diff options
-rw-r--r-- | Makefile | 3 | ||||
-rw-r--r-- | java/Makefile | 63 | ||||
-rw-r--r-- | java/rainbow-java.c | 185 | ||||
-rwxr-xr-x | java/rainbow-java.sh | 47 |
4 files changed, 298 insertions, 0 deletions
@@ -10,17 +10,20 @@ export LIBDIR ?= $(DESTDIR)$(PREFIX)/lib build: python setup.py build $(MAKE) -C nss + $(MAKE) -C java install: python setup.py install --root=$(DESTDIR) $(MAKE) -C bin install $(MAKE) -C nss install + $(MAKE) -C java install install -d $(SYSCONFDIR)/security/console.perms.d/ install -m 0644 rainbow/conf/51-rainbow.perms $(SYSCONFDIR)/security/console.perms.d/51-rainbow.perms install -d $(LOCALSTATEDIR)/spool/rainbow/2 clean: $(MAKE) -C nss clean + $(MAKE) -C java clean .PHONY: build install clean diff --git a/java/Makefile b/java/Makefile new file mode 100644 index 0000000..6465048 --- /dev/null +++ b/java/Makefile @@ -0,0 +1,63 @@ + +WARNFLAGS = \ + -W -Wformat -Wall -Wundef -Wpointer-arith -Wcast-qual \ + -Wcast-align -Wwrite-strings -Wsign-compare \ + -Wmissing-noreturn \ + -Wextra -Wstrict-aliasing=2 \ + -Wunsafe-loop-optimizations \ + -Wuninitialized + +# Compiler flags for generating dependencies +DEPFLAGS = -MMD -MP +CFLAGS ?= -O3 +# CFLAGS ?= -O0 -g +# LDFLAGS ?= -g +ALLCFLAGS = -std=gnu99 -fPIC $(WARNFLAGS) $(DEPFLAGS) $(CFLAGS) + +# declarations + +RAINBOW_JAVA_OBJS = rainbow-java.o +ALL_OBJS = $(RAINBOW_JAVA_OBJS) +BINARIES = rainbow-java + +SH_PATH=$(LIBDIR)/rainbow-java.sh +FULL_PATH=\"$(SH_PATH)\" + +# if you invoke make as 'make V=1' it will verbosely report on what it +# is doing, otherwise it defaults to quiet/pretty mode, which makes +# errors _much_ easier to see +ifneq ($V, 1) +MAKEFLAGS = -s +endif + + +# targets + +all: $(BINARIES) + +clean: + rm -f $(BINARIES) *.d *.o + +install: + install -D -m 0755 rainbow-java.sh $(SH_PATH) + install -D -m 6755 rainbow-java $(BINDIR)/rainbow-java + +# objects + +%.o: %.c + @echo " CC $@" + $(CC) $(ALLCFLAGS) -c -o $@ $< -DFULL_PATH=$(FULL_PATH) + + +# linked binaries + +rainbow-java: $(RAINBOW_JAVA_OBJS) + @echo " LD $@" + $(CC) $(ALLCFLAGS) -o $@ $^ + + +.PHONY: clean install + +-include $(ALL_OBJS:%.o=%.d) + +# vim: noet sts=4 ts=4 sw=4 : diff --git a/java/rainbow-java.c b/java/rainbow-java.c new file mode 100644 index 0000000..a991d44 --- /dev/null +++ b/java/rainbow-java.c @@ -0,0 +1,185 @@ +/* + Template for a setuid program that calls a script. + + The script should be in an unwritable directory and should itself + be unwritable. In fact all parent directories up to the root + should be unwritable. The script must not be setuid, that's what + this program is for. + + This is a template program. You need to fill in the name of the + script that must be executed. This is done by changing the + definition of FULL_PATH below. + + There are also some rules that should be adhered to when writing + the script itself. + + The first and most important rule is to never, ever trust that the + user of the program will behave properly. Program defensively. + Check your arguments for reasonableness. If the user is allowed to + create files, check the names of the files. If the program depends + on argv[0] for the action it should perform, check it. + + Assuming the script is a Bourne shell script, the first line of the + script should be + #!/bin/sh - + The - is important, don't omit it. If you're using esh, the first + line should be + #!/usr/local/bin/esh -f + and for ksh, the first line should be + #!/usr/local/bin/ksh -p + The script should then set the variable IFS to the string + consisting of <space>, <tab>, and <newline>. After this (*not* + before!), the PATH variable should be set to a reasonable value and + exported. Do not expect the PATH to have a reasonable value, so do + not trust the old value of PATH. You should then set the umask of + the program by calling + umask 077 # or 022 if you want the files to be readable + If you plan to change directories, you should either unset CDPATH + or set it to a good value. Setting CDPATH to just ``.'' (dot) is a + good idea. + If, for some reason, you want to use csh, the first line should be + #!/bin/csh -fb + You should then set the path variable to something reasonable, + without trusting the inherited path. Here too, you should set the + umask using the command + umask 077 # or 022 if you want the files to be readable +*/ + +#include <unistd.h> +#include <stdlib.h> +#include <stdio.h> +#include <sys/types.h> +#include <sys/stat.h> +#include <pwd.h> +#include <string.h> + +/* CONFIGURATION SECTION */ +/* the path to the script should be specified from the makefile */ +#ifndef UMASK +#define UMASK 077 +#endif + +/* END OF CONFIGURATION SECTION */ + +#if defined(__STDC__) && defined(__sgi) +#define environ _environ +#endif + +/* don't change def_IFS */ +char def_IFS[] = "IFS= \t\n"; +/* you may want to change def_PATH, but you should really change it in */ +/* your script */ +#ifdef __sgi +char def_PATH[] = "PATH=/usr/bsd:/usr/bin:/bin:/usr/local/bin:/usr/sbin"; +#else +char def_PATH[] = "PATH=/usr/ucb:/usr/bin:/bin:/usr/local/bin"; +#endif +/* don't change def_CDPATH */ +char def_CDPATH[] = "CDPATH=."; +/* don't change def_ENV */ +char def_ENV[] = "ENV=:"; + +/* + This function changes all environment variables that start with LD_ + into variables that start with XD_. This is important since we + don't want the script that is executed to use any funny shared + libraries. + + The other changes to the environment are, strictly speaking, not + needed here. They can safely be done in the script. They are done + here because we don't trust the script writer (just like the script + writer shouldn't trust the user of the script). + If IFS is set in the environment, set it to space,tab,newline. + If CDPATH is set in the environment, set it to ``.''. + Set PATH to a reasonable default. +*/ +void +clean_environ(void) +{ + char **p; + extern char **environ; + + for (p = environ; *p; p++) { + if (strncmp(*p, "LD_", 3) == 0) + **p = 'X'; + else if (strncmp(*p, "_RLD", 4) == 0) + **p = 'X'; + else if (strncmp(*p, "PYTHON", 6) == 0) + **p = 'X'; + else if (strncmp(*p, "IFS=", 4) == 0) + *p = def_IFS; + else if (strncmp(*p, "CDPATH=", 7) == 0) + *p = def_CDPATH; + else if (strncmp(*p, "ENV=", 4) == 0) + *p = def_ENV; + } + putenv(def_PATH); +} + +int +main(int argc __attribute__ ((unused)), char **argv) +{ + struct stat statb; + gid_t egid = getegid(); + uid_t euid = geteuid(); + struct passwd *pw; + int err; + + /* + Sanity check #1. + This check should be made compile-time, but that's not possible. + If you're sure that you specified a full path name for FULL_PATH, + you can omit this check. + */ + if (FULL_PATH[0] != '/') { + fprintf(stderr, "%s: %s is not a full path name\n", argv[0], + FULL_PATH); + fprintf(stderr, "You can only use this wrapper if you\n"); + fprintf(stderr, "compile it with an absolute path.\n"); + exit(1); + } + + /* + Sanity check #2. + Check that the owner of the script is equal to either the + effective uid or the super user. + */ + if (stat(FULL_PATH, &statb) < 0) { + perror("stat"); + exit(1); + } + if (statb.st_uid != 0 && statb.st_uid != euid) { + fprintf(stderr, "%s: %s has the wrong owner\n", argv[0], + FULL_PATH); + fprintf(stderr, "The script should be owned by root,\n"); + fprintf(stderr, "and shouldn't be writeable by anyone.\n"); + exit(1); + } + + pw = getpwuid(getuid()); + if (!pw) { + perror("getpwuid"); + exit(1); + } + + err = setenv("ORIG_USER", pw->pw_name, 1); + if (err) { + perror("setenv"); + exit(1); + } + + if (setregid(egid, egid) < 0) + perror("setregid"); + if (setreuid(euid, euid) < 0) + perror("setreuid"); + + clean_environ(); + + umask(UMASK); + + while (**argv == '-') /* don't let argv[0] start with '-' */ + (*argv)++; + execv(FULL_PATH, argv); + fprintf(stderr, "%s: could not execute the script\n", argv[0]); + exit(1); +} diff --git a/java/rainbow-java.sh b/java/rainbow-java.sh new file mode 100755 index 0000000..e33f0ee --- /dev/null +++ b/java/rainbow-java.sh @@ -0,0 +1,47 @@ +#!/bin/bash + +function usage() { + echo "$0 /path/to/program" + echo "ex: $0 /bin/bash" + exit 1 +} + +read_parent_envvar () { +python <<EOF +import os +from os.path import join + +ppid = os.getppid() +env = open(join('/proc', str(ppid),'environ')).read().split('\0') +for kv in env: + if kv.startswith("$1="): + print kv[len("$1="):] +EOF +} + +PARENT_PATH=`read_parent_envvar PATH` + +if [ -z "$DISPLAY" ]; then + DISPLAY=`read_parent_envvar DISPLAY` +fi + +if [ -z "$TERM" ]; then + DISPLAY=`read_parent_envvar TERM` +fi + +exec /usr/sbin/rainbow-run \ + -q \ + -s /var/spool/rainbow/2 \ + -u "$ORIG_USER" \ + -f 0 -f 1 -f 2 \ + -i "$ORIG_USER" \ + -E "DISPLAY=$DISPLAY" \ + -E "TERM=$TERM" \ + -E "XAUTHORITY=${XAUTHORITY:-${HOME}/.Xauthority}" \ + -E "PATH=${PARENT_PATH}" \ + -a /usr/bin/rainbow-xify \ + -c "`pwd`" \ + -o audio \ + -o network \ + -- \ + "/usr/bin/java" "$@" |