From e6dea148252c9d8cb3de0965f2e558ac13e12f06 Mon Sep 17 00:00:00 2001 From: Daniel Shahaf Date: Thu, 26 Dec 2019 11:49:45 +0000 Subject: [PATCH 1/7] internal: Allow %L in zerrmsg() in non-debug builds, too. This will let error messages include long integers. Upstream-commit: 81185f4c6106d7ea2f7beaabbec7360c08e400d2 Signed-off-by: Kamil Dudka --- Src/utils.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/Src/utils.c b/Src/utils.c index 32f6008..2ddc596 100644 --- a/Src/utils.c +++ b/Src/utils.c @@ -325,12 +325,10 @@ zerrmsg(FILE *file, const char *fmt, va_list ap) nicezputs(s, file); break; } -#ifdef DEBUG case 'L': lnum = va_arg(ap, long); fprintf(file, "%ld", lnum); break; -#endif case 'd': num = va_arg(ap, int); fprintf(file, "%d", num); -- 2.21.1 From 4907caaf15e5a054088e05534c5500679c15b105 Mon Sep 17 00:00:00 2001 From: dana Date: Thu, 26 Dec 2019 14:57:07 -0600 Subject: [PATCH 2/7] unposted: zerrmsg(): Fix macro guard missed in previous commit Upstream-commit: ed21a7b70068b4250a25dcdc5b7213a789b0d0ca Signed-off-by: Kamil Dudka --- Src/utils.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/Src/utils.c b/Src/utils.c index 2ddc596..4a1dcc4 100644 --- a/Src/utils.c +++ b/Src/utils.c @@ -287,9 +287,7 @@ zerrmsg(FILE *file, const char *fmt, va_list ap) { const char *str; int num; -#ifdef DEBUG long lnum; -#endif #ifdef HAVE_STRERROR_R #define ERRBUFSIZE (80) int olderrno; -- 2.21.1 From a6763e5de6eebc5994097fc4d778094e7254589c Mon Sep 17 00:00:00 2001 From: Sam Foxman Date: Sun, 22 Dec 2019 17:30:28 -0500 Subject: [PATCH 3/7] Drop privileges securely Upstream-commit: 24e993db62cf146fb76ebcf677a4a7aa3766fc74 Signed-off-by: Kamil Dudka --- Src/options.c | 146 +++++++++++++++++++++++++++++++++++++++++--------- configure.ac | 4 +- 2 files changed, 125 insertions(+), 25 deletions(-) diff --git a/Src/options.c b/Src/options.c index 590652e..c9608af 100644 --- a/Src/options.c +++ b/Src/options.c @@ -576,6 +576,7 @@ int bin_setopt(char *nam, char **args, UNUSED(Options ops), int isun) { int action, optno, match = 0; + int retval = 0; /* With no arguments or options, display options. */ if (!*args) { @@ -603,18 +604,28 @@ bin_setopt(char *nam, char **args, UNUSED(Options ops), int isun) inittyptab(); return 1; } - if(!(optno = optlookup(*args))) + if(!(optno = optlookup(*args))) { zwarnnam(nam, "no such option: %s", *args); - else if(dosetopt(optno, action, 0, opts)) - zwarnnam(nam, "can't change option: %s", *args); + retval = 1; + } else { + retval = !!dosetopt(optno, action, 0, opts); + if (retval) { + zwarnnam(nam, "can't change option: %s", *args); + } + } break; } else if(**args == 'm') { match = 1; } else { - if (!(optno = optlookupc(**args))) + if (!(optno = optlookupc(**args))) { zwarnnam(nam, "bad option: -%c", **args); - else if(dosetopt(optno, action, 0, opts)) - zwarnnam(nam, "can't change option: -%c", **args); + retval = 1; + } else { + retval = !!dosetopt(optno, action, 0, opts); + if (retval) { + zwarnnam(nam, "can't change option: -%c", **args); + } + } } } args++; @@ -624,10 +635,15 @@ bin_setopt(char *nam, char **args, UNUSED(Options ops), int isun) if (!match) { /* Not globbing the arguments -- arguments are simply option names. */ while (*args) { - if(!(optno = optlookup(*args++))) + if(!(optno = optlookup(*args++))) { zwarnnam(nam, "no such option: %s", args[-1]); - else if(dosetopt(optno, !isun, 0, opts)) - zwarnnam(nam, "can't change option: %s", args[-1]); + retval = 1; + } else { + retval = !!dosetopt(optno, !isun, 0, opts); + if (retval) { + zwarnnam(nam, "can't change option: %s", args[-1]); + } + } } } else { /* Globbing option (-m) set. */ @@ -650,7 +666,8 @@ bin_setopt(char *nam, char **args, UNUSED(Options ops), int isun) tokenize(s); if (!(pprog = patcompile(s, PAT_HEAPDUP, NULL))) { zwarnnam(nam, "bad pattern: %s", *args); - continue; + retval = 1; + break; } /* Loop over expansions. */ scanmatchtable(optiontab, pprog, 0, 0, OPT_ALIAS, @@ -659,7 +676,7 @@ bin_setopt(char *nam, char **args, UNUSED(Options ops), int isun) } } inittyptab(); - return 0; + return retval; } /* Identify an option name */ @@ -768,20 +785,101 @@ dosetopt(int optno, int value, int force, char *new_opts) return -1; } else if(optno == PRIVILEGED && !value) { /* unsetting PRIVILEGED causes the shell to make itself unprivileged */ -#ifdef HAVE_SETUID - setuid(getuid()); - setgid(getgid()); - if (setuid(getuid())) { - zwarn("failed to change user ID: %e", errno); - return -1; - } else if (setgid(getgid())) { - zwarn("failed to change group ID: %e", errno); - return -1; - } + + int skip_setuid = 0; + int skip_setgid = 0; + +#if defined(HAVE_GETEGID) && defined(HAVE_SETGID) && defined(HAVE_GETUID) + int orig_egid = getegid(); +#endif + +#if defined(HAVE_GETEUID) && defined(HAVE_GETUID) + if (geteuid() == getuid()) { + skip_setuid = 1; + } +#endif + +#if defined(HAVE_GETEGID) && defined(HAVE_GETGID) + if (getegid() == getgid()) { + skip_setgid = 1; + } +#endif + + if (!skip_setgid) { + int setgid_err; +#ifdef HAVE_SETRESGID + setgid_err = setresgid(getgid(), getgid(), getgid()); +#elif defined(HAVE_SETREGID) +#if defined(HAVE_GETEGID) && defined(HAVE_SETGID) && defined(HAVE_GETUID) + setgid_err = setregid(getgid(), getgid()); +#else + zwarnnam("unsetopt", + "PRIVILEGED: can't drop privileges; setregid available, but cannot check if saved gid changed"); + return -1; +#endif +#else + zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; setresgid and setregid not available"); + return -1; +#endif + if (setgid_err) { + zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; failed to change group ID: %e", errno); + return -1; + } + } + + if (!skip_setuid) { +#if defined(HAVE_GETEUID) && defined(HAVE_SETUID) + int orig_euid = geteuid(); +#endif + int setuid_err; +#if defined(HAVE_GETEUID) && defined(HAVE_INITGROUPS) && defined(HAVE_GETPWUID) + if (geteuid() == 0) { + struct passwd *pw = getpwuid(getuid()); + if (pw == NULL) { + zwarnnam("unsetopt", "can't drop privileges; failed to get user information for uid %d: %e", + getuid(), errno); + return -1; + } + if (initgroups(pw->pw_name, pw->pw_gid)) { + zwarnnam("unsetopt", "can't drop privileges; failed to set supplementary group list: %e", errno); + return -1; + } + } +#endif + +#ifdef HAVE_SETRESUID + setuid_err = setresuid(getuid(), getuid(), getuid()); +#elif defined(HAVE_SETREUID) +#if defined(HAVE_GETEUID) && defined(HAVE_SETUID) && defined(HAVE_GETUID) + setuid_err = setreuid(getuid(), getuid()); +#else + zwarnnam("unsetopt", + "PRIVILEGED: can't drop privileges; setreuid available, but cannot check if saved uid changed"); + return -1; +#endif #else - zwarn("setuid not available"); - return -1; -#endif /* not HAVE_SETUID */ + zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; setresuid and setreuid not available"); + return -1; +#endif + if (setuid_err) { + zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; failed to change user ID: %e", errno); + return -1; + } +#if defined(HAVE_GETEUID) && defined(HAVE_SETUID) && defined(HAVE_GETUID) + if (getuid() != 0 && !setuid(orig_euid)) { + zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; was able to restore the euid"); + return -1; + } +#endif + } + +#if defined(HAVE_GETEGID) && defined(HAVE_SETGID) && defined(HAVE_GETUID) + if (getuid() != 0 && !skip_setgid && !setgid(orig_egid)) { + zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; was able to restore the egid"); + return -1; + } +#endif + #ifdef JOB_CONTROL } else if (!force && optno == MONITOR && value) { if (new_opts[optno] == value) diff --git a/configure.ac b/configure.ac index d15a6cd..51cdf89 100644 --- a/configure.ac +++ b/configure.ac @@ -1300,7 +1300,9 @@ AC_CHECK_FUNCS(strftime strptime mktime timelocal \ inet_aton inet_pton inet_ntop \ getlogin getpwent getpwnam getpwuid getgrgid getgrnam \ initgroups nis_list \ - setuid seteuid setreuid setresuid setsid \ + getuid setuid seteuid setreuid setresuid setsid \ + getgid setgid setegid setregid setresgid \ + geteuid getegid \ memcpy memmove strstr strerror strtoul \ getrlimit getrusage \ setlocale \ -- 2.21.1 From 07ec3e46db743ff37fd2bfeafbb4a44ddc7b4aaa Mon Sep 17 00:00:00 2001 From: Daniel Shahaf Date: Thu, 26 Dec 2019 09:16:19 +0000 Subject: [PATCH 4/7] Improve PRIVILEGED fixes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Fix retval handling in bin_setopt() - Don't skip_setuid / skip_setgid. It's not our place to optimize away noops (that might not even _be_ noops; they might change the saved uid…). - Remove HAVE_* guard checks around functions that are used unguarded elsewhere. - Use bsd-setres_id.c from OpenSSH to provide setresuid() / setresgid() everywhere, and thus simplify the ifdef soup. Fix some preëxisting bugs in the macro definitions of setuid() (do we still need that one?). - Fix zwarning() format codes for variadic arguments type safety - Restored a comment from HEAD - Fix failure modes around initgroups() - Compared privilege restoration code with OpenSSH's permanently_drop_uid() and updated as needed - Add E01 PRIVILEGED sanity checks Upstream-commit: 8250c5c168f07549ed646e6848e6dda118271e23 Signed-off-by: Kamil Dudka --- Src/openssh_bsd_setres_id.c | 129 +++++++++++++++++++++++++++++++ Src/options.c | 148 ++++++++++++++++-------------------- Src/zsh.mdd | 3 +- Src/zsh_system.h | 94 ++++++++++++++++++----- Test/E01options.ztst | 15 ++++ configure.ac | 5 +- 6 files changed, 292 insertions(+), 102 deletions(-) create mode 100644 Src/openssh_bsd_setres_id.c diff --git a/Src/openssh_bsd_setres_id.c b/Src/openssh_bsd_setres_id.c new file mode 100644 index 0000000..65e91a4 --- /dev/null +++ b/Src/openssh_bsd_setres_id.c @@ -0,0 +1,129 @@ +/* + * Copyright (c) 2012 Darren Tucker (dtucker at zip com au). + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ +/* + * openssh_bsd_setres_id.c - setresuid() and setresgid() wrappers + * + * This file is part of zsh, the Z shell. + * + * It is based on the file openbsd-compat/bsd-setres_id.c in OpenSSH 7.9p1, + * which is subject to the copyright notice above. The zsh modifications are + * licensed as follows: + * + * Copyright (c) 2019 Daniel Shahaf + * All rights reserved. + * + * Permission is hereby granted, without written agreement and without + * license or royalty fees, to use, copy, modify, and distribute this + * software and to distribute modified versions of this software for any + * purpose, provided that the above copyright notice and the following + * two paragraphs appear in all copies of this software. + * + * In no event shall Daniel Shahaf or the Zsh Development Group be liable + * to any party for direct, indirect, special, incidental, or consequential + * damages arising out of the use of this software and its documentation, + * even if Daniel Shahaf and the Zsh Development Group have been advised of + * the possibility of such damage. + * + * Daniel Shahaf and the Zsh Development Group specifically disclaim any + * warranties, including, but not limited to, the implied warranties of + * merchantability and fitness for a particular purpose. The software + * provided hereunder is on an "as is" basis, and Daniel Shahaf and the + * Zsh Development Group have no obligation to provide maintenance, + * support, updates, enhancements, or modifications. + * + */ + + +#include + +#include +#include +#include + +#include "zsh.mdh" + +#if defined(ZSH_IMPLEMENT_SETRESGID) || defined(BROKEN_SETRESGID) +int +setresgid(gid_t rgid, gid_t egid, gid_t sgid) +{ + int ret = 0, saved_errno; + + if (rgid != sgid) { + errno = ENOSYS; + return -1; + } +#if defined(ZSH_HAVE_NATIVE_SETREGID) && !defined(BROKEN_SETREGID) + if (setregid(rgid, egid) < 0) { + saved_errno = errno; + zwarnnam("setregid", "to gid %L: %e", (long)rgid, errno); + errno = saved_errno; + ret = -1; + } +#else + if (setegid(egid) < 0) { + saved_errno = errno; + zwarnnam("setegid", "to gid %L: %e", (long)(unsigned int)egid, errno); + errno = saved_errno; + ret = -1; + } + if (setgid(rgid) < 0) { + saved_errno = errno; + zwarnnam("setgid", "to gid %L: %e", (long)rgid, errno); + errno = saved_errno; + ret = -1; + } +#endif + return ret; +} +#endif + +#if defined(ZSH_IMPLEMENT_SETRESUID) || defined(BROKEN_SETRESUID) +int +setresuid(uid_t ruid, uid_t euid, uid_t suid) +{ + int ret = 0, saved_errno; + + if (ruid != suid) { + errno = ENOSYS; + return -1; + } +#if defined(ZSH_HAVE_NATIVE_SETREUID) && !defined(BROKEN_SETREUID) + if (setreuid(ruid, euid) < 0) { + saved_errno = errno; + zwarnnam("setreuid", "to uid %L: %e", (long)ruid, errno); + errno = saved_errno; + ret = -1; + } +#else + +# ifndef SETEUID_BREAKS_SETUID + if (seteuid(euid) < 0) { + saved_errno = errno; + zwarnnam("seteuid", "to uid %L: %e", (long)euid, errno); + errno = saved_errno; + ret = -1; + } +# endif + if (setuid(ruid) < 0) { + saved_errno = errno; + zwarnnam("setuid", "to uid %L: %e", (long)ruid, errno); + errno = saved_errno; + ret = -1; + } +#endif + return ret; +} +#endif diff --git a/Src/options.c b/Src/options.c index c9608af..deec560 100644 --- a/Src/options.c +++ b/Src/options.c @@ -606,25 +606,21 @@ bin_setopt(char *nam, char **args, UNUSED(Options ops), int isun) } if(!(optno = optlookup(*args))) { zwarnnam(nam, "no such option: %s", *args); - retval = 1; - } else { - retval = !!dosetopt(optno, action, 0, opts); - if (retval) { - zwarnnam(nam, "can't change option: %s", *args); - } + retval |= 1; + } else if (dosetopt(optno, action, 0, opts)) { + zwarnnam(nam, "can't change option: %s", *args); + retval |= 1; } break; } else if(**args == 'm') { match = 1; } else { - if (!(optno = optlookupc(**args))) { + if (!(optno = optlookupc(**args))) { zwarnnam(nam, "bad option: -%c", **args); - retval = 1; - } else { - retval = !!dosetopt(optno, action, 0, opts); - if (retval) { - zwarnnam(nam, "can't change option: -%c", **args); - } + retval |= 1; + } else if (dosetopt(optno, action, 0, opts)) { + zwarnnam(nam, "can't change option: -%c", **args); + retval |= 1; } } } @@ -637,12 +633,10 @@ bin_setopt(char *nam, char **args, UNUSED(Options ops), int isun) while (*args) { if(!(optno = optlookup(*args++))) { zwarnnam(nam, "no such option: %s", args[-1]); - retval = 1; - } else { - retval = !!dosetopt(optno, !isun, 0, opts); - if (retval) { - zwarnnam(nam, "can't change option: %s", args[-1]); - } + retval |= 1; + } else if (dosetopt(optno, !isun, 0, opts)) { + zwarnnam(nam, "can't change option: %s", args[-1]); + retval |= 1; } } } else { @@ -666,7 +660,7 @@ bin_setopt(char *nam, char **args, UNUSED(Options ops), int isun) tokenize(s); if (!(pprog = patcompile(s, PAT_HEAPDUP, NULL))) { zwarnnam(nam, "bad pattern: %s", *args); - retval = 1; + retval |= 1; break; } /* Loop over expansions. */ @@ -786,100 +780,92 @@ dosetopt(int optno, int value, int force, char *new_opts) } else if(optno == PRIVILEGED && !value) { /* unsetting PRIVILEGED causes the shell to make itself unprivileged */ - int skip_setuid = 0; - int skip_setgid = 0; - -#if defined(HAVE_GETEGID) && defined(HAVE_SETGID) && defined(HAVE_GETUID) - int orig_egid = getegid(); -#endif + /* If set, return -1 so lastval will be non-zero. */ + int failed = 0; -#if defined(HAVE_GETEUID) && defined(HAVE_GETUID) - if (geteuid() == getuid()) { - skip_setuid = 1; - } +#ifdef HAVE_SETUID + const int orig_euid = geteuid(); #endif + const int orig_egid = getegid(); -#if defined(HAVE_GETEGID) && defined(HAVE_GETGID) - if (getegid() == getgid()) { - skip_setgid = 1; - } -#endif - - if (!skip_setgid) { - int setgid_err; -#ifdef HAVE_SETRESGID - setgid_err = setresgid(getgid(), getgid(), getgid()); -#elif defined(HAVE_SETREGID) -#if defined(HAVE_GETEGID) && defined(HAVE_SETGID) && defined(HAVE_GETUID) - setgid_err = setregid(getgid(), getgid()); -#else - zwarnnam("unsetopt", - "PRIVILEGED: can't drop privileges; setregid available, but cannot check if saved gid changed"); + /* + * Set the GID first as if we set the UID to non-privileged it + * might be impossible to restore the GID. + */ + { +#ifndef HAVE_SETRESGID + zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; setresgid() and friends not available"); return -1; -#endif #else - zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; setresgid and setregid not available"); - return -1; -#endif + int setgid_err; + setgid_err = setresgid(getgid(), getgid(), getgid()); if (setgid_err) { zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; failed to change group ID: %e", errno); return -1; } +#endif } - if (!skip_setuid) { -#if defined(HAVE_GETEUID) && defined(HAVE_SETUID) - int orig_euid = geteuid(); -#endif + /* Set the UID second. */ + { +#ifndef HAVE_SETRESUID + zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; setresuid() and friends not available"); + return -1; +#else int setuid_err; -#if defined(HAVE_GETEUID) && defined(HAVE_INITGROUPS) && defined(HAVE_GETPWUID) + +# ifdef HAVE_INITGROUPS + /* Set the supplementary groups list. */ if (geteuid() == 0) { struct passwd *pw = getpwuid(getuid()); if (pw == NULL) { - zwarnnam("unsetopt", "can't drop privileges; failed to get user information for uid %d: %e", - getuid(), errno); - return -1; - } - if (initgroups(pw->pw_name, pw->pw_gid)) { + zwarnnam("unsetopt", "can't drop privileges; failed to get user information for uid %L: %e", + (long)getuid(), errno); + failed = 1; + } else if (initgroups(pw->pw_name, pw->pw_gid)) { zwarnnam("unsetopt", "can't drop privileges; failed to set supplementary group list: %e", errno); return -1; } + } else if (getuid() != 0 && + (geteuid() != getuid() || orig_egid != getegid())) { + zwarnnam("unsetopt", "PRIVILEGED: supplementary group list not changed due to lack of permissions: EUID=%L", + (long)geteuid()); + failed = 1; } -#endif +# else + /* initgroups() isn't in POSIX. If it's not available on the system, + * we silently skip it. */ +# endif -#ifdef HAVE_SETRESUID setuid_err = setresuid(getuid(), getuid(), getuid()); -#elif defined(HAVE_SETREUID) -#if defined(HAVE_GETEUID) && defined(HAVE_SETUID) && defined(HAVE_GETUID) - setuid_err = setreuid(getuid(), getuid()); -#else - zwarnnam("unsetopt", - "PRIVILEGED: can't drop privileges; setreuid available, but cannot check if saved uid changed"); - return -1; -#endif -#else - zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; setresuid and setreuid not available"); - return -1; -#endif if (setuid_err) { zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; failed to change user ID: %e", errno); return -1; } -#if defined(HAVE_GETEUID) && defined(HAVE_SETUID) && defined(HAVE_GETUID) - if (getuid() != 0 && !setuid(orig_euid)) { - zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; was able to restore the euid"); - return -1; - } #endif } -#if defined(HAVE_GETEGID) && defined(HAVE_SETGID) && defined(HAVE_GETUID) - if (getuid() != 0 && !skip_setgid && !setgid(orig_egid)) { +#ifdef HAVE_SETGID + if (getuid() != 0 && orig_egid != getegid() && + (setgid(orig_egid) != -1 || setegid(orig_egid) != -1)) { zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; was able to restore the egid"); return -1; } #endif +#ifdef HAVE_SETUID + if (getuid() != 0 && orig_euid != geteuid() && + (setuid(orig_euid) != -1 || seteuid(orig_euid) != -1)) { + zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; was able to restore the euid"); + return -1; + } +#endif + + if (failed) { + /* A warning message has been printed. */ + return -1; + } + #ifdef JOB_CONTROL } else if (!force && optno == MONITOR && value) { if (new_opts[optno] == value) diff --git a/Src/zsh.mdd b/Src/zsh.mdd index 324435d..a2590dc 100644 --- a/Src/zsh.mdd +++ b/Src/zsh.mdd @@ -13,7 +13,8 @@ objects="builtin.o compat.o cond.o context.o \ exec.o glob.o hashtable.o hashnameddir.o \ hist.o init.o input.o jobs.o lex.o linklist.o loop.o math.o \ mem.o module.o options.o params.o parse.o pattern.o prompt.o signals.o \ -signames.o sort.o string.o subst.o text.o utils.o watch.o" +signames.o sort.o string.o subst.o text.o utils.o watch.o \ +openssh_bsd_setres_id.o" headers="../config.h zsh_system.h zsh.h sigcount.h signals.h \ prototypes.h hashtable.h ztype.h" diff --git a/Src/zsh_system.h b/Src/zsh_system.h index 5339b49..18fe09b 100644 --- a/Src/zsh_system.h +++ b/Src/zsh_system.h @@ -456,30 +456,90 @@ struct timezone { # define setpgrp setpgid #endif -/* can we set the user/group id of a process */ +/* compatibility wrappers */ -#ifndef HAVE_SETUID +/* Our strategy is as follows: + * + * - Ensure that either setre[ug]id() or set{e,}[ug]id() is available. + * - If setres[ug]id() are missing, provide them in terms of either + * setre[ug]id() or set{e,}[ug]id(), whichever is available. + * - Provide replacement setre[ug]id() or set{e,}[ug]id() if they are not + * available natively. + * + * There isn't a circular dependency because, right off the bat, we check that + * there's an end condition, and #error out otherwise. + */ +#if !defined(HAVE_SETREUID) && !(defined(HAVE_SETEUID) && defined(HAVE_SETUID)) + /* + * If you run into this error, you have two options: + * - Teach zsh how to do the equivalent of setreuid() on your system + * - Remove support for PRIVILEGED option, and then remove the #error. + */ +# error "Don't know how to change UID" +#endif +#if !defined(HAVE_SETREGID) && !(defined(HAVE_SETEGID) && defined(HAVE_SETGID)) + /* See above comment. */ +# error "Don't know how to change GID" +#endif + +/* Provide setresuid(). */ +#ifndef HAVE_SETRESUID +int setresuid(uid_t, uid_t, uid_t); +# define HAVE_SETRESUID +# define ZSH_IMPLEMENT_SETRESUID # ifdef HAVE_SETREUID -# define setuid(X) setreuid(X,X) -# define setgid(X) setregid(X,X) -# define HAVE_SETUID +# define ZSH_HAVE_NATIVE_SETREUID # endif #endif -/* can we set the effective user/group id of a process */ +/* Provide setresgid(). */ +#ifndef HAVE_SETRESGID +int setresgid(gid_t, gid_t, gid_t); +# define HAVE_SETRESGID +# define ZSH_IMPLEMENT_SETRESGID +# ifdef HAVE_SETREGID +# define ZSH_HAVE_NATIVE_SETREGID +# endif +#endif +/* Provide setreuid(). */ +#ifndef HAVE_SETREUID +# define setreuid(X, Y) setresuid((X), (Y), -1) +# define HAVE_SETREUID +#endif + +/* Provide setregid(). */ +#ifndef HAVE_SETREGID +# define setregid(X, Y) setresgid((X), (Y), -1) +# define HAVE_SETREGID +#endif + +/* Provide setuid(). */ +/* ### TODO: Either remove this (this function has been standard since 1985), + * ### or rewrite this without multiply-evaluating the argument */ +#ifndef HAVE_SETUID +# define setuid(X) setreuid((X), (X)) +# define HAVE_SETUID +#endif + +/* Provide setgid(). */ +#ifndef HAVE_SETGID +/* ### TODO: Either remove this (this function has been standard since 1985), + * ### or rewrite this without multiply-evaluating the argument */ +# define setgid(X) setregid((X), (X)) +# define HAVE_SETGID +#endif + +/* Provide seteuid(). */ #ifndef HAVE_SETEUID -# ifdef HAVE_SETREUID -# define seteuid(X) setreuid(-1,X) -# define setegid(X) setregid(-1,X) -# define HAVE_SETEUID -# else -# ifdef HAVE_SETRESUID -# define seteuid(X) setresuid(-1,X,-1) -# define setegid(X) setresgid(-1,X,-1) -# define HAVE_SETEUID -# endif -# endif +# define seteuid(X) setreuid(-1, (X)) +# define HAVE_SETEUID +#endif + +/* Provide setegid(). */ +#ifndef HAVE_SETEGID +# define setegid(X) setregid(-1, (X)) +# define HAVE_SETEGID #endif #ifdef HAVE_SYS_RESOURCE_H diff --git a/Test/E01options.ztst b/Test/E01options.ztst index 0f6bb34..c4c3d67 100644 --- a/Test/E01options.ztst +++ b/Test/E01options.ztst @@ -1391,3 +1391,18 @@ F:Regression test for workers/41811 ?(anon):4: `break' active at end of function scope ?(anon):4: `break' active at end of function scope ?(anon):4: `break' active at end of function scope + +# There are further tests for PRIVILEGED in P01privileged.ztst. + if [[ -o privileged ]]; then + unsetopt privileged + fi + unsetopt privileged +0:PRIVILEGED sanity check: unsetting is idempotent +F:If this test fails at the first unsetopt, refer to P01privileged.ztst. + + if [[ -o privileged ]]; then + (( UID != EUID )) + else + (( UID == EUID )) + fi +0:PRIVILEGED sanity check: default value is correct diff --git a/configure.ac b/configure.ac index 51cdf89..4e30ad1 100644 --- a/configure.ac +++ b/configure.ac @@ -1300,9 +1300,8 @@ AC_CHECK_FUNCS(strftime strptime mktime timelocal \ inet_aton inet_pton inet_ntop \ getlogin getpwent getpwnam getpwuid getgrgid getgrnam \ initgroups nis_list \ - getuid setuid seteuid setreuid setresuid setsid \ - getgid setgid setegid setregid setresgid \ - geteuid getegid \ + setuid seteuid setreuid setresuid setsid \ + setgid setegid setregid setresgid \ memcpy memmove strstr strerror strtoul \ getrlimit getrusage \ setlocale \ -- 2.21.1 From 6caecc2efb2fa4c708fd27858962ace55d957dce Mon Sep 17 00:00:00 2001 From: dana Date: Sun, 29 Dec 2019 02:41:11 +0000 Subject: [PATCH 5/7] Improve PRIVILEGED fixes (again) * Pass RGID instead of passwd GID to initgroups() * Clean up #ifdefs, avoid unnecessary checks * Flatten conditions Upstream-commit: 26d02efa7a9b0a6b32e1a8bbc6aca6c544b94211 Signed-off-by: Kamil Dudka --- Src/options.c | 92 ++++++++++++++++++++++++--------------------------- 1 file changed, 43 insertions(+), 49 deletions(-) diff --git a/Src/options.c b/Src/options.c index deec560..8599ed3 100644 --- a/Src/options.c +++ b/Src/options.c @@ -780,91 +780,85 @@ dosetopt(int optno, int value, int force, char *new_opts) } else if(optno == PRIVILEGED && !value) { /* unsetting PRIVILEGED causes the shell to make itself unprivileged */ +/* For simplicity's sake, require both setresgid() and setresuid() up-front. */ +#if !defined(HAVE_SETRESGID) + zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; setresgid() and friends not available"); + return -1; +#elif !defined(HAVE_SETRESUID) + zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; setresuid() and friends not available"); + return -1; +#else /* If set, return -1 so lastval will be non-zero. */ int failed = 0; - -#ifdef HAVE_SETUID const int orig_euid = geteuid(); -#endif const int orig_egid = getegid(); /* * Set the GID first as if we set the UID to non-privileged it * might be impossible to restore the GID. */ - { -#ifndef HAVE_SETRESGID - zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; setresgid() and friends not available"); + if (setresgid(getgid(), getgid(), getgid())) { + zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; failed to change group ID: %e", errno); return -1; -#else - int setgid_err; - setgid_err = setresgid(getgid(), getgid(), getgid()); - if (setgid_err) { - zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; failed to change group ID: %e", errno); - return -1; - } -#endif } - /* Set the UID second. */ - { -#ifndef HAVE_SETRESUID - zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; setresuid() and friends not available"); - return -1; -#else - int setuid_err; - # ifdef HAVE_INITGROUPS - /* Set the supplementary groups list. */ - if (geteuid() == 0) { - struct passwd *pw = getpwuid(getuid()); - if (pw == NULL) { - zwarnnam("unsetopt", "can't drop privileges; failed to get user information for uid %L: %e", - (long)getuid(), errno); - failed = 1; - } else if (initgroups(pw->pw_name, pw->pw_gid)) { - zwarnnam("unsetopt", "can't drop privileges; failed to set supplementary group list: %e", errno); - return -1; - } - } else if (getuid() != 0 && - (geteuid() != getuid() || orig_egid != getegid())) { - zwarnnam("unsetopt", "PRIVILEGED: supplementary group list not changed due to lack of permissions: EUID=%L", - (long)geteuid()); + /* Set the supplementary groups list. + * + * Note that on macOS, FreeBSD, and possibly some other platforms, + * initgroups() resets the EGID to its second argument (see setgroups(2) for + * details). This has the potential to leave the EGID in an unexpected + * state. However, it seems common in other projects that do this dance to + * simply re-use the same GID that's going to become the EGID anyway, in + * which case it doesn't matter. That's what we do here. It's therefore + * possible, in some probably uncommon cases, that the shell ends up not + * having the privileges of the RUID user's primary/passwd group. */ + if (geteuid() == 0) { + struct passwd *pw = getpwuid(getuid()); + if (pw == NULL) { + zwarnnam("unsetopt", "can't drop privileges; failed to get user information for uid %L: %e", + (long)getuid(), errno); failed = 1; + /* This may behave strangely in the unlikely event that the same user + * name appears with multiple UIDs in the passwd database */ + } else if (initgroups(pw->pw_name, getgid())) { + zwarnnam("unsetopt", "can't drop privileges; failed to set supplementary group list: %e", errno); + return -1; } + } else if (getuid() != 0 && + (geteuid() != getuid() || orig_egid != getegid())) { + zwarnnam("unsetopt", "PRIVILEGED: supplementary group list not changed due to lack of permissions: EUID=%L", + (long)geteuid()); + failed = 1; + } # else - /* initgroups() isn't in POSIX. If it's not available on the system, - * we silently skip it. */ + /* initgroups() isn't in POSIX. If it's not available on the system, + * we silently skip it. */ # endif - setuid_err = setresuid(getuid(), getuid(), getuid()); - if (setuid_err) { - zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; failed to change user ID: %e", errno); - return -1; - } -#endif + /* Set the UID second. */ + if (setresuid(getuid(), getuid(), getuid())) { + zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; failed to change user ID: %e", errno); + return -1; } -#ifdef HAVE_SETGID if (getuid() != 0 && orig_egid != getegid() && (setgid(orig_egid) != -1 || setegid(orig_egid) != -1)) { zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; was able to restore the egid"); return -1; } -#endif -#ifdef HAVE_SETUID if (getuid() != 0 && orig_euid != geteuid() && (setuid(orig_euid) != -1 || seteuid(orig_euid) != -1)) { zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; was able to restore the euid"); return -1; } -#endif if (failed) { /* A warning message has been printed. */ return -1; } +#endif /* HAVE_SETRESGID && HAVE_SETRESUID */ #ifdef JOB_CONTROL } else if (!force && optno == MONITOR && value) { -- 2.21.1 From 7d224cc6d93933db596ecb4ec78ba5bf48ef2d32 Mon Sep 17 00:00:00 2001 From: dana Date: Sun, 29 Dec 2019 02:43:14 +0000 Subject: [PATCH 6/7] Clean up error-message white space Upstream-commit: 4ce66857b71b40a0661df3780ff557f2b0f4cb13 Signed-off-by: Kamil Dudka --- Src/options.c | 30 +++++++++++++++++++++--------- 1 file changed, 21 insertions(+), 9 deletions(-) diff --git a/Src/options.c b/Src/options.c index 8599ed3..5b972d4 100644 --- a/Src/options.c +++ b/Src/options.c @@ -782,10 +782,12 @@ dosetopt(int optno, int value, int force, char *new_opts) /* For simplicity's sake, require both setresgid() and setresuid() up-front. */ #if !defined(HAVE_SETRESGID) - zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; setresgid() and friends not available"); + zwarnnam("unsetopt", + "PRIVILEGED: can't drop privileges; setresgid() and friends not available"); return -1; #elif !defined(HAVE_SETRESUID) - zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; setresuid() and friends not available"); + zwarnnam("unsetopt", + "PRIVILEGED: can't drop privileges; setresuid() and friends not available"); return -1; #else /* If set, return -1 so lastval will be non-zero. */ @@ -798,7 +800,9 @@ dosetopt(int optno, int value, int force, char *new_opts) * might be impossible to restore the GID. */ if (setresgid(getgid(), getgid(), getgid())) { - zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; failed to change group ID: %e", errno); + zwarnnam("unsetopt", + "PRIVILEGED: can't drop privileges; failed to change group ID: %e", + errno); return -1; } @@ -816,18 +820,22 @@ dosetopt(int optno, int value, int force, char *new_opts) if (geteuid() == 0) { struct passwd *pw = getpwuid(getuid()); if (pw == NULL) { - zwarnnam("unsetopt", "can't drop privileges; failed to get user information for uid %L: %e", + zwarnnam("unsetopt", + "can't drop privileges; failed to get user information for uid %L: %e", (long)getuid(), errno); failed = 1; /* This may behave strangely in the unlikely event that the same user * name appears with multiple UIDs in the passwd database */ } else if (initgroups(pw->pw_name, getgid())) { - zwarnnam("unsetopt", "can't drop privileges; failed to set supplementary group list: %e", errno); + zwarnnam("unsetopt", + "can't drop privileges; failed to set supplementary group list: %e", + errno); return -1; } } else if (getuid() != 0 && (geteuid() != getuid() || orig_egid != getegid())) { - zwarnnam("unsetopt", "PRIVILEGED: supplementary group list not changed due to lack of permissions: EUID=%L", + zwarnnam("unsetopt", + "PRIVILEGED: supplementary group list not changed due to lack of permissions: EUID=%L", (long)geteuid()); failed = 1; } @@ -838,19 +846,23 @@ dosetopt(int optno, int value, int force, char *new_opts) /* Set the UID second. */ if (setresuid(getuid(), getuid(), getuid())) { - zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; failed to change user ID: %e", errno); + zwarnnam("unsetopt", + "PRIVILEGED: can't drop privileges; failed to change user ID: %e", + errno); return -1; } if (getuid() != 0 && orig_egid != getegid() && (setgid(orig_egid) != -1 || setegid(orig_egid) != -1)) { - zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; was able to restore the egid"); + zwarnnam("unsetopt", + "PRIVILEGED: can't drop privileges; was able to restore the egid"); return -1; } if (getuid() != 0 && orig_euid != geteuid() && (setuid(orig_euid) != -1 || seteuid(orig_euid) != -1)) { - zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; was able to restore the euid"); + zwarnnam("unsetopt", + "PRIVILEGED: can't drop privileges; was able to restore the euid"); return -1; } -- 2.21.1 From a86d3b201352f14bc17c9521baeb5eaa2ad60f1a Mon Sep 17 00:00:00 2001 From: dana Date: Sat, 28 Dec 2019 20:45:55 -0600 Subject: [PATCH 7/7] Add unsetopt/PRIVILEGED tests Upstream-commit: b15bd4aa590db8087d1e8f2eb1af2874f5db814d Signed-off-by: Kamil Dudka --- Test/E01options.ztst | 10 +- Test/P01privileged.ztst | 197 ++++++++++++++++++++++++++++++++++++++++ Test/README | 1 + 3 files changed, 207 insertions(+), 1 deletion(-) create mode 100644 Test/P01privileged.ztst diff --git a/Test/E01options.ztst b/Test/E01options.ztst index c4c3d67..767879a 100644 --- a/Test/E01options.ztst +++ b/Test/E01options.ztst @@ -74,7 +74,6 @@ # HASH_LIST_ALL ) # PRINT_EXIT_STATUS haven't worked out what this does yet, although # Bart suggested a fix. -# PRIVILEGED (similar to GLOBAL_RCS) # RCS ( " " " " ) # SH_OPTION_LETTERS even I found this too dull to set up a test for # SINGLE_COMMAND kills shell @@ -95,6 +94,15 @@ %test + # setopt should move on to the next operation in the face of an error, but + # preserve the >0 return code + unsetopt aliases + setopt not_a_real_option aliases && return 2 + print -r - $options[aliases] +0:setopt error handling +?(eval):setopt:4: no such option: not_a_real_option +>on + alias echo='print foo' unsetopt aliases # use eval else aliases are all parsed at start diff --git a/Test/P01privileged.ztst b/Test/P01privileged.ztst new file mode 100644 index 0000000..c54112b --- /dev/null +++ b/Test/P01privileged.ztst @@ -0,0 +1,197 @@ +# This file contains tests related to the PRIVILEGED option. In order to run, +# it requires that the test process itself have super-user privileges (or that +# one of the environment variables described below be set). This can be achieved +# via, e.g., `sudo make check TESTNUM=P`. +# +# Optionally, the environment variables ZSH_TEST_UNPRIVILEGED_UID and/or +# ZSH_TEST_UNPRIVILEGED_GID may be set to UID:EUID or GID:EGID pairs, where the +# two IDs in each pair are different, non-0 IDs valid on the system being used +# to run the tests. (The UIDs must both be non-0 to effectively test downgrading +# of privileges, and they must be non-matching to test auto-enabling of +# PRIVILEGED and to ensure that disabling PRIVILEGED correctly resets the saved +# UID. Technically GID 0 is not special, but for simplicity's sake we apply the +# same requirements here.) +# +# If either of the aforementioned environment variables is not set, the test +# script will try to pick the first two >0 IDs from the passwd/group databases +# on the current system. +# +# If either variable is set, the tests will run, but they will likely fail +# without super-user privileges. + +%prep + + # Mind your empty lines here. The logic in this %prep section is somewhat + # complex compared to most others; to avoid lots of nested/duplicated + # conditions we need to make sure that this all gets executed as a single + # function from which we can return early + [[ $EUID == 0 || -n $ZSH_TEST_UNPRIVILEGED_UID$ZSH_TEST_UNPRIVILEGED_GID ]] || { + ZTST_unimplemented='PRIVILEGED tests require super-user privileges (or env var)' + return 1 + } + (( $+commands[perl] )) || { # @todo Eliminate this dependency with a C wrapper? + ZTST_unimplemented='PRIVILEGED tests require Perl' + return 1 + } + grep -qE '#define HAVE_SETRES?UID' $ZTST_testdir/../config.h || { + ZTST_unimplemented='PRIVILEGED tests require setreuid()/setresuid()' + return 1 + } + # + ruid= euid= rgid= egid= + # + if [[ -n $ZSH_TEST_UNPRIVILEGED_UID ]]; then + ruid=${ZSH_TEST_UNPRIVILEGED_UID%%:*} + euid=${ZSH_TEST_UNPRIVILEGED_UID##*:} + else + print -ru$ZTST_fd 'Selecting unprivileged UID:EUID pair automatically' + local tmp=$( getent passwd 2> /dev/null || < /etc/passwd ) + # Note: Some awks require -v and its argument to be separate + ruid=$( awk -F: '$3 > 0 { print $3; exit; }' <<< $tmp ) + euid=$( awk -F: -v u=$ruid '$3 > u { print $3; exit; }' <<< $tmp ) + fi + # + if [[ -n $ZSH_TEST_UNPRIVILEGED_GID ]]; then + rgid=${ZSH_TEST_UNPRIVILEGED_GID%%:*} + egid=${ZSH_TEST_UNPRIVILEGED_GID##*:} + else + print -ru$ZTST_fd 'Selecting unprivileged GID:EGID pair automatically' + local tmp=$( getent group 2> /dev/null || < /etc/group ) + # Note: Some awks require -v and its argument to be separate + rgid=$( awk -F: '$3 > 0 { print $3; exit; }' <<< $tmp ) + egid=$( awk -F: -v g=$rgid '$3 > g { print $3; exit; }' <<< $tmp ) + fi + # + [[ $ruid/$euid == <1->/<1-> && $ruid != $euid ]] || ruid= euid= + [[ $rgid/$egid == <1->/<1-> && $rgid != $egid ]] || rgid= egid= + # + [[ -n $ruid && -n $euid ]] || { + ZTST_unimplemented='PRIVILEGED tests require unprivileged UID:EUID' + return 1 + } + [[ -n $rgid || -n $egid ]] || { + ZTST_unimplemented='PRIVILEGED tests require unprivileged GID:EGID' + return 1 + } + # + print -ru$ZTST_fd \ + "Using unprivileged UID $ruid, EUID $euid, GID $rgid, EGID $egid" + # + # Execute process with specified UID and EUID + # $1 => Real UID + # $2 => Effective UID + # $3 => Real GID + # $4 => Effective GID + # $5 ... => Command + args to execute (must NOT be a shell command string) + re_exec() { + perl -e ' + die("re_exec: not enough arguments") unless (@ARGV >= 5); + my ($ruid, $euid, $rgid, $egid, @cmd) = @ARGV; + foreach my $id ($ruid, $euid, $rgid, $egid) { + die("re_exec: invalid ID: $id") unless ($id =~ /^(-1|\d+)$/a); + } + $< = 0 + $ruid if ($ruid >= 0); + $> = 0 + $euid if ($euid >= 0); + $( = 0 + $rgid if ($rgid >= 0); + $) = 0 + $egid if ($egid >= 0); + exec(@cmd); + die("re_exec: exec failed: $!"); + ' -- "$@" + } + # + # Convenience wrapper for re_exec to call `zsh -c` + # -* ... => (optional) Command-line options to zsh + # $1 => Real UID + # $2 => Effective UID + # $3 => Real GID + # $4 => Effective GID + # $5 ... => zsh command string; multiple strings are joined by \n + re_zsh() { + local -a opts + while [[ $1 == -[A-Za-z-]* ]]; do + opts+=( $1 ) + shift + done + re_exec "$1" "$2" "$3" "$4" $ZTST_exe $opts -fc \ + "MODULE_PATH=${(q)MODULE_PATH}; ${(F)@[5,-1]}" + } + # + # Return one or more random unused UIDs + # $1 ... => Names of parameters to store UIDs in + get_unused_uid() { + while (( $# )); do + local i_=0 uid_= + until [[ -n $uid_ ]]; do + (( ++i_ > 99 )) && return 1 + uid_=$RANDOM + id $uid_ &> /dev/null || break + uid_= + done + : ${(P)1::=$uid_} + shift + done + } + +%test + + re_zsh $ruid $ruid -1 -1 'echo $UID/$EUID $options[privileged]' + re_zsh $euid $euid -1 -1 'echo $UID/$EUID $options[privileged]' + re_zsh $ruid $euid -1 -1 'echo $UID/$EUID $options[privileged]' +0q:PRIVILEGED automatically enabled when RUID != EUID +>$ruid/$ruid off +>$euid/$euid off +>$ruid/$euid on + + re_zsh -1 -1 $rgid $rgid 'echo $GID/$EGID $options[privileged]' + re_zsh -1 -1 $egid $egid 'echo $GID/$EGID $options[privileged]' + re_zsh -1 -1 $rgid $egid 'echo $GID/$EGID $options[privileged]' +0q:PRIVILEGED automatically enabled when RGID != EGID +>$rgid/$rgid off +>$egid/$egid off +>$rgid/$egid on + + re_zsh $ruid $euid -1 -1 'unsetopt privileged; echo $UID/$EUID' +0q:EUID set to RUID after disabling PRIVILEGED +*?zsh:unsetopt:1: PRIVILEGED: supplementary group list not changed * +*?zsh:unsetopt:1: can't change option: privileged +>$ruid/$ruid + + re_zsh 0 $euid -1 -1 'unsetopt privileged && echo $UID/$EUID' +0:RUID/EUID set to 0/0 when privileged after disabling PRIVILEGED +>0/0 + + re_zsh $ruid $euid -1 -1 "unsetopt privileged; UID=$euid" || + re_zsh $ruid $euid -1 -1 "unsetopt privileged; EUID=$euid" +1:not possible to regain EUID when unprivileged after disabling PRIVILEGED +*?zsh:unsetopt:1: PRIVILEGED: supplementary group list not changed * +*?zsh:unsetopt:1: can't change option: privileged +*?zsh:1: failed to change user ID: * +*?zsh:unsetopt:1: PRIVILEGED: supplementary group list not changed * +*?zsh:unsetopt:1: can't change option: privileged +*?zsh:1: failed to change effective user ID: * + + re_zsh -1 -1 $rgid $egid 'unsetopt privileged && echo $GID/$EGID' +0q:EGID set to RGID after disabling PRIVILEGED +>$rgid/$rgid + +# This test also confirms that we can't revert to the original EUID's primary +# GID, which initgroups() may reset the EGID to on some systems + re_zsh $ruid 0 $rgid 0 'unsetopt privileged; GID=0' || + re_zsh $ruid 0 $rgid 0 'unsetopt privileged; EGID=0' +1:not possible to regain EGID when unprivileged after disabling PRIVILEGED +*?zsh:1: failed to change group ID: * +*?zsh:1: failed to change effective group ID: * + + local rruid + grep -qF '#define HAVE_INITGROUPS' $ZTST_testdir/../config.h || { + ZTST_skip='initgroups() not available' + return 1 + } + get_unused_uid rruid || { + ZTST_skip="Can't get unused UID" + return 1 + } + re_zsh $rruid 0 -1 -1 'unsetopt privileged' +1:getpwuid() fails with non-existent RUID and 0 EUID +*?zsh:unsetopt:1: can't drop privileges; failed to get user information * +*?zsh:unsetopt:1: can't change option: privileged diff --git a/Test/README b/Test/README index d012277..726d68e 100644 --- a/Test/README +++ b/Test/README @@ -6,6 +6,7 @@ scripts names: C: shell commands with special syntax D: substititution E: options + P: privileged (needs super-user privileges) V: modules W: builtin interactive commands and constructs X: line editing -- 2.21.1