2 * Copyright (c) 2012 The FreeBSD Foundation
5 * This software was developed by Pawel Jakub Dawidek under sponsorship from
6 * the FreeBSD Foundation.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * $P4: //depot/projects/trustedbsd/openbsm/bin/auditdistd/sandbox.c#3 $
32 #include <config/config.h>
34 #include <sys/param.h>
39 #include <sys/capability.h>
55 groups_compare(const void *grp0, const void *grp1)
57 gid_t gr0 = *(const gid_t *)grp0;
58 gid_t gr1 = *(const gid_t *)grp1;
60 return (gr0 <= gr1 ? (gr0 < gr1 ? -1 : 0) : 1);
65 sandbox(const char *user, bool capsicum, const char *fmt, ...)
81 gid_t *groups, *ggroups;
85 PJDLOG_ASSERT(user != NULL);
86 PJDLOG_ASSERT(fmt != NULL);
93 * According to getpwnam(3) we have to clear errno before calling the
94 * function to be able to distinguish between an error and missing
95 * entry (with is not treated as error by getpwnam(3)).
101 pjdlog_errno(LOG_ERR,
102 "Unable to find info about '%s' user", user);
105 pjdlog_error("'%s' user doesn't exist.", user);
111 ngroups = sysconf(_SC_NGROUPS_MAX);
113 pjdlog_errno(LOG_WARNING,
114 "Unable to obtain maximum number of groups");
115 ngroups = NGROUPS_MAX;
117 ngroups++; /* For base gid. */
118 groups = malloc(sizeof(groups[0]) * ngroups);
119 if (groups == NULL) {
120 pjdlog_error("Unable to allocate memory for %d groups.",
124 if (getgrouplist(user, pw->pw_gid, groups, &ngroups) == -1) {
125 pjdlog_error("Unable to obtain groups of user %s.", user);
131 (void)vasprintf(&jailhost, fmt, ap);
133 if (jailhost == NULL) {
134 pjdlog_error("Unable to allocate memory for jail host name.");
137 bzero(&jailst, sizeof(jailst));
138 jailst.version = JAIL_API_VERSION;
139 jailst.path = pw->pw_dir;
140 jailst.hostname = jailhost;
141 if (jail(&jailst) >= 0) {
145 pjdlog_errno(LOG_WARNING,
146 "Unable to jail to directory %s", pw->pw_dir);
149 #else /* !HAVE_JAIL */
151 #endif /* !HAVE_JAIL */
154 if (chroot(pw->pw_dir) == -1) {
155 pjdlog_errno(LOG_ERR,
156 "Unable to change root directory to %s",
161 PJDLOG_VERIFY(chdir("/") == 0);
163 if (setgroups(ngroups, groups) == -1) {
164 pjdlog_errno(LOG_ERR, "Unable to set groups");
167 if (setgid(pw->pw_gid) == -1) {
168 pjdlog_errno(LOG_ERR, "Unable to set gid to %u",
169 (unsigned int)pw->pw_gid);
172 if (setuid(pw->pw_uid) == -1) {
173 pjdlog_errno(LOG_ERR, "Unable to set uid to %u",
174 (unsigned int)pw->pw_uid);
178 #ifdef HAVE_CAP_ENTER
180 capsicum = (cap_enter() == 0);
182 pjdlog_common(LOG_DEBUG, 1, errno,
183 "Unable to sandbox using capsicum");
186 #else /* !HAVE_CAP_ENTER */
188 #endif /* !HAVE_CAP_ENTER */
191 * Better be sure that everything succeeded.
193 #ifdef HAVE_GETRESUID
194 PJDLOG_VERIFY(getresuid(&ruid, &euid, &suid) == 0);
195 PJDLOG_VERIFY(suid == pw->pw_uid);
200 PJDLOG_VERIFY(ruid == pw->pw_uid);
201 PJDLOG_VERIFY(euid == pw->pw_uid);
202 #ifdef HAVE_GETRESGID
203 PJDLOG_VERIFY(getresgid(&rgid, &egid, &sgid) == 0);
204 PJDLOG_VERIFY(sgid == pw->pw_gid);
209 PJDLOG_VERIFY(rgid == pw->pw_gid);
210 PJDLOG_VERIFY(egid == pw->pw_gid);
211 PJDLOG_VERIFY(getgroups(0, NULL) == ngroups);
212 ggroups = malloc(sizeof(ggroups[0]) * ngroups);
213 if (ggroups == NULL) {
214 pjdlog_error("Unable to allocate memory for %d groups.",
218 PJDLOG_VERIFY(getgroups(ngroups, ggroups) == ngroups);
219 qsort(groups, (size_t)ngroups, sizeof(groups[0]), groups_compare);
220 qsort(ggroups, (size_t)ngroups, sizeof(ggroups[0]), groups_compare);
221 PJDLOG_VERIFY(bcmp(groups, ggroups, sizeof(groups[0]) * ngroups) == 0);
224 "Privileges successfully dropped using %s%s+setgid+setuid.",
225 capsicum ? "capsicum+" : "", jailed ? "jail" : "chroot");