Unverified Commit 7c035dbb authored by Linus Heckemann's avatar Linus Heckemann Committed by GitHub
Browse files

Merge pull request #156822 from xfix/wrapper-assert-argc-at-least-one 

nixos/wrappers: require argc to be at least one
parents 0659e76d 2a6a3d2c

nixos/modules/security/wrappers/wrapper.c

+21 −17
Original line number Diff line number Diff line
@@ -2,12 +2,12 @@ 
#include <stdio.h>

#include <string.h>

#include <unistd.h>

#include <stdnoreturn.h>

#include <sys/types.h>

#include <sys/stat.h>

#include <sys/xattr.h>

#include <fcntl.h>

#include <dirent.h>

#include <assert.h>

#include <errno.h>

#include <linux/capability.h>

#include <sys/prctl.h>
@@ -16,10 +16,7 @@ 
#include <syscall.h>

#include <byteswap.h>



// Make sure assertions are not compiled out, we use them to codify

// invariants about this program and we want it to fail fast and

// loudly if they are violated.

#undef NDEBUG

#define ASSERT(expr) ((expr) ? (void) 0 : assert_failure(#expr))



extern char **environ;
@@ -38,6 +35,12 @@ static char *wrapper_debug = "WRAPPER_DEBUG"; 
#define LE32_TO_H(x) (x)

#endif



static noreturn void assert_failure(const char *assertion) {

    fprintf(stderr, "Assertion `%s` in NixOS's wrapper.c failed.\n", assertion);

    fflush(stderr);

    abort();

}



int get_last_cap(unsigned *last_cap) {

    FILE* file = fopen("/proc/sys/kernel/cap_last_cap", "r");

    if (file == NULL) {
@@ -167,6 +170,7 @@ int readlink_malloc(const char *p, char **ret) { 
}



int main(int argc, char **argv) {

    ASSERT(argc >= 1);

    char *self_path = NULL;

    int self_path_size = readlink_malloc("/proc/self/exe", &self_path);

    if (self_path_size < 0) {
@@ -181,36 +185,36 @@ int main(int argc, char **argv) { 
    int len = strlen(wrapper_dir);

    if (len > 0 && '/' == wrapper_dir[len - 1])

      --len;

    assert(!strncmp(self_path, wrapper_dir, len));

    assert('/' == wrapper_dir[0]);

    assert('/' == self_path[len]);

    ASSERT(!strncmp(self_path, wrapper_dir, len));

    ASSERT('/' == wrapper_dir[0]);

    ASSERT('/' == self_path[len]);



    // Make *really* *really* sure that we were executed as

    // `self_path', and not, say, as some other setuid program. That

    // is, our effective uid/gid should match the uid/gid of

    // `self_path'.

    struct stat st;

    assert(lstat(self_path, &st) != -1);

    ASSERT(lstat(self_path, &st) != -1);



    assert(!(st.st_mode & S_ISUID) || (st.st_uid == geteuid()));

    assert(!(st.st_mode & S_ISGID) || (st.st_gid == getegid()));

    ASSERT(!(st.st_mode & S_ISUID) || (st.st_uid == geteuid()));

    ASSERT(!(st.st_mode & S_ISGID) || (st.st_gid == getegid()));



    // And, of course, we shouldn't be writable.

    assert(!(st.st_mode & (S_IWGRP | S_IWOTH)));

    ASSERT(!(st.st_mode & (S_IWGRP | S_IWOTH)));



    // Read the path of the real (wrapped) program from <self>.real.

    char real_fn[PATH_MAX + 10];

    int real_fn_size = snprintf(real_fn, sizeof(real_fn), "%s.real", self_path);

    assert(real_fn_size < sizeof(real_fn));

    ASSERT(real_fn_size < sizeof(real_fn));



    int fd_self = open(real_fn, O_RDONLY);

    assert(fd_self != -1);

    ASSERT(fd_self != -1);



    char source_prog[PATH_MAX];

    len = read(fd_self, source_prog, PATH_MAX);

    assert(len != -1);

    assert(len < sizeof(source_prog));

    assert(len > 0);

    ASSERT(len != -1);

    ASSERT(len < sizeof(source_prog));

    ASSERT(len > 0);

    source_prog[len] = 0;



    close(fd_self);