X-Git-Url: https://ruderich.org/simon/gitweb/?p=ptyas%2Fptyas.git;a=blobdiff_plain;f=ptyas.c;h=25f49aa2fc81ebb3d935ec87403857d8606a25a2;hp=1deda82a2e48cf265a73f5b86789bb98395fa2c9;hb=09096d9ba0eb9bc938b7bd050a89abd949bf7257;hpb=825f5f0f639d76e5ef05687408eb3225ba9c93fa

diff --git a/ptyas.c b/ptyas.c
index 1deda82..25f49aa 100644
--- a/ptyas.c
+++ b/ptyas.c
@@ -2,20 +2,20 @@
  * Run the login shell or command as the given user in a new pty to prevent
  * terminal injection attacks.
  *
- * Copyright (C) 2016  Simon Ruderich
+ * Copyright (C) 2016-2019  Simon Ruderich
  *
  * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
+ * it under the terms of the GNU Affero General Public License as published by
  * the Free Software Foundation, either version 3 of the License, or
  * (at your option) any later version.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
+ * GNU Affero General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
 
 #define _GNU_SOURCE
@@ -39,6 +39,12 @@
 #include <termios.h>
 #include <unistd.h>
 
+/* Default PATH for new process.*/
+#ifndef PTYAS_DEFAULT_PATH
+/* Default user PATH from Debian's /etc/profile, change as needed. */
+# define PTYAS_DEFAULT_PATH "/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games"
+#endif
+
 
 static void die(const char *s) {
     perror(s);
@@ -76,9 +82,11 @@ static void open_pty_or_die(int *pty_master, int *pty_slave, uid_t uid) {
     if (*pty_slave == -1) {
         die("open slave tty");
     }
-    /* The user must be able to write to the new TTY. Normally grantpt() would
+    /*
+     * The user must be able to write to the new TTY. Normally grantpt() would
      * do this for us, but we don't trust the user and thus don't want to pass
-     * the pty_master to a process running under that uid. */
+     * the pty_master to a process running under that uid.
+     */
     if (chown(slave_path, uid, (gid_t)-1) != 0) {
         die("chown slave tty");
     }
@@ -113,7 +121,7 @@ static void drop_privileges_or_die(uid_t uid, gid_t gid) {
         die("setgroups");
     }
     if (getgroups(0, NULL) != 0) {
-        die_fmt("failed to drop all groups");
+        die_fmt("failed to drop all supplementary groups");
     }
 
     /* Dropping groups may require privileges, do that first. */
@@ -211,14 +219,15 @@ static void proxy_input_between_ttys(int pty_master, int ctty, volatile pid_t *p
         if (ppoll(fds, nfds, NULL /* no timeout */, &sigset_old) == -1) {
             if (errno == EAGAIN || errno == EINTR) {
                 continue;
-            } else {
-                perror("poll");
             }
+            perror("poll");
             break;
         }
 
-        /* Handle errors first. (Data available before the error occurred
-         * might be skipped, but shouldn't matter here.) */
+        /*
+         * Handle errors first. (Data available before the error occurred
+         * might be dropped, but shouldn't matter here.)
+         */
         if (fds[0].revents & (POLLERR | POLLNVAL)) {
             fprintf(stderr, "poll: error on master: %d\n", fds[0].revents);
             break;
@@ -261,10 +270,12 @@ static void proxy_input_between_ttys(int pty_master, int ctty, volatile pid_t *p
 static volatile pid_t pid_to_wait_for;
 static int pid_to_wait_for_status;
 
-static void sigchld_handler() {
+static void sigchld_handler(int signal) {
     int status;
     pid_t pid;
 
+    (void)signal;
+
     while ((pid = waitpid(-1, &status, WNOHANG)) > 0) {
         if (pid == pid_to_wait_for) {
             /* Mark that our child has died and we should exit as well. */
@@ -275,6 +286,28 @@ static void sigchld_handler() {
     }
 }
 
+/*
+ * SIGWINCH handler to handle resizes of the outer terminal.
+ *
+ * Errors are ignored without message because printing in signal handlers is
+ * problematic (no FILE * usable due to locks) and there's not much we can do
+ * at this point.
+ */
+static int sigwinch_ctty = -1;
+static int sigwinch_slave = -1;
+
+static void sigwinch_handler(int signal) {
+    (void)signal;
+
+    struct winsize size;
+    if (ioctl(sigwinch_ctty, TIOCGWINSZ, &size) == -1) {
+        return;
+    }
+    if (ioctl(sigwinch_slave, TIOCSWINSZ, &size) == -1) {
+        return;
+    }
+}
+
 
 int main(int argc, char **argv) {
     char *exec_argv_shell[] = { NULL, NULL }; /* filled below */
@@ -354,6 +387,11 @@ int main(int argc, char **argv) {
         if (pid == -1) {
             die("fork child");
         } else if (pid == 0) {
+            /*
+             * Drop the privileges just now so that the other user doesn't get
+             * access to the master TTY or the session leader (which might
+             * have additional privileges).
+             */
             drop_privileges_or_die(uid, gid);
 
             dup2_or_die(pty_slave, STDIN_FILENO);
@@ -368,6 +406,14 @@ int main(int argc, char **argv) {
             }
             const char *home = passwd->pw_dir;
 
+            /*
+             * Ignore errors here as we don't want to die on non-existent home
+             * directories to allow running as any user (think "/nonexistent"
+             * as home) and an error message will be annoying to ignore when
+             * running this command in scripts.
+             */
+            chdir(home);
+
             char envp_user[strlen("USER=") + strlen(user) + 1];
             char envp_home[strlen("HOME=") + strlen(home) + 1];
             char envp_term[strlen("TERM=") + strlen(term) + 1];
@@ -376,7 +422,7 @@ int main(int argc, char **argv) {
             snprintf_or_assert(envp_term, sizeof(envp_term), "TERM=%s", term);
 
             char *exec_envp[] = {
-                "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+                "PATH=" PTYAS_DEFAULT_PATH,
                 envp_user,
                 envp_home,
                 term_orig ? envp_term : NULL,
@@ -398,14 +444,26 @@ int main(int argc, char **argv) {
         }
         quit_with_matching_code(status);
     }
-    close_or_die(pty_slave);
+    /* Don't close pty_slave here as it's used in sigwinch_handler(). */
+
+    sigwinch_ctty = ctty;
+    sigwinch_slave = pty_slave;
+
+    struct sigaction action_sigwinch = {
+        .sa_handler = sigwinch_handler,
+    };
+    sigemptyset(&action_sigwinch.sa_mask);
+    if (sigaction(SIGWINCH, &action_sigwinch, NULL) != 0) {
+        die("sigaction SIGWINCH");
+    }
 
     pid_to_wait_for = pid;
-    struct sigaction action = {
+    struct sigaction action_sigchld = {
         .sa_handler = sigchld_handler,
     };
-    if (sigaction(SIGCHLD, &action, NULL) != 0) {
-        die("sigaction");
+    sigemptyset(&action_sigchld.sa_mask);
+    if (sigaction(SIGCHLD, &action_sigchld, NULL) != 0) {
+        die("sigaction SIGCHLD");
     }
 
     if (sigprocmask(SIG_SETMASK, &sigset_old, NULL) != 0) {
@@ -436,8 +494,10 @@ int main(int argc, char **argv) {
         die("tcsetattr restore");
     }
 
-    /* Wait until we got the status code from our child. poll() might also
-     * exit after POLLHUP while we haven't collected the child yet. */
+    /*
+     * Wait until we got the status code from our child. poll() might already
+     * exit after POLLHUP while we haven't collected the child yet.
+     */
     if (sigprocmask(SIG_BLOCK, &sigset, &sigset_old) != 0) {
         die("sigprocmask block sigchld loop");
     }