diff options
| -rw-r--r-- | pinyweb/Makefile | 7 | ||||
| -rw-r--r-- | pinyweb/debian/changelog | 6 | ||||
| -rw-r--r-- | pinyweb/debian/control | 2 | ||||
| -rw-r--r-- | pinyweb/suid/Makefile | 5 | ||||
| -rw-r--r-- | pinyweb/suid/piny-suid.c | 121 |
5 files changed, 139 insertions, 2 deletions
diff --git a/pinyweb/Makefile b/pinyweb/Makefile index 5b1f010..622f24c 100644 --- a/pinyweb/Makefile +++ b/pinyweb/Makefile @@ -1,5 +1,10 @@ build: + $(MAKE) -C suid install: - install -o root -g root -m 755 -d $(DESTDIR)/usr/lib/cgi-bin + install -o root -g root -m 755 -d $(DESTDIR)/usr/lib/cgi-bin $(DESTDIR)/usr/sbin install -o root -g root -m 755 cgi-bin/* $(DESTDIR)/usr/lib/cgi-bin + install -o root -g www-data -m 4754 suid/piny-suid $(DESTDIR)/usr/sbin + +clean: + $(MAKE) -C suid clean diff --git a/pinyweb/debian/changelog b/pinyweb/debian/changelog index e8e9f8d..2b34122 100644 --- a/pinyweb/debian/changelog +++ b/pinyweb/debian/changelog @@ -1,3 +1,9 @@ +pinyweb (0.2) unstable; urgency=low + + * Adding a setuid wrapper. + + -- Julian Blake Kongslie <jblake@omgwallhack.org> Mon, 27 Dec 2010 13:48:40 -0800 + pinyweb (0.1) unstable; urgency=low * Initial release. diff --git a/pinyweb/debian/control b/pinyweb/debian/control index 6abae90..5b44254 100644 --- a/pinyweb/debian/control +++ b/pinyweb/debian/control @@ -7,7 +7,7 @@ Homepage: http://www.piny.be/piny-code/ Standards-version: 3.8.4 Package: pinyweb -Architecture: all +Architecture: any Depends: ${perl:Depends}, ${misc:Depends}, libpiny-perl (>= 0.14) Description: CGIs for managing piny repositories The CGI programs for day-to-day administrative tasks in the Piny diff --git a/pinyweb/suid/Makefile b/pinyweb/suid/Makefile new file mode 100644 index 0000000..6d67058 --- /dev/null +++ b/pinyweb/suid/Makefile @@ -0,0 +1,5 @@ +piny-suid: piny-suid.c + gcc -Wall -Werror -Os -o $@ $< + +clean: + rm -f piny-suid diff --git a/pinyweb/suid/piny-suid.c b/pinyweb/suid/piny-suid.c new file mode 100644 index 0000000..251e3e1 --- /dev/null +++ b/pinyweb/suid/piny-suid.c @@ -0,0 +1,121 @@ +#include <errno.h> +#include <pwd.h> +#include <regex.h> +#include <stdio.h> +#include <string.h> +#include <sys/types.h> +#include <syslog.h> +#include <unistd.h> + +int main( int argc, char *argv[] ) { + + int err; + + openlog( "piny-suid", LOG_ODELAY, LOG_AUTHPRIV ); + + if ( argc < 3 ) { + syslog( LOG_ERR, "Invalid usage" ); + fprintf( stderr, "Usage: %s username command [args ...]\n", argv[0] ); + return 1; + }; + + regex_t user_reg; + + // Please note that these regular expressions should duplicate the language for usernames described in Piny::User. + if ( ( err = regcomp( &user_reg, "^[a-zA-Z][a-zA-Z0-9_.-]*$", REG_EXTENDED | REG_NOSUB ) ) != 0 ) { + size_t sz = regerror( err, &user_reg, NULL, 0 ); + char buf[sz]; + regerror( err, &user_reg, buf, sz ); + syslog( LOG_CRIT, "Internal error; first regex, %s", buf ); + fprintf( stderr, "Internal error compiling first regular expression: %s\n", buf ); + return 1; + }; + + if ( regexec( &user_reg, argv[1], 0, NULL, 0 ) ) { + syslog( LOG_ERR, "Invalid username '%s' (first regex)", argv[1] ); + fprintf( stderr, "'%s' does not appear to be a valid username!\n", argv[1] ); + return 1; + }; + + regfree( &user_reg ); + + if ( ( err = regcomp( &user_reg, "^(git|ikiwiki)-", REG_EXTENDED | REG_NOSUB ) ) != 0 ) { + size_t sz = regerror( err, &user_reg, NULL, 0 ); + char buf[sz]; + regerror( err, &user_reg, buf, sz ); + syslog( LOG_CRIT, "Internal error: second regex, %s", buf ); + fprintf( stderr, "Internal error compiling second regular expression: %s\n", buf ); + return 1; + }; + + if ( ! regexec( &user_reg, argv[1], 0, NULL, 0 ) ) { + syslog( LOG_ERR, "Invalid username '%s' (second regex)", argv[1] ); + fprintf( stderr, "'%s' does not appear to be a valid username!\n", argv[1] ); + return 1; + }; + + regfree( &user_reg ); + + regex_t cmd_reg; + + if ( ( err = regcomp( &cmd_reg, "/", REG_EXTENDED | REG_NOSUB ) ) != 0 ) { + size_t sz = regerror( err, &cmd_reg, NULL, 0 ); + char buf[sz]; + regerror( err, &cmd_reg, buf, sz ); + syslog( LOG_CRIT, "Internal error: third regex, %s", buf ); + fprintf( stderr, "Internal error compiling third regular expression: %s\n", buf ); + return 1; + }; + + if ( ! regexec( &cmd_reg, argv[2], 0, NULL, 0 ) ) { + syslog( LOG_ERR, "Invalid command '%s' (third regex)", argv[2] ); + fprintf( stderr, "'%s' does not appear to be a valid command!\n", argv[2] ); + return 1; + }; + + regfree( &cmd_reg ); + + struct passwd *pwd = getpwnam( argv[1] ); + + if ( ! pwd ) { + syslog( LOG_ERR, "Invalid username '%s' (getpwnam)", argv[1] ); + fprintf( stderr, "'%s' does not appear to be a valid username!\n", argv[1] ); + return 1; + }; + + if ( pwd->pw_uid < 1000 ) { + syslog( LOG_ERR, "Invalid username '%s' (uid)", argv[1] ); + fprintf( stderr, "'%s' does not appear to be a valid username!\n", argv[1] ); + return 1; + }; + + if ( setregid( pwd->pw_gid, pwd->pw_gid ) != 0 ) { + err = errno; + syslog( LOG_ERR, "Unable to change GID: %s, %s", argv[2], strerror( err ) ); + fprintf( stderr, "Unable to change GID: %s\n", strerror( err ) ); + return 1; + }; + + if ( setreuid( pwd->pw_uid, pwd->pw_uid ) != 0 ) { + err = errno; + syslog( LOG_ERR, "Unable to change UID: %s, %s", argv[2], strerror( err ) ); + fprintf( stderr, "Unable to change UID: %s\n", strerror( err ) ); + return 1; + }; + + size_t sz = snprintf( NULL, 0, "/usr/share/piny-suid/%s", argv[2] ); + char buf[sz]; + snprintf( buf, sz, "/usr/share/piny-suid/%s", argv[2] ); + + char * const env[] = + { NULL + }; + + syslog( LOG_NOTICE, "Going to exec '%s' as '%s'", argv[2], argv[1] ); + execve( buf, argv + 2, env ); + + syslog( LOG_ERR, "Invalid command '%s' (fell past exec)", argv[2] ); + fprintf( stderr, "'%s' does not appear to be a valid command!\n", argv[2] ); + return 1; + +}; |