added rainbow-java setuid wrapper and scriptpu

wrapper is trivially modified from:
http://svn.python.org/view/python/trunk/Misc/setuid-prog.c?revision=81029&view=markup

A thin rainbow wrapper around java; use rainbow-java as you would call
java.  The setuid is necessary in order to let ordinary users (and
daemons) drop privledges w/o needing sudo.

4 files changed, 298 insertions, 0 deletions

diff --git a/Makefile b/Makefile
index 31f95f3..9eb4c3c 100644
--- a/Makefile
+++ b/Makefile
@@ -10,17 +10,20 @@ export LIBDIR ?= $(DESTDIR)$(PREFIX)/lib
 build:
 	python setup.py build
 	$(MAKE) -C nss
+	$(MAKE) -C java
 
 install:
 	python setup.py install --root=$(DESTDIR)
 	$(MAKE) -C bin install
 	$(MAKE) -C nss install
+	$(MAKE) -C java install
 	install -d $(SYSCONFDIR)/security/console.perms.d/
 	install -m 0644 rainbow/conf/51-rainbow.perms $(SYSCONFDIR)/security/console.perms.d/51-rainbow.perms
 	install -d $(LOCALSTATEDIR)/spool/rainbow/2
 
 clean:
 	$(MAKE) -C nss clean
+	$(MAKE) -C java clean
 
 .PHONY: build install clean
 
diff --git a/java/Makefile b/java/Makefile
new file mode 100644
index 0000000..6465048
--- /dev/null
+++ b/java/Makefile
@@ -0,0 +1,63 @@
+
+WARNFLAGS = \
+        -W -Wformat -Wall -Wundef -Wpointer-arith -Wcast-qual \
+        -Wcast-align -Wwrite-strings -Wsign-compare \
+        -Wmissing-noreturn \
+        -Wextra -Wstrict-aliasing=2 \
+        -Wunsafe-loop-optimizations \
+		-Wuninitialized
+
+# Compiler flags for generating dependencies
+DEPFLAGS = -MMD -MP
+CFLAGS ?= -O3
+# CFLAGS ?= -O0 -g
+# LDFLAGS ?= -g
+ALLCFLAGS = -std=gnu99 -fPIC $(WARNFLAGS) $(DEPFLAGS) $(CFLAGS)
+
+# declarations
+
+RAINBOW_JAVA_OBJS = rainbow-java.o
+ALL_OBJS = $(RAINBOW_JAVA_OBJS)
+BINARIES = rainbow-java
+
+SH_PATH=$(LIBDIR)/rainbow-java.sh
+FULL_PATH=\"$(SH_PATH)\"
+
+# if you invoke make as 'make V=1' it will verbosely report on what it
+# is doing, otherwise it defaults to quiet/pretty mode, which makes
+# errors _much_ easier to see
+ifneq ($V, 1)
+MAKEFLAGS = -s
+endif
+
+
+# targets
+
+all: $(BINARIES)
+
+clean:
+	rm -f $(BINARIES) *.d *.o
+
+install:
+	install -D -m 0755 rainbow-java.sh $(SH_PATH)
+	install -D -m 6755 rainbow-java $(BINDIR)/rainbow-java
+
+# objects
+
+%.o: %.c
+	@echo "  CC    $@"
+	$(CC) $(ALLCFLAGS) -c -o $@ $< -DFULL_PATH=$(FULL_PATH)
+
+
+# linked binaries
+
+rainbow-java: $(RAINBOW_JAVA_OBJS)
+	@echo "  LD    $@"
+	$(CC) $(ALLCFLAGS) -o $@ $^
+
+
+.PHONY: clean install
+
+-include $(ALL_OBJS:%.o=%.d)
+
+# vim: noet sts=4 ts=4 sw=4 :
diff --git a/java/rainbow-java.c b/java/rainbow-java.c
new file mode 100644
index 0000000..a991d44
--- /dev/null
+++ b/java/rainbow-java.c
@@ -0,0 +1,185 @@
+/*
+   Template for a setuid program that calls a script.
+
+   The script should be in an unwritable directory and should itself
+   be unwritable.  In fact all parent directories up to the root
+   should be unwritable.  The script must not be setuid, that's what
+   this program is for.
+
+   This is a template program.  You need to fill in the name of the
+   script that must be executed.  This is done by changing the
+   definition of FULL_PATH below.
+
+   There are also some rules that should be adhered to when writing
+   the script itself.
+
+   The first and most important rule is to never, ever trust that the
+   user of the program will behave properly.  Program defensively.
+   Check your arguments for reasonableness.  If the user is allowed to
+   create files, check the names of the files.  If the program depends
+   on argv[0] for the action it should perform, check it.
+
+   Assuming the script is a Bourne shell script, the first line of the
+   script should be
+    #!/bin/sh -
+   The - is important, don't omit it.  If you're using esh, the first
+   line should be
+    #!/usr/local/bin/esh -f
+   and for ksh, the first line should be
+    #!/usr/local/bin/ksh -p
+   The script should then set the variable IFS to the string
+   consisting of <space>, <tab>, and <newline>.  After this (*not*
+   before!), the PATH variable should be set to a reasonable value and
+   exported.  Do not expect the PATH to have a reasonable value, so do
+   not trust the old value of PATH.  You should then set the umask of
+   the program by calling
+    umask 077 # or 022 if you want the files to be readable
+   If you plan to change directories, you should either unset CDPATH
+   or set it to a good value.  Setting CDPATH to just ``.'' (dot) is a
+   good idea.
+   If, for some reason, you want to use csh, the first line should be
+    #!/bin/csh -fb
+   You should then set the path variable to something reasonable,
+   without trusting the inherited path.  Here too, you should set the
+   umask using the command
+    umask 077 # or 022 if you want the files to be readable
+*/
+
+#include <unistd.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <pwd.h>
+#include <string.h>
+
+/* CONFIGURATION SECTION */
+/* the path to the script should be specified from the makefile */
+#ifndef UMASK
+#define UMASK           077
+#endif
+
+/* END OF CONFIGURATION SECTION */
+
+#if defined(__STDC__) && defined(__sgi)
+#define environ _environ
+#endif
+
+/* don't change def_IFS */
+char def_IFS[] = "IFS= \t\n";
+/* you may want to change def_PATH, but you should really change it in */
+/* your script */
+#ifdef __sgi
+char def_PATH[] = "PATH=/usr/bsd:/usr/bin:/bin:/usr/local/bin:/usr/sbin";
+#else
+char def_PATH[] = "PATH=/usr/ucb:/usr/bin:/bin:/usr/local/bin";
+#endif
+/* don't change def_CDPATH */
+char def_CDPATH[] = "CDPATH=.";
+/* don't change def_ENV */
+char def_ENV[] = "ENV=:";
+
+/*
+   This function changes all environment variables that start with LD_
+   into variables that start with XD_.  This is important since we
+   don't want the script that is executed to use any funny shared
+   libraries.
+
+   The other changes to the environment are, strictly speaking, not
+   needed here.  They can safely be done in the script.  They are done
+   here because we don't trust the script writer (just like the script
+   writer shouldn't trust the user of the script).
+   If IFS is set in the environment, set it to space,tab,newline.
+   If CDPATH is set in the environment, set it to ``.''.
+   Set PATH to a reasonable default.
+*/
+void
+clean_environ(void)
+{
+    char **p;
+    extern char **environ;
+
+    for (p = environ; *p; p++) {
+        if (strncmp(*p, "LD_", 3) == 0)
+            **p = 'X';
+        else if (strncmp(*p, "_RLD", 4) == 0)
+            **p = 'X';
+        else if (strncmp(*p, "PYTHON", 6) == 0)
+            **p = 'X';
+        else if (strncmp(*p, "IFS=", 4) == 0)
+            *p = def_IFS;
+        else if (strncmp(*p, "CDPATH=", 7) == 0)
+            *p = def_CDPATH;
+        else if (strncmp(*p, "ENV=", 4) == 0)
+            *p = def_ENV;
+    }
+    putenv(def_PATH);
+}
+
+int
+main(int argc __attribute__ ((unused)), char **argv)
+{
+    struct stat statb;
+    gid_t egid = getegid();
+    uid_t euid = geteuid();
+    struct passwd *pw;
+    int err;
+
+    /*
+       Sanity check #1.
+       This check should be made compile-time, but that's not possible.
+       If you're sure that you specified a full path name for FULL_PATH,
+       you can omit this check.
+    */
+    if (FULL_PATH[0] != '/') {
+        fprintf(stderr, "%s: %s is not a full path name\n", argv[0],
+            FULL_PATH);
+        fprintf(stderr, "You can only use this wrapper if you\n");
+        fprintf(stderr, "compile it with an absolute path.\n");
+        exit(1);
+    }
+
+    /*
+       Sanity check #2.
+       Check that the owner of the script is equal to either the
+       effective uid or the super user.
+    */
+    if (stat(FULL_PATH, &statb) < 0) {
+        perror("stat");
+        exit(1);
+    }
+    if (statb.st_uid != 0 && statb.st_uid != euid) {
+        fprintf(stderr, "%s: %s has the wrong owner\n", argv[0],
+            FULL_PATH);
+        fprintf(stderr, "The script should be owned by root,\n");
+        fprintf(stderr, "and shouldn't be writeable by anyone.\n");
+        exit(1);
+    }
+
+    pw = getpwuid(getuid());
+    if (!pw) {
+        perror("getpwuid");
+	exit(1);
+    }
+
+    err = setenv("ORIG_USER", pw->pw_name, 1);
+    if (err) {
+        perror("setenv");
+	exit(1);
+    }
+
+    if (setregid(egid, egid) < 0)
+        perror("setregid");
+    if (setreuid(euid, euid) < 0)
+        perror("setreuid");
+
+    clean_environ();
+
+    umask(UMASK);
+
+    while (**argv == '-')       /* don't let argv[0] start with '-' */
+        (*argv)++;
+    execv(FULL_PATH, argv);
+    fprintf(stderr, "%s: could not execute the script\n", argv[0]);
+    exit(1);
+}
diff --git a/java/rainbow-java.sh b/java/rainbow-java.sh
new file mode 100755
index 0000000..e33f0ee
--- /dev/null
+++ b/java/rainbow-java.sh
@@ -0,0 +1,47 @@
+#!/bin/bash
+
+function usage() {
+  echo "$0 /path/to/program"
+  echo "ex: $0 /bin/bash"
+  exit 1
+}
+
+read_parent_envvar () {
+python <<EOF
+import os
+from os.path import join
+
+ppid = os.getppid()
+env = open(join('/proc', str(ppid),'environ')).read().split('\0')
+for kv in env:
+  if kv.startswith("$1="):
+    print kv[len("$1="):]
+EOF
+}
+
+PARENT_PATH=`read_parent_envvar PATH`
+
+if [ -z "$DISPLAY" ]; then
+  DISPLAY=`read_parent_envvar DISPLAY`
+fi
+
+if [ -z "$TERM" ]; then
+  DISPLAY=`read_parent_envvar TERM`
+fi
+
+exec /usr/sbin/rainbow-run \
+  -q \
+  -s /var/spool/rainbow/2 \
+  -u "$ORIG_USER" \
+  -f 0 -f 1 -f 2 \
+  -i "$ORIG_USER" \
+  -E "DISPLAY=$DISPLAY" \
+  -E "TERM=$TERM" \
+  -E "XAUTHORITY=${XAUTHORITY:-${HOME}/.Xauthority}" \
+  -E "PATH=${PARENT_PATH}" \
+  -a /usr/bin/rainbow-xify \
+  -c "`pwd`" \
+  -o audio \
+  -o network \
+  -- \
+  "/usr/bin/java" "$@"