Merge branch 'setuid-wrapper-readlink'

This commit is contained in:
Shea Levy 2018-03-07 12:44:21 -05:00
commit 6dab907ebe
No known key found for this signature in database
GPG Key ID: 5C0BD6957D86FE27

View File

@ -1,3 +1,4 @@
#define _GNU_SOURCE
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
@ -161,22 +162,34 @@ static int make_caps_ambient(const char *selfPath)
int main(int argc, char * * argv)
{
// I *think* it's safe to assume that a path from a symbolic link
// should safely fit within the PATH_MAX system limit. Though I'm
// not positive it's safe...
char selfPath[PATH_MAX];
int selfPathSize = readlink("/proc/self/exe", selfPath, sizeof(selfPath));
// O_PATH | O_NOFOLLOW gives us a fd pointing to the symlink
int selfExe = open("/proc/self/exe", O_PATH | O_CLOEXEC | O_NOFOLLOW);
assert(selfExe != -1);
struct stat st;
assert(fstat(selfExe, &st) != -1);
size_t selfPathCap = st.st_size + 1;
char *selfPath = malloc(selfPathCap);
assert(selfPath);
int selfPathSize = readlinkat(selfExe, "", selfPath, selfPathCap);
assert(selfPathSize > 0);
// Assert we have room for the zero byte, this ensures the path
// isn't being truncated because it's too big for the buffer.
//
// A better way to handle this might be to use something like the
// whereami library (https://github.com/gpakosz/whereami) or a
// loop that resizes the buffer and re-reads the link if the
// contents are being truncated.
assert(selfPathSize < sizeof(selfPath));
// selfPathSize is the number of bytes readlinkat put into the
// buffer, which does *not* append a null byte. selfPathCap is the
// capacity of the buffer, which was set to the number of bytes in
// the link contents (again, without the null byte) plus one for
// the null byte.
//
// I don't think it's possible for the link contents to change
// between opening a symlink fd and readlinkat on it, so this is
// probably not necessary. Doubly so since this is /proc/self/exe,
// not a normal symlink. But it's trivial to check.
assert(selfPathSize < selfPathCap);
assert(close(selfExe));
// Set the zero byte since readlink doesn't do that for us.
selfPath[selfPathSize] = '\0';
@ -197,7 +210,6 @@ int main(int argc, char * * argv)
// `selfPath', and not, say, as some other setuid program. That
// is, our effective uid/gid should match the uid/gid of
// `selfPath'.
struct stat st;
assert(lstat(selfPath, &st) != -1);
assert(!(st.st_mode & S_ISUID) || (st.st_uid == geteuid()));
@ -228,6 +240,8 @@ int main(int argc, char * * argv)
// capabilities too!
make_caps_ambient(selfPath);
free(selfPath);
execve(sourceProg, argv, environ);
fprintf(stderr, "%s: cannot run `%s': %s\n",