rc.subr: Support setting the audit user when starting services

When an unprivileged user restarts a service using, e.g., sudo, the
service runs with the audit user ID set to that of the unprivileged
user.  This can have surprising effects: for instance, a user that
restarts a jail that is running sshd will end up with their UID attached
to all audit logs associated with users who log in via that sshd
instance.  (sshd will set the audit user, but this is disallowed in
jails by default.)

Add support for rc.conf directives which cause rc to override the audit
user.  Specifically, make <name>_audit_user=foo cause the audit user to
be set to "foo" for service <name>.  A plain audit_user=foo directive
causes all services to be started as foo.

Note, like other similar rc features, this feature is limited to rc
services which are run by executing a command.  Shell functions can't be
wrapped this way.

Reviewed by:	0mp
MFC after:	2 weeks
Sponsored by:	Modirum MDPay
Sponsored by:	Klara, Inc.
Differential Revision:	https://reviews.freebsd.org/D53747

(cherry picked from commit 39ee24182b92114d006abc2b8095334a1d8a083c)

1 files changed, 17 insertions, 1 deletions

diff --git a/libexec/rc/rc.subr b/libexec/rc/rc.subr
index c8060c87eb6e..c6f29c6b0c99 100644
--- a/libexec/rc/rc.subr
+++ b/libexec/rc/rc.subr
@@ -55,6 +55,7 @@ JAIL_CMD=/usr/sbin/jail
 _svcj_generic_params="path=/ mount.nodevfs host=inherit"
 JID=0
 CPUSET="/bin/cpuset"
+SETAUDIT="/usr/sbin/setaudit"
 
 # Cache the services that we loaded with load_rc_config.
 _loaded_services=""
@@ -923,6 +924,9 @@ startmsg()
 #				Meant to be used in /etc/rc.conf to override
 #				${command}.
 #
+#	${name}_audit_user n    Override the audit user for ${command},
+#				specified as a user name or UID.
+#
 #	${name}_chroot	n	Directory to chroot to before running ${command}
 #				Requires /usr to be mounted.
 #
@@ -1141,6 +1145,15 @@ run_rc_command()
 		_cpusetcmd="$CPUSET -l $_cpuset"
 	fi
 
+	eval _audit_user=\$${name}_audit_user
+	if [ -z "$_audit_user" -a -n "$audit_user" ]; then
+		_audit_user=$audit_user
+	fi
+	_setauditcmd=
+	if [ -n "$_audit_user" ]; then
+		_setauditcmd="setaudit -U -a $_audit_user"
+	fi
+
 	# If a specific jail has a specific svcj request, honor it (YES/NO).
 	# If not (variable empty), evaluate the global svcj catch-all.
 	# A global YES can be overriden by a specific NO, and a global NO is overriden
@@ -1505,6 +1518,7 @@ run_rc_command()
 				_doit="\
 ${_nice:+nice -n $_nice }\
 $_cpusetcmd \
+$_setauditcmd \
 ${_fib:+setfib -F $_fib }\
 ${_env:+env $_env }\
 chroot ${_user:+-u $_user }${_group:+-g $_group }${_groups:+-G $_groups }\
@@ -1514,7 +1528,9 @@ $_chroot $command $rc_flags $command_args"
 				_doit="\
 ${_fib:+setfib -F $_fib }\
 ${_env:+env $_env }\
-$_cpusetcmd $command $rc_flags $command_args"
+$_cpusetcmd \
+$_setauditcmd \
+$command $rc_flags $command_args"
 				if [ -n "$_user" ]; then
 				    _doit="su -m $_user -c 'sh -c \"$_doit\"'"
 				fi