+++ /dev/null
-// $Id: reducecap.c 2279 2006-01-22 19:31:53Z ensc $
-
-// Copyright (C) 2003 Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de>
-// based on reducecap.cc by Jacques Gelinas
-//
-// This program is free software; you can redistribute it and/or modify
-// it under the terms of the GNU General Public License as published by
-// the Free Software Foundation; either version 2, or (at your option)
-// any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License
-// along with this program; if not, write to the Free Software
-// Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
-
-#ifdef HAVE_CONFIG_H
-# include <config.h>
-#endif
-
-#include "util.h"
-#include "vserver.h"
-
-#include <stdio.h>
-#include <errno.h>
-#include <unistd.h>
-#include <stdlib.h>
-#include <string.h>
-#include <getopt.h>
-#include <sys/param.h>
-
-#define ENSC_WRAPPERS_PREFIX "reducecap: "
-#define ENSC_WRAPPERS_VSERVER 1
-#define ENSC_WRAPPERS_UNISTD 1
-#include <wrappers.h>
-
-
-#undef _POSIX_SOURCE
-#include "capability-compat.h"
-
-
-#define CMD_HELP 0x1000
-#define CMD_VERSION 0x1001
-
-#define CMD_SHOW 0x2000
-#define CMD_PID 0x2001
-
-#define CMD_CAP 0x4000
-#define CMD_FLAG 0x4004
-#define CMD_SECURE 0x4006
-
-#ifdef VC_ENABLE_API_LEGACY
-# define CMD_OBSOLETE_CHOWN 0x8000
-# define CMD_OBSOLETE_DAC_OVERRIDE 0x8001
-# define CMD_OBSOLETE_DAC_READ_SEARCH 0x8002
-# define CMD_OBSOLETE_FOWNER 0x8003
-# define CMD_OBSOLETE_FSETID 0x8004
-# define CMD_OBSOLETE_KILL 0x8005
-# define CMD_OBSOLETE_SETGID 0x8006
-# define CMD_OBSOLETE_SETUID 0x8007
-# define CMD_OBSOLETE_SETPCAP 0x8008
-# define CMD_OBSOLETE_SYS_TTY_CONFIG 0x8009
-# define CMD_OBSOLETE_LEASE 0x800a
-# define CMD_OBSOLETE_SYS_CHROOT 0x800b
-# define CMD_OBSOLETE_X_LINUX_IMMUTABLE 0x800c
-# define CMD_OBSOLETE_X_NET_BIND_SERVICE 0x800d
-# define CMD_OBSOLETE_X_NET_BROADCAST 0x800e
-# define CMD_OBSOLETE_X_NET_ADMIN 0x800f
-# define CMD_OBSOLETE_X_NET_RAW 0x8010
-# define CMD_OBSOLETE_X_IPC_LOCK 0x8011
-# define CMD_OBSOLETE_X_IPC_OWNER 0x8012
-# define CMD_OBSOLETE_X_SYS_MODULE 0x8013
-# define CMD_OBSOLETE_X_SYS_RAWIO 0x8014
-# define CMD_OBSOLETE_X_SYS_PACCT 0x8015
-# define CMD_OBSOLETE_X_SYS_ADMIN 0x8016
-# define CMD_OBSOLETE_X_SYS_BOOT 0x8017
-# define CMD_OBSOLETE_X_SYS_NICE 0x8018
-# define CMD_OBSOLETE_X_SYS_RESOURCE 0x8019
-# define CMD_OBSOLETE_X_SYS_TIME 0x801a
-# define CMD_OBSOLETE_X_MKNOD 0x801b
-# define CMD_OBSOLETE_X_QUOTACTL 0x801c
-
-static char const * const OBSOLETE_MAPPING[] = {
- // 0 1 2 3
- "CHOWN", "DAC_OVERRIDE", "DAC_READ_SEARCH", "FOWNER",
- "FSETID", "KILL", "SETGID", "SETUID",
- "SETPCAP", "SYS_TTY_CONFIG", "LEASE", "SYS_CHROOT",
- "LINUX_IMMUTABLE", "NET_BIND_SERVICE", "NET_BROADCAST", "NET_ADMIN",
- "NET_RAW", "IPC_LOCK", "IPC_OWNER", "SYS_MODULE",
- "SYS_RAWIO", "SYS_PACCT", "SYS_ADMIN", "SYS_BOOT",
- "SYS_NICE", "SYS_RESOURCE", "SYS_TIME", "MKNOD",
- "QUOTACTL" };
-#endif
-
-struct option const
-CMDLINE_OPTIONS[] = {
- { "help", no_argument, 0, CMD_HELP },
- { "version", no_argument, 0, CMD_VERSION },
- { "cap", required_argument, 0, CMD_CAP },
- { "flag", required_argument, 0, CMD_FLAG },
- { "secure", no_argument, 0, CMD_SECURE },
- { "show", no_argument, 0, CMD_SHOW },
- { "pid", required_argument, 0, CMD_PID },
-#ifdef VC_ENABLE_API_LEGACY
- { "CAP_CHOWN", no_argument, 0, CMD_OBSOLETE_CHOWN },
- { "CAP_DAC_OVERRIDE", no_argument, 0, CMD_OBSOLETE_DAC_OVERRIDE },
- { "CAP_DAC_READ_SEARCH", no_argument, 0, CMD_OBSOLETE_DAC_READ_SEARCH },
- { "CAP_FOWNER", no_argument, 0, CMD_OBSOLETE_FOWNER },
- { "CAP_FSETID", no_argument, 0, CMD_OBSOLETE_FSETID },
- { "CAP_KILL", no_argument, 0, CMD_OBSOLETE_KILL },
- { "CAP_SETGID", no_argument, 0, CMD_OBSOLETE_SETGID },
- { "CAP_SETUID", no_argument, 0, CMD_OBSOLETE_SETUID },
- { "CAP_SETPCAP", no_argument, 0, CMD_OBSOLETE_SETPCAP },
- { "CAP_SYS_TTY_CONFIG", no_argument, 0, CMD_OBSOLETE_SYS_TTY_CONFIG },
- { "CAP_LEASE", no_argument, 0, CMD_OBSOLETE_LEASE },
- { "CAP_SYS_CHROOT", no_argument, 0, CMD_OBSOLETE_SYS_CHROOT },
- { "--CAP_LINUX_IMMUTABLE", no_argument, 0, CMD_OBSOLETE_X_LINUX_IMMUTABLE },
- { "--CAP_NET_BIND_SERVICE", no_argument, 0, CMD_OBSOLETE_X_NET_BIND_SERVICE },
- { "--CAP_NET_BROADCAST", no_argument, 0, CMD_OBSOLETE_X_NET_BROADCAST },
- { "--CAP_NET_ADMIN", no_argument, 0, CMD_OBSOLETE_X_NET_ADMIN },
- { "--CAP_NET_RAW", no_argument, 0, CMD_OBSOLETE_X_NET_RAW },
- { "--CAP_IPC_LOCK", no_argument, 0, CMD_OBSOLETE_X_IPC_LOCK },
- { "--CAP_IPC_OWNER", no_argument, 0, CMD_OBSOLETE_X_IPC_OWNER },
- { "--CAP_SYS_MODULE", no_argument, 0, CMD_OBSOLETE_X_SYS_MODULE },
- { "--CAP_SYS_RAWIO", no_argument, 0, CMD_OBSOLETE_X_SYS_RAWIO },
- { "--CAP_SYS_PACCT", no_argument, 0, CMD_OBSOLETE_X_SYS_PACCT },
- { "--CAP_SYS_ADMIN", no_argument, 0, CMD_OBSOLETE_X_SYS_ADMIN },
- { "--CAP_SYS_BOOT", no_argument, 0, CMD_OBSOLETE_X_SYS_BOOT },
- { "--CAP_SYS_NICE", no_argument, 0, CMD_OBSOLETE_X_SYS_NICE },
- { "--CAP_SYS_RESOURCE", no_argument, 0, CMD_OBSOLETE_X_SYS_RESOURCE },
- { "--CAP_SYS_TIME", no_argument, 0, CMD_OBSOLETE_X_SYS_TIME },
- { "--CAP_MKNOD", no_argument, 0, CMD_OBSOLETE_X_MKNOD },
- { "--CAP_QUOTACTL", no_argument, 0, CMD_OBSOLETE_X_QUOTACTL },
-#endif
- { 0,0,0,0 }
-};
-
-int wrapper_exit_code = 255;
-
-static void
-showHelp(int fd, char const *cmd, int res)
-{
-#if !defined(VC_ENABLE_API_COMPAT) && !defined(VC_ENABLE_API_LEGACY)
- WRITE_MSG(1, "ERROR: tools were built without legacy API support; reducecap will not work!\n\n");
-#endif
-
- WRITE_MSG(fd, "Usage:\n ");
- WRITE_STR(fd, cmd);
- WRITE_MSG(fd,
- " [--show] [--secure] [--flag <flag>] [--cap <capability>] [--] <cmd> <args>*\n ");
- WRITE_STR(fd, cmd);
- WRITE_MSG(fd,
- " --show [--pid <pid>]\n\n"
- "Please report bugs to " PACKAGE_BUGREPORT "\n");
-
- exit(res);
-}
-
-static void
-showVersion()
-{
- WRITE_MSG(1,
- "reducecap " VERSION " -- starts programs with reduced capabilities\n"
- "This program is part of " PACKAGE_STRING "\n\n"
- "Copyright (C) 2003,2004 Enrico Scholz\n"
- VERSION_COPYRIGHT_DISCLAIMER);
- exit(0);
-}
-
-static void
-printReducecap(struct __user_cap_data_struct *user)
-{
- int i;
- WRITE_MSG(1, " Capability Effective Permitted Inheritable\n");
-
- for (i=0;; ++i) {
- size_t const len = 23 + 10*2 + 4+2;
- char const * text = vc_cap2text(i);
- int bit = 1<<i;
- size_t l;
- char buf[len];
- if (text==0) break;
-
- memset(buf, ' ', sizeof buf);
- buf[len-1] = '\n';
- l = MIN(strlen(text), 22);
- memcpy(buf, text, l);
- buf[23 + 10*0 + 4] = (user->effective & bit) ? 'X' : ' ';
- buf[23 + 10*1 + 4] = (user->permitted & bit) ? 'X' : ' ';
- buf[23 + 10*2 + 4] = (user->inheritable & bit) ? 'X' : ' ';
- Vwrite(1, buf, len);
- }
-}
-
-static void
-show(pid_t pid)
-{
- struct __user_cap_header_struct header;
- struct __user_cap_data_struct user;
- header.version = _LINUX_CAPABILITY_VERSION;
- header.pid = pid;
- if (capget(&header,&user)==-1){
- perror ("reducecap: capget()");
- exit(wrapper_exit_code);
- }
-
- printReducecap(&user);
-}
-
-#if defined(VC_ENABLE_API_COMPAT) || defined(VC_ENABLE_API_LEGACY)
-
-static uint32_t
-getCap(char const *cap)
-{
- int bit = vc_text2cap(cap);
- if (bit!=0) {
- WRITE_MSG(2, "Unknown capability '");
- WRITE_STR(2, optarg);
- WRITE_MSG(2, "'; try '--help' for more information\n");
- exit(wrapper_exit_code);
- }
-
- return (1<<bit);
-}
-
-#endif
-
-int main (int argc, char *argv[])
-{
- uint32_t remove = 0;
- bool do_show = false;
- uint32_t flags = 0;
- pid_t pid = 0;
-#ifdef VC_ENABLE_API_LEGACY
- bool show_obsolete_warning = true;
-#endif
-
- while (1) {
- int c = getopt_long(argc, argv, "+", CMDLINE_OPTIONS, 0);
- if (c==-1) break;
-
-#ifdef VC_ENABLE_API_LEGACY
- if (c>=CMD_OBSOLETE_CHOWN && c<=CMD_OBSOLETE_X_QUOTACTL) {
- if (show_obsolete_warning) {
- WRITE_MSG(2, "reducecap: warning, obsolete CLI used\n");
- show_obsolete_warning = false;
- }
-
- remove = getCap(OBSOLETE_MAPPING[c-CMD_OBSOLETE_CHOWN]);
- continue;
- }
-#endif
- switch (c) {
- case CMD_HELP : showHelp(1, argv[0], 0);
- case CMD_VERSION : showVersion();
- case CMD_SHOW : do_show = true; break;
- case CMD_PID : pid = atoi(optarg); break;
-#if defined(VC_ENABLE_API_COMPAT) || defined(VC_ENABLE_API_LEGACY)
- case CMD_SECURE : remove = vc_get_insecurebcaps(); break;
- case CMD_CAP : remove = getCap(optarg); break;
- case CMD_FLAG : {
- struct vc_err_listparser err;
-
- flags = vc_list2cflag_compat(optarg, 0, &err);
- if (err.ptr!=0) {
- WRITE_MSG(2, "Unknown flag '");
- Vwrite(2, err.ptr, err.len);
- WRITE_MSG(2, "'\n");
- exit(wrapper_exit_code);
- }
- break;
- }
-#else
- case CMD_SECURE :
- case CMD_CAP :
- case CMD_FLAG : flags = 0; remove = 0; break;
-#endif
- }
- }
-
- if (!do_show && optind==argc) {
- WRITE_MSG(2, "No command given; use '--help' for more information\n");
- exit(wrapper_exit_code);
- }
-
- if (!do_show && pid!=0) {
- WRITE_MSG(2, "A pid can be specified in '--show' mode only; use '--help' for more information\n");
- exit(wrapper_exit_code);
- }
-
- if (do_show && optind==argc)
- show(pid);
-#if defined(VC_ENABLE_API_COMPAT) || defined(VC_ENABLE_API_LEGACY)
- else {
- Evc_new_s_context(VC_SAMECTX, remove, flags);
- if (do_show) show(pid);
-
- WRITE_MSG(2, "Executing\n");
- Eexecvp(argv[optind], argv+optind);
- }
-#else
- else if (do_show)
- show(pid);
- else {
- WRITE_MSG(2, "reducecap: tools were built without legacy API support; can not continue\n");
- exit(wrapper_exit_code);
- }
-#endif
-
- return EXIT_SUCCESS;
-}
git://git.onelab.eu / util-vserver.git / blobdiff