void describe_uids (saver_info *si, FILE *out) { uid_t uid = getuid(); gid_t gid = getgid(); uid_t euid = geteuid(); gid_t egid = getegid(); char *s1 = strdup (uid_gid_string (uid, gid)); char *s2 = strdup (uid_gid_string (euid, egid)); if (si->orig_uid && *si->orig_uid && (!!strcmp (si->orig_uid, s1) || !!strcmp (si->orig_uid, s2))) fprintf (out, "%s: initial effective uid/gid was %s\n", blurb(), si->orig_uid); fprintf (out, "%s: running as %s", blurb(), s1); if (uid != euid || gid != egid) fprintf (out, "; effectively %s", s2); fprintf(out, "\n"); free(s1); free(s2); }
/* If we've been run as setuid or setgid to someone else (most likely root) turn off the extra permissions so that random user-specified programs don't get special privileges. (On some systems it is necessary to install this program as setuid root in order to read the passwd file to implement lock-mode.) *** WARNING: DO NOT DISABLE ANY OF THE FOLLOWING CODE! If you do so, you will open a security hole. See the sections of the xscreensaver manual titled "LOCKING AND ROOT LOGINS", and "USING XDM". */ void hack_uid (saver_info *si) { /* Discard privileges, and set the effective user/group ids to the real user/group ids. That is, give up our "chmod +s" rights. */ { uid_t euid = geteuid(); gid_t egid = getegid(); uid_t uid = getuid(); gid_t gid = getgid(); si->orig_uid = strdup (uid_gid_string (euid, egid)); if (uid != euid || gid != egid) if (set_ids_by_number (uid, gid, &si->uid_message) != 0) saver_exit (si, 1, 0); } /* Locking can't work when running as root, because we have no way of knowing what the user id of the logged in user is (so we don't know whose password to prompt for.) *** WARNING: DO NOT DISABLE THIS CODE! If you do so, you will open a security hole. See the sections of the xscreensaver manual titled "LOCKING AND ROOT LOGINS", and "USING XDM". */ if (getuid() == (uid_t) 0) { si->locking_disabled_p = True; si->nolock_reason = "running as root"; } /* If we're running as root, switch to a safer user. This is above and beyond the fact that we've disabling locking, above -- the theory is that running graphics demos as root is just always a stupid thing to do, since they have probably never been security reviewed and are more likely to be buggy than just about any other kind of program. (And that assumes non-malicious code. There are also attacks here.) *** WARNING: DO NOT DISABLE THIS CODE! If you do so, you will open a security hole. See the sections of the xscreensaver manual titled "LOCKING AND ROOT LOGINS", and "USING XDM". */ if (getuid() == (uid_t) 0) { struct passwd *p; p = getpwnam ("nobody"); if (! p) p = getpwnam ("noaccess"); if (! p) p = getpwnam ("daemon"); if (! p) { fprintf (stderr, "%s: running as root, and couldn't find a safer uid.\n", blurb()); saver_exit(si, 1, 0); } if (set_ids_by_number (p->pw_uid, p->pw_gid, &si->uid_message) != 0) saver_exit (si, -1, 0); } /* If there's anything even remotely funny looking about the passwd struct, or if we're running as some other user from the list below (a non-comprehensive selection of users known to be privileged in some way, and not normal end-users) then disable locking. If it was possible, switching to "nobody" would be the thing to do, but only root itself has the privs to do that. *** WARNING: DO NOT DISABLE THIS CODE! If you do so, you will open a security hole. See the sections of the xscreensaver manual titled "LOCKING AND ROOT LOGINS", and "USING XDM". */ { uid_t uid = getuid (); /* get it again */ struct passwd *p = getpwuid (uid); /* get it again */ if (!p || uid == (uid_t) 0 || uid == (uid_t) -1 || uid == (uid_t) -2 || p->pw_uid == (uid_t) 0 || p->pw_uid == (uid_t) -1 || p->pw_uid == (uid_t) -2 || !p->pw_name || !*p->pw_name || !strcmp (p->pw_name, "root") || !strcmp (p->pw_name, "nobody") || !strcmp (p->pw_name, "noaccess") || !strcmp (p->pw_name, "operator") || !strcmp (p->pw_name, "daemon") || !strcmp (p->pw_name, "bin") || !strcmp (p->pw_name, "adm") || !strcmp (p->pw_name, "sys") || !strcmp (p->pw_name, "games")) { static char buf [1024]; sprintf (buf, "running as %.100s", (p && p->pw_name && *p->pw_name ? p->pw_name : "<unknown>")); si->nolock_reason = buf; si->locking_disabled_p = True; si->dangerous_uid_p = True; } } }
/* Returns TRUE if OK to lock, FALSE otherwise */ gboolean hack_uid (char **nolock_reason, char **orig_uid, char **uid_message) { char *reason; gboolean ret; ret = TRUE; reason = NULL; if (nolock_reason != NULL) { *nolock_reason = NULL; } if (orig_uid != NULL) { *orig_uid = NULL; } if (uid_message != NULL) { *uid_message = NULL; } /* Discard privileges, and set the effective user/group ids to the real user/group ids. That is, give up our "chmod +s" rights. */ { uid_t euid = geteuid (); gid_t egid = getegid (); uid_t uid = getuid (); gid_t gid = getgid (); if (orig_uid != NULL) { *orig_uid = uid_gid_string (euid, egid); } if (uid != euid || gid != egid) { if (! set_ids_by_number (uid, gid, uid_message)) { reason = g_strdup ("unable to discard privileges."); ret = FALSE; goto out; } } } /* Locking can't work when running as root, because we have no way of knowing what the user id of the logged in user is (so we don't know whose password to prompt for.) *** WARNING: DO NOT DISABLE THIS CODE! If you do so, you will open a security hole. See the sections of the xscreensaver manual titled "LOCKING AND ROOT LOGINS", and "USING XDM". */ if (getuid () == (uid_t) 0) { reason = g_strdup ("running as root"); ret = FALSE; goto out; } out: if (nolock_reason != NULL) { *nolock_reason = g_strdup (reason); } g_free (reason); return ret; }