99
by mattgiuca
trampoline/trampoline.c: Tidied up, added comments, #defines and variables. |
1 |
/* IVLE - Informatics Virtual Learning Environment
|
2 |
* Copyright (C) 2007-2008 The University of Melbourne
|
|
3 |
*
|
|
4 |
* This program is free software; you can redistribute it and/or modify
|
|
5 |
* it under the terms of the GNU General Public License as published by
|
|
6 |
* the Free Software Foundation; either version 2 of the License, or
|
|
7 |
* (at your option) any later version.
|
|
8 |
*
|
|
9 |
* This program is distributed in the hope that it will be useful,
|
|
10 |
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
11 |
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
12 |
* GNU General Public License for more details.
|
|
13 |
*
|
|
14 |
* You should have received a copy of the GNU General Public License
|
|
15 |
* along with this program; if not, write to the Free Software
|
|
16 |
* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
|
|
17 |
*
|
|
18 |
* Program: Trampoline
|
|
19 |
* Author: Tom Conway, Matt Giuca
|
|
20 |
* Date: 20/12/2007
|
|
21 |
*
|
|
22 |
* This program runs a given program in a given working dir.
|
|
23 |
* First, it chroots to a jail path and setuids to a given user ID.
|
|
24 |
* This is intented to provide a safe execution environment for arbitrary
|
|
25 |
* programs and scripts.
|
|
26 |
*
|
|
27 |
* Scripts (such as Python programs) should be executed by supplying
|
|
28 |
* "/usr/bin/python" as the program, and the script as the first argument.
|
|
29 |
*
|
|
30 |
* Usage: trampoline uid jail-path working-path program [args...]
|
|
31 |
* Must run as root. Will safely setuid to the supplied uid, checking that it
|
|
32 |
* is not root. Recommended that the file is set up as follows:
|
|
33 |
* sudo chown root:root trampoline; sudo chroot +s trampoline
|
|
34 |
*/
|
|
35 |
||
95
by mattgiuca
Moved some things out of www into their respective dirs, console and |
36 |
#include <stdio.h> |
37 |
#include <stdlib.h> |
|
38 |
#include <string.h> |
|
39 |
#include <unistd.h> |
|
40 |
||
99
by mattgiuca
trampoline/trampoline.c: Tidied up, added comments, #defines and variables. |
41 |
/* conf.h is admin-configured by the setup process.
|
42 |
* It defines jail_base.
|
|
43 |
*/
|
|
95
by mattgiuca
Moved some things out of www into their respective dirs, console and |
44 |
#include "conf.h" |
45 |
||
99
by mattgiuca
trampoline/trampoline.c: Tidied up, added comments, #defines and variables. |
46 |
/* Argument names */
|
47 |
#define ARG_UID 1
|
|
48 |
#define ARG_JAILPATH 2
|
|
49 |
#define ARG_CWD 3
|
|
50 |
#define ARG_PROG 4
|
|
51 |
||
52 |
#define MIN_ARGC 5
|
|
53 |
||
54 |
#define UID_ROOT 0
|
|
55 |
||
95
by mattgiuca
Moved some things out of www into their respective dirs, console and |
56 |
int main(int argc, char* const argv[]) |
57 |
{
|
|
99
by mattgiuca
trampoline/trampoline.c: Tidied up, added comments, #defines and variables. |
58 |
char* jailpath; |
59 |
int uid; |
|
60 |
/* Args check and usage */
|
|
61 |
if (argc < MIN_ARGC) |
|
62 |
{
|
|
63 |
fprintf(stderr, "usage: %s <uid> <jail> <cwd> <program> [args...]\n", |
|
64 |
argv[0]); |
|
65 |
exit(EXIT_FAILURE); |
|
66 |
}
|
|
67 |
||
68 |
/* Disallow suiding to the root user */
|
|
69 |
uid = atoi(argv[ARG_UID]); |
|
70 |
if (uid == UID_ROOT) |
|
71 |
{
|
|
72 |
fprintf(stderr, "cannot set up a jail as root\n"); |
|
73 |
exit(1); |
|
74 |
}
|
|
75 |
||
76 |
/* Jail path must:
|
|
77 |
* Be non-empty
|
|
78 |
* Start with a '/'
|
|
79 |
* Not contain "/.."
|
|
80 |
* Begin with jail_base
|
|
81 |
*/
|
|
82 |
jailpath = argv[ARG_JAILPATH]; |
|
83 |
if (strlen(jailpath) < 1 || jailpath[0] != '/' |
|
84 |
|| strstr(jailpath, "/..") |
|
85 |
|| strncmp(jailpath, jail_base, strlen(jail_base))) |
|
86 |
{
|
|
87 |
fprintf(stderr, "bad jail path: %s\n", jailpath); |
|
88 |
exit(1); |
|
89 |
}
|
|
90 |
||
91 |
/* chroot into the jail.
|
|
92 |
* Henceforth this process, and its children, cannot see anything above
|
|
93 |
* jailpath. */
|
|
94 |
if (chroot(jailpath)) |
|
95
by mattgiuca
Moved some things out of www into their respective dirs, console and |
95 |
{
|
96 |
perror("could not chroot"); |
|
97 |
exit(1); |
|
98 |
}
|
|
99 |
||
99
by mattgiuca
trampoline/trampoline.c: Tidied up, added comments, #defines and variables. |
100 |
/* chdir into the specified working directory */
|
101 |
if (chdir(argv[ARG_CWD])) |
|
95
by mattgiuca
Moved some things out of www into their respective dirs, console and |
102 |
{
|
103 |
perror("could not chdir"); |
|
104 |
exit(1); |
|
105 |
}
|
|
106 |
||
99
by mattgiuca
trampoline/trampoline.c: Tidied up, added comments, #defines and variables. |
107 |
/* setuid to the given user ID.
|
108 |
* Henceforth we will be running as this user instead of root.
|
|
109 |
*/
|
|
110 |
if (setuid(uid)) |
|
95
by mattgiuca
Moved some things out of www into their respective dirs, console and |
111 |
{
|
112 |
perror("could not setuid"); |
|
113 |
exit(1); |
|
114 |
}
|
|
115 |
||
99
by mattgiuca
trampoline/trampoline.c: Tidied up, added comments, #defines and variables. |
116 |
/* exec (replace this process with the a new instance of the target
|
117 |
* program). Pass along all the arguments.
|
|
118 |
* Note that for script execution, the "program" will be the interpreter,
|
|
119 |
* and the first argument will be the script. */
|
|
120 |
execv(argv[ARG_PROG], argv + ARG_PROG); |
|
95
by mattgiuca
Moved some things out of www into their respective dirs, console and |
121 |
|
122 |
/* nb exec won't return unless there was an error */
|
|
123 |
perror("could not exec"); |
|
99
by mattgiuca
trampoline/trampoline.c: Tidied up, added comments, #defines and variables. |
124 |
return EXIT_FAILURE; |
95
by mattgiuca
Moved some things out of www into their respective dirs, console and |
125 |
}
|