On Monday, Feb 3, 2003, at 07:16 Europe/Amsterdam, Ted Goodridge, Jr
wrote:

Well, I think that hacks have no place in security related software.
But some comments on your program anyway...

Compile with cc -Wall --pedantic to catch some problems (forgetting to
include <stdio.h> and <stdlib.h>, type problem with signedness of
gid_t, sentinel value of execl).

> int printError(int error) {
> /* This function produces the error output based on error. */
> switch (error) {
> case EPERM : printf ("Operation not permitted\n");
> break;
> case EACCES: printf("You do not have permission to that
> path\n");
> break;
> case ENOTDIR: printf("That is not a directory\n");
> break;
> case ENOENT: printf("That directory does not exist\n");
> break;
> case EIO: printf("I/O error!\n");
> break;
> default:
> printf("Unknown error!\n");
> } //switch (error)
> return 0;
> } //printErroR

Use perror(3) and functions from diagnostics(3) for error reporting and
exiting.

> int main (int argc, char *argv[]) {
> int gidlist[] = {atoi(argv[2])};

Check the (number of) arguments! Make sure given id's exist. Print
usage(). Use proper types: gid_t instead of int; gid_t is unsigned!

> if(chroot(argv[1])){
> printError(errno);
> printf("Unable to change the root, exiting.\n");
> exit(1);
> }//end if

diagnostics(3)

> chdir("/");
>
> if(setgid(atoi(argv[2]))) {
> printf("unable to setgid!\n");
> exit(1);

diagnostics(3)

> }
>
> if(setgroups(1,gidlist)) { // also, could use initgroups
> printf("unable to set groups!\n");
> exit(1);

diagnostics(3)

> }
> if(setuid(atoi(argv[3]))) {
> printf("unable to setuid!\n");
> exit(1);

diagnostics(3)

> }
> if(execl(argv[4],argv[4],argv[5],NULL)){

Your call to execl is dangerous (no checking of arguments). Use (void
*) NULL as sentinel.

>
> printError(errno);
> exit(1);

diagnostics(3)

> } //if execl
> return 0;
> }
>

Otto

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]