1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
|
/*
* Copyright (c) 2021, Jesse Buhagiar <jooster669@gmail.com>
* Copyright (c) 2021, Andreas Kling <kling@serenityos.org>
*
* SPDX-License-Identifier: BSD-2-Clause
*/
#include <AK/ScopeGuard.h>
#include <LibCore/Account.h>
#include <LibCore/ArgsParser.h>
#include <LibCore/GetPassword.h>
#include <stdio.h>
#include <unistd.h>
int main(int argc, char** argv)
{
Vector<char const*> command;
Core::ArgsParser args_parser;
uid_t as_user_uid = 0;
args_parser.add_option(as_user_uid, "User to execute as", nullptr, 'u', "UID");
args_parser.add_positional_argument(command, "Command to run at elevated privilege level", "command");
args_parser.parse(argc, argv);
if (pledge("stdio rpath exec id tty", nullptr) < 0) {
perror("pledge");
return 1;
}
if (seteuid(0) < 0) {
perror("seteuid");
return 1;
}
// Fail gracefully if as_user_uid is invalid
auto as_user_or_error = Core::Account::from_uid(as_user_uid);
if (as_user_or_error.is_error()) {
warnln("{}", as_user_or_error.error());
return 1;
}
// If the current user is not a superuser, make them authenticate themselves.
if (auto uid = getuid()) {
auto account_or_error = Core::Account::from_uid(uid);
if (account_or_error.is_error()) {
warnln("{}", account_or_error.error());
return 1;
}
auto const& account = account_or_error.value();
if (account.has_password()) {
auto password_or_error = Core::get_password();
if (password_or_error.is_error()) {
warnln("{}", password_or_error.error());
return 1;
}
auto const& password = password_or_error.value();
if (!account.authenticate(password)) {
warnln("Incorrect or disabled password.");
return 1;
}
}
}
if (pledge("stdio rpath exec id", nullptr) < 0) {
perror("pledge");
return 1;
}
if (setgid(0) < 0) {
perror("setgid");
return 1;
}
if (setuid(as_user_uid) < 0) {
perror("setuid");
return 1;
}
if (pledge("stdio rpath exec", nullptr) < 0) {
perror("pledge");
return 1;
}
Vector<char const*> arguments;
for (auto const& arg : command)
arguments.append(arg);
arguments.append(nullptr);
Vector<String> environment_strings;
if (auto* term = getenv("TERM"))
environment_strings.append(String::formatted("TERM={}", term));
Vector<char const*> environment;
for (auto& item : environment_strings)
environment.append(item.characters());
environment.append(nullptr);
if (execvpe(command.at(0), const_cast<char**>(arguments.data()), const_cast<char**>(environment.data())) < 0) {
perror("execvpe");
exit(1);
}
return 0;
}
|
