.SH NAME
authbind\-helper \- helper program to bind sockets to privileged ports without root
.SH SYNOPSIS
-.BI /usr/lib/authbind/helper " addr\-hex port\-hex " < socket
+.BI /usr/lib/authbind/helper " addr4\-hex port\-hex " < socket
+.br
+.BI /usr/lib/authbind/helper " addr6\-hex port\-hex 6 " < socket
.SH DESCRIPTION
.B helper
is the program used by
It may also be used standalone, i.e. without assistance from
.BR authbind .
Its standard input should be a TCP/IP socket, and it should be passed
-two arguments.
+two or three arguments.
.PP
The arguments are the address and port number, respectively, to which
-the caller desires that the socket be bound. They should be hex
-strings,
+the caller desires that the socket be bound, and the address family
+(ommitted for IPv4; the fixed string
+.B 6
+for IPv6).
+The address and port should be hex strings,
.I without
leading
.BR 0x ,
-of exactly the right length (8 and 4 digits, respectively), being
+of exactly the right length (8 or 32, and 4, digits, respectively), being
a pairs of hex digits for each byte in the address or port number when
expressed in host byte order. For example, the port argument is the
result of something like
.B sprintf(arg,
.B """%04X"",
.BR sin.sin_port) .
-.PP
-.B helper
-will not bind to ports 512 and onwards, because programs like
-.B rshd
-expect these to be used for outgoing connections, so allowing a user
-to bind to one of these would open up security hole(s).
.SH EXIT STATUS
.B helper
will exit with code 0 on success.
.BR /etc/authbind .
.PP
Firstly,
-.BR /etc/authbind/byport/ [ ! ]\fIport\fR
+.BI /etc/authbind/byport/ port
is tested. If this file is accessible for execution to the calling
user, according to
.BR access (2),
.RI ( "Permission denied" ).
.PP
Secondly, if that test fails to resolve the matter,
-.BR /etc/authbind/byaddr/ \fIaddr\fR : [ ! ]\fIport\fR
-is tested, in the same manner as above.
+.BI /etc/authbind/byaddr/ addr , port
+(any protocol) or failing that
+.BI /etc/authbind/byaddr/ addr : port
+(IPv4 only)
+is tested, in the same manner as above. (Here
+.I addr
+is as from
+.BR inet_ntop .)
.PP
Thirdly, if the question is still unresolved, the file
-.BR /etc/authbind/byuid/ [ ! ]\fIuid\fR
+.BI /etc/authbind/byuid/ uid
will be opened and read. If the file does not exist then the binding
is not authorised and
.B bind
.RI ( "Operation not permitted" ", or " "Not owner" ).
If the file does exist it will be searched for a line of the form
.nf
-.IB addr4 / length : min\-port , max\-port
-.IR addrmin [\fB-\fR addrmax ]\fB:\fR min\-port \fB,\fR max\-port
+.IR addrmin [\fB\-\fR addrmax ]\fB,\fR portmin \fB\-\fR portmax
+.IB addr4 / length : portmin , portmax
.fi
-matching the request. The first form requires that the initial
+matching the request.
+The first form requires that the address lies in the
+relevant range (inclusive at both ends).
+The second form requires that the initial
.I length
bits of
.I addr
match those in the proposed
.B bind
-call. The second form requires that the address lies in the
-relevant range (inclusive at both ends). Addresses can
+call and is only available for IPv4.
+Addresses can
be in any form acceptable to inet_pton. In both cases
the proposed port number must lie is in the inclusive range
specified. If such a line is found then the binding is authorised.
.I port
is the (local) TCP or UDP port number, expressed as an unsigned
integer in the minimal non-zero number of digits, and
-.TP
-.I addr
-is the (local) IP address, as a dotted quad.
.PP
If a read error occurs, or the directory
.B /etc/authbind
lines in
.BI /etc/authbind/byuid/ uid
files are silently ignored (as are lines whose
-.I addr
+.I addr4
has non-zero bits more than
.I length
-from the top).
-.TP
+from the top) or where
+.I min
+is larger than
+.IR max .
+.PP
Authorising binding to ports from 512 to 1023 inclusive is
not recommended. Some protocols (including some versions of NFS)
authorise clients by seeing that they are using a port number in this
range. So by authorising a program to be a server for such a port,
you are also authorising it to impersonate the whole host for those
protocols. To make sure that this isn't done by accident,
-if the port number requested is in the range 512-1023, all the files
-checked and read will have the additional
+if the port number requested is in the range 512-1023, authbind
+will expect the permission files to have an additional
.B !
-character.
+at the start of their leafname.
.SH MECHANISM
The shared library loaded using
.B LD_PRELOAD
library explicitly rather than via
.BR LD_PRELOAD .
.PP
-Some badly-written programs may have trouble because
+Some programs may have trouble because
.B authbind
spawns a child process `under their feet', causing (for example) a
.BR fork (2)
to happen and
.B SIGCHLD
-signal to be delivered. Programs should not rely on standard
-libraries not doing these things.
+signal to be delivered. Unfortunately the Unix API does not make
+it possible to deal with this problem in a sane way.
.PP
The access control configuration scheme is somewhat strange.
.SH FILES AND ENVIRONMENT VARIABLES
-authbind (1.2.1) unstable; urgency=low
+authbind (2.0.0) unstable; urgency=medium
+ * Support IPv6. (Closes: #596921.)
+ * Support ports 512-1023 if the user really wants.
+ Explain the problem more clearly in the manpage. (Closes: 654706.)
* Correct manpage description of helper protocol to have
actually-implemented byte order convention. (Closes: #651694.)
+ * Improve wording in BUGS section of manpage about forking.
* Set Priority to optional as in ftpmaster override file.
* Upstream repo is now in git.
const char *np;
const char *tophalfchar="";
unsigned long port, addr4=0, haddr4=0;
- unsigned int hport, a1,a2,a3,a4, alen,pmin,pmax;
- int nchar, af;
+ unsigned int hport;
+ int af;
FILE *file;
if (argc == 3) {
np= inet_ntop(af,addr_any,npbuf,addrlen_any);
assert(np);
- snprintf(fnbuf,sizeof(fnbuf)-1,"byaddr/%s:%s%u",np,tophalfchar,hport);
+ if (af == AF_INET) {
+ snprintf(fnbuf,sizeof(fnbuf)-1,"byaddr/%s%s:%u",np,tophalfchar,hport);
+ if (!access(fnbuf,X_OK)) authorised();
+ if (errno != ENOENT) exiterrno(errno);
+ }
+
+ snprintf(fnbuf,sizeof(fnbuf)-1,"byaddr/%s%s,%u",np,tophalfchar,hport);
if (!access(fnbuf,X_OK)) authorised();
if (errno != ENOENT) exiterrno(errno);
if (!file) exiterrno(errno==ENOENT ? EPERM : errno);
while (fgets(fnbuf,sizeof(fnbuf)-1,file)) {
- nchar= -1;
+ unsigned int a1,a2,a3,a4, alen,pmin,pmax;
+ int nchar= -1;
- char *colon = strchr(fnbuf,'/');
- if (!colon) continue;
- *colon++ = '\0';
+ if (af == AF_INET &&
+ (sscanf(fnbuf," %u.%u.%u.%u/%u: %u,%u %n",
+ &a1,&a2,&a3,&a4,&alen,&pmin,&pmax,&nchar),
+ nchar == strlen(fnbuf))) {
- sscanf(fnbuf," %u.%u.%u.%u/%u%n",
- &a1,&a2,&a3,&a4,&alen,&nchar);
- if (nchar == strlen(fnbuf)) {
if (alen>32 || pmin&~0x0ffff || pmax&~0x0ffff ||
a1&~0x0ff || a2&~0xff || a3&~0x0ff || a4&~0x0ff)
continue;
thaddr= (a1<<24)|(a2<<16)|(a3<<8)|(a4);
thmask= 0x0ffffffffUL<<(32-alen);
if ((haddr4&thmask) != thaddr) continue;
+
} else {
+
+ char *comma = strchr(fnbuf,',');
+ if (comma) continue;
+ *comma++ = '\0';
+
char *hyphen = strchr(fnbuf,'-');
const char *min, *max;
if (hyphen) {
unsigned char maxaddr[addrlen_any];
if (inet_pton(af,min,minaddr) != 1 ||
inet_pton(af,max,maxaddr) != 1)
- continue;
+ continue;
if (memcmp(addr_any,minaddr,addrlen_any) < 0 ||
memcmp(addr_any,maxaddr,addrlen_any) > 0)
- continue;
- }
+ continue;
- sscanf(colon," %u,%u %n",
- &pmin,&pmax,&nchar);
- if (nchar != strlen(colon))
- continue;
-
+ sscanf(comma," %u-%u %n",
+ &pmin,&pmax,&nchar);
+ if (nchar != strlen(comma))
+ continue;
+
+ }
if (hport<pmin || hport>pmax) continue;
authorised();
int bind(int fd, const struct sockaddr *addr, socklen_t addrlen) {
pid_t child, rchild;
- char portarg[5], addrarg[9];
- int r, status;
+ char portarg[5], addrarg[33];
+ const char *afarg;
+ int i, r, status;
const int *evilsignal;
sigset_t block, saved;
+ unsigned int portval;
+
+ switch (addr->sa_family) {
+ case AF_INET:
+ portval = ((struct sockaddr_in*)addr)->sin_port;
+ if (addrlen != sizeof(struct sockaddr_in)) goto bail;
+ break;
+ case AF_INET6:
+ portval = ((struct sockaddr_in6*)addr)->sin6_port;
+ if (addrlen != sizeof(struct sockaddr_in6)) goto bail;
+ break;
+ default:
+ goto bail;
+ }
- if (addr->sa_family != AF_INET || addrlen != sizeof(struct sockaddr_in) ||
- !geteuid() || ((struct sockaddr_in*)addr)->sin_port == 0 ||
- ntohs(((struct sockaddr_in*)addr)->sin_port) >= IPPORT_RESERVED/2)
+ if (!geteuid() || portval == 0 || portval >= IPPORT_RESERVED) {
+ bail:
return old_bind(fd,addr,addrlen);
+ }
sigfillset(&block);
for (evilsignal=evilsignals;
evilsignal++)
sigdelset(&block,*evilsignal);
if (sigprocmask(SIG_BLOCK,&block,&saved)) return -1;
-
- sprintf(addrarg,"%08lx",
- ((unsigned long)(((struct sockaddr_in*)addr)->sin_addr.s_addr))&0x0ffffffffUL);
+
+ switch (addr->sa_family) {
+ case AF_INET:
+ afarg = 0;
+ sprintf(addrarg,"%08lx",
+ ((unsigned long)(((struct sockaddr_in*)addr)->sin_addr.s_addr))
+ &0x0ffffffffUL);
+ break;
+ case AF_INET6:
+ afarg = "6";
+ for (i=0; i<16; i++)
+ sprintf(addrarg+i*2,"%02x",
+ ((struct sockaddr_in6*)addr)->sin6_addr.s6_addr[i]);
+ break;
+ default:
+ abort();
+ }
sprintf(portarg,"%04x",
- ((unsigned int)(((struct sockaddr_in*)addr)->sin_port))&0x0ffff);
+ portval&0x0ffff);
child= fork(); if (child==-1) goto x_err;
if (!child) {
if (dup2(fd,0)) exiterrno(errno);
removepreload();
- execl(HELPER,HELPER,addrarg,portarg,(char*)0);
+ execl(HELPER,HELPER,addrarg,portarg,afarg,(char*)0);
status= errno > 0 && errno < 127 ? errno : 127;
STDERRSTR_CONST("libauthbind: possible installation problem - "
"could not invoke " HELPER " (");
~ian / authbind.git / commitdiff