path: root/cifs.upcall.c

/*
* CIFS user-space helper.
* Copyright (C) Igor Mammedov (niallain@gmail.com) 2007
* Copyright (C) Jeff Layton (jlayton@samba.org) 2010
*
* Used by /sbin/request-key for handling
* cifs upcall for kerberos authorization of access to share and
* cifs upcall for DFS srver name resolving (IPv4/IPv6 aware).
* You should have keyutils installed and add something like the
* following lines to /etc/request-key.conf file:

    create cifs.spnego * * /usr/local/sbin/cifs.upcall %k
    create dns_resolver * * /usr/local/sbin/cifs.upcall %k

* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/

#ifdef HAVE_CONFIG_H
#include "config.h"
#endif /* HAVE_CONFIG_H */

#include <string.h>
#include <getopt.h>
#ifdef HAVE_KRB5_KRB5_H
#include <krb5/krb5.h>
#elif defined(HAVE_KRB5_H)
#include <krb5.h>
#endif
#include <syslog.h>
#include <dirent.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>
#include <keyutils.h>
#include <time.h>
#include <netdb.h>
#include <arpa/inet.h>
#include <ctype.h>
#include <pwd.h>
#include <grp.h>
#include <stdbool.h>
#include <errno.h>

#include "data_blob.h"
#include "spnego.h"
#include "cifs_spnego.h"

#ifdef HAVE_LIBCAP_NG
#include <cap-ng.h>
#endif

static krb5_context	context;
static const char	*prog = "cifs.upcall";

#define DNS_RESOLVER_DEFAULT_TIMEOUT 600 /* 10 minutes */

typedef enum _sectype {
	NONE = 0,
	KRB5,
	MS_KRB5
} sectype_t;

/* These macros unify the keyblock handling of Heimdal and MIT somewhat */
#ifdef HAVE_KRB5_KEYBLOCK_KEYVALUE /* Heimdal */
#define KRB5_KEY_TYPE(k)        ((k)->keytype)
#define KRB5_KEY_LENGTH(k)      ((k)->keyvalue.length)
#define KRB5_KEY_DATA(k)        ((k)->keyvalue.data)
#define KRB5_KEY_DATA_CAST      void
#else /* MIT */
#define KRB5_KEY_TYPE(k)        ((k)->enctype)
#define KRB5_KEY_LENGTH(k)      ((k)->length)
#define KRB5_KEY_DATA(k)        ((k)->contents)
#define KRB5_KEY_DATA_CAST      krb5_octet
#endif

#ifdef HAVE_LIBCAP_NG
static int
trim_capabilities(bool need_environ)
{
	capng_clear(CAPNG_SELECT_BOTH);

	/* SETUID and SETGID to change uid, gid, and grouplist */
	if (capng_updatev(CAPNG_ADD, CAPNG_PERMITTED|CAPNG_EFFECTIVE,
			CAP_SETUID, CAP_SETGID, -1)) {
		syslog(LOG_ERR, "%s: Unable to update capability set: %m\n", __func__);
		return 1;
	}

	 /* Need PTRACE and READ_SEARCH for /proc/pid/environ scraping */
	if (need_environ &&
	    capng_updatev(CAPNG_ADD, CAPNG_PERMITTED|CAPNG_EFFECTIVE,
			CAP_SYS_PTRACE, CAP_DAC_READ_SEARCH, -1)) {
		syslog(LOG_ERR, "%s: Unable to update capability set: %m\n", __func__);
		return 1;
	}

	if (capng_apply(CAPNG_SELECT_BOTH)) {
		syslog(LOG_ERR, "%s: Unable to apply capability set: %m\n", __func__);
		return 1;
	}
	return 0;
}

static int
drop_all_capabilities(void)
{
	capng_clear(CAPNG_SELECT_BOTH);
	if (capng_apply(CAPNG_SELECT_BOTH)) {
		syslog(LOG_ERR, "%s: Unable to apply capability set: %m\n", __func__);
		return 1;
	}
	return 0;
}
#else /* HAVE_LIBCAP_NG */
static int
trim_capabilities(bool unused)
{
	(void)unused;
	return 0;
}

static int
drop_all_capabilities(void)
{
	return 0;
}
#endif /* HAVE_LIBCAP_NG */

/*
 * smb_krb5_principal_get_realm
 *
 * @brief Get realm of a principal
 *
 * @param[in] context		The krb5_context
 * @param[in] principal		The principal
 * @return pointer to the realm
 *
 */
static char *cifs_krb5_principal_get_realm(krb5_principal principal)
{
#ifdef HAVE_KRB5_PRINCIPAL_GET_REALM	/* Heimdal */
	return krb5_principal_get_realm(context, principal);
#elif defined(krb5_princ_realm)	/* MIT */
	krb5_data *realm;
	realm = krb5_princ_realm(context, principal);
	return (char *)realm->data;
#else
	return NULL;
#endif
}

#if !defined(HAVE_KRB5_FREE_UNPARSED_NAME)
static void krb5_free_unparsed_name(krb5_context context, char *val)