Initial revision

diff --git a/Misc/setuid-prog.c b/Misc/setuid-prog.c
new file mode 100644 (file)
index 0000000..6f25493
--- /dev/null
+++ b/Misc/setuid-prog.c
@@ -0,0 +1,172 @@
+/*
+   Template for a setuid program that calls a script.
+
+   The script should be in an unwritable directory and should itself
+   be unwritable.  In fact all parent directories up to the root
+   should be unwritable.  The script must not be setuid, that's what
+   this program is for.
+
+   This is a template program.  You need to fill in the name of the
+   script that must be executed.  This is done by changing the
+   definition of FULL_PATH below.
+
+   There are also some rules that should be adhered to when writing
+   the script itself.
+
+   The first and most important rule is to never, ever trust that the
+   user of the program will behave properly.  Program defensively.
+   Check your arguments for reasonableness.  If the user is allowed to
+   create files, check the names of the files.  If the program depends
+   on argv[0] for the action it should perform, check it.
+
+   Assuming the script is a Bourne shell script, the first line of the
+   script should be
+       #!/bin/sh -
+   The - is important, don't omit it.  If you're using esh, the first
+   line should be
+       #!/usr/local/bin/esh -f
+   and for ksh, the first line should be
+       #!/usr/local/bin/ksh -p
+   The script should then set the variable IFS to the string
+   consisting of <space>, <tab>, and <newline>.  After this (*not*
+   before!), the PATH variable should be set to a reasonable value and
+   exported.  Do not expect the PATH to have a reasonable value, so do
+   not trust the old value of PATH.  You should then set the umask of
+   the program by calling
+       umask 077 # or 022 if you want the files to be readable
+   If you plan to change directories, you should either unset CDPATH
+   or set it to a good value.  Setting CDPATH to just ``.'' (dot) is a
+   good idea.
+   If, for some reason, you want to use csh, the first line should be
+       #!/bin/csh -fb
+   You should then set the path variable to something reasonable,
+   without trusting the inherited path.  Here too, you should set the
+   umask using the command
+       umask 077 # or 022 if you want the files to be readable
+*/
+
+#include <unistd.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+
+/* CONFIGURATION SECTION */
+
+#ifndef FULL_PATH      /* so that this can be specified from the Makefile */
+#define FULL_PATH      "/full/path/of/script"
+#endif
+#ifndef UMASK
+#define UMASK          077
+#endif
+
+/* END OF CONFIGURATION SECTION */
+
+#if defined(__STDC__) && defined(__sgi)
+#define environ _environ
+#endif
+
+/* don't change def_IFS */
+char def_IFS[] = "IFS= \t\n";
+/* you may want to change def_PATH, but you should really change it in */
+/* your script */
+#ifdef __sgi
+char def_PATH[] = "PATH=/usr/bsd:/usr/bin:/bin:/usr/local/bin:/usr/sbin";
+#else
+char def_PATH[] = "PATH=/usr/ucb:/usr/bin:/bin:/usr/local/bin";
+#endif
+/* don't change def_CDPATH */
+char def_CDPATH[] = "CDPATH=.";
+/* don't change def_ENV */
+char def_ENV[] = "ENV=:";
+
+/*
+   This function changes all environment variables that start with LD_
+   into variables that start with XD_.  This is important since we
+   don't want the script that is executed to use any funny shared
+   libraries.
+
+   The other changes to the environment are, strictly speaking, not
+   needed here.  They can safely be done in the script.  They are done
+   here because we don't trust the script writer (just like the script
+   writer shouldn't trust the user of the script).
+   If IFS is set in the environment, set it to space,tab,newline.
+   If CDPATH is set in the environment, set it to ``.''.
+   Set PATH to a reasonable default.
+*/
+void
+clean_environ(void)
+{
+       char **p;
+       extern char **environ;
+
+       for (p = environ; *p; p++) {
+               if (strncmp(*p, "LD_", 3) == 0)
+                       **p = 'X';
+               else if (strncmp(*p, "_RLD", 4) == 0)
+                       **p = 'X';
+               else if (strncmp(*p, "IFS=", 4) == 0)
+                       *p = def_IFS;
+               else if (strncmp(*p, "CDPATH=", 7) == 0)
+                       *p = def_CDPATH;
+               else if (strncmp(*p, "ENV=", 4) == 0)
+                       *p = def_ENV;
+       }
+       putenv(def_PATH);
+}
+
+int
+main(int argc, char **argv)
+{
+       struct stat statb;
+       gid_t egid = getegid();
+       uid_t euid = geteuid();
+
+       /*
+          Sanity check #1.
+          This check should be made compile-time, but that's not possible.
+          If you're sure that you specified a full path name for FULL_PATH,
+          you can omit this check.
+       */
+       if (FULL_PATH[0] != '/') {
+               fprintf(stderr, "%s: %s is not a full path name\n", argv[0],
+                       FULL_PATH);
+               fprintf(stderr, "Tell this program's maintainer that s\\he ");
+               fprintf(stderr, "fouled up some simple rules\n");
+               fprintf(stderr, "pretty badly.\n");
+               exit(1);
+       }
+
+       /*
+          Sanity check #2.
+          Check that the owner of the script is equal to either the
+          effective uid or the super user.
+       */
+       if (stat(FULL_PATH, &statb) < 0) {
+               perror("stat");
+               exit(1);
+       }
+       if (statb.st_uid != 0 && statb.st_uid != euid) {
+               fprintf(stderr, "%s: %s has the wrong owner\n", argv[0],
+                       FULL_PATH);
+               fprintf(stderr, "Tell this program's maintainer that the ");
+               fprintf(stderr, "script should be owned by him/herself or the\n");
+               fprintf(stderr, "superuser.\n");
+               exit(1);
+       }
+
+       if (setregid(egid, egid) < 0)
+               perror("setregid");
+       if (setreuid(euid, euid) < 0)
+               perror("setreuid");
+
+       clean_environ();
+
+       umask(UMASK);
+
+       while (**argv == '-')   /* don't let argv[0] start with '-' */
+               (*argv)++;
+       execv(FULL_PATH, argv);
+       fprintf(stderr, "%s: could not execute the script\n", argv[0]);
+       exit(1);
+}