3 * Check a path for safety
5 * (c) 1999 Mark Wooding
8 /*----- Licensing notice --------------------------------------------------*
10 * This file is part of chkpath.
12 * chkpath is free software; you can redistribute it and/or modify
13 * it under the terms of the GNU General Public License as published by
14 * the Free Software Foundation; either version 2 of the License, or
15 * (at your option) any later version.
17 * chkpath is distributed in the hope that it will be useful,
18 * but WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 * GNU General Public License for more details.
22 * You should have received a copy of the GNU General Public License
23 * along with chkpath; if not, write to the Free Software Foundation,
24 * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
27 /*----- Header files ------------------------------------------------------*/
37 #include <sys/types.h>
44 #include <mLib/alloc.h>
45 #include <mLib/dstr.h>
46 #include <mLib/macros.h>
48 #include "checkpath.h"
50 /*----- Data structures ---------------------------------------------------*/
52 /* --- An item in the directory list --- *
54 * Each directory becomes an element on a list which is manipulated in a
59 struct elt
*e_link
; /* Pointer to the next one along */
60 size_t e_offset
; /* Offset of name in path string */
61 unsigned e_flags
; /* Various useful flags */
62 char e_name
[1]; /* Name of the directory */
65 #define f_sticky 1u /* Directory has sticky bit set */
67 #define f_last 1u /* This is the final item to check */
69 /*----- Static variables --------------------------------------------------*/
71 static struct elt rootnode
= { 0, 0, 0 }; /* Root of the list */
72 static struct elt
*sp
; /* Stack pointer for list */
73 static dstr d
= DSTR_INIT
; /* Current path string */
75 /*----- Main code ---------------------------------------------------------*/
77 /* --- @splitpath@ --- *
79 * Arguments: @const char *path@ = path string to break apart
80 * @struct elt *tail@ = tail block to attach to end of list
82 * Returns: Pointer to the new list head.
84 * Use: Breaks a path string into directories and adds each one
85 * as a node on the list, in the right order. These can then
86 * be pushed onto the directory stack as required.
89 static struct elt
*splitpath(const char *path
, struct elt
*tail
)
91 struct elt
*head
, **ee
= &head
, *e
;
96 /* --- Either a leading `/', or a doubled one --- *
98 * Either way, ignore it.
106 /* --- Skip to the next directory separator --- *
108 * Build a list element for it, and link it on.
111 n
= strcspn(path
, "/");
112 e
= xmalloc(sizeof(struct elt
) + n
+ 1);
113 memcpy(e
->e_name
, path
, n
);
133 * Use: Removes the top item from the directory stack.
136 static void pop(void)
139 struct elt
*e
= sp
->e_link
;
140 d
.len
= sp
->e_offset
;
146 /* --- @popall@ --- *
152 * Use: Removes all the items from the directory stack.
155 static void popall(void)
156 { while (sp
->e_link
) pop(); }
160 * Arguments: @struct elt *e@ = pointer to directory element
164 * Use: Pushes a new subdirectory onto the stack.
167 static void push(struct elt
*e
)
172 DPUTS(&d
, e
->e_name
);
176 /* --- @report@ --- *
178 * Arguments: @const struct checkpath *cp@ = pointer to context
179 * @unsigned what@ = what sort of report is this?
180 * @int verbose@ = how verbose is this?
181 * @const char *p@ = what path does it refer to?
182 * @const char *msg@ = the message to give to the user
186 * Use: Formats and presents messages to the client.
189 static void report(const struct checkpath
*cp
, unsigned what
, int verbose
,
190 const char *p
, const char *msg
, ...)
203 /* --- Decide whether to bin this message --- */
205 if (!cp
->cp_report
|| verbose
> cp
->cp_verbose
|| !(cp
->cp_what
& what
))
208 /* --- If no reporting, do the easy thing --- */
210 if (!(cp
->cp_what
& CP_REPORT
)) {
211 cp
->cp_report(what
, verbose
, p
, 0, cp
->cp_arg
);
215 /* --- Format the message nicely --- */
221 dstr_putf(&d
, "Path: %s: ", p
);
227 dstr_puts(&d
, strerror(e
));
230 u
= (uid_t
)va_arg(ap
, int);
231 if ((pw
= getpwuid(u
)) != 0)
232 dstr_putf(&d
, "`%s'", pw
->pw_name
);
234 dstr_putf(&d
, "%i", (int)u
);
237 g
= (gid_t
)va_arg(ap
, int);
238 if ((gr
= getgrgid(g
)) != 0)
239 dstr_putf(&d
, "`%s'", gr
->gr_name
);
241 dstr_putf(&d
, "%i", (int)g
);
244 s
= va_arg(ap
, const char *);
265 cp
->cp_report(what
, verbose
, p
, d
.buf
, cp
->cp_arg
);
270 /* --- @sanity@ --- *
272 * Arguments: @const char *p@ = name of directory to check
273 * @struct stat *st@ = pointer to @stat@(2) block for it
274 * @const struct checkpath *cp@ = pointer to caller parameters
275 * @unsigned f@ = various flags
277 * Returns: Zero if everything's OK, else bitmask of problems.
279 * Use: Performs the main load of sanity-checking on a directory.
282 static unsigned sanity(const char *p
, struct stat
*st
,
283 const struct checkpath
*cp
, unsigned f
)
290 if (S_ISDIR(st
->st_mode
) &&
291 (!(f
& f_last
) || (cp
->cp_what
& CP_STICKYOK
)))
294 /* --- Check for world-writability --- */
296 if ((cp
->cp_what
& CP_WRWORLD
) &&
297 (st
->st_mode
& (0002 | stickyok
)) == 0002) {
299 report(cp
, CP_WRWORLD
, 1, p
, "** world writable **");
302 /* --- Check for group-writability --- */
304 if ((cp
->cp_what
& (CP_WRGRP
| CP_WROTHGRP
)) &&
305 (st
->st_mode
& (0020 | stickyok
)) == 0020) {
308 if (cp
->cp_what
& CP_WROTHGRP
) {
310 for (i
= 0; i
< cp
->cp_gids
; i
++) {
311 if (st
->st_gid
== cp
->cp_gid
[i
])
312 b
= cp
->cp_what
& CP_WRGRP
;
317 report(cp
, b
, 1, p
, "writable by %sgroup %g",
318 (b
== CP_WROTHGRP
) ?
"other " : "", st
->st_gid
);
322 /* --- Check for user-writability --- */
324 if ((cp
->cp_what
& CP_WROTHUSR
) &&
325 st
->st_uid
!= cp
->cp_uid
&&
328 report(cp
, CP_WROTHUSR
, 1, p
, "owner is user %u", st
->st_uid
);
331 /* --- Done sanity check --- */
336 /* --- @checkpath@ --- *
338 * Arguments: @const char *p@ = directory name which needs checking
339 * @const struct checkpath *cp@ = parameters for the check
341 * Returns: Zero if all is well, otherwise bitmask of problems.
343 * Use: Scrutinises a directory path to see what evil things other
344 * users could do to it.
347 unsigned checkpath(const char *p
, const struct checkpath
*cp
)
354 /* --- Initialize stack pointer and path string --- */
359 /* --- Try to find the current directory --- */
361 if (!getcwd(cwd
, sizeof(cwd
))) {
362 report(cp
, CP_ERROR
, 0, 0, "can't find current directory: %e");
366 /* --- Check that the root directory is OK --- */
368 if (stat("/", &st
)) {
369 report(cp
, CP_ERROR
, 0, 0, "can't stat root directory: %e");
373 report(cp
, CP_REPORT
, 3, p
, "begin scan");
374 bad
|= sanity("/", &st
, cp
, 0);
376 /* --- Get the initial list of things to process --- */
378 ee
= splitpath(p
, 0);
380 ee
= splitpath(cwd
, ee
);
382 /* --- While there are list items which still need doing --- */
387 /* --- Strip off simple `.' elements --- */
389 if (strcmp(ee
->e_name
, ".") == 0) {
395 /* --- Backtrack on `..' elements --- */
397 else if (strcmp(ee
->e_name
, "..") == 0) {
404 /* --- Everything else gets pushed on the end --- */
409 /* --- Find out what sort of a thing this is --- */
411 if (lstat(d
.buf
, &st
)) {
412 report(cp
, CP_ERROR
, 0, d
.buf
, "can't stat: %e");
417 /* --- Handle symbolic links specially --- */
419 if (S_ISLNK(st
.st_mode
)) {
420 dstr buf
= DSTR_INIT
;
423 /* --- Resolve the link --- */
425 dstr_ensure(&buf
, st
.st_size
+ 1);
426 if ((i
= readlink(d
.buf
, buf
.buf
, buf
.sz
)) < 0) {
427 report(cp
, CP_ERROR
, 0, d
.buf
, "can't readlink: %e");
432 report(cp
, CP_SYMLINK
, 2, d
.buf
, "symlink -> `%s'", buf
.buf
);
434 /* --- Handle sticky parents --- *
436 * If I make a symlink in a sticky directory, I can later modify it.
437 * However, nobody else can (except the owner of the directory, and
438 * we'll already have noticed that if we care).
441 if ((cp
->cp_what
& CP_WROTHUSR
) &&
442 (sp
->e_link
->e_flags
& f_sticky
) &&
443 st
.st_uid
!= cp
->cp_uid
&& st
.st_uid
!= 0) {
445 report(cp
, CP_WROTHUSR
, 1, d
.buf
,
446 "symlink modifiable by user %u", st
.st_uid
);
449 /* --- Sort out what to do from here --- */
451 if (buf
.buf
[0] == '/')
455 ee
= splitpath(buf
.buf
, ee
);
460 /* --- Run the sanity check on this path element --- */
462 bad
|= sanity(d
.buf
, &st
, cp
, ee ?
0 : f_last
);
464 if (S_ISDIR(st
.st_mode
)) {
465 if (st
.st_mode
& 01000)
466 sp
->e_flags
|= f_sticky
;
467 report(cp
, CP_REPORT
, 4, d
.buf
, "directory");
471 /* --- Something else I don't understand --- */
476 /* --- Check for leftover junk --- */
479 if (!(bad
& CP_ERROR
))
480 report(cp
, CP_ERROR
, 0, 0, "junk left over after reaching leaf");
492 /* --- @checkpath_addgid@ --- *
494 * Arguments: @struct checkpath *cp@ = pointer to block to fill in
495 * @gid_t g@ = group id to add
497 * Returns: Zero if successful, nonzero if the array is full.
499 * Use: Adds the group @g@ to the structure.
502 int checkpath_addgid(struct checkpath
*cp
, gid_t g
)
506 for (i
= 0; i
< cp
->cp_gids
; i
++) {
507 if (cp
->cp_gid
[i
] == g
)
510 if (cp
->cp_gids
>= N(cp
->cp_gid
))
512 cp
->cp_gid
[cp
->cp_gids
++] = g
;
516 /* --- @checkpath_setuid@ --- *
518 * Arguments: @struct checkpath *cp@ = pointer to block to fill in
522 * Use: Fills in the @cp_uid@ slot of the structure with the real uid
523 * of the current process.
526 void checkpath_setuid(struct checkpath
*cp
) { cp
->cp_uid
= getuid(); }
528 /* --- @checkpath_setgid@ --- *
530 * Arguments: @struct checkpath *cp@ = pointer to block to fill in
532 * Returns: Zero if successful, nonzero if the array is full.
534 * Use: Adds the real gid of the current process to the @cp_gid@
538 int checkpath_setgid(struct checkpath
*cp
)
539 { return (checkpath_addgid(cp
, getgid())); }
541 /* --- @checkpath_setgroups@ --- *
543 * Arguments: @struct checkpath *cp@ = pointer to block to fill in
545 * Returns: Zero if successful, nonzero if the array is full.
547 * Use: Adds the current process's supplementary groups to the
551 int checkpath_setgroups(struct checkpath
*cp
)
554 gid_t gg
[NGROUPS_MAX
];
556 n
= getgroups(N(gg
), gg
);
557 for (i
= 0; i
< n
; i
++) {
558 if (checkpath_addgid(cp
, gg
[i
]))
564 /* --- @checkpath_setids@ --- *
566 * Arguments: @struct checkpath *cp@ = pointer to block to fill in
570 * Use: Fills in the user ids and things in the structure. This is
571 * equivalent to setting @cp_gids = 0@ and then calling
572 * @_setuid@, @_setgid@ and @_setgroups@. It can't fail.
575 void checkpath_setids(struct checkpath
*cp
)
578 checkpath_setuid(cp
);
579 checkpath_setgid(cp
);
580 checkpath_setgroups(cp
);
583 /*----- That's all, folks -------------------------------------------------*/