forked from Telodendria/Telodendria
Implement user validation.
This commit is contained in:
parent
e0a66ad58a
commit
9ae05e84f2
|
@ -4,7 +4,7 @@
|
||||||
|
|
||||||
server-name "localhost";
|
server-name "localhost";
|
||||||
chroot ".";
|
chroot ".";
|
||||||
id "_telodendria" "_telodendria";
|
id "jordan";
|
||||||
data-dir "./data";
|
data-dir "./data";
|
||||||
federation "true";
|
federation "true";
|
||||||
registration "true";
|
registration "true";
|
||||||
|
|
|
@ -227,8 +227,10 @@ you on a sufficiently complete operating system:
|
||||||
</p>
|
</p>
|
||||||
<ul>
|
<ul>
|
||||||
<li>
|
<li>
|
||||||
A standards-compliant C compiler with a POSIX.1c standard library. Because
|
A standards-compliant C compiler with a POSIX.1c standard library and
|
||||||
<b>Telodendria</b> is written in ANSI C and sticks to POSIX.1c features, it
|
access to a <code>chroot()</code> system call (which is available in all
|
||||||
|
UNIX-like operating systems, but is not POSIX.) Because <b>Telodendria</b>
|
||||||
|
is written in ANSI C and sticks almost entirely to POSIX.1c features, it
|
||||||
should compile on almost any compiler and operating system with minimal
|
should compile on almost any compiler and operating system with minimal
|
||||||
effort, but the following compilers and operating systems are known to work:
|
effort, but the following compilers and operating systems are known to work:
|
||||||
<ul>
|
<ul>
|
||||||
|
|
|
@ -26,6 +26,9 @@
|
||||||
#include <string.h>
|
#include <string.h>
|
||||||
#include <unistd.h>
|
#include <unistd.h>
|
||||||
|
|
||||||
|
#include <grp.h>
|
||||||
|
#include <pwd.h>
|
||||||
|
|
||||||
#include <TelodendriaConfig.h>
|
#include <TelodendriaConfig.h>
|
||||||
|
|
||||||
#include <Log.h>
|
#include <Log.h>
|
||||||
|
@ -88,6 +91,10 @@ main(int argc, char **argv)
|
||||||
/* Program configuration */
|
/* Program configuration */
|
||||||
TelodendriaConfig *tConfig = NULL;
|
TelodendriaConfig *tConfig = NULL;
|
||||||
|
|
||||||
|
/* User validation */
|
||||||
|
struct passwd *userInfo;
|
||||||
|
struct group *groupInfo;
|
||||||
|
|
||||||
lc = LogConfigCreate();
|
lc = LogConfigCreate();
|
||||||
|
|
||||||
if (!lc)
|
if (!lc)
|
||||||
|
@ -185,6 +192,71 @@ main(int argc, char **argv)
|
||||||
Log(lc, LOG_DEBUG, "Flags: %x", tConfig->flags);
|
Log(lc, LOG_DEBUG, "Flags: %x", tConfig->flags);
|
||||||
LogConfigUnindent(lc);
|
LogConfigUnindent(lc);
|
||||||
|
|
||||||
|
Log(lc, LOG_TASK, "Evaluating permissions...");
|
||||||
|
|
||||||
|
if (chdir(tConfig->chroot) != 0)
|
||||||
|
{
|
||||||
|
Log(lc, LOG_ERROR, "Unable to change into directory: %s.", tConfig->chroot);
|
||||||
|
exit = EXIT_FAILURE;
|
||||||
|
goto finish;
|
||||||
|
}
|
||||||
|
|
||||||
|
Log(lc, LOG_DEBUG, "Running as uid/gid: %d/%d.", getuid(), getgid());
|
||||||
|
|
||||||
|
userInfo = getpwnam(tConfig->uid);
|
||||||
|
groupInfo = getgrnam(tConfig->gid);
|
||||||
|
|
||||||
|
if (!userInfo || !groupInfo)
|
||||||
|
{
|
||||||
|
Log(lc, LOG_ERROR, "Unable to locate the user/group specified in the configuration.");
|
||||||
|
exit = EXIT_FAILURE;
|
||||||
|
goto finish;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (getuid() == 0)
|
||||||
|
{
|
||||||
|
if (chroot(tConfig->chroot) == 0)
|
||||||
|
{
|
||||||
|
Log(lc, LOG_MESSAGE, "Changed the root directory to: %s.", tConfig->chroot);
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
Log(lc, LOG_WARNING, "Unable to chroot into directory: %s.", tConfig->chroot);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (setgid(groupInfo->gr_gid) != 0 || setuid(userInfo->pw_uid) != 0)
|
||||||
|
{
|
||||||
|
Log(lc, LOG_WARNING, "Unable to set process uid/gid.");
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
Log(lc, LOG_MESSAGE, "Set uid/gid to %s:%s.", tConfig->uid, tConfig->gid);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
Log(lc, LOG_MESSAGE, "Not changing root directory, because we are not root.");
|
||||||
|
|
||||||
|
if (getuid() != userInfo->pw_uid || getgid() != groupInfo->gr_gid)
|
||||||
|
{
|
||||||
|
Log(lc, LOG_WARNING, "Not running as the uid/gid specified in the configuration.");
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
Log(lc, LOG_DEBUG, "Running as the uid/gid specified in the configuration.");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/* These config values are no longer needed; don't hold them in
|
||||||
|
* memory anymore */
|
||||||
|
free(tConfig->chroot);
|
||||||
|
free(tConfig->uid);
|
||||||
|
free(tConfig->gid);
|
||||||
|
|
||||||
|
tConfig->chroot = NULL;
|
||||||
|
tConfig->uid = NULL;
|
||||||
|
tConfig->gid = NULL;
|
||||||
|
|
||||||
finish:
|
finish:
|
||||||
Log(lc, LOG_DEBUG, "Exiting with code '%d'.", exit);
|
Log(lc, LOG_DEBUG, "Exiting with code '%d'.", exit);
|
||||||
TelodendriaConfigFree(tConfig);
|
TelodendriaConfigFree(tConfig);
|
||||||
|
|
|
@ -119,9 +119,23 @@ TelodendriaConfigParse(HashMap * config, LogConfig * lc)
|
||||||
|
|
||||||
GET_DIRECTIVE("id");
|
GET_DIRECTIVE("id");
|
||||||
ASSERT_NO_CHILDREN("id");
|
ASSERT_NO_CHILDREN("id");
|
||||||
ASSERT_VALUES("id", 2);
|
|
||||||
COPY_VALUE(tConfig->uid, 0);
|
COPY_VALUE(tConfig->uid, 0);
|
||||||
COPY_VALUE(tConfig->gid, 1);
|
|
||||||
|
switch (ArraySize(value))
|
||||||
|
{
|
||||||
|
case 1:
|
||||||
|
Log(lc, LOG_WARNING, "No run group specified; assuming it's the same as the user.");
|
||||||
|
tConfig->gid = UtilStringDuplicate(tConfig->uid);
|
||||||
|
break;
|
||||||
|
case 2:
|
||||||
|
COPY_VALUE(tConfig->gid, 1);
|
||||||
|
break;
|
||||||
|
default:
|
||||||
|
Log(lc, LOG_ERROR,
|
||||||
|
"Wrong value count in directive 'id': got '%d', but expected 1 or 2.",
|
||||||
|
ArraySize(value));
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
|
||||||
GET_DIRECTIVE("data-dir");
|
GET_DIRECTIVE("data-dir");
|
||||||
ASSERT_NO_CHILDREN("data-dir");
|
ASSERT_NO_CHILDREN("data-dir");
|
||||||
|
|
|
@ -22,7 +22,7 @@
|
||||||
: "${TELODENDRIA_VERSION:=0.0.0}"
|
: "${TELODENDRIA_VERSION:=0.0.0}"
|
||||||
: "${CVS_TAG:=Telodendria-$(echo $TELODENDRIA_VERSION | sed 's/\./_/g')}"
|
: "${CVS_TAG:=Telodendria-$(echo $TELODENDRIA_VERSION | sed 's/\./_/g')}"
|
||||||
|
|
||||||
: "${DEFINES:=-D_POSIX_C_SOURCE=199506L -DTELODENDRIA_VERSION=\"$TELODENDRIA_VERSION\"}"
|
: "${DEFINES:=-D_BSD_SOURCE -D_POSIX_C_SOURCE=199506L -DTELODENDRIA_VERSION=\"$TELODENDRIA_VERSION\"}"
|
||||||
: "${INCLUDES:=-Isrc/include}"
|
: "${INCLUDES:=-Isrc/include}"
|
||||||
|
|
||||||
: "${CC:=cc}"
|
: "${CC:=cc}"
|
||||||
|
|
Loading…
Reference in New Issue