26ffe8118
Denys Vlasenko
2010-02-26
Subject
su: move restricted_shell into su.c (the only user)
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
include/libbb.h+0 -1
| @@ -1139,7 +1139,6 @@ extern void selinux_preserve_fcontext(int fdesc) FAST_FUNC; | |
| #define selinux_preserve_fcontext(fdesc) ((void)0) | |
| #endif | |
| extern void selinux_or_die(void) FAST_FUNC; | |
| - | extern int restricted_shell(const char *shell) FAST_FUNC; |
| /* setup_environment: | |
| * if chdir pw->pw_dir: ok: else if to_tmp == 1: goto /tmp else: goto / or die | |
libbb/Kbuild+0 -1
| @@ -84,7 +84,6 @@ lib-y += read.o | |
| lib-y += read_key.o | |
| lib-y += recursive_action.o | |
| lib-y += remove_file.o | |
| - | lib-y += restricted_shell.o |
| lib-y += run_shell.o | |
| lib-y += safe_gethostname.o | |
| lib-y += safe_poll.o | |
libbb/restricted_shell.c+0 -46
| @@ -1,46 +0,0 @@ | |
| - | /* vi: set sw=4 ts=4: */ |
| - | /* |
| - | * Copyright 1989 - 1991, Julianne Frances Haugh <[email protected]> |
| - | * All rights reserved. |
| - | * |
| - | * Redistribution and use in source and binary forms, with or without |
| - | * modification, are permitted provided that the following conditions |
| - | * are met: |
| - | * 1. Redistributions of source code must retain the above copyright |
| - | * notice, this list of conditions and the following disclaimer. |
| - | * 2. Redistributions in binary form must reproduce the above copyright |
| - | * notice, this list of conditions and the following disclaimer in the |
| - | * documentation and/or other materials provided with the distribution. |
| - | * 3. Neither the name of Julianne F. Haugh nor the names of its contributors |
| - | * may be used to endorse or promote products derived from this software |
| - | * without specific prior written permission. |
| - | * |
| - | * THIS SOFTWARE IS PROVIDED BY JULIE HAUGH AND CONTRIBUTORS ``AS IS'' AND |
| - | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
| - | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
| - | * ARE DISCLAIMED. IN NO EVENT SHALL JULIE HAUGH OR CONTRIBUTORS BE LIABLE |
| - | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
| - | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
| - | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
| - | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
| - | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
| - | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
| - | * SUCH DAMAGE. |
| - | */ |
| - | |
| - | #include "libbb.h" |
| - | |
| - | /* Return 1 if SHELL is a restricted shell (one not returned by |
| - | getusershell), else 0, meaning it is a standard shell. */ |
| - | int FAST_FUNC restricted_shell(const char *shell) |
| - | { |
| - | char *line; |
| - | |
| - | setusershell(); |
| - | while ((line = getusershell())) { |
| - | if (*line != '#' && strcmp(line, shell) == 0) |
| - | return 0; |
| - | } |
| - | endusershell(); |
| - | return 1; |
| - | } |
loginutils/su.c+18 -1
| @@ -8,6 +8,23 @@ | |
| #include "libbb.h" | |
| #include <syslog.h> | |
| + | #if ENABLE_FEATURE_SU_CHECKS_SHELLS |
| + | /* Return 1 if SHELL is a restricted shell (one not returned by |
| + | getusershell), else 0, meaning it is a standard shell. */ |
| + | static int restricted_shell(const char *shell) |
| + | { |
| + | char *line; |
| + | |
| + | /*setusershell(); - getusershell does it itself*/ |
| + | while ((line = getusershell()) != NULL) { |
| + | if (/* *line != '#' && */ strcmp(line, shell) == 0) |
| + | return 0; |
| + | } |
| + | endusershell(); |
| + | return 1; |
| + | } |
| + | #endif |
| + | |
| #define SU_OPT_mp (3) | |
| #define SU_OPT_l (4) | |
| @@ -89,7 +106,7 @@ int su_main(int argc UNUSED_PARAM, char **argv) | |
| opt_shell = getenv("SHELL"); | |
| #if ENABLE_FEATURE_SU_CHECKS_SHELLS | |
| - | if (opt_shell && cur_uid && restricted_shell(pw->pw_shell)) { |
| + | if (opt_shell && cur_uid != 0 && restricted_shell(pw->pw_shell)) { |
| /* The user being su'd to has a nonstandard shell, and so is | |
| probably a uucp account or has restricted access. Don't | |
| compromise the account by allowing access with a standard | |