emo/busybox
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

su: expand help; simplify passing of -c CMD to run_shell()

Browse Source 
Also, added a comment about bug 9401 (TIOCSTI input injection).

function                                             old     new   delta
packed_usage                                       30909   30932     +23
su_main                                              470     487     +17
sulogin_main                                         260     258      -2
run_applet_and_exit                                  681     678      -3
run_shell                                            166     126     -40

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
This commit is contained in:
Denys Vlasenko 2016-11-03 22:13:08 +01:00
parent 2b288236e8
commit 79e2598c48
6 changed files with 45 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
include/libbb.h
View File

@ -1341,7 +1341,7 @@ char *bb_simplify_abs_path_inplace(char *path) FAST_FUNC;
#endif
extern void bb_do_delay(int seconds) FAST_FUNC;
extern void change_identity(const struct passwd *pw) FAST_FUNC;
extern void run_shell(const char *shell, int loginshell, const char *command, const char **additional_args) NORETURN FAST_FUNC;
extern void run_shell(const char *shell, int loginshell, const char **args) NORETURN FAST_FUNC;
/* Returns $SHELL, getpwuid(getuid())->pw_shell, or DEFAULT_SHELL.
* Note that getpwuid result might need xstrdup'ing

2
libbb/executable.c
View File

@ -97,5 +97,5 @@ void FAST_FUNC exec_prog_or_SHELL(char **argv)
if (argv[0]) {
BB_EXECVP_or_die(argv);
}
run_shell(getenv("SHELL"), /*login:*/ 1, NULL, NULL);
run_shell(getenv("SHELL"), /*login:*/ 1, NULL);
}

29
libbb/run_shell.c
View File

@ -50,19 +50,17 @@ void FAST_FUNC set_current_security_context(security_context_t sid)
#endif
/* Run SHELL, or DEFAULT_SHELL if SHELL is "" or NULL.
* If COMMAND is nonzero, pass it to the shell with the -c option.
* If ADDITIONAL_ARGS is nonzero, pass it to the shell as more
* arguments. */
void FAST_FUNC run_shell(const char *shell, int loginshell, const char *command, const char **additional_args)
* If ADDITIONAL_ARGS is not NULL, pass them to the shell.
*/
void FAST_FUNC run_shell(const char *shell, int loginshell, const char **additional_args)
{
const char **args;
int argno;
int additional_args_cnt = 0;
for (args = additional_args; args && *args; args++)
additional_args_cnt++;
args = additional_args;
while (args && *args)
args++;
args = xmalloc(sizeof(char*) * (4 + additional_args_cnt));
args = xmalloc(sizeof(char*) * (2 + (args - additional_args)));
if (!shell || !shell[0])
shell = DEFAULT_SHELL;
@ -70,16 +68,13 @@ void FAST_FUNC run_shell(const char *shell, int loginshell, const char *command,
args[0] = bb_get_last_path_component_nostrip(shell);
if (loginshell)
args[0] = xasprintf("-%s", args[0]);
argno = 1;
if (command) {
args[argno++] = "-c";
args[argno++] = command;
}
args[1] = NULL;
if (additional_args) {
for (; *additional_args; ++additional_args)
args[argno++] = *additional_args;
int cnt = 1;
for (;;)
if ((args[cnt++] = *additional_args++) == NULL)
break;
}
args[argno] = NULL;
#if ENABLE_SELINUX
if (current_sid)

2
loginutils/login.c
View File

@ -618,7 +618,7 @@ int login_main(int argc UNUSED_PARAM, char **argv)
signal(SIGINT, SIG_DFL);
/* Exec login shell with no additional parameters */
run_shell(pw->pw_shell, 1, NULL, NULL);
run_shell(pw->pw_shell, 1, NULL);
/* return EXIT_FAILURE; - not reached */
}

33
loginutils/su.c
View File

@ -31,10 +31,10 @@
//kbuild:lib-$(CONFIG_SU) += su.o
//usage:#define su_trivial_usage
//usage: "[OPTIONS] [-] [USER]"
//usage: "[-lmp] [-] [-s SH] [USER [SCRIPT ARGS / -c 'CMD' ARG0 ARGS]]"
//usage:#define su_full_usage "\n\n"
//usage: "Run shell under USER (by default, root)\n"
//usage: "\n -,-l Clear environment, run shell as login shell"
//usage: "\n -,-l Clear environment, go to home dir, run shell as login shell"
//usage: "\n -p,-m Do not set new $HOME, $SHELL, $USER, $LOGNAME"
//usage: "\n -c CMD Command to pass to 'sh -c'"
//usage: "\n -s SH Shell to use instead of user's default"
@ -81,8 +81,12 @@ int su_main(int argc UNUSED_PARAM, char **argv)
#endif
const char *old_user;
/* Note: we don't use "'+': stop at first non-option" idiom here.
* For su, "SCRIPT ARGS" or "-c CMD ARGS" do not stop option parsing:
* ARGS starting with dash will be treated as su options,
* not passed to shell. (Tested on util-linux 2.28).
*/
flags = getopt32(argv, "mplc:s:", &opt_command, &opt_shell);
//argc -= optind;
argv += optind;
if (argv[0] && LONE_DASH(argv[0])) {
@ -162,8 +166,29 @@ int su_main(int argc UNUSED_PARAM, char **argv)
pw);
IF_SELINUX(set_current_security_context(NULL);)
if (opt_command) {
*--argv = opt_command;
*--argv = (char*)"-c";
}
/* A nasty ioctl exists which can stuff data into input queue:
* #include <sys/ioctl.h>
* int main() {
* const char *msg = "echo $UID\n";
* while (*msg) ioctl(0, TIOCSTI, *msg++);
* return 0;
* }
* With "su USER -c EXPLOIT" run by root, exploit can make root shell
* read as input and execute arbitrary command.
* It's debatable whether we need to protect against this
* (root may hesitate to run unknown scripts interactively).
*
* Some versions of su run -c CMD in a different session:
* ioctl(TIOCSTI) works only on the controlling tty.
*/
/* Never returns */
run_shell(opt_shell, flags & SU_OPT_l, opt_command, (const char**)argv);
run_shell(opt_shell, flags & SU_OPT_l, (const char**)argv);
/* return EXIT_FAILURE; - not reached */
}

2
loginutils/sulogin.c
View File

@ -89,5 +89,5 @@ int sulogin_main(int argc UNUSED_PARAM, char **argv)
shell = pwd->pw_shell;
/* Exec login shell with no additional parameters. Never returns. */
run_shell(shell, 1, NULL, NULL);
run_shell(shell, 1, NULL);
}