isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Don't expose the implementation of the pivot_root state.

Browse Source
This commit is contained in:
Todd C. Miller
2023-09-11 16:15:41 -06:00
parent 4117ad1462
commit 0b52ffd1a2
7 changed files with 91 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files

55
plugins/sudoers/pivot.c
View File

@@ -29,29 +29,26 @@
#include "sudoers.h"
#define OLD_ROOT 0
#define OLD_CWD 1
/*
* Pivot to a new root directory, storing the old root and old cwd
* in fds[2]. Changes current working directory to the new root.
* in state. Changes current working directory to the new root.
* Returns true on success, else false.
*/
bool
pivot_root(const char *new_root, int fds[2])
pivot_root(const char *new_root, sudoers_pivot_t state)
{
debug_decl(pivot_root, SUDOERS_DEBUG_UTIL);
fds[OLD_ROOT] = open("/", O_RDONLY);
fds[OLD_CWD] = open(".", O_RDONLY);
if (fds[OLD_ROOT] == -1 || fds[OLD_CWD] == -1 || chroot(new_root) == -1) {
if (fds[OLD_ROOT] != -1) {
close(fds[OLD_ROOT]);
fds[OLD_ROOT] = -1;
state.saved_root = open("/", O_RDONLY);
state.saved_cwd = open(".", O_RDONLY);
if (state.saved_root == -1 || state.saved_cwd == -1 || chroot(new_root) == -1) {
if (state.saved_root != -1) {
close(state.saved_root);
state.saved_root = -1;
}
if (fds[OLD_CWD] != -1) {
close(fds[OLD_CWD]);
fds[OLD_CWD] = -1;
if (state.saved_cwd != -1) {
close(state.saved_cwd);
state.saved_cwd = -1;
}
debug_return_bool(false);
}
@@ -63,28 +60,40 @@ pivot_root(const char *new_root, int fds[2])
* Returns true on success, else false.
*/
bool
unpivot_root(int fds[2])
unpivot_root(sudoers_pivot_t state)
{
bool ret = true;
debug_decl(unpivot_root, SUDOERS_DEBUG_UTIL);
/* Order is important: restore old root, *then* change cwd. */
if (fds[OLD_ROOT] != -1) {
if (fchdir(fds[OLD_ROOT]) == -1 || chroot(".") == -1) {
if (state.saved_root != -1) {
if (fchdir(state.saved_root) == -1 || chroot(".") == -1) {
sudo_warn("%s", U_("unable to restore root directory"));
ret = false;
}
close(fds[OLD_ROOT]);
fds[OLD_ROOT] = -1;
close(state.saved_root);
state.saved_root = -1;
}
if (fds[OLD_CWD] != -1) {
if (fchdir(fds[OLD_CWD]) == -1) {
if (state.saved_cwd != -1) {
if (fchdir(state.saved_cwd) == -1) {
sudo_warn("%s", U_("unable to restore current working directory"));
ret = false;
}
close(fds[OLD_CWD]);
fds[OLD_CWD] = -1;
close(state.saved_cwd);
state.saved_cwd = -1;
}
debug_return_bool(ret);
}
int
pivot_get_root(sudoers_pivot_t state)
{
return state.saved_root;
}
int
pivot_get_cwd(sudoers_pivot_t state)
{
return state.saved_cwd;
}