2 * Copyright (c) 1998-2004 Proofpoint, Inc. and its suppliers.
4 * Copyright (c) 1983, 1995-1997 Eric P. Allman. All rights reserved.
5 * Copyright (c) 1988, 1993
6 * The Regents of the University of California. All rights reserved.
8 * By using this file, you agree to the terms and conditions set
9 * forth in the LICENSE file which can be found at the top level of
10 * the sendmail distribution.
16 #include <sm/errstring.h>
18 SM_RCSID("@(#)$Id: safefile.c,v 8.130 2013-11-22 20:51:50 ca Exp $")
22 ** SAFEFILE -- return 0 if a file exists and is safe for a user.
25 ** fn -- filename to check.
26 ** uid -- user id to compare against.
27 ** gid -- group id to compare against.
28 ** user -- user name to compare against (used for group sets).
29 ** flags -- modifiers:
30 ** SFF_MUSTOWN -- "uid" must own this file.
31 ** SFF_NOSLINK -- file cannot be a symbolic link.
32 ** mode -- mode bits that must match.
33 ** st -- if set, points to a stat structure that will
34 ** get the stat info for the file.
37 ** 0 if fn exists, is owned by uid, and matches mode.
38 ** An errno otherwise. The actual errno is cleared.
45 safefile(fn, uid, gid, user, flags, mode, st)
55 register struct group *gr = NULL;
60 char fbuf[MAXPATHLEN];
63 sm_dprintf("safefile(%s, uid=%d, gid=%d, flags=%lx, mode=%o):\n",
64 fn, (int) uid, (int) gid, flags, mode);
66 if (sm_strlcpy(fbuf, fn, sizeof fbuf) >= sizeof fbuf)
69 sm_dprintf("\tpathname too long\n");
76 /* ignore SFF_SAFEDIRPATH if we are debugging */
77 if (RealUid != 0 && RunAsUid == RealUid)
78 flags &= ~SFF_SAFEDIRPATH;
80 /* first check to see if the file exists at all */
82 if ((bitset(SFF_NOSLINK, flags) ? lstat(fn, st)
90 else if (bitset(SFF_SETUIDOK, flags) &&
91 !bitset(S_IXUSR|S_IXGRP|S_IXOTH, st->st_mode) &&
95 ** If final file is set-user-ID, run as the owner of that
96 ** file. Gotta be careful not to reveal anything too
100 # ifdef SUID_ROOT_FILES_OK
101 if (bitset(S_ISUID, st->st_mode))
103 if (bitset(S_ISUID, st->st_mode) && st->st_uid != 0 &&
104 st->st_uid != TrustedUid)
110 # ifdef SUID_ROOT_FILES_OK
111 if (bitset(S_ISGID, st->st_mode))
113 if (bitset(S_ISGID, st->st_mode) && st->st_gid != 0)
118 checkpath = !bitset(SFF_NOPATHCHECK, flags) ||
119 (uid == 0 && !bitset(SFF_ROOTOK|SFF_OPENASROOT, flags));
120 if (bitset(SFF_NOWLINK, flags) && !bitset(SFF_SAFEDIRPATH, flags))
124 /* check the directory */
125 p = strrchr(fn, '/');
128 ret = safedirpath(".", uid, gid, user,
129 flags|SFF_SAFEDIRPATH, 0, 0);
134 ret = safedirpath(fn, uid, gid, user,
135 flags|SFF_SAFEDIRPATH, 0, 0);
140 /* directory is safe */
146 /* Need lstat() information if called stat() before */
147 if (!bitset(SFF_NOSLINK, flags) && lstat(fn, st) < 0)
151 sm_dprintf("\t%s\n", sm_errstring(ret));
154 # endif /* HASLSTAT */
155 /* directory is writable: disallow links */
164 p = strrchr(fn, '/');
167 ret = safedirpath(".", uid, gid, user, flags, 0, 0);
172 ret = safedirpath(fn, uid, gid, user, flags, 0, 0);
180 ** If the target file doesn't exist, check the directory to
181 ** ensure that it is writable by this user.
186 int ret = file_errno;
190 sm_dprintf("\t%s\n", sm_errstring(ret));
193 if (!bitset(SFF_CREAT, flags) || file_errno != ENOENT)
196 /* check to see if legal to create the file */
197 p = strrchr(dir, '/');
204 if (stat(dir, &stbuf) >= 0)
206 int md = S_IWRITE|S_IEXEC;
209 if (stbuf.st_uid == uid)
212 else if (uid == 0 && stbuf.st_uid == TrustedUid)
218 if (stbuf.st_gid == gid)
221 # ifndef NO_GROUP_SET
222 else if (user != NULL && !DontInitGroups &&
224 gr->gr_gid == stbuf.st_gid) ||
225 (gr = getgrgid(stbuf.st_gid)) != NULL))
229 for (gp = gr->gr_mem; *gp != NULL; gp++)
230 if (strcmp(*gp, user) == 0)
235 # endif /* ! NO_GROUP_SET */
239 if ((stbuf.st_mode & md) != md)
240 ret = errno = EACCES;
245 sm_dprintf("\t[final dir %s uid %d mode %lo] %s\n",
246 dir, (int) stbuf.st_uid,
247 (unsigned long) stbuf.st_mode,
251 st->st_mode = ST_MODE_NOFILE;
256 if (bitset(SFF_NOSLINK, flags) && S_ISLNK(st->st_mode))
259 sm_dprintf("\t[slink mode %lo]\tE_SM_NOSLINK\n",
260 (unsigned long) st->st_mode);
263 # endif /* S_ISLNK */
264 if (bitset(SFF_REGONLY, flags) && !S_ISREG(st->st_mode))
267 sm_dprintf("\t[non-reg mode %lo]\tE_SM_REGONLY\n",
268 (unsigned long) st->st_mode);
271 if (bitset(SFF_NOGWFILES, flags) &&
272 bitset(S_IWGRP, st->st_mode))
275 sm_dprintf("\t[write bits %lo]\tE_SM_GWFILE\n",
276 (unsigned long) st->st_mode);
279 if (bitset(SFF_NOWWFILES, flags) &&
280 bitset(S_IWOTH, st->st_mode))
283 sm_dprintf("\t[write bits %lo]\tE_SM_WWFILE\n",
284 (unsigned long) st->st_mode);
287 if (bitset(SFF_NOGRFILES, flags) && bitset(S_IRGRP, st->st_mode))
290 sm_dprintf("\t[read bits %lo]\tE_SM_GRFILE\n",
291 (unsigned long) st->st_mode);
294 if (bitset(SFF_NOWRFILES, flags) && bitset(S_IROTH, st->st_mode))
297 sm_dprintf("\t[read bits %lo]\tE_SM_WRFILE\n",
298 (unsigned long) st->st_mode);
301 if (!bitset(SFF_EXECOK, flags) &&
302 bitset(S_IWUSR|S_IWGRP|S_IWOTH, mode) &&
303 bitset(S_IXUSR|S_IXGRP|S_IXOTH, st->st_mode))
306 sm_dprintf("\t[exec bits %lo]\tE_SM_ISEXEC\n",
307 (unsigned long) st->st_mode);
310 if (bitset(SFF_NOHLINK, flags) && st->st_nlink != 1)
313 sm_dprintf("\t[link count %d]\tE_SM_NOHLINK\n",
318 if (uid == 0 && bitset(SFF_OPENASROOT, flags))
321 else if (uid == 0 && !bitset(SFF_ROOTOK, flags))
323 else if (st->st_uid == uid)
326 else if (uid == 0 && st->st_uid == TrustedUid)
332 if (st->st_gid == gid)
335 # ifndef NO_GROUP_SET
336 else if (user != NULL && !DontInitGroups &&
337 ((gr != NULL && gr->gr_gid == st->st_gid) ||
338 (gr = getgrgid(st->st_gid)) != NULL))
342 for (gp = gr->gr_mem; *gp != NULL; gp++)
343 if (strcmp(*gp, user) == 0)
348 # endif /* ! NO_GROUP_SET */
353 sm_dprintf("\t[uid %d, nlink %d, stat %lo, mode %lo] ",
354 (int) st->st_uid, (int) st->st_nlink,
355 (unsigned long) st->st_mode, (unsigned long) mode);
356 if ((st->st_uid == uid || st->st_uid == 0 ||
357 st->st_uid == TrustedUid ||
358 !bitset(SFF_MUSTOWN, flags)) &&
359 (st->st_mode & mode) == mode)
362 sm_dprintf("\tOK\n");
366 sm_dprintf("\tEACCES\n");
370 ** SAFEDIRPATH -- check to make sure a path to a directory is safe
372 ** Safe means not writable and owned by the right folks.
375 ** fn -- filename to check.
376 ** uid -- user id to compare against.
377 ** gid -- group id to compare against.
378 ** user -- user name to compare against (used for group
380 ** flags -- modifiers:
381 ** SFF_ROOTOK -- ok to use root permissions to open.
382 ** SFF_SAFEDIRPATH -- writable directories are considered
383 ** to be fatal errors.
384 ** level -- symlink recursive level.
385 ** offset -- offset into fn to start checking from.
388 ** 0 -- if the directory path is "safe".
389 ** else -- an error number associated with the path.
393 safedirpath(fn, uid, gid, user, flags, level, offset)
405 char *saveptr = NULL;
407 register struct group *gr = NULL;
408 char s[MAXLINKPATHLEN];
411 /* make sure we aren't in a symlink loop */
412 if (level > MAXSYMLINKS)
415 if (level < 0 || offset < 0 || offset > strlen(fn))
418 /* special case root directory */
423 sm_dprintf("safedirpath(%s, uid=%ld, gid=%ld, flags=%lx, level=%d, offset=%d):\n",
424 fn, (long) uid, (long) gid, flags, level, offset);
426 if (!bitnset(DBS_GROUPWRITABLEDIRPATHSAFE, DontBlameSendmail))
429 /* Make a modifiable copy of the filename */
430 if (sm_strlcpy(s, fn, sizeof s) >= sizeof s)
436 /* put back character */
449 /* Special case for root directory */
463 /* Heuristic: . and .. have already been checked */
464 enddir = strrchr(s, '/');
465 if (enddir != NULL &&
466 (strcmp(enddir, "/..") == 0 ||
467 strcmp(enddir, "/.") == 0))
471 sm_dprintf("\t[dir %s]\n", s);
474 ret = lstat(s, &stbuf);
476 ret = stat(s, &stbuf);
485 /* Follow symlinks */
486 if (S_ISLNK(stbuf.st_mode))
490 char buf[MAXPATHLEN];
491 char fullbuf[MAXLINKPATHLEN];
493 memset(buf, '\0', sizeof buf);
494 linklen = readlink(s, buf, sizeof buf);
500 if (linklen >= sizeof buf)
502 /* file name too long for buffer */
503 ret = errno = EINVAL;
512 /* If path is the same, avoid rechecks */
513 while (s[offset] == buf[offset] &&
517 if (s[offset] == '\0' && buf[offset] == '\0')
519 /* strings match, symlink loop */
523 /* back off from the mismatch */
527 /* Make sure we are at a directory break */
532 while (buf[offset] != '/' &&
540 /* Include the trailing slash */
548 sptr = strrchr(s, '/');
552 offset = sptr + 1 - s;
553 if (sm_strlcpyn(fullbuf,
557 sm_strlcat(fullbuf, buf,
568 if (sm_strlcpy(fullbuf, buf,
578 ret = safedirpath(target, uid, gid, user, flags,
583 /* Don't check permissions on the link file itself */
588 if ((uid == 0 || bitset(SFF_SAFEDIRPATH, flags)) &&
590 !(bitnset(DBS_TRUSTSTICKYBIT, DontBlameSendmail) &&
591 bitset(S_ISVTX, stbuf.st_mode)) &&
593 bitset(mode, stbuf.st_mode))
596 sm_dprintf("\t[dir %s] mode %lo ",
597 s, (unsigned long) stbuf.st_mode);
598 if (bitset(SFF_SAFEDIRPATH, flags))
600 if (bitset(S_IWOTH, stbuf.st_mode))
605 sm_dprintf("FATAL\n");
609 sm_dprintf("WARNING\n");
611 message("051 WARNING: %s writable directory %s",
612 bitset(S_IWOTH, stbuf.st_mode)
617 if (uid == 0 && !bitset(SFF_ROOTOK|SFF_OPENASROOT, flags))
619 if (bitset(S_IXOTH, stbuf.st_mode))
626 ** Let OS determine access to file if we are not
627 ** running as a privileged user. This allows ACLs
628 ** to work. Also, if opening as root, assume we can
629 ** scan the directory.
631 if (geteuid() != 0 || bitset(SFF_OPENASROOT, flags))
634 if (stbuf.st_uid == uid &&
635 bitset(S_IXUSR, stbuf.st_mode))
637 if (stbuf.st_gid == gid &&
638 bitset(S_IXGRP, stbuf.st_mode))
640 # ifndef NO_GROUP_SET
641 if (user != NULL && !DontInitGroups &&
642 ((gr != NULL && gr->gr_gid == stbuf.st_gid) ||
643 (gr = getgrgid(stbuf.st_gid)) != NULL))
647 for (gp = gr->gr_mem; gp != NULL && *gp != NULL; gp++)
648 if (strcmp(*gp, user) == 0)
650 if (gp != NULL && *gp != NULL &&
651 bitset(S_IXGRP, stbuf.st_mode))
654 # endif /* ! NO_GROUP_SET */
655 if (!bitset(S_IXOTH, stbuf.st_mode))
662 sm_dprintf("\t[dir %s] %s\n", fn,
663 ret == 0 ? "OK" : sm_errstring(ret));
667 ** SAFEOPEN -- do a file open with extra checking
670 ** fn -- the file name to open.
671 ** omode -- the open-style mode flags.
672 ** cmode -- the create-style mode flags.
673 ** sff -- safefile flags.
680 safeopen(fn, omode, cmode, sff)
695 sm_dprintf("safeopen: fn=%s, omode=%x, cmode=%x, sff=%lx\n",
696 fn, omode, cmode, sff);
698 if (bitset(O_CREAT, omode))
701 switch (omode & O_ACCMODE)
712 smode = S_IREAD|S_IWRITE;
719 if (bitset(SFF_OPENASROOT, sff))
720 rval = safefile(fn, RunAsUid, RunAsGid, RunAsUserName,
723 rval = safefile(fn, RealUid, RealGid, RealUserName,
730 if (stb.st_mode == ST_MODE_NOFILE && bitset(SFF_CREAT, sff))
731 omode |= O_CREAT | (bitset(SFF_NOTEXCL, sff) ? 0 : O_EXCL);
732 else if (bitset(SFF_CREAT, sff) && bitset(O_EXCL, omode))
734 /* The file exists so an exclusive create would fail */
740 truncate = bitset(O_TRUNC, omode);
745 fd = dfopen(fn, omode, cmode, sff);
748 if (filechanged(fn, fd, &stb))
750 syserr("554 5.3.0 cannot open: file %s changed after open", fn);
752 errno = E_SM_FILECHANGE;
758 ftruncate(fd, (off_t) 0) < 0)
763 syserr("554 5.3.0 cannot open: file %s could not be truncated",
769 #endif /* !NOFTRUNCATE */
774 ** SAFEFOPEN -- do a file open with extra checking
777 ** fn -- the file name to open.
778 ** omode -- the open-style mode flags.
779 ** cmode -- the create-style mode flags.
780 ** sff -- safefile flags.
787 safefopen(fn, omode, cmode, sff)
798 switch (omode & O_ACCMODE)
801 fmode = SM_IO_RDONLY;
805 if (bitset(O_APPEND, omode))
806 fmode = SM_IO_APPEND;
808 fmode = SM_IO_WRONLY;
812 if (bitset(O_TRUNC, omode))
813 fmode = SM_IO_RDWRTR;
814 else if (bitset(O_APPEND, omode))
815 fmode = SM_IO_APPENDRW;
821 syserr("554 5.3.5 safefopen: unknown omode %o", omode);
824 fd = safeopen(fn, omode, cmode, sff);
829 sm_dprintf("safefopen: safeopen failed: %s\n",
830 sm_errstring(errno));
834 fp = sm_io_open(SmFtStdiofd, SM_TIME_DEFAULT,
835 (void *) &fd, fmode, NULL);
842 sm_dprintf("safefopen: fdopen(%s, %d) failed: omode=%x, sff=%lx, err=%s\n",
843 fn, fmode, omode, sff, sm_errstring(errno));
850 ** FILECHANGED -- check to see if file changed after being opened
853 ** fn -- pathname of file to check.
854 ** fd -- file descriptor to check.
855 ** stb -- stat structure from before open.
858 ** true -- if a problem was detected.
859 ** false -- if this file is still the same.
863 filechanged(fn, fd, stb)
870 if (stb->st_mode == ST_MODE_NOFILE)
872 # if HASLSTAT && BOGUS_O_EXCL
873 /* only necessary if exclusive open follows symbolic links */
874 if (lstat(fn, stb) < 0 || stb->st_nlink != 1)
880 if (fstat(fd, &sta) < 0)
883 if (sta.st_nlink != stb->st_nlink ||
884 sta.st_dev != stb->st_dev ||
885 sta.st_ino != stb->st_ino ||
886 # if HAS_ST_GEN && 0 /* AFS returns garbage in st_gen */
887 sta.st_gen != stb->st_gen ||
889 sta.st_uid != stb->st_uid ||
890 sta.st_gid != stb->st_gid)
894 sm_dprintf("File changed after opening:\n");
895 sm_dprintf(" nlink = %ld/%ld\n",
896 (long) stb->st_nlink, (long) sta.st_nlink);
897 sm_dprintf(" dev = %ld/%ld\n",
898 (long) stb->st_dev, (long) sta.st_dev);
899 sm_dprintf(" ino = %llu/%llu\n",
900 (ULONGLONG_T) stb->st_ino,
901 (ULONGLONG_T) sta.st_ino);
903 sm_dprintf(" gen = %ld/%ld\n",
904 (long) stb->st_gen, (long) sta.st_gen);
906 sm_dprintf(" uid = %ld/%ld\n",
907 (long) stb->st_uid, (long) sta.st_uid);
908 sm_dprintf(" gid = %ld/%ld\n",
909 (long) stb->st_gid, (long) sta.st_gid);
917 ** DFOPEN -- determined file open
919 ** This routine has the semantics of open, except that it will
920 ** keep trying a few times to make this happen. The idea is that
921 ** on very loaded systems, we may run out of resources (inodes,
922 ** whatever), so this tries to get around it.
926 dfopen(filename, omode, cmode, sff)
936 for (tries = 0; tries < 10; tries++)
938 (void) sleep((unsigned) (10 * tries));
940 fd = open(filename, omode, cmode);
945 case ENFILE: /* system file table full */
946 case EINTR: /* interrupted syscall */
948 case ETXTBSY: /* Apollo: net file locked */
954 if (!bitset(SFF_NOLOCK, sff) &&
956 fstat(fd, &st) >= 0 &&
961 /* lock the file to avoid accidental conflicts */
962 if ((omode & O_ACCMODE) != O_RDONLY)
966 if (bitset(SFF_NBLOCK, sff))
969 if (!lockfile(fd, filename, NULL, locktype))
971 int save_errno = errno;