sbox-dtc-1.11.7/ 0000755 0001750 0001750 00000000000 12247552434 012036 5 ustar zigo zigo sbox-dtc-1.11.7/README.using_sbox.txt 0000644 0001750 0001750 00000005304 12247552331 015711 0 ustar zigo zigo To use sbox-dtc, we advise the below example Apache vhost configuration. Note
that /var/www/example.com should contain a full usable chroot disk, for example
built using debootstrap, or an image of your favorite Unix system.
With such a setup, both PHP, Python, Perl and Ruby scripts should work, served
by the SBOX chroot.
NameVirtualHost 10.0.0.1:80
ServerName www.example.com
ScriptAlias /cgi-bin /usr/lib/cgi-bin
AddHandler php-cgi-wrapper .php
Action php-cgi-wrapper /cgi-bin/sbox
AddHandler python-cgi-wrapper .py
Action python-cgi-wrapper /cgi-bin/sbox
AddHandler ruby-cgi-wrapper .rb
Action ruby-cgi-wrapper /cgi-bin/sbox
AddHandler ruby-cgi-wrapper .pl
Action ruby-cgi-wrapper /cgi-bin/sbox
Options +ExecCGI
DocumentRoot /var/www/example.com/html
RewriteEngine on
RewriteCond %{REQUEST_URI} ^!/cgi-bin.*
RewriteRule ^(.*) /cgi-bin/sbox/$1 [PT]
DirectoryIndex index.php index.cgi index.pl index.py index.rb index.htm index.html index.php4
Then, you would have things like this in your disk:
/var/www/example.com/{html,var,usr,tmp,...}
On another setup, you can as well do:
DocumentRoot /var/www/example.com/var/www
This way, you can simply do:
$ mkdir -p /var/www/example.com
$ debootstrap --verbose --include=php5-cgi,wordpress \
--arch amd64 /var/www/example.com http://ftp.us.debian.org
and then everything should follow, setup automatically, and work nicely, which
is a quite cool setup! :)
Note that now, what's annoying is apps that are hardly depending on a web
server to be installed (eg: you wont want one in the chroot).
Now, to start customizing SBOX for www.example.com, just do:
cp /etc/sbox/sbox.conf /etc/sbox/vhosts.d/www.example.com
and sbox will use this new file when it sees that HTTP_HOST value is for this
vhost. This way, it is trivial to have different configurations for different
sites on the same server.
Also, if you intend to run PHP as cgi-bin in the chroot, there are couples of
changes you have to make in your php.ini. Here's the directives:
doc_root = /html
cgi.force_redirect = 0
If you don't do that, PHP will complain about not having input.
Also, I would like to add here that if you want unbreakable chroot, it is
recommended to use the GR-Security kernels. Also, it is still possible to
destroy any kind of setup within the chroot, which is still annoying. For
example, your installed script would still be vulnerable to XSS scripting,
MySQL insertions and so on. I would recommend to use mod_security at the
same time as SBOX for these issues, so that you can have a chance to catch
issues before they even reach your applicaiton.
Enjoy the added security!
--
Thomas Goirand Fri, 24 Jun 2011 20:32:12 +0800
sbox-dtc-1.11.7/env.c 0000644 0001750 0001750 00000002172 12247552331 012770 0 ustar zigo zigo #include
#include
#include
#include
#include
#define MAXENV 1024
#ifdef PATH_MAX
#define MAXPATH PATH_MAX
#else
#define MAXPATH 8192
#endif
static char nm[MAXENV];
static char wd[MAXPATH+1];
int main(int argc, char** argv, char** e) {
char *name,*delimiter;
char timestr[1024];
DIR* dir;
struct dirent* dirent;
time_t now;
printf("Content-type: text/plain\n\n");
printf("Arguments:\n");
printf("argc => %d, argv => ",argc);
while (argc>0) {
printf("%s ",*argv++);
argc--;
}
printf("\n\n");
now = time(NULL);
strftime(timestr,1024-1,"Localtime: %c %Z\n",localtime(&now));
puts(timestr);
printf("Identity:\n");
printf("uid=%ld, gid=%ld\n\n",(long)getuid(),(long)getgid());
printf("Current Directory: %s\n\n",getcwd(wd,MAXPATH));
printf("Environment:\n");
while ((name = *e++)) {
delimiter = (char*) strchr(name,'=');
if (delimiter == 0) continue;
if (delimiter - name >= MAXENV) continue;
strncpy(nm,name,delimiter-name);
nm[delimiter-name]='\0';
printf("%s => %s\n",nm,++delimiter);
}
return 0;
}
sbox-dtc-1.11.7/Makefile 0000644 0001750 0001750 00000003355 12247552331 013500 0 ustar zigo zigo # Makefile for sbox.
# 1. Change the definition of CGI_DIRECTORY to point to your site-wide
# cgi-bin directory
# 2. Review the INSTALL_OPTS definitions if you need to (will install
# sbox SUID to root)
# 3. Change CFLAGS and CC definitions if you need to.
# 4. "make"
# 5. "make install"
VERSION=1.11
CC=gcc
COPTS= -O -g
#COPTS = -g -DDEBUG
#COPTS = -W -Wall -ansi -pedantic
STATIC_FLAG=-static
INSTALL_OPTS?= -o root -g bin -m 4111 -s
INSTALL_TARGET_DIR?=/usr/lib/cgi-bin
SYSCONFIG_DIR?=/etc
INSTALL_MY_SYSCONF_DIR=$(DESTDIR)$(SYSCONFIG_DIR)/sbox
INSTALL_DIRECTORY=$(DESTDIR)$(INSTALL_TARGET_DIR)
CFLAGS += $(COPTS) -DVERSION=$(VERSION)
INSTALL = install
LYNX = lynx
PURIFY = purify -chain-length="10" cc -g
LIBS = -ldotconf
default: sbox
all: sbox env
sbox: sbox.o
$(CC) -Wall $(LDFLAGS) $(LDOPTS) -o sbox sbox.o $(LIBS)
# strip sbox
# strip -R .comment -R .note sbox
chmod 4711 sbox
sbox.o: sbox.c sbox.h Makefile
sbox_pure: sbox.o
$(PURIFY) -o $@ sbox.o
env: env.o
$(CC) $(STATIC_FLAG) -o env env.o
README.txt: README.html
$(LYNX) -nolist -underscore -dump $< > $@
clean:
rm -rf *.o core sbox env *~ CVS_sbox* *.tar.gz build debian/tmp debian/substvars debian/files configure-stamp build-stamp
# @-echo "OK, clean :)"
install: sbox
mkdir -p $(INSTALL_DIRECTORY)
$(INSTALL) $(INSTALL_OPTS) sbox $(INSTALL_DIRECTORY)
$(INSTALL) -D -m 0644 sbox.conf $(INSTALL_MY_SYSCONF_DIR)/sbox.conf
dist: README.txt sbox.h sbox.c env.c Makefile
-mkdir sbox-$(VERSION)
cp README.html README.txt sbox.h sbox.c env.c Makefile sbox-$(VERSION)
tar cvf - sbox-$(VERSION) | gzip -9c > sbox-$(VERSION).tgz
rm -rf sbox-$(VERSION)
deb:
if [ -z $(SIGN)"" ] ; then \
./deb ; \
else \
./deb --sign ; \
fi
.PHONY: clean install rpm dist deb
sbox-dtc-1.11.7/README.html 0000644 0001750 0001750 00000122642 12247552331 013664 0 ustar zigo zigo
sbox: Put CGI Scripts in a Box
sbox: Put CGI Scripts in a Box
Abstract
sbox is a CGI wrapper script that allows Web site hosting
services to safely grant CGI authoring privileges to untrusted
clients. In addition to changing the process privileges of client
scripts to match their owners, it goes beyond other wrappers by
placing configurable ceilings on script resource usage, avoiding
unintentional (as well as intentional) denial of service attacks. It
also optionally allows the Webmaster to place client's CGI scripts in
a chroot'ed shell restricted to the author's home directories.
sbox is compatible with all Web servers running under
BSD-derived flavors of Unix. You can use and redistribute it freely.
Poorly-written CGI scripts are the single major source of server
security holes on the World Wide Web. Every CGI script should be
scrutinized and extensively tested before installing it on a server,
and subject to periodic review thereafter.
For Web hosting services, however, this advice is impractical.
Hosting services must sponsor multiple Web authors of different levels
of competence and reliability. Web authors do not trust each other,
and the Web hosting service does not trust the authors. In such a
situation, CGI scripts are even more problematic than usual. Because
all CGI scripts run under the Web server's user ID, one author's
scripts can interfere with another's. For example a malicious author
could create a script that deletes files created by another author's
script, or even cause another author's script to crash by sending it a
kill signal. A poorly written script that contains a security hole
can compromise the entire site's security by, for example,
transmitting the contents of the system password file to a malicious
remote user. The same problems are faced by large academic sites
which provide Web pages for students.
For most Web hosting services it would be impossible to subject each
and every author's CGI scripts to code review. Nor is it practical to
cut off CGI scripting privileges entirely. In the competitive world
of ISP's, customers will just move elsewhere.
The most popular solution to this problem is the use of "wrapper"
scripts. In this system, untrusted author's CGI scripts are never
invoked directly. Instead a small wrapper script is called on to
execute the author's script, the target. The wrapper is
SUID to root. When the wrapper runs, it subjects the target to
certain safety checks (for example, checking that the script is not
world-writable). The wrapper then changes its process ID to match the
owner of the target and executes it. The result is that the author's
script is executed with his own identity and privileges, preventing it
from interfering with other author's scripts. The system also leads
to increased accountability. Any files that an misbehaving script
creates or modifies will bear the fingerprints of its creator.
Without a wrapper, it can be impossible to determine which author's
script is causing problems.
The limitations of wrapper scripts are three-fold:
Wrappers provide little protection against attacks that involve
reading confidential information on the site, for example
sensitive system files or protected documents.
Wrappers expose the author to increased risk from buggy
scripts. By running the author's script with his owner
permissions, the wrapper grants it the ability to read, write or
delete any file in the author's home directory.
There is no protection against denial-of-service attacks. A
buggy script can go into an endless loop, write a huge file into
/usr/tmp, or allocate an array as large as virtual memory,
adversely affecting system responsiveness.
A better solution is to box author's CGI scripts. In
this solution, the CGI script is executed in a restricted environment
in which its access to the file system and to other system resources
is limited. This is what sbox (Secure Box) accomplishes.
When run, it does several things:
It checks the environment for sanity. For example, the script
must be run by the Web user and group, and not by anyone else.
It checks the target script for vulnerabilities, such as being
world writable or being located in a world writable directory.
It performs a chroot to a directory that contains both the script and
the author's HTML files, sealing the script off from the rest
of the system.
It changes its user ID and/or group ID to that of the target
script.
It sets ceilings on the target script's CPU, disk, memory and
process usage.
It lowers the priority of its process.
It cleanses the environment so that only variables which are
part of the CGI protocol are available to the script.
It invokes the target script in this restricted context.
sbox is highly configurable. It can be configured to
chroot without changing its process ID, to change its process ID
without performing the chroot, to change its group ID without changing
its user ID, to establish resource ceilings without doing anything
else, or any other combination that suits you.
System Requirements
sbox is designed to run with any Unix-based Web server.
The package should compile correctly on any standard Unix system;
however the resource limits use the BSD-specific setrlimit()
and setpriority() calls. If you do not know whether your
system supports these calls, check for the existence of the file
/usr/include/system/resource.h. If this file does not exist,
then chances are slim that you can use the resource limits. You can
run sbox without the limits by setting the preprocessor define
SET_LIMITS to FALSE (see below).
Installation
After unpacking the package, you should have the following files:
You will first examine and edit the Makefile, then change sbox.h to
suit your site configuration and preferences. It is suggested that
you keep copies of the unaltered files for future reference.
Adjusting the Makefile
Using your favorite text editor, examine and change the value of the
INSTALL_DIRECTORY variable. This is the location in which
sbox will be installed, and should correspond to your
site-wide CGI directory.
You may also need to fiddle with the options for the
install program. The default is to make
sbox owned by user "root" and group "bin", and installed
with permissions -rws--x--x. This configuration is SUID to
root, necessary in order for the chroot and process ID changing
functions to work.
If you wish to adjust the C compiler and its flags, change the CC and
CFLAGS variables as needed.
Adjusting sbox.h
This is the fun part. sbox.h contains several dozen
flags that affect the script's features. These flags are implemented
as compile-time defines rather than as run-time configuration
variables for security reasons. There is less chance that the
behavior of sbox can be maliciously altered if it has no
dependences on external configuration files.
You should review sbox.h with a text editor and change
the settings as needed. A typical entry looks like this:
/*
* ECHO_FAILURES -- If set to TRUE, will echo fatal error messages
* to the browser. Set to FALSE to inhibit error messages.
*/
#ifndef ECHO_FAILURES
#define ECHO_FAILURES TRUE
#endif
This section sets a feature called ECHO_FAILURES to TRUE. To change
the value to FALSE, simply edit the line that begins with "#define" to
read like this:
#define ECHO_FAILURES FALSE
General Settings
These variables correspond to general sbox settings such
as logging and environment consistency checking.
WEB_USER (default "nobody")
This defines the name of the user that the Web server runs
under, "nobody" by default. If your Web server uses a different
user ID, you must change this define to match.
WEB_GROUP (default "nobody")
This defines the name of the group that the Web server runs
under, "nobody" by default. If your Web server uses a different
group ID, you must change this define to match.
UID_MIN, GID_MIN (defaults 100,100)
These define the lowest UID and GID that the script will run a
target CGI script as. On most systems, low-numbered user and group
IDs correspond to users with special privileges. Change these
values to be the lowest valid unprivileged user and group ID.
Under no circumstances will sbox run a target
script as root (UID 0.)
This defines the search path that will be passed to the author's
CGI scripts, overriding whatever was there before.
USE_ABSOLUTE_ROOT (no default)
If set to an absolute path, sbox will chroot to a hard-coded
directory and use that as its root. Use this if you want to
have sbox work on a particular directory not related to a user's
directory or the web root.
NOTE: the sbox binary you compile will work for that directory ONLY.
If you want to use it for another directory, recompile and use a
different binary
Logging Settings
sbox can be set to log all its actions, including both
failures and successful launches of author's scripts. Log entries are
time stamped and labeled with the numeric IDs of the user and group
that the target script was launched under.
LOG_FILE (default none)
This specifies a file to which sbox will log its
successes and failures. Set this to the full path name of the
file to log to. An empty string ("") will make
sbox log to standard error, which will cause its
log messages to be directed to the ordinary server error log.
Leaving LOG_FILE undefined will cause sbox not to
log any messages.
ECHO_FAILURES (default TRUE)
If this define is set to a true value, any fatal errors
encountered during sbox's execution will be turned
into a properly-formatted HTML message that is displayed for the
remote user's benefit. Otherwise, the standard "An Internal
Error occurred" message is displayed.
Chroot Settings
These variables controls sbox's chroot functionality.
The path names are relative to the document root. In the case of
virtual hosts, this will be whatever is specified by the DocumentRoot
directive in the server's configuration file. In the case of
user-supported directories, it will be the user's public_html
directory.
DO_CHROOT (default TRUE)
If set to a true value, sbox will perform a chroot
to a restricted directory prior to executing the CGI script.
Otherwise no chroot will be performed.
ROOT (default "..")
This tells sbox where to chroot to relative to the
document root. This directory should ordinarily be a level or
two above the document tree so that the script can get access to the
author's HTML documents for processing.
CGI_BIN (default "../cgi-bin")
This define tells sbox where to look for the author's scripts
directory, relative to his site's document tree. This
directory should be contained within the directory specified
by ROOT. For best security, you should specify a directory
that is outside the document tree. The default is a directory
named "cgi-bin" located at the same level as the document root.
SUID/SGID Settings
DO_SUID, DO_SGID (defaults TRUE, TRUE)
These defines control whether the script will perform an SUID
and/or an SGID to the user and group of the target CGI script.
From the author's point of view it's safer to perform an SGID
than an SUID, and usually is more than adequate. If no SUID or SGID
is performed, the author's script will be run with the Web server's
privileges.
SID_MODE (default DIRECTORY)
This define controls whether sbox
should use the ownership of the target script or the
directory containing the target script to determine
whose user ID and/or group ID to run under. Use directory mode
if several users have authoring privileges for a single virtual
host.
Resource Limitation Settings
SET_LIMITS (default TRUE)
If set to a true value, sbox will set
resource usage ceilings before running the target CGI script.
You may need to set this to FALSE if you are using a system that
does not implement the setpriority() and/or setrlimit() calls.
PRIORITY (default 10)
This controls the priority with which target scripts are run.
Values can range from -20 to 20. Higher numbers have
less priority.
These and similar defines control the resource ceilings.
The definitions set caps on CPU usage, the number of processes
the script can spawn, the amount of memory it can use,
the size of the largest file it can create, and other
attributes. For each resource there are two caps, one
hard, the other soft. Soft resources can be increased by any
program that desires to do so by making the appropriate calls to
setrlimit(). Hard limits are inviolable ceilings that cannot be
lifted once established, even by a privileged user. The
hard limits should be rather liberal, the soft limits more
strict. See the setrlimit() man page for details on each of
these resources.
If you use LIMIT_FSIZE_HARD or _SOFT and are logging to stderr,
be careful! If your web server error log is larger than the
limit, no logging will occur.
Making and Installing the Binary
Compile the sbox binary by typing make. If it
compiles successfully, become root and type make
install to install it in your site's cgi-bin directory (at
the location specified in the Makefile.)
You can also install sbox manually by copying it into
your cgi-bin directory and settings its permissions to
---s--x--x. This can be done with the following commands
while logged in as the root user:
In order for sbox to be effective, CGI scripts should be
turned off in all user-supported directories and document directories.
All CGI scripts should be placed in the main cgi-bin directory. No
one but authorized site administrators should have write or listing
privileges for this directory. If you are using the Apache server, a
typical entry for a virtual host will look like this:
<VirtualHost *>
ServerName www.fred.com
ServerAdmin fred@fred.com
DocumentRoot /home/fred/sbox_root/html
TransferLog /home/fred/sbox_root/logs/access_log
ErrorLog /home/fred/sbox_root/logs/error_log
<Directory /home/fred/sbox_root>
Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
AllowOverride Options AuthConfig Limit
order allow,deny
allow from all
</Directory>
</VirtualHost>
(Please be sure to use Options and AllowOverride directives
that match the security policy of your site.)
For a site that uses UserDir-style home pages
(http://www.your.site/~username), a typical configuration is:
UserDir sbox_root/html
<Directory /home/*/sbox_root>
Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
AllowOverride Options AuthConfig Limit
order allow,deny
allow from all
</Directory>
Note that in both cases, the user's document root (where his HTML
files go) is "~fred/sbox_root/html", that is, two directory levels
below his home directory. When sbox runs, it uses the
position of the user's document root to find its root and the cgi-bin
directory. The suggested defaults defined in sbox.h make the ROOT
equal to "..", and CGI_BIN equal to "../cgi-bin", both relative to the
document root. Hence in the examples given above, sbox's root will be
~fred/sbox_root, and sbox will look for his CGI scripts in the
directory ~fred/sbox_root/cgi-bin. When sbox runs in chroot mode,
~fred/sbox_root becomes the new top level ("/") directory, insulating
the user's CGI script from the rest of his home directory, as well as
the rest of the file system. This prevents the CGI script from
inadvertently (or deliberately) doing something antisocial, but gives
the script access to the user's HTML files, for filtering and
templating.
Because the user's CGI script is cut off from the rest of the
filesystem after the chroot call, dynamically linked programs
(including interpreters and the like) will not be happy unless they
can find the shared libraries they rely on. Therefore, the sbox root
directory should be set up like a miniature root directory, and
contain whatever binaries, configuration files and shared libraries
are necessary for programs to run. This list is different from system
to system. See Using the Miniroot and Tips for advice on setting this directory up.
Below is the structure of Fred's directory, assuming that the virtual
host uses ~fred/sbox_root/html as its document root.
% ls -l ~fred/sbox_root
total 10
drwxr-xr-x 2 fred users 1024 Oct 23 06:27 bin/ system binaries
drwxr-xr-x 3 fred users 1024 Oct 19 20:44 cgi-bin/ CGI scripts
drwxr-xr-x 2 fred users 1024 Oct 12 16:59 dev/ device special files
drwxr-xr-x 2 fred users 1024 Oct 19 17:57 etc/ configuration files
drwxr-xr-x 2 fred users 1024 Oct 22 19:14 html/ HTML document root
drwxr-xr-x 3 fred users 1024 Oct 19 20:35 lib/ shared libraries
drwxr-xr-x 3 fred users 1024 Oct 19 20:35 logs/ log files
drwxr-xr-x 2 fred users 1024 Oct 23 05:48 tmp/ temporary files
drwxr-xr-x 2 fred users 1024 Oct 23 05:48 usr/ files that belong in usr
drwxr-xr-x 2 fred users 1024 Oct 23 05:48 var/ files that belong in var
If you do not take advantage of sbox's chroot feature,
but just use it for its ability to change to the user's UID and GID,
then you do not have to do any special directory setup.
http://www.virtual.host.com/cgi-bin/sbox/script_name
^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^
virtual host name user's script
The first part of the URL is the path to the sbox
script. The second part is the path to the user's script, relative
to the cgi-bin directory in his home directory. If the user's
script needs access to additional path information, you can append it
in the natural way:
If you are using the Apache web server and wish the user to be able to
password-protect or otherwise modify access to his cgi-bin directory
using a .htaccess file, then you will need to activate and use
Apache's mod_rewrite module. Otherwise any .htaccess file located in
the user's cgi-bin directory will be ignored. This method will also
make it so that if the requested executable is not found in the
cgi-bin directory, the error condition will fall through to Apache's
error handling system (using ErrorDocument) rather than raising an
sbox error.
First make sure that Apache was compiled with the mod_rewrite
module and that the module is loaded at startup time. The relevant
directive is:
Now assuming that user cgi-bin directories are installed in
~user/sbox_root/cgi-bin, that the sbox executable is installed in
/cgi-bin/sbox, and that user directories are located at
/home/username, enter the following into your httpd.conf file:
These pretty complicated looking pieces of code says that for URLs
that begin with /cgi-bin/sbox/~username/filename, first check whether
the file /home/username/sbox_root/cgi-bin/filename exists and is
available via Apache's access rules. If it isn't available, then
rewrite the URL as /home/username/sbox_root/cgi-bin/filename and
perform the usual processing as if it were a file (which will result
in a 403 or 404 error). Otherwise, don't rewrite the URL and pass it
through to the CGI handler. You will need to tweak these a bit if
users' home directories are somewhere else than /home/user or if you
have changed the names or positions of the sbox root and cgi-bin
directories from their defaults.
To support users' ability to change access rights using .htaccess,
make sure to enable AuthConfig and Limit in sbox_root if you haven't
done so already:
For the convenience of Linux system administrators wishing to use the
chroot features of sbox, I have placed a miniature root directory at
stein.cshl.org/software/sbox/miniroot.img.gz.
This is a gzipped ext2 filesystem image that contains essential system
device files, shared libraries, and executables, including Perl
version 5.8.7 and the most commonly used Perl libraries. The
filesystem image is based on the one distributed with RIP.
You can use this image in several ways:
Install a copy of the image into each user's directory:
This way gives each user a skeleton root directory that he is free to
modify, providing him with considerable flexibility. The downside is
that you may not wish users to have so much flexibility; it also takes
up about 45 megabytes of space per user directory:
Mounting a copy of the miniroot in each user's directory
The alternative method avoids the waste of putting a complete copy
of the root into each user's directory. One copy of the miniroot is
mounted read-only into each user's sbox root, giving them read-only
access to the mount. The main disadvantage of this strategy is that it
generates a mount for each user, which in the case of very many user
accounts might bump up against kernel limitations.
Mount the miniroot read-only on the user's mnt/ directory:
mount ./miniroot.img ~fred/sbox_root/mnt -o ro,loop
Create symlinks to the directories of the mounted filesystem:
cd ~fred/sbox_root
ln -s mnt/* .
Fix permissions of html, cgi-bin and log.
At the end of this process, you should have a directory structure that looks
like this:
lrwxrwxrwx 1 root root 7 Dec 4 18:18 bin -> mnt/bin
drwxrwxr-x 2 fred users 96 Dec 4 18:15 cgi-bin/
lrwxrwxrwx 1 root root 7 Dec 4 18:18 dev -> mnt/dev
lrwxrwxrwx 1 root root 7 Dec 4 18:18 etc -> mnt/etc
drwxr-xr-x 5 fred users 1136 Dec 4 18:15 html/
lrwxrwxrwx 1 root root 7 Dec 4 18:18 lib -> mnt/lib
lrwxrwxrwx 1 fred users 7 Dec 4 18:15 log/
drwxrwxr-x 2 root root 48 Dec 4 18:16 mnt/
lrwxrwxrwx 1 root root 7 Dec 4 18:18 tmp -> mnt/tmp
lrwxrwxrwx 1 root root 7 Dec 4 18:18 usr -> mnt/usr
lrwxrwxrwx 1 root root 7 Dec 4 18:18 var -> mnt/var
If you ever wish to modify the miniroot image, simply mount it
read/write and make the changes you need. If you run out of space on
the miniroot, you can create a new one with the following series of
commands:
mount ./miniroot.img /mnt/miniroot -o ro,loop
dd if=/dev/zero of=./new_miniroot.img bs=1M count=100 # or whatever you want
mke2fs -F ./new_miniroot.img
mount ./new_miniroot.img /mnt/new_miniroot -o rw,loop
cd /mnt/miniroot
find . | cpio -p /mnt/new_miniroot
You are also free to burn the miniroot into a CDROM image, create a
cramfs image, etc.
Here are a few pieces of advice and tips on making best use of
sbox.
Setting up the Chroot directory
Many CGI scripts will not run correctly in a chroot environment unless
they can find the resources they need. Compiled C programs often need
access to shared libraries and/or device special files. Interpreted
scripts need access to their interpreters, for example Perl.
Feature-rich programs like sendmail depend on their configuration
files being present in /etc.
As described above, you will need to turn the chroot directory into a
miniature root file system, complete with /etc, /lib, /bin, /tmp and
/dev directories. If the web server is running on a Linux system,
then one option is to use the miniroot image
provided with sbox as the basis for the root file system. If you
prefer to do it yourself, I recommend that you create and test a
chroot directory for one virtual host, then use it as a master copy
for creating new virtual hosts every time you add a new user account.
Both the cpio and the tar commands can be used to copy shared
libraries and device special files safely.
Programs that check file ownerships may need access to password and/or
group files in order for them to translate from numeric uid's and
gid's to text names. In order to support CGI scripts that perform
this type of action, you should place dummy copies of /etc/passwd and
/etc/group in the author's /etc directory. These files should
not contain real passwords, and should only contain standard
system user accounts (e.g. "bin" and "mail"), plus any needed by the
script. You probably don't want to make the complete list of user
account names available to authors' CGI scripts!
If CGI scripts require access to the DNS system in order to resolve
host names and IP addresses, you should place a copy of
/etc/resolv.conf into the chroot directory. You may need to copy other
configuration files to use certain feature-rich programs. For
example, if scripts send e-mail using the sendmail program, you will
need to install its configuration program, sendmail.cf.
Many programs redirect their output to the device special file
/dev/null. Other programs need access to /dev/zero or other special
files. You can copy these files from the real /dev directory using
either cpio or tar. Alternately you can create the files from scratch
using mknod, but only if you know what you're doing. You'll need to
have superuser privileges to accomplish either of these tasks.
The Unix time system expects to find information about the local
timezone in a compiled file named /etc/localtime. You may
need to copy this into your chroot directory in order for the timezone
to be correctly displayed. You can confirm that the correct timezone
is being found by examining the output of the "env" executable.
There are two ways to finesse the problem of shared libraries. For
compiled C scripts, one option is to link the program statically (by
providing the -static flag to the linker). A less laborious
solution is to place copies of the required shared libraries in the
new root's /lib directory (or /slib, for systems that use that
directory for shared libraries). Many systems have a utility that
lists the shared libraries required by a binary. Use this program to
determine which shared libraries are required, and copy them over into
each author's /lib directory. In addition to the shared libraries,
you may need to copy the dynamic linker itself into the /lib
directory. On my linux system, this file is "ld-linux.so".
If a executable cannot find its shared libraries at run time, it will
usually fail with a specific error message that will lead you to the
problem -- look in the server error log. If you get silent failures,
it's probably the dynamic linker itself that can't be found.
Linux, and possibly some other systems, uses a cache file named
/etc/ld.so.cache to resolve the location of library files. If this
file isn't found at run time, the system will generate a warning but
find the correct shared libraries nevertheless. The quick and dirty
way to get rid of this warning is to copy the current cache file from
the real /etc directory to the chroot one. However, this may have bad
side effects (I haven't actually encountered any, but I worry about
it.) It's better to make this cache file from scratch in the chroot
environment itself. To do this, run the ldconfig program with the
command-line version of chroot. You'll need to be root to do this:
# cd /sbin
# chroot ~fred/pub ./ldconfig
Perl scripts, in addition to requiring the Perl interpreter, will
often need access to the Perl lib directory in order to get at useful
modules (such as CGI.pm). It's
easiest to copy the whole Perl library tree to the correct location in
the chroot directory, being careful to get the path right. For
example, if the real Perl library is located in /usr/local/lib/perl5,
you'll need to create a parallel /usr hierarchy in the chroot
directory. On my system, I recompiled Perl to use /lib/perl5 and
dumped the modules into that directory. If things get bolluxed up,
you can always tell Perl where to look for its libraries by appending
something like this to the top of CGI scripts:
#!/bin/perl
BEGIN { push(@INC,'/lib/perl5','/lib/perl5/i586-linux/5.004'); }
The Document Root and the chroot() directory
Some CGI scripts act as filters on static HTML documents. Examples
include PHP and various guestbook scripts. Such scripts often include
the path to the static document appended to the end of the script's
URL as "additional path information." For example:
The script will be passed two environment variables, PATH_INFO,
containing the additional path information, and PATH_TRANSLATED,
containing the path information translated into an absolute filename.
In the example above, the values of these variables might be:
PATH_INFO
/~fred/guestbook/data.txt
PATH_TRANSLATED
/home/fred/public_html/guestbook/data.txt
When sbox is running it interprets the additional path information as
relative to the user's document root. This means that a document
located in Fred's public_html directory can be referred to this way:
After performing the chroot(), sbox attempts to adjust PATH_TRANSLATED
so that it continues to point to a valid file. If the user's document
root is located within the chroot directory, then PATH_TRANSLATED is
trimmed so that it is relative to the new root directory:
PATH_INFO
/guestbook/data.txt
PATH_TRANSLATED
/public_html/guestbook/data.txt
However, if the document root is entirely outside the new root
directory, then sbox will simply use the same value for PATH_INFO and
PATH_TRANSLATED:
PATH_INFO
/guestbook/data.txt
PATH_TRANSLATED
/guestbook/data.txt
Users and Webmasters should be aware of this behavior, as it can cause
some confusion.
The Resource Limitations
The default resource limits are reasonable. Most authors won't have
problems with them unless they need to do number crunching or
manipulate many files simultaneously. If need be, authors can raise
the soft resource limits up to the levels imposed by the hard limit
ceilings, which are very liberal. C programmers can do this directly
by making calls to setrlimit(). Perl scripters should download and
install Jarkko Hietaniemi's BSD::Resource module from CPAN.
Server-Side Includes
Because of design conflicts, the "#exec" style server-side include
do not work correctly with sbox. However, the "#include
virtual" command, which does almost exactly the same thing, does work
correctly. To include the output of sbox-wrapped CGI
scripts in server-side-include files, just write something like
this:
If you are running Apache 1.2 or higher, you can take advantage of the
rewrite rule module to make sbox transparent. For
virtual hosts, you can add something like the following to main or the
<VirtualHost> section:
RewriteEngine on
RewriteRule ^/cgi/(.*) /cgi-bin/sbox/$1 [PT,NS]
This replaces all URLs that start with "/cgi" with "/cgi-bin/sbox".
This lets authors refer to their scripts with:
http://www.virtual.host.com/cgi/script_name
and to main Web server scripts with:
http://www.virtual.host.com/cgi-bin/guestbook
For user-supported directories, this rewrite rule will allow users to
refer to their scripts using
http://www.host.com/~username/cgi/script_name:
RewriteEngine on
RewriteRule ^/~([^/]+)/cgi/(.+) /cgi-bin/sbox/~$1/$2 [PT,NS]
If you are already using rewrite rules to allow users to control
access with a .htaccess file, place the
appropriate RewriteRule before the first RewriteCond and omit the
[PT,NS] flags. The following two examples show RewriteRule blocks that
will correctly respect .htaccess files:
This distribution comes with a small statically linked binary called
"env" that you can call as a CGI script. It prints out some
information about the current environment, including the user and
group ID's, the current working directory, and the environment
variables, to help you determine whether sbox is
configured correctly and working as expected.
Revamped documentation to show how to get .htaccess and 404 Not Found errors to work correctly.
Added an example root directory for use in chroot mode.
Versions 1.08-1.09
Never released.
Version 1.07
Patch from Jukka Forsgren to cause script to chdir() into target directory in the same
manner as Apache does.
Version 1.06
Fixed cross-scripting security vulnerability identified by Ivan Schmid (ivan.schmid@astalavista.ch)
Version 1.05
Lost version.
Version 1.04
Changes to make sbox compile with egcs version 1.1.2
Fixed problem of CGI scripts not being able to access command line variables
(courtesy Sean Gabriel Heacock)
If logfile can't be opened, logs to standard error instead.
Version 1.03
Added USE_ABSOLUTE_ROOT functionality, contributed by Grant
Kaufmann.
Version 1.02
Fixed a crash that occurred when configured userid or groupid is not in
passwd/group file (patch provided by Terry Lorrah <delikon@itw.net>).
Version 1.01
Fixed minor bug in webmaster's error message.
Fixed minor bug in reporting gid to log file
Version 1.00
Replaced all occurrences of strcpy() and strcat() with strncpy()
and strncat().
Changes to string constants to make more ANSI-compatible.
Code cleanup
Versons 0.98-0.99
Documentation fixes.
Version 0.97
Fixed bugs relating to automounter confusion.
Version 0.95
Fixes to compile and run on Solaris systems. Still not
extensively tested, but no bug reports yet.
Version 0.90
Beta release. Use with caution.
Lincoln
D. Stein, lstein@cshl.org Cold Spring Harbor Laboratory
Last modified: Mon Dec 5 15:58:19 EST 2005
sbox-dtc-1.11.7/sbox.conf 0000644 0001750 0001750 00000007227 12247552331 013664 0 ustar zigo zigo # SBOX configuration file
# This file let you set different limits of the sbox cgi-bin wrapper
# Toggles can have values of On/Off, 1/0, Yes/No
# Variable names are set to CASE_INSENSITIVE
#******************* UID/GID CONFIG ******************#
# user that the Web server runs as
web_user dtc
# group that the Web server runs as
web_group dtcgrp
# allows scripts to be executed if owned by WEB_USER or WEB_GROUP
allow_web_owned_scripts Off
# lowest UID that we will suid to
uid_min 100
# highest UID that we will suid to
uid_max 65535
# lowest GID that we will sgid to
gid_min 100
# highest GID that we will sgid to
gid_max 65535
# Determine whether to use the ownerships of the script or the _directory_
# that the script is found in for the SUID/SGID IDs. If off, it will use
# the UID/GID of the script, if On, it will use the directory UID/GID
sid_mode_directory Off
#******************* PATH CONFIG ******************#
# If set to on, then the user's script will have limited access to
# only the paths defined in safe_path
use_safe_path Off
# SAFE_PATH -- this is the path that will be placed in the environment.
# Script will be running chroot to the user's home directory, so these
# directories may not be available.
safe_path "/bin:/usr/bin:/usr/local/bin"
# LOG_FILE -- log what sbox does. If undefined, won't log.
# If an empty string, logs to standard error.
log_file "/var/log/sbox.log"
# To help debugging, you might want to print the environment
# variables on sbox.log. To do so, set to "on" bellow.
do_log_envvars Off
# ECHO_FAILURES -- If set to 1, will echo fatal error messages
# to the browser. Set to FALSE to inhibit error messages.
echo_failures On
#******************* CHROOT CONFIG ******************#
# DO_CHROOT -- if set to 1, sbox will
# do a chroot to the user's home directory.
do_chroot On
# ROOT
# Directory to which sbox will chroot(), relative to the author's
# document root.
root ".."
# CGI_BIN
# Directory in which users' executables must reside, relative to their
# document root. For best results, this must be contained within ROOT.
#cgi_bin "../cgi-bin"
cgi_bin "../html"
# DO_SUID and DO_SGID -- if set to 1, sbox
# will SUID and/or SGID to the user and group ownership of
# the _directory_ in which the target script is found
do_suid Off
do_sgid Off
#******************* RESOURCE LIMITS ******************#
# Soft limits can be increased by the application. Hard limits cannot be
# changed.
# Whether or not you want to set limits at all.
# If your sytem does not have , then you will
# need to set this to 0.
set_limits On
# priority
priority 10
# maximum CPU time in seconds
limit_cpu_hard 1200
limit_cpu_soft 100
# maximum size of a single file that can be created (blocks) * 1024
limit_fsize_hard 204800 # This is 200MB
limit_fsize_soft 102400 # This is 100MB
# maximum amount of in-memory data * 1024
limit_data_hard 81920 # This is 80MB
limit_data_soft 10240 # This is 10MB
# maximum stack size * 1024
limit_stack_hard 81920 # This is 80MB
limit_stack_soft 10240 # This is 10MB
# core dump size * 1024
limit_core_hard 0 # 0 = don't allow core dumps
limit_core_soft 0 # 0 = don't allow core dumps
# maximum memory ("resident set") usage * 1024
limit_rss_hard 81920 # This is 80MB
limit_rss_soft 20480 # This is 20MB
# max number of processes script can spawn
limit_nproc_hard 2560
limit_nproc_soft 320
# max number of open file descriptors
limit_nofile_hard 2560
limit_nofile_soft 320
# PHP interpreter path
php_path "/usr/lib/cgi-bin/php"
# Python interpreter path
python_path "/usr/bin/python"
# Perl interpreter path
perl_path "/usr/bin/perl"
# Ruby interpreter path
ruby_path "/usr/bin/ruby1.8"
sbox-dtc-1.11.7/sbox.c 0000644 0001750 0001750 00000147501 12247552331 013161 0 ustar zigo zigo #include "sbox.h"
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
//#if SET_LIMITS
#include
//#endif
// The dotconf library to parse /etc/sbox.conf
#include
//#define DEBUG 1
/* DESCRIPTION
sbox is designed to allow untrusted users to run CGI scripts without endangering
the security of the site as a whole.
$Revision: 1.8 $
Call as "http://your.site.com/cgi-bin/sbox/path/to/end_user/script"
1. sbox does a series of checks to confirm that it has been called in correct context
a. user ID is WEB_USER
b. group ID is WEB_GROUP
c. neither of these is root
2. sbox fetches the target script named in PATH_TRANSLATED
a. actually, it walks down the path until it finds the first executable file
3. sbox performs checks on the target script
a. script is not SUID or SGID
b. script is executable
c. script is not writable by WEB_USER or WEB_GROUP
d. directory that script lives in is not writable by WEB_USER or WEB_GROUP
4. sbox determines user and group of owner of the script file or its enclosing directory
5. sbox changes its uid and gid to match the script's file or directory
6. sbox checks that the script is within the owner's home directory
7. sbox chroots to the new root directory
8. sbox fixes PATH_TRANSLATED and SCRIPT_NAME for chroot change
9. sbox sets resource limits
10. sbox logs everything
11. sbox execs script
*/
/* Copyright info:
* Copyright 1997, Lincoln D. Stein
*
* Parts of this code are derived from suexec.c, Copyright 1995-1997 The Apache Group
*/
#ifndef MAXPATHLEN
#ifdef PATH_MAX
#define MAXPATHLEN PATH_MAX
#else
#define MAXPATHLEN 8192
#endif
#endif
#ifndef NAME_MAX
#define NAME_MAX 512
#endif
#define AP_ENVBUF 256
extern char **environ;
/* needed to compile with -ansi */
#ifndef strdup
extern char *strdup (const char *);
#endif
#ifndef chroot
extern int chroot (const char *path);
#endif
static char **cleanenv = NULL;
static FILE *log;
static void open_log();
static void log_error(const char* fmt, ...);
static void fatal_error(const char* fmt, ...);
static void check_consistency();
static char* fetch_target(char *root,char** additional_info,
struct stat* targ,struct stat* dir);
static char* to_abs(char* directory);
static char* document_root ();
static void check_target(const char* newroot,
const char* target,
const struct stat *file_stats,
const struct stat *dir_stats);
static char* fetch_newroot(char* docroot);
static char* shave(char* newroot,
char* target);
static void clean_env();
static void tweak_environment(char* newroot,
char* root,
char* target,
char* additional_info);
static int set_env(const char *name,
const char *value,
int overwrite);
static char* escape(const char* str);
static void chdir_fix(char* newroot, char* target);
//#if SET_LIMITS
static void set_limits();
//#endif
static char *safe_env_lst[] =
{
"AUTH_TYPE",
"CONTENT_LENGTH",
"CONTENT_TYPE",
"DATE_GMT",
"DATE_LOCAL",
"DOCUMENT_NAME",
"DOCUMENT_PATH_INFO",
"DOCUMENT_URI",
"FILEPATH_INFO",
"GATEWAY_INTERFACE",
"LAST_MODIFIED",
"QUERY_STRING",
"QUERY_STRING_UNESCAPED",
"REMOTE_ADDR",
"REMOTE_HOST",
"REMOTE_IDENT",
"REMOTE_PORT",
"REMOTE_USER",
"REDIRECT_QUERY_STRING",
"REDIRECT_STATUS",
"REDIRECT_URL",
"REQUEST_METHOD",
"REQUEST_URI",
"SCRIPT_URI",
"SCRIPT_URL",
"SERVER_ADMIN",
"SERVER_NAME",
"SERVER_PORT",
"SERVER_PROTOCOL",
"SERVER_SOFTWARE",
"USER_NAME",
"TZ",
// #if !DO_CHROOT
// "SCRIPT_NAME",
// "PATH_INFO",
// "PATH_TRANSLATED",
// "DOCUMENT_ROOT",
// "SCRIPT_FILENAME",
// #endif
NULL
};
/***************** SBOX libdotconf config ***************/
typedef struct{
// UID and GID that runs sbox by default
char* web_user;
char* web_group;
int do_suid;
int do_sgid;
int do_log_envvars;
int allow_web_owned_scripts;
int uid_min;
int uid_max;
int gid_min;
int gid_max;
int sid_mode_directory;
int echo_failures;
int do_chroot;
char* safe_path;
int use_safe_path;
char* log_file;
char* root;
char* cgi_bin;
int set_limits;
int priority;
long limit_cpu_hard;
long limit_cpu_soft;
long limit_fsize_hard;
long limit_fsize_soft;
long limit_data_hard;
long limit_data_soft;
long limit_stack_hard;
long limit_stack_soft;
long limit_core_hard;
long limit_core_soft;
long limit_rss_hard;
long limit_rss_soft;
int limit_nproc_hard;
int limit_nproc_soft;
int limit_nofile_hard;
int limit_nofile_soft;
char* php_path;
char* python_path;
char* perl_path;
char* ruby_path;
}sbox_config_t;
sbox_config_t sbox_config;
DOTCONF_CB(cb_web_user);
DOTCONF_CB(cb_web_group);
DOTCONF_CB(cb_do_suid);
DOTCONF_CB(cb_do_sgid);
DOTCONF_CB(cb_do_log_envvars);
DOTCONF_CB(cb_allow_web_owned_scripts);
DOTCONF_CB(cb_uid_min);
DOTCONF_CB(cb_uid_max);
DOTCONF_CB(cb_gid_min);
DOTCONF_CB(cb_gid_max);
DOTCONF_CB(cb_sid_mode_directory);
DOTCONF_CB(cb_echo_failures);
DOTCONF_CB(cb_do_chroot);
DOTCONF_CB(cb_safe_path);
DOTCONF_CB(cb_use_safe_path);
DOTCONF_CB(cb_log_file);
DOTCONF_CB(cb_root);
DOTCONF_CB(cb_cgi_bin);
DOTCONF_CB(cb_set_limits);
DOTCONF_CB(cb_priority);
DOTCONF_CB(cb_limit_cpu_hard);
DOTCONF_CB(cb_limit_cpu_soft);
DOTCONF_CB(cb_limit_fsize_hard);
DOTCONF_CB(cb_limit_fsize_soft);
DOTCONF_CB(cb_limit_data_hard);
DOTCONF_CB(cb_limit_data_soft);
DOTCONF_CB(cb_limit_stack_hard);
DOTCONF_CB(cb_limit_stack_soft);
DOTCONF_CB(cb_limit_core_hard);
DOTCONF_CB(cb_limit_core_soft);
DOTCONF_CB(cb_limit_rss_hard);
DOTCONF_CB(cb_limit_rss_soft);
DOTCONF_CB(cb_limit_nproc_hard);
DOTCONF_CB(cb_limit_nproc_soft);
DOTCONF_CB(cb_limit_nofile_hard);
DOTCONF_CB(cb_limit_nofile_soft);
DOTCONF_CB(cb_php_path);
DOTCONF_CB(cb_python_path);
DOTCONF_CB(cb_perl_path);
DOTCONF_CB(cb_ruby_path);
static configoption_t options[] = {
{"web_user", ARG_STR, cb_web_user, NULL, 0},
{"web_group", ARG_STR, cb_web_group, NULL, 0},
{"do_suid", ARG_TOGGLE, cb_do_suid, 0, 0},
{"do_sgid", ARG_TOGGLE, cb_do_sgid, 0, 0},
{"do_log_envvars", ARG_TOGGLE, cb_do_log_envvars, 0, 0},
{"allow_web_owned_scripts", ARG_TOGGLE, cb_allow_web_owned_scripts, 0, 0},
{"uid_min", ARG_INT, cb_uid_min, 0, 0},
{"uid_max", ARG_INT, cb_uid_max, 0, 0},
{"gid_min", ARG_INT, cb_gid_min, 0, 0},
{"gid_max", ARG_INT, cb_gid_max, 0, 0},
{"sid_mode_directory", ARG_TOGGLE, cb_sid_mode_directory, 0, 0},
{"echo_failures", ARG_TOGGLE, cb_echo_failures, 0, 0},
{"do_chroot", ARG_TOGGLE, cb_do_chroot, 0, 0},
{"safe_path", ARG_STR, cb_safe_path, NULL, 0},
{"use_safe_path", ARG_TOGGLE, cb_use_safe_path, 0, 0},
{"log_file", ARG_STR, cb_log_file, NULL, 0},
{"root", ARG_STR, cb_root, NULL, 0},
{"cgi_bin", ARG_STR, cb_cgi_bin, NULL, 0},
{"set_limits", ARG_TOGGLE, cb_set_limits, 0, 0},
{"priority", ARG_INT, cb_priority, 0, 0},
{"limit_cpu_hard", ARG_INT, cb_limit_cpu_hard, 0, 0},
{"limit_cpu_soft", ARG_INT, cb_limit_cpu_soft, 0, 0},
{"limit_fsize_hard", ARG_INT, cb_limit_fsize_hard, 0, 0},
{"limit_fsize_soft", ARG_INT, cb_limit_fsize_soft, 0, 0},
{"limit_data_hard", ARG_INT, cb_limit_data_hard, 0, 0},
{"limit_data_soft", ARG_INT, cb_limit_data_soft, 0, 0},
{"limit_stack_hard", ARG_INT, cb_limit_stack_hard, 0, 0},
{"limit_stack_soft", ARG_INT, cb_limit_stack_soft, 0, 0},
{"limit_core_hard", ARG_INT, cb_limit_core_hard, 0, 0},
{"limit_core_soft", ARG_INT, cb_limit_core_soft, 0, 0},
{"limit_rss_hard", ARG_INT, cb_limit_rss_hard, 0, 0},
{"limit_rss_soft", ARG_INT, cb_limit_rss_soft, 0, 0},
{"limit_nproc_hard", ARG_INT, cb_limit_nproc_hard, 0, 0},
{"limit_nproc_soft", ARG_INT, cb_limit_nproc_soft, 0, 0},
{"limit_nofile_hard", ARG_INT, cb_limit_nofile_hard, 0, 0},
{"limit_nofile_soft", ARG_INT, cb_limit_nofile_soft, 0, 0},
{"php_path", ARG_STR, cb_php_path, NULL, 0},
{"python_path", ARG_STR, cb_python_path, NULL, 0},
{"perl_path", ARG_STR, cb_perl_path, NULL, 0},
{"ruby_path", ARG_STR, cb_ruby_path, NULL, 0},
LAST_OPTION
};
DOTCONF_CB(cb_web_user){
sbox_config.web_user = (char*)malloc(strlen(cmd->data.str)+1);
strcpy(sbox_config.web_user,cmd->data.str);
return NULL;
}
DOTCONF_CB(cb_web_group){
sbox_config.web_group = (char*)malloc(strlen(cmd->data.str)+1);
strcpy(sbox_config.web_group,cmd->data.str);
return NULL;
}
DOTCONF_CB(cb_do_suid){
sbox_config.do_suid = cmd->data.value;
return NULL;
}
DOTCONF_CB(cb_do_sgid){
sbox_config.do_sgid = cmd->data.value;
return NULL;
}
DOTCONF_CB(cb_do_log_envvars){
sbox_config.do_log_envvars = cmd->data.value;
return NULL;
}
DOTCONF_CB(cb_allow_web_owned_scripts){
sbox_config.allow_web_owned_scripts = cmd->data.value;
return NULL;
}
DOTCONF_CB(cb_uid_min){
sbox_config.uid_min = cmd->data.value;
return NULL;
}
DOTCONF_CB(cb_uid_max){
sbox_config.uid_max = cmd->data.value;
return NULL;
}
DOTCONF_CB(cb_gid_min){
sbox_config.gid_min = cmd->data.value;
return NULL;
}
DOTCONF_CB(cb_gid_max){
sbox_config.gid_max = cmd->data.value;
return NULL;
}
DOTCONF_CB(cb_sid_mode_directory){
sbox_config.sid_mode_directory = cmd->data.value;
return NULL;
}
DOTCONF_CB(cb_echo_failures){
sbox_config.echo_failures = cmd->data.value;
return NULL;
}
DOTCONF_CB(cb_do_chroot){
sbox_config.do_chroot = cmd->data.value;
return NULL;
}
DOTCONF_CB(cb_safe_path){
sbox_config.safe_path = (char*)malloc(strlen(cmd->data.str)+1);
strcpy(sbox_config.safe_path,cmd->data.str);
return NULL;
}
DOTCONF_CB(cb_use_safe_path){
sbox_config.use_safe_path = cmd->data.value;
return NULL;
}
DOTCONF_CB(cb_log_file){
sbox_config.log_file = (char*)malloc(strlen(cmd->data.str)+1);
strcpy(sbox_config.log_file,cmd->data.str);
return NULL;
}
DOTCONF_CB(cb_root){
sbox_config.root = (char*)malloc(strlen(cmd->data.str)+1);
strcpy(sbox_config.root,cmd->data.str);
return NULL;
}
DOTCONF_CB(cb_cgi_bin){
sbox_config.cgi_bin = (char*)malloc(strlen(cmd->data.str)+1);
strcpy(sbox_config.cgi_bin,cmd->data.str);
return NULL;
}
DOTCONF_CB(cb_set_limits){
sbox_config.set_limits = cmd->data.value;
return NULL;
}
DOTCONF_CB(cb_priority){
sbox_config.priority = cmd->data.value;
return NULL;
}
DOTCONF_CB(cb_limit_cpu_hard){
sbox_config.limit_cpu_hard = cmd->data.value;
return NULL;
}
DOTCONF_CB(cb_limit_cpu_soft){
sbox_config.limit_cpu_soft = cmd->data.value;
return NULL;
}
DOTCONF_CB(cb_limit_fsize_hard){
sbox_config.limit_fsize_hard = cmd->data.value * 1024;
return NULL;
}
DOTCONF_CB(cb_limit_fsize_soft){
sbox_config.limit_fsize_soft = cmd->data.value * 1024;
return NULL;
}
DOTCONF_CB(cb_limit_data_hard){
sbox_config.limit_data_hard = cmd->data.value * 1024;
return NULL;
}
DOTCONF_CB(cb_limit_data_soft){
sbox_config.limit_data_soft = cmd->data.value * 1024;
return NULL;
}
DOTCONF_CB(cb_limit_stack_hard){
sbox_config.limit_stack_hard = cmd->data.value * 1024;
return NULL;
}
DOTCONF_CB(cb_limit_stack_soft){
sbox_config.limit_stack_soft = cmd->data.value * 1024;
return NULL;
}
DOTCONF_CB(cb_limit_core_hard){
sbox_config.limit_core_hard = cmd->data.value * 1024;
return NULL;
}
DOTCONF_CB(cb_limit_core_soft){
sbox_config.limit_core_soft = cmd->data.value * 1024;
return NULL;
}
DOTCONF_CB(cb_limit_rss_hard){
sbox_config.limit_rss_hard = cmd->data.value * 1024;
return NULL;
}
DOTCONF_CB(cb_limit_rss_soft){
sbox_config.limit_rss_soft = cmd->data.value * 1024;
return NULL;
}
DOTCONF_CB(cb_limit_nproc_hard){
sbox_config.limit_nproc_hard = cmd->data.value;
return NULL;
}
DOTCONF_CB(cb_limit_nproc_soft){
sbox_config.limit_nproc_soft = cmd->data.value;
return NULL;
}
DOTCONF_CB(cb_limit_nofile_hard){
sbox_config.limit_nofile_hard = cmd->data.value;
return NULL;
}
DOTCONF_CB(cb_limit_nofile_soft){
sbox_config.limit_nofile_soft = cmd->data.value;
return NULL;
}
DOTCONF_CB(cb_php_path){
sbox_config.php_path = (char*)malloc(strlen(cmd->data.str)+1);
strcpy(sbox_config.php_path,cmd->data.str);
return NULL;
}
DOTCONF_CB(cb_python_path){
sbox_config.python_path = (char*)malloc(strlen(cmd->data.str)+1);
strcpy(sbox_config.python_path,cmd->data.str);
return NULL;
}
DOTCONF_CB(cb_perl_path){
sbox_config.perl_path = (char*)malloc(strlen(cmd->data.str)+1);
strcpy(sbox_config.perl_path,cmd->data.str);
return NULL;
}
DOTCONF_CB(cb_ruby_path){
sbox_config.ruby_path = (char*)malloc(strlen(cmd->data.str)+1);
strcpy(sbox_config.ruby_path,cmd->data.str);
return NULL;
}
void read_config_file(char* sboxconf_path){
configfile_t *configfile;
configfile = dotconf_create(sboxconf_path, options, 0, CASE_INSENSITIVE);
if (dotconf_command_loop(configfile) == 0){
fprintf(stderr, "Error reading config file\n");
exit(2);
}
dotconf_cleanup(configfile);
return;
}
// Maxmimum string size for an environment name or value:
#define MAXENV 1024
// Get the HTTP_HOST environment variable value
// Returns NULL if not found
char* get_http_host(char** e){
char *name,*delimiter;
static char envvar_name[MAXENV+2]; // Stores the current env var name, make sure it's big enough by adding 2 safety chars
while ((name = *e++)) {
delimiter = (char*) strchr(name,'=');
if (delimiter == NULL) continue; // If we don't find the "=" delimiter, then we didn't find anything...
if (delimiter - name >= MAXENV) continue; // If our envvar name is too big, then it's as if we didn't find anything
if (strlen(delimiter) > MAXENV) continue;
strncpy(envvar_name,name,delimiter-name); // Copy the envvar name in a buffer, to check for it later
envvar_name[delimiter-name]='\0'; // Make sure it terminates by a delimiting zero
delimiter++; // Point just right after the = sign
if( strcmp(envvar_name,"HTTP_HOST") == 0){ // Have we found the HTTP_HOST?
// log_error("%s => %s\n",envvar_name,delimiter); // Log the HTTP_HOST in our sbox.log
return delimiter;
}
}
return NULL;
}
// Debug function to print the environment values in the sbox.log
// Do not activate all the time, as its printing quite some stuff,
// and flooding a logfile is never a good idea.
void print_the_env(char** e){
char *name,*delimiter;
static char nm[MAXENV+2];
while ((name = *e++)) {
delimiter = (char*) strchr(name,'=');
if (delimiter == NULL) continue;
if (delimiter - name >= MAXENV) continue;
if (strlen(delimiter) > MAXENV) continue;
strncpy(nm,name,delimiter-name);
nm[delimiter-name]='\0';
log_error("%s => %s\n",nm,++delimiter);
}
}
int isToggleValueOn(char* t){
if( strcmp(t,"On") == 0 || strcmp(t,"on") == 0 || strcmp(t,"1") == 0 || strcmp(t,"ON") == 0)
return 1;
else
return 0;
}
// This function will read the environment variables of
// Apache, so that you can eventually set the configuration
// of SBOX in it in order to overwrite what is in /etc/sbox.conf
//
// This gives the additional functionality to be able to have
// specific values depending on which vhost you run.
//
// For example, in your apache config file, you can do:
// SetEnv SBOX_DTC_CONF_web_user 100
// in order to overwrite the "web_user" value.
// Of course, you will need the "mod_env" apache module to do that.
void readEnvSboxConfig(char** e){
char *name,*delimiter;
static char nm[MAXENV];
while ((name = *e++)) {
delimiter = (char*) strchr(name,'=');
if (delimiter == 0) continue;
if (delimiter - name >= MAXENV) continue;
if (strlen(delimiter) > MAXENV) continue;
strncpy(nm,name,delimiter-name);
nm[delimiter-name]='\0';
delimiter++;
if( strcmp(nm,"SBOX_DTC_CONF_web_user") == 0) sbox_config.web_user = delimiter;
if( strcmp(nm,"SBOX_DTC_CONF_web_group") == 0) sbox_config.web_group = delimiter;
if( strcmp(nm,"SBOX_DTC_CONF_allow_web_owned_scripts") == 0) sbox_config.allow_web_owned_scripts = isToggleValueOn(delimiter);
if( strcmp(nm,"SBOX_DTC_CONF_uid_min") == 0) sbox_config.uid_min = atoi(delimiter);
if( strcmp(nm,"SBOX_DTC_CONF_uid_max") == 0) sbox_config.uid_max = atoi(delimiter);
if( strcmp(nm,"SBOX_DTC_CONF_gid_min") == 0) sbox_config.gid_min = atoi(delimiter);
if( strcmp(nm,"SBOX_DTC_CONF_gid_max") == 0) sbox_config.gid_max = atoi(delimiter);
if( strcmp(nm,"SBOX_DTC_CONF_sid_mode_directory") == 0) sbox_config.sid_mode_directory = isToggleValueOn(delimiter);
if( strcmp(nm,"SBOX_DTC_CONF_use_safe_path") == 0) sbox_config.use_safe_path = isToggleValueOn(delimiter);
if( strcmp(nm,"SBOX_DTC_CONF_safe_path") == 0) sbox_config.safe_path = delimiter;
if( strcmp(nm,"SBOX_DTC_CONF_log_file") == 0) sbox_config.log_file = delimiter;
if( strcmp(nm,"SBOX_DTC_CONF_do_log_envvars") == 0) sbox_config.do_log_envvars = isToggleValueOn(delimiter);
if( strcmp(nm,"SBOX_DTC_CONF_echo_failures") == 0) sbox_config.echo_failures = isToggleValueOn(delimiter);
if( strcmp(nm,"SBOX_DTC_CONF_do_chroot") == 0) sbox_config.do_chroot = isToggleValueOn(delimiter);
if( strcmp(nm,"SBOX_DTC_CONF_root") == 0) sbox_config.root = delimiter;
if( strcmp(nm,"SBOX_DTC_CONF_cgi_bin") == 0) sbox_config.cgi_bin = delimiter;
if( strcmp(nm,"SBOX_DTC_CONF_do_suid") == 0) sbox_config.do_suid = isToggleValueOn(delimiter);
if( strcmp(nm,"SBOX_DTC_CONF_do_sgid") == 0) sbox_config.do_sgid = isToggleValueOn(delimiter);
if( strcmp(nm,"SBOX_DTC_CONF_set_limits") == 0) sbox_config.set_limits = isToggleValueOn(delimiter);
if( strcmp(nm,"SBOX_DTC_CONF_priority") == 0) sbox_config.priority = atoi(delimiter);
if( strcmp(nm,"SBOX_DTC_CONF_limit_cpu_hard") == 0) sbox_config.limit_cpu_hard = atol(delimiter);
if( strcmp(nm,"SBOX_DTC_CONF_limit_cpu_soft") == 0) sbox_config.limit_cpu_soft = atol(delimiter);
if( strcmp(nm,"SBOX_DTC_CONF_limit_fsize_hard") == 0) sbox_config.limit_fsize_hard = 1024*atol(delimiter);
if( strcmp(nm,"SBOX_DTC_CONF_limit_fsize_soft") == 0) sbox_config.limit_fsize_soft = 1024*atol(delimiter);
if( strcmp(nm,"SBOX_DTC_CONF_limit_data_hard") == 0) sbox_config.limit_data_hard = 1024*atol(delimiter);
if( strcmp(nm,"SBOX_DTC_CONF_limit_data_soft") == 0) sbox_config.limit_data_soft = 1024*atol(delimiter);
if( strcmp(nm,"SBOX_DTC_CONF_stack_hard") == 0) sbox_config.limit_stack_hard = 1024*atol(delimiter);
if( strcmp(nm,"SBOX_DTC_CONF_limit_stack_soft") == 0) sbox_config.limit_stack_soft = 1024*atol(delimiter);
if( strcmp(nm,"SBOX_DTC_CONF_limit_core_hard") == 0) sbox_config.limit_core_hard = 1024*atol(delimiter);
if( strcmp(nm,"SBOX_DTC_CONF_limit_core_soft") == 0) sbox_config.limit_core_soft = 1024*atol(delimiter);
if( strcmp(nm,"SBOX_DTC_CONF_limit_rss_hard") == 0) sbox_config.limit_rss_hard = 1024*atol(delimiter);
if( strcmp(nm,"SBOX_DTC_CONF_limit_rss_soft") == 0) sbox_config.limit_rss_soft = 1024*atol(delimiter);
if( strcmp(nm,"SBOX_DTC_CONF_limit_nproc_hard") == 0) sbox_config.limit_nproc_hard = atol(delimiter);
if( strcmp(nm,"SBOX_DTC_CONF_limit_nproc_soft") == 0) sbox_config.limit_nproc_soft = atol(delimiter);
if( strcmp(nm,"SBOX_DTC_CONF_limit_nofile_hard") == 0) sbox_config.limit_nofile_hard = atol(delimiter);
if( strcmp(nm,"SBOX_DTC_CONF_limit_nofile_soft") == 0) sbox_config.limit_nofile_soft = atol(delimiter);
}
}
/***************** START OF CODE ****************/
char* getFileExtension(char* file){
int len,i;
len = strlen(file);
for(i=len-1 ; i>0 ; --i){
if( file[i] == '.'){
return &file[i];
}
}
return 0;
}
#define HOST_CONF_FILE_FOLDER "/etc/sbox/vhosts.d/"
int main (int argc, char* argv[], char** e) {
struct stat target_stat,dir_stat;
char *target,*newroot,*root,*additional_info,*cmd,*new_cmd_interp;
int gid,uid,i,return_int;
char* my_http_host;
char* ext;
struct stat stat_buffer;
char* http_host_config_file_path;
int conf_file_path_string_size;
char realpath_path[MAXPATHLEN+2];
char* dirname_path;
char* dirname_path2;
FILE* fp;
////////////////////////// GET THE PATH OF THE SBOX CONFIG DEPENDING ON THE HTTP_HOST ENV VAR //////////////////////////
//sbox_config.log_file = "/var/log/sbox.log";
//open_log();
//log_error("Testing log\n");
my_http_host = get_http_host(e); // Get the current vhost name
if(my_http_host == NULL){
sbox_config.log_file = "/var/log/sbox.log";
open_log();
log_error("HTTP_HOST environment variable not found: exiting.\n");
exit(1);
}
if(strlen(my_http_host) > 1024){
sbox_config.log_file = "/var/log/sbox.log";
open_log();
log_error("HTTP_HOST environment variable too big: exiting.\n");
exit(1);
}
conf_file_path_string_size = strlen(HOST_CONF_FILE_FOLDER) + strlen(my_http_host) + 2;
http_host_config_file_path = malloc(conf_file_path_string_size);
if(http_host_config_file_path == NULL){
sbox_config.log_file = "/var/log/sbox.log";
open_log();
log_error("Could not alloc space for storing HTTP_HOST: exiting.\n");
exit(1);
}
strcpy(http_host_config_file_path,HOST_CONF_FILE_FOLDER);
strcat(http_host_config_file_path,my_http_host);
// log_error("Concat file is: \"%s\"\n",http_host_config_file_path);
if(!realpath(http_host_config_file_path,realpath_path)){
// If not resolved, open the default config file
//log_error("realpath returned NULL: opening default /etc/sbox/sbox.conf\n");
read_config_file("/etc/sbox/sbox.conf");
}else{
// If resolved, then there may be a vhost specific file that can be opened!
log_error("Realpath is: %s\n",realpath_path);
dirname_path = strdup(realpath_path);
dirname_path2 = dirname(dirname_path);
//log_error("dirname_path2 is: %s\n",dirname_path2);
strcat(dirname_path2,"/");
if( strcmp(dirname_path,HOST_CONF_FILE_FOLDER) != 0 ){
sbox_config.log_file = "/var/log/sbox.log";
open_log();
log_error("Directory traversal attempt: exiting.\n");
exit(1);
}
// Get to know if the file exists, if it does use it as config file, if not use /etc/sbox/sbox.conf
fp = fopen(realpath_path,"r");
if(fp == NULL){
//log_error("File %s doesn't exist or can't be read, using /etc/sbox/sbox.conf",realpath_path);
read_config_file("/etc/sbox/sbox.conf");
}else{
//log_error("File exist: using %s\n",realpath_path);
fclose(fp);
read_config_file(realpath_path);
}
}
// Used for debug purpose: do ont use in production, as this is very easy
// to hack a change in the environment of Apache
// readEnvSboxConfig(e);
#if defined(DEBUG)
printf("Web user: %s\n",sbox_config.web_user);
printf("Web group: %s\n",sbox_config.web_group);
printf("do_suid: %d\n",sbox_config.do_suid);
printf("do_guid: %d\n",sbox_config.do_sgid);
printf("uid_min: %d\n",sbox_config.uid_min);
printf("uid_max: %d\n",sbox_config.uid_max);
printf("gid_min: %d\n",sbox_config.gid_min);
printf("gid_max: %d\n",sbox_config.gid_max);
printf("sid_mode_directory: %d\n",sbox_config.sid_mode_directory);
printf("echo_failures: %d\n",sbox_config.echo_failures);
printf("do_chroot: %d\n",sbox_config.do_chroot);
printf("safe_path: %s\n",sbox_config.safe_path);
printf("safe_path_switch: %d\n",sbox_config.safe_path_switch);
printf("log_file: %s\n",sbox_config.log_file);
printf("root: %s\n",sbox_config.root);
printf("cgi_bin: %s\n",sbox_config.cgi_bin);
printf("set_limits: %d\n",sbox_config.set_limits);
printf("priority: %d\n",sbox_config.priority);
printf("limit_cpu_hard: %ld\n",sbox_config.limit_cpu_hard);
printf("limit_cpu_soft: %ld\n",sbox_config.limit_cpu_soft);
printf("limit_fsize_hard: %ld\n",sbox_config.limit_fsize_hard);
printf("limit_fsize_soft: %ld\n",sbox_config.limit_fsize_soft);
printf("limit_data_hard: %ld\n",sbox_config.limit_data_hard);
printf("limit_data_soft: %ld\n",sbox_config.limit_data_soft);
printf("limit_stack_hard: %ld\n",sbox_config.limit_stack_hard);
printf("limit_stack_soft: %ld\n",sbox_config.limit_stack_soft);
printf("limit_core_hard: %ld\n",sbox_config.limit_core_hard);
printf("limit_core_soft: %ld\n",sbox_config.limit_core_soft);
printf("limit_rss_hard: %ld\n",sbox_config.limit_rss_hard);
printf("limit_rss_soft: %ld\n",sbox_config.limit_rss_soft);
printf("limit_nproc_hard: %d\n",sbox_config.limit_nproc_hard);
printf("limit_nproc_soft: %d\n",sbox_config.limit_nproc_soft);
printf("limit_nofile_hard: %d\n",sbox_config.limit_nofile_hard);
printf("limit_nofile_soft: %d\n",sbox_config.limit_nofile_soft);
#endif
open_log();
if(sbox_config.do_log_envvars){
print_the_env(e);
}
check_consistency();
/* figure out the base of the user's HTML document tree */
root = document_root();
/* resolve the additional path information correctly */
target = fetch_target(root,&additional_info,&target_stat,&dir_stat);
if(sbox_config.do_chroot){
/* find the absolute path name of the root */
to_abs(root);
/* calculate the new root for chroot*/
newroot = fetch_newroot(root);
}
/* check that the target is OK */
check_target(newroot,target,&target_stat,&dir_stat);
if(sbox_config.do_chroot){
/* fix the environment */
tweak_environment(newroot,root,target,additional_info);
#if !defined(DEBUG)
/* change to the owner's root */
if (chroot(newroot) < 0)
fatal_error("couldn't chroot to %s (%s)\n",escape(newroot),strerror(errno));
#endif
}
#if defined(DEBUG)
cmd = target;
#else
if(sbox_config.do_chroot){
cmd = shave(newroot,target);
}else{
cmd = target;
}
#endif
clean_env();
/* set hard and soft limits on resource usage */
/* important to do this after log is closed because otherwise the log file
size will be restricted by the LIMIT_FSIZE_SOFT value */
if(sbox_config.set_limits)
set_limits();
/* set to the owner's uid and gid */
if(sbox_config.do_suid || sbox_config.do_sgid){
gid = sbox_config.sid_mode_directory == 1 ? dir_stat.st_gid : target_stat.st_gid;
uid = sbox_config.sid_mode_directory == 1 ? dir_stat.st_uid : target_stat.st_uid;
#if defined(DEBUG)
if (setgid(getgid()) < 0) {
fatal_error("couldn't setgid() to %d (%s)\n",getgid(),strerror(errno));
}
#else
if(sbox_config.do_sgid){
if (setgid(gid) < 0) {
fatal_error("couldn't setgid() to %d (%s)\n",dir_stat.st_gid,strerror(errno));
}
}else{
/* give up our sgid privileges if any*/
if (setgid(getgid()) < 0) {
fatal_error("couldn't setgid() to %d (%s)\n",getgid(),strerror(errno));
}
}
#endif
#if !defined(DEBUG)
if(sbox_config.do_suid){
if (setuid(uid) < 0) {
fatal_error("couldn't setuid() to %d (%s)\n",dir_stat.st_uid,strerror(errno));
}
}
#endif
}
/* give up our root privileges now */
if (setuid(getuid()) < 0) {
fatal_error("couldn't setuid() to %d (%s)\n",getuid(),strerror(errno));
}
/* fix up argv[] array and command depending on the extension */
ext = getFileExtension(cmd);
if(ext == 0){
new_cmd_interp = cmd;
argv[0] = cmd;
if(strlen(sbox_config.log_file) > 0){
log_error("No extension found: starting as CGI: executing %s for uid %d, gid %d\n",target,getuid(),getgid());
}
}else{
if( strcmp(ext,".php") == 0){
new_cmd_interp = sbox_config.php_path;
}else if(strcmp(ext,".py") == 0){
new_cmd_interp = sbox_config.python_path;
}else if(strcmp(ext,".pl") == 0){
new_cmd_interp = sbox_config.perl_path;
}else if(strcmp(ext,".rb") == 0){
new_cmd_interp = sbox_config.ruby_path;
}else{
log_error("Extension not recognised: will exit here!\n");
return -1;
}
argv[0] = new_cmd_interp;
argv[1] = cmd;
log_error("Found %s for %s: %s %s (%s for uid %d and gid %d)\n",ext,target,new_cmd_interp,argv[1],cleanenv[0],getuid(),getgid());
}
/* chdir() to new directory */
chdir_fix(newroot,target);
if(strlen(sbox_config.log_file) > 0 && ext == 0){
log_error("Going to try this: %s , %s, %s\n", new_cmd_interp, argv[1], cleanenv[0]);
}
/* close log file so we don't leak file descriptor */
if (log && log != stderr) {
fp = log; log = NULL;
fclose(fp);
}
/* execute the target */
return_int = execve(new_cmd_interp,argv,cleanenv);
/* if we get here, then something went wrong -- we won't be able to
reopen the log file because we've given up privileges, logging
to stderr causes an Apache "Premature end of script" error because
it's expecting a Content-Type header, so disable logging via
write_log entirely by setting log to NULL. */
log = NULL;
fatal_error("exec of %s failed (%s)\n",escape(new_cmd_interp),strerror(errno));
return -1;
}
/* Will error out if one of the consistency checks fails. */
void check_consistency() {
struct passwd *pass;
struct group *grp;
int uid,gid;
#if !defined(DEBUG)
/* get our group and user ids */
uid = getuid();
if ((pass = getpwuid(uid)) == NULL)
fatal_error("invalid uid: (%ld)\n", uid);
gid = getgid();
if ((grp = getgrgid(gid)) == NULL)
fatal_error("invalid gid: (%ld)\n", gid);
/* exit if either the uid or gid are zero */
if (uid == 0)
fatal_error("cannot be run as root\n");
if (gid == 0)
fatal_error("cannot be run as the root group\n");
/* Make sure that we were invoked by the Web user and group */
if (strcmp(sbox_config.web_user,pass->pw_name))
fatal_error("invoked by %s, but must be run by %s\n",escape(pass->pw_name),escape(sbox_config.web_user));
if (strcmp(sbox_config.web_group,grp->gr_name))
fatal_error("invoked by group %s, but must be run by group %s\n",escape(grp->gr_name),escape(sbox_config.web_group));
#endif
}
void open_log () {
if (strlen(sbox_config.log_file) > 0) {
if ((log = fopen(sbox_config.log_file, "a")) == NULL) {
fprintf(stderr, "sbox failed to open log file. Falling back to stderr.\n");
log = stderr;
}
} else {
log = stderr;
}
// log = NULL;
}
static void write_log(const char* fmt, va_list ap) {
time_t timevar;
char* timestr;
if (log == NULL) return;
timevar = time(NULL);
timestr = ctime(&timevar);
timestr[strlen(timestr)-1]='\0';
fprintf(log,"[%s] sbox[%d]: ",timestr,getpid());
vfprintf(log, fmt, ap);
fflush(log);
return;
}
void log_error(const char* fmt, ...) {
va_list ap;
va_start(ap, fmt);
write_log(fmt,ap);
va_end(ap);
}
void fatal_error(const char* fmt, ...) {
va_list ap;
char* webmaster;
va_start(ap, fmt);
write_log(fmt,ap);
if(sbox_config.echo_failures){
webmaster = (char*)getenv("SERVER_ADMIN");
fprintf(stdout,"Content-type: text/html\n\n");
fprintf(stdout,webmaster ? "%s (%s).": "%s",
CANNED_ERROR_TOP,webmaster,webmaster);
fprintf(stdout,"