3 * Check a path for safety
5 * (c) 1999 Mark Wooding
8 /*----- Licensing notice --------------------------------------------------*
10 * This file is part of chkpath.
12 * chkpath is free software; you can redistribute it and/or modify
13 * it under the terms of the GNU General Public License as published by
14 * the Free Software Foundation; either version 2 of the License, or
15 * (at your option) any later version.
17 * chkpath is distributed in the hope that it will be useful,
18 * but WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 * GNU General Public License for more details.
22 * You should have received a copy of the GNU General Public License
23 * along with chkpath; if not, write to the Free Software Foundation,
24 * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
34 /*----- Header files ------------------------------------------------------*/
37 #include <sys/types.h>
39 /*----- Data structures ---------------------------------------------------*/
41 /* --- Search request --- *
43 * This contains parameters from the caller to control what problems are
44 * looked for, and what to do when they're found.
48 uid_t cp_uid; /* Uid that's considered OK */
49 gid_t cp_gid[NGROUPS_MAX + 1]; /* Array of groups that are OK */
50 int cp_gids; /* Number of groups in the array */
51 int cp_verbose; /* Verbosity level to spit up */
52 unsigned cp_what; /* What things to check for */
53 void (*cp_report)(unsigned /*what*/, int /*verb*/,
54 const char */*dir*/, const char */*msg*/,
56 void *cp_arg; /* Argument for cp_report */
59 /* --- Flags for `@what@' fields in the above --- */
62 #define CP_PROBLEMS 0x1fu /* Mask of problem bits */
63 #define CP_ERROR 0x01u /* Error report */
64 #define CP_WRWORLD 0x02u /* Check write by world */
65 #define CP_WRGRP 0x04u /* Check write by any group */
66 #define CP_WROTHGRP 0x08u /* Check write by other group */
67 #define CP_WROTHUSR 0x10u /* Check write by other user */
70 #define CP_SYMLINK 0x100u /* Report symbolic links */
71 #define CP_REPORT 0x200u /* Make user-readable reports */
72 #define CP_STICKYOK 0x400u /* Don't care if sticky is set */
74 /*----- Functions provided ------------------------------------------------*/
76 /* --- @checkpath@ --- *
78 * Arguments: @const char *p@ = directory name which needs checking
79 * @const struct checkpath *cp@ = parameters for the check
81 * Returns: Zero if all is well, otherwise bitmask of problems.
83 * Use: Scrutinises a directory path to see what evil things other
84 * users could do to it.
87 extern unsigned checkpath(const char */*p*/, const struct checkpath */*cp*/);
89 /* --- @checkpath_addgid@ --- *
91 * Arguments: @struct checkpath *cp@ = pointer to block to fill in
92 * @gid_t g@ = group id to add
94 * Returns: Zero if successful, nonzero if the array is full.
96 * Use: Adds the group @g@ to the structure.
99 extern int checkpath_addgid(struct checkpath */*cp*/, gid_t /*g*/);
101 /* --- @checkpath_setuid@ --- *
103 * Arguments: @struct checkpath *cp@ = pointer to block to fill in
107 * Use: Fills in the @cp_uid@ slot of the structure with the real uid
108 * of the current process.
111 extern void checkpath_setuid(struct checkpath */*cp*/);
113 /* --- @checkpath_setgid@ --- *
115 * Arguments: @struct checkpath *cp@ = pointer to block to fill in
117 * Returns: Zero if successful, nonzero if the array is full.
119 * Use: Adds the real gid of the current process to the @cp_gid@
123 extern int checkpath_setgid(/*cp*/);
125 /* --- @checkpath_setgroups@ --- *
127 * Arguments: @struct checkpath *cp@ = pointer to block to fill in
129 * Returns: Zero if successful, nonzero if the array is full.
131 * Use: Adds the current process's supplementary groups to the
135 extern int checkpath_setgroups(struct checkpath */*cp*/);
137 /* --- @checkpath_setids@ --- *
139 * Arguments: @struct checkpath *cp@ = pointer to block to fill in
143 * Use: Fills in the user ids and things in the structure. This is
144 * equivalent to setting @cp_gids = 0@ and then calling
145 * @_setuid@, @_setgid@ and @_setgroups@. It can't fail.
148 extern void checkpath_setids(struct checkpath */*cp*/);
150 /*----- That's all, folks -------------------------------------------------*/