From 07ae0da06c0d94a3198e484d0de28c9282c4d6cd Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= <fidencio@redhat.com>

Date: Mon, 22 Jan 2018 11:49:23 +0100

Subject: [PATCH 86/88] DESKPROFILE: Use seteuid()/setegid() to create the

 profile

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

In order to create the file, having its owner properly, let's use

seteuid()/setegid() to create when creating the profile, as due to the

drop of the CAP_DAC_OVERRIDE "root" doesn't have access to the folder

where the profile will be created anymore.

By adopting the seteuid()/setegid() solution, calling fchown() in the

profile doesn't make sense, thus it was also removed.

This issue was exposed due to CAP_DAC_OVERRIDE being removed from Fedora

package.

Resolves:

https://pagure.io/SSSD/sssd/issue/3621

Signed-off-by: Fabiano FidĂȘncio <fidencio@redhat.com>

Reviewed-by: Simo Sorce <simo@redhat.com>

---

 src/providers/ipa/ipa_deskprofile_rules_util.c | 70 ++++++++++++++++++++++++--

 1 file changed, 66 insertions(+), 4 deletions(-)

diff --git a/src/providers/ipa/ipa_deskprofile_rules_util.c b/src/providers/ipa/ipa_deskprofile_rules_util.c

index 0846b16f6..eb04a69f8 100644

--- a/src/providers/ipa/ipa_deskprofile_rules_util.c

+++ b/src/providers/ipa/ipa_deskprofile_rules_util.c

@@ -706,6 +706,8 @@ ipa_deskprofile_rules_save_rule_to_disk(

     const char *extension = "json";

     uint32_t prio;

     int fd = -1;

+    gid_t orig_gid;

+    uid_t orig_uid;

     errno_t ret;

     tmp_ctx = talloc_new(mem_ctx);

@@ -713,6 +715,9 @@ ipa_deskprofile_rules_save_rule_to_disk(

         return ENOMEM;

     }

+    orig_gid = getegid();

+    orig_uid = geteuid();

+

     ret = sysdb_attrs_get_string(rule, IPA_CN, &rule_name);

     if (ret != EOK) {

         DEBUG(SSSDBG_TRACE_FUNC,

@@ -875,6 +880,26 @@ ipa_deskprofile_rules_save_rule_to_disk(

         goto done;

     }

+    ret = setegid(gid);

+    if (ret == -1) {

+        ret = errno;

+        DEBUG(SSSDBG_CRIT_FAILURE,

+              "Unable to set effective group id (%"PRIu32") of the domain's "

+              "process [%d]: %s\n",

+              gid, ret, sss_strerror(ret));

+        goto done;

+    }

+

+    ret = seteuid(uid);

+    if (ret == -1) {

+        ret = errno;

+        DEBUG(SSSDBG_CRIT_FAILURE,

+              "Unable to set effective user id (%"PRIu32") of the domain's "

+              "process [%d]: %s\n",

+              uid, ret, sss_strerror(ret));

+        goto done;

+    }

+

     fd = open(filename_path, O_WRONLY | O_CREAT | O_TRUNC, 0600);

     if (fd == -1) {

         ret = errno;

@@ -895,12 +920,23 @@ ipa_deskprofile_rules_save_rule_to_disk(

         goto done;

     }

-    ret = fchown(fd, uid, gid);

-    if (ret != EOK) {

+    ret = seteuid(orig_uid);

+    if (ret == -1) {

         ret = errno;

         DEBUG(SSSDBG_CRIT_FAILURE,

-              "Failed to own the Desktop Profile Rule file \"%s\" [%d]: %s\n",

-              filename_path, ret, sss_strerror(ret));

+              "Failed to set the effect user id (%"PRIu32") of the domain's "

+              "process [%d]: %s\n",

+              orig_uid, ret, sss_strerror(ret));

+        goto done;

+    }

+

+    ret = setegid(orig_gid);

+    if (ret == -1) {

+        ret = errno;

+        DEBUG(SSSDBG_CRIT_FAILURE,

+              "Failed to set the effect group id (%"PRIu32") of the domain's "

+              "process [%d]: %s\n",

+              orig_gid, ret, sss_strerror(ret));

         goto done;

     }

@@ -910,6 +946,32 @@ done:

     if (fd != -1) {

         close(fd);

     }

+    if (geteuid() != orig_uid) {

+        ret = seteuid(orig_uid);

+        if (ret == -1) {

+            ret = errno;

+            DEBUG(SSSDBG_CRIT_FAILURE,

+                  "Unable to set effective user id (%"PRIu32") of the "

+                  "domain's process [%d]: %s\n",

+                  orig_uid, ret, sss_strerror(ret));

+            DEBUG(SSSDBG_CRIT_FAILURE,

+                  "Sending SIGUSR2 to the process: %d\n", getpid());

+            kill(getpid(), SIGUSR2);

+        }

+    }

+    if (getegid() != orig_gid) {

+        ret = setegid(orig_gid);

+        if (ret == -1) {

+            ret = errno;

+            DEBUG(SSSDBG_CRIT_FAILURE,

+                  "Unable to set effective group id (%"PRIu32") of the "

+                  "domain's process. Let's have the process restartd!\n",

+                  orig_gid);

+            DEBUG(SSSDBG_CRIT_FAILURE,

+                  "Sending SIGUSR2 to the process: %d\n", getpid());

+            kill(getpid(), SIGUSR2);

+        }

+    }

     talloc_free(tmp_ctx);

     return ret;

 }

-- 

2.14.3