid, setresuid, getresuid,
setresgid, getresgid, setgroups, getgroups, setfsuid, setfsgid, capget,
capset.

Currently a number of busybox applets, including login, struggle to run
when CONFIG_MULTIUSER is disabled. Even the root user is unable to login:
  login: can't set groups: Functi

This patch adds code to make change_identity() a nop on single user
systems. It works by recognising the signature errno value (ENOSYS, due
to the system calls being disabled) and, to avoid security risks, only
deploys when the current uid and target uid is the same.

After the patch is applied any attempt to switch to a non-root user will
fail. Thus a badly configured userspace (for example, one that tries to
start a daemon as a non-root user when the kernel cannot support this)
will report errors as one would expect.

Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
This commit is contained in:
Daniel Thompson 2015-05-12 07:56:04 +01:00 committed by Denys Vlasenko
parent 7ca5c51cc8
commit a818777d42
1 changed files with 21 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
libbb/change_identity.c
View File

@ -33,9 +33,28 @@
/* Become the user and group(s) specified by PW. */
void FAST_FUNC change_identity(const struct passwd *pw)
{
if (initgroups(pw->pw_name, pw->pw_gid) == -1)
bb_perror_msg_and_die("can't set groups");
int res;
res = initgroups(pw->pw_name, pw->pw_gid);
endgrent(); /* helps to close a fd used internally by libc */
if (res != 0) {
/*
* If initgroups() fails because a system call is unimplemented
* then we are running on a Linux kernel compiled without multiuser
* support (CONFIG_MULTIUSER is not defined).
*
* If we are running without multiuser support *and* the target uid
* already matches the current uid then we can skip the change of
* identity.
*/
if (errno == ENOSYS && pw->pw_uid == getuid()) {
return;
}
bb_perror_msg_and_die("can't set groups");
}
xsetgid(pw->pw_gid);
xsetuid(pw->pw_uid);
}