3 * $Id: checkpath.c,v 1.2 1999/05/18 20:49:12 mdw Exp $
5 * Check a path for safety
7 * (c) 1999 Mark Wooding
10 /*----- Licensing notice --------------------------------------------------*
12 * This file is part of chkpath.
14 * chkpath is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU General Public License as published by
16 * the Free Software Foundation; either version 2 of the License, or
17 * (at your option) any later version.
19 * chkpath is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU General Public License for more details.
24 * You should have received a copy of the GNU General Public License
25 * along with chkpath; if not, write to the Free Software Foundation,
26 * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
29 /*----- Revision history --------------------------------------------------*
31 * $Log: checkpath.c,v $
32 * Revision 1.2 1999/05/18 20:49:12 mdw
33 * Use a dynamic string for reading symlinks.
35 * Revision 1.1.1.1 1999/04/06 20:12:07 mdw
40 /*----- Header files ------------------------------------------------------*/
48 #include <sys/types.h>
55 #include <mLib/alloc.h>
56 #include <mLib/dstr.h>
60 /*----- Data structures ---------------------------------------------------*/
62 /* --- An item in the directory list --- *
64 * Each directory becomes an element on a list which is manipulated in a
69 struct elt
*e_link
; /* Pointer to the next one along */
70 size_t e_offset
; /* Offset of name in path string */
71 unsigned e_flags
; /* Various useful flags */
72 char e_name
[1]; /* Name of the directory */
76 f_sticky
= 1 /* Directory has sticky bit set */
80 f_last
= 1 /* This is the final item to check */
83 /*----- Static variables --------------------------------------------------*/
85 static struct elt rootnode
= { 0, 0, 0 }; /* Root of the list */
86 static struct elt
*sp
; /* Stack pointer for list */
87 static dstr d
; /* Current path string */
89 /*----- Main code ---------------------------------------------------------*/
91 /* --- @splitpath@ --- *
93 * Arguments: @const char *path@ = path string to break apart
94 * @struct elt *tail@ = tail block to attach to end of list
96 * Returns: Pointer to the new list head.
98 * Use: Breaks a path string into directories and adds each one
99 * as a node on the list, in the right order. These can then
100 * be pushed onto the directory stack as required.
103 static struct elt
*splitpath(const char *path
, struct elt
*tail
)
105 struct elt
*head
, **ee
= &head
, *e
;
110 /* --- Either a leading `/', or a doubled one --- *
112 * Either way, ignore it.
120 /* --- Skip to the next directory separator --- *
122 * Build a list element for it, and link it on.
125 n
= strcspn(path
, "/");
126 e
= xmalloc(sizeof(struct elt
) + n
+ 1);
127 memcpy(e
->e_name
, path
, n
);
147 * Use: Removes the top item from the directory stack.
150 static void pop(void)
153 struct elt
*e
= sp
->e_link
;
154 d
.len
= sp
->e_offset
;
160 /* --- @popall@ --- *
166 * Use: Removes all the items from the directory stack.
169 static void popall(void)
177 * Arguments: @struct elt *e@ = pointer to directory element
181 * Use: Pushes a new subdirectory onto the stack.
184 static void push(struct elt
*e
)
189 DPUTS(&d
, e
->e_name
);
193 /* --- @report@ --- *
195 * Arguments: @struct chkpath *cp@ = pointer to context
196 * @int what@ = what sort of report is this?
197 * @int verbose@ = how verbose is this?
198 * @const char *p@ = what path does it refer to?
199 * @const char *msg@ = the message to give to the user
203 * Use: Formats and presents messages to the client.
206 static void report(struct chkpath
*cp
, int what
, int verbose
,
207 const char *p
, const char *msg
, ...)
209 /* --- Decide whether to bin this message --- */
211 if (!cp
->cp_report
|| verbose
> cp
->cp_verbose
|| !(cp
->cp_what
& what
))
214 /* --- Format the message nicely --- */
216 if (cp
->cp_what
& CP_REPORT
) {
228 dstr_putf(&d
, "Path: %s: ", p
);
234 dstr_puts(&d
, strerror(e
));
237 uid_t u
= (uid_t
)va_arg(ap
, int);
238 struct passwd
*pw
= getpwuid(u
);
240 dstr_putf(&d
, "`%s'", pw
->pw_name
);
242 dstr_putf(&d
, "%i", (int)u
);
245 gid_t g
= (gid_t
)va_arg(ap
, int);
246 struct group
*gr
= getgrgid(g
);
248 dstr_putf(&d
, "`%s'", gr
->gr_name
);
250 dstr_putf(&d
, "%i", (int)g
);
253 const char *s
= va_arg(ap
, const char *);
274 cp
->cp_report(what
, verbose
, p
, d
.buf
, cp
->cp_arg
);
278 cp
->cp_report(what
, verbose
, p
, 0, cp
->cp_arg
);
281 /* --- @sanity@ --- *
283 * Arguments: @const char *p@ = name of directory to check
284 * @struct stat *st@ = pointer to @stat@(2) block for it
285 * @struct chkpath *cp@ = pointer to caller parameters
286 * @unsigned f@ = various flags
288 * Returns: Zero if everything's OK, else bitmask of problems.
290 * Use: Performs the main load of sanity-checking on a directory.
293 static int sanity(const char *p
, struct stat
*st
,
294 struct chkpath
*cp
, unsigned f
)
297 int sticky
= (cp
->cp_what
& CP_STICKYOK
) || !(f
& f_last
) ?
01000 : 0;
299 /* --- Check for world-writability --- */
301 if ((cp
->cp_what
& CP_WRWORLD
) &&
302 (st
->st_mode
& (0002 | sticky
)) == 0002) {
304 report(cp
, CP_WRWORLD
, 1, p
, "** world writable **");
307 /* --- Check for group-writability --- */
309 if ((cp
->cp_what
& (CP_WRGRP
| CP_WROTHGRP
)) &&
310 (st
->st_mode
& (0020 | sticky
)) == 0020) {
311 if (cp
->cp_what
& CP_WRGRP
) {
313 report(cp
, CP_WRGRP
, 1, p
, "writable by group %g", st
->st_gid
);
316 for (i
= 0; i
< cp
->cp_gids
; i
++) {
317 if (st
->st_gid
== cp
->cp_gid
[i
])
321 report(cp
, CP_WROTHGRP
, 1, p
, "writable by group %g", st
->st_gid
);
326 /* --- Check for user-writability --- */
328 if ((cp
->cp_what
& CP_WROTHUSR
) &&
329 st
->st_uid
!= cp
->cp_uid
&&
332 report(cp
, CP_WROTHUSR
, 1, p
, "owner is user %u", st
->st_uid
);
335 /* --- Done sanity check --- */
340 /* --- @path_check@ --- *
342 * Arguments: @const char *p@ = directory name which needs checking
343 * @struct chkpath *cp@ = caller parameters for the check
345 * Returns: Zero if all is well, otherwise bitmask of problems.
347 * Use: Scrutinises a directory path to see what evil things other
348 * users could do to it.
351 int path_check(const char *p
, struct chkpath
*cp
)
358 /* --- Initialise stack pointer and path string --- */
363 /* --- Try to find the current directory --- */
365 if (!getcwd(cwd
, sizeof(cwd
))) {
366 report(cp
, CP_ERROR
, 0, 0, "can't find current directory: %e");
370 /* --- Check that the root directory is OK --- */
372 if (stat("/", &st
)) {
373 report(cp
, CP_ERROR
, 0, 0, "can't stat root directory: %e");
377 report(cp
, CP_REPORT
, 3, p
, "begin scan");
378 bad
|= sanity("/", &st
, cp
, 0);
380 /* --- Get the initial list of things to process --- */
382 ee
= splitpath(p
, 0);
384 ee
= splitpath(cwd
, ee
);
386 /* --- While there are list items which still need doing --- */
391 /* --- Strip off simple `.' elements --- */
393 if (strcmp(ee
->e_name
, ".") == 0) {
399 /* --- Backtrack on `..' elements --- */
401 else if (strcmp(ee
->e_name
, "..") == 0) {
408 /* --- Everything else gets pushed on the end --- */
413 /* --- Find out what sort of a thing this is --- */
415 if (lstat(d
.buf
, &st
)) {
416 report(cp
, CP_ERROR
, 0, d
.buf
, "can't stat: %e");
421 /* --- Handle symbolic links specially --- */
423 if (S_ISLNK(st
.st_mode
)) {
427 /* --- Resolve the link --- */
430 dstr_ensure(&buf
, st
.st_size
+ 1);
431 if ((i
= readlink(d
.buf
, buf
.buf
, buf
.sz
)) < 0) {
432 report(cp
, CP_ERROR
, 0, d
.buf
, "can't readlink: %e");
437 report(cp
, CP_SYMLINK
, 2, d
.buf
, "symlink -> `%s'", buf
.buf
);
439 /* --- Handle sticky parents --- *
441 * If I make a symlink in a sticky directory, I can later modify it.
442 * However, nobody else can (except the owner of the directory, and
443 * we'll already have noticed that if we care).
446 if ((cp
->cp_what
& CP_WROTHUSR
) &&
447 (sp
->e_link
->e_flags
& f_sticky
) &&
448 st
.st_uid
!= cp
->cp_uid
&& st
.st_uid
!= 0) {
450 report(cp
, CP_WROTHUSR
, 1, d
.buf
,
451 "symlink modifiable by user %u", st
.st_uid
);
454 /* --- Sort out what to do from here --- */
456 if (buf
.buf
[0] == '/')
460 ee
= splitpath(buf
.buf
, ee
);
465 /* --- Run the sanity check on this path element --- */
467 bad
|= sanity(d
.buf
, &st
, cp
, ee ?
0 : f_last
);
469 if (S_ISDIR(st
.st_mode
)) {
470 if (st
.st_mode
& 01000)
471 sp
->e_flags
|= f_sticky
;
472 report(cp
, CP_REPORT
, 4, d
.buf
, "directory");
476 /* --- Something else I don't understand --- */
481 /* --- Check for leftover junk --- */
484 if (!(bad
& CP_ERROR
))
485 report(cp
, CP_ERROR
, 0, 0, "junk left over after reaching leaf");
497 /* --- @path_setids@ --- *
499 * Arguments: @struct chkpath *cp@ = pointer to block to fill in
501 * Returns: Zero if OK, else @-1@.
503 * Use: Fills in the user ids and things in the structure.
506 void path_setids(struct chkpath
*cp
)
511 cp
->cp_uid
= getuid();
512 n
= getgroups(sizeof(cp
->cp_gid
) / sizeof(cp
->cp_gid
[0]), cp
->cp_gid
);
514 for (i
= 0; i
< n
; i
++) {
515 if (cp
->cp_gid
[i
] == g
)
523 /*----- That's all, folks -------------------------------------------------*/