1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
|
/*
* mock-helper.c: help mock perform tasks needing root privileges
*/
#define _GNU_SOURCE
#include "config.h"
#include <stdio.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <unistd.h>
#include <errno.h>
#include <stdarg.h>
#include <stdlib.h>
/* pull in configure'd defines */
char *rootsdir = ROOTSDIR;
static char const * const ALLOWED_ENV[] =
{
"APT_CONFIG",
"dist",
"ftp_proxy", "http_proxy", "https_proxy", "no_proxy"
};
#define ALLOWED_ENV_SIZE (sizeof (ALLOWED_ENV) / sizeof (ALLOWED_ENV[0]))
/*
* helper functions
*/
void
usage ()
{
printf ("Usage: mock-helper [command]\n");
exit (1);
}
/* print formatted string to stderr, print newline and terminate */
void
error (const char *format, ...)
{
va_list ap;
va_start (ap, format);
fprintf (stderr, "mock-helper: error: ");
vfprintf (stderr, format, ap);
va_end (ap);
fprintf (stderr, "\n");
exit (1);
}
/*
* perform checks on the given dir
* - is the given dir under the allowed hierarchy ?
* - is it an actual dir ?
* - are we not being tricked by using . or .. ?
*/
void
check_dir_allowed (const char *allowed, const char *given)
{
struct stat buf;
char last;
int retval;
/* does given start with allowed ? */
if (strncmp (given, allowed, strlen (allowed)) != 0)
error ("%s: not under allowed directory (%s)", given, allowed);
/* does it try to fool us by using .. ? */
if (strstr (given, "..") != 0)
error ("%s: contains '..'", given);
/* does it try to fool us into following symlinks by having a trailing / ? */
last = given[strlen (given) - 1];
if (last == '/')
error ("%s: ends with '/'", given);
/* are we chrooting to an actual directory (not a symlink or anything) ? */
retval = lstat (given, &buf);
if (retval != 0)
error ("%s: %s", given, strerror (errno));
//printf ("DEBUG: mode: %o\n", buf.st_mode);
if (S_ISLNK (buf.st_mode))
error ("%s: symbolic link", given);
if (!(S_ISDIR (buf.st_mode)))
error ("%s: not a directory", given);
}
/*
* perform checks on the given file
* - is the given file under the allowed hierarchy ?
* - is it an actual file ?
* - are we not being tricked by using .. ?
*/
void
check_file_allowed (const char *allowed, const char *given)
{
struct stat buf;
char last;
int retval;
/* does given start with allowed ? */
if (strncmp (given, allowed, strlen (allowed)) != 0)
error ("%s: not under allowed directory", given);
/* does it try to fool us by using .. ? */
if (strstr (given, "..") != 0)
error ("%s: contains '..'", given);
/* does it have a trailing / ? */
last = given[strlen (given) - 1];
if (last == '/')
error ("%s: ends with '/'", given);
/* are we working with an actual file ? */
retval = lstat (given, &buf);
if (retval != 0)
error ("%s: %s", given, strerror (errno));
//printf ("DEBUG: mode: %o\n", buf.st_mode);
if (S_ISLNK (buf.st_mode))
error ("%s: symbolic link", given);
if (!(S_ISREG (buf.st_mode)))
error ("%s: not a regular file", given);
}
/* argv[0] should by convention be the binary name to be executed */
void
do_command (const char *filename, char *const argv[])
{
/* do not trust user environment;
* copy over allowed env vars, after setting PATH and HOME ourselves
*/
char *env[3 + ALLOWED_ENV_SIZE] = {
[0] = "PATH=/bin:/usr/bin:/usr/sbin",
[1] = "HOME=/root"
};
int retval;
char **arg;
size_t idx=2;
size_t i;
char *envvar;
char *ld_preload;
/* elevate privileges */
setreuid (geteuid (), geteuid ());
//printf ("DEBUG: First argument: %s\n", *argv);
//printf ("DEBUG: Executing %s\n", filename);
/* FIXME: for a debug option */
/*
printf ("Executing %s ", filename);
for (arg = (char **) &(argv[1]); *arg; ++arg)
printf ("%s ", *arg);
printf ("\n");
*/
/* add LD_PRELOAD for our selinux lib if MOCK_LD_PRELOAD is set */
envvar = getenv ("MOCK_LD_PRELOAD");
if (envvar != 0)
{
ld_preload = strdup("LD_PRELOAD=" LIBDIR "/libselinux-mock.so");
env[idx++] = ld_preload;
}
for (i = 0; i < ALLOWED_ENV_SIZE; ++i)
{
char *ptr = getenv (ALLOWED_ENV[i]);
if (ptr==0) continue;
ptr -= strlen (ALLOWED_ENV[i]) + 1;
env[idx++] = ptr;
}
retval = execve (filename, argv, env);
error ("executing %s: %s", filename, strerror (errno));
}
/*
* actual command implementations
*/
void
do_chroot (int argc, char *argv[])
{
if (argc < 3)
error ("No directory given for chroot !");
//printf ("DEBUG: rootsdir: %s\n", rootsdir);
/* do we allow this dir ? */
check_dir_allowed (rootsdir, argv[2]);
do_command ("/usr/sbin/chroot", &(argv[1]));
}
/*
* allow proc mounts:
* mount -t proc proc (root)/proc
* allow devpts mounts:
* mount -t devpts -o uid=500,gid=500 devpts (root)/dev/pts
*/
void
do_mount (int argc, char *argv[])
{
/* see if we have enough arguments for it to be what we want, ie. 5 */
if (argc < 5)
error ("not enough arguments");
/* see if it's -t proc or -t devpts */
if ((strncmp ("-t", argv[2], 2) == 0) &&
(strncmp ("proc", argv[3], 4) == 0))
{
/* see if we're mounting proc to somewhere in rootsdir */
if (strncmp (rootsdir, argv[5], strlen (rootsdir)) != 0)
error ("proc: mount not allowed on %s", argv[5]);
}
else if ((strncmp ("-t", argv[2], 2) == 0) &&
(strncmp ("devpts", argv[3], 6) == 0))
{
if (argc < 7)
error ("devpts: not enough mount arguments");
else if ((strncmp ("-o", argv[4], 2) != 0) ||
(strncmp ("uid=500,gid=500", argv[5], 15) != 0))
error ("devpts: unallowed mount options");
/* see if we're mounting devpts to somewhere in rootsdir */
else if (strncmp (rootsdir, argv[7], strlen (rootsdir)) != 0)
error ("devpts: mount not allowed on %s", argv[7]);
}
else
error ("unallowed mount type");
/* all checks passed, execute */
do_command ("/bin/mount", &(argv[1]));
}
/* clean out a chroot dir */
void
do_rm (int argc, char *argv[])
{
/* enough arguments ? mock-helper rm -rfv (rootdir), 4 */
if (argc < 4)
error ("not enough arguments");
/* see if we're doing rm -rfv */
if (strncmp ("-rfv", argv[2], 4) != 0)
error ("%s: options not allowed", argv[2]);
/* see if we're doing -rfv on a dir under rootsdir */
check_dir_allowed (rootsdir, argv[3]);
/* all checks passed, execute */
do_command ("/bin/rm", &(argv[1]));
}
/* perform rpm commands on root */
void
do_rpm (int argc, char *argv[])
{
/* enough arguments ? mock-helper rpm --root (rootdir) ... , 4 */
if (argc < 4)
error ("not enough arguments");
/* --root */
if (strncmp ("--root", argv[2], 6) != 0)
error ("%s: options not allowed", argv[2]);
/* check given dir */
check_dir_allowed (rootsdir, argv[3]);
/* all checks passed, execute */
do_command ("/bin/rpm", &(argv[1]));
}
void
do_yum (int argc, char *argv[])
{
/* enough arguments ? mock-helper yum --installroot (rootdir) ... , 4 */
if (argc < 4)
error ("not enough arguments");
/* --root */
if (strncmp ("--installroot", argv[2], 6) != 0)
error ("%s: options not allowed", argv[2]);
/* check given dir */
check_dir_allowed (rootsdir, argv[3]);
/* all checks passed, execute */
do_command ("/usr/bin/yum", &(argv[1]));
}
/* unmount archivesdir and proc */
void
do_umount (int argc, char *argv[])
{
/* enough arguments ? mock-helper umount (dir), 3 */
if (argc < 3)
error ("not enough arguments");
/* see if we're unmounting from somewhere in rootsdir */
check_dir_allowed (rootsdir, argv[2]);
/* all checks passed, execute */
do_command ("/bin/umount", &(argv[1]));
}
/* make /dev/ device nodes */
void
do_mknod (int argc, char *argv[])
{
/* enough arguments ? mock-helper mknod (name) -m (mode) (type) (major) (minor), 8 */
if (argc < 8)
error ("not enough arguments");
/* check given file */
if (strncmp (argv[2], rootsdir, strlen (rootsdir)) != 0)
error ("%s: not under allowed directory (%s)", argv[2], rootsdir);
/* does it try to fool us by using .. ? */
if (strstr (argv[2], "..") != 0)
error ("%s: contains '..'", argv[2]);
/* does it have a trailing / ? */
int last = argv[2][strlen (argv[2]) - 1];
if (last == '/')
error ("%s: ends with '/'", argv[2]);
/* -m */
if (strncmp ("-m", argv[3], 2) != 0)
error ("%s: options not allowed", argv[3]);
/* removed specific checks so we can make more than just /dev/null */
/* all checks passed, execute */
do_command ("/bin/mknod", &(argv[1]));
}
int
main (int argc, char *argv[])
{
/* verify input */
if (argc < 2) usage ();
/* see which command we are trying to run */
if (strncmp ("chroot", argv[1], 6) == 0)
do_chroot (argc, argv);
else if (strncmp ("mount", argv[1], 5) == 0)
do_mount (argc, argv);
else if (strncmp ("rm", argv[1], 2) == 0)
do_rm (argc, argv);
else if (strncmp ("umount", argv[1], 6) == 0)
do_umount (argc, argv);
else if (strncmp ("rpm", argv[1], 3) == 0)
do_rpm (argc, argv);
else if (strncmp ("mknod", argv[1], 5) == 0)
do_mknod (argc, argv);
else if (strncmp ("env", argv[1], 3) == 0)
do_command ("/bin/env", &(argv[1]));
else if (strncmp ("yum", argv[1], 3) == 0)
do_yum (argc, argv);
else
{
error ("Command %s not recognized !\n", argv[1]);
exit (1);
}
exit (0);
}
|