1: /*************************************************************************
2: * (C) 2011 AITNET - Sofia/Bulgaria - <office@aitbg.com>
3: * by Michael Pounov <misho@aitbg.com>
4: *
5: * $Author: misho $
6: * $Id: sux.c,v 1.3.2.5 2013/04/09 15:44:28 misho Exp $
7: *
8: *************************************************************************/
9: #include "global.h"
10:
11:
12: cfg_root_t cfg;
13: int Verbose;
14: struct tagProc proc;
15: FILE *lf;
16:
17:
18: static inline void
19: Log(int lvl, const char *fmt, ...)
20: {
21: va_list lst, cp;
22:
23: EVERBS(lvl) {
24: va_start(lst, fmt);
25: va_copy(cp, lst);
26: vfprintf(lf, fmt, lst);
27: va_end(lst);
28: fprintf(lf, "\n");
29: vsyslog(LOG_WARNING, fmt, cp);
30: va_end(cp);
31: }
32: }
33:
34: static inline void
35: Err(const char *fmt, ...)
36: {
37: va_list lst, cp;
38:
39: va_start(lst, fmt);
40: va_copy(cp, lst);
41: vfprintf(lf, fmt, lst);
42: va_end(lst);
43: fprintf(lf, "\n");
44: vsyslog(LOG_ERR, fmt, cp);
45: va_end(cp);
46: }
47:
48: static inline void
49: DumpProc(const char *txt)
50: {
51: Log(0, "%s:: UID:GID=%d:%d Prio=%d Class=%s Name=%s Dir=%s Cmd=%s Script=%s From=%s:%s%s",
52: txt ? txt : __func__, AIT_GET_I16(&proc.proc_uid),
53: AIT_GET_I16(&proc.proc_gid), AIT_GET_I32(&proc.proc_prio),
54: AIT_GET_STR(&proc.proc_class), AIT_GET_STR(&proc.proc_name),
55: AIT_GET_STR(&proc.proc_dir), AIT_GET_STR(&proc.proc_cmd),
56: getenv("PATH_TRANSLATED"), getenv("REMOTE_ADDR"),
57: getenv("REMOTE_PORT"), getenv("REQUEST_URI"));
58: }
59:
60: static void
61: initProg()
62: {
63: char d[MAXPATHLEN];
64:
65: AIT_SET_I16(&proc.proc_uid, getuid());
66: AIT_SET_I16(&proc.proc_gid, getgid());
67: AIT_SET_I32(&proc.proc_prio, getpriority(PRIO_PROCESS, 0));
68: AIT_INIT_VAL2(&proc.proc_class, string);
69: getcwd(d, sizeof d);
70: AIT_SET_STR(&proc.proc_dir, d);
71: AIT_INIT_VAL2(&proc.proc_name, string);
72: AIT_INIT_VAL2(&proc.proc_cmd, string);
73:
74: #if 0
75: lf = fopen(DEFAULT_LOG, "a");
76: if (!lf)
77: #endif
78: lf = stdout;
79:
80: openlog(PACKAGE_NAME, LOG_CONS | LOG_PID | LOG_NDELAY, LOG_USER);
81: }
82:
83: static void
84: endProg()
85: {
86: AIT_FREE_VAL(&proc.proc_uid);
87: AIT_FREE_VAL(&proc.proc_gid);
88: AIT_FREE_VAL(&proc.proc_prio);
89: AIT_FREE_VAL(&proc.proc_class);
90: AIT_FREE_VAL(&proc.proc_dir);
91: AIT_FREE_VAL(&proc.proc_name);
92: AIT_FREE_VAL(&proc.proc_cmd);
93: }
94:
95: static void
96: Usage()
97: {
98: printf( " -= suX =- suExecutor designed for web based applicaions\n"
99: "(C)`11 AITNET ltd - Sofia/Bulgaria - <office@aitnet.org>\n\n"
100: " Syntax: %s [options] <program> [arguments]\n"
101: "\t-u <user>\t\t\tUser for suID\n"
102: "\t-g <group>\t\t\tGroup for suID\n"
103: "\t-p <priority (-20..20)>\t\tExecute with priority\n"
104: "\t-d <directory>\t\t\tDirectory for suID\n"
105: "\t-C <directory>\t\t\tChroot to directory\n"
106: "\t-c <cfgfile>\t\t\tConfig file\n"
107: "\t-l <logfile>\t\t\tLog file path (default:/var/log/suX.log)\n"
108: "\t-o\t\t\t\tForce set UID,GID and Priority for program\n"
109: "\t-v\t\t\t\tVerbose, (more -v, more verbosity)\n"
110: "\t-h\t\t\t\tThis help screen!\n\n", PACKAGE_NAME);
111: }
112:
113: static inline int
114: setUIDGID(char flg, const char *name)
115: {
116: struct stat sb;
117:
118: if (stat(name, &sb) == -1) {
119: ESYSERR(0);
120: return -1;
121: }
122:
123: if (!(flg & SUX_GET_UID))
124: AIT_SET_I16(&proc.proc_uid, sb.st_uid);
125: if (!(flg & SUX_GET_GID))
126: AIT_SET_I16(&proc.proc_gid, sb.st_gid);
127:
128: return 0;
129: }
130:
131: static inline int
132: SetClass()
133: {
134: struct passwd *pass;
135: int ret = 0;
136:
137: pass = getpwuid(AIT_GET_I16(&proc.proc_uid));
138: if (!pass) {
139: Err("Error:: User with this UID %d not found", AIT_GET_I16(&proc.proc_uid));
140: endpwent();
141: return -1;
142: } else
143: AIT_SET_STR(&proc.proc_class, pass->pw_class);
144:
145: if (setusercontext(NULL, pass, AIT_GET_I16(&proc.proc_uid),
146: LOGIN_SETRESOURCES | LOGIN_SETGROUP | LOGIN_SETLOGIN |
147: LOGIN_SETPRIORITY)) {
148: Err("Error:: Cant set login class %s", AIT_GET_STR(&proc.proc_class));
149: ret = -1;
150: }
151:
152: endpwent();
153: return ret;
154: }
155:
156: static int
157: LoadCfgData(char flg)
158: {
159: const char *str;
160: char mode = 0;
161:
162: str = cfg_getAttribute(&cfg, "global", "mode");
163: if (!str) {
164: Err("Error:: Unknown mode ...");
165: return -1;
166: }
167: if (!strcasecmp(str, "SCRIPT")) {
168: mode = 1;
169: if (setUIDGID(flg, AIT_GET_STR(&proc.proc_name)) == -1)
170: return -1;
171: } else if (!strcasecmp(str, "FILE")) {
172: mode = 2;
173: if (setUIDGID(flg, AIT_GET_STR(&proc.proc_name)) == -1)
174: return -1;
175: } else if (!strcasecmp(str, "DIR") &&
176: (str = cfg_getAttribute(&cfg, "global", "directory"))) {
177: mode = 3;
178: if (!(flg & SUX_GET_DIR))
179: AIT_SET_STR(&proc.proc_dir, str);
180:
181: if (setUIDGID(flg, AIT_GET_STR(&proc.proc_dir)) == -1)
182: return -1;
183: } else {
184: Err("Error:: Unknown mode %s", str);
185: return -1;
186: }
187: if (!(flg & SUX_GET_PRIO)) {
188: str = cfg_getAttribute(&cfg, "global", "priority");
189: if (str)
190: AIT_SET_I32(&proc.proc_prio, strtol(str, NULL, 10));
191: }
192:
193: /* find associate extension */
194: str = strrchr(AIT_GET_STR(&proc.proc_name), '.');
195: if (str) {
196: str++;
197: str = (*str) ? str : "default";
198: switch (cfg_loadAttribute(&cfg, "associate", str, &proc.proc_cmd, NULL)) {
199: case -1:
200: ELIBERR(cfg);
201: return -1;
202: case 0:
203: cfg_loadAttribute(&cfg, "associate", "default", &proc.proc_cmd, DEFAULT_CMD);
204: }
205: } else
206: AIT_SET_STR(&proc.proc_cmd, DEFAULT_CMD);
207:
208: return 0;
209: }
210:
211: static int
212: Run(char **argv, char flg)
213: {
214: char **args, *cmd;
215: array_t *acmd, *aarg;
216: int n;
217:
218: if (!argv)
219: return -1;
220:
221: n = array_Args(AIT_GET_STR(&proc.proc_cmd), 0, " \t", &acmd);
222: if (n < 1)
223: return -1;
224: if (!(aarg = array_From((const char***) &argv, 0))) {
225: array_Destroy(&acmd);
226: return -1;
227: } else if (*array(acmd, 0, char*) == '!') {
228: if (array_Grow(acmd, 0, 0)) {
229: array_Destroy(&aarg);
230: array_Destroy(&acmd);
231: return -1;
232: }
233: cmd = array(aarg, 0, char*);
234: } else
235: cmd = array(acmd, 0, char*);
236:
237: if (array_Concat(acmd, aarg) == -1) {
238: array_Destroy(&aarg);
239: array_Destroy(&acmd);
240: return -1;
241: }
242: array_Destroy(&aarg);
243: if (!(args = array_To(acmd))) {
244: array_Destroy(&acmd);
245: return -1;
246: }
247: array_Destroy(&acmd);
248:
249: if (SetClass()) {
250: if (args)
251: e_free(args);
252: return -1;
253: }
254:
255: if (flg & SUX_GET_FORCE) {
256: if (setegid(AIT_GET_I16(&proc.proc_gid)) == -1) {
257: ESYSERR(0);
258: if (args)
259: e_free(args);
260: return -1;
261: }
262: if (seteuid(AIT_GET_I16(&proc.proc_uid)) == -1) {
263: ESYSERR(0);
264: if (args)
265: e_free(args);
266: return -1;
267: }
268: if (setpriority(PRIO_PROCESS, 0, AIT_GET_I32(&proc.proc_prio)) == -1) {
269: ESYSERR(0);
270: if (args)
271: e_free(args);
272: return -1;
273: }
274: }
275:
276: DumpProc(__func__);
277:
278: EVERBS(3) {
279: char **el = args - 1;
280: while (*++el)
281: Log(3, "args: %s", *el);
282: }
283:
284: fflush(lf);
285:
286: execve(cmd, args, environ);
287: if (args)
288: e_free(args);
289: ESYSERR(0);
290: return -1;
291: }
292:
293:
294: int
295: main(int argc, char **argv)
296: {
297: char ch, *str, *wrk, szCfg[MAXPATHLEN], **pp, flg = 0;
298: struct passwd *pass;
299: struct group *grp;
300: FILE *f;
301:
302: initProg();
303: strlcpy(szCfg, DEFAULT_CONFIG, sizeof szCfg);
304:
305: while ((ch = getopt(argc, argv, "hvoC:c:u:g:p:d:l:")) != -1)
306: switch (ch) {
307: case 'l':
308: f = fopen(optarg, "a");
309: if (!f) {
310: Err("Error:: logfile #%d - %s", errno, strerror(errno));
311: return 1;
312: } else
313: if (fileno(lf) > 2)
314: fclose(lf);
315: lf = f;
316: break;
317: case 'd':
318: AIT_SET_STR(&proc.proc_dir, optarg);
319: flg |= SUX_GET_DIR;
320: break;
321: case 'p':
322: AIT_SET_I32(&proc.proc_prio, strtol(optarg, NULL, 0));
323: flg |= SUX_GET_PRIO;
324: break;
325: case 'g':
326: setgrent();
327: grp = getgrnam(optarg);
328: if (grp) {
329: AIT_SET_I16(&proc.proc_gid, grp->gr_gid);
330: flg |= SUX_GET_GID;
331: } else
332: Err("Error:: Group not found!");
333: endgrent();
334: break;
335: case 'u':
336: setpwent();
337: pass = getpwnam(optarg);
338: if (pass) {
339: AIT_SET_I16(&proc.proc_uid, pass->pw_uid);
340: flg |= SUX_GET_UID;
341: } else
342: Err("Error:: User not found!");
343: endpwent();
344: break;
345: case 'c':
346: strlcpy(szCfg, optarg, sizeof szCfg);
347: break;
348: case 'C':
349: if (chroot(optarg) == -1)
350: Err("Error:: chroot to dir");
351: if ((str = getenv("PATH_TRANSLATED")))
352: if ((wrk = strstr(str, optarg)))
353: setenv("PATH_TRANSLATED", str + strlen(optarg), 42);
354: break;
355: case 'o':
356: flg |= SUX_GET_FORCE;
357: break;
358: case 'v':
359: e_incVerbose;
360: break;
361: case 'h':
362: default:
363: Usage();
364: endProg();
365: if (fileno(lf) > 2)
366: fclose(lf);
367: return 1;
368: }
369: argc -= optind;
370: argv += optind;
371:
372: EVERBS(2) {
373: for (pp = argv; *pp; pp++)
374: Log(2, "Args=%s\n", *pp);
375: for (pp = environ; *pp; pp++)
376: Log(2, "Envs=%s\n", *pp);
377: }
378:
379: if (!argc) {
380: if (!(str = getenv("PATH_TRANSLATED"))) {
381: Usage();
382: endProg();
383: if (fileno(lf) > 2)
384: fclose(lf);
385: return 1;
386: } else
387: AIT_SET_STR(&proc.proc_name, str);
388: } else
389: AIT_SET_STR(&proc.proc_name, *argv);
390: Log(2, "Try to load config %s", szCfg);
391: if (cfgLoadConfig(szCfg, &cfg)) {
392: ELIBERR(cfg);
393: endProg();
394: if (fileno(lf) > 2)
395: fclose(lf);
396: return 2;
397: } else
398: if (LoadCfgData(flg) == -1) {
399: cfgUnloadConfig(&cfg);
400: endProg();
401: if (fileno(lf) > 2)
402: fclose(lf);
403: closelog();
404: return 3;
405: }
406: cfgUnloadConfig(&cfg);
407:
408: if (Run(argv, flg) == -1) {
409: endProg();
410: if (fileno(lf) > 2)
411: fclose(lf);
412: closelog();
413: return 4;
414: }
415:
416: endProg();
417: if (fileno(lf) > 2)
418: fclose(lf);
419: closelog();
420: return 0;
421: }
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to sux.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / suX / src