/* If we've been run as setuid or setgid to someone else (most likely root)
turn off the extra permissions so that random user-specified programs
don't get special privileges. (On some systems it is necessary to install
this program as setuid root in order to read the passwd file to implement
lock-mode.)
*** WARNING: DO NOT DISABLE ANY OF THE FOLLOWING CODE!
If you do so, you will open a security hole. See the sections
of the xscreensaver manual titled "LOCKING AND ROOT LOGINS",
and "USING XDM".
*/
void
hack_uid (saver_info *si)
{
/* Discard privileges, and set the effective user/group ids to the
real user/group ids. That is, give up our "chmod +s" rights.
*/
{
uid_t euid = geteuid();
gid_t egid = getegid();
uid_t uid = getuid();
gid_t gid = getgid();
si->orig_uid = strdup (uid_gid_string (euid, egid));
if (uid != euid || gid != egid)
if (set_ids_by_number (uid, gid, &si->uid_message) != 0)
saver_exit (si, 1, 0);
}
/* Locking can't work when running as root, because we have no way of
knowing what the user id of the logged in user is (so we don't know
whose password to prompt for.)
*** WARNING: DO NOT DISABLE THIS CODE!
If you do so, you will open a security hole. See the sections
of the xscreensaver manual titled "LOCKING AND ROOT LOGINS",
and "USING XDM".
*/
if (getuid() == (uid_t) 0)
{
si->locking_disabled_p = True;
si->nolock_reason = "running as root";
}
/* If we're running as root, switch to a safer user. This is above and
beyond the fact that we've disabling locking, above -- the theory is
that running graphics demos as root is just always a stupid thing
to do, since they have probably never been security reviewed and are
more likely to be buggy than just about any other kind of program.
(And that assumes non-malicious code. There are also attacks here.)
*** WARNING: DO NOT DISABLE THIS CODE!
If you do so, you will open a security hole. See the sections
of the xscreensaver manual titled "LOCKING AND ROOT LOGINS",
and "USING XDM".
*/
if (getuid() == (uid_t) 0)
{
struct passwd *p;
p = getpwnam ("nobody");
if (! p) p = getpwnam ("noaccess");
if (! p) p = getpwnam ("daemon");
if (! p)
{
fprintf (stderr,
"%s: running as root, and couldn't find a safer uid.\n",
blurb());
saver_exit(si, 1, 0);
}
if (set_ids_by_number (p->pw_uid, p->pw_gid, &si->uid_message) != 0)
saver_exit (si, -1, 0);
}
/* If there's anything even remotely funny looking about the passwd struct,
or if we're running as some other user from the list below (a
non-comprehensive selection of users known to be privileged in some way,
and not normal end-users) then disable locking. If it was possible,
switching to "nobody" would be the thing to do, but only root itself has
the privs to do that.
*** WARNING: DO NOT DISABLE THIS CODE!
If you do so, you will open a security hole. See the sections
of the xscreensaver manual titled "LOCKING AND ROOT LOGINS",
and "USING XDM".
*/
{
uid_t uid = getuid (); /* get it again */
struct passwd *p = getpwuid (uid); /* get it again */
if (!p ||
uid == (uid_t) 0 ||
uid == (uid_t) -1 ||
uid == (uid_t) -2 ||
p->pw_uid == (uid_t) 0 ||
p->pw_uid == (uid_t) -1 ||
p->pw_uid == (uid_t) -2 ||
!p->pw_name ||
!*p->pw_name ||
!strcmp (p->pw_name, "root") ||
!strcmp (p->pw_name, "nobody") ||
!strcmp (p->pw_name, "noaccess") ||
!strcmp (p->pw_name, "operator") ||
!strcmp (p->pw_name, "daemon") ||
!strcmp (p->pw_name, "bin") ||
!strcmp (p->pw_name, "adm") ||
!strcmp (p->pw_name, "sys") ||
!strcmp (p->pw_name, "games"))
{
static char buf [1024];
sprintf (buf, "running as %.100s",
(p && p->pw_name && *p->pw_name
? p->pw_name : "<unknown>"));
si->nolock_reason = buf;
si->locking_disabled_p = True;
si->dangerous_uid_p = True;
}
}
}
/* Returns TRUE if OK to lock, FALSE otherwise */
gboolean
hack_uid (char **nolock_reason,
char **orig_uid,
char **uid_message)
{
char *reason;
gboolean ret;
ret = TRUE;
reason = NULL;
if (nolock_reason != NULL)
{
*nolock_reason = NULL;
}
if (orig_uid != NULL)
{
*orig_uid = NULL;
}
if (uid_message != NULL)
{
*uid_message = NULL;
}
/* Discard privileges, and set the effective user/group ids to the
real user/group ids. That is, give up our "chmod +s" rights.
*/
{
uid_t euid = geteuid ();
gid_t egid = getegid ();
uid_t uid = getuid ();
gid_t gid = getgid ();
if (orig_uid != NULL)
{
*orig_uid = uid_gid_string (euid, egid);
}
if (uid != euid || gid != egid)
{
if (! set_ids_by_number (uid, gid, uid_message))
{
reason = g_strdup ("unable to discard privileges.");
ret = FALSE;
goto out;
}
}
}
/* Locking can't work when running as root, because we have no way of
knowing what the user id of the logged in user is (so we don't know
whose password to prompt for.)
*** WARNING: DO NOT DISABLE THIS CODE!
If you do so, you will open a security hole. See the sections
of the xscreensaver manual titled "LOCKING AND ROOT LOGINS",
and "USING XDM".
*/
if (getuid () == (uid_t) 0)
{
reason = g_strdup ("running as root");
ret = FALSE;
goto out;
}
out:
if (nolock_reason != NULL)
{
*nolock_reason = g_strdup (reason);
}
g_free (reason);
return ret;
}
