From: Ken Coar Date: Fri, 26 Oct 2001 18:30:57 +0000 (+0000) Subject: Bring forward checkgid helper from 1.3; checks runtime X-Git-Tag: 2.0.27~22 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b444d8ee56fd015829602ebd911b3f0ede21eab8;p=thirdparty%2Fapache%2Fhttpd.git Bring forward checkgid helper from 1.3; checks runtime validity of httpd Group directive-style group identifiers. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@91669 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/support/Makefile.in b/support/Makefile.in index 7cfddfbb9a3..242403a7b5a 100644 --- a/support/Makefile.in +++ b/support/Makefile.in @@ -1,7 +1,7 @@ DISTCLEAN_TARGETS = apxs apachectl dbmmanage log_server_status \ logresolve.pl phf_abuse_log.cgi split-logfile -PROGRAMS = htpasswd htdigest rotatelogs logresolve ab +PROGRAMS = htpasswd htdigest rotatelogs logresolve ab checkgid TARGETS = $(PROGRAMS) PROGRAM_LDADD = $(EXTRA_LDFLAGS) $(PROGRAM_DEPENDENCIES) $(EXTRA_LIBS) @@ -42,6 +42,10 @@ ab_OBJECTS = ab.lo ab: $(ab_OBJECTS) $(LINK) $(ab_LTFLAGS) $(ab_OBJECTS) $(PROGRAM_LDADD) +checkgid_OBJECTS = checkgid.lo +checkgid: $(checkgid_OBJECTS) + $(LINK) $(checkgid_LTFLAGS) $(checkgid_OBJECTS) $(PROGRAM_LDADD) + suexec_OBJECTS = suexec.lo suexec: $(suexec_OBJECTS) $(LINK) $(suexec_OBJECTS) $(PROGRAM_LDADD) diff --git a/support/checkgid.c b/support/checkgid.c new file mode 100644 index 00000000000..dacec205cc3 --- /dev/null +++ b/support/checkgid.c @@ -0,0 +1,145 @@ +/* ==================================================================== + * The Apache Software License, Version 1.1 + * + * Copyright (c) 2001 The Apache Software Foundation. All rights + * reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. The end-user documentation included with the redistribution, + * if any, must include the following acknowledgment: + * "This product includes software developed by the + * Apache Software Foundation (http://www.apache.org/)." + * Alternately, this acknowledgment may appear in the software itself, + * if and wherever such third-party acknowledgments normally appear. + * + * 4. The names "Apache" and "Apache Software Foundation" must + * not be used to endorse or promote products derived from this + * software without prior written permission. For written + * permission, please contact apache@apache.org. + * + * 5. Products derived from this software may not be called "Apache", + * nor may "Apache" appear in their name, without prior written + * permission of the Apache Software Foundation. + * + * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED + * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + * DISCLAIMED. IN NO EVENT SHALL THE APACHE SOFTWARE FOUNDATION OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT + * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF + * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND + * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, + * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT + * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * ==================================================================== + * + * This software consists of voluntary contributions made by many + * individuals on behalf of the Apache Software Foundation. For more + * information on the Apache Software Foundation, please see + * . + */ + +/* + * Given one or more group identifers on the command line (e.g., + * "httpd" or "#-1"), figure out whether they'll be valid for + * the server to use at run-time. + * + * If a groupname isn't found, or we can't setgid() to it, return + * -1. If all groups are valid, return 0. + * + * This may need to be run as the superuser for the setgid() to + * succeed; running it as any other user may result in a false + * negative. + */ + +#include "ap_config.h" +#if APR_HAVE_STDIO_H +#include +#endif +#if APR_HAVE_SYS_TYPES_H +#include +#endif +#if HAVE_GRP_H +#include +#endif +#if APR_HAVE_UNISTD_H +#include +#endif + +int main(int argc, char *argv[]) +{ + int i; + int result; + gid_t gid; + struct group *grent; + struct group fake_grent; + + /* + * Assume success. :-) + */ + result = 0; + for (i = 1; i < argc; ++i) { + char *arg; + arg = argv[i]; + + /* + * If it's from a 'Group #-1' statement, get the numeric value + * and skip the group lookup stuff. + */ + if (*arg == '#') { + gid = atoi(&arg[1]); + fake_grent.gr_gid = gid; + grent = &fake_grent; + } + else { + grent = getgrnam(arg); + } + + /* + * A NULL return means no such group was found, so we're done + * with this one. + */ + if (grent == NULL) { + fprintf(stderr, "%s: group '%s' not found\n", argv[0], arg); + result = -1; + } + else { + int check; + + /* + * See if we can switch to the numeric GID we have. If so, + * all well and good; if not, well.. + */ + gid = grent->gr_gid; + check = setgid(gid); + if (check != 0) { + fprintf(stderr, "%s: invalid group '%s'\n", argv[0], arg); + perror(argv[0]); + result = -1; + } + } + } + /* + * Worst-case return value. + */ + return result; +} +/* + * Local Variables: + * mode: C + * c-file-style: "bsd" + * End: + */