Re: Need help. MJ2 won't work on Fedora Core 9 because of setgid.

On Friday, Oct 31st 2008 at 11:32 -0000, quoth Steven W. Orr:

=>On Sunday, Oct 26th 2008 at 11:38 -0000, quoth Steven W. Orr:
=>
=>=>On Saturday, Oct 25th 2008 at 12:40 -0000, quoth Steven W. Orr:
=>=>
=>=>=>I upgraded from Core 4 to Core 9 and now mj2 won't work anymore. Here's the
=>=>=>problem. In ~majordomo/bin, I have all of the programs and all of the
=>=>=>associated wrappers. The wrappers are all owned by majordomo (owner and group)
=>=>=>and the appropriate ones also have setuid and setgid bits set. Unless I am
=>=>=>sudo'd to the majordomo account (103 in this case), the program does not start
=>=>=>because of a problem with setgid.
=>=>=>
=>=>=>BTW, selinux is totally disabled.
=>=>=>
=>=>=>528 > ~majordomo/bin/mj_shell
=>=>=>Insecure dependency in eval while running setuid at
=>=>=>/usr/lib/perl5/5.10.0/SelfLoader.pm line 54.
=>=>=>Compilation failed in require at
=>=>=>/usr/lib/perl5/site_perl/5.10.0/Term/ReadLine/Perl.pm line 63.
=>=>=>529 >
=>=>=>
=>=>=>I did some experimenting and discovered that the setgid bit is not working. In
=>=>=>fact, I even went so far as to modify the code so that the wrapper was
=>=>=>installed setuid/setgid as root and I made the program do a setgid, setegid,
=>=>=>setresgid to 103, all to no avail. The error that I get back is EPERM, which
=>=>=>in the man page says:
=>=>=>
=>=>=> The calling  process  is  not  privileged  (does  not  have  the
=>=>=> CAP_SETGID  capability),  and  gid  does not match the effective
=>=>=> group ID or saved set-group-ID of the calling process.
=>=>=>
=>=>=>It doesn't matter if I run it as steveo or root. The only time it succeeds is
=>=>=>if I am su'd to majordomo.
=>=>=>
=>=>=>If anyone can help me and help quickly, my server is now down, and I'd really
=>=>=>appreciate suggestions on what to do.
=>=>=>
=>=>=>Is there something that needs to be done to allow setgid to succeed? AFAICT,
=>=>=>that's the only thing that's holding me up right now.
=>=>
=>=>I got it working, but the wrapper had to be replaced. For reasons that I 
=>=>do not understand, the software would run if I was either su'd or sudo'd 
=>=>to the majordomo account. The setuid/setgid thing does not. Here's the 
=>=>wrapper I wrote:
=>=>
=>=>547 > cat ~majordomo/bin/mj_tmplt.c 
=>=>#include <unistd.h>
=>=>#include <string.h>
=>=>#include <stdio.h>
=>=>#include <stdlib.h>
=>=>int main(int ac, char ** av)
=>=>{
=>=>  char * ll;
=>=>  char prog[128];       /* Name of program */
=>=>  char execstr[256];    /* nav[3] */
=>=>  char *nav[50];        /* New ArgV */
=>=>  int ii;
=>=>
=>=>  if ( (ll = rindex(av[0],'/')) != 0 )
=>=>    strcpy ( prog, ll+1 );
=>=>  else
=>=>    strcpy ( prog, av[0] );
=>=>  strcpy( execstr, "/usr/local/majordomo/bin/." );
=>=>  strcat( execstr, prog );
=>=>  nav[0] = "sudo";
=>=>  nav[1] = "-u";
=>=>  nav[2] = "majordomo";
=>=>  nav[3] = execstr;
=>=>  for ( ii = 1; ii < ac; ii++ )
=>=>    nav[ii+3] = av[ii];
=>=>  nav[ii+3] = NULL;
=>=>  execv("/usr/bin/sudo", nav);
=>=>  perror("execv");
=>=>}
=>=>
=>=>And I also had to place the following code into my sudoers file:
=>=>--------------
=>=># User alias specification
=>=>Runas_Alias     MAJ = majordomo
=>=>
=>=># Cmnd alias specification
=>=>Cmnd_Alias      MJ = /usr/local/majordomo/bin/.mj_confirm, \
=>=>                /usr/local/majordomo/bin/.mj_email, \
=>=>                /usr/local/majordomo/bin/.mj_enqueue, \
=>=>                /usr/local/majordomo/bin/.mj_shell, \
=>=>                /usr/local/majordomo/bin/.mj_shutdown, \
=>=>                /usr/local/majordomo/bin/.mj_wwwadm, \
=>=>                /usr/local/majordomo/bin/.mj_wwwusr
=>=>
=>=>ALL     ALL = (MAJ) NOPASSWD: MJ
=>=>--------------
=>=>
=>=>One other problem I noticed is that if you are running sendmail, the 
=>=>install of mj2 does not create a symlink for smrsh:
=>=>
=>=>[root@saturn mqueue]# ls -l /etc/smrsh/
=>=>total 0
=>=>lrwxrwxrwx 1 root root 35 2008-10-24 18:35 mj_enqueue -> /usr/local/majordomo/bin/mj_enqueue
=>=>
=>=>The final content of my ~majordomo/bin now looks like this:
=>=>
=>=>[root@saturn mqueue]# ls -la ~majordomo/bin
=>=>total 240
=>=>drwxr-xr-x  2 majordomo majordomo  4096 2008-10-25 23:33 .
=>=>drwxr-xr-x 17 majordomo majordomo  4096 2008-10-25 22:36 ..
=>=>-r-xr-xr-x  1 majordomo majordomo 10342 2008-10-24 17:15 .mj_confirm
=>=>lrwxrwxrwx  1 majordomo majordomo     8 2008-10-25 22:01 mj_confirm -> mj_tmplt
=>=>-r-xr-xr-x  1 majordomo majordomo 21333 2008-10-24 17:15 .mj_email
=>=>lrwxrwxrwx  1 majordomo majordomo     8 2008-10-25 22:02 mj_email -> mj_tmplt
=>=>-r-xr-xr-x  1 majordomo majordomo 12529 2008-10-24 17:15 .mj_enqueue
=>=>lrwxrwxrwx  1 majordomo majordomo     8 2008-10-25 22:03 mj_enqueue -> mj_tmplt
=>=>-r-xr-xr-x  1 majordomo majordomo 28528 2008-10-24 16:51 mj_queuerun
=>=>-r-xr-xr-x  1 majordomo majordomo  9400 2008-10-24 16:51 mj_queueserv
=>=>-r-xr-xr-x  1 majordomo majordomo 13136 2008-10-24 16:51 mj_setup
=>=>-r-xr-xr-x  1 majordomo majordomo 33396 2008-10-24 18:13 .mj_shell
=>=>lrwxrwxrwx  1 majordomo majordomo     8 2008-10-25 22:02 mj_shell -> mj_tmplt
=>=>-r-xr-xr-x  1 majordomo majordomo  2803 2008-10-24 17:15 .mj_shutdown
=>=>lrwxrwxrwx  1 majordomo majordomo     8 2008-10-25 22:02 mj_shutdown -> mj_tmplt
=>=>-rwxrwxr-x  1 majordomo majordomo  7089 2008-10-25 23:33 mj_tmplt
=>=>-rw-r--r--  1 majordomo majordomo   811 2008-10-25 23:33 mj_tmplt.c
=>=>-r-xr-xr-x  1 majordomo majordomo  6446 2008-10-24 16:51 mj_trigger
=>=>-r-xr-xr-x  1 majordomo majordomo 32155 2008-10-24 17:15 .mj_wwwadm
=>=>lrwxrwxrwx  1 majordomo majordomo     8 2008-10-25 22:03 mj_wwwadm -> mj_tmplt
=>=>-r-xr-xr-x  1 majordomo majordomo 19909 2008-10-24 17:15 .mj_wwwusr
=>=>lrwxrwxrwx  1 majordomo majordomo     8 2008-10-25 22:03 mj_wwwusr -> mj_tmplt
=>=>[root@saturn mqueue]# 
=>=>
=>=>Is this helpful? Is anyone home?
=>
=>Ok. A few more notes for whenever someone can figure this one out. The 
=>wrapper I wrote got me the ability to send mail and to run mj_shell, but 
=>the web interface was DOA. One of my operators then complained that 
=>mj_shell wasn't honoring her setting of EDITOR. I poked around and I 
=>modified the sudoers file:
=>
=>ALL     ALL = (MAJ SETENV:) NOPASSWD: MJ
=>
=>I'm not convinced  that this is correct but it works. 
=>
=>Then the change in the C code goes like this:
=>
=>#include <unistd.h>
=>#include <string.h>
=>#include <stdio.h>
=>#include <stdlib.h>
=>static const int IDX_INIT = { 4 };      /* Last index to be init'd. */
=>int main(int ac, char ** av)
=>{
=>  char * ll;
=>  char prog[128];       /* Name of program */
=>  char execstr[256];    /* nav[3] */
=>  char *nav[50];        /* New ArgV */
=>  int ii;
=>
=>  if ( (ll = rindex(av[0],'/')) != 0 )
=>    strcpy ( prog, ll+1 );
=>  else
=>    strcpy ( prog, av[0] );
=>  strcpy( execstr, "/usr/local/majordomo/bin/." );
=>  strcat( execstr, prog );
=>  nav[0] = "sudo";
=>  nav[1] = "-u";
=>  nav[2] = "majordomo";
=>  nav[3] = "-E";
=>  nav[4] = execstr;
=>  for ( ii = 1; ii < ac; ii++ )
=>    nav[ii+IDX_INIT] = av[ii];
=>  nav[ii+IDX_INIT] = NULL;
=>  execv("/usr/bin/sudo", nav);
=>  perror("execv");
=>}
=>
=>Note the addition of the -E option to allow environment variables to be 
=>passed through.
=>
=>This works but it's still a huge hammer for this problem. Compare
=>
=>wrapper with suid/sgid -> perl
=>vs
=>wrapper not s[ug]id -> sudo -> perl

One more log to throw onto the fire. I just grabbed the src code for sudo. 
In my case, I'm running Fedora 9 with sudo-1.6.9p13-4.fc9.i386. I got the 
src code from rpmbone:
http://rpm.pbone.net/index.php3/stat/26/dist/64/size/616170/name/sudo-1.6.9p13-4.fc9.src.rpm

In set_perms.c, there's some code that looks to be of interest around line 
100. It accesses the capabilities(2) calls in the system. Unfortunately, 
there are multiple functions in the file are called set_perms, and the one 
that's active depends on whether you have various flavors of setuid on 
your box.

I could slog through the code, but what becomes obvious is that the code 
isn't the problem; it's the integration with all of the rest of the other 
systems that mj2 has to support. I'm wondering if the solution I came up 
with to just use sudo is the best way in the end.

-- 
Time flies like the wind. Fruit flies like a banana. Stranger things have  .0.
happened but none stranger than this. Does your driver's license say Organ ..0
Donor?Black holes are where God divided by zero. Listen to me! We are all- 000
individuals! What if this weren't a hypothetical question?
steveo at syslang.net