3 // Copyright (C) 2003 Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de>
5 // This program is free software; you can redistribute it and/or modify
6 // it under the terms of the GNU General Public License as published by
7 // the Free Software Foundation; version 2 of the License.
9 // This program is distributed in the hope that it will be useful,
10 // but WITHOUT ANY WARRANTY; without even the implied warranty of
11 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 // GNU General Public License for more details.
14 // You should have received a copy of the GNU General Public License
15 // along with this program; if not, write to the Free Software
16 // Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
19 // secure-mount <chroot-base> <src> <dst>
21 // mounts <src> into the chroot <chroot-base> at destination <dst> in a way
22 // that prevents symlink attacks
26 // mount tmpfs-directory
28 // mount --bind <src> tmpfs
30 // mount --move tmpfs <dst>
36 #define VERSION_COPYRIGHT_YEAR "2003"
37 #define VERSION_COPYRIGHT_AUTHOR "Enrico Scholz"
41 #include <sys/mount.h>
43 #include <sys/types.h>
51 #define MNTPOINT "/etc"
54 showHelp(int fd, char const *cmd, int res)
56 WRITE_MSG(fd, "Usage: ");
59 " <chroot-base> <src> <dst>\n\n"
60 "Please report bugs to " PACKAGE_BUGREPORT "\n");
69 "secure-mount " VERSION " -- secure mounting of directories in chroots\n"
70 "This program is part of " PACKAGE_STRING "\n"
71 "Copyright (C) 2003 Enrico Scholz\n"
72 VERSION_COPYRIGHT_DISCLAIMER);
76 int main(int argc, char *argv[])
78 int fd = open("/", O_RDONLY);
79 // HACK: sanity checks should be done before declaration, but this does
80 // not work with C89 compilers
81 char path[strlen(argc==1 ? "" : argv[1]) + sizeof(MNTPOINT) + 3];
84 if (!strcmp(argv[1], "--help")) showHelp(1, argv[0], 0);
85 if (!strcmp(argv[1], "--version")) showVersion();
88 WRITE_MSG(2, "Bad parameter count; use --help for further information.\n");
92 if (chroot(argv[1]) == -1 ||
94 perror("chroot()/chdir()");
98 if (mount("none", MNTPOINT, "tmpfs", 0, "size=4k")==-1) {
103 if (mkdir(MNTPOINT "/x",0600) == -1) {
104 perror("mkdir()/fchdir()");
108 if (fchdir(fd) == -1 ||
114 strcpy(path, argv[1]);
115 strcat(path, MNTPOINT "/x");
117 if (mount(argv[2], path, "", MS_BIND, 0)==-1) {
122 if (chroot(argv[1]) == -1) {
127 if (chdir("/") == -1 ||
128 mount(MNTPOINT "/x", argv[3], "", MS_MOVE, 0) == -1) {
129 perror("chdir()/mount()");
133 if (umount(MNTPOINT) == -1) {
141 if (umount(path)==-1) perror("umount(path)");
144 if (chdir(argv[1])==-1) {
151 if (umount("mnt")==-1) perror("umount(\"mnt\")");