Bypass authentication and create no session for root

ok deraadt

2 files changed, 18 insertions, 4 deletions

diff --git a/usr.bin/sndiod/sock.c b/usr.bin/sndiod/sock.c
index be38edaa71f..fb50a4bd99a 100644
--- a/usr.bin/sndiod/sock.c
+++ b/usr.bin/sndiod/sock.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sock.c,v 1.34 2020/04/25 05:03:54 ratchov Exp $	*/
+/*	$OpenBSD: sock.c,v 1.35 2020/04/26 14:13:22 ratchov Exp $	*/
 /*
  * Copyright (c) 2008-2012 Alexandre Ratchov <alex@caoua.org>
  *
@@ -15,6 +15,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 #include <sys/types.h>
+#include <sys/socket.h>
 #include <netinet/in.h>
 #include <errno.h>
 #include <poll.h>
@@ -150,7 +151,7 @@ sock_close(struct sock *f)
 	}
 #endif
 	if (f->pstate > SOCK_AUTH)
-		sock_sesrefs--;
+		sock_sesrefs -= f->sesrefs;
 	if (f->slot) {
 		slot_del(f->slot);
 		f->slot = NULL;
@@ -787,15 +788,27 @@ int
 sock_auth(struct sock *f)
 {
 	struct amsg_auth *p = &f->rmsg.u.auth;
+	uid_t euid;
+	gid_t egid;
+
+	/*
+	 * root bypasses any authenication checks and has no session
+	 */
+	if (getpeereid(f->fd, &euid, &egid) == 0 && euid == 0) {
+		f->pstate = SOCK_HELLO;
+		f->sesrefs = 0;
+		return 1;
+	}
 
 	if (sock_sesrefs == 0) {
 		/* start a new session */
 		memcpy(sock_sescookie, p->cookie, AMSG_COOKIELEN);
+		f->sesrefs = 1;
 	} else if (memcmp(sock_sescookie, p->cookie, AMSG_COOKIELEN) != 0) {
 		/* another session is active, drop connection */
 		return 0;
 	}
-	sock_sesrefs++;
+	sock_sesrefs += f->sesrefs;
 	f->pstate = SOCK_HELLO;
 	return 1;
 }
diff --git a/usr.bin/sndiod/sock.h b/usr.bin/sndiod/sock.h
index 5c50412a101..91f3f2dfd9b 100644
--- a/usr.bin/sndiod/sock.h
+++ b/usr.bin/sndiod/sock.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sock.h,v 1.6 2020/02/26 13:53:58 ratchov Exp $	*/
+/*	$OpenBSD: sock.h,v 1.7 2020/04/26 14:13:22 ratchov Exp $	*/
 /*
  * Copyright (c) 2008-2012 Alexandre Ratchov <alex@caoua.org>
  *
@@ -64,6 +64,7 @@ struct sock {
 #define SOCK_CTLVAL	2		/* send value changes */
 	unsigned int ctlops;		/* bitmap of above */
 	int ctlsyncpending;		/* CTLSYNC waiting to be transmitted */
+	unsigned int sesrefs;		/* 1 if socket belongs to a session */
 };
 
 struct sock *sock_new(int fd);