3 // Copyright (C) 2003 Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de>
5 // This program is free software; you can redistribute it and/or modify
6 // it under the terms of the GNU General Public License as published by
7 // the Free Software Foundation; version 2 of the License.
9 // This program is distributed in the hope that it will be useful,
10 // but WITHOUT ANY WARRANTY; without even the implied warranty of
11 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 // GNU General Public License for more details.
14 // You should have received a copy of the GNU General Public License
15 // along with this program; if not, write to the Free Software
16 // Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
19 // secure-mount <chroot-base> <src> <dst>
21 // mounts <src> into the chroot <chroot-base> at destination <dst> in a way
22 // that prevents symlink attacks
26 // mount tmpfs-directory
28 // mount --bind <src> tmpfs
30 // mount --move tmpfs <dst>
36 #define VERSION_COPYRIGHT_YEAR "2003"
37 #define VERSION_COPYRIGHT_AUTHOR "Enrico Scholz"
41 #include <sys/mount.h>
43 #include <sys/types.h>
51 #define MNTPOINT "/etc"
54 showHelp(int fd, char const *cmd, int res)
56 WRITE_MSG(fd, "Usage: ");
59 " <chroot-base> <src> <dst>\n\n"
60 "Please report bugs to " PACKAGE_BUGREPORT "\n");
69 "secure-mount 0.23.5\n"
70 "Copyright (C) 2003 Enrico Scholz\n"
71 VERSION_COPYRIGHT_DISCLAIMER);
75 int main(int argc, char *argv[])
77 int fd = open("/", O_RDONLY);
78 // HACK: sanity checks should be done before declaration, but this does
79 // not work with C89 compilers
80 char path[strlen(argc==1 ? "" : argv[1]) + sizeof(MNTPOINT) + 3];
83 if (!strcmp(argv[1], "--help")) showHelp(1, argv[0], 0);
84 if (!strcmp(argv[1], "--version")) showVersion();
87 WRITE_MSG(2, "Bad parameter count; use --help for further information.\n");
91 if (chroot(argv[1]) == -1 ||
93 perror("chroot()/chdir()");
97 if (mount("none", MNTPOINT, "tmpfs", 0, "size=4k")==-1) {
102 if (mkdir(MNTPOINT "/x",0600) == -1) {
103 perror("mkdir()/fchdir()");
107 if (fchdir(fd) == -1 ||
113 strcpy(path, argv[1]);
114 strcat(path, MNTPOINT "/x");
116 if (mount(argv[2], path, "", MS_BIND, 0)==-1) {
121 if (chroot(argv[1]) == -1) {
126 if (chdir("/") == -1 ||
127 mount(MNTPOINT "/x", argv[3], "", MS_MOVE, 0) == -1) {
128 perror("chdir()/mount()");
132 if (umount(MNTPOINT) == -1) {
140 if (umount(path)==-1) perror("umount(path)");
143 if (chdir(argv[1])==-1) {
150 if (umount("mnt")==-1) perror("umount(\"mnt\")");