+/* -*-c-*-
+ *
+ * $Id: checkpath.c,v 1.1 1999/04/06 20:12:07 mdw Exp $
+ *
+ * Check a path for safety
+ *
+ * (c) 1999 Mark Wooding
+ */
+
+/*----- Licensing notice --------------------------------------------------*
+ *
+ * This file is part of chkpath.
+ *
+ * chkpath is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * chkpath is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with chkpath; if not, write to the Free Software Foundation,
+ * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+/*----- Revision history --------------------------------------------------*
+ *
+ * $Log: checkpath.c,v $
+ * Revision 1.1 1999/04/06 20:12:07 mdw
+ * Initial revision
+ *
+ */
+
+/*----- Header files ------------------------------------------------------*/
+
+#include <errno.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <unistd.h>
+
+#include <pwd.h>
+#include <grp.h>
+
+#include <mLib/alloc.h>
+#include <mLib/dstr.h>
+
+#include "path.h"
+
+/*----- Data structures ---------------------------------------------------*/
+
+/* --- An item in the directory list --- *
+ *
+ * Each directory becomes an element on a list which is manipulated in a
+ * stack-like way.
+ */
+
+struct elt {
+ struct elt *e_link; /* Pointer to the next one along */
+ size_t e_offset; /* Offset of name in path string */
+ unsigned e_flags; /* Various useful flags */
+ char e_name[1]; /* Name of the directory */
+};
+
+enum {
+ f_sticky = 1 /* Directory has sticky bit set */
+};
+
+enum {
+ f_last = 1 /* This is the final item to check */
+};
+
+/*----- Static variables --------------------------------------------------*/
+
+static struct elt rootnode = { 0, 0, 0 }; /* Root of the list */
+static struct elt *sp; /* Stack pointer for list */
+static dstr d; /* Current path string */
+
+/*----- Main code ---------------------------------------------------------*/
+
+/* --- @splitpath@ --- *
+ *
+ * Arguments: @const char *path@ = path string to break apart
+ * @struct elt *tail@ = tail block to attach to end of list
+ *
+ * Returns: Pointer to the new list head.
+ *
+ * Use: Breaks a path string into directories and adds each one
+ * as a node on the list, in the right order. These can then
+ * be pushed onto the directory stack as required.
+ */
+
+static struct elt *splitpath(const char *path, struct elt *tail)
+{
+ struct elt *head, **ee = &head, *e;
+
+ while (*path) {
+ size_t n;
+
+ /* --- Either a leading `/', or a doubled one --- *
+ *
+ * Either way, ignore it.
+ */
+
+ if (*path == '/') {
+ path++;
+ continue;
+ }
+
+ /* --- Skip to the next directory separator --- *
+ *
+ * Build a list element for it, and link it on.
+ */
+
+ n = strcspn(path, "/");
+ e = xmalloc(sizeof(struct elt) + n + 1);
+ memcpy(e->e_name, path, n);
+ e->e_name[n] = 0;
+ e->e_flags = 0;
+ *ee = e;
+ ee = &e->e_link;
+ path += n;
+ }
+
+ /* --- Done --- */
+
+ *ee = tail;
+ return (head);
+}
+
+/* --- @pop@ --- *
+ *
+ * Arguments: ---
+ *
+ * Returns: ---
+ *
+ * Use: Removes the top item from the directory stack.
+ */
+
+static void pop(void)
+{
+ if (sp->e_link) {
+ struct elt *e = sp->e_link;
+ d.len = sp->e_offset;
+ DPUTZ(&d);
+ sp = e;
+ }
+}
+
+/* --- @popall@ --- *
+ *
+ * Arguments: ---
+ *
+ * Returns: ---
+ *
+ * Use: Removes all the items from the directory stack.
+ */
+
+static void popall(void)
+{
+ while (sp->e_link)
+ pop();
+}
+
+/* --- @push@ --- *
+ *
+ * Arguments: @struct elt *e@ = pointer to directory element
+ *
+ * Returns: ---
+ *
+ * Use: Pushes a new subdirectory onto the stack.
+ */
+
+static void push(struct elt *e)
+{
+ e->e_link = sp;
+ e->e_offset = d.len;
+ DPUTC(&d, '/');
+ DPUTS(&d, e->e_name);
+ sp = e;
+}
+
+/* --- @report@ --- *
+ *
+ * Arguments: @struct chkpath *cp@ = pointer to context
+ * @int what@ = what sort of report is this?
+ * @int verbose@ = how verbose is this?
+ * @const char *p@ = what path does it refer to?
+ * @const char *msg@ = the message to give to the user
+ *
+ * Returns: ---
+ *
+ * Use: Formats and presents messages to the client.
+ */
+
+static void report(struct chkpath *cp, int what, int verbose,
+ const char *p, const char *msg, ...)
+{
+ /* --- Decide whether to bin this message --- */
+
+ if (!cp->cp_report || verbose > cp->cp_verbose || !(cp->cp_what & what))
+ return;
+
+ /* --- Format the message nicely --- */
+
+ if (cp->cp_what & CP_REPORT) {
+ dstr d;
+ va_list ap;
+ const char *q = msg;
+ size_t n;
+ int e = errno;
+
+ dstr_create(&d);
+ va_start(ap, msg);
+ if (verbose > 1)
+ dstr_puts(&d, "[ ");
+ if (p)
+ dstr_putf(&d, "Path: %s: ", p);
+ while (*q) {
+ if (*q == '%') {
+ q++;
+ switch (*q) {
+ case 'e':
+ dstr_puts(&d, strerror(e));
+ break;
+ case 'u': {
+ uid_t u = (uid_t)va_arg(ap, int);
+ struct passwd *pw = getpwuid(u);
+ if (pw)
+ dstr_putf(&d, "`%s'", pw->pw_name);
+ else
+ dstr_putf(&d, "%i", (int)u);
+ } break;
+ case 'g': {
+ gid_t g = (gid_t)va_arg(ap, int);
+ struct group *gr = getgrgid(g);
+ if (gr)
+ dstr_putf(&d, "`%s'", gr->gr_name);
+ else
+ dstr_putf(&d, "%i", (int)g);
+ } break;
+ case 's': {
+ const char *s = va_arg(ap, const char *);
+ dstr_puts(&d, s);
+ } break;
+ case '%':
+ dstr_putc(&d, '%');
+ break;
+ default:
+ dstr_putc(&d, '%');
+ dstr_putc(&d, *q);
+ break;
+ }
+ q++;
+ } else {
+ n = strcspn(q, "%");
+ DPUTM(&d, q, n);
+ q += n;
+ }
+ }
+ if (verbose > 1)
+ dstr_puts(&d, " ]");
+ DPUTZ(&d);
+ cp->cp_report(what, verbose, p, d.buf, cp->cp_arg);
+ dstr_destroy(&d);
+ va_end(ap);
+ } else
+ cp->cp_report(what, verbose, p, 0, cp->cp_arg);
+}
+
+/* --- @sanity@ --- *
+ *
+ * Arguments: @const char *p@ = name of directory to check
+ * @struct stat *st@ = pointer to @stat@(2) block for it
+ * @struct chkpath *cp@ = pointer to caller parameters
+ * @unsigned f@ = various flags
+ *
+ * Returns: Zero if everything's OK, else bitmask of problems.
+ *
+ * Use: Performs the main load of sanity-checking on a directory.
+ */
+
+static int sanity(const char *p, struct stat *st,
+ struct chkpath *cp, unsigned f)
+{
+ int bad = 0;
+ int sticky = (cp->cp_what & CP_STICKYOK) || !(f & f_last) ? 01000 : 0;
+
+ /* --- Check for world-writability --- */
+
+ if ((cp->cp_what & CP_WRWORLD) &&
+ (st->st_mode & (0002 | sticky)) == 0002) {
+ bad |= CP_WRWORLD;
+ report(cp, CP_WRWORLD, 1, p, "** world writable **");
+ }
+
+ /* --- Check for group-writability --- */
+
+ if ((cp->cp_what & (CP_WRGRP | CP_WROTHGRP)) &&
+ (st->st_mode & (0020 | sticky)) == 0020) {
+ if (cp->cp_what & CP_WRGRP) {
+ bad |= CP_WRGRP;
+ report(cp, CP_WRGRP, 1, p, "writable by group %g", st->st_gid);
+ } else {
+ int i;
+ for (i = 0; i < cp->cp_gids; i++) {
+ if (st->st_gid == cp->cp_gid[i])
+ goto good_gid;
+ }
+ bad |= CP_WROTHGRP;
+ report(cp, CP_WROTHGRP, 1, p, "writable by group %g", st->st_gid);
+ good_gid:;
+ }
+ }
+
+ /* --- Check for user-writability --- */
+
+ if ((cp->cp_what & CP_WROTHUSR) &&
+ st->st_uid != cp->cp_uid &&
+ st->st_uid != 0) {
+ bad |= CP_WROTHUSR;
+ report(cp, CP_WROTHUSR, 1, p, "owner is user %u", st->st_uid);
+ }
+
+ /* --- Done sanity check --- */
+
+ return (bad);
+}
+
+/* --- @path_check@ --- *
+ *
+ * Arguments: @const char *p@ = directory name which needs checking
+ * @struct chkpath *cp@ = caller parameters for the check
+ *
+ * Returns: Zero if all is well, otherwise bitmask of problems.
+ *
+ * Use: Scrutinises a directory path to see what evil things other
+ * users could do to it.
+ */
+
+int path_check(const char *p, struct chkpath *cp)
+{
+ char cwd[PATH_MAX];
+ struct elt *e, *ee;
+ struct stat st;
+ int bad = 0;
+
+ /* --- Initialise stack pointer and path string --- */
+
+ sp = &rootnode;
+ dstr_destroy(&d);
+
+ /* --- Try to find the current directory --- */
+
+ if (!getcwd(cwd, sizeof(cwd))) {
+ report(cp, CP_ERROR, 0, 0, "can't find current directory: %e");
+ return (CP_ERROR);
+ }
+
+ /* --- Check that the root directory is OK --- */
+
+ if (stat("/", &st)) {
+ report(cp, CP_ERROR, 0, 0, "can't stat root directory: %e");
+ return (CP_ERROR);
+ }
+
+ report(cp, CP_REPORT, 3, p, "begin scan");
+ bad |= sanity("/", &st, cp, 0);
+
+ /* --- Get the initial list of things to process --- */
+
+ ee = splitpath(p, 0);
+ if (*p != '/')
+ ee = splitpath(cwd, ee);
+
+ /* --- While there are list items which still need doing --- */
+
+ while (ee) {
+ e = ee->e_link;
+
+ /* --- Strip off simple `.' elements --- */
+
+ if (strcmp(ee->e_name, ".") == 0) {
+ free(ee);
+ ee = e;
+ continue;
+ }
+
+ /* --- Backtrack on `..' elements --- */
+
+ else if (strcmp(ee->e_name, "..") == 0) {
+ pop();
+ free(ee);
+ ee = e;
+ continue;
+ }
+
+ /* --- Everything else gets pushed on the end --- */
+
+ push(ee);
+ ee = e;
+
+ /* --- Find out what sort of a thing this is --- */
+
+ if (lstat(d.buf, &st)) {
+ report(cp, CP_ERROR, 0, d.buf, "can't stat: %e");
+ bad |= CP_ERROR;
+ break;
+ }
+
+ /* --- Handle symbolic links specially --- */
+
+ if (S_ISLNK(st.st_mode)) {
+ char buf[PATH_MAX];
+ int i;
+
+ /* --- Resolve the link --- */
+
+ if ((i = readlink(d.buf, buf, sizeof(buf))) < 0) {
+ report(cp, CP_ERROR, 0, d.buf, "can't readlink: %e");
+ bad |= CP_ERROR;
+ break;
+ }
+ buf[i] = 0;
+ report(cp, CP_SYMLINK, 2, d.buf, "symlink -> `%s'", buf);
+
+ /* --- Handle sticky parents --- *
+ *
+ * If I make a symlink in a sticky directory, I can later modify it.
+ * However, nobody else can (except the owner of the directory, and
+ * we'll already have noticed that if we care).
+ */
+
+ if ((cp->cp_what & CP_WROTHUSR) &&
+ (sp->e_link->e_flags & f_sticky) &&
+ st.st_uid != cp->cp_uid && st.st_uid != 0) {
+ bad |= CP_WROTHUSR;
+ report(cp, CP_WROTHUSR, 1, d.buf,
+ "symlink modifiable by user %u", st.st_uid);
+ }
+
+ /* --- Sort out what to do from here --- */
+
+ if (buf[0] == '/')
+ popall();
+ else
+ pop();
+ ee = splitpath(buf, ee);
+ continue;
+ }
+
+ /* --- Run the sanity check on this path element --- */
+
+ bad |= sanity(d.buf, &st, cp, ee ? 0 : f_last);
+
+ if (S_ISDIR(st.st_mode)) {
+ if (st.st_mode & 01000)
+ sp->e_flags |= f_sticky;
+ report(cp, CP_REPORT, 4, d.buf, "directory");
+ continue;
+ }
+
+ /* --- Something else I don't understand --- */
+
+ break;
+ }
+
+ /* --- Check for leftover junk --- */
+
+ if (ee) {
+ if (!(bad & CP_ERROR))
+ report(cp, CP_ERROR, 0, 0, "junk left over after reaching leaf");
+ while (ee) {
+ e = ee->e_link;
+ free(ee);
+ ee = e;
+ }
+ }
+
+ popall();
+ return (bad);
+}
+
+/* --- @path_setids@ --- *
+ *
+ * Arguments: @struct chkpath *cp@ = pointer to block to fill in
+ *
+ * Returns: Zero if OK, else @-1@.
+ *
+ * Use: Fills in the user ids and things in the structure.
+ */
+
+void path_setids(struct chkpath *cp)
+{
+ int n, i;
+ gid_t g = getgid();
+
+ cp->cp_uid = getuid();
+ n = getgroups(sizeof(cp->cp_gid) / sizeof(cp->cp_gid[0]), cp->cp_gid);
+
+ for (i = 0; i < n; i++) {
+ if (cp->cp_gid[i] == g)
+ goto gid_ok;
+ }
+ cp->cp_gid[n++] = g;
+gid_ok:
+ cp->cp_gids = n;
+}
+
+/*----- That's all, folks -------------------------------------------------*/