20170222-01

#include <sys/stat.h>
#include <sys/types.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

int
main(int    ar_argc,
     char **ar_argv
    )
{
  int          lo_found_executable;

  ssize_t      lo_path_alpha;
  ssize_t      lo_path_omega;

  char        *lo_candidate;
  char        *lo_env_path;

  struct stat  lo_st;

  if(geteuid()!=0)
  {
    fprintf(stderr,
            "%s is not setuid root yet\n",
            ar_argv[0]
           );

    return 1;   /* <--------- */
  }

  if(ar_argc<2)
  {
    fprintf(stderr,
            "no program name was passed to %s\n",
            ar_argv[0]
           );

    return 1;   /* <--------- */
  }

  lo_env_path=getenv("PATH");

  if((lo_env_path==NULL) || (strlen(lo_env_path)==0))
  {
    lo_env_path=".";
  }
  if(ar_argv[1][0]=='/')
  {
    lo_env_path="/";
  }
  else
  if(strchr(ar_argv[1],'/'))
  {
    lo_env_path=".";
  }

  lo_candidate=malloc(strlen(lo_env_path)+strlen(ar_argv[1])+5 /* or so */ );

  if(lo_candidate==NULL)
  {
    fprintf(stderr,
            "%s: malloc() fail\n",
            ar_argv[0]
           );

    return 1;   /* <--------- */
  }

  lo_found_executable=0;
  lo_path_alpha      =-1;

  for(;;)
  {
    if((lo_path_alpha>=0) &&
       (lo_env_path[lo_path_alpha]==0)
      )
    {
      break;   /* <--------- */
    }

    lo_path_alpha++;

    lo_path_omega=lo_path_alpha;

    while((lo_env_path[lo_path_omega]!=':') &&
          (lo_env_path[lo_path_omega]!=0)
         )
    {
      lo_path_omega++;
    }

    memmove(lo_candidate,
            lo_env_path+lo_path_alpha,
            lo_path_omega-lo_path_alpha
           );

    lo_candidate[lo_path_omega-lo_path_alpha]=0;

    if(strlen(lo_candidate)==0)
    {
      strcpy(lo_candidate,
             "."
            );
    }

    strcat(lo_candidate,
           "/"
          );

    strcat(lo_candidate,
           ar_argv[1]
          );

    lo_path_alpha=lo_path_omega;

    /* Could we execute this guy if euid were not root? */

    if(access(lo_candidate,
              X_OK
             )==0
      )
    {
      lo_found_executable=1;

      break;   /* <--------- */
    }
  }

  if(!lo_found_executable)
  {
    fprintf(stderr,
            "%s is not executable",
            ar_argv[1]
           );

    return 1;   /* <--------- */
  }

  if(lstat(lo_candidate,&lo_st))
  {
    perror("lstat()");

    return 1;   /* <--------- */
  }

  if(!S_ISREG(lo_st.st_mode))
  {
    fprintf(stderr,
            "file %s is not a regular file\n",
            ar_argv[1]
           );

    return 1;   /* <--------- */
  }

  if(lo_st.st_uid!=9999)
  {
    fprintf(stderr,
            "file %s is not owned by 9999\n",
            ar_argv[1]
           );

    return 1;   /* <--------- */
  }

  ar_argv[1]=lo_candidate;

  setreuid(0,0);

  execv(ar_argv[1],ar_argv+1);

  perror("execv");

  return 1;   /* <--------- */

} /* main() */