/[pdpsoft]/trunk/grid-mw-security/ees/plugin_examples/posix_enf/src/posix_enf.c
ViewVC logotype

Contents of /trunk/grid-mw-security/ees/plugin_examples/posix_enf/src/posix_enf.c

Parent Directory Parent Directory | Revision Log Revision Log


Revision 1398 - (show annotations) (download) (as text)
Tue Jan 19 16:33:01 2010 UTC (12 years ago) by aramv
File MIME type: text/x-chdr
File size: 4980 byte(s)
Added uid switching to posix enforcement plugin
1 #include <unistd.h>
2 #include <stdio.h>
3 #include <grp.h>
4 #include <pwd.h>
5 #include "plugin.h"
6
7 #define MAX_UNDEFINED -1
8 #ifdef NGROUPS_MAX
9 #define NGROUPS NGROUPS_MAX
10 #else
11 #define NGROUPS 32
12 #endif
13
14 static int maxuid = MAX_UNDEFINED;
15 static int maxpgid = MAX_UNDEFINED;
16 static int maxsgid = MAX_UNDEFINED;
17 static int set_only_euid = 0;
18 static int set_only_egid = 0;
19 static int do_uid_check = 0;
20 static char *plugin_name = "posix_enf";
21 struct passwd pwd = NULL;
22
23 aos_context_t *context = NULL;
24 aos_attribute_t *attribute = NULL;
25 uid_t _real_uid = NULL;
26 uid_t _saved_uid = NULL;
27
28 EES_RC downgradeEffectiveToRealUid (uid_t real_uid, uid_t saved_uid);
29 EES_RC upgradeEffectiveToRealUid (uid_t real_uid, uid_t saved_uid);
30
31 EES_PL_RC plugin_initialize(int argc, char* argv[]){
32 static struct option long_options[] =
33 {
34 {"maxuid", required_argument, 0, 'u'},
35 {"maxpgid", required_argument, 0, 'p'},
36 {"maxsgid", required_argument, 0, 's'},
37 {"set_only_euid", required_argument, 0, 'e'},
38 {"set_only_egid", required_argument, 0, 'g'},
39 {"check_uid", no_argument, 0, 'c'}
40 };
41 int option_index, c;
42 _saved_uid = geteuid();
43 do_uid_check = 0;
44
45 eef_log(LOG_ERR, "%s: Initializing posix enforcement plugin!\n", plugin_name);
46
47 /* parse options */
48 while(1){
49 c = getopt_long_only(argc, argv, "u:p:s:e:g:", long_options, &option_index);
50 if(c == -1){
51 break;
52 }
53 switch(c){
54 case 'u':
55 maxuid = atoi(optarg);
56 break;
57 case 'p':
58 maxpgid = atoi(optarg);
59 break;
60 case 's':
61 maxsgid = atoi(optarg);
62 break;
63 case 'e':
64 if(strncmp(optarg,"yes", 4) == 0){
65 set_only_euid = 1;
66 }
67 break;
68 case 'g':
69 if(strncmp(optarg, "yes", 4) == 0){
70 set_only_egid = 1;
71 }
72 break;
73 case 'c':
74 do_uid_check = 1;
75 break;
76 }
77 }
78
79 /* sanity checks */
80 if(maxsgid > NGROUPS){
81 eef_log(LOG_ERR, "%s: Option -maxsgid %i exceeds the system limit of %i", plugin_name, maxsgid, NGROUPS);
82 return EES_PL_FAILURE;
83 } else if(maxsgid == MAX_UNDEFINED){
84 maxsgid = NGROUPS;
85 eef_log(LOG_NOTICE, "%s: Option -maxsgid defaulted to maximum %i", plugin_name, NGROUPS);
86 }
87
88 eef_log(LOG_INFO, "%s: Initialized plugin posix_enf with options:\n", plugin_name);
89 eef_log(LOG_INFO, "%s: maxuid: %i\n", plugin_name, maxuid);
90 eef_log(LOG_INFO, "%s: maxpgid: %i\n", plugin_name, maxpgid);
91 eef_log(LOG_INFO, "%s: maxsgid: %i\n", plugin_name, maxsgid);
92
93 eef_log(LOG_INFO, "%s: set_only_euid: %i\n", plugin_name, set_only_euid);
94 eef_log(LOG_INFO, "%s: set_only_egid: %i\n", plugin_name, set_only_egid);
95
96 return EES_PL_SUCCESS;
97 }
98
99 EES_PL_RC plugin_run(){
100 printf("Examining AOS\n");
101 while((context = getNextContext(OBLIGATION, NULL))){
102 printf("Context: %s\n", getContextObligationId(context));
103 if(strncmp(getContextObligationId(context), "uidgid", strlen("uidgid")) == 0){
104 while((attribute = getNextAttribute(context))){
105 if(strncmp(getAttributeId(attribute), "posix-uid", strlen("posix-uid")) == 0){
106 printf("Got UID: %s\n", getAttributeId(attribute));
107 _real_uid = getAttributeValueAsInt(attribute);
108 } else if(strncmp(getAttributeId(attribute), "posix-gid", strlen("posix-gid")) == 0){
109 printf("Got primary GID: %s\n", getAttributeId(attribute));
110 }
111 }
112 }
113 }
114
115 if(do_uid_check){
116 if(getpwuid()){
117
118 }
119 }
120 downgradeEffectiveToRealUid(_real_uid, _saved_uid);
121 endpwent();
122
123 return 0;
124 }
125
126 EES_PL_RC plugin_terminate(){
127 eef_log(LOG_NOTICE, "plugin poxix_enf terminated\n");
128 upgradeEffectiveToRealUid(_real_uid, _saved_uid);
129 return 0;
130 }
131 /* When the proxy is located on an NFS mount and on the server side the root squash
132 * option has been enabled, the effective uid is mapped to user 'nobody' which should
133 * not be able to read the proxy file. To work around this problem, the effective
134 * uid of the process is changed to that of the calling user and once glexec is done,
135 * the saved uid is used to restore the identity of the process,
136 */
137 EES_RC downgradeEffectiveToRealUid (uid_t real_uid, uid_t saved_uid){
138 real_uid = getuid();
139 if (real_uid != 0){
140 /* Save it */
141 saved_uid = geteuid();
142 printf("Set uid to: %i\n", real_uid);
143 if (seteuid(real_uid)){
144 eef_log(LOG_ERR, "Error on downsizing with seteuid()\n");
145 return EES_PL_FAILURE;
146 }
147 }
148 return EES_PL_SUCCESS;
149 }
150
151 EES_RC upgradeEffectiveToRealUid (uid_t real_uid, uid_t saved_uid){
152 /* Do not forget to put back the original effective uid on the process. */
153 if (real_uid != 0){
154 if (seteuid(saved_uid)){
155 eef_log(LOG_ERR, "Error on returning seteuid()\n");
156 return EES_PL_FAILURE;
157 }
158 }
159 return EES_PL_SUCCESS;
160 }

grid.support@nikhef.nl
ViewVC Help
Powered by ViewVC 1.1.28