|
| 1 | +// Copyright 2025 Pasteur Labs. All Rights Reserved. |
| 2 | +// SPDX-License-Identifier: Apache-2.0 |
| 3 | + |
| 4 | +/* |
| 5 | + * addmeplease - Create user/group entries for non-privileged container users |
| 6 | + * |
| 7 | + * This program allows a non-privileged user to create their own entry in |
| 8 | + * /etc/passwd and /etc/group. This is necessary because: |
| 9 | + * |
| 10 | + * 1. Containers run as non-root users (e.g., USER 501:501) for security |
| 11 | + * 2. Some applications require an entry in /etc/passwd to function properly |
| 12 | + * 3. The container entrypoint runs as the non-privileged user and cannot |
| 13 | + * directly modify /etc/passwd without elevated privileges |
| 14 | + * |
| 15 | + * This binary is compiled and installed with setuid root (chmod 4755), which |
| 16 | + * allows it to temporarily elevate privileges to modify /etc/passwd and |
| 17 | + * /etc/group, then immediately drop privileges back to the calling user. |
| 18 | + * |
| 19 | + * Note: setuid only works with compiled binaries, not shell scripts. This is |
| 20 | + * why this must be implemented in C rather than as a bash script. |
| 21 | + */ |
| 22 | + |
| 23 | +#define _GNU_SOURCE |
| 24 | +#include <stdio.h> |
| 25 | +#include <stdlib.h> |
| 26 | +#include <string.h> |
| 27 | +#include <unistd.h> |
| 28 | +#include <sys/types.h> |
| 29 | +#include <pwd.h> |
| 30 | +#include <grp.h> |
| 31 | +#include <errno.h> |
| 32 | +#include <fcntl.h> |
| 33 | +#include <sys/stat.h> |
| 34 | + |
| 35 | +#define PASSWD_FILE "/etc/passwd" |
| 36 | +#define GROUP_FILE "/etc/group" |
| 37 | +#define SHADOW_FILE "/etc/shadow" |
| 38 | +#define GSHADOW_FILE "/etc/gshadow" |
| 39 | + |
| 40 | +int group_exists(gid_t gid) { |
| 41 | + struct group *grp = getgrgid(gid); |
| 42 | + return (grp != NULL); |
| 43 | +} |
| 44 | + |
| 45 | +int user_exists(uid_t uid) { |
| 46 | + struct passwd *pwd = getpwuid(uid); |
| 47 | + return (pwd != NULL); |
| 48 | +} |
| 49 | + |
| 50 | +int append_to_file(const char *filepath, const char *line) { |
| 51 | + int fd = open(filepath, O_WRONLY | O_APPEND | O_CREAT, 0644); |
| 52 | + if (fd < 0) { |
| 53 | + return -1; |
| 54 | + } |
| 55 | + |
| 56 | + size_t len = strlen(line); |
| 57 | + ssize_t written = write(fd, line, len); |
| 58 | + close(fd); |
| 59 | + |
| 60 | + return (written == (ssize_t)len) ? 0 : -1; |
| 61 | +} |
| 62 | + |
| 63 | +int create_group(gid_t gid, const char *groupname) { |
| 64 | + if (group_exists(gid)) { |
| 65 | + return 0; |
| 66 | + } |
| 67 | + |
| 68 | + // Format: groupname:x:gid: |
| 69 | + char group_line[256]; |
| 70 | + snprintf(group_line, sizeof(group_line), "%s:x:%d:\n", groupname, gid); |
| 71 | + |
| 72 | + if (append_to_file(GROUP_FILE, group_line) != 0) { |
| 73 | + fprintf(stderr, "addmeplease: Failed to add group to %s: %s\n", |
| 74 | + GROUP_FILE, strerror(errno)); |
| 75 | + return -1; |
| 76 | + } |
| 77 | + |
| 78 | + // Add to gshadow if it exists |
| 79 | + char gshadow_line[256]; |
| 80 | + snprintf(gshadow_line, sizeof(gshadow_line), "%s:!::\n", groupname); |
| 81 | + |
| 82 | + struct stat st; |
| 83 | + if (stat(GSHADOW_FILE, &st) == 0) { |
| 84 | + append_to_file(GSHADOW_FILE, gshadow_line); |
| 85 | + } |
| 86 | + |
| 87 | + return 0; |
| 88 | +} |
| 89 | + |
| 90 | +int create_user(uid_t uid, gid_t gid, const char *username) { |
| 91 | + if (user_exists(uid)) { |
| 92 | + return 0; |
| 93 | + } |
| 94 | + |
| 95 | + // Format: username:x:uid:gid:comment:home:shell |
| 96 | + char passwd_line[512]; |
| 97 | + snprintf(passwd_line, sizeof(passwd_line), |
| 98 | + "%s:x:%d:%d:Tesseract User:/tesseract:/bin/bash\n", |
| 99 | + username, uid, gid); |
| 100 | + |
| 101 | + if (append_to_file(PASSWD_FILE, passwd_line) != 0) { |
| 102 | + fprintf(stderr, "addmeplease: Failed to add user to %s: %s\n", |
| 103 | + PASSWD_FILE, strerror(errno)); |
| 104 | + return -1; |
| 105 | + } |
| 106 | + |
| 107 | + // Add to shadow file with locked password |
| 108 | + // Format: username:!:lastchanged:min:max:warn:inactive:expire: |
| 109 | + // We use ! for locked password and 0 for lastchanged (epoch) |
| 110 | + char shadow_line[256]; |
| 111 | + snprintf(shadow_line, sizeof(shadow_line), "%s:!:0:0:99999:7:::\n", username); |
| 112 | + |
| 113 | + struct stat st; |
| 114 | + if (stat(SHADOW_FILE, &st) == 0) { |
| 115 | + // Shadow file typically has restricted permissions |
| 116 | + int fd = open(SHADOW_FILE, O_WRONLY | O_APPEND); |
| 117 | + if (fd >= 0) { |
| 118 | + size_t len = strlen(shadow_line); |
| 119 | + write(fd, shadow_line, len); |
| 120 | + close(fd); |
| 121 | + } |
| 122 | + } |
| 123 | + |
| 124 | + return 0; |
| 125 | +} |
| 126 | + |
| 127 | +int main(void) { |
| 128 | + uid_t real_uid = getuid(); |
| 129 | + gid_t real_gid = getgid(); |
| 130 | + |
| 131 | + // If running as root, nothing to do |
| 132 | + if (real_uid == 0) { |
| 133 | + return 0; |
| 134 | + } |
| 135 | + |
| 136 | + // Check if user already exists |
| 137 | + if (user_exists(real_uid)) { |
| 138 | + return 0; |
| 139 | + } |
| 140 | + |
| 141 | + // We need root privileges to modify /etc/passwd and /etc/group |
| 142 | + // This is why the binary needs setuid root |
| 143 | + if (seteuid(0) != 0) { |
| 144 | + fprintf(stderr, "addmeplease: Failed to elevate privileges: %s\n", strerror(errno)); |
| 145 | + fprintf(stderr, "addmeplease: This binary must be setuid root (chmod 4755)\n"); |
| 146 | + return 1; |
| 147 | + } |
| 148 | + |
| 149 | + // Create group if it doesn't exist |
| 150 | + if (create_group(real_gid, "tesseract-group") != 0) { |
| 151 | + fprintf(stderr, "addmeplease: Warning: Failed to create group\n"); |
| 152 | + // Continue anyway, the GID might exist with a different name |
| 153 | + } |
| 154 | + |
| 155 | + // Create user with current UID/GID |
| 156 | + if (create_user(real_uid, real_gid, "tesseract-user") != 0) { |
| 157 | + fprintf(stderr, "addmeplease: Warning: Failed to create user\n"); |
| 158 | + // Continue anyway |
| 159 | + } |
| 160 | + |
| 161 | + // Drop privileges back to the original user |
| 162 | + if (seteuid(real_uid) != 0) { |
| 163 | + fprintf(stderr, "addmeplease: Failed to drop privileges: %s\n", strerror(errno)); |
| 164 | + return 1; |
| 165 | + } |
| 166 | + |
| 167 | + return 0; |
| 168 | +} |
0 commit comments