[apple/system_cmds.git] / newgrp.tproj / newgrp.c

/*-
 * Copyright (c) 2002 Tim J. Robbins.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

/*
 * newgrp -- change to a new group
 */

#include <sys/cdefs.h>
__FBSDID("$FreeBSD: src/usr.bin/newgrp/newgrp.c,v 1.5 2009/12/13 03:14:06 delphij Exp $");

#include <sys/types.h>

#include <err.h>
#include <errno.h>
#include <grp.h>
#include <libgen.h>
#include <limits.h>
#ifndef __APPLE__
#include <login_cap.h>
#endif /* !__APPLE__ */
#ifdef __APPLE__
#include <membership.h>
#endif /* __APPLE__ */
#include <pwd.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#ifdef __APPLE__
#include <paths.h>
#endif /* __APPLE__ */
static void	 addgroup(const char *grpname);
static void	 doshell(void);
static int	 inarray(gid_t, const gid_t[], int);
static void	 loginshell(void);
static void	 restoregrps(void);
static void	 usage(void);

static struct passwd *pwd;
static uid_t euid;

extern char **environ;

/* Manipulate effective user ID. */
#define PRIV_START do {				\
		if (seteuid(euid) < 0)		\
			err(1, "seteuid");	\
	} while (0)
#define PRIV_END do {				\
		if (seteuid(getuid()) < 0)	\
			err(1, "seteuid");	\
	} while (0)

int
main(int argc, char *argv[])
{
	int ch, login;

	euid = geteuid();
	if (seteuid(getuid()) < 0)
		err(1, "seteuid");

	if ((pwd = getpwuid(getuid())) == NULL)
		errx(1, "unknown user");

	login = 0;
	while ((ch = getopt(argc, argv, "-l")) != -1) {
		switch (ch) {
		case '-':		/* Obsolescent */
		case 'l':
			login = 1;
			break;
		default:
			usage();
		}
	}
	argc -= optind;
	argv += optind;

	switch (argc) {
	case 0:
		restoregrps();
		break;
	case 1:
		addgroup(*argv);
		break;
	default:
		usage();
	}

	if (seteuid(euid) < 0)
		err(1, "seteuid");
	if (setuid(getuid()) < 0)
		err(1, "setuid");

	if (login)
		loginshell();
	else
		doshell();

	/*NOTREACHED*/
	exit(1);
}

static void
usage(void)
{

	fprintf(stderr, "usage: newgrp [-l] [group]\n");
	exit(1);
}

static void
restoregrps(void)
{
	int initres, setres;

	PRIV_START;
	initres = initgroups(pwd->pw_name, pwd->pw_gid);
	setres = setgid(pwd->pw_gid);
	PRIV_END;

	if (initres < 0)
		warn("initgroups");
	if (setres < 0)
		warn("setgid");
}

static void
addgroup(const char *grpname)
{
	gid_t *grps;
	long lgid, ngrps_max;
	int dbmember, i, ngrps;
	gid_t egid;
	struct group *grp;
	char *ep, *pass;
#ifndef __APPLE__
	char **p;
#endif
	char *grp_passwd;
#ifdef __APPLE__
	uuid_t user_uuid;
	uuid_t group_uuid;
	int status;
#endif

	egid = getegid();

	/* Try it as a group name, then a group id. */
	if ((grp = getgrnam(grpname)) == NULL)
		if ((lgid = strtol(grpname, &ep, 10)) <= 0 || *ep != '\0' ||
		    (grp = getgrgid((gid_t)lgid)) == NULL ) {
			warnx("%s: bad group name", grpname);
			return;
		}

#ifdef __APPLE__
	status = mbr_uid_to_uuid(pwd->pw_uid, user_uuid);
	if (status)
		errc(1, status, "mbr_uid_to_uuid");

	status = mbr_gid_to_uuid(grp->gr_gid, group_uuid);
	if (status)
		errc(1, status, "mbr_gid_to_uuid");

	status = mbr_check_membership(user_uuid, group_uuid, &dbmember);
	if (status)
		errc(1, status, "mbr_check_membership");
#else
	/*
	 * If the user is not a member of the requested group and the group
	 * has a password, prompt and check it.
	 */
	dbmember = 0;
	if (pwd->pw_gid == grp->gr_gid)
		dbmember = 1;
	for (p = grp->gr_mem; *p != NULL; p++)
		if (strcmp(*p, pwd->pw_name) == 0) {
			dbmember = 1;
			break;
		}
#endif

	grp_passwd = grp->gr_passwd;
	if ((grp_passwd == NULL) || (grp_passwd[0] == '\0'))
		grp_passwd = "*";
	if (!dbmember && getuid() != 0) {
		pass = getpass("Password:");
		if (pass == NULL ||
		    strcmp(grp_passwd, crypt(pass, grp_passwd)) != 0) {
			fprintf(stderr, "Sorry\n");
			return;
		}
	}

	ngrps_max = sysconf(_SC_NGROUPS_MAX) + 1;
	if ((grps = malloc(sizeof(gid_t) * ngrps_max)) == NULL)
		err(1, "malloc");
	if ((ngrps = getgroups((int)ngrps_max, (gid_t *)grps)) < 0) {
		warn("getgroups");
		goto end;
	}

	/* Remove requested gid from supp. list if it exists. */
	if (grp->gr_gid != egid && inarray(grp->gr_gid, grps, ngrps)) {
		for (i = 0; i < ngrps; i++)
			if (grps[i] == grp->gr_gid)
				break;
		ngrps--;
		memmove(&grps[i], &grps[i + 1], (ngrps - i) * sizeof(gid_t));
		PRIV_START;
		if (setgroups(ngrps, (const gid_t *)grps) < 0) {
			PRIV_END;
			warn("setgroups");
			goto end;
		}
		PRIV_END;
	}

	PRIV_START;
	if (setgid(grp->gr_gid)) {
		PRIV_END;
		warn("setgid");
		goto end;
	}
	PRIV_END;
	grps[0] = grp->gr_gid;

	/* Add old effective gid to supp. list if it does not exist. */
	if (egid != grp->gr_gid && !inarray(egid, grps, ngrps)) {
		if (ngrps + 1 >= ngrps_max)
			warnx("too many groups");
		else {
			grps[ngrps++] = egid;
			PRIV_START;
			if (setgroups(ngrps, (const gid_t *)grps)) {
				PRIV_END;
				warn("setgroups");
				goto end;
			}
			PRIV_END;
		}
	}

end:
	free(grps);
}

static int
inarray(gid_t gid, const gid_t grps[], int ngrps)
{
	int i;

	for (i = 0; i < ngrps; i++)
		if (grps[i] == gid)
			return (1);
	return (0);
}

/*
 * Set the environment to what would be expected if the user logged in
 * again; this performs the same steps as su(1)'s -l option.
 */
static void
loginshell(void)
{
	char *args[2], **cleanenv, *term, *ticket;
	const char *shell;
	char *prog, progbuf[PATH_MAX];
#ifndef __APPLE__
	login_cap_t *lc;
#endif /* !__APPLE__ */
	shell = pwd->pw_shell;
	if (*shell == '\0')
		shell = _PATH_BSHELL;
	if (chdir(pwd->pw_dir) < 0) {
		warn("%s", pwd->pw_dir);
		chdir("/");
	}

	term = getenv("TERM");
	ticket = getenv("KRBTKFILE");

	if ((cleanenv = calloc(20, sizeof(char *))) == NULL)
		err(1, "calloc");
	*cleanenv = NULL;
	environ = cleanenv;
#ifndef __APPLE__
	lc = login_getpwclass(pwd);
	setusercontext(lc, pwd, pwd->pw_uid,
	    LOGIN_SETPATH|LOGIN_SETUMASK|LOGIN_SETENV);
	login_close(lc);
#endif /* !__APPLE__ */
	setenv("USER", pwd->pw_name, 1);
	setenv("SHELL", shell, 1);
	setenv("HOME", pwd->pw_dir, 1);
	if (term != NULL)
		setenv("TERM", term, 1);
	if (ticket != NULL)
		setenv("KRBTKFILE", ticket, 1);

	strlcpy(progbuf, shell, sizeof(progbuf));
	prog = basename(progbuf);

	if (asprintf(args, "-%s", prog) < 0)
		err(1, "asprintf");
	args[1] = NULL;

	execv(shell, args);
	err(1, "%s", shell);
}

static void
doshell(void)
{
	const char *shell;
	char *prog, progbuf[PATH_MAX];

	shell = pwd->pw_shell;
	if (*shell == '\0')
		shell = _PATH_BSHELL;

	strlcpy(progbuf, shell, sizeof(progbuf));
	prog = basename(progbuf);

	execl(shell, prog, (char *)NULL);
	err(1, "%s", shell);
}
Commit	Line	Data
34d340d7 A	1	/*-
	2	* Copyright (c) 2002 Tim J. Robbins.
	3	* All rights reserved.
	4	*
	5	* Redistribution and use in source and binary forms, with or without
	6	* modification, are permitted provided that the following conditions
	7	* are met:
	8	* 1. Redistributions of source code must retain the above copyright
	9	* notice, this list of conditions and the following disclaimer.
	10	* 2. Redistributions in binary form must reproduce the above copyright
	11	* notice, this list of conditions and the following disclaimer in the
	12	* documentation and/or other materials provided with the distribution.
	13	*
	14	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
	15	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	16	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	17	* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
	18	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	19	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	20	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	21	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	22	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	23	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	24	* SUCH DAMAGE.
	25	*/
	26
	27	/*
	28	* newgrp -- change to a new group
	29	*/
	30
	31	#include <sys/cdefs.h>
aaff5f01	32	__FBSDID("$FreeBSD: src/usr.bin/newgrp/newgrp.c,v 1.5 2009/12/13 03:14:06 delphij Exp $");
34d340d7 A	33
	34	#include <sys/types.h>
	35
	36	#include <err.h>
	37	#include <errno.h>
	38	#include <grp.h>
	39	#include <libgen.h>
	40	#include <limits.h>
	41	#ifndef __APPLE__
	42	#include <login_cap.h>
	43	#endif /* !__APPLE__ */
fc6d9e4b A	44	#ifdef __APPLE__
	45	#include <membership.h>
	46	#endif /* __APPLE__ */
34d340d7 A	47	#include <pwd.h>
	48	#include <stdio.h>
	49	#include <stdlib.h>
	50	#include <string.h>
	51	#include <unistd.h>
	52	#ifdef __APPLE__
	53	#include <paths.h>
	54	#endif /* __APPLE__ */
	55	static void addgroup(const char *grpname);
	56	static void doshell(void);
	57	static int inarray(gid_t, const gid_t[], int);
	58	static void loginshell(void);
	59	static void restoregrps(void);
	60	static void usage(void);
	61
	62	static struct passwd *pwd;
	63	static uid_t euid;
	64
	65	extern char **environ;
	66
	67	/* Manipulate effective user ID. */
	68	#define PRIV_START do { \
	69	if (seteuid(euid) < 0) \
	70	err(1, "seteuid"); \
	71	} while (0)
	72	#define PRIV_END do { \
	73	if (seteuid(getuid()) < 0) \
	74	err(1, "seteuid"); \
	75	} while (0)
	76
	77	int
	78	main(int argc, char *argv[])
	79	{
	80	int ch, login;
	81
	82	euid = geteuid();
	83	if (seteuid(getuid()) < 0)
	84	err(1, "seteuid");
	85
	86	if ((pwd = getpwuid(getuid())) == NULL)
	87	errx(1, "unknown user");
	88
	89	login = 0;
	90	while ((ch = getopt(argc, argv, "-l")) != -1) {
	91	switch (ch) {
	92	case '-': /* Obsolescent */
	93	case 'l':
	94	login = 1;
	95	break;
	96	default:
	97	usage();
	98	}
	99	}
	100	argc -= optind;
	101	argv += optind;
	102
	103	switch (argc) {
	104	case 0:
	105	restoregrps();
	106	break;
	107	case 1:
	108	addgroup(*argv);
	109	break;
	110	default:
111	usage();
112	}
113
114	if (seteuid(euid) < 0)
115	err(1, "seteuid");
116	if (setuid(getuid()) < 0)
117	err(1, "setuid");
118
119	if (login)
120	loginshell();
121	else
122	doshell();
123
124	/NOTREACHED/
125	exit(1);
126	}
127
128	static void
129	usage(void)
130	{
131
132	fprintf(stderr, "usage: newgrp [-l] [group]\n");
133	exit(1);
134	}
135
136	static void
137	restoregrps(void)
138	{
139	int initres, setres;
140
141	PRIV_START;
142	initres = initgroups(pwd->pw_name, pwd->pw_gid);
143	setres = setgid(pwd->pw_gid);
144	PRIV_END;
145
146	if (initres < 0)
147	warn("initgroups");
148	if (setres < 0)
aaff5f01	149	warn("setgid");
34d340d7 A	150	}
	151
	152	static void
	153	addgroup(const char *grpname)
	154	{
aaff5f01 A	155	gid_t *grps;
aaff5f01 A	156	long lgid, ngrps_max;
34d340d7 A	157	int dbmember, i, ngrps;
	158	gid_t egid;
	159	struct group *grp;
	160	char ep, pass;
cf37c299	161	#ifndef __APPLE__
34d340d7	162	char **p;
cf37c299	163	#endif
a8daac8f	164	char *grp_passwd;
aaff5f01 A	165	#ifdef __APPLE__
	166	uuid_t user_uuid;
	167	uuid_t group_uuid;
	168	int status;
	169	#endif
34d340d7 A	170
	171	egid = getegid();
	172
	173	/* Try it as a group name, then a group id. */
	174	if ((grp = getgrnam(grpname)) == NULL)
	175	if ((lgid = strtol(grpname, &ep, 10)) <= 0 \|\| *ep != '\0' \|\|
	176	(grp = getgrgid((gid_t)lgid)) == NULL ) {
	177	warnx("%s: bad group name", grpname);
	178	return;
	179	}
	180
aaff5f01 A	181	#ifdef __APPLE__
	182	status = mbr_uid_to_uuid(pwd->pw_uid, user_uuid);
	183	if (status)
	184	errc(1, status, "mbr_uid_to_uuid");
	185
	186	status = mbr_gid_to_uuid(grp->gr_gid, group_uuid);
	187	if (status)
	188	errc(1, status, "mbr_gid_to_uuid");
	189
	190	status = mbr_check_membership(user_uuid, group_uuid, &dbmember);
	191	if (status)
	192	errc(1, status, "mbr_check_membership");
	193	#else
34d340d7 A	194	/*
	195	* If the user is not a member of the requested group and the group
	196	* has a password, prompt and check it.
	197	*/
	198	dbmember = 0;
	199	if (pwd->pw_gid == grp->gr_gid)
	200	dbmember = 1;
	201	for (p = grp->gr_mem; *p != NULL; p++)
	202	if (strcmp(*p, pwd->pw_name) == 0) {
	203	dbmember = 1;
	204	break;
	205	}
aaff5f01 A	206	#endif
aaff5f01 A	207
a8daac8f A	208	grp_passwd = grp->gr_passwd;
	209	if ((grp_passwd == NULL) \|\| (grp_passwd[0] == '\0'))
	210	grp_passwd = "*";
	211	if (!dbmember && getuid() != 0) {
34d340d7 A	212	pass = getpass("Password:");
34d340d7 A	213	if (pass == NULL \|\|
a8daac8f	214	strcmp(grp_passwd, crypt(pass, grp_passwd)) != 0) {
34d340d7 A	215	fprintf(stderr, "Sorry\n");
	216	return;
	217	}
	218	}
	219
aaff5f01 A	220	ngrps_max = sysconf(_SC_NGROUPS_MAX) + 1;
	221	if ((grps = malloc(sizeof(gid_t) * ngrps_max)) == NULL)
	222	err(1, "malloc");
cf37c299	223	if ((ngrps = getgroups((int)ngrps_max, (gid_t *)grps)) < 0) {
34d340d7	224	warn("getgroups");
aaff5f01	225	goto end;
34d340d7 A	226	}
	227
	228	/* Remove requested gid from supp. list if it exists. */
	229	if (grp->gr_gid != egid && inarray(grp->gr_gid, grps, ngrps)) {
	230	for (i = 0; i < ngrps; i++)
	231	if (grps[i] == grp->gr_gid)
	232	break;
	233	ngrps--;
	234	memmove(&grps[i], &grps[i + 1], (ngrps - i) * sizeof(gid_t));
	235	PRIV_START;
	236	if (setgroups(ngrps, (const gid_t *)grps) < 0) {
	237	PRIV_END;
	238	warn("setgroups");
aaff5f01	239	goto end;
34d340d7 A	240	}
	241	PRIV_END;
	242	}
	243
	244	PRIV_START;
	245	if (setgid(grp->gr_gid)) {
	246	PRIV_END;
	247	warn("setgid");
aaff5f01	248	goto end;
34d340d7 A	249	}
	250	PRIV_END;
	251	grps[0] = grp->gr_gid;
	252
	253	/* Add old effective gid to supp. list if it does not exist. */
	254	if (egid != grp->gr_gid && !inarray(egid, grps, ngrps)) {
aaff5f01	255	if (ngrps + 1 >= ngrps_max)
34d340d7 A	256	warnx("too many groups");
	257	else {
	258	grps[ngrps++] = egid;
	259	PRIV_START;
	260	if (setgroups(ngrps, (const gid_t *)grps)) {
	261	PRIV_END;
	262	warn("setgroups");
aaff5f01	263	goto end;
34d340d7 A	264	}
	265	PRIV_END;
	266	}
	267	}
	268
aaff5f01 A	269	end:
aaff5f01 A	270	free(grps);
34d340d7 A	271	}
	272
	273	static int
	274	inarray(gid_t gid, const gid_t grps[], int ngrps)
	275	{
	276	int i;
	277
	278	for (i = 0; i < ngrps; i++)
	279	if (grps[i] == gid)
	280	return (1);
	281	return (0);
	282	}
	283
	284	/*
	285	* Set the environment to what would be expected if the user logged in
	286	* again; this performs the same steps as su(1)'s -l option.
	287	*/
	288	static void
	289	loginshell(void)
	290	{
	291	char args[2], cleanenv, term, *ticket;
	292	const char *shell;
ef8ad44b	293	char *prog, progbuf[PATH_MAX];
34d340d7 A	294	#ifndef __APPLE__
	295	login_cap_t *lc;
	296	#endif /* !__APPLE__ */
	297	shell = pwd->pw_shell;
	298	if (*shell == '\0')
	299	shell = _PATH_BSHELL;
	300	if (chdir(pwd->pw_dir) < 0) {
	301	warn("%s", pwd->pw_dir);
	302	chdir("/");
	303	}
	304
	305	term = getenv("TERM");
	306	ticket = getenv("KRBTKFILE");
	307
	308	if ((cleanenv = calloc(20, sizeof(char *))) == NULL)
	309	err(1, "calloc");
	310	*cleanenv = NULL;
	311	environ = cleanenv;
	312	#ifndef __APPLE__
	313	lc = login_getpwclass(pwd);
	314	setusercontext(lc, pwd, pwd->pw_uid,
	315	LOGIN_SETPATH\|LOGIN_SETUMASK\|LOGIN_SETENV);
	316	login_close(lc);
	317	#endif /* !__APPLE__ */
	318	setenv("USER", pwd->pw_name, 1);
	319	setenv("SHELL", shell, 1);
	320	setenv("HOME", pwd->pw_dir, 1);
	321	if (term != NULL)
	322	setenv("TERM", term, 1);
	323	if (ticket != NULL)
	324	setenv("KRBTKFILE", ticket, 1);
	325
ef8ad44b A	326	strlcpy(progbuf, shell, sizeof(progbuf));
	327	prog = basename(progbuf);
	328
	329	if (asprintf(args, "-%s", prog) < 0)
34d340d7 A	330	err(1, "asprintf");
	331	args[1] = NULL;
	332
	333	execv(shell, args);
	334	err(1, "%s", shell);
	335	}
	336
	337	static void
	338	doshell(void)
	339	{
	340	const char *shell;
ef8ad44b	341	char *prog, progbuf[PATH_MAX];
34d340d7 A	342
	343	shell = pwd->pw_shell;
	344	if (*shell == '\0')
	345	shell = _PATH_BSHELL;
ef8ad44b A	346
	347	strlcpy(progbuf, shell, sizeof(progbuf));
	348	prog = basename(progbuf);
	349
	350	execl(shell, prog, (char *)NULL);
34d340d7 A	351	err(1, "%s", shell);
34d340d7 A	352	}