/[prua]/prua/python-setuid.c
ViewVC logotype

Contents of /prua/python-setuid.c

Parent Directory Parent Directory | Revision Log Revision Log


Revision 1.2 - (show annotations) (download)
Thu Sep 4 22:14:27 2003 UTC (20 years, 9 months ago) by cavok
Branch: MAIN
CVS Tags: HEAD
Changes since 1.1: +6 -8 lines
File MIME type: text/plain
minor changes

1 /* python-setuid.c - Wrapper for execution of Python setuid scripts
2 * Copyright (C) 2003 Domenico Andreoli
3 *
4 * python-setuid.c is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation; either version 2 of the License, or
7 * (at your option) any later version.
8 *
9 * python-setuid.c is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
13 *
14 * You should have received a copy of the GNU General Public License
15 * along with Prua; if not, write to the Free Software
16 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
17 */
18
19 #ifndef PYTHON
20 #error "This wrapper requires PYTHON macro be defined to specify which Python interpreter is to be used."
21 #endif
22 #ifndef FULLPATH
23 #error "This wrapper requires FULLPATH macro be defined to specify which Python script is to be wrapped."
24 #endif
25
26 #include <unistd.h>
27 #include <stdlib.h>
28 #include <stdio.h>
29 #include <sys/stat.h>
30 #include <sys/resource.h>
31 #include <string.h>
32 #include <stdarg.h>
33 #include <errno.h>
34
35 #if defined(__STDC__) && defined(__sgi)
36 #define environ _environ
37 #endif
38
39 static char python[] = PYTHON;
40 static char fullpath[] = FULLPATH;
41
42 static char def_IFS[] = "IFS= \t\n";
43 static char def_CDPATH[] = "CDPATH=.";
44 static char def_ENV[] = "ENV=:";
45 static char def_PATH[] = "PATH=/usr/bin:/bin"; /* :/usr/bin/local"; */
46
47 static void die(const char *fmt, ...)
48 {
49 va_list ap;
50 va_start(ap, fmt);
51 vfprintf(stderr, fmt, ap);
52 va_end(ap);
53 exit(1);
54 }
55
56 /*
57 * This function changes all environment variables that start with LD_
58 * into variables that start with XD_. This is important since we
59 * don't want the script that is executed to use any funny shared
60 * libraries.
61 *
62 * If IFS is set in the environment, set it to space,tab,newline.
63 * If CDPATH is set in the environment, set it to ".".
64 * Set PATH to a reasonable default.
65 */
66 static void clean_environ(void)
67 {
68 char **p;
69 extern char **environ;
70
71 for(p = environ; *p; p++) {
72 if(strncmp(*p, "LD_", 3) == 0)
73 **p = 'X';
74 else if(strncmp(*p, "_RLD", 4) == 0)
75 **p = 'X';
76 else if(strncmp(*p, "PYTHON", 6) == 0)
77 **p = 'X';
78 else if(strncmp(*p, "IFS=", 4) == 0)
79 *p = def_IFS;
80 else if(strncmp(*p, "CDPATH=", 7) == 0)
81 *p = def_CDPATH;
82 else if(strncmp(*p, "ENV=", 4) == 0)
83 *p = def_ENV;
84 }
85 putenv(def_PATH);
86 }
87
88 int main(int argc, char *argv[])
89 {
90 int i;
91 char **args, **a;
92
93 struct stat statb;
94 struct rlimit rlim;
95
96 const gid_t egid = getegid();
97 const uid_t euid = geteuid();
98
99 args = (char**) malloc((argc+3) * sizeof(char*));
100 if(args == NULL)
101 die("%s: malloc: %s\n", argv[0], strerror(errno));
102
103 a = args;
104 *(a++) = python;
105
106 if(euid != getuid() || egid != getgid()) {
107 if(fullpath[0] != '/')
108 die("%s: not a full path name: %s\n", argv[0], fullpath);
109
110 if(stat(fullpath, &statb) < 0)
111 die("%s: stat: %s\n", argv[0], strerror(errno));
112 if(statb.st_uid != 0 && statb.st_uid != euid)
113 die("%s: wrong owner: %s\n", argv[0], fullpath);
114
115 clean_environ();
116
117 umask(077);
118
119 rlim.rlim_cur = 0;
120 rlim.rlim_max = 0;
121 if(setrlimit(RLIMIT_CORE, &rlim) < 0)
122 die("%s: setrlimit: %s\n", argv[0], strerror(errno));
123
124 #ifdef PYTHON_VERSION
125 /* the -E switch has been added in version 2.2 */
126 if(strcmp(PYTHON_VERSION, "2.2") >= 0) {
127 /* this should be superfluous given the castrated environment */
128 *(a++) = "-E";
129 }
130 #endif
131 }
132
133 *(a++) = fullpath;
134
135 for(i = 1; argv[i] != NULL; i++)
136 *(a++) = argv[i];
137
138 *a = NULL;
139
140 execv(python, args);
141
142 die("%s: unable to execute %s: %s\n", argv[0], fullpath, strerror(errno));
143
144 return 1;
145 }

savannah-hackers-public@gnu.org
ViewVC Help
Powered by ViewVC 1.1.26