get_total_time_ms += this_time;
get_total_size += finfo.size;
- DEBUG(2,("(%g kb/s) (average %g kb/s)\n",
+ DEBUG(1,("(%g kb/s) (average %g kb/s)\n",
finfo.size / (1.024*this_time + 1.0e-4),
get_total_size / (1.024*get_total_time_ms)));
}
put_total_time_ms += this_time;
put_total_size += finfo->size;
- DEBUG(2,("(%g kb/s) (average %g kb/s)\n",
+ DEBUG(1,("(%g kb/s) (average %g kb/s)\n",
finfo->size / (1.024*this_time + 1.0e-4),
put_total_size / (1.024*put_total_time_ms)));
}
#define LONG_CONNECT_TIMEOUT 30
#define SHORT_CONNECT_TIMEOUT 5
+
+/* the directory to sit in when idle */
+#define IDLE_DIR "/"
+
#endif
BOOL become_guest(void);
BOOL become_user(int cnum, int uid);
BOOL unbecome_user(void );
-int smbrun(char *cmd,char *outfile);
+int smbrun(char *cmd,char *outfile,BOOL shared);
/*The following definitions come from username.c */
if (lower && upper) {
lower_char_map[(char)upper] = (char)lower;
upper_char_map[(char)lower] = (char)upper;
+ lower_char_map[(char)lower] = (char)lower;
+ upper_char_map[(char)upper] = (char)upper;
}
}
if (!strcsequal(fname,debugf) || !dbf || !file_exist(debugf,NULL))
{
+ int oldumask = umask(022);
strcpy(debugf,fname);
if (dbf) fclose(dbf);
if (append_log)
else
dbf = fopen(debugf,"w");
if (dbf) setbuf(dbf,NULL);
+ umask(oldumask);
}
}
else
{
if (!dbf)
{
+ int oldumask = umask(022);
dbf = fopen(debugf,"w");
+ umask(oldumask);
if (dbf)
setbuf(dbf,NULL);
else
}
if (ret < 0 && (errno == EINPROGRESS || errno == EALREADY)) {
- DEBUG(2,("timeout connecting to %s:%d\n",inet_ntoa(*addr),port));
+ DEBUG(1,("timeout connecting to %s:%d\n",inet_ntoa(*addr),port));
close(res);
return -1;
}
#endif
if (ret < 0) {
- DEBUG(2,("error connecting to %s:%d (%s)\n",
+ DEBUG(1,("error connecting to %s:%d (%s)\n",
inet_ntoa(*addr),port,strerror(errno)));
return -1;
}
static BOOL shm_register_process(char *processreg_file, pid_t pid, BOOL *other_processes)
{
- int old_umask;
int shm_processes_fd = -1;
int nb_read;
pid_t other_pid;
int free_slot = -1;
- int erased_slot;
-
+ int erased_slot;
- old_umask = umask(0);
shm_processes_fd = open(processreg_file, O_RDWR | O_CREAT, 0666);
- umask(old_umask);
if ( shm_processes_fd < 0 )
{
DEBUG(0,("ERROR shm_register_process : processreg_file open failed with code %d\n",errno));
int pw_file_lock(char *name, int type, int secs)
{
- int fd = open(name, O_RDWR | O_CREAT, 0666);
+ int fd = open(name, O_RDWR | O_CREAT, 0600);
if (fd < 0)
return (-1);
if (do_pw_lock(fd, secs, type)) {
tempstr = build_print_command(cnum, PRINTCOMMAND(snum), syscmd, Files[fnum].name);
if (tempstr != NULL)
{
- int ret = smbrun(syscmd,NULL);
+ int ret = smbrun(syscmd,NULL,False);
DEBUG(3,("Running the command `%s' gave %d\n",syscmd,ret));
}
else
struct stat sbuf;
BOOL dorun=True;
int cachetime = lp_lpqcachetime();
- int lfd = -1;
*line = 0;
check_lpq_cache(snum);
DEBUG(3,("Using cached lpq output\n"));
dorun = False;
}
-
- if (dorun) {
- lfd = file_lock(outfile,LPQ_LOCK_TIMEOUT);
- if (lfd<0 ||
- (!fstat(lfd,&sbuf) && (time(NULL) - sbuf.st_mtime)<cachetime)) {
- DEBUG(3,("Using cached lpq output\n"));
- dorun = False;
- file_unlock(lfd); lfd = -1;
- }
- }
}
if (dorun) {
- ret = smbrun(syscmd,outfile);
+ ret = smbrun(syscmd,outfile,True);
DEBUG(3,("Running the command `%s' gave %d\n",syscmd,ret));
}
f = fopen(outfile,"r");
if (!f) {
- if (lfd >= 0) file_unlock(lfd);
return(0);
}
fclose(f);
- if (lfd >= 0) file_unlock(lfd);
-
- if (!cachetime)
+ if (!cachetime) {
unlink(outfile);
- else
+ } else {
+ /* we only expect this to succeed on trapdoor systems, on normal systems
+ the file is owned by root */
chmod(outfile,0666);
+ }
return(count);
}
string_sub(syscmd,"%j",jobstr);
standard_sub(cnum,syscmd);
- ret = smbrun(syscmd,NULL);
+ ret = smbrun(syscmd,NULL,False);
DEBUG(3,("Running the command `%s' gave %d\n",syscmd,ret));
lpq_reset(snum); /* queue has changed */
}
string_sub(syscmd,"%j",jobstr);
standard_sub(cnum,syscmd);
- ret = smbrun(syscmd,NULL);
+ ret = smbrun(syscmd,NULL,False);
DEBUG(3,("Running the command `%s' gave %d\n",syscmd,ret));
lpq_reset(snum); /* queue has changed */
}
{
pstring s;
fstring name;
- FILE *f;
int i;
+ int fd;
if (! (*lp_msg_command()))
{
sprintf(s,"/tmp/msg.XXXXXX");
strcpy(name,(char *)mktemp(s));
- f = fopen(name,"w");
- if (!f)
- {
- DEBUG(1,("can't open message file %s\n",name));
- return;
- }
+ fd = open(name,O_WRONLY|O_CREAT|O_TRUNC|O_EXCL,0600);
+ if (fd == -1) {
+ DEBUG(1,("can't open message file %s\n",name));
+ return;
+ }
- for (i=0;i<msgpos;)
- {
- if (msgbuf[i]=='\r' && i<(msgpos-1) && msgbuf[i+1]=='\n')
- i++;
- fputc(msgbuf[i++],f);
+ for (i=0;i<msgpos;) {
+ if (msgbuf[i]=='\r' && i<(msgpos-1) && msgbuf[i+1]=='\n') {
+ i++; continue;
}
-
- fclose(f);
+ write(fd,&msgbuf[i++],1);
+ }
+ close(fd);
/* run the command */
string_sub(s,"%f",msgfrom);
string_sub(s,"%t",msgto);
standard_sub(-1,s);
- smbrun(s,NULL);
+ smbrun(s,NULL,False);
}
msgpos = 0;
sprintf(syscmd,"%s %s",df_command,path);
standard_sub_basic(syscmd);
- ret = smbrun(syscmd,outfile);
+ ret = smbrun(syscmd,outfile,False);
DEBUG(3,("Running the command `%s' gave %d\n",syscmd,ret));
{
sprintf(magic_output,"%s.out",fname);
chmod(fname,0755);
- ret = smbrun(fname,magic_output);
+ ret = smbrun(fname,magic_output,False);
DEBUG(3,("Invoking magic command %s gave %d\n",fname,ret));
unlink(fname);
}
strcpy(cmd,lp_rootpreexec(SNUM(cnum)));
standard_sub(cnum,cmd);
DEBUG(5,("cmd=%s\n",cmd));
- smbrun(cmd,NULL);
+ smbrun(cmd,NULL,False);
}
if (!become_user(cnum,pcon->uid))
pstring cmd;
strcpy(cmd,lp_preexec(SNUM(cnum)));
standard_sub(cnum,cmd);
- smbrun(cmd,NULL);
+ smbrun(cmd,NULL,False);
}
/* we've finished with the sensitive stuff */
pstring cmd;
strcpy(cmd,lp_postexec(SNUM(cnum)));
standard_sub(cnum,cmd);
- smbrun(cmd,NULL);
+ smbrun(cmd,NULL,False);
unbecome_user();
}
pstring cmd;
strcpy(cmd,lp_rootpostexec(SNUM(cnum)));
standard_sub(cnum,cmd);
- smbrun(cmd,NULL);
+ smbrun(cmd,NULL,False);
}
Connections[cnum].open = False;
if (!file_exist(fname,NULL))
{
+ int oldmask = umask(022);
f = fopen(fname,"w");
if (f) fclose(f);
+ umask(oldmask);
}
total_recs = file_size(fname) / sizeof(crec);
fault_setup(exit_server);
- umask(0777 & ~DEF_CREATE_MASK);
+ /* we want total control over the permissions on created files,
+ so set our umask to 0 */
+ umask(0);
init_uid();
static int initial_uid;
static int initial_gid;
-static int old_umask = 022;
-
-static pstring OriginalDir;
/* what user is current? */
struct current_user current_user;
current_user.cnum = -1;
- GetWd(OriginalDir);
+ ChDir(IDLE_DIR);
}
if (initial_uid != 0)
return(True);
+ if (uid == -1 || uid == 65535) {
+ DEBUG(1,("WARNING: using uid %d is a security risk\n",uid));
+ }
+
#ifdef AIX
{
/* AIX 3 stuff - inspired by a code fragment in wu-ftpd */
{
if (initial_uid != 0)
return(True);
+
+ if (gid == -1 || gid == 65535) {
+ DEBUG(1,("WARNING: using gid %d is a security risk\n",gid));
+ }
#ifdef USE_SETRES
if (setresgid(-1,gid,-1) != 0)
****************************************************************************/
BOOL become_user(int cnum, int uid)
{
- int new_umask;
user_struct *vuser;
int snum,gid;
int id = uid;
return(False);
}
- new_umask = 0777 & ~CREATE_MODE(cnum);
- old_umask = umask(new_umask);
-
current_user.cnum = cnum;
current_user.id = id;
- DEBUG(5,("become_user uid=(%d,%d) gid=(%d,%d) new_umask=0%o\n",
- getuid(),geteuid(),getgid(),getegid(),new_umask));
+ DEBUG(5,("become_user uid=(%d,%d) gid=(%d,%d)\n",
+ getuid(),geteuid(),getgid(),getegid()));
return(True);
}
if (current_user.cnum == -1)
return(False);
- ChDir(OriginalDir);
-
- umask(old_umask);
+ ChDir(IDLE_DIR);
if (initial_uid == 0)
{
current_user.uid = initial_uid;
current_user.gid = initial_gid;
- if (ChDir(OriginalDir) != 0)
+ if (ChDir(IDLE_DIR) != 0)
DEBUG(0,("%s chdir(%s) failed in unbecome_user\n",
- timestring(),OriginalDir));
+ timestring(),IDLE_DIR));
DEBUG(5,("unbecome_user now uid=(%d,%d) gid=(%d,%d)\n",
getuid(),geteuid(),getgid(),getegid()));
/****************************************************************************
-run a command via system() using smbrun, being careful about uid/gid handling
+This is a utility function of smbrun(). It must be called only from
+the child as it may leave the caller in a privilaged state.
****************************************************************************/
-int smbrun(char *cmd,char *outfile)
+static BOOL setup_stdout_file(char *outfile,BOOL shared)
+{
+ int fd;
+ mode_t mode = S_IWUSR|S_IRUSR|S_IRGRP|S_IROTH;
+
+ close(1);
+
+ if (shared) {
+ /* become root - unprivilaged users can't delete these files */
+#ifdef USE_SETRES
+ setresgid(0,0,0);
+ setresuid(0,0,0);
+#else
+ setuid(0);
+ seteuid(0);
+#endif
+ }
+
+ /* now create the file with O_EXCL set */
+ unlink(outfile);
+ fd = open(outfile,O_RDWR|O_CREAT|O_TRUNC|O_EXCL,mode);
+
+ if (fd == -1) return False;
+
+ if (fd != 1) {
+ if (dup2(fd,1) != 0) {
+ DEBUG(2,("Failed to create stdout file descriptor\n"));
+ close(fd);
+ return False;
+ }
+ close(fd);
+ }
+ return True;
+}
+
+
+/****************************************************************************
+run a command being careful about uid/gid handling and putting the output in
+outfile (or discard it if outfile is NULL).
+
+if shared is True then ensure the file will be writeable by all users
+but created such that its owned by root. This overcomes a security hole.
+
+if shared is not set then open the file with O_EXCL set
+****************************************************************************/
+int smbrun(char *cmd,char *outfile,BOOL shared)
{
+ int fd,pid;
+ int uid = current_user.uid;
+ int gid = current_user.gid;
+
+#if USE_SYSTEM
int ret;
pstring syscmd;
char *path = lp_smbrun();
+ /* in the old method we use system() to execute smbrun which then
+ executes the command (using system() again!). This involves lots
+ of shell launches and is very slow. It also suffers from a
+ potential security hole */
if (!file_exist(path,NULL))
{
DEBUG(0,("SMBRUN ERROR: Can't find %s. Installation problem?\n",path));
}
sprintf(syscmd,"%s %d %d \"(%s 2>&1) > %s\"",
- path,current_user.uid,current_user.gid,cmd,
+ path,uid,gid,cmd,
outfile?outfile:"/dev/null");
DEBUG(5,("smbrun - running %s ",syscmd));
ret = system(syscmd);
DEBUG(5,("gave %d\n",ret));
return(ret);
+#else
+ /* in this newer method we will exec /bin/sh with the correct
+ arguments, after first setting stdout to point at the file */
+
+ if ((pid=fork())) {
+ int status=0;
+ /* the parent just waits for the child to exit */
+ if (waitpid(pid,&status,0) != pid) {
+ DEBUG(2,("waitpid(%d) : %s\n",pid,strerror(errno)));
+ return -1;
+ }
+ return status;
+ }
+
+
+ /* we are in the child. we exec /bin/sh to do the work for us. we
+ don't directly exec the command we want because it may be a
+ pipeline or anything else the config file specifies */
+
+ /* point our stdout at the file we want output to go into */
+ if (outfile && !setup_stdout_file(outfile,shared)) {
+ exit(80);
+ }
+
+ /* now completely lose our privilages. This is a fairly paranoid
+ way of doing it, but it does work on all systems that I know of */
+#ifdef USE_SETRES
+ setresgid(0,0,0);
+ setresuid(0,0,0);
+ setresgid(gid,gid,gid);
+ setresuid(uid,uid,uid);
+#else
+ setuid(0);
+ seteuid(0);
+ setgid(gid);
+ setegid(gid);
+ setuid(uid);
+ seteuid(uid);
+#endif
+
+ if (getuid() != uid || geteuid() != uid ||
+ getgid() != gid || getegid() != gid) {
+ /* we failed to lose our privilages - do not execute the command */
+ exit(81); /* we can't print stuff at this stage, instead use exit codes
+ for debugging */
+ }
+
+ /* close all other file descriptors, leaving only 0, 1 and 2. 0 and
+ 2 point to /dev/null from the startup code */
+ for (fd=3;fd<256;fd++) close(fd);
+
+ execl("/bin/sh","sh","-c",cmd,NULL);
+
+ /* not reached */
+ exit(82);
+#endif
}
else
{
dbf = fopen("test.log", "w");
- if (dbf == NULL)
+ if (dbf == NULL) {
printf("Unable to open logfile.\n");
- else
- {
+ } else {
DEBUGLEVEL = 3;
pszTemp = (argc < 3) ? PRINTCAP_NAME : argv[2];
printf("Looking for printer %s in printcap file %s\n",