internal uid/gid tracking. permit can not detach systrace, useful for

sshd.

6 files changed, 81 insertions, 16 deletions

diff --git a/bin/systrace/intercept.c b/bin/systrace/intercept.c
index 44c2accf41e..4dcfb126a39 100644
--- a/bin/systrace/intercept.c
+++ b/bin/systrace/intercept.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: intercept.c,v 1.15 2002/07/12 12:26:29 provos Exp $	*/
+/*	$OpenBSD: intercept.c,v 1.16 2002/07/16 01:22:48 provos Exp $	*/
 /*
  * Copyright 2002 Niels Provos <provos@citi.umich.edu>
  * All rights reserved.
@@ -223,6 +223,7 @@ sigusr1_handler(int signum)
 pid_t
 intercept_run(int bg, int fd, char *path, char *const argv[])
 {
+	struct intercept_pid *icpid;
 	sigset_t none, set, oset;
 	sig_t ohandler;
 	pid_t pid, cpid;
@@ -283,6 +284,14 @@ intercept_run(int bg, int fd, char *path, char *const argv[])
 	/* Choose the pid of the systraced process */
 	pid = bg ? pid : cpid;
 
+	if ((icpid = intercept_getpid(pid)) == NULL)
+		err(1, "intercept_getpid");
+	
+	/* Set uid and gid information */
+	icpid->uid = getuid();
+	icpid->gid = getgid();
+	icpid->flags |= ICFLAGS_UIDKNOWN | ICFLAGS_GIDKNOWN;
+	
 	/* Setup done, restore signal handling state */
 	if (signal(SIGUSR1, ohandler) == SIG_ERR) {
 		kill(pid, SIGKILL);
@@ -568,6 +577,8 @@ intercept_syscall(int fd, pid_t pid, int policynr, char *name, int code,
 
 		/* We need to know the result from this system call */
 		flags = ICFLAGS_RESULT;
+	} else if (!strcmp(name, "setuid") || !strcmp(name, "setgid")) {
+		flags = ICFLAGS_RESULT;
 	}
 
 	sc = intercept_sccb_find(emulation, name);
@@ -602,12 +613,13 @@ intercept_syscall_result(int fd, pid_t pid, int policynr,
 {
 	struct intercept_pid *icpid;
 
+	if (result)
+		goto out;
+
+	icpid = intercept_getpid(pid);
 	if (!strcmp("execve", name)) {
-		if (result)
-			goto out;
 
 		/* Commit the name of the new image */
-		icpid = intercept_getpid(pid);
 		if (icpid->name)
 			free(icpid->name);
 		icpid->name = icpid->newname;
@@ -617,6 +629,12 @@ intercept_syscall_result(int fd, pid_t pid, int policynr,
 			(*intercept_newimagecb)(fd, pid, policynr, emulation,
 			    icpid->name, intercept_newimagecbarg);
 
+	} else if (!strcmp("setuid", name)) {
+		intercept.getarg(0, args, argsize, (void **)&icpid->uid);
+		icpid->flags |= ICFLAGS_UIDKNOWN;
+	} else if (!strcmp("setgid", name)) {
+		intercept.getarg(0, args, argsize, (void **)&icpid->gid);
+		icpid->flags |= ICFLAGS_GIDKNOWN;
 	}
  out:
 	/* Resume execution of the process */
@@ -677,6 +695,11 @@ intercept_child_info(pid_t opid, pid_t npid)
 			err(1, "%s:%d: strdup", __func__, __LINE__);
 	}
 
+	/* Copy some information */
+	inpid->flags = ipid->flags;
+	inpid->uid = ipid->uid;
+	inpid->gid = ipid->gid;
+
 	/* XXX - keeps track of emulation */
 	intercept.clonepid(ipid, inpid);
 }
diff --git a/bin/systrace/intercept.h b/bin/systrace/intercept.h
index 137ba307c9d..2c1fb96421b 100644
--- a/bin/systrace/intercept.h
+++ b/bin/systrace/intercept.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: intercept.h,v 1.6 2002/07/12 12:26:29 provos Exp $	*/
+/*	$OpenBSD: intercept.h,v 1.7 2002/07/16 01:22:48 provos Exp $	*/
 /*
  * Copyright 2002 Niels Provos <provos@citi.umich.edu>
  * All rights reserved.
@@ -75,8 +75,15 @@ struct intercept_pid {
 	short policynr;
 	int execve_code;
 	short execve_policy;
-	char *name;
-	char *newname;
+	char *name;		/* name of current process image */
+	char *newname;		/* image name to be committed by execve */
+
+#define ICFLAGS_UIDKNOWN	0x01
+#define ICFLAGS_GIDKNOWN	0x02
+	int flags;
+
+	uid_t uid;		/* current uid */
+	gid_t gid;		/* current gid */
 
 	void *data;
 
diff --git a/bin/systrace/parse.y b/bin/systrace/parse.y
index d95d47f490d..a7bb313dce6 100644
--- a/bin/systrace/parse.y
+++ b/bin/systrace/parse.y
@@ -1,4 +1,4 @@
-/*	$OpenBSD: parse.y,v 1.4 2002/06/05 17:22:38 mickey Exp $	*/
+/*	$OpenBSD: parse.y,v 1.5 2002/07/16 01:22:48 provos Exp $	*/
 
 /*
  * Copyright 2002 Niels Provos <provos@citi.umich.edu>
@@ -103,6 +103,10 @@ fullexpression	: expression THEN action errorcode
 				break;
 			if (!strcasecmp($4, "inherit"))
 				flags = PROCESS_INHERIT_POLICY;
+			else if (!strcasecmp($4, "detach"))
+				flags = PROCESS_DETACH;
+			else
+				yyerror("Unknown flag: %s", $4);
 			break;
 		}
 
diff --git a/bin/systrace/systrace.1 b/bin/systrace/systrace.1
index e28abe64c31..741a8e812c0 100644
--- a/bin/systrace/systrace.1
+++ b/bin/systrace/systrace.1
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: systrace.1,v 1.21 2002/07/09 15:22:27 provos Exp $
+.\"	$OpenBSD: systrace.1,v 1.22 2002/07/16 01:22:48 provos Exp $
 .\"
 .\" Copyright 2002 Niels Provos <provos@citi.umich.edu>
 .\" All rights reserved.
@@ -63,7 +63,15 @@ Automatically generate a policy that allows every operation the
 application executes.
 The created policy functions as a base that can be refined.
 .It Fl u
-Do not perform aliasing on system call names.
+Do not perform aliasing on system call names.  Aliasing is enabled
+by default to group similar system calls into a single compound
+name.  For example, system calls that read from the file system
+like
+.Fn lstat
+and
+.Fn access
+are translated to
+.Fn fsread .
 .It Fl i
 Inherits the policy of the first executed binary to all children.
 .It Fl t
@@ -110,16 +118,33 @@ is used to return an
 .Xr errno 2
 value to the system call when using a
 .Va deny
-action.  The value
+action.  The values
 .Do
 inherit
 .Dc
-has a special meaning when used with a
+and
+.Do
+detach
+.Dc
+have special meanings when used with a
 .Va permit
 rule for the
 .Va execve
 system call.
-In that case, the current policy is inherited for the new binary.
+When using
+.Do
+inherit,
+.Dc
+the current policy is inherited for the new binary.
+With
+.Do
+detach,
+.Dc
+systrace detaches from a process after successfully
+completing
+the
+.Va execve
+system call.
 .Pp
 The filter operations have the following meaning:
 .Bl -hang -width Dinpath -offset AAA
diff --git a/bin/systrace/systrace.c b/bin/systrace/systrace.c
index cd0b4830a40..a6610531283 100644
--- a/bin/systrace/systrace.c
+++ b/bin/systrace/systrace.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: systrace.c,v 1.26 2002/07/12 12:26:29 provos Exp $	*/
+/*	$OpenBSD: systrace.c,v 1.27 2002/07/16 01:22:48 provos Exp $	*/
 /*
  * Copyright 2002 Niels Provos <provos@citi.umich.edu>
  * All rights reserved.
@@ -254,10 +254,15 @@ execres_cb(int fd, pid_t pid, int policynr, char *emulation, char *name, void *a
 	if (policynr != -1) {
 		struct intercept_pid *ipid;
 
+		ipid = intercept_getpid(pid);
+		if (ipid->uflags & PROCESS_DETACH) {
+			if (intercept_detach(fd, pid) == -1)
+				err(1, "%s: intercept_detach", __func__);
+			return;
+		}
 		if (inherit)
 			return;
 
-		ipid = intercept_getpid(pid);
 		if (ipid->uflags & PROCESS_INHERIT_POLICY)
 			return;
 	}
diff --git a/bin/systrace/systrace.h b/bin/systrace/systrace.h
index 423af432b11..b4ed66f0519 100644
--- a/bin/systrace/systrace.h
+++ b/bin/systrace/systrace.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: systrace.h,v 1.9 2002/07/14 22:34:55 provos Exp $	*/
+/*	$OpenBSD: systrace.h,v 1.10 2002/07/16 01:22:48 provos Exp $	*/
 /*
  * Copyright 2002 Niels Provos <provos@citi.umich.edu>
  * All rights reserved.
@@ -97,6 +97,7 @@ struct policy {
 #define POLICY_CHANGED		0x04
 
 #define PROCESS_INHERIT_POLICY	0x01	/* Process inherits policy */
+#define PROCESS_DETACH		0x02	/* Process gets detached */
 
 int systrace_initpolicy(char *);
 void systrace_initcb(void);