WebSVN – wimsdev – Diff – /trunk/wims/src/Misc/chroot.c

 int execgid=15999;
 int must=0;
 time_t now;
 char *env_rm[]={
-    "s2_dir", "w_wims_home", "session_base_dir", "trusted_module",
+  "s2_dir", "w_wims_home", "session_base_dir", "trusted_module",
-      "session_dir", "wims_server_base", "w_httpd_PWD",
+    "session_dir", "wims_server_base", "w_httpd_PWD",
-      "w_wims_sesdir", "HTTP_CONNECTION",
+    "w_wims_sesdir", "HTTP_CONNECTION",
-      "w_gnuplot_format", "w_insplot_font", "w_ins_anim_limit",
+    "w_gnuplot_format", "w_insplot_font", "w_ins_anim_limit",
-      "w_ins_density", "w_ins_format",
+    "w_ins_density", "w_ins_format",
-      "texgif_fontdir", "texgif_texheader",
+    "texgif_fontdir", "texgif_texheader",
-      "w_wims_tmp_debug", "w_insmath_logic", "w_insmath_rawmath",
+    "w_wims_tmp_debug", "w_insmath_logic", "w_insmath_rawmath",
-      "SERVER_ADMIN", "SERVER_ADDR", "SERVER_NAME"
+    "SERVER_ADMIN", "SERVER_ADDR", "SERVER_NAME"
 };
 #define env_rm_cnt (sizeof(env_rm)/sizeof(env_rm[0]))
 char name_sh[32]="/bin/ash.static";
 /* Remove a tree */
 int remove_tree(char *dirname)
+{
-    DIR *sdir;
+  DIR *sdir;
-    struct dirent *f;
+  struct dirent *f;
-    struct stat dst;
+  struct stat dst;
-    sdir=opendir(dirname);
+  sdir=opendir(dirname);
-    if(sdir==NULL) {   /* Cannot open session directory. */
+  if(sdir==NULL) {   /* Cannot open session directory. */
-       return -1;
+     return -1;
-    }
+  }
-    while((f=readdir(sdir))!=NULL) {
+  while((f=readdir(sdir))!=NULL) {
-        char fname[255];
+    char fname[255];
-        if(strcmp(".",f->d_name)==0 || strcmp("..",f->d_name)==0) continue;
+    if(strcmp(".",f->d_name)==0 || strcmp("..",f->d_name)==0) continue;
-        snprintf(fname,sizeof(fname),"%s/%s",dirname,f->d_name);
+    snprintf(fname,sizeof(fname),"%s/%s",dirname,f->d_name);
-        if(lstat(fname,&dst)) continue;
+    if(lstat(fname,&dst)) continue;
-        if(S_ISDIR(dst.st_mode)) remove_tree(fname);
+    if(S_ISDIR(dst.st_mode)) remove_tree(fname);
-        else {
+    else {
-            if(remove(fname)<0)
+      if(remove(fname)<0)
-              fprintf(stderr,"ch..root: unable to remove %s. %s\n",fname,strerror(errno));
+        fprintf(stderr,"ch..root: unable to remove %s. %s\n",fname,strerror(errno));
-        }
+    }
-    }
+  }
-    closedir(sdir);
+  closedir(sdir);
-    if(rmdir(dirname)<0) {  /* Cannot remove directory. */
+  if(rmdir(dirname)<0) {  /* Cannot remove directory. */
-       return -1;
+     return -1;
-    }
+  }
-    return 0;
+  return 0;
 }
 /* Clean TMP */
 void cleantmp(void)
 {
-    DIR *sdir_base;
+  DIR *sdir_base;
-    struct dirent *ses;
+  struct dirent *ses;
-    struct stat dst;
+  struct stat dst;
-    if(chdir("../chroot/tmp/sessions")<0) return;
+  if(chdir("../chroot/tmp/sessions")<0) return;
-    sdir_base=opendir(".");
+  sdir_base=opendir(".");
-    if(sdir_base==NULL) return;
+  if(sdir_base==NULL) return;
-    while((ses=readdir(sdir_base))!=NULL) {
+  while((ses=readdir(sdir_base))!=NULL) {
-        if(ses->d_name[0]=='.') continue;
+    if(ses->d_name[0]=='.') continue;
-        if(lstat(ses->d_name,&dst)) continue;
+    if(lstat(ses->d_name,&dst)) continue;
-        if(!S_ISDIR(dst.st_mode)) continue;
+    if(!S_ISDIR(dst.st_mode)) continue;
-        if(dst.st_mtime <= now) {
+    if(dst.st_mtime <= now) {
-            if(dst.st_mtime>=now-CLEAN_DELAY) continue;
+        if(dst.st_mtime>=now-CLEAN_DELAY) continue;
-            if(dst.st_mtime>=now-CLEAN_DELAY2 && (dst.st_mode&S_IRWXO)==0) continue;
+        if(dst.st_mtime>=now-CLEAN_DELAY2 && (dst.st_mode&S_IRWXO)==0) continue;
-        }
-        remove_tree(ses->d_name);
+    }
+    remove_tree(ses->d_name);
+  }
+}
 /* Cleaning */
 void cleaning(void)
 {
-    DIR *sdir_base;
+  DIR *sdir_base;
-    struct dirent *ses;
+  struct dirent *ses;
-    struct stat dst;
+  struct stat dst;
-    struct utimbuf ub;
+  struct utimbuf ub;
-    char dbuf[256];
+  char dbuf[256];
-    if(stat(timestamp,&dst)==0 && dst.st_mtime==now) return;
+  if(stat(timestamp,&dst)==0 && dst.st_mtime==now) return;
-    ub.actime=ub.modtime=now; utime(timestamp,&ub);
+  ub.actime=ub.modtime=now; utime(timestamp,&ub);
-    sdir_base=opendir("/proc");
+  sdir_base=opendir("/proc");
-    if(sdir_base==NULL) goto tmpdir;
+  if(sdir_base==NULL) goto tmpdir;
-    while((ses=readdir(sdir_base))!=NULL) {
+  while((ses=readdir(sdir_base))!=NULL) {
-        if(ses->d_name[0]<'0' || ses->d_name[9]>'9') continue;
+    if(ses->d_name[0]<'0' || ses->d_name[9]>'9') continue;
-        snprintf(dbuf,sizeof(dbuf),"/proc/%s",ses->d_name);
+    snprintf(dbuf,sizeof(dbuf),"/proc/%s",ses->d_name);
-        if(lstat(dbuf,&dst)) continue;
+    if(lstat(dbuf,&dst)) continue;
-        if(!S_ISDIR(dst.st_mode)) continue;
+    if(!S_ISDIR(dst.st_mode)) continue;
-        if(dst.st_uid<UID_MIN || dst.st_uid>UID_MIN+UID_MASK) continue;
+    if(dst.st_uid<UID_MIN || dst.st_uid>UID_MIN+UID_MASK) continue;
-        if(((dst.st_gid-UID_MIN-now)&TIME_MASK)<=CPU_MAX) continue;
+    if(((dst.st_gid-UID_MIN-now)&TIME_MASK)<=CPU_MAX) continue;
-        kill(atoi(ses->d_name),SIGKILL);
+    kill(atoi(ses->d_name),SIGKILL);
-    }
+  }
-    closedir(sdir_base);
+  closedir(sdir_base);
-    tmpdir: return;
+  tmpdir: return;
 }
 /* Test Must */
 int test_must(void)
 {
-    char *pc;
+  char *pc;
-    if(must) return 1;
+  if(must) return 1;
-    pc=getenv("chroot"); if(pc && strcmp(pc,"must")==0) return 1;
+  pc=getenv("chroot"); if(pc && strcmp(pc,"must")==0) return 1;
-    else return 0;
+  else return 0;
+}
 /* MAIN */
 int main(int argc,char *argv[])
+{
-    char *args[1024];
+  char *args[1024];
-    char parm[MAX_PARMLEN];
+  char parm[MAX_PARMLEN];
-    char tmpbuf[256];
+  char tmpbuf[256];
-    int i,k,uid,t;
+  int i,k,uid,t;
-    struct stat st;
+  struct stat st;
-    struct rlimit lim;
+  struct rlimit lim;
-    char *p, *pp;
+  char *p, *pp;
-    if(argc<2) return 0;
+  if(argc<2) return 0;
-    now=time(NULL);
+  now=time(NULL);
-    uid=geteuid();
+  uid=geteuid();
-    t=stat("../chroot/tmp/sessions/.chroot",&st);
+  t=stat("../chroot/tmp/sessions/.chroot",&st);
-    if(uid!=0 || t!=0) {
+  if(uid!=0 || t!=0) {
-        if(test_must()) goto abandon;
+    if(test_must()) goto abandon;
-        args[0]="bin/wrap..exec"; k=1;
+    args[0]="bin/wrap..exec"; k=1;
-    }
+  }
-    else {
+  else {
-        k=0;
+    k=0;
-        p=getenv("REMOTE_ADDR");
+    p=getenv("REMOTE_ADDR");
-        if(p && *p) {
+    if(p && *p) {
-            pp=strrchr(p,'.'); if(pp) execuid=(atoi(++pp)&UID_MASK)+UID_MIN;
+      pp=strrchr(p,'.'); if(pp) execuid=(atoi(++pp)&UID_MASK)+UID_MIN;
-        }
+    }
-        getrlimit(RLIMIT_CPU,&lim);
+    getrlimit(RLIMIT_CPU,&lim);
-        i=lim.rlim_max; if(i<0) i=0; if(i>=CPU_MAX) i=CPU_MAX-1;
+    i=lim.rlim_max; if(i<0) i=0; if(i>=CPU_MAX) i=CPU_MAX-1;
-        execgid=((i+now+1)&TIME_MASK)+UID_MIN;
+    execgid=((i+now+1)&TIME_MASK)+UID_MIN;
-        cleaning();
+    cleaning();
-    }
+  }
-    if(argc>1 && strcmp(argv[1],"cleantmpdir")==0) {
+  if(argc>1 && strcmp(argv[1],"cleantmpdir")==0) {
-        if(uid!=0) fprintf(stderr,"ch..root cleantmpdir: uid not changed.\n");
+    if(uid!=0) fprintf(stderr,"ch..root cleantmpdir: uid not changed.\n");
-        else cleantmp();
+    else cleantmp();
-        return 0;
+    return 0;
-    }
+  }
-    if(argc>3 && argv[1][0]=='&') {
+  if(argc>3 && argv[1][0]=='&') {
-        if(k) goto abandon;
+    if(k) goto abandon;
-        if(strcmp(argv[2],"sh")==0) {
+    if(strcmp(argv[2],"sh")==0) {
-            lim.rlim_cur=lim.rlim_max=MAX_OUTLEN;
+      lim.rlim_cur=lim.rlim_max=MAX_OUTLEN;
-            setrlimit(RLIMIT_FSIZE,&lim);
+      setrlimit(RLIMIT_FSIZE,&lim);
-            args[0]=name_sh; args[1]=opt_sh;
+      args[0]=name_sh; args[1]=opt_sh;
-            snprintf(parm,sizeof(parm),"%s\n%s\n",pre_sh,argv[3]);
+      snprintf(parm,sizeof(parm),"%s\n%s\n",pre_sh,argv[3]);
-            args[2]=parm; args[3]=NULL; must=1;
+      args[2]=parm; args[3]=NULL; must=1;
-            goto cont;
+      goto cont;
-        }
+    }
-        if(strcmp(argv[2],"perl")==0) {
+    if(strcmp(argv[2],"perl")==0) {
-            lim.rlim_cur=lim.rlim_max=MAX_OUTLEN;
+      lim.rlim_cur=lim.rlim_max=MAX_OUTLEN;
-            setrlimit(RLIMIT_FSIZE,&lim);
+      setrlimit(RLIMIT_FSIZE,&lim);
-            args[0]=name_perl; args[1]=opt_perl;
+      args[0]=name_perl; args[1]=opt_perl;
-            snprintf(parm,sizeof(parm),"%s\n%s\n",pre_perl,argv[3]);
+      snprintf(parm,sizeof(parm),"%s\n%s\n",pre_perl,argv[3]);
-            args[2]=parm; args[3]=NULL; must=1;
+      args[2]=parm; args[3]=NULL; must=1;
-            goto cont;
+      goto cont;
-        }
-        goto abandon;
-    }
-    for(i=0;i<1000 && i<argc; i++) args[i+k]=argv[i+1];
-    args[i]=NULL;
-    cont:
-    if(uid!=0) {
-        if(test_must()) goto abandon;
-        goto ex2;
-    }
-    if(t!=0) {
-        stat("bin",&st); execuid=execgid=st.st_uid;
-        if(test_must()) goto abandon;
-        goto ex;
+    }
+    goto abandon;
+  }
+  for(i=0;i<1000 && i<argc; i++) args[i+k]=argv[i+1];
+  args[i]=NULL;
+  cont:
+  if(uid!=0) {
+    if(test_must()) goto abandon;
+    goto ex2;
+  }
+  if(t!=0) {
+    stat("bin",&st); execuid=execgid=st.st_uid;
+    if(test_must()) goto abandon;
+    goto ex;
+  }
-    if(chroot("../chroot")==0) {
+  if(chroot("../chroot")==0) {
-        (void)chdir("/tmp");
+    (void)chdir("/tmp");
-        lim.rlim_cur=lim.rlim_max=PROC_QUOTA;
+    lim.rlim_cur=lim.rlim_max=PROC_QUOTA;
-        setrlimit(RLIMIT_NPROC,&lim);
+    setrlimit(RLIMIT_NPROC,&lim);
-        setenv("PATH",chroot_path,1);
+    setenv("PATH",chroot_path,1);
-        p=getenv("w_wims_session");
+    p=getenv("w_wims_session");
-        if(p && *p) {
+    if(p && *p) {
-            snprintf(tmpbuf,sizeof(tmpbuf),"/tmp/sessions/%s",p);
+      snprintf(tmpbuf,sizeof(tmpbuf),"/tmp/sessions/%s",p);
-            p=strchr(tmpbuf,'_'); if(p) *p=0;
+      p=strchr(tmpbuf,'_'); if(p) *p=0;
-            setenv("TMPDIR",tmpbuf,1);
+      setenv("TMPDIR",tmpbuf,1);
-            setenv("tmp_dir",tmpbuf,1);
+      setenv("tmp_dir",tmpbuf,1);
-            p=getenv("w_wims_priv_chroot");
+      p=getenv("w_wims_priv_chroot");
-            if(p && strstr(p,"tmpdir")!=NULL)
+      if(p && strstr(p,"tmpdir")!=NULL)
-              (void)chdir(tmpbuf);
+        (void)chdir(tmpbuf);
-        }
+    }
+  }
-    else if(test_must()) goto abandon;
+  else if(test_must()) goto abandon;
-    ex:
+  ex:
-    if(setregid(execgid,execgid)<0) goto abandon;
+  if(setregid(execgid,execgid)<0) goto abandon;
-    if(setreuid(execuid,execuid)<0) goto abandon;
+  if(setreuid(execuid,execuid)<0) goto abandon;
-    ex2:
+  ex2:
-    for(i=0;i<env_rm_cnt;i++) unsetenv(env_rm[i]);
+  for(i=0;i<env_rm_cnt;i++) unsetenv(env_rm[i]);
-    if(strchr(args[0],'/')) execv(args[0],args); else execvp(args[0],args);
+  if(strchr(args[0],'/')) execv(args[0],args); else execvp(args[0],args);
-    abandon: return 127;
+  abandon: return 127;
+}

Subversion Repositories wimsdev

(root)/trunk/wims/src/Misc/chroot.c – Rev 11539 → 12248