From: Enrico Scholz Date: Wed, 24 Mar 2004 01:41:56 +0000 (+0000) Subject: rewrote it X-Git-Tag: VERSION_0_10~242 X-Git-Url: http://git.linux-vserver.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c860cebe053e697e4222224bc0d8c49fbd942831;p=util-vserver.git rewrote it git-svn-id: http://svn.linux-vserver.org/svn/util-vserver/trunk@1333 94cd875c-1c1d-0410-91d2-eb244daf1a30 --- diff --git a/util-vserver/src/capchroot.c b/util-vserver/src/capchroot.c index 45a6c80..e151bb2 100644 --- a/util-vserver/src/capchroot.c +++ b/util-vserver/src/capchroot.c @@ -26,7 +26,9 @@ #ifdef HAVE_CONFIG_H # include #endif -#include "compat.h" + +#include "vserver.h" +#include "util.h" #include #include @@ -36,76 +38,127 @@ #include #include #include +#include +#include -#include "vserver.h" +#define ENSC_WRAPPERS_PREFIX "capchroot: " +#define ENSC_WRAPPERS_UNISTD 1 +#define ENSC_WRAPPERS_VSERVER 1 +#include -int main (int argc, char *argv[]) +#define CMD_HELP 0x1000 +#define CMD_VERSION 0x1001 +#define CMD_NOCHROOT 0x2000 +#define CMD_SUID 0x2001 + +int wrapper_exit_code = 255; + +static struct option const +CMDLINE_OPTIONS[] = { + { "help", no_argument, 0, CMD_HELP }, + { "version", no_argument, 0, CMD_VERSION }, + { "nochroot", no_argument, 0, CMD_NOCHROOT }, + { "suid", required_argument, 0, CMD_SUID }, + {0,0,0,0} +}; + +static void +showHelp(int fd, char const *cmd, int res) { - if (argc < 3){ - fprintf (stderr,"capchroot version %s\n",VERSION); - fprintf (stderr - ,"capchroot --nochroot directory [ --suid user ] command argument\n" - "\n" - "--nochroot remove the CAP_SYS_CHROOT capability\n" - " after the chroot system call.\n" - "--suid switch to a different user (in the vserver context)\n" - " before executing the command.\n"); - }else{ - const char *uid = NULL; - bool nochroot = false; - int dir; - for (dir=1; dirpw_gid); - setuid(p->pw_uid); - } - if (cmd >= argc){ - fprintf (stderr,"capchroot: No command to execute, do nothing\n"); - }else{ - execvp (argv[cmd],argv+cmd); - fprintf (stderr,"Can't execute %s (%s)\n",argv[cmd] - ,strerror(errno)); - } - } - } - return -1; + VSERVER_DECLARE_CMD(cmd); + WRITE_MSG(fd, "Usage: "); + WRITE_STR(fd, cmd); + WRITE_MSG(fd, + " --nochroot [--suid ] [--] *\n" + "\n" + "Options:\n" + " --nochroot ... remove the CAP_SYS_CHROOT capability\n" + " after the chroot system call.\n" + " --suid ... switch to a different user (in the vserver\n" + " context) before executing the command.\n" + "\n" + "Please report bugs to " PACKAGE_BUGREPORT "\n"); + exit(res); } +static void +showVersion() +{ + WRITE_MSG(1, + "capchroot " VERSION " -- a capability aware chroot\n" + "This program is part of " PACKAGE_STRING "\n\n" + "Copyright (C) 2004 Enrico Scholz\n" + VERSION_COPYRIGHT_DISCLAIMER); + exit(0); +} +static void +setUser(char const *user) +{ + struct passwd *p = 0; + if (user!=0 && strcmp(user, "root")!=0) { + errno = 0; + p = getpwnam(user); + if (p==0) { + if (errno==0) errno = ENOENT; + PERROR_Q(ENSC_WRAPPERS_PREFIX "getpwnam", user); + exit(wrapper_exit_code); + } + } + + if (p!=0) { + Esetgroups(1, &p->pw_gid); + Esetgid(p->pw_gid); + Esetuid(p->pw_uid); + + if (getuid()!=p->pw_uid || getgid()!=p->pw_gid) { + WRITE_MSG(2, ENSC_WRAPPERS_PREFIX "Something went wrong while changing uid; expected uid/gid do not match the actual one\n"); + exit(wrapper_exit_code); + } + } +} + +int main (int argc, char *argv[]) +{ + bool nochroot = false; + char const * suid_user = 0; + + while (1) { + int c = getopt_long(argc, argv, "+", CMDLINE_OPTIONS, 0); + if (c==-1) break; + + switch (c) { + case CMD_HELP : showHelp(1, argv[0], 0); + case CMD_VERSION : showVersion(); + case CMD_NOCHROOT : nochroot = true; break; + case CMD_SUID : suid_user = optarg; break; + default : + WRITE_MSG(2, "Try '"); + WRITE_STR(2, argv[0]); + WRITE_MSG(2, " --help\" for more information.\n"); + return EXIT_FAILURE; + break; + } + } + + if (optind==argc) + WRITE_MSG(2, "No directory specified; try '--help' for more information\n"); + else if (optind+1==argc) + WRITE_MSG(2, "No command specified; try '--help' for more information\n"); + else { + // We resolve the UID before doing the chroot. + // If we do the getpwnam after the chroot, we will end + // up loading shared object from the vserver. + // This is causing two kind of problem: Incompatibilities + // and also a security flaw. The shared objects in the vserver + // may be tweaked to get control of the root server ... + getpwnam("root"); + Echroot(argv[optind]); + if (nochroot) + Evc_new_s_context(VC_SAMECTX, 1< #endif +#include "util.h" +#include "lib/internal.h" + +#include #include #include #include #include #include +static void +showHelp(char const *cmd) +{ + WRITE_MSG(1, "Usage: "); + WRITE_STR(1, cmd); + WRITE_MSG(1, + " [--] \n" + "\n" + "Shows the relative age of \n" + "\n" + "Please report bugs to " PACKAGE_BUGREPORT "\n"); + exit(0); +} + +static void +showVersion() +{ + WRITE_MSG(1, + "filetime " VERSION " -- shows age of a file\n" + "This program is part of " PACKAGE_STRING "\n\n" + "Copyright (C) 2004 Enrico Scholz\n" + VERSION_COPYRIGHT_DISCLAIMER); + exit(0); +} + int main (int argc, char *argv[]) { - int ret = -1; - if (argc != 2){ - fprintf (stderr - ,"filetime version %s\n" - "filetime file\n" - "\n" - "Prints the age of a file\n" - "(how long since it was created or modified)\n" - ,VERSION); - }else{ - struct stat st; - if (stat(argv[1],&st)==-1){ - fprintf (stderr,"Can't stat file %s (%s)\n",argv[1] - ,strerror(errno)); - }else{ - time_t now = time(NULL); - time_t since = now - st.st_mtime; - int days = since / (24*60*60); - int today = since % (24*60*60); - int hours = today / (60*60); - int minutes = (today % (60*60)) / 60; - if (days > 0){ - printf ("%d days ",days); - } - printf ("%02d:%02d\n",hours,minutes); - ret = 0; - } - } - return ret; + int idx = 1; + struct stat st; + + if (argc>=2) { + if (strcmp(argv[1], "--help") ==0) showHelp(argv[0]); + if (strcmp(argv[1], "--version")==0) showVersion(); + if (strcmp(argv[1], "--") ==0) ++idx; + } + if (argc 0) { + l = utilvserver_fmt_ulong(buf, days); + buf[l++] = ' '; + #define MSG "days, " + memcpy(buf+l, MSG, sizeof(MSG)-1); l += sizeof(MSG)-1; + } + + if (hours<10) buf[l++] = '0'; + l += utilvserver_fmt_ulong(buf+l, hours); + buf[l++] = ':'; + if (minutes<10) buf[l++] = '0'; + l += utilvserver_fmt_ulong(buf+l, minutes); + buf[l++] = '\n'; + + (void)write(1, buf, l); + return EXIT_SUCCESS; + } + + return EXIT_FAILURE; } diff --git a/util-vserver/src/readlink.c b/util-vserver/src/readlink.c index 4f023ce..8e7e461 100644 --- a/util-vserver/src/readlink.c +++ b/util-vserver/src/readlink.c @@ -1,7 +1,6 @@ // $Id$ // Copyright (C) 2003 Enrico Scholz -// based on readlink.cc by Jacques Gelinas // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -17,35 +16,65 @@ // along with this program; if not, write to the Free Software // Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. -/* - Copyright Jacques Gelinas jack@solucorp.qc.ca - Distributed under the Gnu Public License, see the License file - in this package. -*/ -#include +#ifdef HAVE_CONFIG_H +# include +#endif + +#include "util.h" + #include #include #include #include +#include + +static void +showHelp(char const *cmd) +{ + WRITE_MSG(1, "Usage: "); + WRITE_STR(1, cmd); + WRITE_MSG(1, + " [--] \n" + "\n" + "Display value of a symbolic link on standard output.\n" + "\n" + "Please report bugs to " PACKAGE_BUGREPORT "\n"); + exit(0); +} + +static void +showVersion() +{ + WRITE_MSG(1, + "readlink " VERSION " -- display value of symlink\n" + "This program is part of " PACKAGE_STRING "\n\n" + "Copyright (C) 2004 Enrico Scholz\n" + VERSION_COPYRIGHT_DISCLAIMER); + exit(0); +} + int main (int argc, char *argv[]) { - int ret = -1; - if (argc != 2){ - fprintf (stderr,"readlink symlink-file\n"); - fprintf (stderr,"Prints the contents of a symlink\n"); - }else{ - char buf[PATH_MAX]; - int len = readlink (argv[1],buf,sizeof(buf)-1); - if (len > 0){ - buf[len] = '\0'; - printf ("%s\n",buf); - ret = 0; - }else{ - fprintf (stderr,"readlink failed for file %s (%s)\n" - ,argv[1],strerror(errno)); - } - } - return ret; + char buf[PATH_MAX + 2]; + int idx = 1; + int len; + + if (argc>=2) { + if (strcmp(argv[1], "--help") ==0) showHelp(argv[0]); + if (strcmp(argv[1], "--version")==0) showVersion(); + if (strcmp(argv[1], "--") ==0) ++idx; + } + if (argc