Skip to content

Commit 301dfb9

Browse files
yosuke-wolfsslyosuke-wolfssl
committed
wolfsshd: fail closed when a per-connection privilege drop fails
1 parent 422f69d commit 301dfb9

1 file changed

Lines changed: 38 additions & 59 deletions

File tree

‎apps/wolfsshd/wolfsshd.c‎

Lines changed: 38 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -595,12 +595,10 @@ static int SCP_Subsystem(WOLFSSHD_CONNECTION* conn, WOLFSSH* ssh,
595595
if (wolfSSHD_AuthReducePermissionsUser(conn->auth, pPasswd->pw_uid,
596596
pPasswd->pw_gid) != WS_SUCCESS) {
597597
wolfSSH_Log(WS_LOG_ERROR, "[SSHD] Error setting user ID");
598-
if (wolfSSHD_AuthReducePermissions(conn->auth) != WS_SUCCESS) {
599-
/* stop everything if not able to reduce permissions level */
600-
exit(1);
601-
}
602-
603-
return WS_FATAL_ERROR;
598+
/* could not drop to the authenticated user; terminate the
599+
* per-connection process rather than continue at a higher
600+
* privilege level */
601+
exit(1);
604602
}
605603
#else
606604
/* impersonate the logged on user for file permissions */
@@ -714,12 +712,10 @@ static int SFTP_Subsystem(WOLFSSHD_CONNECTION* conn, WOLFSSH* ssh,
714712
if (wolfSSHD_AuthReducePermissionsUser(conn->auth, pPasswd->pw_uid,
715713
pPasswd->pw_gid) != WS_SUCCESS) {
716714
wolfSSH_Log(WS_LOG_ERROR, "[SSHD] Error setting user ID");
717-
if (wolfSSHD_AuthReducePermissions(conn->auth) != WS_SUCCESS) {
718-
/* stop everything if not able to reduce permissions level */
719-
exit(1);
720-
}
721-
722-
return WS_FATAL_ERROR;
715+
/* could not drop to the authenticated user; terminate the
716+
* per-connection process rather than continue at a higher
717+
* privilege level */
718+
exit(1);
723719
}
724720
#else
725721
char r[MAX_PATH];
@@ -1424,77 +1420,60 @@ static int SHELL_Subsystem(WOLFSSHD_CONNECTION* conn, WOLFSSH* ssh,
14241420
if (dup2(stdinPipe[0], STDIN_FILENO) == -1) {
14251421
wolfSSH_Log(WS_LOG_ERROR,
14261422
"[SSHD] Error redirecting stdin pipe");
1427-
if (wolfSSHD_AuthReducePermissions(conn->auth) != WS_SUCCESS) {
1428-
exit(1);
1429-
}
1430-
1431-
return WS_FATAL_ERROR;
1423+
/* exit rather than return into the connection handler
1424+
* while still at a raised privilege level */
1425+
exit(1);
14321426
}
14331427
if (dup2(stdoutPipe[1], STDOUT_FILENO) == -1) {
14341428
wolfSSH_Log(WS_LOG_ERROR,
14351429
"[SSHD] Error redirecting stdout pipe");
1436-
if (wolfSSHD_AuthReducePermissions(conn->auth) != WS_SUCCESS) {
1437-
exit(1);
1438-
}
1439-
1440-
return WS_FATAL_ERROR;
1430+
/* exit rather than return into the connection handler
1431+
* while still at a raised privilege level */
1432+
exit(1);
14411433
}
14421434
if (dup2(stderrPipe[1], STDERR_FILENO) == -1) {
14431435
wolfSSH_Log(WS_LOG_ERROR,
14441436
"[SSHD] Error redirecting stderr pipe");
1445-
if (wolfSSHD_AuthReducePermissions(conn->auth) != WS_SUCCESS) {
1446-
exit(1);
1447-
}
1448-
1449-
return WS_FATAL_ERROR;
1437+
/* exit rather than return into the connection handler
1438+
* while still at a raised privilege level */
1439+
exit(1);
14501440
}
14511441
}
14521442

14531443
/* set additional groups if needed */
14541444
if (wolfSSHD_AuthSetGroups(conn->auth, wolfSSH_GetUsername(ssh),
14551445
pPasswd->pw_gid) != WS_SUCCESS) {
14561446
wolfSSH_Log(WS_LOG_ERROR, "[SSHD] Error setting groups");
1457-
if (wolfSSHD_AuthReducePermissions(conn->auth) != WS_SUCCESS) {
1458-
/* stop everything if not able to reduce permissions level */
1459-
exit(1);
1460-
}
1461-
1462-
return WS_FATAL_ERROR;
1447+
/* exit rather than return into the connection handler while
1448+
* still at a raised privilege level */
1449+
exit(1);
14631450
}
14641451

14651452
rc = SetupChroot(usrConf);
14661453
if (rc < 0) {
14671454
wolfSSH_Log(WS_LOG_ERROR, "[SSHD] Error setting chroot");
1468-
if (wolfSSHD_AuthReducePermissions(conn->auth) != WS_SUCCESS) {
1469-
/* stop everything if not able to reduce permissions level */
1470-
exit(1);
1471-
}
1472-
1473-
return WS_FATAL_ERROR;
1455+
/* exit rather than return into the connection handler while
1456+
* still at a raised privilege level */
1457+
exit(1);
14741458
}
14751459
else if (rc == 1) {
14761460
rc = chdir("/");
14771461
if (rc != 0) {
14781462
wolfSSH_Log(WS_LOG_ERROR,
14791463
"[SSHD] Error going to / after chroot");
1480-
if (wolfSSHD_AuthReducePermissions(conn->auth) != WS_SUCCESS) {
1481-
/* stop everything if not able to reduce permissions level */
1482-
exit(1);
1483-
}
1484-
1485-
return WS_FATAL_ERROR;
1464+
/* exit rather than return into the connection handler
1465+
* while still at a raised privilege level */
1466+
exit(1);
14861467
}
14871468
}
14881469

14891470
if (wolfSSHD_AuthReducePermissionsUser(conn->auth, pPasswd->pw_uid,
14901471
pPasswd->pw_gid) != WS_SUCCESS) {
14911472
wolfSSH_Log(WS_LOG_ERROR, "[SSHD] Error setting user ID");
1492-
if (wolfSSHD_AuthReducePermissions(conn->auth) != WS_SUCCESS) {
1493-
/* stop everything if not able to reduce permissions level */
1494-
exit(1);
1495-
}
1496-
1497-
return WS_FATAL_ERROR;
1473+
/* could not drop to the authenticated user; terminate this
1474+
* child rather than return into the connection handler at a
1475+
* higher privilege level */
1476+
exit(1);
14981477
}
14991478

15001479
setenv("HOME", pPasswd->pw_dir, 1);
@@ -1559,12 +1538,11 @@ static int SHELL_Subsystem(WOLFSSHD_CONNECTION* conn, WOLFSSH* ssh,
15591538
if (wolfSSHD_AuthReducePermissionsUser(conn->auth, pPasswd->pw_uid,
15601539
pPasswd->pw_gid) != WS_SUCCESS) {
15611540
wolfSSH_Log(WS_LOG_ERROR, "[SSHD] Error setting user ID");
1562-
if (wolfSSHD_AuthReducePermissions(conn->auth) != WS_SUCCESS) {
1563-
/* stop everything if not able to reduce permissions level */
1564-
exit(1);
1565-
}
1566-
1567-
return WS_FATAL_ERROR;
1541+
/* could not drop to the authenticated user; kill the already
1542+
* forked shell child and terminate the per-connection process
1543+
* rather than continue at a higher privilege level */
1544+
kill(childPid, SIGKILL);
1545+
exit(1);
15681546
}
15691547
sshFd = wolfSSH_get_fd(ssh);
15701548

@@ -2097,7 +2075,8 @@ static void* HandleConnection(void* arg)
20972075
#ifdef WOLFSSH_SHELL
20982076
if (ret == WS_SUCCESS) {
20992077
wolfSSH_Log(WS_LOG_INFO, "[SSHD] Entering new shell");
2100-
SHELL_Subsystem(conn, ssh, pPasswd, usrConf, NULL);
2078+
ret = SHELL_Subsystem(conn, ssh, pPasswd, usrConf,
2079+
NULL);
21012080
}
21022081
#else
21032082
wolfSSH_Log(WS_LOG_ERROR,
@@ -2143,7 +2122,7 @@ static void* HandleConnection(void* arg)
21432122
wolfSSH_Log(WS_LOG_INFO,
21442123
"[SSHD] Entering exec session [%s]",
21452124
wolfSSH_GetSessionCommand(ssh));
2146-
SHELL_Subsystem(conn, ssh, pPasswd, usrConf,
2125+
ret = SHELL_Subsystem(conn, ssh, pPasswd, usrConf,
21472126
wolfSSH_GetSessionCommand(ssh));
21482127
}
21492128
#endif /* WOLFSSH_SHELL */

0 commit comments

Comments
 (0)