Improve formatting before we get too stuck in.

[checkpath] / checkpath.c

/* -*-c-*-
 *
 * Check a path for safety
 *
 * (c) 1999 Mark Wooding
 */

/*----- Licensing notice --------------------------------------------------* 
 *
 * This file is part of chkpath.
 *
 * chkpath is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 * 
 * chkpath is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 * 
 * You should have received a copy of the GNU General Public License
 * along with chkpath; if not, write to the Free Software Foundation,
 * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 */

/*----- Header files ------------------------------------------------------*/

#include <errno.h>
#include <stdarg.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include <sys/types.h>
#include <sys/stat.h>
#include <unistd.h>

#include <pwd.h>
#include <grp.h>

#include <mLib/alloc.h>
#include <mLib/dstr.h>

#include "checkpath.h"

/*----- Data structures ---------------------------------------------------*/

/* --- An item in the directory list --- *
 *
 * Each directory becomes an element on a list which is manipulated in a
 * stack-like way.
 */

struct elt {
  struct elt *e_link;			/* Pointer to the next one along */
  size_t e_offset;			/* Offset of name in path string */
  unsigned e_flags;			/* Various useful flags */
  char e_name[1];			/* Name of the directory */
};

#define f_sticky 1u			/* Directory has sticky bit set */

#define f_last 1u			/* This is the final item to check */

/*----- Static variables --------------------------------------------------*/

static struct elt rootnode = { 0, 0, 0 }; /* Root of the list */
static struct elt *sp;			/* Stack pointer for list */
static dstr d = DSTR_INIT;		/* Current path string */

/*----- Main code ---------------------------------------------------------*/

/* --- @splitpath@ --- *
 *
 * Arguments:	@const char *path@ = path string to break apart
 *		@struct elt *tail@ = tail block to attach to end of list
 *
 * Returns:	Pointer to the new list head.
 *
 * Use:		Breaks a path string into directories and adds each one
 *		as a node on the list, in the right order.  These can then
 *		be pushed onto the directory stack as required.
 */

static struct elt *splitpath(const char *path, struct elt *tail)
{
  struct elt *head, **ee = &head, *e;

  while (*path) {
    size_t n;

    /* --- Either a leading `/', or a doubled one --- *
     *
     * Either way, ignore it.
     */

    if (*path == '/') {
      path++;
      continue;
    }

    /* --- Skip to the next directory separator --- *
     *
     * Build a list element for it, and link it on.
     */

    n = strcspn(path, "/");
    e = xmalloc(sizeof(struct elt) + n + 1);
    memcpy(e->e_name, path, n);
    e->e_name[n] = 0;
    e->e_flags = 0;
    *ee = e;
    ee = &e->e_link;
    path += n;
  }

  /* --- Done --- */

  *ee = tail;
  return (head);
}

/* --- @pop@ --- *
 *
 * Arguments:	---
 *
 * Returns:	---
 *
 * Use:		Removes the top item from the directory stack.
 */

static void pop(void)
{
  if (sp->e_link) {
    struct elt *e = sp->e_link;
    d.len = sp->e_offset;
    DPUTZ(&d);
    sp = e;
  }
}

/* --- @popall@ --- *
 *
 * Arguments:	---
 *
 * Returns:	---
 *
 * Use:		Removes all the items from the directory stack.
 */

static void popall(void)
  { while (sp->e_link) pop(); }

/* --- @push@ --- *
 *
 * Arguments:	@struct elt *e@ = pointer to directory element
 *
 * Returns:	---
 *
 * Use:		Pushes a new subdirectory onto the stack.
 */

static void push(struct elt *e)
{
  e->e_link = sp;
  e->e_offset = d.len;
  DPUTC(&d, '/');
  DPUTS(&d, e->e_name);
  sp = e;
}

/* --- @report@ --- *
 *
 * Arguments:	@const struct checkpath *cp@ = pointer to context
 *		@unsigned what@ = what sort of report is this?
 *		@int verbose@ = how verbose is this?
 *		@const char *p@ = what path does it refer to?
 *		@const char *msg@ = the message to give to the user
 *
 * Returns:	---
 *
 * Use:		Formats and presents messages to the client.
 */

static void report(const struct checkpath *cp, unsigned what, int verbose,
		   const char *p, const char *msg, ...)
{
  dstr d = DSTR_INIT;
  va_list ap;
  const char *q = msg;
  const char *s;
  size_t n;
  int e = errno;
  uid_t u;
  struct passwd *pw;
  gid_t g;
  struct group *gr;

  /* --- Decide whether to bin this message --- */

  if (!cp->cp_report || verbose > cp->cp_verbose || !(cp->cp_what & what))
    return;

  /* --- If no reporting, do the easy thing --- */

  if (!(cp->cp_what & CP_REPORT)) {
    cp->cp_report(what, verbose, p, 0, cp->cp_arg);
    return;
  }

  /* --- Format the message nicely --- */

  va_start(ap, msg);
  if (verbose > 1)
    dstr_puts(&d, "[ ");
  if (p)
    dstr_putf(&d, "Path: %s: ", p);
  while (*q) {
    if (*q == '%') {
      q++;
      switch (*q) {
	case 'e':
	  dstr_puts(&d, strerror(e));
	  break;
	case 'u':
	  u = (uid_t)va_arg(ap, int);
	  if ((pw = getpwuid(u)) != 0)
	    dstr_putf(&d, "`%s'", pw->pw_name);
	  else
	    dstr_putf(&d, "%i", (int)u);
	  break;
	case 'g':
	  g = (gid_t)va_arg(ap, int);
	  if ((gr = getgrgid(g)) != 0)
	    dstr_putf(&d, "`%s'", gr->gr_name);
	  else
	    dstr_putf(&d, "%i", (int)g);
	  break;
	case 's':
	  s = va_arg(ap, const char *);
	  dstr_puts(&d, s);
	  break;
	case '%':
	  dstr_putc(&d, '%');
	  break;
	default:
	  dstr_putc(&d, '%');
	  dstr_putc(&d, *q);
	  break;
      }
      q++;
    } else {
      n = strcspn(q, "%");
      DPUTM(&d, q, n);
      q += n;
    }
  }
  if (verbose > 1)
    dstr_puts(&d, " ]");
  DPUTZ(&d);
  cp->cp_report(what, verbose, p, d.buf, cp->cp_arg);
  dstr_destroy(&d);
  va_end(ap);
}

/* --- @sanity@ --- *
 *
 * Arguments:	@const char *p@ = name of directory to check
 *		@struct stat *st@ = pointer to @stat@(2) block for it
 *		@const struct checkpath *cp@ = pointer to caller parameters
 *		@unsigned f@ = various flags
 *
 * Returns:	Zero if everything's OK, else bitmask of problems.
 *
 * Use:		Performs the main load of sanity-checking on a directory.
 */

static unsigned sanity(const char *p, struct stat *st,
		       const struct checkpath *cp, unsigned f)
{
  unsigned bad = 0;
  int stickyok = 0;
  int i;
  unsigned b;

  if (S_ISDIR(st->st_mode) &&
      (!(f & f_last) || (cp->cp_what & CP_STICKYOK)))
    stickyok = 01000;

  /* --- Check for world-writability --- */

  if ((cp->cp_what & CP_WRWORLD) &&
      (st->st_mode & (0002 | stickyok)) == 0002) {
    bad |= CP_WRWORLD;
    report(cp, CP_WRWORLD, 1, p, "** world writable **");
  }

  /* --- Check for group-writability --- */

  if ((cp->cp_what & (CP_WRGRP | CP_WROTHGRP)) &&
      (st->st_mode & (0020 | stickyok)) == 0020) {
    b = CP_WRGRP;

    if (cp->cp_what & CP_WROTHGRP) {
      b = CP_WROTHGRP;
      for (i = 0; i < cp->cp_gids; i++) {
	if (st->st_gid == cp->cp_gid[i])
	  b = cp->cp_what & CP_WRGRP;
      }
    }
    if (b) {
      bad |= b;
      report(cp, b, 1, p, "writable by %sgroup %g",
	     (b == CP_WROTHGRP) ? "other " : "", st->st_gid);
    }
  }

  /* --- Check for user-writability --- */

  if ((cp->cp_what & CP_WROTHUSR) &&
      st->st_uid != cp->cp_uid &&
      st->st_uid != 0) {
    bad |= CP_WROTHUSR;
    report(cp, CP_WROTHUSR, 1, p, "owner is user %u", st->st_uid);
  }

  /* --- Done sanity check --- */

  return (bad);
}

/* --- @checkpath@ --- *
 *
 * Arguments:	@const char *p@ = directory name which needs checking
 *		@const struct checkpath *cp@ = parameters for the check
 *
 * Returns:	Zero if all is well, otherwise bitmask of problems.
 *
 * Use:		Scrutinises a directory path to see what evil things other
 *		users could do to it.
 */

unsigned checkpath(const char *p, const struct checkpath *cp)
{
  char cwd[PATH_MAX];
  struct elt *e, *ee;
  struct stat st;
  unsigned bad = 0;

  /* --- Initialize stack pointer and path string --- */

  sp = &rootnode;
  dstr_destroy(&d);

  /* --- Try to find the current directory --- */

  if (!getcwd(cwd, sizeof(cwd))) {
    report(cp, CP_ERROR, 0, 0, "can't find current directory: %e");
    return (CP_ERROR);
  }

  /* --- Check that the root directory is OK --- */

  if (stat("/", &st)) {
    report(cp, CP_ERROR, 0, 0, "can't stat root directory: %e");
    return (CP_ERROR);
  }

  report(cp, CP_REPORT, 3, p, "begin scan");
  bad |= sanity("/", &st, cp, 0);

  /* --- Get the initial list of things to process --- */

  ee = splitpath(p, 0);
  if (*p != '/')
    ee = splitpath(cwd, ee);

  /* --- While there are list items which still need doing --- */

  while (ee) {
    e = ee->e_link;

    /* --- Strip off simple `.' elements --- */

    if (strcmp(ee->e_name, ".") == 0) {
      free(ee);
      ee = e;
      continue;
    }

    /* --- Backtrack on `..' elements --- */

    else if (strcmp(ee->e_name, "..") == 0) {
      pop();
      free(ee);
      ee = e;
      continue;
    }

    /* --- Everything else gets pushed on the end --- */

    push(ee);
    ee = e;

    /* --- Find out what sort of a thing this is --- */

    if (lstat(d.buf, &st)) {
      report(cp, CP_ERROR, 0, d.buf, "can't stat: %e");
      bad |= CP_ERROR;
      break;
    }

    /* --- Handle symbolic links specially --- */

    if (S_ISLNK(st.st_mode)) {
      dstr buf = DSTR_INIT;
      int i;

      /* --- Resolve the link --- */

      dstr_ensure(&buf, st.st_size + 1);
      if ((i = readlink(d.buf, buf.buf, buf.sz)) < 0) {
	report(cp, CP_ERROR, 0, d.buf, "can't readlink: %e");
	bad |= CP_ERROR;
	break;
      }
      buf.buf[i] = 0;
      report(cp, CP_SYMLINK, 2, d.buf, "symlink -> `%s'", buf.buf);

      /* --- Handle sticky parents --- *
       *
       * If I make a symlink in a sticky directory, I can later modify it.
       * However, nobody else can (except the owner of the directory, and
       * we'll already have noticed that if we care).
       */

      if ((cp->cp_what & CP_WROTHUSR) &&
	  (sp->e_link->e_flags & f_sticky) &&
	  st.st_uid != cp->cp_uid && st.st_uid != 0) {
	bad |= CP_WROTHUSR;
	report(cp, CP_WROTHUSR, 1, d.buf,
	       "symlink modifiable by user %u", st.st_uid);
      }

      /* --- Sort out what to do from here --- */

      if (buf.buf[0] == '/')
	popall();
      else
	pop();
      ee = splitpath(buf.buf, ee);
      dstr_destroy(&buf);
      continue;
    }

    /* --- Run the sanity check on this path element --- */

    bad |= sanity(d.buf, &st, cp, ee ? 0 : f_last);

    if (S_ISDIR(st.st_mode)) {
      if (st.st_mode & 01000)
	sp->e_flags |= f_sticky;
      report(cp, CP_REPORT, 4, d.buf, "directory");
      continue;
    }

    /* --- Something else I don't understand --- */

    break;
  }

  /* --- Check for leftover junk --- */

  if (ee) {
    if (!(bad & CP_ERROR))
      report(cp, CP_ERROR, 0, 0, "junk left over after reaching leaf");
    while (ee) {
      e = ee->e_link;
      free(ee);
      ee = e;
    }
  }

  popall();
  return (bad);
}

/* --- @checkpath_setids@ --- *
 *
 * Arguments:	@struct checkpath *cp@ = pointer to block to fill in
 *
 * Returns:	---
 *
 * Use:		Fills in the user ids and things in the structure.
 */

void checkpath_setids(struct checkpath *cp)
{
  int n, i;
  gid_t g = getgid();

  cp->cp_uid = getuid();
  n = getgroups(sizeof(cp->cp_gid) / sizeof(cp->cp_gid[0]), cp->cp_gid);
  
  for (i = 0; i < n; i++) {
    if (cp->cp_gid[i] == g)
      goto gid_ok;
  }
  cp->cp_gid[n++] = g;
gid_ok:
  cp->cp_gids = n;
}

/*----- That's all, folks -------------------------------------------------*/