diff options
author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-27 12:52:13 +0000 |
---|---|---|
committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-27 12:52:13 +0000 |
commit | f8e5c55a036f0e2e2a958e30456270f3f9eba933 (patch) | |
tree | 4a06ff510774a7a3373e492df4e2984d7b0664b1 /plugins/python/python_importblocker.c | |
parent | Initial commit. (diff) | |
download | sudo-upstream.tar.xz sudo-upstream.zip |
Adding upstream version 1.9.5p2.upstream/1.9.5p2upstream
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to '')
-rw-r--r-- | plugins/python/python_importblocker.c | 213 |
1 files changed, 213 insertions, 0 deletions
diff --git a/plugins/python/python_importblocker.c b/plugins/python/python_importblocker.c new file mode 100644 index 0000000..2bce36c --- /dev/null +++ b/plugins/python/python_importblocker.c @@ -0,0 +1,213 @@ +/* + * SPDX-License-Identifier: ISC + * + * Copyright (c) 2019-2020 Robert Manner <robert.manner@oneidentity.com> + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +/* + * This is an open source non-commercial project. Dear PVS-Studio, please check it. + * PVS-Studio Static Code Analyzer for C, C++ and C#: http://www.viva64.com + */ + +#include "sudo_python_module.h" + +#include "sudo_util.h" + +#include <sys/types.h> +#include <sys/stat.h> +#include <unistd.h> + + +static int +_verify_import(const char *file_path) +{ + debug_decl(_verify_import, PYTHON_DEBUG_INTERNAL); + + // Check mode and owner similar to what we do in open_sudoers(). + // This is to help avoid loading a potentially insecure module. + struct stat sb; + if (stat(file_path, &sb) != 0) { + PyErr_Format(PyExc_ImportError, "Failed to stat file '%s'", file_path); + debug_return_int(SUDO_RC_ERROR); + } + + if (sb.st_uid != ROOT_UID) { + PyErr_Format(PyExc_ImportError, "File '%s' must be owned by uid %d", file_path, ROOT_UID); + debug_return_int(SUDO_RC_ERROR); + } + + if ((sb.st_mode & (S_IWGRP|S_IWOTH)) != 0) { + PyErr_Format(PyExc_ImportError, "File '%s' must be only be writable by owner", file_path); + debug_return_int(SUDO_RC_ERROR); + } + + debug_return_int(SUDO_RC_OK); +} + +static PyObject * +_sudo_ImportBlocker__Init(PyObject *py_self, PyObject *py_args) +{ + debug_decl(_sudo_ImportBlocker__Init, PYTHON_DEBUG_C_CALLS); + + py_debug_python_call("ImportBlocker", "__init__", py_args, NULL, PYTHON_DEBUG_C_CALLS); + + PyObject *py_meta_path = NULL; + if (!PyArg_UnpackTuple(py_args, "sudo.ImportBlocker.__init__", 2, 2, &py_self, &py_meta_path)) + goto cleanup; + + if (PyObject_SetAttrString(py_self, "meta_path", py_meta_path) != 0) + goto cleanup; + +cleanup: + if (PyErr_Occurred()) + debug_return_ptr(NULL); + + debug_return_ptr_pynone; +} + +static PyObject * +_sudo_ImportBlocker__find_module(PyObject *py_self, PyObject *py_args) +{ + debug_decl(_sudo_ImportBlocker__find_module, PYTHON_DEBUG_C_CALLS); + + PyObject *py_fullname = NULL, *py_path = NULL, *py_meta_path = NULL, + *py_meta_path_iterator = NULL, *py_finder = NULL, + *py_importer = NULL, *py_import_path = NULL; + + py_debug_python_call("ImportBlocker", "find_module", py_args, NULL, PYTHON_DEBUG_C_CALLS); + + if (!PyArg_UnpackTuple(py_args, "sudo.ImportBlocker.find_module", 2, 3, &py_self, &py_fullname, &py_path)) + goto cleanup; + + py_meta_path = PyObject_GetAttrString(py_self, "meta_path"); + if (py_meta_path == NULL) + goto cleanup; + + py_meta_path_iterator = PyObject_GetIter(py_meta_path); + if (py_meta_path_iterator == NULL) + goto cleanup; + + while ((py_finder = PyIter_Next(py_meta_path_iterator)) != NULL) { + py_importer = PyObject_CallMethod(py_finder, "find_module", "(OO)", + py_fullname, py_path); + if (py_importer == NULL) { + goto cleanup; + } + + if (py_importer != Py_None) { // the import could be resolved + if (PyObject_HasAttrString(py_importer, "get_filename")) { + // there is a file associated with the import (.py, .so, etc) + py_import_path = PyObject_CallMethod(py_importer, "get_filename", ""); + const char *import_path = PyUnicode_AsUTF8(py_import_path); + + sudo_debug_printf(SUDO_DEBUG_DIAG, "ImportBlocker: verifying permissions " + "on file '%s'\n", import_path); + if (_verify_import(import_path) != SUDO_RC_OK) + goto cleanup; + + Py_CLEAR(py_import_path); + + } else { + sudo_debug_printf(SUDO_DEBUG_DIAG, "ImportBlocker: internal module import '%s'\n", + PyUnicode_AsUTF8(py_fullname)); + } + + goto cleanup; + } + + Py_CLEAR(py_importer); + Py_CLEAR(py_finder); + } + + Py_CLEAR(py_importer); + py_importer = Py_None; + Py_INCREF(py_importer); + +cleanup: + Py_CLEAR(py_meta_path_iterator); + Py_CLEAR(py_meta_path); + Py_CLEAR(py_finder); + Py_CLEAR(py_import_path); + + if (PyErr_Occurred()) { + Py_CLEAR(py_importer); + debug_return_ptr(NULL); + } + + debug_return_ptr(py_importer); +} + +static PyMethodDef _sudo_ImportBlocker_class_methods[] = +{ + {"__init__", _sudo_ImportBlocker__Init, METH_VARARGS, ""}, + {"find_module", _sudo_ImportBlocker__find_module, METH_VARARGS, ""}, + {NULL, NULL, 0, NULL} +}; + +// This possibly can be replaced with PySys_AddAuditHook for python >= 3.8 +// +// This function is equivalent of the python call: +// sys.meta_path = [sudo.ImportBlocker(sys.meta_path)] +int +sudo_module_register_importblocker(void) +{ + debug_decl(sudo_module_register_importblocker, PYTHON_DEBUG_C_CALLS); + + int rc = SUDO_RC_ERROR; + + PyObject *py_meta_path = NULL, *py_import_blocker_cls = NULL, + *py_import_blocker = NULL; + + py_meta_path = PySys_GetObject("meta_path"); // note: borrowed reference + if (py_meta_path == NULL) { + PyErr_Format(sudo_exc_SudoException, "'sys.meta_path' is not available. " + "Unable to register import blocker hook which is meant to " + "verify that no such module get loaded by the sudo python plugins" + "which are writable by others than root."); + goto cleanup; + } + Py_INCREF(py_meta_path); + + py_import_blocker_cls = sudo_module_create_class("sudo.ImportBlocker", _sudo_ImportBlocker_class_methods, NULL); + if (py_import_blocker_cls == NULL) + goto cleanup; + + // call the constructor + py_import_blocker = PyObject_CallFunctionObjArgs(py_import_blocker_cls, py_meta_path, NULL); + if (py_import_blocker == NULL) + goto cleanup; + + Py_DECREF(py_meta_path); + py_meta_path = PyList_New(1); + if (py_meta_path == NULL) + goto cleanup; + + if (PyList_SetItem(py_meta_path, 0, py_import_blocker) != 0) + goto cleanup; + py_import_blocker = NULL; // list has stolen it + + if (PySys_SetObject("meta_path", py_meta_path) != 0) { + goto cleanup; + } + + rc = SUDO_RC_OK; + +cleanup: + Py_CLEAR(py_meta_path); + Py_CLEAR(py_import_blocker); + Py_CLEAR(py_import_blocker_cls); + + debug_return_int(rc); +} |