| … | |
… | |
| 32 | #include <cstdlib> |
32 | #include <cstdlib> |
| 33 | #include <cstring> |
33 | #include <cstring> |
| 34 | #include <csignal> |
34 | #include <csignal> |
| 35 | |
35 | |
| 36 | #include <sys/types.h> |
36 | #include <sys/types.h> |
| 37 | #include <sys/socket.h> |
|
|
| 38 | #include <unistd.h> |
37 | #include <unistd.h> |
| 39 | #include <fcntl.h> |
38 | #include <fcntl.h> |
| 40 | |
39 | |
| 41 | #ifdef HAVE_SYS_IOCTL_H |
40 | #ifdef HAVE_SYS_IOCTL_H |
| 42 | # include <sys/ioctl.h> |
41 | # include <sys/ioctl.h> |
| … | |
… | |
| 182 | return pfd; |
181 | return pfd; |
| 183 | } |
182 | } |
| 184 | |
183 | |
| 185 | close (pfd); |
184 | close (pfd); |
| 186 | } |
185 | } |
|
|
186 | |
|
|
187 | return -1; |
| 187 | } |
188 | } |
| 188 | #endif |
189 | #endif |
| 189 | |
190 | |
| 190 | /*----------------------------------------------------------------------*/ |
191 | /*----------------------------------------------------------------------*/ |
| 191 | /* |
192 | /* |
| … | |
… | |
| 372 | } |
373 | } |
| 373 | |
374 | |
| 374 | return true; |
375 | return true; |
| 375 | } |
376 | } |
| 376 | |
377 | |
| 377 | ///////////////////////////////////////////////////////////////////////////// |
|
|
| 378 | // helper/proxy support |
|
|
| 379 | |
|
|
| 380 | #if PTYTTY_HELPER |
|
|
| 381 | |
|
|
| 382 | static int sock_fd = -1, lock_fd = -1; |
|
|
| 383 | static int helper_pid, owner_pid; |
|
|
| 384 | |
|
|
| 385 | struct command |
|
|
| 386 | { |
|
|
| 387 | enum { get, login, destroy } type; |
|
|
| 388 | |
|
|
| 389 | ptytty *id; |
|
|
| 390 | |
|
|
| 391 | bool login_shell; |
|
|
| 392 | int cmd_pid; |
|
|
| 393 | char hostname[512]; // arbitrary, but should be plenty |
|
|
| 394 | }; |
|
|
| 395 | |
|
|
| 396 | struct ptytty_proxy : ptytty |
|
|
| 397 | { |
|
|
| 398 | ptytty *id; |
|
|
| 399 | |
|
|
| 400 | ptytty_proxy () |
|
|
| 401 | : id(0) |
|
|
| 402 | { |
|
|
| 403 | } |
|
|
| 404 | |
|
|
| 405 | ~ptytty_proxy (); |
|
|
| 406 | |
|
|
| 407 | bool get (); |
|
|
| 408 | void login (int cmd_pid, bool login_shell, const char *hostname); |
|
|
| 409 | }; |
|
|
| 410 | |
|
|
| 411 | bool |
|
|
| 412 | ptytty_proxy::get () |
|
|
| 413 | { |
|
|
| 414 | command cmd; |
|
|
| 415 | |
|
|
| 416 | cmd.type = command::get; |
|
|
| 417 | |
|
|
| 418 | write (sock_fd, &cmd, sizeof (cmd)); |
|
|
| 419 | |
|
|
| 420 | if (read (sock_fd, &id, sizeof (id)) != sizeof (id)) |
|
|
| 421 | ptytty_fatal ("protocol error while creating pty using helper process, aborting.\n"); |
|
|
| 422 | |
|
|
| 423 | if (!id) |
|
|
| 424 | return false; |
|
|
| 425 | |
|
|
| 426 | if ((pty = recv_fd (sock_fd)) < 0 |
|
|
| 427 | || (tty = recv_fd (sock_fd)) < 0) |
|
|
| 428 | ptytty_fatal ("protocol error while reading pty/tty fds from helper process, aborting.\n"); |
|
|
| 429 | |
|
|
| 430 | return true; |
|
|
| 431 | } |
|
|
| 432 | |
|
|
| 433 | void |
|
|
| 434 | ptytty_proxy::login (int cmd_pid, bool login_shell, const char *hostname) |
|
|
| 435 | { |
|
|
| 436 | command cmd; |
|
|
| 437 | |
|
|
| 438 | cmd.type = command::login; |
|
|
| 439 | cmd.id = id; |
|
|
| 440 | cmd.cmd_pid = cmd_pid; |
|
|
| 441 | cmd.login_shell = login_shell; |
|
|
| 442 | strncpy (cmd.hostname, hostname, sizeof (cmd.hostname)); |
|
|
| 443 | |
|
|
| 444 | write (sock_fd, &cmd, sizeof (cmd)); |
|
|
| 445 | } |
|
|
| 446 | |
|
|
| 447 | ptytty_proxy::~ptytty_proxy () |
|
|
| 448 | { |
|
|
| 449 | if (id) |
|
|
| 450 | { |
|
|
| 451 | command cmd; |
|
|
| 452 | |
|
|
| 453 | cmd.type = command::destroy; |
|
|
| 454 | cmd.id = id; |
|
|
| 455 | |
|
|
| 456 | write (sock_fd, &cmd, sizeof (cmd)); |
|
|
| 457 | } |
|
|
| 458 | } |
|
|
| 459 | |
|
|
| 460 | static |
|
|
| 461 | void serve () |
|
|
| 462 | { |
|
|
| 463 | command cmd; |
|
|
| 464 | vector<ptytty *> ptys; |
|
|
| 465 | |
|
|
| 466 | while (read (sock_fd, &cmd, sizeof (command)) == sizeof (command)) |
|
|
| 467 | { |
|
|
| 468 | if (cmd.type == command::get) |
|
|
| 469 | { |
|
|
| 470 | // -> id ptyfd ttyfd |
|
|
| 471 | cmd.id = new ptytty_unix; |
|
|
| 472 | |
|
|
| 473 | if (cmd.id->get ()) |
|
|
| 474 | { |
|
|
| 475 | write (sock_fd, &cmd.id, sizeof (cmd.id)); |
|
|
| 476 | ptys.push_back (cmd.id); |
|
|
| 477 | |
|
|
| 478 | ptytty::send_fd (sock_fd, cmd.id->pty); |
|
|
| 479 | ptytty::send_fd (sock_fd, cmd.id->tty); |
|
|
| 480 | } |
|
|
| 481 | else |
|
|
| 482 | { |
|
|
| 483 | delete cmd.id; |
|
|
| 484 | cmd.id = 0; |
|
|
| 485 | write (sock_fd, &cmd.id, sizeof (cmd.id)); |
|
|
| 486 | } |
|
|
| 487 | } |
|
|
| 488 | else if (cmd.type == command::login) |
|
|
| 489 | { |
|
|
| 490 | #if UTMP_SUPPORT |
|
|
| 491 | if (find (ptys.begin (), ptys.end (), cmd.id) != ptys.end ()) |
|
|
| 492 | { |
|
|
| 493 | cmd.hostname[sizeof (cmd.hostname) - 1] = 0; |
|
|
| 494 | cmd.id->login (cmd.cmd_pid, cmd.login_shell, cmd.hostname); |
|
|
| 495 | } |
|
|
| 496 | #endif |
|
|
| 497 | } |
|
|
| 498 | else if (cmd.type == command::destroy) |
|
|
| 499 | { |
|
|
| 500 | vector<ptytty *>::iterator pty = find (ptys.begin (), ptys.end (), cmd.id); |
|
|
| 501 | |
|
|
| 502 | if (pty != ptys.end ()) |
|
|
| 503 | { |
|
|
| 504 | delete *pty; |
|
|
| 505 | ptys.erase (pty); |
|
|
| 506 | } |
|
|
| 507 | } |
|
|
| 508 | else |
|
|
| 509 | break; |
|
|
| 510 | } |
|
|
| 511 | |
|
|
| 512 | // destroy all ptys |
|
|
| 513 | for (vector<ptytty *>::iterator i = ptys.end (); i-- > ptys.begin (); ) |
|
|
| 514 | delete *i; |
|
|
| 515 | } |
|
|
| 516 | |
|
|
| 517 | void |
|
|
| 518 | ptytty::use_helper () |
|
|
| 519 | { |
|
|
| 520 | int pid = getpid (); |
|
|
| 521 | |
|
|
| 522 | if (sock_fd >= 0 && pid == owner_pid) |
|
|
| 523 | return; |
|
|
| 524 | |
|
|
| 525 | owner_pid = pid; |
|
|
| 526 | |
|
|
| 527 | int sv[2]; |
|
|
| 528 | |
|
|
| 529 | if (socketpair (AF_UNIX, SOCK_STREAM, 0, sv)) |
|
|
| 530 | ptytty_fatal ("could not create socket to communicate with pty/sessiondb helper, aborting.\n"); |
|
|
| 531 | |
|
|
| 532 | #ifdef PTYTTY_REENTRANT |
|
|
| 533 | int lv[2]; |
|
|
| 534 | |
|
|
| 535 | if (socketpair (AF_UNIX, SOCK_STREAM, 0, lv)) |
|
|
| 536 | ptytty_fatal ("could not create socket to communicate with pty/sessiondb helper, aborting.\n"); |
|
|
| 537 | #endif |
|
|
| 538 | |
|
|
| 539 | helper_pid = fork (); |
|
|
| 540 | |
|
|
| 541 | if (helper_pid < 0) |
|
|
| 542 | ptytty_fatal ("could not create pty/sessiondb helper process, aborting.\n"); |
|
|
| 543 | |
|
|
| 544 | if (helper_pid) |
|
|
| 545 | { |
|
|
| 546 | // client, process |
|
|
| 547 | sock_fd = sv[0]; |
|
|
| 548 | close (sv[1]); |
|
|
| 549 | fcntl (sock_fd, F_SETFD, FD_CLOEXEC); |
|
|
| 550 | #ifdef PTYTTY_REENTRANT |
|
|
| 551 | lock_fd = lv[0]; |
|
|
| 552 | close (lv[1]); |
|
|
| 553 | fcntl (lock_fd, F_SETFD, FD_CLOEXEC); |
|
|
| 554 | #endif |
|
|
| 555 | } |
|
|
| 556 | else |
|
|
| 557 | { |
|
|
| 558 | // server, pty-helper |
|
|
| 559 | sock_fd = sv[1]; |
|
|
| 560 | #ifdef PTYTTY_REENTRANT |
|
|
| 561 | lock_fd = lv[1]; |
|
|
| 562 | #endif |
|
|
| 563 | |
|
|
| 564 | chdir ("/"); |
|
|
| 565 | |
|
|
| 566 | signal (SIGHUP, SIG_IGN); |
|
|
| 567 | signal (SIGTERM, SIG_IGN); |
|
|
| 568 | signal (SIGINT, SIG_IGN); |
|
|
| 569 | signal (SIGPIPE, SIG_IGN); |
|
|
| 570 | |
|
|
| 571 | for (int fd = 0; fd < 1023; fd++) |
|
|
| 572 | if (fd != sock_fd && fd != lock_fd) |
|
|
| 573 | close (fd); |
|
|
| 574 | |
|
|
| 575 | serve (); |
|
|
| 576 | _exit (EXIT_SUCCESS); |
|
|
| 577 | } |
|
|
| 578 | } |
|
|
| 579 | |
|
|
| 580 | #endif |
|
|
| 581 | |
|
|
| 582 | ptytty * |
|
|
| 583 | ptytty::create () |
|
|
| 584 | { |
|
|
| 585 | #if PTYTTY_HELPER |
|
|
| 586 | if (helper_pid && getpid () == owner_pid) |
|
|
| 587 | // use helper process |
|
|
| 588 | return new ptytty_proxy; |
|
|
| 589 | else |
|
|
| 590 | #endif |
|
|
| 591 | return new ptytty_unix; |
|
|
| 592 | } |
|
|
| 593 | |
|
|
| 594 | void |
|
|
| 595 | ptytty::init () |
|
|
| 596 | { |
|
|
| 597 | uid_t uid = getuid (); |
|
|
| 598 | gid_t gid = getgid (); |
|
|
| 599 | |
|
|
| 600 | // before doing anything else, check for setuid/setgid operation, |
|
|
| 601 | // start the helper process and drop privileges |
|
|
| 602 | if (uid != geteuid () |
|
|
| 603 | || gid != getegid ()) |
|
|
| 604 | { |
|
|
| 605 | #if PTYTTY_HELPER |
|
|
| 606 | use_helper (); |
|
|
| 607 | #else |
|
|
| 608 | ptytty_warn ("running setuid/setgid without pty helper compiled in, continuing unprivileged.\n"); |
|
|
| 609 | #endif |
|
|
| 610 | |
|
|
| 611 | drop_privileges (); |
|
|
| 612 | } |
|
|
| 613 | } |
|
|
| 614 | |
|
|
| 615 | void |
|
|
| 616 | ptytty::drop_privileges () |
|
|
| 617 | { |
|
|
| 618 | uid_t uid = getuid (); |
|
|
| 619 | gid_t gid = getgid (); |
|
|
| 620 | |
|
|
| 621 | // drop privileges |
|
|
| 622 | #if HAVE_SETRESUID |
|
|
| 623 | setresgid (gid, gid, gid); |
|
|
| 624 | setresuid (uid, uid, uid); |
|
|
| 625 | #elif HAVE_SETREUID |
|
|
| 626 | setregid (gid, gid); |
|
|
| 627 | setreuid (uid, uid); |
|
|
| 628 | #elif HAVE_SETUID |
|
|
| 629 | setgid (gid); |
|
|
| 630 | setuid (uid); |
|
|
| 631 | #endif |
|
|
| 632 | |
|
|
| 633 | if (uid != geteuid () |
|
|
| 634 | || gid != getegid ()) |
|
|
| 635 | ptytty_fatal ("unable to drop privileges, aborting.\n"); |
|
|
| 636 | } |
|
|
| 637 | |
|
|
| 638 | ///////////////////////////////////////////////////////////////////////////// |
|
|
| 639 | // C API |
|
|
| 640 | |
|
|
| 641 | #ifndef NO_C_API |
|
|
| 642 | |
|
|
| 643 | #define DEFINE_METHOD(retval, name, args1, args2) \ |
|
|
| 644 | extern "C" retval ptytty_ ## name args1 \ |
|
|
| 645 | { return ((struct ptytty *)ptytty)->name args2; } |
|
|
| 646 | |
|
|
| 647 | DEFINE_METHOD(int,pty,(void *ptytty),) |
|
|
| 648 | DEFINE_METHOD(int,tty,(void *ptytty),) |
|
|
| 649 | DEFINE_METHOD(int,get,(void *ptytty),()) |
|
|
| 650 | DEFINE_METHOD(void,login,(void *ptytty, int cmd_pid, bool login_shell, const char *hostname),(cmd_pid,login_shell,hostname)) |
|
|
| 651 | |
|
|
| 652 | DEFINE_METHOD(void,close_tty,(void *ptytty),()) |
|
|
| 653 | DEFINE_METHOD(int,make_controlling_tty,(void *ptytty),()) |
|
|
| 654 | DEFINE_METHOD(void,set_utf8_mode,(void *ptytty, int on),(on)) |
|
|
| 655 | |
|
|
| 656 | #define DEFINE_STATIC(retval, name, args) \ |
|
|
| 657 | extern "C" retval ptytty_ ## name args \ |
|
|
| 658 | { return ptytty::name args; } |
|
|
| 659 | |
|
|
| 660 | DEFINE_STATIC(void,drop_privileges,()) |
|
|
| 661 | DEFINE_STATIC(void,use_helper,()) |
|
|
| 662 | DEFINE_STATIC(void,init,()) |
|
|
| 663 | |
|
|
| 664 | DEFINE_STATIC(void *,create,()) |
|
|
| 665 | |
|
|
| 666 | void ptytty_delete (void *ptytty) |
|
|
| 667 | { |
|
|
| 668 | delete (struct ptytty *)ptytty; |
|
|
| 669 | } |
|
|
| 670 | |
|
|
| 671 | // send_fd, recv_fd not exposed |
|
|
| 672 | |
|
|
| 673 | #endif |
|
|
