diff options
Diffstat (limited to 'plugins/sudoers/find_path.c')
| -rw-r--r-- | plugins/sudoers/find_path.c | 172 |
1 files changed, 172 insertions, 0 deletions
diff --git a/plugins/sudoers/find_path.c b/plugins/sudoers/find_path.c new file mode 100644 index 0000000..5c44b4f --- /dev/null +++ b/plugins/sudoers/find_path.c @@ -0,0 +1,172 @@ +/* + * SPDX-License-Identifier: ISC + * + * Copyright (c) 1996, 1998-2005, 2010-2015, 2017-2019 + * Todd C. Miller <Todd.Miller@sudo.ws> + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + * + * Sponsored in part by the Defense Advanced Research Projects + * Agency (DARPA) and Air Force Research Laboratory, Air Force + * Materiel Command, USAF, under agreement number F39502-99-1-0512. + */ + +/* + * This is an open source non-commercial project. Dear PVS-Studio, please check it. + * PVS-Studio Static Code Analyzer for C, C++ and C#: http://www.viva64.com + */ + +#include <config.h> + +#include <sys/stat.h> +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <unistd.h> +#include <errno.h> + +#include "sudoers.h" + +/* + * Check the given command against the specified allowlist (NULL-terminated). + * On success, rewrites cmnd based on the allowlist and returns true. + * On failure, returns false. + */ +static bool +cmnd_allowed(char *cmnd, size_t cmnd_size, const char *runchroot, + struct stat *cmnd_sbp, char * const *allowlist) +{ + const char *cmnd_base; + char * const *al; + debug_decl(cmnd_allowed, SUDOERS_DEBUG_UTIL); + + if (!sudo_goodpath(cmnd, runchroot, cmnd_sbp)) + debug_return_bool(false); + + if (allowlist == NULL) + debug_return_bool(true); /* nothing to check */ + + /* We compare the base names to avoid excessive stat()ing. */ + if ((cmnd_base = strrchr(cmnd, '/')) == NULL) + debug_return_bool(false); /* can't happen */ + cmnd_base++; + + for (al = allowlist; *al != NULL; al++) { + const char *base, *path = *al; + struct stat sb; + + if ((base = strrchr(path, '/')) == NULL) + continue; /* XXX - warn? */ + base++; + + if (strcmp(cmnd_base, base) != 0) + continue; + + if (sudo_goodpath(path, runchroot, &sb) && + sb.st_dev == cmnd_sbp->st_dev && sb.st_ino == cmnd_sbp->st_ino) { + /* Overwrite cmnd with safe version from allowlist. */ + if (strlcpy(cmnd, path, cmnd_size) < cmnd_size) + debug_return_bool(true); + } + } + debug_return_bool(false); +} + +/* + * This function finds the full pathname for a command and + * stores it in a statically allocated array, filling in a pointer + * to the array. Returns FOUND if the command was found, NOT_FOUND + * if it was not found, or NOT_FOUND_DOT if it would have been found + * but it is in '.' and IGNORE_DOT is set. + * The caller is responsible for freeing the output file. + */ +int +find_path(const char *infile, char **outfile, struct stat *sbp, + const char *path, const char *runchroot, int ignore_dot, + char * const *allowlist) +{ + char command[PATH_MAX]; + const char *cp, *ep, *pathend; + bool found = false; + bool checkdot = false; + int len; + debug_decl(find_path, SUDOERS_DEBUG_UTIL); + + /* + * If we were given a fully qualified or relative path + * there is no need to look at $PATH. + */ + if (strchr(infile, '/') != NULL) { + if (strlcpy(command, infile, sizeof(command)) >= sizeof(command)) { + errno = ENAMETOOLONG; + debug_return_int(NOT_FOUND_ERROR); + } + found = cmnd_allowed(command, sizeof(command), runchroot, sbp, + allowlist); + goto done; + } + + if (path == NULL) + debug_return_int(NOT_FOUND); + + pathend = path + strlen(path); + for (cp = sudo_strsplit(path, pathend, ":", &ep); cp != NULL; + cp = sudo_strsplit(NULL, pathend, ":", &ep)) { + + /* + * Search current dir last if it is in PATH. + * This will miss sneaky things like using './' or './/' (XXX) + */ + if (cp == ep || (*cp == '.' && cp + 1 == ep)) { + checkdot = 1; + continue; + } + + /* + * Resolve the path and exit the loop if found. + */ + len = snprintf(command, sizeof(command), "%.*s/%s", + (int)(ep - cp), cp, infile); + if (len < 0 || len >= ssizeof(command)) { + errno = ENAMETOOLONG; + debug_return_int(NOT_FOUND_ERROR); + } + found = cmnd_allowed(command, sizeof(command), runchroot, + sbp, allowlist); + if (found) + break; + } + + /* + * Check current dir if dot was in the PATH + */ + if (!found && checkdot) { + len = snprintf(command, sizeof(command), "./%s", infile); + if (len < 0 || len >= ssizeof(command)) { + errno = ENAMETOOLONG; + debug_return_int(NOT_FOUND_ERROR); + } + found = cmnd_allowed(command, sizeof(command), runchroot, + sbp, allowlist); + if (found && ignore_dot) + debug_return_int(NOT_FOUND_DOT); + } + +done: + if (found) { + if ((*outfile = strdup(command)) == NULL) + debug_return_int(NOT_FOUND_ERROR); + debug_return_int(FOUND); + } + debug_return_int(NOT_FOUND); +} |