79e2598c4
Denys Vlasenko
2016-11-03
Subject
su: expand help; simplify passing of -c CMD to run_shell()
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
include/libbb.h +1 -1libbb/executable.c +1 -1libbb/run_shell.c +12 -17loginutils/login.c +1 -1loginutils/su.c +29 -4loginutils/sulogin.c +1 -1
include/libbb.h+1 -1
| @@ -1341,7 +1341,7 @@ char *bb_simplify_abs_path_inplace(char *path) FAST_FUNC; | |
| #endif | |
| extern void bb_do_delay(int seconds) FAST_FUNC; | |
| extern void change_identity(const struct passwd *pw) FAST_FUNC; | |
| - | extern void run_shell(const char *shell, int loginshell, const char *command, const char **additional_args) NORETURN FAST_FUNC; |
| + | extern void run_shell(const char *shell, int loginshell, const char **args) NORETURN FAST_FUNC; |
| /* Returns $SHELL, getpwuid(getuid())->pw_shell, or DEFAULT_SHELL. | |
| * Note that getpwuid result might need xstrdup'ing | |
libbb/executable.c+1 -1
| @@ -97,5 +97,5 @@ void FAST_FUNC exec_prog_or_SHELL(char **argv) | |
| if (argv[0]) { | |
| BB_EXECVP_or_die(argv); | |
| } | |
| - | run_shell(getenv("SHELL"), /*login:*/ 1, NULL, NULL); |
| + | run_shell(getenv("SHELL"), /*login:*/ 1, NULL); |
| } | |
libbb/run_shell.c+12 -17
| @@ -50,19 +50,17 @@ void FAST_FUNC set_current_security_context(security_context_t sid) | |
| #endif | |
| /* Run SHELL, or DEFAULT_SHELL if SHELL is "" or NULL. | |
| - | * If COMMAND is nonzero, pass it to the shell with the -c option. |
| - | * If ADDITIONAL_ARGS is nonzero, pass it to the shell as more |
| - | * arguments. */ |
| - | void FAST_FUNC run_shell(const char *shell, int loginshell, const char *command, const char **additional_args) |
| + | * If ADDITIONAL_ARGS is not NULL, pass them to the shell. |
| + | */ |
| + | void FAST_FUNC run_shell(const char *shell, int loginshell, const char **additional_args) |
| { | |
| const char **args; | |
| - | int argno; |
| - | int additional_args_cnt = 0; |
| - | for (args = additional_args; args && *args; args++) |
| - | additional_args_cnt++; |
| + | args = additional_args; |
| + | while (args && *args) |
| + | args++; |
| - | args = xmalloc(sizeof(char*) * (4 + additional_args_cnt)); |
| + | args = xmalloc(sizeof(char*) * (2 + (args - additional_args))); |
| if (!shell || !shell[0]) | |
| shell = DEFAULT_SHELL; | |
| @@ -70,16 +68,13 @@ void FAST_FUNC run_shell(const char *shell, int loginshell, const char *command, | |
| args[0] = bb_get_last_path_component_nostrip(shell); | |
| if (loginshell) | |
| args[0] = xasprintf("-%s", args[0]); | |
| - | argno = 1; |
| - | if (command) { |
| - | args[argno++] = "-c"; |
| - | args[argno++] = command; |
| - | } |
| + | args[1] = NULL; |
| if (additional_args) { | |
| - | for (; *additional_args; ++additional_args) |
| - | args[argno++] = *additional_args; |
| + | int cnt = 1; |
| + | for (;;) |
| + | if ((args[cnt++] = *additional_args++) == NULL) |
| + | break; |
| } | |
| - | args[argno] = NULL; |
| #if ENABLE_SELINUX | |
| if (current_sid) | |
loginutils/login.c+1 -1
| @@ -618,7 +618,7 @@ int login_main(int argc UNUSED_PARAM, char **argv) | |
| signal(SIGINT, SIG_DFL); | |
| /* Exec login shell with no additional parameters */ | |
| - | run_shell(pw->pw_shell, 1, NULL, NULL); |
| + | run_shell(pw->pw_shell, 1, NULL); |
| /* return EXIT_FAILURE; - not reached */ | |
| } | |
loginutils/su.c+29 -4
| @@ -31,10 +31,10 @@ | |
| //kbuild:lib-$(CONFIG_SU) += su.o | |
| //usage:#define su_trivial_usage | |
| - | //usage: "[OPTIONS] [-] [USER]" |
| + | //usage: "[-lmp] [-] [-s SH] [USER [SCRIPT ARGS / -c 'CMD' ARG0 ARGS]]" |
| //usage:#define su_full_usage "\n\n" | |
| //usage: "Run shell under USER (by default, root)\n" | |
| - | //usage: "\n -,-l Clear environment, run shell as login shell" |
| + | //usage: "\n -,-l Clear environment, go to home dir, run shell as login shell" |
| //usage: "\n -p,-m Do not set new $HOME, $SHELL, $USER, $LOGNAME" | |
| //usage: "\n -c CMD Command to pass to 'sh -c'" | |
| //usage: "\n -s SH Shell to use instead of user's default" | |
| @@ -81,8 +81,12 @@ int su_main(int argc UNUSED_PARAM, char **argv) | |
| #endif | |
| const char *old_user; | |
| + | /* Note: we don't use "'+': stop at first non-option" idiom here. |
| + | * For su, "SCRIPT ARGS" or "-c CMD ARGS" do not stop option parsing: |
| + | * ARGS starting with dash will be treated as su options, |
| + | * not passed to shell. (Tested on util-linux 2.28). |
| + | */ |
| flags = getopt32(argv, "mplc:s:", &opt_command, &opt_shell); | |
| - | //argc -= optind; |
| argv += optind; | |
| if (argv[0] && LONE_DASH(argv[0])) { | |
| @@ -162,8 +166,29 @@ int su_main(int argc UNUSED_PARAM, char **argv) | |
| pw); | |
| IF_SELINUX(set_current_security_context(NULL);) | |
| + | if (opt_command) { |
| + | *--argv = opt_command; |
| + | *--argv = (char*)"-c"; |
| + | } |
| + | |
| + | /* A nasty ioctl exists which can stuff data into input queue: |
| + | * #include <sys/ioctl.h> |
| + | * int main() { |
| + | * const char *msg = "echo $UID\n"; |
| + | * while (*msg) ioctl(0, TIOCSTI, *msg++); |
| + | * return 0; |
| + | * } |
| + | * With "su USER -c EXPLOIT" run by root, exploit can make root shell |
| + | * read as input and execute arbitrary command. |
| + | * It's debatable whether we need to protect against this |
| + | * (root may hesitate to run unknown scripts interactively). |
| + | * |
| + | * Some versions of su run -c CMD in a different session: |
| + | * ioctl(TIOCSTI) works only on the controlling tty. |
| + | */ |
| + | |
| /* Never returns */ | |
| - | run_shell(opt_shell, flags & SU_OPT_l, opt_command, (const char**)argv); |
| + | run_shell(opt_shell, flags & SU_OPT_l, (const char**)argv); |
| /* return EXIT_FAILURE; - not reached */ | |
| } | |
loginutils/sulogin.c+1 -1
| @@ -89,5 +89,5 @@ int sulogin_main(int argc UNUSED_PARAM, char **argv) | |
| shell = pwd->pw_shell; | |
| /* Exec login shell with no additional parameters. Never returns. */ | |
| - | run_shell(shell, 1, NULL, NULL); |
| + | run_shell(shell, 1, NULL); |
| } | |