contrib/pcaps4server

#!/bin/sh
# vim: tabstop=4
#
# author:    chris friedhoff - chris@friedhoff.org
# version:   pcaps4server  5  Tue Mar 11 2008
#
#
# changelog:
# 1 - initial release pcaps4convenience
# 1 - 2007.02.15 - initial release
# 2 - 2007.11.02 - changed to new setfcaps api; each app is now callable; supressed error of id
# 3 - 2007.12.28 - changed to libcap2 package setcap/getcap
# 4 - renamed to pcaps4server
#      removed suid0 and convenience files,
#      they are now in pcaps4suid0 resp. pcaps4convenience
# 5 - changed 'attr -S -r' to 'setcap -r' and removed attr code
#
#
###########################################################################
# change the installation of different server to be able not to run as root
# and have their own unpriviledged user. The binary has the needed POSIX
# Capabilities.
# to ensure that the server is really started as his respective user, we set
# the suid bit (BUT NOT 0)!
# paths are hard coded and derive from a slackware system
# change it to your needs !!
###########################################################################



VERBOSE="-v"
#VERBOSE=""
APPS=""

message(){
	printRedMessage "$1"
}

printRedMessage(){
	# print message red and turn back to white
	echo -e "\n\033[00;31m $1 ...\033[00;00m\n"
}

printGreenMessage(){
	# print message red and turn back to white
	echo -e "\033[00;32m $1 ...\033[00;00m\n"
	sleep 0.5
}

checkReturnCode(){
    if [ "$?" != "0" ]; then
        printRedMessage "!! I'M HAVING A PROBLEM !! THE RETURNCODE IS NOT 0 !! I STOP HERE !!"
        exit 1
    else
        printGreenMessage ":-)"
		sleep 0.5
    fi
}



p4r_test(){
	#for now, we work with root
	if [ "$( id -u )" != "0" ]; then
		echo "Sorry, you must be root !"
		exit
	fi
}




# apache 1.3
########
#APPS="$APPS apache1"
apache1_convert(){
	message "converting apache1"
	if [ "$( id -g apache 2>/dev/null )" == "" ]; then
		groupadd -g 60 apache
	fi
	if [ "$( id -u apache 2>/dev/null )" == "" ]; then
		useradd -g apache -d / -u 600 apache
	fi
	sed -i -e "{s|^\(User\).*|\1 apache|; s|^\(Group\) .*|\1 apache|}" /etc/apache/httpd.conf
	chown $VERBOSE -R apache:apache /var/run/apache/
	chown $VERBOSE -R apache:apache /etc/apache/
	chown $VERBOSE -R apache:apache /var/log/apache/
	chown $VERBOSE apache:apache /usr/sbin/httpd
	chmod $VERBOSE u+s /usr/sbin/httpd
	setcap cap_net_bind_service=ep /usr/sbin/httpd
	checkReturnCode
}
apache1_revert(){
	message "reverting apache1"
	chown $VERBOSE -R root:root /var/run/apache/
	chown $VERBOSE -R root:root /etc/apache/
	chown $VERBOSE -R root:root /var/log/apache/
	chown $VERBOSE root:root /usr/sbin/httpd
	chmod $VERBOSE u-s /usr/sbin/httpd
	setcap -r /usr/sbin/httpd
	checkReturnCode
	sed -i -e "{s|^\(User\).*|\1 nobody|; s|^\(Group\).*|\1 nogroup|}" /etc/apache/httpd.conf
	userdel apache
	groupdel apache
}


# apache 2.x
########
APPS="$APPS apache2"
apache2_convert(){
	message "converting apache2"
	if [ "$( id -g apache 2>/dev/null )" == "" ]; then
		groupadd -g 60 apache
	fi
	if [ "$( id -u apache 2>/dev/null )" == "" ]; then
		useradd -g apache -d / -u 600 apache
	fi
	sed -i -e "{s|^\(User\).*|\1 apache|; s|^\(Group\) .*|\1 apache|}" /etc/httpd/httpd.conf
	chown $VERBOSE -R apache:apache /var/run/httpd/
	chown $VERBOSE -R apache:apache /etc/httpd/
	chown $VERBOSE -R apache:apache /var/log/httpd/
	chown $VERBOSE apache:apache /usr/sbin/httpd
	chmod $VERBOSE u+s /usr/sbin/httpd
	#setfcaps -c cap_net_bind_service=p -e /usr/sbin/httpd
	setcap cap_net_bind_service=ep /usr/sbin/httpd
	checkReturnCode
}
apache2_revert(){
	message "reverting apache2"
	chown $VERBOSE -R root:root /var/run/httpd/
	chown $VERBOSE -R root:root /etc/httpd/
	chown $VERBOSE -R root:root /var/log/httpd/
	chown $VERBOSE root:root /usr/sbin/httpd
	chmod $VERBOSE u-s /usr/sbin/httpd
	setcap -r /usr/sbin/httpd
	checkReturnCode
	sed -i -e "{s|^\(User\).*|\1 nobody|; s|^\(Group\).*|\1 nogroup|}" /etc/httpd/httpd.conf
	userdel apache
	groupdel apache
}


# samba
#######
APPS="$APPS samba"
samba_convert(){
	message "converting samba"
	if [ "$( id -g samba 2>/dev/null )" == "" ]; then
		groupadd -g 61 samba
	fi
	if [ "$( id -u samba 2>/dev/null )" == "" ]; then
		useradd -g samba -d / -u 610 samba
	fi
	chown $VERBOSE -R samba:samba /var/log/samba
	chown $VERBOSE -R samba:samba /etc/samba
	chown $VERBOSE -R samba:samba /var/run/samba
	chown $VERBOSE -R samba:samba /var/cache/samba
	chown $VERBOSE samba:samba /usr/sbin/smbd /usr/sbin/nmbd
	chmod $VERBOSE u+s /usr/sbin/smbd /usr/sbin/nmbd
	setcap cap_net_bind_service,cap_sys_resource,cap_dac_override=ep /usr/sbin/smbd
	checkReturnCode
	setcap cap_net_bind_service=ep /usr/sbin/nmbd
	checkReturnCode
}

samba_revert(){
	message "reverting samba"
	chown $VERBOSE -R root:root /var/log/samba
	chown $VERBOSE -R root:root /etc/samba
	chown $VERBOSE -R root:root /var/run/samba
	chown $VERBOSE -R root:root /var/cache/samba
	chown $VERBOSE root:root /usr/sbin/smbd /usr/sbin/nmbd
	chmod $VERBOSE u-s /usr/sbin/smbd /usr/sbin/nmbd
	setcap -r /usr/sbin/smbd
	checkReturnCode
	setcap -r /usr/sbin/nmbd
	checkReturnCode
	userdel samba
	groupdel samba
}


# bind
######
APPS="$APPS bind"
bind_convert(){
	message "converting bind"
	if [ "$( id -g bind 2>/dev/null )" == "" ]; then
		groupadd -g 62 bind
	fi
	if [ "$( id -u bind 2>/dev/null )" == "" ]; then
		useradd -g bind -d / -u 620 bind
	fi
	chown $VERBOSE -R bind:bind /var/run/named
	chown $VERBOSE -R bind:bind /var/named
	chown $VERBOSE bind:bind /etc/rndc.key
	chown $VERBOSE bind:bind /usr/sbin/named
	chmod $VERBOSE u+s /usr/sbin/named
	setcap cap_net_bind_service=ep /usr/sbin/named
	checkReturnCode
}
bind_revert(){
	message "reverting bind"
	chown $VERBOSE -R root:root /var/run/named
	chown $VERBOSE -R root:root /var/named
	chown $VERBOSE root:root /etc/rndc.key
	chown $VERBOSE root:root /usr/sbin/named
	chmod $VERBOSE u-s /usr/sbin/named
	setcap -r /usr/sbin/named
	checkReturnCode
	userdel bind
	groupdel bind
}


# dhcpd
#######
APPS="$APPS dhcpd"
dhcpd_convert(){
	message "converting dhcpd"
	if [ "$( id -g dhcpd 2>/dev/null )" == "" ]; then
		groupadd -g 63 dhcpd
	fi
	if [ "$( id -u dhcpd 2>/dev/null )" == "" ]; then
		useradd -g dhcpd -d / -u 630 dhcpd
	fi
	chown $VERBOSE dhcpd:dhcpd /var/run/dhcpd
	chown $VERBOSE dhcpd:dhcpd /etc/dhcpd.conf
	chown $VERBOSE -R dhcpd:dhcpd /var/state/dhcp/
	chown $VERBOSE dhcpd:dhcpd /usr/sbin/dhcpd
	chmod $VERBOSE u+s /usr/sbin/dhcpd
	setcap cap_net_bind_service,cap_net_raw=ep /usr/sbin/dhcpd
	checkReturnCode
}
dhcpd_revert(){
	message "reverting dhcpd"
	chown $VERBOSE root:root /var/run/dhcpd
	chown $VERBOSE root:root /etc/dhcpd.conf
	chown $VERBOSE -R root:root /var/state/dhcp/
	chown $VERBOSE root:root /usr/sbin/dhcpd
	chmod $VERBOSE u-s /usr/sbin/dhcpd
	setcap -r /usr/sbin/dhcpd
	checkReturnCode
	userdel dhcpd
	groupdel dhcpd
}


# cupsd
#######
APPS="$APPS cupsd"
cupsd_convert(){
	message "converting cupsd"
	if [ "$( id -g cupsd 2>/dev/null )" == "" ]; then
		groupadd -g 64 cupsd
	fi
	if [ "$( id -u cupsd 2>/dev/null )" == "" ]; then
		useradd -g cupsd -d / -u 640 cupsd
	fi
	sed -i -e "{s|^\(User\).*|\1 cupsd|; s|^\(Group\) .*|\1 cupsd|}" /etc/cups/cupsd.conf
	chown $VERBOSE -R cupsd:cupsd /etc/cups
	chown $VERBOSE -R cupsd:cupsd /var/cache/cups
	chown $VERBOSE -R cupsd:cupsd /var/log/cups
	chown $VERBOSE -R cupsd:cupsd /var/spool/cups
	chown $VERBOSE -R cupsd:cupsd /var/run/cups
	chown $VERBOSE cupsd:cupsd /usr/sbin/cupsd
	chmod $VERBOSE u+s /usr/sbin/cupsd
	setcap cap_net_bind_service,cap_dac_read_search=ep /usr/sbin/cupsd
	checkReturnCode
}
cupsd_revert(){
	message "reverting cupsd"
	chown $VERBOSE -R root:root /etc/cups
	chown $VERBOSE -R root:lp /var/cache/cups
	chown $VERBOSE -R root:root /var/log/cups
	chown $VERBOSE -R root:root /var/spool/cups
	chown $VERBOSE root:lp /var/run/cups
	chown $VERBOSE lp:sys /var/run/cups/certs
	chmod $VERBOSE 750 /var/run/cups/certs
	chown $VERBOSE root:root /usr/sbin/cupsd
	chmod $VERBOSE u-s /usr/sbin/cupsd
	setcap -r /usr/sbin/cupsd
	checkReturnCode
	sed -i -e "{s|^\(User\).*|\1 lp|; s|^\(Group\) .*|\1 sys|}" /etc/cups/cupsd.conf
	userdel cupsd
	groupdel cupsd
}


usage_message(){
	echo "Try 'pcaps4server help' for more information"
}


p4r_usage(){
    echo
    echo "pcaps4server"
    echo
    echo "pcaps4server stores the needed POSIX Capabilities for server binaries to"
    echo "run successful into their Permitted and Effective Set."
    echo "The server are now able to run as an unpriviledged user."
	echo "For each server software an unpriviledged user is added the system."
    echo "The ownership of all the respective paths are	changed to this user."
	echo "To ensure that the server is starting as this unpriviledgesd user, the"
    echo "suid bit (NOT 0) is set."
	echo "Effectively this means every user can start this server daemons (for now)."
	echo "All paths are hard coded!"
	echo "You have been warned. Enjoy!"
    echo
    echo "Your Filesystem has to support extended attributes and your kernel must have"
    echo "support for POSIX File Capabilities (CONFIG_SECURITY_FILE_CAPABILITIES)."
    echo
    echo "Usage:  pcaps4server [PROG] [con(vert)|rev(ert)|help]"
    echo
    echo "         con|convert - from setuid0 to POSIX Capabilities"
    echo "         rev|revert  - from POSIX Capabilities back to setui0"
    echo "         help        - this help message"
	echo
	echo "  PROG: $APPS"
    echo
}




case "$1" in
	con|convert)
		p4r_test
		for j in $APPS; do
			${j}_convert
		done
		exit
		;;
	rev|renvert)
		p4r_test
		for j in $APPS; do
			${j}_revert
		done
		exit
		;;
	help)
		p4r_usage
		exit
		;;
esac

for i in ${APPS}; do
	if [ "$1" == "$i" ]; then
		case "$2" in
			con|convert)
				p4r_test
				${i}_convert
				exit
				;;
			rev|revert)
				p4r_test
				${i}_revert
				exit
				;;
			*)
				usage_message
				exit 1
				;;
			esac
	fi
done

usage_message