mdw@git.distorted.org.uk Git - checkpath/blob - checkpath.h

   1 /* -*-c-*-
   2  *
   3  * Check a path for safety
   4  *
   5  * (c) 1999 Mark Wooding
   6  */
   7
   8 /*----- Licensing notice --------------------------------------------------*
   9  *
  10  * This file is part of chkpath.
  11  *
  12  * chkpath is free software; you can redistribute it and/or modify
  13  * it under the terms of the GNU General Public License as published by
  14  * the Free Software Foundation; either version 2 of the License, or
  15  * (at your option) any later version.
  16  *
  17  * chkpath is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with chkpath; if not, write to the Free Software Foundation,
  24  * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  25  */
  26
  27 #ifndef CHECKPATH_H
  28 #define CHECKPATH_H
  29
  30 #ifdef __cplusplus
  31   extern "C" {
  32 #endif
  33
  34 /*----- Header files ------------------------------------------------------*/
  35
  36 #include <limits.h>
  37 #include <sys/types.h>
  38
  39 /*----- Data structures ---------------------------------------------------*/
  40
  41 /* --- Search request --- *
  42  *
  43  * This contains parameters from the caller to control what problems are
  44  * looked for, and what to do when they're found.
  45  */
  46
  47 struct checkpath {
  48   uid_t cp_uid;                         /* Uid that's considered OK */
  49   gid_t cp_gid[NGROUPS_MAX + 1];        /* Array of groups that are OK */
  50   int cp_gids;                          /* Number of groups in the array */
  51   int cp_verbose;                       /* Verbosity level to spit up */
  52   unsigned cp_what;                     /* What things to check for */
  53   void (*cp_report)(unsigned /*what*/, int /*verb*/,
  54                     const char */*dir*/, const char */*msg*/,
  55                     void */*p*/);
  56   void *cp_arg;                         /* Argument for cp_report */
  57 };
  58
  59 /* --- Flags for `@what@' fields in the above --- */
  60
  61 /* Problem types */
  62 #define CP_PROBLEMS 0x1fu               /* Mask of problem bits */
  63 #define CP_ERROR 0x01u                  /* Error report */
  64 #define CP_WRWORLD 0x02u                /* Check write by world */
  65 #define CP_WRGRP 0x04u                  /* Check write by any group */
  66 #define CP_WROTHGRP 0x08u               /* Check write by other group */
  67 #define CP_WROTHUSR 0x10u               /* Check write by other user */
  68
  69 /* Other flags */
  70 #define CP_SYMLINK 0x100u               /* Report symbolic links */
  71 #define CP_REPORT 0x200u                /* Make user-readable reports */
  72 #define CP_STICKYOK 0x400u              /* Don't care if sticky is set */
  73
  74 /*----- Functions provided ------------------------------------------------*/
  75
  76 /* --- @checkpath@ --- *
  77  *
  78  * Arguments:   @const char *p@ = directory name which needs checking
  79  *              @const struct checkpath *cp@ = parameters for the check
  80  *
  81  * Returns:     Zero if all is well, otherwise bitmask of problems.
  82  *
  83  * Use:         Scrutinises a directory path to see what evil things other
  84  *              users could do to it.
  85  */
  86
  87 extern unsigned checkpath(const char */*p*/, const struct checkpath */*cp*/);
  88
  89 /* --- @checkpath_addgid@ --- *
  90  *
  91  * Arguments:   @struct checkpath *cp@ = pointer to block to fill in
  92  *              @gid_t g@ = group id to add
  93  *
  94  * Returns:     Zero if successful, nonzero if the array is full.
  95  *
  96  * Use:         Adds the group @g@ to the structure.
  97  */
  98
  99 extern int checkpath_addgid(struct checkpath */*cp*/, gid_t /*g*/);
 100
 101 /* --- @checkpath_setuid@ --- *
 102  *
 103  * Arguments:   @struct checkpath *cp@ = pointer to block to fill in
 104  *
 105  * Returns:     ---
 106  *
 107  * Use:         Fills in the @cp_uid@ slot of the structure with the real uid
 108  *              of the current process.
 109  */
 110
 111 extern void checkpath_setuid(struct checkpath */*cp*/);
 112
 113 /* --- @checkpath_setgid@ --- *
 114  *
 115  * Arguments:   @struct checkpath *cp@ = pointer to block to fill in
 116  *
 117  * Returns:     Zero if successful, nonzero if the array is full.
 118  *
 119  * Use:         Adds the real gid of the current process to the @cp_gid@
 120  *              array.
 121  */
 122
 123 extern int checkpath_setgid(/*cp*/);
 124
 125 /* --- @checkpath_setgroups@ --- *
 126  *
 127  * Arguments:   @struct checkpath *cp@ = pointer to block to fill in
 128  *
 129  * Returns:     Zero if successful, nonzero if the array is full.
 130  *
 131  * Use:         Adds the current process's supplementary groups to the
 132  *              @cp_gid@ table.
 133  */
 134
 135 extern int checkpath_setgroups(struct checkpath */*cp*/);
 136
 137 /* --- @checkpath_setids@ --- *
 138  *
 139  * Arguments:   @struct checkpath *cp@ = pointer to block to fill in
 140  *
 141  * Returns:     ---
 142  *
 143  * Use:         Fills in the user ids and things in the structure.  This is
 144  *              equivalent to setting @cp_gids = 0@ and then calling
 145  *              @_setuid@, @_setgid@ and @_setgroups@.  It can't fail.
 146  */
 147
 148 extern void checkpath_setids(struct checkpath */*cp*/);
 149
 150 /*----- That's all, folks -------------------------------------------------*/
 151
 152 #ifdef __cplusplus
 153   }
 154 #endif
 155
 156 #endif